Latest update (add quic)

.gitignore

@@ -2,7 +2,7 @@
 /.dir-locals.el
 
 # Top level excludes
-/Makefile.orig
+/Makefile
 /MINFO
 /TABLE
 /*.pc
@@ -13,11 +13,6 @@
 /tmp.*
 /configdata.pm
 
-# *all* Makefiles
-Makefile
-# ... except in demos
-!/demos/*/Makefile
-
 # Links under apps
 /apps/CA.pl
 /apps/tsget
@@ -26,10 +21,12 @@ Makefile
 
 # Auto generated headers
 /crypto/buildinf.h
-/apps/progs.h
-/crypto/include/internal/*_conf.h
-/openssl/include/opensslconf.h
-/util/domd
+/include/crypto/*_conf.h
+/include/openssl/configuration.h
+/include/openssl/opensslv.h
+
+# Auto generated doc files
+doc/man1/openssl-*.pod
 
 # error code files
 /crypto/err/openssl.txt.old
@@ -57,10 +54,18 @@ Makefile
 /test/ssltest_old
 /test/x509aux
 /test/v3ext
+/test/versions
 /test/ossl_shim/ossl_shim
+/test/rsa_complex
+/test/confdump
+/test/bio_prefix_text
+# Other generated files in test/
+/test/provider_internal_test.cnf
+/test/fipsinstall.cnf
+/providers/fipsinstall.cnf
 
 # Certain files that get created by tests on the fly
-/test/test-runs
+/test-runs
 /test/buildtest_*
 
 # Fuzz stuff.
@@ -74,14 +79,16 @@ Makefile
 !/fuzz/*.*
 
 # Misc auto generated files
-/include/openssl/opensslconf.h
+/doc/man7/openssl_user_macros.pod
 /tools/c_rehash
 /tools/c_rehash.pl
 /util/shlib_wrap.sh
 /tags
 /TAGS
-/libcrypto.map
-/libssl.map
+*.map
+*.ld
+/apps/progs.c
+/apps/progs.h
 
 # Windows (legacy)
 /tmp32
@@ -94,7 +101,6 @@ Makefile
 /out32dll.dbg
 /inc32
 /MINFO
-/ms/.rnd
 /ms/bcb.mak
 /ms/libeay32.def
 /ms/nt.mak
@@ -128,6 +134,10 @@ Makefile
 /test/fips_test_suite.c
 /test/shatest.c
 
+# Generated docs directories
+/doc/html
+/doc/man
+
 ##### Generic patterns
 # Auto generated assembly language source files
 *.s
@@ -176,6 +186,7 @@ Makefile.save
 *.bak
 cscope.*
 *.d
+*.d.tmp
 pod2htmd.tmp
 
 # Windows manifest files

ACKNOWLEDGEMENTS

@@ -1,2 +0,0 @@
-Please https://www.openssl.org/community/thanks.html for the current
-acknowledgements.

ACKNOWLEDGEMENTS.md

@@ -0,0 +1,7 @@
+Acknowlegements
+===============
+
+Please see our [Thanks!][] page for the current acknowledgements.
+
+[Thanks!]: https://www.openssl.org/community/thanks.html
+

AUTHORS

@@ -1,35 +0,0 @@
-# This is the list of OpenSSL authors for copyright purposes.
-#
-# This does not necessarily list everyone who has contributed code, since in
-# some cases, their employer may be the copyright holder.  To see the full list
-# of contributors, see the revision history in source control.
-OpenSSL Software Services, Inc.
-OpenSSL Software Foundation, Inc.
-
-# Individuals
-Andy Polyakov
-Ben Laurie
-Ben Kaduk
-Bernd Edlinger
-Bodo Möller
-David Benjamin
-Emilia Käsper
-Eric Young
-Geoff Thorpe
-Holger Reif
-Kurt Roeckx
-Lutz Jänicke
-Mark J. Cox
-Matt Caswell
-Matthias St. Pierre
-Nils Larsch
-Paul Dale
-Paul C. Sutton
-Ralf S. Engelschall
-Rich Salz
-Richard Levitte
-Stephen Henson
-Steve Marquess
-Tim Hudson
-Ulf Möller
-Viktor Dukhovni

AUTHORS.md

@@ -0,0 +1,44 @@
+Authors
+=======
+
+This is the list of OpenSSL authors for copyright purposes.
+It does not necessarily list everyone who has contributed code,
+since in some cases, their employer may be the copyright holder.
+To see the full list of contributors, see the revision history in
+source control.
+
+Groups
+------
+
+ * OpenSSL Software Services, Inc.
+ * OpenSSL Software Foundation, Inc.
+
+Individuals
+-----------
+
+ * Andy Polyakov
+ * Ben Laurie
+ * Ben Kaduk
+ * Bernd Edlinger
+ * Bodo Möller
+ * David Benjamin
+ * Emilia Käsper
+ * Eric Young
+ * Geoff Thorpe
+ * Holger Reif
+ * Kurt Roeckx
+ * Lutz Jänicke
+ * Mark J. Cox
+ * Matt Caswell
+ * Matthias St. Pierre
+ * Nils Larsch
+ * Paul Dale
+ * Paul C. Sutton
+ * Ralf S. Engelschall
+ * Rich Salz
+ * Richard Levitte
+ * Stephen Henson
+ * Steve Marquess
+ * Tim Hudson
+ * Ulf Möller
+ * Viktor Dukhovni

CONTRIBUTING

@@ -1,72 +0,0 @@
-HOW TO CONTRIBUTE TO OpenSSL
-----------------------------
-
-(Please visit https://www.openssl.org/community/getting-started.html for
-other ideas about how to contribute.)
-
-Development is done on GitHub, https://github.com/openssl/openssl.
-
-To request new features or report bugs, please open an issue on GitHub
-
-To submit a patch, please open a pull request on GitHub.  If you are thinking
-of making a large contribution, open an issue for it before starting work,
-to get comments from the community.  Someone may be already working on
-the same thing or there may be reasons why that feature isn't implemented.
-
-To make it easier to review and accept your pull request, please follow these
-guidelines:
-
-    1. Anything other than a trivial contribution requires a Contributor
-    License Agreement (CLA), giving us permission to use your code. See
-    https://www.openssl.org/policies/cla.html for details.  If your
-    contribution is too small to require a CLA, put "CLA: trivial" on a
-    line by itself in your commit message body.
-
-    2.  All source files should start with the following text (with
-    appropriate comment characters at the start of each line and the
-    year(s) updated):
-
-        Copyright 20xx-20yy The OpenSSL Project Authors. All Rights Reserved.
-
-        Licensed under the OpenSSL license (the "License").  You may not use
-        this file except in compliance with the License.  You can obtain a copy
-        in the file LICENSE in the source distribution or at
-        https://www.openssl.org/source/license.html
-
-    3.  Patches should be as current as possible; expect to have to rebase
-    often. We do not accept merge commits, you will have to remove them
-    (usually by rebasing) before it will be acceptable.
-
-    4.  Patches should follow our coding style (see
-    https://www.openssl.org/policies/codingstyle.html) and compile
-    without warnings. Where gcc or clang is available you should use the
-    --strict-warnings Configure option.  OpenSSL compiles on many varied
-    platforms: try to ensure you only use portable features.  Clean builds
-    via Travis and AppVeyor are required, and they are started automatically
-    whenever a PR is created or updated.
-
-    5.  When at all possible, patches should include tests. These can
-    either be added to an existing test, or completely new.  Please see
-    test/README for information on the test framework.
-
-    6.  New features or changed functionality must include
-    documentation. Please look at the "pod" files in doc/man[1357] for
-    examples of our style. Run "make doc-nits" to make sure that your
-    documentation changes are clean.
-
-    7.  For user visible changes (API changes, behaviour changes, ...),
-    consider adding a note in CHANGES.  This could be a summarising
-    description of the change, and could explain the grander details.
-    Have a look through existing entries for inspiration. 
-    Please note that this is NOT simply a copy of git-log oneliners.
-    Also note that security fixes get an entry in CHANGES.
-    This file helps users get more in depth information of what comes
-    with a specific release without having to sift through the higher
-    noise ratio in git-log.
-
-    8.  For larger or more important user visible changes, as well as
-    security fixes, please add a line in NEWS.  On exception, it might be
-    worth adding a multi-line entry (such as the entry that announces all
-    the types that became opaque with OpenSSL 1.1.0).
-    This file helps users get a very quick summary of what comes with a
-    specific release, to see if an upgrade is worth the effort.

CONTRIBUTING.md

@@ -0,0 +1,91 @@
+HOW TO CONTRIBUTE TO OpenSSL
+============================
+
+Please visit our [Getting Started][gs] page for other ideas about how to contribute.
+
+  [gs]: https://www.openssl.org/community/getting-started.html
+
+Development is done on GitHub in the [openssl/openssl][gh] repository.
+
+  [gh]: https://github.com/openssl/openssl
+
+To request new features or report bugs, please open an issue on GitHub
+
+To submit a patch, please open a pull request on GitHub.  If you are thinking
+of making a large contribution, open an issue for it before starting work,
+to get comments from the community.  Someone may be already working on
+the same thing or there may be reasons why that feature isn't implemented.
+
+To make it easier to review and accept your pull request, please follow these
+guidelines:
+
+ 1. Anything other than a trivial contribution requires a [Contributor
+    License Agreement][CLA] (CLA), giving us permission to use your code.
+    If your contribution is too small to require a CLA (e.g. fixing a spelling
+    mistake), place the text "`CLA: trivial`" on a line by itself separated by
+    an empty line from the rest of the commit message. It is not sufficient to
+    only place the text in the GitHub pull request description.
+
+    [CLA]: https://www.openssl.org/policies/cla.html
+
+    To amend a missing "`CLA: trivial`" line after submission, do the following:
+
+    ```
+        git commit --amend
+        [add the line, save and quit the editor]
+        git push -f
+    ```
+
+ 2. All source files should start with the following text (with
+    appropriate comment characters at the start of each line and the
+    year(s) updated):
+
+    ```
+        Copyright 20xx-20yy The OpenSSL Project Authors. All Rights Reserved.
+
+        Licensed under the Apache License 2.0 (the "License").  You may not use
+        this file except in compliance with the License.  You can obtain a copy
+        in the file LICENSE in the source distribution or at
+        https://www.openssl.org/source/license.html
+    ```
+
+ 3. Patches should be as current as possible; expect to have to rebase
+    often. We do not accept merge commits, you will have to remove them
+    (usually by rebasing) before it will be acceptable.
+
+ 4. Patches should follow our [coding style][] and compile without warnings.
+    Where gcc or clang is available you should use the
+    --strict-warnings Configure option.  OpenSSL compiles on many varied
+    platforms: try to ensure you only use portable features.  Clean builds
+    via Travis and AppVeyor are required, and they are started automatically
+    whenever a PR is created or updated.
+
+    [coding style]: https://www.openssl.org/policies/codingstyle.html
+
+ 5. When at all possible, patches should include tests. These can
+    either be added to an existing test, or completely new.  Please see
+    test/README for information on the test framework.
+
+ 6. New features or changed functionality must include
+    documentation. Please look at the "pod" files in doc/man[1357] for
+    examples of our style. Run "make doc-nits" to make sure that your
+    documentation changes are clean.
+
+ 7. For user visible changes (API changes, behaviour changes, ...),
+    consider adding a note in [CHANGES.md](CHANGES.md).
+    This could be a summarising description of the change, and could
+    explain the grander details.
+    Have a look through existing entries for inspiration.
+    Please note that this is NOT simply a copy of git-log one-liners.
+    Also note that security fixes get an entry in CHANGES.md.
+    This file helps users get more in depth information of what comes
+    with a specific release without having to sift through the higher
+    noise ratio in git-log.
+
+ 8. For larger or more important user visible changes, as well as
+    security fixes, please add a line in [NEWS.md](NEWS.md).
+    On exception, it might be worth adding a multi-line entry (such as
+    the entry that announces all the types that became opaque with
+    OpenSSL 1.1.0).
+    This file helps users get a very quick summary of what comes with a
+    specific release, to see if an upgrade is worth the effort.

Configurations/00-base-templates.conf

@@ -14,38 +14,15 @@ my %targets=(
 	thread_scheme	=> "(unknown)", # Assume we don't know
 	thread_defines	=> [],
 
-	apps_aux_src	=> "",
-	apps_init_src	=> "",
-	cpuid_asm_src	=> "mem_clr.c",
-	uplink_aux_src	=> "",
-	bn_asm_src	=> "bn_asm.c",
-	ec_asm_src	=> "",
-	des_asm_src	=> "des_enc.c fcrypt_b.c",
-	aes_asm_src	=> "aes_core.c aes_cbc.c",
-	bf_asm_src	=> "bf_enc.c",
-	md5_asm_src	=> "",
-	cast_asm_src	=> "c_enc.c",
-	rc4_asm_src	=> "rc4_enc.c rc4_skey.c",
-	rmd160_asm_src	=> "",
-	rc5_asm_src	=> "rc5_enc.c",
-	wp_asm_src	=> "wp_block.c",
-	cmll_asm_src	=> "camellia.c cmll_misc.c cmll_cbc.c",
-	modes_asm_src	=> "",
-	padlock_asm_src	=> "",
-	chacha_asm_src	=> "chacha_enc.c",
-	poly1305_asm_src	=> "",
-	keccak1600_asm_src	=> "keccak1600.c",
-
 	unistd		=> "<unistd.h>",
 	shared_target	=> "",
 	shared_cflag	=> "",
 	shared_defines	=> [],
 	shared_ldflag	=> "",
 	shared_rcflag	=> "",
-	shared_extension	=> "",
 
 	#### Defaults for the benefit of the config targets who don't inherit
-	#### a BASE and assume Unixly defaults
+	#### a BASE and assume Unix defaults
 	#### THESE WILL DISAPPEAR IN OpenSSL 1.2
 	build_scheme	=> [ "unified", "unix" ],
 	build_file	=> "Makefile",
@@ -70,7 +47,7 @@ my %targets=(
 
 	defines		=>
 	    sub {
-                my @defs = ();
+                my @defs = ( 'OPENSSL_BUILDING_OPENSSL' );
                 push @defs, "ZLIB" unless $disabled{zlib};
                 push @defs, "ZLIB_SHARED" unless $disabled{"zlib-dynamic"};
                 return [ @defs ];
@@ -104,6 +81,8 @@ my %targets=(
 
         build_scheme    => [ "unified", "unix" ],
         build_file      => "Makefile",
+
+        perl_platform   => 'Unix',
     },
 
     BASE_Windows => {
@@ -144,6 +123,8 @@ my %targets=(
 
         build_file      => "makefile",
         build_scheme    => [ "unified", "windows" ],
+
+        perl_platform   => 'Windows',
     },
 
     BASE_VMS => {
@@ -162,189 +143,7 @@ my %targets=(
 
         build_file       => "descrip.mms",
         build_scheme     => [ "unified", "VMS" ],
-    },
 
-    uplink_common => {
-	template	=> 1,
-	apps_init_src	=> add("../ms/applink.c"),
-	uplink_aux_src	=> add("../ms/uplink.c"),
-	defines		=> add("OPENSSL_USE_APPLINK"),
-    },
-    x86_uplink => {
-	inherit_from	=> [ "uplink_common" ],
-	template	=> 1,
-	uplink_aux_src	=> add("uplink-x86.s"),
-    },
-    x86_64_uplink => {
-	inherit_from	=> [ "uplink_common" ],
-	template	=> 1,
-	uplink_aux_src	=> add("uplink-x86_64.s"),
-    },
-    ia64_uplink => {
-	inherit_from	=> [ "uplink_common" ],
-	template	=> 1,
-	uplink_aux_src	=> add("uplink-ia64.s"),
-    },
-
-    x86_asm => {
-	template	=> 1,
-	cpuid_asm_src	=> "x86cpuid.s",
-	bn_asm_src	=> "bn-586.s co-586.s x86-mont.s x86-gf2m.s",
-	ec_asm_src	=> "ecp_nistz256.c ecp_nistz256-x86.s",
-	des_asm_src	=> "des-586.s crypt586.s",
-	aes_asm_src	=> "aes-586.s vpaes-x86.s aesni-x86.s",
-	bf_asm_src	=> "bf-586.s",
-	md5_asm_src	=> "md5-586.s",
-	cast_asm_src	=> "cast-586.s",
-	sha1_asm_src	=> "sha1-586.s sha256-586.s sha512-586.s",
-	rc4_asm_src	=> "rc4-586.s",
-	rmd160_asm_src	=> "rmd-586.s",
-	rc5_asm_src	=> "rc5-586.s",
-	wp_asm_src	=> "wp_block.c wp-mmx.s",
-	cmll_asm_src	=> "cmll-x86.s",
-	modes_asm_src	=> "ghash-x86.s",
-	padlock_asm_src	=> "e_padlock-x86.s",
-	chacha_asm_src	=> "chacha-x86.s",
-	poly1305_asm_src=> "poly1305-x86.s",
-    },
-    x86_elf_asm => {
-	template	=> 1,
-	inherit_from	=> [ "x86_asm" ],
-	perlasm_scheme	=> "elf"
-    },
-    x86_64_asm => {
-	template	=> 1,
-	cpuid_asm_src   => "x86_64cpuid.s",
-	bn_asm_src      => "asm/x86_64-gcc.c x86_64-mont.s x86_64-mont5.s x86_64-gf2m.s rsaz_exp.c rsaz-x86_64.s rsaz-avx2.s",
-	ec_asm_src      => "ecp_nistz256.c ecp_nistz256-x86_64.s x25519-x86_64.s",
-	aes_asm_src     => "aes-x86_64.s vpaes-x86_64.s bsaes-x86_64.s aesni-x86_64.s aesni-sha1-x86_64.s aesni-sha256-x86_64.s aesni-mb-x86_64.s",
-	md5_asm_src     => "md5-x86_64.s",
-	sha1_asm_src    => "sha1-x86_64.s sha256-x86_64.s sha512-x86_64.s sha1-mb-x86_64.s sha256-mb-x86_64.s",
-	rc4_asm_src     => "rc4-x86_64.s rc4-md5-x86_64.s",
-	wp_asm_src      => "wp-x86_64.s",
-	cmll_asm_src    => "cmll-x86_64.s cmll_misc.c",
-	modes_asm_src   => "ghash-x86_64.s aesni-gcm-x86_64.s",
-	padlock_asm_src => "e_padlock-x86_64.s",
-	chacha_asm_src	=> "chacha-x86_64.s",
-	poly1305_asm_src=> "poly1305-x86_64.s",
-	keccak1600_asm_src	=> "keccak1600-x86_64.s",
-    },
-    ia64_asm => {
-	template	=> 1,
-	cpuid_asm_src   => "ia64cpuid.s",
-	bn_asm_src      => "bn-ia64.s ia64-mont.s",
-	aes_asm_src     => "aes_core.c aes_cbc.c aes-ia64.s",
-	sha1_asm_src    => "sha1-ia64.s sha256-ia64.s sha512-ia64.s",
-	modes_asm_src   => "ghash-ia64.s",
-	perlasm_scheme	=> "void"
-    },
-    sparcv9_asm => {
-	template	=> 1,
-	cpuid_asm_src   => "sparcv9cap.c sparccpuid.S",
-	bn_asm_src      => "asm/sparcv8plus.S sparcv9-mont.S sparcv9a-mont.S vis3-mont.S sparct4-mont.S sparcv9-gf2m.S",
-	ec_asm_src      => "ecp_nistz256.c ecp_nistz256-sparcv9.S",
-	des_asm_src     => "des_enc-sparc.S fcrypt_b.c dest4-sparcv9.S",
-	aes_asm_src     => "aes_core.c aes_cbc.c aes-sparcv9.S aest4-sparcv9.S aesfx-sparcv9.S",
-	md5_asm_src     => "md5-sparcv9.S",
-	sha1_asm_src    => "sha1-sparcv9.S sha256-sparcv9.S sha512-sparcv9.S",
-	cmll_asm_src    => "camellia.c cmll_misc.c cmll_cbc.c cmllt4-sparcv9.S",
-	modes_asm_src   => "ghash-sparcv9.S",
-	poly1305_asm_src=> "poly1305-sparcv9.S",
-	perlasm_scheme	=> "void"
-    },
-    sparcv8_asm => {
-	template	=> 1,
-	cpuid_asm_src   => "",
-	bn_asm_src      => "asm/sparcv8.S",
-	des_asm_src     => "des_enc-sparc.S fcrypt_b.c",
-	perlasm_scheme	=> "void"
-    },
-    alpha_asm => {
-	template	=> 1,
-	cpuid_asm_src   => "alphacpuid.s",
-	bn_asm_src      => "bn_asm.c alpha-mont.S",
-	sha1_asm_src    => "sha1-alpha.S",
-	modes_asm_src   => "ghash-alpha.S",
-	perlasm_scheme	=> "void"
-    },
-    mips32_asm => {
-	template	=> 1,
-	bn_asm_src      => "bn-mips.S mips-mont.S",
-	aes_asm_src     => "aes_cbc.c aes-mips.S",
-	sha1_asm_src    => "sha1-mips.S sha256-mips.S",
-    },
-    mips64_asm => {
-	inherit_from	=> [ "mips32_asm" ],
-	template	=> 1,
-	sha1_asm_src    => add("sha512-mips.S"),
-	poly1305_asm_src=> "poly1305-mips.S",
-    },
-    s390x_asm => {
-	template	=> 1,
-	cpuid_asm_src   => "s390xcap.c s390xcpuid.S",
-	bn_asm_src      => "asm/s390x.S s390x-mont.S s390x-gf2m.s",
-	aes_asm_src     => "aes-s390x.S aes-ctr.fake aes-xts.fake",
-	sha1_asm_src    => "sha1-s390x.S sha256-s390x.S sha512-s390x.S",
-	rc4_asm_src     => "rc4-s390x.s",
-	modes_asm_src   => "ghash-s390x.S",
-	chacha_asm_src  => "chacha-s390x.S",
-	poly1305_asm_src=> "poly1305-s390x.S",
-	keccak1600_asm_src	=> "keccak1600-s390x.S",
-    },
-    armv4_asm => {
-	template	=> 1,
-	cpuid_asm_src   => "armcap.c armv4cpuid.S",
-	bn_asm_src      => "bn_asm.c armv4-mont.S armv4-gf2m.S",
-	ec_asm_src      => "ecp_nistz256.c ecp_nistz256-armv4.S",
-	aes_asm_src     => "aes_cbc.c aes-armv4.S bsaes-armv7.S aesv8-armx.S",
-	sha1_asm_src    => "sha1-armv4-large.S sha256-armv4.S sha512-armv4.S",
-	modes_asm_src   => "ghash-armv4.S ghashv8-armx.S",
-	chacha_asm_src  => "chacha-armv4.S",
-	poly1305_asm_src=> "poly1305-armv4.S", 
-	keccak1600_asm_src	=> "keccak1600-armv4.S",
-	perlasm_scheme	=> "void"
-    },
-    aarch64_asm => {
-	template	=> 1,
-	cpuid_asm_src   => "armcap.c arm64cpuid.S",
-	ec_asm_src      => "ecp_nistz256.c ecp_nistz256-armv8.S",
-	bn_asm_src      => "bn_asm.c armv8-mont.S",
-	aes_asm_src     => "aes_core.c aes_cbc.c aesv8-armx.S vpaes-armv8.S",
-	sha1_asm_src    => "sha1-armv8.S sha256-armv8.S sha512-armv8.S",
-	modes_asm_src   => "ghashv8-armx.S",
-	chacha_asm_src  => "chacha-armv8.S",
-	poly1305_asm_src=> "poly1305-armv8.S",
-	keccak1600_asm_src	=> "keccak1600-armv8.S",
-    },
-    parisc11_asm => {
-	template	=> 1,
-	cpuid_asm_src   => "pariscid.s",
-	bn_asm_src      => "bn_asm.c parisc-mont.s",
-	aes_asm_src     => "aes_core.c aes_cbc.c aes-parisc.s",
-	sha1_asm_src    => "sha1-parisc.s sha256-parisc.s sha512-parisc.s",
-	rc4_asm_src     => "rc4-parisc.s",
-	modes_asm_src   => "ghash-parisc.s",
-	perlasm_scheme	=> "32"
-    },
-    parisc20_64_asm => {
-	template	=> 1,
-	inherit_from	=> [ "parisc11_asm" ],
-	perlasm_scheme	=> "64",
-    },
-    ppc32_asm => {
-	template	=> 1,
-	cpuid_asm_src   => "ppccpuid.s ppccap.c",
-	bn_asm_src      => "bn-ppc.s ppc-mont.s",
-	aes_asm_src     => "aes_core.c aes_cbc.c aes-ppc.s vpaes-ppc.s aesp8-ppc.s",
-	sha1_asm_src    => "sha1-ppc.s sha256-ppc.s sha512-ppc.s sha256p8-ppc.s sha512p8-ppc.s",
-	modes_asm_src   => "ghashp8-ppc.s",
-	chacha_asm_src	=> "chacha-ppc.s",
-	poly1305_asm_src=> "poly1305-ppc.s poly1305-ppcfp.s",
-    },
-    ppc64_asm => {
-	inherit_from	=> [ "ppc32_asm" ],
-	template	=> 1,
-	ec_asm_src	=> "ecp_nistz256.c ecp_nistz256-ppc64.s x25519-ppc64.s",
-	keccak1600_asm_src	=> "keccak1600-ppc64.s",
+        perl_platform    => 'VMS',
     },
 );

Configurations/10-main.conf

@@ -211,18 +211,28 @@ my %targets = (
         ex_libs          => add("-lsocket -lnsl -ldl"),
         dso_scheme       => "dlfcn",
         thread_scheme    => "pthreads",
-        shared_target    => "self",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
+    },
+#### Solaris common with Sun C setups
+    "solaris-common-cc" => {
+        inherit_from     => [ "solaris-common" ],
+        template         => 1,
+        shared_target    => "solaris",
         shared_ldflag    => "-Wl,-Bsymbolic",
         shared_defflag   => "-Wl,-M,",
         shared_sonameflag=> "-Wl,-h,",
     },
+#### Solaris common with GNU C setups
+    "solaris-common-gcc" => {
+        inherit_from     => [ "solaris-common" ],
+        template         => 1,
+        shared_target    => "solaris-gcc", # The rest is on shared_info.pl
+    },
 #### Solaris x86 with GNU C setups
     "solaris-x86-gcc" => {
         # NB. GNU C has to be configured to use GNU assembler, and not
         # /usr/ccs/bin/as. Failure to comply will result in compile
         # failures [at least] in 32-bit build.
-        inherit_from     => [ "solaris-common", asm("x86_elf_asm") ],
+        inherit_from     => [ "solaris-common-gcc" ],
         CC               => "gcc",
         CFLAGS           => add_before(picker(default => "-Wall",
                                               debug   => "-O0 -g",
@@ -233,6 +243,8 @@ my %targets = (
         bn_ops           => "BN_LLONG",
         shared_cflag     => "-fPIC",
         shared_ldflag    => add_before("-shared -static-libgcc"),
+        asm_arch         => 'x86',
+        perlasm_scheme   => 'elf',
     },
     "solaris64-x86_64-gcc" => {
         # -shared -static-libgcc might appear controversial, but modules
@@ -243,7 +255,7 @@ my %targets = (
         # code [thanks to inline assembler], I would actually recommend
         # to consider using gcc shared build even with vendor compiler:-)
         #                        -- <appro@openssl.org>
-        inherit_from     => [ "solaris-common", asm("x86_64_asm") ],
+        inherit_from     => [ "solaris-common-gcc" ],
         CC               => "gcc",
         CFLAGS           => add_before(picker(default => "-Wall",
                                               debug   => "-O0 -g",
@@ -252,6 +264,7 @@ my %targets = (
         lib_cppflags     => add("-DL_ENDIAN"),
         ex_libs          => add(threads("-pthread")),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "elf",
         shared_cflag     => "-fPIC",
         shared_ldflag    => add_before("-shared -static-libgcc"),
@@ -263,7 +276,7 @@ my %targets = (
     # primarily because vendor assembler can't assemble our modules
     # with -KPIC flag. As result it, assembly support, was not even
     # available as option. But its lack means lack of side-channel
-    # resistant code, which is incompatible with security by todays
+    # resistant code, which is incompatible with security by today's
     # standards. Fortunately gcc is readily available prepackaged
     # option, which we can firmly point at...
     #
@@ -272,7 +285,7 @@ my %targets = (
     # Consider switching to solaris64-x86_64-gcc even here...
     #
     "solaris64-x86_64-cc" => {
-        inherit_from     => [ "solaris-common", asm("x86_64_asm") ],
+        inherit_from     => [ "solaris-common-cc" ],
         CC               => "cc",
         CFLAGS           => add_before(picker(debug   => "-g",
                                               release => "-xO5 -xdepend -xbuiltin")),
@@ -283,6 +296,7 @@ my %targets = (
         lflags           => add(threads("-mt")),
         ex_libs          => add(threads("-lpthread")),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "elf",
         shared_cflag     => "-KPIC",
         shared_ldflag    => add_before("-G -dy -z text"),
@@ -291,7 +305,7 @@ my %targets = (
 
 #### SPARC Solaris with GNU C setups
     "solaris-sparcv7-gcc" => {
-        inherit_from     => [ "solaris-common" ],
+        inherit_from     => [ "solaris-common-gcc" ],
         CC               => "gcc",
         CFLAGS           => add_before(picker(default => "-Wall",
                                               debug   => "-O0 -g",
@@ -304,14 +318,18 @@ my %targets = (
         shared_ldflag    => add_before("-shared"),
     },
     "solaris-sparcv8-gcc" => {
-        inherit_from     => [ "solaris-sparcv7-gcc", asm("sparcv8_asm") ],
+        inherit_from     => [ "solaris-sparcv7-gcc" ],
         cflags           => add_before("-mcpu=v8"),
+        asm_arch         => 'sparcv8',
+        perlasm_scheme   => 'void',
     },
     "solaris-sparcv9-gcc" => {
         # -m32 should be safe to add as long as driver recognizes
         # -mcpu=ultrasparc
-        inherit_from     => [ "solaris-sparcv7-gcc", asm("sparcv9_asm") ],
+        inherit_from     => [ "solaris-sparcv7-gcc" ],
         cflags           => add_before("-m32 -mcpu=ultrasparc"),
+        asm_arch         => 'sparcv9',
+        perlasm_scheme   => 'void',
     },
     "solaris64-sparcv9-gcc" => {
         inherit_from     => [ "solaris-sparcv9-gcc" ],
@@ -325,7 +343,7 @@ my %targets = (
 # SC4.2 is ok, better than gcc even on bn as long as you tell it -xarch=v8
 # SC5.0 note: Compiler common patch 107357-01 or later is required!
     "solaris-sparcv7-cc" => {
-        inherit_from     => [ "solaris-common" ],
+        inherit_from     => [ "solaris-common-cc" ],
         CC               => "cc",
         CFLAGS           => add_before(picker(debug   => "-g",
                                               release => "-xO5 -xdepend")),
@@ -340,17 +358,23 @@ my %targets = (
     },
 ####
     "solaris-sparcv8-cc" => {
-        inherit_from     => [ "solaris-sparcv7-cc", asm("sparcv8_asm") ],
+        inherit_from     => [ "solaris-sparcv7-cc" ],
         cflags           => add_before("-xarch=v8"),
+        asm_arch         => 'sparcv8',
+        perlasm_scheme   => 'void',
     },
     "solaris-sparcv9-cc" => {
-        inherit_from     => [ "solaris-sparcv7-cc", asm("sparcv9_asm") ],
+        inherit_from     => [ "solaris-sparcv7-cc" ],
         cflags           => add_before("-xarch=v8plus"),
+        asm_arch         => 'sparcv9',
+        perlasm_scheme   => 'void',
     },
     "solaris64-sparcv9-cc" => {
-        inherit_from     => [ "solaris-sparcv7-cc", asm("sparcv9_asm") ],
+        inherit_from     => [ "solaris-sparcv7-cc" ],
         cflags           => add_before("-xarch=v9"),
         bn_ops           => "BN_LLONG RC4_CHAR",
+        asm_arch         => 'sparcv9',
+        perlasm_scheme   => 'void',
         multilib         => "/64",
     },
 
@@ -360,55 +384,58 @@ my %targets = (
         inherit_from     => [ "BASE_unix" ],
         template         => 1,
         cppflags         => threads("-D_SGI_MP_SOURCE"),
-        lib_cppflags     => "-DB_ENDIAN -DBN_DIV3W",
+        lib_cppflags     => "-DB_ENDIAN",
         ex_libs          => add(threads("-lpthread")),
         thread_scheme    => "pthreads",
         dso_scheme       => "dlfcn",
         shared_target    => "self",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         shared_ldflag    => "-shared -Wl,-Bsymbolic",
         shared_sonameflag=> "-Wl,-soname,",
     },
     "irix-mips3-gcc" => {
-        inherit_from     => [ "irix-common", asm("mips64_asm") ],
+        inherit_from     => [ "irix-common" ],
         CC               => "gcc",
         CFLAGS           => picker(debug   => "-g -O0",
                                    release => "-O3"),
         LDFLAGS          => "-static-libgcc",
         cflags           => "-mabi=n32",
         bn_ops           => "RC4_CHAR SIXTY_FOUR_BIT",
+        asm_arch         => 'mips64',
         perlasm_scheme   => "n32",
         multilib         => "32",
     },
     "irix-mips3-cc" => {
-        inherit_from     => [ "irix-common", asm("mips64_asm") ],
+        inherit_from     => [ "irix-common" ],
         CC               => "cc",
         CFLAGS           => picker(debug   => "-g -O0",
                                    release => "-O2"),
         cflags           => "-n32 -mips3 -use_readonly_const -G0 -rdata_shared",
         bn_ops           => "RC4_CHAR SIXTY_FOUR_BIT",
+        asm_arch         => 'mips64',
         perlasm_scheme   => "n32",
         multilib         => "32",
     },
     # N64 ABI builds.
     "irix64-mips4-gcc" => {
-        inherit_from     => [ "irix-common", asm("mips64_asm") ],
+        inherit_from     => [ "irix-common" ],
         CC               => "gcc",
         CFLAGS           => picker(debug   => "-g -O0",
                                    release => "-O3"),
         LDFLAGS          => "-static-libgcc",
         cflags           => "-mabi=64 -mips4",
         bn_ops           => "RC4_CHAR SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'mips64',
         perlasm_scheme   => "64",
         multilib         => "64",
     },
     "irix64-mips4-cc" => {
-        inherit_from     => [ "irix-common", asm("mips64_asm") ],
+        inherit_from     => [ "irix-common" ],
         CC               => "cc",
         CFLAGS           => picker(debug   => "-g -O0",
                                    release => "-O2"),
         cflags           => "-64 -mips4 -use_readonly_const -G0 -rdata_shared",
         bn_ops           => "RC4_CHAR SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'mips64',
         perlasm_scheme   => "64",
         multilib         => "64",
     },
@@ -434,7 +461,7 @@ my %targets = (
 #   32-bit message digests. (For the moment of this writing) HP C
 #   doesn't seem to "digest" too many local variables (they make "him"
 #   chew forever:-). For more details look-up MD32_XARRAY comment in
-#   crypto/sha/sha_lcl.h.
+#   crypto/sha/sha_local.h.
 # - originally there were 32-bit hpux-parisc2-* targets. They were
 #   scrapped, because a) they were not interchangeable with other 32-bit
 #   targets; b) performance-critical 32-bit assembly modules implement
@@ -468,17 +495,21 @@ my %targets = (
         shared_extension => ".sl.\$(SHLIB_VERSION_NUMBER)",
     },
     "hpux-parisc1_1-gcc" => {
-        inherit_from     => [ "hpux-parisc-gcc", asm("parisc11_asm") ],
+        inherit_from     => [ "hpux-parisc-gcc" ],
+        asm_arch         => 'parisc11',
+        perlasm_scheme   => "32",
         multilib         => "/pa1.1",
     },
     "hpux64-parisc2-gcc" => {
-        inherit_from     => [ "hpux-common", asm("parisc20_64_asm") ],
+        inherit_from     => [ "hpux-common" ],
         CC               => "gcc",
         CFLAGS           => combine(picker(debug   => "-O0 -g",
                                            release => "-O3")),
         cflags           => add(threads("-pthread")),
         ex_libs          => add("-ldl", threads("-pthread")),
         bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
+        asm_arch         => 'parisc20_64',
+        perlasm_scheme   => "64",
         shared_cflag     => "-fpic",
         shared_ldflag    => add_before("-shared"),
         shared_extension => ".sl.\$(SHLIB_VERSION_NUMBER)",
@@ -502,12 +533,14 @@ my %targets = (
         shared_extension => ".sl.\$(SHLIB_VERSION_NUMBER)",
     },
     "hpux-parisc1_1-cc" => {
-        inherit_from     => [ "hpux-parisc-cc", asm("parisc11_asm") ],
+        inherit_from     => [ "hpux-parisc-cc" ],
         cflags           => add_before("+DA1.1"),
+        asm_arch         => 'parisc11',
+        perlasm_scheme   => "32",
         multilib         => "/pa1.1",
     },
     "hpux64-parisc2-cc" => {
-        inherit_from     => [ "hpux-common", asm("parisc20_64_asm") ],
+        inherit_from     => [ "hpux-common" ],
         CC               => "cc",
         CFLAGS           => picker(debug   => "+O0 +d -g",
                                    release => "+O3") ,
@@ -516,6 +549,8 @@ my %targets = (
         lib_cppflags     => add("-DMD32_XARRAY"),
         ex_libs          => add("-ldl", threads("-lpthread")),
         bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
+        asm_arch         => 'parisc20_64',
+        perlasm_scheme   => "64",
         shared_cflag     => "+Z",
         shared_ldflag    => add_before("-b"),
         shared_extension => ".sl.\$(SHLIB_VERSION_NUMBER)",
@@ -524,7 +559,7 @@ my %targets = (
 
     # HP/UX IA-64 targets
     "hpux-ia64-cc" => {
-        inherit_from     => [ "hpux-common", asm("ia64_asm") ],
+        inherit_from     => [ "hpux-common" ],
         CC               => "cc",
         CFLAGS           => picker(debug   => "+O0 +d -g",
                                    release => "+O2"),
@@ -532,13 +567,14 @@ my %targets = (
         cppflags         => add(threads("-D_REENTRANT")),
         ex_libs          => add("-ldl", threads("-lpthread")),
         bn_ops           => "SIXTY_FOUR_BIT",
+        asm_arch         => 'ia64',
+        perlasm_scheme   => 'void',
         shared_cflag     => "+Z",
         shared_ldflag    => add_before("-b"),
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         multilib         => "/hpux32",
     },
     "hpux64-ia64-cc" => {
-        inherit_from     => [ "hpux-common", asm("ia64_asm") ],
+        inherit_from     => [ "hpux-common" ],
         CC               => "cc",
         CFLAGS           => picker(debug   => "+O0 +d -g",
                                    release => "+O3"),
@@ -546,36 +582,39 @@ my %targets = (
         cppflags         => threads("-D_REENTRANT"),
         ex_libs          => add("-ldl", threads("-lpthread")),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'ia64',
+        perlasm_scheme   => 'void',
         shared_cflag     => "+Z",
         shared_ldflag    => add_before("-b"),
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         multilib         => "/hpux64",
     },
     # GCC builds...
     "hpux-ia64-gcc" => {
-        inherit_from     => [ "hpux-common", asm("ia64_asm") ],
+        inherit_from     => [ "hpux-common" ],
         CC               => "gcc",
         CFLAGS           => picker(debug   => "-O0 -g",
                                    release => "-O3"),
         cflags           => add(threads("-pthread")),
         ex_libs          => add("-ldl", threads("-pthread")),
         bn_ops           => "SIXTY_FOUR_BIT",
+        asm_arch         => 'ia64',
+        perlasm_scheme   => 'void',
         shared_cflag     => "-fpic",
         shared_ldflag    => add_before("-shared"),
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         multilib         => "/hpux32",
     },
     "hpux64-ia64-gcc" => {
-        inherit_from     => [ "hpux-common", asm("ia64_asm") ],
+        inherit_from     => [ "hpux-common" ],
         CC               => "gcc",
         CFLAGS           => picker(debug   => "-O0 -g",
                                    release => "-O3"),
         cflags           => combine("-mlp64", threads("-pthread")),
         ex_libs          => add("-ldl", threads("-pthread")),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'ia64',
+        perlasm_scheme   => 'void',
         shared_cflag     => "-fpic",
         shared_ldflag    => add_before("-shared"),
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         multilib         => "/hpux64",
     },
 
@@ -599,20 +638,22 @@ my %targets = (
 #### there were even osf1-* configs targeting prior versions provided,
 #### but not anymore...
     "tru64-alpha-gcc" => {
-        inherit_from     => [ "BASE_unix", asm("alpha_asm") ],
+        inherit_from     => [ "BASE_unix" ],
         CC               => "gcc",
         CFLAGS           => "-O3",
         cflags           => add("-std=c9x", threads("-pthread")),
         cppflags         => "-D_XOPEN_SOURCE=500 -D_OSF_SOURCE",
         ex_libs          => add("-lrt", threads("-pthread")), # for mlock(2)
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'alpha',
+        perlasm_scheme   => "void",
         thread_scheme    => "pthreads",
         dso_scheme       => "dlfcn",
         shared_target    => "alpha-osf1-shared",
         shared_extension => ".so",
     },
     "tru64-alpha-cc" => {
-        inherit_from     => [ "BASE_unix", asm("alpha_asm") ],
+        inherit_from     => [ "BASE_unix" ],
         CC               => "cc",
         CFLAGS           => "-tune host -fast",
         cflags           => add("-std1 -readonly_strings",
@@ -620,6 +661,8 @@ my %targets = (
         cppflags         => "-D_XOPEN_SOURCE=500 -D_OSF_SOURCE",
         ex_libs          => add("-lrt", threads("-pthread")), # for mlock(2)
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'alpha',
+        perlasm_scheme   => "void",
         thread_scheme    => "pthreads",
         dso_scheme       => "dlfcn",
         shared_target    => "alpha-osf1-shared",
@@ -651,8 +694,7 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
-        shared_ldflag    => "-Wl,-znodelete",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
+        shared_ldflag    => sub { $disabled{pinshared} ? () : "-Wl,-znodelete" },
         enable           => [ "afalgeng" ],
     },
     "linux-generic64" => {
@@ -661,22 +703,25 @@ my %targets = (
     },
 
     "linux-ppc" => {
-        inherit_from     => [ "linux-generic32", asm("ppc32_asm") ],
+        inherit_from     => [ "linux-generic32" ],
+        asm_arch         => 'ppc32',
         perlasm_scheme   => "linux32",
     },
     "linux-ppc64" => {
-        inherit_from     => [ "linux-generic64", asm("ppc64_asm") ],
+        inherit_from     => [ "linux-generic64" ],
         cflags           => add("-m64"),
         cxxflags         => add("-m64"),
         lib_cppflags     => add("-DB_ENDIAN"),
+        asm_arch         => 'ppc64',
         perlasm_scheme   => "linux64",
         multilib         => "64",
     },
     "linux-ppc64le" => {
-        inherit_from     => [ "linux-generic64", asm("ppc64_asm") ],
+        inherit_from     => [ "linux-generic64" ],
         cflags           => add("-m64"),
         cxxflags         => add("-m64"),
         lib_cppflags     => add("-DL_ENDIAN"),
+        asm_arch         => 'ppc64',
         perlasm_scheme   => "linux64le",
     },
 
@@ -712,46 +757,49 @@ my %targets = (
         #
         # ./Configure linux-armv4 -march=armv6 -D__ARM_MAX_ARCH__=8
         #
-        inherit_from     => [ "linux-generic32", asm("armv4_asm") ],
+        inherit_from     => [ "linux-generic32" ],
+        asm_arch         => 'armv4',
         perlasm_scheme   => "linux32",
     },
     "linux-aarch64" => {
-        inherit_from     => [ "linux-generic64", asm("aarch64_asm") ],
+        inherit_from     => [ "linux-generic64" ],
+        asm_arch         => 'aarch64',
         perlasm_scheme   => "linux64",
     },
     "linux-arm64ilp32" => {  # https://wiki.linaro.org/Platform/arm64-ilp32
-        inherit_from     => [ "linux-generic32", asm("aarch64_asm") ],
+        inherit_from     => [ "linux-generic32" ],
         cflags           => add("-mabi=ilp32"),
         cxxflags         => add("-mabi=ilp32"),
         bn_ops           => "SIXTY_FOUR_BIT RC4_CHAR",
+        asm_arch         => 'aarch64',
         perlasm_scheme   => "linux64",
     },
 
     "linux-mips32" => {
         # Configure script adds minimally required -march for assembly
         # support, if no -march was specified at command line.
-        inherit_from     => [ "linux-generic32", asm("mips32_asm") ],
+        inherit_from     => [ "linux-generic32" ],
         cflags           => add("-mabi=32"),
         cxxflags         => add("-mabi=32"),
-        lib_cppflags     => add("-DBN_DIV3W"),
+        asm_arch         => 'mips32',
         perlasm_scheme   => "o32",
     },
     # mips32 and mips64 below refer to contemporary MIPS Architecture
     # specifications, MIPS32 and MIPS64, rather than to kernel bitness.
     "linux-mips64" => {
-        inherit_from     => [ "linux-generic32", asm("mips64_asm") ],
+        inherit_from     => [ "linux-generic32" ],
         cflags           => add("-mabi=n32"),
         cxxflags         => add("-mabi=n32"),
-        lib_cppflags     => add("-DBN_DIV3W"),
-        bn_ops           => "SIXTY_FOUR_BIT RC4_CHAR",
+        bn_ops           => "RC4_CHAR",
+        asm_arch         => 'mips64',
         perlasm_scheme   => "n32",
         multilib         => "32",
     },
     "linux64-mips64" => {
-        inherit_from     => [ "linux-generic64", asm("mips64_asm") ],
+        inherit_from     => [ "linux-generic64" ],
         cflags           => add("-mabi=64"),
         cxxflags         => add("-mabi=64"),
-        lib_cppflags     => add("-DBN_DIV3W"),
+        asm_arch         => 'mips64',
         perlasm_scheme   => "64",
         multilib         => "64",
     },
@@ -760,13 +808,15 @@ my %targets = (
     #### These two targets are a bit aged and are to be used on older Linux
     #### machines where gcc doesn't understand -m32 and -m64
     "linux-elf" => {
-        inherit_from     => [ "linux-generic32", asm("x86_elf_asm") ],
+        inherit_from     => [ "linux-generic32" ],
         CFLAGS           => add(picker(release => "-fomit-frame-pointer")),
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "BN_LLONG",
+        asm_arch         => 'x86',
+        perlasm_scheme   => "elf",
     },
     "linux-aout" => {
-        inherit_from     => [ "BASE_unix", asm("x86_asm") ],
+        inherit_from     => [ "BASE_unix" ],
         CC               => "gcc",
         CFLAGS           => add(picker(default => "-Wall",
                                        debug   => "-O0 -g",
@@ -774,17 +824,19 @@ my %targets = (
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "BN_LLONG",
         thread_scheme    => "(unknown)",
+        asm_arch         => 'x86',
         perlasm_scheme   => "a.out",
     },
 
     #### X86 / X86_64 targets
     "linux-x86" => {
-        inherit_from     => [ "linux-generic32", asm("x86_asm") ],
+        inherit_from     => [ "linux-generic32" ],
         CFLAGS           => add(picker(release => "-fomit-frame-pointer")),
         cflags           => add("-m32"),
         cxxflags         => add("-m32"),
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "BN_LLONG",
+        asm_arch         => 'x86',
         perlasm_scheme   => "elf",
     },
     "linux-x86-clang" => {
@@ -793,11 +845,12 @@ my %targets = (
         CXX              => "clang++",
     },
     "linux-x86_64" => {
-        inherit_from     => [ "linux-generic64", asm("x86_64_asm") ],
+        inherit_from     => [ "linux-generic64" ],
         cflags           => add("-m64"),
         cxxflags         => add("-m64"),
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "elf",
         multilib         => "64",
     },
@@ -807,25 +860,29 @@ my %targets = (
         CXX              => "clang++",
     },
     "linux-x32" => {
-        inherit_from     => [ "linux-generic32", asm("x86_64_asm") ],
+        inherit_from     => [ "linux-generic32" ],
         cflags           => add("-mx32"),
         cxxflags         => add("-mx32"),
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "SIXTY_FOUR_BIT",
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "elf32",
         multilib         => "x32",
     },
 
     "linux-ia64" => {
-        inherit_from     => [ "linux-generic64", asm("ia64_asm") ],
+        inherit_from     => [ "linux-generic64" ],
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'ia64',
+        perlasm_scheme   => 'void',
     },
 
     "linux64-s390x" => {
-        inherit_from     => [ "linux-generic64", asm("s390x_asm") ],
+        inherit_from     => [ "linux-generic64" ],
         cflags           => add("-m64"),
         cxxflags         => add("-m64"),
         lib_cppflags     => add("-DB_ENDIAN"),
+        asm_arch         => 's390x',
         perlasm_scheme   => "64",
         multilib         => "64",
     },
@@ -846,44 +903,52 @@ my %targets = (
         # yet, because of couple of bugs in glibc
         # sysdeps/s390/dl-procinfo.c affecting ldconfig and ld.so.1...
         #
-        inherit_from     => [ "linux-generic32", asm("s390x_asm") ],
+        inherit_from     => [ "linux-generic32" ],
         cflags           => add("-m31 -Wa,-mzarch"),
         cxxflags         => add("-m31 -Wa,-mzarch"),
         lib_cppflags     => add("-DB_ENDIAN"),
-        bn_asm_src       => sub { my $r=join(" ",@_); $r=~s|asm/s390x\.S|bn_asm.c|; $r; },
+        asm_arch         => 's390x',
         perlasm_scheme   => "31",
         multilib         => "/highgprs",
     },
 
     #### SPARC Linux setups
     "linux-sparcv8" => {
-        inherit_from     => [ "linux-generic32", asm("sparcv8_asm") ],
+        inherit_from     => [ "linux-generic32" ],
         cflags           => add("-mcpu=v8"),
         cxxflags         => add("-mcpu=v8"),
         lib_cppflags     => add("-DB_ENDIAN -DBN_DIV2W"),
+        asm_arch         => 'sparcv8',
+        perlasm_scheme   => 'void',
     },
     "linux-sparcv9" => {
         # it's a real mess with -mcpu=ultrasparc option under Linux,
         # but -Wa,-Av8plus should do the trick no matter what.
-        inherit_from     => [ "linux-generic32", asm("sparcv9_asm") ],
+        inherit_from     => [ "linux-generic32" ],
         cflags           => add("-m32 -mcpu=ultrasparc -Wa,-Av8plus"),
         cxxflags         => add("-m32 -mcpu=ultrasparc -Wa,-Av8plus"),
         lib_cppflags     => add("-DB_ENDIAN -DBN_DIV2W"),
+        asm_arch         => 'sparcv9',
+        perlasm_scheme   => 'void',
     },
     "linux64-sparcv9" => {
         # GCC 3.1 is a requirement
-        inherit_from     => [ "linux-generic64", asm("sparcv9_asm") ],
+        inherit_from     => [ "linux-generic64" ],
         cflags           => add("-m64 -mcpu=ultrasparc"),
         cxxflags         => add("-m64 -mcpu=ultrasparc"),
         lib_cppflags     => add("-DB_ENDIAN"),
         bn_ops           => "BN_LLONG RC4_CHAR",
+        asm_arch         => 'sparcv9',
+        perlasm_scheme   => 'void',
         multilib         => "64",
     },
 
     "linux-alpha-gcc" => {
-        inherit_from     => [ "linux-generic64", asm("alpha_asm") ],
+        inherit_from     => [ "linux-generic64" ],
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'alpha',
+        perlasm_scheme   => "void",
     },
     "linux-c64xplus" => {
         inherit_from     => [ "BASE_unix" ],
@@ -895,21 +960,13 @@ my %targets = (
         cppflags         => combine("-DOPENSSL_SMALL_FOOTPRINT",
                                     threads("-D_REENTRANT")),
         bn_ops           => "BN_LLONG",
-        cpuid_asm_src    => "c64xpluscpuid.s",
-        bn_asm_src       => "asm/bn-c64xplus.asm c64xplus-gf2m.s",
-        aes_asm_src      => "aes-c64xplus.s aes_cbc.c aes-ctr.fake",
-        sha1_asm_src     => "sha1-c64xplus.s sha256-c64xplus.s sha512-c64xplus.s",
-        rc4_asm_src      => "rc4-c64xplus.s",
-        modes_asm_src    => "ghash-c64xplus.s",
-        chacha_asm_src   => "chacha-c64xplus.s",
-        poly1305_asm_src => "poly1305-c64xplus.s",
         thread_scheme    => "pthreads",
+        asm_arch         => 'c64xplus',
         perlasm_scheme   => "void",
         dso_scheme       => "dlfcn",
         shared_target    => "linux-shared",
         shared_cflag     => "--pic",
         shared_ldflag    => add("-z --sysv --shared"),
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         ranlib           => "true",
     },
 
@@ -936,7 +993,6 @@ my %targets = (
         dso_scheme       => "dlfcn",
         shared_target    => "bsd-gcc-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
     "BSD-generic64" => {
         inherit_from     => [ "BSD-generic32" ],
@@ -944,11 +1000,11 @@ my %targets = (
     },
 
     "BSD-x86" => {
-        inherit_from     => [ "BSD-generic32", asm("x86_asm") ],
+        inherit_from     => [ "BSD-generic32" ],
         CFLAGS           => add(picker(release => "-fomit-frame-pointer")),
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "BN_LLONG",
-        shared_target    => "bsd-shared",
+        asm_arch         => 'x86',
         perlasm_scheme   => "a.out",
     },
     "BSD-x86-elf" => {
@@ -957,61 +1013,52 @@ my %targets = (
     },
 
     "BSD-sparcv8" => {
-        inherit_from     => [ "BSD-generic32", asm("sparcv8_asm") ],
+        inherit_from     => [ "BSD-generic32" ],
         cflags           => add("-mcpu=v8"),
         lib_cppflags     => add("-DB_ENDIAN"),
+        asm_arch         => 'sparcv8',
+        perlasm_scheme   => 'void',
     },
     "BSD-sparc64" => {
         # -DMD32_REG_T=int doesn't actually belong in sparc64 target, it
         # simply *happens* to work around a compiler bug in gcc 3.3.3,
         # triggered by RIPEMD160 code.
-        inherit_from     => [ "BSD-generic64", asm("sparcv9_asm") ],
+        inherit_from     => [ "BSD-generic64" ],
         lib_cppflags     => add("-DB_ENDIAN -DMD32_REG_T=int"),
         bn_ops           => "BN_LLONG",
+        asm_arch         => 'sparcv9',
+        perlasm_scheme   => 'void',
     },
 
     "BSD-ia64" => {
-        inherit_from     => [ "BSD-generic64", asm("ia64_asm") ],
+        inherit_from     => [ "BSD-generic64" ],
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'ia64',
+        perlasm_scheme   => 'void',
     },
 
     "BSD-x86_64" => {
-        inherit_from     => [ "BSD-generic64", asm("x86_64_asm") ],
+        inherit_from     => [ "BSD-generic64" ],
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "elf",
     },
 
     "bsdi-elf-gcc" => {
-        inherit_from     => [ "BASE_unix", asm("x86_elf_asm") ],
+        inherit_from     => [ "BASE_unix" ],
         CC               => "gcc",
         CFLAGS           => "-fomit-frame-pointer -O3 -Wall",
         lib_cppflags     => "-DPERL5 -DL_ENDIAN",
         ex_libs          => add("-ldl"),
         bn_ops           => "BN_LLONG",
+        asm_arch         => 'x86',
+        perlasm_scheme   => "elf",
         thread_scheme    => "(unknown)",
         dso_scheme       => "dlfcn",
         shared_target    => "bsd-gcc-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
-    },
-
-    "nextstep" => {
-        inherit_from     => [ "BASE_unix" ],
-        CC               => "cc",
-        CFLAGS           => "-O -Wall",
-        unistd           => "<libc.h>",
-        bn_ops           => "BN_LLONG",
-        thread_scheme    => "(unknown)",
-    },
-    "nextstep3.3" => {
-        inherit_from     => [ "BASE_unix" ],
-        CC               => "cc",
-        CFLAGS           => "-O3 -Wall",
-        unistd           => "<libc.h>",
-        bn_ops           => "BN_LLONG",
-        thread_scheme    => "(unknown)",
     },
 
 #### SCO/Caldera targets.
@@ -1043,7 +1090,7 @@ my %targets = (
         thread_scheme    => "uithreads",
     },
     "unixware-7" => {
-        inherit_from     => [ "BASE_unix", asm("x86_elf_asm") ],
+        inherit_from     => [ "BASE_unix" ],
         CC               => "cc",
         CFLAGS           => "-O",
         cflags           => combine("-Kalloca", threads("-Kthread")),
@@ -1051,14 +1098,14 @@ my %targets = (
         ex_libs          => add("-lsocket -lnsl"),
         thread_scheme    => "uithreads",
         bn_ops           => "BN_LLONG",
+        asm_arch         => 'x86',
         perlasm_scheme   => "elf-1",
         dso_scheme       => "dlfcn",
         shared_target    => "svr5-shared",
         shared_cflag     => "-Kpic",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
     "unixware-7-gcc" => {
-        inherit_from     => [ "BASE_unix", asm("x86_elf_asm") ],
+        inherit_from     => [ "BASE_unix" ],
         CC               => "gcc",
         CFLAGS           => "-O3 -fomit-frame-pointer -Wall",
         cppflags         => add(threads("-D_REENTRANT")),
@@ -1066,37 +1113,37 @@ my %targets = (
         ex_libs          => add("-lsocket -lnsl"),
         bn_ops           => "BN_LLONG",
         thread_scheme    => "pthreads",
+        asm_arch         => 'x86',
         perlasm_scheme   => "elf-1",
         dso_scheme       => "dlfcn",
         shared_target    => "gnu-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
 # SCO 5 - Ben Laurie says the -O breaks the SCO cc.
     "sco5-cc" => {
-        inherit_from     => [ "BASE_unix", asm("x86_elf_asm") ],
+        inherit_from     => [ "BASE_unix" ],
         cc               => "cc",
         cflags           => "-belf",
         ex_libs          => add("-lsocket -lnsl"),
         thread_scheme    => "(unknown)",
+        asm_arch         => 'x86',
         perlasm_scheme   => "elf-1",
         dso_scheme       => "dlfcn",
         shared_target    => "svr3-shared",
         shared_cflag     => "-Kpic",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
     "sco5-gcc" => {
-        inherit_from     => [ "BASE_unix", asm("x86_elf_asm") ],
+        inherit_from     => [ "BASE_unix" ],
         cc               => "gcc",
         cflags           => "-O3 -fomit-frame-pointer",
         ex_libs          => add("-lsocket -lnsl"),
         bn_ops           => "BN_LLONG",
         thread_scheme    => "(unknown)",
+        asm_arch         => 'x86',
         perlasm_scheme   => "elf-1",
         dso_scheme       => "dlfcn",
         shared_target    => "svr3-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
 
 #### IBM's AIX.
@@ -1113,36 +1160,35 @@ my %targets = (
         lflags           => "-Wl,-bsvr4",
         thread_scheme    => "pthreads",
         dso_scheme       => "dlfcn",
-        shared_target    => "self",
-        module_ldflags   => "-Wl,-G,-bsymbolic,-bexpall",
-        shared_ldflag    => "-Wl,-G,-bsymbolic",
+        shared_target    => "aix",
+        module_ldflags   => "-Wl,-G,-bsymbolic,-bnoentry",
+        shared_ldflag    => "-Wl,-G,-bsymbolic,-bnoentry",
         shared_defflag   => "-Wl,-bE:",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
-        dso_extension    => ".so",
-        lib_extension    => shared("_a.a"),
-        shared_extension_simple => shared(".a"),
+        perl_platform    => 'AIX',
     },
     "aix-gcc" => {
-        inherit_from     => [ "aix-common", asm("ppc32_asm") ],
+        inherit_from     => [ "aix-common" ],
         CC               => "gcc",
         CFLAGS           => picker(debug   => "-O0 -g",
                                    release => "-O"),
         cflags           => add(threads("-pthread")),
         ex_libs          => threads("-pthread"),
         bn_ops           => "BN_LLONG RC4_CHAR",
+        asm_arch         => 'ppc32',
         perlasm_scheme   => "aix32",
         shared_ldflag    => add_before("-shared -static-libgcc"),
         AR               => add("-X32"),
         RANLIB           => add("-X32"),
     },
     "aix64-gcc" => {
-        inherit_from     => [ "aix-common", asm("ppc64_asm") ],
+        inherit_from     => [ "aix-common" ],
         CC               => "gcc",
         CFLAGS           => picker(debug   => "-O0 -g",
                                    release => "-O"),
         cflags           => combine("-maix64", threads("-pthread")),
         ex_libs          => threads("-pthread"),
         bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
+        asm_arch         => 'ppc64',
         perlasm_scheme   => "aix64",
         shared_ldflag    => add_before("-shared -static-libgcc"),
         shared_extension => "64.so.\$(SHLIB_VERSION_NUMBER)",
@@ -1150,7 +1196,7 @@ my %targets = (
         RANLIB           => add("-X64"),
     },
     "aix-cc" => {
-        inherit_from     => [ "aix-common", asm("ppc32_asm") ],
+        inherit_from     => [ "aix-common" ],
         CC               => "cc",
         CFLAGS           => picker(debug   => "-O0 -g",
                                    release => "-O"),
@@ -1159,13 +1205,14 @@ my %targets = (
         cppflags         => threads("-D_THREAD_SAFE"),
         ex_libs          => threads("-lpthreads"),
         bn_ops           => "BN_LLONG RC4_CHAR",
+        asm_arch         => 'ppc32',
         perlasm_scheme   => "aix32",
         shared_cflag     => "-qpic",
         AR               => add("-X32"),
         RANLIB           => add("-X32"),
     },
     "aix64-cc" => {
-        inherit_from     => [ "aix-common", asm("ppc64_asm") ],
+        inherit_from     => [ "aix-common" ],
         CC               => "cc",
         CFLAGS           => picker(debug   => "-O0 -g",
                                    release => "-O"),
@@ -1174,6 +1221,7 @@ my %targets = (
         cppflags         => threads("-D_THREAD_SAFE"),
         ex_libs          => threads("-lpthreads"),
         bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
+        asm_arch         => 'ppc64',
         perlasm_scheme   => "aix64",
         dso_scheme       => "dlfcn",
         shared_cflag     => "-qpic",
@@ -1230,12 +1278,13 @@ my %targets = (
         lib_defines      => add("L_ENDIAN"),
         dso_cflags       => "/Zi /Fddso.pdb",
         bin_cflags       => "/Zi /Fdapp.pdb",
+        # def_flag made to empty string so a .def file gets generated
+        shared_defflag   => '',
         shared_ldflag    => "/dll",
         shared_target    => "win-shared", # meaningless except it gives Configure a hint
         thread_scheme    => "winthreads",
         dso_scheme       => "win32",
-        apps_aux_src     => add("win32_init.c"),
-        bn_ops           => "EXPORT_VAR_AS_FN",
+        perl_platform    => 'Windows::MSVC',
         # additional parameter to build_scheme denotes install-path "flavour"
         build_scheme     => add("VC-common", { separator => undef }),
     },
@@ -1289,40 +1338,38 @@ my %targets = (
         bn_ops           => add("SIXTY_FOUR_BIT"),
     },
     "VC-WIN64I" => {
-        inherit_from     => [ "VC-WIN64-common", asm("ia64_asm"),
-                              sub { $disabled{shared} ? () : "ia64_uplink" } ],
+        inherit_from     => [ "VC-WIN64-common" ],
         AS               => "ias",
         ASFLAGS          => "-d debug",
         asoutflag        => "-o ",
         sys_id           => "WIN64I",
-        bn_asm_src       => sub { return undef unless @_;
-                                  my $r=join(" ",@_); $r=~s|bn-ia64.s|bn_asm.c|; $r; },
+        uplink_arch      => 'ia64',
+        asm_arch         => 'ia64',
         perlasm_scheme   => "ias",
         multilib         => "-ia64",
     },
     "VC-WIN64A" => {
-        inherit_from     => [ "VC-WIN64-common", asm("x86_64_asm"),
-                              sub { $disabled{shared} ? () : "x86_64_uplink" } ],
+        inherit_from     => [ "VC-WIN64-common" ],
         AS               => sub { vc_win64a_info()->{AS} },
         ASFLAGS          => sub { vc_win64a_info()->{ASFLAGS} },
         asoutflag        => sub { vc_win64a_info()->{asoutflag} },
         asflags          => sub { vc_win64a_info()->{asflags} },
         sys_id           => "WIN64A",
-        bn_asm_src       => sub { return undef unless @_;
-                                  my $r=join(" ",@_); $r=~s|asm/x86_64-gcc|bn_asm|; $r; },
+        uplink_arch      => 'x86_64',
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "auto",
         multilib         => "-x64",
     },
     "VC-WIN32" => {
-        inherit_from     => [ "VC-noCE-common", asm("x86_asm"),
-                              sub { $disabled{shared} ? () : "uplink_common" } ],
-        CFLAGS           => add("/WX"),
+        inherit_from     => [ "VC-noCE-common" ],
         AS               => sub { vc_win32_info()->{AS} },
         ASFLAGS          => sub { vc_win32_info()->{ASFLAGS} },
         asoutflag        => sub { vc_win32_info()->{asoutflag} },
         asflags          => sub { vc_win32_info()->{asflags} },
         sys_id           => "WIN32",
         bn_ops           => add("BN_LLONG"),
+        uplink_arch      => 'common',
+        asm_arch         => 'x86',
         perlasm_scheme   => sub { vc_win32_info()->{perlasm_scheme} },
         # "WOW" stands for "Windows on Windows", and "VC-WOW" engages
         # some installation path heuristics in windows-makefile.tmpl...
@@ -1376,62 +1423,55 @@ my %targets = (
     },
 
 #### MinGW
-    "mingw" => {
-        inherit_from     => [ "BASE_unix", asm("x86_asm"),
-                              sub { $disabled{shared} ? () : "x86_uplink" } ],
-        CC               => "gcc",
-        CFLAGS           => picker(default => "-Wall",
-                                   debug   => "-g -O0",
-                                   release => "-O3 -fomit-frame-pointer"),
-        cflags           => "-m32",
-        cppflags         => combine("-DUNICODE -D_UNICODE -DWIN32_LEAN_AND_MEAN",
-                                    threads("-D_MT")),
-        lib_cppflags     => "-DL_ENDIAN",
-        sys_id           => "MINGW32",
-        ex_libs          => add("-lws2_32 -lgdi32 -lcrypt32"),
-        bn_ops           => "BN_LLONG EXPORT_VAR_AS_FN",
-        thread_scheme    => "winthreads",
-        perlasm_scheme   => "coff",
-        dso_scheme       => "win32",
-        shared_target    => "mingw-shared",
-        shared_cppflags  => add("_WINDLL"),
-        shared_ldflag    => "-static-libgcc",
-        shared_rcflag    => "--target=pe-i386",
-        shared_extension => ".dll",
-        multilib         => "",
-        apps_aux_src     => add("win32_init.c"),
-    },
-    "mingw64" => {
-        # As for OPENSSL_USE_APPLINK. Applink makes it possible to use
-        # .dll compiled with one compiler with application compiled with
-        # another compiler. It's possible to engage Applink support in
-        # mingw64 build, but it's not done, because till mingw64
-        # supports structured exception handling, one can't seriously
-        # consider its binaries for using with non-mingw64 run-time
-        # environment. And as mingw64 is always consistent with itself,
-        # Applink is never engaged and can as well be omitted.
-        inherit_from     => [ "BASE_unix", asm("x86_64_asm") ],
+    "mingw-common" => {
+        inherit_from     => [ 'BASE_unix' ],
+        template         => 1,
         CC               => "gcc",
         CFLAGS           => picker(default => "-Wall",
                                    debug   => "-g -O0",
                                    release => "-O3"),
-        cflags           => "-m64",
         cppflags         => combine("-DUNICODE -D_UNICODE -DWIN32_LEAN_AND_MEAN",
                                     threads("-D_MT")),
         lib_cppflags     => "-DL_ENDIAN",
-        sys_id           => "MINGW64",
         ex_libs          => add("-lws2_32 -lgdi32 -lcrypt32"),
-        bn_ops           => "SIXTY_FOUR_BIT EXPORT_VAR_AS_FN",
         thread_scheme    => "winthreads",
-        perlasm_scheme   => "mingw64",
         dso_scheme       => "win32",
         shared_target    => "mingw-shared",
         shared_cppflags  => add("_WINDLL"),
         shared_ldflag    => "-static-libgcc",
+
+        perl_platform    => 'mingw',
+    },
+    "mingw" => {
+        inherit_from     => [ "mingw-common" ],
+        CFLAGS           => add(picker(release => "-fomit-frame-pointer")),
+        cflags           => "-m32",
+        sys_id           => "MINGW32",
+        bn_ops           => add("BN_LLONG"),
+        asm_arch         => 'x86',
+        uplink_arch      => 'x86',
+        perlasm_scheme   => "coff",
+        shared_rcflag    => "--target=pe-i386",
+        multilib         => "",
+    },
+    "mingw64" => {
+        # As for uplink_arch. Applink makes it possible to use
+        # .dll compiled with one compiler with application compiled with
+        # another compiler. It's possible to engage Applink support in
+        # mingw64 build, but it's not done, because until mingw64
+        # supports structured exception handling, one can't seriously
+        # consider its binaries for using with non-mingw64 run-time
+        # environment. And as mingw64 is always consistent with itself,
+        # Applink is never engaged and can as well be omitted.
+        inherit_from     => [ "mingw-common" ],
+        cflags           => "-m64",
+        sys_id           => "MINGW64",
+        bn_ops           => add("SIXTY_FOUR_BIT"),
+        asm_arch         => 'x86_64',
+        uplink_arch      => undef,
+        perlasm_scheme   => "mingw64",
         shared_rcflag    => "--target=pe-x86-64",
-        shared_extension => ".dll",
         multilib         => "64",
-        apps_aux_src     => add("win32_init.c"),
     },
 
 #### UEFI
@@ -1442,6 +1482,16 @@ my %targets = (
         lib_cppflags     => "-DL_ENDIAN",
         sys_id           => "UEFI",
     },
+    "UEFI-x86" => {
+        inherit_from     => [ "UEFI" ],
+        asm_arch         => 'x86',
+        perlasm_scheme   => "win32n",
+    },
+    "UEFI-x86_64" => {
+        inherit_from     => [ "UEFI" ],
+        asm_arch         => 'x86_64',
+        perlasm_scheme   => "nasm",
+    },
 
 #### UWIN
     "UWIN" => {
@@ -1455,37 +1505,36 @@ my %targets = (
     },
 
 #### Cygwin
-    "Cygwin-x86" => {
-        inherit_from     => [ "BASE_unix", asm("x86_asm") ],
-        CC               => "gcc",
-        CFLAGS           => picker(default => "-Wall",
-                                   debug   => "-g -O0",
-                                   release => "-O3 -fomit-frame-pointer"),
-        lib_cppflags     => "-DTERMIOS -DL_ENDIAN",
-        sys_id           => "CYGWIN",
-        bn_ops           => "BN_LLONG",
-        thread_scheme    => "pthread",
-        perlasm_scheme   => "coff",
-        dso_scheme       => "dlfcn",
-        shared_target    => "cygwin-shared",
-        shared_cppflags  => "-D_WINDLL",
-        shared_extension => ".dll",
-    },
-    "Cygwin-x86_64" => {
-        inherit_from     => [ "BASE_unix", asm("x86_64_asm") ],
+    "Cygwin-common" => {
+        inherit_from     => [ "BASE_unix" ],
+        template         => 1,
+
         CC               => "gcc",
         CFLAGS           => picker(default => "-Wall",
                                    debug   => "-g -O0",
                                    release => "-O3"),
         lib_cppflags     => "-DTERMIOS -DL_ENDIAN",
         sys_id           => "CYGWIN",
-        bn_ops           => "SIXTY_FOUR_BIT_LONG",
         thread_scheme    => "pthread",
-        perlasm_scheme   => "mingw64",
         dso_scheme       => "dlfcn",
         shared_target    => "cygwin-shared",
         shared_cppflags  => "-D_WINDLL",
-        shared_extension => ".dll",
+
+        perl_platform    => 'Cygwin',
+    },
+    "Cygwin-x86" => {
+        inherit_from     => [ "Cygwin-common" ],
+        CFLAGS           => add(picker(release => "-O3 -fomit-frame-pointer")),
+        bn_ops           => "BN_LLONG",
+        asm_arch         => 'x86',
+        perlasm_scheme   => "coff",
+    },
+    "Cygwin-x86_64" => {
+        inherit_from     => [ "Cygwin-common" ],
+        CC               => "gcc",
+        bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'x86_64',
+        perlasm_scheme   => "mingw64",
     },
     # Backward compatibility for those using this target
     "Cygwin" => {
@@ -1528,51 +1577,55 @@ my %targets = (
     # with future defaults for below two targets, because MacOS X
     # for PPC has no future, it was discontinued by vendor in 2009.
     "darwin-ppc-cc" => {
-        inherit_from     => [ "darwin-common", asm("ppc32_asm") ],
+        inherit_from     => [ "darwin-common" ],
         cflags           => add("-arch ppc -std=gnu9x -Wa,-force_cpusubtype_ALL"),
         lib_cppflags     => add("-DB_ENDIAN"),
         shared_cflag     => add("-fno-common"),
+        asm_arch         => 'ppc32',
         perlasm_scheme   => "osx32",
     },
     "darwin64-ppc-cc" => {
-        inherit_from     => [ "darwin-common", asm("ppc64_asm") ],
+        inherit_from     => [ "darwin-common" ],
         cflags           => add("-arch ppc64 -std=gnu9x"),
         lib_cppflags     => add("-DB_ENDIAN"),
         bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
+        asm_arch         => 'ppc64',
         perlasm_scheme   => "osx64",
     },
     "darwin-i386-cc" => {
-        inherit_from     => [ "darwin-common", asm("x86_asm") ],
+        inherit_from     => [ "darwin-common" ],
         CFLAGS           => add(picker(release => "-fomit-frame-pointer")),
         cflags           => add("-arch i386"),
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "BN_LLONG RC4_INT",
+        asm_arch         => 'x86',
         perlasm_scheme   => "macosx",
     },
     "darwin64-x86_64-cc" => {
-        inherit_from     => [ "darwin-common", asm("x86_64_asm") ],
+        inherit_from     => [ "darwin-common" ],
         CFLAGS           => add("-Wall"),
         cflags           => add("-arch x86_64"),
         lib_cppflags     => add("-DL_ENDIAN"),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "macosx",
     },
 
 ##### GNU Hurd
     "hurd-x86" => {
         inherit_from     => [ "BASE_unix" ],
-        inherit_from     => [ asm("x86_elf_asm") ],
         CC               => "gcc",
         CFLAGS           => "-O3 -fomit-frame-pointer -Wall",
         cflags           => threads("-pthread"),
         lib_cppflags     => "-DL_ENDIAN",
         ex_libs          => add("-ldl", threads("-pthread")),
         bn_ops           => "BN_LLONG",
+        asm_arch         => 'x86',
+        perlasm_scheme   => 'elf',
         thread_scheme    => "pthreads",
         dso_scheme       => "dlfcn",
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
 
 ##### VxWorks for various targets
@@ -1658,7 +1711,7 @@ my %targets = (
         ranlib           => "ranlibpentium",
     },
     "vxworks-mips" => {
-        inherit_from     => [ "BASE_unix", asm("mips32_asm") ],
+        inherit_from     => [ "BASE_unix" ],
         CC               => "ccmips",
         CFLAGS           => "-O -G 0",
         cflags           => "-mrtp -mips2 -B\$(WIND_BASE)/host/\$(WIND_HOST_TYPE)/lib/gcc-lib/ -msoft-float -mno-branch-likely -fno-builtin -fno-defer-pop",
@@ -1673,6 +1726,7 @@ my %targets = (
         lflags           => add("-L \$(WIND_BASE)/target/usr/lib/mips/MIPSI32/sfcommon"),
         ex_libs          => add("-Wl,--defsym,__wrs_rtp_base=0xe0000000"),
         thread_scheme    => "pthreads",
+        asm_arch         => 'mips32',
         perlasm_scheme   => "o32",
         ranlib           => "ranlibmips",
     },
@@ -1688,7 +1742,6 @@ my %targets = (
         dso_scheme       => sub { env('LIBSSL_dlfcn') },
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         ranlib           => sub { env('RANLIB') },
     },
     "uClinux-dist64" => {
@@ -1701,7 +1754,6 @@ my %targets = (
         dso_scheme       => sub { env('LIBSSL_dlfcn') },
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         ranlib           => sub { env('RANLIB') },
     },
 
@@ -1732,12 +1784,19 @@ my %targets = (
         lflags           => picker(default => "/MAP='F\$PARSE(\".MAP\",\"\$\@\")'",
                                    debug   => "/DEBUG/TRACEBACK",
                                    release => "/NODEBUG/NOTRACEBACK"),
+        # Because of dso_cflags below, we can't set the generic |cflags| here,
+        # as it can't be overridden, so we set separate C flags for libraries
+        # and binaries instead.
+        bin_cflags       => add("/NAMES=(AS_IS,SHORTENED)/EXTERN_MODEL=STRICT_REFDEF"),
         lib_cflags       => add("/NAMES=(AS_IS,SHORTENED)/EXTERN_MODEL=STRICT_REFDEF"),
-        # no_inst_lib_cflags is used instead of lib_cflags by descrip.mms.tmpl
-        # for object files belonging to selected internal libraries
-        no_inst_lib_cflags => "",
+        # For modules specifically, we assume that they only use public
+        # OpenSSL symbols, and therefore don't need to mangle names on
+        # their own.
+        dso_cflags       => "",
         ex_libs          => add(sub { return vms_info()->{zlib} || (); }),
         shared_target    => "vms-shared",
+        # def_flag made to empty string so a .opt file gets generated
+        shared_defflag   => '',
         dso_scheme       => "vms",
         thread_scheme    => "pthreads",
 
@@ -1747,8 +1806,8 @@ my %targets = (
         asflags          => sub { vms_info()->{asflags} },
         perlasm_scheme   => sub { vms_info()->{perlasm_scheme} },
 
-        apps_aux_src     => "vms_term_sock.c",
-        apps_init_src    => "vms_decc_init.c",
+        disable          => add('pinshared'),
+
     },
 
     # From HELP CC/POINTER_SIZE:
@@ -1781,13 +1840,12 @@ my %targets = (
         pointer_size     => "64",
     },
     "vms-ia64" => {
-        inherit_from     => [ "vms-generic",
-                              sub { vms_info()->{as}
-                                        ? asm("ia64_asm")->() : () } ],
+        inherit_from     => [ "vms-generic" ],
         bn_ops           => "SIXTY_FOUR_BIT RC4_INT",
+        asm_arch         => sub { vms_info()->{AS} ? 'ia64' : undef },
+        perlasm_scheme   => 'ias',
         pointer_size     => "",
 
-        modes_asm_src    => "", # Because ghash-ia64.s doesn't work on VMS
     },
     "vms-ia64-p32" => {
         inherit_from     => [ "vms-ia64" ],

Configurations/15-android.conf

@@ -4,6 +4,8 @@
 # comments below...
 
 {
+    use File::Spec::Functions;
+
     my $android_ndk = {};
     my %triplet = (
         arm    => "arm-linux-androideabi",
@@ -20,9 +22,21 @@
                 return $android_ndk = { bn_ops => "BN_AUTO" };
             }
 
-            my $ndk = $ENV{ANDROID_NDK};
-            die "\$ANDROID_NDK is not defined"  if (!$ndk);
-            die "\$ANDROID_NDK=$ndk is invalid" if (!-d "$ndk/platforms");
+            my $ndk_var;
+            my $ndk;
+            foreach (qw(ANDROID_NDK_ROOT ANDROID_NDK)) {
+                $ndk_var = $_;
+                $ndk = $ENV{$ndk_var};
+                last if defined $ndk;
+            }
+            die "\$ANDROID_NDK_ROOT is not defined"  if (!$ndk);
+            if (!-d "$ndk/platforms" && !-f "$ndk/AndroidVersion.txt") {
+                # $ndk/platforms is traditional "all-inclusive" NDK, while
+                # $ndk/AndroidVersion.txt is so-called standalone toolchain
+                # tailored for specific target down to API level.
+                die "\$ANDROID_NDK_ROOT=$ndk is invalid";
+            }
+            $ndk = canonpath($ndk);
 
             my $ndkver = undef;
 
@@ -37,10 +51,18 @@
                 close $fh;
             }
 
-            my $sysroot;
+            my ($sysroot, $api, $arch);
 
-            if (!($sysroot = $ENV{CROSS_SYSROOT})) {
-                my $api = "*";
+            $config{target} =~ m|[^-]+-([^-]+)$|;	# split on dash
+            $arch = $1;
+
+            if ($sysroot = $ENV{CROSS_SYSROOT}) {
+                $sysroot =~ m|/android-([0-9]+)/arch-(\w+)/?$|;
+                ($api, $arch) = ($1, $2);
+            } elsif (-f "$ndk/AndroidVersion.txt") {
+                $sysroot = "$ndk/sysroot";
+            } else {
+                $api = "*";
 
                 # see if user passed -D__ANDROID_API__=N
                 foreach (@{$useradd{CPPDEFINES}}, @{$user{CPPFLAGS}}) {
@@ -56,19 +78,17 @@
                                      } glob("$ndk/platforms/android-$api");
                 die "no $ndk/platforms/android-$api" if ($#platforms < 0);
 
-                $config{target} =~ m|[^-]+-([^-]+)$|;   # split on dash
-                $sysroot = "@platforms[$#platforms]/arch-$1";
+                $sysroot = "@platforms[$#platforms]/arch-$arch";
+                $sysroot =~ m|/android-([0-9]+)/arch-$arch|;
+                $api = $1;
             }
             die "no sysroot=$sysroot"   if (!-d $sysroot);
 
-            $sysroot =~ m|/android-([0-9]+)/arch-(\w+)/?$|;
-            my ($api, $arch) = ($1, $2);
-
             my $triarch = $triplet{$arch};
             my $cflags;
             my $cppflags;
 
-            # see if there is NDK clang on $PATH
+            # see if there is NDK clang on $PATH, "universal" or "standalone"
             if (which("clang") =~ m|^$ndk/.*/prebuilt/([^/]+)/|) {
                 my $host=$1;
                 # harmonize with gcc default
@@ -76,10 +96,27 @@
                 (my $tridefault = $triarch) =~ s/^arm-/$arm-/;
                 (my $tritools   = $triarch) =~ s/(?:x|i6)86(_64)?-.*/x86$1/;
                 $cflags .= " -target $tridefault "
-                        .  "-gcc-toolchain \$(ANDROID_NDK)/toolchains"
+                        .  "-gcc-toolchain \$($ndk_var)/toolchains"
                         .  "/$tritools-4.9/prebuilt/$host";
                 $user{CC} = "clang" if ($user{CC} !~ m|clang|);
                 $user{CROSS_COMPILE} = undef;
+                if (which("llvm-ar") =~ m|^$ndk/.*/prebuilt/([^/]+)/|) {
+                    $user{AR} = "llvm-ar";
+                    $user{ARFLAGS} = [ "rs" ];
+                    $user{RANLIB} = ":";
+                }
+            } elsif (-f "$ndk/AndroidVersion.txt") {    #"standalone toolchain"
+                my $cc = $user{CC} // "clang";
+                # One can probably argue that both clang and gcc should be
+                # probed, but support for "standalone toolchain" was added
+                # *after* announcement that gcc is being phased out, so
+                # favouring clang is considered adequate. Those who insist
+                # have option to enforce test for gcc with CC=gcc.
+                if (which("$triarch-$cc") !~ m|^$ndk|) {
+                    die "no NDK $triarch-$cc on \$PATH";
+                }
+                $user{CC} = $cc;
+                $user{CROSS_COMPILE} = "$triarch-";
             } elsif ($user{CC} eq "clang") {
                 die "no NDK clang on \$PATH";
             } else {
@@ -96,13 +133,13 @@
                 die "no $incroot/$triarch" if (!-d "$incroot/$triarch");
                 $incroot =~ s|^$ndk/||;
                 $cppflags  = "-D__ANDROID_API__=$api";
-                $cppflags .= " -isystem \$(ANDROID_NDK)/$incroot/$triarch";
-                $cppflags .= " -isystem \$(ANDROID_NDK)/$incroot";
+                $cppflags .= " -isystem \$($ndk_var)/$incroot/$triarch";
+                $cppflags .= " -isystem \$($ndk_var)/$incroot";
             }
 
             $sysroot =~ s|^$ndk/||;
             $android_ndk = {
-                cflags   => "$cflags --sysroot=\$(ANDROID_NDK)/$sysroot",
+                cflags   => "$cflags --sysroot=\$($ndk_var)/$sysroot",
                 cppflags => $cppflags,
                 bn_ops   => $arch =~ m/64$/ ? "SIXTY_FOUR_BIT_LONG"
                                             : "BN_LLONG",
@@ -131,7 +168,8 @@ my %targets = (
         cppflags         => add(sub { android_ndk()->{cppflags} }),
         cxxflags         => add(sub { android_ndk()->{cflags} }),
         bn_ops           => sub { android_ndk()->{bn_ops} },
-        bin_cflags       => "-pie",
+        bin_cflags       => "-fPIE",
+        bin_lflags       => "-pie",
         enable           => [ ],
     },
     "android-arm" => {
@@ -162,18 +200,22 @@ my %targets = (
         # -march and/or -mfloat-abi flags. NDK defaults to armv5te.
         # Newer NDK versions reportedly require additional -latomic.
         #
-        inherit_from     => [ "android", asm("armv4_asm") ],
+        inherit_from     => [ "android" ],
         bn_ops           => add("RC4_CHAR"),
+        asm_arch         => 'armv4',
+        perlasm_scheme   => "void",
     },
     "android-arm64" => {
-        inherit_from     => [ "android", asm("aarch64_asm") ],
+        inherit_from     => [ "android" ],
         bn_ops           => add("RC4_CHAR"),
+        asm_arch         => 'aarch64',
         perlasm_scheme   => "linux64",
     },
 
     "android-mips" => {
-        inherit_from     => [ "android", asm("mips32_asm") ],
+        inherit_from     => [ "android" ],
         bn_ops           => add("RC4_CHAR"),
+        asm_arch         => 'mips32',
         perlasm_scheme   => "o32",
     },
     "android-mips64" => {
@@ -186,25 +228,28 @@ my %targets = (
         # with previous MIPS ISA versions, in sense that unlike
         # prior versions original MIPS binary code will fail.
         #
-        inherit_from     => [ "android", asm("mips64_asm") ],
+        inherit_from     => [ "android" ],
         bn_ops           => add("RC4_CHAR"),
+        asm_arch         => 'mips64',
         perlasm_scheme   => "64",
     },
 
     "android-x86" => {
-        inherit_from     => [ "android", asm("x86_asm") ],
+        inherit_from     => [ "android" ],
         CFLAGS           => add(picker(release => "-fomit-frame-pointer")),
         bn_ops           => add("RC4_INT"),
+        asm_arch         => 'x86',
         perlasm_scheme   => "android",
     },
     "android-x86_64" => {
-        inherit_from     => [ "android", asm("x86_64_asm") ],
+        inherit_from     => [ "android" ],
         bn_ops           => add("RC4_INT"),
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "elf",
     },
 
     ####################################################################
-    # Backward compatible targets, (might) requre $CROSS_SYSROOT
+    # Backward compatible targets, (might) require $CROSS_SYSROOT
     #
     "android-armeabi" => {
         inherit_from     => [ "android-arm" ],

Configurations/15-ios.conf

@@ -1,36 +1,38 @@
 #### iPhoneOS/iOS
 #
-# It takes recent enough XCode to use following two targets. It shouldn't
+# It takes recent enough Xcode to use following two targets. It shouldn't
 # be a problem by now, but if they don't work, original targets below
 # that depend on manual definition of environment variables should still
 # work...
 #
 my %targets = (
+    "ios-common" => {
+        template         => 1,
+        inherit_from     => [ "darwin-common" ],
+        sys_id           => "iOS",
+        disable          => [ "engine", "async" ],
+    },
     "ios-xcrun" => {
-        inherit_from     => [ "darwin-common", asm("armv4_asm") ],
+        inherit_from     => [ "ios-common" ],
         # It should be possible to go below iOS 6 and even add -arch armv6,
         # thus targeting iPhone pre-3GS, but it's assumed to be irrelevant
         # at this point.
         CC               => "xcrun -sdk iphoneos cc",
         cflags           => add("-arch armv7 -mios-version-min=6.0.0 -fno-common"),
-        sys_id           => "iOS",
+        asm_arch         => 'armv4',
         perlasm_scheme   => "ios32",
-        disable          => [ "engine" ],
     },
     "ios64-xcrun" => {
-        inherit_from     => [ "darwin-common", asm("aarch64_asm") ],
+        inherit_from     => [ "ios-common" ],
         CC               => "xcrun -sdk iphoneos cc",
         cflags           => add("-arch arm64 -mios-version-min=7.0.0 -fno-common"),
-        sys_id           => "iOS",
         bn_ops           => "SIXTY_FOUR_BIT_LONG RC4_CHAR",
+        asm_arch         => 'aarch64',
         perlasm_scheme   => "ios64",
-        disable          => [ "engine" ],
     },
     "iossimulator-xcrun" => {
-        inherit_from     => [ "darwin-common" ],
+        inherit_from     => [ "ios-common" ],
         CC               => "xcrun -sdk iphonesimulator cc",
-        sys_id           => "iOS",
-        disable          => [ "engine" ],
     },
 # It takes three prior-set environment variables to make it work:
 #
@@ -46,10 +48,8 @@ my %targets = (
 # CROSS_SDK=iPhoneOS.sdk
 #
     "iphoneos-cross" => {
-        inherit_from     => [ "darwin-common" ],
+        inherit_from     => [ "ios-common" ],
         cflags           => add("-isysroot \$(CROSS_TOP)/SDKs/\$(CROSS_SDK) -fno-common"),
-        sys_id           => "iOS",
-        disable          => [ "engine" ],
     },
     "ios-cross" => {
         inherit_from     => [ "ios-xcrun" ],

Configurations/50-djgpp.conf

@@ -4,7 +4,6 @@
 
 my %targets = (
     "DJGPP" => {
-        inherit_from     => [ asm("x86_asm") ],
         CC               => "gcc",
         CFLAGS           => "-fomit-frame-pointer -O2 -Wall",
         cflags           => "-I/dev/env/WATT_ROOT/inc -DTERMIOS -DL_ENDIAN",
@@ -12,6 +11,7 @@ my %targets = (
         lflags           => add("-L/dev/env/WATT_ROOT/lib"),
         ex_libs          => add("-lwatt"),
         bn_ops           => "BN_LLONG",
+        asm_arch         => 'x86',
         perlasm_scheme   => "a.out",
     },
 );

Configurations/50-haiku.conf

@@ -15,12 +15,14 @@ my %targets = (
         shared_target    => "gnu-shared",
         shared_cflag     => "-fPIC",
         shared_ldflag    => "-shared",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
+        perl_platform    => 'Unix',
     },
     "haiku-x86" => {
-        inherit_from     => [ "haiku-common", asm("x86_elf_asm") ],
+        inherit_from     => [ "haiku-common" ],
         CFLAGS           => add(picker(release => "-fomit-frame-pointer")),
         bn_ops           => "BN_LLONG",
+        asm_arch         => 'x86',
+        perlasm_scheme   => 'elf',
     },
     "haiku-x86_64" => {
         inherit_from     => [ "haiku-common" ],

Configurations/50-masm.conf

@@ -9,15 +9,14 @@
 
 my %targets = (
     "VC-WIN64A-masm" => {
-        inherit_from    => [ "VC-WIN64-common", asm("x86_64_asm"),
-                             sub { $disabled{shared} ? () : "x86_64_uplink" } ],
+        inherit_from    => [ "VC-WIN64-common" ],
         AS              => "ml64",
         ASFLAGS         => "/nologo /Zi",
         asoutflag       => "/Fo",
         asflags         => "/c /Cp /Cx",
         sys_id          => "WIN64A",
-        bn_asm_src      => sub { return undef unless @_;
-                                 my $r=join(" ",@_); $r=~s|asm/x86_64-gcc|bn_asm|; $r; },
+        uplink_arch      => 'x86_64',
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "masm",
     },
 );

Configurations/50-os390.conf

@@ -0,0 +1,11 @@
+## -*- mode: perl; -*-
+(
+# OS/390 Unix an EBCDIC-based Unix system on IBM mainframe
+    "OS390-Unix" => {
+        inherit_from     => [ "BASE_unix" ],
+        cc               => "cc",
+        cflags           => "-O -DB_ENDIAN -DCHARSET_EBCDIC",
+        bn_ops           => "THIRTY_TWO_BIT RC4_CHAR",
+        thread_scheme    => "(unknown)",
+    }
+);

Configurations/50-win-onecore.conf

@@ -1,15 +1,35 @@
+## -*- mode: perl; -*-
 # Windows OneCore targets.
 #
-# OneCore is new API stability "contract" that transends Desktop, IoT and
+# OneCore is new API stability "contract" that transcends Desktop, IoT and
 # Mobile[?] Windows editions. It's a set up "umbrella" libraries that
 # export subset of Win32 API that are common to all Windows 10 devices.
 #
-# OneCore Configuration temporarly dedicated for console applications 
+# OneCore Configuration temporarily dedicated for console applications
 # due to disabled event logging, which is incompatible with one core.
 # Error messages are provided via standard error only.
 # TODO: extend error handling to use ETW based eventing
 # (Or rework whole error messaging)
 
+my $UWP_info = {};
+sub UWP_info {
+    unless (%$UWP_info) {
+        my $SDKver = `powershell -Command  \"& {\$(Get-Item \\\"hklm:\\SOFTWARE\\WOW6432Node\\Microsoft\\Microsoft SDKs\\Windows\\\").GetValue(\\\"CurrentVersion\\\")}\"`;
+        $SDKver =~ s|\R$||;
+        my @SDKver_split = split(/\./, $SDKver);
+        # SDK version older than 10.0.17763 don't support our ASM builds
+        if ($SDKver_split[0] < 10
+            || ($SDKver_split[0] == 10
+                && $SDKver_split[1] == 0
+                && $SDKver_split[2] < 17763)) {
+            $UWP_info->{disable} = [ 'asm' ];
+        } else {
+            $UWP_info->{disable} = [ ];
+        }
+    }
+    return $UWP_info;
+}
+
 my %targets = (
     "VC-WIN32-ONECORE" => {
         inherit_from    => [ "VC-WIN32" ],
@@ -47,7 +67,7 @@ my %targets = (
         inherit_from    => [ "VC-noCE-common" ],
         defines         => add("_ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE",
                                "OPENSSL_SYS_WIN_CORE"),
-        bn_ops          => "BN_LLONG RC4_CHAR EXPORT_VAR_AS_FN",
+        bn_ops          => "BN_LLONG RC4_CHAR",
         lflags          => add("/NODEFAULTLIB:kernel32.lib"),
         ex_libs         => "onecore.lib",
         multilib        => "-arm",
@@ -56,9 +76,62 @@ my %targets = (
         inherit_from    => [ "VC-noCE-common" ],
         defines         => add("_ARM_WINAPI_PARTITION_DESKTOP_SDK_AVAILABLE",
                                "OPENSSL_SYS_WIN_CORE"),
-        bn_ops          => "SIXTY_FOUR_BIT RC4_CHAR EXPORT_VAR_AS_FN",
+        bn_ops          => "SIXTY_FOUR_BIT RC4_CHAR",
         lflags          => add("/NODEFAULTLIB:kernel32.lib"),
         ex_libs         => "onecore.lib",
         multilib        => "-arm64",
     },
+
+    # Universal Windows Platform (UWP) App Support
+
+    # TODO
+    #
+    # The 'disable' attribute should have 'uplink'.
+    # however, these are checked in some 'inherit_from', which is processed
+    # very early, before the 'disable' attributes are seen.
+    # This is a problem that needs to be resolved in Configure first.
+    #
+    # But if you want to build library with Windows 10 Version 1809 SDK or
+    # earlier, the 'disable' attribute should also have 'asm'.
+
+    "VC-WIN32-UWP" => {
+        inherit_from    => [ "VC-WIN32-ONECORE" ],
+        lflags          => add("/APPCONTAINER"),
+        defines         => add("WINAPI_FAMILY=WINAPI_FAMILY_APP",
+                               "_WIN32_WINNT=0x0A00"),
+        dso_scheme      => "",
+        disable         => sub { [ 'ui-console', 'stdio', 'async', 'uplink',
+                                   @{ UWP_info()->{disable} } ] },
+        ex_libs         => "WindowsApp.lib",
+    },
+     "VC-WIN64A-UWP" => {
+        inherit_from    => [ "VC-WIN64A-ONECORE" ],
+        lflags          => add("/APPCONTAINER"),
+        defines         => add("WINAPI_FAMILY=WINAPI_FAMILY_APP",
+                               "_WIN32_WINNT=0x0A00"),
+        dso_scheme      => "",
+        disable         => sub { [ 'ui-console', 'stdio', 'async', 'uplink',
+                                   @{ UWP_info()->{disable} } ] },
+        ex_libs         => "WindowsApp.lib",
+    },
+    "VC-WIN32-ARM-UWP" => {
+        inherit_from    => [ "VC-WIN32-ARM" ],
+        lflags          => add("/APPCONTAINER"),
+        defines         => add("WINAPI_FAMILY=WINAPI_FAMILY_APP",
+                               "_WIN32_WINNT=0x0A00"),
+        dso_scheme      => "",
+        disable         => sub { [ 'ui-console', 'stdio', 'async', 'uplink',
+                                   @{ UWP_info()->{disable} } ] },
+        ex_libs         => "WindowsApp.lib",
+    },
+     "VC-WIN64-ARM-UWP" => {
+        inherit_from    => [ "VC-WIN64-ARM" ],
+        lflags          => add("/APPCONTAINER"),
+        defines         => add("WINAPI_FAMILY=WINAPI_FAMILY_APP",
+                               "_WIN32_WINNT=0x0A00"),
+        dso_scheme      => "",
+        disable         => sub { [ 'ui-console', 'stdio', 'async', 'uplink',
+                                   @{ UWP_info()->{disable} } ] },
+        ex_libs         => "WindowsApp.lib",
+    },
 );

Configurations/90-team.norelease.conf

@@ -18,17 +18,18 @@ my %targets = (
     "debug-erbridge" => {
         inherit_from     => [ 'BASE_unix', "x86_64_asm" ],
         cc               => "gcc",
-        cflags           => combine("$gcc_devteam_warn -DBN_DEBUG -DCONF_DEBUG -m64 -DL_ENDIAN -DTERMIO -g",
+        cflags           => combine(join(' ', @gcc_devteam_warn),
+                                    "-DBN_DEBUG -DCONF_DEBUG -m64 -DL_ENDIAN -DTERMIO -g",
                                     threads("-D_REENTRANT")),
         ex_libs          => add(" ","-ldl"),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
         thread_scheme    => "pthreads",
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "elf",
         dso_scheme       => "dlfcn",
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
         shared_ldflag    => "-m64",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
         multilib         => "64",
     },
     "debug-linux-pentium" => {
@@ -38,6 +39,8 @@ my %targets = (
                                     threads("-D_REENTRANT")),
         ex_libs          => add(" ","-ldl"),
         bn_ops           => "BN_LLONG",
+        asm_arch         => 'x86',
+        perlasm_scheme   => 'elf',
         thread_scheme    => "pthreads",
         dso_scheme       => "dlfcn",
     },
@@ -48,58 +51,36 @@ my %targets = (
                                     threads("-D_REENTRANT")),
         ex_libs          => add(" ","-ldl"),
         bn_ops           => "BN_LLONG",
+        asm_arch         => 'x86',
+        perlasm_scheme   => 'elf',
         thread_scheme    => "pthreads",
         dso_scheme       => "dlfcn",
     },
-    "debug-linux-ia32-aes" => {
-        inherit_from     => [ 'BASE_unix' ],
-        cc               => "gcc",
-        cflags           => combine("-DL_ENDIAN -O3 -fomit-frame-pointer -Wall",
-                                    threads("-D_REENTRANT")),
-        ex_libs          => add(" ","-ldl"),
-        bn_ops           => "BN_LLONG",
-        cpuid_asm_src    => "x86cpuid.s",
-        bn_asm_src       => "bn-586.s co-586.s x86-mont.s",
-        des_asm_src      => "des-586.s crypt586.s",
-        aes_asm_src      => "aes_x86core.s aes_cbc.s aesni-x86.s",
-        bf_asm_src       => "bf-586.s",
-        md5_asm_src      => "md5-586.s",
-        sha1_asm_src     => "sha1-586.s sha256-586.s sha512-586.s",
-        cast_asm_src     => "cast-586.s",
-        rc4_asm_src      => "rc4-586.s",
-        rmd160_asm_src   => "rmd-586.s",
-        rc5_asm_src      => "rc5-586.s",
-        wp_asm_src       => "wp_block.s wp-mmx.s",
-        modes_asm_src    => "ghash-x86.s",
-        padlock_asm_src  => "e_padlock-x86.s",
-        thread_scheme    => "pthreads",
-        perlasm_scheme   => "elf",
-        dso_scheme       => "dlfcn",
-        shared_target    => "linux-shared",
-        shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
-    },
     "debug-test-64-clang" => {
         inherit_from     => [ 'BASE_unix', "x86_64_asm" ],
         cc               => "clang",
-        cflags           => combine("$gcc_devteam_warn -Wno-error=overlength-strings -Wno-error=extended-offsetof -Wno-error=language-extension-token -Wno-error=unused-const-variable -Wstrict-overflow -Qunused-arguments -DBN_DEBUG -DCONF_DEBUG -DDEBUG_SAFESTACK -DDEBUG_UNUSED -g3 -O3 -pipe",
+        cflags           => combine(join(' ', @gcc_devteam_warn),
+                                    "-Wno-error=overlength-strings -Wno-error=extended-offsetof -Wno-error=language-extension-token -Wno-error=unused-const-variable -Wstrict-overflow -Qunused-arguments -DBN_DEBUG -DCONF_DEBUG -DDEBUG_UNUSED -g3 -O3 -pipe",
                                     threads("${BSDthreads}")),
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
         thread_scheme    => "pthreads",
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "elf",
         dso_scheme       => "dlfcn",
         shared_target    => "bsd-gcc-shared",
         shared_cflag     => "-fPIC",
-        shared_extension => ".so.\$(SHLIB_VERSION_NUMBER)",
     },
     "darwin64-debug-test-64-clang" => {
         inherit_from     => [ 'BASE_unix', "x86_64_asm" ],
         cc               => "clang",
-        cflags           => combine("-arch x86_64 -DL_ENDIAN $gcc_devteam_warn -Wno-error=overlength-strings -Wno-error=extended-offsetof -Wno-error=language-extension-token -Wno-error=unused-const-variable -Wstrict-overflow -Qunused-arguments -DBN_DEBUG -DCONF_DEBUG -DDEBUG_SAFESTACK -DDEBUG_UNUSED -g3 -O3 -pipe",
+        cflags           => combine("-arch x86_64 -DL_ENDIAN",
+                                    join(' ', @gcc_devteam_warn),
+                                    "-Wno-error=overlength-strings -Wno-error=extended-offsetof -Wno-error=language-extension-token -Wno-error=unused-const-variable -Wstrict-overflow -Qunused-arguments -DBN_DEBUG -DCONF_DEBUG -DDEBUG_UNUSED -g3 -O3 -pipe",
                                     threads("${BSDthreads}")),
         sys_id           => "MACOSX",
         bn_ops           => "SIXTY_FOUR_BIT_LONG",
         thread_scheme    => "pthreads",
+        asm_arch         => 'x86_64',
         perlasm_scheme   => "macosx",
         dso_scheme       => "dlfcn",
         shared_target    => "darwin-shared",

Configurations/README

@@ -118,7 +118,7 @@ In each table entry, the following keys are significant:
                            '<unistd.h>'.  This is very rarely needed.
 
         shared_extension => File name extension used for shared
-                            libraries. 
+                            libraries.
         obj_extension   => File name extension used for object files.
                            On unix, this defaults to ".o" (NOTE: this
                            is here for future use, it's not
@@ -159,17 +159,31 @@ In each table entry, the following keys are significant:
                            below [2].
         dso_scheme      => The type of dynamic shared objects to build
                            for.  This mostly comes into play with
-                           engines, but can be used for other purposes
+                           modules, but can be used for other purposes
                            as well.  Valid values are "DLFCN"
                            (dlopen() et al), "DLFCN_NO_H" (for systems
                            that use dlopen() et al but do not have
                            fcntl.h), "DL" (shl_load() et al), "WIN32"
                            and "VMS".
+        asm_arch        => The architecture to be used for compiling assembly
+                           source.  This acts as a selector in build.info files.
+        uplink_arch     => The architecture to be used for compiling uplink
+                           source.  This acts as a selector in build.info files.
+                           This is separate from asm_arch because it's compiled
+                           even when 'no-asm' is given, even though it contains
+                           assembler source.
         perlasm_scheme  => The perlasm method used to create the
                            assembler files used when compiling with
                            assembler implementations.
         shared_target   => The shared library building method used.
-                           This is a target found in Makefile.shared.
+                           This serves multiple purposes:
+                           - as index for targets found in shared_info.pl.
+                           - as linker script generation selector.
+                           To serve both purposes, the index for shared_info.pl
+                           should end with '-shared', and this suffix will be
+                           removed for use as a linker script generation
+                           selector.  Note that the latter is only used if
+                           'shared_defflag' is defined.
         build_scheme    => The scheme used to build up a Makefile.
                            In its simplest form, the value is a string
                            with the name of the build scheme.
@@ -222,63 +236,6 @@ In each table entry, the following keys are significant:
                                                 up of 'unsigned char's;
                            RC4_INT              RC4 key schedule is made
                                                 up of 'unsigned int's;
-                           EXPORT_VAR_AS_FN     for shared libraries,
-                                                export vars as
-                                                accessor functions.
-
-        apps_aux_src    => Extra source to build apps/openssl and other
-                           apps, as needed by the target and that can be
-                           collected in a library.
-        apps_init_src   => Init source to build apps/openssl and other
-                           apps, as needed by the target.  This code
-                           cannot be placed in a library, as the rest
-                           of the code isn't expected to link to it
-                           explicitely.
-        cpuid_asm_src   => assembler implementation of cpuid code as
-                           well as OPENSSL_cleanse().
-                           Default to mem_clr.c
-        bn_asm_src      => Assembler implementation of core bignum
-                           functions.
-                           Defaults to bn_asm.c
-        ec_asm_src      => Assembler implementation of core EC
-                           functions.
-        des_asm_src     => Assembler implementation of core DES
-                           encryption functions.
-                           Defaults to 'des_enc.c fcrypt_b.c'
-        aes_asm_src     => Assembler implementation of core AES
-                           functions.
-                           Defaults to 'aes_core.c aes_cbc.c'
-        bf_asm_src      => Assembler implementation of core BlowFish
-                           functions.
-                           Defaults to 'bf_enc.c'
-        md5_asm_src     => Assembler implementation of core MD5
-                           functions.
-        sha1_asm_src    => Assembler implementation of core SHA1,
-                           functions, and also possibly SHA256 and
-                           SHA512 ones.
-        cast_asm_src    => Assembler implementation of core CAST
-                           functions.
-                           Defaults to 'c_enc.c'
-        rc4_asm_src     => Assembler implementation of core RC4
-                           functions.
-                           Defaults to 'rc4_enc.c rc4_skey.c'
-        rmd160_asm_src  => Assembler implementation of core RMD160
-                           functions.
-        rc5_asm_src     => Assembler implementation of core RC5
-                           functions.
-                           Defaults to 'rc5_enc.c'
-        wp_asm_src      => Assembler implementation of core WHIRLPOOL
-                           functions.
-        cmll_asm_src    => Assembler implementation of core CAMELLIA
-                           functions.
-                           Defaults to 'camellia.c cmll_misc.c cmll_cbc.c'
-        modes_asm_src   => Assembler implementation of cipher modes,
-                           currently the functions gcm_gmult_4bit and
-                           gcm_ghash_4bit.
-        padlock_asm_src => Assembler implementation of core parts of
-                           the padlock engine.  This is mandatory on
-                           any platform where the padlock engine might
-                           actually be built.
 
 
 [1] as part of the target configuration, one can have a key called
@@ -343,7 +300,7 @@ In each table entry, the following keys are significant:
 
     - shared libraries; that would be libcrypto and libssl.
     - shared objects (sometimes called dynamic libraries);  that would
-      be the engines.
+      be the modules.
     - applications; those are apps/openssl and all the test apps.
 
     Very roughly speaking, linking is done like this (words in braces
@@ -393,16 +350,21 @@ $sourcedir and $builddir, which are the locations of the source
 directory for the current build.info file and the corresponding build
 directory, all relative to the top of the build tree.
 
-To begin with, things to be built are declared by setting specific
+'Configure' only knows inherently about the top build.info file.  For
+any other directory that has one, further directories to look into
+must be indicated like this:
+
+    SUBDIRS=something someelse
+
+On to things to be built; they are declared by setting specific
 variables:
 
     PROGRAMS=foo bar
     LIBS=libsomething
-    ENGINES=libeng
+    MODULES=libeng
     SCRIPTS=myhack
-    EXTRA=file1 file2
 
-Note that the files mentioned for PROGRAMS, LIBS and ENGINES *must* be
+Note that the files mentioned for PROGRAMS, LIBS and MODULES *must* be
 without extensions.  The build file templates will figure them out.
 
 For each thing to be built, it is then possible to say what sources
@@ -433,23 +395,6 @@ support building static libraries and DLLs at the same time, so using
 static libraries on Windows can only be done when configured
 'no-shared'.
 
-One some platforms, shared libraries come with a name that's different
-from their static counterpart.  That's declared as follows:
-
-    SHARED_NAME[libfoo]=cygfoo-{- $config{shlibver} -}
-
-The example is from Cygwin, which has a required naming convention.
-
-Sometimes, it makes sense to rename an output file, for example a
-library:
-
-    RENAME[libfoo]=libbar
-
-That line has "libfoo" renamed to "libbar".  While it makes no
-sense at all to just have a rename like that (why not just use
-"libbar" everywhere?), it does make sense when it can be used
-conditionally.  See a little further below for an example.
-
 In some cases, it's desirable to include some source files in the
 shared form of a library only:
 
@@ -460,6 +405,10 @@ include paths the build of their source files should use:
 
     INCLUDE[foo]=include
 
+It's also possible to specify C macros that should be defined:
+
+    DEFINE[foo]=FOO BAR=1
+
 In some cases, one might want to generate some source files from
 others, that's done as follows:
 
@@ -486,48 +435,6 @@ be used in that case:
 
 NOTE: GENERATE lines are limited to one command only per GENERATE.
 
-As a last resort, it's possible to have raw build file lines, between
-BEGINRAW and ENDRAW lines as follows:
-
-    BEGINRAW[Makefile(unix)]
-    haha.h: {- $builddir -}/Makefile
-        echo "/* haha */" > haha.h
-    ENDRAW[Makefile(unix)]
-
-The word within square brackets is the build_file configuration item
-or the build_file configuration item followed by the second word in the
-build_scheme configuration item for the configured target within
-parenthesis as shown above.  For example, with the following relevant
-configuration items:
-
-   build_file   => "build.ninja"
-   build_scheme => [ "unified", "unix" ]
-
-... these lines will be considered:
-
-   BEGINRAW[build.ninja]
-   build haha.h: echo "/* haha */" > haha.h
-   ENDRAW[build.ninja]
-
-   BEGINRAW[build.ninja(unix)]
-   build hoho.h: echo "/* hoho */" > hoho.h
-   ENDRAW[build.ninja(unix)]
-
-Should it be needed because the recipes within a RAW section might
-clash with those generated by Configure, it's possible to tell it
-not to generate them with the use of OVERRIDES, for example:
-
-    SOURCE[libfoo]=foo.c bar.c
-    
-    OVERRIDES=bar.o
-    BEGINRAW[Makefile(unix)]
-    bar.o: bar.c
-    	$(CC) $(CFLAGS) -DSPECIAL -c -o $@ $<
-    ENDRAW[Makefile(unix)]
-
-See the documentation further up for more information on configuration
-items.
-
 Finally, you can have some simple conditional use of the build.info
 information, looking like this:
 
@@ -554,15 +461,6 @@ conditions based on something in the passed variables, for example:
       SOURCE[libfoo]=...
     ENDIF
 
-or:
-
-    # VMS has a cultural standard where all libraries are prefixed.
-    # For OpenSSL, the choice is 'ossl_'
-    IF[{- $config{target} =~ /^vms/ -}]
-     RENAME[libcrypto]=ossl_libcrypto
-     RENAME[libssl]=ossl_libssl
-    ENDIF
-
 
 Build-file programming with the "unified" build system
 ======================================================
@@ -636,8 +534,9 @@ They are all expected to return a string with the lines they produce.
                                 incs => [ "INCL/PATH", ... ]
                                 intent => one of "lib", "dso", "bin" );
 
-                  'obj' has the intended object file *without*
-                  extension, src2obj() is expected to add that.
+                  'obj' has the intended object file with '.o'
+                  extension, src2obj() is expected to change it to
+                  something more suitable for the platform.
                   'srcs' has the list of source files to build the
                   object file, with the first item being the source
                   file that directly corresponds to the object file.
@@ -657,33 +556,36 @@ They are all expected to return a string with the lines they produce.
 
                   'lib' has the intended library file name *without*
                   extension, obj2lib is expected to add that.  'objs'
-                  has the list of object files (also *without*
-                  extension) to build this library.
+                  has the list of object files to build this library.
 
-    libobj2shlib - function that produces build file lines to build a
+    libobj2shlib - backward compatibility function that's used the
+                  same way as obj2shlib (described next), and was
+                  expected to build the shared library from the
+                  corresponding static library when that was suitable.
+                  NOTE: building a shared library from a static
+                  library is now DEPRECATED, as they no longer share
+                  object files.  Attempting to do this will fail.
+
+    obj2shlib   - function that produces build file lines to build a
                   shareable object library file ("libfoo.so" in Unix
-                  terms) from the corresponding static library file
-                  or object files.
+                  terms) from the corresponding object files.
 
                   called like this:
 
-                        libobj2shlib(shlib => "PATH/TO/shlibfile",
-                                     lib => "PATH/TO/libfile",
-                                     objs => [ "PATH/TO/objectfile", ... ],
-                                     deps => [ "PATH/TO/otherlibfile", ... ]);
+                        obj2shlib(shlib => "PATH/TO/shlibfile",
+                                  lib => "PATH/TO/libfile",
+                                  objs => [ "PATH/TO/objectfile", ... ],
+                                  deps => [ "PATH/TO/otherlibfile", ... ]);
 
-                  'lib' has the intended library file name *without*
-                  extension, libobj2shlib is expected to add that.
+                  'lib' has the base (static) library ffile name
+                  *without* extension.  This is useful in case
+                  supporting files are needed (such as import
+                  libraries on Windows).
                   'shlib' has the corresponding shared library name
                   *without* extension.  'deps' has the list of other
                   libraries (also *without* extension) this library
                   needs to be linked with.  'objs' has the list of
-                  object files (also *without* extension) to build
-                  this library.
-
-                  This function has a choice; it can use the
-                  corresponding static library as input to make the
-                  shared library, or the list of object files.
+                  object files to build this library.
 
     obj2dso     - function that produces build file lines to build a
                   dynamic shared object file from object files.
@@ -695,12 +597,9 @@ They are all expected to return a string with the lines they produce.
                                 deps => [ "PATH/TO/otherlibfile",
                                 ... ]);
 
-                  This is almost the same as libobj2shlib, but the
+                  This is almost the same as obj2shlib, but the
                   intent is to build a shareable library that can be
-                  loaded in runtime (a "plugin"...).  The differences
-                  are subtle, one of the most visible ones is that the
-                  resulting shareable library is produced from object
-                  files only.
+                  loaded in runtime (a "plugin"...).
 
     obj2bin     - function that produces build file lines to build an
                   executable file from object files.
@@ -713,11 +612,10 @@ They are all expected to return a string with the lines they produce.
 
                   'bin' has the intended executable file name
                   *without* extension, obj2bin is expected to add
-                  that.  'objs' has the list of object files (also
-                  *without* extension) to build this library.  'deps'
-                  has the list of library files (also *without*
-                  extension) that the programs needs to be linked
-                  with.
+                  that.  'objs' has the list of object files to build
+                  this library.  'deps' has the list of library files
+                  (also *without* extension) that the programs needs
+                  to be linked with.
 
     in2script   - function that produces build file lines to build a
                   script file from some input.

Configurations/README.design

@@ -36,22 +36,23 @@ in build.info.  Their file name extensions will be inferred by the
 build-file templates, adapted for the platform they are meant for (see
 sections on %unified_info and build-file templates further down).
 
-The variables PROGRAMS, LIBS, ENGINES and SCRIPTS are used to declare
+The variables PROGRAMS, LIBS, MODULES and SCRIPTS are used to declare
 end products.  There are variants for them with '_NO_INST' as suffix
 (PROGRAM_NO_INST etc) to specify end products that shouldn't get
 installed.
 
-The variables SOURCE, DEPEND and INCLUDE are indexed by a produced
-file, and their values are the source used to produce that particular
-produced file, extra dependencies, and include directories needed.
+The variables SOURCE, DEPEND, INCLUDE and DEFINE are indexed by a
+produced file, and their values are the source used to produce that
+particular produced file, extra dependencies, include directories
+needed, or C macros to be defined.
 
 All their values in all the build.info throughout the source tree are
-collected together and form a set of programs, libraries, engines and
+collected together and form a set of programs, libraries, modules and
 scripts to be produced, source files, dependencies, etc etc etc.
 
 Let's have a pretend example, a very limited contraption of OpenSSL,
 composed of the program 'apps/openssl', the libraries 'libssl' and
-'libcrypto', an engine 'engines/ossltest' and their sources and
+'libcrypto', an module 'engines/ossltest' and their sources and
 dependencies.
 
     # build.info
@@ -86,7 +87,7 @@ depends on the library 'libssl' to function properly.
     LIBS=../libcrypto
     SOURCE[../libcrypto]=aes.c evp.c cversion.c
     DEPEND[cversion.o]=buildinf.h
-    
+
     GENERATE[buildinf.h]=../util/mkbuildinf.pl "$(CC) $(CFLAGS)" "$(PLATFORM)"
     DEPEND[buildinf.h]=../Makefile
     DEPEND[../util/mkbuildinf.pl]=../util/Foo.pm
@@ -101,7 +102,7 @@ show that duplicate information isn't an issue.
 This build.info file informs us that 'libcrypto' is built from a few
 source files, 'crypto/aes.c', 'crypto/evp.c' and 'crypto/cversion.c'.
 It also shows us that building the object file inferred from
-'crypto/cversion.c' depends on 'crypto/buildinf.h'.  Finally, it 
+'crypto/cversion.c' depends on 'crypto/buildinf.h'.  Finally, it
 also shows the possibility to declare how some files are generated
 using some script, in this case a perl script, and how such scripts
 can be declared to depend on other files, in this case a perl module.
@@ -111,9 +112,6 @@ Two things are worth an extra note:
 'DEPEND[cversion.o]' mentions an object file.  DEPEND indexes is the
 only location where it's valid to mention them
 
-Lines in 'BEGINRAW'..'ENDRAW' sections must always mention files as
-seen from the top directory, no exception.
-
     # ssl/build.info
     LIBS=../libssl
     SOURCE[../libssl]=tls.c
@@ -122,22 +120,22 @@ This is the build.info file in 'ssl/', and it tells us that the
 library 'libssl' is built from the source file 'ssl/tls.c'.
 
     # engines/build.info
-    ENGINES=dasync
+    MODULES=dasync
     SOURCE[dasync]=e_dasync.c
     DEPEND[dasync]=../libcrypto
     INCLUDE[dasync]=../include
 
-    ENGINES_NO_INST=ossltest
+    MODULES_NO_INST=ossltest
     SOURCE[ossltest]=e_ossltest.c
     DEPEND[ossltest]=../libcrypto.a
     INCLUDE[ossltest]=../include
 
-This is the build.info file in 'engines/', telling us that two engines
+This is the build.info file in 'engines/', telling us that two modules
 called 'engines/dasync' and 'engines/ossltest' shall be built, that
 dasync's source is 'engines/e_dasync.c' and ossltest's source is
 'engines/e_ossltest.c' and that the include directory 'include/' may
-be used when building anything that will be part of these engines.
-Also, both engines depend on the library 'libcrypto' to function
+be used when building anything that will be part of these modules.
+Also, both modules depend on the library 'libcrypto' to function
 properly.  ossltest is explicitly linked with the static variant of
 the library 'libcrypto'.  Finally, only dasync is being installed, as
 ossltest is only for internal testing.
@@ -152,22 +150,22 @@ information comes down to this:
     SOURCE[libssl]=ssl/tls.c
     INCLUDE[libssl]=include
     DEPEND[libssl]=libcrypto
-    
+
     PROGRAMS=apps/openssl
     SOURCE[apps/openssl]=apps/openssl.c
     INCLUDE[apps/openssl]=. include
     DEPEND[apps/openssl]=libssl
 
-    ENGINES=engines/dasync
+    MODULES=engines/dasync
     SOURCE[engines/dasync]=engines/e_dasync.c
     DEPEND[engines/dasync]=libcrypto
     INCLUDE[engines/dasync]=include
 
-    ENGINES_NO_INST=engines/ossltest
+    MODULES_NO_INST=engines/ossltest
     SOURCE[engines/ossltest]=engines/e_ossltest.c
     DEPEND[engines/ossltest]=libcrypto.a
     INCLUDE[engines/ossltest]=include
-    
+
     GENERATE[crypto/buildinf.h]=util/mkbuildinf.pl "$(CC) $(CFLAGS)" "$(PLATFORM)"
     DEPEND[crypto/buildinf.h]=Makefile
     DEPEND[util/mkbuildinf.pl]=util/Foo.pm
@@ -179,10 +177,10 @@ LIBS may be used to declare routine libraries only.
 
 PROGRAMS may be used to declare programs only.
 
-ENGINES may be used to declare engines only.
+MODULES may be used to declare modules only.
 
 The indexes for SOURCE must only be end product files, such as
-libraries, programs or engines.  The values of SOURCE variables must
+libraries, programs or modules.  The values of SOURCE variables must
 only be source files (possibly generated).
 
 INCLUDE and DEPEND shows a relationship between different files
@@ -211,8 +209,8 @@ indexes:
                pairs.  These are directly inferred from the DEPEND
                variables in build.info files.
 
-  engines   => a list of engines.  These are directly inferred from
-               the ENGINES variable in build.info files.
+  modules   => a list of modules.  These are directly inferred from
+               the MODULES variable in build.info files.
 
   generate  => a hash table containing 'file' => [ 'generator' ... ]
                pairs.  These are directly inferred from the GENERATE
@@ -223,7 +221,7 @@ indexes:
                variables in build.info files.
 
   install   => a hash table containing 'type' => [ 'file' ... ] pairs.
-               The types are 'programs', 'libraries', 'engines' and
+               The types are 'programs', 'libraries', 'modules' and
                'scripts', and the array of files list the files of
                that type that should be installed.
 
@@ -233,11 +231,6 @@ indexes:
   programs  => a list of programs.  These are directly inferred from
                the PROGRAMS variable in build.info files.
 
-  rawlines  => a list of build-file lines.  These are a direct copy of
-               the BEGINRAW..ENDRAW lines in build.info files.  Note:
-               only the BEGINRAW..ENDRAW section for the current
-               platform are copied, the rest are ignored.
-
   scripts   => a list of scripts.  There are directly inferred from
                the SCRIPTS variable in build.info files.
 
@@ -287,7 +280,7 @@ section above would be digested into a %unified_info table:
                         "util/Foo.pm",
                     ],
             },
-        "engines" =>
+        "modules" =>
             [
                 "engines/dasync",
                 "engines/ossltest",
@@ -328,7 +321,7 @@ section above would be digested into a %unified_info table:
             }
         "install" =>
             {
-                "engines" =>
+                "modules" =>
                     [
                         "engines/dasync",
                     ],
@@ -351,9 +344,6 @@ section above would be digested into a %unified_info table:
             [
                 "apps/openssl",
             ],
-        "rawlines" =>
-            [
-            ],
         "sources" =>
             {
                 "apps/openssl" =>
@@ -471,8 +461,9 @@ etc.
                                 incs => [ "INCL/PATH", ... ]
                                 intent => one of "lib", "dso", "bin" );
 
-                  'obj' has the intended object file *without*
-                  extension, src2obj() is expected to add that.
+                  'obj' has the intended object file with '.o'
+                  extension, src2obj() is expected to change it to
+                  something more suitable for the platform.
                   'srcs' has the list of source files to build the
                   object file, with the first item being the source
                   file that directly corresponds to the object file.
@@ -492,51 +483,50 @@ etc.
 
                   'lib' has the intended library file name *without*
                   extension, obj2lib is expected to add that.  'objs'
-                  has the list of object files (also *without*
-                  extension) to build this library.
+                  has the list of object files to build this library.
 
-    libobj2shlib - function that produces build file lines to build a
+    libobj2shlib - backward compatibility function that's used the
+                  same way as obj2shlib (described next), and was
+                  expected to build the shared library from the
+                  corresponding static library when that was suitable.
+                  NOTE: building a shared library from a static
+                  library is now DEPRECATED, as they no longer share
+                  object files.  Attempting to do this will fail.
+
+    obj2shlib   - function that produces build file lines to build a
                   shareable object library file ("libfoo.so" in Unix
-                  terms) from the corresponding static library file
-                  or object files.
+                  terms) from the corresponding object files.
 
                   called like this:
 
-                        libobj2shlib(shlib => "PATH/TO/shlibfile",
-                                     lib => "PATH/TO/libfile",
-                                     objs => [ "PATH/TO/objectfile", ... ],
-                                     deps => [ "PATH/TO/otherlibfile", ... ]);
+                        obj2shlib(shlib => "PATH/TO/shlibfile",
+                                  lib => "PATH/TO/libfile",
+                                  objs => [ "PATH/TO/objectfile", ... ],
+                                  deps => [ "PATH/TO/otherlibfile", ... ]);
 
-                  'lib' has the intended library file name *without*
-                  extension, libobj2shlib is expected to add that.
+                  'lib' has the base (static) library file name
+                  *without* extension.  This is useful in case
+                  supporting files are needed (such as import
+                  libraries on Windows).
                   'shlib' has the corresponding shared library name
                   *without* extension.  'deps' has the list of other
                   libraries (also *without* extension) this library
                   needs to be linked with.  'objs' has the list of
-                  object files (also *without* extension) to build
-                  this library.
+                  object files to build this library.
 
-                  This function has a choice; it can use the
-                  corresponding static library as input to make the
-                  shared library, or the list of object files.
-
-    obj2dynlib  - function that produces build file lines to build a
-                  dynamically loadable library file ("libfoo.so" on
-                  Unix) from object files.
+    obj2dso     - function that produces build file lines to build a
+                  dynamic shared object file from object files.
 
                   called like this:
 
-                        obj2dynlib(lib => "PATH/TO/libfile",
-                                   objs => [ "PATH/TO/objectfile", ... ],
-                                   deps => [ "PATH/TO/otherlibfile",
-                                   ... ]);
+                        obj2dso(lib => "PATH/TO/libfile",
+                                objs => [ "PATH/TO/objectfile", ... ],
+                                deps => [ "PATH/TO/otherlibfile",
+                                ... ]);
 
-                  This is almost the same as libobj2shlib, but the
+                  This is almost the same as obj2shlib, but the
                   intent is to build a shareable library that can be
-                  loaded in runtime (a "plugin"...).  The differences
-                  are subtle, one of the most visible ones is that the
-                  resulting shareable library is produced from object
-                  files only.
+                  loaded in runtime (a "plugin"...).
 
     obj2bin     - function that produces build file lines to build an
                   executable file from object files.
@@ -549,11 +539,10 @@ etc.
 
                   'bin' has the intended executable file name
                   *without* extension, obj2bin is expected to add
-                  that.  'objs' has the list of object files (also
-                  *without* extension) to build this library.  'deps'
-                  has the list of library files (also *without*
-                  extension) that the programs needs to be linked
-                  with.
+                  that.  'objs' has the list of object files to build
+                  this library.  'deps' has the list of library files
+                  (also *without* extension) that the programs needs
+                  to be linked with.
 
     in2script   - function that produces build file lines to build a
                   script file from some input.
@@ -567,7 +556,7 @@ etc.
                   'sources' has the list of source files to build the
                   resulting script from.
 
-Along with the build-file templates is the driving engine
+Along with the build-file templates is the driving template
 Configurations/common.tmpl, which looks through all the information in
 %unified_info and generates all the rulesets to build libraries,
 programs and all intermediate files, using the rule generating
@@ -577,34 +566,30 @@ As an example with the smaller build.info set we've seen as an
 example, producing the rules to build 'libcrypto' would result in the
 following calls:
 
-    # Note: libobj2shlib will only be called if shared libraries are
+    # Note: obj2shlib will only be called if shared libraries are
     # to be produced.
-    # Note 2: libobj2shlib gets both the name of the static library
-    # and the names of all the object files that go into it.  It's up
-    # to the implementation to decide which to use as input.
-    # Note 3: common.tmpl peals off the ".o" extension from all object
-    # files, as the platform at hand may have a different one.
-    libobj2shlib(shlib => "libcrypto",
-                 lib => "libcrypto",
-                 objs => [ "crypto/aes", "crypto/evp", "crypto/cversion" ],
-                 deps => [  ]);
+    # Note 2: obj2shlib must convert the '.o' extension to whatever
+    # is suitable on the local platform.
+    obj2shlib(shlib => "libcrypto",
+              objs => [ "crypto/aes.o", "crypto/evp.o", "crypto/cversion.o" ],
+              deps => [  ]);
 
     obj2lib(lib => "libcrypto"
-            objs => [ "crypto/aes", "crypto/evp", "crypto/cversion" ]);
+            objs => [ "crypto/aes.o", "crypto/evp.o", "crypto/cversion.o" ]);
 
-    src2obj(obj => "crypto/aes"
+    src2obj(obj => "crypto/aes.o"
             srcs => [ "crypto/aes.c" ],
             deps => [ ],
             incs => [ "include" ],
             intent => "lib");
 
-    src2obj(obj => "crypto/evp"
+    src2obj(obj => "crypto/evp.o"
             srcs => [ "crypto/evp.c" ],
             deps => [ ],
             incs => [ "include" ],
             intent => "lib");
 
-    src2obj(obj => "crypto/cversion"
+    src2obj(obj => "crypto/cversion.o"
             srcs => [ "crypto/cversion.c" ],
             deps => [ "crypto/buildinf.h" ],
             incs => [ "include" ],

Configurations/common.tmpl

@@ -2,37 +2,99 @@
 
  use File::Basename;
 
+ my $debug_resolvedepends = $ENV{BUILDFILE_DEBUG_DEPENDS};
+ my $debug_rules = $ENV{BUILDFILE_DEBUG_RULES};
+
  # A cache of objects for which a recipe has already been generated
  my %cache;
 
- # resolvedepends and reducedepends work in tandem to make sure
- # there are no duplicate dependencies and that they are in the
- # right order.  This is especially used to sort the list of
- # libraries that a build depends on.
+ # collectdepends, expanddepends and reducedepends work together to make
+ # sure there are no duplicate or weak dependencies and that they are in
+ # the right order.  This is used to sort the list of libraries  that a
+ # build depends on.
  sub extensionlesslib {
      my @result = map { $_ =~ /(\.a)?$/; $` } @_;
      return @result if wantarray;
      return $result[0];
  }
- sub resolvedepends {
+
+ # collectdepends dives into the tree of dependencies and returns
+ # a list of all the non-weak ones.
+ sub collectdepends {
+     return () unless @_;
+
      my $thing = shift;
      my $extensionlessthing = extensionlesslib($thing);
      my @listsofar = @_;    # to check if we're looping
      my @list = @{$unified_info{depends}->{$thing} //
                       $unified_info{depends}->{$extensionlessthing}};
      my @newlist = ();
-     if (scalar @list) {
-         foreach my $item (@list) {
-             my $extensionlessitem = extensionlesslib($item);
-             # It's time to break off when the dependency list starts looping
-             next if grep { extensionlesslib($_) eq $extensionlessitem } @listsofar;
-             push @newlist, $item, resolvedepends($item, @listsofar, $item);
-         }
+
+     print STDERR "DEBUG[collectdepends] $thing > ", join(' ', @listsofar), "\n"
+         if $debug_resolvedepends;
+     foreach my $item (@list) {
+         my $extensionlessitem = extensionlesslib($item);
+         # It's time to break off when the dependency list starts looping
+         next if grep { extensionlesslib($_) eq $extensionlessitem } @listsofar;
+         # Don't add anything here if the dependency is weak
+         next if defined $unified_info{attributes}->{depends}->{$thing}->{$item}->{'weak'};
+         my @resolved = collectdepends($item, @listsofar, $item);
+         push @newlist, $item, @resolved;
      }
+     print STDERR "DEBUG[collectdepends] $thing < ", join(' ', @newlist), "\n"
+         if $debug_resolvedepends;
      @newlist;
  }
+
+ # expanddepends goes through a list of stuff, checks if they have any
+ # dependencies, and adds them at the end of the current position if
+ # they aren't already present later on.
+ sub expanddepends {
+     my @after = ( @_ );
+     print STDERR "DEBUG[expanddepends]> ", join(' ', @after), "\n"
+         if $debug_resolvedepends;
+     my @before = ();
+     while (@after) {
+         my $item = shift @after;
+         print STDERR "DEBUG[expanddepends]\\  ", join(' ', @before), "\n"
+             if $debug_resolvedepends;
+         print STDERR "DEBUG[expanddepends] - ", $item, "\n"
+             if $debug_resolvedepends;
+         my @middle = (
+             $item,
+             map {
+                 my $x = $_;
+                 my $extlessx = extensionlesslib($x);
+                 if (grep { $extlessx eq extensionlesslib($_) } @before
+                     and
+                     !grep { $extlessx eq extensionlesslib($_) } @after) {
+                     print STDERR "DEBUG[expanddepends] + ", $x, "\n"
+                         if $debug_resolvedepends;
+                     ( $x )
+                 } else {
+                     print STDERR "DEBUG[expanddepends] ! ", $x, "\n"
+                         if $debug_resolvedepends;
+                     ()
+                 }
+             } @{$unified_info{depends}->{$item} // []}
+         );
+         print STDERR "DEBUG[expanddepends] = ", join(' ', @middle), "\n"
+             if $debug_resolvedepends;
+         print STDERR "DEBUG[expanddepends]/  ", join(' ', @after), "\n"
+             if $debug_resolvedepends;
+         push @before, @middle;
+     }
+     print STDERR "DEBUG[expanddepends]< ", join(' ', @before), "\n"
+         if $debug_resolvedepends;
+     @before;
+ }
+
+ # reducedepends looks through a list, and checks if each item is
+ # repeated later on.  If it is, the earlier copy is dropped.
  sub reducedepends {
      my @list = @_;
+     print STDERR "DEBUG[reducedepends]> ", join(' ', @list), "\n"
+         if $debug_resolvedepends;
      my @newlist = ();
      my %replace = ();
      while (@list) {
@@ -49,19 +111,25 @@
              push @newlist, $item;
          }
      }
-     map { $replace{$_} // $_; } @newlist;
+     @newlist = map { $replace{$_} // $_; } @newlist;
+     print STDERR "DEBUG[reducedepends]< ", join(' ', @newlist), "\n"
+         if $debug_resolvedepends;
+     @newlist;
  }
 
- # is_installed checks if a given file will be installed (i.e. they are
- # not defined _NO_INST in build.info)
- sub is_installed {
-     my $product = shift;
-     if (grep { $product eq $_ }
-         map { (@{$unified_info{install}->{$_}}) }
-         keys %{$unified_info{install}}) {
-         return 1;
-     }
-     return 0;
+ # Do it all
+ # This takes multiple inputs and combine them into a single list of
+ # interdependent things.  The returned value will include all the input.
+ # Callers are responsible for taking away the things they are building.
+ sub resolvedepends {
+     print STDERR "DEBUG[resolvedepends] START (", join(', ', @_), ")\n"
+         if $debug_resolvedepends;
+     my @all =
+         reducedepends(expanddepends(map { ( $_, collectdepends($_) ) } @_));
+     print STDERR "DEBUG[resolvedepends] END (", join(', ', @_), ") : ",
+         join(',', map { "\n    $_" } @all), "\n"
+         if $debug_resolvedepends;
+     @all;
  }
 
  # dogenerate is responsible for producing all the recipes that build
@@ -78,11 +146,23 @@
              if ref $unified_info{generate}->{$src} eq "";
          my $script = $unified_info{generate}->{$src}->[0];
          $OUT .= generatesrc(src => $src,
+                             product => $bin,
                              generator => $unified_info{generate}->{$src},
                              generator_incs => $unified_info{includes}->{$script},
                              generator_deps => $unified_info{depends}->{$script},
                              deps => $unified_info{depends}->{$src},
-                             incs => $unified_info{includes}->{$obj},
+                             incs => [ defined $obj
+                                           ? @{$unified_info{includes}->{$obj}}
+                                           : (),
+                                       defined $bin
+                                           ? @{$unified_info{includes}->{$bin}}
+                                           : () ],
+                             defs => [ defined $obj
+                                           ? @{$unified_info{defines}->{$obj}}
+                                           : (),
+                                       defined $bin
+                                           ? @{$unified_info{defines}->{$bin}}
+                                           : () ],
                              %opts);
          foreach (@{$unified_info{depends}->{$src}}) {
              dogenerate($_, $obj, $bin, %opts);
@@ -99,11 +179,30 @@
      my $bin = shift;
      my %opts = @_;
      if (@{$unified_info{sources}->{$obj}}) {
-         $OUT .= src2obj(obj => $obj,
-                         product => $bin,
-                         srcs => $unified_info{sources}->{$obj},
-                         deps => $unified_info{depends}->{$obj},
-                         incs => $unified_info{includes}->{$obj},
+         my @srcs = @{$unified_info{sources}->{$obj}};
+         my @deps = @{$unified_info{depends}->{$obj}};
+         my @incs = ( @{$unified_info{includes}->{$obj}},
+                      @{$unified_info{includes}->{$bin}} );
+         my @defs = ( @{$unified_info{defines}->{$obj}},
+                      @{$unified_info{defines}->{$bin}} );
+         print STDERR "DEBUG[doobj] \@srcs for $obj ($bin) : ",
+             join(",", map { "\n    $_" } @srcs), "\n"
+             if $debug_rules;
+         print STDERR "DEBUG[doobj] \@deps for $obj ($bin) : ",
+             join(",", map { "\n    $_" } @deps), "\n"
+             if $debug_rules;
+         print STDERR "DEBUG[doobj] \@incs for $obj ($bin) : ",
+             join(",", map { "\n    $_" } @incs), "\n"
+             if $debug_rules;
+         print STDERR "DEBUG[doobj] \@defs for $obj ($bin) : ",
+             join(",", map { "\n    $_" } @defs), "\n"
+             if $debug_rules;
+         print STDERR "DEBUG[doobj] \%opts for $obj ($bin) : ", ,
+             join(",", map { "\n    $_ = $opts{$_}" } sort keys %opts), "\n"
+             if $debug_rules;
+         $OUT .= src2obj(obj => $obj, product => $bin,
+                         srcs => [ @srcs ], deps => [ @deps ],
+                         incs => [ @incs ], defs => [ @defs ],
                          %opts);
          foreach ((@{$unified_info{sources}->{$obj}},
                    @{$unified_info{depends}->{$obj}})) {
@@ -113,55 +212,189 @@
      $cache{$obj} = 1;
  }
 
+ # Helper functions to grab all applicable intermediary files.
+ # This is particularly useful when a library is given as source
+ # rather than a dependency.  In that case, we consider it to be a
+ # container with object file references, or possibly references
+ # to further libraries to pilfer in the same way.
+ sub getsrclibs {
+     my $section = shift;
+
+     # For all input, see if it sources static libraries.  If it does,
+     # return them together with the result of a recursive call.
+     map { ( $_, getsrclibs($section, $_) ) }
+     grep { $_ =~ m|\.a$| }
+     map { @{$unified_info{$section}->{$_} // []} }
+     @_;
+ }
+
+ sub getlibobjs {
+     my $section = shift;
+
+     # For all input, see if it's an intermediary file (library or object).
+     # If it is, collect the result of a recursive call, or if that returns
+     # an empty list, the element itself.  Return the result.
+     map {
+         my @x = getlibobjs($section, @{$unified_info{$section}->{$_}});
+         @x ? @x : ( $_ );
+     }
+     grep { defined $unified_info{$section}->{$_} }
+     @_;
+ }
+
  # dolib is responsible for building libraries.  It will call
- # libobj2shlib is shared libraries are produced, and obj2lib in all
+ # obj2shlib if shared libraries are produced, and obj2lib in all
  # cases.  It also makes sure all object files for the library are
  # built.
  sub dolib {
      my $lib = shift;
      return "" if $cache{$lib};
+
+     my %attrs = %{$unified_info{attributes}->{libraries}->{$lib}};
+
+     my @deps = ( resolvedepends(getsrclibs('sources', $lib)) );
+
+     # We support two types of objs, those who are specific to this library
+     # (they end up in @objs) and those that we get indirectly, via other
+     # libraries (they end up in @foreign_objs).  We get the latter any time
+     # someone has done something like this in build.info:
+     #     SOURCE[libfoo.a]=libbar.a
+     # The indirect object files must be kept in a separate array so they
+     # don't get rebuilt unnecessarily (and with incorrect auxiliary
+     # information).
+     #
+     # Object files can't be collected commonly for shared and static
+     # libraries, because we contain their respective object files in
+     # {shared_sources} and {sources}, and because the implications are
+     # slightly different for each library form.
+     #
+     # We grab all these "foreign" object files recursively with getlibobjs().
+
      unless ($disabled{shared} || $lib =~ /\.a$/) {
-         $OUT .= libobj2shlib(shlib => $unified_info{sharednames}->{$lib},
-                              lib => $lib,
-                              objs => [ @{$unified_info{shared_sources}->{$lib}},
-                                        @{$unified_info{sources}->{$lib}} ],
-                              deps => [ reducedepends(resolvedepends($lib)) ],
-                              installed => is_installed($lib));
-         foreach ((@{$unified_info{shared_sources}->{$lib}},
-                   @{$unified_info{sources}->{$lib}})) {
+         my $obj2shlib = defined &obj2shlib ? \&obj2shlib : \&libobj2shlib;
+         # If this library sources other static libraries and those
+         # libraries are marked {noinst}, there's no need to include
+         # all of their object files.  Instead, we treat those static
+         # libraries as dependents alongside any other library this
+         # one depends on, and let symbol resolution do its job.
+         my @sourced_libs = ();
+         my @objs = ();
+         my @foreign_objs = ();
+         my @deps = ();
+         foreach (@{$unified_info{shared_sources}->{$lib}}) {
+             if ($_ !~ m|\.a$|) {
+                 push @objs, $_;
+             } elsif ($unified_info{attributes}->{libraries}->{$_}->{noinst}) {
+                 push @deps, $_;
+             } else {
+                 push @deps, getsrclibs('sources', $_);
+                 push @foreign_objs, getlibobjs('sources', $_);
+             }
+         }
+         @deps = ( grep { $_ ne $lib } resolvedepends($lib, @deps) );
+         print STDERR "DEBUG[dolib:shlib] \%attrs for $lib : ", ,
+             join(",", map { "\n    $_ = $attrs{$_}" } sort keys %attrs), "\n"
+             if %attrs && $debug_rules;
+         print STDERR "DEBUG[dolib:shlib] \@deps for $lib : ",
+             join(",", map { "\n    $_" } @deps), "\n"
+             if @deps && $debug_rules;
+         print STDERR "DEBUG[dolib:shlib] \@objs for $lib : ",
+             join(",", map { "\n    $_" } @objs), "\n"
+             if @objs && $debug_rules;
+         print STDERR "DEBUG[dolib:shlib] \@foreign_objs for $lib : ",
+             join(",", map { "\n    $_" } @foreign_objs), "\n"
+             if @foreign_objs && $debug_rules;
+         $OUT .= $obj2shlib->(lib => $lib,
+                              attrs => { %attrs },
+                              objs => [ @objs, @foreign_objs ],
+                              deps => [ @deps ]);
+         foreach (@objs) {
              # If this is somehow a compiled object, take care of it that way
              # Otherwise, it might simply be generated
              if (defined $unified_info{sources}->{$_}) {
-                 doobj($_, $lib, intent => "lib", installed => is_installed($lib));
+                 if($_ =~ /\.a$/) {
+                     dolib($_);
+                 } else {
+                     doobj($_, $lib, intent => "shlib", attrs => { %attrs });
+                 }
              } else {
                  dogenerate($_, undef, undef, intent => "lib");
              }
          }
      }
-     $OUT .= obj2lib(lib => $lib,
-                     objs => [ @{$unified_info{sources}->{$lib}} ]);
-     foreach (@{$unified_info{sources}->{$lib}}) {
-         doobj($_, $lib, intent => "lib", installed => is_installed($lib));
+     {
+         # When putting static libraries together, we cannot rely on any
+         # symbol resolution, so for all static libraries used as source for
+         # this one, as well as other libraries they depend on, we simply
+         # grab all their object files unconditionally,
+         # Symbol resolution will happen when any program, module or shared
+         # library is linked with this one.
+         my @objs = ();
+         my @sourcedeps = ();
+         my @foreign_objs = ();
+         foreach (@{$unified_info{sources}->{$lib}}) {
+             if ($_ !~ m|\.a$|) {
+                 push @objs, $_;
+             } else {
+                 push @sourcedeps, $_;
+             }
+         }
+         @sourcedeps = ( grep { $_ ne $lib } resolvedepends(@sourcedeps) );
+         print STDERR "DEBUG[dolib:lib] : \@sourcedeps for $_ : ",
+             join(",", map { "\n    $_" } @sourcedeps), "\n"
+             if @sourcedeps && $debug_rules;
+         @foreign_objs = getlibobjs('sources', @sourcedeps);
+         print STDERR "DEBUG[dolib:lib] \%attrs for $lib : ", ,
+             join(",", map { "\n    $_ = $attrs{$_}" } sort keys %attrs), "\n"
+             if %attrs && $debug_rules;
+         print STDERR "DEBUG[dolib:lib] \@objs for $lib : ",
+             join(",", map { "\n    $_" } @objs), "\n"
+             if @objs && $debug_rules;
+         print STDERR "DEBUG[dolib:lib] \@foreign_objs for $lib : ",
+             join(",", map { "\n    $_" } @foreign_objs), "\n"
+             if @foreign_objs && $debug_rules;
+         $OUT .= obj2lib(lib => $lib, attrs => { %attrs },
+                         objs => [ @objs, @foreign_objs ]);
+         foreach (@objs) {
+             doobj($_, $lib, intent => "lib", attrs => { %attrs });
+         }
      }
      $cache{$lib} = 1;
  }
 
- # doengine is responsible for building engines.  It will call
+ # domodule is responsible for building modules.  It will call
  # obj2dso, and also makes sure all object files for the library
  # are built.
- sub doengine {
-     my $lib = shift;
-     return "" if $cache{$lib};
-     $OUT .= obj2dso(lib => $lib,
-                     objs => [ @{$unified_info{sources}->{$lib}},
-                               @{$unified_info{shared_sources}->{$lib}} ],
-                     deps => [ resolvedepends($lib) ],
-                     installed => is_installed($lib));
-     foreach ((@{$unified_info{sources}->{$lib}},
-               @{$unified_info{shared_sources}->{$lib}})) {
-         doobj($_, $lib, intent => "dso", installed => is_installed($lib));
+ sub domodule {
+     my $module = shift;
+     return "" if $cache{$module};
+     my %attrs = %{$unified_info{attributes}->{modules}->{$module}};
+     my @objs = @{$unified_info{sources}->{$module}};
+     my @deps = ( grep { $_ ne $module }
+                  resolvedepends($module) );
+     print STDERR "DEBUG[domodule] \%attrs for $module :",
+         join(",", map { "\n    $_ = $attrs{$_}" } sort keys %attrs), "\n"
+         if $debug_rules;
+     print STDERR "DEBUG[domodule] \@objs for $module : ",
+         join(",", map { "\n    $_" } @objs), "\n"
+         if $debug_rules;
+     print STDERR "DEBUG[domodule] \@deps for $module : ",
+         join(",", map { "\n    $_" } @deps), "\n"
+         if $debug_rules;
+     $OUT .= obj2dso(module => $module,
+                     attrs => { %attrs },
+                     objs => [ @objs ],
+                     deps => [ @deps ]);
+     foreach (@{$unified_info{sources}->{$module}}) {
+         # If this is somehow a compiled object, take care of it that way
+         # Otherwise, it might simply be generated
+         if (defined $unified_info{sources}->{$_}) {
+             doobj($_, $module, intent => "dso", attrs => { %attrs });
+         } else {
+             dogenerate($_, undef, $module, intent => "dso");
+         }
      }
-     $cache{$lib} = 1;
+     $cache{$module} = 1;
  }
 
  # dobin is responsible for building programs.  It will call obj2bin,
@@ -169,13 +402,24 @@
  sub dobin {
      my $bin = shift;
      return "" if $cache{$bin};
-     my $deps = [ reducedepends(resolvedepends($bin)) ];
+     my %attrs = %{$unified_info{attributes}->{programs}->{$bin}};
+     my @objs = @{$unified_info{sources}->{$bin}};
+     my @deps = ( grep { $_ ne $bin } resolvedepends($bin) );
+     print STDERR "DEBUG[dobin] \%attrs for $bin : ",
+         join(",", map { "\n    $_ = $attrs{$_}" } sort keys %attrs), "\n"
+         if %attrs && $debug_rules;
+     print STDERR "DEBUG[dobin] \@objs for $bin : ",
+         join(",", map { "\n    $_" } @objs), "\n"
+         if @objs && $debug_rules;
+     print STDERR "DEBUG[dobin] \@deps for $bin : ",
+         join(",", map { "\n    $_" } @deps), "\n"
+         if @deps && $debug_rules;
      $OUT .= obj2bin(bin => $bin,
-                     objs => [ @{$unified_info{sources}->{$bin}} ],
-                     deps => $deps,
-                     installed => is_installed($bin));
-     foreach (@{$unified_info{sources}->{$bin}}) {
-         doobj($_, $bin, intent => "bin", installed => is_installed($bin));
+                     attrs => { %attrs },
+                     objs => [ @objs ],
+                     deps => [ @deps ]);
+     foreach (@objs) {
+         doobj($_, $bin, intent => "bin", attrs => { %attrs });
      }
      $cache{$bin} = 1;
  }
@@ -186,8 +430,8 @@
      my $script = shift;
      return "" if $cache{$script};
      $OUT .= in2script(script => $script,
-                       sources => $unified_info{sources}->{$script},
-                       installed => is_installed($script));
+                       attrs => $unified_info{attributes}->{$script},
+                       sources => $unified_info{sources}->{$script});
      $cache{$script} = 1;
  }
 
@@ -200,63 +444,35 @@
      $cache{$dir} = 1;
  }
 
- # Start with populating the cache with all the overrides
- %cache = map { $_ => 1 } @{$unified_info{overrides}};
-
- # For convenience collect information regarding directories where
- # files are generated, those generated files and the end product
- # they end up in where applicable.  Then, add build rules for those
- # directories
- if (exists &generatedir) {
-     my %loopinfo = ( "dso" => [ @{$unified_info{engines}} ],
-                      "lib" => [ @{$unified_info{libraries}} ],
-                      "bin" => [ @{$unified_info{programs}} ],
-                      "script" => [ @{$unified_info{scripts}} ] );
-     foreach my $type (keys %loopinfo) {
-         foreach my $product (@{$loopinfo{$type}}) {
-             my %dirs = ();
-             my $pd = dirname($product);
-
-             # We already have a "test" target, and the current directory
-             # is just silly to make a target for
-             $dirs{$pd} = 1 unless $pd eq "test" || $pd eq ".";
-
-             foreach (@{$unified_info{sources}->{$product}}) {
-                 my $d = dirname($_);
-
-                 # We don't want to create targets for source directories
-                 # when building out of source
-                 next if ($config{sourcedir} ne $config{builddir}
-                          && $d =~ m|^\Q$config{sourcedir}\E|);
-                 # We already have a "test" target, and the current directory
-                 # is just silly to make a target for
-                 next if $d eq "test" || $d eq ".";
-
-                 $dirs{$d} = 1;
-                 push @{$unified_info{dirinfo}->{$d}->{deps}}, $_
-                     if $d ne $pd;
-             }
-             foreach (keys %dirs) {
-                 push @{$unified_info{dirinfo}->{$_}->{products}->{$type}},
-                 $product;
-             }
+ # dodocs is responsible for building documentation from .pods.
+ # It will call generatesrc.
+ sub dodocs {
+     my $type = shift;
+     my $section = shift;
+     foreach my $doc (@{$unified_info{"${type}docs"}->{$section}}) {
+         next if $cache{$doc};
+         $OUT .= generatesrc(src => $doc,
+                             generator => $unified_info{generate}->{$doc});
+         foreach ((@{$unified_info{depends}->{$doc}})) {
+             dogenerate($_, undef, undef, %opts);
          }
+         $cache{$doc} = 1;
      }
  }
 
+ # Start with populating the cache with all the overrides
+ %cache = map { $_ => 1 } @{$unified_info{overrides}};
+
  # Build mandatory generated headers
  foreach (@{$unified_info{depends}->{""}}) { dogenerate($_); }
 
- # Build all known libraries, engines, programs and scripts.
+ # Build all known libraries, modules, programs and scripts.
  # Everything else will be handled as a consequence.
  foreach (@{$unified_info{libraries}}) { dolib($_);    }
- foreach (@{$unified_info{engines}})   { doengine($_); }
+ foreach (@{$unified_info{modules}})   { domodule($_); }
  foreach (@{$unified_info{programs}})  { dobin($_);    }
  foreach (@{$unified_info{scripts}})   { doscript($_); }
-
+ foreach (sort keys %{$unified_info{htmldocs}}) { dodocs('html', $_); }
+ foreach (sort keys %{$unified_info{mandocs}})  { dodocs('man', $_); }
  foreach (sort keys %{$unified_info{dirinfo}})  { dodir($_); }
-
- # Finally, should there be any applicable BEGINRAW/ENDRAW sections,
- # they are added here.
- $OUT .= $_."\n" foreach @{$unified_info{rawlines}};
 -}

Configurations/common0.tmpl

@@ -16,13 +16,13 @@
              ? ()
              : ( map { @{$unified_info{shared_sources}->{$_}} }
                  keys %{$unified_info{shared_sources}} ),
-         # Things we explicitely depend on are usually generated
+         # Things we explicitly depend on are usually generated
          ( map { $_ eq "" ? () : @{$unified_info{depends}->{$_}} }
                keys %{$unified_info{depends}} ));
  our @generated =
      sort ( ( grep { defined $unified_info{generate}->{$_} }
               sort keys %generatables ),
-            # Scripts are assumed to be generated, so add thhem too
+            # Scripts are assumed to be generated, so add them too
             ( grep { defined $unified_info{sources}->{$_} }
               @{$unified_info{scripts}} ) );
 

Configurations/descrip.mms.tmpl

@@ -5,12 +5,9 @@
   use File::Spec::Functions qw/:DEFAULT abs2rel rel2abs/;
   use File::Basename;
 
-  # Our prefix, claimed when speaking with the VSI folks Tuesday
-  # January 26th 2016
-  our $osslprefix = 'OSSL$';
-  (our $osslprefix_q = $osslprefix) =~ s/\$/\\\$/;
+  (our $osslprefix_q = platform->osslprefix()) =~ s/\$/\\\$/;
 
-  our $sover_dirname = sprintf "%02d%02d", split(/\./, $config{shlib_version_number});
+  our $sover_dirname = platform->shlib_version_as_filename();
   our $osslver = sprintf "%02d%02d", split(/\./, $config{version});
 
   our $sourcedir = $config{sourcedir};
@@ -31,40 +28,53 @@
       (my $x = shift) =~ s|\]$|...]|;
       $x
   }
-  sub move {
-      my $f = catdir(@_);
-      my $b = abs2rel(rel2abs("."),rel2abs($f));
-      $sourcedir = catdir($b,$sourcedir)
-          if !file_name_is_absolute($sourcedir);
-      $builddir = catdir($b,$builddir)
-          if !file_name_is_absolute($builddir);
-      "";
   }
 
   # Because we need to make two computations of these data,
   # we store them in arrays for reuse
   our @libs =
-      map { (my $x = $_) =~ s/\.a$//; $x }
+      map { platform->staticname($_) }
       @{$unified_info{libraries}};
   our @shlibs =
-      map { $unified_info{sharednames}->{$_} || () }
-      grep(!/\.a$/, @{$unified_info{libraries}});
+      map { platform->sharedname($_) // () }
+      @{$unified_info{libraries}};
   our @install_libs =
-      map { (my $x = $_) =~ s/\.a$//; $x }
-      @{$unified_info{install}->{libraries}};
+      map { platform->staticname($_) }
+      grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
+      @{$unified_info{libraries}};
   our @install_shlibs =
-      map { $unified_info{sharednames}->{$_} || () }
-      grep(!/\.a$/, @{$unified_info{install}->{libraries}});
+      map { platform->sharedname($_) // () }
+      grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
+      @{$unified_info{libraries}};
+  our @install_engines =
+      grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
+             && $unified_info{attributes}->{modules}->{$_}->{engine} }
+      @{$unified_info{modules}};
+  our @install_modules =
+      grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
+             && !$unified_info{attributes}->{modules}->{$_}->{engine} }
+      @{$unified_info{modules}};
+  our @install_programs =
+      grep { !$unified_info{attributes}->{programs}->{$_}->{noinst} }
+      @{$unified_info{programs}};
+  our @install_bin_scripts =
+      grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst}
+             && !$unified_info{attributes}->{scripts}->{$_}->{misc} }
+      @{$unified_info{scripts}};
+  our @install_misc_scripts =
+      grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst}
+             && $unified_info{attributes}->{scripts}->{$_}->{misc} }
+      @{$unified_info{scripts}};
 
   # This is a horrible hack, but is needed because recursive inclusion of files
   # in different directories does not work well with HP C.
   my $sd = sourcedir("crypto", "async", "arch");
   foreach (grep /\[\.crypto\.async\.arch\].*\.o$/, keys %{$unified_info{sources}}) {
-      (my $x = $_) =~ s|\.o$|.OBJ|;
-      $unified_info{before}->{$x}
+      my $obj = platform->obj($_);
+      $unified_info{before}->{$obj}
           = qq(arch_include = F\$PARSE("$sd","A.;",,,"SYNTAX_ONLY") - "A.;"
         define arch 'arch_include');
-      $unified_info{after}->{$x}
+      $unified_info{after}->{$obj}
           = qq(deassign arch);
   }
   my $sd1 = sourcedir("ssl","record");
@@ -72,13 +82,13 @@
   my @ssl_locl_users = grep(/^\[\.(?:ssl\.(?:record|statem)|test)\].*\.o$/,
                             keys %{$unified_info{sources}});
   foreach (@ssl_locl_users) {
-      (my $x = $_) =~ s|\.o$|.OBJ|;
-      $unified_info{before}->{$x}
+      my $obj = platform->obj($_);
+      $unified_info{before}->{$obj}
           = qq(record_include = F\$PARSE("$sd1","A.;",,,"SYNTAX_ONLY") - "A.;"
         define record 'record_include'
         statem_include = F\$PARSE("$sd2","A.;",,,"SYNTAX_ONLY") - "A.;"
         define statem 'statem_include');
-      $unified_info{after}->{$x}
+      $unified_info{after}->{$obj}
           = qq(deassign statem
         deassign record);
   }
@@ -89,9 +99,6 @@
 
       return "$target : build_generated\n\t\pipe \$(MMS) \$(MMSQUALIFIERS) depend && \$(MMS) \$(MMSQUALIFIERS) _$target\n_$target";
   }
-  #use Data::Dumper;
-  #print STDERR "DEBUG: before:\n", Dumper($unified_info{before});
-  #print STDERR "DEBUG: after:\n", Dumper($unified_info{after});
   "";
 -}
 PLATFORM={- $config{target} -}
@@ -103,49 +110,43 @@ BLDDIR={- $config{builddir} -}
 # Allow both V and VERBOSE to indicate verbosity.  This only applies
 # to testing.
 VERBOSE=$(V)
+VERBOSE_FAILURE=$(VF)
 
-VERSION={- $config{version} -}
+VERSION={- "$config{full_version}" -}
 MAJOR={- $config{major} -}
 MINOR={- $config{minor} -}
-SHLIB_VERSION_NUMBER={- $config{shlib_version_number} -}
-SHLIB_VERSION_HISTORY={- $config{shlib_version_history} -}
-SHLIB_MAJOR={- $config{shlib_major} -}
-SHLIB_MINOR={- $config{shlib_minor} -}
+SHLIB_VERSION_NUMBER={- $config{shlib_version} -}
 SHLIB_TARGET={- $target{shared_target} -}
 
-EXE_EXT=.EXE
-LIB_EXT=.OLB
-SHLIB_EXT=.EXE
-OBJ_EXT=.OBJ
-DEP_EXT=.D
-
 LIBS={- join(", ", map { "-\n\t".$_.".OLB" } @libs) -}
 SHLIBS={- join(", ", map { "-\n\t".$_.".EXE" } @shlibs) -}
-ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{engines}}) -}
+MODULES={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{modules}}) -}
 PROGRAMS={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{programs}}) -}
 SCRIPTS={- join(", ", map { "-\n\t".$_ } @{$unified_info{scripts}}) -}
 {- output_off() if $disabled{makedepend}; "" -}
-DEPS={- our @deps = map { (my $x = $_) =~ s|\.o$|\$(DEP_EXT)|; $x; }
+DEPS={- our @deps = map { platform->isobj($_) ? platform->dep($_) : $_ }
                     grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ }
                     keys %{$unified_info{sources}};
         join(", ", map { "-\n\t".$_ } @deps); -}
 {- output_on() if $disabled{makedepend}; "" -}
 GENERATED_MANDATORY={- join(", ", map { "-\n\t".$_ } @{$unified_info{depends}->{""}} ) -}
 GENERATED={- # common0.tmpl provides @generated
-             join(", ", map { (my $x = $_) =~ s|\.[sS]$|.asm|; "-\n\t".$x }
-                        @generated) -}
+             join(", ", map { platform->convertext($_) } @generated) -}
 
 INSTALL_LIBS={- join(", ", map { "-\n\t".$_.".OLB" } @install_libs) -}
 INSTALL_SHLIBS={- join(", ", map { "-\n\t".$_.".EXE" } @install_shlibs) -}
-INSTALL_ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{install}->{engines}}) -}
-INSTALL_PROGRAMS={- join(", ", map { "-\n\t".$_.".EXE" } @{$unified_info{install}->{programs}}) -}
-{- output_off() if $disabled{apps}; "" -}
-BIN_SCRIPTS=[.tools]c_rehash.pl
-MISC_SCRIPTS=[.apps]CA.pl, [.apps]tsget.pl
-{- output_on() if $disabled{apps}; "" -}
+INSTALL_ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @install_engines) -}
+INSTALL_MODULES={- join(", ", map { "-\n\t".$_.".EXE" } @install_modules) -}
+INSTALL_PROGRAMS={- join(", ", map { "-\n\t".$_.".EXE" } @install_programs) -}
+BIN_SCRIPTS={- join(", ", @install_bin_scripts) -}
+MISC_SCRIPTS={- join(", ", @install_misc_scripts) -}
+HTMLDOCS1={- join(", ", map { "-\n\t".$_ } @{$unified_info{htmldocs}->{man1}}) -}
+HTMLDOCS3={- join(", ", map { "-\n\t".$_ } @{$unified_info{htmldocs}->{man3}}) -}
+HTMLDOCS5={- join(", ", map { "-\n\t".$_ } @{$unified_info{htmldocs}->{man5}}) -}
+HTMLDOCS7={- join(", ", map { "-\n\t".$_ } @{$unified_info{htmldocs}->{man7}}) -}
 
-APPS_OPENSSL={- use File::Spec::Functions;
-                catfile("apps","openssl") -}
+APPS_OPENSSL="{- use File::Spec::Functions;
+                 catfile("apps","openssl") -}"
 
 # DESTDIR is for package builders so that they can configure for, say,
 # SYS$COMMON:[OPENSSL] and yet have everything installed in STAGING:[USER].
@@ -165,9 +166,11 @@ OPENSSLDIR={- catdir($config{openssldir}) or
               $config{prefix} ? catdir($config{prefix},"COMMON")
                               : "SYS\$COMMON:[OPENSSL-COMMON]" -}
 # The same, but for C
-OPENSSLDIR_C={- $osslprefix -}DATAROOT:[000000]
-# Where installed engines reside, for C
-ENGINESDIR_C={- $osslprefix -}ENGINES{- $sover_dirname.$target{pointer_size} -}:
+OPENSSLDIR_C={- platform->osslprefix() -}DATAROOT:[000000]
+# Where installed ENGINE modules reside, for C
+ENGINESDIR_C={- platform->osslprefix() -}ENGINES{- $sover_dirname.$target{pointer_size} -}:
+# Where modules reside, for C
+MODULESDIR_C={- platform->osslprefix() -}MODULES{- $sover_dirname.$target{pointer_size} -}:
 
 ##### User defined commands and flags ################################
 
@@ -195,8 +198,9 @@ ASOUTFLAG={- $target{asoutflag} -}$(OSSL_EMPTY)
 
 CNF_ASFLAGS={- join('', $target{asflags} || (),
                         @{$config{asflags}}) -}
-CNF_DEFINES={- our $defines2 = join('', map { ",$_" } @{$target{defines}},
-                                                      @{$config{defines}}) -}
+CNF_DEFINES={- our $defines2 = join('', (map { ",$_" } @{$target{defines}},
+                                                       @{$config{defines}}),
+                                        "'extradefines'") -}
 CNF_INCLUDES={- our $includes2 = join(',', @{$target{includes}},
                                            @{$config{includes}}) -}
 CNF_CPPFLAGS={- our $cppflags2 = join('', $target{cppflags} || (),
@@ -226,7 +230,8 @@ LIB_DEFINES={- our $lib_defines =
                                        @{$config{shared_defines}}));
                join('', $lib_defines,
                         (map { ",$_" } 'OPENSSLDIR="""$(OPENSSLDIR_C)"""',
-                                       'ENGINESDIR="""$(ENGINESDIR_C)"""'),
+                                       'ENGINESDIR="""$(ENGINESDIR_C)"""',
+                                       'MODULESDIR="""$(MODULESDIR_C)"""'),
                         '$(CNF_DEFINES)', '$(DEFINES)') -}
 LIB_INCLUDES={- our $lib_includes =
                 join(',', @{$target{lib_includes}},
@@ -298,8 +303,8 @@ BIN_CPPFLAGS={- join('', "'qual_includes'",
                          $target{bin_cppflags} || (),
                          @{$config{bin_cppflag}},
                          '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
-BIN_CFLAGS={- join('', $target{bin_cflag} || (),
-                       @{$config{bin_cflag}},
+BIN_CFLAGS={- join('', $target{bin_cflags} || (),
+                       @{$config{bin_cflags}},
                        '$(CNF_CFLAGS)', '$(CFLAGS)') -}
 BIN_LDFLAGS={- join('', $target{bin_lflags} || (),
                         @{$config{bin_lflags}} || (),
@@ -312,12 +317,14 @@ NO_INST_LIB_CFLAGS={- join('', $target{no_inst_lib_cflags}
                                @{$config{lib_cflags}},
                                @{$config{shared_cflag}},
                                '$(CNF_CFLAGS)', '$(CFLAGS)') -}
-NO_INST_DSO_CFLAGS={- join('', $target{no_inst_lib_cflags}
-                               // $target{lib_cflags}
+NO_INST_DSO_CFLAGS={- join('', $target{no_inst_dso_cflags}
+                               // $target{dso_cflags}
+                               // (),
+                               $target{no_inst_module_cflags}
+                               // $target{module_cflags}
                                // (),
-                               $target{dso_cflags} || (),
-                               @{$config{lib_cflags}},
                                @{$config{dso_cflags}},
+                               @{$config{module_cflags}},
                                '$(CNF_CFLAGS)', '$(CFLAGS)') -}
 NO_INST_BIN_CFLAGS={- join('', $target{no_inst_bin_cflags}
                                // $target{bin_cflags}
@@ -349,6 +356,9 @@ CPPFLAGS_Q={- (my $c = $lib_cppflags.$cppflags2.$cppflags1) =~ s|"|""|g;
 # given with /INCLUDE is a fantasy, unfortunately.
 NODEBUG=@
 .FIRST :
+        $(NODEBUG) sourcetop = F$PARSE("$(SRCDIR)","[]A.;",,"SYNTAX_ONLY,NO_CONCEAL") - ".][000000" - "[000000." - "][" - "]A.;" + ".]"
+        $(NODEBUG) DEFINE ossl_sourceroot 'sourcetop'
+        $(NODEBUG) !
         $(NODEBUG) openssl_inc1 = F$PARSE("[.include.openssl]","A.;",,,"syntax_only") - "A.;"
         $(NODEBUG) openssl_inc2 = F$PARSE("{- catdir($config{sourcedir},"[.include.openssl]") -}","A.;",,,"SYNTAX_ONLY") - "A.;"
         $(NODEBUG) internal_inc1 = F$PARSE("[.crypto.include.internal]","A.;",,,"SYNTAX_ONLY") - "A.;"
@@ -399,45 +409,42 @@ NODEBUG=@
 
 # The main targets ###################################################
 
-{- dependmagic('all'); -} : build_libs_nodep, build_engines_nodep, build_programs_nodep
+{- dependmagic('build_sw'); -} : build_libs_nodep, build_modules_nodep, build_programs_nodep copy-utils
 {- dependmagic('build_libs'); -} : build_libs_nodep
-{- dependmagic('build_engines'); -} : build_engines_nodep
+{- dependmagic('build_modules'); -} : build_modules_nodep
 {- dependmagic('build_programs'); -} : build_programs_nodep
 
 build_generated : $(GENERATED_MANDATORY)
 build_libs_nodep : $(LIBS), $(SHLIBS)
-build_engines_nodep : $(ENGINES)
+build_modules_nodep : $(MODULES)
 build_programs_nodep : $(PROGRAMS), $(SCRIPTS)
 
+build_docs: build_html_docs
+build_html_docs: $(HTMLDOCS1) $(HTMLDOCS3) $(HTMLDOCS5) $(HTMLDOCS7)
+
 # Kept around for backward compatibility
 build_apps build_tests : build_programs
 
 # Convenience target to prebuild all generated files, not just the mandatory
 # ones
-build_all_generated : $(GENERATED_MANDATORY) $(GENERATED)
+build_all_generated : $(GENERATED_MANDATORY) $(GENERATED) build_docs
 	@ ! {- output_off() if $disabled{makedepend}; "" -}
 	@ WRITE SYS$OUTPUT "Warning: consider configuring with no-makedepend, because if"
 	@ WRITE SYS$OUTPUT "         target system doesn't have $(PERL),"
 	@ WRITE SYS$OUTPUT "         then make will fail..."
 	@ ! {- output_on() if $disabled{makedepend}; "" -}
 
+all : build_sw build_docs
+
 test : tests
-{- dependmagic('tests'); -} : build_programs_nodep, build_engines_nodep
+{- dependmagic('tests'); -} : build_programs_nodep, build_modules_nodep copy-utils
         @ ! {- output_off() if $disabled{tests}; "" -}
-        SET DEFAULT [.test]{- move("test") -}
-        CREATE/DIR [.test-runs]
         DEFINE SRCTOP {- sourcedir() -}
         DEFINE BLDTOP {- builddir() -}
-        DEFINE RESULT_D {- builddir(qw(test test-runs)) -}
-        DEFINE OPENSSL_ENGINES {- builddir("engines") -}
-        DEFINE OPENSSL_DEBUG_MEMORY "on"
         IF "$(VERBOSE)" .NES. "" THEN DEFINE VERBOSE "$(VERBOSE)"
         $(PERL) {- sourcefile("test", "run_tests.pl") -} $(TESTS)
-        DEASSIGN OPENSSL_DEBUG_MEMORY
-        DEASSIGN OPENSSL_ENGINES
         DEASSIGN BLDTOP
         DEASSIGN SRCTOP
-        SET DEFAULT [-]{- move("..") -}
         @ ! {- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
         @ WRITE SYS$OUTPUT "Tests are not supported with your chosen Configure options"
         @ ! {- output_on() if !$disabled{tests}; "" -}
@@ -451,7 +458,9 @@ list-tests :
         @ WRITE SYS$OUTPUT "Tests are not supported with your chosen Configure options"
         @ ! {- output_on() if !$disabled{tests}; "" -}
 
-install : install_sw install_ssldirs install_docs
+install : install_sw install_ssldirs install_docs install_final
+
+install_final :
         @ WRITE SYS$OUTPUT ""
         @ WRITE SYS$OUTPUT "######################################################################"
         @ WRITE SYS$OUTPUT ""
@@ -482,14 +491,18 @@ check_install :
 uninstall : uninstall_docs uninstall_sw
 
 # Because VMS wants the generation number (or *) to delete files, we can't
-# use $(LIBS), $(PROGRAMS), $(GENERATED) and $(ENGINES)directly.
+# use $(LIBS), $(PROGRAMS), $(GENERATED) and $(MODULES) directly.
 libclean :
         {- join("\n\t", map { "- DELETE $_.OLB;*" } @libs) || "@ !" -}
         {- join("\n\t", map { "- DELETE $_.EXE;*,$_.MAP;*" } @shlibs) || "@ !" -}
 
 clean : libclean
+        {- join("\n\t", map { "- DELETE $_;*" } @{$unified_info{htmldocs}->{man1}}) || "@ !" -}
+        {- join("\n\t", map { "- DELETE $_;*" } @{$unified_info{htmldocs}->{man3}}) || "@ !" -}
+        {- join("\n\t", map { "- DELETE $_;*" } @{$unified_info{htmldocs}->{man5}}) || "@ !" -}
+        {- join("\n\t", map { "- DELETE $_;*" } @{$unified_info{htmldocs}->{man7}}) || "@ !" -}
         {- join("\n\t", map { "- DELETE $_.EXE;*,$_.OPT;*" } @{$unified_info{programs}}) || "@ !" -}
-        {- join("\n\t", map { "- DELETE $_.EXE;*,$_.OPT;*" } @{$unified_info{engines}}) || "@ !" -}
+        {- join("\n\t", map { "- DELETE $_.EXE;*,$_.OPT;*" } @{$unified_info{modules}}) || "@ !" -}
         {- join("\n\t", map { "- DELETE $_;*" } @{$unified_info{scripts}}) || "@ !" -}
         {- join("\n\t", map { "- DELETE $_;*" } @{$unified_info{depends}->{""}}) || "@ !" -}
         {- join("\n\t", map { "- DELETE $_;*" } @generated) || "@ !" -}
@@ -513,13 +526,11 @@ descrip.mms : FORCE
 
 # Install helper targets #############################################
 
-install_sw : all install_shared _install_dev_ns -
-             install_engines _install_runtime_ns -
-             install_startup install_ivp
+install_sw : install_dev install_engines install_modules -
+             install_runtime install_startup install_ivp
 
-uninstall_sw : uninstall_shared _uninstall_dev_ns -
-               uninstall_engines _uninstall_runtime_ns -
-               uninstall_startup uninstall_ivp
+uninstall_sw : uninstall_dev uninstall_modules uninstall_engines -
+               uninstall_runtime uninstall_startup uninstall_ivp
 
 install_docs : install_html_docs
 
@@ -547,17 +558,7 @@ install_ssldirs : check_INSTALLTOP
                 COPY/PROT=W:R {- sourcefile("apps", "ct_log_list.cnf") -} -
                         ossl_dataroot:[000000]ct_log_list.cnf
 
-install_shared : check_INSTALLTOP
-        @ {- output_off() if $disabled{shared}; "" -} !
-        @ WRITE SYS$OUTPUT "*** Installing shareable images"
-        @ ! Install shared (runtime) libraries
-        - CREATE/DIR ossl_installroot:[LIB.'arch']
-        {- join("\n        ",
-                map { "COPY/PROT=W:R $_.EXE ossl_installroot:[LIB.'arch']" }
-                @install_shlibs) -}
-        @ {- output_on() if $disabled{shared}; "" -} !
-
-_install_dev_ns : check_INSTALLTOP
+install_dev : check_INSTALLTOP install_runtime_libs
         @ WRITE SYS$OUTPUT "*** Installing development files"
         @ ! Install header files
         - CREATE/DIR ossl_installroot:[include.openssl]
@@ -568,9 +569,38 @@ _install_dev_ns : check_INSTALLTOP
                 map { "COPY/PROT=W:R $_.OLB ossl_installroot:[LIB.'arch']" }
                 @install_libs) -}
 
-install_dev : install_shared _install_dev_ns
+install_engines : check_INSTALLTOP install_runtime_libs build_modules
+        @ {- output_off() unless scalar @install_engines; "" -} !
+        @ WRITE SYS$OUTPUT "*** Installing engines"
+        - CREATE/DIR ossl_installroot:[ENGINES{- $sover_dirname.$target{pointer_size} -}.'arch']
+        {- join("\n        ",
+                map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[ENGINES$sover_dirname$target{pointer_size}.'arch']" }
+                @install_engines) -}
+        @ {- output_on() unless scalar @install_engines; "" -} !
 
-_install_runtime_ns : check_INSTALLTOP
+install_modules : check_INSTALLTOP install_runtime_libs build_modules
+        @ {- output_off() unless scalar @install_modules; "" -} !
+        @ WRITE SYS$OUTPUT "*** Installing modules"
+        - CREATE/DIR ossl_installroot:[MODULES{- $sover_dirname.$target{pointer_size} -}.'arch']
+        {- join("\n        ",
+                map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[MODULES$sover_dirname$target{pointer_size}.'arch']" }
+                @install_modules) -}
+        @ {- output_on() unless scalar @install_modules; "" -} !
+
+install_runtime : install_programs
+
+install_runtime_libs : check_INSTALLTOP build_libs
+        @ {- output_off() if $disabled{shared}; "" -} !
+        @ WRITE SYS$OUTPUT "*** Installing shareable images"
+        @ ! Install shared (runtime) libraries
+        - CREATE/DIR ossl_installroot:[LIB.'arch']
+        {- join("\n        ",
+                map { "COPY/PROT=W:R $_.EXE ossl_installroot:[LIB.'arch']" }
+                @install_shlibs) -}
+        @ {- output_on() if $disabled{shared}; "" -} !
+
+install_programs : check_INSTALLTOP install_runtime_libs build_programs
+        @ {- output_off() if $disabled{apps}; "" -} !
         @ ! Install the main program
         - CREATE/DIR ossl_installroot:[EXE.'arch']
         COPY/PROT=W:RE [.APPS]openssl.EXE -
@@ -579,17 +609,6 @@ _install_runtime_ns : check_INSTALLTOP
         COPY/PROT=W:RE $(BIN_SCRIPTS) ossl_installroot:[EXE]
         @ ! {- output_on() if $disabled{apps}; "" -}
 
-install_runtime : install_shared _install_runtime_ns
-
-install_engines : check_INSTALLTOP
-        @ {- output_off() unless scalar @{$unified_info{engines}}; "" -} !
-        @ WRITE SYS$OUTPUT "*** Installing engines"
-        - CREATE/DIR ossl_installroot:[ENGINES{- $sover_dirname.$target{pointer_size} -}.'arch']
-        {- join("\n        ",
-                map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[ENGINES$sover_dirname$target{pointer_size}.'arch']" }
-                @{$unified_info{install}->{engines}}) -}
-        @ {- output_on() unless scalar @{$unified_info{engines}}; "" -} !
-
 install_startup : [.VMS]openssl_startup.com [.VMS]openssl_shutdown.com -
                  [.VMS]openssl_utils.com, check_INSTALLTOP
         - CREATE/DIR ossl_installroot:[SYS$STARTUP]
@@ -639,7 +658,7 @@ vmsconfig.pm : configdata.pm
         WRITE CONFIG "our %config = ("
         WRITE CONFIG "  target => '","{- $config{target} -}","',"
         WRITE CONFIG "  version => '","{- $config{version} -}","',"
-        WRITE CONFIG "  shlib_version_number => '","{- $config{shlib_version_number} -}","',"
+        WRITE CONFIG "  shlib_version => '","{- $config{shlib_version} -}","',"
         WRITE CONFIG "  shlib_major => '","{- $config{shlib_major} -}","',"
         WRITE CONFIG "  shlib_minor => '","{- $config{shlib_minor} -}","',"
         WRITE CONFIG "  no_shared => '","{- $disabled{shared} -}","',"
@@ -654,11 +673,21 @@ vmsconfig.pm : configdata.pm
         WRITE CONFIG "1;"
         CLOSE CONFIG
 
-install_html_docs : check_INSTALLTOP
-        sourcedir = F$PARSE("{- $sourcedir -}A.;","[]") - "]A.;" + ".DOC]"
-        $(PERL) {- sourcefile("util", "process_docs.pl") -} -
-                --sourcedir='sourcedir' --destdir=ossl_installroot:[HTML] -
-                --type=html
+install_html_docs : check_INSTALLTOP build_html_docs
+        @ WRITE SYS$OUTPUT "*** Installing HTML docs"
+        - CREATE/DIR ossl_installroot:[HTML.MAN1]
+        - CREATE/DIR ossl_installroot:[HTML.MAN3]
+        - CREATE/DIR ossl_installroot:[HTML.MAN5]
+        - CREATE/DIR ossl_installroot:[HTML.MAN7]
+        {- join("\n        ",
+                ( map { "COPY/PROT=W:RE $_ ossl_installroot:[HTML.MAN1]" }
+                  @{$unified_info{htmldocs}->{man1}} ),
+                ( map { "COPY/PROT=W:RE $_ ossl_installroot:[HTML.MAN3]" }
+                  @{$unified_info{htmldocs}->{man3}} ),
+                ( map { "COPY/PROT=W:RE $_ ossl_installroot:[HTML.MAN5]" }
+                  @{$unified_info{htmldocs}->{man5}} ),
+                ( map { "COPY/PROT=W:RE $_ ossl_installroot:[HTML.MAN7]" }
+                  @{$unified_info{htmldocs}->{man7}} )) -}
 
 check_INSTALLTOP :
         @ IF "$(INSTALLTOP)" .EQS. "" THEN -
@@ -668,6 +697,14 @@ check_INSTALLTOP :
 
 # Helper targets #####################################################
 
+copy-utils : [.util]wrap.pl
+
+[.util]wrap.pl : configdata.pm
+	@ IF "$(SRCDIR)" .NES. "$(BLDDIR)" THEN -
+		CREATE/DIR/LOG [.util]
+	@ IF "$(SRCDIR)" .NES. "$(BLDDIR)" THEN -
+		COPY/LOG ossl_sourceroot:[util]wrap.pl [.util]
+
 # Developer targets ##################################################
 
 debug_logicals :
@@ -694,12 +731,13 @@ reconfigure reconf :
   # Helper function to figure out dependencies on libraries
   # It takes a list of library names and outputs a list of dependencies
   sub compute_lib_depends {
-      if ($disabled{shared}) {
-          return map { $_ =~ /\.a$/ ? $`.".OLB" : $_.".OLB" } @_;
-      }
-      return map { $_ =~ /\.a$/
-                   ? $`.".OLB"
-                   : $unified_info{sharednames}->{$_}.".EXE" } @_;
+      # Depending on shared libraries:
+      # On Windows POSIX layers, we depend on {libname}.dll.a
+      # On Unix platforms, we depend on {shlibname}.so
+      return map {
+          { lib   => platform->sharedlib($_) // platform->staticlib($_),
+            attrs => $unified_info{attributes}->{libraries}->{$_} }
+      } @_;
   }
 
   # Helper function to deal with inclusion directory specs.
@@ -746,20 +784,45 @@ reconfigure reconf :
 
   sub generatesrc {
       my %args = @_;
-      (my $target = $args{src}) =~ s/\.[sS]$/.asm/;
       my $generator = join(" ", @{$args{generator}});
       my $generator_incs = join("", map { ' "-I'.$_.'"' } @{$args{generator_incs}});
       my $deps = join(", -\n\t\t", @{$args{generator_deps}}, @{$args{deps}});
 
-      if ($target !~ /\.asm$/) {
+      if ($args{src} =~ /\.html$/) {
+	  my $title = basename($args{src}, ".html");
+	  my $pod = $args{generator}->[0];
+	  my $mkpod2html = sourcefile('util', 'mkpod2html.pl');
+	  return <<"EOF";
+$args{src}: $pod
+	\$(PERL) $mkpod2html -i $pod -o \$\@ -t "$title" -r "\$(SRCDIR)/doc"
+EOF
+      } elsif (platform->isdef($args{src})) {
+          my $target = platform->def($args{src});
+          my $mkdef = sourcefile('util', 'mkdef.pl');
+          my $ord_ver = $args{intent} eq 'lib' ? ' --version $(VERSION)' : '';
+          my $ord_name =
+              $args{generator}->[1] || basename($args{product}, '.EXE');
+          my $case_insensitive =
+              $target{$args{intent}.'_cflags'} =~ m|/NAMES=[^/]*AS_IS|i
+              ? '' : ' --case-insensitive';
+          return <<"EOF";
+$target : $args{generator}->[0] $deps $mkdef
+	\$(PERL) $mkdef$ord_ver --ordinals $args{generator}->[0] --name $ord_name "--OS" "VMS"$case_insensitive > $target
+EOF
+      } elsif (!platform->isasm($args{src})) {
+          my $target = $args{src};
           if ($args{generator}->[0] =~ m|^.*\.in$|) {
 	      my $dofile = abs2rel(rel2abs(catfile($config{sourcedir},
                                                    "util", "dofile.pl")),
                                    rel2abs($config{builddir}));
+              my @modules = ( 'configdata.pm',
+                              grep { $_ =~ m|\.pm$| } @{$args{deps}} );
+              my %moduleincs = map { '"-I'.dirname($_).'"' => 1 } @modules;
+              @modules = map { '"-M'.basename($_, '.pm').'"' } @modules;
+              my $modules = join(' ', '', sort keys %moduleincs, @modules);
               return <<"EOF";
 $target : $args{generator}->[0] $deps
-	\$(PERL) "-I\$(BLDDIR)" "-Mconfigdata" $dofile \\
-	    "-o$target{build_file}" $generator > \$\@
+	\$(PERL)$modules $dofile "-o$target{build_file}" $generator > \$\@
 EOF
 	  } else {
               return <<"EOF";
@@ -768,20 +831,14 @@ $target : $args{generator}->[0] $deps
 EOF
 	  }
       } else {
-          if ($args{generator}->[0] =~ /\.pl$/) {
-              $generator = '$(PERL)'.$generator_incs.' '.$generator;
-          } elsif ($args{generator}->[0] =~ /\.S$/) {
-              $generator = undef;
-          } else {
-              die "Generator type for $src unknown: $generator\n";
-          }
-
           my $cppflags = {
+              shlib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)',
               lib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)',
               dso => '$(DSO_CFLAGS) $(DSO_CPPFLAGS)',
               bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)'
           } -> {$args{intent}};
-          my @incs_cmds = includes({ lib => '$(LIB_INCLUDES)',
+          my @incs_cmds = includes({ shlib => '$(LIB_INCLUDES)',
+                                     lib => '$(LIB_INCLUDES)',
                                      dso => '$(DSO_INCLUDES)',
                                      bin => '$(BIN_INCLUDES)' } -> {$args{intent}},
                                    '$(CNF_INCLUDES)',
@@ -789,6 +846,18 @@ EOF
                                    @{$args{incs}});
           my $incs_on = join("\n\t\@ ", @{$incs_cmds[0]}) || '!';
           my $incs_off = join("\n\t\@ ", @{$incs_cmds[1]}) || '!';
+          my $defs = join("", map { ",".$_ } @{$args{defs}});
+          my $target = platform->asm($args{src});
+
+          if ($args{generator}->[0] =~ /\.pl$/) {
+              $generator = '$(PERL)'.$generator_incs.' '.$generator
+                  .' '.$cppflags;
+          } elsif ($args{generator}->[0] =~ /\.S$/) {
+              $generator = undef;
+          } else {
+              die "Generator type for $src unknown: $generator\n";
+          }
+
           if (defined($generator)) {
               # If the target is named foo.S in build.info, we want to
               # end up generating foo.s in two steps.
@@ -797,35 +866,48 @@ EOF
 $target : $args{generator}->[0] $deps
 	$generator \$\@-S
         \@ $incs_on
+        \@ extradefines = "$defs"
 	PIPE \$(CPP) $cppflags \$\@-S | -
-        \$(PERL) -ne "/^#(\\s*line)?\\s*[0-9]+\\s+""/ or print" > \$\@-i
+             \$(PERL) -ne "/^#(\\s*line)?\\s*[0-9]+\\s+""/ or print" > \$\@-i
+        \@ DELETE/SYMBOL/LOCAL extradefines
         \@ $incs_off
         RENAME \$\@-i \$\@
-        DELETE \$\@-S
+        DELETE \$\@-S;
 EOF
               }
               # Otherwise....
               return <<"EOF";
 $target : $args{generator}->[0] $deps
+        \@ $incs_on
+        \@ extradefines = "$defs"
 	$generator \$\@
+        \@ DELETE/SYMBOL/LOCAL extradefines
+        \@ $incs_off
 EOF
           }
           return <<"EOF";
 $target : $args{generator}->[0] $deps
         \@ $incs_on
+        \@ extradefines = "$defs"
         SHOW SYMBOL qual_includes
         PIPE \$(CPP) $cppflags $args{generator}->[0] | -
         \$(PERL) "-ne" "/^#(\\s*line)?\\s*[0-9]+\\s+""/ or print" > \$\@
+        \@ DELETE/SYMBOL/LOCAL extradefines
         \@ $incs_off
 EOF
       }
   }
 
   sub src2obj {
+      my $asmext = platform->asmext();
       my %args = @_;
-      my @srcs = map { (my $x = $_) =~ s/\.s$/.asm/; $x
-                     } ( @{$args{srcs}} );
-      (my $obj = $args{obj}) =~ s|\.o$||;
+      my @srcs =
+          map { my $x = $_;
+                (platform->isasm($x) && grep { $x eq $_ } @generated)
+                ? platform->asm($x) : $x }
+          ( @{$args{srcs}} );
+      my $obj = platform->obj($args{obj});
+      my $dep = platform->dep($args{obj});
       my $deps = join(", -\n\t\t", @srcs, @{$args{deps}});
 
       # Because VMS C isn't very good at combining a /INCLUDE path with
@@ -838,39 +920,37 @@ EOF
       my $backward = abs2rel(rel2abs("."), rel2abs($forward));
       my $objd = abs2rel(rel2abs(dirname($obj)), rel2abs($forward));
       my $objn = basename($obj);
+      my $depd = abs2rel(rel2abs(dirname($dep)), rel2abs($forward));
+      my $depn = basename($dep);
       my $srcs =
           join(", ", map { abs2rel(rel2abs($_), rel2abs($forward)) } @srcs);
-      my $before = $unified_info{before}->{$obj.".OBJ"} || "\@ !";
-      my $after = $unified_info{after}->{$obj.".OBJ"} || "\@ !";
-
-      if ($srcs[0] =~ /\.asm$/) {
-          my $asflags = { lib => ' $(LIB_ASFLAGS)',
-		          dso => ' $(DSO_ASFLAGS)',
-		          bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}};
-          return <<"EOF";
-$obj.OBJ : $deps
-        ${before}
-        SET DEFAULT $forward
-        \$(AS) $asflags \$(ASOUTFLAG)${objd}${objn}.OBJ $srcs
-        SET DEFAULT $backward
-EOF
-      }
+      my $before = $unified_info{before}->{$obj} || "\@ !";
+      my $after = $unified_info{after}->{$obj} || "\@ !";
 
       my $cflags;
-      if ($args{installed}) {
-          $cflags = { lib => '$(LIB_CFLAGS)',
-                      dso => '$(DSO_CFLAGS)',
-                      bin => '$(BIN_CFLAGS)' } -> {$args{intent}};
-      } else {
-          $cflags = { lib => '$(NO_INST_LIB_CFLAGS)',
+      if ($args{attrs}->{noinst}) {
+          $cflags = { shlib => '$(NO_INST_LIB_CFLAGS)',
+                      lib => '$(NO_INST_LIB_CFLAGS)',
                       dso => '$(NO_INST_DSO_CFLAGS)',
                       bin => '$(NO_INST_BIN_CFLAGS)' } -> {$args{intent}};
+      } else {
+          $cflags = { shlib => '$(LIB_CFLAGS)',
+                      lib => '$(LIB_CFLAGS)',
+                      dso => '$(DSO_CFLAGS)',
+                      bin => '$(BIN_CFLAGS)' } -> {$args{intent}};
       }
-      $cflags .= { lib => '$(LIB_CPPFLAGS)',
+      $cflags .= { shlib => '$(LIB_CPPFLAGS)',
+		   lib => '$(LIB_CPPFLAGS)',
 		   dso => '$(DSO_CPPFLAGS)',
 		   bin => '$(BIN_CPPFLAGS)' } -> {$args{intent}};
+      my $defs = join("", map { ",".$_ } @{$args{defs}});
+      my $asflags = { shlib => ' $(LIB_ASFLAGS)',
+		      lib => ' $(LIB_ASFLAGS)',
+		      dso => ' $(DSO_ASFLAGS)',
+		      bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}};
 
-      my @incs_cmds = includes({ lib => '$(LIB_INCLUDES)',
+      my @incs_cmds = includes({ shlib => '$(LIB_INCLUDES)',
+                                 lib => '$(LIB_INCLUDES)',
                                  dso => '$(DSO_INCLUDES)',
                                  bin => '$(BIN_INCLUDES)' } -> {$args{intent}},
                                '$(INCLUDES)',
@@ -880,34 +960,66 @@ EOF
                                } @{$args{incs}});
       my $incs_on = join("\n\t\@ ", @{$incs_cmds[0]}) || '!';
       my $incs_off = join("\n\t\@ ", @{$incs_cmds[1]}) || '!';
-      my $depbuild = $disabled{makedepend} ? ""
-          : " /MMS=(FILE=${objd}${objn}.D,TARGET=$obj.OBJ)";
 
-      return <<"EOF";
-$obj.OBJ : $deps
+      if ($srcs[0] =~ /\Q${asmext}\E$/) {
+          return <<"EOF";
+$obj : $deps
+        ${before}
+        SET DEFAULT $forward
+        \$(AS) $asflags \$(ASOUTFLAG)${objd}${objn} $srcs
+        SET DEFAULT $backward
+        ${after}
+        - PURGE $obj
+EOF
+      } elsif ($srcs[0] =~ /.S$/) {
+         return <<"EOF";
+$obj : $deps
         ${before}
         SET DEFAULT $forward
         \@ $incs_on
-        \$(CC) ${cflags}${depbuild} /OBJECT=${objd}${objn}.OBJ /REPOSITORY=$backward $srcs
+        \@ extradefines = "$defs"
+        PIPE \$(CPP) ${cflags} $srcs | -
+             \$(PERL) -ne "/^#(\\s*line)?\\s*[0-9]+\\s+""/ or print" -
+             > ${objd}${objn}-asm
+        \@ DELETE/SYMBOL/LOCAL extradefines
         \@ $incs_off
         SET DEFAULT $backward
         ${after}
-        - PURGE $obj.OBJ
+        \$(AS) $asflags \$(ASOUTFLAG)$obj $obj-asm
+        - PURGE $obj
+EOF
+      }
+
+      my $depbuild = $disabled{makedepend} ? ""
+          : " /MMS=(FILE=${depd}${depn},TARGET=$obj)";
+
+      return <<"EOF";
+$obj : $deps
+        ${before}
+        SET DEFAULT $forward
+        \@ $incs_on
+        \@ extradefines = "$defs"
+        \$(CC) ${cflags}${depbuild} /OBJECT=${objd}${objn} /REPOSITORY=$backward $srcs
+        \@ DELETE/SYMBOL/LOCAL extradefines
+        \@ $incs_off
+        SET DEFAULT $backward
+        ${after}
+        - PURGE $obj
 EOF
   }
-  sub libobj2shlib {
+  sub obj2shlib {
       my %args = @_;
-      my $lib = $args{lib};
-      my $shlib = $args{shlib};
-      my $libd = dirname($lib);
-      my $libn = basename($lib);
-      my @objs = map { (my $x = $_) =~ s|\.o$|.OBJ|; $x }
-                 grep { $_ =~ m|\.o$| }
+      my $shlibname = platform->sharedname($args{lib});
+      my $shlib = platform->sharedlib($args{lib});
+      my @objs = map { platform->convertext($_) }
+                 grep { platform->isobj($_) }
+                 @{$args{objs}};
+      my @defs = map { platform->convertext($_) }
+                 grep { platform->isdef($_) }
                  @{$args{objs}};
-      my @defs = grep { $_ =~ /\.opt$/ } @{$args{objs}};
       my @deps = compute_lib_depends(@{$args{deps}});
       die "More than one symbol vector" if scalar @defs > 1;
-      my $deps = join(", -\n\t\t", @defs, @deps);
+      my $deps = join(", -\n\t\t", @objs, @defs, map { $_->{lib} } @deps);
       my $shlib_target = $disabled{shared} ? "" : $target{shared_target};
       my $translatesyms_pl = abs2rel(rel2abs(catfile($config{sourcedir},
                                                      "VMS", "translatesyms.pl")),
@@ -921,22 +1033,23 @@ EOF
                                  "WRITE OPT_FILE \"$x" } @objs).
           "\"";
       my $write_opt2 =
-          join("\n\t", map { my $x = $_ =~ /\[/ ? $_ : "[]".$_;
+          join("\n\t", map { my $x = $_->{lib} =~ /\[/
+                                 ? $_->{lib} : "[]".$_->{lib};
                              $x =~ s|(\.EXE)|$1/SHARE|;
                              $x =~ s|(\.OLB)|$1/LIB|;
                              "WRITE OPT_FILE \"$x\"" } @deps)
           || "\@ !";
       return <<"EOF"
-$shlib.EXE : $lib.OLB $deps
+$shlib : $deps
         \$(PERL) $translatesyms_pl \$(BLDDIR)CXX\$DEMANGLER_DB. < $defs[0] > $defs[0]-translated
-        OPEN/WRITE/SHARE=READ OPT_FILE $lib-components.OPT
+        OPEN/WRITE/SHARE=READ OPT_FILE $shlibname-components.OPT
         $write_opt1
         $write_opt2
         CLOSE OPT_FILE
         LINK \$(LIB_LDFLAGS)/SHARE=\$\@ $defs[0]-translated/OPT,-
-                $lib-components.OPT/OPT \$(LIB_EX_LIBS)
-        DELETE $defs[0]-translated;*,$lib-components.OPT;*
-        PURGE $shlib.EXE,$shlib.MAP
+                $shlibname-components.OPT/OPT \$(LIB_EX_LIBS)
+        DELETE $defs[0]-translated;*,$shlibname-components.OPT;*
+        PURGE $shlibname.EXE,$shlibname.MAP
 EOF
         . ($config{target} =~ m|alpha| ? "" : <<"EOF"
         SET IMAGE/FLAGS=(NOCALL_DEBUG) \$\@
@@ -945,17 +1058,18 @@ EOF
   }
   sub obj2dso {
       my %args = @_;
-      my $lib = $args{lib};
-      my $libd = dirname($lib);
-      my $libn = basename($lib);
-      (my $libn_nolib = $libn) =~ s/^lib//;
-      my @objs = map { (my $x = $_) =~ s|\.o$|.OBJ|; $x } @{$args{objs}};
+      my $dsoname = platform->dsoname($args{module});
+      my $dso = platform->dso($args{module});
+      my @objs = map { platform->convertext($_) }
+                 grep { platform->isobj($_) }
+                 @{$args{objs}};
+      my @defs = map { platform->convertext($_) }
+                 grep { platform->isdef($_) }
+                 @{$args{objs}};
       my @deps = compute_lib_depends(@{$args{deps}});
-      my $deps = join(", -\n\t\t", @objs, @deps);
+      my $deps = join(", -\n\t\t", @objs, @defs, map { $_->{lib} } @deps);
+      die "More than one symbol vector" if scalar @defs > 1;
       my $shlib_target = $disabled{shared} ? "" : $target{shared_target};
-      my $engine_opt = abs2rel(rel2abs(catfile($config{sourcedir},
-                                               "VMS", "engine.opt")),
-                               rel2abs($config{builddir}));
       # The "[]" hack is because in .OPT files, each line inherits the
       # previous line's file spec as default, so if no directory spec
       # is present in the current line and the previous line has one that
@@ -965,20 +1079,21 @@ EOF
                                  "WRITE OPT_FILE \"$x" } @objs).
           "\"";
       my $write_opt2 =
-          join("\n\t", map { my $x = $_ =~ /\[/ ? $_ : "[]".$_;
+          join("\n\t", map { my $x = $_->{lib} =~ /\[/
+                                 ? $_->{lib} : "[]".$_->{lib};
                              $x =~ s|(\.EXE)|$1/SHARE|;
                              $x =~ s|(\.OLB)|$1/LIB|;
                              "WRITE OPT_FILE \"$x\"" } @deps)
           || "\@ !";
       return <<"EOF"
-$lib.EXE : $deps
-        OPEN/WRITE/SHARE=READ OPT_FILE $lib.OPT
-        TYPE $engine_opt /OUTPUT=OPT_FILE:
+$dso : $deps
+        OPEN/WRITE/SHARE=READ OPT_FILE $dsoname-components.OPT
         $write_opt1
         $write_opt2
         CLOSE OPT_FILE
-        LINK \$(DSO_LDFLAGS)/SHARE=\$\@ $lib.OPT/OPT \$(DSO_EX_LIBS)
-        - PURGE $lib.EXE,$lib.OPT,$lib.MAP
+        LINK \$(DSO_LDFLAGS)/SHARE=\$\@ $defs[0]/OPT,-
+		$dsoname-components.OPT/OPT \$(DSO_EX_LIBS)
+        - PURGE $dsoname.EXE,$dsoname.OPT,$dsoname.MAP
 EOF
         . ($config{target} =~ m|alpha| ? "" : <<"EOF"
         SET IMAGE/FLAGS=(NOCALL_DEBUG) \$\@
@@ -987,29 +1102,31 @@ EOF
   }
   sub obj2lib {
       my %args = @_;
-      (my $lib = $args{lib}) =~ s/\.a$//;
-      my @objs = map { (my $x = $_) =~ s|\.o$|.OBJ|; $x } @{$args{objs}};
+      my $lib = platform->staticlib($args{lib});
+      my @objs = map { platform->convertext($_) }
+                 grep { platform->isobj($_) }
+                 @{$args{objs}};
       my $objs = join(", -\n\t\t", @objs);
-      my $fill_lib = join("\n\t", (map { "LIBRARY/REPLACE $lib.OLB $_" }
-                                   @objs));
+      my $fill_lib = join("\n\t", (map { "LIBRARY/REPLACE $lib $_" } @objs));
       return <<"EOF";
-$lib.OLB : $objs
-        LIBRARY/CREATE/OBJECT $lib.OLB
+$lib : $objs
+        LIBRARY/CREATE/OBJECT $lib
         $fill_lib
-        - PURGE $lib.OLB
+        - PURGE $lib
 EOF
   }
   sub obj2bin {
       my %args = @_;
-      my $bin = $args{bin};
-      my $bind = dirname($bin);
-      my $binn = basename($bin);
-      my @objs = map { (my $x = $_) =~ s|\.o$|.OBJ|; $x } @{$args{objs}};
+      my $bin = platform->bin($args{bin});
+      my $binname = platform->binname($args{bin});
+      my @objs = map { platform->convertext($_) }
+                 grep { platform->isobj($_) }
+                 @{$args{objs}};
       my $objs = join(",", @objs);
       my @deps = compute_lib_depends(@{$args{deps}});
-      my $deps = join(", -\n\t\t", @objs, @deps);
+      my $deps = join(", -\n\t\t", @objs, map { $_->{lib} } @deps);
 
-      my $olb_count = scalar grep(m|\.OLB$|, @deps);
+      my $olb_count = scalar grep(m|\.OLB$|, map { $_->{lib} } @deps);
       my $analyse_objs = "@ !";
       if ($olb_count > 0) {
           my $analyse_quals =
@@ -1025,14 +1142,22 @@ EOF
                                  "\@ WRITE OPT_FILE \"$x" } @objs).
           "\"";
       my $write_opt2 =
-          join("\n\t", map { my @lines = ();
-                             my $x = $_ =~ /\[/ ? $_ : "[]".$_;
+          join("\n\t", "WRITE OPT_FILE \"CASE_SENSITIVE=YES\"",
+                       map { my @lines = ();
+                             use Data::Dumper;
+                             my $x = $_->{lib} =~ /\[/
+                                 ? $_->{lib} : "[]".$_->{lib};
                              if ($x =~ m|\.EXE$|) {
                                  push @lines, "\@ WRITE OPT_FILE \"$x/SHARE\"";
                              } elsif ($x =~ m|\.OLB$|) {
-                                 (my $l = $x) =~ s/\W/_/g;
-                                 push @lines, 
-                                     "\@ IF nomain THEN WRITE OPT_FILE \"$x/LIB\$(INCLUDE_MAIN_$l)\"",
+                                 # Special hack to include the MAIN object
+                                 # module explicitly.  This will only be done
+                                 # if there isn't a 'main' in the program's
+                                 # object modules already.
+                                 my $main = $_->{attrs}->{has_main}
+                                     ? '/INCLUDE=main' : '';
+                                 push @lines,
+                                     "\@ IF nomain THEN WRITE OPT_FILE \"$x/LIB$main\"",
                                      "\@ IF .NOT. nomain THEN WRITE OPT_FILE \"$x/LIB\""
                              }
                              @lines
@@ -1057,19 +1182,19 @@ EOF
       # isn't necessary.  If there are other warnings, however, we show them
       # and let it break the build.
       return <<"EOF"
-$bin.EXE : $deps
+$bin : $deps
         $analyse_objs
-        @ OPEN/WRITE/SHARE=READ OPT_FILE $bin.OPT
+        @ OPEN/WRITE/SHARE=READ OPT_FILE $binname.OPT
         $write_opt1
         $write_opt2
         @ CLOSE OPT_FILE
-        TYPE $bin.opt ! For debugging
-        - pipe SPAWN/WAIT/NOLOG/OUT=$bin.LINKLOG -
-                    LINK \$(BIN_LDFLAGS)/EXEC=\$\@ $bin.OPT/OPT \$(BIN_EX_LIBS) ; -
+        TYPE $binname.OPT ! For debugging
+        - pipe SPAWN/WAIT/NOLOG/OUT=$binname.LINKLOG -
+                    LINK \$(BIN_LDFLAGS)/EXEC=\$\@ $binname.OPT/OPT \$(BIN_EX_LIBS) ; -
                link_status = \$status ; link_severity = link_status .AND. 7
         @ search_severity = 1
         -@ IF link_severity .EQ. 0 THEN -
-                pipe SEARCH $bin.LINKLOG "%","-"/MATCH=AND | -
+                pipe SEARCH $binname.LINKLOG "%","-"/MATCH=AND | -
                      SPAWN/WAIT/NOLOG/OUT=NLA0: -
                           SEARCH SYS\$INPUT: "-W-MULDEF,"/MATCH=NOR ; -
                      search_severity = \$severity
@@ -1080,10 +1205,10 @@ $bin.EXE : $deps
         @ IF search_severity .EQ. 3 THEN link_severity = 1
         @ ! At this point, if link_severity shows that there was a fault
         @ ! or warning, make sure to restore the linking status.
-        -@ IF .NOT. link_severity THEN TYPE $bin.LINKLOG
-        -@ DELETE $bin.LINKLOG;*
+        -@ IF .NOT. link_severity THEN TYPE $binname.LINKLOG
+        -@ DELETE $binname.LINKLOG;*
         @ IF .NOT. link_severity THEN SPAWN/WAIT/NOLOG EXIT 'link_status'
-        - PURGE $bin.EXE,$bin.OPT
+        - PURGE $bin,$binname.OPT
 EOF
       . ($config{target} =~ m|alpha| ? "" : <<"EOF"
         SET IMAGE/FLAGS=(NOCALL_DEBUG) \$\@

Configurations/dist.conf

@@ -1,12 +0,0 @@
-## -*- mode: perl; -*-
-## Build configuration targets for openssl-team members
-
-# This is to support 'make dist'
-my %targets = (
-    "dist" => {
-        inherit_from     => [ 'BASE_unix' ],
-        CC               => "cc",
-        CFLAGS           => "-O",
-        thread_scheme    => "(unknown)",
-    },
-);

Configurations/platform.pm

@@ -0,0 +1,18 @@
+package platform;
+
+use strict;
+use warnings;
+use vars qw(@ISA);
+
+# Callers must make sure @INC has the build directory
+use configdata;
+
+my $module = $target{perl_platform} || 'Unix';
+(my $module_path = $module) =~ s|::|/|g;
+
+require "platform/$module_path.pm";
+@ISA = ("platform::$module");
+
+1;
+
+__END__

Configurations/platform/AIX.pm

@@ -0,0 +1,28 @@
+package platform::AIX;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::Unix;
+@ISA = qw(platform::Unix);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub dsoext              { '.so' }
+sub shlibextsimple      { '.a' }
+
+# In shared mode, the default static library names clashes with the final
+# "simple" full shared library name, so we add '_a' to the basename of the
+# static libraries in that case.
+sub staticname {
+    # Non-installed libraries are *always* static, and their names remain
+    # the same, except for the mandatory extension
+    my $in_libname = platform::BASE->staticname($_[1]);
+    return $in_libname if $unified_info{attributes}->{$_[1]}->{noinst};
+
+    return platform::BASE->staticname($_[1]) . '_a';
+}

Configurations/platform/BASE.pm

@@ -0,0 +1,98 @@
+package platform::BASE;
+
+use strict;
+use warnings;
+use Carp;
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+# Globally defined "platform specific" extensions, available for uniformity
+sub depext      { '.d' }
+
+# Functions to convert internal file representations to platform specific
+# ones.  Note that these all depend on extension functions that MUST be
+# defined per platform.
+#
+# Currently known internal or semi-internal extensions are:
+#
+# .a            For libraries that are made static only.
+#               Internal libraries only.
+# .o            For object files.
+# .s, .S        Assembler files.  This is an actual extension on Unix
+# .res          Resource file.  This is an actual extension on Windows
+
+sub binname     { return $_[1] } # Name of executable binary
+sub dsoname     { return $_[1] } # Name of dynamic shared object (DSO)
+sub sharedname  { return __isshared($_[1]) ? $_[1] : undef } # Name of shared lib
+sub staticname  { return __base($_[1], '.a') } # Name of static lib
+
+# Convenience function to convert the shlib version to an acceptable part
+# of a file or directory name.  By default, we consider it acceptable as is.
+sub shlib_version_as_filename { return $config{shlib_version} }
+
+# Convenience functions to convert the possible extension of an input file name
+sub bin         { return $_[0]->binname($_[1]) . $_[0]->binext() }
+sub dso         { return $_[0]->dsoname($_[1]) . $_[0]->dsoext() }
+sub sharedlib   { return __concat($_[0]->sharedname($_[1]), $_[0]->shlibext()) }
+sub staticlib   { return $_[0]->staticname($_[1]) . $_[0]->libext() }
+
+# More convenience functions for intermediary files
+sub def         { return __base($_[1], '.ld') . $_[0]->defext() }
+sub obj         { return __base($_[1], '.o') . $_[0]->objext() }
+sub res         { return __base($_[1], '.res') . $_[0]->resext() }
+sub dep         { return __base($_[1], '.o') . $_[0]->depext() } # <- objname
+sub asm         { return __base($_[1], '.S', '.s') . $_[0]->asmext() }
+
+# Another set of convenience functions for standard checks of certain
+# internal extensions and conversion from internal to platform specific
+# extension.  Note that the latter doesn't deal with libraries because
+# of ambivalence
+sub isdef       { return $_[1] =~ m|\.ld$|;   }
+sub isobj       { return $_[1] =~ m|\.o$|;    }
+sub isres       { return $_[1] =~ m|\.res$|;  }
+sub isasm       { return $_[1] =~ m|\.[Ss]$|; }
+sub isstaticlib { return $_[1] =~ m|\.a$|;    }
+sub convertext {
+    if ($_[0]->isdef($_[1]))        { return $_[0]->def($_[1]); }
+    if ($_[0]->isobj($_[1]))        { return $_[0]->obj($_[1]); }
+    if ($_[0]->isres($_[1]))        { return $_[0]->res($_[1]); }
+    if ($_[0]->isasm($_[1]))        { return $_[0]->asm($_[1]); }
+    if ($_[0]->isstaticlib($_[1]))  { return $_[0]->staticlib($_[1]); }
+    return $_[1];
+}
+
+# Helpers ############################################################
+
+# __base EXPR, LIST
+# This returns the given path (EXPR) with the matching suffix from LIST stripped
+sub __base {
+    my $path = shift;
+    foreach (@_) {
+        if ($path =~ m|\Q${_}\E$|) {
+            return $`;
+        }
+    }
+    return $path;
+}
+
+# __isshared EXPR
+# EXPR is supposed to be a library name.  This will return true if that library
+# can be assumed to be a shared library, otherwise false
+sub __isshared {
+    return !($disabled{shared} || $_[0] =~ /\.a$/);
+}
+
+# __concat LIST
+# Returns the concatenation of all elements of LIST if none of them is
+# undefined.  If one of them is undefined, returns undef instead.
+sub __concat {
+    my $result = '';
+    foreach (@_) {
+        return undef unless defined $_;
+        $result .= $_;
+    }
+    return $result;
+}
+
+1;

Configurations/platform/Cygwin.pm

@@ -0,0 +1,22 @@
+package platform::Cygwin;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::mingw;
+@ISA = qw(platform::mingw);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub sharedname {
+    my $class = shift;
+    my $lib = platform::mingw->sharedname(@_);
+    $lib =~ s|^lib|cyg| if defined $lib;
+    return $lib;
+}
+
+1;

Configurations/platform/Unix.pm

@@ -0,0 +1,69 @@
+package platform::Unix;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::BASE;
+@ISA = qw(platform::BASE);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub binext              { $target{exe_extension} || '' }
+sub dsoext              { $target{dso_extension} || platform->shlibextsimple()
+                              || '.so' }
+# Because these are also used in scripts and not just Makefile, we must
+# convert $(SHLIB_VERSION_NUMBER) to the actual number.
+sub shlibext            { (my $x = $target{shared_extension}
+                               || '.so.$(SHLIB_VERSION_NUMBER)')
+                              =~ s|\.\$\(SHLIB_VERSION_NUMBER\)
+                                  |.$config{shlib_version}|x;
+                          $x; }
+sub libext              { $target{lib_extension} || '.a' }
+sub defext              { $target{def_extension} || '.ld' }
+sub objext              { $target{obj_extension} || '.o' }
+sub depext              { $target{obj_extension} || '.d' }
+
+# Other extra that aren't defined in platform::BASE
+sub shlibextsimple      { (my $x = $target{shared_extension} || '.so')
+                              =~ s|\.\$\(SHLIB_VERSION_NUMBER\)||;
+                          $x; }
+sub shlibvariant        { $target{shlib_variant} || "" }
+sub makedepprog         { $disabled{makedepend} ? undef : $config{makedepprog} }
+
+# No conversion of assembler extension on Unix
+sub asm {
+    return $_[1];
+}
+
+# At some point, we might decide that static libraries are called something
+# other than the default...
+sub staticname {
+    # Non-installed libraries are *always* static, and their names remain
+    # the same, except for the mandatory extension
+    my $in_libname = platform::BASE->staticname($_[1]);
+    return $in_libname if $unified_info{attributes}->{$_[1]}->{noinst};
+
+    # We currently return the same name anyway...  but we might choose to
+    # append '_static' or '_a' some time in the future.
+    return platform::BASE->staticname($_[1]);
+}
+
+sub sharedname {
+    return platform::BASE::__concat(platform::BASE->sharedname($_[1]),
+                                    ($_[0]->shlibvariant() // ''));
+}
+
+sub sharedname_simple {
+    return platform::BASE::__isshared($_[1]) ? $_[1] : undef;
+}
+
+sub sharedlib_simple {
+    return platform::BASE::__concat($_[0]->sharedname_simple($_[1]),
+                                    $_[0]->shlibextsimple());
+}
+
+1;

Configurations/platform/VMS.pm

@@ -0,0 +1,64 @@
+package platform::VMS;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::BASE;
+@ISA = qw(platform::BASE);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+# VMS has a cultural standard where all installed libraries are prefixed.
+# For OpenSSL, the choice is 'ossl$' (this prefix was claimed in a
+# conversation with VSI, Tuesday January 26 2016)
+sub osslprefix          { 'OSSL$' }
+
+sub binext              { '.EXE' }
+sub dsoext              { '.EXE' }
+sub shlibext            { '.EXE' }
+sub libext              { '.OLB' }
+sub defext              { '.OPT' }
+sub objext              { '.OBJ' }
+sub depext              { '.D' }
+sub asmext              { '.ASM' }
+
+# Other extra that aren't defined in platform::BASE
+sub shlibvariant        { $target{shlib_variant} || '' }
+
+sub optext              { '.OPT' }
+sub optname             { return $_[1] }
+sub opt                 { return $_[0]->optname($_[1]) . $_[0]->optext() }
+
+# Other projects include the pointer size in the name of installed libraries,
+# so we do too.
+sub staticname {
+    # Non-installed libraries are *always* static, and their names remain
+    # the same, except for the mandatory extension
+    my $in_libname = platform::BASE->staticname($_[1]);
+    return $in_libname if $unified_info{attributes}->{$_[1]}->{noinst};
+
+    return platform::BASE::__concat($_[0]->osslprefix(),
+                                    platform::BASE->staticname($_[1]),
+                                    $target{pointer_size});
+}
+
+# To enable installation of multiple major OpenSSL releases, we include the
+# version number in installed shared library names.
+my $sover_filename =
+    join('', map { sprintf "%02d", $_ } split(m|\.|, $config{shlib_version}));
+sub shlib_version_as_filename {
+    return $sover_filename;
+}
+sub sharedname {
+    return platform::BASE::__concat($_[0]->osslprefix(),
+                                    platform::BASE->sharedname($_[1]),
+                                    $_[0]->shlib_version_as_filename(),
+                                    ($_[0]->shlibvariant() // ''),
+                                    "_shr$target{pointer_size}");
+}
+
+1;

Configurations/platform/Windows.pm

@@ -0,0 +1,63 @@
+package platform::Windows;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::BASE;
+@ISA = qw(platform::BASE);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub binext              { '.exe' }
+sub dsoext              { '.dll' }
+sub shlibext            { '.dll' }
+sub libext              { '.lib' }
+sub defext              { '.def' }
+sub objext              { '.obj' }
+sub depext              { '.d' }
+sub asmext              { '.asm' }
+
+# Other extra that aren't defined in platform::BASE
+sub resext              { '.res' }
+sub shlibextimport      { '.lib' }
+sub shlibvariant        { $target{shlib_variant} || '' }
+
+sub staticname {
+    # Non-installed libraries are *always* static, and their names remain
+    # the same, except for the mandatory extension
+    my $in_libname = platform::BASE->staticname($_[1]);
+    return $in_libname if $unified_info{attributes}->{$_[1]}->{noinst};
+
+    # To make sure not to clash with an import library, we make the static
+    # variant of our installed libraries get '_static' added to their names.
+    return platform::BASE->staticname($_[1])
+        . ($disabled{shared} ? '' : '_static');
+}
+
+# To mark forward compatibility, we include the OpenSSL major release version
+# number in the installed shared library names.
+(my $sover_filename = $config{shlib_version}) =~ s|\.|_|g;
+sub shlib_version_as_filename {
+    return $sover_filename
+}
+sub sharedname {
+    return platform::BASE::__concat(platform::BASE->sharedname($_[1]),
+                                    "-",
+                                    $_[0]->shlib_version_as_filename(),
+                                    ($_[0]->shlibvariant() // ''));
+}
+
+sub sharedname_import {
+    return platform::BASE::__isshared($_[1]) ? $_[1] : undef;
+}
+
+sub sharedlib_import {
+    return platform::BASE::__concat($_[0]->sharedname_import($_[1]),
+                                    $_[0]->shlibextimport());
+}
+
+1;

Configurations/platform/Windows/MSVC.pm

@@ -0,0 +1,33 @@
+package platform::Windows::MSVC;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::Windows;
+@ISA = qw(platform::Windows);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub pdbext              { '.pdb' }
+
+sub staticlibpdb {
+    return platform::BASE::__concat($_[0]->staticname($_[1]), $_[0]->pdbext());
+}
+
+sub sharedlibpdb {
+    return platform::BASE::__concat($_[0]->sharedname($_[1]), $_[0]->pdbext());
+}
+
+sub dsopdb {
+    return platform::BASE::__concat($_[0]->dsoname($_[1]), $_[0]->pdbext());
+}
+
+sub binpdb {
+    return platform::BASE::__concat($_[0]->binname($_[1]), $_[0]->pdbext());
+}
+
+1;

Configurations/platform/mingw.pm

@@ -0,0 +1,48 @@
+package platform::mingw;
+
+use strict;
+use warnings;
+use Carp;
+
+use vars qw(@ISA);
+
+require platform::Unix;
+@ISA = qw(platform::Unix);
+
+# Assume someone set @INC right before loading this module
+use configdata;
+
+sub binext              { '.exe' }
+sub objext              { '.obj' }
+sub libext              { '.a' }
+sub dsoext              { '.dll' }
+sub defext              { '.def' }
+
+# Other extra that aren't defined in platform::BASE
+sub resext              { '.res.obj' }
+sub shlibext            { '.dll' }
+sub shlibextimport      { $target{shared_import_extension} || '.dll.a' }
+sub shlibextsimple      { undef }
+sub makedepprog         { $disabled{makedepend} ? undef : $config{makedepprog} }
+
+(my $sover_filename = $config{shlib_version}) =~ s|\.|_|g;
+sub shlib_version_as_filename {
+    return $sover_filename;
+}
+sub sharedname {
+    return platform::BASE::__concat(platform::BASE->sharedname($_[1]),
+                                    "-",
+                                    $_[0]->shlib_version_as_filename(),
+                                    ($config{target} eq "mingw64"
+                                         ? "-x64" : ""));
+}
+
+# With Mingw and other DLL producers, there isn't really any "simpler"
+# shared library name.  However, there is a static import library, so
+# we return that instead.
+sub sharedlib_simple {
+    return platform::BASE::__concat(platform::BASE->sharedname($_[1]),
+                                    $_[0]->shlibextimport());
+}
+
+1;

Configurations/shared-info.pl

@@ -1,8 +1,8 @@
 #! /usr/bin/env perl
 # -*- mode: perl; -*-
-# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
 #
-# Licensed under the OpenSSL license (the "License").  You may not use
+# Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
 # in the file LICENSE in the source distribution or at
 # https://www.openssl.org/source/license.html
@@ -32,15 +32,14 @@ my %shared_info;
         return {
             %{$shared_info{'gnu-shared'}},
             shared_defflag    => '-Wl,--version-script=',
+            dso_ldflags       =>
+                (grep /(?:^|\s)-fsanitize/,
+                 @{$config{CFLAGS}}, @{$config{cflags}})
+                ? ''
+                : '-Wl,-z,defs',
         };
     },
     'bsd-gcc-shared' => sub { return $shared_info{'linux-shared'}; },
-    'bsd-shared' => sub {
-        return $shared_info{'gnu-shared'} if detect_gnu_ld();
-        return {
-            shared_ldflag     => '-shared -nostdlib',
-        };
-    },
     'darwin-shared' => {
         module_ldflags        => '-bundle',
         shared_ldflag         => '-dynamiclib -current_version $(SHLIB_VERSION_NUMBER) -compatibility_version $(SHLIB_VERSION_NUMBER)',
@@ -53,7 +52,7 @@ my %shared_info;
     'mingw-shared' => sub {
         return {
             %{$shared_info{'cygwin-shared'}},
-            # def_flag made to empty string so  it still generates
+            # def_flag made to empty string so it still generates
             # something
             shared_defflag    => '',
         };
@@ -79,4 +78,16 @@ my %shared_info;
             shared_sonameflag => '-h ',
         };
     },
+    'solaris-gcc-shared' => sub {
+        return $shared_info{'linux-shared'} if detect_gnu_ld();
+        return {
+            # Note: we should also have -shared here, but because some
+            # config targets define it with an added -static-libgcc
+            # following it, we don't want to change the order.  This
+            # forces all solaris gcc config targets to define shared_ldflag
+            shared_ldflag     => '-Wl,-Bsymbolic',
+            shared_defflag    => "-Wl,-M,",
+            shared_sonameflag => "-Wl,-h,",
+        };
+    },
 );

Configurations/unix-Makefile.tmpl

@@ -3,16 +3,7 @@
 ##
 ## {- join("\n## ", @autowarntext) -}
 {-
-     our $objext = $target{obj_extension} || ".o";
-     our $depext = $target{dep_extension} || ".d";
-     our $exeext = $target{exe_extension} || "";
-     our $libext = $target{lib_extension} || ".a";
-     our $shlibext = $target{shared_extension} || ".so";
-     our $shlibvariant = $target{shlib_variant} || "";
-     our $shlibextsimple = $target{shared_extension_simple} || ".so";
-     our $shlibextimport = $target{shared_import_extension} || "";
-     our $dsoext = $target{dso_extension} || ".so";
-     our $makedepprog = $disabled{makedepend} ? undef : $config{makedepprog};
+     our $makedepprog = platform->makedepprog();
 
      sub windowsdll { $config{target} =~ /^(?:Cygwin|mingw)/ }
 
@@ -20,58 +11,8 @@
      # libcrypto.a and use libcrypto_a.a as static one.
      sub sharedaix  { !$disabled{shared} && $config{target} =~ /^aix/ }
 
-     our $sover_dirname = $config{shlib_version_number};
-     $sover_dirname =~ s|\.|_|g
-         if $config{target} =~ /^mingw/;
+     our $sover_dirname = platform->shlib_version_as_filename();
 
-     # shlib and shlib_simple both take a static library name and figure
-     # out what the shlib name should be.
-     #
-     # When OpenSSL is configured "no-shared", these functions will just
-     # return empty lists, making them suitable to join().
-     #
-     # With Windows DLL producers, shlib($libname) will return the shared
-     # library name (which usually is different from the static library
-     # name) with the default shared extension appended to it, while
-     # shlib_simple($libname) will return the static library name with
-     # the shared extension followed by ".a" appended to it.  The former
-     # result is used as the runtime shared library while the latter is
-     # used as the DLL import library.
-     #
-     # On all Unix systems, shlib($libname) will return the library name
-     # with the default shared extension, while shlib_simple($libname)
-     # will return the name from shlib($libname) with any SO version number
-     # removed.  On some systems, they may therefore return the exact same
-     # string.
-     sub shlib {
-         my $lib = shift;
-         return () if $disabled{shared} || $lib =~ /\.a$/;
-         return $unified_info{sharednames}->{$lib}. $shlibvariant. '$(SHLIB_EXT)';
-     }
-     sub shlib_simple {
-         my $lib = shift;
-         return () if $disabled{shared} || $lib =~ /\.a$/;
-
-         if (windowsdll()) {
-             return $lib . '$(SHLIB_EXT_IMPORT)';
-         }
-         return $lib .  '$(SHLIB_EXT_SIMPLE)';
-     }
-
-     # Easy fixing of static library names
-     sub lib {
-         (my $lib = shift) =~ s/\.a$//;
-         return $lib . $libext;
-     }
-
-     # dso is a complement to shlib / shlib_simple that returns the
-     # given libname with the simple shared extension (possible SO version
-     # removed).  This differs from shlib_simple() by being unconditional.
-     sub dso {
-         my $engine = shift;
-
-         return $engine . $dsoext;
-     }
      # This makes sure things get built in the order they need
      # to. You're welcome.
      sub dependmagic {
@@ -79,6 +20,40 @@
 
          return "$target: build_generated\n\t\$(MAKE) depend && \$(MAKE) _$target\n_$target";
      }
+
+     our $COLUMNS = $ENV{COLUMNS};
+     if ($COLUMNS =~ /^\d+$/) {
+         $COLUMNS = int($COLUMNS) - 2; # 2 to leave space for ending ' \'
+     } else {
+         $COLUMNS = 76;
+     }
+
+     sub fill_lines {
+         my $item_sep = shift;                  # string
+         my $line_length = shift;               # number of chars
+
+         my @result = ();
+         my $resultpos = 0;
+
+         foreach (@_) {
+             my $fill_line = $result[$resultpos] // '';
+             my $newline =
+                 ($fill_line eq '' ? '' : $fill_line . $item_sep) . $_;
+
+             if (length($newline) > $line_length) {
+                 # If this is a single item and the intended result line
+                 # is empty, we put it there anyway
+                 if ($fill_line eq '') {
+                     $result[$resultpos++] = $newline;
+                 } else {
+                     $result[++$resultpos] = $_;
+                 }
+             } else {
+                 $result[$resultpos] = $newline;
+             }
+         }
+         return @result;
+     }
      '';
 -}
 PLATFORM={- $config{target} -}
@@ -87,45 +62,149 @@ CONFIGURE_ARGS=({- join(", ",quotify_l(@{$config{perlargv}})) -})
 SRCDIR={- $config{sourcedir} -}
 BLDDIR={- $config{builddir} -}
 
-VERSION={- $config{version} -}
+VERSION={- "$config{full_version}" -}
 MAJOR={- $config{major} -}
 MINOR={- $config{minor} -}
-SHLIB_VERSION_NUMBER={- $config{shlib_version_number} -}
-SHLIB_VERSION_HISTORY={- $config{shlib_version_history} -}
-SHLIB_MAJOR={- $config{shlib_major} -}
-SHLIB_MINOR={- $config{shlib_minor} -}
+SHLIB_VERSION_NUMBER={- $config{shlib_version} -}
 SHLIB_TARGET={- $target{shared_target} -}
-SHLIB_EXT={- $shlibext -}
-SHLIB_EXT_SIMPLE={- $shlibextsimple -}
-SHLIB_EXT_IMPORT={- $shlibextimport -}
 
-LIBS={- join(" ", map { lib($_) } @{$unified_info{libraries}}) -}
-SHLIBS={- join(" ", map { shlib($_) } @{$unified_info{libraries}}) -}
-SHLIB_INFO={- join(" ", map { "\"".shlib($_).";".shlib_simple($_)."\"" } @{$unified_info{libraries}}) -}
-ENGINES={- join(" ", map { dso($_) } @{$unified_info{engines}}) -}
-PROGRAMS={- join(" ", map { $_.$exeext } @{$unified_info{programs}}) -}
-SCRIPTS={- join(" ", @{$unified_info{scripts}}) -}
+LIBS={- join(" \\\n" . ' ' x 5,
+             fill_lines(" ", $COLUMNS - 5,
+                        map { platform->staticlib($_) // () }
+                        @{$unified_info{libraries}})) -}
+SHLIBS={- join(" \\\n" . ' ' x 7,
+               fill_lines(" ", $COLUMNS - 7,
+                          map { platform->sharedlib($_) // () }
+                          @{$unified_info{libraries}})) -}
+SHLIB_INFO={- join(" \\\n" . ' ' x 11,
+                   fill_lines(" ", $COLUMNS - 11,
+                          map { my $x = platform->sharedlib($_);
+                                my $y = platform->sharedlib_simple($_);
+                                $x ? "\"$x;$y\"" : () }
+                          @{$unified_info{libraries}})) -}
+MODULES={- join(" \\\n" . ' ' x 8,
+                fill_lines(" ", $COLUMNS - 8,
+                           map { platform->dso($_) }
+                           @{$unified_info{modules}})) -}
+PROGRAMS={- join(" \\\n" . ' ' x 9,
+                 fill_lines(" ", $COLUMNS - 9,
+                            map { platform->bin($_) }
+                            @{$unified_info{programs}})) -}
+SCRIPTS={- join(" \\\n" . ' ' x 8,
+                fill_lines(" ", $COLUMNS - 8, @{$unified_info{scripts}})) -}
 {- output_off() if $disabled{makedepend}; "" -}
-DEPS={- join(" ", map { (my $x = $_) =~ s|\.o$|$depext|; $x; }
-                  grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ }
-                  keys %{$unified_info{sources}}); -}
+DEPS={- join(" \\\n" . ' ' x 5,
+             fill_lines(" ", $COLUMNS - 5,
+                        map { platform->isobj($_) ? platform->dep($_) : () }
+                        grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ }
+                        keys %{$unified_info{sources}})); -}
 {- output_on() if $disabled{makedepend}; "" -}
-GENERATED_MANDATORY={- join(" ", @{$unified_info{depends}->{""}}) -}
+GENERATED_MANDATORY={- join(" \\\n" . ' ' x 20,
+                            fill_lines(" ", $COLUMNS - 20,
+                                       @{$unified_info{depends}->{""}})) -}
 GENERATED={- # common0.tmpl provides @generated
-             join(" ", @generated ) -}
+             join(" \\\n" . ' ' x 5,
+                  fill_lines(" ", $COLUMNS - 5,
+                             map { platform->convertext($_) } @generated )) -}
 
-INSTALL_LIBS={- join(" ", map { lib($_) } @{$unified_info{install}->{libraries}}) -}
-INSTALL_SHLIBS={- join(" ", map { shlib($_) } @{$unified_info{install}->{libraries}}) -}
-INSTALL_SHLIB_INFO={- join(" ", map { "\"".shlib($_).";".shlib_simple($_)."\"" } @{$unified_info{install}->{libraries}}) -}
-INSTALL_ENGINES={- join(" ", map { dso($_) } @{$unified_info{install}->{engines}}) -}
-INSTALL_PROGRAMS={- join(" ", map { $_.$exeext } @{$unified_info{install}->{programs}}) -}
-{- output_off() if $disabled{apps}; "" -}
-BIN_SCRIPTS=$(BLDDIR)/tools/c_rehash
-MISC_SCRIPTS=$(BLDDIR)/apps/CA.pl $(BLDDIR)/apps/tsget.pl:tsget
-{- output_on() if $disabled{apps}; "" -}
+INSTALL_LIBS={-
+        join(" \\\n" . ' ' x 13,
+             fill_lines(" ", $COLUMNS - 13,
+                        map { platform->staticlib($_) // () }
+                        grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
+                        @{$unified_info{libraries}}))
+-}
+INSTALL_SHLIBS={-
+        join(" \\\n" . ' ' x 15,
+             fill_lines(" ", $COLUMNS - 15,
+                        map { platform->sharedlib($_) // () }
+                        grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
+                        @{$unified_info{libraries}}))
+-}
+INSTALL_SHLIB_INFO={-
+        join(" \\\n" . ' ' x 19,
+             fill_lines(" ", $COLUMNS - 19,
+                        map { my $x = platform->sharedlib($_);
+                              my $y = platform->sharedlib_simple($_);
+                              $x ? "\"$x;$y\"" : () }
+                        grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
+                        @{$unified_info{libraries}}))
+-}
+INSTALL_ENGINES={-
+        join(" \\\n" . ' ' x 16,
+             fill_lines(" ", $COLUMNS - 16,
+                        map { platform->dso($_) }
+                        grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
+                               && $unified_info{attributes}->{modules}->{$_}->{engine} }
+                        @{$unified_info{modules}}))
+-}
+INSTALL_MODULES={-
+        join(" \\\n" . ' ' x 16,
+             fill_lines(" ", $COLUMNS - 16,
+                        map { platform->dso($_) }
+                        grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
+                               && !$unified_info{attributes}->{modules}->{$_}->{engine} }
+                        @{$unified_info{modules}}))
+-}
+INSTALL_PROGRAMS={-
+        join(" \\\n" . ' ' x 16,
+             fill_lines(" ", $COLUMNS - 16, map { platform->bin($_) }
+                        grep { !$unified_info{attributes}->{programs}->{$_}->{noinst} }
+                        @{$unified_info{programs}}))
+-}
+BIN_SCRIPTS={-
+        join(" \\\n" . ' ' x 12,
+             fill_lines(" ", $COLUMNS - 12,
+                        map { my $x = $unified_info{attributes}->{scripts}->{$_}->{linkname};
+                              $x ? "$_:$x" : $_ }
+                        grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst}
+                               && !$unified_info{attributes}->{scripts}->{$_}->{misc} }
+                        @{$unified_info{scripts}}))
+-}
+MISC_SCRIPTS={-
+        join(" \\\n" . ' ' x 13,
+             fill_lines(" ", $COLUMNS - 13,
+                        map { my $x = $unified_info{attributes}->{scripts}->{$_}->{linkname};
+                              $x ? "$_:$x" : $_ }
+                        grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst}
+                               && $unified_info{attributes}->{scripts}->{$_}->{misc} }
+                        @{$unified_info{scripts}}))
+-}
+HTMLDOCS1={-
+        join(" \\\n" . ' ' x 10,
+             fill_lines(" ", $COLUMNS - 10, map { platform->bin($_) }
+                        @{$unified_info{htmldocs}->{man1}})) -}
+HTMLDOCS3={-
+        join(" \\\n" . ' ' x 10,
+             fill_lines(" ", $COLUMNS - 10, map { platform->bin($_) }
+                        @{$unified_info{htmldocs}->{man3}})) -}
+HTMLDOCS5={-
+        join(" \\\n" . ' ' x 10,
+             fill_lines(" ", $COLUMNS - 10, map { platform->bin($_) }
+                        @{$unified_info{htmldocs}->{man5}})) -}
+HTMLDOCS7={-
+        join(" \\\n" . ' ' x 10,
+             fill_lines(" ", $COLUMNS - 10, map { platform->bin($_) }
+                        @{$unified_info{htmldocs}->{man7}})) -}
+MANDOCS1={-
+        join(" \\\n" . ' ' x 9,
+             fill_lines(" ", $COLUMNS - 9, map { platform->bin($_) }
+                        @{$unified_info{mandocs}->{man1}})) -}
+MANDOCS3={-
+        join(" \\\n" . ' ' x 9,
+             fill_lines(" ", $COLUMNS - 9, map { platform->bin($_) }
+                        @{$unified_info{mandocs}->{man3}})) -}
+MANDOCS5={-
+        join(" \\\n" . ' ' x 9,
+             fill_lines(" ", $COLUMNS - 9, map { platform->bin($_) }
+                        @{$unified_info{mandocs}->{man5}})) -}
+MANDOCS7={-
+        join(" \\\n" . ' ' x 9,
+             fill_lines(" ", $COLUMNS - 9, map { platform->bin($_) }
+                        @{$unified_info{mandocs}->{man7}})) -}
 
-APPS_OPENSSL={- use File::Spec::Functions;
-                catfile("apps","openssl") -}
+APPS_OPENSSL="{- use File::Spec::Functions;
+                 catfile("apps","openssl") -}"
 
 # DESTDIR is for package builders so that they can configure for, say,
 # /usr/ and yet have everything installed to /tmp/somedir/usr/.
@@ -171,6 +250,7 @@ LIBDIR={- our $libdir = $config{libdir};
 libdir={- file_name_is_absolute($libdir)
           ? $libdir : '$(INSTALLTOP)/$(LIBDIR)' -}
 ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}
+MODULESDIR=$(libdir)/ossl-modules
 
 # Convenience variable for those who want to set the rpath in shared
 # libraries and applications
@@ -227,6 +307,7 @@ TARFLAGS= {- $target{TARFLAGS} -}
 
 BASENAME=       openssl
 NAME=           $(BASENAME)-$(VERSION)
+# Relative to $(SRCDIR)
 TARFILE=        ../$(NAME).tar
 
 ##### Project flags ##################################################
@@ -259,14 +340,22 @@ LIB_CPPFLAGS={- our $lib_cppflags =
                 join(' ', $target{lib_cppflags} || (),
                           $target{shared_cppflag} || (),
                           (map { '-D'.$_ }
-                               @{$config{lib_defines}},
-                               @{$config{shared_defines}}),
+                               @{$target{lib_defines} || ()},
+                               @{$target{shared_defines} || ()},
+                               @{$config{lib_defines} || ()},
+                               @{$config{shared_defines} || ()}),
+                          (map { '-I'.quotify1($_) }
+                               @{$target{lib_includes}},
+                               @{$target{shared_includes}},
+                               @{$config{lib_includes}},
+                               @{$config{shared_includes}}),
                           @{$config{lib_cppflags}},
                           @{$config{shared_cppflag}});
                 join(' ', $lib_cppflags,
                           (map { '-D'.$_ }
                                'OPENSSLDIR="\"$(OPENSSLDIR)\""',
-                               'ENGINESDIR="\"$(ENGINESDIR)\""'),
+                               'ENGINESDIR="\"$(ENGINESDIR)\""',
+                               'MODULESDIR="\"$(MODULESDIR)\""'),
                           '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
 LIB_CFLAGS={- join(' ', $target{lib_cflags} || (),
                         $target{shared_cflag} || (),
@@ -284,6 +373,16 @@ LIB_LDFLAGS={- join(' ', $target{shared_ldflag} || (),
 LIB_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
 DSO_CPPFLAGS={- join(' ', $target{dso_cppflags} || (),
                           $target{module_cppflags} || (),
+                          (map { '-D'.$_ }
+                               @{$target{dso_defines}},
+                               @{$target{module_defines}},
+                               @{$config{dso_defines} || ()},
+                               @{$config{module_defines} || ()}),
+                          (map { '-I'.quotify1($_) }
+                               @{$target{dso_includes}},
+                               @{$target{module_includes}},
+                               @{$config{dso_includes}},
+                               @{$config{module_includes}}),
                           @{$config{dso_cppflags}},
                           @{$config{module_cppflags}},
                           '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
@@ -304,6 +403,7 @@ DSO_LDFLAGS={- join(' ', $target{dso_ldflags} || (),
                          '$(CNF_LDFLAGS)', '$(LDFLAGS)') -}
 DSO_EX_LIBS=$(CNF_EX_LIBS) $(EX_LIBS)
 BIN_CPPFLAGS={- join(' ', $target{bin_cppflags} || (),
+                          (map { '-D'.$_ } @{$config{bin_defines} || ()}),
                           @{$config{bin_cppflags}},
                           '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
 BIN_CFLAGS={- join(' ', $target{bin_cflags} || (),
@@ -341,14 +441,18 @@ LANG=C
 
 # The main targets ###################################################
 
-{- dependmagic('all'); -}: build_libs_nodep build_engines_nodep build_programs_nodep link-utils
+{- dependmagic('build_sw'); -}: build_libs_nodep build_modules_nodep build_programs_nodep link-utils
 {- dependmagic('build_libs'); -}: build_libs_nodep
-{- dependmagic('build_engines'); -}: build_engines_nodep
+{- dependmagic('build_modules'); -}: build_modules_nodep
 {- dependmagic('build_programs'); -}: build_programs_nodep
 
+build_docs: build_man_docs build_html_docs
+build_man_docs: $(MANDOCS1) $(MANDOCS3) $(MANDOCS5) $(MANDOCS7)
+build_html_docs: $(HTMLDOCS1) $(HTMLDOCS3) $(HTMLDOCS5) $(HTMLDOCS7)
+
 build_generated: $(GENERATED_MANDATORY)
 build_libs_nodep: libcrypto.pc libssl.pc openssl.pc
-build_engines_nodep: $(ENGINES)
+build_modules_nodep: $(MODULES)
 build_programs_nodep: $(PROGRAMS) $(SCRIPTS)
 
 # Kept around for backward compatibility
@@ -356,26 +460,23 @@ build_apps build_tests: build_programs
 
 # Convenience target to prebuild all generated files, not just the mandatory
 # ones
-build_all_generated: $(GENERATED_MANDATORY) $(GENERATED)
+build_all_generated: $(GENERATED_MANDATORY) $(GENERATED) build_docs
 	@ : {- output_off() if $disabled{makedepend}; "" -}
 	@echo "Warning: consider configuring with no-makedepend, because if"
 	@echo "         target system doesn't have $(PERL),"
 	@echo "         then make will fail..."
 	@ : {- output_on() if $disabled{makedepend}; "" -}
 
+all: build_sw build_docs
+
 test: tests
-{- dependmagic('tests'); -}: build_programs_nodep build_engines_nodep link-utils
+{- dependmagic('tests'); -}: build_programs_nodep build_modules_nodep link-utils
 	@ : {- output_off() if $disabled{tests}; "" -}
-	( cd test; \
-	  mkdir -p test-runs; \
-	  SRCTOP=../$(SRCDIR) \
-	  BLDTOP=../$(BLDDIR) \
-	  RESULT_D=test-runs \
+	( SRCTOP=$(SRCDIR) \
+	  BLDTOP=$(BLDDIR) \
 	  PERL="$(PERL)" \
-	  EXE_EXT={- $exeext -} \
-	  OPENSSL_ENGINES=`cd ../$(BLDDIR)/engines 2>/dev/null && pwd` \
-	  OPENSSL_DEBUG_MEMORY=on \
-	    $(PERL) ../$(SRCDIR)/test/run_tests.pl $(TESTS) )
+	  EXE_EXT={- platform->binext() -} \
+	  $(PERL) $(SRCDIR)/test/run_tests.pl $(TESTS) )
 	@ : {- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
 	@echo "Tests are not supported with your chosen Configure options"
 	@ : {- output_on() if !$disabled{tests}; "" -}
@@ -408,18 +509,20 @@ libclean:
 		fi; \
 	done
 	$(RM) $(LIBS)
-	$(RM) *.map
+	$(RM) *{- platform->defext() -}
 
 clean: libclean
-	$(RM) $(PROGRAMS) $(TESTPROGS) $(ENGINES) $(SCRIPTS)
+	$(RM) $(HTMLDOCS1) $(HTMLDOCS3) $(HTMLDOCS5) $(HTMLDOCS7)
+	$(RM) $(MANDOCS1) $(MANDOCS3) $(MANDOCS5) $(MANDOCS7)
+	$(RM) $(PROGRAMS) $(TESTPROGS) $(MODULES) $(SCRIPTS)
 	$(RM) $(GENERATED_MANDATORY) $(GENERATED)
-	-$(RM) `find . -name '*{- $depext -}' -a \! -path "./.git/*"`
-	-$(RM) `find . -name '*{- $objext -}' -a \! -path "./.git/*"`
+	-$(RM) `find . -name '*{- platform->depext() -}' \! -name '.*' \! -type d -print`
+	-$(RM) `find . -name '*{- platform->objext() -}' \! -name '.*' \! -type d -print`
 	$(RM) core
-	$(RM) tags TAGS doc-nits
+	$(RM) tags TAGS doc-nits cmd-nits md-nits
 	$(RM) -r test/test-runs
 	$(RM) openssl.pc libcrypto.pc libssl.pc
-	-$(RM) `find . -type l -a \! -path "./.git/*"`
+	-$(RM) `find . -type l \! -name '.*' -print`
 	$(RM) $(TARFILE)
 
 distclean: clean
@@ -437,14 +540,14 @@ depend:
 
 # Install helper targets #############################################
 
-install_sw: all install_dev install_engines install_runtime
+install_sw: install_dev install_engines install_modules install_runtime
 
-uninstall_sw: uninstall_runtime uninstall_engines uninstall_dev
+uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev
 
 install_docs: install_man_docs install_html_docs
 
 uninstall_docs: uninstall_man_docs uninstall_html_docs
-	$(RM) -r -v $(DESTDIR)$(DOCDIR)
+	$(RM) -r $(DESTDIR)$(DOCDIR)
 
 install_ssldirs:
 	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(OPENSSLDIR)/certs
@@ -491,15 +594,15 @@ install_ssldirs:
 		chmod 644 $(DESTDIR)$(OPENSSLDIR)/ct_log_list.cnf; \
 	fi
 
-install_dev:
+install_dev: install_runtime_libs
 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
 	@$(ECHO) "*** Installing development files"
 	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(INSTALLTOP)/include/openssl
-	@ : {- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } @{$target{defines}}; "" -}
+	@ : {- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
 	@$(ECHO) "install $(SRCDIR)/ms/applink.c -> $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c"
 	@cp $(SRCDIR)/ms/applink.c $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c
 	@chmod 644 $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c
-	@ : {- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } @{$target{defines}}; "" -}
+	@ : {- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
 	@set -e; for i in $(SRCDIR)/include/openssl/*.h \
 			  $(BLDDIR)/include/openssl/*.h; do \
 		fn=`basename $$i`; \
@@ -524,11 +627,6 @@ install_dev:
 		fn1=`basename $$s1`; \
 		fn2=`basename $$s2`; \
 		: {- output_off(); output_on() unless windowsdll() or sharedaix(); "" -}; \
-		$(ECHO) "install $$s1 -> $(DESTDIR)$(libdir)/$$fn1"; \
-		cp $$s1 $(DESTDIR)$(libdir)/$$fn1.new; \
-		chmod 755 $(DESTDIR)$(libdir)/$$fn1.new; \
-		mv -f $(DESTDIR)$(libdir)/$$fn1.new \
-		      $(DESTDIR)$(libdir)/$$fn1; \
 		if [ "$$fn1" != "$$fn2" ]; then \
 			$(ECHO) "link $(DESTDIR)$(libdir)/$$fn2 -> $(DESTDIR)$(libdir)/$$fn1"; \
 			ln -sf $$fn1 $(DESTDIR)$(libdir)/$$fn2; \
@@ -568,12 +666,12 @@ install_dev:
 	@cp openssl.pc $(DESTDIR)$(libdir)/pkgconfig
 	@chmod 644 $(DESTDIR)$(libdir)/pkgconfig/openssl.pc
 
-uninstall_dev:
+uninstall_dev: uninstall_runtime_libs
 	@$(ECHO) "*** Uninstalling development files"
-	@ : {- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } @{$target{defines}}; "" -}
+	@ : {- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
 	@$(ECHO) "$(RM) $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c"
 	@$(RM) $(DESTDIR)$(INSTALLTOP)/include/openssl/applink.c
-	@ : {- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } @{$target{defines}}; "" -}
+	@ : {- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
 	@set -e; for i in $(SRCDIR)/include/openssl/*.h \
 			  $(BLDDIR)/include/openssl/*.h; do \
 		fn=`basename $$i`; \
@@ -612,7 +710,9 @@ uninstall_dev:
 	-$(RMDIR) $(DESTDIR)$(libdir)/pkgconfig
 	-$(RMDIR) $(DESTDIR)$(libdir)
 
-install_engines:
+_install_modules_deps: install_runtime_libs build_modules
+
+install_engines: _install_modules_deps
 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
 	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(ENGINESDIR)/
 	@$(ECHO) "*** Installing engines"
@@ -631,7 +731,7 @@ uninstall_engines:
 	@set -e; for e in dummy $(INSTALL_ENGINES); do \
 		if [ "$$e" = "dummy" ]; then continue; fi; \
 		fn=`basename $$e`; \
-		if [ "$$fn" = '{- dso("ossltest") -}' ]; then \
+		if [ "$$fn" = '{- platform->dso("ossltest") -}' ]; then \
 			continue; \
 		fi; \
 		$(ECHO) "$(RM) $(DESTDIR)$(ENGINESDIR)/$$fn"; \
@@ -639,20 +739,50 @@ uninstall_engines:
 	done
 	-$(RMDIR) $(DESTDIR)$(ENGINESDIR)
 
-install_runtime:
+install_modules: _install_modules_deps
+	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(MODULESDIR)/
+	@$(ECHO) "*** Installing modules"
+	@set -e; for e in dummy $(INSTALL_MODULES); do \
+		if [ "$$e" = "dummy" ]; then continue; fi; \
+		fn=`basename $$e`; \
+		$(ECHO) "install $$e -> $(DESTDIR)$(MODULESDIR)/$$fn"; \
+		cp $$e $(DESTDIR)$(MODULESDIR)/$$fn.new; \
+		chmod 755 $(DESTDIR)$(MODULESDIR)/$$fn.new; \
+		mv -f $(DESTDIR)$(MODULESDIR)/$$fn.new \
+		      $(DESTDIR)$(MODULESDIR)/$$fn; \
+	done
+
+uninstall_modules:
+	@$(ECHO) "*** Uninstalling modules"
+	@set -e; for e in dummy $(INSTALL_MODULES); do \
+		if [ "$$e" = "dummy" ]; then continue; fi; \
+		fn=`basename $$e`; \
+		if [ "$$fn" = '{- platform->dso("ossltest") -}' ]; then \
+			continue; \
+		fi; \
+		$(ECHO) "$(RM) $(DESTDIR)$(MODULESDIR)/$$fn"; \
+		$(RM) $(DESTDIR)$(MODULESDIR)/$$fn; \
+	done
+	-$(RMDIR) $(DESTDIR)$(MODULESDIR)
+
+install_runtime: install_programs
+
+install_runtime_libs: build_libs
 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
-	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(INSTALLTOP)/bin
 	@ : {- output_off() if windowsdll(); "" -}
 	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(libdir)
-	@ : {- output_on() if windowsdll(); "" -}
-	@$(ECHO) "*** Installing runtime files"
+	@ : {- output_on() if windowsdll(); output_off() unless windowsdll(); "" -}
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(INSTALLTOP)/bin
+	@ : {- output_on() unless windowsdll(); "" -}
+	@$(ECHO) "*** Installing runtime libraries"
 	@set -e; for s in dummy $(INSTALL_SHLIBS); do \
 		if [ "$$s" = "dummy" ]; then continue; fi; \
 		fn=`basename $$s`; \
 		: {- output_off() unless windowsdll(); "" -}; \
 		$(ECHO) "install $$s -> $(DESTDIR)$(INSTALLTOP)/bin/$$fn"; \
 		cp $$s $(DESTDIR)$(INSTALLTOP)/bin/$$fn.new; \
-		chmod 644 $(DESTDIR)$(INSTALLTOP)/bin/$$fn.new; \
+		chmod 755 $(DESTDIR)$(INSTALLTOP)/bin/$$fn.new; \
 		mv -f $(DESTDIR)$(INSTALLTOP)/bin/$$fn.new \
 		      $(DESTDIR)$(INSTALLTOP)/bin/$$fn; \
 		: {- output_on() unless windowsdll(); "" -}{- output_off() if windowsdll(); "" -}; \
@@ -663,6 +793,11 @@ install_runtime:
 		      $(DESTDIR)$(libdir)/$$fn; \
 		: {- output_on() if windowsdll(); "" -}; \
 	done
+
+install_programs: install_runtime_libs build_programs
+	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(INSTALLTOP)/bin
+	@$(ECHO) "*** Installing runtime programs"
 	@set -e; for x in dummy $(INSTALL_PROGRAMS); do \
 		if [ "$$x" = "dummy" ]; then continue; fi; \
 		fn=`basename $$x`; \
@@ -682,8 +817,10 @@ install_runtime:
 		      $(DESTDIR)$(INSTALLTOP)/bin/$$fn; \
 	done
 
-uninstall_runtime:
-	@$(ECHO) "*** Uninstalling runtime files"
+uninstall_runtime: uninstall_programs uninstall_runtime_libs
+
+uninstall_programs:
+	@$(ECHO) "*** Uninstalling runtime programs"
 	@set -e; for x in dummy $(INSTALL_PROGRAMS); \
 	do  \
 		if [ "$$x" = "dummy" ]; then continue; fi; \
@@ -698,6 +835,10 @@ uninstall_runtime:
 		$(ECHO) "$(RM) $(DESTDIR)$(INSTALLTOP)/bin/$$fn"; \
 		$(RM) $(DESTDIR)$(INSTALLTOP)/bin/$$fn; \
 	done
+	-$(RMDIR) $(DESTDIR)$(INSTALLTOP)/bin
+
+uninstall_runtime_libs:
+	@$(ECHO) "*** Uninstalling runtime libraries"
 	@ : {- output_off() unless windowsdll(); "" -}
 	@set -e; for s in dummy $(INSTALL_SHLIBS); do \
 		if [ "$$s" = "dummy" ]; then continue; fi; \
@@ -706,32 +847,133 @@ uninstall_runtime:
 		$(RM) $(DESTDIR)$(INSTALLTOP)/bin/$$fn; \
 	done
 	@ : {- output_on() unless windowsdll(); "" -}
-	-$(RMDIR) $(DESTDIR)$(INSTALLTOP)/bin
 
 
-install_man_docs:
+install_man_docs: build_man_docs
 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(MANDIR)/man1
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(MANDIR)/man3
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(MANDIR)/man5
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(MANDIR)/man7
 	@$(ECHO) "*** Installing manpages"
-	$(PERL) $(SRCDIR)/util/process_docs.pl \
-		--destdir=$(DESTDIR)$(MANDIR) --type=man --suffix=$(MANSUFFIX)
+	@set -e; for x in dummy $(MANDOCS1); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man1/$${fn}$(MANSUFFIX)"; \
+		cp $$x $(DESTDIR)$(MANDIR)/man1/$${fn}$(MANSUFFIX); \
+		chmod 755 $(DESTDIR)$(MANDIR)/man1/$${fn}$(MANSUFFIX); \
+	done
+	@set -e; for x in dummy $(MANDOCS3); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man3/$${fn}$(MANSUFFIX)"; \
+		cp $$x $(DESTDIR)$(MANDIR)/man3/$${fn}$(MANSUFFIX); \
+		chmod 755 $(DESTDIR)$(MANDIR)/man3/$${fn}$(MANSUFFIX); \
+	done
+	@set -e; for x in dummy $(MANDOCS5); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man5/$${fn}$(MANSUFFIX)"; \
+		cp $$x $(DESTDIR)$(MANDIR)/man5/$${fn}$(MANSUFFIX); \
+		chmod 755 $(DESTDIR)$(MANDIR)/man5/$${fn}$(MANSUFFIX); \
+	done
+	@set -e; for x in dummy $(MANDOCS7); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "install $$x -> $(DESTDIR)$(MANDIR)/man7/$${fn}$(MANSUFFIX)"; \
+		cp $$x $(DESTDIR)$(MANDIR)/man7/$${fn}$(MANSUFFIX); \
+		chmod 755 $(DESTDIR)$(MANDIR)/man7/$${fn}$(MANSUFFIX); \
+	done
 
 uninstall_man_docs:
 	@$(ECHO) "*** Uninstalling manpages"
-	$(PERL) $(SRCDIR)/util/process_docs.pl \
-		--destdir=$(DESTDIR)$(MANDIR) --type=man --suffix=$(MANSUFFIX) \
-		--remove
+	@set -e; for x in dummy $(MANDOCS1); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man1/$${fn}$(MANSUFFIX)"; \
+		$(RM) $(DESTDIR)$(MANDIR)/man1/$${fn}$(MANSUFFIX); \
+	done
+	@set -e; for x in dummy $(MANDOCS3); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man3/$${fn}$(MANSUFFIX)"; \
+		$(RM) $(DESTDIR)$(MANDIR)/man3/$${fn}$(MANSUFFIX); \
+	done
+	@set -e; for x in dummy $(MANDOCS5); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man5/$${fn}$(MANSUFFIX)"; \
+		$(RM) $(DESTDIR)$(MANDIR)/man5/$${fn}$(MANSUFFIX); \
+	done
+	@set -e; for x in dummy $(MANDOCS7); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "$(RM) $(DESTDIR)$(MANDIR)/man7/$${fn}$(MANSUFFIX)"; \
+		$(RM) $(DESTDIR)$(MANDIR)/man7/$${fn}$(MANSUFFIX); \
+	done
 
-install_html_docs:
+install_html_docs: build_html_docs
 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(HTMLDIR)/man1
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(HTMLDIR)/man3
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(HTMLDIR)/man5
+	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(HTMLDIR)/man7
 	@$(ECHO) "*** Installing HTML manpages"
-	$(PERL) $(SRCDIR)/util/process_docs.pl \
-		--destdir=$(DESTDIR)$(HTMLDIR) --type=html
+	@set -e; for x in dummy $(HTMLDOCS1); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "install $$x -> $(DESTDIR)$(HTMLDIR)/man1/$$fn"; \
+		cp $$x $(DESTDIR)$(HTMLDIR)/man1/$$fn; \
+		chmod 755 $(DESTDIR)$(HTMLDIR)/man1/$$fn; \
+	done
+	@set -e; for x in dummy $(HTMLDOCS3); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "install $$x -> $(DESTDIR)$(HTMLDIR)/man3/$$fn"; \
+		cp $$x $(DESTDIR)$(HTMLDIR)/man3/$$fn; \
+		chmod 755 $(DESTDIR)$(HTMLDIR)/man3/$$fn; \
+	done
+	@set -e; for x in dummy $(HTMLDOCS5); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "install $$x -> $(DESTDIR)$(HTMLDIR)/man5/$$fn"; \
+		cp $$x $(DESTDIR)$(HTMLDIR)/man5/$$fn; \
+		chmod 755 $(DESTDIR)$(HTMLDIR)/man5/$$fn; \
+	done
+	@set -e; for x in dummy $(HTMLDOCS7); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "install $$x -> $(DESTDIR)$(HTMLDIR)/man7/$$fn"; \
+		cp $$x $(DESTDIR)$(HTMLDIR)/man7/$$fn; \
+		chmod 755 $(DESTDIR)$(HTMLDIR)/man7/$$fn; \
+	done
 
 uninstall_html_docs:
-	@$(ECHO) "*** Uninstalling manpages"
-	$(PERL) $(SRCDIR)/util/process_docs.pl \
-		--destdir=$(DESTDIR)$(HTMLDIR) --type=html --remove
-
+	@$(ECHO) "*** Uninstalling HTML manpages"
+	@set -e; for x in dummy $(HTMLDOCS1); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "$(RM) $(DESTDIR)$(HTMLDIR)/man1/$$fn"; \
+		$(RM) $(DESTDIR)$(HTMLDIR)/man1/$$fn; \
+	done
+	@set -e; for x in dummy $(HTMLDOCS3); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "$(RM) $(DESTDIR)$(HTMLDIR)/man3/$$fn"; \
+		$(RM) $(DESTDIR)$(HTMLDIR)/man3/$$fn; \
+	done
+	@set -e; for x in dummy $(HTMLDOCS5); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "$(RM) $(DESTDIR)$(HTMLDIR)/man5/$$fn"; \
+		$(RM) $(DESTDIR)$(HTMLDIR)/man5/$$fn; \
+	done
+	@set -e; for x in dummy $(HTMLDOCS7); do \
+		if [ "$$x" = "dummy" ]; then continue; fi; \
+		fn=`basename $$x`; \
+		$(ECHO) "$(RM) $(DESTDIR)$(HTMLDIR)/man7/$$fn"; \
+		$(RM) $(DESTDIR)$(HTMLDIR)/man7/$$fn; \
+	done
 
 # Developer targets (note: these are only available on Unix) #########
 
@@ -740,11 +982,21 @@ update: generate errors ordinals
 generate: generate_apps generate_crypto_bn generate_crypto_objects \
           generate_crypto_conf generate_crypto_asn1 generate_fuzz_oids
 
-.PHONY: doc-nits
-doc-nits:
-	(cd $(SRCDIR); $(PERL) util/find-doc-nits -n -p ) >doc-nits
-	@if [ -s doc-nits ] ; then cat doc-nits ; exit 1; \
-	else echo 'doc-nits: no errors.'; rm doc-nits ; fi
+.PHONY: doc-nits cmd-nits md-nits
+doc-nits: build_generated
+	$(PERL) $(SRCDIR)/util/find-doc-nits -n -l -e
+
+cmd-nits: build_generated apps/openssl
+	$(PERL) $(SRCDIR)/util/find-doc-nits -c
+
+# This uses "mdl", the markdownlint application, which is written in ruby.
+# The source is at https://github.com/markdownlint/markdownlint
+# If you have ruby installed, "gem install mdl" should work.
+# Another option is at https://snapcraft.io/install/mdl/debian
+# Finally, there's a Node.js version, which we haven't tried, that
+# can be found at https://github.com/DavidAnson/markdownlint
+md-nits:
+	mdl -s util/markdownlint.rb .
 
 # Test coverage is a good idea for the future
 #coverage: $(PROGRAMS) $(TESTPROGRAMS)
@@ -777,6 +1029,7 @@ generate_crypto_objects:
 				crypto/objects/obj_mac.num \
 				crypto/objects/obj_xref.txt \
 				> crypto/objects/obj_xref.h )
+	( cd $(SRCDIR);	cat crypto/objects/obj_compat.h >> include/openssl/obj_mac.h )
 
 generate_crypto_conf:
 	( cd $(SRCDIR); $(PERL) crypto/conf/keysets.pl \
@@ -805,9 +1058,49 @@ errors:
                 -conf $$E `basename $$E .ec`.c ; \
           done )
 
+{- use File::Basename;
+
+   our @sslheaders =
+       qw( include/openssl/ssl.h
+           include/openssl/ssl2.h
+           include/openssl/ssl3.h
+           include/openssl/sslerr.h
+           include/openssl/tls1.h
+           include/openssl/dtls1.h
+           include/openssl/srtp.h );
+   our @cryptoheaders =
+       qw( include/internal/dso.h
+           include/internal/o_dir.h
+           include/internal/err.h
+           include/internal/evp.h
+           include/internal/sslconf.h );
+   our @cryptoskipheaders = ( @sslheaders,
+       qw( include/openssl/conf_api.h
+           include/openssl/ebcdic.h
+           include/openssl/opensslconf.h
+           include/openssl/symhacks.h ) );
+   foreach my $f ( glob(catfile($config{sourcedir},
+                                'include','openssl','*.h')) ) {
+       my $fn = "include/openssl/" . basename($f);
+       push @cryptoheaders, $fn unless grep { $_ eq $fn } @cryptoskipheaders;
+   }
+   "";
+-}
+CRYPTOHEADERS={- join(" \\\n" . ' ' x 14,
+                      fill_lines(" ", $COLUMNS - 14, sort @cryptoheaders)) -}
+SSLHEADERS={- join(" \\\n" . ' ' x 11,
+                   fill_lines(" ", $COLUMNS - 11, sort @sslheaders)) -}
 ordinals:
-	( b=`pwd`; cd $(SRCDIR); $(PERL) -I$$b util/mkdef.pl crypto update )
-	( b=`pwd`; cd $(SRCDIR); $(PERL) -I$$b util/mkdef.pl ssl update )
+	( cd $(SRCDIR); \
+          $(PERL) util/mknum.pl --version $(VERSION) --no-warnings \
+                  --ordinals util/libcrypto.num \
+                  --symhacks include/openssl/symhacks.h \
+                  $(CRYPTOHEADERS) )
+	( cd $(SRCDIR); \
+          $(PERL) util/mknum.pl --version $(VERSION) --no-warnings \
+                  --ordinals util/libssl.num \
+                  --symhacks include/openssl/symhacks.h \
+                  $(SSLHEADERS))
 
 test_ordinals:
 	( cd test; \
@@ -822,53 +1115,24 @@ tags TAGS: FORCE
 
 # Release targets (note: only available on Unix) #####################
 
-# If your tar command doesn't support --owner and --group, make sure to
-# use one that does, for example GNU tar
-TAR_COMMAND=$(TAR) $(TARFLAGS) --owner 0 --group 0 -cf -
-PREPARE_CMD=:
 tar:
-	set -e; \
-	TMPDIR=/var/tmp/openssl-copy.$$$$; \
-	DISTDIR=$(NAME); \
-	mkdir -p $$TMPDIR/$$DISTDIR; \
-	(cd $(SRCDIR); \
-	 excl_re=`git submodule status | sed -e 's/^.//' | cut -d' ' -f2`; \
-	 excl_re="^(fuzz/corpora|Configurations/.*\.norelease\.conf|`echo $$excl_re | sed -e 's/ /$$|/g'`\$$)"; \
-	 echo "$$excl_re"; \
-	 git ls-tree -r --name-only --full-tree HEAD \
-	 | egrep -v "$$excl_re" \
-	 | while read F; do \
-	       mkdir -p $$TMPDIR/$$DISTDIR/`dirname $$F`; \
-	       cp $$F $$TMPDIR/$$DISTDIR/$$F; \
-	   done); \
-	(cd $$TMPDIR/$$DISTDIR; \
-	 $(PREPARE_CMD); \
-	 find . -type d -print | xargs chmod 755; \
-	 find . -type f -print | xargs chmod a+r; \
-	 find . -type f -perm -0100 -print | xargs chmod a+x); \
-	(cd $$TMPDIR; $(TAR_COMMAND) $$DISTDIR) \
-	| (cd $(SRCDIR); gzip --best > $(TARFILE).gz); \
-	rm -rf $$TMPDIR
-	cd $(SRCDIR); ls -l $(TARFILE).gz
-
-dist:
-	@$(MAKE) PREPARE_CMD='$(PERL) ./Configure dist' TARFILE="$(TARFILE)" NAME="$(NAME)" tar
+	(cd $(SRCDIR); ./util/mktar.sh --name='$(NAME)' --tarfile='$(TARFILE)')
 
 # Helper targets #####################################################
 
-link-utils: $(BLDDIR)/util/opensslwrap.sh
+link-utils: $(BLDDIR)/util/opensslwrap.sh $(BLDDIR)/util/wrap.pl
 
-$(BLDDIR)/util/opensslwrap.sh: configdata.pm
+$(BLDDIR)/util/opensslwrap.sh $(BLDDIR)/util/wrap.pl: configdata.pm
 	@if [ "$(SRCDIR)" != "$(BLDDIR)" ]; then \
 	    mkdir -p "$(BLDDIR)/util"; \
-	    ln -sf "../$(SRCDIR)/util/opensslwrap.sh" "$(BLDDIR)/util"; \
+	    ln -sf "../$(SRCDIR)/util/`basename "$@"`" "$(BLDDIR)/util"; \
 	fi
 
 FORCE:
 
 # Building targets ###################################################
 
-libcrypto.pc libssl.pc openssl.pc: configdata.pm $(LIBS) {- join(" ",map { shlib_simple($_) } @{$unified_info{libraries}}) -}
+libcrypto.pc libssl.pc openssl.pc: configdata.pm $(LIBS) {- join(" ",map { platform->sharedlib_simple($_) // () } @{$unified_info{libraries}}) -}
 libcrypto.pc:
 	@ ( echo 'prefix=$(INSTALLTOP)'; \
 	    echo 'exec_prefix=$${prefix}'; \
@@ -919,7 +1183,12 @@ openssl.pc:
 	    echo 'Version: '$(VERSION); \
 	    echo 'Requires: libssl libcrypto' ) > openssl.pc
 
-configdata.pm: $(SRCDIR)/Configure $(SRCDIR)/config {- join(" ", @{$config{build_file_templates}}, @{$config{build_infos}}, @{$config{conf_files}}) -}
+configdata.pm: $(SRCDIR)/Configure $(SRCDIR)/config \
+               {- join(" \\\n" . ' ' x 15,
+                       fill_lines(" ", $COLUMNS - 15,
+                                  @{$config{build_file_templates}},
+                                  @{$config{build_infos}},
+                                  @{$config{conf_files}})) -}
 	@echo "Detected changed: $?"
 	$(PERL) configdata.pm -r
 	@echo "**************************************************"
@@ -939,14 +1208,10 @@ reconfigure reconf:
   # Helper function to figure out dependencies on libraries
   # It takes a list of library names and outputs a list of dependencies
   sub compute_lib_depends {
-      if ($disabled{shared}) {
-          return map { lib($_) } @_;
-      }
-
       # Depending on shared libraries:
       # On Windows POSIX layers, we depend on {libname}.dll.a
       # On Unix platforms, we depend on {shlibname}.so
-      return map { $_ =~ /\.a$/ ? $`.$libext : shlib_simple($_) } @_;
+      return map { platform->sharedlib_simple($_) // platform->staticlib($_) } @_;
   }
 
   sub generatesrc {
@@ -954,17 +1219,47 @@ reconfigure reconf:
       my $generator = join(" ", @{$args{generator}});
       my $generator_incs = join("", map { " -I".$_ } @{$args{generator_incs}});
       my $incs = join("", map { " -I".$_ } @{$args{incs}});
+      my $defs = join("", map { " -D".$_ } @{$args{defs}});
       my $deps = join(" ", @{$args{generator_deps}}, @{$args{deps}});
 
-      if ($args{src} !~ /\.[sS]$/) {
+      if ($args{src} =~ /\.html$/) {
+	  my $title = basename($args{src}, ".html");
+	  my $pod = $args{generator}->[0];
+	  return <<"EOF";
+$args{src}: $pod
+	\$(PERL) \$(SRCDIR)/util/mkpod2html.pl -i "$pod" -o \$\@ -t "$title" -r "\$(SRCDIR)/doc"
+EOF
+      } elsif ($args{src} =~ /\.(\d)$/) {
+	  my $section = $1;
+	  my $name = uc basename($args{src}, ".$section");
+	  my $pod = $args{generator}->[0];
+	  return <<"EOF";
+$args{src}: $pod
+	pod2man --name=$name --section=$section --center=OpenSSL \\
+		--release=\$(VERSION) $pod >\$\@
+EOF
+      } elsif (platform->isdef($args{src})) {
+          my $target = platform->def($args{src});
+          (my $mkdef_os = $target{shared_target}) =~ s|-shared$||;
+          my $ord_ver = $args{intent} eq 'lib' ? ' --version $(VERSION)' : '';
+          my $ord_name = $args{generator}->[1] || $args{product};
+          return <<"EOF";
+$target: $args{generator}->[0] $deps \$(SRCDIR)/util/mkdef.pl
+	\$(PERL) \$(SRCDIR)/util/mkdef.pl$ord_ver --ordinals $args{generator}->[0]  --name $ord_name --OS $mkdef_os > $target
+EOF
+      } elsif (!platform->isasm($args{src})) {
           if ($args{generator}->[0] =~ m|^.*\.in$|) {
               my $dofile = abs2rel(rel2abs(catfile($config{sourcedir},
                                                    "util", "dofile.pl")),
                                    rel2abs($config{builddir}));
+              my @modules = ( 'configdata.pm',
+                              grep { $_ =~ m|\.pm$| } @{$args{deps}} );
+              my %moduleincs = map { '"-I'.dirname($_).'"' => 1 } @modules;
+              @modules = map { "-M".basename($_, '.pm') } @modules;
+              my $modules = join(' ', '', sort keys %moduleincs, @modules);
               return <<"EOF";
-$args{src}: $args{generator}->[0] $deps
-	\$(PERL) "-I\$(BLDDIR)" -Mconfigdata "$dofile" \\
-	    "-o$target{build_file}" $generator > \$@
+$args{src}: $args{generator}->[0] $deps \$(BLDDIR)/configdata.pm
+	\$(PERL)$modules "$dofile" "-o$target{build_file}" $generator > \$@
 EOF
 	  } else {
               return <<"EOF";
@@ -973,8 +1268,16 @@ $args{src}: $args{generator}->[0] $deps
 EOF
 	  }
       } else {
+          my $cppflags = {
+              shlib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)',
+              lib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)',
+              dso => '$(DSO_CFLAGS) $(DSO_CPPFLAGS)',
+              bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)'
+          } -> {$args{intent}};
+
           if ($args{generator}->[0] =~ /\.pl$/) {
-              $generator = 'CC="$(CC)" $(PERL)'.$generator_incs.' '.$generator;
+              $generator = 'CC="$(CC)" $(PERL)'.$generator_incs.' '.$generator
+                  .' "$(PERLASM_SCHEME)"'.$incs.' '.$cppflags.$defs.' $(PROCESSOR)';
           } elsif ($args{generator}->[0] =~ /\.m4$/) {
               $generator = 'm4 -B 8192'.$generator_incs.' '.$generator.' >'
           } elsif ($args{generator}->[0] =~ /\.S$/) {
@@ -983,11 +1286,6 @@ EOF
               die "Generator type for $args{src} unknown: $generator\n";
           }
 
-          my $cppflags = {
-              lib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)',
-              dso => '$(DSO_CFLAGS) $(DSO_CPPFLAGS)',
-              bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)'
-          } -> {$args{intent}};
           if (defined($generator)) {
               return <<"EOF";
 $args{src}: $args{generator}->[0] $deps
@@ -996,7 +1294,7 @@ EOF
           }
           return <<"EOF";
 $args{src}: $args{generator}->[0] $deps
-	\$(CC) $incs $cppflags -E $args{generator}->[0] | \\
+	\$(CC) $incs $cppflags $defs -E $args{generator}->[0] | \\
 	\$(PERL) -ne '/^#(line)?\\s*[0-9]+/ or print' > \$@
 EOF
       }
@@ -1007,11 +1305,13 @@ EOF
   # last in the line.  We may therefore need to put back a line ending.
   sub src2obj {
       my %args = @_;
-      (my $obj = $args{obj}) =~ s|\.o$||;
+      my $obj = platform->convertext($args{obj});
+      my $dep = platform->dep($args{obj});
       my @srcs = @{$args{srcs}};
       my $srcs = join(" ",  @srcs);
       my $deps = join(" ", @srcs, @{$args{deps}});
       my $incs = join("", map { " -I".$_ } @{$args{incs}});
+      my $defs = join("", map { " -D".$_ } @{$args{defs}});
       my $cmd;
       my $cmdflags;
       my $cmdcompile;
@@ -1023,6 +1323,7 @@ EOF
           $cmd = '$(CXX)';
           $cmdcompile = ' -c';
           $cmdflags = {
+              shlib => '$(LIB_CXXFLAGS) $(LIB_CPPFLAGS)',
               lib => '$(LIB_CXXFLAGS) $(LIB_CPPFLAGS)',
               dso => '$(DSO_CXXFLAGS) $(DSO_CPPFLAGS)',
               bin => '$(BIN_CXXFLAGS) $(BIN_CPPFLAGS)'
@@ -1031,6 +1332,7 @@ EOF
           $cmd = '$(CC)';
           $cmdcompile = ' -c';
           $cmdflags = {
+              shlib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)',
               lib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)',
               dso => '$(DSO_CFLAGS) $(DSO_CPPFLAGS)',
               bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)'
@@ -1040,7 +1342,7 @@ EOF
       # extension-specific rules
       if (grep /\.s$/, @srcs) {
           $recipe .= <<"EOF";
-$obj$objext: $deps
+$obj: $deps
 	$cmd $cmdflags -c -o \$\@ $srcs
 EOF
       } elsif (grep /\.S$/, @srcs) {
@@ -1050,181 +1352,208 @@ EOF
           # The platform is long discontinued by vendor so there is
           # hardly a point to drag it along...
           $recipe .= <<"EOF";
-$obj$objext: $deps
-	$cmd $incs $cmdflags -c -o \$\@ $srcs
+$obj: $deps
+	$cmd $incs $defs $cmdflags -c -o \$\@ $srcs
 EOF
       } elsif (defined $makedepprog && $makedepprog !~ /\/makedepend/
                && !grep /\.rc$/, @srcs) {
           $recipe .= <<"EOF";
-$obj$objext: $deps
-	$cmd $incs $cmdflags -MMD -MF $obj$depext.tmp -MT \$\@ -c -o \$\@ $srcs
-	\@touch $obj$depext.tmp
-	\@if cmp $obj$depext.tmp $obj$depext > /dev/null 2> /dev/null; then \\
-		rm -f $obj$depext.tmp; \\
+$obj: $deps
+	$cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -MT \$\@ -c -o \$\@ $srcs
+	\@touch $dep.tmp
+	\@if cmp $dep.tmp $dep > /dev/null 2> /dev/null; then \\
+		rm -f $dep.tmp; \\
 	else \\
-		mv $obj$depext.tmp $obj$depext; \\
+		mv $dep.tmp $dep; \\
 	fi
 EOF
       } else {
           $recipe .= <<"EOF";
-$obj$objext: $deps
-	$cmd $incs $cmdflags $cmdcompile -o \$\@ $srcs
+$obj: $deps
+	$cmd $incs $defs $cmdflags $cmdcompile -o \$\@ $srcs
 EOF
           if (defined $makedepprog  && $makedepprog =~ /\/makedepend/) {
               $recipe .= <<"EOF";
 	\$(MAKEDEPEND) -f- -Y -- $incs $cmdflags -- $srcs 2>/dev/null \\
-	    > $obj$depext
+	    > $dep
 EOF
           }
       }
       return $recipe;
   }
-  # On Unix, we build shlibs from static libs, so we're ignoring the
-  # object file array.  We *know* this routine is only called when we've
-  # configure 'shared'.
-  sub libobj2shlib {
+  # We *know* this routine is only called when we've configure 'shared'.
+  sub obj2shlib {
       my %args = @_;
-      my $lib = $args{lib};
-      my $shlib = $args{shlib};
-      my $libd = dirname($lib);
-      my $libn = basename($lib);
-      (my $libname = $libn) =~ s/^lib//;
       my @linkdirs = ();
-      foreach (@{args{deps}}) {
-          my $d = dirname($_);
-          push @linkdirs, $d unless grep { $d eq $_ } @linkdirs;
+      my @linklibs = ();
+      foreach (@{$args{deps}}) {
+          if (platform->isstaticlib($_)) {
+              push @linklibs, platform->convertext($_);
+          } else {
+              my $d = "-L" . dirname($_);
+              my $l = basename($_);
+              $l =~ s/^lib//;
+              $l = "-l" . $l;
+              push @linklibs, $l;
+              push @linkdirs, $d unless grep { $d eq $_ } @linkdirs;
+          }
       }
-      my $linkflags = join("", map { "-L$_ " } @linkdirs);
-      my $linklibs = join("", map { my $f = basename($_);
-                                    (my $l = $f) =~ s/^lib//;
-                                    " -l$l" } @{$args{deps}});
-      my @objs = map { (my $x = $_) =~ s|\.o$||; "$x$objext" }
-                 grep { $_ !~ m/\.(?:def|map)$/ }
+      my $linkflags = join("", map { $_." " } @linkdirs);
+      my $linklibs = join("", map { $_." " } @linklibs);
+      my @objs = map { platform->convertext($_) }
+                 grep { !platform->isdef($_) }
+                 @{$args{objs}};
+      my @defs = map { platform->def($_) }
+                 grep { platform->isdef($_) }
                  @{$args{objs}};
-      my @defs = grep { $_ =~ /\.(?:def|map)$/ } @{$args{objs}};
       my @deps = compute_lib_depends(@{$args{deps}});
       die "More than one exported symbol map" if scalar @defs > 1;
-      my $objs = join(" ", @objs);
-      my $deps = join(" ", @objs, @defs, @deps);
-      my $target = shlib_simple($lib);
-      my $target_full = shlib($lib);
+
+      my $simple = platform->sharedlib_simple($args{lib});
+      my $full = platform->sharedlib($args{lib});
       my $shared_soname = "";
-      $shared_soname .= ' '.$target{shared_sonameflag}.basename($target_full)
+      $shared_soname .= ' '.$target{shared_sonameflag}.basename($full)
           if defined $target{shared_sonameflag};
       my $shared_imp = "";
-      $shared_imp .= ' '.$target{shared_impflag}.basename($target)
+      $shared_imp .= ' '.$target{shared_impflag}.basename($simple)
           if defined $target{shared_impflag};
       my $shared_def = join("", map { ' '.$target{shared_defflag}.$_ } @defs);
+
+      my $objs = join(" \\\n\t\t", fill_lines(' ', $COLUMNS - 16, @objs));
+      my $deps = join(" \\\n" . ' ' x (length($full) + 2),
+                      fill_lines(' ', $COLUMNS - length($full) - 2,
+                                 @objs, @defs, @deps));
+
       my $recipe = <<"EOF";
-# When building on a Windows POSIX layer (Cygwin or Mingw), we know for a fact
-# that two files get produced, {shlibname}.dll and {libname}.dll.a.
-# With all other Unix platforms, we often build a shared library with the
-# SO version built into the file name and a symlink without the SO version
-# It's not necessary to have both as targets.  The choice falls on the
-# simplest, {libname}\$(SHLIB_EXT_IMPORT) for Windows POSIX layers and
-# {libname}\$(SHLIB_EXT_SIMPLE) for the Unix platforms.
-$target: $deps
+$simple: $full
+EOF
+      if (sharedaix()) {
+          $recipe .= <<"EOF";
+	rm -f $simple && \\
+	\$(AR) r $simple $full
+EOF
+      } elsif ($simple ne $full) {
+          $recipe .= <<"EOF";
+	rm -f $simple && \\
+	ln -s $full $simple
+EOF
+      }
+      $recipe .= <<"EOF";
+$full: $deps
 	\$(CC) \$(LIB_CFLAGS) $linkflags\$(LIB_LDFLAGS)$shared_soname$shared_imp \\
-		-o $target_full$shared_def $objs \\
-                $linklibs \$(LIB_EX_LIBS)
+		-o $full$shared_def \\
+		$objs \\
+		$linklibs \$(LIB_EX_LIBS)
 EOF
       if (windowsdll()) {
           $recipe .= <<"EOF";
-	rm -f apps/$shlib'\$(SHLIB_EXT)'
-	rm -f test/$shlib'\$(SHLIB_EXT)'
-	rm -f fuzz/$shlib'\$(SHLIB_EXT)'
-	cp -p $shlib'\$(SHLIB_EXT)' apps/
-	cp -p $shlib'\$(SHLIB_EXT)' test/
-	cp -p $shlib'\$(SHLIB_EXT)' fuzz/
-EOF
-      } elsif (sharedaix()) {
-          $recipe .= <<"EOF";
-	rm -f $target && \\
-	\$(AR) r $target $target_full
-EOF
-      } else {
-          $recipe .= <<"EOF";
-	if [ '$target' != '$target_full' ]; then \\
-		rm -f $target; \\
-		ln -s $target_full $target; \\
-	fi
+	rm -f apps/$full
+	rm -f test/$full
+	rm -f fuzz/$full
+	cp -p $full apps/
+	cp -p $full test/
+	cp -p $full fuzz/
 EOF
       }
+      return $recipe;
   }
   sub obj2dso {
       my %args = @_;
-      my $dso = $args{lib};
-      my $dsod = dirname($dso);
-      my $dson = basename($dso);
+      my $dso = platform->dso($args{module});
       my @linkdirs = ();
-      foreach (@{args{deps}}) {
-          my $d = dirname($_);
-          push @linkdirs, $d unless grep { $d eq $_ } @linkdirs;
+      my @linklibs = ();
+      foreach (@{$args{deps}}) {
+          next unless defined $_;
+          if (platform->isstaticlib($_)) {
+              push @linklibs, platform->convertext($_);
+          } else {
+              my $d = "-L" . dirname($_);
+              my $l = basename($_);
+              $l =~ s/^lib//;
+              $l = "-l" . $l;
+              push @linklibs, $l;
+              push @linkdirs, $d unless grep { $d eq $_ } @linkdirs;
+          }
       }
-      my $linkflags = join("", map { "-L$_ " } @linkdirs);
-      my $linklibs = join("", map { my $f = basename($_);
-                                    (my $l = $f) =~ s/^lib//;
-                                    " -l$l" } @{$args{deps}});
-      my @objs = map { (my $x = $_) =~ s|\.o$||; "$x$objext" }
-                 grep { $_ !~ m/\.(?:def|map)$/ }
+      my $linkflags = join("", map { $_." " } @linkdirs);
+      my $linklibs = join("", map { $_." " } @linklibs);
+      my @objs = map { platform->convertext($_) }
+                 grep { !platform->isdef($_) }
+                 @{$args{objs}};
+      my @defs = map { platform->def($_) }
+                 grep { platform->isdef($_) }
                  @{$args{objs}};
       my @deps = compute_lib_depends(@{$args{deps}});
-      my $objs = join(" ", @objs);
-      my $deps = join(" ", @deps);
-      my $target = dso($dso);
+      my $shared_def = join("", map { ' '.$target{shared_defflag}.$_ } @defs);
+
+      my $objs = join(" \\\n\t\t", fill_lines(' ', $COLUMNS - 16, @objs));
+      my $deps = join(" \\\n" . ' ' x (length($dso) + 2),
+                      fill_lines(' ', $COLUMNS - length($dso) - 2,
+                                 @objs, @defs, @deps));
+
       return <<"EOF";
-$target: $objs $deps
+$dso: $deps
 	\$(CC) \$(DSO_CFLAGS) $linkflags\$(DSO_LDFLAGS) \\
-		-o $target $objs \\
-                $linklibs \$(DSO_EX_LIBS)
+		-o $dso$shared_def \\
+		$objs \\
+		$linklibs\$(DSO_EX_LIBS)
 EOF
   }
   sub obj2lib {
       my %args = @_;
-      (my $lib = $args{lib}) =~ s/\.a$//;
-      my @objs = map { (my $x = $_) =~ s|\.o$|$objext|; $x } @{$args{objs}};
-      my $objs = join(" ", @objs);
+      my $lib = platform->staticlib($args{lib});
+      my @objs = map { platform->obj($_) } @{$args{objs}};
+      my $objs = join(" \\\n" . ' ' x (length($lib) + 2),
+                      fill_lines(' ', $COLUMNS - length($lib) - 2, @objs));
       return <<"EOF";
-$lib$libext: $objs
+$lib: $objs
 	\$(AR) \$(ARFLAGS) \$\@ \$\?
 	\$(RANLIB) \$\@ || echo Never mind.
 EOF
   }
   sub obj2bin {
       my %args = @_;
-      my $bin = $args{bin};
-      my $bind = dirname($bin);
-      my $binn = basename($bin);
-      my $objs = join(" ", map { (my $x = $_) =~ s|\.o$||; "$x$objext" }
-                           @{$args{objs}});
-      my $deps = join(" ",compute_lib_depends(@{$args{deps}}));
+      my $bin = platform->bin($args{bin});
+      my @objs = map { platform->obj($_) } @{$args{objs}};
+      my @deps = compute_lib_depends(@{$args{deps}});
+      my $objs = join(" \\\n" . ' ' x (length($bin) + 2),
+                      fill_lines(' ', $COLUMNS - length($bin) - 2, @objs));
       my @linkdirs = ();
-      foreach (@{args{deps}}) {
-          next if $_ =~ /\.a$/;
-          my $d = dirname($_);
-          push @linkdirs, $d unless grep { $d eq $_ } @linkdirs;
+      my @linklibs = ();
+      foreach (@{$args{deps}}) {
+          next unless defined $_;
+          if (platform->isstaticlib($_)) {
+              push @linklibs, platform->convertext($_);
+          } else {
+              my $d = "-L" . dirname($_);
+              my $l = basename($_);
+              $l =~ s/^lib//;
+              $l = "-l" . $l;
+              push @linklibs, $l;
+              push @linkdirs, $d unless grep { $d eq $_ } @linkdirs;
+          }
       }
-      my $linkflags = join("", map { "-L$_ " } @linkdirs);
-      my $linklibs = join("", map { if ($_ =~ s/\.a$//) {
-                                        " $_$libext";
-                                    } else {
-                                        my $f = basename($_);
-                                        (my $l = $f) =~ s/^lib//;
-                                        " -l$l"
-                                    }
-                                  } @{$args{deps}});
+      my $linkflags = join("", map { $_." " } @linkdirs);
+      my $linklibs = join("", map { $_." " } @linklibs);
       my $cmd = '$(CC)';
       my $cmdflags = '$(BIN_CFLAGS)';
       if (grep /_cc\.o$/, @{$args{objs}}) {
           $cmd = '$(CXX)';
           $cmdflags = '$(BIN_CXXFLAGS)';
       }
+
+      my $objs = join(" \\\n\t\t", fill_lines(' ', $COLUMNS - 16, @objs));
+      my $deps = join(" \\\n" . ' ' x (length($bin) + 2),
+                      fill_lines(' ', $COLUMNS - length($bin) - 2,
+                                 @objs, @deps));
+
       return <<"EOF";
-$bin$exeext: $objs $deps
-	rm -f $bin$exeext
+$bin: $deps
+	rm -f $bin
 	\$\${LDCMD:-$cmd} $cmdflags $linkflags\$(BIN_LDFLAGS) \\
-		-o $bin$exeext $objs \\
-		$linklibs \$(BIN_EX_LIBS)
+		-o $bin \\
+		$objs \\
+		$linklibs\$(BIN_EX_LIBS)
 EOF
   }
   sub in2script {
@@ -1244,11 +1573,15 @@ EOF
   sub generatedir {
       my %args = @_;
       my $dir = $args{dir};
-      my @deps = map { s|\.o$|$objext|; $_ } @{$args{deps}};
-      my @actions = ();
-      my %extinfo = ( dso => $dsoext,
-                      lib => $libext,
-                      bin => $exeext );
+      my @deps = map { platform->convertext($_) } @{$args{deps}};
+      my @comments = ();
+      my %extinfo = ( dso => platform->dsoext(),
+                      lib => platform->libext(),
+                      bin => platform->binext() );
+
+      # We already have a 'test' target, and the top directory is just plain
+      # silly
+      return if $dir eq "test" || $dir eq ".";
 
       foreach my $type (("dso", "lib", "bin", "script")) {
           next unless defined($unified_info{dirinfo}->{$dir}->{products}->{$type});
@@ -1261,16 +1594,19 @@ EOF
                   if (dirname($prod) eq $dir) {
                       push @deps, $prod.$extinfo{$type};
                   } else {
-                      push @actions, "\t@ : No support to produce $type ".join(", ", @{$unified_info{dirinfo}->{$dir}->{products}->{$type}});
+                      push @comments, "# No support to produce $type ".join(", ", @{$unified_info{dirinfo}->{$dir}->{products}->{$type}});
                   }
               }
           }
       }
 
-      my $deps = join(" ", @deps);
-      my $actions = join("\n", "", @actions);
+      my $target = "$dir $dir/";
+      my $deps = join(" \\\n\t",
+                      fill_lines(' ', $COLUMNS - 8, @deps));
+      my $comments = join("\n", "", @comments);
       return <<"EOF";
-$args{dir} $args{dir}/: $deps$actions
+$target: \\
+	$deps$comments
 EOF
   }
   ""    # Important!  This becomes part of the template result.

Configurations/windows-makefile.tmpl

@@ -3,16 +3,9 @@
 ##
 ## {- join("\n## ", @autowarntext) -}
 {-
- our $objext = $target{obj_extension} || ".obj";
- our $resext = $target{res_extension} || ".res";
- our $depext = $target{dep_extension} || ".d";
- our $exeext = $target{exe_extension} || ".exe";
- our $libext = $target{lib_extension} || ".lib";
- our $shlibext = $target{shared_extension} || ".dll";
- our $shlibextimport = $target{shared_import_extension} || ".lib";
- our $dsoext = $target{dso_extension} || ".dll";
+ use File::Basename;
 
- (our $sover_dirname = $config{shlib_version_number}) =~ s|\.|_|g;
+ our $sover_dirname = platform->shlib_version_as_filename();
 
  my $build_scheme = $target{build_scheme};
  my $install_flavour = $build_scheme->[$#$build_scheme]; # last element
@@ -31,29 +24,6 @@
  $win_installroot = $ENV{$win_installroot};
  $win_commonroot = $ENV{$win_commonroot};
 
- sub shlib {
-     my $lib = shift;
-     return () if $disabled{shared} || $lib =~ /\.a$/;
-     return () unless defined $unified_info{sharednames}->{$lib};
-     return $unified_info{sharednames}->{$lib} . $shlibext;
- }
-
- sub lib {
-     (my $lib = shift) =~ s/\.a$//;
-     return $lib . $libext;
- }
-
- sub shlib_import {
-     my $lib = shift;
-     return () if $disabled{shared} || $lib =~ /\.a$/;
-     return $lib . $shlibextimport;
- }
-
- sub dso {
-     my $dso = shift;
-
-     return $dso . $dsoext;
- }
  # This makes sure things get built in the order they need
  # to. You're welcome.
  sub dependmagic {
@@ -68,44 +38,115 @@ PLATFORM={- $config{target} -}
 SRCDIR={- $config{sourcedir} -}
 BLDDIR={- $config{builddir} -}
 
-VERSION={- $config{version} -}
+VERSION={- "$config{full_version}" -}
 MAJOR={- $config{major} -}
 MINOR={- $config{minor} -}
 
-SHLIB_VERSION_NUMBER={- $config{shlib_version_number} -}
+SHLIB_VERSION_NUMBER={- $config{shlib_version} -}
 
-LIBS={- join(" ", map { lib($_) } @{$unified_info{libraries}}) -}
-SHLIBS={- join(" ", map { shlib($_) } @{$unified_info{libraries}}) -}
-SHLIBPDBS={- join(" ", map { local $shlibext = ".pdb"; shlib($_) } @{$unified_info{libraries}}) -}
-ENGINES={- join(" ", map { dso($_) } @{$unified_info{engines}}) -}
-ENGINEPDBS={- join(" ", map { local $dsoext = ".pdb"; dso($_) } @{$unified_info{engines}}) -}
-PROGRAMS={- our @PROGRAMS = map { $_.$exeext } @{$unified_info{programs}}; join(" ", @PROGRAMS) -}
+LIBS={- join(" ", map { ( platform->sharedlib_import($_), platform->staticlib($_) ) } @{$unified_info{libraries}}) -}
+SHLIBS={- join(" ", map { platform->sharedlib($_) // () } @{$unified_info{libraries}}) -}
+SHLIBPDBS={- join(" ", map { platform->sharedlibpdb($_) // () } @{$unified_info{libraries}}) -}
+MODULES={- our @MODULES = map { platform->dso($_) } @{$unified_info{modules}};
+           join(" ", @MODULES) -}
+MODULEPDBS={- join(" ", map { platform->dsopdb($_) } @{$unified_info{modules}}) -}
+PROGRAMS={- our @PROGRAMS = map { platform->bin($_) } @{$unified_info{programs}}; join(" ", @PROGRAMS) -}
 PROGRAMPDBS={- join(" ", map { $_.".pdb" } @{$unified_info{programs}}) -}
-SCRIPTS={- join(" ", @{$unified_info{scripts}}) -}
+SCRIPTS={- our @SCRIPTS = @{$unified_info{scripts}}; join(" ", @SCRIPTS) -}
 {- output_off() if $disabled{makedepend}; "" -}
-DEPS={- join(" ", map { (my $x = $_) =~ s|\.o$|$depext|; $x; }
+DEPS={- join(" ", map { platform->isobj($_) ? platform->dep($_) : () }
                   grep { $unified_info{sources}->{$_}->[0] =~ /\.c$/ }
                   keys %{$unified_info{sources}}); -}
 {- output_on() if $disabled{makedepend}; "" -}
-GENERATED_MANDATORY={- join(" ", @{$unified_info{depends}->{""}} ) -}
+GENERATED_MANDATORY={- our @GENERATED_MANDATORY = @{$unified_info{depends}->{""}};
+                       join(" ", @GENERATED_MANDATORY) -}
 GENERATED={- # common0.tmpl provides @generated
-             join(" ", map { (my $x = $_) =~ s|\.[sS]$|.asm|; $x }
-                       @generated) -}
+             our @GENERATED = map { platform->convertext($_) } @generated;
+             join(" ", @GENERATED) -}
 
-INSTALL_LIBS={- join(" ", map { quotify1(lib($_)) } @{$unified_info{install}->{libraries}}) -}
-INSTALL_SHLIBS={- join(" ", map { quotify1(shlib($_)) } @{$unified_info{install}->{libraries}}) -}
-INSTALL_SHLIBPDBS={- join(" ", map { local $shlibext = ".pdb"; quotify1(shlib($_)) } @{$unified_info{install}->{libraries}}) -}
-INSTALL_ENGINES={- join(" ", map { quotify1(dso($_)) } @{$unified_info{install}->{engines}}) -}
-INSTALL_ENGINEPDBS={- join(" ", map { local $dsoext = ".pdb"; quotify1(dso($_)) } @{$unified_info{install}->{engines}}) -}
-INSTALL_PROGRAMS={- join(" ", map { quotify1($_.$exeext) } grep { !m|^test\\| } @{$unified_info{install}->{programs}}) -}
-INSTALL_PROGRAMPDBS={- join(" ", map { quotify1($_.".pdb") } grep { !m|^test\\| } @{$unified_info{install}->{programs}}) -}
-{- output_off() if $disabled{apps}; "" -}
-BIN_SCRIPTS="$(BLDDIR)\tools\c_rehash.pl"
-MISC_SCRIPTS="$(BLDDIR)\apps\CA.pl" "$(BLDDIR)\apps\tsget.pl"
-{- output_on() if $disabled{apps}; "" -}
+INSTALL_LIBS={-
+        join(" ", map { quotify1(platform->sharedlib_import($_)
+                                 // platform->staticlib($_)) }
+                  grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
+                  @{$unified_info{libraries}})
+-}
+INSTALL_SHLIBS={-
+        join(" ", map { my $x = platform->sharedlib($_);
+                        $x ? quotify_l($x) : () }
+                  grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
+                  @{$unified_info{libraries}})
+-}
+INSTALL_SHLIBPDBS={-
+        join(" ", map { my $x = platform->sharedlibpdb($_);
+                        $x ? quotify_l($x) : () }
+                  grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
+                  @{$unified_info{libraries}})
+-}
+INSTALL_ENGINES={-
+        join(" ", map { quotify1(platform->dso($_)) }
+                  grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
+                         && $unified_info{attributes}->{modules}->{$_}->{engine} }
+                  @{$unified_info{modules}})
+-}
+INSTALL_ENGINEPDBS={-
+        join(" ", map { quotify1(platform->dsopdb($_)) }
+                  grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
+                         && $unified_info{attributes}->{modules}->{$_}->{engine} }
+                  @{$unified_info{modules}})
+-}
+INSTALL_MODULES={-
+        join(" ", map { platform->dso($_) }
+                  grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
+                          && !$unified_info{attributes}->{modules}->{$_}->{engine} }
+                  @{$unified_info{modules}})
+-}
+INSTALL_MODULEPDBS={-
+        join(" ", map { quotify1(platform->dsopdb($_)) }
+                  grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
+                         && !$unified_info{attributes}->{modules}->{$_}->{engine} }
+                  @{$unified_info{modules}})
+-}
+INSTALL_PROGRAMS={-
+        join(" ", map { quotify1(platform->bin($_)) }
+                  grep { !$unified_info{attributes}->{programs}->{$_}->{noinst} }
+                  @{$unified_info{programs}})
+-}
+INSTALL_PROGRAMPDBS={-
+        join(" ", map { quotify1(platform->binpdb($_)) }
+                  grep { !$unified_info{attributes}->{programs}->{$_}->{noinst} }
+                  @{$unified_info{programs}})
+-}
+BIN_SCRIPTS={-
+        join(" ", map { quotify1($_) }
+                  grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst}
+                         && !$unified_info{attributes}->{scripts}->{$_}->{misc} }
+                  @{$unified_info{scripts}})
+-}
+MISC_SCRIPTS={-
+        join(" ", map { quotify1($_) }
+                  grep { !$unified_info{attributes}->{scripts}->{$_}->{noinst}
+                         && $unified_info{attributes}->{scripts}->{$_}->{misc} }
+                  @{$unified_info{scripts}})
+-}
+HTMLDOCS1={- our @HTMLDOCS1 = @{$unified_info{htmldocs}->{man1}};
+             join(" ", @HTMLDOCS1) -}
+HTMLDOCS3={- our @HTMLDOCS3 = @{$unified_info{htmldocs}->{man3}};
+             join(" ", @HTMLDOCS3) -}
+HTMLDOCS5={- our @HTMLDOCS5 = @{$unified_info{htmldocs}->{man5}};
+             join(" ", @HTMLDOCS5) -}
+HTMLDOCS7={- our @HTMLDOCS7 = @{$unified_info{htmldocs}->{man7}};
+             join(" ", @HTMLDOCS7) -}
+HTMLDOCS1_BLDDIRS={- my %dirs = map { dirname($_) => 1 } @HTMLDOCS1;
+                     join(' ', sort keys %dirs) -}
+HTMLDOCS3_BLDDIRS={- my %dirs = map { dirname($_) => 1 } @HTMLDOCS3;
+                     join(' ', sort keys %dirs) -}
+HTMLDOCS5_BLDDIRS={- my %dirs = map { dirname($_) => 1 } @HTMLDOCS5;
+                     join(' ', sort keys %dirs) -}
+HTMLDOCS7_BLDDIRS={- my %dirs = map { dirname($_) => 1 } @HTMLDOCS7;
+                     join(' ', sort keys %dirs) -}
 
-APPS_OPENSSL={- use File::Spec::Functions;
-                "\"".catfile("apps","openssl")."\"" -}
+APPS_OPENSSL="{- use File::Spec::Functions;
+                 catfile("apps","openssl") -}"
 
 # Do not edit these manually. Use Configure with --prefix or --openssldir
 # to change this!  Short explanation in the top comment in Configure
@@ -140,20 +181,33 @@ OPENSSLDIR_dev={- #
 OPENSSLDIR_dir={- canonpath($openssldir_dir) -}
 LIBDIR={- our $libdir = $config{libdir} || "lib";
           file_name_is_absolute($libdir) ? "" : $libdir -}
-ENGINESDIR_dev={- use File::Spec::Functions qw(:DEFAULT splitpath);
-                  our $enginesdir = catdir($prefix,$libdir,"engines-$sover_dirname");
-                  our ($enginesdir_dev, $enginesdir_dir, $enginesdir_file) =
-                      splitpath($enginesdir, 1);
-                  $enginesdir_dev -}
+MODULESDIR_dev={- use File::Spec::Functions qw(:DEFAULT splitpath catpath);
+                  our $modulesprefix = catdir($prefix,$libdir);
+                  our ($modulesprefix_dev, $modulesprefix_dir,
+                       $modulesprefix_file) =
+                      splitpath($modulesprefix, 1);
+                  our $modulesdir_dev = $modulesprefix_dev;
+                  our $modulesdir_dir =
+                      catdir($modulesprefix_dir, "ossl-modules");
+                  our $modulesdir = catpath($modulesdir_dev, $modulesdir_dir);
+                  our $enginesdir_dev = $modulesprefix_dev;
+                  our $enginesdir_dir =
+                      catdir($modulesprefix_dir, "engines-$sover_dirname");
+                  our $enginesdir = catpath($enginesdir_dev, $enginesdir_dir);
+                  $modulesdir_dev -}
+MODULESDIR_dir={- canonpath($modulesdir_dir) -}
+ENGINESDIR_dev={- $enginesdir_dev -}
 ENGINESDIR_dir={- canonpath($enginesdir_dir) -}
 !IF "$(DESTDIR)" != ""
 INSTALLTOP=$(DESTDIR)$(INSTALLTOP_dir)
 OPENSSLDIR=$(DESTDIR)$(OPENSSLDIR_dir)
 ENGINESDIR=$(DESTDIR)$(ENGINESDIR_dir)
+MODULESDIR=$(DESTDIR)$(MODULESDIR_dir)
 !ELSE
 INSTALLTOP=$(INSTALLTOP_dev)$(INSTALLTOP_dir)
 OPENSSLDIR=$(OPENSSLDIR_dev)$(OPENSSLDIR_dir)
 ENGINESDIR=$(ENGINESDIR_dev)$(ENGINESDIR_dir)
+MODULESDIR=$(MODULESDIR_dev)$(MODULESDIR_dir)
 !ENDIF
 
 # $(libdir) is chosen to be compatible with the GNU coding standards
@@ -162,29 +216,30 @@ libdir={- file_name_is_absolute($libdir)
 
 ##### User defined commands and flags ################################
 
-CC={- $config{CC} -}
-CPP={- $config{CPP} -}
+CC="{- $config{CC} -}"
+CPP="{- $config{CPP} -}"
 CPPFLAGS={- our $cppflags1 = join(" ",
                                   (map { "-D".$_} @{$config{CPPDEFINES}}),
-                                  (map { " /I ".$_} @{$config{CPPINCLUDES}}),
+                                  (map { " -I ".$_} @{$config{CPPINCLUDES}}),
                                   @{$config{CPPFLAGS}}) -}
 CFLAGS={- join(' ', @{$config{CFLAGS}}) -}
-LD={- $config{LD} -}
+LD="{- $config{LD} -}"
 LDFLAGS={- join(' ', @{$config{LDFLAGS}}) -}
 EX_LIBS={- join(' ', @{$config{LDLIBS}}) -}
 
 PERL={- $config{PERL} -}
 
-AR={- $config{AR} -}
+AR="{- $config{AR} -}"
 ARFLAGS= {- join(' ', @{$config{ARFLAGS}}) -}
 
-MT={- $config{MT} -}
+MT="{- $config{MT} -}"
 MTFLAGS= {- join(' ', @{$config{MTFLAGS}}) -}
 
-AS={- $config{AS} -}
+AS="{- $config{AS} -}"
 ASFLAGS={- join(' ', @{$config{ASFLAGS}}) -}
 
-RC={- $config{RC} -}
+RC="{- $config{RC} -}"
+RCFLAGS={- join(' ', @{$config{RCFLAGS}}) -}
 
 ECHO="$(PERL)" "$(SRCDIR)\util\echo.pl"
 
@@ -247,7 +302,8 @@ LIB_CPPFLAGS={- our $lib_cppflags =
                 join(' ', $lib_cppflags,
                           (map { '-D'.quotify1($_) }
                                "OPENSSLDIR=\"$openssldir\"",
-                               "ENGINESDIR=\"$enginesdir\""),
+                               "ENGINESDIR=\"$enginesdir\"",
+                               "MODULESDIR=\"$modulesdir\""),
                           '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
 LIB_CFLAGS={- join(' ', $target{lib_cflags} || (),
                         $target{shared_cflag} || (),
@@ -264,7 +320,17 @@ DSO_ASFLAGS={- join(' ', $target{dso_asflags} || (),
                          @{$config{module_asflags}},
                          '$(CNF_ASFLAGS)', '$(ASFLAGS)') -}
 DSO_CPPFLAGS={- join(' ', $target{dso_cppflags} || (),
-                          $target{module_cppflags} || (),
+                          $target{module_cppflag} || (),
+                          (map { '-D'.quotify1($_) }
+                               @{$target{dso_defines}},
+                               @{$target{module_defines}},
+                               @{$config{dso_defines}},
+                               @{$config{module_defines}}),
+                          (map { '-I'.quotify1($_) }
+                               @{$target{dso_includes}},
+                               @{$target{module_includes}},
+                               @{$config{dso_includes}},
+                               @{$config{module_includes}}),
                           @{$config{dso_cppflags}},
                           @{$config{module_cppflags}},
                           '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
@@ -283,6 +349,7 @@ BIN_ASFLAGS={- join(' ', $target{bin_asflags} || (),
                          @{$config{bin_asflags}},
                          '$(CNF_ASFLAGS)', '$(ASFLAGS)') -}
 BIN_CPPFLAGS={- join(' ', $target{bin_cppflags} || (),
+                          (map { '-D'.$_ } @{$config{bin_defines} || ()}),
                           @{$config{bin_cppflags}},
                           '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
 BIN_CFLAGS={- join(' ', $target{bin_cflags} || (),
@@ -305,14 +372,17 @@ PROCESSOR= {- $config{processor} -}
 
 # The main targets ###################################################
 
-{- dependmagic('all'); -}: build_libs_nodep build_engines_nodep build_programs_nodep
+{- dependmagic('build_sw'); -}: build_libs_nodep build_modules_nodep build_programs_nodep copy-utils
 {- dependmagic('build_libs'); -}: build_libs_nodep
-{- dependmagic('build_engines'); -}: build_engines_nodep
+{- dependmagic('build_modules'); -}: build_modules_nodep
 {- dependmagic('build_programs'); -}: build_programs_nodep
 
+build_docs: build_html_docs
+build_html_docs: $(HTMLDOCS1) $(HTMLDOCS3) $(HTMLDOCS5) $(HTMLDOCS7)
+
 build_generated: $(GENERATED_MANDATORY)
-build_libs_nodep: $(LIBS) {- join(" ",map { shlib_import($_) } @{$unified_info{libraries}}) -}
-build_engines_nodep: $(ENGINES)
+build_libs_nodep: $(LIBS) {- join(" ",map { platform->sharedlib_import($_) // () } @{$unified_info{libraries}}) -}
+build_modules_nodep: $(MODULES)
 build_programs_nodep: $(PROGRAMS) $(SCRIPTS)
 
 # Kept around for backward compatibility
@@ -320,23 +390,21 @@ build_apps build_tests: build_programs
 
 # Convenience target to prebuild all generated files, not just the mandatory
 # ones
-build_all_generated: $(GENERATED_MANDATORY) $(GENERATED)
+build_all_generated: $(GENERATED_MANDATORY) $(GENERATED) build_docs
 	@{- output_off() if $disabled{makedepend}; "" -}
 	@$(ECHO) "Warning: consider configuring with no-makedepend, because if"
 	@$(ECHO) "         target system doesn't have $(PERL),"
 	@$(ECHO) "         then make will fail..."
 	@{- output_on() if $disabled{makedepend}; "" -}
 
+all: build_sw build_docs
+
 test: tests
-{- dependmagic('tests'); -}: build_programs_nodep build_engines_nodep
+{- dependmagic('tests'); -}: build_programs_nodep build_modules_nodep copy-utils
 	@{- output_off() if $disabled{tests}; "" -}
-	-mkdir $(BLDDIR)\test\test-runs
 	set SRCTOP=$(SRCDIR)
 	set BLDTOP=$(BLDDIR)
-	set RESULT_D=$(BLDDIR)\test\test-runs
 	set PERL=$(PERL)
-	set OPENSSL_ENGINES=$(MAKEDIR)\engines
-	set OPENSSL_DEBUG_MEMORY=on
 	"$(PERL)" "$(SRCDIR)\test\run_tests.pl" $(TESTS)
 	@{- if ($disabled{tests}) { output_on(); } else { output_off(); } "" -}
 	@$(ECHO) "Tests are not supported with your chosen Configure options"
@@ -359,11 +427,15 @@ libclean:
 	-del /Q /F $(LIBS) libcrypto.* libssl.* ossl_static.pdb
 
 clean: libclean
+	-rmdir /Q /S $(HTMLDOCS1_BLDDIRS)
+	-rmdir /Q /S $(HTMLDOCS3_BLDDIRS)
+	-rmdir /Q /S $(HTMLDOCS5_BLDDIRS)
+	-rmdir /Q /S $(HTMLDOCS7_BLDDIRS)
 	{- join("\n\t", map { "-del /Q /F $_" } @PROGRAMS) -}
-	-del /Q /F $(ENGINES)
-	-del /Q /F $(SCRIPTS)
-	-del /Q /F $(GENERATED_MANDATORY)
-	-del /Q /F $(GENERATED)
+	{- join("\n\t", map { "-del /Q /F $_" } @MODULES) -}
+	{- join("\n\t", map { "-del /Q /F $_" } @SCRIPTS) -}
+	{- join("\n\t", map { "-del /Q /F $_" } @GENERATED_MANDATORY) -}
+	{- join("\n\t", map { "-del /Q /F $_" } @GENERATED) -}
 	-del /Q /S /F *.d *.obj *.pdb *.ilk *.manifest
 	-del /Q /S /F engines\*.lib engines\*.exp
 	-del /Q /S /F apps\*.lib apps\*.rc apps\*.res apps\*.exp
@@ -381,9 +453,9 @@ depend:
 
 # Install helper targets #############################################
 
-install_sw: all install_dev install_engines install_runtime
+install_sw: install_dev install_engines install_modules install_runtime
 
-uninstall_sw: uninstall_runtime uninstall_engines uninstall_dev
+uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev
 
 install_docs: install_html_docs
 
@@ -398,7 +470,8 @@ install_ssldirs:
 	@IF NOT EXIST "$(OPENSSLDIR)\openssl.cnf" \
          "$(PERL)" "$(SRCDIR)\util\copy.pl" "$(SRCDIR)\apps\openssl.cnf" \
                                         "$(OPENSSLDIR)\openssl.cnf"
-	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(MISC_SCRIPTS) \
+	@if not "$(MISC_SCRIPTS)"=="" \
+	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(MISC_SCRIPTS) \
                                         "$(OPENSSLDIR)\misc"
 	@"$(PERL)" "$(SRCDIR)\util\copy.pl" "$(SRCDIR)\apps\ct_log_list.cnf" \
                                         "$(OPENSSLDIR)\ct_log_list.cnf.dist"
@@ -406,14 +479,14 @@ install_ssldirs:
          "$(PERL)" "$(SRCDIR)\util\copy.pl" "$(SRCDIR)\apps\ct_log_list.cnf" \
                                         "$(OPENSSLDIR)\ct_log_list.cnf"
 
-install_dev:
+install_dev: install_runtime_libs
 	@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
 	@$(ECHO) "*** Installing development files"
 	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\include\openssl"
-	@{- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } @{$config{defines}}; "" -}
+	@{- output_off() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
 	@"$(PERL)" "$(SRCDIR)\util\copy.pl" "$(SRCDIR)\ms\applink.c" \
 				       "$(INSTALLTOP)\include\openssl"
-	@{- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } @{$config{defines}}; "" -}
+	@{- output_on() unless grep { $_ eq "OPENSSL_USE_APPLINK" } (@{$target{defines}}, @{$config{defines}}); "" -}
 	@"$(PERL)" "$(SRCDIR)\util\copy.pl" "-exclude_re=/__DECC_" \
 				       "$(SRCDIR)\include\openssl\*.h" \
 				       "$(INSTALLTOP)\include\openssl"
@@ -426,41 +499,85 @@ install_dev:
 
 uninstall_dev:
 
-install_engines:
+_install_modules_deps: install_runtime_libs build_modules
+
+install_engines: _install_modules_deps
 	@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
 	@$(ECHO) "*** Installing engines"
 	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(ENGINESDIR)"
-	@if not "$(ENGINES)"=="" \
+	@if not "$(INSTALL_ENGINES)"=="" \
 	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_ENGINES) "$(ENGINESDIR)"
-	@if not "$(ENGINES)"=="" \
+	@if not "$(INSTALL_ENGINES)"=="" \
 	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_ENGINEPDBS) "$(ENGINESDIR)"
 
 uninstall_engines:
 
-install_runtime:
+install_modules: _install_modules_deps
 	@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
-	@$(ECHO) "*** Installing runtime files"
+	@$(ECHO) "*** Installing modules"
+	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(MODULESDIR)"
+	@if not "$(INSTALL_MODULES)"=="" \
+	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_MODULES) "$(MODULESDIR)"
+	@if not "$(INSTALL_MODULES)"=="" \
+	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_MODULEPDBS) "$(MODULESDIR)"
+
+uninstall_modules:
+
+install_runtime: install_programs
+
+install_runtime_libs: build_libs
+	@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
+	@$(ECHO) "*** Installing runtime libraries"
 	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\bin"
 	@if not "$(SHLIBS)"=="" \
 	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_SHLIBS) "$(INSTALLTOP)\bin"
 	@if not "$(SHLIBS)"=="" \
 	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_SHLIBPDBS) \
                                         "$(INSTALLTOP)\bin"
-	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_PROGRAMS) \
+
+install_programs: install_runtime_libs build_programs
+	@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
+	@$(ECHO) "*** Installing runtime programs"
+	@if not "$(INSTALL_PROGRAMS)"=="" \
+	 "$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\bin"
+	@if not "$(INSTALL_PROGRAMS)"=="" \
+	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_PROGRAMS) \
                                         "$(INSTALLTOP)\bin"
-	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_PROGRAMPDBS) \
+	@if not "$(INSTALL_PROGRAMS)"=="" \
+	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_PROGRAMPDBS) \
                                         "$(INSTALLTOP)\bin"
-	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(BIN_SCRIPTS) \
+	@if not "$(INSTALL_PROGRAMS)"=="" \
+	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(BIN_SCRIPTS) \
                                         "$(INSTALLTOP)\bin"
 
 uninstall_runtime:
 
-install_html_docs:
-        "$(PERL)" "$(SRCDIR)\util\process_docs.pl" \
-                "--destdir=$(INSTALLTOP)\html" --type=html
+install_html_docs: build_html_docs
+	@if "$(INSTALLTOP)"=="" ( echo INSTALLTOP should not be empty & exit 1 )
+	@echo *** Installing HTML docs
+	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\html\man1"
+	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\html\man3"
+	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\html\man5"
+	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(INSTALLTOP)\html\man7"
+	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(BLDDIR)\doc\html\man1\*.html \
+                                        "$(INSTALLTOP)\html\man1"
+	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(BLDDIR)\doc\html\man3\*.html \
+                                        "$(INSTALLTOP)\html\man3"
+	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(BLDDIR)\doc\html\man5\*.html \
+                                        "$(INSTALLTOP)\html\man5"
+	@"$(PERL)" "$(SRCDIR)\util\copy.pl" $(BLDDIR)\doc\html\man7\*.html \
+                                        "$(INSTALLTOP)\html\man7"
 
 uninstall_html_docs:
 
+# Helper targets #####################################################
+
+copy-utils: $(BLDDIR)\util\wrap.pl
+
+$(BLDDIR)\util\wrap.pl: configdata.pm
+	@if NOT EXIST "$(BLDDIR)\util" mkdir "$(BLDDIR)\util"
+	@if NOT "$(SRCDIR)"=="$(BLDDIR)" copy "$(SRCDIR)\util\$(@F)" "$(BLDDIR)\util"
+
 # Building targets ###################################################
 
 configdata.pm: "$(SRCDIR)\Configure" {- join(" ", map { '"'.$_.'"' } @{$config{build_file_templates}}, @{$config{build_infos}}, @{$config{conf_files}}) -}
@@ -484,35 +601,54 @@ reconfigure reconf:
  # It takes a list of library names and outputs a list of dependencies
  sub compute_lib_depends {
      if ($disabled{shared}) {
-	 return map { lib($_) } @_;
+	 return map { platform->staticlib($_) } @_;
      }
-     foreach (@_) {
-         (my $l = $_) =~ s/\.a$//;
-         die "Linking with static variants of shared libraries is not supported in this configuration\n"
-             if $l ne $_ && shlib($l);
-     }
-     return map { shlib_import($_) or lib($_) } @_;
+     return map { platform->sharedlib_import($_) // platform->staticlib($_) } @_;
  }
 
   sub generatesrc {
       my %args = @_;
-      (my $target = $args{src}) =~ s/\.[sS]$/.asm/;
       my ($gen0, @gens) = @{$args{generator}};
       my $generator = '"'.$gen0.'"'.join('', map { " $_" } @gens);
       my $generator_incs = join("", map { " -I \"$_\"" } @{$args{generator_incs}});
-      my $incs = join("", map { " /I \"$_\"" } @{$args{incs}});
+      my $incs = join("", map { " -I \"$_\"" } @{$args{incs}});
+      my $defs = join("", map { " -D".$_ } @{$args{defs}});
       my $deps = @{$args{deps}} ?
           '"'.join('" "', @{$args{generator_deps}}, @{$args{deps}}).'"' : '';
 
-      if ($target !~ /\.asm$/) {
+      if ($args{src} =~ /\.html$/) {
+	  my $title = basename($args{src}, ".html");
+	  my $pod = $args{generator}->[0];
+	  return <<"EOF";
+$args{src}: "$pod"
+	\$(PERL) \$(SRCDIR)/util/mkpod2html.pl -i "$pod" -o \$\@ -t "$title" -r "\$(SRCDIR)/doc"
+EOF
+      } elsif (platform->isdef($args{src})) {
+          my $target = platform->def($args{src});
+          my $mkdef = abs2rel(rel2abs(catfile($config{sourcedir},
+                                              "util", "mkdef.pl")),
+                              rel2abs($config{builddir}));
+          my $ord_ver = $args{intent} eq 'lib' ? ' --version $(VERSION)' : '';
+          my $ord_name =
+              $args{generator}->[1] || platform->dsoname($args{product});
+          return <<"EOF";
+$target: $args{generator}->[0] $deps $mkdef
+	"\$(PERL)" $mkdef$ord_ver --ordinals $args{generator}->[0] --name $ord_name --OS windows > $target
+EOF
+      } elsif (!platform->isasm($args{src})) {
+          my $target = $args{src};
           if ($args{generator}->[0] =~ m|^.*\.in$|) {
               my $dofile = abs2rel(rel2abs(catfile($config{sourcedir},
                                                    "util", "dofile.pl")),
                                    rel2abs($config{builddir}));
+              my @modules = ( 'configdata.pm',
+                              grep { $_ =~ m|\.pm$| } @{$args{deps}} );
+              my %moduleincs = map { '"-I'.dirname($_).'"' => 1 } @modules;
+              @modules = map { "-M".basename($_, '.pm') } @modules;
+              my $modules = join(' ', '', sort keys %moduleincs, @modules);
               return <<"EOF";
 $target: "$args{generator}->[0]" $deps
-	"\$(PERL)" "-I\$(BLDDIR)" -Mconfigdata "$dofile" \\
-	    "-o$target{build_file}" $generator > \$@
+	"\$(PERL)"$modules "$dofile" "-o$target{build_file}" $generator > \$@
 EOF
 	  } else {
               return <<"EOF";
@@ -521,20 +657,23 @@ $target: "$args{generator}->[0]" $deps
 EOF
 	  }
       } else {
+          my $cppflags = {
+              shlib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)',
+              lib => '$(LIB_CFLAGS) $(LIB_CPPFLAGS)',
+              dso => '$(DSO_CFLAGS) $(DSO_CPPFLAGS)',
+              bin => '$(BIN_CFLAGS) $(BIN_CPPFLAGS)'
+          } -> {$args{intent}};
+          my $target = platform->asm($args{src});
+
           if ($args{generator}->[0] =~ /\.pl$/) {
-              $generator = '"$(PERL)"'.$generator_incs.' '.$generator;
+              $generator = '"$(PERL)"'.$generator_incs.' '.$generator
+                  .' "$(PERLASM_SCHEME)"'.$incs.' '.$cppflags.$defs.' $(PROCESSSOR)';
           } elsif ($args{generator}->[0] =~ /\.S$/) {
               $generator = undef;
           } else {
               die "Generator type for $src unknown: $generator\n";
           }
 
-          my $cppflags = $incs;
-          $cppflags .= {
-              lib => ' $(LIB_CFLAGS) $(LIB_CPPFLAGS)',
-              dso => ' $(DSO_CFLAGS) $(DSO_CPPFLAGS)',
-              bin => ' $(BIN_CFLAGS) $(BIN_CPPFLAGS)'
-          } -> {$args{intent}};
           if (defined($generator)) {
               # If the target is named foo.S in build.info, we want to
               # end up generating foo.s in two steps.
@@ -543,7 +682,7 @@ EOF
 $target: "$args{generator}->[0]" $deps
 	set ASM=\$(AS)
 	$generator \$@.S
-	\$(CPP) $cppflags \$@.S > \$@.i && move /Y \$@.i \$@
+	\$(CPP) $incs $cppflags $defs \$@.S > \$@.i && move /Y \$@.i \$@
         del /Q \$@.S
 EOF
               }
@@ -556,159 +695,170 @@ EOF
           }
           return <<"EOF";
 $target: "$args{generator}->[0]" $deps
-	\$(CPP) $incs $cppflags "$args{generator}->[0]" > \$@.i && move /Y \$@.i \$@
+	\$(CPP) $incs $cppflags $defs "$args{generator}->[0]" > \$@.i && move /Y \$@.i \$@
 EOF
       }
   }
 
  sub src2obj {
+     my $asmext = platform->asmext();
      my %args = @_;
-     my @srcs = map { (my $x = $_) =~ s/\.s$/.asm/; $x
-                    } ( @{$args{srcs}} );
+     my @srcs =
+         map { my $x = $_;
+               (platform->isasm($x) && grep { $x eq $_ } @generated)
+               ? platform->asm($x) : $x }
+         ( @{$args{srcs}} );
      my $srcs = '"'.join('" "',  @srcs).'"';
      my $deps = '"'.join('" "', @srcs, @{$args{deps}}).'"';
-     my $incs = join("", map { ' /I "'.$_.'"' } @{$args{incs}});
-     my $cflags = { lib => ' $(LIB_CFLAGS)',
+     my $incs = join("", map { ' -I "'.$_.'"' } @{$args{incs}});
+     my $defs = join("", map { " -D".$_ } @{$args{defs}});
+     my $cflags = { shlib => ' $(LIB_CFLAGS)',
+		    lib => ' $(LIB_CFLAGS)',
 		    dso => ' $(DSO_CFLAGS)',
 		    bin => ' $(BIN_CFLAGS)' } -> {$args{intent}};
      $cflags .= $incs;
-     $cflags .= { lib => ' $(LIB_CPPFLAGS)',
+     $cflags .= { shlib => ' $(LIB_CPPFLAGS)',
+		  lib => ' $(LIB_CPPFLAGS)',
 		  dso => ' $(DSO_CPPFLAGS)',
 		  bin => ' $(BIN_CPPFLAGS)' } -> {$args{intent}};
-     my $asflags = { lib => ' $(LIB_ASFLAGS)',
+     my $asflags = { shlib => ' $(LIB_ASFLAGS)',
+		     lib => ' $(LIB_ASFLAGS)',
 		     dso => ' $(DSO_ASFLAGS)',
 		     bin => ' $(BIN_ASFLAGS)' } -> {$args{intent}};
      my $makedepprog = $config{makedepprog};
      if ($srcs[0] =~ /\.rc$/) {
+         my $res = platform->res($args{obj});
          return <<"EOF";
-$args{obj}: $deps
-	\$(RC) \$(RCOUTFLAG)\$\@ $srcs
+$res: $deps
+	\$(RC) \$(RCFLAGS) \$(RCOUTFLAG)\$\@ $srcs
 EOF
      }
-     (my $obj = $args{obj}) =~ s|\.o$||;
-     if ($srcs[0] =~ /\.asm$/) {
+     my $obj = platform->obj($args{obj});
+     my $dep = platform->dep($args{obj});
+     if ($srcs[0] =~ /\Q${asmext}\E$/) {
          return <<"EOF";
-$obj$objext: $deps
+$obj: $deps
 	\$(AS) $asflags \$(ASOUTFLAG)\$\@ $srcs
 EOF
      } elsif ($srcs[0] =~ /.S$/) {
          return <<"EOF";
-$obj$objext: $deps
-	\$(CC) /EP /D__ASSEMBLER__ $cflags $srcs > \$@.asm && \$(AS) $asflags \$(ASOUTFLAG)\$\@ \$@.asm
+$obj: $deps
+	\$(CC) /EP -D__ASSEMBLER__ $cflags $defs $srcs > \$@.asm && \$(AS) $asflags \$(ASOUTFLAG)\$\@ \$@.asm
 EOF
      }
-     return <<"EOF"	if (!$disabled{makedepend});
-$obj$depext: $deps
-	\$(CC) $cflags /Zs /showIncludes $srcs 2>&1 > $obj$depext
-$obj$objext: $obj$depext
-	\$(CC) $cflags -c \$(COUTFLAG)\$\@ $srcs
+     my $recipe = <<"EOF";
+$obj: $deps
+	\$(CC) $cflags $defs -c \$(COUTFLAG)\$\@ $srcs
 EOF
-    return <<"EOF"	if ($disabled{makedepend});
-$obj$objext: $deps
-	\$(CC) $cflags -c \$(COUTFLAG)\$\@ $srcs
+     $recipe .= <<"EOF"	unless $disabled{makedepend};
+	\$(CC) $cflags $defs /Zs /showIncludes $srcs 2>&1 > $dep
 EOF
+     return $recipe;
  }
 
- # On Unix, we build shlibs from static libs, so we're ignoring the
- # object file array.  We *know* this routine is only called when we've
- # configure 'shared'.
- sub libobj2shlib {
+ # We *know* this routine is only called when we've configure 'shared'.
+ # Also, note that even though the import library built here looks like
+ # a static library, it really isn't.
+ sub obj2shlib {
      my %args = @_;
      my $lib = $args{lib};
-     my $shlib = $args{shlib};
-     my @objs = map { (my $x = $_) =~ s|\.o$|$objext|; $x }
-                grep { $_ =~ m/\.(?:o|res)$/ }
+     my @objs = map { platform->convertext($_) }
+                grep { platform->isobj($_) || platform->isres($_) }
+                @{$args{objs}};
+     my @defs = map { platform->def($_) }
+                grep { platform->isdef($_) }
                 @{$args{objs}};
-     my @defs = grep { $_ =~ /\.def$/ } @{$args{objs}};
      my @deps = compute_lib_depends(@{$args{deps}});
      die "More than one exported symbols list" if scalar @defs > 1;
      my $linklibs = join("", map { "$_\n" } @deps);
      my $objs = join("\n", @objs);
      my $deps = join(" ", @objs, @defs, @deps);
-     my $target = shlib_import($lib);
+     my $import = platform->sharedlib_import($lib);
+     my $dll =  platform->sharedlib($lib);
      my $shared_def = join("", map { " /def:$_" } @defs);
      return <<"EOF"
-$target: $deps
-	IF EXIST $shlib$shlibext.manifest DEL /F /Q $shlib$shlibext.manifest
+# The import library may look like a static library, but it is not.
+# We MUST make the import library depend on the DLL, in case someone
+# mistakenly removes the latter.
+$import: $dll
+$dll: $deps
+	IF EXIST $full.manifest DEL /F /Q $full.manifest
 	IF EXIST \$@ DEL /F /Q \$@
 	\$(LD) \$(LDFLAGS) \$(LIB_LDFLAGS) \\
-		/implib:\$@ \$(LDOUTFLAG)$shlib$shlibext$shared_def @<< || (DEL /Q \$(\@B).* $shlib.* && EXIT 1)
+		/implib:$import \$(LDOUTFLAG)$dll$shared_def @<< || (DEL /Q \$(\@B).* $import && EXIT 1)
 $objs
 $linklibs\$(LIB_EX_LIBS)
 <<
-	IF EXIST $shlib$shlibext.manifest \\
-	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$shlib$shlibext.manifest \$(MTOUTFLAG)$shlib$shlibext
-	IF EXIST apps\\$shlib$shlibext DEL /Q /F apps\\$shlib$shlibext
-	IF EXIST test\\$shlib$shlibext DEL /Q /F test\\$shlib$shlibext
-	IF EXIST fuzz\\$shlib$shlibext DEL /Q /F fuzz\\$shlib$shlibext
-	COPY $shlib$shlibext apps
-	COPY $shlib$shlibext test
-	COPY $shlib$shlibext fuzz
+	IF EXIST $dll.manifest \\
+	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$dll.manifest \$(MTOUTFLAG)$dll
+	IF EXIST apps\\$dll DEL /Q /F apps\\$dll
+	IF EXIST test\\$dll DEL /Q /F test\\$dll
+	IF EXIST fuzz\\$dll DEL /Q /F fuzz\\$dll
+	COPY $dll apps
+	COPY $dll test
+	COPY $dll fuzz
 EOF
  }
  sub obj2dso {
      my %args = @_;
-     my $dso = $args{lib};
-     my $dso_n = basename($dso);
-     my @objs = map { (my $x = $_) =~ s|\.o$|$objext|; $x } @{$args{objs}};
+     my $dso = platform->dso($args{module});
+     my $dso_n = platform->dsoname($args{module});
+     my @objs = map { platform->convertext($_) }
+                grep { platform->isobj($_) || platform->isres($_) }
+                @{$args{objs}};
+     my @defs = map { platform->def($_) }
+                grep { platform->isdef($_) }
+                @{$args{objs}};
      my @deps = compute_lib_depends(@{$args{deps}});
      my $objs = join("\n", @objs);
      my $linklibs = join("", map { "$_\n" } @deps);
-     my $deps = join(" ", @objs, @deps);
+     my $deps = join(" ", @objs, @defs, @deps);
+     my $shared_def = join("", map { " /def:$_" } @defs);
      return <<"EOF";
-$dso$dsoext: $deps
-	IF EXIST $dso$dsoext.manifest DEL /F /Q $dso$dsoext.manifest
-	\$(LD) \$(LDFLAGS) \$(DSO_LDFLAGS) \$(LDOUTFLAG)$dso$dsoext /def:<< @<<
-LIBRARY         $dso_n
-EXPORTS
-    bind_engine		@1
-    v_check		@2
-<<
+$dso: $deps
+	IF EXIST $dso.manifest DEL /F /Q $dso.manifest
+	\$(LD) \$(LDFLAGS) \$(DSO_LDFLAGS) \\
+		\$(LDOUTFLAG)$dso$shared_def @<< || (DEL /Q \$(\@B).* $dso_n.* && EXIT 1)
 $objs
 $linklibs \$(DSO_EX_LIBS)
 <<
-	IF EXIST $dso$dsoext.manifest \\
-	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$dso$dsoext.manifest \$(MTOUTFLAG)$dso$dsoext
+	IF EXIST $dso.manifest \\
+	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$dso.manifest \$(MTOUTFLAG)$dso
 EOF
  }
  sub obj2lib {
      my %args = @_;
-     my $lib = $args{lib};
-
-     # Because static libs and import libs are both named the same in native
-     # Windows, we can't have both.  We skip the static lib in that case,
-     # as the shared libs are what we use anyway.
-     return "" unless $disabled{"shared"} || $lib =~ /\.a$/;
-
-     $lib =~ s/\.a$//;
-     my @objs = map { (my $x = $_) =~ s|\.o$|$objext|; $x } @{$args{objs}};
+     my $lib = platform->staticlib($args{lib});
+     my @objs = map { platform->obj($_) } @{$args{objs}};
      my $objs = join("\n", @objs);
      my $deps = join(" ", @objs);
      return <<"EOF";
-$lib$libext: $deps
-	\$(AR) \$(ARFLAGS) \$(AROUTFLAG)$lib$libext @<<
+$lib: $deps
+	\$(AR) \$(ARFLAGS) \$(AROUTFLAG)$lib @<<
 $objs
 <<
 EOF
  }
  sub obj2bin {
      my %args = @_;
-     my $bin = $args{bin};
-     my @objs = map { (my $x = $_) =~ s|\.o$|$objext|; $x } @{$args{objs}};
+     my $bin = platform->bin($args{bin});
+     my @objs = map { platform->convertext($_) }
+                grep { platform->isobj($_) || platform->isres($_) }
+                @{$args{objs}};
      my @deps = compute_lib_depends(@{$args{deps}});
      my $objs = join("\n", @objs);
      my $linklibs = join("", map { "$_\n" } @deps);
      my $deps = join(" ", @objs, @deps);
      return <<"EOF";
-$bin$exeext: $deps
-	IF EXIST $bin$exeext.manifest DEL /F /Q $bin$exeext.manifest
-	\$(LD) \$(LDFLAGS) \$(BIN_LDFLAGS) \$(LDOUTFLAG)$bin$exeext @<<
+$bin: $deps
+	IF EXIST $bin.manifest DEL /F /Q $bin.manifest
+	\$(LD) \$(LDFLAGS) \$(BIN_LDFLAGS) \$(LDOUTFLAG)$bin @<<
 $objs
 setargv.obj
 $linklibs\$(BIN_EX_LIBS)
 <<
-	IF EXIST $bin$exeext.manifest \\
-	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$bin$exeext.manifest \$(MTOUTFLAG)$bin$exeext
+	IF EXIST $bin.manifest \\
+	   \$(MT) \$(MTFLAGS) \$(MTINFLAG)$bin.manifest \$(MTOUTFLAG)$bin
 EOF
   }
   sub in2script {
@@ -727,11 +877,15 @@ EOF
   sub generatedir {
       my %args = @_;
       my $dir = $args{dir};
-      my @deps = map { s|\.o$|$objext|; $_ } @{$args{deps}};
+      my @deps = map { platform->convertext($_) } @{$args{deps}};
       my @actions = ();
-      my %extinfo = ( dso => $dsoext,
-                      lib => $libext,
-                      bin => $exeext );
+      my %extinfo = ( dso => platform->dsoext(),
+                      lib => platform->libext(),
+                      bin => platform->binext() );
+
+      # We already have a 'test' target, and the top directory is just plain
+      # silly
+      return if $dir eq "test" || $dir eq ".";
 
       foreach my $type (("dso", "lib", "bin", "script")) {
           next unless defined($unified_info{dirinfo}->{$dir}->{products}->{$type});
@@ -750,7 +904,7 @@ EOF
       my $deps = join(" ", @deps);
       my $actions = join("\n", "", @actions);
       return <<"EOF";
-$args{dir} $args{dir}\\ : $deps$actions
+$dir $dir\\ : $deps$actions
 EOF
   }
   ""    # Important!  This becomes part of the template result.

Configure

@@ -1,8 +1,8 @@
 #! /usr/bin/env perl
 # -*- mode: perl; -*-
-# Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
 #
-# Licensed under the OpenSSL license (the "License").  You may not use
+# Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
 # in the file LICENSE in the source distribution or at
 # https://www.openssl.org/source/license.html
@@ -15,16 +15,18 @@ use Config;
 use FindBin;
 use lib "$FindBin::Bin/util/perl";
 use File::Basename;
-use File::Spec::Functions qw/:DEFAULT abs2rel rel2abs/;
+use File::Spec::Functions qw/:DEFAULT abs2rel rel2abs splitdir/;
 use File::Path qw/mkpath/;
+use OpenSSL::fallback "$FindBin::Bin/external/perl/MODULES.txt";
 use OpenSSL::Glob;
+use OpenSSL::Template;
 
-# see INSTALL for instructions.
+# see INSTALL.md for instructions.
 
 my $orig_death_handler = $SIG{__DIE__};
 $SIG{__DIE__} = \&death_handler;
 
-my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-dso] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
+my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [[no-]threads] [[no-]shared] [[no-]zlib|zlib-dynamic] [no-asm] [no-egd] [sctp] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] [--with-xxx[=vvv]] [--config=FILE] os/compiler[:flags]\n";
 
 # Options:
 #
@@ -43,8 +45,11 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lx
 #
 # --cross-compile-prefix Add specified prefix to binutils components.
 #
-# --api         One of 0.9.8, 1.0.0 or 1.1.0.  Do not compile support for
-#               interfaces deprecated as of the specified OpenSSL version.
+# --api         One of 0.9.8, 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, or 3.0
+#               Define the public APIs as they were for that version
+#               including patch releases.  If 'no-deprecated' is also
+#               given, do not compile support for interfaces deprecated
+#               up to and including the specified OpenSSL version.
 #
 # no-hw-xxx     do not compile support for specific crypto hardware.
 #               Generic OpenSSL-style methods relating to this support
@@ -54,28 +59,35 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lx
 # [no-]threads  [don't] try to create a library that is suitable for
 #               multithreaded applications (default is "threads" if we
 #               know how to do it)
-# [no-]shared	[don't] try to create shared libraries when supported.
+# [no-]shared   [don't] try to create shared libraries when supported.
 # [no-]pic      [don't] try to build position independent code when supported.
 #               If disabled, it also disables shared and dynamic-engine.
 # no-asm        do not use assembler
-# no-dso        do not compile in any native shared-library methods. This
-#               will ensure that all methods just return NULL.
 # no-egd        do not compile support for the entropy-gathering daemon APIs
 # [no-]zlib     [don't] compile support for zlib compression.
-# zlib-dynamic	Like "zlib", but the zlib library is expected to be a shared
-#		library and will be loaded in run-time by the OpenSSL library.
+# zlib-dynamic  Like "zlib", but the zlib library is expected to be a shared
+#               library and will be loaded in run-time by the OpenSSL library.
 # sctp          include SCTP support
+# no-uplink     Don't build support for UPLINK interface.
 # enable-weak-ssl-ciphers
 #               Enable weak ciphers that are disabled by default.
 # 386           generate 80386 code in assembly modules
 # no-sse2       disables IA-32 SSE2 code in assembly modules, the above
 #               mentioned '386' option implies this one
 # no-<cipher>   build without specified algorithm (rsa, idea, rc5, ...)
-# -<xxx> +<xxx> compiler options are passed through
+# -<xxx> +<xxx> All options which are unknown to the 'Configure' script are
+# /<xxx>        passed through to the compiler. Unix-style options beginning
+#               with a '-' or '+' are recognized, as well as Windows-style
+#               options beginning with a '/'. If the option contains arguments
+#               separated by spaces, then the URL-style notation %20 can be
+#               used for the space character in order to avoid having to quote
+#               the option. For example, -opt%20arg gets expanded to -opt arg.
+#               In fact, any ASCII character can be encoded as %xx using its
+#               hexadecimal encoding.
 # -static       while -static is also a pass-through compiler option (and
 #               as such is limited to environments where it's actually
 #               meaningful), it triggers a number configuration options,
-#               namely no-dso, no-pic, no-shared and no-threads. It is
+#               namely no-pic, no-shared and no-threads. It is
 #               argued that the only reason to produce statically linked
 #               binaries (and in context it means executables linked with
 #               -static flag, and not just executables linked with static
@@ -89,22 +101,20 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lx
 #               linked openssl executable has rather debugging value than
 #               production quality.
 #
-# DEBUG_SAFESTACK use type-safe stacks to enforce type-safety on stack items
-#		provided to stack calls. Generates unique stack functions for
-#		each possible stack type.
-# BN_LLONG	use the type 'long long' in crypto/bn/bn.h
-# RC4_CHAR	use 'char' instead of 'int' for RC4_INT in crypto/rc4/rc4.h
+# BN_LLONG      use the type 'long long' in crypto/bn/bn.h
+# RC4_CHAR      use 'char' instead of 'int' for RC4_INT in crypto/rc4/rc4.h
 # Following are set automatically by this script
 #
-# MD5_ASM	use some extra md5 assembler,
-# SHA1_ASM	use some extra sha1 assembler, must define L_ENDIAN for x86
-# RMD160_ASM	use some extra ripemd160 assembler,
-# SHA256_ASM	sha256_block is implemented in assembler
-# SHA512_ASM	sha512_block is implemented in assembler
-# AES_ASM	AES_[en|de]crypt is implemented in assembler
+# MD5_ASM       use some extra md5 assembler,
+# SHA1_ASM      use some extra sha1 assembler, must define L_ENDIAN for x86
+# RMD160_ASM    use some extra ripemd160 assembler,
+# SHA256_ASM    sha256_block is implemented in assembler
+# SHA512_ASM    sha512_block is implemented in assembler
+# AES_ASM       AES_[en|de]crypt is implemented in assembler
 
-# Minimum warning options... any contributions to OpenSSL should at least get
-# past these.
+# Minimum warning options... any contributions to OpenSSL should at least
+# get past these.  Note that we only use these with C compilers, not with
+# C++ compilers.
 
 # DEBUG_UNUSED enables __owur (warn unused result) checks.
 # -DPEDANTIC complements -pedantic and is meant to mask code that
@@ -119,22 +129,23 @@ my $usage="Usage: Configure [no-<cipher> ...] [enable-<cipher> ...] [-Dxxx] [-lx
 # code, so we just tell compiler to be pedantic about everything
 # but 'long long' type.
 
-my $gcc_devteam_warn = "-DDEBUG_UNUSED"
-        . " -DPEDANTIC -pedantic -Wno-long-long"
-        . " -Wall"
-        . " -Wextra"
-        . " -Wno-unused-parameter"
-        . " -Wno-missing-field-initializers"
-        . " -Wswitch"
-        . " -Wsign-compare"
-        . " -Wmissing-prototypes"
-        . " -Wstrict-prototypes"
-        . " -Wshadow"
-        . " -Wformat"
-        . " -Wtype-limits"
-        . " -Wundef"
-        . " -Werror"
-        ;
+my @gcc_devteam_warn = qw(
+    -DDEBUG_UNUSED
+    -DPEDANTIC -pedantic -Wno-long-long
+    -Wall
+    -Wextra
+    -Wno-unused-parameter
+    -Wno-missing-field-initializers
+    -Wswitch
+    -Wsign-compare
+    -Wshadow
+    -Wformat
+    -Wtype-limits
+    -Wundef
+    -Werror
+    -Wmissing-prototypes
+    -Wstrict-prototypes
+);
 
 # These are used in addition to $gcc_devteam_warn when the compiler is clang.
 # TODO(openssl-team): fix problems and investigate if (at least) the
@@ -144,20 +155,20 @@ my $gcc_devteam_warn = "-DDEBUG_UNUSED"
 #       -Wlanguage-extension-token -- no, we use asm()
 #       -Wunused-macros -- no, too tricky for BN and _XOPEN_SOURCE etc
 #       -Wextended-offsetof -- no, needed in CMS ASN1 code
-my $clang_devteam_warn = ""
-        . " -Wswitch-default"
-        . " -Wno-parentheses-equality"
-        . " -Wno-language-extension-token"
-        . " -Wno-extended-offsetof"
-        . " -Wconditional-uninitialized"
-        . " -Wincompatible-pointer-types-discards-qualifiers"
-        . " -Wmissing-variable-declarations"
-        . " -Wno-unknown-warning-option"
-        ;
+my @clang_devteam_warn = qw(
+    -Wno-unknown-warning-option
+    -Wswitch-default
+    -Wno-parentheses-equality
+    -Wno-language-extension-token
+    -Wno-extended-offsetof
+    -Wconditional-uninitialized
+    -Wincompatible-pointer-types-discards-qualifiers
+    -Wmissing-variable-declarations
+);
 
-# This adds backtrace information to the memory leak info.  Is only used
-# when crypto-mdebug-backtrace is enabled.
-my $memleak_devteam_backtrace = "-rdynamic";
+my @cl_devteam_warn = qw(
+    /WX
+);
 
 my $strict_warnings = 0;
 
@@ -173,11 +184,24 @@ our $BSDthreads="-pthread -D_THREAD_SAFE -D_REENTRANT";
 #
 # API compatibility name to version number mapping.
 #
-my $maxapi = "1.1.0";           # API for "no-deprecated" builds
 my $apitable = {
-    "1.1.0" => "0x10100000L",
-    "1.0.0" => "0x10000000L",
-    "0.9.8" => "0x00908000L",
+    # This table expresses when API additions or changes can occur.
+    # The numbering used changes from 3.0 and on because we updated
+    # (solidified) our version numbering scheme at that point.
+
+    # From 3.0 and on, we internalise the given version number in dedcimal
+    # as MAJOR * 10000 + MINOR * 100 + 0
+    "3.0.0" => 30000,
+    "3.0"   => 30000,
+
+    # Note that before 3.0, we didn't have the same version number scheme.
+    # Still, the numbering we use here covers what we need.
+    "1.1.1" => 10101,
+    "1.1.0" => 10100,
+    "1.0.2" => 10002,
+    "1.0.1" => 10001,
+    "1.0.0" => 10000,
+    "0.9.8" =>   908,
 };
 
 our %table = ();
@@ -222,48 +246,77 @@ if (grep /^reconf(igure)?$/, @argvcopy) {
     die "reconfiguring with other arguments present isn't supported"
         if scalar @argvcopy > 1;
     if (-f "./configdata.pm") {
-	my $file = "./configdata.pm";
-	unless (my $return = do $file) {
-	    die "couldn't parse $file: $@" if $@;
+        my $file = "./configdata.pm";
+        unless (my $return = do $file) {
+            die "couldn't parse $file: $@" if $@;
             die "couldn't do $file: $!"    unless defined $return;
             die "couldn't run $file"       unless $return;
-	}
+        }
 
-	@argvcopy = defined($configdata::config{perlargv}) ?
-	    @{$configdata::config{perlargv}} : ();
-	die "Incorrect data to reconfigure, please do a normal configuration\n"
-	    if (grep(/^reconf/,@argvcopy));
-	$config{perlenv} = $configdata::config{perlenv} // {};
+        @argvcopy = defined($configdata::config{perlargv}) ?
+            @{$configdata::config{perlargv}} : ();
+        die "Incorrect data to reconfigure, please do a normal configuration\n"
+            if (grep(/^reconf/,@argvcopy));
+        $config{perlenv} = $configdata::config{perlenv} // {};
     } else {
-	die "Insufficient data to reconfigure, please do a normal configuration\n";
+        die "Insufficient data to reconfigure, please do a normal configuration\n";
     }
 }
 
 $config{perlargv} = [ @argvcopy ];
 
+# Historical: if known directories in crypto/ have been removed, it means
+# that those sub-systems are disabled.
+# (the other option would be to removed them from the SUBDIRS statement in
+# crypto/build.info)
+# We reverse the input list for cosmetic purely reasons, to compensate that
+# 'unshift' adds at the front of the list (i.e. in reverse input order).
+foreach ( reverse sort( 'aes', 'aria', 'bf', 'camellia', 'cast', 'des', 'dh',
+                        'dsa', 'ec', 'hmac', 'idea', 'md2', 'md5', 'mdc2',
+                        'rc2', 'rc4', 'rc5', 'ripemd', 'rsa', 'seed', 'sha',
+                        'sm2', 'sm3', 'sm4') ) {
+    unshift @argvcopy, "no-$_" if ! -d catdir($srcdir, 'crypto', $_);
+}
+
 # Collect version numbers
-$config{version} = "unknown";
-$config{version_num} = "unknown";
-$config{shlib_version_number} = "unknown";
-$config{shlib_version_history} = "unknown";
+my %version = ();
 
 collect_information(
-    collect_from_file(catfile($srcdir,'include/openssl/opensslv.h')),
-    qr/OPENSSL.VERSION.TEXT.*OpenSSL (\S+) / => sub { $config{version} = $1; },
-    qr/OPENSSL.VERSION.NUMBER.*(0x\S+)/	     => sub { $config{version_num}=$1 },
-    qr/SHLIB_VERSION_NUMBER *"([^"]+)"/	     => sub { $config{shlib_version_number}=$1 },
-    qr/SHLIB_VERSION_HISTORY *"([^"]*)"/     => sub { $config{shlib_version_history}=$1 }
+    collect_from_file(catfile($srcdir,'VERSION')),
+    qr/\s*(\w+)\s*=\s*(.*?)\s*$/ =>
+        sub {
+            # Only define it if there is a value at all
+            if ($2 ne '') {
+                my $k = $1;
+                my $v = $2;
+                # Some values are quoted.  Trim the quotes
+                $v = $1 if $v =~ /^"(.*)"$/;
+                $version{uc $k} = $v;
+            }
+        },
+    "OTHERWISE" =>
+        sub { die "Something wrong with this line:\n$_\nin $srcdir/VERSION" },
     );
-if ($config{shlib_version_history} ne "") { $config{shlib_version_history} .= ":"; }
 
-($config{major}, $config{minor})
-    = ($config{version} =~ /^([0-9]+)\.([0-9\.]+)/);
-($config{shlib_major}, $config{shlib_minor})
-    = ($config{shlib_version_number} =~ /^([0-9]+)\.([0-9\.]+)/);
-die "erroneous version information in opensslv.h: ",
-    "$config{major}, $config{minor}, $config{shlib_major}, $config{shlib_minor}\n"
-    if ($config{major} eq "" || $config{minor} eq ""
-	|| $config{shlib_major} eq "" ||  $config{shlib_minor} eq "");
+$config{major} = $version{MAJOR} // 'unknown';
+$config{minor} = $version{MINOR} // 'unknown';
+$config{patch} = $version{PATCH} // 'unknown';
+$config{prerelease} =
+    defined $version{PRE_RELEASE_TAG} ? "-$version{PRE_RELEASE_TAG}" : '';
+$config{build_metadata} =
+    defined $version{BUILD_METADATA} ? "+$version{BUILD_METADATA}" : '';
+$config{shlib_version} = $version{SHLIB_VERSION} // 'unknown';
+$config{release_date} = $version{RELEASE_DATE} // 'xx XXX xxxx';
+
+$config{version} = "$config{major}.$config{minor}.$config{patch}";
+$config{full_version} = "$config{version}$config{prerelease}$config{build_metadata}";
+
+die "erroneous version information in VERSION: ",
+    "$config{version}, $config{shlib_version}\n"
+    unless (defined $version{MAJOR}
+            && defined $version{MINOR}
+            && defined $version{PATCH}
+            && defined $version{SHLIB_VERSION});
 
 # Collect target configurations
 
@@ -298,21 +351,6 @@ $config{libdir}="";
 my $auto_threads=1;    # enable threads automatically? true by default
 my $default_ranlib;
 
-# Top level directories to build
-$config{dirs} = [ "crypto", "ssl", "engines", "apps", "test", "util", "tools", "fuzz" ];
-# crypto/ subdirectories to build
-$config{sdirs} = [
-    "objects",
-    "md2", "md4", "md5", "sha", "mdc2", "hmac", "ripemd", "whrlpool", "poly1305", "blake2", "siphash", "sm3",
-    "des", "aes", "rc2", "rc4", "rc5", "idea", "aria", "bf", "cast", "camellia", "seed", "sm4", "chacha", "modes",
-    "bn", "ec", "rsa", "dsa", "dh", "sm2", "dso", "engine",
-    "buffer", "bio", "stack", "lhash", "rand", "err",
-    "evp", "asn1", "pem", "x509", "x509v3", "conf", "txt_db", "pkcs7", "pkcs12", "comp", "ocsp", "ui",
-    "cms", "ts", "srp", "cmac", "ct", "async", "kdf", "store"
-    ];
-# test/ subdirectories to build
-$config{tdirs} = [ "ossl_shim" ];
-
 # Known TLS and DTLS protocols
 my @tls = qw(ssl3 tls1 tls1_1 tls1_2 tls1_3);
 my @dtls = qw(dtls1 dtls1_2);
@@ -332,15 +370,16 @@ my @disablables = (
     "autoload-config",
     "bf",
     "blake2",
+    "buildtest-c++",
     "camellia",
     "capieng",
     "cast",
     "chacha",
     "cmac",
+    "cmp",
     "cms",
     "comp",
     "crypto-mdebug",
-    "crypto-mdebug-backtrace",
     "ct",
     "deprecated",
     "des",
@@ -361,25 +400,30 @@ my @disablables = (
     "err",
     "external-tests",
     "filenames",
+    "fips",
     "fuzz-libfuzzer",
     "fuzz-afl",
     "gost",
-    "heartbeats",
-    "hw(-.+)?",
     "idea",
+    "ktls",
+    "legacy",
     "makedepend",
     "md2",
     "md4",
     "mdc2",
+    "module",
     "msan",
     "multiblock",
     "nextprotoneg",
+    "pinshared",
     "ocb",
     "ocsp",
+    "padlockeng",
     "pic",
     "poly1305",
     "posix-io",
     "psk",
+    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -388,9 +432,11 @@ my @disablables = (
     "rmd160",
     "scrypt",
     "sctp",
+    "secure-memory",
     "seed",
     "shared",
     "siphash",
+    "siv",
     "sm2",
     "sm3",
     "sm4",
@@ -405,87 +451,118 @@ my @disablables = (
     "tests",
     "threads",
     "tls",
-    "tls13downgrade",
+    "trace",
     "ts",
     "ubsan",
     "ui-console",
     "unit-test",
+    "uplink",
     "whirlpool",
     "weak-ssl-ciphers",
     "zlib",
     "zlib-dynamic",
     );
 foreach my $proto ((@tls, @dtls))
-	{
-	push(@disablables, $proto);
-	push(@disablables, "$proto-method") unless $proto eq "tls1_3";
-	}
+        {
+        push(@disablables, $proto);
+        push(@disablables, "$proto-method") unless $proto eq "tls1_3";
+        }
+
+# Internal disablables, for aliasing purposes.  They serve no special
+# purpose here, but allow scripts to get to know them through configdata.pm,
+# where these are merged with @disablables.
+# The actual aliasing mechanism is done via %disable_cascades
+my @disablables_int = qw(
+    crmf
+    );
 
 my %deprecated_disablables = (
     "ssl2" => undef,
     "buf-freelists" => undef,
+    "crypto-mdebug-backtrace" => undef,
+    "hw" => "hw",               # causes cascade, but no macro
+    "hw-padlock" => "padlockeng",
     "ripemd" => "rmd160",
     "ui" => "ui-console",
+    "heartbeats" => undef,
     );
 
 # All of the following are disabled by default:
 
 our %disabled = ( # "what"         => "comment"
-		  "asan"		=> "default",
-		  "crypto-mdebug"       => "default",
-		  "crypto-mdebug-backtrace" => "default",
-		  "devcryptoeng"	=> "default",
-		  "ec_nistp_64_gcc_128" => "default",
-		  "egd"                 => "default",
-		  "external-tests"	=> "default",
-		  "fuzz-libfuzzer"	=> "default",
-		  "fuzz-afl"		=> "default",
-		  "heartbeats"          => "default",
-		  "md2"                 => "default",
+                  "asan"                => "default",
+                  "buildtest-c++"       => "default",
+                  "crypto-mdebug"       => "default",
+                  "crypto-mdebug-backtrace" => "default",
+                  "devcryptoeng"        => "default",
+                  "ec_nistp_64_gcc_128" => "default",
+                  "egd"                 => "default",
+                  "external-tests"      => "default",
+                  "fuzz-libfuzzer"      => "default",
+                  "fuzz-afl"            => "default",
+                  "md2"                 => "default",
                   "msan"                => "default",
-		  "rc5"                 => "default",
-		  "sctp"                => "default",
-		  "ssl-trace"           => "default",
-		  "ssl3"                => "default",
-		  "ssl3-method"         => "default",
-                  "ubsan"		=> "default",
-		  "tls13downgrade"      => "default",
-		  "unit-test"           => "default",
-		  "weak-ssl-ciphers"    => "default",
-		  "zlib"                => "default",
-		  "zlib-dynamic"        => "default",
-		);
+                  "rc5"                 => "default",
+                  "sctp"                => "default",
+                  "ssl-trace"           => "default",
+                  "ssl3"                => "default",
+                  "ssl3-method"         => "default",
+                  "trace"               => "default",
+                  "ubsan"               => "default",
+                  "unit-test"           => "default",
+                  "weak-ssl-ciphers"    => "default",
+                  "zlib"                => "default",
+                  "zlib-dynamic"        => "default",
+                  "ktls"                => "default",
+                );
 
 # Note: => pair form used for aesthetics, not to truly make a hash table
 my @disable_cascades = (
-    # "what"		=> [ "cascade", ... ]
+    # "what"            => [ "cascade", ... ]
     sub { $config{processor} eq "386" }
-			=> [ "sse2" ],
-    "ssl"		=> [ "ssl3" ],
-    "ssl3-method"	=> [ "ssl3" ],
-    "zlib"		=> [ "zlib-dynamic" ],
-    "des"		=> [ "mdc2" ],
-    "ec"		=> [ "ecdsa", "ecdh" ],
-
-    "dgram"		=> [ "dtls", "sctp" ],
-    "sock"		=> [ "dgram" ],
-    "dtls"		=> [ @dtls ],
+                        => [ "sse2" ],
+    "ssl"               => [ "ssl3" ],
+    "ssl3-method"       => [ "ssl3" ],
+    "zlib"              => [ "zlib-dynamic" ],
+    "des"               => [ "mdc2" ],
+    "ec"                => [ "ecdsa", "ecdh", "sm2", "gost" ],
+    sub { $disabled{"ec"} && $disabled{"dh"} }
+                        => [ "tls1_3" ],
+    "dgram"             => [ "dtls", "sctp" ],
+    "sock"              => [ "dgram" ],
+    "dtls"              => [ @dtls ],
     sub { 0 == scalar grep { !$disabled{$_} } @dtls }
-			=> [ "dtls" ],
+                        => [ "dtls" ],
 
-    "tls"		=> [ @tls ],
+    "tls"               => [ @tls ],
     sub { 0 == scalar grep { !$disabled{$_} } @tls }
-			=> [ "tls" ],
+                        => [ "tls" ],
 
     "crypto-mdebug"     => [ "crypto-mdebug-backtrace" ],
 
-    # Without DSO, we can't load dynamic engines, so don't build them dynamic
-    "dso"               => [ "dynamic-engine" ],
+    # If no modules, then no dynamic engines either
+    "module"            => [ "dynamic-engine" ],
 
-    # Without position independent code, there can be no shared libraries or DSOs
-    "pic"               => [ "shared" ],
-    "shared"            => [ "dynamic-engine" ],
-    "engine"            => [ "afalgeng", "devcryptoeng" ],
+    # Without shared libraries, dynamic engines aren't possible.
+    # This is due to them having to link with libcrypto and register features
+    # using the ENGINE functionality, and since that relies on global tables,
+    # those *have* to be exacty the same as the ones accessed from the app,
+    # which cannot be guaranteed if shared libraries aren't present.
+    # (note that even with shared libraries, both the app and dynamic engines
+    # must be linked with the same library)
+    "shared"            => [ "dynamic-engine", "uplink" ],
+    "dso"               => [ "dynamic-engine", "module" ],
+    # Other modules don't necessarily have to link with libcrypto, so shared
+    # libraries do not have to be a condition to produce those.
+
+    # Without position independent code, there can be no shared libraries
+    # or modules.
+    "pic"               => [ "shared", "module" ],
+
+    "module"            => [ "fips" ],
+
+    "engine"            => [ grep /eng$/, @disablables ],
+    "hw"                => [ "padlockeng" ],
 
     # no-autoalginit is only useful when building non-shared
     "autoalginit"       => [ "shared", "apps" ],
@@ -494,11 +571,20 @@ my @disable_cascades = (
     "apps"              => [ "tests" ],
     "tests"             => [ "external-tests" ],
     "comp"              => [ "zlib" ],
-    "ec"                => [ "tls1_3", "sm2" ],
     "sm3"               => [ "sm2" ],
     sub { !$disabled{"unit-test"} } => [ "heartbeats" ],
 
     sub { !$disabled{"msan"} } => [ "asm" ],
+
+    sub { $disabled{cmac}; } => [ "siv" ],
+    "legacy"                 => [ "md2" ],
+
+    "cmp"               => [ "crmf" ],
+    "tls1_3"            => [ "quic" ],
+
+    # Padlock engine uses low-level AES APIs which are deprecated
+    sub { $disabled{"deprecated-3.0"} }
+          => [ "padlockeng" ]
     );
 
 # Avoid protocol support holes.  Also disable all versions below N, if version
@@ -508,14 +594,14 @@ my @list = (reverse @tls);
 while ((my $first, my $second) = (shift @list, shift @list)) {
     last unless @list;
     push @disable_cascades, ( sub { !$disabled{$first} && $disabled{$second} }
-			      => [ @list ] );
+                              => [ @list ] );
     unshift @list, $second;
 }
 my @list = (reverse @dtls);
 while ((my $first, my $second) = (shift @list, shift @list)) {
     last unless @list;
     push @disable_cascades, ( sub { !$disabled{$first} && $disabled{$second} }
-			      => [ @list ] );
+                              => [ @list ] );
     unshift @list, $second;
 }
 
@@ -525,7 +611,7 @@ while ((my $first, my $second) = (shift @list, shift @list)) {
 
 &usage if ($#ARGV < 0);
 
-# For the "make variables" CINCLUDES and CDEFINES, we support lists with
+# For the "make variables" CPPINCLUDES and CPPDEFINES, we support lists with
 # platform specific list separators.  Users from those platforms should
 # recognise those separators from how you set up the PATH to find executables.
 # The default is the Unix like separator, :, but as an exception, we also
@@ -542,24 +628,24 @@ my %user = (
     AS          => undef,
     ASFLAGS     => [],
     CC          => env('CC'),
-    CFLAGS      => [],
+    CFLAGS      => [ env('CFLAGS') || () ],
     CXX         => env('CXX'),
-    CXXFLAGS    => [],
+    CXXFLAGS    => [ env('CXXFLAGS') || () ],
     CPP         => undef,
-    CPPFLAGS    => [],  # -D, -I, -Wp,
+    CPPFLAGS    => [ env('CPPFLAGS') || () ],  # -D, -I, -Wp,
     CPPDEFINES  => [],  # Alternative for -D
     CPPINCLUDES => [],  # Alternative for -I
     CROSS_COMPILE => env('CROSS_COMPILE'),
     HASHBANGPERL=> env('HASHBANGPERL') || env('PERL'),
     LD          => undef,
-    LDFLAGS     => [],  # -L, -Wl,
-    LDLIBS      => [],  # -l
+    LDFLAGS     => [ env('LDFLAGS') || () ],  # -L, -Wl,
+    LDLIBS      => [ env('LDLIBS') || () ],  # -l
     MT          => undef,
     MTFLAGS     => [],
     PERL        => env('PERL') || ($^O ne "VMS" ? $^X : "perl"),
     RANLIB      => env('RANLIB'),
     RC          => env('RC') || env('WINDRES'),
-    RCFLAGS     => [],
+    RCFLAGS     => [ env('RCFLAGS') || () ],
     RM          => undef,
    );
 # Info about what "make variables" may be prefixed with the cross compiler
@@ -576,6 +662,7 @@ my %useradd = (
     CXXFLAGS    => [],
     LDFLAGS     => [],
     LDLIBS      => [],
+    RCFLAGS     => [],
    );
 
 my %user_synonyms = (
@@ -608,10 +695,8 @@ $config{lflags} = [ env('__CNF_LDFLAGS') || () ];
 $config{ex_libs} = [ env('__CNF_LDLIBS') || () ];
 
 $config{openssl_api_defines}=[];
-$config{openssl_algorithm_defines}=[];
-$config{openssl_thread_defines}=[];
 $config{openssl_sys_defines}=[];
-$config{openssl_other_defines}=[];
+$config{openssl_feature_defines}=[];
 $config{options}="";
 $config{build_type} = "release";
 my $target="";
@@ -623,49 +708,50 @@ my %deprecated_options = ();
 my @known_seed_sources = qw(getrandom devrandom os egd none rdcpu librandom);
 my @seed_sources = ();
 while (@argvcopy)
-	{
-	$_ = shift @argvcopy;
+        {
+        $_ = shift @argvcopy;
 
-	# Support env variable assignments among the options
-	if (m|^(\w+)=(.+)?$|)
-		{
-		$cmdvars{$1} = $2;
-		# Every time a variable is given as a configuration argument,
-		# it acts as a reset if the variable.
-		if (exists $user{$1})
-			{
-			$user{$1} = ref $user{$1} eq "ARRAY" ? [] : undef;
-			}
-		#if (exists $useradd{$1})
-		#	{
-		#	$useradd{$1} = [];
-		#	}
-		next;
-		}
+        # Support env variable assignments among the options
+        if (m|^(\w+)=(.+)?$|)
+                {
+                $cmdvars{$1} = $2;
+                # Every time a variable is given as a configuration argument,
+                # it acts as a reset if the variable.
+                if (exists $user{$1})
+                        {
+                        $user{$1} = ref $user{$1} eq "ARRAY" ? [] : undef;
+                        }
+                #if (exists $useradd{$1})
+                #       {
+                #       $useradd{$1} = [];
+                #       }
+                next;
+                }
 
-	# VMS is a case insensitive environment, and depending on settings
-	# out of our control, we may receive options uppercased.  Let's
-	# downcase at least the part before any equal sign.
-	if ($^O eq "VMS")
-		{
-		s/^([^=]*)/lc($1)/e;
-		}
+        # VMS is a case insensitive environment, and depending on settings
+        # out of our control, we may receive options uppercased.  Let's
+        # downcase at least the part before any equal sign.
+        if ($^O eq "VMS")
+                {
+                s/^([^=]*)/lc($1)/e;
+                }
 
-	# some people just can't read the instructions, clang people have to...
-	s/^-no-(?!integrated-as)/no-/;
+        # some people just can't read the instructions, clang people have to...
+        s/^-no-(?!integrated-as)/no-/;
 
-	# rewrite some options in "enable-..." form
-	s /^-?-?shared$/enable-shared/;
-	s /^sctp$/enable-sctp/;
-	s /^threads$/enable-threads/;
-	s /^zlib$/enable-zlib/;
-	s /^zlib-dynamic$/enable-zlib-dynamic/;
+        # rewrite some options in "enable-..." form
+        s /^-?-?shared$/enable-shared/;
+        s /^sctp$/enable-sctp/;
+        s /^threads$/enable-threads/;
+        s /^zlib$/enable-zlib/;
+        s /^zlib-dynamic$/enable-zlib-dynamic/;
 
         if (/^(no|disable|enable)-(.+)$/)
                 {
                 my $word = $2;
-                if (!exists $deprecated_disablables{$word}
-                        && !grep { $word =~ /^${_}$/ } @disablables)
+                if ($word !~ m|hw(?:-.+)| # special treatment for hw regexp opt
+                        && !exists $deprecated_disablables{$word}
+                        && !grep { $word eq $_ } @disablables)
                         {
                         $unsupported_options{$_} = 1;
                         next;
@@ -719,15 +805,19 @@ while (@argvcopy)
                                 $disabled{$deprecated_disablables{$1}} = "option";
                                 }
                         }
+                elsif ($1 =~ m|hw(?:-.+)|) # deprecate hw options in regexp form
+                        {
+                        $deprecated_options{$_} = 1;
+                        }
                 else
                         {
                         $disabled{$1} = "option";
                         }
-		# No longer an automatic choice
-		$auto_threads = 0 if ($1 eq "threads");
-		}
-	elsif (/^enable-(.+)$/)
-		{
+                # No longer an automatic choice
+                $auto_threads = 0 if ($1 eq "threads");
+                }
+        elsif (/^enable-(.+)$/)
+                {
                 if ($1 eq "static-engine")
                         {
                         $disabled{"dynamic-engine"} = "option";
@@ -740,173 +830,183 @@ while (@argvcopy)
                         {
                         delete $disabled{"zlib"};
                         }
-		my $algo = $1;
-		delete $disabled{$algo};
+                my $algo = $1;
+                delete $disabled{$algo};
 
-		# No longer an automatic choice
-		$auto_threads = 0 if ($1 eq "threads");
-		}
-	elsif (/^--strict-warnings$/)
-		{
-		$strict_warnings = 1;
-		}
-	elsif (/^--debug$/)
-		{
-		$config{build_type} = "debug";
-		}
-	elsif (/^--release$/)
-		{
-		$config{build_type} = "release";
-		}
-	elsif (/^386$/)
-		{ $config{processor}=386; }
-	elsif (/^fips$/)
-		{
-		die "FIPS mode not supported\n";
-		}
-	elsif (/^rsaref$/)
-		{
-		# No RSAref support any more since it's not needed.
-		# The check for the option is there so scripts aren't
-		# broken
-		}
-	elsif (/^nofipscanistercheck$/)
-		{
-		die "FIPS mode not supported\n";
-		}
-	elsif (/^[-+]/)
-		{
-		if (/^--prefix=(.*)$/)
-			{
-			$config{prefix}=$1;
-			die "Directory given with --prefix MUST be absolute\n"
-				unless file_name_is_absolute($config{prefix});
-			}
-		elsif (/^--api=(.*)$/)
-			{
-			$config{api}=$1;
-			}
-		elsif (/^--libdir=(.*)$/)
-			{
-			$config{libdir}=$1;
-			}
-		elsif (/^--openssldir=(.*)$/)
-			{
-			$config{openssldir}=$1;
-			}
-		elsif (/^--with-zlib-lib=(.*)$/)
-			{
-			$withargs{zlib_lib}=$1;
-			}
-		elsif (/^--with-zlib-include=(.*)$/)
-			{
-			$withargs{zlib_include}=$1;
-			}
-		elsif (/^--with-fuzzer-lib=(.*)$/)
-			{
-			$withargs{fuzzer_lib}=$1;
-			}
-		elsif (/^--with-fuzzer-include=(.*)$/)
-			{
-			$withargs{fuzzer_include}=$1;
-			}
-		elsif (/^--with-rand-seed=(.*)$/)
-			{
-			foreach my $x (split(m|,|, $1))
-			    {
-			    die "Unknown --with-rand-seed choice $x\n"
-				if ! grep { $x eq $_ } @known_seed_sources;
-			    push @seed_sources, $x;
-			    }
+                # No longer an automatic choice
+                $auto_threads = 0 if ($1 eq "threads");
+                }
+        elsif (/^--strict-warnings$/)
+                {
+                # Pretend that our strict flags is a C flag, and replace it
+                # with the proper flags later on
+                push @{$useradd{CFLAGS}}, '--ossl-strict-warnings';
+                $strict_warnings=1;
+                }
+        elsif (/^--debug$/)
+                {
+                $config{build_type} = "debug";
+                }
+        elsif (/^--release$/)
+                {
+                $config{build_type} = "release";
+                }
+        elsif (/^386$/)
+                { $config{processor}=386; }
+        elsif (/^fips$/)
+                {
+                die "FIPS mode not supported\n";
+                }
+        elsif (/^rsaref$/)
+                {
+                # No RSAref support any more since it's not needed.
+                # The check for the option is there so scripts aren't
+                # broken
+                }
+        elsif (/^nofipscanistercheck$/)
+                {
+                die "FIPS mode not supported\n";
+                }
+        elsif (m|^[-+/]|)
+                {
+                if (/^--prefix=(.*)$/)
+                        {
+                        $config{prefix}=$1;
+                        die "Directory given with --prefix MUST be absolute\n"
+                                unless file_name_is_absolute($config{prefix});
                         }
-		elsif (/^--cross-compile-prefix=(.*)$/)
-			{
-			$user{CROSS_COMPILE}=$1;
-			}
-		elsif (/^--config=(.*)$/)
-			{
-			read_config $1;
-			}
-		elsif (/^-l(.*)$/)
-			{
-			push @{$useradd{LDLIBS}}, $_;
-			}
-		elsif (/^-framework$/)
-			{
-			push @{$useradd{LDLIBS}}, $_, shift(@argvcopy);
-			}
-		elsif (/^-L(.*)$/ or /^-Wl,/)
-			{
-			push @{$useradd{LDFLAGS}}, $_;
-			}
-		elsif (/^-rpath$/ or /^-R$/)
-			# -rpath is the OSF1 rpath flag
-			# -R is the old Solaris rpath flag
-			{
-			my $rpath = shift(@argvcopy) || "";
-			$rpath .= " " if $rpath ne "";
-			push @{$useradd{LDFLAGS}}, $_, $rpath;
-			}
-		elsif (/^-static$/)
-			{
-			push @{$useradd{LDFLAGS}}, $_;
-			$disabled{"dso"} = "forced";
-			$disabled{"pic"} = "forced";
-			$disabled{"shared"} = "forced";
-			$disabled{"threads"} = "forced";
-			}
-		elsif (/^-D(.*)$/)
-			{
-			push @{$useradd{CPPDEFINES}}, $1;
-			}
-		elsif (/^-I(.*)$/)
-			{
-			push @{$useradd{CPPINCLUDES}}, $1;
-			}
-		elsif (/^-Wp,$/)
-			{
-			push @{$useradd{CPPFLAGS}}, $1;
-			}
-		else	# common if (/^[-+]/), just pass down...
-			{
-			$_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei;
-			push @{$useradd{CFLAGS}}, $_;
-			push @{$useradd{CXXFLAGS}}, $_;
-			}
-		}
-	else
-		{
-		die "target already defined - $target (offending arg: $_)\n" if ($target ne "");
-		$target=$_;
-		}
-	unless ($_ eq $target || /^no-/ || /^disable-/)
-		{
-		# "no-..." follows later after implied deactivations
-		# have been derived.  (Don't take this too seriously,
-		# we really only write OPTIONS to the Makefile out of
-		# nostalgia.)
+                elsif (/^--api=(.*)$/)
+                        {
+                        my $api = $1;
+                        die "Unknown API compatibility level $api"
+                                unless defined $apitable->{$api};
+                        $config{api}=$apitable->{$api};
+                        }
+                elsif (/^--libdir=(.*)$/)
+                        {
+                        $config{libdir}=$1;
+                        }
+                elsif (/^--openssldir=(.*)$/)
+                        {
+                        $config{openssldir}=$1;
+                        }
+                elsif (/^--with-zlib-lib=(.*)$/)
+                        {
+                        $withargs{zlib_lib}=$1;
+                        }
+                elsif (/^--with-zlib-include=(.*)$/)
+                        {
+                        $withargs{zlib_include}=$1;
+                        }
+                elsif (/^--with-fuzzer-lib=(.*)$/)
+                        {
+                        $withargs{fuzzer_lib}=$1;
+                        }
+                elsif (/^--with-fuzzer-include=(.*)$/)
+                        {
+                        $withargs{fuzzer_include}=$1;
+                        }
+                elsif (/^--with-rand-seed=(.*)$/)
+                        {
+                        foreach my $x (split(m|,|, $1))
+                            {
+                            die "Unknown --with-rand-seed choice $x\n"
+                                if ! grep { $x eq $_ } @known_seed_sources;
+                            push @seed_sources, $x;
+                            }
+                        }
+                elsif (/^--cross-compile-prefix=(.*)$/)
+                        {
+                        $user{CROSS_COMPILE}=$1;
+                        }
+                elsif (/^--config=(.*)$/)
+                        {
+                        read_config $1;
+                        }
+                elsif (/^-l(.*)$/)
+                        {
+                        push @{$useradd{LDLIBS}}, $_;
+                        }
+                elsif (/^-framework$/)
+                        {
+                        push @{$useradd{LDLIBS}}, $_, shift(@argvcopy);
+                        }
+                elsif (/^-L(.*)$/ or /^-Wl,/)
+                        {
+                        push @{$useradd{LDFLAGS}}, $_;
+                        }
+                elsif (/^-rpath$/ or /^-R$/)
+                        # -rpath is the OSF1 rpath flag
+                        # -R is the old Solaris rpath flag
+                        {
+                        my $rpath = shift(@argvcopy) || "";
+                        $rpath .= " " if $rpath ne "";
+                        push @{$useradd{LDFLAGS}}, $_, $rpath;
+                        }
+                elsif (/^-static$/)
+                        {
+                        push @{$useradd{LDFLAGS}}, $_;
+                        }
+                elsif (m|^[-/]D(.*)$|)
+                        {
+                        push @{$useradd{CPPDEFINES}}, $1;
+                        }
+                elsif (m|^[-/]I(.*)$|)
+                        {
+                        push @{$useradd{CPPINCLUDES}}, $1;
+                        }
+                elsif (/^-Wp,$/)
+                        {
+                        push @{$useradd{CPPFLAGS}}, $1;
+                        }
+                else    # common if (/^[-+]/), just pass down...
+                        {
+                        # Treat %xx as an ASCII code (e.g. replace %20 by a space character).
+                        # This provides a simple way to pass options with arguments separated
+                        # by spaces without quoting (e.g. -opt%20arg translates to -opt arg).
+                        $_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei;
+                        push @{$useradd{CFLAGS}}, $_;
+                        push @{$useradd{CXXFLAGS}}, $_;
+                        }
+                }
+        elsif (m|^/|)
+                {
+                # Treat %xx as an ASCII code (e.g. replace %20 by a space character).
+                # This provides a simple way to pass options with arguments separated
+                # by spaces without quoting (e.g. /opt%20arg translates to /opt arg).
+                $_ =~ s/%([0-9a-f]{1,2})/chr(hex($1))/gei;
+                push @{$useradd{CFLAGS}}, $_;
+                push @{$useradd{CXXFLAGS}}, $_;
+                }
+        else
+                {
+                die "target already defined - $target (offending arg: $_)\n" if ($target ne "");
+                $target=$_;
+                }
+        unless ($_ eq $target || /^no-/ || /^disable-/)
+                {
+                # "no-..." follows later after implied deactivations
+                # have been derived.  (Don't take this too seriously,
+                # we really only write OPTIONS to the Makefile out of
+                # nostalgia.)
 
-		if ($config{options} eq "")
-			{ $config{options} = $_; }
-		else
-			{ $config{options} .= " ".$_; }
-		}
-	}
-
-if (defined($config{api}) && !exists $apitable->{$config{api}}) {
-	die "***** Unsupported api compatibility level: $config{api}\n",
-}
+                if ($config{options} eq "")
+                        { $config{options} = $_; }
+                else
+                        { $config{options} .= " ".$_; }
+                }
+        }
 
 if (keys %deprecated_options)
-	{
-	warn "***** Deprecated options: ",
-		join(", ", keys %deprecated_options), "\n";
-	}
+        {
+        warn "***** Deprecated options: ",
+                join(", ", keys %deprecated_options), "\n";
+        }
 if (keys %unsupported_options)
-	{
-	die "***** Unsupported options: ",
-		join(", ", keys %unsupported_options), "\n";
-	}
+        {
+        die "***** Unsupported options: ",
+                join(", ", keys %unsupported_options), "\n";
+        }
 
 # If any %useradd entry has been set, we must check that the "make
 # variables" haven't been set.  We start by checking of any %useradd entry
@@ -951,7 +1051,11 @@ foreach (keys %user) {
 
     if (defined $value) {
         if (ref $user{$_} eq 'ARRAY') {
-            $user{$_} = [ split /$list_separator_re/, $value ];
+            if ($_ eq 'CPPDEFINES' || $_ eq 'CPPINCLUDES') {
+                $user{$_} = [ split /$list_separator_re/, $value ];
+            } else {
+                $user{$_} = [ $value ];
+            }
         } elsif (!defined $user{$_}) {
             $user{$_} = $value;
         }
@@ -962,36 +1066,46 @@ if (grep { /-rpath\b/ } ($user{LDFLAGS} ? @{$user{LDFLAGS}} : ())
     && !$disabled{shared}
     && !($disabled{asan} && $disabled{msan} && $disabled{ubsan})) {
     die "***** Cannot simultaneously use -rpath, shared libraries, and\n",
-	"***** any of asan, msan or ubsan\n";
+        "***** any of asan, msan or ubsan\n";
 }
 
-my @tocheckfor = (keys %disabled);
-while (@tocheckfor) {
-    my %new_tocheckfor = ();
-    my @cascade_copy = (@disable_cascades);
-    while (@cascade_copy) {
-	my ($test, $descendents) = (shift @cascade_copy, shift @cascade_copy);
-	if (ref($test) eq "CODE" ? $test->() : defined($disabled{$test})) {
-	    foreach(grep { !defined($disabled{$_}) } @$descendents) {
-		$new_tocheckfor{$_} = 1; $disabled{$_} = "forced";
-	    }
-	}
+sub disable {
+    my $disable_type = shift;
+
+    for (@_) {
+        $disabled{$_} = $disable_type;
+    }
+
+    my @tocheckfor = (@_ ? @_ : keys %disabled);
+    while (@tocheckfor) {
+        my %new_tocheckfor = ();
+        my @cascade_copy = (@disable_cascades);
+        while (@cascade_copy) {
+            my ($test, $descendents) =
+                (shift @cascade_copy, shift @cascade_copy);
+            if (ref($test) eq "CODE" ? $test->() : defined($disabled{$test})) {
+                foreach (grep { !defined($disabled{$_}) } @$descendents) {
+                    $new_tocheckfor{$_} = 1; $disabled{$_} = "cascade";
+                }
+            }
+        }
+        @tocheckfor = (keys %new_tocheckfor);
     }
-    @tocheckfor = (keys %new_tocheckfor);
 }
+disable();                     # First cascade run
 
 our $die = sub { die @_; };
 if ($target eq "TABLE") {
     local $die = sub { warn @_; };
     foreach (sort keys %table) {
-	print_table_entry($_, "TABLE");
+        print_table_entry($_, "TABLE");
     }
     exit 0;
 }
 
 if ($target eq "LIST") {
     foreach (sort keys %table) {
-	print $_,"\n" unless $table{$_}->{template};
+        print $_,"\n" unless $table{$_}->{template};
     }
     exit 0;
 }
@@ -1000,24 +1114,42 @@ if ($target eq "HASH") {
     local $die = sub { warn @_; };
     print "%table = (\n";
     foreach (sort keys %table) {
-	print_table_entry($_, "HASH");
+        print_table_entry($_, "HASH");
     }
     exit 0;
 }
 
-print "Configuring OpenSSL version $config{version} ($config{version_num}) ";
-print "for $target\n";
+print "Configuring OpenSSL version $config{full_version} ";
+print "for target $target\n";
 
 if (scalar(@seed_sources) == 0) {
     print "Using os-specific seed configuration\n";
     push @seed_sources, 'os';
 }
-die "Cannot seed with none and anything else"
-    if scalar(grep { $_ eq 'none' } @seed_sources) > 0
-        && scalar(@seed_sources) > 1;
-push @{$config{openssl_other_defines}},
+if (scalar(grep { $_ eq 'egd' } @seed_sources) > 0) {
+    delete $disabled{'egd'};
+}
+if (scalar(grep { $_ eq 'none' } @seed_sources) > 0) {
+    die "Cannot seed with none and anything else" if scalar(@seed_sources) > 1;
+    warn <<_____ if scalar(@seed_sources) == 1;
+
+============================== WARNING ===============================
+You have selected the --with-rand-seed=none option, which effectively
+disables automatic reseeding of the OpenSSL random generator.
+All operations depending on the random generator such as creating keys
+will not work unless the random generator is seeded manually by the
+application.
+
+Please read the 'Note on random number generation' section in the
+INSTALL.md instructions and the RAND_DRBG(7) manual page for more
+details.
+============================== WARNING ===============================
+
+_____
+}
+push @{$config{openssl_feature_defines}},
      map { (my $x = $_) =~ tr|[\-a-z]|[_A-Z]|; "OPENSSL_RAND_SEED_$x" }
-	@seed_sources;
+        @seed_sources;
 
 # Backward compatibility?
 if ($target =~ m/^CygWin32(-.*)$/) {
@@ -1031,14 +1163,15 @@ if ($d) {
 
     # If we do not find debug-foo in the table, the target is set to foo.
     if (!$table{$target}) {
-	$target = $t;
+        $target = $t;
     }
 }
+
+&usage if !$table{$target} || $table{$target}->{template};
+
 $config{target} = $target;
 my %target = resolve_config($target);
 
-&usage if (!%target || $target{template});
-
 foreach (keys %target_attr_translate) {
     $target{$target_attr_translate{$_}} = $target{$_}
         if $target{$_};
@@ -1047,47 +1180,11 @@ foreach (keys %target_attr_translate) {
 
 %target = ( %{$table{DEFAULTS}}, %target );
 
-# Make the flags to build DSOs the same as for shared libraries unless they
-# are already defined
-$target{module_cflags} = $target{shared_cflag} unless defined $target{module_cflags};
-$target{module_cxxflags} = $target{shared_cxxflag} unless defined $target{module_cxxflags};
-$target{module_ldflags} = $target{shared_ldflag} unless defined $target{module_ldflags};
-{
-    my $shared_info_pl =
-        catfile(dirname($0), "Configurations", "shared-info.pl");
-    my %shared_info = read_eval_file($shared_info_pl);
-    push @{$target{_conf_fname_int}}, $shared_info_pl;
-    my $si = $target{shared_target};
-    while (ref $si ne "HASH") {
-        last if ! defined $si;
-        if (ref $si eq "CODE") {
-            $si = $si->();
-        } else {
-            $si = $shared_info{$si};
-        }
-    }
-
-    # Some of the 'shared_target' values don't have any entried in
-    # %shared_info.  That's perfectly fine, AS LONG AS the build file
-    # template knows how to handle this.  That is currently the case for
-    # Windows and VMS.
-    if (defined $si) {
-        # Just as above, copy certain shared_* attributes to the corresponding
-        # module_ attribute unless the latter is already defined
-        $si->{module_cflags} = $si->{shared_cflag} unless defined $si->{module_cflags};
-        $si->{module_cxxflags} = $si->{shared_cxxflag} unless defined $si->{module_cxxflags};
-        $si->{module_ldflags} = $si->{shared_ldflag} unless defined $si->{module_ldflags};
-        foreach (sort keys %$si) {
-            $target{$_} = defined $target{$_}
-                ? add($si->{$_})->($target{$_})
-                : $si->{$_};
-        }
-    }
-}
-
 my %conf_files = map { $_ => 1 } (@{$target{_conf_fname_int}});
 $config{conf_files} = [ sort keys %conf_files ];
 
+# Using sub disable within these loops may prove fragile, so we run
+# a cascade afterwards
 foreach my $feature (@{$target{disable}}) {
     if (exists $deprecated_disablables{$feature}) {
         warn "***** config $target disables deprecated feature $feature\n";
@@ -1097,30 +1194,28 @@ foreach my $feature (@{$target{disable}}) {
     $disabled{$feature} = 'config';
 }
 foreach my $feature (@{$target{enable}}) {
-    if ("default" eq ($disabled{$_} // "")) {
+    if ("default" eq ($disabled{$feature} // "")) {
         if (exists $deprecated_disablables{$feature}) {
             warn "***** config $target enables deprecated feature $feature\n";
         } elsif (!grep { $feature eq $_ } @disablables) {
             die "***** config $target enables unknown feature $feature\n";
         }
-        delete $disabled{$_};
+        delete $disabled{$feature};
     }
 }
 
+# If uplink_arch isn't defined, disable uplink
+$disabled{uplink} = 'no uplink_arch' unless (defined $target{uplink_arch});
+# If asm_arch isn't defined, disable asm
+$disabled{asm} = 'no asm_arch' unless (defined $target{asm_arch});
+
+disable();                      # Run a cascade now
+
 $target{CXXFLAGS}//=$target{CFLAGS} if $target{CXX};
 $target{cxxflags}//=$target{cflags} if $target{CXX};
-$target{exe_extension}="";
-$target{exe_extension}=".exe" if ($config{target} eq "DJGPP"
-                                  || $config{target} =~ /^(?:Cygwin|mingw)/);
+$target{exe_extension}=".exe" if ($config{target} eq "DJGPP");
 $target{exe_extension}=".pm"  if ($config{target} =~ /vos/);
 
-($target{shared_extension_simple}=$target{shared_extension})
-    =~ s|\.\$\(SHLIB_VERSION_NUMBER\)||
-    unless defined($target{shared_extension_simple});
-$target{dso_extension}//=$target{shared_extension_simple};
-($target{shared_import_extension}=$target{shared_extension_simple}.".a")
-    if ($config{target} =~ /^(?:Cygwin|mingw)/);
-
 # Fill %config with values from %user, and in case those are undefined or
 # empty, use values from %target (acting as a default).
 foreach (keys %user) {
@@ -1155,45 +1250,24 @@ foreach (keys %user) {
     delete $config{$_} unless defined $config{$_};
 }
 
-# Allow overriding the build file name
-$config{build_file} = env('BUILDFILE') || $target{build_file} || "Makefile";
-
-my %disabled_info = ();         # For configdata.pm
-foreach my $what (sort keys %disabled) {
-    $config{options} .= " no-$what";
-
-    if (!grep { $what eq $_ } ( 'dso', 'threads', 'shared', 'pic',
-                                'dynamic-engine', 'makedepend',
-                                'zlib-dynamic', 'zlib', 'sse2' )) {
-        (my $WHAT = uc $what) =~ s|-|_|g;
-
-        # Fix up C macro end names
-        $WHAT = "RMD160" if $what eq "ripemd";
-
-        # fix-up crypto/directory name(s)
-        $what = "ripemd" if $what eq "rmd160";
-        $what = "whrlpool" if $what eq "whirlpool";
-
-        my $macro = $disabled_info{$what}->{macro} = "OPENSSL_NO_$WHAT";
-
-        if ((grep { $what eq $_ } @{$config{sdirs}})
-                && $what ne 'async' && $what ne 'err') {
-            @{$config{sdirs}} = grep { $what ne $_} @{$config{sdirs}};
-            $disabled_info{$what}->{skipped} = [ catdir('crypto', $what) ];
-
-            if ($what ne 'engine') {
-                push @{$config{openssl_algorithm_defines}}, $macro;
-            } else {
-                @{$config{dirs}} = grep !/^engines$/, @{$config{dirs}};
-                push @{$disabled_info{engine}->{skipped}}, catdir('engines');
-                push @{$config{openssl_other_defines}}, $macro;
-            }
-        } else {
-            push @{$config{openssl_other_defines}}, $macro;
-        }
+# Finish up %config by appending things the user gave us on the command line
+# apart from "make variables"
+foreach (keys %useradd) {
+    # The must all be lists, so we assert that here
+    die "internal error: \$useradd{$_} isn't an ARRAY\n"
+        unless ref $useradd{$_} eq 'ARRAY';
 
+    if (defined $config{$_}) {
+        push @{$config{$_}}, @{$useradd{$_}};
+    } else {
+        $config{$_} = [ @{$useradd{$_}} ];
     }
 }
+# At this point, we can forget everything about %user and %useradd,
+# because it's now all been merged into the corresponding $config entry
+
+# Allow overriding the build file name
+$config{build_file} = env('BUILDFILE') || $target{build_file} || "Makefile";
 
 # Make sure build_scheme is consistent.
 $target{build_scheme} = [ $target{build_scheme} ]
@@ -1224,21 +1298,20 @@ foreach my $checker (($builder_platform."-".$target{build_file}."-checker.pm",
 push @{$config{defines}}, "NDEBUG"    if $config{build_type} eq "release";
 
 if ($target =~ /^mingw/ && `$config{CC} --target-help 2>&1` =~ m/-mno-cygwin/m)
-	{
-	push @{$config{cflags}}, "-mno-cygwin";
-	push @{$config{cxxflags}}, "-mno-cygwin" if $config{CXX};
-	push @{$config{shared_ldflag}}, "-mno-cygwin";
-	}
+        {
+        push @{$config{cflags}}, "-mno-cygwin";
+        push @{$config{cxxflags}}, "-mno-cygwin" if $config{CXX};
+        push @{$config{shared_ldflag}}, "-mno-cygwin";
+        }
 
 if ($target =~ /linux.*-mips/ && !$disabled{asm}
-        && !grep { $_ !~ /-m(ips|arch=)/ } (@{$user{CFLAGS}},
-                                            @{$useradd{CFLAGS}})) {
-	# minimally required architecture flags for assembly modules
-	my $value;
-	$value = '-mips2' if ($target =~ /mips32/);
-	$value = '-mips3' if ($target =~ /mips64/);
-	unshift @{$config{cflags}}, $value;
-	unshift @{$config{cxxflags}}, $value if $config{CXX};
+        && !grep { $_ !~ /-m(ips|arch=)/ } (@{$config{CFLAGS}})) {
+        # minimally required architecture flags for assembly modules
+        my $value;
+        $value = '-mips2' if ($target =~ /mips32/);
+        $value = '-mips3' if ($target =~ /mips64/);
+        unshift @{$config{cflags}}, $value;
+        unshift @{$config{cxxflags}}, $value if $config{CXX};
 }
 
 # If threads aren't disabled, check how possible they are
@@ -1246,7 +1319,7 @@ unless ($disabled{threads}) {
     if ($auto_threads) {
         # Enabled by default, disable it forcibly if unavailable
         if ($target{thread_scheme} eq "(unknown)") {
-            $disabled{threads} = "unavailable";
+            disable("unavailable", 'threads');
         }
     } else {
         # The user chose to enable threads explicitly, let's see
@@ -1257,8 +1330,7 @@ unless ($disabled{threads}) {
             # system-dependent compiler options that are necessary.  We
             # can't truly check that the given options are correct, but
             # we expect the user to know what [s]He is doing.
-            if (!@{$user{CFLAGS}} && !@{$useradd{CFLAGS}}
-                    && !@{$user{CPPDEFINES}} && !@{$useradd{CPPDEFINES}}) {
+            if (!@{$config{CFLAGS}} && !@{$config{CPPDEFINES}}) {
                 die "You asked for multi-threading support, but didn't\n"
                     ,"provide any system-specific compiler options\n";
             }
@@ -1266,51 +1338,59 @@ unless ($disabled{threads}) {
     }
 }
 
+# Find out if clang's sanitizers have been enabled with -fsanitize
+# flags and ensure that the corresponding %disabled elements area
+# removed to reflect that the sanitizers are indeed enabled.
+my %detected_sanitizers = ();
+foreach (grep /^-fsanitize=/, @{$config{CFLAGS} || []}) {
+    (my $checks = $_) =~ s/^-fsanitize=//;
+    foreach (split /,/, $checks) {
+        my $d = { address       => 'asan',
+                  undefined     => 'ubsan',
+                  memory        => 'msan' } -> {$_};
+        next unless defined $d;
+
+        $detected_sanitizers{$d} = 1;
+        if (defined $disabled{$d}) {
+            die "***** Conflict between disabling $d and enabling $_ sanitizer"
+                if $disabled{$d} ne "default";
+            delete $disabled{$d};
+        }
+    }
+}
+
 # If threads still aren't disabled, add a C macro to ensure the source
 # code knows about it.  Any other flag is taken care of by the configs.
 unless($disabled{threads}) {
-    push @{$config{openssl_thread_defines}}, "OPENSSL_THREADS";
-}
-
-# With "deprecated" disable all deprecated features.
-if (defined($disabled{"deprecated"})) {
-        $config{api} = $maxapi;
+    push @{$config{openssl_feature_defines}}, "OPENSSL_THREADS";
 }
 
 my $no_shared_warn=0;
 if ($target{shared_target} eq "")
-	{
-	$no_shared_warn = 1
-	    if (!$disabled{shared} || !$disabled{"dynamic-engine"});
-	$disabled{shared} = "no-shared-target";
-	$disabled{pic} = $disabled{shared} = $disabled{"dynamic-engine"} =
-	    "no-shared-target";
-	}
+        {
+        $no_shared_warn = 1
+            if (!$disabled{shared} || !$disabled{"dynamic-engine"});
+        disable('no-shared-target', 'pic');
+        }
 
 if ($disabled{"dynamic-engine"}) {
-        push @{$config{openssl_other_defines}}, "OPENSSL_NO_DYNAMIC_ENGINE";
         $config{dynamic_engines} = 0;
 } else {
-        push @{$config{openssl_other_defines}}, "OPENSSL_NO_STATIC_ENGINE";
         $config{dynamic_engines} = 1;
 }
 
-unless ($disabled{asan}) {
+unless ($disabled{asan} || defined $detected_sanitizers{asan}) {
     push @{$config{cflags}}, "-fsanitize=address";
-    push @{$config{cxxflags}}, "-fsanitize=address" if $config{CXX};
 }
 
-unless ($disabled{ubsan}) {
+unless ($disabled{ubsan} || defined $detected_sanitizers{ubsan}) {
     # -DPEDANTIC or -fnosanitize=alignment may also be required on some
     # platforms.
     push @{$config{cflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all";
-    push @{$config{cxxflags}}, "-fsanitize=undefined", "-fno-sanitize-recover=all"
-        if $config{CXX};
 }
 
-unless ($disabled{msan}) {
+unless ($disabled{msan} || defined $detected_sanitizers{msan}) {
   push @{$config{cflags}}, "-fsanitize=memory";
-  push @{$config{cxxflags}}, "-fsanitize=memory" if $config{CXX};
 }
 
 unless ($disabled{"fuzz-libfuzzer"} && $disabled{"fuzz-afl"}
@@ -1324,103 +1404,46 @@ unless ($disabled{"fuzz-libfuzzer"} && $disabled{"fuzz-afl"}
 
 # This saves the build files from having to check
 if ($disabled{pic})
-	{
-	foreach (qw(shared_cflag shared_cxxflag shared_cppflag
-		    shared_defines shared_includes shared_ldflag
-		    module_cflags module_cxxflags module_cppflags
-		    module_defines module_includes module_lflags))
-		{
-		delete $config{$_};
-		$target{$_} = "";
-		}
-	}
+        {
+        foreach (qw(shared_cflag shared_cxxflag shared_cppflag
+                    shared_defines shared_includes shared_ldflag
+                    module_cflags module_cxxflags module_cppflags
+                    module_defines module_includes module_lflags))
+                {
+                delete $config{$_};
+                $target{$_} = "";
+                }
+        }
 else
-	{
-	push @{$config{lib_defines}}, "OPENSSL_PIC";
-	}
+        {
+        push @{$config{lib_defines}}, "OPENSSL_PIC";
+        }
 
 if ($target{sys_id} ne "")
-	{
-	push @{$config{openssl_sys_defines}}, "OPENSSL_SYS_$target{sys_id}";
-	}
+        {
+        push @{$config{openssl_sys_defines}}, "OPENSSL_SYS_$target{sys_id}";
+        }
+
+my %predefined_C = compiler_predefined($config{CROSS_COMPILE}.$config{CC});
+my %predefined_CXX = $config{CXX}
+    ? compiler_predefined($config{CROSS_COMPILE}.$config{CXX})
+    : ();
 
 unless ($disabled{asm}) {
-    $target{cpuid_asm_src}=$table{DEFAULTS}->{cpuid_asm_src} if ($config{processor} eq "386");
-    push @{$config{lib_defines}}, "OPENSSL_CPUID_OBJ" if ($target{cpuid_asm_src} ne "mem_clr.c");
-
-    $target{bn_asm_src} =~ s/\w+-gf2m.c// if (defined($disabled{ec2m}));
-
-    # bn-586 is the only one implementing bn_*_part_words
-    push @{$config{lib_defines}}, "OPENSSL_BN_ASM_PART_WORDS" if ($target{bn_asm_src} =~ /bn-586/);
-    push @{$config{lib_defines}}, "OPENSSL_IA32_SSE2" if (!$disabled{sse2} && $target{bn_asm_src} =~ /86/);
-
-    push @{$config{lib_defines}}, "OPENSSL_BN_ASM_MONT" if ($target{bn_asm_src} =~ /-mont/);
-    push @{$config{lib_defines}}, "OPENSSL_BN_ASM_MONT5" if ($target{bn_asm_src} =~ /-mont5/);
-    push @{$config{lib_defines}}, "OPENSSL_BN_ASM_GF2m" if ($target{bn_asm_src} =~ /-gf2m/);
-
-    if ($target{sha1_asm_src}) {
-	push @{$config{lib_defines}}, "SHA1_ASM"   if ($target{sha1_asm_src} =~ /sx86/ || $target{sha1_asm_src} =~ /sha1/);
-	push @{$config{lib_defines}}, "SHA256_ASM" if ($target{sha1_asm_src} =~ /sha256/);
-	push @{$config{lib_defines}}, "SHA512_ASM" if ($target{sha1_asm_src} =~ /sha512/);
-    }
-    if ($target{keccak1600_asm_src} ne $table{DEFAULTS}->{keccak1600_asm_src}) {
-	push @{$config{lib_defines}}, "KECCAK1600_ASM";
-    }
-    if ($target{rc4_asm_src} ne $table{DEFAULTS}->{rc4_asm_src}) {
-	push @{$config{lib_defines}}, "RC4_ASM";
-    }
-    if ($target{md5_asm_src}) {
-	push @{$config{lib_defines}}, "MD5_ASM";
-    }
-    $target{cast_asm_src}=$table{DEFAULTS}->{cast_asm_src} unless $disabled{pic}; # CAST assembler is not PIC
-    if ($target{rmd160_asm_src}) {
-	push @{$config{lib_defines}}, "RMD160_ASM";
-    }
-    if ($target{aes_asm_src}) {
-	push @{$config{lib_defines}}, "AES_ASM" if ($target{aes_asm_src} =~ m/\baes-/);;
-	# aes-ctr.fake is not a real file, only indication that assembler
-	# module implements AES_ctr32_encrypt...
-	push @{$config{lib_defines}}, "AES_CTR_ASM" if ($target{aes_asm_src} =~ s/\s*aes-ctr\.fake//);
-	# aes-xts.fake indicates presence of AES_xts_[en|de]crypt...
-	push @{$config{lib_defines}}, "AES_XTS_ASM" if ($target{aes_asm_src} =~ s/\s*aes-xts\.fake//);
-	$target{aes_asm_src} =~ s/\s*(vpaes|aesni)-x86\.s//g if ($disabled{sse2});
-	push @{$config{lib_defines}}, "VPAES_ASM" if ($target{aes_asm_src} =~ m/vpaes/);
-	push @{$config{lib_defines}}, "BSAES_ASM" if ($target{aes_asm_src} =~ m/bsaes/);
-    }
-    if ($target{wp_asm_src} =~ /mmx/) {
-        if ($config{processor} eq "386") {
-	    $target{wp_asm_src}=$table{DEFAULTS}->{wp_asm_src};
-	} elsif (!$disabled{"whirlpool"}) {
-	    push @{$config{lib_defines}}, "WHIRLPOOL_ASM";
-	}
-    }
-    if ($target{modes_asm_src} =~ /ghash-/) {
-	push @{$config{lib_defines}}, "GHASH_ASM";
-    }
-    if ($target{ec_asm_src} =~ /ecp_nistz256/) {
-	push @{$config{lib_defines}}, "ECP_NISTZ256_ASM";
-    }
-    if ($target{ec_asm_src} =~ /x25519/) {
-	push @{$config{lib_defines}}, "X25519_ASM";
-    }
-    if ($target{padlock_asm_src} ne $table{DEFAULTS}->{padlock_asm_src}) {
-	push @{$config{lib_defines}}, "PADLOCK_ASM";
-    }
-    if ($target{poly1305_asm_src} ne "") {
-	push @{$config{lib_defines}}, "POLY1305_ASM";
+    # big endian systems can use ELFv2 ABI
+    if ($target eq "linux-ppc64") {
+        $target{perlasm_scheme} = "linux64v2" if ($predefined_C{_CALL_ELF} == 2);
     }
 }
 
-my %predefined = compiler_predefined($config{CROSS_COMPILE}.$config{CC});
-
 # Check for makedepend capabilities.
 if (!$disabled{makedepend}) {
     if ($config{target} =~ /^(VC|vms)-/) {
         # For VC- and vms- targets, there's nothing more to do here.  The
         # functionality is hard coded in the corresponding build files for
         # cl (Windows) and CC/DECC (VMS).
-    } elsif (($predefined{__GNUC__} // -1) >= 3
-	     && !($predefined{__APPLE_CC__} && !$predefined{__clang__})) {
+    } elsif (($predefined_C{__GNUC__} // -1) >= 3
+             && !($predefined_C{__APPLE_CC__} && !$predefined_C{__clang__})) {
         # We know that GNU C version 3 and up as well as all clang
         # versions support dependency generation, but Xcode did not
         # handle $cc -M before clang support (but claims __GNUC__ = 3)
@@ -1429,19 +1452,19 @@ if (!$disabled{makedepend}) {
         # In all other cases, we look for 'makedepend', and disable the
         # capability if not found.
         $config{makedepprog} = which('makedepend');
-        $disabled{makedepend} = "unavailable" unless $config{makedepprog};
+        disable('unavailable', 'makedepend') unless $config{makedepprog};
     }
 }
 
-if (!$disabled{asm}) {
+if (!$disabled{asm} && !$predefined_C{__MACH__} && $^O ne 'VMS') {
     # probe for -Wa,--noexecstack option...
-    if ($predefined{__clang__}) {
+    if ($predefined_C{__clang__}) {
         # clang has builtin assembler, which doesn't recognize --help,
         # but it apparently recognizes the option in question on all
         # supported platforms even when it's meaningless. In other words
         # probe would fail, but probed option always accepted...
         push @{$config{cflags}}, "-Wa,--noexecstack", "-Qunused-arguments";
-    } elsif ($^O ne 'VMS') {
+    } else {
         my $cc = $config{CROSS_COMPILE}.$config{CC};
         open(PIPE, "$cc -Wa,--help -c -o null.$$.o -x assembler /dev/null 2>&1 |");
         while(<PIPE>) {
@@ -1457,28 +1480,34 @@ if (!$disabled{asm}) {
 
 # Deal with bn_ops ###################################################
 
-$config{bn_ll}			=0;
-$config{export_var_as_fn}	=0;
+$config{bn_ll}                  =0;
 my $def_int="unsigned int";
-$config{rc4_int}		=$def_int;
+$config{rc4_int}                =$def_int;
 ($config{b64l},$config{b64},$config{b32})=(0,0,1);
 
 my $count = 0;
 foreach (sort split(/\s+/,$target{bn_ops})) {
     $count++ if /SIXTY_FOUR_BIT|SIXTY_FOUR_BIT_LONG|THIRTY_TWO_BIT/;
-    $config{export_var_as_fn}=1                 if $_ eq 'EXPORT_VAR_AS_FN';
-    $config{bn_ll}=1				if $_ eq 'BN_LLONG';
-    $config{rc4_int}="unsigned char"		if $_ eq 'RC4_CHAR';
+    $config{bn_ll}=1                            if $_ eq 'BN_LLONG';
+    $config{rc4_int}="unsigned char"            if $_ eq 'RC4_CHAR';
     ($config{b64l},$config{b64},$config{b32})
-	=(0,1,0)				if $_ eq 'SIXTY_FOUR_BIT';
+        =(0,1,0)                                if $_ eq 'SIXTY_FOUR_BIT';
     ($config{b64l},$config{b64},$config{b32})
-	=(1,0,0)				if $_ eq 'SIXTY_FOUR_BIT_LONG';
+        =(1,0,0)                                if $_ eq 'SIXTY_FOUR_BIT_LONG';
     ($config{b64l},$config{b64},$config{b32})
-	=(0,0,1)				if $_ eq 'THIRTY_TWO_BIT';
+        =(0,0,1)                                if $_ eq 'THIRTY_TWO_BIT';
 }
 die "Exactly one of SIXTY_FOUR_BIT|SIXTY_FOUR_BIT_LONG|THIRTY_TWO_BIT can be set in bn_ops\n"
     if $count > 1;
 
+$config{api} = $config{major} * 10000 + $config{minor} * 100
+    unless $config{api};
+foreach (keys %$apitable) {
+    $disabled{"deprecated-$_"} = "deprecation"
+        if $disabled{deprecated} && $config{api} >= $apitable->{$_};
+}
+
+disable();                      # Run a cascade now
 
 # Hack cflags for better warnings (dev option) #######################
 
@@ -1489,55 +1518,40 @@ $config{cflags} = [ map { (my $x = $_) =~ s/([\\\"])/\\$1/g; $x }
 $config{cxxflags} = [ map { (my $x = $_) =~ s/([\\\"])/\\$1/g; $x }
                           @{$config{cxxflags}} ] if $config{CXX};
 
-if (defined($config{api})) {
-    $config{openssl_api_defines} = [ "OPENSSL_MIN_API=".$apitable->{$config{api}} ];
-    my $apiflag = sprintf("OPENSSL_API_COMPAT=%s", $apitable->{$config{api}});
-    push @{$config{defines}}, $apiflag;
+$config{openssl_api_defines} = [
+    "OPENSSL_CONFIGURED_API=".$config{api},
+];
+
+my @strict_warnings_collection=();
+if ($strict_warnings)
+        {
+        my $wopt;
+        my $gccver = $predefined_C{__GNUC__} // -1;
+
+        if ($gccver >= 4)
+                {
+                push @strict_warnings_collection, @gcc_devteam_warn;
+                push @strict_warnings_collection, @clang_devteam_warn
+                    if (defined($predefined_C{__clang__}));
+                }
+        elsif ($config{target} =~ /^VC-/)
+                {
+                push @strict_warnings_collection, @cl_devteam_warn;
+                }
+        else
+                {
+                warn "WARNING --strict-warnings requires gcc[>=4] or gcc-alike, or MSVC"
+                }
+        }
+
+if (grep { $_ =~ /(?:^|\s)-static(?:\s|$)/ } @{$config{LDFLAGS}}) {
+    disable('static', 'pic', 'threads');
 }
 
-if ($strict_warnings)
-	{
-	my $wopt;
-	my $gccver = $predefined{__GNUC__} // -1;
-
-	die "ERROR --strict-warnings requires gcc[>=4] or gcc-alike"
-            unless $gccver >= 4;
-	foreach $wopt (split /\s+/, $gcc_devteam_warn)
-		{
-		push @{$config{cflags}}, $wopt
-			unless grep { $_ eq $wopt } @{$config{cflags}};
-		push @{$config{cxxflags}}, $wopt
-			if ($config{CXX}
-			    && !grep { $_ eq $wopt } @{$config{cxxflags}});
-		}
-	if (defined($predefined{__clang__}))
-		{
-		foreach $wopt (split /\s+/, $clang_devteam_warn)
-			{
-			push @{$config{cflags}}, $wopt
-				unless grep { $_ eq $wopt } @{$config{cflags}};
-			push @{$config{cxxflags}}, $wopt
-				if ($config{CXX}
-				    && !grep { $_ eq $wopt } @{$config{cxxflags}});
-			}
-		}
-	}
-
-unless ($disabled{"crypto-mdebug-backtrace"})
-	{
-	foreach my $wopt (split /\s+/, $memleak_devteam_backtrace)
-		{
-		push @{$config{cflags}}, $wopt
-			unless grep { $_ eq $wopt } @{$config{cflags}};
-		push @{$config{cxxflags}}, $wopt
-			if ($config{CXX}
-			    && !grep { $_ eq $wopt } @{$config{cxxflags}});
-		}
-	if ($target =~ /^BSD-/)
-		{
-		push @{$config{ex_libs}}, "-lexecinfo";
-		}
-	}
+$config{CFLAGS} = [ map { $_ eq '--ossl-strict-warnings'
+                              ? @strict_warnings_collection
+                              : ( $_ ) }
+                    @{$config{CFLAGS}} ];
 
 unless ($disabled{afalgeng}) {
     $config{afalgeng}="";
@@ -1549,42 +1563,158 @@ unless ($disabled{afalgeng}) {
             ($mi2) = $mi2 =~ /(\d+)/;
             my $ver = $ma*10000 + $mi1*100 + $mi2;
             if ($ver < $minver) {
-                $disabled{afalgeng} = "too-old-kernel";
+                disable('too-old-kernel', 'afalgeng');
             } else {
                 push @{$config{engdirs}}, "afalg";
             }
         } else {
-            $disabled{afalgeng} = "cross-compiling";
+            disable('cross-compiling', 'afalgeng');
         }
     } else {
-        $disabled{afalgeng}  = "not-linux";
+        disable('not-linux', 'afalgeng');
     }
 }
 
-push @{$config{openssl_other_defines}}, "OPENSSL_NO_AFALGENG" if ($disabled{afalgeng});
+unless ($disabled{devcryptoeng}) {
+    if ($target =~ m/^BSD/) {
+        my $maxver = 5*100 + 7;
+        my $sysstr = `uname -s`;
+        my $verstr = `uname -r`;
+        $sysstr =~ s|\R$||;
+        $verstr =~ s|\R$||;
+        my ($ma, $mi, @rest) = split m|\.|, $verstr;
+        my $ver = $ma*100 + $mi;
+        if ($sysstr eq 'OpenBSD' && $ver >= $maxver) {
+            disable('too-new-kernel', 'devcryptoeng');
+        }
+    }
+}
 
-# Finish up %config by appending things the user gave us on the command line
-# apart from "make variables"
-foreach (keys %useradd) {
-    # The must all be lists, so we assert that here
-    die "internal error: \$useradd{$_} isn't an ARRAY\n"
-        unless ref $useradd{$_} eq 'ARRAY';
+unless ($disabled{ktls}) {
+    $config{ktls}="";
+    if ($target =~ m/^linux/) {
+        my $usr = "/usr/$config{cross_compile_prefix}";
+        chop($usr);
+        if ($config{cross_compile_prefix} eq "") {
+            $usr = "/usr";
+        }
+        my $minver = (4 << 16) + (13 << 8) + 0;
+        my @verstr = split(" ",`cat $usr/include/linux/version.h | grep LINUX_VERSION_CODE`);
 
-    if (defined $config{$_}) {
-        push @{$config{$_}}, @{$useradd{$_}};
+        if ($verstr[2] < $minver) {
+            disable('too-old-kernel', 'ktls');
+        }
+    } elsif ($target =~ m/^BSD/) {
+        my $cc = $config{CROSS_COMPILE}.$config{CC};
+        system("printf '#include <sys/types.h>\n#include <sys/ktls.h>' | $cc -E - >/dev/null 2>&1");
+        if ($? != 0) {
+            disable('too-old-freebsd', 'ktls');
+        }
     } else {
-        $config{$_} = [ @{$useradd{$_}} ];
+        disable('not-linux-or-freebsd', 'ktls');
     }
 }
 
-# ALL MODIFICATIONS TO %config and %target MUST BE DONE FROM HERE ON
+push @{$config{openssl_other_defines}}, "OPENSSL_NO_KTLS" if ($disabled{ktls});
+
+# Get the extra flags used when building shared libraries and modules.  We
+# do this late because some of them depend on %disabled.
+
+# Make the flags to build DSOs the same as for shared libraries unless they
+# are already defined
+$target{module_cflags} = $target{shared_cflag} unless defined $target{module_cflags};
+$target{module_cxxflags} = $target{shared_cxxflag} unless defined $target{module_cxxflags};
+$target{module_ldflags} = $target{shared_ldflag} unless defined $target{module_ldflags};
+{
+    my $shared_info_pl =
+        catfile(dirname($0), "Configurations", "shared-info.pl");
+    my %shared_info = read_eval_file($shared_info_pl);
+    push @{$target{_conf_fname_int}}, $shared_info_pl;
+    my $si = $target{shared_target};
+    while (ref $si ne "HASH") {
+        last if ! defined $si;
+        if (ref $si eq "CODE") {
+            $si = $si->();
+        } else {
+            $si = $shared_info{$si};
+        }
+    }
+
+    # Some of the 'shared_target' values don't have any entries in
+    # %shared_info.  That's perfectly fine, AS LONG AS the build file
+    # template knows how to handle this.  That is currently the case for
+    # Windows and VMS.
+    if (defined $si) {
+        # Just as above, copy certain shared_* attributes to the corresponding
+        # module_ attribute unless the latter is already defined
+        $si->{module_cflags} = $si->{shared_cflag} unless defined $si->{module_cflags};
+        $si->{module_cxxflags} = $si->{shared_cxxflag} unless defined $si->{module_cxxflags};
+        $si->{module_ldflags} = $si->{shared_ldflag} unless defined $si->{module_ldflags};
+        foreach (sort keys %$si) {
+            $target{$_} = defined $target{$_}
+                ? add($si->{$_})->($target{$_})
+                : $si->{$_};
+        }
+    }
+}
+
+# ALL MODIFICATIONS TO %disabled, %config and %target MUST BE DONE FROM HERE ON
+
+######################################################################
+# Build up information for skipping certain directories depending on disabled
+# features, as well as setting up macros for disabled features.
+
+# This is a tentative database of directories to skip.  Some entries may not
+# correspond to anything real, but that's ok, they will simply be ignored.
+# The actual processing of these entries is done in the build.info lookup
+# loop further down.
+#
+# The key is a Unix formatted path in the source tree, the value is an index
+# into %disabled_info, so any existing path gets added to a corresponding
+# 'skipped' entry in there with the list of skipped directories.
+my %skipdir = ();
+my %disabled_info = ();         # For configdata.pm
+foreach my $what (sort keys %disabled) {
+    # There are deprecated disablables that translate to themselves.
+    # They cause disabling cascades, but should otherwise not regiter.
+    next if $deprecated_disablables{$what};
+    # The generated $disabled{"deprecated-x.y"} entries are special
+    # and treated properly elsewhere
+    next if $what =~ m|^deprecated-|;
+
+    $config{options} .= " no-$what";
+
+    if (!grep { $what eq $_ } ( 'buildtest-c++', 'fips', 'threads', 'shared',
+                                'module', 'pic', 'dynamic-engine', 'makedepend',
+                                'zlib-dynamic', 'zlib', 'sse2', 'legacy' )) {
+        (my $WHAT = uc $what) =~ s|-|_|g;
+        my $skipdir = $what;
+
+        # fix-up crypto/directory name(s)
+        $skipdir = "ripemd" if $what eq "rmd160";
+        $skipdir = "whrlpool" if $what eq "whirlpool";
+
+        my $macro = $disabled_info{$what}->{macro} = "OPENSSL_NO_$WHAT";
+        push @{$config{openssl_feature_defines}}, $macro;
+
+        $skipdir{engines} = $what if $what eq 'engine';
+        $skipdir{"crypto/$skipdir"} = $what
+            unless $what eq 'async' || $what eq 'err' || $what eq 'dso';
+    }
+}
+
+if ($disabled{"dynamic-engine"}) {
+    push @{$config{openssl_feature_defines}}, "OPENSSL_NO_DYNAMIC_ENGINE";
+} else {
+    push @{$config{openssl_feature_defines}}, "OPENSSL_NO_STATIC_ENGINE";
+}
 
 # If we use the unified build, collect information from build.info files
 my %unified_info = ();
 
 my $buildinfo_debug = defined($ENV{CONFIGURE_DEBUG_BUILDINFO});
 if ($builder eq "unified") {
-    use with_fallback qw(Text::Template);
+    use Text::Template 1.46;
 
     sub cleandir {
         my $base = shift;
@@ -1622,38 +1752,38 @@ if ($builder eq "unified") {
     # Store the name of the template file we will build the build file from
     # in %config.  This may be useful for the build file itself.
     my @build_file_template_names =
-	( $builder_platform."-".$target{build_file}.".tmpl",
-	  $target{build_file}.".tmpl" );
+        ( $builder_platform."-".$target{build_file}.".tmpl",
+          $target{build_file}.".tmpl" );
     my @build_file_templates = ();
 
     # First, look in the user provided directory, if given
     if (defined env($local_config_envname)) {
-	@build_file_templates =
-	    map {
-		if ($^O eq 'VMS') {
-		    # VMS environment variables are logical names,
-		    # which can be used as is
-		    $local_config_envname . ':' . $_;
-		} else {
-		    catfile(env($local_config_envname), $_);
-		}
-	    }
-	    @build_file_template_names;
+        @build_file_templates =
+            map {
+                if ($^O eq 'VMS') {
+                    # VMS environment variables are logical names,
+                    # which can be used as is
+                    $local_config_envname . ':' . $_;
+                } else {
+                    catfile(env($local_config_envname), $_);
+                }
+            }
+            @build_file_template_names;
     }
     # Then, look in our standard directory
     push @build_file_templates,
-	( map { cleanfile($srcdir, catfile("Configurations", $_), $blddir) }
-	  @build_file_template_names );
+        ( map { cleanfile($srcdir, catfile("Configurations", $_), $blddir) }
+          @build_file_template_names );
 
     my $build_file_template;
     for $_ (@build_file_templates) {
-	$build_file_template = $_;
+        $build_file_template = $_;
         last if -f $build_file_template;
 
         $build_file_template = undef;
     }
     if (!defined $build_file_template) {
-	die "*** Couldn't find any of:\n", join("\n", @build_file_templates), "\n";
+        die "*** Couldn't find any of:\n", join("\n", @build_file_templates), "\n";
     }
     $config{build_file_templates}
       = [ cleanfile($srcdir, catfile("Configurations", "common0.tmpl"),
@@ -1662,60 +1792,165 @@ if ($builder eq "unified") {
           cleanfile($srcdir, catfile("Configurations", "common.tmpl"),
                     $blddir) ];
 
-    my @build_infos = ( [ ".", "build.info" ] );
-    foreach (@{$config{dirs}}) {
-        push @build_infos, [ $_, "build.info" ]
-            if (-f catfile($srcdir, $_, "build.info"));
-    }
-    foreach (@{$config{sdirs}}) {
-        push @build_infos, [ catdir("crypto", $_), "build.info" ]
-            if (-f catfile($srcdir, "crypto", $_, "build.info"));
-    }
-    foreach (@{$config{engdirs}}) {
-        push @build_infos, [ catdir("engines", $_), "build.info" ]
-            if (-f catfile($srcdir, "engines", $_, "build.info"));
-    }
-    foreach (@{$config{tdirs}}) {
-        push @build_infos, [ catdir("test", $_), "build.info" ]
-            if (-f catfile($srcdir, "test", $_, "build.info"));
-    }
+    my @build_dirs = ( [ ] );   # current directory
 
     $config{build_infos} = [ ];
 
     my %ordinals = ();
-    foreach (@build_infos) {
-        my $sourced = catdir($srcdir, $_->[0]);
-        my $buildd = catdir($blddir, $_->[0]);
+    while (@build_dirs) {
+        my @curd = @{shift @build_dirs};
+        my $sourced = catdir($srcdir, @curd);
+        my $buildd = catdir($blddir, @curd);
+
+        my $unixdir = join('/', @curd);
+        if (exists $skipdir{$unixdir}) {
+            my $what = $skipdir{$unixdir};
+            push @{$disabled_info{$what}->{skipped}}, catdir(@curd);
+            next;
+        }
 
         mkpath($buildd);
 
-        my $f = $_->[1];
+        my $f = 'build.info';
         # The basic things we're trying to build
         my @programs = ();
-        my @programs_install = ();
         my @libraries = ();
-        my @libraries_install = ();
-        my @engines = ();
-        my @engines_install = ();
+        my @modules = ();
         my @scripts = ();
-        my @scripts_install = ();
-        my @extra = ();
-        my @overrides = ();
-        my @intermediates = ();
-        my @rawlines = ();
 
         my %sources = ();
         my %shared_sources = ();
         my %includes = ();
+        my %defines = ();
         my %depends = ();
-        my %renames = ();
-        my %sharednames = ();
         my %generate = ();
+        my %htmldocs = ();
+        my %mandocs = ();
+
+        # Support for $variablename in build.info files.
+        # Embedded perl code is the ultimate master, still.  If its output
+        # contains a dollar sign, it had better be escaped, or it will be
+        # taken for a variable name prefix.
+        my %variables = ();
+        # Variable name syntax
+        my $variable_name_re = qr/(?P<VARIABLE>[[:alpha:]][[:alnum:]_]*)/;
+        # Value modifier syntaxes
+        my $variable_subst_re = qr/\/(?P<RE>(?:\\\/|.)*?)\/(?P<SUBST>.*?)/;
+        # Variable reference
+        my $variable_simple_re = qr/(?<!\\)\$${variable_name_re}/;
+        my $variable_w_mod_re =
+            qr/(?<!\\)\$\{${variable_name_re}(?P<MOD>(?:\\\/|.)*?)\}/;
+        # Tie it all together
+        my $variable_re = qr/${variable_simple_re}|${variable_w_mod_re}/;
+
+        my $expand_variables = sub {
+            my $value = '';
+            my $value_rest = shift;
+
+            if ($ENV{CONFIGURE_DEBUG_VARIABLE_EXPAND}) {
+                print STDERR
+                    "DEBUG[\$expand_variables] Parsed '$value_rest' ...\n"
+            }
+
+            while ($value_rest =~ /${variable_re}/) {
+                # We must save important regexp values, because the next
+                # regexp clears them
+                my $mod = $+{MOD};
+                my $variable_value = $variables{$+{VARIABLE}};
+
+                $value_rest = $';
+                $value .= $`;
+
+                # Process modifier expressions, if present
+                if (defined $mod) {
+                    if ($mod =~ /^${variable_subst_re}$/) {
+                        my $re = $+{RE};
+                        my $subst = $+{SUBST};
+
+                        $variable_value =~ s/\Q$re\E/$subst/g;
+
+                        if ($ENV{CONFIGURE_DEBUG_VARIABLE_EXPAND}) {
+                            print STDERR
+                                "DEBUG[\$expand_variables] ... and substituted ",
+                                "'$re' with '$subst'\n";
+                        }
+                    }
+                }
+
+                $value .= $variable_value;
+            }
+            if ($ENV{CONFIGURE_DEBUG_VARIABLE_EXPAND}) {
+                print STDERR
+                    "DEBUG[\$expand_variables] ... into: '$value$value_rest'\n";
+            }
+            return $value . $value_rest;
+        };
+
+        # Support for attributes in build.info files
+        my %attributes = ();
+        my $handle_attributes = sub {
+            my $attr_str = shift;
+            my $ref = shift;
+            my @goals = @_;
+
+            return unless defined $attr_str;
+
+            my @a = tokenize($attr_str, qr|\s*,\s*|);
+            foreach my $a (@a) {
+                my $ac = 1;
+                my $ak = $a;
+                my $av = 1;
+                if ($a =~ m|^(!)?(.*?)\s* = \s*(.*?)$|) {
+                    $ac = ! $1;
+                    $ak = $1;
+                    $av = $2;
+                }
+                foreach my $g (@goals) {
+                    if ($ac) {
+                        $$ref->{$g}->{$ak} = $av;
+                    } else {
+                        delete $$ref->{$g}->{$ak};
+                    }
+                }
+            }
+        };
+
+        # Support for pushing values on multiple indexes of a given hash
+        # array.
+        my $push_to = sub {
+            my $valueref = shift;
+            my $index_str = shift; # May be undef or empty
+            my $attrref = shift;   # May be undef
+            my $attr_str = shift;
+            my @values = @_;
+
+            if (defined $index_str) {
+                my @indexes = ( '' );
+                if ($index_str !~ m|^\s*$|) {
+                    @indexes = tokenize($index_str);
+                }
+                foreach (@indexes) {
+                    push @{$valueref->{$_}}, @values;
+                    if (defined $attrref) {
+                        $handle_attributes->($attr_str, \$$attrref->{$_},
+                                             @values);
+                    }
+                }
+            } else {
+                push @$valueref, @values;
+                $handle_attributes->($attr_str, $attrref, @values)
+                    if defined $attrref;
+            }
+        };
 
         # We want to detect configdata.pm in the source tree, so we
         # don't use it if the build tree is different.
         my $src_configdata = cleanfile($srcdir, "configdata.pm", $blddir);
 
+
+        if ($buildinfo_debug) {
+            print STDERR "DEBUG: Reading ",catfile($sourced, $f),"\n";
+        }
         push @{$config{build_infos}}, catfile(abs2rel($sourced, $blddir), $f);
         my $template =
             Text::Template->new(TYPE => 'FILE',
@@ -1741,117 +1976,112 @@ if ($builder eq "unified") {
         # 1 last was positive (don't skip lines until next ELSE, ELSIF or ENDIF)
         # 2 positive ELSE (following ELSIF should fail)
         my @skip = ();
+
+        # A few useful generic regexps
+        my $index_re = qr/\[\s*(?P<INDEX>(?:\\.|.)*?)\s*\]/;
+        my $cond_re = qr/\[\s*(?P<COND>(?:\\.|.)*?)\s*\]/;
+        my $attribs_re = qr/(?:\{\s*(?P<ATTRIBS>(?:\\.|.)*?)\s*\})?/;
+        my $value_re = qr/\s*(?P<VALUE>.*?)\s*/;
         collect_information(
             collect_from_array([ @text ],
                                qr/\\$/ => sub { my $l1 = shift; my $l2 = shift;
                                                 $l1 =~ s/\\$//; $l1.$l2 }),
             # Info we're looking for
-            qr/^\s*IF\[((?:\\.|[^\\\]])*)\]\s*$/
+            qr/^\s* IF ${cond_re} \s*$/x
             => sub {
                 if (! @skip || $skip[$#skip] > 0) {
-                    push @skip, !! $1;
+                    push @skip, !! $expand_variables->($+{COND});
                 } else {
                     push @skip, -1;
                 }
             },
-            qr/^\s*ELSIF\[((?:\\.|[^\\\]])*)\]\s*$/
+            qr/^\s* ELSIF ${cond_re} \s*$/x
             => sub { die "ELSIF out of scope" if ! @skip;
                      die "ELSIF following ELSE" if abs($skip[$#skip]) == 2;
                      $skip[$#skip] = -1 if $skip[$#skip] != 0;
-                     $skip[$#skip] = !! $1
+                     $skip[$#skip] = !! $expand_variables->($+{COND})
                          if $skip[$#skip] == 0; },
-            qr/^\s*ELSE\s*$/
+            qr/^\s* ELSE \s*$/x
             => sub { die "ELSE out of scope" if ! @skip;
                      $skip[$#skip] = -2 if $skip[$#skip] != 0;
                      $skip[$#skip] = 2 if $skip[$#skip] == 0; },
-            qr/^\s*ENDIF\s*$/
+            qr/^\s* ENDIF \s*$/x
             => sub { die "ENDIF out of scope" if ! @skip;
                      pop @skip; },
-            qr/^\s*PROGRAMS(_NO_INST)?\s*=\s*(.*)\s*$/
+            qr/^\s* ${variable_re} \s* = ${value_re} $/x
             => sub {
                 if (!@skip || $skip[$#skip] > 0) {
-                    my $install = $1;
-                    my @x = tokenize($2);
-                    push @programs, @x;
-                    push @programs_install, @x unless $install;
+                    $variables{$+{VARIABLE}} = $expand_variables->($+{VALUE});
                 }
             },
-            qr/^\s*LIBS(_NO_INST)?\s*=\s*(.*)\s*$/
+            qr/^\s* SUBDIRS \s* = ${value_re} $/x
             => sub {
                 if (!@skip || $skip[$#skip] > 0) {
-                    my $install = $1;
-                    my @x = tokenize($2);
-                    push @libraries, @x;
-                    push @libraries_install, @x unless $install;
-                }
-            },
-            qr/^\s*ENGINES(_NO_INST)?\s*=\s*(.*)\s*$/
-            => sub {
-                if (!@skip || $skip[$#skip] > 0) {
-                    my $install = $1;
-                    my @x = tokenize($2);
-                    push @engines, @x;
-                    push @engines_install, @x unless $install;
-                }
-            },
-            qr/^\s*SCRIPTS(_NO_INST)?\s*=\s*(.*)\s*$/
-            => sub {
-                if (!@skip || $skip[$#skip] > 0) {
-                    my $install = $1;
-                    my @x = tokenize($2);
-                    push @scripts, @x;
-                    push @scripts_install, @x unless $install;
-                }
-            },
-            qr/^\s*EXTRA\s*=\s*(.*)\s*$/
-            => sub { push @extra, tokenize($1)
-                         if !@skip || $skip[$#skip] > 0 },
-            qr/^\s*OVERRIDES\s*=\s*(.*)\s*$/
-            => sub { push @overrides, tokenize($1)
-                         if !@skip || $skip[$#skip] > 0 },
-
-            qr/^\s*ORDINALS\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/,
-            => sub { push @{$ordinals{$1}}, tokenize($2)
-                         if !@skip || $skip[$#skip] > 0 },
-            qr/^\s*SOURCE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
-            => sub { push @{$sources{$1}}, tokenize($2)
-                         if !@skip || $skip[$#skip] > 0 },
-            qr/^\s*SHARED_SOURCE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
-            => sub { push @{$shared_sources{$1}}, tokenize($2)
-                         if !@skip || $skip[$#skip] > 0 },
-            qr/^\s*INCLUDE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
-            => sub { push @{$includes{$1}}, tokenize($2)
-                         if !@skip || $skip[$#skip] > 0 },
-            qr/^\s*DEPEND\[((?:\\.|[^\\\]])*)\]\s*=\s*(.*)\s*$/
-            => sub { push @{$depends{$1}}, tokenize($2)
-                         if !@skip || $skip[$#skip] > 0 },
-            qr/^\s*GENERATE\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
-            => sub { push @{$generate{$1}}, $2
-                         if !@skip || $skip[$#skip] > 0 },
-            qr/^\s*RENAME\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
-            => sub { push @{$renames{$1}}, tokenize($2)
-                         if !@skip || $skip[$#skip] > 0 },
-            qr/^\s*SHARED_NAME\[((?:\\.|[^\\\]])+)\]\s*=\s*(.*)\s*$/
-            => sub { push @{$sharednames{$1}}, tokenize($2)
-                         if !@skip || $skip[$#skip] > 0 },
-            qr/^\s*BEGINRAW\[((?:\\.|[^\\\]])+)\]\s*$/
-            => sub {
-                my $lineiterator = shift;
-                my $target_kind = $1;
-                while (defined $lineiterator->()) {
-                    s|\R$||;
-                    if (/^\s*ENDRAW\[((?:\\.|[^\\\]])+)\]\s*$/) {
-                        die "ENDRAW doesn't match BEGINRAW"
-                            if $1 ne $target_kind;
-                        last;
+                    foreach (tokenize($expand_variables->($+{VALUE}))) {
+                        push @build_dirs, [ @curd, splitdir($_, 1) ];
                     }
-                    next if @skip && $skip[$#skip] <= 0;
-                    push @rawlines,  $_
-                        if ($target_kind eq $target{build_file}
-                            || $target_kind eq $target{build_file}."(".$builder_platform.")");
                 }
             },
-            qr/^\s*(?:#.*)?$/ => sub { },
+            qr/^\s* PROGRAMS ${attribs_re} \s* =  ${value_re} $/x
+            => sub { $push_to->(\@programs, undef,
+                                \$attributes{programs}, $+{ATTRIBS},
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* LIBS ${attribs_re} \s* =  ${value_re} $/x
+            => sub { $push_to->(\@libraries, undef,
+                                \$attributes{libraries}, $+{ATTRIBS},
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* MODULES ${attribs_re} \s* =  ${value_re} $/x
+            => sub { $push_to->(\@modules, undef,
+                                \$attributes{modules}, $+{ATTRIBS},
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* SCRIPTS ${attribs_re} \s* =  ${value_re} $/x
+            => sub { $push_to->(\@scripts, undef,
+                                \$attributes{scripts}, $+{ATTRIBS},
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* HTMLDOCS ${index_re} = ${value_re} $/x
+            => sub { $push_to->(\%htmldocs, $expand_variables->($+{INDEX}),
+                                undef, undef,
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* MANDOCS ${index_re} = ${value_re} $/x
+            => sub { $push_to->(\%mandocs, $expand_variables->($+{INDEX}),
+                                undef, undef,
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* SOURCE ${index_re} = ${value_re} $/x
+            => sub { $push_to->(\%sources, $expand_variables->($+{INDEX}),
+                                undef, undef,
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* SHARED_SOURCE ${index_re} = ${value_re} $/x
+            => sub { $push_to->(\%shared_sources, $expand_variables->($+{INDEX}),
+                                undef, undef,
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* INCLUDE ${index_re} = ${value_re} $/x
+            => sub { $push_to->(\%includes, $expand_variables->($+{INDEX}),
+                                undef, undef,
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* DEFINE ${index_re} = ${value_re} $/x
+            => sub { $push_to->(\%defines, $expand_variables->($+{INDEX}),
+                                undef, undef,
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* DEPEND ${index_re} ${attribs_re} = ${value_re} $/x
+            => sub { $push_to->(\%depends, $expand_variables->($+{INDEX}),
+                                \$attributes{depends}, $+{ATTRIBS},
+                                tokenize($expand_variables->($+{VALUE})))
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* GENERATE ${index_re} = ${value_re} $/x
+            => sub { $push_to->(\%generate, $expand_variables->($+{INDEX}),
+                                undef, undef, $+{VALUE})
+                         if !@skip || $skip[$#skip] > 0; },
+            qr/^\s* (?:\#.*)? $/x => sub { },
             "OTHERWISE" => sub { die "Something wrong with this line:\n$_\nat $sourced/$f" },
             "BEFORE" => sub {
                 if ($buildinfo_debug) {
@@ -1867,152 +2097,52 @@ if ($builder eq "unified") {
             );
         die "runaway IF?" if (@skip);
 
-        foreach (keys %renames) {
-            die "$_ renamed to more than one thing: "
-                ,join(" ", @{$renames{$_}}),"\n"
-                if scalar @{$renames{$_}} > 1;
-            my $dest = cleanfile($buildd, $_, $blddir);
-            my $to = cleanfile($buildd, $renames{$_}->[0], $blddir);
-            die "$dest renamed to more than one thing: "
-                ,$unified_info{rename}->{$dest}, $to
-                unless !defined($unified_info{rename}->{$dest})
-                or $unified_info{rename}->{$dest} eq $to;
-            $unified_info{rename}->{$dest} = $to;
-        }
-
-        foreach (@programs) {
-            my $program = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$program}) {
-                $program = $unified_info{rename}->{$program};
-            }
-            $unified_info{programs}->{$program} = 1;
-        }
-
-        foreach (@programs_install) {
-            my $program = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$program}) {
-                $program = $unified_info{rename}->{$program};
-            }
-            $unified_info{install}->{programs}->{$program} = 1;
-        }
-
-        foreach (@libraries) {
-            my $library = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$library}) {
-                $library = $unified_info{rename}->{$library};
-            }
-            $unified_info{libraries}->{$library} = 1;
-        }
-
-        foreach (@libraries_install) {
-            my $library = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$library}) {
-                $library = $unified_info{rename}->{$library};
-            }
-            $unified_info{install}->{libraries}->{$library} = 1;
-        }
-
-        die <<"EOF" if scalar @engines and !$config{dynamic_engines};
+        if (grep { defined $attributes{modules}->{$_}->{engine} } keys %attributes
+                and !$config{dynamic_engines}) {
+            die <<"EOF"
 ENGINES can only be used if configured with 'dynamic-engine'.
 This is usually a fault in a build.info file.
 EOF
-        foreach (@engines) {
-            my $library = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$library}) {
-                $library = $unified_info{rename}->{$library};
-            }
-            $unified_info{engines}->{$library} = 1;
         }
 
-        foreach (@engines_install) {
-            my $library = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$library}) {
-                $library = $unified_info{rename}->{$library};
-            }
-            $unified_info{install}->{engines}->{$library} = 1;
-        }
+        {
+            my %infos = ( programs  => [ @programs  ],
+                          libraries => [ @libraries ],
+                          modules   => [ @modules   ],
+                          scripts   => [ @scripts   ] );
+            foreach my $k (keys %infos) {
+                foreach (@{$infos{$k}}) {
+                    my $item = cleanfile($buildd, $_, $blddir);
+                    $unified_info{$k}->{$item} = 1;
 
-        foreach (@scripts) {
-            my $script = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$script}) {
-                $script = $unified_info{rename}->{$script};
-            }
-            $unified_info{scripts}->{$script} = 1;
-        }
-
-        foreach (@scripts_install) {
-            my $script = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$script}) {
-                $script = $unified_info{rename}->{$script};
-            }
-            $unified_info{install}->{scripts}->{$script} = 1;
-        }
-
-        foreach (@extra) {
-            my $extra = cleanfile($buildd, $_, $blddir);
-            $unified_info{extra}->{$extra} = 1;
-        }
-
-        foreach (@overrides) {
-            my $override = cleanfile($buildd, $_, $blddir);
-            $unified_info{overrides}->{$override} = 1;
-        }
-
-        push @{$unified_info{rawlines}}, @rawlines;
-
-        unless ($disabled{shared}) {
-            # Check sharednames.
-            foreach (keys %sharednames) {
-                my $dest = cleanfile($buildd, $_, $blddir);
-                if ($unified_info{rename}->{$dest}) {
-                    $dest = $unified_info{rename}->{$dest};
-                }
-                die "shared_name for $dest with multiple values: "
-                    ,join(" ", @{$sharednames{$_}}),"\n"
-                    if scalar @{$sharednames{$_}} > 1;
-                my $to = cleanfile($buildd, $sharednames{$_}->[0], $blddir);
-                die "shared_name found for a library $dest that isn't defined\n"
-                    unless $unified_info{libraries}->{$dest};
-                die "shared_name for $dest with multiple values: "
-                    ,$unified_info{sharednames}->{$dest}, ", ", $to
-                    unless !defined($unified_info{sharednames}->{$dest})
-                    or $unified_info{sharednames}->{$dest} eq $to;
-                $unified_info{sharednames}->{$dest} = $to;
-            }
-
-            # Additionally, we set up sharednames for libraries that don't
-            # have any, as themselves.  Only for libraries that aren't
-            # explicitly static.
-            foreach (grep !/\.a$/, keys %{$unified_info{libraries}}) {
-                if (!defined $unified_info{sharednames}->{$_}) {
-                    $unified_info{sharednames}->{$_} = $_
+                    # Fix up associated attributes
+                    $unified_info{attributes}->{$k}->{$item} =
+                        $attributes{$k}->{$_}
+                        if defined $attributes{$k}->{$_};
                 }
             }
-
-            # Check that we haven't defined any library as both shared and
-            # explicitly static.  That is forbidden.
-            my @doubles = ();
-            foreach (grep /\.a$/, keys %{$unified_info{libraries}}) {
-                (my $l = $_) =~ s/\.a$//;
-                push @doubles, $l if defined $unified_info{sharednames}->{$l};
-            }
-            die "these libraries are both explicitly static and shared:\n  ",
-                join(" ", @doubles), "\n"
-                if @doubles;
         }
 
+        # Check that we haven't defined any library as both shared and
+        # explicitly static.  That is forbidden.
+        my @doubles = ();
+        foreach (grep /\.a$/, keys %{$unified_info{libraries}}) {
+            (my $l = $_) =~ s/\.a$//;
+            push @doubles, $l if defined $unified_info{libraries}->{$l};
+        }
+        die "these libraries are both explicitly static and shared:\n  ",
+            join(" ", @doubles), "\n"
+            if @doubles;
+
         foreach (keys %sources) {
             my $dest = $_;
             my $ddest = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$ddest}) {
-                $ddest = $unified_info{rename}->{$ddest};
-            }
             foreach (@{$sources{$dest}}) {
                 my $s = cleanfile($sourced, $_, $blddir);
 
-                # If it isn't in the source tree, we assume it's generated
-                # in the build tree
-                if ($s eq $src_configdata || ! -f $s || $generate{$_}) {
+                # If it's generated or we simply don't find it in the source
+                # tree, we assume it's in the build tree.
+                if ($s eq $src_configdata || $generate{$_} || ! -f $s) {
                     $s = cleanfile($buildd, $_, $blddir);
                 }
                 # We recognise C++, C and asm files
@@ -2021,15 +2151,15 @@ EOF
                     $o =~ s/\.[csS]$/.o/; # C and assembler
                     $o =~ s/\.(cc|cpp)$/_cc.o/; # C++
                     $o = cleanfile($buildd, $o, $blddir);
-                    $unified_info{sources}->{$ddest}->{$o} = 1;
-                    $unified_info{sources}->{$o}->{$s} = 1;
+                    $unified_info{sources}->{$ddest}->{$o} = -1;
+                    $unified_info{sources}->{$o}->{$s} = -1;
                 } elsif ($s =~ /\.rc$/) {
                     # We also recognise resource files
                     my $o = $_;
                     $o =~ s/\.rc$/.res/; # Resource configuration
                     my $o = cleanfile($buildd, $o, $blddir);
-                    $unified_info{sources}->{$ddest}->{$o} = 1;
-                    $unified_info{sources}->{$o}->{$s} = 1;
+                    $unified_info{sources}->{$ddest}->{$o} = -1;
+                    $unified_info{sources}->{$o}->{$s} = -1;
                 } else {
                     $unified_info{sources}->{$ddest}->{$s} = 1;
                 }
@@ -2039,15 +2169,12 @@ EOF
         foreach (keys %shared_sources) {
             my $dest = $_;
             my $ddest = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$ddest}) {
-                $ddest = $unified_info{rename}->{$ddest};
-            }
             foreach (@{$shared_sources{$dest}}) {
                 my $s = cleanfile($sourced, $_, $blddir);
 
-                # If it isn't in the source tree, we assume it's generated
-                # in the build tree
-                if ($s eq $src_configdata || ! -f $s || $generate{$_}) {
+                # If it's generated or we simply don't find it in the source
+                # tree, we assume it's in the build tree.
+                if ($s eq $src_configdata || $generate{$_} || ! -f $s) {
                     $s = cleanfile($buildd, $_, $blddir);
                 }
 
@@ -2057,20 +2184,20 @@ EOF
                     $o =~ s/\.[csS]$/.o/; # C and assembler
                     $o =~ s/\.(cc|cpp)$/_cc.o/; # C++
                     $o = cleanfile($buildd, $o, $blddir);
-                    $unified_info{shared_sources}->{$ddest}->{$o} = 1;
-                    $unified_info{sources}->{$o}->{$s} = 1;
+                    $unified_info{shared_sources}->{$ddest}->{$o} = -1;
+                    $unified_info{sources}->{$o}->{$s} = -1;
                 } elsif ($s =~ /\.rc$/) {
                     # We also recognise resource files
                     my $o = $_;
                     $o =~ s/\.rc$/.res/; # Resource configuration
                     my $o = cleanfile($buildd, $o, $blddir);
-                    $unified_info{shared_sources}->{$ddest}->{$o} = 1;
-                    $unified_info{sources}->{$o}->{$s} = 1;
-                } elsif ($s =~ /\.(def|map|opt)$/) {
-                    # We also recognise .def / .map / .opt files
+                    $unified_info{shared_sources}->{$ddest}->{$o} = -1;
+                    $unified_info{sources}->{$o}->{$s} = -1;
+                } elsif ($s =~ /\.ld$/) {
+                    # We also recognise linker scripts (or corresponding)
                     # We know they are generated files
-                    my $def = cleanfile($buildd, $s, $blddir);
-                    $unified_info{shared_sources}->{$ddest}->{$def} = 1;
+                    my $ld = cleanfile($buildd, $_, $blddir);
+                    $unified_info{shared_sources}->{$ddest}->{$ld} = 1;
                 } else {
                     die "unrecognised source file type for shared library: $s\n";
                 }
@@ -2080,14 +2207,18 @@ EOF
         foreach (keys %generate) {
             my $dest = $_;
             my $ddest = cleanfile($buildd, $_, $blddir);
-            if ($unified_info{rename}->{$ddest}) {
-                $ddest = $unified_info{rename}->{$ddest};
-            }
             die "more than one generator for $dest: "
-                    ,join(" ", @{$generate{$_}}),"\n"
-                    if scalar @{$generate{$_}} > 1;
+                ,join(" ", @{$generate{$_}}),"\n"
+                if scalar @{$generate{$_}} > 1;
             my @generator = split /\s+/, $generate{$dest}->[0];
-            $generator[0] = cleanfile($sourced, $generator[0], $blddir),
+            my $gen = $generator[0];
+            $generator[0] = cleanfile($sourced, $gen, $blddir);
+
+            # If the generator is itself generated, it's in the build tree
+            if ($generate{$gen}) {
+                $generator[0] = cleanfile($buildd, $gen, $blddir);
+            }
+
             $unified_info{generate}->{$ddest} = [ @generator ];
         }
 
@@ -2099,37 +2230,26 @@ EOF
             # a generated file in the build tree.
             if ($ddest ne "" && ($ddest eq $src_configdata || ! -f $ddest)) {
                 $ddest = cleanfile($buildd, $_, $blddir);
-                if ($unified_info{rename}->{$ddest}) {
-                    $ddest = $unified_info{rename}->{$ddest};
-                }
             }
             foreach (@{$depends{$dest}}) {
                 my $d = cleanfile($sourced, $_, $blddir);
 
                 # If we know it's generated, or assume it is because we can't
                 # find it in the source tree, we set file we depend on to be
-                # in the build tree rather than the source tree, and assume
-                # and that there are lines to build it in a BEGINRAW..ENDRAW
-                # section or in the Makefile template.
+                # in the build tree rather than the source tree.
                 if ($d eq $src_configdata
-                    || ! -f $d
                     || (grep { $d eq $_ }
                         map { cleanfile($srcdir, $_, $blddir) }
-                        grep { /\.h$/ } keys %{$unified_info{generate}})) {
+                        grep { /\.h$/ } keys %{$unified_info{generate}})
+                    || ! -f $d) {
                     $d = cleanfile($buildd, $_, $blddir);
                 }
-                # Take note if the file to depend on is being renamed
-                # Take extra care with files ending with .a, they should
-                # be treated without that extension, and the extension
-                # should be added back after treatment.
-                $d =~ /(\.a)?$/;
-                my $e = $1 // "";
-                $d = $`;
-                if ($unified_info{rename}->{$d}) {
-                    $d = $unified_info{rename}->{$d};
-                }
-                $d .= $e;
                 $unified_info{depends}->{$ddest}->{$d} = 1;
+
+                # Fix up associated attributes
+                $unified_info{attributes}->{depends}->{$ddest}->{$d} =
+                    $attributes{depends}->{$dest}->{$_}
+                    if defined $attributes{depends}->{$dest}->{$_};
             }
         }
 
@@ -2141,9 +2261,6 @@ EOF
             # a generated file in the build tree.
             if ($ddest eq $src_configdata || ! -f $ddest) {
                 $ddest = cleanfile($buildd, $_, $blddir);
-                if ($unified_info{rename}->{$ddest}) {
-                    $ddest = $unified_info{rename}->{$ddest};
-                }
             }
             foreach (@{$includes{$dest}}) {
                 my $is = cleandir($sourced, $_, $blddir);
@@ -2154,6 +2271,47 @@ EOF
                     unless grep { $_ eq $ib } @{$unified_info{includes}->{$ddest}->{build}};
             }
         }
+
+        foreach my $dest (keys %defines) {
+            my $ddest;
+
+            if ($dest ne "") {
+                $ddest = cleanfile($sourced, $dest, $blddir);
+
+                # If the destination doesn't exist in source, it can only
+                # be a generated file in the build tree.
+                if (! -f $ddest) {
+                    $ddest = cleanfile($buildd, $dest, $blddir);
+                }
+            }
+            foreach my $v (@{$defines{$dest}}) {
+                $v =~ m|^([^=]*)(=.*)?$|;
+                die "0 length macro name not permitted\n" if $1 eq "";
+                if ($dest ne "") {
+                    die "$1 defined more than once\n"
+                        if defined $unified_info{defines}->{$ddest}->{$1};
+                    $unified_info{defines}->{$ddest}->{$1} = $2;
+                } else {
+                    die "$1 defined more than once\n"
+                        if grep { $v eq $_ } @{$config{defines}};
+                    push @{$config{defines}}, $v;
+                }
+            }
+        }
+
+        foreach my $section (keys %htmldocs) {
+            foreach (@{$htmldocs{$section}}) {
+                my $htmldocs = cleanfile($buildd, $_, $blddir);
+                $unified_info{htmldocs}->{$section}->{$htmldocs} = 1;
+            }
+        }
+
+        foreach my $section (keys %mandocs) {
+            foreach (@{$mandocs{$section}}) {
+                my $mandocs = cleanfile($buildd, $_, $blddir);
+                $unified_info{mandocs}->{$section}->{$mandocs} = 1;
+            }
+        }
     }
 
     my $ordinals_text = join(', ', sort keys %ordinals);
@@ -2164,6 +2322,34 @@ They are ignored and should be replaced with a combination of GENERATE,
 DEPEND and SHARED_SOURCE.
 EOF
 
+
+    # Go through the sources of all libraries and check that the same basename
+    # doesn't appear more than once.  Some static library archivers depend on
+    # them being unique.
+    {
+        my $err = 0;
+        foreach my $prod (keys %{$unified_info{libraries}}) {
+            my @prod_sources =
+                map { keys %{$unified_info{sources}->{$_}} }
+                keys %{$unified_info{sources}->{$prod}};
+            my %srccnt = ();
+
+            # Count how many times a given each source basename
+            # appears for each product.
+            foreach my $src (@prod_sources) {
+                $srccnt{basename $src}++;
+            }
+
+            foreach my $src (keys %srccnt) {
+                if ((my $cnt = $srccnt{$src}) > 1) {
+                    print STDERR "$src appears $cnt times for the product $prod\n";
+                    $err++
+                }
+            }
+        }
+        die if $err > 0;
+    }
+
     # Massage the result
 
     # If we depend on a header file or a perl module, add an inclusion of
@@ -2181,38 +2367,131 @@ EOF
         }
     }
 
-    # Trickle down includes placed on libraries, engines and programs to
-    # their sources (i.e. object files)
-    foreach my $dest (keys %{$unified_info{engines}},
-                      keys %{$unified_info{libraries}},
-                      keys %{$unified_info{programs}}) {
-        foreach my $k (("source", "build")) {
-            next unless defined($unified_info{includes}->{$dest}->{$k});
-            my @incs = reverse @{$unified_info{includes}->{$dest}->{$k}};
-            foreach my $obj (grep /\.o$/,
-                             (keys %{$unified_info{sources}->{$dest}},
-                              keys %{$unified_info{shared_sources}->{$dest}})) {
-                foreach my $inc (@incs) {
-                    unshift @{$unified_info{includes}->{$obj}->{$k}}, $inc
-                        unless grep { $_ eq $inc } @{$unified_info{includes}->{$obj}->{$k}};
+    # Go through all intermediary files and change their names to something that
+    # reflects what they will be built for.  Note that for some source files,
+    # this leads to duplicate object files because they are used multiple times.
+    # the goal is to rename all object files according to this scheme:
+    #    {productname}-{midfix}-{origobjname}.[o|res]
+    # the {midfix} is a keyword indicating the type of product, which is mostly
+    # valuable for libraries since they come in two forms.
+    #
+    # This also reorganises the {sources} and {shared_sources} so that the
+    # former only contains ALL object files that are supposed to end up in
+    # static libraries and programs, while the latter contains ALL object files
+    # that are supposed to end up in shared libraries and DSOs.
+    # The main reason for having two different source structures is to allow
+    # the same name to be used for the static and the shared variants of a
+    # library.
+    {
+        # Take copies so we don't get interference from added stuff
+        my %unified_copy = ();
+        foreach (('sources', 'shared_sources')) {
+            $unified_copy{$_} = { %{$unified_info{$_}} }
+                if defined($unified_info{$_});
+            delete $unified_info{$_};
+        }
+        foreach my $prodtype (('programs', 'libraries', 'modules', 'scripts')) {
+            # $intent serves multi purposes:
+            # - give a prefix for the new object files names
+            # - in the case of libraries, rearrange the object files so static
+            #   libraries use the 'sources' structure exclusively, while shared
+            #   libraries use the 'shared_sources' structure exclusively.
+            my $intent = {
+                programs  => { bin    => { src => [ 'sources' ],
+                                           dst => 'sources' } },
+                libraries => { lib    => { src => [ 'sources' ],
+                                           dst => 'sources' },
+                               shlib  => { prodselect =>
+                                               sub { grep !/\.a$/, @_ },
+                                           src => [ 'sources',
+                                                    'shared_sources' ],
+                                           dst => 'shared_sources' } },
+                modules   => { dso    => { src => [ 'sources' ],
+                                           dst => 'sources' } },
+                scripts   => { script => { src => [ 'sources' ],
+                                           dst => 'sources' } }
+               } -> {$prodtype};
+            foreach my $kind (keys %$intent) {
+                next if ($intent->{$kind}->{dst} eq 'shared_sources'
+                             && $disabled{shared});
+
+                my @src = @{$intent->{$kind}->{src}};
+                my $dst = $intent->{$kind}->{dst};
+                my $prodselect = $intent->{$kind}->{prodselect} // sub { @_ };
+                foreach my $prod ($prodselect->(keys %{$unified_info{$prodtype}})) {
+                    # %prod_sources has all applicable objects as keys, and
+                    # their corresponding sources as values
+                    my %prod_sources =
+                        map { $_ => [ keys %{$unified_copy{sources}->{$_}} ] }
+                        map { keys %{$unified_copy{$_}->{$prod}} }
+                        @src;
+                    foreach (keys %prod_sources) {
+                        # Only affect object files and resource files,
+                        # the others simply get a new value
+                        # (+1 instead of -1)
+                        if ($_ =~ /\.(o|res)$/) {
+                            (my $prodname = $prod) =~ s|\.a$||;
+                            my $newobj =
+                                catfile(dirname($_),
+                                        basename($prodname)
+                                            . '-' . $kind
+                                            . '-' . basename($_));
+                            $unified_info{$dst}->{$prod}->{$newobj} = 1;
+                            foreach my $src (@{$prod_sources{$_}}) {
+                                $unified_info{sources}->{$newobj}->{$src} = 1;
+                            }
+                            # Adjust dependencies
+                            foreach my $deps (keys %{$unified_info{depends}->{$_}}) {
+                                $unified_info{depends}->{$_}->{$deps} = -1;
+                                $unified_info{depends}->{$newobj}->{$deps} = 1;
+                            }
+                            # Adjust includes
+                            foreach my $k (('source', 'build')) {
+                                next unless
+                                    defined($unified_info{includes}->{$_}->{$k});
+                                my @incs = @{$unified_info{includes}->{$_}->{$k}};
+                                $unified_info{includes}->{$newobj}->{$k} = [ @incs ];
+                            }
+                        } else {
+                            $unified_info{$dst}->{$prod}->{$_} = 1;
+                        }
+                    }
                 }
             }
         }
-        delete $unified_info{includes}->{$dest};
     }
 
+    # At this point, we have a number of sources with the value -1.  They
+    # aren't part of the local build and are probably meant for a different
+    # platform, and can therefore be cleaned away.  That happens when making
+    # %unified_info more efficient below.
+
     ### Make unified_info a bit more efficient
     # One level structures
-    foreach (("programs", "libraries", "engines", "scripts", "extra", "overrides")) {
+    foreach (("programs", "libraries", "modules", "scripts")) {
         $unified_info{$_} = [ sort keys %{$unified_info{$_}} ];
     }
     # Two level structures
-    foreach my $l1 (("install", "sources", "shared_sources", "ldadd", "depends")) {
+    foreach my $l1 (("sources", "shared_sources", "ldadd", "depends",
+                     "htmldocs", "mandocs")) {
         foreach my $l2 (sort keys %{$unified_info{$l1}}) {
-            $unified_info{$l1}->{$l2} =
-                [ sort keys %{$unified_info{$l1}->{$l2}} ];
+            my @items =
+                sort
+                grep { $unified_info{$l1}->{$l2}->{$_} > 0 }
+                keys %{$unified_info{$l1}->{$l2}};
+            if (@items) {
+                $unified_info{$l1}->{$l2} = [ @items ];
+            } else {
+                delete $unified_info{$l1}->{$l2};
+            }
         }
     }
+    # Defines
+    foreach my $dest (sort keys %{$unified_info{defines}}) {
+        $unified_info{defines}->{$dest}
+            = [ map { $_.$unified_info{defines}->{$dest}->{$_} }
+                sort keys %{$unified_info{defines}->{$dest}} ];
+    }
     # Includes
     foreach my $dest (sort keys %{$unified_info{includes}}) {
         if (defined($unified_info{includes}->{$dest}->{build})) {
@@ -2225,9 +2504,51 @@ EOF
                 push @{$unified_info{includes}->{$dest}}, $inc
                     unless grep { $_ eq $inc } @{$unified_info{includes}->{$dest}};
             }
-        } else {
+        } elsif (defined($unified_info{includes}->{$dest}->{source})) {
             $unified_info{includes}->{$dest} =
                 [ @{$unified_info{includes}->{$dest}->{source}} ];
+        } else {
+            delete $unified_info{includes}->{$dest};
+        }
+    }
+
+    # For convenience collect information regarding directories where
+    # files are generated, those generated files and the end product
+    # they end up in where applicable.  Then, add build rules for those
+    # directories
+    my %loopinfo = ( "lib" => [ @{$unified_info{libraries}} ],
+                     "dso" => [ @{$unified_info{modules}} ],
+                     "bin" => [ @{$unified_info{programs}} ],
+                     "script" => [ @{$unified_info{scripts}} ],
+                     "docs" => [ (map { @{$unified_info{htmldocs}->{$_} // []} }
+                                  keys %{$unified_info{htmldocs} // {}}),
+                                 (map { @{$unified_info{mandocs}->{$_} // []} }
+                                  keys %{$unified_info{mandocs} // {}}) ] );
+    foreach my $type (keys %loopinfo) {
+        foreach my $product (@{$loopinfo{$type}}) {
+            my %dirs = ();
+            my $pd = dirname($product);
+
+            foreach (@{$unified_info{sources}->{$product} // []},
+                     @{$unified_info{shared_sources}->{$product} // []}) {
+                my $d = dirname($_);
+
+                # We don't want to create targets for source directories
+                # when building out of source
+                next if ($config{sourcedir} ne $config{builddir}
+                             && $d =~ m|^\Q$config{sourcedir}\E|);
+                # We already have a "test" target, and the current directory
+                # is just silly to make a target for
+                next if $d eq "test" || $d eq ".";
+
+                $dirs{$d} = 1;
+                push @{$unified_info{dirinfo}->{$d}->{deps}}, $_
+                    if $d ne $pd;
+            }
+            foreach (keys %dirs) {
+                push @{$unified_info{dirinfo}->{$_}->{products}->{$type}},
+                    $product;
+            }
         }
     }
 }
@@ -2244,443 +2565,50 @@ foreach (grep /_(asm|aux)_src$/, keys %target) {
 
 # Write down our configuration where it fits #########################
 
-print "Creating configdata.pm\n";
-open(OUT,">configdata.pm") || die "unable to create configdata.pm: $!\n";
-print OUT <<"EOF";
-#! $config{HASHBANGPERL}
-
-package configdata;
-
-use strict;
-use warnings;
-
-use Exporter;
-#use vars qw(\@ISA \@EXPORT);
-our \@ISA = qw(Exporter);
-our \@EXPORT = qw(\%config \%target \%disabled \%withargs \%unified_info \@disablables);
-
-EOF
-print OUT "our %config = (\n";
-foreach (sort keys %config) {
-    if (ref($config{$_}) eq "ARRAY") {
-	print OUT "  ", $_, " => [ ", join(", ",
-					   map { quotify("perl", $_) }
-					   @{$config{$_}}), " ],\n";
-    } elsif (ref($config{$_}) eq "HASH") {
-	print OUT "  ", $_, " => {";
-        if (scalar keys %{$config{$_}} > 0) {
-            print OUT "\n";
-            foreach my $key (sort keys %{$config{$_}}) {
-                print OUT "      ",
-                    join(" => ",
-                         quotify("perl", $key),
-                         defined $config{$_}->{$key}
-                             ? quotify("perl", $config{$_}->{$key})
-                             : "undef");
-                print OUT ",\n";
-            }
-            print OUT "  ";
-        }
-        print OUT "},\n";
-    } else {
-	print OUT "  ", $_, " => ", quotify("perl", $config{$_}), ",\n"
-    }
-}
-print OUT <<"EOF";
+my %template_vars = (
+    config => \%config,
+    target => \%target,
+    disablables => \@disablables,
+    disablables_int => \@disablables_int,
+    disabled => \%disabled,
+    withargs => \%withargs,
+    unified_info => \%unified_info,
+    tls => \@tls,
+    dtls => \@dtls,
+    makevars => [ sort keys %user ],
+    disabled_info => \%disabled_info,
+    user_crossable => \@user_crossable,
 );
-
-EOF
-print OUT "our %target = (\n";
-foreach (sort keys %target) {
-    if (ref($target{$_}) eq "ARRAY") {
-	print OUT "  ", $_, " => [ ", join(", ",
-					   map { quotify("perl", $_) }
-					   @{$target{$_}}), " ],\n";
-    } else {
-	print OUT "  ", $_, " => ", quotify("perl", $target{$_}), ",\n"
-    }
-}
-print OUT <<"EOF";
-);
-
-EOF
-print OUT "our \%available_protocols = (\n";
-print OUT "  tls => [ ", join(", ", map { quotify("perl", $_) } @tls), " ],\n";
-print OUT "  dtls => [ ", join(", ", map { quotify("perl", $_) } @dtls), " ],\n";
-print OUT <<"EOF";
-);
-
-EOF
-print OUT "our \@disablables = (\n";
-foreach (@disablables) {
-    print OUT "  ", quotify("perl", $_), ",\n";
-}
-print OUT <<"EOF";
-);
-
-EOF
-print OUT "our \%disabled = (\n";
-foreach (sort keys %disabled) {
-    print OUT "  ", quotify("perl", $_), " => ", quotify("perl", $disabled{$_}), ",\n";
-}
-print OUT <<"EOF";
-);
-
-EOF
-print OUT "our %withargs = (\n";
-foreach (sort keys %withargs) {
-    if (ref($withargs{$_}) eq "ARRAY") {
-	print OUT "  ", $_, " => [ ", join(", ",
-					   map { quotify("perl", $_) }
-					   @{$withargs{$_}}), " ],\n";
-    } else {
-	print OUT "  ", $_, " => ", quotify("perl", $withargs{$_}), ",\n"
-    }
-}
-print OUT <<"EOF";
-);
-
-EOF
-if ($builder eq "unified") {
-    my $recurse;
-    $recurse = sub {
-        my $indent = shift;
-        foreach (@_) {
-            if (ref $_ eq "ARRAY") {
-                print OUT " "x$indent, "[\n";
-                foreach (@$_) {
-                    $recurse->($indent + 4, $_);
-                }
-                print OUT " "x$indent, "],\n";
-            } elsif (ref $_ eq "HASH") {
-                my %h = %$_;
-                print OUT " "x$indent, "{\n";
-                foreach (sort keys %h) {
-                    if (ref $h{$_} eq "") {
-                        print OUT " "x($indent + 4), quotify("perl", $_), " => ", quotify("perl", $h{$_}), ",\n";
-                    } else {
-                        print OUT " "x($indent + 4), quotify("perl", $_), " =>\n";
-                        $recurse->($indent + 8, $h{$_});
-                    }
-                }
-                print OUT " "x$indent, "},\n";
-            } else {
-                print OUT " "x$indent, quotify("perl", $_), ",\n";
-            }
-        }
-    };
-    print OUT "our %unified_info = (\n";
-    foreach (sort keys %unified_info) {
-        if (ref $unified_info{$_} eq "") {
-            print OUT " "x4, quotify("perl", $_), " => ", quotify("perl", $unified_info{$_}), ",\n";
-        } else {
-            print OUT " "x4, quotify("perl", $_), " =>\n";
-            $recurse->(8, $unified_info{$_});
-        }
-    }
-    print OUT <<"EOF";
-);
-
-EOF
-}
-print OUT
-    "# The following data is only used when this files is use as a script\n";
-print OUT "my \@makevars = (\n";
-foreach (sort keys %user) {
-    print OUT "    '",$_,"',\n";
-}
-print OUT ");\n";
-print OUT "my \%disabled_info = (\n";
-foreach my $what (sort keys %disabled_info) {
-    print OUT "    '$what' => {\n";
-    foreach my $info (sort keys %{$disabled_info{$what}}) {
-        if (ref $disabled_info{$what}->{$info} eq 'ARRAY') {
-            print OUT "        $info => [ ",
-                join(', ', map { "'$_'" } @{$disabled_info{$what}->{$info}}),
-                " ],\n";
-        } else {
-            print OUT "        $info => '", $disabled_info{$what}->{$info},
-                "',\n";
-        }
-    }
-    print OUT "    },\n";
-}
-print OUT ");\n";
-print OUT 'my @user_crossable = qw( ', join (' ', @user_crossable), " );\n";
-print OUT << 'EOF';
-# If run directly, we can give some answers, and even reconfigure
-unless (caller) {
-    use Getopt::Long;
-    use File::Spec::Functions;
-    use File::Basename;
-    use Pod::Usage;
-
-    my $here = dirname($0);
-
-    my $dump = undef;
-    my $cmdline = undef;
-    my $options = undef;
-    my $target = undef;
-    my $envvars = undef;
-    my $makevars = undef;
-    my $buildparams = undef;
-    my $reconf = undef;
-    my $verbose = undef;
-    my $help = undef;
-    my $man = undef;
-    GetOptions('dump|d'                 => \$dump,
-               'command-line|c'         => \$cmdline,
-               'options|o'              => \$options,
-               'target|t'               => \$target,
-               'environment|e'          => \$envvars,
-               'make-variables|m'       => \$makevars,
-               'build-parameters|b'     => \$buildparams,
-               'reconfigure|reconf|r'   => \$reconf,
-               'verbose|v'              => \$verbose,
-               'help'                   => \$help,
-               'man'                    => \$man)
-        or die "Errors in command line arguments\n";
-
-    unless ($dump || $cmdline || $options || $target || $envvars || $makevars
-            || $buildparams || $reconf || $verbose || $help || $man) {
-        print STDERR <<"_____";
-You must give at least one option.
-For more information, do '$0 --help'
-_____
-        exit(2);
-    }
-
-    if ($help) {
-        pod2usage(-exitval => 0,
-                  -verbose => 1);
-    }
-    if ($man) {
-        pod2usage(-exitval => 0,
-                  -verbose => 2);
-    }
-    if ($dump || $cmdline) {
-        print "\nCommand line (with current working directory = $here):\n\n";
-        print '    ',join(' ',
-                          $config{PERL},
-                          catfile($config{sourcedir}, 'Configure'),
-                          @{$config{perlargv}}), "\n";
-        print "\nPerl information:\n\n";
-        print '    ',$config{perl_cmd},"\n";
-        print '    ',$config{perl_version},' for ',$config{perl_archname},"\n";
-    }
-    if ($dump || $options) {
-        my $longest = 0;
-        my $longest2 = 0;
-        foreach my $what (@disablables) {
-            $longest = length($what) if $longest < length($what);
-            $longest2 = length($disabled{$what})
-                if $disabled{$what} && $longest2 < length($disabled{$what});
-        }
-        print "\nEnabled features:\n\n";
-        foreach my $what (@disablables) {
-            print "    $what\n" unless $disabled{$what};
-        }
-        print "\nDisabled features:\n\n";
-        foreach my $what (@disablables) {
-            if ($disabled{$what}) {
-                print "    $what", ' ' x ($longest - length($what) + 1),
-                    "[$disabled{$what}]", ' ' x ($longest2 - length($disabled{$what}) + 1);
-                print $disabled_info{$what}->{macro}
-                    if $disabled_info{$what}->{macro};
-                print ' (skip ',
-                    join(', ', @{$disabled_info{$what}->{skipped}}),
-                    ')'
-                    if $disabled_info{$what}->{skipped};
-                print "\n";
-            }
-        }
-    }
-    if ($dump || $target) {
-        print "\nConfig target attributes:\n\n";
-        foreach (sort keys %target) {
-            next if $_ =~ m|^_| || $_ eq 'template';
-            my $quotify = sub {
-                map { (my $x = $_) =~ s|([\\\$\@"])|\\$1|g; "\"$x\""} @_;
-            };
-            print '    ', $_, ' => ';
-            if (ref($target{$_}) eq "ARRAY") {
-                print '[ ', join(', ', $quotify->(@{$target{$_}})), " ],\n";
-            } else {
-                print $quotify->($target{$_}), ",\n"
-            }
-        }
-    }
-    if ($dump || $envvars) {
-        print "\nRecorded environment:\n\n";
-        foreach (sort keys %{$config{perlenv}}) {
-            print '    ',$_,' = ',($config{perlenv}->{$_} || ''),"\n";
-        }
-    }
-    if ($dump || $makevars) {
-        print "\nMakevars:\n\n";
-        foreach my $var (@makevars) {
-            my $prefix = '';
-            $prefix = $config{CROSS_COMPILE}
-                if grep { $var eq $_ } @user_crossable;
-            $prefix //= '';
-            print '    ',$var,' ' x (16 - length $var),'= ',
-                (ref $config{$var} eq 'ARRAY'
-                 ? join(' ', @{$config{$var}})
-                 : $prefix.$config{$var}),
-                "\n"
-                if defined $config{$var};
-        }
-
-        my @buildfile = ($config{builddir}, $config{build_file});
-        unshift @buildfile, $here
-            unless file_name_is_absolute($config{builddir});
-        my $buildfile = canonpath(catdir(@buildfile));
-        print <<"_____";
-
-NOTE: These variables only represent the configuration view.  The build file
-template may have processed these variables further, please have a look at the
-build file for more exact data:
-    $buildfile
-_____
-    }
-    if ($dump || $buildparams) {
-        my @buildfile = ($config{builddir}, $config{build_file});
-        unshift @buildfile, $here
-            unless file_name_is_absolute($config{builddir});
-        print "\nbuild file:\n\n";
-        print "    ", canonpath(catfile(@buildfile)),"\n";
-
-        print "\nbuild file templates:\n\n";
-        foreach (@{$config{build_file_templates}}) {
-            my @tmpl = ($_);
-            unshift @tmpl, $here
-                unless file_name_is_absolute($config{sourcedir});
-            print '    ',canonpath(catfile(@tmpl)),"\n";
-        }
-    }
-    if ($reconf) {
-        if ($verbose) {
-            print 'Reconfiguring with: ', join(' ',@{$config{perlargv}}), "\n";
-	    foreach (sort keys %{$config{perlenv}}) {
-	        print '    ',$_,' = ',($config{perlenv}->{$_} || ""),"\n";
-	    }
-        }
-
-        chdir $here;
-        exec $^X,catfile($config{sourcedir}, 'Configure'),'reconf';
-    }
-}
-
-1;
-
-__END__
-
-=head1 NAME
-
-configdata.pm - configuration data for OpenSSL builds
-
-=head1 SYNOPSIS
-
-Interactive:
-
-  perl configdata.pm [options]
-
-As data bank module:
-
-  use configdata;
-
-=head1 DESCRIPTION
-
-This module can be used in two modes, interactively and as a module containing
-all the data recorded by OpenSSL's Configure script.
-
-When used interactively, simply run it as any perl script, with at least one
-option, and you will get the information you ask for.  See L</OPTIONS> below.
-
-When loaded as a module, you get a few databanks with useful information to
-perform build related tasks.  The databanks are:
-
-    %config             Configured things.
-    %target             The OpenSSL config target with all inheritances
-                        resolved.
-    %disabled           The features that are disabled.
-    @disablables        The list of features that can be disabled.
-    %withargs           All data given through --with-THING options.
-    %unified_info       All information that was computed from the build.info
-                        files.
-
-=head1 OPTIONS
-
-=over 4
-
-=item B<--help>
-
-Print a brief help message and exit.
-
-=item B<--man>
-
-Print the manual page and exit.
-
-=item B<--dump> | B<-d>
-
-Print all relevant configuration data.  This is equivalent to B<--command-line>
-B<--options> B<--target> B<--environment> B<--make-variables>
-B<--build-parameters>.
-
-=item B<--command-line> | B<-c>
-
-Print the current configuration command line.
-
-=item B<--options> | B<-o>
-
-Print the features, both enabled and disabled, and display defined macro and
-skipped directories where applicable.
-
-=item B<--target> | B<-t>
-
-Print the config attributes for this config target.
-
-=item B<--environment> | B<-e>
-
-Print the environment variables and their values at the time of configuration.
-
-=item B<--make-variables> | B<-m>
-
-Print the main make variables generated in the current configuration
-
-=item B<--build-parameters> | B<-b>
-
-Print the build parameters, i.e. build file and build file templates.
-
-=item B<--reconfigure> | B<--reconf> | B<-r>
-
-Redo the configuration.
-
-=item B<--verbose> | B<-v>
-
-Verbose output.
-
-=back
-
-=cut
-
-EOF
-close(OUT);
+my $configdata_outname = 'configdata.pm';
+print "Creating $configdata_outname\n";
+open CONFIGDATA, ">$configdata_outname.new"
+            or die "Trying to create $configdata_outname.new: $!";
+my $configdata_tmplname = cleanfile($srcdir, "configdata.pm.in", $blddir);
+my $configdata_tmpl =
+    OpenSSL::Template->new(TYPE => 'FILE', SOURCE => $configdata_tmplname);
+$configdata_tmpl->fill_in(
+    FILENAME => $configdata_tmplname,
+    OUTPUT => \*CONFIGDATA,
+    HASH => { %template_vars,
+              autowarntext => [
+                  'WARNING: do not edit!',
+                  "Generated by Configure from $configdata_tmplname",
+              ] }
+) or die $Text::Template::ERROR;
+close CONFIGDATA;
+rename "$configdata_outname.new", $configdata_outname;
 if ($builder_platform eq 'unix') {
     my $mode = (0755 & ~umask);
     chmod $mode, 'configdata.pm'
         or warn sprintf("WARNING: Couldn't change mode for 'configdata.pm' to 0%03o: %s\n",$mode,$!);
 }
 
-my %builders = (
-    unified => sub {
-        print 'Creating ',$target{build_file},"\n";
-        run_dofile(catfile($blddir, $target{build_file}),
-                   @{$config{build_file_templates}});
-    },
-    );
-
-$builders{$builder}->($builder_platform, @builder_opts);
+print "Running $configdata_outname\n";
+my $perlcmd = (quotify("maybeshell", $config{PERL}))[0];
+my $cmd = "$perlcmd $configdata_outname";
+#print STDERR "DEBUG[run_dofile]: \$cmd = $cmd\n";
+system($cmd);
+exit 1 if $? != 0;
 
 $SIG{__DIE__} = $orig_death_handler;
 
@@ -2688,7 +2616,7 @@ print <<"EOF" if ($disabled{threads} eq "unavailable");
 
 The library could not be configured for supporting multi-threaded
 applications as the compiler options required on this system are not known.
-See file INSTALL for details if you need multi-threading.
+See file INSTALL.md for details if you need multi-threading.
 EOF
 
 print <<"EOF" if ($no_shared_warn);
@@ -2704,10 +2632,16 @@ print <<"EOF";
 
 **********************************************************************
 ***                                                                ***
-***   If you want to report a building issue, please include the   ***
-***   output from this command:                                    ***
+***   OpenSSL has been successfully configured                     ***
 ***                                                                ***
-***     perl configdata.pm --dump                                  ***
+***   If you encounter a problem while building, please open an    ***
+***   issue on GitHub <https://github.com/openssl/openssl/issues>  ***
+***   and include the output from the following command:           ***
+***                                                                ***
+***       perl configdata.pm --dump                                ***
+***                                                                ***
+***   (If you are new to OpenSSL, you might want to consult the    ***
+***   'Troubleshooting' section in the INSTALL.md file first)      ***
 ***                                                                ***
 **********************************************************************
 EOF
@@ -2727,8 +2661,8 @@ sub death_handler {
     my @message = ( <<"_____", @_ );
 
 Failure!  $build_file wasn't produced.
-Please read INSTALL and associated NOTES files.  You may also have to look over
-your available compiler tool chain or change your configuration.
+Please read INSTALL.md and associated NOTES files.  You may also have to
+look over your available compiler tool chain or change your configuration.
 
 _____
 
@@ -2744,18 +2678,6 @@ _____
 # Thus, whenever there's mention of a returned value, it's about that
 # intended value.
 
-# Helper function to implement conditional inheritance depending on the
-# value of $disabled{asm}.  Used in inherit_from values as follows:
-#
-#      inherit_from => [ "template", asm("asm_tmpl") ]
-#
-sub asm {
-    my @x = @_;
-    sub {
-	$disabled{asm} ? () : @x;
-    }
-}
-
 # Helper function to implement conditional value variants, with a default
 # plus additional values based on the value of $config{build_type}.
 # Arguments are given in hash table form:
@@ -2818,29 +2740,29 @@ sub _add {
     my $found_array = !defined($separator);
 
     my @values =
-	map {
-	    my $res = $_;
-	    while (ref($res) eq "CODE") {
-		$res = $res->();
-	    }
-	    if (defined($res)) {
-		if (ref($res) eq "ARRAY") {
-		    $found_array = 1;
-		    @$res;
-		} else {
-		    $res;
-		}
-	    } else {
-		();
-	    }
+        map {
+            my $res = $_;
+            while (ref($res) eq "CODE") {
+                $res = $res->();
+            }
+            if (defined($res)) {
+                if (ref($res) eq "ARRAY") {
+                    $found_array = 1;
+                    @$res;
+                } else {
+                    $res;
+                }
+            } else {
+                ();
+            }
     } (@_);
 
     $add_called = 1;
 
     if ($found_array) {
-	[ @values ];
+        [ @values ];
     } else {
-	join($separator, grep { defined($_) && $_ ne "" } @values);
+        join($separator, grep { defined($_) && $_ ne "" } @values);
     }
 }
 sub add_before {
@@ -2890,10 +2812,10 @@ sub read_config {
     my %targets;
 
     {
-	# Protect certain tables from tampering
-	local %table = ();
+        # Protect certain tables from tampering
+        local %table = ();
 
-	%targets = read_eval_file($fname);
+        %targets = read_eval_file($fname);
     }
     my %preexisting = ();
     foreach (sort keys %targets) {
@@ -2909,14 +2831,14 @@ EOF
 
     # For each target, check that it's configured with a hash table.
     foreach (keys %targets) {
-	if (ref($targets{$_}) ne "HASH") {
-	    if (ref($targets{$_}) eq "") {
-		warn "Deprecated target configuration for $_, ignoring...\n";
-	    } else {
-		warn "Misconfigured target configuration for $_ (should be a hash table), ignoring...\n";
-	    }
-	    delete $targets{$_};
-	} else {
+        if (ref($targets{$_}) ne "HASH") {
+            if (ref($targets{$_}) eq "") {
+                warn "Deprecated target configuration for $_, ignoring...\n";
+            } else {
+                warn "Misconfigured target configuration for $_ (should be a hash table), ignoring...\n";
+            }
+            delete $targets{$_};
+        } else {
             $targets{$_}->{_conf_fname_int} = add([ $fname ]);
         }
     }
@@ -2935,13 +2857,13 @@ sub resolve_config {
 #    my $extra_checks = defined($ENV{CONFIGURE_EXTRA_CHECKS});
 
     if (grep { $_ eq $target } @breadcrumbs) {
-	die "inherit_from loop!  target backtrace:\n  "
-	    ,$target,"\n  ",join("\n  ", @breadcrumbs),"\n";
+        die "inherit_from loop!  target backtrace:\n  "
+            ,$target,"\n  ",join("\n  ", @breadcrumbs),"\n";
     }
 
     if (!defined($table{$target})) {
-	warn "Warning! target $target doesn't exist!\n";
-	return ();
+        warn "Warning! target $target doesn't exist!\n";
+        return ();
     }
     # Recurse through all inheritances.  They will be resolved on the
     # fly, so when this operation is done, they will all just be a
@@ -2951,22 +2873,22 @@ sub resolve_config {
     # this stage is done.
     my %combined_inheritance = ();
     if ($table{$target}->{inherit_from}) {
-	my @inherit_from =
-	    map { ref($_) eq "CODE" ? $_->() : $_ } @{$table{$target}->{inherit_from}};
-	foreach (@inherit_from) {
-	    my %inherited_config = resolve_config($_, $target, @breadcrumbs);
+        my @inherit_from =
+            map { ref($_) eq "CODE" ? $_->() : $_ } @{$table{$target}->{inherit_from}};
+        foreach (@inherit_from) {
+            my %inherited_config = resolve_config($_, $target, @breadcrumbs);
 
-	    # 'template' is a marker that's considered private to
-	    # the config that had it.
-	    delete $inherited_config{template};
+            # 'template' is a marker that's considered private to
+            # the config that had it.
+            delete $inherited_config{template};
 
-	    foreach (keys %inherited_config) {
-		if (!$combined_inheritance{$_}) {
-		    $combined_inheritance{$_} = [];
-		}
-		push @{$combined_inheritance{$_}}, $inherited_config{$_};
-	    }
-	}
+            foreach (keys %inherited_config) {
+                if (!$combined_inheritance{$_}) {
+                    $combined_inheritance{$_} = [];
+                }
+                push @{$combined_inheritance{$_}}, $inherited_config{$_};
+            }
+        }
     }
 
     # We won't need inherit_from in this target any more, since we've
@@ -2987,14 +2909,14 @@ sub resolve_config {
     my $default_combiner = add();
 
     my %all_keys =
-	map { $_ => 1 } (keys %combined_inheritance,
-			 keys %{$table{$target}});
+        map { $_ => 1 } (keys %combined_inheritance,
+                         keys %{$table{$target}});
 
     sub process_values {
-	my $object    = shift;
-	my $inherited = shift;  # Always a [ list ]
-	my $target    = shift;
-	my $entry     = shift;
+        my $object    = shift;
+        my $inherited = shift;  # Always a [ list ]
+        my $target    = shift;
+        my $entry     = shift;
 
         $add_called = 0;
 
@@ -3019,16 +2941,16 @@ sub resolve_config {
     foreach (sort keys %all_keys) {
         my $previous = $combined_inheritance{$_};
 
-	# Current target doesn't have a value for the current key?
-	# Assign it the default combiner, the rest of this loop body
-	# will handle it just like any other coderef.
-	if (!exists $table{$target}->{$_}) {
-	    $table{$target}->{$_} = $default_combiner;
-	}
+        # Current target doesn't have a value for the current key?
+        # Assign it the default combiner, the rest of this loop body
+        # will handle it just like any other coderef.
+        if (!exists $table{$target}->{$_}) {
+            $table{$target}->{$_} = $default_combiner;
+        }
 
-	$table{$target}->{$_} = process_values($table{$target}->{$_},
-					       $combined_inheritance{$_},
-					       $target, $_);
+        $table{$target}->{$_} = process_values($table{$target}->{$_},
+                                               $combined_inheritance{$_},
+                                               $target, $_);
         unless(defined($table{$target}->{$_})) {
             delete $table{$target}->{$_};
         }
@@ -3043,57 +2965,39 @@ sub resolve_config {
 }
 
 sub usage
-	{
-	print STDERR $usage;
-	print STDERR "\npick os/compiler from:\n";
-	my $j=0;
-	my $i;
+        {
+        print STDERR $usage;
+        print STDERR "\npick os/compiler from:\n";
+        my $j=0;
+        my $i;
         my $k=0;
-	foreach $i (sort keys %table)
-		{
-		next if $table{$i}->{template};
-		next if $i =~ /^debug/;
-		$k += length($i) + 1;
-		if ($k > 78)
-			{
-			print STDERR "\n";
-			$k=length($i);
-			}
-		print STDERR $i . " ";
-		}
-	foreach $i (sort keys %table)
-		{
-		next if $table{$i}->{template};
-		next if $i !~ /^debug/;
-		$k += length($i) + 1;
-		if ($k > 78)
-			{
-			print STDERR "\n";
-			$k=length($i);
-			}
-		print STDERR $i . " ";
-		}
-	print STDERR "\n\nNOTE: If in doubt, on Unix-ish systems use './config'.\n";
-	exit(1);
-	}
-
-sub run_dofile
-{
-    my $out = shift;
-    my @templates = @_;
-
-    unlink $out || warn "Can't remove $out, $!"
-        if -f $out;
-    foreach (@templates) {
-        die "Can't open $_, $!" unless -f $_;
-    }
-    my $perlcmd = (quotify("maybeshell", $config{PERL}))[0];
-    my $cmd = "$perlcmd \"-I.\" \"-Mconfigdata\" \"$dofile\" -o\"Configure\" \"".join("\" \"",@templates)."\" > \"$out.new\"";
-    #print STDERR "DEBUG[run_dofile]: \$cmd = $cmd\n";
-    system($cmd);
-    exit 1 if $? != 0;
-    rename("$out.new", $out) || die "Can't rename $out.new, $!";
-}
+        foreach $i (sort keys %table)
+                {
+                next if $table{$i}->{template};
+                next if $i =~ /^debug/;
+                $k += length($i) + 1;
+                if ($k > 78)
+                        {
+                        print STDERR "\n";
+                        $k=length($i);
+                        }
+                print STDERR $i . " ";
+                }
+        foreach $i (sort keys %table)
+                {
+                next if $table{$i}->{template};
+                next if $i !~ /^debug/;
+                $k += length($i) + 1;
+                if ($k > 78)
+                        {
+                        print STDERR "\n";
+                        $k=length($i);
+                        }
+                print STDERR $i . " ";
+                }
+        print STDERR "\n\nNOTE: If in doubt, on Unix-ish systems use './config'.\n";
+        exit(1);
+        }
 
 sub compiler_predefined {
     state %predefined;
@@ -3169,69 +3073,49 @@ sub print_table_entry
     return if $target{template};
 
     my @sequence = (
-	"sys_id",
-	"cpp",
-	"cppflags",
-	"defines",
-	"includes",
-	"cc",
-	"cflags",
-	"unistd",
-	"ld",
-	"lflags",
-	"loutflag",
-	"ex_libs",
-	"bn_ops",
-	"apps_aux_src",
-	"cpuid_asm_src",
-	"uplink_aux_src",
-	"bn_asm_src",
-	"ec_asm_src",
-	"des_asm_src",
-	"aes_asm_src",
-	"bf_asm_src",
-	"md5_asm_src",
-	"cast_asm_src",
-	"sha1_asm_src",
-	"rc4_asm_src",
-	"rmd160_asm_src",
-	"rc5_asm_src",
-	"wp_asm_src",
-	"cmll_asm_src",
-	"modes_asm_src",
-	"padlock_asm_src",
-	"chacha_asm_src",
-	"poly1035_asm_src",
-	"thread_scheme",
-	"perlasm_scheme",
-	"dso_scheme",
-	"shared_target",
-	"shared_cflag",
-	"shared_defines",
-	"shared_ldflag",
-	"shared_rcflag",
-	"shared_extension",
-	"dso_extension",
-	"obj_extension",
-	"exe_extension",
-	"ranlib",
-	"ar",
-	"arflags",
-	"aroutflag",
-	"rc",
-	"rcflags",
-	"rcoutflag",
-	"mt",
-	"mtflags",
-	"mtinflag",
-	"mtoutflag",
-	"multilib",
-	"build_scheme",
-	);
+        "sys_id",
+        "cpp",
+        "cppflags",
+        "defines",
+        "includes",
+        "cc",
+        "cflags",
+        "ld",
+        "lflags",
+        "loutflag",
+        "ex_libs",
+        "bn_ops",
+        "poly1035_asm_src",
+        "thread_scheme",
+        "perlasm_scheme",
+        "dso_scheme",
+        "shared_target",
+        "shared_cflag",
+        "shared_defines",
+        "shared_ldflag",
+        "shared_rcflag",
+        "shared_extension",
+        "dso_extension",
+        "obj_extension",
+        "exe_extension",
+        "ranlib",
+        "ar",
+        "arflags",
+        "aroutflag",
+        "rc",
+        "rcflags",
+        "rcoutflag",
+        "mt",
+        "mtflags",
+        "mtinflag",
+        "mtoutflag",
+        "multilib",
+        "build_scheme",
+        );
 
     if ($type eq "TABLE") {
-	print "\n";
-	print "*** $now_printing\n";
+        print "\n";
+        print "*** $now_printing\n";
         foreach (@sequence) {
             if (ref($target{$_}) eq "ARRAY") {
                 printf "\$%-12s = %s\n", $_, join(" ", @{$target{$_}});
@@ -3240,19 +3124,19 @@ sub print_table_entry
             }
         }
     } elsif ($type eq "HASH") {
-	my $largest =
-	    length((sort { length($a) <=> length($b) } @sequence)[-1]);
-	print "    '$now_printing' => {\n";
-	foreach (@sequence) {
-	    if ($target{$_}) {
+        my $largest =
+            length((sort { length($a) <=> length($b) } @sequence)[-1]);
+        print "    '$now_printing' => {\n";
+        foreach (@sequence) {
+            if ($target{$_}) {
                 if (ref($target{$_}) eq "ARRAY") {
                     print "      '",$_,"'"," " x ($largest - length($_))," => [ ",join(", ", map { "'$_'" } @{$target{$_}})," ],\n";
                 } else {
                     print "      '",$_,"'"," " x ($largest - length($_))," => '",$target{$_},"',\n";
                 }
-	    }
-	}
-	print "    },\n";
+            }
+        }
+        print "    },\n";
     }
 }
 
@@ -3300,21 +3184,21 @@ sub absolutedir {
 
 sub quotify {
     my %processors = (
-	perl    => sub { my $x = shift;
-			 $x =~ s/([\\\$\@"])/\\$1/g;
-			 return '"'.$x.'"'; },
-	maybeshell => sub { my $x = shift;
-			    (my $y = $x) =~ s/([\\\"])/\\$1/g;
-			    if ($x ne $y || $x =~ m|\s|) {
-				return '"'.$y.'"';
-			    } else {
-				return $x;
-			    }
-			},
-	);
+        perl    => sub { my $x = shift;
+                         $x =~ s/([\\\$\@"])/\\$1/g;
+                         return '"'.$x.'"'; },
+        maybeshell => sub { my $x = shift;
+                            (my $y = $x) =~ s/([\\\"])/\\$1/g;
+                            if ($x ne $y || $x =~ m|\s|) {
+                                return '"'.$y.'"';
+                            } else {
+                                return $x;
+                            }
+                        },
+        );
     my $for = shift;
     my $processor =
-	defined($processors{$for}) ? $processors{$for} : sub { shift; };
+        defined($processors{$for}) ? $processors{$for} : sub { shift; };
 
     return map { $processor->($_); } @_;
 }
@@ -3411,39 +3295,50 @@ sub collect_information {
 }
 
 # tokenize($line)
+# tokenize($line,$separator)
 # $line is a line of text to split up into tokens
-# returns a list of tokens
+# $separator [optional] is a regular expression that separates the tokens,
+# the default being spaces.  Do not use quotes of any kind as separators,
+# that will give undefined results.
+# Returns a list of tokens.
 #
-# Tokens are divided by spaces.  If the tokens include spaces, they
-# have to be quoted with single or double quotes.  Double quotes
-# inside a double quoted token must be escaped.  Escaping is done
+# Tokens are divided by separator (spaces by default).  If the tokens include
+# the separators, they have to be quoted with single or double quotes.
+# Double quotes inside a double quoted token must be escaped.  Escaping is done
 # with backslash.
 # Basically, the same quoting rules apply for " and ' as in any
 # Unix shell.
 sub tokenize {
     my $line = my $debug_line = shift;
+    my $separator = shift // qr|\s+|;
     my @result = ();
 
-    while ($line =~ s|^\s+||, $line ne "") {
+    if ($ENV{CONFIGURE_DEBUG_TOKENIZE}) {
+        print STDERR "DEBUG[tokenize]: \$separator = $separator\n";
+    }
+
+    while ($line =~ s|^${separator}||, $line ne "") {
         my $token = "";
-        while ($line ne "" && $line !~ m|^\s|) {
-            if ($line =~ m/^"((?:[^"\\]+|\\.)*)"/) {
-                $token .= $1;
-                $line = $';
-            } elsif ($line =~ m/^'([^']*)'/) {
-                $token .= $1;
-                $line = $';
-            } elsif ($line =~ m/^(\S+)/) {
-                $token .= $1;
-                $line = $';
-            }
+    again:
+        $line =~ m/^(.*?)(${separator}|"|'|$)/;
+        $token .= $1;
+        $line = $2.$';
+
+        if ($line =~ m/^"((?:[^"\\]+|\\.)*)"/) {
+            $token .= $1;
+            $line = $';
+            goto again;
+        } elsif ($line =~ m/^'([^']*)'/) {
+            $token .= $1;
+            $line = $';
+            goto again;
         }
         push @result, $token;
     }
 
     if ($ENV{CONFIGURE_DEBUG_TOKENIZE}) {
-	print STDERR "DEBUG[tokenize]: Parsed '$debug_line' into:\n";
-	print STDERR "DEBUG[tokenize]: ('", join("', '", @result), "')\n";
+        print STDERR "DEBUG[tokenize]: Parsed '$debug_line' into:\n";
+        print STDERR "DEBUG[tokenize]: ('", join("', '", @result), "')\n";
     }
     return @result;
 }

FAQ

@@ -1,2 +0,0 @@
-The FAQ is now maintained on the web:
-        https://www.openssl.org/docs/faq.html

FAQ.md

@@ -0,0 +1,6 @@
+Frequently Asked Questions (FAQ)
+================================
+
+The [Frequently Asked Questions][FAQ] are now maintained on the OpenSSL homepage.
+
+  [FAQ]: https://www.openssl.org/docs/faq.html

HACKING

@@ -0,0 +1,26 @@
+ MODIFYING OPENSSL SOURCE
+ ------------------------
+ This document describes the way to add custom modifications to OpenSSL sources.
+
+ If you are adding new public functions to the custom library build, you need to
+ either add a prototype in one of the existing OpenSSL header files;
+ or provide a new header file and edit Configurations/unix-Makefile.tmpl to pick up that file.
+
+ After that perform the following steps:
+
+    ./config -Werror --strict-warnings [your-options]
+    make update
+    make
+    make test
+
+ "make update" ensures that your functions declarations are added to util/libcrypto.num or util/libssl.num
+ If you plan to submit the changes you made to OpenSSL (see CONTRIBUTING), it's worth running:
+
+    make doc-nits
+
+ after running "make update" to ensure that documentation has correct format.
+
+ "make update" also generates files related to OIDs (in the crypto/objects/ folder) and errors.
+ If a merge error occurs in one of these generated files then the generated files need to be removed
+ and regenerated using "make update".
+ To aid in this process the generated files can be committed separately so they can be removed easily.

INSTALL

@@ -1,1225 +0,0 @@
- OPENSSL INSTALLATION
- --------------------
-
- This document describes installation on all supported operating
- systems (the Unix/Linux family (which includes Mac OS/X), OpenVMS,
- and Windows).
-
- To install OpenSSL, you will need:
-
-  * A make implementation
-  * Perl 5 with core modules (please read NOTES.PERL)
-  * The perl module Text::Template (please read NOTES.PERL)
-  * an ANSI C compiler
-  * a development environment in the form of development libraries and C
-    header files
-  * a supported operating system
-
- For additional platform specific requirements, solutions to specific
- issues and other details, please read one of these:
-
-  * NOTES.UNIX (any supported Unix like system)
-  * NOTES.VMS (OpenVMS)
-  * NOTES.WIN (any supported Windows)
-  * NOTES.DJGPP (DOS platform with DJGPP)
-  * NOTES.ANDROID (obviously Android [NDK])
-
- Notational conventions in this document
- ---------------------------------------
-
- Throughout this document, we use the following conventions in command
- examples:
-
- $ command                      Any line starting with a dollar sign
-                                ($) is a command line.
-
- { word1 | word2 | word3 }      This denotes a mandatory choice, to be
-                                replaced with one of the given words.
-                                A simple example would be this:
-
-                                $ echo { FOO | BAR | COOKIE }
-
-                                which is to be understood as one of
-                                these:
-
-                                $ echo FOO
-                                - or -
-                                $ echo BAR
-                                - or -
-                                $ echo COOKIE
-
- [ word1 | word2 | word3 ]      Similar to { word1 | word2 | word3 }
-                                except it's optional to give any of
-                                those.  In addition to the examples
-                                above, this would also be valid:
-
-                                $ echo
-
- {{ target }}                   This denotes a mandatory word or
-                                sequence of words of some sort.  A
-                                simple example would be this:
-
-                                $ type {{ filename }}
-
-                                which is to be understood to use the
-                                command 'type' on some file name
-                                determined by the user.
-
- [[ options ]]                  Similar to {{ target }}, but is
-                                optional.
-
- Note that the notation assumes spaces around {, }, [, ], {{, }} and
- [[, ]].  This is to differentiate from OpenVMS directory
- specifications, which also use [ and ], but without spaces.
-
- Quick Start
- -----------
-
- If you want to just get on with it, do:
-
-  on Unix (again, this includes Mac OS/X):
-
-    $ ./config
-    $ make
-    $ make test
-    $ make install
-
-  on OpenVMS:
-
-    $ @config
-    $ mms
-    $ mms test
-    $ mms install
-
-  on Windows (only pick one of the targets for configuration):
-
-    $ perl Configure { VC-WIN32 | VC-WIN64A | VC-WIN64I | VC-CE }
-    $ nmake
-    $ nmake test
-    $ nmake install
-
- If any of these steps fails, see section Installation in Detail below.
-
- This will build and install OpenSSL in the default location, which is:
-
-  Unix:    normal installation directories under /usr/local
-  OpenVMS: SYS$COMMON:[OPENSSL-'version'...], where 'version' is the
-           OpenSSL version number with underscores instead of periods.
-  Windows: C:\Program Files\OpenSSL or C:\Program Files (x86)\OpenSSL
-
- If you want to install it anywhere else, run config like this:
-
-  On Unix:
-
-    $ ./config --prefix=/opt/openssl --openssldir=/usr/local/ssl
-
-  On OpenVMS:
-
-    $ @config --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
-
- (Note: if you do add options to the configuration command, please make sure
- you've read more than just this Quick Start, such as relevant NOTES.* files,
- the options outline below, as configuration options may change the outcome
- in otherwise unexpected ways)
-
-
- Configuration Options
- ---------------------
-
- There are several options to ./config (or ./Configure) to customize
- the build (note that for Windows, the defaults for --prefix and
- --openssldir depend in what configuration is used and what Windows
- implementation OpenSSL is built on.  More notes on this in NOTES.WIN):
-
-  --api=x.y.z
-                   Don't build with support for deprecated APIs below the
-                   specified version number. For example "--api=1.1.0" will
-                   remove support for all APIS that were deprecated in OpenSSL
-                   version 1.1.0 or below.
-
-  --cross-compile-prefix=PREFIX
-                   The PREFIX to include in front of commands for your
-                   toolchain. It's likely to have to end with dash, e.g.
-                   a-b-c- would invoke GNU compiler as a-b-c-gcc, etc.
-                   Unfortunately cross-compiling is too case-specific to
-                   put together one-size-fits-all instructions. You might
-                   have to pass more flags or set up environment variables
-                   to actually make it work. Android and iOS cases are
-                   discussed in corresponding Configurations/10-main.cf
-                   sections. But there are cases when this option alone is
-                   sufficient. For example to build the mingw64 target on
-                   Linux "--cross-compile-prefix=x86_64-w64-mingw32-"
-                   works. Naturally provided that mingw packages are
-                   installed. Today Debian and Ubuntu users have option to
-                   install a number of prepackaged cross-compilers along
-                   with corresponding run-time and development packages for
-                   "alien" hardware. To give another example
-                   "--cross-compile-prefix=mipsel-linux-gnu-" suffices
-                   in such case. Needless to mention that you have to
-                   invoke ./Configure, not ./config, and pass your target
-                   name explicitly.
-
-  --debug
-                   Build OpenSSL with debugging symbols.
-
-  --libdir=DIR
-                   The name of the directory under the top of the installation
-                   directory tree (see the --prefix option) where libraries will
-                   be installed. By default this is "lib". Note that on Windows
-                   only ".lib" files will be stored in this location. dll files
-                   will always be installed to the "bin" directory.
-
-  --openssldir=DIR
-                   Directory for OpenSSL configuration files, and also the
-                   default certificate and key store.  Defaults are:
-
-                   Unix:           /usr/local/ssl
-                   Windows:        C:\Program Files\Common Files\SSL
-                                or C:\Program Files (x86)\Common Files\SSL
-                   OpenVMS:        SYS$COMMON:[OPENSSL-COMMON]
-
-  --prefix=DIR
-                   The top of the installation directory tree.  Defaults are:
-
-                   Unix:           /usr/local
-                   Windows:        C:\Program Files\OpenSSL
-                                or C:\Program Files (x86)\OpenSSL
-                   OpenVMS:        SYS$COMMON:[OPENSSL-'version']
-
-  --release
-                   Build OpenSSL without debugging symbols. This is the default.
-
-  --strict-warnings
-                   This is a developer flag that switches on various compiler
-                   options recommended for OpenSSL development. It only works
-                   when using gcc or clang as the compiler. If you are
-                   developing a patch for OpenSSL then it is recommended that
-                   you use this option where possible.
-
-  --with-zlib-include=DIR
-                   The directory for the location of the zlib include file. This
-                   option is only necessary if enable-zlib (see below) is used
-                   and the include file is not already on the system include
-                   path.
-
-  --with-zlib-lib=LIB
-                   On Unix: this is the directory containing the zlib library.
-                   If not provided the system library path will be used.
-                   On Windows: this is the filename of the zlib library (with or
-                   without a path). This flag must be provided if the
-                   zlib-dynamic option is not also used. If zlib-dynamic is used
-                   then this flag is optional and a default value ("ZLIB1") is
-                   used if not provided.
-                   On VMS: this is the filename of the zlib library (with or
-                   without a path). This flag is optional and if not provided
-                   then "GNV$LIBZSHR", "GNV$LIBZSHR32" or "GNV$LIBZSHR64" is
-                   used by default depending on the pointer size chosen.
-
-
-  --with-rand-seed=seed1[,seed2,...]
-                   A comma separated list of seeding methods which will be tried
-                   by OpenSSL in order to obtain random input (a.k.a "entropy")
-                   for seeding its cryptographically secure random number
-                   generator (CSPRNG). The current seeding methods are:
-
-                   os:         Use a trusted operating system entropy source.
-                               This is the default method if such an entropy
-                               source exists.
-                   getrandom:  Use the L<getrandom(2)> or equivalent system
-                               call.
-                   devrandom:  Use the the first device from the DEVRANDOM list
-                               which can be opened to read random bytes. The
-                               DEVRANDOM preprocessor constant expands to
-                               "/dev/urandom","/dev/random","/dev/srandom" on
-                               most unix-ish operating systems.
-                   egd:        Check for an entropy generating daemon.
-                   rdcpu:      Use the RDSEED or RDRAND command if provided by
-                               the CPU.
-                   librandom:  Use librandom (not implemented yet).
-                   none:       Disable automatic seeding. This is the default
-                               on some operating systems where no suitable
-                               entropy source exists, or no support for it is
-                               implemented yet.
-
-                   For more information, see the section 'Note on random number
-                   generation' at the end of this document.
-
-  no-afalgeng
-                   Don't build the AFALG engine. This option will be forced if
-                   on a platform that does not support AFALG.
-
-  enable-asan
-                   Build with the Address sanitiser. This is a developer option
-                   only. It may not work on all platforms and should never be
-                   used in production environments. It will only work when used
-                   with gcc or clang and should be used in conjunction with the
-                   no-shared option.
-
-  no-asm
-                   Do not use assembler code. This should be viewed as
-                   debugging/trouble-shooting option rather than production.
-                   On some platforms a small amount of assembler code may
-                   still be used even with this option.
-
-  no-async
-                   Do not build support for async operations.
-
-  no-autoalginit
-                   Don't automatically load all supported ciphers and digests.
-                   Typically OpenSSL will make available all of its supported
-                   ciphers and digests. For a statically linked application this
-                   may be undesirable if small executable size is an objective.
-                   This only affects libcrypto. Ciphers and digests will have to
-                   be loaded manually using EVP_add_cipher() and
-                   EVP_add_digest() if this option is used. This option will
-                   force a non-shared build.
-
-  no-autoerrinit
-                   Don't automatically load all libcrypto/libssl error strings.
-                   Typically OpenSSL will automatically load human readable
-                   error strings. For a statically linked application this may
-                   be undesirable if small executable size is an objective.
-
-  no-autoload-config
-                   Don't automatically load the default openssl.cnf file.
-                   Typically OpenSSL will automatically load a system config
-                   file which configures default ssl options.
-
-  no-capieng
-                   Don't build the CAPI engine. This option will be forced if
-                   on a platform that does not support CAPI.
-
-  no-cms
-                   Don't build support for CMS features
-
-  no-comp
-                   Don't build support for SSL/TLS compression. If this option
-                   is left enabled (the default), then compression will only
-                   work if the zlib or zlib-dynamic options are also chosen.
-
-  enable-crypto-mdebug
-                   Build support for debugging memory allocated via
-                   OPENSSL_malloc() or OPENSSL_zalloc().
-
-  enable-crypto-mdebug-backtrace
-                   As for crypto-mdebug, but additionally provide backtrace
-                   information for allocated memory.
-                   TO BE USED WITH CARE: this uses GNU C functionality, and
-                   is therefore not usable for non-GNU config targets.  If
-                   your build complains about the use of '-rdynamic' or the
-                   lack of header file execinfo.h, this option is not for you.
-                   ALSO NOTE that even though execinfo.h is available on your
-                   system (through Gnulib), the functions might just be stubs
-                   that do nothing.
-
-  no-ct
-                   Don't build support for Certificate Transparency.
-
-  no-deprecated
-                   Don't build with support for any deprecated APIs. This is the
-                   same as using "--api" and supplying the latest version
-                   number.
-
-  no-dgram
-                   Don't build support for datagram based BIOs. Selecting this
-                   option will also force the disabling of DTLS.
-
-  no-dso
-                   Don't build support for loading Dynamic Shared Objects.
-
-  no-dynamic-engine
-                   Don't build the dynamically loaded engines. This only has an
-                   effect in a "shared" build
-
-  no-ec
-                   Don't build support for Elliptic Curves.
-
-  no-ec2m
-                   Don't build support for binary Elliptic Curves
-
-  enable-ec_nistp_64_gcc_128
-                   Enable support for optimised implementations of some commonly
-                   used NIST elliptic curves.
-                   This is only supported on platforms:
-                   - with little-endian storage of non-byte types
-                   - that tolerate misaligned memory references
-                   - where the compiler:
-                     - supports the non-standard type __uint128_t
-                     - defines the built-in macro __SIZEOF_INT128__
-
-  enable-egd
-                   Build support for gathering entropy from EGD (Entropy
-                   Gathering Daemon).
-
-  no-engine
-                   Don't build support for loading engines.
-
-  no-err
-                   Don't compile in any error strings.
-
-  enable-external-tests
-                   Enable building of integration with external test suites.
-                   This is a developer option and may not work on all platforms.
-                   The only supported external test suite at the current time is
-                   the BoringSSL test suite. See the file test/README.external
-                   for further details.
-
-  no-filenames
-                   Don't compile in filename and line number information (e.g.
-                   for errors and memory allocation).
-
-  enable-fuzz-libfuzzer, enable-fuzz-afl
-                   Build with support for fuzzing using either libfuzzer or AFL.
-                   These are developer options only. They may not work on all
-                   platforms and should never be used in production environments.
-                   See the file fuzz/README.md for further details.
-
-  no-gost
-                   Don't build support for GOST based ciphersuites. Note that
-                   if this feature is enabled then GOST ciphersuites are only
-                   available if the GOST algorithms are also available through
-                   loading an externally supplied engine.
-
-  no-hw-padlock
-                   Don't build the padlock engine.
-
-  no-makedepend
-                   Don't generate dependencies.
-
-  no-multiblock
-                   Don't build support for writing multiple records in one
-                   go in libssl (Note: this is a different capability to the
-                   pipelining functionality).
-
-  no-nextprotoneg
-                   Don't build support for the NPN TLS extension.
-
-  no-ocsp
-                   Don't build support for OCSP.
-
-  no-pic
-                   Don't build with support for Position Independent Code.
-
-  no-posix-io
-                   Don't use POSIX IO capabilities.
-
-  no-psk
-                   Don't build support for Pre-Shared Key based ciphersuites.
-
-  no-rdrand
-                   Don't use hardware RDRAND capabilities.
-
-  no-rfc3779
-                   Don't build support for RFC3779 ("X.509 Extensions for IP
-                   Addresses and AS Identifiers")
-
-  sctp
-                   Build support for SCTP
-
-  no-shared
-                   Do not create shared libraries, only static ones.  See "Note
-                   on shared libraries" below.
-
-  no-sock
-                   Don't build support for socket BIOs
-
-  no-srp
-                   Don't build support for SRP or SRP based ciphersuites.
-
-  no-srtp
-                   Don't build SRTP support
-
-  no-sse2
-                   Exclude SSE2 code paths from 32-bit x86 assembly modules.
-                   Normally SSE2 extension is detected at run-time, but the
-                   decision whether or not the machine code will be executed
-                   is taken solely on CPU capability vector. This means that
-                   if you happen to run OS kernel which does not support SSE2
-                   extension on Intel P4 processor, then your application
-                   might be exposed to "illegal instruction" exception.
-                   There might be a way to enable support in kernel, e.g.
-                   FreeBSD kernel can  be compiled with CPU_ENABLE_SSE, and
-                   there is a way to disengage SSE2 code paths upon application
-                   start-up, but if you aim for wider "audience" running
-                   such kernel, consider no-sse2. Both the 386 and
-                   no-asm options imply no-sse2.
-
-  enable-ssl-trace
-                   Build with the SSL Trace capabilities (adds the "-trace"
-                   option to s_client and s_server).
-
-  no-static-engine
-                   Don't build the statically linked engines. This only
-                   has an impact when not built "shared".
-
-  no-stdio
-                   Don't use anything from the C header file "stdio.h" that
-                   makes use of the "FILE" type. Only libcrypto and libssl can
-                   be built in this way. Using this option will suppress
-                   building the command line applications. Additionally since
-                   the OpenSSL tests also use the command line applications the
-                   tests will also be skipped.
-
-  no-tests
-                   Don't build test programs or run any test.
-
-  no-threads
-                   Don't try to build with support for multi-threaded
-                   applications.
-
-  threads
-                   Build with support for multi-threaded applications. Most
-                   platforms will enable this by default. However if on a
-                   platform where this is not the case then this will usually
-                   require additional system-dependent options! See "Note on
-                   multi-threading" below.
-
-  enable-tls13downgrade
-                   TODO(TLS1.3): Make this enabled by default and remove the
-                   option when TLSv1.3 is out of draft
-                   TLSv1.3 offers a downgrade protection mechanism. This is
-                   implemented but disabled by default. It should not typically
-                   be enabled except for testing purposes. Otherwise this could
-                   cause problems if a pre-RFC version of OpenSSL talks to an
-                   RFC implementation (it will erroneously be detected as a
-                   downgrade).
-
-  no-ts
-                   Don't build Time Stamping Authority support.
-
-  enable-ubsan
-                   Build with the Undefined Behaviour sanitiser. This is a
-                   developer option only. It may not work on all platforms and
-                   should never be used in production environments. It will only
-                   work when used with gcc or clang and should be used in
-                   conjunction with the "-DPEDANTIC" option (or the
-                   --strict-warnings option).
-
-  no-ui
-                   Don't build with the "UI" capability (i.e. the set of
-                   features enabling text based prompts).
-
-  enable-unit-test
-                   Enable additional unit test APIs. This should not typically
-                   be used in production deployments.
-
-  enable-weak-ssl-ciphers
-                   Build support for SSL/TLS ciphers that are considered "weak"
-                   (e.g. RC4 based ciphersuites).
-
-  zlib
-                   Build with support for zlib compression/decompression.
-
-  zlib-dynamic
-                   Like "zlib", but has OpenSSL load the zlib library
-                   dynamically when needed.  This is only supported on systems
-                   where loading of shared libraries is supported.
-
-  386
-                   In 32-bit x86 builds, when generating assembly modules,
-                   use the 80386 instruction set only (the default x86 code
-                   is more efficient, but requires at least a 486). Note:
-                   This doesn't affect code generated by compiler, you're
-                   likely to complement configuration command line with
-                   suitable compiler-specific option.
-
-  no-<prot>
-                   Don't build support for negotiating the specified SSL/TLS
-                   protocol (one of ssl, ssl3, tls, tls1, tls1_1, tls1_2,
-                   tls1_3, dtls, dtls1 or dtls1_2). If "no-tls" is selected then
-                   all of tls1, tls1_1, tls1_2 and tls1_3 are disabled.
-                   Similarly "no-dtls" will disable dtls1 and dtls1_2. The
-                   "no-ssl" option is synonymous with "no-ssl3". Note this only
-                   affects version negotiation. OpenSSL will still provide the
-                   methods for applications to explicitly select the individual
-                   protocol versions.
-
-  no-<prot>-method
-                   As for no-<prot> but in addition do not build the methods for
-                   applications to explicitly select individual protocol
-                   versions. Note that there is no "no-tls1_3-method" option
-                   because there is no application method for TLSv1.3. Using
-                   individual protocol methods directly is deprecated.
-                   Applications should use TLS_method() instead.
-
-  enable-<alg>
-                   Build with support for the specified algorithm, where <alg>
-                   is one of: md2 or rc5.
-
-  no-<alg>
-                   Build without support for the specified algorithm, where
-                   <alg> is one of: aria, bf, blake2, camellia, cast, chacha,
-                   cmac, des, dh, dsa, ecdh, ecdsa, idea, md4, mdc2, ocb,
-                   poly1305, rc2, rc4, rmd160, scrypt, seed, siphash, sm2, sm3,
-                   sm4 or whirlpool.  The "ripemd" algorithm is deprecated and
-                   if used is synonymous with rmd160.
-
-  -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
-                   These system specific options will be recognised and
-                   passed through to the compiler to allow you to define
-                   preprocessor symbols, specify additional libraries, library
-                   directories or other compiler options. It might be worth
-                   noting that some compilers generate code specifically for
-                   processor the compiler currently executes on. This is not
-                   necessarily what you might have in mind, since it might be
-                   unsuitable for execution on other, typically older,
-                   processor. Consult your compiler documentation.
-
-                   Take note of the VAR=value documentation below and how
-                   these flags interact with those variables.
-
-  -xxx, +xxx
-                   Additional options that are not otherwise recognised are
-                   passed through as they are to the compiler as well.  Again,
-                   consult your compiler documentation.
-
-                   Take note of the VAR=value documentation below and how
-                   these flags interact with those variables.
-
-  VAR=value
-                   Assignment of environment variable for Configure.  These
-                   work just like normal environment variable assignments,
-                   but are supported on all platforms and are confined to
-                   the configuration scripts only.  These assignments override
-                   the corresponding value in the inherited environment, if
-                   there is one.
-
-                   The following variables are used as "make variables" and
-                   can be used as an alternative to giving preprocessor,
-                   compiler and linker options directly as configuration.
-                   The following variables are supported:
-
-                   AR              The static library archiver.
-                   ARFLAGS         Flags for the static library archiver.
-                   AS              The assembler compiler.
-                   ASFLAGS         Flags for the assembler compiler.
-                   CC              The C compiler.
-                   CFLAGS          Flags for the C compiler.
-                   CXX             The C++ compiler.
-                   CXXFLAGS        Flags for the C++ compiler.
-                   CPP             The C/C++ preprocessor.
-                   CPPFLAGS        Flags for the C/C++ preprocessor.
-                   CPPDEFINES      List of CPP macro definitions, separated
-                                   by a platform specific character (':' or
-                                   space for Unix, ';' for Windows, ',' for
-                                   VMS).  This can be used instead of using
-                                   -D (or what corresponds to that on your
-                                   compiler) in CPPFLAGS.
-                   CPPINCLUDES     List of CPP inclusion directories, separated
-                                   the same way as for CPPDEFINES.  This can
-                                   be used instead of -I (or what corresponds
-                                   to that on your compiler) in CPPFLAGS.
-                   HASHBANGPERL    Perl invocation to be inserted after '#!'
-                                   in public perl scripts (only relevant on
-                                   Unix).
-                   LD              The program linker (not used on Unix, $(CC)
-                                   is used there).
-                   LDFLAGS         Flags for the shared library, DSO and
-                                   program linker.
-                   LDLIBS          Extra libraries to use when linking.
-                                   Takes the form of a space separated list
-                                   of library specifications on Unix and
-                                   Windows, and as a comma separated list of
-                                   libraries on VMS.
-                   RANLIB          The library archive indexer.
-                   RC              The Windows resources manipulator.
-                   RCFLAGS         Flags for the Windows reources manipulator.
-                   RM              The command to remove files and directories.
-
-                   These cannot be mixed with compiling / linking flags given
-                   on the command line.  In other words, something like this
-                   isn't permitted.
-
-                       ./config -DFOO CPPFLAGS=-DBAR -DCOOKIE
-
-                   Backward compatibility note:
-
-                   To be compatible with older configuration scripts, the
-                   environment variables are ignored if compiling / linking
-                   flags are given on the command line, except for these:
-
-                   AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC
-                   and WINDRES
-
-                   For example, the following command will not see -DBAR:
-
-                        CPPFLAGS=-DBAR ./config -DCOOKIE
-
-                   However, the following will see both set variables:
-
-                        CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- \
-                        ./config -DCOOKIE
-
-  reconf
-  reconfigure
-                   Reconfigure from earlier data.  This fetches the previous
-                   command line options and environment from data saved in
-                   "configdata.pm", and runs the configuration process again,
-                   using these options and environment.
-                   Note: NO other option is permitted together with "reconf".
-                   This means that you also MUST use "./Configure" (or
-                   what corresponds to that on non-Unix platforms) directly
-                   to invoke this option.
-                   Note: The original configuration saves away values for ALL
-                   environment variables that were used, and if they weren't
-                   defined, they are still saved away with information that
-                   they weren't originally defined.  This information takes
-                   precedence over environment variables that are defined
-                   when reconfiguring.
-
- Displaying configuration data
- -----------------------------
-
- The configuration script itself will say very little, and finishes by
- creating "configdata.pm".  This perl module can be loaded by other scripts
- to find all the configuration data, and it can also be used as a script to
- display all sorts of configuration data in a human readable form.
-
- For more information, please do:
-
-       $ ./configdata.pm --help                         # Unix
-
-       or
-
-       $ perl configdata.pm --help                      # Windows and VMS
-
- Installation in Detail
- ----------------------
-
- 1a. Configure OpenSSL for your operation system automatically:
-
-     NOTE: This is not available on Windows.
-
-       $ ./config [[ options ]]                         # Unix
-
-       or
-
-       $ @config [[ options ]]                          ! OpenVMS
-
-     For the remainder of this text, the Unix form will be used in all
-     examples, please use the appropriate form for your platform.
-
-     This guesses at your operating system (and compiler, if necessary) and
-     configures OpenSSL based on this guess. Run ./config -t to see
-     if it guessed correctly. If you want to use a different compiler, you
-     are cross-compiling for another platform, or the ./config guess was
-     wrong for other reasons, go to step 1b. Otherwise go to step 2.
-
-     On some systems, you can include debugging information as follows:
-
-       $ ./config -d [[ options ]]
-
- 1b. Configure OpenSSL for your operating system manually
-
-     OpenSSL knows about a range of different operating system, hardware and
-     compiler combinations. To see the ones it knows about, run
-
-       $ ./Configure                                    # Unix
-
-       or
-
-       $ perl Configure                                 # All other platforms
-
-     For the remainder of this text, the Unix form will be used in all
-     examples, please use the appropriate form for your platform.
-
-     Pick a suitable name from the list that matches your system. For most
-     operating systems there is a choice between using "cc" or "gcc".  When
-     you have identified your system (and if necessary compiler) use this name
-     as the argument to Configure. For example, a "linux-elf" user would
-     run:
-
-       $ ./Configure linux-elf [[ options ]]
-
-     If your system isn't listed, you will have to create a configuration
-     file named Configurations/{{ something }}.conf and add the correct
-     configuration for your system. See the available configs as examples
-     and read Configurations/README and Configurations/README.design for
-     more information.
-
-     The generic configurations "cc" or "gcc" should usually work on 32 bit
-     Unix-like systems.
-
-     Configure creates a build file ("Makefile" on Unix, "makefile" on Windows
-     and "descrip.mms" on OpenVMS) from a suitable template in Configurations,
-     and defines various macros in include/openssl/opensslconf.h (generated from
-     include/openssl/opensslconf.h.in).
-
- 1c. Configure OpenSSL for building outside of the source tree.
-
-     OpenSSL can be configured to build in a build directory separate from
-     the directory with the source code.  It's done by placing yourself in
-     some other directory and invoking the configuration commands from
-     there.
-
-     Unix example:
-
-       $ mkdir /var/tmp/openssl-build
-       $ cd /var/tmp/openssl-build
-       $ /PATH/TO/OPENSSL/SOURCE/config [[ options ]]
-
-       or
-
-       $ /PATH/TO/OPENSSL/SOURCE/Configure {{ target }} [[ options ]]
-
-     OpenVMS example:
-
-       $ set default sys$login:
-       $ create/dir [.tmp.openssl-build]
-       $ set default [.tmp.openssl-build]
-       $ @[PATH.TO.OPENSSL.SOURCE]config [[ options ]]
-
-       or
-
-       $ @[PATH.TO.OPENSSL.SOURCE]Configure {{ target }} [[ options ]]
-
-     Windows example:
-
-       $ C:
-       $ mkdir \temp-openssl
-       $ cd \temp-openssl
-       $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure {{ target }} [[ options ]]
-
-     Paths can be relative just as well as absolute.  Configure will
-     do its best to translate them to relative paths whenever possible.
-
-  2. Build OpenSSL by running:
-
-       $ make                                           # Unix
-       $ mms                                            ! (or mmk) OpenVMS
-       $ nmake                                          # Windows
-
-     This will build the OpenSSL libraries (libcrypto.a and libssl.a on
-     Unix, corresponding on other platforms) and the OpenSSL binary
-     ("openssl"). The libraries will be built in the top-level directory,
-     and the binary will be in the "apps" subdirectory.
-
-     Troubleshooting:
-
-     If the build fails, look at the output.  There may be reasons
-     for the failure that aren't problems in OpenSSL itself (like
-     missing standard headers).
-
-     If the build succeeded previously, but fails after a source or
-     configuration change, it might be helpful to clean the build tree
-     before attempting another build. Use this command:
-
-       $ make clean                                     # Unix
-       $ mms clean                                      ! (or mmk) OpenVMS
-       $ nmake clean                                    # Windows
-
-     Assembler error messages can sometimes be sidestepped by using the
-     "no-asm" configuration option.
-
-     Compiling parts of OpenSSL with gcc and others with the system
-     compiler will result in unresolved symbols on some systems.
-
-     If you are still having problems you can get help by sending an email
-     to the openssl-users email list (see
-     https://www.openssl.org/community/mailinglists.html for details). If
-     it is a bug with OpenSSL itself, please open an issue on GitHub, at
-     https://github.com/openssl/openssl/issues. Please review the existing
-     ones first; maybe the bug was already reported or has already been
-     fixed.
-
-  3. After a successful build, the libraries should be tested. Run:
-
-       $ make test                                      # Unix
-       $ mms test                                       ! OpenVMS
-       $ nmake test                                     # Windows
-
-     NOTE: you MUST run the tests from an unprivileged account (or
-     disable your privileges temporarily if your platform allows it).
-
-     If some tests fail, look at the output.  There may be reasons for
-     the failure that isn't a problem in OpenSSL itself (like a
-     malfunction with Perl).  You may want increased verbosity, that
-     can be accomplished like this:
-
-       $ make VERBOSE=1 test                            # Unix
-
-       $ mms /macro=(VERBOSE=1) test                    ! OpenVMS
-
-       $ nmake VERBOSE=1 test                           # Windows
-
-     If you want to run just one or a few specific tests, you can use
-     the make variable TESTS to specify them, like this:
-
-       $ make TESTS='test_rsa test_dsa' test            # Unix
-       $ mms/macro="TESTS=test_rsa test_dsa" test       ! OpenVMS
-       $ nmake TESTS='test_rsa test_dsa' test           # Windows
-
-     And of course, you can combine (Unix example shown):
-
-       $ make VERBOSE=1 TESTS='test_rsa test_dsa' test
-
-     You can find the list of available tests like this:
-
-       $ make list-tests                                # Unix
-       $ mms list-tests                                 ! OpenVMS
-       $ nmake list-tests                               # Windows
-
-     Have a look at the manual for the perl module Test::Harness to
-     see what other HARNESS_* variables there are.
-
-     If you find a problem with OpenSSL itself, try removing any
-     compiler optimization flags from the CFLAGS line in Makefile and
-     run "make clean; make" or corresponding.
-
-     To report a bug please open an issue on GitHub, at
-     https://github.com/openssl/openssl/issues.
-
-     For more details on how the make variables TESTS can be used,
-     see section TESTS in Detail below.
-
-  4. If everything tests ok, install OpenSSL with
-
-       $ make install                                   # Unix
-       $ mms install                                    ! OpenVMS
-       $ nmake install                                  # Windows
-
-     This will install all the software components in this directory
-     tree under PREFIX (the directory given with --prefix or its
-     default):
-
-       Unix:
-
-         bin/           Contains the openssl binary and a few other
-                        utility scripts.
-         include/openssl
-                        Contains the header files needed if you want
-                        to build your own programs that use libcrypto
-                        or libssl.
-         lib            Contains the OpenSSL library files.
-         lib/engines    Contains the OpenSSL dynamically loadable engines.
-
-         share/man/man1 Contains the OpenSSL command line man-pages.
-         share/man/man3 Contains the OpenSSL library calls man-pages.
-         share/man/man5 Contains the OpenSSL configuration format man-pages.
-         share/man/man7 Contains the OpenSSL other misc man-pages.
-
-         share/doc/openssl/html/man1
-         share/doc/openssl/html/man3
-         share/doc/openssl/html/man5
-         share/doc/openssl/html/man7
-                        Contains the HTML rendition of the man-pages.
-
-       OpenVMS ('arch' is replaced with the architecture name, "Alpha"
-       or "ia64", 'sover' is replaced with the shared library version
-       (0101 for 1.1), and 'pz' is replaced with the pointer size
-       OpenSSL was built with):
-
-         [.EXE.'arch']  Contains the openssl binary.
-         [.EXE]         Contains a few utility scripts.
-         [.include.openssl]
-                        Contains the header files needed if you want
-                        to build your own programs that use libcrypto
-                        or libssl.
-         [.LIB.'arch']  Contains the OpenSSL library files.
-         [.ENGINES'sover''pz'.'arch']
-                        Contains the OpenSSL dynamically loadable engines.
-         [.SYS$STARTUP] Contains startup, login and shutdown scripts.
-                        These define appropriate logical names and
-                        command symbols.
-         [.SYSTEST]     Contains the installation verification procedure.
-         [.HTML]        Contains the HTML rendition of the manual pages.
-
-
-     Additionally, install will add the following directories under
-     OPENSSLDIR (the directory given with --openssldir or its default)
-     for you convenience:
-
-         certs          Initially empty, this is the default location
-                        for certificate files.
-         private        Initially empty, this is the default location
-                        for private key files.
-         misc           Various scripts.
-
-     Package builders who want to configure the library for standard
-     locations, but have the package installed somewhere else so that
-     it can easily be packaged, can use
-
-       $ make DESTDIR=/tmp/package-root install         # Unix
-       $ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS
-
-     The specified destination directory will be prepended to all
-     installation target paths.
-
-  Compatibility issues with previous OpenSSL versions:
-
-  *  COMPILING existing applications
-
-     OpenSSL 1.1.0 hides a number of structures that were previously
-     open.  This includes all internal libssl structures and a number
-     of EVP types.  Accessor functions have been added to allow
-     controlled access to the structures' data.
-
-     This means that some software needs to be rewritten to adapt to
-     the new ways of doing things.  This often amounts to allocating
-     an instance of a structure explicitly where you could previously
-     allocate them on the stack as automatic variables, and using the
-     provided accessor functions where you would previously access a
-     structure's field directly.
-
-     Some APIs have changed as well.  However, older APIs have been
-     preserved when possible.
-
- Environment Variables
- ---------------------
-
- A number of environment variables can be used to provide additional control
- over the build process. Typically these should be defined prior to running
- config or Configure. Not all environment variables are relevant to all
- platforms.
-
- AR
-                The name of the ar executable to use.
-
- BUILDFILE
-                Use a different build file name than the platform default
-                ("Makefile" on Unixly platforms, "makefile" on native Windows,
-                "descrip.mms" on OpenVMS).  This requires that there is a
-                corresponding build file template.  See Configurations/README
-                for further information.
-
- CC
-                The compiler to use. Configure will attempt to pick a default
-                compiler for your platform but this choice can be overridden
-                using this variable. Set it to the compiler executable you wish
-                to use, e.g. "gcc" or "clang".
-
- CROSS_COMPILE
-                This environment variable has the same meaning as for the
-                "--cross-compile-prefix" Configure flag described above. If both
-                are set then the Configure flag takes precedence.
-
- NM
-                The name of the nm executable to use.
-
- OPENSSL_LOCAL_CONFIG_DIR
-                OpenSSL comes with a database of information about how it
-                should be built on different platforms as well as build file
-                templates for those platforms. The database is comprised of
-                ".conf" files in the Configurations directory.  The build
-                file templates reside there as well as ".tmpl" files. See the
-                file Configurations/README for further information about the
-                format of ".conf" files as well as information on the ".tmpl"
-                files.
-                In addition to the standard ".conf" and ".tmpl" files, it is
-                possible to create your own ".conf" and ".tmpl" files and store
-                them locally, outside the OpenSSL source tree. This environment
-                variable can be set to the directory where these files are held
-                and will be considered by Configure before it looks in the
-                standard directories.
-
- PERL
-                The name of the Perl executable to use when building OpenSSL.
-                This variable is used in config script only. Configure on the
-                other hand imposes the interpreter by which it itself was
-                executed on the whole build procedure.
-
- HASHBANGPERL
-                The command string for the Perl executable to insert in the
-                #! line of perl scripts that will be publically installed.
-                Default: /usr/bin/env perl
-                Note: the value of this variable is added to the same scripts
-                on all platforms, but it's only relevant on Unix-like platforms.
-
- RC
-                The name of the rc executable to use. The default will be as
-                defined for the target platform in the ".conf" file. If not
-                defined then "windres" will be used. The WINDRES environment
-                variable is synonymous to this. If both are defined then RC
-                takes precedence.
-
- RANLIB
-                The name of the ranlib executable to use.
-
- WINDRES
-                See RC.
-
- Makefile targets
- ----------------
-
- The Configure script generates a Makefile in a format relevant to the specific
- platform. The Makefiles provide a number of targets that can be used. Not all
- targets may be available on all platforms. Only the most common targets are
- described here. Examine the Makefiles themselves for the full list.
-
- all
-                The default target to build all the software components.
-
- clean
-                Remove all build artefacts and return the directory to a "clean"
-                state.
-
- depend
-                Rebuild the dependencies in the Makefiles. This is a legacy
-                option that no longer needs to be used in OpenSSL 1.1.0.
-
- install
-                Install all OpenSSL components.
-
- install_sw
-                Only install the OpenSSL software components.
-
- install_docs
-                Only install the OpenSSL documentation components.
-
- install_man_docs
-                Only install the OpenSSL man pages (Unix only).
-
- install_html_docs
-                Only install the OpenSSL html documentation.
-
- list-tests
-                Prints a list of all the self test names.
-
- test
-                Build and run the OpenSSL self tests.
-
- uninstall
-                Uninstall all OpenSSL components.
-
- reconfigure
- reconf
-                Re-run the configuration process, as exactly as the last time
-                as possible.
-
- update
-                This is a developer option. If you are developing a patch for
-                OpenSSL you may need to use this if you want to update
-                automatically generated files; add new error codes or add new
-                (or change the visibility of) public API functions. (Unix only).
-
- TESTS in Detail
- ---------------
-
- The make variable TESTS supports a versatile set of space separated tokens
- with which you can specify a set of tests to be performed.  With a "current
- set of tests" in mind, initially being empty, here are the possible tokens:
-
- alltests       The current set of tests becomes the whole set of available
-                tests (as listed when you do 'make list-tests' or similar).
- xxx            Adds the test 'xxx' to the current set of tests.
- -xxx           Removes 'xxx' from the current set of tests.  If this is the
-                first token in the list, the current set of tests is first
-                assigned the whole set of available tests, effectively making
-                this token equivalent to TESTS="alltests -xxx".
- nn             Adds the test group 'nn' (which is a number) to the current
-                set of tests.
- -nn            Removes the test group 'nn' from the current set of tests.
-                If this is the first token in the list, the current set of
-                tests is first assigned the whole set of available tests,
-                effectively making this token equivalent to
-                TESTS="alltests -xxx".
-
- Also, all tokens except for "alltests" may have wildcards, such as *.
- (on Unix and Windows, BSD style wildcards are supported, while on VMS,
- it's VMS style wildcards)
-
- Example: All tests except for the fuzz tests:
-
- $ make TESTS=-test_fuzz test
-
- or (if you want to be explicit)
-
- $ make TESTS='alltests -test_fuzz' test
-
- Example: All tests that have a name starting with "test_ssl" but not those
- starting with "test_ssl_":
-
- $ make TESTS='test_ssl* -test_ssl_*' test
-
- Example: Only test group 10:
-
- $ make TESTS='10'
-
- Example: All tests except the slow group (group 99):
-
- $ make TESTS='-99'
-
- Example: All tests in test groups 80 to 99 except for tests in group 90:
-
- $ make TESTS='[89]? -90'
-
- Note on multi-threading
- -----------------------
-
- For some systems, the OpenSSL Configure script knows what compiler options
- are needed to generate a library that is suitable for multi-threaded
- applications.  On these systems, support for multi-threading is enabled
- by default; use the "no-threads" option to disable (this should never be
- necessary).
-
- On other systems, to enable support for multi-threading, you will have
- to specify at least two options: "threads", and a system-dependent option.
- (The latter is "-D_REENTRANT" on various systems.)  The default in this
- case, obviously, is not to include support for multi-threading (but
- you can still use "no-threads" to suppress an annoying warning message
- from the Configure script.)
-
- OpenSSL provides built-in support for two threading models: pthreads (found on
- most UNIX/Linux systems), and Windows threads. No other threading models are
- supported. If your platform does not provide pthreads or Windows threads then
- you should Configure with the "no-threads" option.
-
- Notes on shared libraries
- -------------------------
-
- For most systems the OpenSSL Configure script knows what is needed to
- build shared libraries for libcrypto and libssl. On these systems
- the shared libraries will be created by default. This can be suppressed and
- only static libraries created by using the "no-shared" option. On systems
- where OpenSSL does not know how to build shared libraries the "no-shared"
- option will be forced and only static libraries will be created.
-
- Shared libraries are named a little differently on different platforms.
- One way or another, they all have the major OpenSSL version number as
- part of the file name, i.e. for OpenSSL 1.1.x, 1.1 is somehow part of
- the name.
-
- On most POSIXly platforms, shared libraries are named libcrypto.so.1.1
- and libssl.so.1.1.
-
- on Cygwin, shared libraries are named cygcrypto-1.1.dll and cygssl-1.1.dll
- with import libraries libcrypto.dll.a and libssl.dll.a.
-
- On Windows build with MSVC or using MingW, shared libraries are named
- libcrypto-1_1.dll and libssl-1_1.dll for 32-bit Windows, libcrypto-1_1-x64.dll
- and libssl-1_1-x64.dll for 64-bit x86_64 Windows, and libcrypto-1_1-ia64.dll
- and libssl-1_1-ia64.dll for IA64 Windows.  With MSVC, the import libraries
- are named libcrypto.lib and libssl.lib, while with MingW, they are named
- libcrypto.dll.a and libssl.dll.a.
-
- On VMS, shareable images (VMS speak for shared libraries) are named
- ossl$libcrypto0101_shr.exe and ossl$libssl0101_shr.exe.  However, when
- OpenSSL is specifically built for 32-bit pointers, the shareable images
- are named ossl$libcrypto0101_shr32.exe and ossl$libssl0101_shr32.exe
- instead, and when built for 64-bit pointers, they are named
- ossl$libcrypto0101_shr64.exe and ossl$libssl0101_shr64.exe.
-
- Note on random number generation
- --------------------------------
-
- Availability of cryptographically secure random numbers is required for
- secret key generation. OpenSSL provides several options to seed the
- internal CSPRNG. If not properly seeded, the internal CSPRNG will refuse
- to deliver random bytes and a "PRNG not seeded error" will occur.
-
- The seeding method can be configured using the --with-rand-seed option,
- which can be used to specify a comma separated list of seed methods.
- However in most cases OpenSSL will choose a suitable default method,
- so it is not necessary to explicitely provide this option. Note also
- that not all methods are available on all platforms.
-
- I) On operating systems which provide a suitable randomness source (in
- form  of a system call or system device), OpenSSL will use the optimal
- available  method to seed the CSPRNG from the operating system's
- randomness sources. This corresponds to the option --with-rand-seed=os.
-
- II) On systems without such a suitable randomness source, automatic seeding
- and reseeding is disabled (--with-rand-seed=none) and it may be necessary
- to install additional support software to obtain a random seed and reseed
- the CSPRNG manually.  Please check out the manual pages for RAND_add(),
- RAND_bytes(), RAND_egd(), and the FAQ for more information.

INSTALL.md

@@ -0,0 +1,1795 @@
+Build and Install
+=================
+
+This document describes installation on all supported operating
+systems (the Unix/Linux family, including macOS), OpenVMS,
+and Windows).
+
+Table of Contents
+=================
+
+ - [Prerequisites](#prerequisites)
+ - [Notational Conventions](#notational-conventions)
+ - [Quick Installation Guide](#quick-installation-guide)
+   - [Building OpenSSL](#building-openssl)
+   - [Installing OpenSSL](#installing-openssl)
+ - [Configuration Options](#configuration-options)
+   - [API Level](#api-level)
+   - [Cross Compile Prefix](#cross-compile-prefix)
+   - [Build Type](#build-type)
+   - [Directories](#directories)
+   - [Compiler Warnings](#compiler-warnings)
+   - [ZLib Flags](#zlib-flags)
+   - [Seeding the Random Generator](#seeding-the-random-generator)
+   - [Enable and Disable Features](#enable-and-disable-features)
+   - [Displaying configuration data](#displaying-configuration-data)
+ - [Installation Steps in Detail](#installation-steps-in-detail)
+   - [Configure](#configure-openssl)
+   - [Build](#build-openssl)
+   - [Test](#test-openssl)
+   - [Install](#install-openssl)
+ - [Advanced Build Options](#advanced-build-options)
+   - [Environment Variables](#environment-variables)
+   - [Makefile Targets](#makefile-targets)
+   - [Running Selected Tests](#running-selected-tests)
+ - [Troubleshooting](#troubleshooting)
+   - [Configuration Problems](#configuration-problems)
+   - [Build Failures](#build-failures)
+   - [Test Failures](#test-failures)
+ - [Notes](#notes)
+   - [Notes on multi-threading](#notes-on-multi-threading)
+   - [Notes on shared libraries](#notes-on-shared-libraries)
+   - [Notes on random number generation](#notes-on-random-number-generation)
+
+Prerequisites
+=============
+
+To install OpenSSL, you will need:
+
+ * A make implementation
+ * Perl 5 with core modules (please read [NOTES.PERL](NOTES.PERL))
+ * The Perl module Text::Template (please read [NOTES.PERL](NOTES.PERL))
+ * an ANSI C compiler
+ * a development environment in the form of development libraries and C
+   header files
+ * a supported operating system
+
+For additional platform specific requirements, solutions to specific
+issues and other details, please read one of these:
+
+ * [NOTES.UNIX](NOTES.UNIX) - notes for Unix like systems
+ * [NOTES.VMS](NOTES.VMS) - notes related to OpenVMS
+ * [NOTES.WIN](NOTES.WIN) - notes related to the Windows platform
+ * [NOTES.DJGPP](NOTES.DJGPP) - building for DOS with DJGPP
+ * [NOTES.ANDROID](NOTES.ANDROID) - building for Android platforms (using NDK)
+ * [NOTES.VALGRIND](NOTES.VALGRIND) - testing with Valgrind
+ * [NOTES.PERL](NOTES.PERL) - some notes on Perl
+
+Notational conventions
+======================
+
+Throughout this document, we use the following conventions.
+
+Commands
+--------
+
+Any line starting with a dollar sign is a command line.
+
+    $ command
+
+The dollar sign indicates the shell prompt and is not to be entered as
+part of the command.
+
+Choices
+-------
+
+Several words in curly braces separated by pipe characters indicate a
+**mandatory choice**, to be replaced with one of the given words.
+For example, the line
+
+    $ echo { WORD1 | WORD2 | WORD3 }
+
+represents one of the following three commands
+
+    $ echo WORD1
+    - or -
+    $ echo WORD2
+    - or -
+    $ echo WORD3
+
+One or several words in square brackets separated by pipe characters
+denote an **optional choice**.  It is similar to the mandatory choice,
+but it can also be omitted entirely.
+
+So the line
+
+    $ echo [ WORD1 | WORD2 | WORD3 ]
+
+represents one of the four commands
+
+    $ echo WORD1
+    - or -
+    $ echo WORD2
+    - or -
+    $ echo WORD3
+    - or -
+    $ echo
+
+Arguments
+---------
+
+**Mandatory arguments** are enclosed in double curly braces.
+A simple example would be
+
+    $ type {{ filename }}
+
+which is to be understood to use the command `type` on some file name
+determined by the user.
+
+**Optional Arguments** are enclosed in double square brackets.
+
+    [[ options ]]
+
+Note that the notation assumes spaces around {, }, [, ], {{, }} and
+[[, ]].  This is to differentiate from OpenVMS directory
+specifications, which also use [ and ], but without spaces.
+
+Quick Installation Guide
+========================
+
+If you just want to get OpenSSL installed without bothering too much
+about the details, here is the short version of how to build and install
+OpenSSL.  If any of the following steps fails, please consult the
+[Installation in Detail](#installation-in-detail) section below.
+
+Building OpenSSL
+----------------
+
+Use the following commands to configure, build and test OpenSSL.
+The testing is optional, but recommended if you intend to install
+OpenSSL for production use.
+
+### Unix / Linux / macOS
+
+    $ ./config
+    $ make
+    $ make test
+
+### OpenVMS
+
+Use the following commands to build OpenSSL:
+
+    $ @config
+    $ mms
+    $ mms test
+
+### Windows
+
+If you are using Visual Studio, open a Developer Command Prompt and
+and issue the following commands to build OpenSSL.
+
+    $ perl Configure { VC-WIN32 | VC-WIN64A | VC-WIN64I | VC-CE }
+    $ nmake
+    $ nmake test
+
+As mentioned in the [Choices](#choices) section, you need to pick one
+of the four Configure targets in the first command.
+
+Most likely you will be using the VC-WIN64A target for 64bit Windows
+binaries (AMD64) or VC-WIN32 for 32bit Windows binaries (X86).
+The other two options are VC_WIN64I (Intel IA64, Itanium) and
+VC-CE (Windows CE) are rather uncommon nowadays.
+
+Installing OpenSSL
+------------------
+
+The following commands will install OpenSSL to a default system location.
+
+**Danger Zone:** even if you are impatient, please read the following two
+paragraphs carefully before you install OpenSSL.
+
+For security reasons the default system location is by default not writable
+for unprivileged users.  So for the final installation step administrative
+privileges are required.  The default system location and the procedure to
+obtain administrative privileges depends on the operating sytem.
+It is recommended to compile and test OpenSSL with normal user privileges
+and use administrative privileges only for the final installation step.
+
+On some platforms OpenSSL is preinstalled as part of the Operating System.
+In this case it is highly recommended not to overwrite the system versions,
+because other applications or libraries might depend on it.
+To avoid breaking other applications, install your copy of OpenSSL to a
+[different location](#installing-to-a-different-location) which is not in
+the global search path for system libraries.
+
+Finally, if you plan on using the FIPS module, you need to read the
+[Post-installation Notes](#post-installation-notes) further down.
+
+### Unix / Linux / macOS
+
+Depending on your distribution, you need to run the following command as
+root user or prepend `sudo` to the command:
+
+    $ make install
+
+By default, OpenSSL will be installed to
+
+    /usr/local
+
+More precisely, the files will be installed into the  subdirectories
+
+    /usr/local/bin
+    /usr/local/lib
+    /usr/local/include
+    ...
+
+depending on the file type, as it is custom on Unix-like operating systems.
+
+### OpenVMS
+
+Use the following command to install OpenSSL.
+
+    $ mms install
+
+By default, OpenSSL will be installed to
+
+    SYS$COMMON:[OPENSSL-'version'...]
+
+where 'version' is the OpenSSL version number with underscores instead
+of periods.
+
+### Windows
+
+If you are using Visual Studio, open the Developer Command Prompt _elevated_
+and issue the following command.
+
+    $ nmake install
+
+The easiest way to elevate the Command Prompt is to press and hold down
+the both the `<CTRL>` and `<SHIFT>` key while clicking the menu item in the
+task menu.
+
+The default installation location is
+
+    C:\Program Files\OpenSSL
+
+for native binaries, or
+
+    C:\Program Files (x86)\OpenSSL
+
+for 32bit binaries on 64bit Windows (WOW64).
+
+#### Installing to a different location
+
+To install OpenSSL to a different location (for example into your home
+directory for testing purposes) run config as shown in the following
+examples.
+
+On Unix:
+
+    $ ./config --prefix=/opt/openssl --openssldir=/usr/local/ssl
+
+On OpenVMS:
+
+    $ @config --prefix=PROGRAM:[INSTALLS] --openssldir=SYS$MANAGER:[OPENSSL]
+
+Note: if you do add options to the configuration command, please make sure
+you've read more than just this Quick Start, such as relevant `NOTES.*` files,
+the options outline below, as configuration options may change the outcome
+in otherwise unexpected ways.
+
+Configuration Options
+=====================
+
+There are several options to ./config (or ./Configure) to customize
+the build (note that for Windows, the defaults for `--prefix` and
+`--openssldir` depend in what configuration is used and what Windows
+implementation OpenSSL is built on.  More notes on this in NOTES.WIN):
+
+API Level
+---------
+
+    --api=x.y[.z]
+
+Build the OpenSSL libraries to support the API for the specified version.
+If [no-deprecated](#no-deprecated) is also given, don't build with support
+for deprecated APIs in or below the specified version number.  For example,
+addding
+
+    --api=1.1.0 no-deprecated
+
+will remove support for all APIs that were deprecated in OpenSSL version
+1.1.0 or below.  This is a rather specialized option for developers.
+If you just intend to remove all deprecated APIs up to the current version
+entirely, just specify [no-deprecated](#no-deprecated).
+If `--api` isn't given, it defaults to the current (minor) OpenSSL version.
+
+Cross Compile Prefix
+--------------------
+
+    --cross-compile-prefix=PREFIX
+
+The PREFIX to include in front of commands for your toolchain.
+
+It is likely to have to end with dash, e.g.  a-b-c- would invoke GNU compiler as
+a-b-c-gcc, etc.  Unfortunately cross-compiling is too case-specific to put
+together one-size-fits-all instructions.  You might have to pass more flags or
+set up environment variables to actually make it work.  Android and iOS cases are
+discussed in corresponding `Configurations/15-*.conf` files.  But there are cases
+when this option alone is sufficient.  For example to build the mingw64 target on
+Linux `--cross-compile-prefix=x86_64-w64-mingw32-` works.  Naturally provided
+that mingw packages are installed.  Today Debian and Ubuntu users have option to
+install a number of prepackaged cross-compilers along with corresponding
+run-time and development packages for "alien" hardware.  To give another example
+`--cross-compile-prefix=mipsel-linux-gnu-` suffices in such case.  Needless to
+mention that you have to invoke `./Configure`, not `./config`, and pass your target
+name explicitly.  Also, note that `--openssldir` refers to target's file system,
+not one you are building on.
+
+Build Type
+----------
+
+    --debug
+
+Build OpenSSL with debugging symbols and zero optimization level.
+
+    --release
+
+Build OpenSSL without debugging symbols.  This is the default.
+
+Directories
+-----------
+
+### libdir
+
+    --libdir=DIR
+
+The name of the directory under the top of the installation directory tree
+(see the `--prefix` option) where libraries will be installed.  By default
+this is "lib". Note that on Windows only static libraries (`*.lib`) will
+be stored in this location. Shared libraries (`*.dll`) will always be
+installed to the "bin" directory.
+
+### openssldir
+
+    --openssldir=DIR
+
+Directory for OpenSSL configuration files, and also the default certificate
+and key store.  Defaults are:
+
+    Unix:           /usr/local/ssl
+    Windows:        C:\Program Files\Common Files\SSL
+    OpenVMS:        SYS$COMMON:[OPENSSL-COMMON]
+
+For 32bit Windows applications on Windows 64bit (WOW64), always replace
+`C:\Program Files` by `C:\Program Files (x86)`.
+
+### prefix
+
+    --prefix=DIR
+
+The top of the installation directory tree.  Defaults are:
+
+    Unix:           /usr/local
+    Windows:        C:\Program Files\OpenSSL
+    OpenVMS:        SYS$COMMON:[OPENSSL-'version']
+
+Compiler Warnings
+-----------------
+
+    --strict-warnings
+
+This is a developer flag that switches on various compiler options recommended
+for OpenSSL development.  It only works when using gcc or clang as the compiler.
+If you are developing a patch for OpenSSL then it is recommended that you use
+this option where possible.
+
+ZLib Flags
+----------
+
+### with-zlib-include
+
+    --with-zlib-include=DIR
+
+The directory for the location of the zlib include file.  This option is only
+necessary if [enable-zlib](#enable-zlib) is used and the include file is not
+already on the system include path.
+
+### with-zlib-lib
+
+    --with-zlib-lib=LIB
+
+**On Unix**: this is the directory containing the zlib library.
+If not provided the system library path will be used.
+
+**On Windows:** this is the filename of the zlib library (with or
+without a path).  This flag must be provided if the
+[zlib-dynamic](#zlib-dynamic) option is not also used.  If zlib-dynamic is used
+then this flag is optional and defaults to "ZLIB1" if not provided.
+
+**On VMS:** this is the filename of the zlib library (with or without a path).
+This flag is optional and if not provided then "GNV$LIBZSHR", "GNV$LIBZSHR32"
+or "GNV$LIBZSHR64" is used by default depending on the pointer size chosen.
+
+Seeding the Random Generator
+----------------------------
+
+    --with-rand-seed=seed1[,seed2,...]
+
+A comma separated list of seeding methods which will be tried by OpenSSL
+in order to obtain random input (a.k.a "entropy") for seeding its
+cryptographically secure random number generator (CSPRNG).
+The current seeding methods are:
+
+### os
+
+Use a trusted operating system entropy source.
+This is the default method if such an entropy source exists.
+
+### getrandom
+
+Use the [getrandom(2)][man-getrandom] or equivalent system call.
+
+[man-getrandom]: http://man7.org/linux/man-pages/man2/getrandom.2.html
+
+### devrandom
+
+Use the first device from the DEVRANDOM list which can be opened to read
+random bytes.  The DEVRANDOM preprocessor constant expands to
+
+    "/dev/urandom","/dev/random","/dev/srandom"
+
+on most unix-ish operating systems.
+
+### egd
+
+Check for an entropy generating daemon.
+
+### rdcpu
+
+Use the RDSEED or RDRAND command if provided by the CPU.
+
+### librandom
+
+Use librandom (not implemented yet).
+
+### none
+
+Disable automatic seeding.  This is the default on some operating systems where
+no suitable entropy source exists, or no support for it is implemented yet.
+
+For more information, see the section [Notes on random number generation][rng]
+at the end of this document.
+
+[rng]: #notes-on-random-number-generation
+
+Enable and Disable Features
+---------------------------
+
+Feature options always come in pairs, an option to enable feature xxxx, and
+and option to disable it:
+
+    [ enable-xxxx | no-xxxx ]
+
+Whether a feature is enabled or disabled by default, depends on the feature.
+In the following list, always the non-default variant is documented: if
+feature xxxx is disabled by default then enable-xxxx is documented and
+if feature xxxx is enabled by default then no-xxxx is documented.
+
+### no-afalgeng
+
+Don't build the AFALG engine.
+
+This option will be forced on a platform that does not support AFALG.
+
+### enable-ktls
+
+Build with Kernel TLS support.
+
+This option will enable the use of the Kernel TLS data-path, which can improve
+performance and allow for the use of sendfile and splice system calls on
+TLS sockets.  The Kernel may use TLS accelerators if any are available on the
+system.  This option will be forced off on systems that do not support the
+Kernel TLS data-path.
+
+### enable-asan
+
+Build with the Address sanitiser.
+
+This is a developer option only.  It may not work on all platforms and should
+never be used in production environments.  It will only work when used with
+gcc or clang and should be used in conjunction with the [no-shared](#no-shared)
+option.
+
+### no-asm
+
+Do not use assembler code.
+
+This should be viewed as debugging/troubleshooting option rather than for
+production use.  On some platforms a small amount of assembler code may still
+be used even with this option.
+
+### no-async
+
+Do not build support for async operations.
+
+### no-autoalginit
+
+Don't automatically load all supported ciphers and digests.
+
+Typically OpenSSL will make available all of its supported ciphers and digests.
+For a statically linked application this may be undesirable if small executable
+size is an objective.  This only affects libcrypto.  Ciphers and digests will
+have to be loaded manually using EVP_add_cipher() and EVP_add_digest() if this
+option is used.  This option will force a non-shared build.
+
+### no-autoerrinit
+
+Don't automatically load all libcrypto/libssl error strings.
+
+Typically OpenSSL will automatically load human readable error strings.  For a
+statically linked application this may be undesirable if small executable size
+is an objective.
+
+### no-autoload-config
+
+Don't automatically load the default openssl.cnf file.
+
+Typically OpenSSL will automatically load a system config file which configures
+default SSL options.
+
+### enable-buildtest-c++
+
+While testing, generate C++ buildtest files that simply check that the public
+OpenSSL header files are usable standalone with C++.
+
+Enabling this option demands extra care.  For any compiler flag given directly
+as configuration option, you must ensure that it's valid for both the C and
+the C++ compiler.  If not, the C++ build test will most likely break.  As an
+alternative, you can use the language specific variables, CFLAGS and CXXFLAGS.
+
+### no-capieng
+
+Don't build the CAPI engine.
+
+This option will be forced if on a platform that does not support CAPI.
+
+### no-cmp
+
+Don't build support for Certificate Management Protocol (CMP).
+
+### no-cms
+
+Don't build support for Cryptographic Message Syntax (CMS).
+
+### no-comp
+
+Don't build support for SSL/TLS compression.
+
+If this option is enabled (the default), then compression will only work if
+the zlib or zlib-dynamic options are also chosen.
+
+### enable-crypto-mdebug
+
+This now only enables the failed-malloc feature.
+
+### enable-crypto-mdebug-backtrace
+
+This is a no-op; the project uses the compiler's address/leak sanitizer instead.
+
+### no-ct
+
+Don't build support for Certificate Transparency (CT).
+
+### no-deprecated
+
+Don't build with support for deprecated APIs up until and including the version
+given with `--api` (or the current version, if `--api` wasn't specified).
+
+### no-dgram
+
+Don't build support for datagram based BIOs.
+
+Selecting this option will also force the disabling of DTLS.
+
+### no-dso
+
+Don't build support for loading Dynamic Shared Objects (DSO)
+
+### enable-devcryptoeng
+
+Build the `/dev/crypto` engine.
+
+This option is automatically selected on the BSD platform, in which case it can
+be disabled with no-devcryptoeng.
+
+### no-dynamic-engine
+
+Don't build the dynamically loaded engines.
+
+This only has an effect in a shared build.
+
+### no-ec
+
+Don't build support for Elliptic Curves.
+
+### no-ec2m
+
+Don't build support for binary Elliptic Curves
+
+### enable-ec_nistp_64_gcc_128
+
+Enable support for optimised implementations of some commonly used NIST
+elliptic curves.
+
+This option is only supported on platforms:
+
+ - with little-endian storage of non-byte types
+ - that tolerate misaligned memory references
+ - where the compiler:
+   - supports the non-standard type `__uint128_t`
+   - defines the built-in macro `__SIZEOF_INT128__`
+
+### enable-egd
+
+Build support for gathering entropy from the Entropy Gathering Daemon (EGD).
+
+### no-engine
+
+Don't build support for loading engines.
+
+### no-err
+
+Don't compile in any error strings.
+
+### enable-external-tests
+
+Enable building of integration with external test suites.
+
+This is a developer option and may not work on all platforms.  The following
+external test suites are currently supported:
+
+ - BoringSSL test suite
+ - Python PYCA/Cryptography test suite
+ - krb5 test suite
+
+See the file [test/README.external]/(test/README.external) for further details.
+
+### no-filenames
+
+Don't compile in filename and line number information (e.g.  for errors and
+memory allocation).
+
+### no-fips
+
+Don't compile the FIPS provider
+
+### enable-fuzz-libfuzzer, enable-fuzz-afl
+
+Build with support for fuzzing using either libfuzzer or AFL.
+
+These are developer options only.  They may not work on all  platforms and
+should never be used in production environments.
+
+See the file [fuzz/README.md](fuzz/README.md) for further details.
+
+### no-gost
+
+Don't build support for GOST based ciphersuites.
+
+Note that if this feature is enabled then GOST ciphersuites are only available
+if the GOST algorithms are also available through loading an externally supplied
+engine.
+
+### no-legacy
+
+Don't build the legacy provider.
+
+Disabling this also disables the legacy algorithms: MD2 (already disabled by default).
+
+### no-makedepend
+
+Don't generate dependencies.
+
+### no-module
+
+Don't build any dynamically loadable engines.
+
+This also implies 'no-dynamic-engine'.
+
+### no-multiblock
+
+Don't build support for writing multiple records in one go in libssl
+
+Note: this is a different capability to the pipelining functionality.
+
+### no-nextprotoneg
+
+Don't build support for the Next Protocol Negotiation (NPN) TLS extension.
+
+### no-ocsp
+
+Don't build support for Online Certificate Status Protocol (OCSP).
+
+### no-padlockeng
+
+Don't build the padlock engine.
+
+### no-hw-padlock
+
+As synonyme for no-padlockeng.  Deprecated and should not be used.
+
+### no-pic
+
+Don't build with support for Position Independent Code.
+
+### no-pinshared
+
+Don't pin the shared libraries.
+
+By default OpenSSL will attempt to stay in memory until the process exits.
+This is so that libcrypto and libssl can be properly cleaned up automatically
+via an atexit() handler.  The handler is registered by libcrypto and cleans
+up both libraries.  On some platforms the atexit() handler will run on unload of
+libcrypto (if it has been dynamically loaded) rather than at process exit.  This
+option can be used to stop OpenSSL from attempting to stay in memory until the
+process exits.  This could lead to crashes if either libcrypto or libssl have
+already been unloaded at the point that the atexit handler is invoked, e.g.  on a
+platform which calls atexit() on unload of the library, and libssl is unloaded
+before libcrypto then a crash is likely to happen.  Applications can suppress
+running of the atexit() handler at run time by using the OPENSSL_INIT_NO_ATEXIT
+option to OPENSSL_init_crypto().  See the man page for it for further details.
+
+### no-posix-io
+
+Don't use POSIX IO capabilities.
+
+### no-psk
+
+Don't build support for Pre-Shared Key based ciphersuites.
+
+### no-rdrand
+
+Don't use hardware RDRAND capabilities.
+
+### no-rfc3779
+
+Don't build support for RFC3779, "X.509 Extensions for IP Addresses and
+AS Identifiers".
+
+### sctp
+
+Build support for Stream Control Transmission Protocol (SCTP).
+
+### no-shared
+
+Do not create shared libraries, only static ones.
+
+See [Notes on shared libraries](#notes-on-shared-libraries) below.
+
+### no-sock
+
+Don't build support for socket BIOs.
+
+### no-srp
+
+Don't build support for Secure Remote Password (SRP) protocol or
+SRP based ciphersuites.
+
+### no-srtp
+
+Don't build Secure Real-Time Transport Protocol (SRTP) support.
+
+### no-sse2
+
+Exclude SSE2 code paths from 32-bit x86 assembly modules.
+
+Normally SSE2 extension is detected at run-time, but the decision whether or not
+the machine code will be executed is taken solely on CPU capability vector.  This
+means that if you happen to run OS kernel which does not support SSE2 extension
+on Intel P4 processor, then your application might be exposed to "illegal
+instruction" exception.  There might be a way to enable support in kernel, e.g.
+FreeBSD kernel can be compiled with CPU_ENABLE_SSE, and there is a way to
+disengage SSE2 code paths upon application start-up, but if you aim for wider
+"audience" running such kernel, consider no-sse2.  Both the 386 and no-asm
+options imply no-sse2.
+
+### enable-ssl-trace
+
+Build with the SSL Trace capabilities.
+
+This adds the "-trace" option to s_client and s_server.
+
+### no-static-engine
+
+Don't build the statically linked engines.
+
+This only has an impact when not built "shared".
+
+### no-stdio
+
+Don't use anything from the C header file "stdio.h" that makes use of the "FILE"
+type.  Only libcrypto and libssl can be built in this way.  Using this option will
+suppress building the command line applications.  Additionally, since the OpenSSL
+tests also use the command line applications, the tests will also be skipped.
+
+### no-tests
+
+Don't build test programs or run any tests.
+
+### no-threads
+
+Don't build with support for multi-threaded applications.
+
+### threads
+
+Build with support for multi-threaded applications.  Most platforms will enable
+this by default.  However if on a platform where this is not the case then this
+will usually require additional system-dependent options!
+
+See [Notes on multi-threading](#notes-on-multi-threading) below.
+
+### enable-trace
+
+Build with support for the integrated tracing api.
+
+See manual pages OSSL_trace_set_channel(3) and OSSL_trace_enabled(3) for details.
+
+### no-ts
+
+Don't build Time Stamping (TS) Authority support.
+
+### enable-ubsan
+
+Build with the Undefined Behaviour sanitiser (UBSAN).
+
+This is a developer option only.  It may not work on all platforms and should
+never be used in production environments.  It will only work when used with gcc
+or clang and should be used in conjunction with the `-DPEDANTIC` option
+(or the `--strict-warnings` option).
+
+### no-ui-console
+
+Don't build with the User Interface (UI) console method
+
+The User Interface console method enables text based console prompts.
+
+### enable-unit-test
+
+Enable additional unit test APIs.
+
+This should not typically be used in production deployments.
+
+### no-uplink
+
+Don't build support for UPLINK interface.
+
+### enable-weak-ssl-ciphers
+
+Build support for SSL/TLS ciphers that are considered "weak"
+
+Enabling this includes for example the RC4 based ciphersuites.
+
+### zlib
+
+Build with support for zlib compression/decompression.
+
+### zlib-dynamic
+
+Like the zlib option, but has OpenSSL load the zlib library dynamically
+when needed.
+
+This is only supported on systems where loading of shared libraries is supported.
+
+### 386
+
+In 32-bit x86 builds, use the 80386 instruction set only in assembly modules
+
+The default x86 code is more efficient, but requires at least an 486 processor.
+Note: This doesn't affect compiler generated code, so this option needs to be
+accompanied by a corresponding compiler-specific option.
+
+### no-{protocol}
+
+    no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}
+
+Don't build support for negotiating the specified SSL/TLS protocol.
+
+If "no-tls" is selected then all of tls1, tls1_1, tls1_2 and tls1_3 are disabled.
+Similarly "no-dtls" will disable dtls1 and dtls1_2.  The "no-ssl" option is
+synonymous with "no-ssl3".  Note this only affects version negotiation.
+OpenSSL will still provide the methods for applications to explicitly select
+the individual protocol versions.
+
+### no-{protocol}-method
+
+    no-{ssl|ssl3|tls|tls1|tls1_1|tls1_2|tls1_3|dtls|dtls1|dtls1_2}-method
+
+Analogous to no-{protocol} but in addition do not build the methods for
+applications to explicitly select individual protocol versions.  Note that there
+is no "no-tls1_3-method" option because there is no application method for
+TLSv1.3.
+
+Using individual protocol methods directly is deprecated.  Applications should
+use TLS_method() instead.
+
+### enable-{algorithm}
+
+    enable-{md2|rc5}
+
+Build with support for the specified algorithm.
+
+### no-{algorithm}
+
+    no-{aria|bf|blake2|camellia|cast|chacha|cmac|
+        des|dh|dsa|ecdh|ecdsa|idea|md4|mdc2|ocb|
+        poly1305|rc2|rc4|rmd160|scrypt|seed|
+        siphash|siv|sm2|sm3|sm4|whirlpool}
+
+Build without support for the specified algorithm.
+
+The "ripemd" algorithm is deprecated and if used is synonymous with rmd160.
+
+### Compiler-specific options
+
+    -Dxxx, -Ixxx, -Wp, -lxxx, -Lxxx, -Wl, -rpath, -R, -framework, -static
+
+These system specific options will be recognised and passed through to the
+compiler to allow you to define preprocessor symbols, specify additional
+libraries, library directories or other compiler options.  It might be worth
+noting that some compilers generate code specifically for processor the
+compiler currently executes on.  This is not necessarily what you might have
+in mind, since it might be unsuitable for execution on other, typically older,
+processor.  Consult your compiler documentation.
+
+Take note of the [Environment Variables](#environment-variables) documentation
+below and how these flags interact with those variables.
+
+    -xxx, +xxx, /xxx
+
+Additional options that are not otherwise recognised are passed through as
+they are to the compiler as well.  Unix-style options beginning with a
+'-' or '+' and Windows-style options beginning with a '/' are recognized.
+Again, consult your compiler documentation.
+
+If the option contains arguments separated by spaces, then the URL-style
+notation %20 can be used for the space character in order to avoid having
+to quote the option.  For example, -opt%20arg gets expanded to -opt arg.
+In fact, any ASCII character can be encoded as %xx using its hexadecimal
+encoding.
+
+Take note of the [Environment Variables](#environment-variables) documentation
+below and how these flags interact with those variables.
+
+### Environment Variables
+
+    VAR=value
+
+Assign the given value to the environment variable VAR for Configure.
+
+These work just like normal environment variable assignments, but are supported
+on all platforms and are confined to the configuration scripts only.
+These assignments override the corresponding value in the inherited environment,
+if there is one.
+
+The following variables are used as "make variables" and can be used as an
+alternative to giving preprocessor, compiler and linker options directly as
+configuration.  The following variables are supported:
+
+    AR              The static library archiver.
+    ARFLAGS         Flags for the static library archiver.
+    AS              The assembler compiler.
+    ASFLAGS         Flags for the assembler compiler.
+    CC              The C compiler.
+    CFLAGS          Flags for the C compiler.
+    CXX             The C++ compiler.
+    CXXFLAGS        Flags for the C++ compiler.
+    CPP             The C/C++ preprocessor.
+    CPPFLAGS        Flags for the C/C++ preprocessor.
+    CPPDEFINES      List of CPP macro definitions, separated
+                    by a platform specific character (':' or
+                    space for Unix, ';' for Windows, ',' for
+                    VMS).  This can be used instead of using
+                    -D (or what corresponds to that on your
+                    compiler) in CPPFLAGS.
+    CPPINCLUDES     List of CPP inclusion directories, separated
+                    the same way as for CPPDEFINES.  This can
+                    be used instead of -I (or what corresponds
+                    to that on your compiler) in CPPFLAGS.
+    HASHBANGPERL    Perl invocation to be inserted after '#!'
+                    in public perl scripts (only relevant on
+                    Unix).
+    LD              The program linker (not used on Unix, $(CC)
+                    is used there).
+    LDFLAGS         Flags for the shared library, DSO and
+                    program linker.
+    LDLIBS          Extra libraries to use when linking.
+                    Takes the form of a space separated list
+                    of library specifications on Unix and
+                    Windows, and as a comma separated list of
+                    libraries on VMS.
+    RANLIB          The library archive indexer.
+    RC              The Windows resource compiler.
+    RCFLAGS         Flags for the Windows resource compiler.
+    RM              The command to remove files and directories.
+
+These cannot be mixed with compiling/linking flags given on the command line.
+In other words, something like this isn't permitted.
+
+    ./config -DFOO CPPFLAGS=-DBAR -DCOOKIE
+
+Backward compatibility note:
+
+To be compatible with older configuration scripts, the environment variables
+are ignored if compiling/linking flags are given on the command line, except
+for the following:
+
+    AR, CC, CXX, CROSS_COMPILE, HASHBANGPERL, PERL, RANLIB, RC, and WINDRES
+
+For example, the following command will not see -DBAR:
+
+    CPPFLAGS=-DBAR ./config -DCOOKIE
+
+However, the following will see both set variables:
+
+    CC=gcc CROSS_COMPILE=x86_64-w64-mingw32- ./config -DCOOKIE
+
+If CC is set, it is advisable to also set CXX to ensure both the C and C++
+compiler are in the same "family".  This becomes relevant with
+'enable-external-tests' and 'enable-buildtest-c++'.
+
+### Reconfigure
+
+    reconf
+    reconfigure
+
+Reconfigure from earlier data.
+
+This fetches the previous command line options and environment from data saved
+in "configdata.pm" and runs the configuration process again, using these
+options and environment.  Note: NO other option is permitted together with
+"reconf".  This means that you also MUST use "./Configure" (or what corresponds
+to that on non-Unix platforms) directly to invoke this option.  Note: The
+original configuration saves away values for ALL environment variables that were
+used, and if they weren't defined, they are still saved away with information
+that they weren't originally defined.  This information takes precedence over
+environment variables that are defined when reconfiguring.
+
+Displaying configuration data
+-----------------------------
+
+The configuration script itself will say very little, and finishes by
+creating "configdata.pm".  This perl module can be loaded by other scripts
+to find all the configuration data, and it can also be used as a script to
+display all sorts of configuration data in a human readable form.
+
+For more information, please do:
+
+    $ ./configdata.pm --help                         # Unix
+
+or
+
+    $ perl configdata.pm --help                      # Windows and VMS
+
+Installation Steps in Detail
+============================
+
+Configure OpenSSL
+-----------------
+
+### Automatic Configuration
+
+On some platform a `config` script is available which attempts to guess
+your operating system (and compiler, if necessary) and calls the `Configure`
+Perl script with appropriate target based on its guess.  Further options can
+be supplied to the `config` script, which will be passed on to the `Configure`
+script.
+
+#### Unix / Linux / macOS
+
+    $ ./config [[ options ]]
+
+#### OpenVMS
+
+    $ @config [[ options ]]
+
+#### Windows
+
+Automatic configuration is not available on Windows.
+
+For the remainder of this text, the Unix form will be used in all examples,
+please use the appropriate form for your platform.
+
+You can run
+
+    $ ./config -t
+
+to see whether your target is guessed correctly.  If you want to use a different
+compiler, you  are cross-compiling for another platform, or the ./config guess
+was wrong for other reasons, see the [Manual Configuration](#manual-configuration)
+section.  Oherwise continue with the [Build OpenSSL](#build-openssl) section below.
+
+On some systems, you can include debugging information as follows:
+
+      $ ./config -d [[ options ]]
+
+### Manual Configuration
+
+OpenSSL knows about a range of different operating system, hardware and
+compiler combinations.  To see the ones it knows about, run
+
+    $ ./Configure                                    # Unix
+
+or
+
+    $ perl Configure                                 # All other platforms
+
+For the remainder of this text, the Unix form will be used in all examples.
+Please use the appropriate form for your platform.
+
+Pick a suitable name from the list that matches your system.  For most
+operating systems there is a choice between using "cc" or "gcc".
+When you have identified your system (and if necessary compiler) use this
+name as the argument to Configure.  For example, a "linux-elf" user would
+run:
+
+    $ ./Configure linux-elf [[ options ]]
+
+### Creating your own Configuration
+
+If your system isn't listed, you will have to create a configuration
+file named Configurations/{{ something }}.conf and add the correct
+configuration for your system.  See the available configs as examples
+and read Configurations/README and Configurations/README.design for
+more information.
+
+The generic configurations "cc" or "gcc" should usually work on 32 bit
+Unix-like systems.
+
+Configure creates a build file ("Makefile" on Unix, "makefile" on Windows
+and "descrip.mms" on OpenVMS) from a suitable template in Configurations,
+and defines various macros in include/openssl/configuration.h (generated
+from include/openssl/configuration.h.in).
+
+### Out of Tree Builds
+
+OpenSSL can be configured to build in a build directory separate from the
+source code directory.  It's done by placing yourself in some other
+directory and invoking the configuration commands from there.
+
+#### Unix example
+
+    $ mkdir /var/tmp/openssl-build
+    $ cd /var/tmp/openssl-build
+    $ /PATH/TO/OPENSSL/SOURCE/config [[ options ]]
+
+or
+
+    $ /PATH/TO/OPENSSL/SOURCE/Configure {{ target }} [[ options ]]
+
+#### OpenVMS example
+
+    $ set default sys$login:
+    $ create/dir [.tmp.openssl-build]
+    $ set default [.tmp.openssl-build]
+    $ @[PATH.TO.OPENSSL.SOURCE]config [[ options ]]
+
+or
+
+    $ @[PATH.TO.OPENSSL.SOURCE]Configure {{ target }} [[ options ]]
+
+#### Windows example
+
+    $ C:
+    $ mkdir \temp-openssl
+    $ cd \temp-openssl
+    $ perl d:\PATH\TO\OPENSSL\SOURCE\Configure {{ target }} [[ options ]]
+
+Paths can be relative just as well as absolute.  Configure will do its best
+to translate them to relative paths whenever possible.
+
+Build OpenSSL
+-------------
+
+Build OpenSSL by running:
+
+    $ make                                           # Unix
+    $ mms                                            ! (or mmk) OpenVMS
+    $ nmake                                          # Windows
+
+This will build the OpenSSL libraries (libcrypto.a and libssl.a on
+Unix, corresponding on other platforms) and the OpenSSL binary
+("openssl").  The libraries will be built in the top-level directory,
+and the binary will be in the "apps" subdirectory.
+
+If the build fails, take a look at the [Build Failures](#build-failures)
+subsection of the [Troubleshooting](#troubleshooting) section.
+
+Test OpenSSL
+------------
+
+After a successful build, and before installing, the libraries should
+be tested.  Run:
+
+    $ make test                                      # Unix
+    $ mms test                                       ! OpenVMS
+    $ nmake test                                     # Windows
+
+**Warning:** you MUST run the tests from an unprivileged account (or disable
+your privileges temporarily if your platform allows it).
+
+If some tests fail, take a look at the [Test Failures](#test-failures)
+subsection of the [Troubleshooting](#troubleshooting) section.
+
+Install OpenSSL
+---------------
+
+If everything tests ok, install OpenSSL with
+
+    $ make install                                   # Unix
+    $ mms install                                    ! OpenVMS
+    $ nmake install                                  # Windows
+
+Note that in order to perform the install step above you need to have
+appropriate permissions to write to the installation directory.
+
+The above commands will install all the software components in this
+directory tree under PREFIX (the directory given with `--prefix` or
+its default):
+
+### Unix / Linux / macOS
+
+    bin/           Contains the openssl binary and a few other
+                   utility scripts.
+    include/openssl
+                   Contains the header files needed if you want
+                   to build your own programs that use libcrypto
+                   or libssl.
+    lib            Contains the OpenSSL library files.
+    lib/engines    Contains the OpenSSL dynamically loadable engines.
+
+    share/man/man1 Contains the OpenSSL command line man-pages.
+    share/man/man3 Contains the OpenSSL library calls man-pages.
+    share/man/man5 Contains the OpenSSL configuration format man-pages.
+    share/man/man7 Contains the OpenSSL other misc man-pages.
+
+    share/doc/openssl/html/man1
+    share/doc/openssl/html/man3
+    share/doc/openssl/html/man5
+    share/doc/openssl/html/man7
+                   Contains the HTML rendition of the man-pages.
+
+### OpenVMS
+
+'arch' is replaced with the architecture name, "Alpha" or "ia64",
+'sover' is replaced with the shared library version (0101 for 1.1), and
+'pz' is replaced with the pointer size OpenSSL was built with:
+
+    [.EXE.'arch']  Contains the openssl binary.
+    [.EXE]         Contains a few utility scripts.
+    [.include.openssl]
+                   Contains the header files needed if you want
+                   to build your own programs that use libcrypto
+                   or libssl.
+    [.LIB.'arch']  Contains the OpenSSL library files.
+    [.ENGINES'sover''pz'.'arch']
+                   Contains the OpenSSL dynamically loadable engines.
+    [.SYS$STARTUP] Contains startup, login and shutdown scripts.
+                   These define appropriate logical names and
+                   command symbols.
+    [.SYSTEST]     Contains the installation verification procedure.
+    [.HTML]        Contains the HTML rendition of the manual pages.
+
+### Additional Directories
+
+Additionally, install will add the following directories under
+OPENSSLDIR (the directory given with `--openssldir` or its default)
+for you convenience:
+
+    certs          Initially empty, this is the default location
+                   for certificate files.
+    private        Initially empty, this is the default location
+                   for private key files.
+    misc           Various scripts.
+
+The installation directory should be appropriately protected to ensure
+unprivileged users cannot make changes to OpenSSL binaries or files, or
+install engines.  If you already have a pre-installed version of OpenSSL as
+part of your Operating System it is recommended that you do not overwrite
+the system version and instead install to somewhere else.
+
+Package builders who want to configure the library for standard locations,
+but have the package installed somewhere else so that it can easily be
+packaged, can use
+
+  $ make DESTDIR=/tmp/package-root install         # Unix
+  $ mms/macro="DESTDIR=TMP:[PACKAGE-ROOT]" install ! OpenVMS
+
+The specified destination directory will be prepended to all installation
+target paths.
+
+Compatibility issues with previous OpenSSL versions
+---------------------------------------------------
+
+### COMPILING existing applications
+
+Starting with version 1.1.0, OpenSSL hides a number of structures that were
+previously open.  This includes all internal libssl structures and a number
+of EVP types.  Accessor functions have been added to allow controlled access
+to the structures' data.
+
+This means that some software needs to be rewritten to adapt to the new ways
+of doing things.  This often amounts to allocating an instance of a structure
+explicitly where you could previously allocate them on the stack as automatic
+variables, and using the provided accessor functions where you would previously
+access a structure's field directly.
+
+Some APIs have changed as well.  However, older APIs have been preserved when
+possible.
+
+Post-installation Notes
+-----------------------
+
+With the default OpenSSL installation comes a FIPS provider module, which
+needs some post-installation attention, without which it will not be usable.
+This involves using the following command:
+
+    openssl fipsinstall
+
+See the openssl-fipsinstall(1) manual for details and examples.
+
+Advanced Build Options
+======================
+
+Environment Variables
+---------------------
+
+A number of environment variables can be used to provide additional control
+over the build process.  Typically these should be defined prior to running
+config or Configure.  Not all environment variables are relevant to all
+platforms.
+
+    AR
+                   The name of the ar executable to use.
+
+    BUILDFILE
+                   Use a different build file name than the platform default
+                   ("Makefile" on Unix-like platforms, "makefile" on native Windows,
+                   "descrip.mms" on OpenVMS).  This requires that there is a
+                   corresponding build file template.  See Configurations/README
+                   for further information.
+
+    CC
+                   The compiler to use. Configure will attempt to pick a default
+                   compiler for your platform but this choice can be overridden
+                   using this variable. Set it to the compiler executable you wish
+                   to use, e.g. "gcc" or "clang".
+
+    CROSS_COMPILE
+                   This environment variable has the same meaning as for the
+                   "--cross-compile-prefix" Configure flag described above. If both
+                   are set then the Configure flag takes precedence.
+
+    NM
+                   The name of the nm executable to use.
+
+    OPENSSL_LOCAL_CONFIG_DIR
+                   OpenSSL comes with a database of information about how it
+                   should be built on different platforms as well as build file
+                   templates for those platforms. The database is comprised of
+                   ".conf" files in the Configurations directory.  The build
+                   file templates reside there as well as ".tmpl" files. See the
+                   file Configurations/README for further information about the
+                   format of ".conf" files as well as information on the ".tmpl"
+                   files.
+                   In addition to the standard ".conf" and ".tmpl" files, it is
+                   possible to create your own ".conf" and ".tmpl" files and store
+                   them locally, outside the OpenSSL source tree. This environment
+                   variable can be set to the directory where these files are held
+                   and will be considered by Configure before it looks in the
+                   standard directories.
+
+    PERL
+                   The name of the Perl executable to use when building OpenSSL.
+                   This variable is used in config script only. Configure on the
+                   other hand imposes the interpreter by which it itself was
+                   executed on the whole build procedure.
+
+    HASHBANGPERL
+                   The command string for the Perl executable to insert in the
+                   #! line of perl scripts that will be publicly installed.
+                   Default: /usr/bin/env perl
+                   Note: the value of this variable is added to the same scripts
+                   on all platforms, but it's only relevant on Unix-like platforms.
+
+    RC
+                   The name of the rc executable to use. The default will be as
+                   defined for the target platform in the ".conf" file. If not
+                   defined then "windres" will be used. The WINDRES environment
+                   variable is synonymous to this. If both are defined then RC
+                   takes precedence.
+
+    RANLIB
+                   The name of the ranlib executable to use.
+
+    WINDRES
+                   See RC.
+
+Makefile Targets
+----------------
+
+The Configure script generates a Makefile in a format relevant to the specific
+platform.  The Makefiles provide a number of targets that can be used.  Not all
+targets may be available on all platforms.  Only the most common targets are
+described here.  Examine the Makefiles themselves for the full list.
+
+    all
+                   The target to build all the software components and
+                   documentation.
+
+    build_sw
+                   Build all the software components.
+                   THIS IS THE DEFAULT TARGET.
+
+    build_docs
+                   Build all documentation components.
+
+    clean
+                   Remove all build artefacts and return the directory to a "clean"
+                   state.
+
+    depend
+                   Rebuild the dependencies in the Makefiles. This is a legacy
+                   option that no longer needs to be used since OpenSSL 1.1.0.
+
+    install
+                   Install all OpenSSL components.
+
+    install_sw
+                   Only install the OpenSSL software components.
+
+    install_docs
+                   Only install the OpenSSL documentation components.
+
+    install_man_docs
+                   Only install the OpenSSL man pages (Unix only).
+
+    install_html_docs
+                   Only install the OpenSSL html documentation.
+
+    list-tests
+                   Prints a list of all the self test names.
+
+    test
+                   Build and run the OpenSSL self tests.
+
+    uninstall
+                   Uninstall all OpenSSL components.
+
+    reconfigure
+    reconf
+                   Re-run the configuration process, as exactly as the last time
+                   as possible.
+
+    update
+                   This is a developer option. If you are developing a patch for
+                   OpenSSL you may need to use this if you want to update
+                   automatically generated files; add new error codes or add new
+                   (or change the visibility of) public API functions. (Unix only).
+
+Running Selected Tests
+----------------------
+
+The make variable TESTS supports a versatile set of space separated tokens
+with which you can specify a set of tests to be performed.  With a "current
+set of tests" in mind, initially being empty, here are the possible tokens:
+
+     alltests      The current set of tests becomes the whole set of available
+                   tests (as listed when you do 'make list-tests' or similar).
+
+     xxx           Adds the test 'xxx' to the current set of tests.
+
+    -xxx           Removes 'xxx' from the current set of tests.  If this is the
+                   first token in the list, the current set of tests is first
+                   assigned the whole set of available tests, effectively making
+                   this token equivalent to TESTS="alltests -xxx".
+
+     nn            Adds the test group 'nn' (which is a number) to the current
+                   set of tests.
+
+    -nn            Removes the test group 'nn' from the current set of tests.
+                   If this is the first token in the list, the current set of
+                   tests is first assigned the whole set of available tests,
+                   effectively making this token equivalent to
+                   TESTS="alltests -xxx".
+
+Also, all tokens except for "alltests" may have wildcards, such as *.
+(on Unix and Windows, BSD style wildcards are supported, while on VMS,
+it's VMS style wildcards)
+
+### Examples
+
+Run all tests except for the fuzz tests:
+
+    $ make TESTS=-test_fuzz test
+
+or, if you want to be explicit:
+
+    $ make TESTS='alltests -test_fuzz' test
+
+Run all tests that have a name starting with "test_ssl" but not those
+starting with "test_ssl_":
+
+    $ make TESTS='test_ssl* -test_ssl_*' test
+
+Run only test group 10:
+
+    $ make TESTS='10'
+
+Run all tests except the slow group (group 99):
+
+    $ make TESTS='-99'
+
+Run all tests in test groups 80 to 99 except for tests in group 90:
+
+    $ make TESTS='[89]? -90'
+
+To stochastically verify that the algorithm that produces uniformly distributed
+random numbers is operating correctly (with a false positive rate of 0.01%):
+
+    $ ./util/wrap.sh test/bntest -stochastic
+
+Troubleshooting
+===============
+
+Configuration Problems
+----------------------
+
+### Selecting the correct target
+
+The `./config` script tries hard to guess your operating system, but in some
+cases it does not succeed. You will see a message like the following:
+
+    $ ./config
+    Operating system: x86-whatever-minix
+    This system (minix) is not supported. See file INSTALL for details.
+
+Even if the automatic target selection by the `./config` script fails, chances
+are that you still might find a suitable target in the Configurations directory,
+which you can supply to the `./Configure` command, possibly after some adjustment.
+
+The Configurations directory contains a lot of examples of such targets.
+The main configuration file is [10-main.conf][], which contains all targets that
+are officially supported by the OpenSSL team. Other configuration files contain
+targets contributed by other OpenSSL users. The list of targets can be found in
+a Perl list `my %targets = ( ... )`.
+
+    my %targets = (
+    ...
+    "target-name" => {
+        inherit_from     => [ "base-target" ],
+        CC               => "...",
+        cflags           => add("..."),
+        asm_arch         => '...',
+        perlasm_scheme   => "...",
+    },
+    ...
+    )
+
+If you call `.\Configure` without arguments, it will give you a list of all
+known targets. Using `grep`, you can lookup the target definition in the
+Configurations directory. For example the "android-x86_64" can be found in
+Configurations/15-android.conf.
+
+The directory contains two README files, which explain the general syntax and
+design of the configurations files.
+
+ - [Configurations/README](Configurations/README)
+ - [Configurations/README.design](Configurations/README.design)
+
+If you need further help, try to search the [openssl-users][] mailing list
+or the [GitHub Issues][] for existing solutions. If you don't find anything,
+you can [raise an issue][] to ask a question yourself.
+
+More about our support resources can be found in the [SUPPORT][] file.
+
+### Configuration Errors
+
+If the `./config` or `./Configure`  command fails with an error message,
+read the error message carefully and try to figure out whether you made
+a mistake (e.g., by providing a wrong option), or whether the script is
+working incorrectly. If you think you encountered a bug, please
+[raise an issue][] on GitHub to file a bug report.
+
+Along with a short description of the bug, please provide the complete
+configure command line and the relevant output including the error message.
+
+Note: To make the output readable, pleace add a 'code fence' (three backquotes
+` ``` ` on a separate line) before and after your output:
+
+     ```
+     $ ./Configure [your arguments...]
+
+     [output...]
+
+     ```
+
+Build Failures
+--------------
+
+If the build fails, look carefully at the output. Try to locate and understand
+the error message. It might be that the compiler is already telling you
+exactly what you need to do to fix your problem.
+
+There may be reasons for the failure that aren't problems in OpenSSL itself,
+for example if the compiler reports missing standard or third party headers.
+
+If the build succeeded previously, but fails after a source or configuration
+change, it might be helpful to clean the build tree before attempting another
+build.  Use this command:
+
+    $ make clean                                     # Unix
+    $ mms clean                                      ! (or mmk) OpenVMS
+    $ nmake clean                                    # Windows
+
+Assembler error messages can sometimes be sidestepped by using the
+"no-asm" configuration option.
+
+Compiling parts of OpenSSL with gcc and others with the system compiler will
+result in unresolved symbols on some systems.
+
+If you are still having problems, try to search the [openssl-users][] mailing
+list or the [GitHub Issues][] for existing solutions. If you think you
+encountered an OpenSSL bug, please [raise an issue][] to file a bug report.
+Please take the time to review the existing issues first; maybe the bug was
+already reported or has already been fixed.
+
+Test Failures
+-------------
+
+If some tests fail, look at the output.  There may be reasons for the failure
+that isn't a problem in OpenSSL itself (like a malfunction with Perl).
+You may want increased verbosity, that can be accomplished like this:
+
+Verbosity on failure only (make macro VERBOSE_FAILURE or VF):
+
+    $ make VF=1 test                                 # Unix
+    $ mms /macro=(VF=1) test                         ! OpenVMS
+    $ nmake VF=1 test                                # Windows
+
+Full verbosity (make macro VERBOSE or V):
+
+    $ make V=1 test                                  # Unix
+    $ mms /macro=(V=1) test                          ! OpenVMS
+    $ nmake V=1 test                                 # Windows
+
+If you want to run just one or a few specific tests, you can use
+the make variable TESTS to specify them, like this:
+
+    $ make TESTS='test_rsa test_dsa' test            # Unix
+    $ mms/macro="TESTS=test_rsa test_dsa" test       ! OpenVMS
+    $ nmake TESTS='test_rsa test_dsa' test           # Windows
+
+And of course, you can combine (Unix example shown):
+
+    $ make VF=1 TESTS='test_rsa test_dsa' test
+
+You can find the list of available tests like this:
+
+    $ make list-tests                                # Unix
+    $ mms list-tests                                 ! OpenVMS
+    $ nmake list-tests                               # Windows
+
+Have a look at the manual for the perl module Test::Harness to
+see what other HARNESS_* variables there are.
+
+If you find a problem with OpenSSL itself, try removing any
+compiler optimization flags from the CFLAGS line in Makefile and
+run "make clean; make" or corresponding.
+
+To report a bug please open an issue on GitHub, at
+<https://github.com/openssl/openssl/issues>.
+
+For more details on how the make variables TESTS can be used,
+see section [Running Selected Tests](#running-selected-tests) below.
+
+Notes
+=====
+
+Notes on multi-threading
+------------------------
+
+For some systems, the OpenSSL Configure script knows what compiler options
+are needed to generate a library that is suitable for multi-threaded
+applications.  On these systems, support for multi-threading is enabled
+by default; use the "no-threads" option to disable (this should never be
+necessary).
+
+On other systems, to enable support for multi-threading, you will have
+to specify at least two options: "threads", and a system-dependent option.
+(The latter is "-D_REENTRANT" on various systems.)  The default in this
+case, obviously, is not to include support for multi-threading (but
+you can still use "no-threads" to suppress an annoying warning message
+from the Configure script.)
+
+OpenSSL provides built-in support for two threading models: pthreads (found on
+most UNIX/Linux systems), and Windows threads.  No other threading models are
+supported.  If your platform does not provide pthreads or Windows threads then
+you should Configure with the "no-threads" option.
+
+Notes on shared libraries
+-------------------------
+
+For most systems the OpenSSL Configure script knows what is needed to
+build shared libraries for libcrypto and libssl.  On these systems
+the shared libraries will be created by default.  This can be suppressed and
+only static libraries created by using the "no-shared" option.  On systems
+where OpenSSL does not know how to build shared libraries the "no-shared"
+option will be forced and only static libraries will be created.
+
+Shared libraries are named a little differently on different platforms.
+One way or another, they all have the major OpenSSL version number as
+part of the file name, i.e.  for OpenSSL 1.1.x, 1.1 is somehow part of
+the name.
+
+On most POSIX platforms, shared libraries are named libcrypto.so.1.1
+and libssl.so.1.1.
+
+on Cygwin, shared libraries are named cygcrypto-1.1.dll and cygssl-1.1.dll
+with import libraries libcrypto.dll.a and libssl.dll.a.
+
+On Windows build with MSVC or using MingW, shared libraries are named
+libcrypto-1_1.dll and libssl-1_1.dll for 32-bit Windows, libcrypto-1_1-x64.dll
+and libssl-1_1-x64.dll for 64-bit x86_64 Windows, and libcrypto-1_1-ia64.dll
+and libssl-1_1-ia64.dll for IA64 Windows.  With MSVC, the import libraries
+are named libcrypto.lib and libssl.lib, while with MingW, they are named
+libcrypto.dll.a and libssl.dll.a.
+
+On VMS, shareable images (VMS speak for shared libraries) are named
+ossl$libcrypto0101_shr.exe and ossl$libssl0101_shr.exe.  However, when
+OpenSSL is specifically built for 32-bit pointers, the shareable images
+are named ossl$libcrypto0101_shr32.exe and ossl$libssl0101_shr32.exe
+instead, and when built for 64-bit pointers, they are named
+ossl$libcrypto0101_shr64.exe and ossl$libssl0101_shr64.exe.
+
+Notes on random number generation
+---------------------------------
+
+Availability of cryptographically secure random numbers is required for
+secret key generation.  OpenSSL provides several options to seed the
+internal CSPRNG.  If not properly seeded, the internal CSPRNG will refuse
+to deliver random bytes and a "PRNG not seeded error" will occur.
+
+The seeding method can be configured using the `--with-rand-seed` option,
+which can be used to specify a comma separated list of seed methods.
+However in most cases OpenSSL will choose a suitable default method,
+so it is not necessary to explicitly provide this option.  Note also
+that not all methods are available on all platforms.
+
+I) On operating systems which provide a suitable randomness source (in
+form  of a system call or system device), OpenSSL will use the optimal
+available  method to seed the CSPRNG from the operating system's
+randomness sources.  This corresponds to the option `--with-rand-seed=os`.
+
+II) On systems without such a suitable randomness source, automatic seeding
+and reseeding is disabled (--with-rand-seed=none) and it may be necessary
+to install additional support software to obtain a random seed and reseed
+the CSPRNG manually.  Please check out the manual pages for RAND_add(),
+RAND_bytes(), RAND_egd(), and the FAQ for more information.
+
+<!-- Links  -->
+
+[openssl-users]:
+    <https://mta.openssl.org/mailman/listinfo/openssl-users>
+
+[SUPPORT]:
+    ./SUPPORT.md
+
+[GitHub Issues]:
+    <https://github.com/openssl/openssl/issues>
+
+[raise an issue]:
+    <https://github.com/openssl/openssl/issues/new/choose>
+
+[10-main.conf]:
+    Configurations/10-main.conf

LICENSE

@@ -1,125 +1,177 @@
 
-  LICENSE ISSUES
-  ==============
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
 
-  The OpenSSL toolkit stays under a double license, i.e. both the conditions of
-  the OpenSSL License and the original SSLeay license apply to the toolkit.
-  See below for the actual license texts.
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
-  OpenSSL License
-  ---------------
+   1. Definitions.
 
-/* ====================================================================
- * Copyright (c) 1998-2018 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    openssl-core@openssl.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
 
- Original SSLeay License
- -----------------------
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
 
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
 
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

NEWS

@@ -1,884 +0,0 @@
-
-  NEWS
-  ====
-
-  This file gives a brief overview of the major changes between each OpenSSL
-  release. For more details please read the CHANGES file.
-
-  Major changes between OpenSSL 1.1.0h and OpenSSL 1.1.1 [in pre-release]
-
-      o Support for TLSv1.3 added
-      o Move the display of configuration data to configdata.pm.
-      o Allow GNU style "make variables" to be used with Configure.
-      o Add a STORE module (OSSL_STORE)
-      o Claim the namespaces OSSL and OPENSSL, represented as symbol prefixes
-      o Add multi-prime RSA (RFC 8017) support
-      o Add SM3 implemented according to GB/T 32905-2016
-      o Add SM4 implemented according to GB/T 32907-2016.
-      o Add 'Maximum Fragment Length' TLS extension negotiation and support
-      o Add ARIA support
-      o Add SHA3
-      o Rewrite of devcrypto engine
-      o Add support for SipHash
-      o Grand redesign of the OpenSSL random generator
-
-  Major changes between OpenSSL 1.1.0g and OpenSSL 1.1.0h [under development]
-
-      o Constructed ASN.1 types with a recursive definition could exceed the
-        stack (CVE-2018-0739)
-      o Incorrect CRYPTO_memcmp on HP-UX PA-RISC (CVE-2018-0733)
-      o rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
-
-  Major changes between OpenSSL 1.1.0f and OpenSSL 1.1.0g [2 Nov 2017]
-
-      o bn_sqrx8x_internal carry bug on x86_64 (CVE-2017-3736)
-      o Malformed X.509 IPAddressFamily could cause OOB read (CVE-2017-3735)
-
-  Major changes between OpenSSL 1.1.0e and OpenSSL 1.1.0f [25 May 2017]
-
-      o config now recognises 64-bit mingw and chooses mingw64 instead of mingw
-
-  Major changes between OpenSSL 1.1.0d and OpenSSL 1.1.0e [16 Feb 2017]
-
-      o Encrypt-Then-Mac renegotiation crash (CVE-2017-3733)
-
-  Major changes between OpenSSL 1.1.0c and OpenSSL 1.1.0d [26 Jan 2017]
-
-      o Truncated packet could crash via OOB read (CVE-2017-3731)
-      o Bad (EC)DHE parameters cause a client crash (CVE-2017-3730)
-      o BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
-
-  Major changes between OpenSSL 1.1.0b and OpenSSL 1.1.0c [10 Nov 2016]
-
-      o ChaCha20/Poly1305 heap-buffer-overflow (CVE-2016-7054)
-      o CMS Null dereference (CVE-2016-7053)
-      o Montgomery multiplication may produce incorrect results (CVE-2016-7055)
-
-  Major changes between OpenSSL 1.1.0a and OpenSSL 1.1.0b [26 Sep 2016]
-
-      o Fix Use After Free for large message sizes (CVE-2016-6309)
-
-  Major changes between OpenSSL 1.1.0 and OpenSSL 1.1.0a [22 Sep 2016]
-
-      o OCSP Status Request extension unbounded memory growth (CVE-2016-6304)
-      o SSL_peek() hang on empty record (CVE-2016-6305)
-      o Excessive allocation of memory in tls_get_message_header()
-       (CVE-2016-6307)
-      o Excessive allocation of memory in dtls1_preprocess_fragment()
-       (CVE-2016-6308)
-
-  Major changes between OpenSSL 1.0.2h and OpenSSL 1.1.0 [25 Aug 2016]
-
-      o Copyright text was shrunk to a boilerplate that points to the license
-      o "shared" builds are now the default when possible
-      o Added support for "pipelining"
-      o Added the AFALG engine
-      o New threading API implemented
-      o Support for ChaCha20 and Poly1305 added to libcrypto and libssl
-      o Support for extended master secret
-      o CCM ciphersuites
-      o Reworked test suite, now based on perl, Test::Harness and Test::More
-      o *Most* libcrypto and libssl public structures were made opaque,
-        including:
-        BIGNUM and associated types, EC_KEY and EC_KEY_METHOD,
-        DH and DH_METHOD, DSA and DSA_METHOD, RSA and RSA_METHOD,
-        BIO and BIO_METHOD, EVP_MD_CTX, EVP_MD, EVP_CIPHER_CTX,
-        EVP_CIPHER, EVP_PKEY and associated types, HMAC_CTX,
-        X509, X509_CRL, X509_OBJECT, X509_STORE_CTX, X509_STORE,
-        X509_LOOKUP, X509_LOOKUP_METHOD
-      o libssl internal structures made opaque
-      o SSLv2 support removed
-      o Kerberos ciphersuite support removed
-      o RC4 removed from DEFAULT ciphersuites in libssl
-      o 40 and 56 bit cipher support removed from libssl
-      o All public header files moved to include/openssl, no more symlinking
-      o SSL/TLS state machine, version negotiation and record layer rewritten
-      o EC revision: now operations use new EC_KEY_METHOD.
-      o Support for OCB mode added to libcrypto
-      o Support for asynchronous crypto operations added to libcrypto and libssl
-      o Deprecated interfaces can now be disabled at build time either
-        relative to the latest release via the "no-deprecated" Configure
-        argument, or via the "--api=1.1.0|1.0.0|0.9.8" option.
-      o Application software can be compiled with -DOPENSSL_API_COMPAT=version
-        to ensure that features deprecated in that version are not exposed.
-      o Support for RFC6698/RFC7671 DANE TLSA peer authentication
-      o Change of Configure to use --prefix as the main installation
-        directory location rather than --openssldir.  The latter becomes
-        the directory for certs, private key and openssl.cnf exclusively.
-      o Reworked BIO networking library, with full support for IPv6.
-      o New "unified" build system
-      o New security levels
-      o Support for scrypt algorithm
-      o Support for X25519
-      o Extended SSL_CONF support using configuration files
-      o KDF algorithm support. Implement TLS PRF as a KDF.
-      o Support for Certificate Transparency
-      o HKDF support.
-
-  Major changes between OpenSSL 1.0.2g and OpenSSL 1.0.2h [3 May 2016]
-
-      o Prevent padding oracle in AES-NI CBC MAC check (CVE-2016-2107)
-      o Fix EVP_EncodeUpdate overflow (CVE-2016-2105)
-      o Fix EVP_EncryptUpdate overflow (CVE-2016-2106)
-      o Prevent ASN.1 BIO excessive memory allocation (CVE-2016-2109)
-      o EBCDIC overread (CVE-2016-2176)
-      o Modify behavior of ALPN to invoke callback after SNI/servername
-        callback, such that updates to the SSL_CTX affect ALPN.
-      o Remove LOW from the DEFAULT cipher list.  This removes singles DES from
-        the default.
-      o Only remove the SSLv2 methods with the no-ssl2-method option.
-
-  Major changes between OpenSSL 1.0.2f and OpenSSL 1.0.2g [1 Mar 2016]
-
-      o Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
-      o Disable SSLv2 default build, default negotiation and weak ciphers
-        (CVE-2016-0800)
-      o Fix a double-free in DSA code (CVE-2016-0705)
-      o Disable SRP fake user seed to address a server memory leak
-        (CVE-2016-0798)
-      o Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
-        (CVE-2016-0797)
-      o Fix memory issues in BIO_*printf functions (CVE-2016-0799)
-      o Fix side channel attack on modular exponentiation (CVE-2016-0702)
-
-  Major changes between OpenSSL 1.0.2e and OpenSSL 1.0.2f [28 Jan 2016]
-
-      o DH small subgroups (CVE-2016-0701)
-      o SSLv2 doesn't block disabled ciphers (CVE-2015-3197)
-
-  Major changes between OpenSSL 1.0.2d and OpenSSL 1.0.2e [3 Dec 2015]
-
-      o BN_mod_exp may produce incorrect results on x86_64 (CVE-2015-3193)
-      o Certificate verify crash with missing PSS parameter (CVE-2015-3194)
-      o X509_ATTRIBUTE memory leak (CVE-2015-3195)
-      o Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs
-      o In DSA_generate_parameters_ex, if the provided seed is too short,
-        return an error
-
-  Major changes between OpenSSL 1.0.2c and OpenSSL 1.0.2d [9 Jul 2015]
-
-      o Alternate chains certificate forgery (CVE-2015-1793)
-      o Race condition handling PSK identify hint (CVE-2015-3196)
-
-  Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [12 Jun 2015]
-
-      o Fix HMAC ABI incompatibility
-
-  Major changes between OpenSSL 1.0.2a and OpenSSL 1.0.2b [11 Jun 2015]
-
-      o Malformed ECParameters causes infinite loop (CVE-2015-1788)
-      o Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
-      o PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
-      o CMS verify infinite loop with unknown hash function (CVE-2015-1792)
-      o Race condition handling NewSessionTicket (CVE-2015-1791)
-
-  Major changes between OpenSSL 1.0.2 and OpenSSL 1.0.2a [19 Mar 2015]
-
-      o OpenSSL 1.0.2 ClientHello sigalgs DoS fix (CVE-2015-0291)
-      o Multiblock corrupted pointer fix (CVE-2015-0290)
-      o Segmentation fault in DTLSv1_listen fix (CVE-2015-0207)
-      o Segmentation fault in ASN1_TYPE_cmp fix (CVE-2015-0286)
-      o Segmentation fault for invalid PSS parameters fix (CVE-2015-0208)
-      o ASN.1 structure reuse memory corruption fix (CVE-2015-0287)
-      o PKCS7 NULL pointer dereferences fix (CVE-2015-0289)
-      o DoS via reachable assert in SSLv2 servers fix (CVE-2015-0293)
-      o Empty CKE with client auth and DHE fix (CVE-2015-1787)
-      o Handshake with unseeded PRNG fix (CVE-2015-0285)
-      o Use After Free following d2i_ECPrivatekey error fix (CVE-2015-0209)
-      o X509_to_X509_REQ NULL pointer deref fix (CVE-2015-0288)
-      o Removed the export ciphers from the DEFAULT ciphers
-
-  Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.2 [22 Jan 2015]:
-
-      o Suite B support for TLS 1.2 and DTLS 1.2
-      o Support for DTLS 1.2
-      o TLS automatic EC curve selection.
-      o API to set TLS supported signature algorithms and curves
-      o SSL_CONF configuration API.
-      o TLS Brainpool support.
-      o ALPN support.
-      o CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
-
-  Major changes between OpenSSL 1.0.1k and OpenSSL 1.0.1l [15 Jan 2015]
-
-      o Build fixes for the Windows and OpenVMS platforms
-
-  Major changes between OpenSSL 1.0.1j and OpenSSL 1.0.1k [8 Jan 2015]
-
-      o Fix for CVE-2014-3571
-      o Fix for CVE-2015-0206
-      o Fix for CVE-2014-3569
-      o Fix for CVE-2014-3572
-      o Fix for CVE-2015-0204
-      o Fix for CVE-2015-0205
-      o Fix for CVE-2014-8275
-      o Fix for CVE-2014-3570
-
-  Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014]
-
-      o Fix for CVE-2014-3513
-      o Fix for CVE-2014-3567
-      o Mitigation for CVE-2014-3566 (SSL protocol vulnerability)
-      o Fix for CVE-2014-3568
-
-  Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014]
-
-      o Fix for CVE-2014-3512
-      o Fix for CVE-2014-3511
-      o Fix for CVE-2014-3510
-      o Fix for CVE-2014-3507
-      o Fix for CVE-2014-3506
-      o Fix for CVE-2014-3505
-      o Fix for CVE-2014-3509
-      o Fix for CVE-2014-5139
-      o Fix for CVE-2014-3508
-
-  Major changes between OpenSSL 1.0.1g and OpenSSL 1.0.1h [5 Jun 2014]
-
-      o Fix for CVE-2014-0224
-      o Fix for CVE-2014-0221
-      o Fix for CVE-2014-0198
-      o Fix for CVE-2014-0195
-      o Fix for CVE-2014-3470
-      o Fix for CVE-2010-5298
-
-  Major changes between OpenSSL 1.0.1f and OpenSSL 1.0.1g [7 Apr 2014]
-
-      o Fix for CVE-2014-0160
-      o Add TLS padding extension workaround for broken servers.
-      o Fix for CVE-2014-0076
-
-  Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]
-
-      o Don't include gmt_unix_time in TLS server and client random values
-      o Fix for TLS record tampering bug CVE-2013-4353
-      o Fix for TLS version checking bug CVE-2013-6449
-      o Fix for DTLS retransmission bug CVE-2013-6450
-
-  Major changes between OpenSSL 1.0.1d and OpenSSL 1.0.1e [11 Feb 2013]:
-
-      o Corrected fix for CVE-2013-0169
-
-  Major changes between OpenSSL 1.0.1c and OpenSSL 1.0.1d [4 Feb 2013]:
-
-      o Fix renegotiation in TLS 1.1, 1.2 by using the correct TLS version.
-      o Include the fips configuration module.
-      o Fix OCSP bad key DoS attack CVE-2013-0166
-      o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169
-      o Fix for TLS AESNI record handling flaw CVE-2012-2686
-
-  Major changes between OpenSSL 1.0.1b and OpenSSL 1.0.1c [10 May 2012]:
-
-      o Fix TLS/DTLS record length checking bug CVE-2012-2333
-      o Don't attempt to use non-FIPS composite ciphers in FIPS mode.
-
-  Major changes between OpenSSL 1.0.1a and OpenSSL 1.0.1b [26 Apr 2012]:
-
-      o Fix compilation error on non-x86 platforms.
-      o Make FIPS capable OpenSSL ciphers work in non-FIPS mode.
-      o Fix SSL_OP_NO_TLSv1_1 clash with SSL_OP_ALL in OpenSSL 1.0.0
-
-  Major changes between OpenSSL 1.0.1 and OpenSSL 1.0.1a [19 Apr 2012]:
-
-      o Fix for ASN1 overflow bug CVE-2012-2110
-      o Workarounds for some servers that hang on long client hellos.
-      o Fix SEGV in AES code.
-
-  Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.1 [14 Mar 2012]:
-
-      o TLS/DTLS heartbeat support.
-      o SCTP support.
-      o RFC 5705 TLS key material exporter.
-      o RFC 5764 DTLS-SRTP negotiation.
-      o Next Protocol Negotiation.
-      o PSS signatures in certificates, requests and CRLs.
-      o Support for password based recipient info for CMS.
-      o Support TLS v1.2 and TLS v1.1.
-      o Preliminary FIPS capability for unvalidated 2.0 FIPS module.
-      o SRP support.
-
-  Major changes between OpenSSL 1.0.0g and OpenSSL 1.0.0h [12 Mar 2012]:
-
-      o Fix for CMS/PKCS#7 MMA CVE-2012-0884
-      o Corrected fix for CVE-2011-4619
-      o Various DTLS fixes.
-
-  Major changes between OpenSSL 1.0.0f and OpenSSL 1.0.0g [18 Jan 2012]:
-
-      o Fix for DTLS DoS issue CVE-2012-0050
-
-  Major changes between OpenSSL 1.0.0e and OpenSSL 1.0.0f [4 Jan 2012]:
-
-      o Fix for DTLS plaintext recovery attack CVE-2011-4108
-      o Clear block padding bytes of SSL 3.0 records CVE-2011-4576
-      o Only allow one SGC handshake restart for SSL/TLS CVE-2011-4619
-      o Check parameters are not NULL in GOST ENGINE CVE-2012-0027
-      o Check for malformed RFC3779 data CVE-2011-4577
-
-  Major changes between OpenSSL 1.0.0d and OpenSSL 1.0.0e [6 Sep 2011]:
-
-      o Fix for CRL vulnerability issue CVE-2011-3207
-      o Fix for ECDH crashes CVE-2011-3210
-      o Protection against EC timing attacks.
-      o Support ECDH ciphersuites for certificates using SHA2 algorithms.
-      o Various DTLS fixes.
-
-  Major changes between OpenSSL 1.0.0c and OpenSSL 1.0.0d [8 Feb 2011]:
-
-      o Fix for security issue CVE-2011-0014
-
-  Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c [2 Dec 2010]:
-
-      o Fix for security issue CVE-2010-4180
-      o Fix for CVE-2010-4252
-      o Fix mishandling of absent EC point format extension.
-      o Fix various platform compilation issues.
-      o Corrected fix for security issue CVE-2010-3864.
-
-  Major changes between OpenSSL 1.0.0a and OpenSSL 1.0.0b [16 Nov 2010]:
-
-      o Fix for security issue CVE-2010-3864.
-      o Fix for CVE-2010-2939
-      o Fix WIN32 build system for GOST ENGINE.
-
-  Major changes between OpenSSL 1.0.0 and OpenSSL 1.0.0a [1 Jun 2010]:
-
-      o Fix for security issue CVE-2010-1633.
-      o GOST MAC and CFB fixes.
-
-  Major changes between OpenSSL 0.9.8n and OpenSSL 1.0.0 [29 Mar 2010]:
-
-      o RFC3280 path validation: sufficient to process PKITS tests.
-      o Integrated support for PVK files and keyblobs.
-      o Change default private key format to PKCS#8.
-      o CMS support: able to process all examples in RFC4134
-      o Streaming ASN1 encode support for PKCS#7 and CMS.
-      o Multiple signer and signer add support for PKCS#7 and CMS.
-      o ASN1 printing support.
-      o Whirlpool hash algorithm added.
-      o RFC3161 time stamp support.
-      o New generalised public key API supporting ENGINE based algorithms.
-      o New generalised public key API utilities.
-      o New ENGINE supporting GOST algorithms.
-      o SSL/TLS GOST ciphersuite support.
-      o PKCS#7 and CMS GOST support.
-      o RFC4279 PSK ciphersuite support.
-      o Supported points format extension for ECC ciphersuites.
-      o ecdsa-with-SHA224/256/384/512 signature types.
-      o dsa-with-SHA224 and dsa-with-SHA256 signature types.
-      o Opaque PRF Input TLS extension support.
-      o Updated time routines to avoid OS limitations.
-
-  Major changes between OpenSSL 0.9.8m and OpenSSL 0.9.8n [24 Mar 2010]:
-
-      o CFB cipher definition fixes.
-      o Fix security issues CVE-2010-0740 and CVE-2010-0433.
-
-  Major changes between OpenSSL 0.9.8l and OpenSSL 0.9.8m [25 Feb 2010]:
-
-      o Cipher definition fixes.
-      o Workaround for slow RAND_poll() on some WIN32 versions.
-      o Remove MD2 from algorithm tables.
-      o SPKAC handling fixes.
-      o Support for RFC5746 TLS renegotiation extension.
-      o Compression memory leak fixed.
-      o Compression session resumption fixed.
-      o Ticket and SNI coexistence fixes.
-      o Many fixes to DTLS handling.
-
-  Major changes between OpenSSL 0.9.8k and OpenSSL 0.9.8l [5 Nov 2009]:
-
-      o Temporary work around for CVE-2009-3555: disable renegotiation.
-
-  Major changes between OpenSSL 0.9.8j and OpenSSL 0.9.8k [25 Mar 2009]:
-
-      o Fix various build issues.
-      o Fix security issues (CVE-2009-0590, CVE-2009-0591, CVE-2009-0789)
-
-  Major changes between OpenSSL 0.9.8i and OpenSSL 0.9.8j [7 Jan 2009]:
-
-      o Fix security issue (CVE-2008-5077)
-      o Merge FIPS 140-2 branch code.
-
-  Major changes between OpenSSL 0.9.8g and OpenSSL 0.9.8h [28 May 2008]:
-
-      o CryptoAPI ENGINE support.
-      o Various precautionary measures.
-      o Fix for bugs affecting certificate request creation.
-      o Support for local machine keyset attribute in PKCS#12 files.
-
-  Major changes between OpenSSL 0.9.8f and OpenSSL 0.9.8g [19 Oct 2007]:
-
-      o Backport of CMS functionality to 0.9.8.
-      o Fixes for bugs introduced with 0.9.8f.
-
-  Major changes between OpenSSL 0.9.8e and OpenSSL 0.9.8f [11 Oct 2007]:
-
-      o Add gcc 4.2 support.
-      o Add support for AES and SSE2 assembly language optimization
-        for VC++ build.
-      o Support for RFC4507bis and server name extensions if explicitly
-        selected at compile time.
-      o DTLS improvements.
-      o RFC4507bis support.
-      o TLS Extensions support.
-
-  Major changes between OpenSSL 0.9.8d and OpenSSL 0.9.8e [23 Feb 2007]:
-
-      o Various ciphersuite selection fixes.
-      o RFC3779 support.
-
-  Major changes between OpenSSL 0.9.8c and OpenSSL 0.9.8d [28 Sep 2006]:
-
-      o Introduce limits to prevent malicious key DoS  (CVE-2006-2940)
-      o Fix security issues (CVE-2006-2937, CVE-2006-3737, CVE-2006-4343)
-      o Changes to ciphersuite selection algorithm
-
-  Major changes between OpenSSL 0.9.8b and OpenSSL 0.9.8c [5 Sep 2006]:
-
-      o Fix Daniel Bleichenbacher forged signature attack, CVE-2006-4339
-      o New cipher Camellia
-
-  Major changes between OpenSSL 0.9.8a and OpenSSL 0.9.8b [4 May 2006]:
-
-      o Cipher string fixes.
-      o Fixes for VC++ 2005.
-      o Updated ECC cipher suite support.
-      o New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free().
-      o Zlib compression usage fixes.
-      o Built in dynamic engine compilation support on Win32.
-      o Fixes auto dynamic engine loading in Win32.
-
-  Major changes between OpenSSL 0.9.8 and OpenSSL 0.9.8a [11 Oct 2005]:
-
-      o Fix potential SSL 2.0 rollback, CVE-2005-2969
-      o Extended Windows CE support
-
-  Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.8 [5 Jul 2005]:
-
-      o Major work on the BIGNUM library for higher efficiency and to
-        make operations more streamlined and less contradictory.  This
-        is the result of a major audit of the BIGNUM library.
-      o Addition of BIGNUM functions for fields GF(2^m) and NIST
-        curves, to support the Elliptic Crypto functions.
-      o Major work on Elliptic Crypto; ECDH and ECDSA added, including
-        the use through EVP, X509 and ENGINE.
-      o New ASN.1 mini-compiler that's usable through the OpenSSL
-        configuration file.
-      o Added support for ASN.1 indefinite length constructed encoding.
-      o New PKCS#12 'medium level' API to manipulate PKCS#12 files.
-      o Complete rework of shared library construction and linking
-        programs with shared or static libraries, through a separate
-        Makefile.shared.
-      o Rework of the passing of parameters from one Makefile to another.
-      o Changed ENGINE framework to load dynamic engine modules
-        automatically from specifically given directories.
-      o New structure and ASN.1 functions for CertificatePair.
-      o Changed the ZLIB compression method to be stateful.
-      o Changed the key-generation and primality testing "progress"
-        mechanism to take a structure that contains the ticker
-        function and an argument.
-      o New engine module: GMP (performs private key exponentiation).
-      o New engine module: VIA PadLOck ACE extension in VIA C3
-        Nehemiah processors.
-      o Added support for IPv6 addresses in certificate extensions.
-        See RFC 1884, section 2.2.
-      o Added support for certificate policy mappings, policy
-        constraints and name constraints.
-      o Added support for multi-valued AVAs in the OpenSSL
-        configuration file.
-      o Added support for multiple certificates with the same subject
-        in the 'openssl ca' index file.
-      o Make it possible to create self-signed certificates using
-        'openssl ca -selfsign'.
-      o Make it possible to generate a serial number file with
-        'openssl ca -create_serial'.
-      o New binary search functions with extended functionality.
-      o New BUF functions.
-      o New STORE structure and library to provide an interface to all
-        sorts of data repositories.  Supports storage of public and
-        private keys, certificates, CRLs, numbers and arbitrary blobs.
-        This library is unfortunately unfinished and unused within
-        OpenSSL.
-      o New control functions for the error stack.
-      o Changed the PKCS#7 library to support one-pass S/MIME
-        processing.
-      o Added the possibility to compile without old deprecated
-        functionality with the OPENSSL_NO_DEPRECATED macro or the
-        'no-deprecated' argument to the config and Configure scripts.
-      o Constification of all ASN.1 conversion functions, and other
-        affected functions.
-      o Improved platform support for PowerPC.
-      o New FIPS 180-2 algorithms (SHA-224, -256, -384 and -512).
-      o New X509_VERIFY_PARAM structure to support parameterisation
-        of X.509 path validation.
-      o Major overhaul of RC4 performance on Intel P4, IA-64 and
-        AMD64.
-      o Changed the Configure script to have some algorithms disabled
-        by default.  Those can be explicitly enabled with the new
-        argument form 'enable-xxx'.
-      o Change the default digest in 'openssl' commands from MD5 to
-        SHA-1.
-      o Added support for DTLS.
-      o New BIGNUM blinding.
-      o Added support for the RSA-PSS encryption scheme
-      o Added support for the RSA X.931 padding.
-      o Added support for BSD sockets on NetWare.
-      o Added support for files larger than 2GB.
-      o Added initial support for Win64.
-      o Added alternate pkg-config files.
-
-  Major changes between OpenSSL 0.9.7l and OpenSSL 0.9.7m [23 Feb 2007]:
-
-      o FIPS 1.1.1 module linking.
-      o Various ciphersuite selection fixes.
-
-  Major changes between OpenSSL 0.9.7k and OpenSSL 0.9.7l [28 Sep 2006]:
-
-      o Introduce limits to prevent malicious key DoS  (CVE-2006-2940)
-      o Fix security issues (CVE-2006-2937, CVE-2006-3737, CVE-2006-4343)
-
-  Major changes between OpenSSL 0.9.7j and OpenSSL 0.9.7k [5 Sep 2006]:
-
-      o Fix Daniel Bleichenbacher forged signature attack, CVE-2006-4339
-
-  Major changes between OpenSSL 0.9.7i and OpenSSL 0.9.7j [4 May 2006]:
-
-      o Visual C++ 2005 fixes.
-      o Update Windows build system for FIPS.
-
-  Major changes between OpenSSL 0.9.7h and OpenSSL 0.9.7i [14 Oct 2005]:
-
-      o Give EVP_MAX_MD_SIZE it's old value, except for a FIPS build.
-
-  Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.7h [11 Oct 2005]:
-
-      o Fix SSL 2.0 Rollback, CVE-2005-2969
-      o Allow use of fixed-length exponent on DSA signing
-      o Default fixed-window RSA, DSA, DH private-key operations
-
-  Major changes between OpenSSL 0.9.7f and OpenSSL 0.9.7g [11 Apr 2005]:
-
-      o More compilation issues fixed.
-      o Adaptation to more modern Kerberos API.
-      o Enhanced or corrected configuration for Solaris64, Mingw and Cygwin.
-      o Enhanced x86_64 assembler BIGNUM module.
-      o More constification.
-      o Added processing of proxy certificates (RFC 3820).
-
-  Major changes between OpenSSL 0.9.7e and OpenSSL 0.9.7f [22 Mar 2005]:
-
-      o Several compilation issues fixed.
-      o Many memory allocation failure checks added.
-      o Improved comparison of X509 Name type.
-      o Mandatory basic checks on certificates.
-      o Performance improvements.
-
-  Major changes between OpenSSL 0.9.7d and OpenSSL 0.9.7e [25 Oct 2004]:
-
-      o Fix race condition in CRL checking code.
-      o Fixes to PKCS#7 (S/MIME) code.
-
-  Major changes between OpenSSL 0.9.7c and OpenSSL 0.9.7d [17 Mar 2004]:
-
-      o Security: Fix Kerberos ciphersuite SSL/TLS handshaking bug
-      o Security: Fix null-pointer assignment in do_change_cipher_spec()
-      o Allow multiple active certificates with same subject in CA index
-      o Multiple X509 verification fixes
-      o Speed up HMAC and other operations
-
-  Major changes between OpenSSL 0.9.7b and OpenSSL 0.9.7c [30 Sep 2003]:
-
-      o Security: fix various ASN1 parsing bugs.
-      o New -ignore_err option to OCSP utility.
-      o Various interop and bug fixes in S/MIME code.
-      o SSL/TLS protocol fix for unrequested client certificates.
-
-  Major changes between OpenSSL 0.9.7a and OpenSSL 0.9.7b [10 Apr 2003]:
-
-      o Security: counter the Klima-Pokorny-Rosa extension of
-        Bleichbacher's attack
-      o Security: make RSA blinding default.
-      o Configuration: Irix fixes, AIX fixes, better mingw support.
-      o Support for new platforms: linux-ia64-ecc.
-      o Build: shared library support fixes.
-      o ASN.1: treat domainComponent correctly.
-      o Documentation: fixes and additions.
-
-  Major changes between OpenSSL 0.9.7 and OpenSSL 0.9.7a [19 Feb 2003]:
-
-      o Security: Important security related bugfixes.
-      o Enhanced compatibility with MIT Kerberos.
-      o Can be built without the ENGINE framework.
-      o IA32 assembler enhancements.
-      o Support for new platforms: FreeBSD/IA64 and FreeBSD/Sparc64.
-      o Configuration: the no-err option now works properly.
-      o SSL/TLS: now handles manual certificate chain building.
-      o SSL/TLS: certain session ID malfunctions corrected.
-
-  Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.7 [30 Dec 2002]:
-
-      o New library section OCSP.
-      o Complete rewrite of ASN1 code.
-      o CRL checking in verify code and openssl utility.
-      o Extension copying in 'ca' utility.
-      o Flexible display options in 'ca' utility.
-      o Provisional support for international characters with UTF8.
-      o Support for external crypto devices ('engine') is no longer
-        a separate distribution.
-      o New elliptic curve library section.
-      o New AES (Rijndael) library section.
-      o Support for new platforms: Windows CE, Tandem OSS, A/UX, AIX 64-bit,
-        Linux x86_64, Linux 64-bit on Sparc v9
-      o Extended support for some platforms: VxWorks
-      o Enhanced support for shared libraries.
-      o Now only builds PIC code when shared library support is requested.
-      o Support for pkg-config.
-      o Lots of new manuals.
-      o Makes symbolic links to or copies of manuals to cover all described
-        functions.
-      o Change DES API to clean up the namespace (some applications link also
-        against libdes providing similar functions having the same name).
-        Provide macros for backward compatibility (will be removed in the
-        future).
-      o Unify handling of cryptographic algorithms (software and engine)
-        to be available via EVP routines for asymmetric and symmetric ciphers.
-      o NCONF: new configuration handling routines.
-      o Change API to use more 'const' modifiers to improve error checking
-        and help optimizers.
-      o Finally remove references to RSAref.
-      o Reworked parts of the BIGNUM code.
-      o Support for new engines: Broadcom ubsec, Accelerated Encryption
-        Processing, IBM 4758.
-      o A few new engines added in the demos area.
-      o Extended and corrected OID (object identifier) table.
-      o PRNG: query at more locations for a random device, automatic query for
-        EGD style random sources at several locations.
-      o SSL/TLS: allow optional cipher choice according to server's preference.
-      o SSL/TLS: allow server to explicitly set new session ids.
-      o SSL/TLS: support Kerberos cipher suites (RFC2712).
-        Only supports MIT Kerberos for now.
-      o SSL/TLS: allow more precise control of renegotiations and sessions.
-      o SSL/TLS: add callback to retrieve SSL/TLS messages.
-      o SSL/TLS: support AES cipher suites (RFC3268).
-
-  Major changes between OpenSSL 0.9.6j and OpenSSL 0.9.6k [30 Sep 2003]:
-
-      o Security: fix various ASN1 parsing bugs.
-      o SSL/TLS protocol fix for unrequested client certificates.
-
-  Major changes between OpenSSL 0.9.6i and OpenSSL 0.9.6j [10 Apr 2003]:
-
-      o Security: counter the Klima-Pokorny-Rosa extension of
-        Bleichbacher's attack
-      o Security: make RSA blinding default.
-      o Build: shared library support fixes.
-
-  Major changes between OpenSSL 0.9.6h and OpenSSL 0.9.6i [19 Feb 2003]:
-
-      o Important security related bugfixes.
-
-  Major changes between OpenSSL 0.9.6g and OpenSSL 0.9.6h [5 Dec 2002]:
-
-      o New configuration targets for Tandem OSS and A/UX.
-      o New OIDs for Microsoft attributes.
-      o Better handling of SSL session caching.
-      o Better comparison of distinguished names.
-      o Better handling of shared libraries in a mixed GNU/non-GNU environment.
-      o Support assembler code with Borland C.
-      o Fixes for length problems.
-      o Fixes for uninitialised variables.
-      o Fixes for memory leaks, some unusual crashes and some race conditions.
-      o Fixes for smaller building problems.
-      o Updates of manuals, FAQ and other instructive documents.
-
-  Major changes between OpenSSL 0.9.6f and OpenSSL 0.9.6g [9 Aug 2002]:
-
-      o Important building fixes on Unix.
-
-  Major changes between OpenSSL 0.9.6e and OpenSSL 0.9.6f [8 Aug 2002]:
-
-      o Various important bugfixes.
-
-  Major changes between OpenSSL 0.9.6d and OpenSSL 0.9.6e [30 Jul 2002]:
-
-      o Important security related bugfixes.
-      o Various SSL/TLS library bugfixes.
-
-  Major changes between OpenSSL 0.9.6c and OpenSSL 0.9.6d [9 May 2002]:
-
-      o Various SSL/TLS library bugfixes.
-      o Fix DH parameter generation for 'non-standard' generators.
-
-  Major changes between OpenSSL 0.9.6b and OpenSSL 0.9.6c [21 Dec 2001]:
-
-      o Various SSL/TLS library bugfixes.
-      o BIGNUM library fixes.
-      o RSA OAEP and random number generation fixes.
-      o Object identifiers corrected and added.
-      o Add assembler BN routines for IA64.
-      o Add support for OS/390 Unix, UnixWare with gcc, OpenUNIX 8,
-        MIPS Linux; shared library support for Irix, HP-UX.
-      o Add crypto accelerator support for AEP, Baltimore SureWare,
-        Broadcom and Cryptographic Appliance's keyserver
-        [in 0.9.6c-engine release].
-
-  Major changes between OpenSSL 0.9.6a and OpenSSL 0.9.6b [9 Jul 2001]:
-
-      o Security fix: PRNG improvements.
-      o Security fix: RSA OAEP check.
-      o Security fix: Reinsert and fix countermeasure to Bleichbacher's
-        attack.
-      o MIPS bug fix in BIGNUM.
-      o Bug fix in "openssl enc".
-      o Bug fix in X.509 printing routine.
-      o Bug fix in DSA verification routine and DSA S/MIME verification.
-      o Bug fix to make PRNG thread-safe.
-      o Bug fix in RAND_file_name().
-      o Bug fix in compatibility mode trust settings.
-      o Bug fix in blowfish EVP.
-      o Increase default size for BIO buffering filter.
-      o Compatibility fixes in some scripts.
-
-  Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.6a [5 Apr 2001]:
-
-      o Security fix: change behavior of OpenSSL to avoid using
-        environment variables when running as root.
-      o Security fix: check the result of RSA-CRT to reduce the
-        possibility of deducing the private key from an incorrectly
-        calculated signature.
-      o Security fix: prevent Bleichenbacher's DSA attack.
-      o Security fix: Zero the premaster secret after deriving the
-        master secret in DH ciphersuites.
-      o Reimplement SSL_peek(), which had various problems.
-      o Compatibility fix: the function des_encrypt() renamed to
-        des_encrypt1() to avoid clashes with some Unixen libc.
-      o Bug fixes for Win32, HP/UX and Irix.
-      o Bug fixes in BIGNUM, SSL, PKCS#7, PKCS#12, X.509, CONF and
-        memory checking routines.
-      o Bug fixes for RSA operations in threaded environments.
-      o Bug fixes in misc. openssl applications.
-      o Remove a few potential memory leaks.
-      o Add tighter checks of BIGNUM routines.
-      o Shared library support has been reworked for generality.
-      o More documentation.
-      o New function BN_rand_range().
-      o Add "-rand" option to openssl s_client and s_server.
-
-  Major changes between OpenSSL 0.9.5a and OpenSSL 0.9.6 [10 Oct 2000]:
-
-      o Some documentation for BIO and SSL libraries.
-      o Enhanced chain verification using key identifiers.
-      o New sign and verify options to 'dgst' application.
-      o Support for DER and PEM encoded messages in 'smime' application.
-      o New 'rsautl' application, low level RSA utility.
-      o MD4 now included.
-      o Bugfix for SSL rollback padding check.
-      o Support for external crypto devices [1].
-      o Enhanced EVP interface.
-
-    [1] The support for external crypto devices is currently a separate
-        distribution.  See the file README.ENGINE.
-
-  Major changes between OpenSSL 0.9.5 and OpenSSL 0.9.5a [1 Apr 2000]:
-
-      o Bug fixes for Win32, SuSE Linux, NeXTSTEP and FreeBSD 2.2.8
-      o Shared library support for HPUX and Solaris-gcc
-      o Support of Linux/IA64
-      o Assembler support for Mingw32
-      o New 'rand' application
-      o New way to check for existence of algorithms from scripts
-
-  Major changes between OpenSSL 0.9.4 and OpenSSL 0.9.5 [25 May 2000]:
-
-      o S/MIME support in new 'smime' command
-      o Documentation for the OpenSSL command line application
-      o Automation of 'req' application
-      o Fixes to make s_client, s_server work under Windows
-      o Support for multiple fieldnames in SPKACs
-      o New SPKAC command line utility and associated library functions
-      o Options to allow passwords to be obtained from various sources
-      o New public key PEM format and options to handle it
-      o Many other fixes and enhancements to command line utilities
-      o Usable certificate chain verification
-      o Certificate purpose checking
-      o Certificate trust settings
-      o Support of authority information access extension
-      o Extensions in certificate requests
-      o Simplified X509 name and attribute routines
-      o Initial (incomplete) support for international character sets
-      o New DH_METHOD, DSA_METHOD and enhanced RSA_METHOD
-      o Read only memory BIOs and simplified creation function
-      o TLS/SSL protocol bugfixes: Accept TLS 'client hello' in SSL 3.0
-        record; allow fragmentation and interleaving of handshake and other
-        data
-      o TLS/SSL code now "tolerates" MS SGC
-      o Work around for Netscape client certificate hang bug
-      o RSA_NULL option that removes RSA patent code but keeps other
-        RSA functionality
-      o Memory leak detection now allows applications to add extra information
-        via a per-thread stack
-      o PRNG robustness improved
-      o EGD support
-      o BIGNUM library bug fixes
-      o Faster DSA parameter generation
-      o Enhanced support for Alpha Linux
-      o Experimental MacOS support
-
-  Major changes between OpenSSL 0.9.3 and OpenSSL 0.9.4 [9 Aug 1999]:
-
-      o Transparent support for PKCS#8 format private keys: these are used
-        by several software packages and are more secure than the standard
-        form
-      o PKCS#5 v2.0 implementation
-      o Password callbacks have a new void * argument for application data
-      o Avoid various memory leaks
-      o New pipe-like BIO that allows using the SSL library when actual I/O
-        must be handled by the application (BIO pair)
-
-  Major changes between OpenSSL 0.9.2b and OpenSSL 0.9.3 [24 May 1999]:
-      o Lots of enhancements and cleanups to the Configuration mechanism
-      o RSA OEAP related fixes
-      o Added `openssl ca -revoke' option for revoking a certificate
-      o Source cleanups: const correctness, type-safe stacks and ASN.1 SETs
-      o Source tree cleanups: removed lots of obsolete files
-      o Thawte SXNet, certificate policies and CRL distribution points
-        extension support
-      o Preliminary (experimental) S/MIME support
-      o Support for ASN.1 UTF8String and VisibleString
-      o Full integration of PKCS#12 code
-      o Sparc assembler bignum implementation, optimized hash functions
-      o Option to disable selected ciphers
-
-  Major changes between OpenSSL 0.9.1c and OpenSSL 0.9.2b [22 Mar 1999]:
-      o Fixed a security hole related to session resumption
-      o Fixed RSA encryption routines for the p < q case
-      o "ALL" in cipher lists now means "everything except NULL ciphers"
-      o Support for Triple-DES CBCM cipher
-      o Support of Optimal Asymmetric Encryption Padding (OAEP) for RSA
-      o First support for new TLSv1 ciphers
-      o Added a few new BIOs (syslog BIO, reliable BIO)
-      o Extended support for DSA certificate/keys.
-      o Extended support for Certificate Signing Requests (CSR)
-      o Initial support for X.509v3 extensions
-      o Extended support for compression inside the SSL record layer
-      o Overhauled Win32 builds
-      o Cleanups and fixes to the Big Number (BN) library
-      o Support for ASN.1 GeneralizedTime
-      o Splitted ASN.1 SETs from SEQUENCEs
-      o ASN1 and PEM support for Netscape Certificate Sequences
-      o Overhauled Perl interface
-      o Lots of source tree cleanups.
-      o Lots of memory leak fixes.
-      o Lots of bug fixes.
-
-  Major changes between SSLeay 0.9.0b and OpenSSL 0.9.1c [23 Dec 1998]:
-      o Integration of the popular NO_RSA/NO_DSA patches
-      o Initial support for compression inside the SSL record layer
-      o Added BIO proxy and filtering functionality
-      o Extended Big Number (BN) library
-      o Added RIPE MD160 message digest
-      o Added support for RC2/64bit cipher
-      o Extended ASN.1 parser routines
-      o Adjustments of the source tree for CVS
-      o Support for various new platforms

NEWS.md

@@ -0,0 +1,1447 @@
+NEWS
+====
+
+This file gives a brief overview of the major changes between each OpenSSL
+release. For more details please read the CHANGES file.
+
+OpenSSL Releases
+----------------
+
+ - [OpenSSL 3.0](#openssl-30)
+ - [OpenSSL 1.1.1](#openssl-111)
+ - [OpenSSL 1.1.0](#openssl-110)
+ - [OpenSSL 1.0.2](#openssl-102)
+ - [OpenSSL 1.0.1](#openssl-101)
+ - [OpenSSL 1.0.0](#openssl-100)
+ - [OpenSSL 0.9.x](#openssl-09x)
+
+OpenSSL 3.0
+-----------
+
+### Major changes between OpenSSL 1.1.1 and OpenSSL 3.0 [under development]
+
+  * Interactive mode is removed from the 'openssl' program.
+  * The X25519, X448, Ed25519, Ed448 and SHAKE256 algorithms are included in
+    the FIPS provider.  None have the "fips=yes" property set and, as such,
+    will not be accidentially used.
+  * The algorithm specific public key command line applications have
+    been deprecated.  These include dhparam, gendsa and others.  The pkey
+    alternatives should be used intead: pkey, pkeyparam and genpkey.
+  * X509 certificates signed using SHA1 are no longer allowed at security
+    level 1 or higher. The default security level for TLS is 1, so
+    certificates signed using SHA1 are by default no longer trusted to
+    authenticate servers or clients.
+  * enable-crypto-mdebug and enable-crypto-mdebug-backtrace were mostly
+    disabled; the project uses address sanitize/leak-detect instead.
+  * Added a Certificate Management Protocol (CMP, RFC 4210) implementation
+    also covering CRMF (RFC 4211) and HTTP transfer (RFC 6712).
+    It is part of the crypto lib and adds a 'cmp' app with a demo configuration.
+    All widely used CMP features are supported for both clients and servers.
+  * Added a proper HTTP(S) client to libcrypto supporting GET and POST,
+    redirection, plain and ASN.1-encoded contents, proxies, and timeouts.
+  * Added OSSL_SERIALIZER, a generic serializer API.
+  * Added OSSL_PARAM_BLD, an easier to use API to OSSL_PARAM.
+  * Added error raising macros, ERR_raise() and ERR_raise_data().
+  * Deprecated ERR_put_error().
+  * Added OSSL_PROVIDER_available(), to check provider availibility.
+  * Added 'openssl mac' that uses the EVP_MAC API.
+  * Added 'openssl kdf' that uses the EVP_KDF API.
+  * Add OPENSSL_info() and 'openssl info' to get built-in data.
+  * Add support for enabling instrumentation through trace and debug
+    output.
+  * Changed our version number scheme and set the next major release to
+    3.0.0
+  * Added EVP_MAC, an EVP layer MAC API, and a generic EVP_PKEY to EVP_MAC
+    bridge.
+  * Removed the heartbeat message in DTLS feature.
+  * Added EVP_KDF, an EVP layer KDF API, and a generic EVP_PKEY to EVP_KDF
+    bridge.
+  * All of the low level MD2, MD4, MD5, MDC2, RIPEMD160, SHA1, SHA224,
+    SHA256, SHA384, SHA512 and Whirlpool digest functions have been
+    deprecated.
+  * All of the low level AES, Blowfish, Camellia, CAST, DES, IDEA, RC2,
+    RC4, RC5 and SEED cipher functions have been deprecated.
+  * All of the low level DH, DSA, ECDH, ECDSA and RSA public key functions
+    have been deprecated.
+
+OpenSSL 1.1.1
+-------------
+
+### Major changes between OpenSSL 1.1.1e and OpenSSL 1.1.1f [under development]
+
+  *
+
+### Major changes between OpenSSL 1.1.1d and OpenSSL 1.1.1e [17 Mar 2020]
+
+  * Fixed an overflow bug in the x64_64 Montgomery squaring procedure
+    used in exponentiation with 512-bit moduli ([CVE-2019-1551][])
+
+### Major changes between OpenSSL 1.1.1c and OpenSSL 1.1.1d [10 Sep 2019]
+
+  * Fixed a fork protection issue ([CVE-2019-1549][])
+  * Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
+    ([CVE-2019-1563][])
+  * For built-in EC curves, ensure an EC_GROUP built from the curve name is
+    used even when parsing explicit parameters
+  * Compute ECC cofactors if not provided during EC_GROUP construction
+    ([CVE-2019-1547][])
+  * Early start up entropy quality from the DEVRANDOM seed source has been
+    improved for older Linux systems
+  * Correct the extended master secret constant on EBCDIC systems
+  * Use Windows installation paths in the mingw builds ([CVE-2019-1552][])
+  * Changed DH_check to accept parameters with order q and 2q subgroups
+  * Significantly reduce secure memory usage by the randomness pools
+  * Revert the DEVRANDOM_WAIT feature for Linux systems
+
+### Major changes between OpenSSL 1.1.1b and OpenSSL 1.1.1c [28 May 2019]
+
+  * Prevent over long nonces in ChaCha20-Poly1305 ([CVE-2019-1543][])
+
+### Major changes between OpenSSL 1.1.1a and OpenSSL 1.1.1b [26 Feb 2019]
+
+  * Change the info callback signals for the start and end of a post-handshake
+    message exchange in TLSv1.3.
+  * Fix a bug in DTLS over SCTP. This breaks interoperability with older
+    versions of OpenSSL like OpenSSL 1.1.0 and OpenSSL 1.0.2.
+
+### Major changes between OpenSSL 1.1.1 and OpenSSL 1.1.1a [20 Nov 2018]
+
+  * Timing vulnerability in DSA signature generation ([CVE-2018-0734][])
+  * Timing vulnerability in ECDSA signature generation ([CVE-2018-0735][])
+
+### Major changes between OpenSSL 1.1.0i and OpenSSL 1.1.1 [11 Sep 2018]
+
+  * Support for TLSv1.3 added. The TLSv1.3 implementation includes:
+    * Fully compliant implementation of RFC8446 (TLSv1.3) on by default
+    * Early data (0-RTT)
+    * Post-handshake authentication and key update
+    * Middlebox Compatibility Mode
+    * TLSv1.3 PSKs
+    * Support for all five RFC8446 ciphersuites
+    * RSA-PSS signature algorithms (backported to TLSv1.2)
+    * Configurable session ticket support
+    * Stateless server support
+    * Rewrite of the packet construction code for "safer" packet handling
+    * Rewrite of the extension handling code
+    For further important information, see the [TLS1.3 page](
+    https://wiki.openssl.org/index.php/TLS1.3) in the OpenSSL Wiki.
+
+  * Complete rewrite of the OpenSSL random number generator to introduce the
+    following capabilities
+      * The default RAND method now utilizes an AES-CTR DRBG according to
+        NIST standard SP 800-90Ar1.
+      * Support for multiple DRBG instances with seed chaining.
+      * There is a public and private DRBG instance.
+      * The DRBG instances are fork-safe.
+      * Keep all global DRBG instances on the secure heap if it is enabled.
+      * The public and private DRBG instance are per thread for lock free
+      operation
+  * Support for various new cryptographic algorithms including:
+      * SHA3
+      * SHA512/224 and SHA512/256
+      * EdDSA (both Ed25519 and Ed448) including X509 and TLS support
+      * X448 (adding to the existing X25519 support in 1.1.0)
+      * Multi-prime RSA
+      * SM2
+      * SM3
+      * SM4
+      * SipHash
+      * ARIA (including TLS support)
+  * Significant Side-Channel attack security improvements
+  * Add a new ClientHello callback to provide the ability to adjust the SSL
+  object at an early stage.
+  * Add 'Maximum Fragment Length' TLS extension negotiation and support
+  * A new STORE module, which implements a uniform and URI based reader of
+   stores that can contain keys, certificates, CRLs and numerous other
+  objects.
+  * Move the display of configuration data to configdata.pm.
+  * Allow GNU style "make variables" to be used with Configure.
+  * Claim the namespaces OSSL and OPENSSL, represented as symbol prefixes
+  * Rewrite of devcrypto engine
+
+OpenSSL 1.1.0
+-------------
+
+### Major changes between OpenSSL 1.1.0k and OpenSSL 1.1.0l [10 Sep 2019]
+
+  * Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
+    ([CVE-2019-1563][])
+  * For built-in EC curves, ensure an EC_GROUP built from the curve name is
+    used even when parsing explicit parameters
+  * Compute ECC cofactors if not provided during EC_GROUP construction
+    ([CVE-2019-1547][])
+  * Use Windows installation paths in the mingw builds ([CVE-2019-1552][])
+
+### Major changes between OpenSSL 1.1.0j and OpenSSL 1.1.0k [28 May 2019]
+
+  * Prevent over long nonces in ChaCha20-Poly1305 ([CVE-2019-1543][])
+
+### Major changes between OpenSSL 1.1.0i and OpenSSL 1.1.0j [20 Nov 2018]
+
+  * Timing vulnerability in DSA signature generation ([CVE-2018-0734][])
+  * Timing vulnerability in ECDSA signature generation ([CVE-2018-0735][])
+
+### Major changes between OpenSSL 1.1.0h and OpenSSL 1.1.0i [14 Aug 2018]
+
+  * Client DoS due to large DH parameter ([CVE-2018-0732][])
+  * Cache timing vulnerability in RSA Key Generation ([CVE-2018-0737][])
+
+### Major changes between OpenSSL 1.1.0g and OpenSSL 1.1.0h [27 Mar 2018]
+
+  * Constructed ASN.1 types with a recursive definition could exceed the
+    stack ([CVE-2018-0739][])
+  * Incorrect CRYPTO_memcmp on HP-UX PA-RISC ([CVE-2018-0733][])
+  * rsaz_1024_mul_avx2 overflow bug on x86_64 ([CVE-2017-3738][])
+
+### Major changes between OpenSSL 1.1.0f and OpenSSL 1.1.0g [2 Nov 2017]
+
+  * bn_sqrx8x_internal carry bug on x86_64 ([CVE-2017-3736][])
+  * Malformed X.509 IPAddressFamily could cause OOB read ([CVE-2017-3735][])
+
+### Major changes between OpenSSL 1.1.0e and OpenSSL 1.1.0f [25 May 2017]
+
+  * config now recognises 64-bit mingw and chooses mingw64 instead of mingw
+
+### Major changes between OpenSSL 1.1.0d and OpenSSL 1.1.0e [16 Feb 2017]
+
+  * Encrypt-Then-Mac renegotiation crash ([CVE-2017-3733][])
+
+### Major changes between OpenSSL 1.1.0c and OpenSSL 1.1.0d [26 Jan 2017]
+
+  * Truncated packet could crash via OOB read ([CVE-2017-3731][])
+  * Bad (EC)DHE parameters cause a client crash ([CVE-2017-3730][])
+  * BN_mod_exp may produce incorrect results on x86_64 ([CVE-2017-3732][])
+
+### Major changes between OpenSSL 1.1.0b and OpenSSL 1.1.0c [10 Nov 2016]
+
+  * ChaCha20/Poly1305 heap-buffer-overflow ([CVE-2016-7054][])
+  * CMS Null dereference ([CVE-2016-7053][])
+  * Montgomery multiplication may produce incorrect results ([CVE-2016-7055][])
+
+### Major changes between OpenSSL 1.1.0a and OpenSSL 1.1.0b [26 Sep 2016]
+
+  * Fix Use After Free for large message sizes ([CVE-2016-6309][])
+
+### Major changes between OpenSSL 1.1.0 and OpenSSL 1.1.0a [22 Sep 2016]
+
+  * OCSP Status Request extension unbounded memory growth ([CVE-2016-6304][])
+  * SSL_peek() hang on empty record ([CVE-2016-6305][])
+  * Excessive allocation of memory in tls_get_message_header()
+    ([CVE-2016-6307][])
+  * Excessive allocation of memory in dtls1_preprocess_fragment()
+    ([CVE-2016-6308][])
+
+### Major changes between OpenSSL 1.0.2h and OpenSSL 1.1.0 [25 Aug 2016]
+
+  * Copyright text was shrunk to a boilerplate that points to the license
+  * "shared" builds are now the default when possible
+  * Added support for "pipelining"
+  * Added the AFALG engine
+  * New threading API implemented
+  * Support for ChaCha20 and Poly1305 added to libcrypto and libssl
+  * Support for extended master secret
+  * CCM ciphersuites
+  * Reworked test suite, now based on perl, Test::Harness and Test::More
+  * *Most* libcrypto and libssl public structures were made opaque,
+    including:
+    BIGNUM and associated types, EC_KEY and EC_KEY_METHOD,
+    DH and DH_METHOD, DSA and DSA_METHOD, RSA and RSA_METHOD,
+    BIO and BIO_METHOD, EVP_MD_CTX, EVP_MD, EVP_CIPHER_CTX,
+    EVP_CIPHER, EVP_PKEY and associated types, HMAC_CTX,
+    X509, X509_CRL, X509_OBJECT, X509_STORE_CTX, X509_STORE,
+    X509_LOOKUP, X509_LOOKUP_METHOD
+  * libssl internal structures made opaque
+  * SSLv2 support removed
+  * Kerberos ciphersuite support removed
+  * RC4 removed from DEFAULT ciphersuites in libssl
+  * 40 and 56 bit cipher support removed from libssl
+  * All public header files moved to include/openssl, no more symlinking
+  * SSL/TLS state machine, version negotiation and record layer rewritten
+  * EC revision: now operations use new EC_KEY_METHOD.
+  * Support for OCB mode added to libcrypto
+  * Support for asynchronous crypto operations added to libcrypto and libssl
+  * Deprecated interfaces can now be disabled at build time either
+    relative to the latest release via the "no-deprecated" Configure
+    argument, or via the "--api=1.1.0|1.0.0|0.9.8" option.
+  * Application software can be compiled with -DOPENSSL_API_COMPAT=version
+    to ensure that features deprecated in that version are not exposed.
+  * Support for RFC6698/RFC7671 DANE TLSA peer authentication
+  * Change of Configure to use --prefix as the main installation
+    directory location rather than --openssldir.  The latter becomes
+    the directory for certs, private key and openssl.cnf exclusively.
+  * Reworked BIO networking library, with full support for IPv6.
+  * New "unified" build system
+  * New security levels
+  * Support for scrypt algorithm
+  * Support for X25519
+  * Extended SSL_CONF support using configuration files
+  * KDF algorithm support. Implement TLS PRF as a KDF.
+  * Support for Certificate Transparency
+  * HKDF support.
+
+OpenSSL 1.0.2
+-------------
+
+### Major changes between OpenSSL 1.0.2s and OpenSSL 1.0.2t [10 Sep 2019]
+
+  * Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey
+    ([CVE-2019-1563][])
+  * For built-in EC curves, ensure an EC_GROUP built from the curve name is
+    used even when parsing explicit parameters
+  * Compute ECC cofactors if not provided during EC_GROUP construction
+    ([CVE-2019-1547][])
+  * Document issue with installation paths in diverse Windows builds
+    ([CVE-2019-1552][])
+
+### Major changes between OpenSSL 1.0.2r and OpenSSL 1.0.2s [28 May 2019]
+
+  * None
+
+### Major changes between OpenSSL 1.0.2q and OpenSSL 1.0.2r [26 Feb 2019]
+
+  * 0-byte record padding oracle ([CVE-2019-1559][])
+
+### Major changes between OpenSSL 1.0.2p and OpenSSL 1.0.2q [20 Nov 2018]
+
+  * Microarchitecture timing vulnerability in ECC scalar multiplication ([CVE-2018-5407][])
+  * Timing vulnerability in DSA signature generation ([CVE-2018-0734][])
+
+### Major changes between OpenSSL 1.0.2o and OpenSSL 1.0.2p [14 Aug 2018]
+
+  * Client DoS due to large DH parameter ([CVE-2018-0732][])
+  * Cache timing vulnerability in RSA Key Generation ([CVE-2018-0737][])
+
+### Major changes between OpenSSL 1.0.2n and OpenSSL 1.0.2o [27 Mar 2018]
+
+  * Constructed ASN.1 types with a recursive definition could exceed the
+    stack ([CVE-2018-0739][])
+
+### Major changes between OpenSSL 1.0.2m and OpenSSL 1.0.2n [7 Dec 2017]
+
+  * Read/write after SSL object in error state ([CVE-2017-3737][])
+  * rsaz_1024_mul_avx2 overflow bug on x86_64 ([CVE-2017-3738][])
+
+### Major changes between OpenSSL 1.0.2l and OpenSSL 1.0.2m [2 Nov 2017]
+
+  * bn_sqrx8x_internal carry bug on x86_64 ([CVE-2017-3736][])
+  * Malformed X.509 IPAddressFamily could cause OOB read ([CVE-2017-3735][])
+
+### Major changes between OpenSSL 1.0.2k and OpenSSL 1.0.2l [25 May 2017]
+
+  * config now recognises 64-bit mingw and chooses mingw64 instead of mingw
+
+### Major changes between OpenSSL 1.0.2j and OpenSSL 1.0.2k [26 Jan 2017]
+
+  * Truncated packet could crash via OOB read ([CVE-2017-3731][])
+  * BN_mod_exp may produce incorrect results on x86_64 ([CVE-2017-3732][])
+  * Montgomery multiplication may produce incorrect results ([CVE-2016-7055][])
+
+### Major changes between OpenSSL 1.0.2i and OpenSSL 1.0.2j [26 Sep 2016]
+
+  * Missing CRL sanity check ([CVE-2016-7052][])
+
+### Major changes between OpenSSL 1.0.2h and OpenSSL 1.0.2i [22 Sep 2016]
+
+  * OCSP Status Request extension unbounded memory growth ([CVE-2016-6304][])
+  * SWEET32 Mitigation ([CVE-2016-2183][])
+  * OOB write in MDC2_Update() ([CVE-2016-6303][])
+  * Malformed SHA512 ticket DoS ([CVE-2016-6302][])
+  * OOB write in BN_bn2dec() ([CVE-2016-2182][])
+  * OOB read in TS_OBJ_print_bio() ([CVE-2016-2180][])
+  * Pointer arithmetic undefined behaviour ([CVE-2016-2177][])
+  * Constant time flag not preserved in DSA signing ([CVE-2016-2178][])
+  * DTLS buffered message DoS ([CVE-2016-2179][])
+  * DTLS replay protection DoS ([CVE-2016-2181][])
+  * Certificate message OOB reads ([CVE-2016-6306][])
+
+### Major changes between OpenSSL 1.0.2g and OpenSSL 1.0.2h [3 May 2016]
+
+  * Prevent padding oracle in AES-NI CBC MAC check ([CVE-2016-2107][])
+  * Fix EVP_EncodeUpdate overflow ([CVE-2016-2105][])
+  * Fix EVP_EncryptUpdate overflow ([CVE-2016-2106][])
+  * Prevent ASN.1 BIO excessive memory allocation ([CVE-2016-2109][])
+  * EBCDIC overread ([CVE-2016-2176][])
+  * Modify behavior of ALPN to invoke callback after SNI/servername
+    callback, such that updates to the SSL_CTX affect ALPN.
+  * Remove LOW from the DEFAULT cipher list.  This removes singles DES from
+    the default.
+  * Only remove the SSLv2 methods with the no-ssl2-method option.
+
+### Major changes between OpenSSL 1.0.2f and OpenSSL 1.0.2g [1 Mar 2016]
+
+  * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
+  * Disable SSLv2 default build, default negotiation and weak ciphers
+    ([CVE-2016-0800][])
+  * Fix a double-free in DSA code ([CVE-2016-0705][])
+  * Disable SRP fake user seed to address a server memory leak
+    ([CVE-2016-0798][])
+  * Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
+    ([CVE-2016-0797][])
+  * Fix memory issues in BIO_*printf functions ([CVE-2016-0799][])
+  * Fix side channel attack on modular exponentiation ([CVE-2016-0702][])
+
+### Major changes between OpenSSL 1.0.2e and OpenSSL 1.0.2f [28 Jan 2016]
+
+  * DH small subgroups ([CVE-2016-0701][])
+  * SSLv2 doesn't block disabled ciphers ([CVE-2015-3197][])
+
+### Major changes between OpenSSL 1.0.2d and OpenSSL 1.0.2e [3 Dec 2015]
+
+  * BN_mod_exp may produce incorrect results on x86_64 ([CVE-2015-3193][])
+  * Certificate verify crash with missing PSS parameter ([CVE-2015-3194][])
+  * X509_ATTRIBUTE memory leak ([CVE-2015-3195][])
+  * Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs
+  * In DSA_generate_parameters_ex, if the provided seed is too short,
+    return an error
+
+### Major changes between OpenSSL 1.0.2c and OpenSSL 1.0.2d [9 Jul 2015]
+
+  * Alternate chains certificate forgery ([CVE-2015-1793][])
+  * Race condition handling PSK identify hint ([CVE-2015-3196][])
+
+### Major changes between OpenSSL 1.0.2b and OpenSSL 1.0.2c [12 Jun 2015]
+
+  * Fix HMAC ABI incompatibility
+
+### Major changes between OpenSSL 1.0.2a and OpenSSL 1.0.2b [11 Jun 2015]
+
+  * Malformed ECParameters causes infinite loop ([CVE-2015-1788][])
+  * Exploitable out-of-bounds read in X509_cmp_time ([CVE-2015-1789][])
+  * PKCS7 crash with missing EnvelopedContent ([CVE-2015-1790][])
+  * CMS verify infinite loop with unknown hash function ([CVE-2015-1792][])
+  * Race condition handling NewSessionTicket ([CVE-2015-1791][])
+
+### Major changes between OpenSSL 1.0.2 and OpenSSL 1.0.2a [19 Mar 2015]
+
+  * OpenSSL 1.0.2 ClientHello sigalgs DoS fix ([CVE-2015-0291][])
+  * Multiblock corrupted pointer fix ([CVE-2015-0290][])
+  * Segmentation fault in DTLSv1_listen fix ([CVE-2015-0207][])
+  * Segmentation fault in ASN1_TYPE_cmp fix ([CVE-2015-0286][])
+  * Segmentation fault for invalid PSS parameters fix ([CVE-2015-0208][])
+  * ASN.1 structure reuse memory corruption fix ([CVE-2015-0287][])
+  * PKCS7 NULL pointer dereferences fix ([CVE-2015-0289][])
+  * DoS via reachable assert in SSLv2 servers fix ([CVE-2015-0293][])
+  * Empty CKE with client auth and DHE fix ([CVE-2015-1787][])
+  * Handshake with unseeded PRNG fix ([CVE-2015-0285][])
+  * Use After Free following d2i_ECPrivatekey error fix ([CVE-2015-0209][])
+  * X509_to_X509_REQ NULL pointer deref fix ([CVE-2015-0288][])
+  * Removed the export ciphers from the DEFAULT ciphers
+
+### Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.2 [22 Jan 2015]
+
+  * Suite B support for TLS 1.2 and DTLS 1.2
+  * Support for DTLS 1.2
+  * TLS automatic EC curve selection.
+  * API to set TLS supported signature algorithms and curves
+  * SSL_CONF configuration API.
+  * TLS Brainpool support.
+  * ALPN support.
+  * CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
+
+OpenSSL 1.0.1
+-------------
+
+### Major changes between OpenSSL 1.0.1t and OpenSSL 1.0.1u [22 Sep 2016]
+
+  * OCSP Status Request extension unbounded memory growth ([CVE-2016-6304][])
+  * SWEET32 Mitigation ([CVE-2016-2183][])
+  * OOB write in MDC2_Update() ([CVE-2016-6303][])
+  * Malformed SHA512 ticket DoS ([CVE-2016-6302][])
+  * OOB write in BN_bn2dec() ([CVE-2016-2182][])
+  * OOB read in TS_OBJ_print_bio() ([CVE-2016-2180][])
+  * Pointer arithmetic undefined behaviour ([CVE-2016-2177][])
+  * Constant time flag not preserved in DSA signing ([CVE-2016-2178][])
+  * DTLS buffered message DoS ([CVE-2016-2179][])
+  * DTLS replay protection DoS ([CVE-2016-2181][])
+  * Certificate message OOB reads ([CVE-2016-6306][])
+
+### Major changes between OpenSSL 1.0.1s and OpenSSL 1.0.1t [3 May 2016]
+
+  * Prevent padding oracle in AES-NI CBC MAC check ([CVE-2016-2107][])
+  * Fix EVP_EncodeUpdate overflow ([CVE-2016-2105][])
+  * Fix EVP_EncryptUpdate overflow ([CVE-2016-2106][])
+  * Prevent ASN.1 BIO excessive memory allocation ([CVE-2016-2109][])
+  * EBCDIC overread ([CVE-2016-2176][])
+  * Modify behavior of ALPN to invoke callback after SNI/servername
+    callback, such that updates to the SSL_CTX affect ALPN.
+  * Remove LOW from the DEFAULT cipher list.  This removes singles DES from
+    the default.
+  * Only remove the SSLv2 methods with the no-ssl2-method option.
+
+### Major changes between OpenSSL 1.0.1r and OpenSSL 1.0.1s [1 Mar 2016]
+
+  * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
+  * Disable SSLv2 default build, default negotiation and weak ciphers
+    ([CVE-2016-0800][])
+  * Fix a double-free in DSA code ([CVE-2016-0705][])
+  * Disable SRP fake user seed to address a server memory leak
+    ([CVE-2016-0798][])
+  * Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
+    ([CVE-2016-0797][])
+  * Fix memory issues in BIO_*printf functions ([CVE-2016-0799][])
+  * Fix side channel attack on modular exponentiation ([CVE-2016-0702][])
+
+### Major changes between OpenSSL 1.0.1q and OpenSSL 1.0.1r [28 Jan 2016]
+
+  * Protection for DH small subgroup attacks
+  * SSLv2 doesn't block disabled ciphers ([CVE-2015-3197][])
+
+### Major changes between OpenSSL 1.0.1p and OpenSSL 1.0.1q [3 Dec 2015]
+
+  * Certificate verify crash with missing PSS parameter ([CVE-2015-3194][])
+  * X509_ATTRIBUTE memory leak ([CVE-2015-3195][])
+  * Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs
+  * In DSA_generate_parameters_ex, if the provided seed is too short,
+    return an error
+
+### Major changes between OpenSSL 1.0.1o and OpenSSL 1.0.1p [9 Jul 2015]
+
+  * Alternate chains certificate forgery ([CVE-2015-1793][])
+  * Race condition handling PSK identify hint ([CVE-2015-3196][])
+
+### Major changes between OpenSSL 1.0.1n and OpenSSL 1.0.1o [12 Jun 2015]
+
+  * Fix HMAC ABI incompatibility
+
+### Major changes between OpenSSL 1.0.1m and OpenSSL 1.0.1n [11 Jun 2015]
+
+  * Malformed ECParameters causes infinite loop ([CVE-2015-1788][])
+  * Exploitable out-of-bounds read in X509_cmp_time ([CVE-2015-1789][])
+  * PKCS7 crash with missing EnvelopedContent ([CVE-2015-1790][])
+  * CMS verify infinite loop with unknown hash function ([CVE-2015-1792][])
+  * Race condition handling NewSessionTicket ([CVE-2015-1791][])
+
+### Major changes between OpenSSL 1.0.1l and OpenSSL 1.0.1m [19 Mar 2015]
+
+  * Segmentation fault in ASN1_TYPE_cmp fix ([CVE-2015-0286][])
+  * ASN.1 structure reuse memory corruption fix ([CVE-2015-0287][])
+  * PKCS7 NULL pointer dereferences fix ([CVE-2015-0289][])
+  * DoS via reachable assert in SSLv2 servers fix ([CVE-2015-0293][])
+  * Use After Free following d2i_ECPrivatekey error fix ([CVE-2015-0209][])
+  * X509_to_X509_REQ NULL pointer deref fix ([CVE-2015-0288][])
+  * Removed the export ciphers from the DEFAULT ciphers
+
+### Major changes between OpenSSL 1.0.1k and OpenSSL 1.0.1l [15 Jan 2015]
+
+  * Build fixes for the Windows and OpenVMS platforms
+
+### Major changes between OpenSSL 1.0.1j and OpenSSL 1.0.1k [8 Jan 2015]
+
+  * Fix for [CVE-2014-3571][]
+  * Fix for [CVE-2015-0206][]
+  * Fix for [CVE-2014-3569][]
+  * Fix for [CVE-2014-3572][]
+  * Fix for [CVE-2015-0204][]
+  * Fix for [CVE-2015-0205][]
+  * Fix for [CVE-2014-8275][]
+  * Fix for [CVE-2014-3570][]
+
+### Major changes between OpenSSL 1.0.1i and OpenSSL 1.0.1j [15 Oct 2014]
+
+  * Fix for [CVE-2014-3513][]
+  * Fix for [CVE-2014-3567][]
+  * Mitigation for [CVE-2014-3566][] (SSL protocol vulnerability)
+  * Fix for [CVE-2014-3568][]
+
+### Major changes between OpenSSL 1.0.1h and OpenSSL 1.0.1i [6 Aug 2014]
+
+  * Fix for [CVE-2014-3512][]
+  * Fix for [CVE-2014-3511][]
+  * Fix for [CVE-2014-3510][]
+  * Fix for [CVE-2014-3507][]
+  * Fix for [CVE-2014-3506][]
+  * Fix for [CVE-2014-3505][]
+  * Fix for [CVE-2014-3509][]
+  * Fix for [CVE-2014-5139][]
+  * Fix for [CVE-2014-3508][]
+
+### Major changes between OpenSSL 1.0.1g and OpenSSL 1.0.1h [5 Jun 2014]
+
+  * Fix for [CVE-2014-0224][]
+  * Fix for [CVE-2014-0221][]
+  * Fix for [CVE-2014-0198][]
+  * Fix for [CVE-2014-0195][]
+  * Fix for [CVE-2014-3470][]
+  * Fix for [CVE-2010-5298][]
+
+### Major changes between OpenSSL 1.0.1f and OpenSSL 1.0.1g [7 Apr 2014]
+
+  * Fix for [CVE-2014-0160][]
+  * Add TLS padding extension workaround for broken servers.
+  * Fix for [CVE-2014-0076][]
+
+### Major changes between OpenSSL 1.0.1e and OpenSSL 1.0.1f [6 Jan 2014]
+
+  * Don't include gmt_unix_time in TLS server and client random values
+  * Fix for TLS record tampering bug [CVE-2013-4353][]
+  * Fix for TLS version checking bug [CVE-2013-6449][]
+  * Fix for DTLS retransmission bug [CVE-2013-6450][]
+
+### Major changes between OpenSSL 1.0.1d and OpenSSL 1.0.1e [11 Feb 2013]
+
+  * Corrected fix for [CVE-2013-0169][]
+
+### Major changes between OpenSSL 1.0.1c and OpenSSL 1.0.1d [4 Feb 2013]
+
+  * Fix renegotiation in TLS 1.1, 1.2 by using the correct TLS version.
+  * Include the fips configuration module.
+  * Fix OCSP bad key DoS attack [CVE-2013-0166][]
+  * Fix for SSL/TLS/DTLS CBC plaintext recovery attack [CVE-2013-0169][]
+  * Fix for TLS AESNI record handling flaw [CVE-2012-2686][]
+
+### Major changes between OpenSSL 1.0.1b and OpenSSL 1.0.1c [10 May 2012]
+
+  * Fix TLS/DTLS record length checking bug [CVE-2012-2333][]
+  * Don't attempt to use non-FIPS composite ciphers in FIPS mode.
+
+### Major changes between OpenSSL 1.0.1a and OpenSSL 1.0.1b [26 Apr 2012]
+
+  * Fix compilation error on non-x86 platforms.
+  * Make FIPS capable OpenSSL ciphers work in non-FIPS mode.
+  * Fix SSL_OP_NO_TLSv1_1 clash with SSL_OP_ALL in OpenSSL 1.0.0
+
+### Major changes between OpenSSL 1.0.1 and OpenSSL 1.0.1a [19 Apr 2012]
+
+  * Fix for ASN1 overflow bug [CVE-2012-2110][]
+  * Workarounds for some servers that hang on long client hellos.
+  * Fix SEGV in AES code.
+
+### Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.1 [14 Mar 2012]
+
+  * TLS/DTLS heartbeat support.
+  * SCTP support.
+  * RFC 5705 TLS key material exporter.
+  * RFC 5764 DTLS-SRTP negotiation.
+  * Next Protocol Negotiation.
+  * PSS signatures in certificates, requests and CRLs.
+  * Support for password based recipient info for CMS.
+  * Support TLS v1.2 and TLS v1.1.
+  * Preliminary FIPS capability for unvalidated 2.0 FIPS module.
+  * SRP support.
+
+OpenSSL 1.0.0
+-------------
+
+### Major changes between OpenSSL 1.0.0s and OpenSSL 1.0.0t [3 Dec 2015]
+
+  * X509_ATTRIBUTE memory leak ([CVE-2015-3195][])
+  * Race condition handling PSK identify hint ([CVE-2015-3196][])
+
+### Major changes between OpenSSL 1.0.0r and OpenSSL 1.0.0s [11 Jun 2015]
+
+  * Malformed ECParameters causes infinite loop ([CVE-2015-1788][])
+  * Exploitable out-of-bounds read in X509_cmp_time ([CVE-2015-1789][])
+  * PKCS7 crash with missing EnvelopedContent ([CVE-2015-1790][])
+  * CMS verify infinite loop with unknown hash function ([CVE-2015-1792][])
+  * Race condition handling NewSessionTicket ([CVE-2015-1791][])
+
+### Major changes between OpenSSL 1.0.0q and OpenSSL 1.0.0r [19 Mar 2015]
+
+  * Segmentation fault in ASN1_TYPE_cmp fix ([CVE-2015-0286][])
+  * ASN.1 structure reuse memory corruption fix ([CVE-2015-0287][])
+  * PKCS7 NULL pointer dereferences fix ([CVE-2015-0289][])
+  * DoS via reachable assert in SSLv2 servers fix ([CVE-2015-0293][])
+  * Use After Free following d2i_ECPrivatekey error fix ([CVE-2015-0209][])
+  * X509_to_X509_REQ NULL pointer deref fix ([CVE-2015-0288][])
+  * Removed the export ciphers from the DEFAULT ciphers
+
+### Major changes between OpenSSL 1.0.0p and OpenSSL 1.0.0q [15 Jan 2015]
+
+  * Build fixes for the Windows and OpenVMS platforms
+
+### Major changes between OpenSSL 1.0.0o and OpenSSL 1.0.0p [8 Jan 2015]
+
+  * Fix for [CVE-2014-3571][]
+  * Fix for [CVE-2015-0206][]
+  * Fix for [CVE-2014-3569][]
+  * Fix for [CVE-2014-3572][]
+  * Fix for [CVE-2015-0204][]
+  * Fix for [CVE-2015-0205][]
+  * Fix for [CVE-2014-8275][]
+  * Fix for [CVE-2014-3570][]
+
+### Major changes between OpenSSL 1.0.0n and OpenSSL 1.0.0o [15 Oct 2014]
+
+  * Fix for [CVE-2014-3513][]
+  * Fix for [CVE-2014-3567][]
+  * Mitigation for [CVE-2014-3566][] (SSL protocol vulnerability)
+  * Fix for [CVE-2014-3568][]
+
+### Major changes between OpenSSL 1.0.0m and OpenSSL 1.0.0n [6 Aug 2014]
+
+  * Fix for [CVE-2014-3510][]
+  * Fix for [CVE-2014-3507][]
+  * Fix for [CVE-2014-3506][]
+  * Fix for [CVE-2014-3505][]
+  * Fix for [CVE-2014-3509][]
+  * Fix for [CVE-2014-3508][]
+
+  Known issues in OpenSSL 1.0.0m:
+
+  * EAP-FAST and other applications using tls_session_secret_cb
+    wont resume sessions. Fixed in 1.0.0n-dev
+  * Compilation failure of s3_pkt.c on some platforms due to missing
+    `<limits.h>` include. Fixed in 1.0.0n-dev
+
+### Major changes between OpenSSL 1.0.0l and OpenSSL 1.0.0m [5 Jun 2014]
+
+  * Fix for [CVE-2014-0224][]
+  * Fix for [CVE-2014-0221][]
+  * Fix for [CVE-2014-0198][]
+  * Fix for [CVE-2014-0195][]
+  * Fix for [CVE-2014-3470][]
+  * Fix for [CVE-2014-0076][]
+  * Fix for [CVE-2010-5298][]
+
+### Major changes between OpenSSL 1.0.0k and OpenSSL 1.0.0l [6 Jan 2014]
+
+  * Fix for DTLS retransmission bug [CVE-2013-6450][]
+
+### Major changes between OpenSSL 1.0.0j and OpenSSL 1.0.0k [5 Feb 2013]
+
+  * Fix for SSL/TLS/DTLS CBC plaintext recovery attack [CVE-2013-0169][]
+  * Fix OCSP bad key DoS attack [CVE-2013-0166][]
+
+### Major changes between OpenSSL 1.0.0i and OpenSSL 1.0.0j [10 May 2012]
+
+  * Fix DTLS record length checking bug [CVE-2012-2333][]
+
+### Major changes between OpenSSL 1.0.0h and OpenSSL 1.0.0i [19 Apr 2012]
+
+  * Fix for ASN1 overflow bug [CVE-2012-2110][]
+
+### Major changes between OpenSSL 1.0.0g and OpenSSL 1.0.0h [12 Mar 2012]
+
+  * Fix for CMS/PKCS#7 MMA [CVE-2012-0884][]
+  * Corrected fix for [CVE-2011-4619][]
+  * Various DTLS fixes.
+
+### Major changes between OpenSSL 1.0.0f and OpenSSL 1.0.0g [18 Jan 2012]
+
+  * Fix for DTLS DoS issue [CVE-2012-0050][]
+
+### Major changes between OpenSSL 1.0.0e and OpenSSL 1.0.0f [4 Jan 2012]
+
+  * Fix for DTLS plaintext recovery attack [CVE-2011-4108][]
+  * Clear block padding bytes of SSL 3.0 records [CVE-2011-4576][]
+  * Only allow one SGC handshake restart for SSL/TLS [CVE-2011-4619][]
+  * Check parameters are not NULL in GOST ENGINE [CVE-2012-0027][]
+  * Check for malformed RFC3779 data [CVE-2011-4577][]
+
+### Major changes between OpenSSL 1.0.0d and OpenSSL 1.0.0e [6 Sep 2011]
+
+  * Fix for CRL vulnerability issue [CVE-2011-3207][]
+  * Fix for ECDH crashes [CVE-2011-3210][]
+  * Protection against EC timing attacks.
+  * Support ECDH ciphersuites for certificates using SHA2 algorithms.
+  * Various DTLS fixes.
+
+### Major changes between OpenSSL 1.0.0c and OpenSSL 1.0.0d [8 Feb 2011]
+
+  * Fix for security issue [CVE-2011-0014][]
+
+### Major changes between OpenSSL 1.0.0b and OpenSSL 1.0.0c [2 Dec 2010]
+
+  * Fix for security issue [CVE-2010-4180][]
+  * Fix for [CVE-2010-4252][]
+  * Fix mishandling of absent EC point format extension.
+  * Fix various platform compilation issues.
+  * Corrected fix for security issue [CVE-2010-3864][].
+
+### Major changes between OpenSSL 1.0.0a and OpenSSL 1.0.0b [16 Nov 2010]
+
+  * Fix for security issue [CVE-2010-3864][].
+  * Fix for [CVE-2010-2939][]
+  * Fix WIN32 build system for GOST ENGINE.
+
+### Major changes between OpenSSL 1.0.0 and OpenSSL 1.0.0a [1 Jun 2010]
+
+  * Fix for security issue [CVE-2010-1633][].
+  * GOST MAC and CFB fixes.
+
+### Major changes between OpenSSL 0.9.8n and OpenSSL 1.0.0 [29 Mar 2010]
+
+  * RFC3280 path validation: sufficient to process PKITS tests.
+  * Integrated support for PVK files and keyblobs.
+  * Change default private key format to PKCS#8.
+  * CMS support: able to process all examples in RFC4134
+  * Streaming ASN1 encode support for PKCS#7 and CMS.
+  * Multiple signer and signer add support for PKCS#7 and CMS.
+  * ASN1 printing support.
+  * Whirlpool hash algorithm added.
+  * RFC3161 time stamp support.
+  * New generalised public key API supporting ENGINE based algorithms.
+  * New generalised public key API utilities.
+  * New ENGINE supporting GOST algorithms.
+  * SSL/TLS GOST ciphersuite support.
+  * PKCS#7 and CMS GOST support.
+  * RFC4279 PSK ciphersuite support.
+  * Supported points format extension for ECC ciphersuites.
+  * ecdsa-with-SHA224/256/384/512 signature types.
+  * dsa-with-SHA224 and dsa-with-SHA256 signature types.
+  * Opaque PRF Input TLS extension support.
+  * Updated time routines to avoid OS limitations.
+
+OpenSSL 0.9.x
+-------------
+
+### Major changes between OpenSSL 0.9.8m and OpenSSL 0.9.8n [24 Mar 2010]
+
+  * CFB cipher definition fixes.
+  * Fix security issues [CVE-2010-0740][] and [CVE-2010-0433][].
+
+### Major changes between OpenSSL 0.9.8l and OpenSSL 0.9.8m [25 Feb 2010]
+
+  * Cipher definition fixes.
+  * Workaround for slow RAND_poll() on some WIN32 versions.
+  * Remove MD2 from algorithm tables.
+  * SPKAC handling fixes.
+  * Support for RFC5746 TLS renegotiation extension.
+  * Compression memory leak fixed.
+  * Compression session resumption fixed.
+  * Ticket and SNI coexistence fixes.
+  * Many fixes to DTLS handling.
+
+### Major changes between OpenSSL 0.9.8k and OpenSSL 0.9.8l [5 Nov 2009]
+
+  * Temporary work around for [CVE-2009-3555][]: disable renegotiation.
+
+### Major changes between OpenSSL 0.9.8j and OpenSSL 0.9.8k [25 Mar 2009]
+
+  * Fix various build issues.
+  * Fix security issues ([CVE-2009-0590][], [CVE-2009-0591][], [CVE-2009-0789][])
+
+### Major changes between OpenSSL 0.9.8i and OpenSSL 0.9.8j [7 Jan 2009]
+
+  * Fix security issue ([CVE-2008-5077][])
+  * Merge FIPS 140-2 branch code.
+
+### Major changes between OpenSSL 0.9.8g and OpenSSL 0.9.8h [28 May 2008]
+
+  * CryptoAPI ENGINE support.
+  * Various precautionary measures.
+  * Fix for bugs affecting certificate request creation.
+  * Support for local machine keyset attribute in PKCS#12 files.
+
+### Major changes between OpenSSL 0.9.8f and OpenSSL 0.9.8g [19 Oct 2007]
+
+  * Backport of CMS functionality to 0.9.8.
+  * Fixes for bugs introduced with 0.9.8f.
+
+### Major changes between OpenSSL 0.9.8e and OpenSSL 0.9.8f [11 Oct 2007]
+
+  * Add gcc 4.2 support.
+  * Add support for AES and SSE2 assembly language optimization
+    for VC++ build.
+  * Support for RFC4507bis and server name extensions if explicitly
+    selected at compile time.
+  * DTLS improvements.
+  * RFC4507bis support.
+  * TLS Extensions support.
+
+### Major changes between OpenSSL 0.9.8d and OpenSSL 0.9.8e [23 Feb 2007]
+
+  * Various ciphersuite selection fixes.
+  * RFC3779 support.
+
+### Major changes between OpenSSL 0.9.8c and OpenSSL 0.9.8d [28 Sep 2006]
+
+  * Introduce limits to prevent malicious key DoS  ([CVE-2006-2940][])
+  * Fix security issues ([CVE-2006-2937][], [CVE-2006-3737][], [CVE-2006-4343][])
+  * Changes to ciphersuite selection algorithm
+
+### Major changes between OpenSSL 0.9.8b and OpenSSL 0.9.8c [5 Sep 2006]
+
+  * Fix Daniel Bleichenbacher forged signature attack, [CVE-2006-4339][]
+  * New cipher Camellia
+
+### Major changes between OpenSSL 0.9.8a and OpenSSL 0.9.8b [4 May 2006]
+
+  * Cipher string fixes.
+  * Fixes for VC++ 2005.
+  * Updated ECC cipher suite support.
+  * New functions EVP_CIPHER_CTX_new() and EVP_CIPHER_CTX_free().
+  * Zlib compression usage fixes.
+  * Built in dynamic engine compilation support on Win32.
+  * Fixes auto dynamic engine loading in Win32.
+
+### Major changes between OpenSSL 0.9.8 and OpenSSL 0.9.8a [11 Oct 2005]
+
+  * Fix potential SSL 2.0 rollback, [CVE-2005-2969][]
+  * Extended Windows CE support
+
+### Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.8 [5 Jul 2005]
+
+  * Major work on the BIGNUM library for higher efficiency and to
+    make operations more streamlined and less contradictory.  This
+    is the result of a major audit of the BIGNUM library.
+  * Addition of BIGNUM functions for fields GF(2^m) and NIST
+    curves, to support the Elliptic Crypto functions.
+  * Major work on Elliptic Crypto; ECDH and ECDSA added, including
+    the use through EVP, X509 and ENGINE.
+  * New ASN.1 mini-compiler that's usable through the OpenSSL
+    configuration file.
+  * Added support for ASN.1 indefinite length constructed encoding.
+  * New PKCS#12 'medium level' API to manipulate PKCS#12 files.
+  * Complete rework of shared library construction and linking
+    programs with shared or static libraries, through a separate
+    Makefile.shared.
+  * Rework of the passing of parameters from one Makefile to another.
+  * Changed ENGINE framework to load dynamic engine modules
+    automatically from specifically given directories.
+  * New structure and ASN.1 functions for CertificatePair.
+  * Changed the ZLIB compression method to be stateful.
+  * Changed the key-generation and primality testing "progress"
+    mechanism to take a structure that contains the ticker
+    function and an argument.
+  * New engine module: GMP (performs private key exponentiation).
+  * New engine module: VIA PadLOck ACE extension in VIA C3
+    Nehemiah processors.
+  * Added support for IPv6 addresses in certificate extensions.
+    See RFC 1884, section 2.2.
+  * Added support for certificate policy mappings, policy
+    constraints and name constraints.
+  * Added support for multi-valued AVAs in the OpenSSL
+    configuration file.
+  * Added support for multiple certificates with the same subject
+    in the 'openssl ca' index file.
+  * Make it possible to create self-signed certificates using
+    'openssl ca -selfsign'.
+  * Make it possible to generate a serial number file with
+    'openssl ca -create_serial'.
+  * New binary search functions with extended functionality.
+  * New BUF functions.
+  * New STORE structure and library to provide an interface to all
+    sorts of data repositories.  Supports storage of public and
+    private keys, certificates, CRLs, numbers and arbitrary blobs.
+    This library is unfortunately unfinished and unused within
+    OpenSSL.
+  * New control functions for the error stack.
+  * Changed the PKCS#7 library to support one-pass S/MIME
+    processing.
+  * Added the possibility to compile without old deprecated
+    functionality with the OPENSSL_NO_DEPRECATED macro or the
+    'no-deprecated' argument to the config and Configure scripts.
+  * Constification of all ASN.1 conversion functions, and other
+    affected functions.
+  * Improved platform support for PowerPC.
+  * New FIPS 180-2 algorithms (SHA-224, -256, -384 and -512).
+  * New X509_VERIFY_PARAM structure to support parameterisation
+  of X.509 path validation.
+  * Major overhaul of RC4 performance on Intel P4, IA-64 and
+    AMD64.
+  * Changed the Configure script to have some algorithms disabled
+    by default.  Those can be explicitly enabled with the new
+    argument form 'enable-xxx'.
+  * Change the default digest in 'openssl' commands from MD5 to
+    SHA-1.
+  * Added support for DTLS.
+  * New BIGNUM blinding.
+  * Added support for the RSA-PSS encryption scheme
+  * Added support for the RSA X.931 padding.
+  * Added support for BSD sockets on NetWare.
+  * Added support for files larger than 2GB.
+  * Added initial support for Win64.
+  * Added alternate pkg-config files.
+
+### Major changes between OpenSSL 0.9.7l and OpenSSL 0.9.7m [23 Feb 2007]
+
+  * FIPS 1.1.1 module linking.
+  * Various ciphersuite selection fixes.
+
+### Major changes between OpenSSL 0.9.7k and OpenSSL 0.9.7l [28 Sep 2006]
+
+  * Introduce limits to prevent malicious key DoS  ([CVE-2006-2940][])
+  * Fix security issues ([CVE-2006-2937][], [CVE-2006-3737][], [CVE-2006-4343][])
+
+### Major changes between OpenSSL 0.9.7j and OpenSSL 0.9.7k [5 Sep 2006]
+
+  * Fix Daniel Bleichenbacher forged signature attack, [CVE-2006-4339][]
+
+### Major changes between OpenSSL 0.9.7i and OpenSSL 0.9.7j [4 May 2006]
+
+  * Visual C++ 2005 fixes.
+  * Update Windows build system for FIPS.
+
+### Major changes between OpenSSL 0.9.7h and OpenSSL 0.9.7i [14 Oct 2005]
+
+  * Give EVP_MAX_MD_SIZE its old value, except for a FIPS build.
+
+### Major changes between OpenSSL 0.9.7g and OpenSSL 0.9.7h [11 Oct 2005]
+
+  * Fix SSL 2.0 Rollback, [CVE-2005-2969][]
+  * Allow use of fixed-length exponent on DSA signing
+  * Default fixed-window RSA, DSA, DH private-key operations
+
+### Major changes between OpenSSL 0.9.7f and OpenSSL 0.9.7g [11 Apr 2005]
+
+  * More compilation issues fixed.
+  * Adaptation to more modern Kerberos API.
+  * Enhanced or corrected configuration for Solaris64, Mingw and Cygwin.
+  * Enhanced x86_64 assembler BIGNUM module.
+  * More constification.
+  * Added processing of proxy certificates (RFC 3820).
+
+### Major changes between OpenSSL 0.9.7e and OpenSSL 0.9.7f [22 Mar 2005]
+
+  * Several compilation issues fixed.
+  * Many memory allocation failure checks added.
+  * Improved comparison of X509 Name type.
+  * Mandatory basic checks on certificates.
+  * Performance improvements.
+
+### Major changes between OpenSSL 0.9.7d and OpenSSL 0.9.7e [25 Oct 2004]
+
+  * Fix race condition in CRL checking code.
+  * Fixes to PKCS#7 (S/MIME) code.
+
+### Major changes between OpenSSL 0.9.7c and OpenSSL 0.9.7d [17 Mar 2004]
+
+  * Security: Fix Kerberos ciphersuite SSL/TLS handshaking bug
+  * Security: Fix null-pointer assignment in do_change_cipher_spec()
+  * Allow multiple active certificates with same subject in CA index
+  * Multiple X509 verification fixes
+  * Speed up HMAC and other operations
+
+### Major changes between OpenSSL 0.9.7b and OpenSSL 0.9.7c [30 Sep 2003]
+
+  * Security: fix various ASN1 parsing bugs.
+  * New -ignore_err option to OCSP utility.
+  * Various interop and bug fixes in S/MIME code.
+  * SSL/TLS protocol fix for unrequested client certificates.
+
+### Major changes between OpenSSL 0.9.7a and OpenSSL 0.9.7b [10 Apr 2003]
+
+  * Security: counter the Klima-Pokorny-Rosa extension of
+    Bleichbacher's attack
+  * Security: make RSA blinding default.
+  * Configuration: Irix fixes, AIX fixes, better mingw support.
+  * Support for new platforms: linux-ia64-ecc.
+  * Build: shared library support fixes.
+  * ASN.1: treat domainComponent correctly.
+  * Documentation: fixes and additions.
+
+### Major changes between OpenSSL 0.9.7 and OpenSSL 0.9.7a [19 Feb 2003]
+
+  * Security: Important security related bugfixes.
+  * Enhanced compatibility with MIT Kerberos.
+  * Can be built without the ENGINE framework.
+  * IA32 assembler enhancements.
+  * Support for new platforms: FreeBSD/IA64 and FreeBSD/Sparc64.
+  * Configuration: the no-err option now works properly.
+  * SSL/TLS: now handles manual certificate chain building.
+  * SSL/TLS: certain session ID malfunctions corrected.
+
+### Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.7 [30 Dec 2002]
+
+  * New library section OCSP.
+  * Complete rewrite of ASN1 code.
+  * CRL checking in verify code and openssl utility.
+  * Extension copying in 'ca' utility.
+  * Flexible display options in 'ca' utility.
+  * Provisional support for international characters with UTF8.
+  * Support for external crypto devices ('engine') is no longer
+    a separate distribution.
+  * New elliptic curve library section.
+  * New AES (Rijndael) library section.
+  * Support for new platforms: Windows CE, Tandem OSS, A/UX, AIX 64-bit,
+    Linux x86_64, Linux 64-bit on Sparc v9
+  * Extended support for some platforms: VxWorks
+  * Enhanced support for shared libraries.
+  * Now only builds PIC code when shared library support is requested.
+  * Support for pkg-config.
+  * Lots of new manuals.
+  * Makes symbolic links to or copies of manuals to cover all described
+    functions.
+  * Change DES API to clean up the namespace (some applications link also
+    against libdes providing similar functions having the same name).
+    Provide macros for backward compatibility (will be removed in the
+    future).
+  * Unify handling of cryptographic algorithms (software and engine)
+    to be available via EVP routines for asymmetric and symmetric ciphers.
+  * NCONF: new configuration handling routines.
+  * Change API to use more 'const' modifiers to improve error checking
+    and help optimizers.
+  * Finally remove references to RSAref.
+  * Reworked parts of the BIGNUM code.
+  * Support for new engines: Broadcom ubsec, Accelerated Encryption
+    Processing, IBM 4758.
+  * A few new engines added in the demos area.
+  * Extended and corrected OID (object identifier) table.
+  * PRNG: query at more locations for a random device, automatic query for
+    EGD style random sources at several locations.
+  * SSL/TLS: allow optional cipher choice according to server's preference.
+  * SSL/TLS: allow server to explicitly set new session ids.
+  * SSL/TLS: support Kerberos cipher suites (RFC2712).
+    Only supports MIT Kerberos for now.
+  * SSL/TLS: allow more precise control of renegotiations and sessions.
+  * SSL/TLS: add callback to retrieve SSL/TLS messages.
+  * SSL/TLS: support AES cipher suites (RFC3268).
+
+### Major changes between OpenSSL 0.9.6j and OpenSSL 0.9.6k [30 Sep 2003]
+
+  * Security: fix various ASN1 parsing bugs.
+  * SSL/TLS protocol fix for unrequested client certificates.
+
+### Major changes between OpenSSL 0.9.6i and OpenSSL 0.9.6j [10 Apr 2003]
+
+  * Security: counter the Klima-Pokorny-Rosa extension of
+    Bleichbacher's attack
+  * Security: make RSA blinding default.
+  * Build: shared library support fixes.
+
+### Major changes between OpenSSL 0.9.6h and OpenSSL 0.9.6i [19 Feb 2003]
+
+  * Important security related bugfixes.
+
+### Major changes between OpenSSL 0.9.6g and OpenSSL 0.9.6h [5 Dec 2002]
+
+  * New configuration targets for Tandem OSS and A/UX.
+  * New OIDs for Microsoft attributes.
+  * Better handling of SSL session caching.
+  * Better comparison of distinguished names.
+  * Better handling of shared libraries in a mixed GNU/non-GNU environment.
+  * Support assembler code with Borland C.
+  * Fixes for length problems.
+  * Fixes for uninitialised variables.
+  * Fixes for memory leaks, some unusual crashes and some race conditions.
+  * Fixes for smaller building problems.
+  * Updates of manuals, FAQ and other instructive documents.
+
+### Major changes between OpenSSL 0.9.6f and OpenSSL 0.9.6g [9 Aug 2002]
+
+  * Important building fixes on Unix.
+
+### Major changes between OpenSSL 0.9.6e and OpenSSL 0.9.6f [8 Aug 2002]
+
+  * Various important bugfixes.
+
+### Major changes between OpenSSL 0.9.6d and OpenSSL 0.9.6e [30 Jul 2002]
+
+  * Important security related bugfixes.
+  * Various SSL/TLS library bugfixes.
+
+### Major changes between OpenSSL 0.9.6c and OpenSSL 0.9.6d [9 May 2002]
+
+  * Various SSL/TLS library bugfixes.
+  * Fix DH parameter generation for 'non-standard' generators.
+
+### Major changes between OpenSSL 0.9.6b and OpenSSL 0.9.6c [21 Dec 2001]
+
+  * Various SSL/TLS library bugfixes.
+  * BIGNUM library fixes.
+  * RSA OAEP and random number generation fixes.
+  * Object identifiers corrected and added.
+  * Add assembler BN routines for IA64.
+  * Add support for OS/390 Unix, UnixWare with gcc, OpenUNIX 8,
+    MIPS Linux; shared library support for Irix, HP-UX.
+  * Add crypto accelerator support for AEP, Baltimore SureWare,
+    Broadcom and Cryptographic Appliance's keyserver
+    [in 0.9.6c-engine release].
+
+### Major changes between OpenSSL 0.9.6a and OpenSSL 0.9.6b [9 Jul 2001]
+
+  * Security fix: PRNG improvements.
+  * Security fix: RSA OAEP check.
+  * Security fix: Reinsert and fix countermeasure to Bleichbacher's
+    attack.
+  * MIPS bug fix in BIGNUM.
+  * Bug fix in "openssl enc".
+  * Bug fix in X.509 printing routine.
+  * Bug fix in DSA verification routine and DSA S/MIME verification.
+  * Bug fix to make PRNG thread-safe.
+  * Bug fix in RAND_file_name().
+  * Bug fix in compatibility mode trust settings.
+  * Bug fix in blowfish EVP.
+  * Increase default size for BIO buffering filter.
+  * Compatibility fixes in some scripts.
+
+### Major changes between OpenSSL 0.9.6 and OpenSSL 0.9.6a [5 Apr 2001]
+
+  * Security fix: change behavior of OpenSSL to avoid using
+    environment variables when running as root.
+  * Security fix: check the result of RSA-CRT to reduce the
+    possibility of deducing the private key from an incorrectly
+    calculated signature.
+  * Security fix: prevent Bleichenbacher's DSA attack.
+  * Security fix: Zero the premaster secret after deriving the
+    master secret in DH ciphersuites.
+  * Reimplement SSL_peek(), which had various problems.
+  * Compatibility fix: the function des_encrypt() renamed to
+    des_encrypt1() to avoid clashes with some Unixen libc.
+  * Bug fixes for Win32, HP/UX and Irix.
+  * Bug fixes in BIGNUM, SSL, PKCS#7, PKCS#12, X.509, CONF and
+    memory checking routines.
+  * Bug fixes for RSA operations in threaded environments.
+  * Bug fixes in misc. openssl applications.
+  * Remove a few potential memory leaks.
+  * Add tighter checks of BIGNUM routines.
+  * Shared library support has been reworked for generality.
+  * More documentation.
+  * New function BN_rand_range().
+  * Add "-rand" option to openssl s_client and s_server.
+
+### Major changes between OpenSSL 0.9.5a and OpenSSL 0.9.6 [10 Oct 2000]
+
+  * Some documentation for BIO and SSL libraries.
+  * Enhanced chain verification using key identifiers.
+  * New sign and verify options to 'dgst' application.
+  * Support for DER and PEM encoded messages in 'smime' application.
+  * New 'rsautl' application, low level RSA utility.
+  * MD4 now included.
+  * Bugfix for SSL rollback padding check.
+  * Support for external crypto devices [1].
+  * Enhanced EVP interface.
+
+  [1] The support for external crypto devices is currently a separate
+      distribution.  See the file README.ENGINE.
+
+### Major changes between OpenSSL 0.9.5 and OpenSSL 0.9.5a [1 Apr 2000]
+
+  * Bug fixes for Win32, SuSE Linux, NeXTSTEP and FreeBSD 2.2.8
+  * Shared library support for HPUX and Solaris-gcc
+  * Support of Linux/IA64
+  * Assembler support for Mingw32
+  * New 'rand' application
+  * New way to check for existence of algorithms from scripts
+
+### Major changes between OpenSSL 0.9.4 and OpenSSL 0.9.5 [25 May 2000]
+
+  * S/MIME support in new 'smime' command
+  * Documentation for the OpenSSL command line application
+  * Automation of 'req' application
+  * Fixes to make s_client, s_server work under Windows
+  * Support for multiple fieldnames in SPKACs
+  * New SPKAC command line utility and associated library functions
+  * Options to allow passwords to be obtained from various sources
+  * New public key PEM format and options to handle it
+  * Many other fixes and enhancements to command line utilities
+  * Usable certificate chain verification
+  * Certificate purpose checking
+  * Certificate trust settings
+  * Support of authority information access extension
+  * Extensions in certificate requests
+  * Simplified X509 name and attribute routines
+  * Initial (incomplete) support for international character sets
+  * New DH_METHOD, DSA_METHOD and enhanced RSA_METHOD
+  * Read only memory BIOs and simplified creation function
+  * TLS/SSL protocol bugfixes: Accept TLS 'client hello' in SSL 3.0
+    record; allow fragmentation and interleaving of handshake and other
+    data
+  * TLS/SSL code now "tolerates" MS SGC
+  * Work around for Netscape client certificate hang bug
+  * RSA_NULL option that removes RSA patent code but keeps other
+    RSA functionality
+  * Memory leak detection now allows applications to add extra information
+    via a per-thread stack
+  * PRNG robustness improved
+  * EGD support
+  * BIGNUM library bug fixes
+  * Faster DSA parameter generation
+  * Enhanced support for Alpha Linux
+  * Experimental MacOS support
+
+### Major changes between OpenSSL 0.9.3 and OpenSSL 0.9.4 [9 Aug 1999]
+
+  * Transparent support for PKCS#8 format private keys: these are used
+    by several software packages and are more secure than the standard
+    form
+  * PKCS#5 v2.0 implementation
+  * Password callbacks have a new void * argument for application data
+  * Avoid various memory leaks
+  * New pipe-like BIO that allows using the SSL library when actual I/O
+    must be handled by the application (BIO pair)
+
+### Major changes between OpenSSL 0.9.2b and OpenSSL 0.9.3 [24 May 1999]
+
+  * Lots of enhancements and cleanups to the Configuration mechanism
+  * RSA OEAP related fixes
+  * Added "openssl ca -revoke" option for revoking a certificate
+  * Source cleanups: const correctness, type-safe stacks and ASN.1 SETs
+  * Source tree cleanups: removed lots of obsolete files
+  * Thawte SXNet, certificate policies and CRL distribution points
+    extension support
+  * Preliminary (experimental) S/MIME support
+  * Support for ASN.1 UTF8String and VisibleString
+  * Full integration of PKCS#12 code
+  * Sparc assembler bignum implementation, optimized hash functions
+  * Option to disable selected ciphers
+
+### Major changes between OpenSSL 0.9.1c and OpenSSL 0.9.2b [22 Mar 1999]
+
+  * Fixed a security hole related to session resumption
+  * Fixed RSA encryption routines for the p < q case
+  * "ALL" in cipher lists now means "everything except NULL ciphers"
+  * Support for Triple-DES CBCM cipher
+  * Support of Optimal Asymmetric Encryption Padding (OAEP) for RSA
+  * First support for new TLSv1 ciphers
+  * Added a few new BIOs (syslog BIO, reliable BIO)
+  * Extended support for DSA certificate/keys.
+  * Extended support for Certificate Signing Requests (CSR)
+  * Initial support for X.509v3 extensions
+  * Extended support for compression inside the SSL record layer
+  * Overhauled Win32 builds
+  * Cleanups and fixes to the Big Number (BN) library
+  * Support for ASN.1 GeneralizedTime
+  * Splitted ASN.1 SETs from SEQUENCEs
+  * ASN1 and PEM support for Netscape Certificate Sequences
+  * Overhauled Perl interface
+  * Lots of source tree cleanups.
+  * Lots of memory leak fixes.
+  * Lots of bug fixes.
+
+### Major changes between SSLeay 0.9.0b and OpenSSL 0.9.1c [23 Dec 1998]
+
+  * Integration of the popular NO_RSA/NO_DSA patches
+  * Initial support for compression inside the SSL record layer
+  * Added BIO proxy and filtering functionality
+  * Extended Big Number (BN) library
+  * Added RIPE MD160 message digest
+  * Added support for RC2/64bit cipher
+  * Extended ASN.1 parser routines
+  * Adjustments of the source tree for CVS
+  * Support for various new platforms
+
+<!-- Links -->
+
+[CVE-2019-1563]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1563
+[CVE-2019-1559]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1559
+[CVE-2019-1552]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1552
+[CVE-2019-1551]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1551
+[CVE-2019-1549]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1549
+[CVE-2019-1547]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1547
+[CVE-2019-1543]: https://www.openssl.org/news/vulnerabilities.html#CVE-2019-1543
+[CVE-2018-5407]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-5407
+[CVE-2018-0739]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0739
+[CVE-2018-0737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0737
+[CVE-2018-0735]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0735
+[CVE-2018-0734]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0734
+[CVE-2018-0733]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0733
+[CVE-2018-0732]: https://www.openssl.org/news/vulnerabilities.html#CVE-2018-0732
+[CVE-2017-3738]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3738
+[CVE-2017-3737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3737
+[CVE-2017-3736]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3736
+[CVE-2017-3735]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3735
+[CVE-2017-3733]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3733
+[CVE-2017-3732]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3732
+[CVE-2017-3731]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3731
+[CVE-2017-3730]: https://www.openssl.org/news/vulnerabilities.html#CVE-2017-3730
+[CVE-2016-7055]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7055
+[CVE-2016-7054]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7054
+[CVE-2016-7053]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7053
+[CVE-2016-7052]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-7052
+[CVE-2016-6309]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6309
+[CVE-2016-6308]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6308
+[CVE-2016-6307]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6307
+[CVE-2016-6306]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6306
+[CVE-2016-6305]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6305
+[CVE-2016-6304]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6304
+[CVE-2016-6303]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6303
+[CVE-2016-6302]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-6302
+[CVE-2016-2183]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2183
+[CVE-2016-2182]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2182
+[CVE-2016-2181]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2181
+[CVE-2016-2180]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2180
+[CVE-2016-2179]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2179
+[CVE-2016-2178]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2178
+[CVE-2016-2177]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2177
+[CVE-2016-2176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2176
+[CVE-2016-2109]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2109
+[CVE-2016-2107]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2107
+[CVE-2016-2106]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2106
+[CVE-2016-2105]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-2105
+[CVE-2016-0800]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0800
+[CVE-2016-0799]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0799
+[CVE-2016-0798]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0798
+[CVE-2016-0797]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0797
+[CVE-2016-0705]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0705
+[CVE-2016-0702]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0702
+[CVE-2016-0701]: https://www.openssl.org/news/vulnerabilities.html#CVE-2016-0701
+[CVE-2015-3197]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3197
+[CVE-2015-3196]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3196
+[CVE-2015-3195]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3195
+[CVE-2015-3194]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3194
+[CVE-2015-3193]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-3193
+[CVE-2015-1793]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1793
+[CVE-2015-1792]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1792
+[CVE-2015-1791]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1791
+[CVE-2015-1790]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1790
+[CVE-2015-1789]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1789
+[CVE-2015-1788]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1788
+[CVE-2015-1787]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-1787
+[CVE-2015-0293]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0293
+[CVE-2015-0291]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0291
+[CVE-2015-0290]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0290
+[CVE-2015-0289]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0289
+[CVE-2015-0288]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0288
+[CVE-2015-0287]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0287
+[CVE-2015-0286]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0286
+[CVE-2015-0285]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0285
+[CVE-2015-0209]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0209
+[CVE-2015-0208]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0208
+[CVE-2015-0207]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0207
+[CVE-2015-0206]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0206
+[CVE-2015-0205]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0205
+[CVE-2015-0204]: https://www.openssl.org/news/vulnerabilities.html#CVE-2015-0204
+[CVE-2014-8275]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-8275
+[CVE-2014-5139]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-5139
+[CVE-2014-3572]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3572
+[CVE-2014-3571]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3571
+[CVE-2014-3570]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3570
+[CVE-2014-3569]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3569
+[CVE-2014-3568]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3568
+[CVE-2014-3567]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3567
+[CVE-2014-3566]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3566
+[CVE-2014-3513]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3513
+[CVE-2014-3512]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3512
+[CVE-2014-3511]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3511
+[CVE-2014-3510]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3510
+[CVE-2014-3509]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3509
+[CVE-2014-3508]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3508
+[CVE-2014-3507]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3507
+[CVE-2014-3506]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3506
+[CVE-2014-3505]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3505
+[CVE-2014-3470]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-3470
+[CVE-2014-0224]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0224
+[CVE-2014-0221]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0221
+[CVE-2014-0198]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0198
+[CVE-2014-0195]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0195
+[CVE-2014-0160]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0160
+[CVE-2014-0076]: https://www.openssl.org/news/vulnerabilities.html#CVE-2014-0076
+[CVE-2013-6450]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-6450
+[CVE-2013-6449]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-6449
+[CVE-2013-4353]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-4353
+[CVE-2013-0169]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-0169
+[CVE-2013-0166]: https://www.openssl.org/news/vulnerabilities.html#CVE-2013-0166
+[CVE-2012-2686]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2686
+[CVE-2012-2333]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2333
+[CVE-2012-2110]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-2110
+[CVE-2012-0884]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0884
+[CVE-2012-0050]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0050
+[CVE-2012-0027]: https://www.openssl.org/news/vulnerabilities.html#CVE-2012-0027
+[CVE-2011-4619]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4619
+[CVE-2011-4577]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4577
+[CVE-2011-4576]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4576
+[CVE-2011-4108]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-4108
+[CVE-2011-3210]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-3210
+[CVE-2011-3207]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-3207
+[CVE-2011-0014]: https://www.openssl.org/news/vulnerabilities.html#CVE-2011-0014
+[CVE-2010-5298]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-5298
+[CVE-2010-4252]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-4252
+[CVE-2010-4180]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-4180
+[CVE-2010-3864]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-3864
+[CVE-2010-2939]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-2939
+[CVE-2010-1633]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-1633
+[CVE-2010-0740]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-0740
+[CVE-2010-0433]: https://www.openssl.org/news/vulnerabilities.html#CVE-2010-0433
+[CVE-2009-3555]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-3555
+[CVE-2009-0789]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0789
+[CVE-2009-0591]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0591
+[CVE-2009-0590]: https://www.openssl.org/news/vulnerabilities.html#CVE-2009-0590
+[CVE-2008-5077]: https://www.openssl.org/news/vulnerabilities.html#CVE-2008-5077
+[CVE-2006-4343]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-4343
+[CVE-2006-4339]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-4339
+[CVE-2006-3737]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-3737
+[CVE-2006-2940]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-2940
+[CVE-2006-2937]: https://www.openssl.org/news/vulnerabilities.html#CVE-2006-2937
+[CVE-2005-2969]: https://www.openssl.org/news/vulnerabilities.html#CVE-2005-2969

NOTES.ANDROID

@@ -15,39 +15,58 @@
  Configuration
  -------------
 
- Android is naturally cross-compiled target and you can't use ./config.
+ Android is a naturally cross-compiled target and you can't use ./config.
  You have to use ./Configure and name your target explicitly; there are
  android-arm, android-arm64, android-mips, android-mip64, android-x86
- and android-x86_64. Do not pass --cross-compile-prefix (as you might
- be tempted), as it will be "calculated" automatically based on chosen
- platform. Though you still need to know the prefix to extend your PATH,
- in order to invoke $(CROSS_COMPILE)gcc and company. (Configure will fail
- and give you a hint if you get it wrong.) Apart from PATH adjustment
- you need to set ANDROID_NDK environment to point at NDK directory
- as /some/where/android-ndk-<ver>. NDK customarily supports multiple
- Android API levels, e.g. android-14, android-21, etc. By default latest 
- one available is chosen. If you need to target older platform, pass
- additional -D__ANDROID_API__=N to Configure. N is numeric value of the
- target platform version. For example, to compile for ICS on ARM with
- NDK 10d:
+ and android-x86_64 (*MIPS targets are no longer supported with NDK R20+).
+ Do not pass --cross-compile-prefix (as you might be tempted), as it will
+ be "calculated" automatically based on chosen platform. Though you still
+ need to know the prefix to extend your PATH, in order to invoke
+ $(CROSS_COMPILE)clang [*gcc on NDK 19 and lower] and company. (Configure
+ will fail and give you a hint if you get it wrong.) Apart from PATH
+ adjustment you need to set ANDROID_NDK_ROOT environment to point at the
+ NDK directory. If you're using a side-by-side NDK the path will look
+ something like /some/where/android-sdk/ndk/<ver>, and for a standalone
+ NDK the path will be something like /some/where/android-ndk-<ver>.
+ Both variables are significant at both configuration and compilation times.
+ The NDK customarily supports multiple Android API levels, e.g. android-14,
+ android-21, etc. By default latest API level is chosen. If you need to
+ target an older platform pass the argument -D__ANDROID_API__=N to Configure,
+ with N being the numerical value of the target platform version. For example,
+ to compile for Android 10 arm64 with a side-by-side NDK r20.0.5594570
 
-    ANDROID_NDK=/some/where/android-ndk-10d
-    PATH=$ANDROID_NDK/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin:$PATH
+	export ANDROID_NDK_ROOT=/home/whoever/Android/android-sdk/ndk/20.0.5594570
+	PATH=$ANDROID_NDK_ROOT/toolchains/llvm/prebuilt/linux-x86_64/bin:$ANDROID_NDK_ROOT/toolchains/arm-linux-androideabi-4.9/prebuilt/linux-x86_64/bin:$PATH
+	./Configure android-arm64 -D__ANDROID_API__=29
+	make
+
+ Older versions of the NDK have GCC under their common prebuilt tools directory, so the bin path
+ will be slightly different. EG: to compile for ICS on ARM with NDK 10d:
+
+    export ANDROID_NDK_ROOT=/some/where/android-ndk-10d
+    PATH=$ANDROID_NDK_ROOT/toolchains/arm-linux-androideabi-4.8/prebuilt/linux-x86_64/bin:$PATH
     ./Configure android-arm -D__ANDROID_API__=14
+    make
 
  Caveat lector! Earlier OpenSSL versions relied on additional CROSS_SYSROOT
- variable set to $ANDROID_NDK/platforms/android-<api>/arch-<arch> to
+ variable set to $ANDROID_NDK_ROOT/platforms/android-<api>/arch-<arch> to
  appoint headers-n-libraries' location. It's still recognized in order
  to facilitate migration from older projects. However, since API level
  appears in CROSS_SYSROOT value, passing -D__ANDROID_API__=N can be in
  conflict, and mixing the two is therefore not supported. Migration to
  CROSS_SYSROOT-less setup is recommended.
 
- One can engage clang by adjusting PATH to cover NDK's clang. Just keep
- in mind that if you miss it, Configure will try to use gcc... Also,
- PATH would need even further adjustment to cover unprefixed, yet
- target-specific, ar and ranlib (or not, if you use binutils-multiarch
- on your Linux).
+ One can engage clang by adjusting PATH to cover same NDK's clang. Just
+ keep in mind that if you miss it, Configure will try to use gcc...
+ Also, PATH would need even further adjustment to cover unprefixed, yet
+ target-specific, ar and ranlib. It's possible that you don't need to
+ bother, if binutils-multiarch is installed on your Linux system.
+
+ Another option is to create so called "standalone toolchain" tailored
+ for single specific platform including Android API level, and assign its
+ location to ANDROID_NDK_ROOT. In such case you have to pass matching
+ target name to Configure and shouldn't use -D__ANDROID_API__=N. PATH
+ adjustment becomes simpler, $ANDROID_NDK_ROOT/bin:$PATH suffices.
 
  Running tests (on Linux)
  ------------------------

NOTES.DJGPP

@@ -1,5 +1,5 @@
 
- 
+
  INSTALLATION ON THE DOS PLATFORM WITH DJGPP
  -------------------------------------------
 
@@ -29,7 +29,7 @@
  running "./Configure" with appropriate arguments:
 
 	./Configure no-threads --prefix=/dev/env/DJDIR DJGPP
- 
+
  And finally fire up "make". You may run out of DPMI selectors when
  running in a DOS box under Windows. If so, just close the BASH
  shell, go back to Windows, and restart BASH. Then run "make" again.

NOTES.PERL

@@ -35,9 +35,11 @@
  MinGW and Cygwin. The key recommendation is to use "matching" Perl,
  one that matches build environment. For example, if you will build
  on Cygwin be sure to use the Cygwin package manager to install Perl.
- For MSYS builds use the MSYS provided Perl. For VC-* builds we
- recommend ActiveState Perl, available from
- http://www.activestate.com/ActivePerl.
+ For MSYS builds use the MSYS provided Perl.
+ For VC-* builds we recommend Strawberry Perl, from http://strawberryperl.com.
+ An alternative is ActiveState Perl, from http://www.activestate.com/ActivePerl
+ for which you may need to explicitly select the Perl module Win32/Console.pm
+ available via https://platform.activestate.com/ActiveState.
 
  Notes on Perl on VMS
  --------------------
@@ -78,7 +80,7 @@
  ---------------------------------
 
  There are a number of ways to install a perl module.  In all
- descriptions below, Text::Template will server as an example.
+ descriptions below, Text::Template will serve as an example.
 
  1. for Linux users, the easiest is to install with the use of your
     favorite package manager.  Usually, all you need to do is search

NOTES.VALGRIND

@@ -0,0 +1,70 @@
+
+NOTES FOR VALGRIND
+==================
+
+Valgrind is a test harness that includes many tools such as memcheck,
+which is commonly used to check for memory leaks, etc. The default tool
+run by Valgrind is memcheck. There are other tools available, but this
+will focus on memcheck.
+
+Valgrind runs programs in a virtual machine, this means OpenSSL unit
+tests run under Valgrind will take longer than normal.
+
+Requirements
+------------
+
+1. Platform supported by Valgrind
+   See: http://valgrind.org/info/platforms.html
+2. Valgrind installed on the platform
+   See: http://valgrind.org/downloads/current.html
+3. OpensSSL compiled
+   See: INSTALL
+
+Running Tests
+-------------
+
+Test behavior can be modified by adjusting environment variables.
+
+EXE_SHELL
+
+This variable is used to specify the shell used to execute OpenSSL test
+programs. The default wrapper (util/wrap.pl) initializes the environment
+to allow programs to find shared libraries. The variable can be modified
+to specify a different executable environment.
+
+   EXE_SHELL="`/bin/pwd`/util/wrap.pl valgrind --error-exitcode=1 --leak-check=full -q"
+
+This will start up Valgrind with the default checker (memcheck).
+The --error-exitcode=1 option specifies that Valgrind should exit with an
+error code of 1 when memory leaks occur.
+The --leak-check=full option specifies extensive memory checking.
+The -q option prints only error messages.
+Additional Valgrind options may be added to the EXE_SHELL variable.
+
+OPENSSL_ia32cap
+
+This variable controls the processor-specific code on Intel processors.
+By default, OpenSSL will attempt to figure out the capabilities of a
+processor, and use it to its fullest capability. This variable can be
+used to control what capabilities OpenSSL uses.
+
+As of valgrind-3.15.0 on Linux/x86_64, instructions up to AVX2 are
+supported. Setting the following disables instructions beyond AVX2:
+
+   OPENSSL_ia32cap=":0"
+
+This variable may need to be set to something different based on the
+processor and Valgrind version you are running tests on. More information
+may be found in docs/man3/OPENSSL_ia32cap.pod.
+
+Additional variables (i.e. VERBOSE and TESTS) are described in the
+INSTALL file in the root of the OpenSSL source tree.
+
+Example command line:
+
+   make test EXE_SHELL="`/bin/pwd`/util/wrap.pl valgrind --error-exitcode=1 --leak-check=full -q" OPENSSL_ia32cap=":0"
+
+If an error occurs, you can then run the specific test via the TESTS
+variable with the VERBOSE option to gather additional information.
+
+   make test VERBOSE=1 TESTS=test_test EXE_SHELL="`/bin/pwd`/util/wrap.pl valgrind --error-exitcode=1 --leak-check=full -q" OPENSSL_ia32cap=":0"

NOTES.VMS

@@ -42,7 +42,7 @@
  for now is to rename the OpenSSL source directory, as follows (please
  adjust for the actual source directory name you have):
 
-    $ rename openssl-1^.1^.0.DIR openssl-1_1_0.DIR 
+    $ rename openssl-1^.1^.0.DIR openssl-1_1_0.DIR
 
 
  About MMS and DCL

NOTES.WIN

@@ -1,58 +1,74 @@
 
- NOTES FOR THE WINDOWS PLATFORMS
- ===============================
+ NOTES FOR WINDOWS PLATFORMS
+ ===========================
 
- Windows targets can be classified as "native", ones that use Windows API
- directly, and "hosted" which rely on POSIX-compatible layer. "Native"
- targets are VC-* (where "VC" stems from abbreviating Microsoft Visual C
- compiler) and mingw[64]. "Hosted" platforms are Cygwin and MSYS[2]. Even
- though the latter is not directly supported by OpenSSL Team, it's #1
- popular choice for building MinGW targets. In the nutshell MinGW builds
- are always cross-compiled. On Linux and Cygwin they look exactly as such
- and require --cross-compile-prefix option. While on MSYS[2] it's solved
- rather by placing gcc that produces "MinGW binary" code 1st on $PATH.
- This is customarily source of confusion. "Hosted" applications "live" in
- emulated file system name space with POSIX-y root, mount points, /dev
- and even /proc. Confusion is intensified by the fact that MSYS2 shell
- (or rather emulated execve(2) call) examines the binary it's about to
- start, and if it's found *not* to be linked with MSYS2 POSIX-y thing,
- command line arguments that look like file names get translated from
- emulated name space to "native". For example '/c/some/where' becomes
- 'c:\some\where', '/dev/null' - 'nul'. This creates an illusion that
- there is no difference between MSYS2 shell and "MinGW binary", but
- there is. Just keep in mind that "MinGW binary" "experiences" Windows
- system in exactly same way as one produced by VC, and in its essence
- is indistinguishable from the latter. (Which by the way is why
- it's referred to in quotes here, as "MinGW binary", it's just as
- "native" as it can get.)
+ There are various options to build and run OpenSSL on the Windows platforms.
 
- Visual C++ builds, a.k.a. VC-*
- ==============================
+ "Native" OpenSSL uses the Windows APIs directly at run time.
+ To build a native OpenSSL you can either use:
+
+     Microsoft Visual C++ (MSVC) C compiler on the command line
+ or
+     MinGW cross compiler
+     run on the GNU-like development environment MSYS2
+     or run on Linux or Cygwin
+
+ "Hosted" OpenSSL relies on an external POSIX compatibility layer
+ for building (using GNU/Unix shell, compiler, and tools) and at run time.
+ For this option you can use Cygwin.
+
+
+ Visual C++ native builds, a.k.a. VC-*
+ =====================================
 
  Requirement details
  -------------------
 
- In addition to the requirements and instructions listed in INSTALL,
+ In addition to the requirements and instructions listed in INSTALL.md,
  these are required as well:
 
- - Perl. We recommend ActiveState Perl, available from
-   https://www.activestate.com/ActivePerl. Another viable alternative
-   appears to be Strawberry Perl, http://strawberryperl.com.
-   You also need the perl module Text::Template, available on CPAN.
-   Please read NOTES.PERL for more information.
+ - Perl.
+   We recommend Strawberry Perl, available from http://strawberryperl.com/
+   Please read NOTES.PERL for more information, including the use of CPAN.
+   An alternative is ActiveState Perl, https://www.activestate.com/ActivePerl
+   for which you may need to explicitly build the Perl module Win32/Console.pm
+   via https://platform.activestate.com/ActiveState and then download it.
 
- - Microsoft Visual C compiler. Since we can't test them all, there is
-   unavoidable uncertainty about which versions are supported. Latest
-   version along with couple of previous are certainly supported. On
-   the other hand oldest one is known not to work. Everything between
-   falls into best-effort category.
+ - Microsoft Visual C compiler.
+   Since these are proprietary and ever-changing we cannot test them all.
+   Older versions may not work. Use a recent version wherever possible.
 
- - Netwide Assembler, a.k.a. NASM, available from https://www.nasm.us,
-   is required. Note that NASM is the only supported assembler. Even
-   though Microsoft provided assembler is NOT supported, contemporary
-   64-bit version is exercised through continuous integration of
-   VC-WIN64A-masm target.
+ - Netwide Assembler (NASM), available from https://www.nasm.us
+   Note that NASM is the only supported assembler.
 
+ Quick start
+ -----------
+
+ 1. Install Perl
+
+ 2. Install NASM
+
+ 3. Make sure both Perl and NASM are on your %PATH%
+
+ 4. Use Visual Studio Developer Command Prompt with administrative privileges,
+    choosing one of its variants depending on the intended architecture.
+    Or run "cmd" and execute "vcvarsall.bat" with one of the options x86,
+    x86_amd64, x86_arm, x86_arm64, amd64, amd64_x86, amd64_arm, or amd64_arm64.
+    This sets up the environment variables needed for nmake.exe, cl.exe, etc.
+    See also https://docs.microsoft.com/cpp/build/building-on-the-command-line
+
+ 5. From the root of the OpenSSL source directory enter
+    perl Configure VC-WIN32    if you want 32-bit OpenSSL or
+    perl Configure VC-WIN64A   if you want 64-bit OpenSSL
+
+ 6. nmake
+
+ 7. nmake test
+
+ 8. nmake install
+
+ For the full installation instructions, or if anything goes wrong at any stage,
+ check the INSTALL.md file.
 
  Installation directories
  ------------------------
@@ -83,31 +99,63 @@
  is, of course, to choose a different set of directories by using
  --prefix and --openssldir when configuring.
 
- mingw and mingw64
- =================
+ Special notes for Universal Windows Platform builds, a.k.a. VC-*-UWP
+ --------------------------------------------------------------------
 
- * MSYS2 shell and development environment installation:
+ - UWP targets only support building the static and dynamic libraries.
 
-   Download MSYS2 from https://msys2.github.io/ and follow installation
-   instructions. Once up and running install even make, perl, (git if
-   needed,) mingw-w64-i686-gcc and/or mingw-w64-x86_64-gcc. You should
-   have corresponding MinGW items on your start menu, use *them*, not
-   generic MSYS2. As implied in opening note, difference between them
-   is which compiler is found 1st on $PATH. At this point ./config
-   should recognize correct target, roll as if it was Unix...
+ - You should define the platform type to "uwp" and the target arch via
+   "vcvarsall.bat" before you compile. For example, if you want to build
+   "arm64" builds, you should run "vcvarsall.bat x86_arm64 uwp".
 
- * It is also possible to build mingw[64] on Linux or Cygwin by
-   configuring with corresponding --cross-compile-prefix= option. For
-   example
+
+ Native OpenSSL built using MinGW
+ ================================
+
+ MinGW offers an alternative way to build native OpenSSL, by cross compilation.
+
+ * Usually the build is done on Windows in a GNU-like environment called MSYS2.
+
+   MSYS2 provides GNU tools, a Unix-like command prompt,
+   and a UNIX compatibility layer for applications.
+   However in this context it is only used for building OpenSSL.
+   The resulting OpenSSL does not rely on MSYS2 to run and is fully native.
+
+   Requirement details
+
+   - MSYS2 shell, from https://www.msys2.org/
+
+   - Perl, at least version 5.10.0, which usually comes pre-installed with MSYS2
+
+   - make, installed using "pacman -S make" into the MSYS2 environment
+
+   - MinGW[64] compiler: mingw-w64-i686-gcc and/or mingw-w64-x86_64-gcc.
+     These compilers must be on your MSYS2 $PATH.
+     A common error is to not have these on your $PATH.
+     The MSYS2 version of gcc will not work correctly here.
+
+   In the MSYS2 shell do the configuration depending on the target architecture:
+
+     ./Configure mingw ...
+   or
+     ./Configure mingw64 ...
+   or
+     ./config ...
+   for the default architecture.
+
+   Apart from that, follow the Unix / Linux instructions in INSTALL.md.
+
+ * It is also possible to build mingw[64] on Linux or Cygwin.
+
+   In this case configure with the corresponding --cross-compile-prefix= option.
+   For example
 
      ./Configure mingw --cross-compile-prefix=i686-w64-mingw32- ...
-
    or
-
      ./Configure mingw64 --cross-compile-prefix=x86_64-w64-mingw32- ...
 
-   This naturally implies that you've installed corresponding add-on
-   packages.
+   This requires that you've installed the necessary add-on packages for
+   mingw[64] cross compilation.
 
  Linking your application
  ========================
@@ -136,28 +184,29 @@
 	}
 
  If you link with OpenSSL .DLLs, then you're expected to include into
- your application code small "shim" snippet, which provides glue between
- OpenSSL BIO layer and your compiler run-time. See the OPENSSL_Applink
- manual page for further details.
+ your application code a small "shim" snippet, which provides
+ the glue between the OpenSSL BIO layer and your compiler run-time.
+ See also the OPENSSL_Applink manual page.
 
- Cygwin, "hosted" environment
- ============================
 
- Cygwin implements a Posix/Unix runtime system (cygwin1.dll) on top of the
- Windows subsystem and provides a bash shell and GNU tools environment.
- Consequently, a make of OpenSSL with Cygwin is virtually identical to the
+ Hosted OpenSSL built using Cygwin
+ =================================
+
+ Cygwin implements a POSIX/Unix runtime system (cygwin1.dll) on top of the
+ Windows subsystem and provides a Bash shell and GNU tools environment.
+ Consequently, a build of OpenSSL with Cygwin is virtually identical to the
  Unix procedure.
 
  To build OpenSSL using Cygwin, you need to:
 
- * Install Cygwin (see https://cygwin.com/)
+ * Install Cygwin, see https://cygwin.com/
 
- * Install Cygwin Perl and ensure it is in the path. Recall that
-   as least 5.10.0 is required.
+ * Install Cygwin Perl, at least version 5.10.0
+   and ensure it is in the $PATH
 
- * Run the Cygwin bash shell
+ * Run the Cygwin Bash shell
 
- Apart from that, follow the Unix instructions in INSTALL.
+ Apart from that, follow the Unix / Linux instructions in INSTALL.md.
 
  NOTE: "make test" and normal file operations may fail in directories
  mounted as text (i.e. mount -t c:\somewhere /home) due to Cygwin

README

@@ -1,93 +0,0 @@
-
- OpenSSL 1.1.1-pre9-dev
-
- Copyright (c) 1998-2018 The OpenSSL Project
- Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
- All rights reserved.
-
- DESCRIPTION
- -----------
-
- The OpenSSL Project is a collaborative effort to develop a robust,
- commercial-grade, fully featured, and Open Source toolkit implementing the
- Transport Layer Security (TLS) protocols (including SSLv3) as well as a
- full-strength general purpose cryptographic library.
-
- OpenSSL is descended from the SSLeay library developed by Eric A. Young
- and Tim J. Hudson.  The OpenSSL toolkit is licensed under a dual-license (the
- OpenSSL license plus the SSLeay license), which means that you are free to
- get and use it for commercial and non-commercial purposes as long as you
- fulfill the conditions of both licenses.
-
- OVERVIEW
- --------
-
- The OpenSSL toolkit includes:
-
- libssl (with platform specific naming):
-     Provides the client and server-side implementations for SSLv3 and TLS.
-
- libcrypto (with platform specific naming):
-     Provides general cryptographic and X.509 support needed by SSL/TLS but
-     not logically part of it.
-
- openssl:
-     A command line tool that can be used for:
-        Creation of key parameters
-        Creation of X.509 certificates, CSRs and CRLs
-        Calculation of message digests
-        Encryption and decryption
-        SSL/TLS client and server tests
-        Handling of S/MIME signed or encrypted mail
-        And more...
-
- INSTALLATION
- ------------
-
- See the appropriate file:
-        INSTALL         Linux, Unix, Windows, OpenVMS, ...
-        NOTES.*         INSTALL addendums for different platforms
-
- SUPPORT
- -------
-
- See the OpenSSL website www.openssl.org for details on how to obtain
- commercial technical support. Free community support is available through the
- openssl-users email list (see
- https://www.openssl.org/community/mailinglists.html for further details).
-
- If you have any problems with OpenSSL then please take the following steps
- first:
-
-    - Download the latest version from the repository
-      to see if the problem has already been addressed
-    - Configure with no-asm
-    - Remove compiler optimization flags
-
- If you wish to report a bug then please include the following information
- and create an issue on GitHub:
-
-    - OpenSSL version: output of 'openssl version -a'
-    - Configuration data: output of 'perl configdata.pm --dump'
-    - OS Name, Version, Hardware platform
-    - Compiler Details (name, version)
-    - Application Details (name, version)
-    - Problem Description (steps that will reproduce the problem, if known)
-    - Stack Traceback (if the application dumps core)
-
- Just because something doesn't work the way you expect does not mean it
- is necessarily a bug in OpenSSL. Use the openssl-users email list for this type
- of query.
-
- HOW TO CONTRIBUTE TO OpenSSL
- ----------------------------
-
- See CONTRIBUTING
-
- LEGALITIES
- ----------
-
- A number of nations restrict the use or export of cryptography. If you
- are potentially subject to such restrictions you should seek competent
- professional legal advice before attempting to develop or distribute
- cryptographic code.

README.md

@@ -0,0 +1,236 @@
+Welcome to the OpenSSL Project
+==============================
+
+[![openssl logo][]][www.openssl.org]
+
+[![travis badge][]][travis jobs]
+[![appveyor badge][]][appveyor jobs]
+
+OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit
+for the Transport Layer Security (TLS) protocol formerly known as the
+Secure Sockets Layer (SSL) protocol. The protocol implementation is based
+on a full-strength general purpose cryptographic library, which can also
+be used stand-alone.
+
+OpenSSL is descended from the SSLeay library developed by Eric A. Young
+and Tim J. Hudson.
+
+The official Home Page of the OpenSSL Project is [www.openssl.org][].
+
+Table of Contents
+=================
+
+ - [Overview](#overview)
+ - [Download](#download)
+ - [Build and Install](#build-and-install)
+ - [Documentation](#documentation)
+ - [License](#license)
+ - [Support](#support)
+ - [Contributing](#contributing)
+ - [Legalities](#legalities)
+
+Overview
+========
+
+The OpenSSL toolkit includes:
+
+- **libssl**
+  an implementation of all TLS protocol versions up to TLSv1.3 ([RFC 8446][]).
+
+- **libcrypto**
+  a full-strength general purpose cryptographic library. It constitutes the
+  basis of the TLS implementation, but can also be used independently.
+
+- **openssl**
+  the OpenSSL command line tool, a swiss army knife for cryptographic tasks,
+  testing and analyzing. It can be used for
+  - creation of key parameters
+  - creation of X.509 certificates, CSRs and CRLs
+  - calculation of message digests
+  - encryption and decryption
+  - SSL/TLS client and server tests
+  - handling of S/MIME signed or encrypted mail
+  - and more...
+
+Download
+========
+
+For Production Use
+------------------
+
+Source code tarballs of the official releases can be downloaded from
+[www.openssl.org/source](https://www.openssl.org/source).
+The OpenSSL project does not distribute the toolkit in binary form.
+
+However, for a large variety of operating systems precompiled versions
+of the OpenSSL toolkit are available. In particular on Linux and other
+Unix operating systems it is normally recommended to link against the
+precompiled shared libraries provided by the distributor or vendor.
+
+For Testing and Development
+---------------------------
+
+Although testing and development could in theory also be done using
+the source tarballs, having a local copy of the git repository with
+the entire project history gives you much more insight into the
+code base.
+
+The official OpenSSL Git Repository is located at [git.openssl.org][].
+There is a GitHub mirror of the repository at [github.com/openssl/openssl][],
+which is updated automatically from the former on every commit.
+
+A local copy of the Git Repository can be obtained by cloning it from
+the original OpenSSL repository using
+
+    git clone git://git.openssl.org/openssl.git
+
+or from the GitHub mirror using
+
+    git clone https://github.com/openssl/openssl.git
+
+If you intend to contribute to OpenSSL, either to fix bugs or contribute
+new features, you need to fork the OpenSSL repository openssl/openssl on
+GitHub and clone your public fork instead.
+
+    git clone https://github.com/yourname/openssl.git
+
+This is necessary, because all development of OpenSSL nowadays is done via
+GitHub pull requests. For more details, see [Contributing](#contributing).
+
+Build and Install
+=================
+
+After obtaining the Source, have a look at the [INSTALL](INSTALL.md) file for
+detailed instructions about building and installing OpenSSL. For some
+platforms, the installation instructions are amended by a platform specific
+document.
+
+ * [NOTES.ANDROID](NOTES.ANDROID)
+ * [NOTES.DJGPP](NOTES.DJGPP)
+ * [NOTES.PERL](NOTES.PERL)
+ * [NOTES.UNIX](NOTES.UNIX)
+ * [NOTES.VALGRIND](NOTES.VALGRIND)
+ * [NOTES.VMS](NOTES.VMS)
+ * [NOTES.WIN](NOTES.WIN)
+
+Specific notes on upgrading to OpenSSL 3.0 from previous versions, as well as
+known issues are available on the OpenSSL
+[wiki](https://wiki.openssl.org/index.php/OpenSSL_3.0).
+
+Documentation
+=============
+
+Manual Pages
+------------
+
+The manual pages for the master branch and all current stable releases are
+available online.
+
+- [OpenSSL master](https://www.openssl.org/docs/manmaster)
+- [OpenSSL 1.1.1](https://www.openssl.org/docs/man1.1.1)
+
+Wiki
+----
+
+There is a Wiki at [wiki.openssl.org][] which is currently not very active.
+It contains a lot of useful information, not all of which is up to date.
+
+License
+=======
+
+OpenSSL is licensed under the Apache License 2.0, which means that
+you are free to get and use it for commercial and non-commercial
+purposes as long as you fulfill its conditions.
+
+See the [LICENSE](LICENSE) file for more details.
+
+Support
+=======
+
+There are various ways to get in touch. The correct channel depends on
+your requirement. see the [SUPPORT](SUPPORT.md) file for more details.
+
+Contributing
+============
+
+If you are interested and willing to contribute to the OpenSSL project,
+please take a look at the [CONTRIBUTING](CONTRIBUTING.md) file.
+
+Since 2016, development takes place in public on the GitHub open source
+platform. The OpenSSL Project Pages at [openssl.github.io][] are a
+valuable source of information if you want to get familiar with our
+development process on GitHub.
+
+Legalities
+==========
+
+A number of nations restrict the use or export of cryptography. If you are
+potentially subject to such restrictions you should seek legal advice before
+attempting to develop or distribute cryptographic code.
+
+Copyright
+=========
+
+Copyright (c) 1998-2020 The OpenSSL Project
+
+Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
+
+All rights reserved.
+
+<!-- Links  -->
+
+[www.openssl.org]:
+    <https://www.openssl.org>
+    "OpenSSL Homepage"
+
+[git.openssl.org]:
+    <https://git.openssl.org>
+    "OpenSSL Git Repository"
+
+[git.openssl.org]:
+    <https://git.openssl.org>
+    "OpenSSL Git Repository"
+
+[github.com/openssl/openssl]:
+    <https://github.com/openssl/openssl>
+    "OpenSSL GitHub Mirror"
+
+[openssl.github.io]:
+    <https://mspncp.github.io>
+    "OpenSSL Project Pages"
+
+[wiki.openssl.org]:
+    <https://wiki.openssl.org>
+    "OpenSSL Wiki"
+
+[RFC 8446]:
+     <https://tools.ietf.org/html/rfc8446>
+
+<!-- Logos and Badges -->
+<!--
+  Note: The security token for the appveyor badge (the random number in
+  the URL below) was obtained for the mspncp/openssl project.
+  It needs to be replaced by the correct token by some core member
+  (@levitte, @mattcaswell?). It can be obtained for project members at
+  https://ci.appveyor.com/project/openssl/openssl/settings/badges.
+-->
+
+[openssl logo]:
+    doc/images/openssl.svg
+    "OpenSSL Logo"
+
+[travis badge]:
+    <https://travis-ci.org/openssl/openssl.svg?branch=master>
+    "Travis Build Status"
+
+[travis jobs]:
+    <https://travis-ci.org/openssl/openssl>
+    "Travis Jobs"
+
+[appveyor badge]:
+    <https://ci.appveyor.com/api/projects/status/ikn2l4u1xsume63u/branch/master?svg=true>
+    "AppVeyor Build Status"
+
+[appveyor jobs]:
+    <https://ci.appveyor.com/project/openssl/openssl/branch/master>
+    "AppVeyor Jobs"

SUPPORT.md

@@ -0,0 +1,120 @@
+OpenSSL User Support resources
+==============================
+
+_Under Construction; not more than a collection of text fragments yet._
+
+See the OpenSSL website www.openssl.org for details on how to obtain
+commercial technical support. Free community support is available through the
+openssl-users email list (see
+<https://www.openssl.org/community/mailinglists.html for> further details).
+
+If you have any problems with OpenSSL then please take the following steps
+first:
+
+ - Download the latest version from the repository
+   to see if the problem has already been addressed
+ - Configure with no-asm
+ - Remove compiler optimization flags
+
+If you wish to report a bug then please include the following information
+and create an issue on GitHub:
+
+ - OpenSSL version: output of 'openssl version -a'
+ - Configuration data: output of 'perl configdata.pm ==dump'
+ - OS Name, Version, Hardware platform
+ - Compiler Details (name, version)
+ - Application Details (name, version)
+ - Problem Description (steps that will reproduce the problem, if known)
+ - Stack Traceback (if the application dumps core)
+
+Just because something doesn't work the way you expect does not mean it
+is necessarily a bug in OpenSSL. Use the openssl-users email list for this type
+of query.
+
+For *questions* on how to use OpenSSL or what went wrong when you
+tried something, our primary resource is the mailing list
+openssl-users@openssl.org, where you can get help from others in the
+OpenSSL community (which includes the developers as time permits).
+
+Only subscribers can post to openssl-users@openssl.org (although the
+archives are public).
+For more information, see <https://www.openssl.org/community/mailinglists.html>
+
+You have general questions about using OpenSSL
+----------------------------------------------
+
+In this case the [openssl-users][] mailing list is the right place for you.
+The list is not only watched by the OpenSSL team members, but also by many
+other OpenSSL users. Here you will most likely get the answer to your questions.
+An overview over the [mailing lists](#mailing-lists) can be found below.
+
+You found a Bug
+---------------
+
+If you have any problems with OpenSSL then please take the following steps first:
+
+- Search the mailing lists and/or the GitHub issues to find out whether
+  the problem has already been reported.
+- Download the latest version from the repository to see if the problem
+  has already been addressed.
+- Configure without assembler support (`no-asm`) and check whether the
+  problem persists.
+- Remove compiler optimization flags.
+
+Please keep in mind: Just because something doesn't work the way you expect
+does not mean it is necessarily a bug in OpenSSL. If you are not sure,
+consider searching the mail archives and posting a question to the
+[openssl-users][] mailing list first.
+
+### Open an Issue
+
+If you wish to report a bug, please open an [issue][github-issues] on GitHub
+and include the following information:
+
+- OpenSSL version: output of `openssl version -a`
+- Configuration data: output of `perl configdata.pm --dump`
+- OS Name, Version, Hardware platform
+- Compiler Details (name, version)
+- Application Details (name, version)
+- Problem Description (steps that will reproduce the problem, if known)
+- Stack Traceback (if the application dumps core)
+
+Not only errors in the software, also errors in the documentation, in
+particular the manual pages, can be reported as issues.
+
+### Submit a Pull Request
+
+The fastest way to get a bug fixed is to fix it yourself ;-). If you are
+experienced in programming and know how to fix the bug, you can open a
+pull request. The details are covered in the [Contributing](#contributing) section.
+
+Don't hesitate to open a pull request, even if it's only a small change
+like a grammatical or typographical error in the documentation.
+
+Mailing Lists
+=============
+
+The OpenSSL maintains a number of [mailing lists][] for various purposes.
+The most important lists are:
+
+- [openssl-users][] for general questions about using the OpenSSL software
+                    and discussions between OpenSSL users.
+
+- [openssl-announce][] for official announcements to the OpenSSL community.
+
+- [openssl-project][]  for discussion about the development roadmap
+                       and governance.
+
+- [openssl-dev][]      for discussion about development of OpenSSL.
+
+The openssl-dev list has been discontinued since development is now taking
+place in form of GitHub pull requests. Although not active anymore, the
+searchable archive may still contain useful information.
+
+<!-- Links -->
+
+[mailing lists]:     https://www.openssl.org/community/mailinglists.html
+[openssl-users]:     https://mta.openssl.org/mailman/listinfo/openssl-users
+[openssl-announce]:  https://mta.openssl.org/mailman/listinfo/openssl-announce
+[openssl-project]:   https://mta.openssl.org/mailman/listinfo/openssl-project
+[openssl-dev]:       https://mta.openssl.org/mailman/listinfo/openssl-dev

VERSION

@@ -0,0 +1,7 @@
+MAJOR=3
+MINOR=0
+PATCH=0
+PRE_RELEASE_TAG=alpha4-dev
+BUILD_METADATA=
+RELEASE_DATE=""
+SHLIB_VERSION=3

VMS/VMSify-conf.pl

@@ -1,7 +1,7 @@
 #! /usr/bin/env perl
 # Copyright 2004-2016 The OpenSSL Project Authors. All Rights Reserved.
 #
-# Licensed under the OpenSSL license (the "License").  You may not use
+# Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
 # in the file LICENSE in the source distribution or at
 # https://www.openssl.org/source/license.html

VMS/openssl_shutdown.com.in

@@ -26,7 +26,7 @@ $	ENDIF
 $
 $	! Abbrevs
 $	DEAS := DEASSIGN /NOLOG 'P1'
-$	sv   := {- sprintf "%02d%02d", split m|\.|, $config{shlib_version_number} -}
+$	sv   := {- sprintf "%02d%02d", split m|\.|, $config{shlib_version} -}
 $	pz   := {- $config{pointer_size} -}
 $
 $	DEAS OSSL$DATAROOT

VMS/openssl_startup.com.in

@@ -88,7 +88,7 @@ $
 $	! Abbrevs
 $	DEFT := DEFINE /TRANSLATION=CONCEALED /NOLOG 'P1'
 $	DEF  := DEFINE /NOLOG 'P1'
-$	sv   := {- sprintf "%02d%02d", split m|\.|, $config{shlib_version_number} -}
+$	sv   := {- sprintf "%02d%02d", split m|\.|, $config{shlib_version} -}
 $	pz   := {- $config{pointer_size} -}
 $
 $	DEFT OSSL$DATAROOT		'OPENSSLDIR_']

VMS/translatesyms.pl

@@ -1,7 +1,7 @@
 #! /usr/bin/env perl
 # Copyright 2016 The OpenSSL Project Authors. All Rights Reserved.
 #
-# Licensed under the OpenSSL license (the "License").  You may not use
+# Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
 # in the file LICENSE in the source distribution or at
 # https://www.openssl.org/source/license.html

apps/CA.pl.in

@@ -1,7 +1,7 @@
 #!{- $config{HASHBANGPERL} -}
-# Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
 #
-# Licensed under the OpenSSL license (the "License").  You may not use
+# Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
 # in the file LICENSE in the source distribution or at
 # https://www.openssl.org/source/license.html
@@ -14,57 +14,63 @@
 use strict;
 use warnings;
 
-my $openssl = "openssl";
-if(defined $ENV{'OPENSSL'}) {
-    $openssl = $ENV{'OPENSSL'};
-} else {
-    $ENV{'OPENSSL'} = $openssl;
-}
-
 my $verbose = 1;
+my @OPENSSL_CMDS = ("req", "ca", "pkcs12", "x509", "verify");
 
-my $OPENSSL_CONFIG = $ENV{"OPENSSL_CONFIG"} || "";
-my $DAYS = "-days 365";
-my $CADAYS = "-days 1095";	# 3 years
+my $openssl = $ENV{'OPENSSL'} // "openssl";
+$ENV{'OPENSSL'} = $openssl;
+my $OPENSSL_CONFIG = $ENV{"OPENSSL_CONFIG"} // "";
+
+# Command invocations.
 my $REQ = "$openssl req $OPENSSL_CONFIG";
 my $CA = "$openssl ca $OPENSSL_CONFIG";
 my $VERIFY = "$openssl verify";
 my $X509 = "$openssl x509";
 my $PKCS12 = "$openssl pkcs12";
 
-# default openssl.cnf file has setup as per the following
+# Default values for various configuration settings.
 my $CATOP = "./demoCA";
 my $CAKEY = "cakey.pem";
 my $CAREQ = "careq.pem";
 my $CACERT = "cacert.pem";
 my $CACRL = "crl.pem";
-my $DIRMODE = 0777;
-
+my $DAYS = "-days 365";
+my $CADAYS = "-days 1095";	# 3 years
 my $NEWKEY = "newkey.pem";
 my $NEWREQ = "newreq.pem";
 my $NEWCERT = "newcert.pem";
 my $NEWP12 = "newcert.p12";
-my $RET = 0;
-my $WHAT = shift @ARGV || "";
-my @OPENSSL_CMDS = ("req", "ca", "pkcs12", "x509", "verify");
-my %EXTRA = extra_args(\@ARGV, "-extra-");
-my $FILE;
 
-sub extra_args {
-    my ($args_ref, $arg_prefix) = @_;
-    my %eargs = map {
-	if ($_ < $#$args_ref) {
-	    my ($arg, $value) = splice(@$args_ref, $_, 2);
-	    $arg =~ s/$arg_prefix//;
-	    ($arg, $value);
-	} else {
-	    ();
-	}
-    } reverse grep($$args_ref[$_] =~ /$arg_prefix/, 0..$#$args_ref);
-    my %empty = map { ($_, "") } @OPENSSL_CMDS;
-    return (%empty, %eargs);
+# Commandline parsing
+my %EXTRA;
+my $WHAT = shift @ARGV || "";
+@ARGV = parse_extra(@ARGV);
+my $RET = 0;
+
+# Split out "-extra-CMD value", and return new |@ARGV|. Fill in
+# |EXTRA{CMD}| with list of values.
+sub parse_extra
+{
+    foreach ( @OPENSSL_CMDS ) {
+        $EXTRA{$_} = '';
+    }
+
+    my @result;
+    while ( scalar(@_) > 0 ) {
+        my $arg = shift;
+        if ( $arg !~ m/-extra-([a-z0-9]+)/ ) {
+            push @result, $arg;
+            next;
+        }
+        $arg =~ s/-extra-//;
+        die("Unknown \"-${arg}-extra\" option, exiting")
+            unless scalar grep { $arg eq $_ } @OPENSSL_CMDS;
+        $EXTRA{$arg} .= " " . shift;
+    }
+    return @result;
 }
 
+
 # See if reason for a CRL entry is valid; exit if not.
 sub crl_reason_ok
 {
@@ -113,19 +119,25 @@ sub run
 
 
 if ( $WHAT =~ /^(-\?|-h|-help)$/ ) {
-    print STDERR "usage: CA.pl -newcert | -newreq | -newreq-nodes | -xsign | -sign | -signCA | -signcert | -crl | -newca [-extra-cmd extra-params]\n";
-    print STDERR "       CA.pl -pkcs12 [-extra-pkcs12 extra-params] [certname]\n";
-    print STDERR "       CA.pl -verify [-extra-verify extra-params] certfile ...\n";
-    print STDERR "       CA.pl -revoke [-extra-ca extra-params] certfile [reason]\n";
+    print STDERR <<EOF;
+Usage:
+    CA.pl -newcert | -newreq | -newreq-nodes | -xsign | -sign | -signCA | -signcert | -crl | -newca [-extra-cmd parameter]
+    CA.pl -pkcs12 [-extra-pkcs12 parameter] [certname]
+    CA.pl -verify [-extra-verify parameter] certfile ...
+    CA.pl -revoke [-extra-ca parameter] certfile [reason]
+EOF
     exit 0;
 }
+
 if ($WHAT eq '-newcert' ) {
     # create a certificate
-    $RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS $EXTRA{req}");
+    $RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS"
+            . " $EXTRA{req}");
     print "Cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
 } elsif ($WHAT eq '-precert' ) {
     # create a pre-certificate
-    $RET = run("$REQ -x509 -precert -keyout $NEWKEY -out $NEWCERT $DAYS");
+    $RET = run("$REQ -x509 -precert -keyout $NEWKEY -out $NEWCERT $DAYS"
+            . " $EXTRA{req}");
     print "Pre-cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
 } elsif ($WHAT =~ /^\-newreq(\-nodes)?$/ ) {
     # create a certificate request
@@ -133,11 +145,20 @@ if ($WHAT eq '-newcert' ) {
     print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;
 } elsif ($WHAT eq '-newca' ) {
     # create the directory hierarchy
-    mkdir ${CATOP}, $DIRMODE;
-    mkdir "${CATOP}/certs", $DIRMODE;
-    mkdir "${CATOP}/crl", $DIRMODE ;
-    mkdir "${CATOP}/newcerts", $DIRMODE;
-    mkdir "${CATOP}/private", $DIRMODE;
+    my @dirs = ( "${CATOP}", "${CATOP}/certs", "${CATOP}/crl",
+                "${CATOP}/newcerts", "${CATOP}/private" );
+    die "${CATOP}/index.txt exists.\nRemove old sub-tree to proceed,"
+        if -f "${CATOP}/index.txt";
+    die "${CATOP}/serial exists.\nRemove old sub-tree to proceed,"
+        if -f "${CATOP}/serial";
+    foreach my $d ( @dirs ) {
+        if ( -d $d ) {
+            warn "Directory $d exists" if -d $d;
+        } else {
+            mkdir $d or die "Can't mkdir $d, $!";
+        }
+    }
+
     open OUT, ">${CATOP}/index.txt";
     close OUT;
     open OUT, ">${CATOP}/crlnumber";
@@ -145,6 +166,7 @@ if ($WHAT eq '-newcert' ) {
     close OUT;
     # ask user for existing CA certificate
     print "CA certificate filename (or enter to create)\n";
+    my $FILE;
     $FILE = "" unless defined($FILE = <STDIN>);
     $FILE =~ s{\R$}{};
     if ($FILE ne "") {
@@ -152,44 +174,42 @@ if ($WHAT eq '-newcert' ) {
         copy_pemfile($FILE,"${CATOP}/$CACERT", "CERTIFICATE");
     } else {
         print "Making CA certificate ...\n";
-        $RET = run("$REQ -new -keyout"
-                . " ${CATOP}/private/$CAKEY"
+        $RET = run("$REQ -new -keyout ${CATOP}/private/$CAKEY"
                 . " -out ${CATOP}/$CAREQ $EXTRA{req}");
         $RET = run("$CA -create_serial"
                 . " -out ${CATOP}/$CACERT $CADAYS -batch"
                 . " -keyfile ${CATOP}/private/$CAKEY -selfsign"
-                . " -extensions v3_ca $EXTRA{ca}"
-                . " -infiles ${CATOP}/$CAREQ") if $RET == 0;
+                . " -extensions v3_ca"
+                . " -infiles ${CATOP}/$CAREQ $EXTRA{ca}") if $RET == 0;
         print "CA certificate is in ${CATOP}/$CACERT\n" if $RET == 0;
     }
 } elsif ($WHAT eq '-pkcs12' ) {
     my $cname = $ARGV[0];
     $cname = "My Certificate" unless defined $cname;
     $RET = run("$PKCS12 -in $NEWCERT -inkey $NEWKEY"
-            . " -certfile ${CATOP}/$CACERT"
-            . " -out $NEWP12"
+            . " -certfile ${CATOP}/$CACERT -out $NEWP12"
             . " -export -name \"$cname\" $EXTRA{pkcs12}");
     print "PKCS #12 file is in $NEWP12\n" if $RET == 0;
 } elsif ($WHAT eq '-xsign' ) {
-    $RET = run("$CA -policy policy_anything $EXTRA{ca} -infiles $NEWREQ");
+    $RET = run("$CA -policy policy_anything -infiles $NEWREQ $EXTRA{ca}");
 } elsif ($WHAT eq '-sign' ) {
-    $RET = run("$CA -policy policy_anything -out $NEWCERT $EXTRA{ca} -infiles $NEWREQ");
+    $RET = run("$CA -policy policy_anything -out $NEWCERT"
+            . " -infiles $NEWREQ $EXTRA{ca}");
     print "Signed certificate is in $NEWCERT\n" if $RET == 0;
 } elsif ($WHAT eq '-signCA' ) {
     $RET = run("$CA -policy policy_anything -out $NEWCERT"
-            . " -extensions v3_ca $EXTRA{ca} -infiles $NEWREQ");
+            . " -extensions v3_ca -infiles $NEWREQ $EXTRA{ca}");
     print "Signed CA certificate is in $NEWCERT\n" if $RET == 0;
 } elsif ($WHAT eq '-signcert' ) {
     $RET = run("$X509 -x509toreq -in $NEWREQ -signkey $NEWREQ"
             . " -out tmp.pem $EXTRA{x509}");
     $RET = run("$CA -policy policy_anything -out $NEWCERT"
-            . "$EXTRA{ca} -infiles tmp.pem") if $RET == 0;
+            .  "-infiles tmp.pem $EXTRA{ca}") if $RET == 0;
     print "Signed certificate is in $NEWCERT\n" if $RET == 0;
 } elsif ($WHAT eq '-verify' ) {
     my @files = @ARGV ? @ARGV : ( $NEWCERT );
-    my $file;
-    foreach $file (@files) {
-        my $status = run("$VERIFY \"-CAfile\" ${CATOP}/$CACERT $file $EXTRA{verify}");
+    foreach my $file (@files) {
+        my $status = run("$VERIFY -CAfile ${CATOP}/$CACERT $file $EXTRA{verify}");
         $RET = $status if $status != 0;
     }
 } elsif ($WHAT eq '-crl' ) {

apps/apps.c

@@ -1,2740 +0,0 @@
-/*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#if !defined(_POSIX_C_SOURCE) && defined(OPENSSL_SYS_VMS)
-/*
- * On VMS, you need to define this to get the declaration of fileno().  The
- * value 2 is to make sure no function defined in POSIX-2 is left undefined.
- */
-# define _POSIX_C_SOURCE 2
-#endif
-
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/types.h>
-#ifndef OPENSSL_NO_POSIX_IO
-# include <sys/stat.h>
-# include <fcntl.h>
-#endif
-#include <ctype.h>
-#include <errno.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
-#include <openssl/x509v3.h>
-#include <openssl/pem.h>
-#include <openssl/pkcs12.h>
-#include <openssl/ui.h>
-#include <openssl/safestack.h>
-#ifndef OPENSSL_NO_ENGINE
-# include <openssl/engine.h>
-#endif
-#ifndef OPENSSL_NO_RSA
-# include <openssl/rsa.h>
-#endif
-#include <openssl/bn.h>
-#include <openssl/ssl.h>
-#include "s_apps.h"
-#include "apps.h"
-
-#ifdef _WIN32
-static int WIN32_rename(const char *from, const char *to);
-# define rename(from,to) WIN32_rename((from),(to))
-#endif
-
-typedef struct {
-    const char *name;
-    unsigned long flag;
-    unsigned long mask;
-} NAME_EX_TBL;
-
-static UI_METHOD *ui_method = NULL;
-static const UI_METHOD *ui_fallback_method = NULL;
-
-static int set_table_opts(unsigned long *flags, const char *arg,
-                          const NAME_EX_TBL * in_tbl);
-static int set_multi_opts(unsigned long *flags, const char *arg,
-                          const NAME_EX_TBL * in_tbl);
-
-int app_init(long mesgwin);
-
-int chopup_args(ARGS *arg, char *buf)
-{
-    int quoted;
-    char c = '\0', *p = NULL;
-
-    arg->argc = 0;
-    if (arg->size == 0) {
-        arg->size = 20;
-        arg->argv = app_malloc(sizeof(*arg->argv) * arg->size, "argv space");
-    }
-
-    for (p = buf;;) {
-        /* Skip whitespace. */
-        while (*p && isspace(_UC(*p)))
-            p++;
-        if (!*p)
-            break;
-
-        /* The start of something good :-) */
-        if (arg->argc >= arg->size) {
-            char **tmp;
-            arg->size += 20;
-            tmp = OPENSSL_realloc(arg->argv, sizeof(*arg->argv) * arg->size);
-            if (tmp == NULL)
-                return 0;
-            arg->argv = tmp;
-        }
-        quoted = *p == '\'' || *p == '"';
-        if (quoted)
-            c = *p++;
-        arg->argv[arg->argc++] = p;
-
-        /* now look for the end of this */
-        if (quoted) {
-            while (*p && *p != c)
-                p++;
-            *p++ = '\0';
-        } else {
-            while (*p && !isspace(_UC(*p)))
-                p++;
-            if (*p)
-                *p++ = '\0';
-        }
-    }
-    arg->argv[arg->argc] = NULL;
-    return 1;
-}
-
-#ifndef APP_INIT
-int app_init(long mesgwin)
-{
-    return 1;
-}
-#endif
-
-int ctx_set_verify_locations(SSL_CTX *ctx, const char *CAfile,
-                             const char *CApath, int noCAfile, int noCApath)
-{
-    if (CAfile == NULL && CApath == NULL) {
-        if (!noCAfile && SSL_CTX_set_default_verify_file(ctx) <= 0)
-            return 0;
-        if (!noCApath && SSL_CTX_set_default_verify_dir(ctx) <= 0)
-            return 0;
-
-        return 1;
-    }
-    return SSL_CTX_load_verify_locations(ctx, CAfile, CApath);
-}
-
-#ifndef OPENSSL_NO_CT
-
-int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path)
-{
-    if (path == NULL)
-        return SSL_CTX_set_default_ctlog_list_file(ctx);
-
-    return SSL_CTX_set_ctlog_list_file(ctx, path);
-}
-
-#endif
-
-static unsigned long nmflag = 0;
-static char nmflag_set = 0;
-
-int set_nameopt(const char *arg)
-{
-    int ret = set_name_ex(&nmflag, arg);
-
-    if (ret)
-        nmflag_set = 1;
-
-    return ret;
-}
-
-unsigned long get_nameopt(void)
-{
-    return (nmflag_set) ? nmflag : XN_FLAG_ONELINE;
-}
-
-int dump_cert_text(BIO *out, X509 *x)
-{
-    print_name(out, "subject=", X509_get_subject_name(x), get_nameopt());
-    BIO_puts(out, "\n");
-    print_name(out, "issuer=", X509_get_issuer_name(x), get_nameopt());
-    BIO_puts(out, "\n");
-
-    return 0;
-}
-
-static int ui_open(UI *ui)
-{
-    int (*opener)(UI *ui) = UI_method_get_opener(ui_fallback_method);
-
-    if (opener)
-        return opener(ui);
-    return 1;
-}
-
-static int ui_read(UI *ui, UI_STRING *uis)
-{
-    int (*reader)(UI *ui, UI_STRING *uis) = NULL;
-
-    if (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD
-        && UI_get0_user_data(ui)) {
-        switch (UI_get_string_type(uis)) {
-        case UIT_PROMPT:
-        case UIT_VERIFY:
-            {
-                const char *password =
-                    ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
-                if (password && password[0] != '\0') {
-                    UI_set_result(ui, uis, password);
-                    return 1;
-                }
-            }
-            break;
-        case UIT_NONE:
-        case UIT_BOOLEAN:
-        case UIT_INFO:
-        case UIT_ERROR:
-            break;
-        }
-    }
-
-    reader = UI_method_get_reader(ui_fallback_method);
-    if (reader)
-        return reader(ui, uis);
-    return 1;
-}
-
-static int ui_write(UI *ui, UI_STRING *uis)
-{
-    int (*writer)(UI *ui, UI_STRING *uis) = NULL;
-
-    if (UI_get_input_flags(uis) & UI_INPUT_FLAG_DEFAULT_PWD
-        && UI_get0_user_data(ui)) {
-        switch (UI_get_string_type(uis)) {
-        case UIT_PROMPT:
-        case UIT_VERIFY:
-            {
-                const char *password =
-                    ((PW_CB_DATA *)UI_get0_user_data(ui))->password;
-                if (password && password[0] != '\0')
-                    return 1;
-            }
-            break;
-        case UIT_NONE:
-        case UIT_BOOLEAN:
-        case UIT_INFO:
-        case UIT_ERROR:
-            break;
-        }
-    }
-
-    writer = UI_method_get_writer(ui_fallback_method);
-    if (writer)
-        return writer(ui, uis);
-    return 1;
-}
-
-static int ui_close(UI *ui)
-{
-    int (*closer)(UI *ui) = UI_method_get_closer(ui_fallback_method);
-
-    if (closer)
-        return closer(ui);
-    return 1;
-}
-
-int setup_ui_method(void)
-{
-    ui_fallback_method = UI_null();
-#ifndef OPENSSL_NO_UI_CONSOLE
-    ui_fallback_method = UI_OpenSSL();
-#endif
-    ui_method = UI_create_method("OpenSSL application user interface");
-    UI_method_set_opener(ui_method, ui_open);
-    UI_method_set_reader(ui_method, ui_read);
-    UI_method_set_writer(ui_method, ui_write);
-    UI_method_set_closer(ui_method, ui_close);
-    return 0;
-}
-
-void destroy_ui_method(void)
-{
-    if (ui_method) {
-        UI_destroy_method(ui_method);
-        ui_method = NULL;
-    }
-}
-
-const UI_METHOD *get_ui_method(void)
-{
-    return ui_method;
-}
-
-int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_tmp)
-{
-    int res = 0;
-    UI *ui = NULL;
-    PW_CB_DATA *cb_data = (PW_CB_DATA *)cb_tmp;
-
-    ui = UI_new_method(ui_method);
-    if (ui) {
-        int ok = 0;
-        char *buff = NULL;
-        int ui_flags = 0;
-        const char *prompt_info = NULL;
-        char *prompt;
-
-        if (cb_data != NULL && cb_data->prompt_info != NULL)
-            prompt_info = cb_data->prompt_info;
-        prompt = UI_construct_prompt(ui, "pass phrase", prompt_info);
-        if (!prompt) {
-            BIO_printf(bio_err, "Out of memory\n");
-            UI_free(ui);
-            return 0;
-        }
-
-        ui_flags |= UI_INPUT_FLAG_DEFAULT_PWD;
-        UI_ctrl(ui, UI_CTRL_PRINT_ERRORS, 1, 0, 0);
-
-        /* We know that there is no previous user data to return to us */
-        (void)UI_add_user_data(ui, cb_data);
-
-        ok = UI_add_input_string(ui, prompt, ui_flags, buf,
-                                 PW_MIN_LENGTH, bufsiz - 1);
-
-        if (ok >= 0 && verify) {
-            buff = app_malloc(bufsiz, "password buffer");
-            ok = UI_add_verify_string(ui, prompt, ui_flags, buff,
-                                      PW_MIN_LENGTH, bufsiz - 1, buf);
-        }
-        if (ok >= 0)
-            do {
-                ok = UI_process(ui);
-            } while (ok < 0 && UI_ctrl(ui, UI_CTRL_IS_REDOABLE, 0, 0, 0));
-
-        OPENSSL_clear_free(buff, (unsigned int)bufsiz);
-
-        if (ok >= 0)
-            res = strlen(buf);
-        if (ok == -1) {
-            BIO_printf(bio_err, "User interface error\n");
-            ERR_print_errors(bio_err);
-            OPENSSL_cleanse(buf, (unsigned int)bufsiz);
-            res = 0;
-        }
-        if (ok == -2) {
-            BIO_printf(bio_err, "aborted!\n");
-            OPENSSL_cleanse(buf, (unsigned int)bufsiz);
-            res = 0;
-        }
-        UI_free(ui);
-        OPENSSL_free(prompt);
-    }
-    return res;
-}
-
-static char *app_get_pass(const char *arg, int keepbio);
-
-int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2)
-{
-    int same;
-    if (arg2 == NULL || arg1 == NULL || strcmp(arg1, arg2))
-        same = 0;
-    else
-        same = 1;
-    if (arg1 != NULL) {
-        *pass1 = app_get_pass(arg1, same);
-        if (*pass1 == NULL)
-            return 0;
-    } else if (pass1 != NULL) {
-        *pass1 = NULL;
-    }
-    if (arg2 != NULL) {
-        *pass2 = app_get_pass(arg2, same ? 2 : 0);
-        if (*pass2 == NULL)
-            return 0;
-    } else if (pass2 != NULL) {
-        *pass2 = NULL;
-    }
-    return 1;
-}
-
-static char *app_get_pass(const char *arg, int keepbio)
-{
-    char *tmp, tpass[APP_PASS_LEN];
-    static BIO *pwdbio = NULL;
-    int i;
-
-    if (strncmp(arg, "pass:", 5) == 0)
-        return OPENSSL_strdup(arg + 5);
-    if (strncmp(arg, "env:", 4) == 0) {
-        tmp = getenv(arg + 4);
-        if (tmp == NULL) {
-            BIO_printf(bio_err, "Can't read environment variable %s\n", arg + 4);
-            return NULL;
-        }
-        return OPENSSL_strdup(tmp);
-    }
-    if (!keepbio || pwdbio == NULL) {
-        if (strncmp(arg, "file:", 5) == 0) {
-            pwdbio = BIO_new_file(arg + 5, "r");
-            if (pwdbio == NULL) {
-                BIO_printf(bio_err, "Can't open file %s\n", arg + 5);
-                return NULL;
-            }
-#if !defined(_WIN32)
-            /*
-             * Under _WIN32, which covers even Win64 and CE, file
-             * descriptors referenced by BIO_s_fd are not inherited
-             * by child process and therefore below is not an option.
-             * It could have been an option if bss_fd.c was operating
-             * on real Windows descriptors, such as those obtained
-             * with CreateFile.
-             */
-        } else if (strncmp(arg, "fd:", 3) == 0) {
-            BIO *btmp;
-            i = atoi(arg + 3);
-            if (i >= 0)
-                pwdbio = BIO_new_fd(i, BIO_NOCLOSE);
-            if ((i < 0) || !pwdbio) {
-                BIO_printf(bio_err, "Can't access file descriptor %s\n", arg + 3);
-                return NULL;
-            }
-            /*
-             * Can't do BIO_gets on an fd BIO so add a buffering BIO
-             */
-            btmp = BIO_new(BIO_f_buffer());
-            pwdbio = BIO_push(btmp, pwdbio);
-#endif
-        } else if (strcmp(arg, "stdin") == 0) {
-            pwdbio = dup_bio_in(FORMAT_TEXT);
-            if (!pwdbio) {
-                BIO_printf(bio_err, "Can't open BIO for stdin\n");
-                return NULL;
-            }
-        } else {
-            BIO_printf(bio_err, "Invalid password argument \"%s\"\n", arg);
-            return NULL;
-        }
-    }
-    i = BIO_gets(pwdbio, tpass, APP_PASS_LEN);
-    if (keepbio != 1) {
-        BIO_free_all(pwdbio);
-        pwdbio = NULL;
-    }
-    if (i <= 0) {
-        BIO_printf(bio_err, "Error reading password from BIO\n");
-        return NULL;
-    }
-    tmp = strchr(tpass, '\n');
-    if (tmp != NULL)
-        *tmp = 0;
-    return OPENSSL_strdup(tpass);
-}
-
-CONF *app_load_config_bio(BIO *in, const char *filename)
-{
-    long errorline = -1;
-    CONF *conf;
-    int i;
-
-    conf = NCONF_new(NULL);
-    i = NCONF_load_bio(conf, in, &errorline);
-    if (i > 0)
-        return conf;
-
-    if (errorline <= 0) {
-        BIO_printf(bio_err, "%s: Can't load ", opt_getprog());
-    } else {
-        BIO_printf(bio_err, "%s: Error on line %ld of ", opt_getprog(),
-                   errorline);
-    }
-    if (filename != NULL)
-        BIO_printf(bio_err, "config file \"%s\"\n", filename);
-    else
-        BIO_printf(bio_err, "config input");
-
-    NCONF_free(conf);
-    return NULL;
-}
-
-CONF *app_load_config(const char *filename)
-{
-    BIO *in;
-    CONF *conf;
-
-    in = bio_open_default(filename, 'r', FORMAT_TEXT);
-    if (in == NULL)
-        return NULL;
-
-    conf = app_load_config_bio(in, filename);
-    BIO_free(in);
-    return conf;
-}
-
-CONF *app_load_config_quiet(const char *filename)
-{
-    BIO *in;
-    CONF *conf;
-
-    in = bio_open_default_quiet(filename, 'r', FORMAT_TEXT);
-    if (in == NULL)
-        return NULL;
-
-    conf = app_load_config_bio(in, filename);
-    BIO_free(in);
-    return conf;
-}
-
-int app_load_modules(const CONF *config)
-{
-    CONF *to_free = NULL;
-
-    if (config == NULL)
-        config = to_free = app_load_config_quiet(default_config_file);
-    if (config == NULL)
-        return 1;
-
-    if (CONF_modules_load(config, NULL, 0) <= 0) {
-        BIO_printf(bio_err, "Error configuring OpenSSL modules\n");
-        ERR_print_errors(bio_err);
-        NCONF_free(to_free);
-        return 0;
-    }
-    NCONF_free(to_free);
-    return 1;
-}
-
-int add_oid_section(CONF *conf)
-{
-    char *p;
-    STACK_OF(CONF_VALUE) *sktmp;
-    CONF_VALUE *cnf;
-    int i;
-
-    if ((p = NCONF_get_string(conf, NULL, "oid_section")) == NULL) {
-        ERR_clear_error();
-        return 1;
-    }
-    if ((sktmp = NCONF_get_section(conf, p)) == NULL) {
-        BIO_printf(bio_err, "problem loading oid section %s\n", p);
-        return 0;
-    }
-    for (i = 0; i < sk_CONF_VALUE_num(sktmp); i++) {
-        cnf = sk_CONF_VALUE_value(sktmp, i);
-        if (OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) {
-            BIO_printf(bio_err, "problem creating object %s=%s\n",
-                       cnf->name, cnf->value);
-            return 0;
-        }
-    }
-    return 1;
-}
-
-static int load_pkcs12(BIO *in, const char *desc,
-                       pem_password_cb *pem_cb, void *cb_data,
-                       EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
-{
-    const char *pass;
-    char tpass[PEM_BUFSIZE];
-    int len, ret = 0;
-    PKCS12 *p12;
-    p12 = d2i_PKCS12_bio(in, NULL);
-    if (p12 == NULL) {
-        BIO_printf(bio_err, "Error loading PKCS12 file for %s\n", desc);
-        goto die;
-    }
-    /* See if an empty password will do */
-    if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0)) {
-        pass = "";
-    } else {
-        if (!pem_cb)
-            pem_cb = (pem_password_cb *)password_callback;
-        len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data);
-        if (len < 0) {
-            BIO_printf(bio_err, "Passphrase callback error for %s\n", desc);
-            goto die;
-        }
-        if (len < PEM_BUFSIZE)
-            tpass[len] = 0;
-        if (!PKCS12_verify_mac(p12, tpass, len)) {
-            BIO_printf(bio_err,
-                       "Mac verify error (wrong password?) in PKCS12 file for %s\n",
-                       desc);
-            goto die;
-        }
-        pass = tpass;
-    }
-    ret = PKCS12_parse(p12, pass, pkey, cert, ca);
- die:
-    PKCS12_free(p12);
-    return ret;
-}
-
-#if !defined(OPENSSL_NO_OCSP) && !defined(OPENSSL_NO_SOCK)
-static int load_cert_crl_http(const char *url, X509 **pcert, X509_CRL **pcrl)
-{
-    char *host = NULL, *port = NULL, *path = NULL;
-    BIO *bio = NULL;
-    OCSP_REQ_CTX *rctx = NULL;
-    int use_ssl, rv = 0;
-    if (!OCSP_parse_url(url, &host, &port, &path, &use_ssl))
-        goto err;
-    if (use_ssl) {
-        BIO_puts(bio_err, "https not supported\n");
-        goto err;
-    }
-    bio = BIO_new_connect(host);
-    if (!bio || !BIO_set_conn_port(bio, port))
-        goto err;
-    rctx = OCSP_REQ_CTX_new(bio, 1024);
-    if (rctx == NULL)
-        goto err;
-    if (!OCSP_REQ_CTX_http(rctx, "GET", path))
-        goto err;
-    if (!OCSP_REQ_CTX_add1_header(rctx, "Host", host))
-        goto err;
-    if (pcert) {
-        do {
-            rv = X509_http_nbio(rctx, pcert);
-        } while (rv == -1);
-    } else {
-        do {
-            rv = X509_CRL_http_nbio(rctx, pcrl);
-        } while (rv == -1);
-    }
-
- err:
-    OPENSSL_free(host);
-    OPENSSL_free(path);
-    OPENSSL_free(port);
-    BIO_free_all(bio);
-    OCSP_REQ_CTX_free(rctx);
-    if (rv != 1) {
-        BIO_printf(bio_err, "Error loading %s from %s\n",
-                   pcert ? "certificate" : "CRL", url);
-        ERR_print_errors(bio_err);
-    }
-    return rv;
-}
-#endif
-
-X509 *load_cert(const char *file, int format, const char *cert_descrip)
-{
-    X509 *x = NULL;
-    BIO *cert;
-
-    if (format == FORMAT_HTTP) {
-#if !defined(OPENSSL_NO_OCSP) && !defined(OPENSSL_NO_SOCK)
-        load_cert_crl_http(file, &x, NULL);
-#endif
-        return x;
-    }
-
-    if (file == NULL) {
-        unbuffer(stdin);
-        cert = dup_bio_in(format);
-    } else {
-        cert = bio_open_default(file, 'r', format);
-    }
-    if (cert == NULL)
-        goto end;
-
-    if (format == FORMAT_ASN1) {
-        x = d2i_X509_bio(cert, NULL);
-    } else if (format == FORMAT_PEM) {
-        x = PEM_read_bio_X509_AUX(cert, NULL,
-                                  (pem_password_cb *)password_callback, NULL);
-    } else if (format == FORMAT_PKCS12) {
-        if (!load_pkcs12(cert, cert_descrip, NULL, NULL, NULL, &x, NULL))
-            goto end;
-    } else {
-        BIO_printf(bio_err, "bad input format specified for %s\n", cert_descrip);
-        goto end;
-    }
- end:
-    if (x == NULL) {
-        BIO_printf(bio_err, "unable to load certificate\n");
-        ERR_print_errors(bio_err);
-    }
-    BIO_free(cert);
-    return x;
-}
-
-X509_CRL *load_crl(const char *infile, int format)
-{
-    X509_CRL *x = NULL;
-    BIO *in = NULL;
-
-    if (format == FORMAT_HTTP) {
-#if !defined(OPENSSL_NO_OCSP) && !defined(OPENSSL_NO_SOCK)
-        load_cert_crl_http(infile, NULL, &x);
-#endif
-        return x;
-    }
-
-    in = bio_open_default(infile, 'r', format);
-    if (in == NULL)
-        goto end;
-    if (format == FORMAT_ASN1) {
-        x = d2i_X509_CRL_bio(in, NULL);
-    } else if (format == FORMAT_PEM) {
-        x = PEM_read_bio_X509_CRL(in, NULL, NULL, NULL);
-    } else {
-        BIO_printf(bio_err, "bad input format specified for input crl\n");
-        goto end;
-    }
-    if (x == NULL) {
-        BIO_printf(bio_err, "unable to load CRL\n");
-        ERR_print_errors(bio_err);
-        goto end;
-    }
-
- end:
-    BIO_free(in);
-    return x;
-}
-
-EVP_PKEY *load_key(const char *file, int format, int maybe_stdin,
-                   const char *pass, ENGINE *e, const char *key_descrip)
-{
-    BIO *key = NULL;
-    EVP_PKEY *pkey = NULL;
-    PW_CB_DATA cb_data;
-
-    cb_data.password = pass;
-    cb_data.prompt_info = file;
-
-    if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE)) {
-        BIO_printf(bio_err, "no keyfile specified\n");
-        goto end;
-    }
-    if (format == FORMAT_ENGINE) {
-        if (e == NULL) {
-            BIO_printf(bio_err, "no engine specified\n");
-        } else {
-#ifndef OPENSSL_NO_ENGINE
-            if (ENGINE_init(e)) {
-                pkey = ENGINE_load_private_key(e, file, ui_method, &cb_data);
-                ENGINE_finish(e);
-            }
-            if (pkey == NULL) {
-                BIO_printf(bio_err, "cannot load %s from engine\n", key_descrip);
-                ERR_print_errors(bio_err);
-            }
-#else
-            BIO_printf(bio_err, "engines not supported\n");
-#endif
-        }
-        goto end;
-    }
-    if (file == NULL && maybe_stdin) {
-        unbuffer(stdin);
-        key = dup_bio_in(format);
-    } else {
-        key = bio_open_default(file, 'r', format);
-    }
-    if (key == NULL)
-        goto end;
-    if (format == FORMAT_ASN1) {
-        pkey = d2i_PrivateKey_bio(key, NULL);
-    } else if (format == FORMAT_PEM) {
-        pkey = PEM_read_bio_PrivateKey(key, NULL,
-                                       (pem_password_cb *)password_callback,
-                                       &cb_data);
-    } else if (format == FORMAT_PKCS12) {
-        if (!load_pkcs12(key, key_descrip,
-                         (pem_password_cb *)password_callback, &cb_data,
-                         &pkey, NULL, NULL))
-            goto end;
-#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA) && !defined (OPENSSL_NO_RC4)
-    } else if (format == FORMAT_MSBLOB) {
-        pkey = b2i_PrivateKey_bio(key);
-    } else if (format == FORMAT_PVK) {
-        pkey = b2i_PVK_bio(key, (pem_password_cb *)password_callback,
-                           &cb_data);
-#endif
-    } else {
-        BIO_printf(bio_err, "bad input format specified for key file\n");
-        goto end;
-    }
- end:
-    BIO_free(key);
-    if (pkey == NULL) {
-        BIO_printf(bio_err, "unable to load %s\n", key_descrip);
-        ERR_print_errors(bio_err);
-    }
-    return pkey;
-}
-
-EVP_PKEY *load_pubkey(const char *file, int format, int maybe_stdin,
-                      const char *pass, ENGINE *e, const char *key_descrip)
-{
-    BIO *key = NULL;
-    EVP_PKEY *pkey = NULL;
-    PW_CB_DATA cb_data;
-
-    cb_data.password = pass;
-    cb_data.prompt_info = file;
-
-    if (file == NULL && (!maybe_stdin || format == FORMAT_ENGINE)) {
-        BIO_printf(bio_err, "no keyfile specified\n");
-        goto end;
-    }
-    if (format == FORMAT_ENGINE) {
-        if (e == NULL) {
-            BIO_printf(bio_err, "no engine specified\n");
-        } else {
-#ifndef OPENSSL_NO_ENGINE
-            pkey = ENGINE_load_public_key(e, file, ui_method, &cb_data);
-            if (pkey == NULL) {
-                BIO_printf(bio_err, "cannot load %s from engine\n", key_descrip);
-                ERR_print_errors(bio_err);
-            }
-#else
-            BIO_printf(bio_err, "engines not supported\n");
-#endif
-        }
-        goto end;
-    }
-    if (file == NULL && maybe_stdin) {
-        unbuffer(stdin);
-        key = dup_bio_in(format);
-    } else {
-        key = bio_open_default(file, 'r', format);
-    }
-    if (key == NULL)
-        goto end;
-    if (format == FORMAT_ASN1) {
-        pkey = d2i_PUBKEY_bio(key, NULL);
-    } else if (format == FORMAT_ASN1RSA) {
-#ifndef OPENSSL_NO_RSA
-        RSA *rsa;
-        rsa = d2i_RSAPublicKey_bio(key, NULL);
-        if (rsa) {
-            pkey = EVP_PKEY_new();
-            if (pkey != NULL)
-                EVP_PKEY_set1_RSA(pkey, rsa);
-            RSA_free(rsa);
-        } else
-#else
-        BIO_printf(bio_err, "RSA keys not supported\n");
-#endif
-            pkey = NULL;
-    } else if (format == FORMAT_PEMRSA) {
-#ifndef OPENSSL_NO_RSA
-        RSA *rsa;
-        rsa = PEM_read_bio_RSAPublicKey(key, NULL,
-                                        (pem_password_cb *)password_callback,
-                                        &cb_data);
-        if (rsa != NULL) {
-            pkey = EVP_PKEY_new();
-            if (pkey != NULL)
-                EVP_PKEY_set1_RSA(pkey, rsa);
-            RSA_free(rsa);
-        } else
-#else
-        BIO_printf(bio_err, "RSA keys not supported\n");
-#endif
-            pkey = NULL;
-    } else if (format == FORMAT_PEM) {
-        pkey = PEM_read_bio_PUBKEY(key, NULL,
-                                   (pem_password_cb *)password_callback,
-                                   &cb_data);
-#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DSA)
-    } else if (format == FORMAT_MSBLOB) {
-        pkey = b2i_PublicKey_bio(key);
-#endif
-    }
- end:
-    BIO_free(key);
-    if (pkey == NULL)
-        BIO_printf(bio_err, "unable to load %s\n", key_descrip);
-    return pkey;
-}
-
-static int load_certs_crls(const char *file, int format,
-                           const char *pass, const char *desc,
-                           STACK_OF(X509) **pcerts,
-                           STACK_OF(X509_CRL) **pcrls)
-{
-    int i;
-    BIO *bio;
-    STACK_OF(X509_INFO) *xis = NULL;
-    X509_INFO *xi;
-    PW_CB_DATA cb_data;
-    int rv = 0;
-
-    cb_data.password = pass;
-    cb_data.prompt_info = file;
-
-    if (format != FORMAT_PEM) {
-        BIO_printf(bio_err, "bad input format specified for %s\n", desc);
-        return 0;
-    }
-
-    bio = bio_open_default(file, 'r', FORMAT_PEM);
-    if (bio == NULL)
-        return 0;
-
-    xis = PEM_X509_INFO_read_bio(bio, NULL,
-                                 (pem_password_cb *)password_callback,
-                                 &cb_data);
-
-    BIO_free(bio);
-
-    if (pcerts != NULL && *pcerts == NULL) {
-        *pcerts = sk_X509_new_null();
-        if (*pcerts == NULL)
-            goto end;
-    }
-
-    if (pcrls != NULL && *pcrls == NULL) {
-        *pcrls = sk_X509_CRL_new_null();
-        if (*pcrls == NULL)
-            goto end;
-    }
-
-    for (i = 0; i < sk_X509_INFO_num(xis); i++) {
-        xi = sk_X509_INFO_value(xis, i);
-        if (xi->x509 != NULL && pcerts != NULL) {
-            if (!sk_X509_push(*pcerts, xi->x509))
-                goto end;
-            xi->x509 = NULL;
-        }
-        if (xi->crl != NULL && pcrls != NULL) {
-            if (!sk_X509_CRL_push(*pcrls, xi->crl))
-                goto end;
-            xi->crl = NULL;
-        }
-    }
-
-    if (pcerts != NULL && sk_X509_num(*pcerts) > 0)
-        rv = 1;
-
-    if (pcrls != NULL && sk_X509_CRL_num(*pcrls) > 0)
-        rv = 1;
-
- end:
-
-    sk_X509_INFO_pop_free(xis, X509_INFO_free);
-
-    if (rv == 0) {
-        if (pcerts != NULL) {
-            sk_X509_pop_free(*pcerts, X509_free);
-            *pcerts = NULL;
-        }
-        if (pcrls != NULL) {
-            sk_X509_CRL_pop_free(*pcrls, X509_CRL_free);
-            *pcrls = NULL;
-        }
-        BIO_printf(bio_err, "unable to load %s\n",
-                   pcerts ? "certificates" : "CRLs");
-        ERR_print_errors(bio_err);
-    }
-    return rv;
-}
-
-void* app_malloc(int sz, const char *what)
-{
-    void *vp = OPENSSL_malloc(sz);
-
-    if (vp == NULL) {
-        BIO_printf(bio_err, "%s: Could not allocate %d bytes for %s\n",
-                opt_getprog(), sz, what);
-        ERR_print_errors(bio_err);
-        exit(1);
-    }
-    return vp;
-}
-
-/*
- * Initialize or extend, if *certs != NULL, a certificate stack.
- */
-int load_certs(const char *file, STACK_OF(X509) **certs, int format,
-               const char *pass, const char *desc)
-{
-    return load_certs_crls(file, format, pass, desc, certs, NULL);
-}
-
-/*
- * Initialize or extend, if *crls != NULL, a certificate stack.
- */
-int load_crls(const char *file, STACK_OF(X509_CRL) **crls, int format,
-              const char *pass, const char *desc)
-{
-    return load_certs_crls(file, format, pass, desc, NULL, crls);
-}
-
-#define X509V3_EXT_UNKNOWN_MASK         (0xfL << 16)
-/* Return error for unknown extensions */
-#define X509V3_EXT_DEFAULT              0
-/* Print error for unknown extensions */
-#define X509V3_EXT_ERROR_UNKNOWN        (1L << 16)
-/* ASN1 parse unknown extensions */
-#define X509V3_EXT_PARSE_UNKNOWN        (2L << 16)
-/* BIO_dump unknown extensions */
-#define X509V3_EXT_DUMP_UNKNOWN         (3L << 16)
-
-#define X509_FLAG_CA (X509_FLAG_NO_ISSUER | X509_FLAG_NO_PUBKEY | \
-                         X509_FLAG_NO_HEADER | X509_FLAG_NO_VERSION)
-
-int set_cert_ex(unsigned long *flags, const char *arg)
-{
-    static const NAME_EX_TBL cert_tbl[] = {
-        {"compatible", X509_FLAG_COMPAT, 0xffffffffl},
-        {"ca_default", X509_FLAG_CA, 0xffffffffl},
-        {"no_header", X509_FLAG_NO_HEADER, 0},
-        {"no_version", X509_FLAG_NO_VERSION, 0},
-        {"no_serial", X509_FLAG_NO_SERIAL, 0},
-        {"no_signame", X509_FLAG_NO_SIGNAME, 0},
-        {"no_validity", X509_FLAG_NO_VALIDITY, 0},
-        {"no_subject", X509_FLAG_NO_SUBJECT, 0},
-        {"no_issuer", X509_FLAG_NO_ISSUER, 0},
-        {"no_pubkey", X509_FLAG_NO_PUBKEY, 0},
-        {"no_extensions", X509_FLAG_NO_EXTENSIONS, 0},
-        {"no_sigdump", X509_FLAG_NO_SIGDUMP, 0},
-        {"no_aux", X509_FLAG_NO_AUX, 0},
-        {"no_attributes", X509_FLAG_NO_ATTRIBUTES, 0},
-        {"ext_default", X509V3_EXT_DEFAULT, X509V3_EXT_UNKNOWN_MASK},
-        {"ext_error", X509V3_EXT_ERROR_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
-        {"ext_parse", X509V3_EXT_PARSE_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
-        {"ext_dump", X509V3_EXT_DUMP_UNKNOWN, X509V3_EXT_UNKNOWN_MASK},
-        {NULL, 0, 0}
-    };
-    return set_multi_opts(flags, arg, cert_tbl);
-}
-
-int set_name_ex(unsigned long *flags, const char *arg)
-{
-    static const NAME_EX_TBL ex_tbl[] = {
-        {"esc_2253", ASN1_STRFLGS_ESC_2253, 0},
-        {"esc_2254", ASN1_STRFLGS_ESC_2254, 0},
-        {"esc_ctrl", ASN1_STRFLGS_ESC_CTRL, 0},
-        {"esc_msb", ASN1_STRFLGS_ESC_MSB, 0},
-        {"use_quote", ASN1_STRFLGS_ESC_QUOTE, 0},
-        {"utf8", ASN1_STRFLGS_UTF8_CONVERT, 0},
-        {"ignore_type", ASN1_STRFLGS_IGNORE_TYPE, 0},
-        {"show_type", ASN1_STRFLGS_SHOW_TYPE, 0},
-        {"dump_all", ASN1_STRFLGS_DUMP_ALL, 0},
-        {"dump_nostr", ASN1_STRFLGS_DUMP_UNKNOWN, 0},
-        {"dump_der", ASN1_STRFLGS_DUMP_DER, 0},
-        {"compat", XN_FLAG_COMPAT, 0xffffffffL},
-        {"sep_comma_plus", XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_MASK},
-        {"sep_comma_plus_space", XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_MASK},
-        {"sep_semi_plus_space", XN_FLAG_SEP_SPLUS_SPC, XN_FLAG_SEP_MASK},
-        {"sep_multiline", XN_FLAG_SEP_MULTILINE, XN_FLAG_SEP_MASK},
-        {"dn_rev", XN_FLAG_DN_REV, 0},
-        {"nofname", XN_FLAG_FN_NONE, XN_FLAG_FN_MASK},
-        {"sname", XN_FLAG_FN_SN, XN_FLAG_FN_MASK},
-        {"lname", XN_FLAG_FN_LN, XN_FLAG_FN_MASK},
-        {"align", XN_FLAG_FN_ALIGN, 0},
-        {"oid", XN_FLAG_FN_OID, XN_FLAG_FN_MASK},
-        {"space_eq", XN_FLAG_SPC_EQ, 0},
-        {"dump_unknown", XN_FLAG_DUMP_UNKNOWN_FIELDS, 0},
-        {"RFC2253", XN_FLAG_RFC2253, 0xffffffffL},
-        {"oneline", XN_FLAG_ONELINE, 0xffffffffL},
-        {"multiline", XN_FLAG_MULTILINE, 0xffffffffL},
-        {"ca_default", XN_FLAG_MULTILINE, 0xffffffffL},
-        {NULL, 0, 0}
-    };
-    if (set_multi_opts(flags, arg, ex_tbl) == 0)
-        return 0;
-    if (*flags != XN_FLAG_COMPAT
-        && (*flags & XN_FLAG_SEP_MASK) == 0)
-        *flags |= XN_FLAG_SEP_CPLUS_SPC;
-    return 1;
-}
-
-int set_ext_copy(int *copy_type, const char *arg)
-{
-    if (strcasecmp(arg, "none") == 0)
-        *copy_type = EXT_COPY_NONE;
-    else if (strcasecmp(arg, "copy") == 0)
-        *copy_type = EXT_COPY_ADD;
-    else if (strcasecmp(arg, "copyall") == 0)
-        *copy_type = EXT_COPY_ALL;
-    else
-        return 0;
-    return 1;
-}
-
-int copy_extensions(X509 *x, X509_REQ *req, int copy_type)
-{
-    STACK_OF(X509_EXTENSION) *exts = NULL;
-    X509_EXTENSION *ext, *tmpext;
-    ASN1_OBJECT *obj;
-    int i, idx, ret = 0;
-    if (!x || !req || (copy_type == EXT_COPY_NONE))
-        return 1;
-    exts = X509_REQ_get_extensions(req);
-
-    for (i = 0; i < sk_X509_EXTENSION_num(exts); i++) {
-        ext = sk_X509_EXTENSION_value(exts, i);
-        obj = X509_EXTENSION_get_object(ext);
-        idx = X509_get_ext_by_OBJ(x, obj, -1);
-        /* Does extension exist? */
-        if (idx != -1) {
-            /* If normal copy don't override existing extension */
-            if (copy_type == EXT_COPY_ADD)
-                continue;
-            /* Delete all extensions of same type */
-            do {
-                tmpext = X509_get_ext(x, idx);
-                X509_delete_ext(x, idx);
-                X509_EXTENSION_free(tmpext);
-                idx = X509_get_ext_by_OBJ(x, obj, -1);
-            } while (idx != -1);
-        }
-        if (!X509_add_ext(x, ext, -1))
-            goto end;
-    }
-
-    ret = 1;
-
- end:
-
-    sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
-
-    return ret;
-}
-
-static int set_multi_opts(unsigned long *flags, const char *arg,
-                          const NAME_EX_TBL * in_tbl)
-{
-    STACK_OF(CONF_VALUE) *vals;
-    CONF_VALUE *val;
-    int i, ret = 1;
-    if (!arg)
-        return 0;
-    vals = X509V3_parse_list(arg);
-    for (i = 0; i < sk_CONF_VALUE_num(vals); i++) {
-        val = sk_CONF_VALUE_value(vals, i);
-        if (!set_table_opts(flags, val->name, in_tbl))
-            ret = 0;
-    }
-    sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
-    return ret;
-}
-
-static int set_table_opts(unsigned long *flags, const char *arg,
-                          const NAME_EX_TBL * in_tbl)
-{
-    char c;
-    const NAME_EX_TBL *ptbl;
-    c = arg[0];
-
-    if (c == '-') {
-        c = 0;
-        arg++;
-    } else if (c == '+') {
-        c = 1;
-        arg++;
-    } else {
-        c = 1;
-    }
-
-    for (ptbl = in_tbl; ptbl->name; ptbl++) {
-        if (strcasecmp(arg, ptbl->name) == 0) {
-            *flags &= ~ptbl->mask;
-            if (c)
-                *flags |= ptbl->flag;
-            else
-                *flags &= ~ptbl->flag;
-            return 1;
-        }
-    }
-    return 0;
-}
-
-void print_name(BIO *out, const char *title, X509_NAME *nm,
-                unsigned long lflags)
-{
-    char *buf;
-    char mline = 0;
-    int indent = 0;
-
-    if (title)
-        BIO_puts(out, title);
-    if ((lflags & XN_FLAG_SEP_MASK) == XN_FLAG_SEP_MULTILINE) {
-        mline = 1;
-        indent = 4;
-    }
-    if (lflags == XN_FLAG_COMPAT) {
-        buf = X509_NAME_oneline(nm, 0, 0);
-        BIO_puts(out, buf);
-        BIO_puts(out, "\n");
-        OPENSSL_free(buf);
-    } else {
-        if (mline)
-            BIO_puts(out, "\n");
-        X509_NAME_print_ex(out, nm, indent, lflags);
-        BIO_puts(out, "\n");
-    }
-}
-
-void print_bignum_var(BIO *out, const BIGNUM *in, const char *var,
-                      int len, unsigned char *buffer)
-{
-    BIO_printf(out, "    static unsigned char %s_%d[] = {", var, len);
-    if (BN_is_zero(in)) {
-        BIO_printf(out, "\n        0x00");
-    } else {
-        int i, l;
-
-        l = BN_bn2bin(in, buffer);
-        for (i = 0; i < l; i++) {
-            BIO_printf(out, (i % 10) == 0 ? "\n        " : " ");
-            if (i < l - 1)
-                BIO_printf(out, "0x%02X,", buffer[i]);
-            else
-                BIO_printf(out, "0x%02X", buffer[i]);
-        }
-    }
-    BIO_printf(out, "\n    };\n");
-}
-
-void print_array(BIO *out, const char* title, int len, const unsigned char* d)
-{
-    int i;
-
-    BIO_printf(out, "unsigned char %s[%d] = {", title, len);
-    for (i = 0; i < len; i++) {
-        if ((i % 10) == 0)
-            BIO_printf(out, "\n    ");
-        if (i < len - 1)
-            BIO_printf(out, "0x%02X, ", d[i]);
-        else
-            BIO_printf(out, "0x%02X", d[i]);
-    }
-    BIO_printf(out, "\n};\n");
-}
-
-X509_STORE *setup_verify(const char *CAfile, const char *CApath, int noCAfile, int noCApath)
-{
-    X509_STORE *store = X509_STORE_new();
-    X509_LOOKUP *lookup;
-
-    if (store == NULL)
-        goto end;
-
-    if (CAfile != NULL || !noCAfile) {
-        lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
-        if (lookup == NULL)
-            goto end;
-        if (CAfile) {
-            if (!X509_LOOKUP_load_file(lookup, CAfile, X509_FILETYPE_PEM)) {
-                BIO_printf(bio_err, "Error loading file %s\n", CAfile);
-                goto end;
-            }
-        } else {
-            X509_LOOKUP_load_file(lookup, NULL, X509_FILETYPE_DEFAULT);
-        }
-    }
-
-    if (CApath != NULL || !noCApath) {
-        lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
-        if (lookup == NULL)
-            goto end;
-        if (CApath) {
-            if (!X509_LOOKUP_add_dir(lookup, CApath, X509_FILETYPE_PEM)) {
-                BIO_printf(bio_err, "Error loading directory %s\n", CApath);
-                goto end;
-            }
-        } else {
-            X509_LOOKUP_add_dir(lookup, NULL, X509_FILETYPE_DEFAULT);
-        }
-    }
-
-    ERR_clear_error();
-    return store;
- end:
-    X509_STORE_free(store);
-    return NULL;
-}
-
-#ifndef OPENSSL_NO_ENGINE
-/* Try to load an engine in a shareable library */
-static ENGINE *try_load_engine(const char *engine)
-{
-    ENGINE *e = ENGINE_by_id("dynamic");
-    if (e) {
-        if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine, 0)
-            || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) {
-            ENGINE_free(e);
-            e = NULL;
-        }
-    }
-    return e;
-}
-#endif
-
-ENGINE *setup_engine(const char *engine, int debug)
-{
-    ENGINE *e = NULL;
-
-#ifndef OPENSSL_NO_ENGINE
-    if (engine != NULL) {
-        if (strcmp(engine, "auto") == 0) {
-            BIO_printf(bio_err, "enabling auto ENGINE support\n");
-            ENGINE_register_all_complete();
-            return NULL;
-        }
-        if ((e = ENGINE_by_id(engine)) == NULL
-            && (e = try_load_engine(engine)) == NULL) {
-            BIO_printf(bio_err, "invalid engine \"%s\"\n", engine);
-            ERR_print_errors(bio_err);
-            return NULL;
-        }
-        if (debug) {
-            ENGINE_ctrl(e, ENGINE_CTRL_SET_LOGSTREAM, 0, bio_err, 0);
-        }
-        ENGINE_ctrl_cmd(e, "SET_USER_INTERFACE", 0, ui_method, 0, 1);
-        if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) {
-            BIO_printf(bio_err, "can't use that engine\n");
-            ERR_print_errors(bio_err);
-            ENGINE_free(e);
-            return NULL;
-        }
-
-        BIO_printf(bio_err, "engine \"%s\" set.\n", ENGINE_get_id(e));
-    }
-#endif
-    return e;
-}
-
-void release_engine(ENGINE *e)
-{
-#ifndef OPENSSL_NO_ENGINE
-    if (e != NULL)
-        /* Free our "structural" reference. */
-        ENGINE_free(e);
-#endif
-}
-
-static unsigned long index_serial_hash(const OPENSSL_CSTRING *a)
-{
-    const char *n;
-
-    n = a[DB_serial];
-    while (*n == '0')
-        n++;
-    return OPENSSL_LH_strhash(n);
-}
-
-static int index_serial_cmp(const OPENSSL_CSTRING *a,
-                            const OPENSSL_CSTRING *b)
-{
-    const char *aa, *bb;
-
-    for (aa = a[DB_serial]; *aa == '0'; aa++) ;
-    for (bb = b[DB_serial]; *bb == '0'; bb++) ;
-    return strcmp(aa, bb);
-}
-
-static int index_name_qual(char **a)
-{
-    return (a[0][0] == 'V');
-}
-
-static unsigned long index_name_hash(const OPENSSL_CSTRING *a)
-{
-    return OPENSSL_LH_strhash(a[DB_name]);
-}
-
-int index_name_cmp(const OPENSSL_CSTRING *a, const OPENSSL_CSTRING *b)
-{
-    return strcmp(a[DB_name], b[DB_name]);
-}
-
-static IMPLEMENT_LHASH_HASH_FN(index_serial, OPENSSL_CSTRING)
-static IMPLEMENT_LHASH_COMP_FN(index_serial, OPENSSL_CSTRING)
-static IMPLEMENT_LHASH_HASH_FN(index_name, OPENSSL_CSTRING)
-static IMPLEMENT_LHASH_COMP_FN(index_name, OPENSSL_CSTRING)
-#undef BSIZE
-#define BSIZE 256
-BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai)
-{
-    BIO *in = NULL;
-    BIGNUM *ret = NULL;
-    char buf[1024];
-    ASN1_INTEGER *ai = NULL;
-
-    ai = ASN1_INTEGER_new();
-    if (ai == NULL)
-        goto err;
-
-    in = BIO_new_file(serialfile, "r");
-    if (in == NULL) {
-        if (!create) {
-            perror(serialfile);
-            goto err;
-        }
-        ERR_clear_error();
-        ret = BN_new();
-        if (ret == NULL || !rand_serial(ret, ai))
-            BIO_printf(bio_err, "Out of memory\n");
-    } else {
-        if (!a2i_ASN1_INTEGER(in, ai, buf, 1024)) {
-            BIO_printf(bio_err, "unable to load number from %s\n",
-                       serialfile);
-            goto err;
-        }
-        ret = ASN1_INTEGER_to_BN(ai, NULL);
-        if (ret == NULL) {
-            BIO_printf(bio_err,
-                       "error converting number from bin to BIGNUM\n");
-            goto err;
-        }
-    }
-
-    if (ret && retai) {
-        *retai = ai;
-        ai = NULL;
-    }
- err:
-    BIO_free(in);
-    ASN1_INTEGER_free(ai);
-    return ret;
-}
-
-int save_serial(const char *serialfile, const char *suffix, const BIGNUM *serial,
-                ASN1_INTEGER **retai)
-{
-    char buf[1][BSIZE];
-    BIO *out = NULL;
-    int ret = 0;
-    ASN1_INTEGER *ai = NULL;
-    int j;
-
-    if (suffix == NULL)
-        j = strlen(serialfile);
-    else
-        j = strlen(serialfile) + strlen(suffix) + 1;
-    if (j >= BSIZE) {
-        BIO_printf(bio_err, "file name too long\n");
-        goto err;
-    }
-
-    if (suffix == NULL)
-        OPENSSL_strlcpy(buf[0], serialfile, BSIZE);
-    else {
-#ifndef OPENSSL_SYS_VMS
-        j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", serialfile, suffix);
-#else
-        j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", serialfile, suffix);
-#endif
-    }
-    out = BIO_new_file(buf[0], "w");
-    if (out == NULL) {
-        ERR_print_errors(bio_err);
-        goto err;
-    }
-
-    if ((ai = BN_to_ASN1_INTEGER(serial, NULL)) == NULL) {
-        BIO_printf(bio_err, "error converting serial to ASN.1 format\n");
-        goto err;
-    }
-    i2a_ASN1_INTEGER(out, ai);
-    BIO_puts(out, "\n");
-    ret = 1;
-    if (retai) {
-        *retai = ai;
-        ai = NULL;
-    }
- err:
-    BIO_free_all(out);
-    ASN1_INTEGER_free(ai);
-    return ret;
-}
-
-int rotate_serial(const char *serialfile, const char *new_suffix,
-                  const char *old_suffix)
-{
-    char buf[2][BSIZE];
-    int i, j;
-
-    i = strlen(serialfile) + strlen(old_suffix);
-    j = strlen(serialfile) + strlen(new_suffix);
-    if (i > j)
-        j = i;
-    if (j + 1 >= BSIZE) {
-        BIO_printf(bio_err, "file name too long\n");
-        goto err;
-    }
-#ifndef OPENSSL_SYS_VMS
-    j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", serialfile, new_suffix);
-    j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s.%s", serialfile, old_suffix);
-#else
-    j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", serialfile, new_suffix);
-    j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s-%s", serialfile, old_suffix);
-#endif
-    if (rename(serialfile, buf[1]) < 0 && errno != ENOENT
-#ifdef ENOTDIR
-        && errno != ENOTDIR
-#endif
-        ) {
-        BIO_printf(bio_err,
-                   "unable to rename %s to %s\n", serialfile, buf[1]);
-        perror("reason");
-        goto err;
-    }
-    if (rename(buf[0], serialfile) < 0) {
-        BIO_printf(bio_err,
-                   "unable to rename %s to %s\n", buf[0], serialfile);
-        perror("reason");
-        rename(buf[1], serialfile);
-        goto err;
-    }
-    return 1;
- err:
-    return 0;
-}
-
-int rand_serial(BIGNUM *b, ASN1_INTEGER *ai)
-{
-    BIGNUM *btmp;
-    int ret = 0;
-
-    btmp = b == NULL ? BN_new() : b;
-    if (btmp == NULL)
-        return 0;
-
-    if (!BN_rand(btmp, SERIAL_RAND_BITS, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY))
-        goto error;
-    if (ai && !BN_to_ASN1_INTEGER(btmp, ai))
-        goto error;
-
-    ret = 1;
-
- error:
-
-    if (btmp != b)
-        BN_free(btmp);
-
-    return ret;
-}
-
-CA_DB *load_index(const char *dbfile, DB_ATTR *db_attr)
-{
-    CA_DB *retdb = NULL;
-    TXT_DB *tmpdb = NULL;
-    BIO *in;
-    CONF *dbattr_conf = NULL;
-    char buf[BSIZE];
-#ifndef OPENSSL_NO_POSIX_IO
-    FILE *dbfp;
-    struct stat dbst;
-#endif
-
-    in = BIO_new_file(dbfile, "r");
-    if (in == NULL) {
-        ERR_print_errors(bio_err);
-        goto err;
-    }
-
-#ifndef OPENSSL_NO_POSIX_IO
-    BIO_get_fp(in, &dbfp);
-    if (fstat(fileno(dbfp), &dbst) == -1) {
-        SYSerr(SYS_F_FSTAT, errno);
-        ERR_add_error_data(3, "fstat('", dbfile, "')");
-        ERR_print_errors(bio_err);
-        goto err;
-    }
-#endif
-
-    if ((tmpdb = TXT_DB_read(in, DB_NUMBER)) == NULL)
-        goto err;
-
-#ifndef OPENSSL_SYS_VMS
-    BIO_snprintf(buf, sizeof(buf), "%s.attr", dbfile);
-#else
-    BIO_snprintf(buf, sizeof(buf), "%s-attr", dbfile);
-#endif
-    dbattr_conf = app_load_config(buf);
-
-    retdb = app_malloc(sizeof(*retdb), "new DB");
-    retdb->db = tmpdb;
-    tmpdb = NULL;
-    if (db_attr)
-        retdb->attributes = *db_attr;
-    else {
-        retdb->attributes.unique_subject = 1;
-    }
-
-    if (dbattr_conf) {
-        char *p = NCONF_get_string(dbattr_conf, NULL, "unique_subject");
-        if (p) {
-            retdb->attributes.unique_subject = parse_yesno(p, 1);
-        }
-    }
-
-    retdb->dbfname = OPENSSL_strdup(dbfile);
-#ifndef OPENSSL_NO_POSIX_IO
-    retdb->dbst = dbst;
-#endif
-
- err:
-    NCONF_free(dbattr_conf);
-    TXT_DB_free(tmpdb);
-    BIO_free_all(in);
-    return retdb;
-}
-
-/*
- * Returns > 0 on success, <= 0 on error
- */
-int index_index(CA_DB *db)
-{
-    if (!TXT_DB_create_index(db->db, DB_serial, NULL,
-                             LHASH_HASH_FN(index_serial),
-                             LHASH_COMP_FN(index_serial))) {
-        BIO_printf(bio_err,
-                   "error creating serial number index:(%ld,%ld,%ld)\n",
-                   db->db->error, db->db->arg1, db->db->arg2);
-        return 0;
-    }
-
-    if (db->attributes.unique_subject
-        && !TXT_DB_create_index(db->db, DB_name, index_name_qual,
-                                LHASH_HASH_FN(index_name),
-                                LHASH_COMP_FN(index_name))) {
-        BIO_printf(bio_err, "error creating name index:(%ld,%ld,%ld)\n",
-                   db->db->error, db->db->arg1, db->db->arg2);
-        return 0;
-    }
-    return 1;
-}
-
-int save_index(const char *dbfile, const char *suffix, CA_DB *db)
-{
-    char buf[3][BSIZE];
-    BIO *out;
-    int j;
-
-    j = strlen(dbfile) + strlen(suffix);
-    if (j + 6 >= BSIZE) {
-        BIO_printf(bio_err, "file name too long\n");
-        goto err;
-    }
-#ifndef OPENSSL_SYS_VMS
-    j = BIO_snprintf(buf[2], sizeof(buf[2]), "%s.attr", dbfile);
-    j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s.attr.%s", dbfile, suffix);
-    j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", dbfile, suffix);
-#else
-    j = BIO_snprintf(buf[2], sizeof(buf[2]), "%s-attr", dbfile);
-    j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s-attr-%s", dbfile, suffix);
-    j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", dbfile, suffix);
-#endif
-    out = BIO_new_file(buf[0], "w");
-    if (out == NULL) {
-        perror(dbfile);
-        BIO_printf(bio_err, "unable to open '%s'\n", dbfile);
-        goto err;
-    }
-    j = TXT_DB_write(out, db->db);
-    BIO_free(out);
-    if (j <= 0)
-        goto err;
-
-    out = BIO_new_file(buf[1], "w");
-    if (out == NULL) {
-        perror(buf[2]);
-        BIO_printf(bio_err, "unable to open '%s'\n", buf[2]);
-        goto err;
-    }
-    BIO_printf(out, "unique_subject = %s\n",
-               db->attributes.unique_subject ? "yes" : "no");
-    BIO_free(out);
-
-    return 1;
- err:
-    return 0;
-}
-
-int rotate_index(const char *dbfile, const char *new_suffix,
-                 const char *old_suffix)
-{
-    char buf[5][BSIZE];
-    int i, j;
-
-    i = strlen(dbfile) + strlen(old_suffix);
-    j = strlen(dbfile) + strlen(new_suffix);
-    if (i > j)
-        j = i;
-    if (j + 6 >= BSIZE) {
-        BIO_printf(bio_err, "file name too long\n");
-        goto err;
-    }
-#ifndef OPENSSL_SYS_VMS
-    j = BIO_snprintf(buf[4], sizeof(buf[4]), "%s.attr", dbfile);
-    j = BIO_snprintf(buf[3], sizeof(buf[3]), "%s.attr.%s", dbfile, old_suffix);
-    j = BIO_snprintf(buf[2], sizeof(buf[2]), "%s.attr.%s", dbfile, new_suffix);
-    j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s.%s", dbfile, old_suffix);
-    j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s.%s", dbfile, new_suffix);
-#else
-    j = BIO_snprintf(buf[4], sizeof(buf[4]), "%s-attr", dbfile);
-    j = BIO_snprintf(buf[3], sizeof(buf[3]), "%s-attr-%s", dbfile, old_suffix);
-    j = BIO_snprintf(buf[2], sizeof(buf[2]), "%s-attr-%s", dbfile, new_suffix);
-    j = BIO_snprintf(buf[1], sizeof(buf[1]), "%s-%s", dbfile, old_suffix);
-    j = BIO_snprintf(buf[0], sizeof(buf[0]), "%s-%s", dbfile, new_suffix);
-#endif
-    if (rename(dbfile, buf[1]) < 0 && errno != ENOENT
-#ifdef ENOTDIR
-        && errno != ENOTDIR
-#endif
-        ) {
-        BIO_printf(bio_err, "unable to rename %s to %s\n", dbfile, buf[1]);
-        perror("reason");
-        goto err;
-    }
-    if (rename(buf[0], dbfile) < 0) {
-        BIO_printf(bio_err, "unable to rename %s to %s\n", buf[0], dbfile);
-        perror("reason");
-        rename(buf[1], dbfile);
-        goto err;
-    }
-    if (rename(buf[4], buf[3]) < 0 && errno != ENOENT
-#ifdef ENOTDIR
-        && errno != ENOTDIR
-#endif
-        ) {
-        BIO_printf(bio_err, "unable to rename %s to %s\n", buf[4], buf[3]);
-        perror("reason");
-        rename(dbfile, buf[0]);
-        rename(buf[1], dbfile);
-        goto err;
-    }
-    if (rename(buf[2], buf[4]) < 0) {
-        BIO_printf(bio_err, "unable to rename %s to %s\n", buf[2], buf[4]);
-        perror("reason");
-        rename(buf[3], buf[4]);
-        rename(dbfile, buf[0]);
-        rename(buf[1], dbfile);
-        goto err;
-    }
-    return 1;
- err:
-    return 0;
-}
-
-void free_index(CA_DB *db)
-{
-    if (db) {
-        TXT_DB_free(db->db);
-        OPENSSL_free(db->dbfname);
-        OPENSSL_free(db);
-    }
-}
-
-int parse_yesno(const char *str, int def)
-{
-    if (str) {
-        switch (*str) {
-        case 'f':              /* false */
-        case 'F':              /* FALSE */
-        case 'n':              /* no */
-        case 'N':              /* NO */
-        case '0':              /* 0 */
-            return 0;
-        case 't':              /* true */
-        case 'T':              /* TRUE */
-        case 'y':              /* yes */
-        case 'Y':              /* YES */
-        case '1':              /* 1 */
-            return 1;
-        }
-    }
-    return def;
-}
-
-/*
- * name is expected to be in the format /type0=value0/type1=value1/type2=...
- * where characters may be escaped by \
- */
-X509_NAME *parse_name(const char *cp, long chtype, int canmulti)
-{
-    int nextismulti = 0;
-    char *work;
-    X509_NAME *n;
-
-    if (*cp++ != '/')
-        return NULL;
-
-    n = X509_NAME_new();
-    if (n == NULL)
-        return NULL;
-    work = OPENSSL_strdup(cp);
-    if (work == NULL)
-        goto err;
-
-    while (*cp) {
-        char *bp = work;
-        char *typestr = bp;
-        unsigned char *valstr;
-        int nid;
-        int ismulti = nextismulti;
-        nextismulti = 0;
-
-        /* Collect the type */
-        while (*cp && *cp != '=')
-            *bp++ = *cp++;
-        if (*cp == '\0') {
-            BIO_printf(bio_err,
-                    "%s: Hit end of string before finding the equals.\n",
-                    opt_getprog());
-            goto err;
-        }
-        *bp++ = '\0';
-        ++cp;
-
-        /* Collect the value. */
-        valstr = (unsigned char *)bp;
-        for (; *cp && *cp != '/'; *bp++ = *cp++) {
-            if (canmulti && *cp == '+') {
-                nextismulti = 1;
-                break;
-            }
-            if (*cp == '\\' && *++cp == '\0') {
-                BIO_printf(bio_err,
-                        "%s: escape character at end of string\n",
-                        opt_getprog());
-                goto err;
-            }
-        }
-        *bp++ = '\0';
-
-        /* If not at EOS (must be + or /), move forward. */
-        if (*cp)
-            ++cp;
-
-        /* Parse */
-        nid = OBJ_txt2nid(typestr);
-        if (nid == NID_undef) {
-            BIO_printf(bio_err, "%s: Skipping unknown attribute \"%s\"\n",
-                      opt_getprog(), typestr);
-            continue;
-        }
-        if (!X509_NAME_add_entry_by_NID(n, nid, chtype,
-                                        valstr, strlen((char *)valstr),
-                                        -1, ismulti ? -1 : 0))
-            goto err;
-    }
-
-    OPENSSL_free(work);
-    return n;
-
- err:
-    X509_NAME_free(n);
-    OPENSSL_free(work);
-    return NULL;
-}
-
-/*
- * Read whole contents of a BIO into an allocated memory buffer and return
- * it.
- */
-
-int bio_to_mem(unsigned char **out, int maxlen, BIO *in)
-{
-    BIO *mem;
-    int len, ret;
-    unsigned char tbuf[1024];
-
-    mem = BIO_new(BIO_s_mem());
-    if (mem == NULL)
-        return -1;
-    for (;;) {
-        if ((maxlen != -1) && maxlen < 1024)
-            len = maxlen;
-        else
-            len = 1024;
-        len = BIO_read(in, tbuf, len);
-        if (len < 0) {
-            BIO_free(mem);
-            return -1;
-        }
-        if (len == 0)
-            break;
-        if (BIO_write(mem, tbuf, len) != len) {
-            BIO_free(mem);
-            return -1;
-        }
-        maxlen -= len;
-
-        if (maxlen == 0)
-            break;
-    }
-    ret = BIO_get_mem_data(mem, (char **)out);
-    BIO_set_flags(mem, BIO_FLAGS_MEM_RDONLY);
-    BIO_free(mem);
-    return ret;
-}
-
-int pkey_ctrl_string(EVP_PKEY_CTX *ctx, const char *value)
-{
-    int rv;
-    char *stmp, *vtmp = NULL;
-    stmp = OPENSSL_strdup(value);
-    if (!stmp)
-        return -1;
-    vtmp = strchr(stmp, ':');
-    if (vtmp) {
-        *vtmp = 0;
-        vtmp++;
-    }
-    rv = EVP_PKEY_CTX_ctrl_str(ctx, stmp, vtmp);
-    OPENSSL_free(stmp);
-    return rv;
-}
-
-static void nodes_print(const char *name, STACK_OF(X509_POLICY_NODE) *nodes)
-{
-    X509_POLICY_NODE *node;
-    int i;
-
-    BIO_printf(bio_err, "%s Policies:", name);
-    if (nodes) {
-        BIO_puts(bio_err, "\n");
-        for (i = 0; i < sk_X509_POLICY_NODE_num(nodes); i++) {
-            node = sk_X509_POLICY_NODE_value(nodes, i);
-            X509_POLICY_NODE_print(bio_err, node, 2);
-        }
-    } else {
-        BIO_puts(bio_err, " <empty>\n");
-    }
-}
-
-void policies_print(X509_STORE_CTX *ctx)
-{
-    X509_POLICY_TREE *tree;
-    int explicit_policy;
-    tree = X509_STORE_CTX_get0_policy_tree(ctx);
-    explicit_policy = X509_STORE_CTX_get_explicit_policy(ctx);
-
-    BIO_printf(bio_err, "Require explicit Policy: %s\n",
-               explicit_policy ? "True" : "False");
-
-    nodes_print("Authority", X509_policy_tree_get0_policies(tree));
-    nodes_print("User", X509_policy_tree_get0_user_policies(tree));
-}
-
-/*-
- * next_protos_parse parses a comma separated list of strings into a string
- * in a format suitable for passing to SSL_CTX_set_next_protos_advertised.
- *   outlen: (output) set to the length of the resulting buffer on success.
- *   err: (maybe NULL) on failure, an error message line is written to this BIO.
- *   in: a NUL terminated string like "abc,def,ghi"
- *
- *   returns: a malloc'd buffer or NULL on failure.
- */
-unsigned char *next_protos_parse(size_t *outlen, const char *in)
-{
-    size_t len;
-    unsigned char *out;
-    size_t i, start = 0;
-
-    len = strlen(in);
-    if (len >= 65535)
-        return NULL;
-
-    out = app_malloc(strlen(in) + 1, "NPN buffer");
-    for (i = 0; i <= len; ++i) {
-        if (i == len || in[i] == ',') {
-            if (i - start > 255) {
-                OPENSSL_free(out);
-                return NULL;
-            }
-            out[start] = (unsigned char)(i - start);
-            start = i + 1;
-        } else {
-            out[i + 1] = in[i];
-        }
-    }
-
-    *outlen = len + 1;
-    return out;
-}
-
-void print_cert_checks(BIO *bio, X509 *x,
-                       const char *checkhost,
-                       const char *checkemail, const char *checkip)
-{
-    if (x == NULL)
-        return;
-    if (checkhost) {
-        BIO_printf(bio, "Hostname %s does%s match certificate\n",
-                   checkhost,
-                   X509_check_host(x, checkhost, 0, 0, NULL) == 1
-                       ? "" : " NOT");
-    }
-
-    if (checkemail) {
-        BIO_printf(bio, "Email %s does%s match certificate\n",
-                   checkemail, X509_check_email(x, checkemail, 0, 0)
-                   ? "" : " NOT");
-    }
-
-    if (checkip) {
-        BIO_printf(bio, "IP %s does%s match certificate\n",
-                   checkip, X509_check_ip_asc(x, checkip, 0) ? "" : " NOT");
-    }
-}
-
-/* Get first http URL from a DIST_POINT structure */
-
-static const char *get_dp_url(DIST_POINT *dp)
-{
-    GENERAL_NAMES *gens;
-    GENERAL_NAME *gen;
-    int i, gtype;
-    ASN1_STRING *uri;
-    if (!dp->distpoint || dp->distpoint->type != 0)
-        return NULL;
-    gens = dp->distpoint->name.fullname;
-    for (i = 0; i < sk_GENERAL_NAME_num(gens); i++) {
-        gen = sk_GENERAL_NAME_value(gens, i);
-        uri = GENERAL_NAME_get0_value(gen, &gtype);
-        if (gtype == GEN_URI && ASN1_STRING_length(uri) > 6) {
-            const char *uptr = (const char *)ASN1_STRING_get0_data(uri);
-            if (strncmp(uptr, "http://", 7) == 0)
-                return uptr;
-        }
-    }
-    return NULL;
-}
-
-/*
- * Look through a CRLDP structure and attempt to find an http URL to
- * downloads a CRL from.
- */
-
-static X509_CRL *load_crl_crldp(STACK_OF(DIST_POINT) *crldp)
-{
-    int i;
-    const char *urlptr = NULL;
-    for (i = 0; i < sk_DIST_POINT_num(crldp); i++) {
-        DIST_POINT *dp = sk_DIST_POINT_value(crldp, i);
-        urlptr = get_dp_url(dp);
-        if (urlptr)
-            return load_crl(urlptr, FORMAT_HTTP);
-    }
-    return NULL;
-}
-
-/*
- * Example of downloading CRLs from CRLDP: not usable for real world as it
- * always downloads, doesn't support non-blocking I/O and doesn't cache
- * anything.
- */
-
-static STACK_OF(X509_CRL) *crls_http_cb(X509_STORE_CTX *ctx, X509_NAME *nm)
-{
-    X509 *x;
-    STACK_OF(X509_CRL) *crls = NULL;
-    X509_CRL *crl;
-    STACK_OF(DIST_POINT) *crldp;
-
-    crls = sk_X509_CRL_new_null();
-    if (!crls)
-        return NULL;
-    x = X509_STORE_CTX_get_current_cert(ctx);
-    crldp = X509_get_ext_d2i(x, NID_crl_distribution_points, NULL, NULL);
-    crl = load_crl_crldp(crldp);
-    sk_DIST_POINT_pop_free(crldp, DIST_POINT_free);
-    if (!crl) {
-        sk_X509_CRL_free(crls);
-        return NULL;
-    }
-    sk_X509_CRL_push(crls, crl);
-    /* Try to download delta CRL */
-    crldp = X509_get_ext_d2i(x, NID_freshest_crl, NULL, NULL);
-    crl = load_crl_crldp(crldp);
-    sk_DIST_POINT_pop_free(crldp, DIST_POINT_free);
-    if (crl)
-        sk_X509_CRL_push(crls, crl);
-    return crls;
-}
-
-void store_setup_crl_download(X509_STORE *st)
-{
-    X509_STORE_set_lookup_crls_cb(st, crls_http_cb);
-}
-
-/*
- * Platform-specific sections
- */
-#if defined(_WIN32)
-# ifdef fileno
-#  undef fileno
-#  define fileno(a) (int)_fileno(a)
-# endif
-
-# include <windows.h>
-# include <tchar.h>
-
-static int WIN32_rename(const char *from, const char *to)
-{
-    TCHAR *tfrom = NULL, *tto;
-    DWORD err;
-    int ret = 0;
-
-    if (sizeof(TCHAR) == 1) {
-        tfrom = (TCHAR *)from;
-        tto = (TCHAR *)to;
-    } else {                    /* UNICODE path */
-
-        size_t i, flen = strlen(from) + 1, tlen = strlen(to) + 1;
-        tfrom = malloc(sizeof(*tfrom) * (flen + tlen));
-        if (tfrom == NULL)
-            goto err;
-        tto = tfrom + flen;
-# if !defined(_WIN32_WCE) || _WIN32_WCE>=101
-        if (!MultiByteToWideChar(CP_ACP, 0, from, flen, (WCHAR *)tfrom, flen))
-# endif
-            for (i = 0; i < flen; i++)
-                tfrom[i] = (TCHAR)from[i];
-# if !defined(_WIN32_WCE) || _WIN32_WCE>=101
-        if (!MultiByteToWideChar(CP_ACP, 0, to, tlen, (WCHAR *)tto, tlen))
-# endif
-            for (i = 0; i < tlen; i++)
-                tto[i] = (TCHAR)to[i];
-    }
-
-    if (MoveFile(tfrom, tto))
-        goto ok;
-    err = GetLastError();
-    if (err == ERROR_ALREADY_EXISTS || err == ERROR_FILE_EXISTS) {
-        if (DeleteFile(tto) && MoveFile(tfrom, tto))
-            goto ok;
-        err = GetLastError();
-    }
-    if (err == ERROR_FILE_NOT_FOUND || err == ERROR_PATH_NOT_FOUND)
-        errno = ENOENT;
-    else if (err == ERROR_ACCESS_DENIED)
-        errno = EACCES;
-    else
-        errno = EINVAL;         /* we could map more codes... */
- err:
-    ret = -1;
- ok:
-    if (tfrom != NULL && tfrom != (TCHAR *)from)
-        free(tfrom);
-    return ret;
-}
-#endif
-
-/* app_tminterval section */
-#if defined(_WIN32)
-double app_tminterval(int stop, int usertime)
-{
-    FILETIME now;
-    double ret = 0;
-    static ULARGE_INTEGER tmstart;
-    static int warning = 1;
-# ifdef _WIN32_WINNT
-    static HANDLE proc = NULL;
-
-    if (proc == NULL) {
-        if (check_winnt())
-            proc = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE,
-                               GetCurrentProcessId());
-        if (proc == NULL)
-            proc = (HANDLE) - 1;
-    }
-
-    if (usertime && proc != (HANDLE) - 1) {
-        FILETIME junk;
-        GetProcessTimes(proc, &junk, &junk, &junk, &now);
-    } else
-# endif
-    {
-        SYSTEMTIME systime;
-
-        if (usertime && warning) {
-            BIO_printf(bio_err, "To get meaningful results, run "
-                       "this program on idle system.\n");
-            warning = 0;
-        }
-        GetSystemTime(&systime);
-        SystemTimeToFileTime(&systime, &now);
-    }
-
-    if (stop == TM_START) {
-        tmstart.u.LowPart = now.dwLowDateTime;
-        tmstart.u.HighPart = now.dwHighDateTime;
-    } else {
-        ULARGE_INTEGER tmstop;
-
-        tmstop.u.LowPart = now.dwLowDateTime;
-        tmstop.u.HighPart = now.dwHighDateTime;
-
-        ret = (__int64)(tmstop.QuadPart - tmstart.QuadPart) * 1e-7;
-    }
-
-    return ret;
-}
-#elif defined(OPENSSL_SYSTEM_VXWORKS)
-# include <time.h>
-
-double app_tminterval(int stop, int usertime)
-{
-    double ret = 0;
-# ifdef CLOCK_REALTIME
-    static struct timespec tmstart;
-    struct timespec now;
-# else
-    static unsigned long tmstart;
-    unsigned long now;
-# endif
-    static int warning = 1;
-
-    if (usertime && warning) {
-        BIO_printf(bio_err, "To get meaningful results, run "
-                   "this program on idle system.\n");
-        warning = 0;
-    }
-# ifdef CLOCK_REALTIME
-    clock_gettime(CLOCK_REALTIME, &now);
-    if (stop == TM_START)
-        tmstart = now;
-    else
-        ret = ((now.tv_sec + now.tv_nsec * 1e-9)
-               - (tmstart.tv_sec + tmstart.tv_nsec * 1e-9));
-# else
-    now = tickGet();
-    if (stop == TM_START)
-        tmstart = now;
-    else
-        ret = (now - tmstart) / (double)sysClkRateGet();
-# endif
-    return ret;
-}
-
-#elif defined(OPENSSL_SYSTEM_VMS)
-# include <time.h>
-# include <times.h>
-
-double app_tminterval(int stop, int usertime)
-{
-    static clock_t tmstart;
-    double ret = 0;
-    clock_t now;
-# ifdef __TMS
-    struct tms rus;
-
-    now = times(&rus);
-    if (usertime)
-        now = rus.tms_utime;
-# else
-    if (usertime)
-        now = clock();          /* sum of user and kernel times */
-    else {
-        struct timeval tv;
-        gettimeofday(&tv, NULL);
-        now = (clock_t)((unsigned long long)tv.tv_sec * CLK_TCK +
-                        (unsigned long long)tv.tv_usec * (1000000 / CLK_TCK)
-            );
-    }
-# endif
-    if (stop == TM_START)
-        tmstart = now;
-    else
-        ret = (now - tmstart) / (double)(CLK_TCK);
-
-    return ret;
-}
-
-#elif defined(_SC_CLK_TCK)      /* by means of unistd.h */
-# include <sys/times.h>
-
-double app_tminterval(int stop, int usertime)
-{
-    double ret = 0;
-    struct tms rus;
-    clock_t now = times(&rus);
-    static clock_t tmstart;
-
-    if (usertime)
-        now = rus.tms_utime;
-
-    if (stop == TM_START) {
-        tmstart = now;
-    } else {
-        long int tck = sysconf(_SC_CLK_TCK);
-        ret = (now - tmstart) / (double)tck;
-    }
-
-    return ret;
-}
-
-#else
-# include <sys/time.h>
-# include <sys/resource.h>
-
-double app_tminterval(int stop, int usertime)
-{
-    double ret = 0;
-    struct rusage rus;
-    struct timeval now;
-    static struct timeval tmstart;
-
-    if (usertime)
-        getrusage(RUSAGE_SELF, &rus), now = rus.ru_utime;
-    else
-        gettimeofday(&now, NULL);
-
-    if (stop == TM_START)
-        tmstart = now;
-    else
-        ret = ((now.tv_sec + now.tv_usec * 1e-6)
-               - (tmstart.tv_sec + tmstart.tv_usec * 1e-6));
-
-    return ret;
-}
-#endif
-
-int app_access(const char* name, int flag)
-{
-#ifdef _WIN32
-    return _access(name, flag);
-#else
-    return access(name, flag);
-#endif
-}
-
-/* app_isdir section */
-#ifdef _WIN32
-int app_isdir(const char *name)
-{
-    DWORD attr;
-# if defined(UNICODE) || defined(_UNICODE)
-    size_t i, len_0 = strlen(name) + 1;
-    WCHAR tempname[MAX_PATH];
-
-    if (len_0 > MAX_PATH)
-        return -1;
-
-#  if !defined(_WIN32_WCE) || _WIN32_WCE>=101
-    if (!MultiByteToWideChar(CP_ACP, 0, name, len_0, tempname, MAX_PATH))
-#  endif
-        for (i = 0; i < len_0; i++)
-            tempname[i] = (WCHAR)name[i];
-
-    attr = GetFileAttributes(tempname);
-# else
-    attr = GetFileAttributes(name);
-# endif
-    if (attr == INVALID_FILE_ATTRIBUTES)
-        return -1;
-    return ((attr & FILE_ATTRIBUTE_DIRECTORY) != 0);
-}
-#else
-# include <sys/stat.h>
-# ifndef S_ISDIR
-#  if defined(_S_IFMT) && defined(_S_IFDIR)
-#   define S_ISDIR(a)   (((a) & _S_IFMT) == _S_IFDIR)
-#  else
-#   define S_ISDIR(a)   (((a) & S_IFMT) == S_IFDIR)
-#  endif
-# endif
-
-int app_isdir(const char *name)
-{
-# if defined(S_ISDIR)
-    struct stat st;
-
-    if (stat(name, &st) == 0)
-        return S_ISDIR(st.st_mode);
-    else
-        return -1;
-# else
-    return -1;
-# endif
-}
-#endif
-
-/* raw_read|write section */
-#if defined(__VMS)
-# include "vms_term_sock.h"
-static int stdin_sock = -1;
-
-static void close_stdin_sock(void)
-{
-    TerminalSocket (TERM_SOCK_DELETE, &stdin_sock);
-}
-
-int fileno_stdin(void)
-{
-    if (stdin_sock == -1) {
-        TerminalSocket(TERM_SOCK_CREATE, &stdin_sock);
-        atexit(close_stdin_sock);
-    }
-
-    return stdin_sock;
-}
-#else
-int fileno_stdin(void)
-{
-    return fileno(stdin);
-}
-#endif
-
-int fileno_stdout(void)
-{
-    return fileno(stdout);
-}
-
-#if defined(_WIN32) && defined(STD_INPUT_HANDLE)
-int raw_read_stdin(void *buf, int siz)
-{
-    DWORD n;
-    if (ReadFile(GetStdHandle(STD_INPUT_HANDLE), buf, siz, &n, NULL))
-        return n;
-    else
-        return -1;
-}
-#elif defined(__VMS)
-# include <sys/socket.h>
-
-int raw_read_stdin(void *buf, int siz)
-{
-    return recv(fileno_stdin(), buf, siz, 0);
-}
-#else
-int raw_read_stdin(void *buf, int siz)
-{
-    return read(fileno_stdin(), buf, siz);
-}
-#endif
-
-#if defined(_WIN32) && defined(STD_OUTPUT_HANDLE)
-int raw_write_stdout(const void *buf, int siz)
-{
-    DWORD n;
-    if (WriteFile(GetStdHandle(STD_OUTPUT_HANDLE), buf, siz, &n, NULL))
-        return n;
-    else
-        return -1;
-}
-#else
-int raw_write_stdout(const void *buf, int siz)
-{
-    return write(fileno_stdout(), buf, siz);
-}
-#endif
-
-/*
- * Centralized handling if input and output files with format specification
- * The format is meant to show what the input and output is supposed to be,
- * and is therefore a show of intent more than anything else.  However, it
- * does impact behavior on some platform, such as differentiating between
- * text and binary input/output on non-Unix platforms
- */
-static int istext(int format)
-{
-    return (format & B_FORMAT_TEXT) == B_FORMAT_TEXT;
-}
-
-BIO *dup_bio_in(int format)
-{
-    return BIO_new_fp(stdin,
-                      BIO_NOCLOSE | (istext(format) ? BIO_FP_TEXT : 0));
-}
-
-static BIO_METHOD *prefix_method = NULL;
-
-BIO *dup_bio_out(int format)
-{
-    BIO *b = BIO_new_fp(stdout,
-                        BIO_NOCLOSE | (istext(format) ? BIO_FP_TEXT : 0));
-    void *prefix = NULL;
-
-#ifdef OPENSSL_SYS_VMS
-    if (istext(format))
-        b = BIO_push(BIO_new(BIO_f_linebuffer()), b);
-#endif
-
-    if (istext(format) && (prefix = getenv("HARNESS_OSSL_PREFIX")) != NULL) {
-        if (prefix_method == NULL)
-            prefix_method = apps_bf_prefix();
-        b = BIO_push(BIO_new(prefix_method), b);
-        BIO_ctrl(b, PREFIX_CTRL_SET_PREFIX, 0, prefix);
-    }
-
-    return b;
-}
-
-BIO *dup_bio_err(int format)
-{
-    BIO *b = BIO_new_fp(stderr,
-                        BIO_NOCLOSE | (istext(format) ? BIO_FP_TEXT : 0));
-#ifdef OPENSSL_SYS_VMS
-    if (istext(format))
-        b = BIO_push(BIO_new(BIO_f_linebuffer()), b);
-#endif
-    return b;
-}
-
-void destroy_prefix_method(void)
-{
-    BIO_meth_free(prefix_method);
-    prefix_method = NULL;
-}
-
-void unbuffer(FILE *fp)
-{
-/*
- * On VMS, setbuf() will only take 32-bit pointers, and a compilation
- * with /POINTER_SIZE=64 will give off a MAYLOSEDATA2 warning here.
- * However, we trust that the C RTL will never give us a FILE pointer
- * above the first 4 GB of memory, so we simply turn off the warning
- * temporarily.
- */
-#if defined(OPENSSL_SYS_VMS) && defined(__DECC)
-# pragma environment save
-# pragma message disable maylosedata2
-#endif
-    setbuf(fp, NULL);
-#if defined(OPENSSL_SYS_VMS) && defined(__DECC)
-# pragma environment restore
-#endif
-}
-
-static const char *modestr(char mode, int format)
-{
-    OPENSSL_assert(mode == 'a' || mode == 'r' || mode == 'w');
-
-    switch (mode) {
-    case 'a':
-        return istext(format) ? "a" : "ab";
-    case 'r':
-        return istext(format) ? "r" : "rb";
-    case 'w':
-        return istext(format) ? "w" : "wb";
-    }
-    /* The assert above should make sure we never reach this point */
-    return NULL;
-}
-
-static const char *modeverb(char mode)
-{
-    switch (mode) {
-    case 'a':
-        return "appending";
-    case 'r':
-        return "reading";
-    case 'w':
-        return "writing";
-    }
-    return "(doing something)";
-}
-
-/*
- * Open a file for writing, owner-read-only.
- */
-BIO *bio_open_owner(const char *filename, int format, int private)
-{
-    FILE *fp = NULL;
-    BIO *b = NULL;
-    int fd = -1, bflags, mode, textmode;
-
-    if (!private || filename == NULL || strcmp(filename, "-") == 0)
-        return bio_open_default(filename, 'w', format);
-
-    mode = O_WRONLY;
-#ifdef O_CREAT
-    mode |= O_CREAT;
-#endif
-#ifdef O_TRUNC
-    mode |= O_TRUNC;
-#endif
-    textmode = istext(format);
-    if (!textmode) {
-#ifdef O_BINARY
-        mode |= O_BINARY;
-#elif defined(_O_BINARY)
-        mode |= _O_BINARY;
-#endif
-    }
-
-#ifdef OPENSSL_SYS_VMS
-    /* VMS doesn't have O_BINARY, it just doesn't make sense.  But,
-     * it still needs to know that we're going binary, or fdopen()
-     * will fail with "invalid argument"...  so we tell VMS what the
-     * context is.
-     */
-    if (!textmode)
-        fd = open(filename, mode, 0600, "ctx=bin");
-    else
-#endif
-        fd = open(filename, mode, 0600);
-    if (fd < 0)
-        goto err;
-    fp = fdopen(fd, modestr('w', format));
-    if (fp == NULL)
-        goto err;
-    bflags = BIO_CLOSE;
-    if (textmode)
-        bflags |= BIO_FP_TEXT;
-    b = BIO_new_fp(fp, bflags);
-    if (b)
-        return b;
-
- err:
-    BIO_printf(bio_err, "%s: Can't open \"%s\" for writing, %s\n",
-               opt_getprog(), filename, strerror(errno));
-    ERR_print_errors(bio_err);
-    /* If we have fp, then fdopen took over fd, so don't close both. */
-    if (fp)
-        fclose(fp);
-    else if (fd >= 0)
-        close(fd);
-    return NULL;
-}
-
-static BIO *bio_open_default_(const char *filename, char mode, int format,
-                              int quiet)
-{
-    BIO *ret;
-
-    if (filename == NULL || strcmp(filename, "-") == 0) {
-        ret = mode == 'r' ? dup_bio_in(format) : dup_bio_out(format);
-        if (quiet) {
-            ERR_clear_error();
-            return ret;
-        }
-        if (ret != NULL)
-            return ret;
-        BIO_printf(bio_err,
-                   "Can't open %s, %s\n",
-                   mode == 'r' ? "stdin" : "stdout", strerror(errno));
-    } else {
-        ret = BIO_new_file(filename, modestr(mode, format));
-        if (quiet) {
-            ERR_clear_error();
-            return ret;
-        }
-        if (ret != NULL)
-            return ret;
-        BIO_printf(bio_err,
-                   "Can't open %s for %s, %s\n",
-                   filename, modeverb(mode), strerror(errno));
-    }
-    ERR_print_errors(bio_err);
-    return NULL;
-}
-
-BIO *bio_open_default(const char *filename, char mode, int format)
-{
-    return bio_open_default_(filename, mode, format, 0);
-}
-
-BIO *bio_open_default_quiet(const char *filename, char mode, int format)
-{
-    return bio_open_default_(filename, mode, format, 1);
-}
-
-void wait_for_async(SSL *s)
-{
-    /* On Windows select only works for sockets, so we simply don't wait  */
-#ifndef OPENSSL_SYS_WINDOWS
-    int width = 0;
-    fd_set asyncfds;
-    OSSL_ASYNC_FD *fds;
-    size_t numfds;
-    size_t i;
-
-    if (!SSL_get_all_async_fds(s, NULL, &numfds))
-        return;
-    if (numfds == 0)
-        return;
-    fds = app_malloc(sizeof(OSSL_ASYNC_FD) * numfds, "allocate async fds");
-    if (!SSL_get_all_async_fds(s, fds, &numfds)) {
-        OPENSSL_free(fds);
-        return;
-    }
-
-    FD_ZERO(&asyncfds);
-    for (i = 0; i < numfds; i++) {
-        if (width <= (int)fds[i])
-            width = (int)fds[i] + 1;
-        openssl_fdset((int)fds[i], &asyncfds);
-    }
-    select(width, (void *)&asyncfds, NULL, NULL, NULL);
-    OPENSSL_free(fds);
-#endif
-}
-
-/* if OPENSSL_SYS_WINDOWS is defined then so is OPENSSL_SYS_MSDOS */
-#if defined(OPENSSL_SYS_MSDOS)
-int has_stdin_waiting(void)
-{
-# if defined(OPENSSL_SYS_WINDOWS)
-    HANDLE inhand = GetStdHandle(STD_INPUT_HANDLE);
-    DWORD events = 0;
-    INPUT_RECORD inputrec;
-    DWORD insize = 1;
-    BOOL peeked;
-
-    if (inhand == INVALID_HANDLE_VALUE) {
-        return 0;
-    }
-
-    peeked = PeekConsoleInput(inhand, &inputrec, insize, &events);
-    if (!peeked) {
-        /* Probably redirected input? _kbhit() does not work in this case */
-        if (!feof(stdin)) {
-            return 1;
-        }
-        return 0;
-    }
-# endif
-    return _kbhit();
-}
-#endif
-
-/* Corrupt a signature by modifying final byte */
-void corrupt_signature(const ASN1_STRING *signature)
-{
-        unsigned char *s = signature->data;
-        s[signature->length - 1] ^= 0x1;
-}
-
-int set_cert_times(X509 *x, const char *startdate, const char *enddate,
-                   int days)
-{
-    if (startdate == NULL || strcmp(startdate, "today") == 0) {
-        if (X509_gmtime_adj(X509_getm_notBefore(x), 0) == NULL)
-            return 0;
-    } else {
-        if (!ASN1_TIME_set_string_X509(X509_getm_notBefore(x), startdate))
-            return 0;
-    }
-    if (enddate == NULL) {
-        if (X509_time_adj_ex(X509_getm_notAfter(x), days, 0, NULL)
-            == NULL)
-            return 0;
-    } else if (!ASN1_TIME_set_string_X509(X509_getm_notAfter(x), enddate)) {
-        return 0;
-    }
-    return 1;
-}
-
-void make_uppercase(char *string)
-{
-    int i;
-
-    for (i = 0; string[i] != '\0'; i++)
-        string[i] = toupper((unsigned char)string[i]);
-}

apps/apps.h

@@ -1,634 +0,0 @@
-/*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#ifndef HEADER_APPS_H
-# define HEADER_APPS_H
-
-# include "e_os.h" /* struct timeval for DTLS */
-# include "internal/nelem.h"
-# include <assert.h>
-
-# include <sys/types.h>
-# ifndef OPENSSL_NO_POSIX_IO
-#  include <sys/stat.h>
-#  include <fcntl.h>
-# endif
-
-# include <openssl/e_os2.h>
-# include <openssl/ossl_typ.h>
-# include <openssl/bio.h>
-# include <openssl/x509.h>
-# include <openssl/conf.h>
-# include <openssl/txt_db.h>
-# include <openssl/engine.h>
-# include <openssl/ocsp.h>
-# include <signal.h>
-
-# if defined(OPENSSL_SYS_WIN32) || defined(OPENSSL_SYS_WINCE)
-#  define openssl_fdset(a,b) FD_SET((unsigned int)a, b)
-# else
-#  define openssl_fdset(a,b) FD_SET(a, b)
-# endif
-
-/*
- * quick macro when you need to pass an unsigned char instead of a char.
- * this is true for some implementations of the is*() functions, for
- * example.
- */
-#define _UC(c) ((unsigned char)(c))
-
-void app_RAND_load_conf(CONF *c, const char *section);
-void app_RAND_write(void);
-
-extern char *default_config_file;
-extern BIO *bio_in;
-extern BIO *bio_out;
-extern BIO *bio_err;
-extern const unsigned char tls13_aes128gcmsha256_id[];
-extern const unsigned char tls13_aes256gcmsha384_id[];
-extern BIO_ADDR *ourpeer;
-
-BIO_METHOD *apps_bf_prefix(void);
-/*
- * The control used to set the prefix with BIO_ctrl()
- * We make it high enough so the chance of ever clashing with the BIO library
- * remains unlikely for the foreseeable future and beyond.
- */
-#define PREFIX_CTRL_SET_PREFIX  (1 << 15)
-/*
- * apps_bf_prefix() returns a dynamically created BIO_METHOD, which we
- * need to destroy at some point.  When created internally, it's stored
- * in an internal pointer which can be freed with the following function
- */
-void destroy_prefix_method(void);
-
-BIO *dup_bio_in(int format);
-BIO *dup_bio_out(int format);
-BIO *dup_bio_err(int format);
-BIO *bio_open_owner(const char *filename, int format, int private);
-BIO *bio_open_default(const char *filename, char mode, int format);
-BIO *bio_open_default_quiet(const char *filename, char mode, int format);
-CONF *app_load_config_bio(BIO *in, const char *filename);
-CONF *app_load_config(const char *filename);
-CONF *app_load_config_quiet(const char *filename);
-int app_load_modules(const CONF *config);
-void unbuffer(FILE *fp);
-void wait_for_async(SSL *s);
-# if defined(OPENSSL_SYS_MSDOS)
-int has_stdin_waiting(void);
-# endif
-
-void corrupt_signature(const ASN1_STRING *signature);
-int set_cert_times(X509 *x, const char *startdate, const char *enddate,
-                   int days);
-
-/*
- * Common verification options.
- */
-# define OPT_V_ENUM \
-        OPT_V__FIRST=2000, \
-        OPT_V_POLICY, OPT_V_PURPOSE, OPT_V_VERIFY_NAME, OPT_V_VERIFY_DEPTH, \
-        OPT_V_ATTIME, OPT_V_VERIFY_HOSTNAME, OPT_V_VERIFY_EMAIL, \
-        OPT_V_VERIFY_IP, OPT_V_IGNORE_CRITICAL, OPT_V_ISSUER_CHECKS, \
-        OPT_V_CRL_CHECK, OPT_V_CRL_CHECK_ALL, OPT_V_POLICY_CHECK, \
-        OPT_V_EXPLICIT_POLICY, OPT_V_INHIBIT_ANY, OPT_V_INHIBIT_MAP, \
-        OPT_V_X509_STRICT, OPT_V_EXTENDED_CRL, OPT_V_USE_DELTAS, \
-        OPT_V_POLICY_PRINT, OPT_V_CHECK_SS_SIG, OPT_V_TRUSTED_FIRST, \
-        OPT_V_SUITEB_128_ONLY, OPT_V_SUITEB_128, OPT_V_SUITEB_192, \
-        OPT_V_PARTIAL_CHAIN, OPT_V_NO_ALT_CHAINS, OPT_V_NO_CHECK_TIME, \
-        OPT_V_VERIFY_AUTH_LEVEL, OPT_V_ALLOW_PROXY_CERTS, \
-        OPT_V__LAST
-
-# define OPT_V_OPTIONS \
-        { "policy", OPT_V_POLICY, 's', "adds policy to the acceptable policy set"}, \
-        { "purpose", OPT_V_PURPOSE, 's', \
-            "certificate chain purpose"}, \
-        { "verify_name", OPT_V_VERIFY_NAME, 's', "verification policy name"}, \
-        { "verify_depth", OPT_V_VERIFY_DEPTH, 'n', \
-            "chain depth limit" }, \
-        { "auth_level", OPT_V_VERIFY_AUTH_LEVEL, 'n', \
-            "chain authentication security level" }, \
-        { "attime", OPT_V_ATTIME, 'M', "verification epoch time" }, \
-        { "verify_hostname", OPT_V_VERIFY_HOSTNAME, 's', \
-            "expected peer hostname" }, \
-        { "verify_email", OPT_V_VERIFY_EMAIL, 's', \
-            "expected peer email" }, \
-        { "verify_ip", OPT_V_VERIFY_IP, 's', \
-            "expected peer IP address" }, \
-        { "ignore_critical", OPT_V_IGNORE_CRITICAL, '-', \
-            "permit unhandled critical extensions"}, \
-        { "issuer_checks", OPT_V_ISSUER_CHECKS, '-', "(deprecated)"}, \
-        { "crl_check", OPT_V_CRL_CHECK, '-', "check leaf certificate revocation" }, \
-        { "crl_check_all", OPT_V_CRL_CHECK_ALL, '-', "check full chain revocation" }, \
-        { "policy_check", OPT_V_POLICY_CHECK, '-', "perform rfc5280 policy checks"}, \
-        { "explicit_policy", OPT_V_EXPLICIT_POLICY, '-', \
-            "set policy variable require-explicit-policy"}, \
-        { "inhibit_any", OPT_V_INHIBIT_ANY, '-', \
-            "set policy variable inhibit-any-policy"}, \
-        { "inhibit_map", OPT_V_INHIBIT_MAP, '-', \
-            "set policy variable inhibit-policy-mapping"}, \
-        { "x509_strict", OPT_V_X509_STRICT, '-', \
-            "disable certificate compatibility work-arounds"}, \
-        { "extended_crl", OPT_V_EXTENDED_CRL, '-', \
-            "enable extended CRL features"}, \
-        { "use_deltas", OPT_V_USE_DELTAS, '-', \
-            "use delta CRLs"}, \
-        { "policy_print", OPT_V_POLICY_PRINT, '-', \
-            "print policy processing diagnostics"}, \
-        { "check_ss_sig", OPT_V_CHECK_SS_SIG, '-', \
-            "check root CA self-signatures"}, \
-        { "trusted_first", OPT_V_TRUSTED_FIRST, '-', \
-            "search trust store first (default)" }, \
-        { "suiteB_128_only", OPT_V_SUITEB_128_ONLY, '-', "Suite B 128-bit-only mode"}, \
-        { "suiteB_128", OPT_V_SUITEB_128, '-', \
-            "Suite B 128-bit mode allowing 192-bit algorithms"}, \
-        { "suiteB_192", OPT_V_SUITEB_192, '-', "Suite B 192-bit-only mode" }, \
-        { "partial_chain", OPT_V_PARTIAL_CHAIN, '-', \
-            "accept chains anchored by intermediate trust-store CAs"}, \
-        { "no_alt_chains", OPT_V_NO_ALT_CHAINS, '-', "(deprecated)" }, \
-        { "no_check_time", OPT_V_NO_CHECK_TIME, '-', "ignore certificate validity time" }, \
-        { "allow_proxy_certs", OPT_V_ALLOW_PROXY_CERTS, '-', "allow the use of proxy certificates" }
-
-# define OPT_V_CASES \
-        OPT_V__FIRST: case OPT_V__LAST: break; \
-        case OPT_V_POLICY: \
-        case OPT_V_PURPOSE: \
-        case OPT_V_VERIFY_NAME: \
-        case OPT_V_VERIFY_DEPTH: \
-        case OPT_V_VERIFY_AUTH_LEVEL: \
-        case OPT_V_ATTIME: \
-        case OPT_V_VERIFY_HOSTNAME: \
-        case OPT_V_VERIFY_EMAIL: \
-        case OPT_V_VERIFY_IP: \
-        case OPT_V_IGNORE_CRITICAL: \
-        case OPT_V_ISSUER_CHECKS: \
-        case OPT_V_CRL_CHECK: \
-        case OPT_V_CRL_CHECK_ALL: \
-        case OPT_V_POLICY_CHECK: \
-        case OPT_V_EXPLICIT_POLICY: \
-        case OPT_V_INHIBIT_ANY: \
-        case OPT_V_INHIBIT_MAP: \
-        case OPT_V_X509_STRICT: \
-        case OPT_V_EXTENDED_CRL: \
-        case OPT_V_USE_DELTAS: \
-        case OPT_V_POLICY_PRINT: \
-        case OPT_V_CHECK_SS_SIG: \
-        case OPT_V_TRUSTED_FIRST: \
-        case OPT_V_SUITEB_128_ONLY: \
-        case OPT_V_SUITEB_128: \
-        case OPT_V_SUITEB_192: \
-        case OPT_V_PARTIAL_CHAIN: \
-        case OPT_V_NO_ALT_CHAINS: \
-        case OPT_V_NO_CHECK_TIME: \
-        case OPT_V_ALLOW_PROXY_CERTS
-
-/*
- * Common "extended validation" options.
- */
-# define OPT_X_ENUM \
-        OPT_X__FIRST=1000, \
-        OPT_X_KEY, OPT_X_CERT, OPT_X_CHAIN, OPT_X_CHAIN_BUILD, \
-        OPT_X_CERTFORM, OPT_X_KEYFORM, \
-        OPT_X__LAST
-
-# define OPT_X_OPTIONS \
-        { "xkey", OPT_X_KEY, '<', "key for Extended certificates"}, \
-        { "xcert", OPT_X_CERT, '<', "cert for Extended certificates"}, \
-        { "xchain", OPT_X_CHAIN, '<', "chain for Extended certificates"}, \
-        { "xchain_build", OPT_X_CHAIN_BUILD, '-', \
-            "build certificate chain for the extended certificates"}, \
-        { "xcertform", OPT_X_CERTFORM, 'F', \
-            "format of Extended certificate (PEM or DER) PEM default " }, \
-        { "xkeyform", OPT_X_KEYFORM, 'F', \
-            "format of Extended certificate's key (PEM or DER) PEM default"}
-
-# define OPT_X_CASES \
-        OPT_X__FIRST: case OPT_X__LAST: break; \
-        case OPT_X_KEY: \
-        case OPT_X_CERT: \
-        case OPT_X_CHAIN: \
-        case OPT_X_CHAIN_BUILD: \
-        case OPT_X_CERTFORM: \
-        case OPT_X_KEYFORM
-
-/*
- * Common SSL options.
- * Any changes here must be coordinated with ../ssl/ssl_conf.c
- */
-# define OPT_S_ENUM \
-        OPT_S__FIRST=3000, \
-        OPT_S_NOSSL3, OPT_S_NOTLS1, OPT_S_NOTLS1_1, OPT_S_NOTLS1_2, \
-        OPT_S_NOTLS1_3, OPT_S_BUGS, OPT_S_NO_COMP, OPT_S_NOTICKET, \
-        OPT_S_SERVERPREF, OPT_S_LEGACYRENEG, OPT_S_LEGACYCONN, \
-        OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, OPT_S_ALLOW_NO_DHE_KEX, \
-        OPT_S_PRIORITIZE_CHACHA, \
-        OPT_S_STRICT, OPT_S_SIGALGS, OPT_S_CLIENTSIGALGS, OPT_S_GROUPS, \
-        OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, OPT_S_CIPHERSUITES, \
-        OPT_S_RECORD_PADDING, OPT_S_DEBUGBROKE, OPT_S_COMP, \
-        OPT_S_MINPROTO, OPT_S_MAXPROTO, \
-        OPT_S_NO_RENEGOTIATION, OPT_S_NO_MIDDLEBOX, OPT_S__LAST
-
-# define OPT_S_OPTIONS \
-        {"no_ssl3", OPT_S_NOSSL3, '-',"Just disable SSLv3" }, \
-        {"no_tls1", OPT_S_NOTLS1, '-', "Just disable TLSv1"}, \
-        {"no_tls1_1", OPT_S_NOTLS1_1, '-', "Just disable TLSv1.1" }, \
-        {"no_tls1_2", OPT_S_NOTLS1_2, '-', "Just disable TLSv1.2"}, \
-        {"no_tls1_3", OPT_S_NOTLS1_3, '-', "Just disable TLSv1.3"}, \
-        {"bugs", OPT_S_BUGS, '-', "Turn on SSL bug compatibility"}, \
-        {"no_comp", OPT_S_NO_COMP, '-', "Disable SSL/TLS compression (default)" }, \
-        {"comp", OPT_S_COMP, '-', "Use SSL/TLS-level compression" }, \
-        {"no_ticket", OPT_S_NOTICKET, '-', \
-            "Disable use of TLS session tickets"}, \
-        {"serverpref", OPT_S_SERVERPREF, '-', "Use server's cipher preferences"}, \
-        {"legacy_renegotiation", OPT_S_LEGACYRENEG, '-', \
-            "Enable use of legacy renegotiation (dangerous)"}, \
-        {"no_renegotiation", OPT_S_NO_RENEGOTIATION, '-', \
-            "Disable all renegotiation."}, \
-        {"legacy_server_connect", OPT_S_LEGACYCONN, '-', \
-            "Allow initial connection to servers that don't support RI"}, \
-        {"no_resumption_on_reneg", OPT_S_ONRESUMP, '-', \
-            "Disallow session resumption on renegotiation"}, \
-        {"no_legacy_server_connect", OPT_S_NOLEGACYCONN, '-', \
-            "Disallow initial connection to servers that don't support RI"}, \
-        {"allow_no_dhe_kex", OPT_S_ALLOW_NO_DHE_KEX, '-', \
-            "In TLSv1.3 allow non-(ec)dhe based key exchange on resumption"}, \
-        {"prioritize_chacha", OPT_S_PRIORITIZE_CHACHA, '-', \
-            "Prioritize ChaCha ciphers when preferred by clients"}, \
-        {"strict", OPT_S_STRICT, '-', \
-            "Enforce strict certificate checks as per TLS standard"}, \
-        {"sigalgs", OPT_S_SIGALGS, 's', \
-            "Signature algorithms to support (colon-separated list)" }, \
-        {"client_sigalgs", OPT_S_CLIENTSIGALGS, 's', \
-            "Signature algorithms to support for client certificate" \
-            " authentication (colon-separated list)" }, \
-        {"groups", OPT_S_GROUPS, 's', \
-            "Groups to advertise (colon-separated list)" }, \
-        {"curves", OPT_S_CURVES, 's', \
-            "Groups to advertise (colon-separated list)" }, \
-        {"named_curve", OPT_S_NAMEDCURVE, 's', \
-            "Elliptic curve used for ECDHE (server-side only)" }, \
-        {"cipher", OPT_S_CIPHER, 's', "Specify TLSv1.2 and below cipher list to be used"}, \
-        {"ciphersuites", OPT_S_CIPHERSUITES, 's', "Specify TLSv1.3 ciphersuites to be used"}, \
-        {"min_protocol", OPT_S_MINPROTO, 's', "Specify the minimum protocol version to be used"}, \
-        {"max_protocol", OPT_S_MAXPROTO, 's', "Specify the maximum protocol version to be used"}, \
-        {"record_padding", OPT_S_RECORD_PADDING, 's', \
-            "Block size to pad TLS 1.3 records to."}, \
-        {"debug_broken_protocol", OPT_S_DEBUGBROKE, '-', \
-            "Perform all sorts of protocol violations for testing purposes"}, \
-        {"no_middlebox", OPT_S_NO_MIDDLEBOX, '-', \
-            "Disable TLSv1.3 middlebox compat mode" }
-
-# define OPT_S_CASES \
-        OPT_S__FIRST: case OPT_S__LAST: break; \
-        case OPT_S_NOSSL3: \
-        case OPT_S_NOTLS1: \
-        case OPT_S_NOTLS1_1: \
-        case OPT_S_NOTLS1_2: \
-        case OPT_S_NOTLS1_3: \
-        case OPT_S_BUGS: \
-        case OPT_S_NO_COMP: \
-        case OPT_S_COMP: \
-        case OPT_S_NOTICKET: \
-        case OPT_S_SERVERPREF: \
-        case OPT_S_LEGACYRENEG: \
-        case OPT_S_LEGACYCONN: \
-        case OPT_S_ONRESUMP: \
-        case OPT_S_NOLEGACYCONN: \
-        case OPT_S_ALLOW_NO_DHE_KEX: \
-        case OPT_S_PRIORITIZE_CHACHA: \
-        case OPT_S_STRICT: \
-        case OPT_S_SIGALGS: \
-        case OPT_S_CLIENTSIGALGS: \
-        case OPT_S_GROUPS: \
-        case OPT_S_CURVES: \
-        case OPT_S_NAMEDCURVE: \
-        case OPT_S_CIPHER: \
-        case OPT_S_CIPHERSUITES: \
-        case OPT_S_RECORD_PADDING: \
-        case OPT_S_NO_RENEGOTIATION: \
-        case OPT_S_MINPROTO: \
-        case OPT_S_MAXPROTO: \
-        case OPT_S_DEBUGBROKE: \
-        case OPT_S_NO_MIDDLEBOX
-
-#define IS_NO_PROT_FLAG(o) \
- (o == OPT_S_NOSSL3 || o == OPT_S_NOTLS1 || o == OPT_S_NOTLS1_1 \
-  || o == OPT_S_NOTLS1_2 || o == OPT_S_NOTLS1_3)
-
-/*
- * Random state options.
- */
-# define OPT_R_ENUM \
-        OPT_R__FIRST=1500, OPT_R_RAND, OPT_R_WRITERAND, OPT_R__LAST
-
-# define OPT_R_OPTIONS \
-    {"rand", OPT_R_RAND, 's', "Load the file(s) into the random number generator"}, \
-    {"writerand", OPT_R_WRITERAND, '>', "Write random data to the specified file"}
-
-# define OPT_R_CASES \
-        OPT_R__FIRST: case OPT_R__LAST: break; \
-        case OPT_R_RAND: case OPT_R_WRITERAND
-
-/*
- * Option parsing.
- */
-extern const char OPT_HELP_STR[];
-extern const char OPT_MORE_STR[];
-typedef struct options_st {
-    const char *name;
-    int retval;
-    /*
-     * value type: - no value (also the value zero), n number, p positive
-     * number, u unsigned, l long, s string, < input file, > output file,
-     * f any format, F der/pem format, E der/pem/engine format identifier.
-     * l, n and u include zero; p does not.
-     */
-    int valtype;
-    const char *helpstr;
-} OPTIONS;
-
-/*
- * A string/int pairing; widely use for option value lookup, hence the
- * name OPT_PAIR. But that name is misleading in s_cb.c, so we also use
- * the "generic" name STRINT_PAIR.
- */
-typedef struct string_int_pair_st {
-    const char *name;
-    int retval;
-} OPT_PAIR, STRINT_PAIR;
-
-/* Flags to pass into opt_format; see FORMAT_xxx, below. */
-# define OPT_FMT_PEMDER          (1L <<  1)
-# define OPT_FMT_PKCS12          (1L <<  2)
-# define OPT_FMT_SMIME           (1L <<  3)
-# define OPT_FMT_ENGINE          (1L <<  4)
-# define OPT_FMT_MSBLOB          (1L <<  5)
-# define OPT_FMT_NETSCAPE        (1L <<  6)
-# define OPT_FMT_NSS             (1L <<  7)
-# define OPT_FMT_TEXT            (1L <<  8)
-# define OPT_FMT_HTTP            (1L <<  9)
-# define OPT_FMT_PVK             (1L << 10)
-# define OPT_FMT_PDE     (OPT_FMT_PEMDER | OPT_FMT_ENGINE)
-# define OPT_FMT_PDS     (OPT_FMT_PEMDER | OPT_FMT_SMIME)
-# define OPT_FMT_ANY     ( \
-        OPT_FMT_PEMDER | OPT_FMT_PKCS12 | OPT_FMT_SMIME | \
-        OPT_FMT_ENGINE | OPT_FMT_MSBLOB | OPT_FMT_NETSCAPE | \
-        OPT_FMT_NSS | OPT_FMT_TEXT | OPT_FMT_HTTP | OPT_FMT_PVK)
-
-char *opt_progname(const char *argv0);
-char *opt_getprog(void);
-char *opt_init(int ac, char **av, const OPTIONS * o);
-int opt_next(void);
-int opt_format(const char *s, unsigned long flags, int *result);
-int opt_int(const char *arg, int *result);
-int opt_ulong(const char *arg, unsigned long *result);
-int opt_long(const char *arg, long *result);
-#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L && \
-    defined(INTMAX_MAX) && defined(UINTMAX_MAX)
-int opt_imax(const char *arg, intmax_t *result);
-int opt_umax(const char *arg, uintmax_t *result);
-#else
-# define opt_imax opt_long
-# define opt_umax opt_ulong
-# define intmax_t long
-# define uintmax_t unsigned long
-#endif
-int opt_pair(const char *arg, const OPT_PAIR * pairs, int *result);
-int opt_cipher(const char *name, const EVP_CIPHER **cipherp);
-int opt_md(const char *name, const EVP_MD **mdp);
-char *opt_arg(void);
-char *opt_flag(void);
-char *opt_unknown(void);
-char **opt_rest(void);
-int opt_num_rest(void);
-int opt_verify(int i, X509_VERIFY_PARAM *vpm);
-int opt_rand(int i);
-void opt_help(const OPTIONS * list);
-int opt_format_error(const char *s, unsigned long flags);
-
-typedef struct args_st {
-    int size;
-    int argc;
-    char **argv;
-} ARGS;
-
-/*
- * VMS C only for now, implemented in vms_decc_init.c
- * If other C compilers forget to terminate argv with NULL, this function
- * can be re-used.
- */
-char **copy_argv(int *argc, char *argv[]);
-/*
- * Win32-specific argv initialization that splits OS-supplied UNICODE
- * command line string to array of UTF8-encoded strings.
- */
-void win32_utf8argv(int *argc, char **argv[]);
-
-
-# define PW_MIN_LENGTH 4
-typedef struct pw_cb_data {
-    const void *password;
-    const char *prompt_info;
-} PW_CB_DATA;
-
-int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_data);
-
-int setup_ui_method(void);
-void destroy_ui_method(void);
-const UI_METHOD *get_ui_method(void);
-
-int chopup_args(ARGS *arg, char *buf);
-# ifdef HEADER_X509_H
-int dump_cert_text(BIO *out, X509 *x);
-void print_name(BIO *out, const char *title, X509_NAME *nm,
-                unsigned long lflags);
-# endif
-void print_bignum_var(BIO *, const BIGNUM *, const char*,
-                      int, unsigned char *);
-void print_array(BIO *, const char *, int, const unsigned char *);
-int set_nameopt(const char *arg);
-unsigned long get_nameopt(void);
-int set_cert_ex(unsigned long *flags, const char *arg);
-int set_name_ex(unsigned long *flags, const char *arg);
-int set_ext_copy(int *copy_type, const char *arg);
-int copy_extensions(X509 *x, X509_REQ *req, int copy_type);
-int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2);
-int add_oid_section(CONF *conf);
-X509 *load_cert(const char *file, int format, const char *cert_descrip);
-X509_CRL *load_crl(const char *infile, int format);
-EVP_PKEY *load_key(const char *file, int format, int maybe_stdin,
-                   const char *pass, ENGINE *e, const char *key_descrip);
-EVP_PKEY *load_pubkey(const char *file, int format, int maybe_stdin,
-                      const char *pass, ENGINE *e, const char *key_descrip);
-int load_certs(const char *file, STACK_OF(X509) **certs, int format,
-               const char *pass, const char *cert_descrip);
-int load_crls(const char *file, STACK_OF(X509_CRL) **crls, int format,
-              const char *pass, const char *cert_descrip);
-X509_STORE *setup_verify(const char *CAfile, const char *CApath,
-                         int noCAfile, int noCApath);
-__owur int ctx_set_verify_locations(SSL_CTX *ctx, const char *CAfile,
-                                    const char *CApath, int noCAfile,
-                                    int noCApath);
-
-#ifndef OPENSSL_NO_CT
-
-/*
- * Sets the file to load the Certificate Transparency log list from.
- * If path is NULL, loads from the default file path.
- * Returns 1 on success, 0 otherwise.
- */
-__owur int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path);
-
-#endif
-
-ENGINE *setup_engine(const char *engine, int debug);
-void release_engine(ENGINE *e);
-
-# ifndef OPENSSL_NO_OCSP
-OCSP_RESPONSE *process_responder(OCSP_REQUEST *req,
-                                 const char *host, const char *path,
-                                 const char *port, int use_ssl,
-                                 STACK_OF(CONF_VALUE) *headers,
-                                 int req_timeout);
-# endif
-
-/* Functions defined in ca.c and also used in ocsp.c */
-int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
-                   ASN1_GENERALIZEDTIME **pinvtm, const char *str);
-
-# define DB_type         0
-# define DB_exp_date     1
-# define DB_rev_date     2
-# define DB_serial       3      /* index - unique */
-# define DB_file         4
-# define DB_name         5      /* index - unique when active and not
-                                 * disabled */
-# define DB_NUMBER       6
-
-# define DB_TYPE_REV     'R'    /* Revoked  */
-# define DB_TYPE_EXP     'E'    /* Expired  */
-# define DB_TYPE_VAL     'V'    /* Valid ; inserted with: ca ... -valid */
-# define DB_TYPE_SUSP    'S'    /* Suspended  */
-
-typedef struct db_attr_st {
-    int unique_subject;
-} DB_ATTR;
-typedef struct ca_db_st {
-    DB_ATTR attributes;
-    TXT_DB *db;
-    char *dbfname;
-# ifndef OPENSSL_NO_POSIX_IO
-    struct stat dbst;
-# endif
-} CA_DB;
-
-void* app_malloc(int sz, const char *what);
-BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai);
-int save_serial(const char *serialfile, const char *suffix, const BIGNUM *serial,
-                ASN1_INTEGER **retai);
-int rotate_serial(const char *serialfile, const char *new_suffix,
-                  const char *old_suffix);
-int rand_serial(BIGNUM *b, ASN1_INTEGER *ai);
-CA_DB *load_index(const char *dbfile, DB_ATTR *dbattr);
-int index_index(CA_DB *db);
-int save_index(const char *dbfile, const char *suffix, CA_DB *db);
-int rotate_index(const char *dbfile, const char *new_suffix,
-                 const char *old_suffix);
-void free_index(CA_DB *db);
-# define index_name_cmp_noconst(a, b) \
-        index_name_cmp((const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, a), \
-        (const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, b))
-int index_name_cmp(const OPENSSL_CSTRING *a, const OPENSSL_CSTRING *b);
-int parse_yesno(const char *str, int def);
-
-X509_NAME *parse_name(const char *str, long chtype, int multirdn);
-void policies_print(X509_STORE_CTX *ctx);
-int bio_to_mem(unsigned char **out, int maxlen, BIO *in);
-int pkey_ctrl_string(EVP_PKEY_CTX *ctx, const char *value);
-int init_gen_str(EVP_PKEY_CTX **pctx,
-                 const char *algname, ENGINE *e, int do_param);
-int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md,
-                 STACK_OF(OPENSSL_STRING) *sigopts);
-int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md,
-                     STACK_OF(OPENSSL_STRING) *sigopts);
-int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,
-                     STACK_OF(OPENSSL_STRING) *sigopts);
-
-extern char *psk_key;
-
-
-unsigned char *next_protos_parse(size_t *outlen, const char *in);
-
-void print_cert_checks(BIO *bio, X509 *x,
-                       const char *checkhost,
-                       const char *checkemail, const char *checkip);
-
-void store_setup_crl_download(X509_STORE *st);
-
-/* See OPT_FMT_xxx, above. */
-/* On some platforms, it's important to distinguish between text and binary
- * files.  On some, there might even be specific file formats for different
- * contents.  The FORMAT_xxx macros are meant to express an intent with the
- * file being read or created.
- */
-# define B_FORMAT_TEXT   0x8000
-# define FORMAT_UNDEF    0
-# define FORMAT_TEXT    (1 | B_FORMAT_TEXT)     /* Generic text */
-# define FORMAT_BINARY   2                      /* Generic binary */
-# define FORMAT_BASE64  (3 | B_FORMAT_TEXT)     /* Base64 */
-# define FORMAT_ASN1     4                      /* ASN.1/DER */
-# define FORMAT_PEM     (5 | B_FORMAT_TEXT)
-# define FORMAT_PKCS12   6
-# define FORMAT_SMIME   (7 | B_FORMAT_TEXT)
-# define FORMAT_ENGINE   8                      /* Not really a file format */
-# define FORMAT_PEMRSA  (9 | B_FORMAT_TEXT)     /* PEM RSAPubicKey format */
-# define FORMAT_ASN1RSA  10                     /* DER RSAPubicKey format */
-# define FORMAT_MSBLOB   11                     /* MS Key blob format */
-# define FORMAT_PVK      12                     /* MS PVK file format */
-# define FORMAT_HTTP     13                     /* Download using HTTP */
-# define FORMAT_NSS      14                     /* NSS keylog format */
-
-# define EXT_COPY_NONE   0
-# define EXT_COPY_ADD    1
-# define EXT_COPY_ALL    2
-
-# define NETSCAPE_CERT_HDR       "certificate"
-
-# define APP_PASS_LEN    1024
-
-/*
- * IETF RFC 5280 says serial number must be <= 20 bytes. Use 159 bits
- * so that the first bit will never be one, so that the DER encoding
- * rules won't force a leading octet.
- */
-# define SERIAL_RAND_BITS        159
-
-int app_isdir(const char *);
-int app_access(const char *, int flag);
-int fileno_stdin(void);
-int fileno_stdout(void);
-int raw_read_stdin(void *, int);
-int raw_write_stdout(const void *, int);
-
-# define TM_START        0
-# define TM_STOP         1
-double app_tminterval(int stop, int usertime);
-
-void make_uppercase(char *string);
-
-typedef struct verify_options_st {
-    int depth;
-    int quiet;
-    int error;
-    int return_error;
-} VERIFY_CB_ARGS;
-
-extern VERIFY_CB_ARGS verify_args;
-
-#endif

apps/asn1pars.c

@@ -1,7 +1,7 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -18,6 +18,9 @@
 #include <openssl/pem.h>
 #include <openssl/asn1t.h>
 
+DEFINE_STACK_OF(ASN1_OBJECT)
+DEFINE_STACK_OF_STRING()
+
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_INFORM, OPT_IN, OPT_OUT, OPT_INDENT, OPT_NOOUT,
@@ -27,27 +30,32 @@ typedef enum OPTION_choice {
 } OPTION_CHOICE;
 
 const OPTIONS asn1parse_options[] = {
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
+    {"oid", OPT_OID, '<', "file of extra oid definitions"},
+
+    OPT_SECTION("I/O"),
     {"inform", OPT_INFORM, 'F', "input format - one of DER PEM"},
     {"in", OPT_IN, '<', "input file"},
     {"out", OPT_OUT, '>', "output file (output format is always DER)"},
-    {"i", OPT_INDENT, 0, "indents the output"},
     {"noout", OPT_NOOUT, 0, "do not produce any output"},
     {"offset", OPT_OFFSET, 'p', "offset into file"},
     {"length", OPT_LENGTH, 'p', "length of section in file"},
-    {"oid", OPT_OID, '<', "file of extra oid definitions"},
-    {"dump", OPT_DUMP, 0, "unknown data in hex form"},
-    {"dlimit", OPT_DLIMIT, 'p',
-     "dump the first arg bytes of unknown data in hex form"},
     {"strparse", OPT_STRPARSE, 'p',
      "offset; a series of these can be used to 'dig'"},
-    {OPT_MORE_STR, 0, 0, "into multiple ASN1 blob wrappings"},
     {"genstr", OPT_GENSTR, 's', "string to generate ASN1 structure from"},
+    {OPT_MORE_STR, 0, 0, "into multiple ASN1 blob wrappings"},
     {"genconf", OPT_GENCONF, 's', "file to generate ASN1 structure from"},
-    {OPT_MORE_STR, 0, 0, "(-inform  will be ignored)"},
     {"strictpem", OPT_STRICTPEM, 0,
      "do not attempt base64 decode outside PEM markers"},
     {"item", OPT_ITEM, 's', "item to parse and print"},
+    {OPT_MORE_STR, 0, 0, "(-inform  will be ignored)"},
+
+    OPT_SECTION("Formatting"),
+    {"i", OPT_INDENT, 0, "indents the output"},
+    {"dump", OPT_DUMP, 0, "unknown data in hex form"},
+    {"dlimit", OPT_DLIMIT, 'p',
+     "dump the first arg bytes of unknown data in hex form"},
     {NULL}
 };
 
@@ -170,17 +178,17 @@ int asn1parse_main(int argc, char **argv)
     if (derfile && (derout = bio_open_default(derfile, 'w', FORMAT_ASN1)) == NULL)
         goto end;
 
+    if ((buf = BUF_MEM_new()) == NULL)
+        goto end;
     if (strictpem) {
-        if (PEM_read_bio(in, &name, &header, &str, &num) !=
-            1) {
+        if (PEM_read_bio(in, &name, &header, &str, &num) != 1) {
             BIO_printf(bio_err, "Error reading PEM file\n");
             ERR_print_errors(bio_err);
             goto end;
         }
+        buf->data = (char *)str;
+        buf->length = buf->max = num;
     } else {
-
-        if ((buf = BUF_MEM_new()) == NULL)
-            goto end;
         if (!BUF_MEM_grow(buf, BUFSIZ * 8))
             goto end;           /* Pre-allocate :-) */
 
@@ -303,8 +311,6 @@ int asn1parse_main(int argc, char **argv)
     BUF_MEM_free(buf);
     OPENSSL_free(name);
     OPENSSL_free(header);
-    if (strictpem)
-        OPENSSL_free(str);
     ASN1_TYPE_free(at);
     sk_OPENSSL_STRING_free(osk);
     return ret;

apps/bf_prefix.c

@@ -1,177 +0,0 @@
-/*
- * Copyright 2018 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the OpenSSL license (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#include <stdio.h>
-#include <string.h>
-#include <errno.h>
-#include <openssl/bio.h>
-#include "apps.h"
-
-static int prefix_write(BIO *b, const char *out, size_t outl,
-                        size_t *numwritten);
-static int prefix_read(BIO *b, char *buf, size_t size, size_t *numread);
-static int prefix_puts(BIO *b, const char *str);
-static int prefix_gets(BIO *b, char *str, int size);
-static long prefix_ctrl(BIO *b, int cmd, long arg1, void *arg2);
-static int prefix_create(BIO *b);
-static int prefix_destroy(BIO *b);
-static long prefix_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp);
-
-static BIO_METHOD *prefix_meth = NULL;
-
-BIO_METHOD *apps_bf_prefix(void)
-{
-    if (prefix_meth == NULL) {
-        if ((prefix_meth =
-             BIO_meth_new(BIO_TYPE_FILTER, "Prefix filter")) == NULL
-            || !BIO_meth_set_create(prefix_meth, prefix_create)
-            || !BIO_meth_set_destroy(prefix_meth, prefix_destroy)
-            || !BIO_meth_set_write_ex(prefix_meth, prefix_write)
-            || !BIO_meth_set_read_ex(prefix_meth, prefix_read)
-            || !BIO_meth_set_puts(prefix_meth, prefix_puts)
-            || !BIO_meth_set_gets(prefix_meth, prefix_gets)
-            || !BIO_meth_set_ctrl(prefix_meth, prefix_ctrl)
-            || !BIO_meth_set_callback_ctrl(prefix_meth, prefix_callback_ctrl)) {
-            BIO_meth_free(prefix_meth);
-            prefix_meth = NULL;
-        }
-    }
-    return prefix_meth;
-}
-
-typedef struct prefix_ctx_st {
-    char *prefix;
-    int linestart;               /* flag to indicate we're at the line start */
-} PREFIX_CTX;
-
-static int prefix_create(BIO *b)
-{
-    PREFIX_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
-
-    if (ctx == NULL)
-        return 0;
-
-    ctx->prefix = NULL;
-    ctx->linestart = 1;
-    BIO_set_data(b, ctx);
-    BIO_set_init(b, 1);
-    return 1;
-}
-
-static int prefix_destroy(BIO *b)
-{
-    PREFIX_CTX *ctx = BIO_get_data(b);
-
-    OPENSSL_free(ctx->prefix);
-    OPENSSL_free(ctx);
-    return 1;
-}
-
-static int prefix_read(BIO *b, char *in, size_t size, size_t *numread)
-{
-    return BIO_read_ex(BIO_next(b), in, size, numread);
-}
-
-static int prefix_write(BIO *b, const char *out, size_t outl,
-                        size_t *numwritten)
-{
-    PREFIX_CTX *ctx = BIO_get_data(b);
-
-    if (ctx == NULL)
-        return 0;
-
-    /* If no prefix is set or if it's empty, we've got nothing to do here */
-    if (ctx->prefix == NULL || *ctx->prefix == '\0') {
-        /* We do note if what comes next will be a new line, though */
-        if (outl > 0)
-            ctx->linestart = (out[outl-1] == '\n');
-        return BIO_write_ex(BIO_next(b), out, outl, numwritten);
-    }
-
-    *numwritten = 0;
-
-    while (outl > 0) {
-        size_t i;
-        char c;
-
-        /* If we know that we're at the start of the line, output the prefix */
-        if (ctx->linestart) {
-            size_t dontcare;
-
-            if (!BIO_write_ex(BIO_next(b), ctx->prefix, strlen(ctx->prefix),
-                              &dontcare))
-                return 0;
-            ctx->linestart = 0;
-        }
-
-        /* Now, go look for the next LF, or the end of the string */
-        for (i = 0, c = '\0'; i < outl && (c = out[i]) != '\n'; i++)
-            continue;
-        if (c == '\n')
-            i++;
-
-        /* Output what we found so far */
-        while (i > 0) {
-            size_t num = 0;
-
-            if (!BIO_write_ex(BIO_next(b), out, i, &num))
-                return 0;
-            out += num;
-            outl -= num;
-            *numwritten += num;
-            i -= num;
-        }
-
-        /* If we found a LF, what follows is a new line, so take note */
-        if (c == '\n')
-            ctx->linestart = 1;
-    }
-
-    return 1;
-}
-
-static long prefix_ctrl(BIO *b, int cmd, long num, void *ptr)
-{
-    long ret = 0;
-
-    switch (cmd) {
-    case PREFIX_CTRL_SET_PREFIX:
-        {
-            PREFIX_CTX *ctx = BIO_get_data(b);
-
-            if (ctx == NULL)
-                break;
-
-            OPENSSL_free(ctx->prefix);
-            ctx->prefix = OPENSSL_strdup((const char *)ptr);
-            ret = ctx->prefix != NULL;
-        }
-        break;
-    default:
-        if (BIO_next(b) != NULL)
-            ret = BIO_ctrl(BIO_next(b), cmd, num, ptr);
-        break;
-    }
-    return ret;
-}
-
-static long prefix_callback_ctrl(BIO *b, int cmd, BIO_info_cb *fp)
-{
-    return BIO_callback_ctrl(BIO_next(b), cmd, fp);
-}
-
-static int prefix_gets(BIO *b, char *buf, int size)
-{
-    return BIO_gets(BIO_next(b), buf, size);
-}
-
-static int prefix_puts(BIO *b, const char *str)
-{
-    return BIO_write(b, str, strlen(str));
-}

apps/build.info

@@ -1,38 +1,80 @@
-{- our @apps_openssl_src =
-       qw(openssl.c
-          asn1pars.c ca.c ciphers.c cms.c crl.c crl2p7.c dgst.c dhparam.c
-          dsa.c dsaparam.c ec.c ecparam.c enc.c engine.c errstr.c gendsa.c
-          genpkey.c genrsa.c nseq.c ocsp.c passwd.c pkcs12.c pkcs7.c pkcs8.c
-          pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c rsa.c rsautl.c
-          s_client.c s_server.c s_time.c sess_id.c smime.c speed.c spkac.c
-          srp.c ts.c verify.c version.c x509.c rehash.c storeutl.c);
-   our @apps_lib_src =
-       ( qw(apps.c opt.c s_cb.c s_socket.c app_rand.c bf_prefix.c),
-         split(/\s+/, $target{apps_aux_src}) );
-   our @apps_init_src = split(/\s+/, $target{apps_init_src});
-   "" -}
-IF[{- !$disabled{apps} -}]
-  LIBS_NO_INST=libapps.a
-  SOURCE[libapps.a]={- join(" ", @apps_lib_src) -}
-  INCLUDE[libapps.a]=.. ../include
+SUBDIRS=lib
 
+# Program init source, that don't have direct linkage with the rest of the
+# source, and can therefore not be part of a library.
+IF[{- !$disabled{uplink} -}]
+  $INITSRC=../ms/applink.c
+ENDIF
+IF[{- $config{target} =~ /^vms-/ -}]
+  $INITSRC=vms_decc_init.c
+ENDIF
+
+# Source for the 'openssl' program
+$OPENSSLSRC=\
+        openssl.c progs.c \
+        asn1pars.c ca.c ciphers.c cms.c crl.c crl2p7.c dgst.c \
+        enc.c errstr.c \
+        genpkey.c kdf.c mac.c nseq.c passwd.c pkcs7.c \
+        pkcs8.c pkey.c pkeyparam.c pkeyutl.c prime.c rand.c req.c \
+        rsautl.c s_client.c s_server.c s_time.c sess_id.c smime.c speed.c \
+        spkac.c verify.c version.c x509.c rehash.c storeutl.c \
+        list.c info.c provider.c fipsinstall.c
+IF[{- !$disabled{'des'} -}]
+  $OPENSSLSRC=$OPENSSLSRC pkcs12.c
+ENDIF
+IF[{- !$disabled{'ec'} -}]
+  $OPENSSLSRC=$OPENSSLSRC ec.c ecparam.c
+ENDIF
+IF[{- !$disabled{'ocsp'} -}]
+  $OPENSSLSRC=$OPENSSLSRC ocsp.c
+ENDIF
+IF[{- !$disabled{'srp'} -}]
+  $OPENSSLSRC=$OPENSSLSRC srp.c
+ENDIF
+IF[{- !$disabled{'ts'} -}]
+  $OPENSSLSRC=$OPENSSLSRC ts.c
+ENDIF
+IF[{- !$disabled{'dh'} -}]
+$OPENSSLSRC=$OPENSSLSRC dhparam.c
+ENDIF
+IF[{- !$disabled{'dsa'} -}]
+$OPENSSLSRC=$OPENSSLSRC dsa.c dsaparam.c gendsa.c
+ENDIF
+IF[{- !$disabled{'engine'} -}]
+$OPENSSLSRC=$OPENSSLSRC engine.c
+ENDIF
+IF[{- !$disabled{'rsa'} -}]
+$OPENSSLSRC=$OPENSSLSRC rsa.c genrsa.c
+ENDIF
+IF[{- !$disabled{'cmp'} -}]
+  $OPENSSLSRC=$OPENSSLSRC cmp.c cmp_mock_srv.c
+ENDIF
+
+IF[{- !$disabled{apps} -}]
   PROGRAMS=openssl
-  SOURCE[openssl]={- join(" ", @apps_init_src) -}
-  SOURCE[openssl]={- join(" ", @apps_openssl_src) -}
-  INCLUDE[openssl]=.. ../include
+  SOURCE[openssl]=$INITSRC $OPENSSLSRC
+  INCLUDE[openssl]=.. ../include include
   DEPEND[openssl]=libapps.a ../libssl
 
-IF[{- $config{target} =~ /^(?:Cygwin|mingw|VC-)/ -}]
-  GENERATE[openssl.rc]=../util/mkrc.pl openssl
-  SOURCE[openssl]=openssl.rc
-ENDIF
+  DEPEND[${OPENSSLSRC/.c/.o}]=progs.h
+  GENERATE[progs.c]=progs.pl -C $(APPS_OPENSSL)
+  GENERATE[progs.h]=progs.pl -H $(APPS_OPENSSL)
+  # progs.pl tries to read all 'openssl' sources, including progs.c, so we make
+  # sure things are generated in the correct order.
+  DEPEND[progs.h]=progs.c
+  # Because the files to look through may change (depends on $OPENSSLSRC),
+  # always depend on a changed configuration.
+  DEPEND[progs.c]=../configdata.pm
 
-  {- join("\n  ", map { (my $x = $_) =~ s|\.c$|.o|; "DEPEND[$x]=progs.h" }
-                  @apps_openssl_src) -}
-  GENERATE[progs.h]=progs.pl $(APPS_OPENSSL)
-  DEPEND[progs.h]=../configdata.pm
+  IF[{- $config{target} =~ /^(?:Cygwin|mingw|VC-)/ -}]
+    GENERATE[openssl.rc]=../util/mkrc.pl openssl
+    SOURCE[openssl]=openssl.rc
+  ENDIF
 
-  SCRIPTS=CA.pl tsget.pl
+  SCRIPTS{misc}=CA.pl
   SOURCE[CA.pl]=CA.pl.in
+  # linkname tells build files that a symbolic link or copy of this script
+  # without extension must be installed as well.  Unix or Unix lookalike only.
+  SCRIPTS{misc,linkname=tsget}=tsget.pl
   SOURCE[tsget.pl]=tsget.in
 ENDIF

apps/ca.c

@@ -1,7 +1,7 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -34,6 +34,11 @@
 #include "apps.h"
 #include "progs.h"
 
+DEFINE_STACK_OF(X509)
+DEFINE_STACK_OF(X509_EXTENSION)
+DEFINE_STACK_OF(CONF_VALUE)
+DEFINE_STACK_OF_STRING()
+
 #ifndef W_OK
 # define F_OK 0
 # define W_OK 2
@@ -88,8 +93,11 @@ typedef enum {
 
 static char *lookup_conf(const CONF *conf, const char *group, const char *tag);
 
-static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
-                   const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+static int certify(X509 **xret, const char *infile, int informat,
+                   EVP_PKEY *pkey, X509 *x509,
+                   const EVP_MD *dgst,
+                   STACK_OF(OPENSSL_STRING) *sigopts,
+                   STACK_OF(OPENSSL_STRING) *vfyopts,
                    STACK_OF(CONF_VALUE) *policy, CA_DB *db,
                    BIGNUM *serial, const char *subj, unsigned long chtype,
                    int multirdn, int email_dn, const char *startdate,
@@ -97,8 +105,11 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
                    long days, int batch, const char *ext_sect, CONF *conf,
                    int verbose, unsigned long certopt, unsigned long nameopt,
                    int default_op, int ext_copy, int selfsign);
-static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
-                        const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+static int certify_cert(X509 **xret, const char *infile, int informat,
+                        EVP_PKEY *pkey, X509 *x509,
+                        const EVP_MD *dgst,
+                        STACK_OF(OPENSSL_STRING) *sigopts,
+                        STACK_OF(OPENSSL_STRING) *vfyopts,
                         STACK_OF(CONF_VALUE) *policy, CA_DB *db,
                         BIGNUM *serial, const char *subj, unsigned long chtype,
                         int multirdn, int email_dn, const char *startdate,
@@ -141,24 +152,49 @@ typedef enum OPTION_choice {
     OPT_ENGINE, OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SUBJ, OPT_UTF8,
     OPT_CREATE_SERIAL, OPT_MULTIVALUE_RDN, OPT_STARTDATE, OPT_ENDDATE,
     OPT_DAYS, OPT_MD, OPT_POLICY, OPT_KEYFILE, OPT_KEYFORM, OPT_PASSIN,
-    OPT_KEY, OPT_CERT, OPT_SELFSIGN, OPT_IN, OPT_OUT, OPT_OUTDIR,
+    OPT_KEY, OPT_CERT, OPT_CERTFORM, OPT_SELFSIGN,
+    OPT_IN, OPT_INFORM, OPT_OUT, OPT_OUTDIR, OPT_VFYOPT,
     OPT_SIGOPT, OPT_NOTEXT, OPT_BATCH, OPT_PRESERVEDN, OPT_NOEMAILDN,
     OPT_GENCRL, OPT_MSIE_HACK, OPT_CRLDAYS, OPT_CRLHOURS, OPT_CRLSEC,
     OPT_INFILES, OPT_SS_CERT, OPT_SPKAC, OPT_REVOKE, OPT_VALID,
     OPT_EXTENSIONS, OPT_EXTFILE, OPT_STATUS, OPT_UPDATEDB, OPT_CRLEXTS,
     OPT_RAND_SERIAL,
-    OPT_R_ENUM,
+    OPT_R_ENUM, OPT_PROV_ENUM,
     /* Do not change the order here; see related case statements below */
     OPT_CRL_REASON, OPT_CRL_HOLD, OPT_CRL_COMPROMISE, OPT_CRL_CA_COMPROMISE
 } OPTION_CHOICE;
 
 const OPTIONS ca_options[] = {
+    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [certreq...]\n"},
+
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
     {"verbose", OPT_VERBOSE, '-', "Verbose output during processing"},
+    {"outdir", OPT_OUTDIR, '/', "Where to put output cert"},
+    {"in", OPT_IN, '<', "The input cert request(s)"},
+    {"inform", OPT_INFORM, 'F', "CSR input format (DER or PEM); default PEM"},
+    {"infiles", OPT_INFILES, '-', "The last argument, requests to process"},
+    {"out", OPT_OUT, '>', "Where to put the output file(s)"},
+    {"notext", OPT_NOTEXT, '-', "Do not print the generated certificate"},
+    {"batch", OPT_BATCH, '-', "Don't ask questions"},
+    {"msie_hack", OPT_MSIE_HACK, '-',
+     "msie modifications to handle all Universal Strings"},
+    {"ss_cert", OPT_SS_CERT, '<', "File contains a self signed cert to sign"},
+    {"spkac", OPT_SPKAC, '<',
+     "File contains DN and signed public key and challenge"},
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+#endif
+
+    OPT_SECTION("Configuration"),
     {"config", OPT_CONFIG, 's', "A config file"},
     {"name", OPT_NAME, 's', "The particular CA definition to use"},
+    {"section", OPT_NAME, 's', "An alias for -name"},
+    {"policy", OPT_POLICY, 's', "The CA 'policy' to support"},
+
+    OPT_SECTION("Certificate"),
     {"subj", OPT_SUBJ, 's', "Use arg instead of request's subject"},
-    {"utf8", OPT_UTF8, '-', "Input characters are UTF8 (default ASCII)"},
+    {"utf8", OPT_UTF8, '-', "Input characters are UTF8; default ASCII"},
     {"create_serial", OPT_CREATE_SERIAL, '-',
      "If reading serial fails, create a new random serial"},
     {"rand_serial", OPT_RAND_SERIAL, '-',
@@ -169,40 +205,31 @@ const OPTIONS ca_options[] = {
     {"enddate", OPT_ENDDATE, 's',
      "YYMMDDHHMMSSZ cert notAfter (overrides -days)"},
     {"days", OPT_DAYS, 'p', "Number of days to certify the cert for"},
-    {"md", OPT_MD, 's', "md to use; one of md2, md5, sha or sha1"},
-    {"policy", OPT_POLICY, 's', "The CA 'policy' to support"},
-    {"keyfile", OPT_KEYFILE, 's', "Private key"},
-    {"keyform", OPT_KEYFORM, 'f', "Private key file format (PEM or ENGINE)"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"key", OPT_KEY, 's', "Key to decode the private key if it is encrypted"},
-    {"cert", OPT_CERT, '<', "The CA cert"},
-    {"selfsign", OPT_SELFSIGN, '-',
-     "Sign a cert with the key associated with it"},
-    {"in", OPT_IN, '<', "The input PEM encoded cert request(s)"},
-    {"out", OPT_OUT, '>', "Where to put the output file(s)"},
-    {"outdir", OPT_OUTDIR, '/', "Where to put output cert"},
-    {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
-    {"notext", OPT_NOTEXT, '-', "Do not print the generated certificate"},
-    {"batch", OPT_BATCH, '-', "Don't ask questions"},
-    {"preserveDN", OPT_PRESERVEDN, '-', "Don't re-order the DN"},
-    {"noemailDN", OPT_NOEMAILDN, '-', "Don't add the EMAIL field to the DN"},
-    {"gencrl", OPT_GENCRL, '-', "Generate a new CRL"},
-    {"msie_hack", OPT_MSIE_HACK, '-',
-     "msie modifications to handle all those universal strings"},
-    {"crldays", OPT_CRLDAYS, 'p', "Days until the next CRL is due"},
-    {"crlhours", OPT_CRLHOURS, 'p', "Hours until the next CRL is due"},
-    {"crlsec", OPT_CRLSEC, 'p', "Seconds until the next CRL is due"},
-    {"infiles", OPT_INFILES, '-', "The last argument, requests to process"},
-    {"ss_cert", OPT_SS_CERT, '<', "File contains a self signed cert to sign"},
-    {"spkac", OPT_SPKAC, '<',
-     "File contains DN and signed public key and challenge"},
-    {"revoke", OPT_REVOKE, '<', "Revoke a cert (given in file)"},
-    {"valid", OPT_VALID, 's',
-     "Add a Valid(not-revoked) DB entry about a cert (given in file)"},
     {"extensions", OPT_EXTENSIONS, 's',
      "Extension section (override value in config file)"},
     {"extfile", OPT_EXTFILE, '<',
      "Configuration file with X509v3 extensions to add"},
+    {"preserveDN", OPT_PRESERVEDN, '-', "Don't re-order the DN"},
+    {"noemailDN", OPT_NOEMAILDN, '-', "Don't add the EMAIL field to the DN"},
+
+    OPT_SECTION("Signing"),
+    {"md", OPT_MD, 's', "md to use; one of md2, md5, sha or sha1"},
+    {"keyfile", OPT_KEYFILE, 's', "Private key"},
+    {"keyform", OPT_KEYFORM, 'f', "Private key file format (ENGINE, other values ignored)"},
+    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
+    {"key", OPT_KEY, 's', "Key to decode the private key if it is encrypted"},
+    {"cert", OPT_CERT, '<', "The CA cert"},
+    {"certform", OPT_CERTFORM, 'F',
+     "certificate input format (DER/PEM/P12); has no effect"},
+    {"selfsign", OPT_SELFSIGN, '-',
+     "Sign a cert with the key associated with it"},
+    {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
+    {"vfyopt", OPT_SIGOPT, 's', "Verification parameter in n:v form"},
+
+    OPT_SECTION("Revocation"),
+    {"gencrl", OPT_GENCRL, '-', "Generate a new CRL"},
+    {"valid", OPT_VALID, 's',
+     "Add a Valid(not-revoked) DB entry about a cert (given in file)"},
     {"status", OPT_STATUS, 's', "Shows cert status given the serial number"},
     {"updatedb", OPT_UPDATEDB, '-', "Updates db for expired cert"},
     {"crlexts", OPT_CRLEXTS, 's',
@@ -214,10 +241,16 @@ const OPTIONS ca_options[] = {
      "sets compromise time to val and the revocation reason to keyCompromise"},
     {"crl_CA_compromise", OPT_CRL_CA_COMPROMISE, 's',
      "sets compromise time to val and the revocation reason to CACompromise"},
+    {"crldays", OPT_CRLDAYS, 'p', "Days until the next CRL is due"},
+    {"crlhours", OPT_CRLHOURS, 'p', "Hours until the next CRL is due"},
+    {"crlsec", OPT_CRLSEC, 'p', "Seconds until the next CRL is due"},
+    {"revoke", OPT_REVOKE, '<', "Revoke a cert (given in file)"},
+
     OPT_R_OPTIONS,
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
+    OPT_PROV_OPTIONS,
+
+    OPT_PARAMETERS(),
+    {"certreq", 0, 0, "Certificate requests to be signed (optional)"},
     {NULL}
 };
 
@@ -233,13 +266,14 @@ int ca_main(int argc, char **argv)
     CA_DB *db = NULL;
     DB_ATTR db_attr;
     STACK_OF(CONF_VALUE) *attribs = NULL;
-    STACK_OF(OPENSSL_STRING) *sigopts = NULL;
+    STACK_OF(OPENSSL_STRING) *sigopts = NULL, *vfyopts = NULL;
     STACK_OF(X509) *cert_sk = NULL;
     X509_CRL *crl = NULL;
     const EVP_MD *dgst = NULL;
     char *configfile = default_config_file, *section = NULL;
     char *md = NULL, *policy = NULL, *keyfile = NULL;
     char *certfile = NULL, *crl_ext = NULL, *crlnumberfile = NULL, *key = NULL;
+    int certformat = FORMAT_PEM, informat = FORMAT_PEM;
     const char *infile = NULL, *spkac_file = NULL, *ss_cert_file = NULL;
     const char *extensions = NULL, *extfile = NULL, *passinarg = NULL;
     char *outdir = NULL, *outfile = NULL, *rev_arg = NULL, *ser_status = NULL;
@@ -255,7 +289,7 @@ int ca_main(int argc, char **argv)
     int batch = 0, default_op = 1, doupdatedb = 0, ext_copy = EXT_COPY_NONE;
     int keyformat = FORMAT_PEM, multirdn = 0, notext = 0, output_der = 0;
     int ret = 1, email_dn = 1, req = 0, verbose = 0, gencrl = 0, dorevoke = 0;
-    int rand_ser = 0, i, j, selfsign = 0;
+    int rand_ser = 0, i, j, selfsign = 0, def_nid, def_ret;
     long crldays = 0, crlhours = 0, crlsec = 0, days = 0;
     unsigned long chtype = MBSTRING_ASC, certopt = 0;
     X509 *x509 = NULL, *x509p = NULL, *x = NULL;
@@ -279,6 +313,10 @@ opthelp:
             req = 1;
             infile = opt_arg();
             break;
+        case OPT_INFORM:
+            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &informat))
+                goto opthelp;
+            break;
         case OPT_OUT:
             outfile = opt_arg();
             break;
@@ -336,12 +374,20 @@ opthelp:
             if (!opt_rand(o))
                 goto end;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         case OPT_KEY:
             key = opt_arg();
             break;
         case OPT_CERT:
             certfile = opt_arg();
             break;
+        case OPT_CERTFORM:
+            if (!opt_format(opt_arg(), OPT_FMT_ANY, &certformat))
+                goto opthelp;
+            break;
         case OPT_SELFSIGN:
             selfsign = 1;
             break;
@@ -354,6 +400,12 @@ opthelp:
             if (sigopts == NULL || !sk_OPENSSL_STRING_push(sigopts, opt_arg()))
                 goto end;
             break;
+        case OPT_VFYOPT:
+            if (vfyopts == NULL)
+                vfyopts = sk_OPENSSL_STRING_new_null();
+            if (vfyopts == NULL || !sk_OPENSSL_STRING_push(vfyopts, opt_arg()))
+                goto end;
+            break;
         case OPT_NOTEXT:
             notext = 1;
             break;
@@ -521,8 +573,7 @@ end_of_options:
         }
     }
     pkey = load_key(keyfile, keyformat, 0, key, e, "CA private key");
-    if (key != NULL)
-        OPENSSL_cleanse(key, strlen(key));
+    cleanse(key);
     if (pkey == NULL)
         /* load_key() has already printed an appropriate message */
         goto end;
@@ -534,7 +585,7 @@ end_of_options:
             && (certfile = lookup_conf(conf, section, ENV_CERTIFICATE)) == NULL)
             goto end;
 
-        x509 = load_cert(certfile, FORMAT_PEM, "CA certificate");
+        x509 = load_cert(certfile, certformat, "CA certificate");
         if (x509 == NULL)
             goto end;
 
@@ -605,7 +656,7 @@ end_of_options:
         /*
          * outdir is a directory spec, but access() for VMS demands a
          * filename.  We could use the DEC C routine to convert the
-         * directory syntax to Unixly, and give that to app_isdir,
+         * directory syntax to Unix, and give that to app_isdir,
          * but for now the fopen will catch the error if it's not a
          * directory
          */
@@ -722,30 +773,34 @@ end_of_options:
 
     /*****************************************************************/
     if (req || gencrl) {
-        if (spkac_file != NULL) {
+        if (spkac_file != NULL && outfile != NULL) {
             output_der = 1;
             batch = 1;
         }
     }
 
-    if (md == NULL && (md = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL)
-        goto end;
-
-    if (strcmp(md, "null") == 0) {
+    def_ret = EVP_PKEY_get_default_digest_nid(pkey, &def_nid);
+    /*
+     * EVP_PKEY_get_default_digest_nid() returns 2 if the digest is
+     * mandatory for this algorithm.
+     */
+    if (def_ret == 2 && def_nid == NID_undef) {
+        /* The signing algorithm requires there to be no digest */
         dgst = EVP_md_null();
+    } else if (md == NULL
+               && (md = lookup_conf(conf, section, ENV_DEFAULT_MD)) == NULL) {
+        goto end;
     } else {
         if (strcmp(md, "default") == 0) {
-            int def_nid;
-            if (EVP_PKEY_get_default_digest_nid(pkey, &def_nid) <= 0) {
+            if (def_ret <= 0) {
                 BIO_puts(bio_err, "no default digest\n");
                 goto end;
             }
             md = (char *)OBJ_nid2sn(def_nid);
         }
 
-        if (!opt_md(md, &dgst)) {
+        if (!opt_md(md, &dgst))
             goto end;
-        }
     }
 
     if (req) {
@@ -885,8 +940,8 @@ end_of_options:
         }
         if (ss_cert_file != NULL) {
             total++;
-            j = certify_cert(&x, ss_cert_file, pkey, x509, dgst, sigopts,
-                             attribs,
+            j = certify_cert(&x, ss_cert_file, certformat, pkey, x509, dgst,
+                             sigopts, vfyopts, attribs,
                              db, serial, subj, chtype, multirdn, email_dn,
                              startdate, enddate, days, batch, extensions,
                              conf, verbose, certopt, get_nameopt(), default_op,
@@ -906,7 +961,8 @@ end_of_options:
         }
         if (infile != NULL) {
             total++;
-            j = certify(&x, infile, pkey, x509p, dgst, sigopts, attribs, db,
+            j = certify(&x, infile, informat, pkey, x509p, dgst,
+                        sigopts, vfyopts, attribs, db,
                         serial, subj, chtype, multirdn, email_dn, startdate,
                         enddate, days, batch, extensions, conf, verbose,
                         certopt, get_nameopt(), default_op, ext_copy, selfsign);
@@ -925,7 +981,9 @@ end_of_options:
         }
         for (i = 0; i < argc; i++) {
             total++;
-            j = certify(&x, argv[i], pkey, x509p, dgst, sigopts, attribs, db,
+            j = certify(&x, argv[i], informat, pkey, x509p, dgst,
+                        sigopts, vfyopts,
+                        attribs, db,
                         serial, subj, chtype, multirdn, email_dn, startdate,
                         enddate, days, batch, extensions, conf, verbose,
                         certopt, get_nameopt(), default_op, ext_copy, selfsign);
@@ -972,7 +1030,7 @@ end_of_options:
             BIO_printf(bio_err, "Write out database with %d new entries\n",
                        sk_X509_num(cert_sk));
 
-            if (!rand_ser
+            if (serialfile != NULL
                     && !save_serial(serialfile, "new", serial, NULL))
                 goto end;
 
@@ -1040,7 +1098,8 @@ end_of_options:
 
         if (sk_X509_num(cert_sk)) {
             /* Rename the database and the serial file */
-            if (!rotate_serial(serialfile, "new", "old"))
+            if (serialfile != NULL
+                    && !rotate_serial(serialfile, "new", "old"))
                 goto end;
 
             if (!rotate_index(dbfile, "new", "old"))
@@ -1173,10 +1232,9 @@ end_of_options:
         }
 
         /* we have a CRL number that need updating */
-        if (crlnumberfile != NULL)
-            if (!rand_ser
-                    && !save_serial(crlnumberfile, "new", crlnumber, NULL))
-                goto end;
+        if (crlnumberfile != NULL
+                && !save_serial(crlnumberfile, "new", crlnumber, NULL))
+            goto end;
 
         BN_free(crlnumber);
         crlnumber = NULL;
@@ -1191,9 +1249,10 @@ end_of_options:
 
         PEM_write_bio_X509_CRL(Sout, crl);
 
-        if (crlnumberfile != NULL) /* Rename the crlnumber file */
-            if (!rotate_serial(crlnumberfile, "new", "old"))
-                goto end;
+        /* Rename the crlnumber file */
+        if (crlnumberfile != NULL
+                && !rotate_serial(crlnumberfile, "new", "old"))
+            goto end;
 
     }
     /*****************************************************************/
@@ -1203,7 +1262,7 @@ end_of_options:
             goto end;
         } else {
             X509 *revcert;
-            revcert = load_cert(infile, FORMAT_PEM, infile);
+            revcert = load_cert(infile, certformat, infile);
             if (revcert == NULL)
                 goto end;
             if (dorevoke == 2)
@@ -1238,6 +1297,7 @@ end_of_options:
     BN_free(crlnumber);
     free_index(db);
     sk_OPENSSL_STRING_free(sigopts);
+    sk_OPENSSL_STRING_free(vfyopts);
     EVP_PKEY_free(pkey);
     X509_free(x509);
     X509_CRL_free(crl);
@@ -1255,8 +1315,11 @@ static char *lookup_conf(const CONF *conf, const char *section, const char *tag)
     return entry;
 }
 
-static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
-                   const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+static int certify(X509 **xret, const char *infile, int informat,
+                   EVP_PKEY *pkey, X509 *x509,
+                   const EVP_MD *dgst,
+                   STACK_OF(OPENSSL_STRING) *sigopts,
+                   STACK_OF(OPENSSL_STRING) *vfyopts,
                    STACK_OF(CONF_VALUE) *policy, CA_DB *db,
                    BIGNUM *serial, const char *subj, unsigned long chtype,
                    int multirdn, int email_dn, const char *startdate,
@@ -1266,20 +1329,12 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
                    int default_op, int ext_copy, int selfsign)
 {
     X509_REQ *req = NULL;
-    BIO *in = NULL;
     EVP_PKEY *pktmp = NULL;
     int ok = -1, i;
 
-    in = BIO_new_file(infile, "r");
-    if (in == NULL) {
-        ERR_print_errors(bio_err);
+    req = load_csr(infile, informat, "certificate request");
+    if (req == NULL)
         goto end;
-    }
-    if ((req = PEM_read_bio_X509_REQ(in, NULL, NULL, NULL)) == NULL) {
-        BIO_printf(bio_err, "Error reading certificate request in %s\n",
-                   infile);
-        goto end;
-    }
     if (verbose)
         X509_REQ_print_ex(bio_err, req, nameopt, X509_FLAG_COMPAT);
 
@@ -1295,7 +1350,7 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
         BIO_printf(bio_err, "error unpacking public key\n");
         goto end;
     }
-    i = X509_REQ_verify(req, pktmp);
+    i = do_X509_REQ_verify(req, pktmp, vfyopts);
     pktmp = NULL;
     if (i < 0) {
         ok = 0;
@@ -1320,12 +1375,14 @@ static int certify(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
 
  end:
     X509_REQ_free(req);
-    BIO_free(in);
     return ok;
 }
 
-static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x509,
-                        const EVP_MD *dgst, STACK_OF(OPENSSL_STRING) *sigopts,
+static int certify_cert(X509 **xret, const char *infile, int certformat,
+                        EVP_PKEY *pkey, X509 *x509,
+                        const EVP_MD *dgst,
+                        STACK_OF(OPENSSL_STRING) *sigopts,
+                        STACK_OF(OPENSSL_STRING) *vfyopts,
                         STACK_OF(CONF_VALUE) *policy, CA_DB *db,
                         BIGNUM *serial, const char *subj, unsigned long chtype,
                         int multirdn, int email_dn, const char *startdate,
@@ -1338,7 +1395,7 @@ static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x
     EVP_PKEY *pktmp = NULL;
     int ok = -1, i;
 
-    if ((req = load_cert(infile, FORMAT_PEM, infile)) == NULL)
+    if ((req = load_cert(infile, certformat, infile)) == NULL)
         goto end;
     if (verbose)
         X509_print(bio_err, req);
@@ -1349,7 +1406,7 @@ static int certify_cert(X509 **xret, const char *infile, EVP_PKEY *pkey, X509 *x
         BIO_printf(bio_err, "error unpacking public key\n");
         goto end;
     }
-    i = X509_verify(req, pktmp);
+    i = do_X509_verify(req, pktmp, vfyopts);
     if (i < 0) {
         ok = 0;
         BIO_printf(bio_err, "Signature verification problems....\n");
@@ -1386,7 +1443,8 @@ static int do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509,
                    CONF *lconf, unsigned long certopt, unsigned long nameopt,
                    int default_op, int ext_copy, int selfsign)
 {
-    X509_NAME *name = NULL, *CAname = NULL, *subject = NULL;
+    const X509_NAME *name = NULL;
+    X509_NAME *CAname = NULL, *subject = NULL;
     const ASN1_TIME *tm;
     ASN1_STRING *str, *str2;
     ASN1_OBJECT *obj;

apps/ciphers.c

@@ -1,7 +1,7 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -15,6 +15,8 @@
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 
+DEFINE_STACK_OF_CONST(SSL_CIPHER)
+
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_STDNAME,
@@ -27,39 +29,50 @@ typedef enum OPTION_choice {
     OPT_PSK,
     OPT_SRP,
     OPT_CIPHERSUITES,
-    OPT_V, OPT_UPPER_V, OPT_S
+    OPT_V, OPT_UPPER_V, OPT_S, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS ciphers_options[] = {
+    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [cipher]\n"},
+
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
+
+    OPT_SECTION("Output"),
     {"v", OPT_V, '-', "Verbose listing of the SSL/TLS ciphers"},
     {"V", OPT_UPPER_V, '-', "Even more verbose"},
+    {"stdname", OPT_STDNAME, '-', "Show standard cipher names"},
+    {"convert", OPT_CONVERT, 's', "Convert standard name into OpenSSL name"},
+
+    OPT_SECTION("Cipher specification"),
     {"s", OPT_S, '-', "Only supported ciphers"},
 #ifndef OPENSSL_NO_SSL3
-    {"ssl3", OPT_SSL3, '-', "SSL3 mode"},
+    {"ssl3", OPT_SSL3, '-', "Ciphers compatible with SSL3"},
 #endif
 #ifndef OPENSSL_NO_TLS1
-    {"tls1", OPT_TLS1, '-', "TLS1 mode"},
+    {"tls1", OPT_TLS1, '-', "Ciphers compatible with TLS1"},
 #endif
 #ifndef OPENSSL_NO_TLS1_1
-    {"tls1_1", OPT_TLS1_1, '-', "TLS1.1 mode"},
+    {"tls1_1", OPT_TLS1_1, '-', "Ciphers compatible with TLS1.1"},
 #endif
 #ifndef OPENSSL_NO_TLS1_2
-    {"tls1_2", OPT_TLS1_2, '-', "TLS1.2 mode"},
+    {"tls1_2", OPT_TLS1_2, '-', "Ciphers compatible with TLS1.2"},
 #endif
 #ifndef OPENSSL_NO_TLS1_3
-    {"tls1_3", OPT_TLS1_3, '-', "TLS1.3 mode"},
+    {"tls1_3", OPT_TLS1_3, '-', "Ciphers compatible with TLS1.3"},
 #endif
-    {"stdname", OPT_STDNAME, '-', "Show standard cipher names"},
 #ifndef OPENSSL_NO_PSK
-    {"psk", OPT_PSK, '-', "include ciphersuites requiring PSK"},
+    {"psk", OPT_PSK, '-', "Include ciphersuites requiring PSK"},
 #endif
 #ifndef OPENSSL_NO_SRP
-    {"srp", OPT_SRP, '-', "include ciphersuites requiring SRP"},
+    {"srp", OPT_SRP, '-', "Include ciphersuites requiring SRP"},
 #endif
-    {"convert", OPT_CONVERT, 's', "Convert standard name into OpenSSL name"},
     {"ciphersuites", OPT_CIPHERSUITES, 's',
      "Configure the TLSv1.3 ciphersuites to use"},
+    OPT_PROV_OPTIONS,
+
+    OPT_PARAMETERS(),
+    {"cipher", 0, 0, "Cipher string to decode (optional)"},
     {NULL}
 };
 
@@ -159,6 +172,10 @@ int ciphers_main(int argc, char **argv)
         case OPT_CIPHERSUITES:
             ciphersuites = opt_arg();
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         }
     }
     argv = opt_rest();
@@ -247,7 +264,7 @@ int ciphers_main(int argc, char **argv)
                 const char *nm = SSL_CIPHER_standard_name(c);
                 if (nm == NULL)
                     nm = "UNKNOWN";
-                BIO_printf(bio_out, "%s - ", nm);
+                BIO_printf(bio_out, "%-45s - ", nm);
             }
             BIO_puts(bio_out, SSL_CIPHER_description(c, buf, sizeof(buf)));
         }

apps/cmp.c

@@ -0,0 +1,3192 @@
+/*
+ * Copyright 2007-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright Nokia 2007-2019
+ * Copyright Siemens AG 2015-2019
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <string.h>
+#include <ctype.h>
+
+#include "apps.h"
+#include "http_server.h"
+#include "s_apps.h"
+#include "progs.h"
+
+#include "cmp_mock_srv.h"
+
+/* tweaks needed due to missing unistd.h on Windows */
+#ifdef _WIN32
+# define access _access
+#endif
+#ifndef F_OK
+# define F_OK 0
+#endif
+
+#include <openssl/ui.h>
+#include <openssl/pkcs12.h>
+#include <openssl/ssl.h>
+
+/* explicit #includes not strictly needed since implied by the above: */
+#include <stdlib.h>
+#include <openssl/cmp.h>
+#include <openssl/cmp_util.h>
+#include <openssl/crmf.h>
+#include <openssl/crypto.h>
+#include <openssl/err.h>
+#include <openssl/store.h>
+#include <openssl/objects.h>
+#include <openssl/x509.h>
+
+DEFINE_STACK_OF(X509)
+DEFINE_STACK_OF(X509_EXTENSION)
+DEFINE_STACK_OF(OSSL_CMP_ITAV)
+
+static char *opt_config = NULL;
+#define CMP_SECTION "cmp"
+#define SECTION_NAME_MAX 40 /* max length of section name */
+#define DEFAULT_SECTION "default"
+static char *opt_section = CMP_SECTION;
+
+#undef PROG
+#define PROG cmp_main
+static char *prog = "cmp";
+
+static int read_config(void);
+
+static CONF *conf = NULL; /* OpenSSL config file context structure */
+static OSSL_CMP_CTX *cmp_ctx = NULL; /* the client-side CMP context */
+
+/* the type of cmp command we want to send */
+typedef enum {
+    CMP_IR,
+    CMP_KUR,
+    CMP_CR,
+    CMP_P10CR,
+    CMP_RR,
+    CMP_GENM
+} cmp_cmd_t;
+
+/* message transfer */
+static char *opt_server = NULL;
+static char server_port_s[32] = { '\0' };
+static int server_port = 0;
+static char *opt_proxy = NULL;
+static char *opt_no_proxy = NULL;
+static char *opt_path = "/";
+static int opt_msg_timeout = -1;
+static int opt_total_timeout = -1;
+
+/* server authentication */
+static char *opt_trusted = NULL;
+static char *opt_untrusted = NULL;
+static char *opt_srvcert = NULL;
+static char *opt_recipient = NULL;
+static char *opt_expect_sender = NULL;
+static int opt_ignore_keyusage = 0;
+static int opt_unprotected_errors = 0;
+static char *opt_extracertsout = NULL;
+static char *opt_cacertsout = NULL;
+
+/* client authentication */
+static char *opt_ref = NULL;
+static char *opt_secret = NULL;
+static char *opt_cert = NULL;
+static char *opt_key = NULL;
+static char *opt_keypass = NULL;
+static char *opt_digest = NULL;
+static char *opt_mac = NULL;
+static char *opt_extracerts = NULL;
+static int opt_unprotected_requests = 0;
+
+/* generic message */
+static char *opt_cmd_s = NULL;
+static int opt_cmd = -1;
+static char *opt_geninfo = NULL;
+static char *opt_infotype_s = NULL;
+static int opt_infotype = NID_undef;
+
+/* certificate enrollment */
+static char *opt_newkey = NULL;
+static char *opt_newkeypass = NULL;
+static char *opt_subject = NULL;
+static char *opt_issuer = NULL;
+static int opt_days = 0;
+static char *opt_reqexts = NULL;
+static char *opt_sans = NULL;
+static int opt_san_nodefault = 0;
+static char *opt_policies = NULL;
+static char *opt_policy_oids = NULL;
+static int opt_policy_oids_critical = 0;
+static int opt_popo = OSSL_CRMF_POPO_NONE - 1;
+static char *opt_csr = NULL;
+static char *opt_out_trusted = NULL;
+static int opt_implicit_confirm = 0;
+static int opt_disable_confirm = 0;
+static char *opt_certout = NULL;
+
+/* certificate enrollment and revocation */
+static char *opt_oldcert = NULL;
+static int opt_revreason = CRL_REASON_NONE;
+
+/* credentials format */
+static char *opt_certform_s = "PEM";
+static int opt_certform = FORMAT_PEM;
+static char *opt_keyform_s = "PEM";
+static int opt_keyform = FORMAT_PEM;
+static char *opt_certsform_s = "PEM";
+static int opt_certsform = FORMAT_PEM;
+static char *opt_otherpass = NULL;
+static char *opt_engine = NULL;
+
+/* TLS connection */
+static int opt_tls_used = 0;
+static char *opt_tls_cert = NULL;
+static char *opt_tls_key = NULL;
+static char *opt_tls_keypass = NULL;
+static char *opt_tls_extra = NULL;
+static char *opt_tls_trusted = NULL;
+static char *opt_tls_host = NULL;
+
+/* client-side debugging */
+static int opt_batch = 0;
+static int opt_repeat = 1;
+static char *opt_reqin = NULL;
+static int opt_reqin_new_tid = 0;
+static char *opt_reqout = NULL;
+static char *opt_rspin = NULL;
+static char *opt_rspout = NULL;
+static int opt_use_mock_srv = 0;
+
+/* server-side debugging */
+static char *opt_port = NULL;
+static int opt_max_msgs = 0;
+
+static char *opt_srv_ref = NULL;
+static char *opt_srv_secret = NULL;
+static char *opt_srv_cert = NULL;
+static char *opt_srv_key = NULL;
+static char *opt_srv_keypass = NULL;
+
+static char *opt_srv_trusted = NULL;
+static char *opt_srv_untrusted = NULL;
+static char *opt_rsp_cert = NULL;
+static char *opt_rsp_extracerts = NULL;
+static char *opt_rsp_capubs = NULL;
+static int opt_poll_count = 0;
+static int opt_check_after = 1;
+static int opt_grant_implicitconf = 0;
+
+static int opt_pkistatus = OSSL_CMP_PKISTATUS_accepted;
+static int opt_failure = INT_MIN;
+static int opt_failurebits = 0;
+static char *opt_statusstring = NULL;
+static int opt_send_error = 0;
+static int opt_send_unprotected = 0;
+static int opt_send_unprot_err = 0;
+static int opt_accept_unprotected = 0;
+static int opt_accept_unprot_err = 0;
+static int opt_accept_raverified = 0;
+
+static X509_VERIFY_PARAM *vpm = NULL;
+
+typedef enum OPTION_choice {
+    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
+    OPT_CONFIG, OPT_SECTION,
+
+    OPT_CMD, OPT_INFOTYPE, OPT_GENINFO,
+
+    OPT_NEWKEY, OPT_NEWKEYPASS, OPT_SUBJECT, OPT_ISSUER,
+    OPT_DAYS, OPT_REQEXTS,
+    OPT_SANS, OPT_SAN_NODEFAULT,
+    OPT_POLICIES, OPT_POLICY_OIDS, OPT_POLICY_OIDS_CRITICAL,
+    OPT_POPO, OPT_CSR,
+    OPT_OUT_TRUSTED, OPT_IMPLICIT_CONFIRM, OPT_DISABLE_CONFIRM,
+    OPT_CERTOUT,
+
+    OPT_OLDCERT, OPT_REVREASON,
+
+    OPT_SERVER, OPT_PROXY, OPT_NO_PROXY, OPT_PATH,
+    OPT_MSG_TIMEOUT, OPT_TOTAL_TIMEOUT,
+
+    OPT_TRUSTED, OPT_UNTRUSTED, OPT_SRVCERT,
+    OPT_RECIPIENT, OPT_EXPECT_SENDER,
+    OPT_IGNORE_KEYUSAGE, OPT_UNPROTECTED_ERRORS,
+    OPT_EXTRACERTSOUT, OPT_CACERTSOUT,
+
+    OPT_REF, OPT_SECRET, OPT_CERT, OPT_KEY, OPT_KEYPASS,
+    OPT_DIGEST, OPT_MAC, OPT_EXTRACERTS,
+    OPT_UNPROTECTED_REQUESTS,
+
+    OPT_CERTFORM, OPT_KEYFORM, OPT_CERTSFORM,
+    OPT_OTHERPASS,
+#ifndef OPENSSL_NO_ENGINE
+    OPT_ENGINE,
+#endif
+    OPT_PROV_ENUM,
+
+    OPT_TLS_USED, OPT_TLS_CERT, OPT_TLS_KEY,
+    OPT_TLS_KEYPASS,
+    OPT_TLS_EXTRA, OPT_TLS_TRUSTED, OPT_TLS_HOST,
+
+    OPT_BATCH, OPT_REPEAT,
+    OPT_REQIN, OPT_REQIN_NEW_TID, OPT_REQOUT, OPT_RSPIN, OPT_RSPOUT,
+
+    OPT_USE_MOCK_SRV, OPT_PORT, OPT_MAX_MSGS,
+    OPT_SRV_REF, OPT_SRV_SECRET,
+    OPT_SRV_CERT, OPT_SRV_KEY, OPT_SRV_KEYPASS,
+    OPT_SRV_TRUSTED, OPT_SRV_UNTRUSTED,
+    OPT_RSP_CERT, OPT_RSP_EXTRACERTS, OPT_RSP_CAPUBS,
+    OPT_POLL_COUNT, OPT_CHECK_AFTER,
+    OPT_GRANT_IMPLICITCONF,
+    OPT_PKISTATUS, OPT_FAILURE,
+    OPT_FAILUREBITS, OPT_STATUSSTRING,
+    OPT_SEND_ERROR, OPT_SEND_UNPROTECTED,
+    OPT_SEND_UNPROT_ERR, OPT_ACCEPT_UNPROTECTED,
+    OPT_ACCEPT_UNPROT_ERR, OPT_ACCEPT_RAVERIFIED,
+
+    OPT_V_ENUM
+} OPTION_CHOICE;
+
+const OPTIONS cmp_options[] = {
+    /* entries must be in the same order as enumerated above!! */
+    {"help", OPT_HELP, '-', "Display this summary"},
+    {"config", OPT_CONFIG, 's',
+     "Configuration file to use. \"\" = none. Default from env variable OPENSSL_CONF"},
+    {"section", OPT_SECTION, 's',
+     "Section(s) in config file to get options from. \"\" = 'default'. Default 'cmp'"},
+
+    OPT_SECTION("Generic message"),
+    {"cmd", OPT_CMD, 's', "CMP request to send: ir/cr/kur/p10cr/rr/genm"},
+    {"infotype", OPT_INFOTYPE, 's',
+     "InfoType name for requesting specific info in genm, e.g. 'signKeyPairTypes'"},
+    {"geninfo", OPT_GENINFO, 's',
+     "generalInfo integer values to place in request PKIHeader with given OID"},
+    {OPT_MORE_STR, 0, 0,
+     "specified in the form <OID>:int:<n>, e.g. \"1.2.3:int:987\""},
+
+    OPT_SECTION("Certificate enrollment"),
+    {"newkey", OPT_NEWKEY, 's',
+     "Private or public key for the requested cert. Default: CSR key or client key"},
+    {"newkeypass", OPT_NEWKEYPASS, 's', "New private key pass phrase source"},
+    {"subject", OPT_SUBJECT, 's',
+     "Distinguished Name (DN) of subject to use in the requested cert template"},
+    {OPT_MORE_STR, 0, 0,
+     "For kur, default is the subject DN of the reference cert (see -oldcert);"},
+    {OPT_MORE_STR, 0, 0,
+     "this default is used for ir and cr only if no Subject Alt Names are set"},
+    {"issuer", OPT_ISSUER, 's',
+     "DN of the issuer to place in the requested certificate template"},
+    {OPT_MORE_STR, 0, 0,
+     "also used as recipient if neither -recipient nor -srvcert are given"},
+    {"days", OPT_DAYS, 'n',
+     "Requested validity time of the new certificate in number of days"},
+    {"reqexts", OPT_REQEXTS, 's',
+     "Name of config file section defining certificate request extensions"},
+    {"sans", OPT_SANS, 's',
+     "Subject Alt Names (IPADDR/DNS/URI) to add as (critical) cert req extension"},
+    {"san_nodefault", OPT_SAN_NODEFAULT, '-',
+     "Do not take default SANs from reference certificate (see -oldcert)"},
+    {"policies", OPT_POLICIES, 's',
+     "Name of config file section defining policies certificate request extension"},
+    {"policy_oids", OPT_POLICY_OIDS, 's',
+     "Policy OID(s) to add as policies certificate request extension"},
+    {"policy_oids_critical", OPT_POLICY_OIDS_CRITICAL, '-',
+     "Flag the policy OID(s) given with -policy_oids as critical"},
+    {"popo", OPT_POPO, 'n',
+     "Proof-of-Possession (POPO) method to use for ir/cr/kur where"},
+    {OPT_MORE_STR, 0, 0,
+     "-1 = NONE, 0 = RAVERIFIED, 1 = SIGNATURE (default), 2 = KEYENC"},
+    {"csr", OPT_CSR, 's',
+     "CSR file in PKCS#10 format to use in p10cr for legacy support"},
+    {"out_trusted", OPT_OUT_TRUSTED, 's',
+     "Certificates to trust when verifying newly enrolled certificates"},
+    {"implicit_confirm", OPT_IMPLICIT_CONFIRM, '-',
+     "Request implicit confirmation of newly enrolled certificates"},
+    {"disable_confirm", OPT_DISABLE_CONFIRM, '-',
+     "Do not confirm newly enrolled certificate w/o requesting implicit"},
+    {OPT_MORE_STR, 0, 0,
+     "confirmation. WARNING: This leads to behavior violating RFC 4210"},
+    {"certout", OPT_CERTOUT, 's',
+     "File to save newly enrolled certificate"},
+
+    OPT_SECTION("Certificate enrollment and revocation"),
+
+    {"oldcert", OPT_OLDCERT, 's',
+     "Certificate to be updated (defaulting to -cert) or to be revoked in rr;"},
+    {OPT_MORE_STR, 0, 0,
+     "also used as reference (defaulting to -cert) for subject DN and SANs."},
+    {OPT_MORE_STR, 0, 0,
+     "Its issuer is used as recipient unless -srvcert, -recipient or -issuer given"},
+    {"revreason", OPT_REVREASON, 'n',
+     "Reason code to include in revocation request (rr); possible values:"},
+    {OPT_MORE_STR, 0, 0,
+     "0..6, 8..10 (see RFC5280, 5.3.1) or -1. Default -1 = none included"},
+
+    OPT_SECTION("Message transfer"),
+    {"server", OPT_SERVER, 's',
+     "[http[s]://]address[:port] of CMP server. Default port 80 or 443."},
+    {OPT_MORE_STR, 0, 0,
+     "The address may be a DNS name or an IP address"},
+    {"proxy", OPT_PROXY, 's',
+     "[http[s]://]address[:port][/path] of HTTP(S) proxy to use; path is ignored"},
+    {"no_proxy", OPT_NO_PROXY, 's',
+     "List of addresses of servers not to use HTTP(S) proxy for"},
+    {OPT_MORE_STR, 0, 0,
+     "Default from environment variable 'no_proxy', else 'NO_PROXY', else none"},
+    {"path", OPT_PATH, 's',
+     "HTTP path (aka CMP alias) at the CMP server. Default \"/\""},
+    {"msg_timeout", OPT_MSG_TIMEOUT, 'n',
+     "Timeout per CMP message round trip (or 0 for none). Default 120 seconds"},
+    {"total_timeout", OPT_TOTAL_TIMEOUT, 'n',
+     "Overall time an enrollment incl. polling may take. Default 0 = infinite"},
+
+    OPT_SECTION("Server authentication"),
+    {"trusted", OPT_TRUSTED, 's',
+     "Certificates to trust as chain roots when verifying signed CMP responses"},
+    {OPT_MORE_STR, 0, 0, "unless -srvcert is given"},
+    {"untrusted", OPT_UNTRUSTED, 's',
+     "Intermediate CA certs for chain construction for CMP/TLS/enrolled certs"},
+    {"srvcert", OPT_SRVCERT, 's',
+     "Server cert to pin and trust directly when verifying signed CMP responses"},
+    {"recipient", OPT_RECIPIENT, 's',
+     "Distinguished Name (DN) to use as msg recipient; see man page for defaults"},
+    {"expect_sender", OPT_EXPECT_SENDER, 's',
+     "DN of expected sender of responses. Defaults to subject of -srvcert, if any"},
+    {"ignore_keyusage", OPT_IGNORE_KEYUSAGE, '-',
+     "Ignore CMP signer cert key usage, else 'digitalSignature' must be allowed"},
+    {"unprotected_errors", OPT_UNPROTECTED_ERRORS, '-',
+     "Accept missing or invalid protection of regular error messages and negative"},
+    {OPT_MORE_STR, 0, 0,
+     "certificate responses (ip/cp/kup), revocation responses (rp), and PKIConf"},
+    {OPT_MORE_STR, 0, 0,
+     "WARNING: This setting leads to behavior allowing violation of RFC 4210"},
+    {"extracertsout", OPT_EXTRACERTSOUT, 's',
+     "File to save extra certificates received in the extraCerts field"},
+    {"cacertsout", OPT_CACERTSOUT, 's',
+     "File to save CA certificates received in the caPubs field of 'ip' messages"},
+
+    OPT_SECTION("Client authentication"),
+    {"ref", OPT_REF, 's',
+     "Reference value to use as senderKID in case no -cert is given"},
+    {"secret", OPT_SECRET, 's',
+     "Password source for client authentication with a pre-shared key (secret)"},
+    {"cert", OPT_CERT, 's',
+     "Client's current certificate (needed unless using -secret for PBM);"},
+    {OPT_MORE_STR, 0, 0,
+     "any further certs included are appended in extraCerts field"},
+    {"key", OPT_KEY, 's', "Private key for the client's current certificate"},
+    {"keypass", OPT_KEYPASS, 's',
+     "Client private key (and cert and old cert file) pass phrase source"},
+    {"digest", OPT_DIGEST, 's',
+     "Digest to use in message protection and POPO signatures. Default \"sha256\""},
+    {"mac", OPT_MAC, 's',
+     "MAC algorithm to use in PBM-based message protection. Default \"hmac-sha1\""},
+    {"extracerts", OPT_EXTRACERTS, 's',
+     "Certificates to append in extraCerts field of outgoing messages"},
+    {"unprotected_requests", OPT_UNPROTECTED_REQUESTS, '-',
+     "Send messages without CMP-level protection"},
+
+    OPT_SECTION("Credentials format"),
+    {"certform", OPT_CERTFORM, 's',
+     "Format (PEM or DER) to use when saving a certificate to a file. Default PEM"},
+    {OPT_MORE_STR, 0, 0,
+     "This also determines format to use for writing (not supported for P12)"},
+    {"keyform", OPT_KEYFORM, 's',
+     "Format to assume when reading key files. Default PEM"},
+    {"certsform", OPT_CERTSFORM, 's',
+     "Format (PEM/DER/P12) to try first reading multiple certs. Default PEM"},
+    {"otherpass", OPT_OTHERPASS, 's',
+     "Pass phrase source potentially needed for loading certificates of others"},
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's',
+     "Use crypto engine with given identifier, possibly a hardware device."},
+    {OPT_MORE_STR, 0, 0,
+     "Engines may be defined in OpenSSL config file engine section."},
+    {OPT_MORE_STR, 0, 0,
+     "Options like -key specifying keys held in the engine can give key IDs"},
+    {OPT_MORE_STR, 0, 0,
+     "prefixed by 'engine:', e.g. '-key engine:pkcs11:object=mykey;pin-value=1234'"},
+#endif
+    OPT_PROV_OPTIONS,
+
+    OPT_SECTION("TLS connection"),
+    {"tls_used", OPT_TLS_USED, '-',
+     "Enable using TLS (also when other TLS options are not set)"},
+    {"tls_cert", OPT_TLS_CERT, 's',
+     "Client's TLS certificate. May include chain to be provided to TLS server"},
+    {"tls_key", OPT_TLS_KEY, 's',
+     "Private key for the client's TLS certificate"},
+    {"tls_keypass", OPT_TLS_KEYPASS, 's',
+     "Pass phrase source for the client's private TLS key (and TLS cert file)"},
+    {"tls_extra", OPT_TLS_EXTRA, 's',
+     "Extra certificates to provide to TLS server during TLS handshake"},
+    {"tls_trusted", OPT_TLS_TRUSTED, 's',
+     "Trusted certificates to use for verifying the TLS server certificate;"},
+    {OPT_MORE_STR, 0, 0, "this implies host name validation"},
+    {"tls_host", OPT_TLS_HOST, 's',
+     "Address to be checked (rather than -server) during TLS host name validation"},
+
+    OPT_SECTION("Client-side debugging"),
+    {"batch", OPT_BATCH, '-',
+     "Do not interactively prompt for input when a password is required etc."},
+    {"repeat", OPT_REPEAT, 'n',
+     "Invoke the transaction the given number of times. Default 1"},
+    {"reqin", OPT_REQIN, 's', "Take sequence of CMP requests from file(s)"},
+    {"reqin_new_tid", OPT_REQIN_NEW_TID, '-',
+     "Use fresh transactionID for CMP requests read from -reqin"},
+    {"reqout", OPT_REQOUT, 's', "Save sequence of CMP requests to file(s)"},
+    {"rspin", OPT_RSPIN, 's',
+     "Process sequence of CMP responses provided in file(s), skipping server"},
+    {"rspout", OPT_RSPOUT, 's', "Save sequence of CMP responses to file(s)"},
+
+    {"use_mock_srv", OPT_USE_MOCK_SRV, '-', "Use mock server at API level, bypassing HTTP"},
+
+    OPT_SECTION("Mock server"),
+    {"port", OPT_PORT, 's', "Act as HTTP mock server listening on given port"},
+    {"max_msgs", OPT_MAX_MSGS, 'n',
+     "max number of messages handled by HTTP mock server. Default: 0 = unlimited"},
+
+    {"srv_ref", OPT_SRV_REF, 's',
+     "Reference value to use as senderKID of server in case no -srv_cert is given"},
+    {"srv_secret", OPT_SRV_SECRET, 's',
+     "Password source for server authentication with a pre-shared key (secret)"},
+    {"srv_cert", OPT_SRV_CERT, 's', "Certificate of the server"},
+    {"srv_key", OPT_SRV_KEY, 's',
+     "Private key used by the server for signing messages"},
+    {"srv_keypass", OPT_SRV_KEYPASS, 's',
+     "Server private key (and cert) file pass phrase source"},
+
+    {"srv_trusted", OPT_SRV_TRUSTED, 's',
+     "Trusted certificates for client authentication"},
+    {"srv_untrusted", OPT_SRV_UNTRUSTED, 's',
+     "Intermediate certs that may be useful for verifying CMP protection"},
+    {"rsp_cert", OPT_RSP_CERT, 's',
+     "Certificate to be returned as mock enrollment result"},
+    {"rsp_extracerts", OPT_RSP_EXTRACERTS, 's',
+     "Extra certificates to be included in mock certification responses"},
+    {"rsp_capubs", OPT_RSP_CAPUBS, 's',
+     "CA certificates to be included in mock ip response"},
+    {"poll_count", OPT_POLL_COUNT, 'n',
+     "Number of times the client must poll before receiving a certificate"},
+    {"check_after", OPT_CHECK_AFTER, 'n',
+     "The check_after value (time to wait) to include in poll response"},
+    {"grant_implicitconf", OPT_GRANT_IMPLICITCONF, '-',
+     "Grant implicit confirmation of newly enrolled certificate"},
+
+    {"pkistatus", OPT_PKISTATUS, 'n',
+     "PKIStatus to be included in server response. Possible values: 0..6"},
+    {"failure", OPT_FAILURE, 'n',
+     "A single failure info bit number to include in server response, 0..26"},
+    {"failurebits", OPT_FAILUREBITS, 'n',
+     "Number representing failure bits to include in server response, 0..2^27 - 1"},
+    {"statusstring", OPT_STATUSSTRING, 's',
+     "Status string to be included in server response"},
+    {"send_error", OPT_SEND_ERROR, '-',
+     "Force server to reply with error message"},
+    {"send_unprotected", OPT_SEND_UNPROTECTED, '-',
+     "Send response messages without CMP-level protection"},
+    {"send_unprot_err", OPT_SEND_UNPROT_ERR, '-',
+     "In case of negative responses, server shall send unprotected error messages,"},
+    {OPT_MORE_STR, 0, 0,
+     "certificate responses (ip/cp/kup), and revocation responses (rp)."},
+    {OPT_MORE_STR, 0, 0,
+     "WARNING: This setting leads to behavior violating RFC 4210"},
+    {"accept_unprotected", OPT_ACCEPT_UNPROTECTED, '-',
+     "Accept missing or invalid protection of requests"},
+    {"accept_unprot_err", OPT_ACCEPT_UNPROT_ERR, '-',
+     "Accept unprotected error messages from client"},
+    {"accept_raverified", OPT_ACCEPT_RAVERIFIED, '-',
+     "Accept RAVERIFIED as proof-of-possession (POPO)"},
+
+    OPT_V_OPTIONS,
+    {NULL}
+};
+
+typedef union {
+    char **txt;
+    int *num;
+    long *num_long;
+} varref;
+static varref cmp_vars[] = { /* must be in same order as enumerated above! */
+    {&opt_config}, {&opt_section},
+
+    {&opt_cmd_s}, {&opt_infotype_s}, {&opt_geninfo},
+
+    {&opt_newkey}, {&opt_newkeypass}, {&opt_subject}, {&opt_issuer},
+    {(char **)&opt_days}, {&opt_reqexts},
+    {&opt_sans}, {(char **)&opt_san_nodefault},
+    {&opt_policies}, {&opt_policy_oids}, {(char **)&opt_policy_oids_critical},
+    {(char **)&opt_popo}, {&opt_csr},
+    {&opt_out_trusted},
+    {(char **)&opt_implicit_confirm}, {(char **)&opt_disable_confirm},
+    {&opt_certout},
+
+    {&opt_oldcert}, {(char **)&opt_revreason},
+
+    {&opt_server}, {&opt_proxy}, {&opt_no_proxy}, {&opt_path},
+    {(char **)&opt_msg_timeout}, {(char **)&opt_total_timeout},
+
+    {&opt_trusted}, {&opt_untrusted}, {&opt_srvcert},
+    {&opt_recipient}, {&opt_expect_sender},
+    {(char **)&opt_ignore_keyusage}, {(char **)&opt_unprotected_errors},
+    {&opt_extracertsout}, {&opt_cacertsout},
+
+    {&opt_ref}, {&opt_secret}, {&opt_cert}, {&opt_key}, {&opt_keypass},
+    {&opt_digest}, {&opt_mac}, {&opt_extracerts},
+    {(char **)&opt_unprotected_requests},
+
+    {&opt_certform_s}, {&opt_keyform_s}, {&opt_certsform_s},
+    {&opt_otherpass},
+#ifndef OPENSSL_NO_ENGINE
+    {&opt_engine},
+#endif
+
+    {(char **)&opt_tls_used}, {&opt_tls_cert}, {&opt_tls_key},
+    {&opt_tls_keypass},
+    {&opt_tls_extra}, {&opt_tls_trusted}, {&opt_tls_host},
+
+    {(char **)&opt_batch}, {(char **)&opt_repeat},
+    {&opt_reqin}, {(char **)&opt_reqin_new_tid},
+    {&opt_reqout}, {&opt_rspin}, {&opt_rspout},
+
+    {(char **)&opt_use_mock_srv}, {&opt_port}, {(char **)&opt_max_msgs},
+    {&opt_srv_ref}, {&opt_srv_secret},
+    {&opt_srv_cert}, {&opt_srv_key}, {&opt_srv_keypass},
+    {&opt_srv_trusted}, {&opt_srv_untrusted},
+    {&opt_rsp_cert}, {&opt_rsp_extracerts}, {&opt_rsp_capubs},
+    {(char **)&opt_poll_count}, {(char **)&opt_check_after},
+    {(char **)&opt_grant_implicitconf},
+    {(char **)&opt_pkistatus}, {(char **)&opt_failure},
+    {(char **)&opt_failurebits}, {&opt_statusstring},
+    {(char **)&opt_send_error}, {(char **)&opt_send_unprotected},
+    {(char **)&opt_send_unprot_err}, {(char **)&opt_accept_unprotected},
+    {(char **)&opt_accept_unprot_err}, {(char **)&opt_accept_raverified},
+
+    {NULL}
+};
+
+#ifndef NDEBUG
+# define FUNC (strcmp(OPENSSL_FUNC, "(unknown function)") == 0  \
+               ? "CMP" : "OPENSSL_FUNC")
+# define PRINT_LOCATION(bio) BIO_printf(bio, "%s:%s:%d:", \
+                                        FUNC, OPENSSL_FILE, OPENSSL_LINE)
+#else
+# define PRINT_LOCATION(bio) ((void)0)
+#endif
+#define CMP_print(bio, prefix, msg, a1, a2, a3) \
+    (PRINT_LOCATION(bio), \
+     BIO_printf(bio, "CMP %s: " msg "\n", prefix, a1, a2, a3))
+#define CMP_INFO(msg, a1, a2, a3)  CMP_print(bio_out, "info", msg, a1, a2, a3)
+#define CMP_info(msg)              CMP_INFO(msg"%s%s%s", "", "", "")
+#define CMP_info1(msg, a1)         CMP_INFO(msg"%s%s",   a1, "", "")
+#define CMP_info2(msg, a1, a2)     CMP_INFO(msg"%s",     a1, a2, "")
+#define CMP_info3(msg, a1, a2, a3) CMP_INFO(msg,         a1, a2, a3)
+#define CMP_WARN(m, a1, a2, a3)    CMP_print(bio_out, "warning", m, a1, a2, a3)
+#define CMP_warn(msg)              CMP_WARN(msg"%s%s%s", "", "", "")
+#define CMP_warn1(msg, a1)         CMP_WARN(msg"%s%s",   a1, "", "")
+#define CMP_warn2(msg, a1, a2)     CMP_WARN(msg"%s",     a1, a2, "")
+#define CMP_warn3(msg, a1, a2, a3) CMP_WARN(msg,         a1, a2, a3)
+#define CMP_ERR(msg, a1, a2, a3)   CMP_print(bio_err, "error", msg, a1, a2, a3)
+#define CMP_err(msg)               CMP_ERR(msg"%s%s%s", "", "", "")
+#define CMP_err1(msg, a1)          CMP_ERR(msg"%s%s",   a1, "", "")
+#define CMP_err2(msg, a1, a2)      CMP_ERR(msg"%s",     a1, a2, "")
+#define CMP_err3(msg, a1, a2, a3)  CMP_ERR(msg,         a1, a2, a3)
+
+static int print_to_bio_out(const char *func, const char *file, int line,
+                            OSSL_CMP_severity level, const char *msg)
+{
+    return OSSL_CMP_print_to_bio(bio_out, func, file, line, level, msg);
+}
+
+/* code duplicated from crypto/cmp/cmp_util.c */
+static int sk_X509_add1_cert(STACK_OF(X509) *sk, X509 *cert,
+                             int no_dup, int prepend)
+{
+    if (no_dup) {
+        /*
+         * not using sk_X509_set_cmp_func() and sk_X509_find()
+         * because this re-orders the certs on the stack
+         */
+        int i;
+
+        for (i = 0; i < sk_X509_num(sk); i++) {
+            if (X509_cmp(sk_X509_value(sk, i), cert) == 0)
+                return 1;
+        }
+    }
+    if (!X509_up_ref(cert))
+        return 0;
+    if (!sk_X509_insert(sk, cert, prepend ? 0 : -1)) {
+        X509_free(cert);
+        return 0;
+    }
+    return 1;
+}
+
+/* code duplicated from crypto/cmp/cmp_util.c */
+static int sk_X509_add1_certs(STACK_OF(X509) *sk, STACK_OF(X509) *certs,
+                              int no_self_signed, int no_dups, int prepend)
+/* compiler would allow 'const' for the list of certs, yet they are up-ref'ed */
+{
+    int i;
+
+    if (sk == NULL)
+        return 0;
+    if (certs == NULL)
+        return 1;
+    for (i = 0; i < sk_X509_num(certs); i++) {
+        X509 *cert = sk_X509_value(certs, i);
+
+        if (!no_self_signed || X509_check_issued(cert, cert) != X509_V_OK) {
+            if (!sk_X509_add1_cert(sk, cert, no_dups, prepend))
+                return 0;
+        }
+    }
+    return 1;
+}
+
+/* TODO potentially move to apps/lib/apps.c */
+static char *next_item(char *opt) /* in list separated by comma and/or space */
+{
+    /* advance to separator (comma or whitespace), if any */
+    while (*opt != ',' && !isspace(*opt) && *opt != '\0') {
+        if (*opt == '\\' && opt[1] != '\0')
+            /* skip and unescape '\' escaped char */
+            memmove(opt, opt + 1, strlen(opt));
+        opt++;
+    }
+    if (*opt != '\0') {
+        /* terminate current item */
+        *opt++ = '\0';
+        /* skip over any whitespace after separator */
+        while (isspace(*opt))
+            opt++;
+    }
+    return *opt == '\0' ? NULL : opt; /* NULL indicates end of input */
+}
+
+static EVP_PKEY *load_key_pwd(const char *uri, int format,
+                              const char *pass, ENGINE *e, const char *desc)
+{
+    char *pass_string = get_passwd(pass, desc);
+    EVP_PKEY *pkey = load_key(uri, format, 0, pass_string, e, desc);
+
+    clear_free(pass_string);
+    return pkey;
+}
+
+static X509 *load_cert_pwd(const char *uri, const char *pass, const char *desc)
+{
+    X509 *cert;
+    char *pass_string = get_passwd(pass, desc);
+
+    cert = load_cert_pass(uri, 0, pass_string, desc);
+    clear_free(pass_string);
+    return cert;
+}
+
+/* TODO remove when PR #4930 is merged */
+static int load_pkcs12(BIO *in, const char *desc,
+                       pem_password_cb *pem_cb, void *cb_data,
+                       EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
+{
+    const char *pass;
+    char tpass[PEM_BUFSIZE];
+    int len;
+    int ret = 0;
+    PKCS12 *p12 = d2i_PKCS12_bio(in, NULL);
+
+    if (desc == NULL)
+        desc = "PKCS12 input";
+    if (p12 == NULL) {
+        BIO_printf(bio_err, "error loading PKCS12 file for %s\n", desc);
+        goto die;
+    }
+
+    /* See if an empty password will do */
+    if (PKCS12_verify_mac(p12, "", 0) || PKCS12_verify_mac(p12, NULL, 0)) {
+        pass = "";
+    } else {
+        if (pem_cb == NULL)
+            pem_cb = wrap_password_callback;
+        len = pem_cb(tpass, PEM_BUFSIZE, 0, cb_data);
+        if (len < 0) {
+            BIO_printf(bio_err, "passphrase callback error for %s\n", desc);
+            goto die;
+        }
+        if (len < PEM_BUFSIZE)
+            tpass[len] = 0;
+        if (!PKCS12_verify_mac(p12, tpass, len)) {
+            BIO_printf(bio_err,
+                       "mac verify error (wrong password?) in PKCS12 file for %s\n",
+                       desc);
+            goto die;
+        }
+        pass = tpass;
+    }
+    ret = PKCS12_parse(p12, pass, pkey, cert, ca);
+ die:
+    PKCS12_free(p12);
+    return ret;
+}
+
+/* TODO potentially move this and related functions to apps/lib/apps.c */
+static int adjust_format(const char **infile, int format, int engine_ok)
+{
+    if (!strncasecmp(*infile, "http://", 7)
+            || !strncasecmp(*infile, "https://", 8)) {
+        format = FORMAT_HTTP;
+    } else if (engine_ok && strncasecmp(*infile, "engine:", 7) == 0) {
+        *infile += 7;
+        format = FORMAT_ENGINE;
+    } else {
+        if (strncasecmp(*infile, "file:", 5) == 0)
+            *infile += 5;
+        /*
+         * the following is a heuristic whether first to try PEM or DER
+         * or PKCS12 as the input format for files
+         */
+        if (strlen(*infile) >= 4) {
+            const char *extension = *infile + strlen(*infile) - 4;
+
+            if (strncasecmp(extension, ".crt", 4) == 0
+                    || strncasecmp(extension, ".pem", 4) == 0)
+                /* weak recognition of PEM format */
+                format = FORMAT_PEM;
+            else if (strncasecmp(extension, ".cer", 4) == 0
+                         || strncasecmp(extension, ".der", 4) == 0)
+                /* weak recognition of DER format */
+                format = FORMAT_ASN1;
+            else if (strncasecmp(extension, ".p12", 4) == 0)
+                /* weak recognition of PKCS#12 format */
+                format = FORMAT_PKCS12;
+            /* else retain given format */
+        }
+    }
+    return format;
+}
+
+/*
+ * TODO potentially move this and related functions to apps/lib/
+ * or even better extend OSSL_STORE with type OSSL_STORE_INFO_CRL
+ */
+static X509_REQ *load_csr_autofmt(const char *infile, const char *desc)
+{
+    X509_REQ *csr;
+    BIO *bio_bak = bio_err;
+    int can_retry;
+    int format = adjust_format(&infile, FORMAT_PEM, 0);
+
+    can_retry = format == FORMAT_PEM || format == FORMAT_ASN1;
+    if (can_retry)
+        bio_err = NULL; /* do not show errors on more than one try */
+    csr = load_csr(infile, format, desc);
+    bio_err = bio_bak;
+    if (csr == NULL && can_retry) {
+        ERR_clear_error();
+        format = (format == FORMAT_PEM ? FORMAT_ASN1 : FORMAT_PEM);
+        csr = load_csr(infile, format, desc);
+    }
+    if (csr == NULL) {
+        ERR_print_errors(bio_err);
+        BIO_printf(bio_err, "error: unable to load %s from file '%s'\n", desc,
+                   infile);
+    }
+    return csr;
+}
+
+/* TODO replace by calling generalized load_certs() when PR #4930 is merged */
+static int load_certs_preliminary(const char *file, STACK_OF(X509) **certs,
+                                  int format, const char *pass,
+                                  const char *desc)
+{
+    X509 *cert = NULL;
+    int ret = 0;
+
+    if (format == FORMAT_PKCS12) {
+        BIO *bio = bio_open_default(file, 'r', format);
+
+        if (bio != NULL) {
+            EVP_PKEY *pkey = NULL; /* pkey is needed until PR #4930 is merged */
+            PW_CB_DATA cb_data;
+
+            cb_data.password = pass;
+            cb_data.prompt_info = file;
+            ret = load_pkcs12(bio, desc, wrap_password_callback,
+                              &cb_data, &pkey, &cert, certs);
+            EVP_PKEY_free(pkey);
+            BIO_free(bio);
+        }
+    } else if (format == FORMAT_ASN1) { /* load only one cert in this case */
+        CMP_warn1("can load only one certificate in DER format from %s", file);
+        cert = load_cert_pass(file, 0, pass, desc);
+    }
+    if (format == FORMAT_PKCS12 || format == FORMAT_ASN1) {
+        if (cert) {
+            if (*certs == NULL)
+                *certs = sk_X509_new_null();
+            if (*certs != NULL)
+                ret = sk_X509_insert(*certs, cert, 0);
+            else
+                X509_free(cert);
+        }
+    } else {
+        ret = load_certs(file, certs, format, pass, desc);
+    }
+    return ret;
+}
+
+static void warn_certs_expired(const char *file, STACK_OF(X509) **certs)
+{
+    int i, res;
+    X509 *cert;
+    char *subj;
+
+    for (i = 0; i < sk_X509_num(*certs); i++) {
+        cert = sk_X509_value(*certs, i);
+        res = X509_cmp_timeframe(vpm, X509_get0_notBefore(cert),
+                                 X509_get0_notAfter(cert));
+        if (res != 0) {
+            subj = X509_NAME_oneline(X509_get_subject_name(cert), NULL, 0);
+            CMP_warn3("certificate from '%s' with subject '%s' %s", file, subj,
+                      res > 0 ? "has expired" : "not yet valid");
+            OPENSSL_free(subj);
+        }
+    }
+}
+
+/*
+ * TODO potentially move this and related functions to apps/lib/
+ * or even better extend OSSL_STORE with type OSSL_STORE_INFO_CERTS
+ */
+static int load_certs_autofmt(const char *infile, STACK_OF(X509) **certs,
+                              int exclude_http, const char *pass,
+                              const char *desc)
+{
+    int ret = 0;
+    char *pass_string;
+    BIO *bio_bak = bio_err;
+    int format = adjust_format(&infile, opt_certsform, 0);
+
+    if (exclude_http && format == FORMAT_HTTP) {
+        BIO_printf(bio_err, "error: HTTP retrieval not allowed for %s\n", desc);
+        return ret;
+    }
+    pass_string = get_passwd(pass, desc);
+    if (format != FORMAT_HTTP)
+        bio_err = NULL; /* do not show errors on more than one try */
+    ret = load_certs_preliminary(infile, certs, format, pass_string, desc);
+    bio_err = bio_bak;
+    if (!ret && format != FORMAT_HTTP) {
+        int format2 = format == FORMAT_PEM ? FORMAT_ASN1 : FORMAT_PEM;
+
+        ERR_clear_error();
+        ret = load_certs_preliminary(infile, certs, format2, pass_string, desc);
+    }
+    clear_free(pass_string);
+
+    if (ret)
+        warn_certs_expired(infile, certs);
+    return ret;
+}
+
+/* set expected host name/IP addr and clears the email addr in the given ts */
+static int truststore_set_host_etc(X509_STORE *ts, char *host)
+{
+    X509_VERIFY_PARAM *ts_vpm = X509_STORE_get0_param(ts);
+
+    /* first clear any host names, IP, and email addresses */
+    if (!X509_VERIFY_PARAM_set1_host(ts_vpm, NULL, 0)
+            || !X509_VERIFY_PARAM_set1_ip(ts_vpm, NULL, 0)
+            || !X509_VERIFY_PARAM_set1_email(ts_vpm, NULL, 0))
+        return 0;
+    X509_VERIFY_PARAM_set_hostflags(ts_vpm,
+                                    X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT |
+                                    X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
+    return (host != NULL && X509_VERIFY_PARAM_set1_ip_asc(ts_vpm, host))
+        || X509_VERIFY_PARAM_set1_host(ts_vpm, host, 0);
+}
+
+static X509_STORE *sk_X509_to_store(X509_STORE *store /* may be NULL */,
+                                    const STACK_OF(X509) *certs /* may NULL */)
+{
+    int i;
+
+    if (store == NULL)
+        store = X509_STORE_new();
+    if (store == NULL)
+        return NULL;
+    for (i = 0; i < sk_X509_num(certs); i++) {
+        if (!X509_STORE_add_cert(store, sk_X509_value(certs, i))) {
+            X509_STORE_free(store);
+            return NULL;
+        }
+    }
+    return store;
+}
+
+/* write OSSL_CMP_MSG DER-encoded to the specified file name item */
+static int write_PKIMESSAGE(const OSSL_CMP_MSG *msg, char **filenames)
+{
+    char *file;
+    BIO *bio;
+
+    if (msg == NULL || filenames == NULL) {
+        CMP_err("NULL arg to write_PKIMESSAGE");
+        return 0;
+    }
+    if (*filenames == NULL) {
+        CMP_err("Not enough file names provided for writing PKIMessage");
+        return 0;
+    }
+
+    file = *filenames;
+    *filenames = next_item(file);
+    bio = BIO_new_file(file, "wb");
+    if (bio == NULL) {
+        CMP_err1("Cannot open file '%s' for writing", file);
+        return 0;
+    }
+    if (i2d_OSSL_CMP_MSG_bio(bio, msg) < 0) {
+        CMP_err1("Cannot write PKIMessage to file '%s'", file);
+        BIO_free(bio);
+        return 0;
+    }
+    BIO_free(bio);
+    return 1;
+}
+
+/* read DER-encoded OSSL_CMP_MSG from the specified file name item */
+static OSSL_CMP_MSG *read_PKIMESSAGE(char **filenames)
+{
+    char *file;
+    BIO *bio;
+    OSSL_CMP_MSG *ret;
+
+    if (filenames == NULL) {
+        CMP_err("NULL arg to read_PKIMESSAGE");
+        return NULL;
+    }
+    if (*filenames == NULL) {
+        CMP_err("Not enough file names provided for reading PKIMessage");
+        return NULL;
+    }
+
+    file = *filenames;
+    *filenames = next_item(file);
+    bio = BIO_new_file(file, "rb");
+    if (bio == NULL) {
+        CMP_err1("Cannot open file '%s' for reading", file);
+        return NULL;
+    }
+    ret = d2i_OSSL_CMP_MSG_bio(bio, NULL);
+    if (ret == NULL)
+        CMP_err1("Cannot read PKIMessage from file '%s'", file);
+    BIO_free(bio);
+    return ret;
+}
+
+/*-
+ * Sends the PKIMessage req and on success place the response in *res
+ * basically like OSSL_CMP_MSG_http_perform(), but in addition allows
+ * to dump the sequence of requests and responses to files and/or
+ * to take the sequence of requests and responses from files.
+ */
+static OSSL_CMP_MSG *read_write_req_resp(OSSL_CMP_CTX *ctx,
+                                         const OSSL_CMP_MSG *req)
+{
+    OSSL_CMP_MSG *req_new = NULL;
+    OSSL_CMP_MSG *res = NULL;
+    OSSL_CMP_PKIHEADER *hdr;
+
+    if (req != NULL && opt_reqout != NULL
+            && !write_PKIMESSAGE(req, &opt_reqout))
+        goto err;
+    if (opt_reqin != NULL && opt_rspin == NULL) {
+        if ((req_new = read_PKIMESSAGE(&opt_reqin)) == NULL)
+            goto err;
+        /*-
+         * The transaction ID in req_new read from opt_reqin may not be fresh.
+         * In this case the server may complain "Transaction id already in use."
+         * The following workaround unfortunately requires re-protection.
+         */
+        if (opt_reqin_new_tid
+                && !OSSL_CMP_MSG_update_transactionID(ctx, req_new))
+            goto err;
+    }
+
+    if (opt_rspin != NULL) {
+        res = read_PKIMESSAGE(&opt_rspin);
+    } else {
+        const OSSL_CMP_MSG *actual_req = opt_reqin != NULL ? req_new : req;
+
+        res = opt_use_mock_srv
+            ? OSSL_CMP_CTX_server_perform(ctx, actual_req)
+            : OSSL_CMP_MSG_http_perform(ctx, actual_req);
+    }
+    if (res == NULL)
+        goto err;
+
+    if (opt_reqin != NULL || opt_rspin != NULL) {
+        /* need to satisfy nonce and transactionID checks */
+        ASN1_OCTET_STRING *nonce;
+        ASN1_OCTET_STRING *tid;
+
+        hdr = OSSL_CMP_MSG_get0_header(res);
+        nonce = OSSL_CMP_HDR_get0_recipNonce(hdr);
+        tid = OSSL_CMP_HDR_get0_transactionID(hdr);
+        if (!OSSL_CMP_CTX_set1_senderNonce(ctx, nonce)
+                || !OSSL_CMP_CTX_set1_transactionID(ctx, tid)) {
+            OSSL_CMP_MSG_free(res);
+            res = NULL;
+            goto err;
+        }
+    }
+
+    if (opt_rspout != NULL && !write_PKIMESSAGE(res, &opt_rspout)) {
+        OSSL_CMP_MSG_free(res);
+        res = NULL;
+    }
+
+ err:
+    OSSL_CMP_MSG_free(req_new);
+    return res;
+}
+
+/*
+ * parse string as integer value, not allowing trailing garbage, see also
+ * https://www.gnu.org/software/libc/manual/html_node/Parsing-of-Integers.html
+ *
+ * returns integer value, or INT_MIN on error
+ */
+static int atoint(const char *str)
+{
+    char *tailptr;
+    long res = strtol(str, &tailptr, 10);
+
+    if  ((*tailptr != '\0') || (res < INT_MIN) || (res > INT_MAX))
+        return INT_MIN;
+    else
+        return (int)res;
+}
+
+static int parse_addr(char **opt_string, int port, const char *name)
+{
+    char *port_string;
+
+    if (strncasecmp(*opt_string, OSSL_HTTP_PREFIX,
+                    strlen(OSSL_HTTP_PREFIX)) == 0) {
+        *opt_string += strlen(OSSL_HTTP_PREFIX);
+    } else if (strncasecmp(*opt_string, OSSL_HTTPS_PREFIX,
+                           strlen(OSSL_HTTPS_PREFIX)) == 0) {
+        *opt_string += strlen(OSSL_HTTPS_PREFIX);
+        if (port == 0)
+            port = 443; /* == integer value of OSSL_HTTPS_PORT */
+    }
+
+    if ((port_string = strrchr(*opt_string, ':')) == NULL)
+        return port; /* using default */
+    *(port_string++) = '\0';
+    port = atoint(port_string);
+    if ((port <= 0) || (port > 65535)) {
+        CMP_err2("invalid %s port '%s' given, sane range 1-65535",
+                 name, port_string);
+        return -1;
+    }
+    return port;
+}
+
+static int set1_store_parameters(X509_STORE *ts)
+{
+    if (ts == NULL)
+        return 0;
+
+    /* copy vpm to store */
+    if (!X509_STORE_set1_param(ts, vpm /* may be NULL */)) {
+        BIO_printf(bio_err, "error setting verification parameters\n");
+        OSSL_CMP_CTX_print_errors(cmp_ctx);
+        return 0;
+    }
+
+    X509_STORE_set_verify_cb(ts, X509_STORE_CTX_print_verify_cb);
+
+    return 1;
+}
+
+static int set_name(const char *str,
+                    int (*set_fn) (OSSL_CMP_CTX *ctx, const X509_NAME *name),
+                    OSSL_CMP_CTX *ctx, const char *desc)
+{
+    if (str != NULL) {
+        X509_NAME *n = parse_name(str, MBSTRING_ASC, 0);
+
+        if (n == NULL) {
+            CMP_err2("cannot parse %s DN '%s'", desc, str);
+            return 0;
+        }
+        if (!(*set_fn) (ctx, n)) {
+            X509_NAME_free(n);
+            CMP_err("out of memory");
+            return 0;
+        }
+        X509_NAME_free(n);
+    }
+    return 1;
+}
+
+static int set_gennames(OSSL_CMP_CTX *ctx, char *names, const char *desc)
+{
+    char *next;
+
+    for (; names != NULL; names = next) {
+        GENERAL_NAME *n;
+
+        next = next_item(names);
+        if (strcmp(names, "critical") == 0) {
+            (void)OSSL_CMP_CTX_set_option(ctx,
+                                          OSSL_CMP_OPT_SUBJECTALTNAME_CRITICAL,
+                                          1);
+            continue;
+        }
+
+        /* try IP address first, then URI or domain name */
+        (void)ERR_set_mark();
+        n = a2i_GENERAL_NAME(NULL, NULL, NULL, GEN_IPADD, names, 0);
+        if (n == NULL)
+            n = a2i_GENERAL_NAME(NULL, NULL, NULL,
+                                 strchr(names, ':') != NULL ? GEN_URI : GEN_DNS,
+                                 names, 0);
+        (void)ERR_pop_to_mark();
+
+        if (n == NULL) {
+            CMP_err2("bad syntax of %s '%s'", desc, names);
+            return 0;
+        }
+        if (!OSSL_CMP_CTX_push1_subjectAltName(ctx, n)) {
+            GENERAL_NAME_free(n);
+            CMP_err("out of memory");
+            return 0;
+        }
+        GENERAL_NAME_free(n);
+    }
+    return 1;
+}
+
+/* TODO potentially move to apps/lib/apps.c */
+/*
+ * create cert store structure with certificates read from given file(s)
+ * returns pointer to created X509_STORE on success, NULL on error
+ */
+static X509_STORE *load_certstore(char *input, const char *desc)
+{
+    X509_STORE *store = NULL;
+    STACK_OF(X509) *certs = NULL;
+
+    if (input == NULL)
+        goto err;
+
+    while (input != NULL) {
+        char *next = next_item(input);           \
+
+        if (!load_certs_autofmt(input, &certs, 1, opt_otherpass, desc)
+                || !(store = sk_X509_to_store(store, certs))) {
+            /* CMP_err("out of memory"); */
+            X509_STORE_free(store);
+            store = NULL;
+            goto err;
+        }
+        sk_X509_pop_free(certs, X509_free);
+        certs = NULL;
+        input = next;
+    }
+ err:
+    sk_X509_pop_free(certs, X509_free);
+    return store;
+}
+
+/* TODO potentially move to apps/lib/apps.c */
+static STACK_OF(X509) *load_certs_multifile(char *files,
+                                            const char *pass, const char *desc)
+{
+    STACK_OF(X509) *certs = NULL;
+    STACK_OF(X509) *result = sk_X509_new_null();
+
+    if (files == NULL)
+        goto err;
+    if (result == NULL)
+        goto oom;
+
+    while (files != NULL) {
+        char *next = next_item(files);
+
+        if (!load_certs_autofmt(files, &certs, 0, pass, desc))
+            goto err;
+        if (!sk_X509_add1_certs(result, certs, 0, 1 /* no dups */, 0))
+            goto oom;
+        sk_X509_pop_free(certs, X509_free);
+        certs = NULL;
+        files = next;
+    }
+    return result;
+
+ oom:
+    BIO_printf(bio_err, "out of memory\n");
+ err:
+    sk_X509_pop_free(certs, X509_free);
+    sk_X509_pop_free(result, X509_free);
+    return NULL;
+}
+
+typedef int (*add_X509_stack_fn_t)(void *ctx, const STACK_OF(X509) *certs);
+typedef int (*add_X509_fn_t)(void *ctx, const X509 *cert);
+
+static int setup_certs(char *files, const char *desc, void *ctx,
+                       add_X509_stack_fn_t addn_fn, add_X509_fn_t add1_fn)
+{
+    int ret = 1;
+
+    if (files != NULL) {
+        STACK_OF(X509) *certs = load_certs_multifile(files, opt_otherpass,
+                                                     desc);
+        if (certs == NULL) {
+            ret = 0;
+        } else {
+            if (addn_fn != NULL) {
+                ret = (*addn_fn)(ctx, certs);
+            } else {
+                int i;
+
+                for (i = 0; i < sk_X509_num(certs /* may be NULL */); i++)
+                    ret &= (*add1_fn)(ctx, sk_X509_value(certs, i));
+            }
+            sk_X509_pop_free(certs, X509_free);
+        }
+    }
+    return ret;
+}
+
+
+/*
+ * parse and transform some options, checking their syntax.
+ * Returns 1 on success, 0 on error
+ */
+static int transform_opts(void)
+{
+    if (opt_cmd_s != NULL) {
+        if (!strcmp(opt_cmd_s, "ir")) {
+            opt_cmd = CMP_IR;
+        } else if (!strcmp(opt_cmd_s, "kur")) {
+            opt_cmd = CMP_KUR;
+        } else if (!strcmp(opt_cmd_s, "cr")) {
+            opt_cmd = CMP_CR;
+        } else if (!strcmp(opt_cmd_s, "p10cr")) {
+            opt_cmd = CMP_P10CR;
+        } else if (!strcmp(opt_cmd_s, "rr")) {
+            opt_cmd = CMP_RR;
+        } else if (!strcmp(opt_cmd_s, "genm")) {
+            opt_cmd = CMP_GENM;
+        } else {
+            CMP_err1("unknown cmp command '%s'", opt_cmd_s);
+            return 0;
+        }
+    } else {
+        CMP_err("no cmp command to execute");
+        return 0;
+    }
+
+#ifdef OPENSSL_NO_ENGINE
+# define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12 | OPT_FMT_ENGINE)
+#else
+# define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12)
+#endif
+
+    if (opt_keyform_s != NULL
+            && !opt_format(opt_keyform_s, FORMAT_OPTIONS, &opt_keyform)) {
+        CMP_err("unknown option given for key loading format");
+        return 0;
+    }
+
+#undef FORMAT_OPTIONS
+
+    if (opt_certform_s != NULL
+            && !opt_format(opt_certform_s, OPT_FMT_PEMDER, &opt_certform)) {
+        CMP_err("unknown option given for certificate storing format");
+        return 0;
+    }
+
+    if (opt_certsform_s != NULL
+            && !opt_format(opt_certsform_s, OPT_FMT_PEMDER | OPT_FMT_PKCS12,
+                           &opt_certsform)) {
+        CMP_err("unknown option given for certificate list loading format");
+        return 0;
+    }
+
+    return 1;
+}
+
+static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *e)
+{
+    OSSL_CMP_CTX *ctx; /* extra CMP (client) ctx partly used by server */
+    OSSL_CMP_SRV_CTX *srv_ctx = ossl_cmp_mock_srv_new();
+
+    if (srv_ctx == NULL)
+        return NULL;
+    ctx = OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx);
+
+    if (opt_srv_ref == NULL) {
+        if (opt_srv_cert == NULL) {
+            /* opt_srv_cert should determine the sender */
+            CMP_err("must give -srv_ref for server if no -srv_cert given");
+            goto err;
+        }
+    } else {
+        if (!OSSL_CMP_CTX_set1_referenceValue(ctx, (unsigned char *)opt_srv_ref,
+                                              strlen(opt_srv_ref)))
+            goto err;
+    }
+
+    if (opt_srv_secret != NULL) {
+        int res;
+        char *pass_str = get_passwd(opt_srv_secret, "PBMAC secret of server");
+
+        if (pass_str != NULL) {
+            cleanse(opt_srv_secret);
+            res = OSSL_CMP_CTX_set1_secretValue(ctx, (unsigned char *)pass_str,
+                                                strlen(pass_str));
+            clear_free(pass_str);
+            if (res == 0)
+                goto err;
+        }
+    } else if (opt_srv_cert == NULL) {
+        CMP_err("server credentials must be given if -use_mock_srv or -port is used");
+        goto err;
+    } else {
+        CMP_warn("server will not be able to handle PBM-protected requests since -srv_secret is not given");
+    }
+
+    if (opt_srv_secret == NULL
+            && ((opt_srv_cert == NULL) != (opt_srv_key == NULL))) {
+        CMP_err("must give both -srv_cert and -srv_key options or neither");
+        goto err;
+    }
+    if (opt_srv_cert != NULL) {
+        X509 *srv_cert = load_cert_pwd(opt_srv_cert, opt_srv_keypass,
+                                       "certificate of the server");
+
+        if (srv_cert == NULL || !OSSL_CMP_CTX_set1_cert(ctx, srv_cert)) {
+            X509_free(srv_cert);
+            goto err;
+        }
+        X509_free(srv_cert);
+    }
+    if (opt_srv_key != NULL) {
+        EVP_PKEY *pkey = load_key_pwd(opt_srv_key, opt_keyform,
+                                      opt_srv_keypass,
+                                      e, "private key for server cert");
+
+        if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {
+            EVP_PKEY_free(pkey);
+            goto err;
+        }
+        EVP_PKEY_free(pkey);
+    }
+    cleanse(opt_srv_keypass);
+
+    if (opt_srv_trusted != NULL) {
+        X509_STORE *ts =
+            load_certstore(opt_srv_trusted, "certificates trusted by server");
+
+        if (ts == NULL)
+            goto err;
+        if (!set1_store_parameters(ts)
+                || !truststore_set_host_etc(ts, NULL)
+                || !OSSL_CMP_CTX_set0_trustedStore(ctx, ts)) {
+            X509_STORE_free(ts);
+            goto err;
+        }
+    } else {
+        CMP_warn("server will not be able to handle signature-protected requests since -srv_trusted is not given");
+    }
+    if (!setup_certs(opt_srv_untrusted, "untrusted certificates", ctx,
+                     (add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted_certs,
+                     NULL))
+        goto err;
+
+    if (opt_rsp_cert == NULL) {
+        CMP_err("must give -rsp_cert for mock server");
+        goto err;
+    } else {
+        X509 *cert = load_cert_pwd(opt_rsp_cert, opt_keypass,
+                                   "cert to be returned by the mock server");
+
+        if (cert == NULL)
+            goto err;
+        /* from server perspective the server is the client */
+        if (!ossl_cmp_mock_srv_set1_certOut(srv_ctx, cert)) {
+            X509_free(cert);
+            goto err;
+        }
+        X509_free(cert);
+    }
+    /* TODO find a cleaner solution not requiring type casts */
+    if (!setup_certs(opt_rsp_extracerts,
+                     "CMP extra certificates for mock server", srv_ctx,
+                     (add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_chainOut,
+                     NULL))
+        goto err;
+    if (!setup_certs(opt_rsp_capubs, "caPubs for mock server", srv_ctx,
+                     (add_X509_stack_fn_t)ossl_cmp_mock_srv_set1_caPubsOut,
+                     NULL))
+        goto err;
+    (void)ossl_cmp_mock_srv_set_pollCount(srv_ctx, opt_poll_count);
+    (void)ossl_cmp_mock_srv_set_checkAfterTime(srv_ctx, opt_check_after);
+    if (opt_grant_implicitconf)
+        (void)OSSL_CMP_SRV_CTX_set_grant_implicit_confirm(srv_ctx, 1);
+
+    if (opt_failure != INT_MIN) { /* option has been set explicity */
+        if (opt_failure < 0 || OSSL_CMP_PKIFAILUREINFO_MAX < opt_failure) {
+            CMP_err1("-failure out of range, should be >= 0 and <= %d",
+                     OSSL_CMP_PKIFAILUREINFO_MAX);
+            goto err;
+        }
+        if (opt_failurebits != 0)
+            CMP_warn("-failurebits overrides -failure");
+        else
+            opt_failurebits = 1 << opt_failure;
+    }
+    if ((unsigned)opt_failurebits > OSSL_CMP_PKIFAILUREINFO_MAX_BIT_PATTERN) {
+        CMP_err("-failurebits out of range");
+        goto err;
+    }
+    if (!ossl_cmp_mock_srv_set_statusInfo(srv_ctx, opt_pkistatus,
+                                          opt_failurebits, opt_statusstring))
+        goto err;
+
+    if (opt_send_error)
+        (void)ossl_cmp_mock_srv_set_send_error(srv_ctx, 1);
+
+    if (opt_send_unprotected)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_SEND, 1);
+    if (opt_send_unprot_err)
+        (void)OSSL_CMP_SRV_CTX_set_send_unprotected_errors(srv_ctx, 1);
+    if (opt_accept_unprotected)
+        (void)OSSL_CMP_SRV_CTX_set_accept_unprotected(srv_ctx, 1);
+    if (opt_accept_unprot_err)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS, 1);
+    if (opt_accept_raverified)
+        (void)OSSL_CMP_SRV_CTX_set_accept_raverified(srv_ctx, 1);
+
+    return srv_ctx;
+
+ err:
+    ossl_cmp_mock_srv_free(srv_ctx);
+    return NULL;
+}
+
+/*
+ * set up verification aspects of OSSL_CMP_CTX w.r.t. opts from config file/CLI.
+ * Returns pointer on success, NULL on error
+ */
+static int setup_verification_ctx(OSSL_CMP_CTX *ctx)
+{
+    if (!setup_certs(opt_untrusted, "untrusted certificates", ctx,
+                     (add_X509_stack_fn_t)OSSL_CMP_CTX_set1_untrusted_certs,
+                     NULL))
+        goto err;
+
+    if (opt_srvcert != NULL || opt_trusted != NULL) {
+        X509_STORE *ts = NULL;
+
+        if (opt_srvcert != NULL) {
+            X509 *srvcert;
+
+            if (opt_trusted != NULL) {
+                CMP_warn("-trusted option is ignored since -srvcert option is present");
+                opt_trusted = NULL;
+            }
+            if (opt_recipient != NULL) {
+                CMP_warn("-recipient option is ignored since -srvcert option is present");
+                opt_recipient = NULL;
+            }
+            srvcert = load_cert_pwd(opt_srvcert, opt_otherpass,
+                                    "directly trusted CMP server certificate");
+            if (srvcert == NULL)
+                /*
+                 * opt_otherpass is needed in case
+                 * opt_srvcert is an encrypted PKCS#12 file
+                 */
+                goto err;
+            if (!OSSL_CMP_CTX_set1_srvCert(ctx, srvcert)) {
+                X509_free(srvcert);
+                goto oom;
+            }
+            X509_free(srvcert);
+            if ((ts = X509_STORE_new()) == NULL)
+                goto oom;
+        }
+        if (opt_trusted != NULL
+                && (ts = load_certstore(opt_trusted, "trusted certificates"))
+            == NULL)
+            goto err;
+        if (!set1_store_parameters(ts) /* also copies vpm */
+                /*
+                 * clear any expected host/ip/email address;
+                 * opt_expect_sender is used instead
+                 */
+                || !truststore_set_host_etc(ts, NULL)
+                || !OSSL_CMP_CTX_set0_trustedStore(ctx, ts)) {
+            X509_STORE_free(ts);
+            goto oom;
+        }
+    }
+
+    if (opt_ignore_keyusage)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_IGNORE_KEYUSAGE, 1);
+
+    if (opt_unprotected_errors)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_ERRORS, 1);
+
+    if (opt_out_trusted != NULL) { /* for use in OSSL_CMP_certConf_cb() */
+        X509_VERIFY_PARAM *out_vpm = NULL;
+        X509_STORE *out_trusted =
+            load_certstore(opt_out_trusted,
+                           "trusted certs for verifying newly enrolled cert");
+
+        if (out_trusted == NULL)
+            goto err;
+        /* any -verify_hostname, -verify_ip, and -verify_email apply here */
+        if (!set1_store_parameters(out_trusted))
+            goto oom;
+        /* ignore any -attime here, new certs are current anyway */
+        out_vpm = X509_STORE_get0_param(out_trusted);
+        X509_VERIFY_PARAM_clear_flags(out_vpm, X509_V_FLAG_USE_CHECK_TIME);
+
+        (void)OSSL_CMP_CTX_set_certConf_cb_arg(ctx, out_trusted);
+    }
+
+    if (opt_disable_confirm)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_DISABLE_CONFIRM, 1);
+
+    if (opt_implicit_confirm)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_IMPLICIT_CONFIRM, 1);
+
+    (void)OSSL_CMP_CTX_set_certConf_cb(ctx, OSSL_CMP_certConf_cb);
+
+    return 1;
+
+ oom:
+    CMP_err("out of memory");
+ err:
+    return 0;
+}
+
+#ifndef OPENSSL_NO_SOCK
+/*
+ * set up ssl_ctx for the OSSL_CMP_CTX based on options from config file/CLI.
+ * Returns pointer on success, NULL on error
+ */
+static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
+{
+    STACK_OF(X509) *untrusted_certs = OSSL_CMP_CTX_get0_untrusted_certs(ctx);
+    EVP_PKEY *pkey = NULL;
+    X509_STORE *trust_store = NULL;
+    SSL_CTX *ssl_ctx;
+    int i;
+
+    ssl_ctx = SSL_CTX_new(TLS_client_method());
+    if (ssl_ctx == NULL)
+        return NULL;
+
+    SSL_CTX_set_mode(ssl_ctx, SSL_MODE_AUTO_RETRY);
+
+    if (opt_tls_trusted != NULL) {
+        if ((trust_store = load_certstore(opt_tls_trusted,
+                                          "trusted TLS certificates")) == NULL)
+            goto err;
+        SSL_CTX_set_cert_store(ssl_ctx, trust_store);
+        /* for improved diagnostics on SSL_CTX_build_cert_chain() errors: */
+        X509_STORE_set_verify_cb(trust_store, X509_STORE_CTX_print_verify_cb);
+    }
+
+    if (opt_tls_cert != NULL && opt_tls_key != NULL) {
+        X509 *cert;
+        STACK_OF(X509) *certs = NULL;
+
+        if (!load_certs_autofmt(opt_tls_cert, &certs, 0, opt_tls_keypass,
+                                "TLS client certificate (optionally with chain)"))
+            /*
+             * opt_tls_keypass is needed in case opt_tls_cert is an encrypted
+             * PKCS#12 file
+             */
+            goto err;
+
+        cert = sk_X509_delete(certs, 0);
+        if (cert == NULL || SSL_CTX_use_certificate(ssl_ctx, cert) <= 0) {
+            CMP_err1("unable to use client TLS certificate file '%s'",
+                     opt_tls_cert);
+            X509_free(cert);
+            sk_X509_pop_free(certs, X509_free);
+            goto err;
+        }
+        X509_free(cert); /* we do not need the handle any more */
+
+        /*
+         * Any further certs and any untrusted certs are used for constructing
+         * the chain to be provided with the TLS client cert to the TLS server.
+         */
+        if (!SSL_CTX_set0_chain(ssl_ctx, certs)) {
+            CMP_err("could not set TLS client cert chain");
+            sk_X509_pop_free(certs, X509_free);
+            goto err;
+        }
+        for (i = 0; i < sk_X509_num(untrusted_certs); i++) {
+            cert = sk_X509_value(untrusted_certs, i);
+            if (!SSL_CTX_add1_chain_cert(ssl_ctx, cert)) {
+                CMP_err("could not add untrusted cert to TLS client cert chain");
+                goto err;
+            }
+        }
+        if (!SSL_CTX_build_cert_chain(ssl_ctx,
+                                      SSL_BUILD_CHAIN_FLAG_UNTRUSTED |
+                                      SSL_BUILD_CHAIN_FLAG_NO_ROOT)) {
+            CMP_warn("could not build cert chain for own TLS cert");
+            OSSL_CMP_CTX_print_errors(ctx);
+        }
+
+        /* If present we append to the list also the certs from opt_tls_extra */
+        if (opt_tls_extra != NULL) {
+            STACK_OF(X509) *tls_extra = load_certs_multifile(opt_tls_extra,
+                                                             opt_otherpass,
+                                                             "extra certificates for TLS");
+            int res = 1;
+
+            if (tls_extra == NULL)
+                goto err;
+            for (i = 0; i < sk_X509_num(tls_extra); i++) {
+                cert = sk_X509_value(tls_extra, i);
+                if (res != 0)
+                    res = SSL_CTX_add_extra_chain_cert(ssl_ctx, cert);
+                if (res == 0)
+                    X509_free(cert);
+            }
+            sk_X509_free(tls_extra);
+            if (res == 0) {
+                BIO_printf(bio_err, "error: unable to add TLS extra certs\n");
+                goto err;
+            }
+        }
+
+        pkey = load_key_pwd(opt_tls_key, opt_keyform, opt_tls_keypass,
+                            e, "TLS client private key");
+        cleanse(opt_tls_keypass);
+        if (pkey == NULL)
+            goto err;
+        /*
+         * verify the key matches the cert,
+         * not using SSL_CTX_check_private_key(ssl_ctx)
+         * because it gives poor and sometimes misleading diagnostics
+         */
+        if (!X509_check_private_key(SSL_CTX_get0_certificate(ssl_ctx),
+                                    pkey)) {
+            CMP_err2("TLS private key '%s' does not match the TLS certificate '%s'\n",
+                     opt_tls_key, opt_tls_cert);
+            EVP_PKEY_free(pkey);
+            pkey = NULL; /* otherwise, for some reason double free! */
+            goto err;
+        }
+        if (SSL_CTX_use_PrivateKey(ssl_ctx, pkey) <= 0) {
+            CMP_err1("unable to use TLS client private key '%s'", opt_tls_key);
+            EVP_PKEY_free(pkey);
+            pkey = NULL; /* otherwise, for some reason double free! */
+            goto err;
+        }
+        EVP_PKEY_free(pkey); /* we do not need the handle any more */
+    }
+    if (opt_tls_trusted != NULL) {
+        /* enable and parameterize server hostname/IP address check */
+        if (!truststore_set_host_etc(trust_store,
+                                     opt_tls_host != NULL ?
+                                     opt_tls_host : opt_server))
+            /* TODO: is the server host name correct for TLS via proxy? */
+            goto err;
+        SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
+    }
+    return ssl_ctx;
+ err:
+    SSL_CTX_free(ssl_ctx);
+    return NULL;
+}
+#endif
+
+/*
+ * set up protection aspects of OSSL_CMP_CTX based on options from config
+ * file/CLI while parsing options and checking their consistency.
+ * Returns 1 on success, 0 on error
+ */
+static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
+{
+    if (!opt_unprotected_requests && opt_secret == NULL && opt_cert == NULL) {
+        CMP_err("must give client credentials unless -unprotected_requests is set");
+        goto err;
+    }
+
+    if (opt_ref == NULL && opt_cert == NULL && opt_subject == NULL) {
+        /* cert or subject should determine the sender */
+        CMP_err("must give -ref if no -cert and no -subject given");
+        goto err;
+    }
+    if (!opt_secret && ((opt_cert == NULL) != (opt_key == NULL))) {
+        CMP_err("must give both -cert and -key options or neither");
+        goto err;
+    }
+    if (opt_secret != NULL) {
+        char *pass_string = get_passwd(opt_secret, "PBMAC");
+        int res;
+
+        if (pass_string != NULL) {
+            cleanse(opt_secret);
+            res = OSSL_CMP_CTX_set1_secretValue(ctx,
+                                                (unsigned char *)pass_string,
+                                                strlen(pass_string));
+            clear_free(pass_string);
+            if (res == 0)
+                goto err;
+        }
+        if (opt_cert != NULL || opt_key != NULL)
+            CMP_warn("no signature-based protection used since -secret is given");
+    }
+    if (opt_ref != NULL
+            && !OSSL_CMP_CTX_set1_referenceValue(ctx, (unsigned char *)opt_ref,
+                                                 strlen(opt_ref)))
+        goto err;
+
+    if (opt_key != NULL) {
+        EVP_PKEY *pkey = load_key_pwd(opt_key, opt_keyform, opt_keypass, e,
+                                      "private key for CMP client certificate");
+
+        if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {
+            EVP_PKEY_free(pkey);
+            goto err;
+        }
+        EVP_PKEY_free(pkey);
+    }
+    if (opt_secret == NULL && opt_srvcert == NULL && opt_trusted == NULL) {
+        CMP_err("missing -secret or -srvcert or -trusted");
+        goto err;
+    }
+
+    if (opt_cert != NULL) {
+        X509 *cert;
+        STACK_OF(X509) *certs = NULL;
+        int ok;
+
+        if (!load_certs_autofmt(opt_cert, &certs, 0, opt_keypass,
+                                "CMP client certificate (and optionally extra certs)"))
+            /* opt_keypass is needed if opt_cert is an encrypted PKCS#12 file */
+            goto err;
+
+        cert = sk_X509_delete(certs, 0);
+        if (cert == NULL) {
+            CMP_err("no client certificate found");
+            sk_X509_pop_free(certs, X509_free);
+            goto err;
+        }
+        ok = OSSL_CMP_CTX_set1_cert(ctx, cert);
+        X509_free(cert);
+
+        if (ok) {
+            /* add any remaining certs to the list of untrusted certs */
+            STACK_OF(X509) *untrusted = OSSL_CMP_CTX_get0_untrusted_certs(ctx);
+            ok = untrusted != NULL ?
+                sk_X509_add1_certs(untrusted, certs, 0, 1 /* no dups */, 0) :
+                OSSL_CMP_CTX_set1_untrusted_certs(ctx, certs);
+        }
+        sk_X509_pop_free(certs, X509_free);
+        if (!ok)
+            goto oom;
+    }
+
+    if (!setup_certs(opt_extracerts, "extra certificates for CMP", ctx,
+                     (add_X509_stack_fn_t)OSSL_CMP_CTX_set1_extraCertsOut,
+                     NULL))
+        goto err;
+    cleanse(opt_otherpass);
+
+    if (opt_unprotected_requests)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_UNPROTECTED_SEND, 1);
+
+    if (opt_digest != NULL) {
+        int digest = OBJ_ln2nid(opt_digest);
+
+        if (digest == NID_undef) {
+            CMP_err1("digest algorithm name not recognized: '%s'", opt_digest);
+            goto err;
+        }
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_DIGEST_ALGNID, digest);
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_OWF_ALGNID, digest);
+    }
+
+    if (opt_mac != NULL) {
+        int mac = OBJ_ln2nid(opt_mac);
+        if (mac == NID_undef) {
+            CMP_err1("MAC algorithm name not recognized: '%s'", opt_mac);
+            goto err;
+        }
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_MAC_ALGNID, mac);
+    }
+    return 1;
+
+ oom:
+    CMP_err("out of memory");
+ err:
+    return 0;
+}
+
+/*
+ * set up IR/CR/KUR/CertConf/RR specific parts of the OSSL_CMP_CTX
+ * based on options from config file/CLI.
+ * Returns pointer on success, NULL on error
+ */
+static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
+{
+    if (opt_subject == NULL && opt_oldcert == NULL && opt_cert == NULL)
+        CMP_warn("no -subject given, neither -oldcert nor -cert available as default");
+    if (!set_name(opt_subject, OSSL_CMP_CTX_set1_subjectName, ctx, "subject")
+            || !set_name(opt_issuer, OSSL_CMP_CTX_set1_issuer, ctx, "issuer"))
+        goto err;
+
+    if (opt_newkey != NULL) {
+        const char *file = opt_newkey;
+        const int format = opt_keyform;
+        const char *pass = opt_newkeypass;
+        const char *desc = "new private or public key for cert to be enrolled";
+        EVP_PKEY *pkey = load_key_pwd(file, format, pass, e, NULL);
+        int priv = 1;
+
+        if (pkey == NULL) {
+            ERR_clear_error();
+            pkey = load_pubkey(file, format, 0, pass, e, desc);
+            priv = 0;
+        }
+        cleanse(opt_newkeypass);
+        if (pkey == NULL || !OSSL_CMP_CTX_set0_newPkey(ctx, priv, pkey)) {
+            EVP_PKEY_free(pkey);
+            goto err;
+        }
+    }
+
+    if (opt_days > 0)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_VALIDITY_DAYS,
+                                      opt_days);
+
+    if (opt_policies != NULL && opt_policy_oids != NULL) {
+        CMP_err("cannot have policies both via -policies and via -policy_oids");
+        goto err;
+    }
+
+    if (opt_reqexts != NULL || opt_policies != NULL) {
+        X509V3_CTX ext_ctx;
+        X509_EXTENSIONS *exts = sk_X509_EXTENSION_new_null();
+
+        if (exts == NULL)
+            goto err;
+        X509V3_set_ctx(&ext_ctx, NULL, NULL, NULL, NULL, 0);
+        X509V3_set_nconf(&ext_ctx, conf);
+        if (opt_reqexts != NULL
+            && !X509V3_EXT_add_nconf_sk(conf, &ext_ctx, opt_reqexts, &exts)) {
+            CMP_err1("cannot load certificate request extension section '%s'",
+                     opt_reqexts);
+            sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
+            goto err;
+        }
+        if (opt_policies != NULL
+            && !X509V3_EXT_add_nconf_sk(conf, &ext_ctx, opt_policies, &exts)) {
+            CMP_err1("cannot load policy cert request extension section '%s'",
+                     opt_policies);
+            sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
+            goto err;
+        }
+        OSSL_CMP_CTX_set0_reqExtensions(ctx, exts);
+    }
+    if (OSSL_CMP_CTX_reqExtensions_have_SAN(ctx) && opt_sans != NULL) {
+        CMP_err("cannot have Subject Alternative Names both via -reqexts and via -sans");
+        goto err;
+    }
+
+    if (!set_gennames(ctx, opt_sans, "Subject Alternative Name"))
+        goto err;
+
+    if (opt_san_nodefault) {
+        if (opt_sans != NULL)
+            CMP_warn("-opt_san_nodefault has no effect when -sans is used");
+        (void)OSSL_CMP_CTX_set_option(ctx,
+                                      OSSL_CMP_OPT_SUBJECTALTNAME_NODEFAULT, 1);
+    }
+
+    if (opt_policy_oids_critical) {
+        if (opt_policy_oids == NULL)
+            CMP_warn("-opt_policy_oids_critical has no effect unless -policy_oids is given");
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_POLICIES_CRITICAL, 1);
+    }
+
+    while (opt_policy_oids != NULL) {
+        ASN1_OBJECT *policy;
+        POLICYINFO *pinfo;
+        char *next = next_item(opt_policy_oids);
+
+        if ((policy = OBJ_txt2obj(opt_policy_oids, 1)) == 0) {
+            CMP_err1("unknown policy OID '%s'", opt_policy_oids);
+            goto err;
+        }
+
+        if ((pinfo = POLICYINFO_new()) == NULL) {
+            ASN1_OBJECT_free(policy);
+            goto err;
+        }
+        pinfo->policyid = policy;
+
+        if (!OSSL_CMP_CTX_push0_policy(ctx, pinfo)) {
+            CMP_err1("cannot add policy with OID '%s'", opt_policy_oids);
+            POLICYINFO_free(pinfo);
+            goto err;
+        }
+        opt_policy_oids = next;
+    }
+
+    if (opt_popo >= OSSL_CRMF_POPO_NONE)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_POPO_METHOD, opt_popo);
+
+    if (opt_csr != NULL) {
+        if (opt_cmd != CMP_P10CR) {
+            CMP_warn("-csr option is ignored for command other than p10cr");
+        } else {
+            X509_REQ *csr =
+                load_csr_autofmt(opt_csr, "PKCS#10 CSR for p10cr");
+
+            if (csr == NULL)
+                goto err;
+            if (!OSSL_CMP_CTX_set1_p10CSR(ctx, csr)) {
+                X509_REQ_free(csr);
+                goto oom;
+            }
+            X509_REQ_free(csr);
+        }
+    }
+
+    if (opt_oldcert != NULL) {
+        X509 *oldcert = load_cert_pwd(opt_oldcert, opt_keypass,
+                                      "certificate to be updated/revoked");
+        /* opt_keypass is needed if opt_oldcert is an encrypted PKCS#12 file */
+
+        if (oldcert == NULL)
+            goto err;
+        if (!OSSL_CMP_CTX_set1_oldCert(ctx, oldcert)) {
+            X509_free(oldcert);
+            goto oom;
+        }
+        X509_free(oldcert);
+    }
+    cleanse(opt_keypass);
+    if (opt_revreason > CRL_REASON_NONE)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_REVOCATION_REASON,
+                                      opt_revreason);
+
+    return 1;
+
+ oom:
+    CMP_err("out of memory");
+ err:
+    return 0;
+}
+
+static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
+{
+    long value;
+    ASN1_OBJECT *type;
+    ASN1_INTEGER *aint;
+    ASN1_TYPE *val;
+    OSSL_CMP_ITAV *itav;
+    char *endstr;
+    char *valptr = strchr(opt_geninfo, ':');
+
+    if (valptr == NULL) {
+        CMP_err("missing ':' in -geninfo option");
+        return 0;
+    }
+    valptr[0] = '\0';
+    valptr++;
+
+    if (strncasecmp(valptr, "int:", 4) != 0) {
+        CMP_err("missing 'int:' in -geninfo option");
+        return 0;
+    }
+    valptr += 4;
+
+    value = strtol(valptr, &endstr, 10);
+    if (endstr == valptr || *endstr != '\0') {
+        CMP_err("cannot parse int in -geninfo option");
+        return 0;
+    }
+
+    type = OBJ_txt2obj(opt_geninfo, 1);
+    if (type == NULL) {
+        CMP_err("cannot parse OID in -geninfo option");
+        return 0;
+    }
+
+    aint = ASN1_INTEGER_new();
+    if (aint == NULL || !ASN1_INTEGER_set(aint, value))
+        goto oom;
+
+    val = ASN1_TYPE_new();
+    if (val == NULL) {
+        ASN1_INTEGER_free(aint);
+        goto oom;
+    }
+    ASN1_TYPE_set(val, V_ASN1_INTEGER, aint);
+    itav = OSSL_CMP_ITAV_create(type, val);
+    if (itav == NULL) {
+        ASN1_TYPE_free(val);
+        goto oom;
+    }
+
+    if (!OSSL_CMP_CTX_push0_geninfo_ITAV(ctx, itav)) {
+        OSSL_CMP_ITAV_free(itav);
+        return 0;
+    }
+    return 1;
+
+ oom:
+    CMP_err("out of memory");
+    return 0;
+}
+
+
+/*
+ * set up the client-side OSSL_CMP_CTX based on options from config file/CLI
+ * while parsing options and checking their consistency.
+ * Prints reason for error to bio_err.
+ * Returns 1 on success, 0 on error
+ */
+static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *e)
+{
+    int ret = 0;
+    char server_buf[200] = { '\0' };
+    char proxy_buf[200] = { '\0' };
+    char *proxy_host = NULL;
+    char *proxy_port_str = NULL;
+
+    if (opt_server == NULL) {
+        CMP_err("missing server address[:port]");
+        goto err;
+    } else if ((server_port =
+                parse_addr(&opt_server, server_port, "server")) < 0) {
+        goto err;
+    }
+    if (server_port != 0)
+        BIO_snprintf(server_port_s, sizeof(server_port_s), "%d", server_port);
+    if (!OSSL_CMP_CTX_set1_server(ctx, opt_server)
+            || !OSSL_CMP_CTX_set_serverPort(ctx, server_port)
+            || !OSSL_CMP_CTX_set1_serverPath(ctx, opt_path))
+        goto oom;
+    if (opt_proxy != NULL && !OSSL_CMP_CTX_set1_proxy(ctx, opt_proxy))
+        goto oom;
+    if (opt_no_proxy != NULL && !OSSL_CMP_CTX_set1_no_proxy(ctx, opt_no_proxy))
+        goto oom;
+    (void)BIO_snprintf(server_buf, sizeof(server_buf), "http%s://%s%s%s/%s",
+                       opt_tls_used ? "s" : "", opt_server,
+                       server_port == 0 ? "" : ":", server_port_s,
+                       opt_path == NULL ? "" :
+                       opt_path[0] == '/' ? opt_path + 1 : opt_path);
+
+    if (opt_proxy != NULL)
+        (void)BIO_snprintf(proxy_buf, sizeof(proxy_buf), " via %s", opt_proxy);
+    CMP_info2("will contact %s%s", server_buf, proxy_buf);
+
+    if (!transform_opts())
+        goto err;
+
+    if (opt_cmd == CMP_IR || opt_cmd == CMP_CR || opt_cmd == CMP_KUR) {
+        if (opt_newkey == NULL && opt_key == NULL && opt_csr == NULL) {
+            CMP_err("missing -newkey (or -key) to be certified");
+            goto err;
+        }
+        if (opt_certout == NULL) {
+            CMP_err("-certout not given, nowhere to save certificate");
+            goto err;
+        }
+    }
+    if (opt_cmd == CMP_KUR) {
+        char *ref_cert = opt_oldcert != NULL ? opt_oldcert : opt_cert;
+
+        if (ref_cert == NULL) {
+            CMP_err("missing -oldcert option for certificate to be updated");
+            goto err;
+        }
+        if (opt_subject != NULL)
+            CMP_warn2("-subject '%s' given, which overrides the subject of '%s' in KUR",
+                      opt_subject, ref_cert);
+    }
+    if (opt_cmd == CMP_RR && opt_oldcert == NULL) {
+        CMP_err("missing certificate to be revoked");
+        goto err;
+    }
+    if (opt_cmd == CMP_P10CR && opt_csr == NULL) {
+        CMP_err("missing PKCS#10 CSR for p10cr");
+        goto err;
+    }
+
+    if (opt_recipient == NULL && opt_srvcert == NULL && opt_issuer == NULL
+            && opt_oldcert == NULL && opt_cert == NULL)
+        CMP_warn("missing -recipient, -srvcert, -issuer, -oldcert or -cert; recipient will be set to \"NULL-DN\"");
+
+    if (opt_infotype_s != NULL) {
+        char id_buf[100] = "id-it-";
+
+        strncat(id_buf, opt_infotype_s, sizeof(id_buf) - strlen(id_buf) - 1);
+        if ((opt_infotype = OBJ_sn2nid(id_buf)) == NID_undef) {
+            CMP_err("unknown OID name in -infotype option");
+            goto err;
+        }
+    }
+
+    if (!setup_verification_ctx(ctx))
+        goto err;
+
+    if (opt_msg_timeout >= 0) /* must do this before setup_ssl_ctx() */
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_MSG_TIMEOUT,
+                                      opt_msg_timeout);
+    if (opt_total_timeout >= 0)
+        (void)OSSL_CMP_CTX_set_option(ctx, OSSL_CMP_OPT_TOTAL_TIMEOUT,
+                                      opt_total_timeout);
+
+    if (opt_reqin != NULL && opt_rspin != NULL)
+        CMP_warn("-reqin is ignored since -rspin is present");
+    if (opt_reqin_new_tid && opt_reqin == NULL)
+        CMP_warn("-reqin_new_tid is ignored since -reqin is not present");
+    if (opt_reqin != NULL || opt_reqout != NULL
+            || opt_rspin != NULL || opt_rspout != NULL || opt_use_mock_srv)
+        (void)OSSL_CMP_CTX_set_transfer_cb(ctx, read_write_req_resp);
+
+    if ((opt_tls_cert != NULL || opt_tls_key != NULL
+         || opt_tls_keypass != NULL || opt_tls_extra != NULL
+         || opt_tls_trusted != NULL || opt_tls_host != NULL)
+            && !opt_tls_used)
+        CMP_warn("TLS options(s) given but not -tls_used");
+    if (opt_tls_used) {
+#ifdef OPENSSL_NO_SOCK
+        BIO_printf(bio_err, "Cannot use TLS - sockets not supported\n");
+        goto err;
+#else
+        APP_HTTP_TLS_INFO *info;
+
+        if (opt_tls_cert != NULL
+            || opt_tls_key != NULL || opt_tls_keypass != NULL) {
+            if (opt_tls_key == NULL) {
+                CMP_err("missing -tls_key option");
+                goto err;
+            } else if (opt_tls_cert == NULL) {
+                CMP_err("missing -tls_cert option");
+                goto err;
+            }
+        }
+        if (opt_use_mock_srv) {
+            CMP_err("cannot use TLS options together with -use_mock_srv");
+            goto err;
+        }
+        if ((info = OPENSSL_zalloc(sizeof(*info))) == NULL)
+            goto err;
+        (void)OSSL_CMP_CTX_set_http_cb_arg(ctx, info);
+        /* info will be freed along with CMP ctx */
+        info->server = opt_server;
+        info->port = server_port_s;
+        info->use_proxy = opt_proxy != NULL;
+        info->timeout = OSSL_CMP_CTX_get_option(ctx, OSSL_CMP_OPT_MSG_TIMEOUT);
+        info->ssl_ctx = setup_ssl_ctx(ctx, e);
+        if (info->ssl_ctx == NULL)
+            goto err;
+        (void)OSSL_CMP_CTX_set_http_cb(ctx, app_http_tls_cb);
+#endif
+    }
+
+    if (!setup_protection_ctx(ctx, e))
+        goto err;
+
+    if (!setup_request_ctx(ctx, e))
+        goto err;
+
+    if (!set_name(opt_recipient, OSSL_CMP_CTX_set1_recipient, ctx, "recipient")
+            || !set_name(opt_expect_sender, OSSL_CMP_CTX_set1_expected_sender,
+                         ctx, "expected sender"))
+        goto err;
+
+    if (opt_geninfo != NULL && !handle_opt_geninfo(ctx))
+        goto err;
+
+    ret = 1;
+
+ err:
+    OPENSSL_free(proxy_host);
+    OPENSSL_free(proxy_port_str);
+    return ret;
+ oom:
+    CMP_err("out of memory");
+    goto err;
+}
+
+/*
+ * write out the given certificate to the output specified by bio.
+ * Depending on options use either PEM or DER format.
+ * Returns 1 on success, 0 on error
+ */
+static int write_cert(BIO *bio, X509 *cert)
+{
+    if ((opt_certform == FORMAT_PEM && PEM_write_bio_X509(bio, cert))
+            || (opt_certform == FORMAT_ASN1 && i2d_X509_bio(bio, cert)))
+        return 1;
+    if (opt_certform != FORMAT_PEM && opt_certform != FORMAT_ASN1)
+        BIO_printf(bio_err,
+                   "error: unsupported type '%s' for writing certificates\n",
+                   opt_certform_s);
+    return 0;
+}
+
+/*
+ * writes out a stack of certs to the given file.
+ * Depending on options use either PEM or DER format,
+ * where DER does not make much sense for writing more than one cert!
+ * Returns number of written certificates on success, 0 on error.
+ */
+static int save_certs(OSSL_CMP_CTX *ctx,
+                      STACK_OF(X509) *certs, char *destFile, char *desc)
+{
+    BIO *bio = NULL;
+    int i;
+    int n = sk_X509_num(certs);
+
+    CMP_info3("received %d %s certificate(s), saving to file '%s'",
+              n, desc, destFile);
+    if (n > 1 && opt_certform != FORMAT_PEM)
+        CMP_warn("saving more than one certificate in non-PEM format");
+
+    if (destFile == NULL || (bio = BIO_new(BIO_s_file())) == NULL
+            || !BIO_write_filename(bio, (char *)destFile)) {
+        CMP_err1("could not open file '%s' for writing", destFile);
+        n = -1;
+        goto err;
+    }
+
+    for (i = 0; i < n; i++) {
+        if (!write_cert(bio, sk_X509_value(certs, i))) {
+            CMP_err1("cannot write certificate to file '%s'", destFile);
+            n = -1;
+            goto err;
+        }
+    }
+
+ err:
+    BIO_free(bio);
+    return n;
+}
+
+static void print_itavs(STACK_OF(OSSL_CMP_ITAV) *itavs)
+{
+    OSSL_CMP_ITAV *itav = NULL;
+    char buf[128];
+    int i;
+    int n = sk_OSSL_CMP_ITAV_num(itavs); /* itavs == NULL leads to 0 */
+
+    if (n == 0) {
+        CMP_info("genp contains no ITAV");
+        return;
+    }
+
+    for (i = 0; i < n; i++) {
+        itav = sk_OSSL_CMP_ITAV_value(itavs, i);
+        OBJ_obj2txt(buf, 128, OSSL_CMP_ITAV_get0_type(itav), 0);
+        CMP_info1("genp contains ITAV of type: %s", buf);
+    }
+}
+
+static char opt_item[SECTION_NAME_MAX + 1];
+/* get previous name from a comma-separated list of names */
+static const char *prev_item(const char *opt, const char *end)
+{
+    const char *beg;
+    size_t len;
+
+    if (end == opt)
+        return NULL;
+    beg = end;
+    while (beg != opt && beg[-1] != ',' && !isspace(beg[-1]))
+        beg--;
+    len = end - beg;
+    if (len > SECTION_NAME_MAX)
+        len = SECTION_NAME_MAX;
+    strncpy(opt_item, beg, len);
+    opt_item[SECTION_NAME_MAX] = '\0'; /* avoid gcc v8 O3 stringop-truncation */
+    opt_item[len] = '\0';
+    if (len > SECTION_NAME_MAX)
+        CMP_warn2("using only first %d characters of section name starting with \"%s\"",
+                  SECTION_NAME_MAX, opt_item);
+    while (beg != opt && (beg[-1] == ',' || isspace(beg[-1])))
+        beg--;
+    return beg;
+}
+
+/* get str value for name from a comma-separated hierarchy of config sections */
+static char *conf_get_string(const CONF *src_conf, const char *groups,
+                             const char *name)
+{
+    char *res = NULL;
+    const char *end = groups + strlen(groups);
+
+    while ((end = prev_item(groups, end)) != NULL) {
+        if ((res = NCONF_get_string(src_conf, opt_item, name)) != NULL)
+            return res;
+    }
+    return res;
+}
+
+/* get long val for name from a comma-separated hierarchy of config sections */
+static int conf_get_number_e(const CONF *conf_, const char *groups,
+                             const char *name, long *result)
+{
+    char *str = conf_get_string(conf_, groups, name);
+    char *tailptr;
+    long res;
+
+    if (str == NULL || *str == '\0')
+        return 0;
+
+    res = strtol(str, &tailptr, 10);
+    if (res == LONG_MIN || res == LONG_MAX || *tailptr != '\0')
+        return 0;
+
+    *result = res;
+    return 1;
+}
+
+/*
+ * use the command line option table to read values from the CMP section
+ * of openssl.cnf.  Defaults are taken from the config file, they can be
+ * overwritten on the command line.
+ */
+static int read_config(void)
+{
+    unsigned int i;
+    long num = 0;
+    char *txt = NULL;
+    const OPTIONS *opt;
+    int provider_option;
+    int verification_option;
+
+    /*
+     * starting with offset OPT_SECTION because OPT_CONFIG and OPT_SECTION would
+     * not make sense within the config file. They have already been handled.
+     */
+    for (i = OPT_SECTION - OPT_HELP, opt = &cmp_options[OPT_SECTION];
+         opt->name; i++, opt++) {
+        if (!strcmp(opt->name, OPT_SECTION_STR)
+                || !strcmp(opt->name, OPT_MORE_STR)) {
+            i--;
+            continue;
+        }
+        provider_option = (OPT_PROV__FIRST <= opt->retval
+                               && opt->retval < OPT_PROV__LAST);
+        verification_option = (OPT_V__FIRST <= opt->retval
+                                   && opt->retval < OPT_V__LAST);
+        if (provider_option || verification_option)
+            i--;
+        if (cmp_vars[i].txt == NULL) {
+            CMP_err1("internal: cmp_vars array too short, i=%d", i);
+            return 0;
+        }
+        switch (opt->valtype) {
+        case '-':
+        case 'n':
+        case 'l':
+            if (!conf_get_number_e(conf, opt_section, opt->name, &num)) {
+                ERR_clear_error();
+                continue; /* option not provided */
+            }
+            break;
+            /*
+             * do not use '<' in cmp_options. Incorrect treatment
+             * somewhere in args_verify() can wrongly set badarg = 1
+             */
+        case '<':
+        case 's':
+        case 'M':
+            txt = conf_get_string(conf, opt_section, opt->name);
+            if (txt == NULL) {
+                ERR_clear_error();
+                continue; /* option not provided */
+            }
+            break;
+        default:
+            CMP_err2("internal: unsupported type '%c' for option '%s'",
+                     opt->valtype, opt->name);
+            return 0;
+            break;
+        }
+        if (provider_option || verification_option) {
+            int conf_argc = 1;
+            char *conf_argv[3];
+            char arg1[82];
+
+            BIO_snprintf(arg1, 81, "-%s", (char *)opt->name);
+            conf_argv[0] = prog;
+            conf_argv[1] = arg1;
+            if (opt->valtype == '-') {
+                if (num != 0)
+                    conf_argc = 2;
+            } else {
+                conf_argc = 3;
+                conf_argv[2] = conf_get_string(conf, opt_section, opt->name);
+                /* not NULL */
+            }
+            if (conf_argc > 1) {
+                (void)opt_init(conf_argc, conf_argv, cmp_options);
+
+                if (provider_option
+                    ? !opt_provider(opt_next())
+                    : !opt_verify(opt_next(), vpm)) {
+                    CMP_err2("for option '%s' in config file section '%s'",
+                             opt->name, opt_section);
+                    return 0;
+                }
+            }
+        } else {
+            switch (opt->valtype) {
+            case '-':
+            case 'n':
+                if (num < INT_MIN || INT_MAX < num) {
+                    BIO_printf(bio_err,
+                               "integer value out of range for option '%s'\n",
+                               opt->name);
+                    return 0;
+                }
+                *cmp_vars[i].num = (int)num;
+                break;
+            case 'l':
+                *cmp_vars[i].num_long = num;
+                break;
+            default:
+                if (txt != NULL && txt[0] == '\0')
+                    txt = NULL; /* reset option on empty string input */
+                *cmp_vars[i].txt = txt;
+                break;
+            }
+        }
+    }
+
+    return 1;
+}
+
+static char *opt_str(char *opt)
+{
+    char *arg = opt_arg();
+
+    if (arg[0] == '\0') {
+        CMP_warn1("argument of -%s option is empty string, resetting option",
+                  opt);
+        arg = NULL;
+    } else if (arg[0] == '-') {
+        CMP_warn1("argument of -%s option starts with hyphen", opt);
+    }
+    return arg;
+}
+
+static int opt_nat(void)
+{
+    int result = -1;
+
+    if (opt_int(opt_arg(), &result) && result < 0)
+        BIO_printf(bio_err, "error: argument '%s' must not be negative\n",
+                   opt_arg());
+    return result;
+}
+
+/* returns 1 on success, 0 on error, -1 on -help (i.e., stop with success) */
+static int get_opts(int argc, char **argv)
+{
+    OPTION_CHOICE o;
+
+    prog = opt_init(argc, argv, cmp_options);
+
+    while ((o = opt_next()) != OPT_EOF) {
+        switch (o) {
+        case OPT_EOF:
+        case OPT_ERR:
+            goto opt_err;
+        case OPT_HELP:
+            opt_help(cmp_options);
+            return -1;
+        case OPT_CONFIG: /* has already been handled */
+            break;
+        case OPT_SECTION: /* has already been handled */
+            break;
+        case OPT_SERVER:
+            opt_server = opt_str("server");
+            break;
+        case OPT_PROXY:
+            opt_proxy = opt_str("proxy");
+            break;
+        case OPT_NO_PROXY:
+            opt_no_proxy = opt_str("no_proxy");
+            break;
+        case OPT_PATH:
+            opt_path = opt_str("path");
+            break;
+        case OPT_MSG_TIMEOUT:
+            if ((opt_msg_timeout = opt_nat()) < 0)
+                goto opt_err;
+            break;
+        case OPT_TOTAL_TIMEOUT:
+            if ((opt_total_timeout = opt_nat()) < 0)
+                goto opt_err;
+            break;
+        case OPT_TLS_USED:
+            opt_tls_used = 1;
+            break;
+        case OPT_TLS_CERT:
+            opt_tls_cert = opt_str("tls_cert");
+            break;
+        case OPT_TLS_KEY:
+            opt_tls_key = opt_str("tls_key");
+            break;
+        case OPT_TLS_KEYPASS:
+            opt_tls_keypass = opt_str("tls_keypass");
+            break;
+        case OPT_TLS_EXTRA:
+            opt_tls_extra = opt_str("tls_extra");
+            break;
+        case OPT_TLS_TRUSTED:
+            opt_tls_trusted = opt_str("tls_trusted");
+            break;
+        case OPT_TLS_HOST:
+            opt_tls_host = opt_str("tls_host");
+            break;
+        case OPT_REF:
+            opt_ref = opt_str("ref");
+            break;
+        case OPT_SECRET:
+            opt_secret = opt_str("secret");
+            break;
+        case OPT_CERT:
+            opt_cert = opt_str("cert");
+            break;
+        case OPT_KEY:
+            opt_key = opt_str("key");
+            break;
+        case OPT_KEYPASS:
+            opt_keypass = opt_str("keypass");
+            break;
+        case OPT_DIGEST:
+            opt_digest = opt_str("digest");
+            break;
+        case OPT_MAC:
+            opt_mac = opt_str("mac");
+            break;
+        case OPT_EXTRACERTS:
+            opt_extracerts = opt_str("extracerts");
+            break;
+        case OPT_UNPROTECTED_REQUESTS:
+            opt_unprotected_requests = 1;
+            break;
+
+        case OPT_TRUSTED:
+            opt_trusted = opt_str("trusted");
+            break;
+        case OPT_UNTRUSTED:
+            opt_untrusted = opt_str("untrusted");
+            break;
+        case OPT_SRVCERT:
+            opt_srvcert = opt_str("srvcert");
+            break;
+        case OPT_RECIPIENT:
+            opt_recipient = opt_str("recipient");
+            break;
+        case OPT_EXPECT_SENDER:
+            opt_expect_sender = opt_str("expect_sender");
+            break;
+        case OPT_IGNORE_KEYUSAGE:
+            opt_ignore_keyusage = 1;
+            break;
+        case OPT_UNPROTECTED_ERRORS:
+            opt_unprotected_errors = 1;
+            break;
+        case OPT_EXTRACERTSOUT:
+            opt_extracertsout = opt_str("extracertsout");
+            break;
+        case OPT_CACERTSOUT:
+            opt_cacertsout = opt_str("cacertsout");
+            break;
+
+        case OPT_V_CASES:
+            if (!opt_verify(o, vpm))
+                goto opt_err;
+            break;
+        case OPT_CMD:
+            opt_cmd_s = opt_str("cmd");
+            break;
+        case OPT_INFOTYPE:
+            opt_infotype_s = opt_str("infotype");
+            break;
+        case OPT_GENINFO:
+            opt_geninfo = opt_str("geninfo");
+            break;
+
+        case OPT_NEWKEY:
+            opt_newkey = opt_str("newkey");
+            break;
+        case OPT_NEWKEYPASS:
+            opt_newkeypass = opt_str("newkeypass");
+            break;
+        case OPT_SUBJECT:
+            opt_subject = opt_str("subject");
+            break;
+        case OPT_ISSUER:
+            opt_issuer = opt_str("issuer");
+            break;
+        case OPT_DAYS:
+            if ((opt_days = opt_nat()) < 0)
+                goto opt_err;
+            break;
+        case OPT_REQEXTS:
+            opt_reqexts = opt_str("reqexts");
+            break;
+        case OPT_SANS:
+            opt_sans = opt_str("sans");
+            break;
+        case OPT_SAN_NODEFAULT:
+            opt_san_nodefault = 1;
+            break;
+        case OPT_POLICIES:
+            opt_policies = opt_str("policies");
+            break;
+        case OPT_POLICY_OIDS:
+            opt_policy_oids = opt_str("policy_oids");
+            break;
+        case OPT_POLICY_OIDS_CRITICAL:
+            opt_policy_oids_critical = 1;
+            break;
+        case OPT_POPO:
+            if (!opt_int(opt_arg(), &opt_popo)
+                    || opt_popo < OSSL_CRMF_POPO_NONE
+                    || opt_popo > OSSL_CRMF_POPO_KEYENC) {
+                CMP_err("invalid popo spec. Valid values are -1 .. 2");
+                goto opt_err;
+            }
+            break;
+        case OPT_CSR:
+            opt_csr = opt_arg();
+            break;
+        case OPT_OUT_TRUSTED:
+            opt_out_trusted = opt_str("out_trusted");
+            break;
+        case OPT_IMPLICIT_CONFIRM:
+            opt_implicit_confirm = 1;
+            break;
+        case OPT_DISABLE_CONFIRM:
+            opt_disable_confirm = 1;
+            break;
+        case OPT_CERTOUT:
+            opt_certout = opt_str("certout");
+            break;
+        case OPT_OLDCERT:
+            opt_oldcert = opt_str("oldcert");
+            break;
+        case OPT_REVREASON:
+            if (!opt_int(opt_arg(), &opt_revreason)
+                    || opt_revreason < CRL_REASON_NONE
+                    || opt_revreason > CRL_REASON_AA_COMPROMISE
+                    || opt_revreason == 7) {
+                CMP_err("invalid revreason. Valid values are -1 .. 6, 8 .. 10");
+                goto opt_err;
+            }
+            break;
+        case OPT_CERTFORM:
+            opt_certform_s = opt_str("certform");
+            break;
+        case OPT_KEYFORM:
+            opt_keyform_s = opt_str("keyform");
+            break;
+        case OPT_CERTSFORM:
+            opt_certsform_s = opt_str("certsform");
+            break;
+        case OPT_OTHERPASS:
+            opt_otherpass = opt_str("otherpass");
+            break;
+#ifndef OPENSSL_NO_ENGINE
+        case OPT_ENGINE:
+            opt_engine = opt_str("engine");
+            break;
+#endif
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto opt_err;
+            break;
+
+        case OPT_BATCH:
+            opt_batch = 1;
+            break;
+        case OPT_REPEAT:
+            opt_repeat = opt_nat();
+            break;
+        case OPT_REQIN:
+            opt_reqin = opt_str("reqin");
+            break;
+        case OPT_REQIN_NEW_TID:
+            opt_reqin_new_tid = 1;
+            break;
+        case OPT_REQOUT:
+            opt_reqout = opt_str("reqout");
+            break;
+        case OPT_RSPIN:
+            opt_rspin = opt_str("rspin");
+            break;
+        case OPT_RSPOUT:
+            opt_rspout = opt_str("rspout");
+            break;
+        case OPT_USE_MOCK_SRV:
+            opt_use_mock_srv = 1;
+            break;
+        case OPT_PORT:
+            opt_port = opt_str("port");
+            break;
+        case OPT_MAX_MSGS:
+            if ((opt_max_msgs = opt_nat()) < 0)
+                goto opt_err;
+            break;
+        case OPT_SRV_REF:
+            opt_srv_ref = opt_str("srv_ref");
+            break;
+        case OPT_SRV_SECRET:
+            opt_srv_secret = opt_str("srv_secret");
+            break;
+        case OPT_SRV_CERT:
+            opt_srv_cert = opt_str("srv_cert");
+            break;
+        case OPT_SRV_KEY:
+            opt_srv_key = opt_str("srv_key");
+            break;
+        case OPT_SRV_KEYPASS:
+            opt_srv_keypass = opt_str("srv_keypass");
+            break;
+        case OPT_SRV_TRUSTED:
+            opt_srv_trusted = opt_str("srv_trusted");
+            break;
+        case OPT_SRV_UNTRUSTED:
+            opt_srv_untrusted = opt_str("srv_untrusted");
+            break;
+        case OPT_RSP_CERT:
+            opt_rsp_cert = opt_str("rsp_cert");
+            break;
+        case OPT_RSP_EXTRACERTS:
+            opt_rsp_extracerts = opt_str("rsp_extracerts");
+            break;
+        case OPT_RSP_CAPUBS:
+            opt_rsp_capubs = opt_str("rsp_capubs");
+            break;
+        case OPT_POLL_COUNT:
+            opt_poll_count = opt_nat();
+            break;
+        case OPT_CHECK_AFTER:
+            opt_check_after = opt_nat();
+            break;
+        case OPT_GRANT_IMPLICITCONF:
+            opt_grant_implicitconf = 1;
+            break;
+        case OPT_PKISTATUS:
+            opt_pkistatus = opt_nat();
+            break;
+        case OPT_FAILURE:
+            opt_failure = opt_nat();
+            break;
+        case OPT_FAILUREBITS:
+            opt_failurebits = opt_nat();
+            break;
+        case OPT_STATUSSTRING:
+            opt_statusstring = opt_str("statusstring");
+            break;
+        case OPT_SEND_ERROR:
+            opt_send_error = 1;
+            break;
+        case OPT_SEND_UNPROTECTED:
+            opt_send_unprotected = 1;
+            break;
+        case OPT_SEND_UNPROT_ERR:
+            opt_send_unprot_err = 1;
+            break;
+        case OPT_ACCEPT_UNPROTECTED:
+            opt_accept_unprotected = 1;
+            break;
+        case OPT_ACCEPT_UNPROT_ERR:
+            opt_accept_unprot_err = 1;
+            break;
+        case OPT_ACCEPT_RAVERIFIED:
+            opt_accept_raverified = 1;
+            break;
+        }
+    }
+    argc = opt_num_rest();
+    argv = opt_rest();
+    if (argc != 0) {
+        CMP_err1("unknown parameter %s", argv[0]);
+        goto opt_err;
+    }
+    return 1;
+
+ opt_err:
+    CMP_err1("use -help for summary of '%s' options", prog);
+    return 0;
+}
+
+int cmp_main(int argc, char **argv)
+{
+    char *configfile = NULL;
+    int i;
+    X509 *newcert = NULL;
+    ENGINE *e = NULL;
+    char mock_server[] = "mock server:1";
+    int ret = 0; /* default: failure */
+
+    if (argc <= 1) {
+        opt_help(cmp_options);
+        goto err;
+    }
+
+    /*
+     * handle OPT_CONFIG and OPT_SECTION upfront to take effect for other opts
+     */
+    for (i = 1; i < argc - 1; i++) {
+        if (*argv[i] == '-') {
+            if (!strcmp(argv[i] + 1, cmp_options[OPT_CONFIG - OPT_HELP].name))
+                opt_config = argv[i + 1];
+            else if (!strcmp(argv[i] + 1,
+                             cmp_options[OPT_SECTION - OPT_HELP].name))
+                opt_section = argv[i + 1];
+        }
+    }
+    if (opt_section[0] == '\0') /* empty string */
+        opt_section = DEFAULT_SECTION;
+
+    vpm = X509_VERIFY_PARAM_new();
+    if (vpm == NULL) {
+        CMP_err("out of memory");
+        goto err;
+    }
+
+    /* read default values for options from config file */
+    configfile = opt_config != NULL ? opt_config : default_config_file;
+    if (configfile && configfile[0] != '\0' /* non-empty string */
+            && (configfile != default_config_file
+                    || access(configfile, F_OK) != -1)) {
+        CMP_info1("using OpenSSL configuration file '%s'", configfile);
+        conf = app_load_config(configfile);
+        if (conf == NULL) {
+            goto err;
+        } else {
+            if (strcmp(opt_section, CMP_SECTION) == 0) { /* default */
+                if (!NCONF_get_section(conf, opt_section))
+                    CMP_info2("no [%s] section found in config file '%s';"
+                              " will thus use just [default] and unnamed section if present",
+                              opt_section, configfile);
+            } else {
+                const char *end = opt_section + strlen(opt_section);
+                while ((end = prev_item(opt_section, end)) != NULL) {
+                    if (!NCONF_get_section(conf, opt_item)) {
+                        CMP_err2("no [%s] section found in config file '%s'",
+                                 opt_item, configfile);
+                        goto err;
+                    }
+                }
+            }
+            if (!read_config())
+                goto err;
+        }
+    }
+    (void)BIO_flush(bio_err); /* prevent interference with opt_help() */
+
+    ret = get_opts(argc, argv);
+    if (ret <= 0)
+        goto err;
+    ret = 0;
+
+    if (opt_batch) {
+#ifndef OPENSSL_NO_ENGINE
+        UI_METHOD *ui_fallback_method;
+# ifndef OPENSSL_NO_UI_CONSOLE
+        ui_fallback_method = UI_OpenSSL();
+# else
+        ui_fallback_method = (UI_METHOD *)UI_null();
+# endif
+        UI_method_set_reader(ui_fallback_method, NULL);
+#endif
+    }
+
+    if (opt_engine != NULL)
+        e = setup_engine_methods(opt_engine, 0 /* not: ENGINE_METHOD_ALL */, 0);
+
+    if (opt_port != NULL) {
+        if (opt_use_mock_srv) {
+            CMP_err("cannot use both -port and -use_mock_srv options");
+            goto err;
+        }
+        if (opt_server != NULL) {
+            CMP_err("cannot use both -port and -server options");
+            goto err;
+        }
+    }
+
+    if ((cmp_ctx = OSSL_CMP_CTX_new()) == NULL) {
+        CMP_err("out of memory");
+        goto err;
+    }
+    if (!OSSL_CMP_CTX_set_log_cb(cmp_ctx, print_to_bio_out)) {
+        CMP_err1("cannot set up error reporting and logging for %s", prog);
+        goto err;
+    }
+    if ((opt_use_mock_srv || opt_port != NULL)) {
+        OSSL_CMP_SRV_CTX *srv_ctx;
+
+        if ((srv_ctx = setup_srv_ctx(e)) == NULL)
+            goto err;
+        OSSL_CMP_CTX_set_transfer_cb_arg(cmp_ctx, srv_ctx);
+        if (!OSSL_CMP_CTX_set_log_cb(OSSL_CMP_SRV_CTX_get0_cmp_ctx(srv_ctx),
+                                     print_to_bio_out)) {
+            CMP_err1("cannot set up error reporting and logging for %s", prog);
+            goto err;
+        }
+    }
+
+
+    if (opt_port != NULL) { /* act as very basic CMP HTTP server */
+#ifdef OPENSSL_NO_SOCK
+        BIO_printf(bio_err, "Cannot act as server - sockets not supported\n");
+#else
+        BIO *acbio;
+        BIO *cbio = NULL;
+        int msgs = 0;
+
+        if ((acbio = http_server_init_bio(prog, opt_port)) == NULL)
+            goto err;
+        while (opt_max_msgs <= 0 || msgs < opt_max_msgs) {
+            char *path = NULL;
+            OSSL_CMP_MSG *req = NULL;
+            OSSL_CMP_MSG *resp = NULL;
+
+            ret = http_server_get_asn1_req(ASN1_ITEM_rptr(OSSL_CMP_MSG),
+                                           (ASN1_VALUE **)&req, &path,
+                                           &cbio, acbio, prog, 0, 0);
+            if (ret == 0)
+                continue;
+            if (ret++ == -1)
+                break; /* fatal error */
+
+            ret = 0;
+            msgs++;
+            if (req != NULL) {
+                if (strcmp(path, "") != 0 && strcmp(path, "pkix/") != 0) {
+                    (void)http_server_send_status(cbio, 404, "Not Found");
+                    CMP_err1("Expecting empty path or 'pkix/' but got '%s'",
+                             path);
+                    OPENSSL_free(path);
+                    OSSL_CMP_MSG_free(req);
+                    goto cont;
+                }
+                OPENSSL_free(path);
+                resp = OSSL_CMP_CTX_server_perform(cmp_ctx, req);
+                OSSL_CMP_MSG_free(req);
+                if (resp == NULL) {
+                    (void)http_server_send_status(cbio,
+                                                  500, "Internal Server Error");
+                    break; /* treated as fatal error */
+                }
+                ret = http_server_send_asn1_resp(cbio, "application/pkixcmp",
+                                                 ASN1_ITEM_rptr(OSSL_CMP_MSG),
+                                                 (const ASN1_VALUE *)resp);
+                OSSL_CMP_MSG_free(resp);
+                if (!ret)
+                    break; /* treated as fatal error */
+            } else {
+                (void)http_server_send_status(cbio, 400, "Bad Request");
+            }
+        cont:
+            BIO_free_all(cbio);
+            cbio = NULL;
+        }
+        BIO_free_all(cbio);
+        BIO_free_all(acbio);
+#endif
+        goto err;
+    }
+    /* else act as CMP client */
+
+    if (opt_use_mock_srv) {
+        if (opt_server != NULL) {
+            CMP_err("cannot use both -use_mock_srv and -server options");
+            goto err;
+        }
+        if (opt_proxy != NULL) {
+            CMP_err("cannot use both -use_mock_srv and -proxy options");
+            goto err;
+        }
+        opt_server = mock_server;
+        opt_proxy = "API";
+    } else {
+        if (opt_server == NULL) {
+            CMP_err("missing -server option");
+            goto err;
+        }
+    }
+
+    if (!setup_client_ctx(cmp_ctx, e)) {
+        CMP_err("cannot set up CMP context");
+        goto err;
+    }
+    for (i = 0; i < opt_repeat; i++) {
+        /* everything is ready, now connect and perform the command! */
+        switch (opt_cmd) {
+        case CMP_IR:
+            newcert = OSSL_CMP_exec_IR_ses(cmp_ctx);
+            if (newcert == NULL)
+                goto err;
+            break;
+        case CMP_KUR:
+            newcert = OSSL_CMP_exec_KUR_ses(cmp_ctx);
+            if (newcert == NULL)
+                goto err;
+            break;
+        case CMP_CR:
+            newcert = OSSL_CMP_exec_CR_ses(cmp_ctx);
+            if (newcert == NULL)
+                goto err;
+            break;
+        case CMP_P10CR:
+            newcert = OSSL_CMP_exec_P10CR_ses(cmp_ctx);
+            if (newcert == NULL)
+                goto err;
+            break;
+        case CMP_RR:
+            if (OSSL_CMP_exec_RR_ses(cmp_ctx) == NULL)
+                goto err;
+            break;
+        case CMP_GENM:
+            {
+                STACK_OF(OSSL_CMP_ITAV) *itavs;
+
+                if (opt_infotype != NID_undef) {
+                    OSSL_CMP_ITAV *itav =
+                        OSSL_CMP_ITAV_create(OBJ_nid2obj(opt_infotype), NULL);
+                    if (itav == NULL)
+                        goto err;
+                    OSSL_CMP_CTX_push0_genm_ITAV(cmp_ctx, itav);
+                }
+
+                if ((itavs = OSSL_CMP_exec_GENM_ses(cmp_ctx)) == NULL)
+                    goto err;
+                print_itavs(itavs);
+                sk_OSSL_CMP_ITAV_pop_free(itavs, OSSL_CMP_ITAV_free);
+                break;
+            }
+        default:
+            break;
+        }
+
+        {
+            /* print PKIStatusInfo (this is in case there has been no error) */
+            int status = OSSL_CMP_CTX_get_status(cmp_ctx);
+            char *buf = app_malloc(OSSL_CMP_PKISI_BUFLEN, "PKIStatusInfo buf");
+            const char *string =
+                OSSL_CMP_CTX_snprint_PKIStatus(cmp_ctx, buf,
+                                               OSSL_CMP_PKISI_BUFLEN);
+
+            CMP_print(bio_err,
+                      status == OSSL_CMP_PKISTATUS_accepted ? "info" :
+                      status == OSSL_CMP_PKISTATUS_rejection ? "server error" :
+                      status == OSSL_CMP_PKISTATUS_waiting ? "internal error"
+                                                           : "warning",
+                      "received from %s %s %s", opt_server,
+                      string != NULL ? string : "<unknown PKIStatus>", "");
+            OPENSSL_free(buf);
+        }
+
+        if (opt_cacertsout != NULL) {
+            STACK_OF(X509) *certs = OSSL_CMP_CTX_get1_caPubs(cmp_ctx);
+
+            if (sk_X509_num(certs) > 0
+                    && save_certs(cmp_ctx, certs, opt_cacertsout, "CA") < 0) {
+                sk_X509_pop_free(certs, X509_free);
+                goto err;
+            }
+            sk_X509_pop_free(certs, X509_free);
+        }
+
+        if (opt_extracertsout != NULL) {
+            STACK_OF(X509) *certs = OSSL_CMP_CTX_get1_extraCertsIn(cmp_ctx);
+            if (sk_X509_num(certs) > 0
+                    && save_certs(cmp_ctx, certs, opt_extracertsout,
+                                  "extra") < 0) {
+                sk_X509_pop_free(certs, X509_free);
+                goto err;
+            }
+            sk_X509_pop_free(certs, X509_free);
+        }
+
+        if (opt_certout != NULL && newcert != NULL) {
+            STACK_OF(X509) *certs = sk_X509_new_null();
+
+            if (certs == NULL || !sk_X509_push(certs, newcert)
+                    || save_certs(cmp_ctx, certs, opt_certout,
+                                  "enrolled") < 0) {
+                sk_X509_free(certs);
+                goto err;
+            }
+            sk_X509_free(certs);
+        }
+        if (!OSSL_CMP_CTX_reinit(cmp_ctx))
+            goto err;
+    }
+    ret = 1;
+
+ err:
+    /* in case we ended up here on error without proper cleaning */
+    cleanse(opt_keypass);
+    cleanse(opt_newkeypass);
+    cleanse(opt_otherpass);
+    cleanse(opt_tls_keypass);
+    cleanse(opt_secret);
+    cleanse(opt_srv_keypass);
+    cleanse(opt_srv_secret);
+
+    if (ret != 1)
+        OSSL_CMP_CTX_print_errors(cmp_ctx);
+
+    ossl_cmp_mock_srv_free(OSSL_CMP_CTX_get_transfer_cb_arg(cmp_ctx));
+    {
+        APP_HTTP_TLS_INFO *http_tls_info =
+            OSSL_CMP_CTX_get_http_cb_arg(cmp_ctx);
+
+        if (http_tls_info != NULL) {
+            SSL_CTX_free(http_tls_info->ssl_ctx);
+            OPENSSL_free(http_tls_info);
+        }
+    }
+    X509_STORE_free(OSSL_CMP_CTX_get_certConf_cb_arg(cmp_ctx));
+    OSSL_CMP_CTX_free(cmp_ctx);
+    X509_VERIFY_PARAM_free(vpm);
+    release_engine(e);
+
+    NCONF_free(conf); /* must not do as long as opt_... variables are used */
+    OSSL_CMP_log_close();
+
+    return ret == 0 ? EXIT_FAILURE : EXIT_SUCCESS;
+}

apps/cmp_mock_srv.c

@@ -0,0 +1,412 @@
+/*
+ * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright Siemens AG 2018-2020
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or atf
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "apps.h"
+#include "cmp_mock_srv.h"
+
+#include <openssl/cmp.h>
+#include <openssl/err.h>
+#include <openssl/cmperr.h>
+
+DEFINE_STACK_OF(X509)
+DEFINE_STACK_OF(OSSL_CMP_ITAV)
+DEFINE_STACK_OF(ASN1_UTF8STRING)
+ 
+/* the context for the CMP mock server */
+typedef struct
+{
+    X509 *certOut;             /* certificate to be returned in cp/ip/kup msg */
+    STACK_OF(X509) *chainOut;  /* chain of certOut to add to extraCerts field */
+    STACK_OF(X509) *caPubsOut; /* certs to return in caPubs field of ip msg */
+    OSSL_CMP_PKISI *statusOut; /* status for ip/cp/kup/rp msg unless polling */
+    int sendError;             /* send error response also on valid requests */
+    OSSL_CMP_MSG *certReq;     /* ir/cr/p10cr/kur remembered while polling */
+    int certReqId;             /* id of last ir/cr/kur, used for polling */
+    int pollCount;             /* number of polls before actual cert response */
+    int checkAfterTime;        /* time the client should wait between polling */
+} mock_srv_ctx;
+
+
+static void mock_srv_ctx_free(mock_srv_ctx *ctx)
+{
+    if (ctx == NULL)
+        return;
+
+    OSSL_CMP_PKISI_free(ctx->statusOut);
+    X509_free(ctx->certOut);
+    sk_X509_pop_free(ctx->chainOut, X509_free);
+    sk_X509_pop_free(ctx->caPubsOut, X509_free);
+    OSSL_CMP_MSG_free(ctx->certReq);
+    OPENSSL_free(ctx);
+}
+
+static mock_srv_ctx *mock_srv_ctx_new(void)
+{
+    mock_srv_ctx *ctx = OPENSSL_zalloc(sizeof(mock_srv_ctx));
+
+    if (ctx == NULL)
+        goto err;
+
+    if ((ctx->statusOut = OSSL_CMP_PKISI_new()) == NULL)
+        goto err;
+
+    ctx->certReqId = -1;
+
+    /* all other elements are initialized to 0 or NULL, respectively */
+    return ctx;
+ err:
+    mock_srv_ctx_free(ctx);
+    return NULL;
+}
+
+int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (cert == NULL || X509_up_ref(cert)) {
+        X509_free(ctx->certOut);
+        ctx->certOut = cert;
+        return 1;
+    }
+    return 0;
+}
+
+int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
+                                    STACK_OF(X509) *chain)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    STACK_OF(X509) *chain_copy = NULL;
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (chain != NULL && (chain_copy = X509_chain_up_ref(chain)) == NULL)
+        return 0;
+    sk_X509_pop_free(ctx->chainOut, X509_free);
+    ctx->chainOut = chain_copy;
+    return 1;
+}
+
+int ossl_cmp_mock_srv_set1_caPubsOut(OSSL_CMP_SRV_CTX *srv_ctx,
+                                     STACK_OF(X509) *caPubs)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    STACK_OF(X509) *caPubs_copy = NULL;
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (caPubs != NULL && (caPubs_copy = X509_chain_up_ref(caPubs)) == NULL)
+        return 0;
+    sk_X509_pop_free(ctx->caPubsOut, X509_free);
+    ctx->caPubsOut = caPubs_copy;
+    return 1;
+}
+
+int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
+                                     int fail_info, const char *text)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    OSSL_CMP_PKISI *si;
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if ((si = OSSL_CMP_STATUSINFO_new(status, fail_info, text)) == NULL)
+        return 0;
+    OSSL_CMP_PKISI_free(ctx->statusOut);
+    ctx->statusOut = si;
+    return 1;
+}
+
+int ossl_cmp_mock_srv_set_send_error(OSSL_CMP_SRV_CTX *srv_ctx, int val)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    ctx->sendError = val != 0;
+    return 1;
+}
+
+int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (count < 0) {
+        CMPerr(0, CMP_R_INVALID_ARGS);
+        return 0;
+    }
+    ctx->pollCount = count;
+    return 1;
+}
+
+int ossl_cmp_mock_srv_set_checkAfterTime(OSSL_CMP_SRV_CTX *srv_ctx, int sec)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    ctx->checkAfterTime = sec;
+    return 1;
+}
+
+static OSSL_CMP_PKISI *process_cert_request(OSSL_CMP_SRV_CTX *srv_ctx,
+                                            const OSSL_CMP_MSG *cert_req,
+                                            int certReqId,
+                                            const OSSL_CRMF_MSG *crm,
+                                            const X509_REQ *p10cr,
+                                            X509 **certOut,
+                                            STACK_OF(X509) **chainOut,
+                                            STACK_OF(X509) **caPubs)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    OSSL_CMP_PKISI *si = NULL;
+
+    if (ctx == NULL || cert_req == NULL
+            || certOut == NULL || chainOut == NULL || caPubs == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return NULL;
+    }
+    if (ctx->sendError) {
+        CMPerr(0, CMP_R_ERROR_PROCESSING_MESSAGE);
+        return NULL;
+    }
+
+    *certOut = NULL;
+    *chainOut = NULL;
+    *caPubs = NULL;
+    ctx->certReqId = certReqId;
+    if (ctx->pollCount > 0) {
+        ctx->pollCount--;
+        OSSL_CMP_MSG_free(ctx->certReq);
+        if ((ctx->certReq = OSSL_CMP_MSG_dup(cert_req)) == NULL)
+            return NULL;
+        return OSSL_CMP_STATUSINFO_new(OSSL_CMP_PKISTATUS_waiting, 0, NULL);
+    }
+    if (ctx->certOut != NULL
+            && (*certOut = X509_dup(ctx->certOut)) == NULL)
+        /* TODO better return a cert produced from data in request template */
+        goto err;
+    if (ctx->chainOut != NULL
+            && (*chainOut = X509_chain_up_ref(ctx->chainOut)) == NULL)
+        goto err;
+    if (ctx->caPubsOut != NULL
+            && (*caPubs = X509_chain_up_ref(ctx->caPubsOut)) == NULL)
+        goto err;
+    if (ctx->statusOut != NULL
+            && (si = OSSL_CMP_PKISI_dup(ctx->statusOut)) == NULL)
+        goto err;
+    return si;
+
+ err:
+    X509_free(*certOut);
+    *certOut = NULL;
+    sk_X509_pop_free(*chainOut, X509_free);
+    *chainOut = NULL;
+    sk_X509_pop_free(*caPubs, X509_free);
+    *caPubs = NULL;
+    return NULL;
+}
+
+static OSSL_CMP_PKISI *process_rr(OSSL_CMP_SRV_CTX *srv_ctx,
+                                  const OSSL_CMP_MSG *rr,
+                                  const X509_NAME *issuer,
+                                  const ASN1_INTEGER *serial)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL || rr == NULL || issuer == NULL || serial == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return NULL;
+    }
+    if (ctx->sendError || ctx->certOut == NULL) {
+        CMPerr(0, CMP_R_ERROR_PROCESSING_MESSAGE);
+        return NULL;
+    }
+
+    /* accept revocation only for the certificate we sent in ir/cr/kur */
+    if (X509_NAME_cmp(issuer, X509_get_issuer_name(ctx->certOut)) != 0
+            || ASN1_INTEGER_cmp(serial,
+                                X509_get0_serialNumber(ctx->certOut)) != 0) {
+        CMPerr(0, CMP_R_REQUEST_NOT_ACCEPTED);
+        return NULL;
+    }
+    return OSSL_CMP_PKISI_dup(ctx->statusOut);
+}
+
+static int process_genm(OSSL_CMP_SRV_CTX *srv_ctx,
+                        const OSSL_CMP_MSG *genm,
+                        const STACK_OF(OSSL_CMP_ITAV) *in,
+                        STACK_OF(OSSL_CMP_ITAV) **out)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL || genm == NULL || in == NULL || out == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (ctx->sendError) {
+        CMPerr(0, CMP_R_ERROR_PROCESSING_MESSAGE);
+        return 0;
+    }
+
+    *out = sk_OSSL_CMP_ITAV_deep_copy(in, OSSL_CMP_ITAV_dup,
+                                      OSSL_CMP_ITAV_free);
+    return *out != NULL;
+}
+
+static void process_error(OSSL_CMP_SRV_CTX *srv_ctx, const OSSL_CMP_MSG *error,
+                          const OSSL_CMP_PKISI *statusInfo,
+                          const ASN1_INTEGER *errorCode,
+                          const OSSL_CMP_PKIFREETEXT *errorDetails)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    char buf[OSSL_CMP_PKISI_BUFLEN];
+    char *sibuf;
+    int i;
+
+    if (ctx == NULL || error == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return;
+    }
+
+    BIO_printf(bio_err, "mock server received error:\n");
+
+    if (statusInfo == NULL) {
+        BIO_printf(bio_err, "pkiStatusInfo absent\n");
+    } else {
+        sibuf = OSSL_CMP_snprint_PKIStatusInfo(statusInfo, buf, sizeof(buf));
+        BIO_printf(bio_err, "pkiStatusInfo: %s\n",
+                   sibuf != NULL ? sibuf: "<invalid>");
+    }
+
+    if (errorCode == NULL)
+        BIO_printf(bio_err, "errorCode absent\n");
+    else
+        BIO_printf(bio_err, "errorCode: %ld\n", ASN1_INTEGER_get(errorCode));
+
+    if (sk_ASN1_UTF8STRING_num(errorDetails) <= 0) {
+        BIO_printf(bio_err, "errorDetails absent\n");
+    } else {
+        /* TODO could use sk_ASN1_UTF8STRING2text() if exported */
+        BIO_printf(bio_err, "errorDetails: ");
+        for (i = 0; i < sk_ASN1_UTF8STRING_num(errorDetails); i++) {
+            if (i > 0)
+                BIO_printf(bio_err, ", ");
+            BIO_printf(bio_err, "\"");
+            ASN1_STRING_print(bio_err,
+                              sk_ASN1_UTF8STRING_value(errorDetails, i));
+            BIO_printf(bio_err, "\"");
+        }
+        BIO_printf(bio_err, "\n");
+    }
+}
+
+static int process_certConf(OSSL_CMP_SRV_CTX *srv_ctx,
+                            const OSSL_CMP_MSG *certConf, int certReqId,
+                            const ASN1_OCTET_STRING *certHash,
+                            const OSSL_CMP_PKISI *si)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+    ASN1_OCTET_STRING *digest;
+
+    if (ctx == NULL || certConf == NULL || certHash == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (ctx->sendError || ctx->certOut == NULL) {
+        CMPerr(0, CMP_R_ERROR_PROCESSING_MESSAGE);
+        return 0;
+    }
+
+    if (certReqId != ctx->certReqId) {
+        /* in case of error, invalid reqId -1 */
+        CMPerr(0, CMP_R_BAD_REQUEST_ID);
+        return 0;
+    }
+
+    if ((digest = X509_digest_sig(ctx->certOut)) == NULL)
+        return 0;
+    if (ASN1_OCTET_STRING_cmp(certHash, digest) != 0) {
+        ASN1_OCTET_STRING_free(digest);
+        CMPerr(0, CMP_R_CERTHASH_UNMATCHED);
+        return 0;
+    }
+    ASN1_OCTET_STRING_free(digest);
+    return 1;
+}
+
+static int process_pollReq(OSSL_CMP_SRV_CTX *srv_ctx,
+                           const OSSL_CMP_MSG *pollReq, int certReqId,
+                           OSSL_CMP_MSG **certReq, int64_t *check_after)
+{
+    mock_srv_ctx *ctx = OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx);
+
+    if (ctx == NULL || pollReq == NULL
+            || certReq == NULL || check_after == NULL) {
+        CMPerr(0, CMP_R_NULL_ARGUMENT);
+        return 0;
+    }
+    if (ctx->sendError || ctx->certReq == NULL) {
+        *certReq = NULL;
+        CMPerr(0, CMP_R_ERROR_PROCESSING_MESSAGE);
+        return 0;
+    }
+
+    if (ctx->pollCount == 0) {
+        *certReq = ctx->certReq;
+        ctx->certReq = NULL;
+        *check_after = 0;
+    } else {
+        ctx->pollCount--;
+        *certReq = NULL;
+        *check_after = ctx->checkAfterTime;
+    }
+    return 1;
+}
+
+OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(void)
+{
+    OSSL_CMP_SRV_CTX *srv_ctx = OSSL_CMP_SRV_CTX_new();
+    mock_srv_ctx *ctx = mock_srv_ctx_new();
+
+    if (srv_ctx != NULL && ctx != NULL
+            && OSSL_CMP_SRV_CTX_init(srv_ctx, ctx, process_cert_request,
+                                     process_rr, process_genm, process_error,
+                                     process_certConf, process_pollReq))
+        return srv_ctx;
+
+    mock_srv_ctx_free(ctx);
+    OSSL_CMP_SRV_CTX_free(srv_ctx);
+    return NULL;
+}
+
+void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx)
+{
+    if (srv_ctx != NULL)
+        mock_srv_ctx_free(OSSL_CMP_SRV_CTX_get0_custom_ctx(srv_ctx));
+    OSSL_CMP_SRV_CTX_free(srv_ctx);
+}

apps/cmp_mock_srv.h

@@ -0,0 +1,34 @@
+/*
+ * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright Siemens AG 2018-2020
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef OSSL_APPS_CMP_MOCK_SRV_H
+# define OSSL_APPS_CMP_MOCK_SRV_H
+
+# include <openssl/opensslconf.h>
+# ifndef OPENSSL_NO_CMP
+
+#  include <openssl/cmp.h>
+
+OSSL_CMP_SRV_CTX *ossl_cmp_mock_srv_new(void);
+void ossl_cmp_mock_srv_free(OSSL_CMP_SRV_CTX *srv_ctx);
+
+int ossl_cmp_mock_srv_set1_certOut(OSSL_CMP_SRV_CTX *srv_ctx, X509 *cert);
+int ossl_cmp_mock_srv_set1_chainOut(OSSL_CMP_SRV_CTX *srv_ctx,
+                                    STACK_OF(X509) *chain);
+int ossl_cmp_mock_srv_set1_caPubsOut(OSSL_CMP_SRV_CTX *srv_ctx,
+                                     STACK_OF(X509) *caPubs);
+int ossl_cmp_mock_srv_set_statusInfo(OSSL_CMP_SRV_CTX *srv_ctx, int status,
+                                     int fail_info, const char *text);
+int ossl_cmp_mock_srv_set_send_error(OSSL_CMP_SRV_CTX *srv_ctx, int val);
+int ossl_cmp_mock_srv_set_pollCount(OSSL_CMP_SRV_CTX *srv_ctx, int count);
+int ossl_cmp_mock_srv_set_checkAfterTime(OSSL_CMP_SRV_CTX *srv_ctx, int sec);
+
+# endif /* !defined(OPENSSL_NO_CMP) */
+#endif /* !defined(OSSL_APPS_CMP_MOCK_SRV_H) */

apps/cms.c

@@ -1,7 +1,7 @@
 /*
- * Copyright 2008-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2008-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -23,6 +23,12 @@
 # include <openssl/x509v3.h>
 # include <openssl/cms.h>
 
+DEFINE_STACK_OF(X509)
+DEFINE_STACK_OF(CMS_SignerInfo)
+DEFINE_STACK_OF(GENERAL_NAME)
+DEFINE_STACK_OF(GENERAL_NAMES)
+DEFINE_STACK_OF_STRING()
+
 static int save_certs(char *signerfile, STACK_OF(X509) *signers);
 static int cms_cb(int ok, X509_STORE_CTX *ctx);
 static void receipt_request_print(CMS_ContentInfo *cms);
@@ -65,7 +71,7 @@ struct cms_key_param_st {
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_ENCRYPT,
-    OPT_DECRYPT, OPT_SIGN, OPT_SIGN_RECEIPT, OPT_RESIGN,
+    OPT_DECRYPT, OPT_SIGN, OPT_CADES, OPT_SIGN_RECEIPT, OPT_RESIGN,
     OPT_VERIFY, OPT_VERIFY_RETCODE, OPT_VERIFY_RECEIPT,
     OPT_CMSOUT, OPT_DATA_OUT, OPT_DATA_CREATE, OPT_DIGEST_VERIFY,
     OPT_DIGEST_CREATE, OPT_COMPRESS, OPT_UNCOMPRESS,
@@ -75,111 +81,156 @@ typedef enum OPTION_choice {
     OPT_NOSIGS, OPT_NO_CONTENT_VERIFY, OPT_NO_ATTR_VERIFY, OPT_INDEF,
     OPT_NOINDEF, OPT_CRLFEOL, OPT_NOOUT, OPT_RR_PRINT,
     OPT_RR_ALL, OPT_RR_FIRST, OPT_RCTFORM, OPT_CERTFILE, OPT_CAFILE,
-    OPT_CAPATH, OPT_NOCAPATH, OPT_NOCAFILE,OPT_CONTENT, OPT_PRINT,
+    OPT_CAPATH, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE,
+    OPT_CONTENT, OPT_PRINT,
     OPT_SECRETKEY, OPT_SECRETKEYID, OPT_PWRI_PASSWORD, OPT_ECONTENT_TYPE,
     OPT_PASSIN, OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP,
     OPT_CERTSOUT, OPT_MD, OPT_INKEY, OPT_KEYFORM, OPT_KEYOPT, OPT_RR_FROM,
     OPT_RR_TO, OPT_AES128_WRAP, OPT_AES192_WRAP, OPT_AES256_WRAP,
-    OPT_3DES_WRAP, OPT_ENGINE,
+    OPT_3DES_WRAP, OPT_WRAP, OPT_ENGINE,
     OPT_R_ENUM,
+    OPT_PROV_ENUM,
     OPT_V_ENUM,
-    OPT_CIPHER
+    OPT_CIPHER,
+    OPT_ORIGINATOR
 } OPTION_CHOICE;
 
 const OPTIONS cms_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] cert.pem...\n"},
-    {OPT_HELP_STR, 1, '-',
-        "  cert.pem... recipient certs for encryption\n"},
-    {OPT_HELP_STR, 1, '-', "Valid options are:\n"},
+    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [cert...]\n"},
+
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
     {"inform", OPT_INFORM, 'c', "Input format SMIME (default), PEM or DER"},
     {"outform", OPT_OUTFORM, 'c',
      "Output format SMIME (default), PEM or DER"},
     {"in", OPT_IN, '<', "Input file"},
     {"out", OPT_OUT, '>', "Output file"},
+    {"debug_decrypt", OPT_DEBUG_DECRYPT, '-',
+        "Disable MMA protection and return an error if no recipient found"
+        " (see documentation)"},
+    {"stream", OPT_INDEF, '-', "Enable CMS streaming"},
+    {"indef", OPT_INDEF, '-', "Same as -stream"},
+    {"noindef", OPT_NOINDEF, '-', "Disable CMS streaming"},
+    {"crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of CR only" },
+    {"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
+    {"CApath", OPT_CAPATH, '/', "trusted certificates directory"},
+    {"CAstore", OPT_CASTORE, ':', "trusted certificates store URI"},
+    {"no-CAfile", OPT_NOCAFILE, '-',
+     "Do not load the default certificates file"},
+    {"no-CApath", OPT_NOCAPATH, '-',
+     "Do not load certificates from the default certificates directory"},
+    {"no-CAstore", OPT_NOCASTORE, '-',
+     "Do not load certificates from the default certificates store"},
+# ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
+# endif
+
+    OPT_SECTION("Action"),
     {"encrypt", OPT_ENCRYPT, '-', "Encrypt message"},
     {"decrypt", OPT_DECRYPT, '-', "Decrypt encrypted message"},
     {"sign", OPT_SIGN, '-', "Sign message"},
     {"sign_receipt", OPT_SIGN_RECEIPT, '-', "Generate a signed receipt for the message"},
     {"resign", OPT_RESIGN, '-', "Resign a signed message"},
+    {"cades", OPT_CADES, '-', "Include signer certificate digest"},
     {"verify", OPT_VERIFY, '-', "Verify signed message"},
-    {"verify_retcode", OPT_VERIFY_RETCODE, '-'},
-    {"verify_receipt", OPT_VERIFY_RECEIPT, '<'},
+    {"verify_retcode", OPT_VERIFY_RETCODE, '-',
+        "Exit non-zero on verification failure"},
+    {"verify_receipt", OPT_VERIFY_RECEIPT, '<',
+        "Verify receipts; exit if receipt signatures do not verify"},
+    {"digest_verify", OPT_DIGEST_VERIFY, '-',
+        "Verify a CMS \"DigestedData\" object and output it"},
+    {"digest_create", OPT_DIGEST_CREATE, '-',
+        "Create a CMS \"DigestedData\" object"},
+    {"compress", OPT_COMPRESS, '-', "Create a CMS \"CompressedData\" object"},
+    {"uncompress", OPT_UNCOMPRESS, '-',
+        "Uncompress a CMS \"CompressedData\" object"},
+    {"EncryptedData_decrypt", OPT_ED_DECRYPT, '-',
+        "Decrypt CMS \"EncryptedData\" object using symmetric key"},
+    {"EncryptedData_encrypt", OPT_ED_ENCRYPT, '-',
+        "Create CMS \"EncryptedData\" object using symmetric key"},
+    {"data_out", OPT_DATA_OUT, '-', "Copy CMS \"Data\" object to output"},
+    {"data_create", OPT_DATA_CREATE, '-', "Create a CMS \"Data\" object"},
     {"cmsout", OPT_CMSOUT, '-', "Output CMS structure"},
-    {"data_out", OPT_DATA_OUT, '-'},
-    {"data_create", OPT_DATA_CREATE, '-'},
-    {"digest_verify", OPT_DIGEST_VERIFY, '-'},
-    {"digest_create", OPT_DIGEST_CREATE, '-'},
-    {"compress", OPT_COMPRESS, '-'},
-    {"uncompress", OPT_UNCOMPRESS, '-'},
-    {"EncryptedData_decrypt", OPT_ED_DECRYPT, '-'},
-    {"EncryptedData_encrypt", OPT_ED_ENCRYPT, '-'},
-    {"debug_decrypt", OPT_DEBUG_DECRYPT, '-'},
-    {"text", OPT_TEXT, '-', "Include or delete text MIME headers"},
-    {"asciicrlf", OPT_ASCIICRLF, '-'},
+    {"no_content_verify", OPT_NO_CONTENT_VERIFY, '-',
+        "Do not verify signed content signatures"},
+    {"no_attr_verify", OPT_NO_ATTR_VERIFY, '-',
+        "Do not verify signed attribute signatures"},
     {"nointern", OPT_NOINTERN, '-',
-     "Don't search certificates in message for signer"},
+        "Don't search certificates in message for signer"},
     {"noverify", OPT_NOVERIFY, '-', "Don't verify signers certificate"},
-    {"nocerts", OPT_NOCERTS, '-',
-     "Don't include signers certificate when signing"},
-    {"noattr", OPT_NOATTR, '-', "Don't include any signed attributes"},
+
+    OPT_SECTION("Formatting"),
+    {"text", OPT_TEXT, '-', "Include or delete text MIME headers"},
+    {"asciicrlf", OPT_ASCIICRLF, '-',
+        "Perform CRLF canonicalisation when signing"},
     {"nodetach", OPT_NODETACH, '-', "Use opaque signing"},
     {"nosmimecap", OPT_NOSMIMECAP, '-', "Omit the SMIMECapabilities attribute"},
+    {"noattr", OPT_NOATTR, '-', "Don't include any signed attributes"},
     {"binary", OPT_BINARY, '-', "Don't translate message to text"},
     {"keyid", OPT_KEYID, '-', "Use subject key identifier"},
     {"nosigs", OPT_NOSIGS, '-', "Don't verify message signature"},
-    {"no_content_verify", OPT_NO_CONTENT_VERIFY, '-'},
-    {"no_attr_verify", OPT_NO_ATTR_VERIFY, '-'},
-    {"stream", OPT_INDEF, '-', "Enable CMS streaming"},
-    {"indef", OPT_INDEF, '-', "Same as -stream"},
-    {"noindef", OPT_NOINDEF, '-', "Disable CMS streaming"},
-    {"crlfeol", OPT_CRLFEOL, '-', "Use CRLF as EOL termination instead of CR only" },
-    {"noout", OPT_NOOUT, '-', "For the -cmsout operation do not output the parsed CMS structure"},
+    {"nocerts", OPT_NOCERTS, '-',
+     "Don't include signers certificate when signing"},
+    {"noout", OPT_NOOUT, '-',
+        "For the -cmsout operation do not output the parsed CMS structure"},
     {"receipt_request_print", OPT_RR_PRINT, '-', "Print CMS Receipt Request" },
-    {"receipt_request_all", OPT_RR_ALL, '-'},
-    {"receipt_request_first", OPT_RR_FIRST, '-'},
+    {"receipt_request_all", OPT_RR_ALL, '-',
+        "When signing, create a receipt request for all recipients"},
+    {"receipt_request_first", OPT_RR_FIRST, '-',
+        "When signing, create a receipt request for first recipient"},
     {"rctform", OPT_RCTFORM, 'F', "Receipt file format"},
     {"certfile", OPT_CERTFILE, '<', "Other certificates file"},
-    {"CAfile", OPT_CAFILE, '<', "Trusted certificates file"},
-    {"CApath", OPT_CAPATH, '/', "trusted certificates directory"},
-    {"no-CAfile", OPT_NOCAFILE, '-',
-     "Do not load the default certificates file"},
-    {"no-CApath", OPT_NOCAPATH, '-',
-     "Do not load certificates from the default certificates directory"},
     {"content", OPT_CONTENT, '<',
      "Supply or override content for detached signature"},
     {"print", OPT_PRINT, '-',
      "For the -cmsout operation print out all fields of the CMS structure"},
-    {"secretkey", OPT_SECRETKEY, 's'},
-    {"secretkeyid", OPT_SECRETKEYID, 's'},
-    {"pwri_password", OPT_PWRI_PASSWORD, 's'},
-    {"econtent_type", OPT_ECONTENT_TYPE, 's'},
+    {"certsout", OPT_CERTSOUT, '>', "Certificate output file"},
+
+    OPT_SECTION("Keying"),
+    {"secretkey", OPT_SECRETKEY, 's',
+        "Use specified hex-encoded key to decrypt/encrypt recipients or content"},
+    {"secretkeyid", OPT_SECRETKEYID, 's',
+        "Identity of the -secretkey for CMS \"KEKRecipientInfo\" object"},
+    {"pwri_password", OPT_PWRI_PASSWORD, 's',
+        "Specific password for recipient"},
     {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
+    {"inkey", OPT_INKEY, 's',
+     "Input private key (if not signer or recipient)"},
+    {"keyform", OPT_KEYFORM, 'f', "Input private key format (ENGINE, other values ignored)"},
+    {"keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs"},
+
+    OPT_SECTION("Mail header"),
+    {"econtent_type", OPT_ECONTENT_TYPE, 's', "OID for external content"},
     {"to", OPT_TO, 's', "To address"},
     {"from", OPT_FROM, 's', "From address"},
     {"subject", OPT_SUBJECT, 's', "Subject"},
     {"signer", OPT_SIGNER, 's', "Signer certificate file"},
+    {"originator", OPT_ORIGINATOR, 's', "Originator certificate file"},
     {"recip", OPT_RECIP, '<', "Recipient cert file for decryption"},
-    {"certsout", OPT_CERTSOUT, '>', "Certificate output file"},
+    {"receipt_request_from", OPT_RR_FROM, 's',
+        "Create signed receipt request with specified email address"},
+    {"receipt_request_to", OPT_RR_TO, 's',
+        "Create signed receipt targeted to specified address"},
+
+    OPT_SECTION("Encryption"),
     {"md", OPT_MD, 's', "Digest algorithm to use when signing or resigning"},
-    {"inkey", OPT_INKEY, 's',
-     "Input private key (if not signer or recipient)"},
-    {"keyform", OPT_KEYFORM, 'f', "Input private key format (PEM or ENGINE)"},
-    {"keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs"},
-    {"receipt_request_from", OPT_RR_FROM, 's'},
-    {"receipt_request_to", OPT_RR_TO, 's'},
     {"", OPT_CIPHER, '-', "Any supported cipher"},
-    OPT_R_OPTIONS,
-    OPT_V_OPTIONS,
+
+    OPT_SECTION("Key-wrapping"),
     {"aes128-wrap", OPT_AES128_WRAP, '-', "Use AES128 to wrap key"},
     {"aes192-wrap", OPT_AES192_WRAP, '-', "Use AES192 to wrap key"},
     {"aes256-wrap", OPT_AES256_WRAP, '-', "Use AES256 to wrap key"},
 # ifndef OPENSSL_NO_DES
     {"des3-wrap", OPT_3DES_WRAP, '-', "Use 3DES-EDE to wrap key"},
 # endif
-# ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-# endif
+    {"wrap", OPT_WRAP, 's', "Any wrap cipher to wrap key"},
+
+    OPT_R_OPTIONS,
+    OPT_V_OPTIONS,
+    OPT_PROV_OPTIONS,
+
+    OPT_PARAMETERS(),
+    {"cert", 0, 0, "Recipient certs (optional; used only when encrypting)"},
     {NULL}
 };
 
@@ -196,15 +247,15 @@ int cms_main(int argc, char **argv)
     STACK_OF(OPENSSL_STRING) *rr_to = NULL, *rr_from = NULL;
     STACK_OF(OPENSSL_STRING) *sksigners = NULL, *skkeys = NULL;
     STACK_OF(X509) *encerts = NULL, *other = NULL;
-    X509 *cert = NULL, *recip = NULL, *signer = NULL;
+    X509 *cert = NULL, *recip = NULL, *signer = NULL, *originator = NULL;
     X509_STORE *store = NULL;
     X509_VERIFY_PARAM *vpm = NULL;
     char *certfile = NULL, *keyfile = NULL, *contfile = NULL;
-    const char *CAfile = NULL, *CApath = NULL;
+    const char *CAfile = NULL, *CApath = NULL, *CAstore = NULL;
     char *certsoutfile = NULL;
-    int noCAfile = 0, noCApath = 0;
+    int noCAfile = 0, noCApath = 0, noCAstore = 0;
     char *infile = NULL, *outfile = NULL, *rctfile = NULL;
-    char *passinarg = NULL, *passin = NULL, *signerfile = NULL, *recipfile = NULL;
+    char *passinarg = NULL, *passin = NULL, *signerfile = NULL, *originatorfile = NULL, *recipfile = NULL;
     char *to = NULL, *from = NULL, *subject = NULL, *prog;
     cms_key_param *key_first = NULL, *key_param = NULL;
     int flags = CMS_DETACHED, noout = 0, print = 0, keyidx = -1, vpmtouched = 0;
@@ -326,6 +377,9 @@ int cms_main(int argc, char **argv)
         case OPT_BINARY:
             flags |= CMS_BINARY;
             break;
+        case OPT_CADES:
+            flags |= CMS_CADES;
+            break;
         case OPT_KEYID:
             flags |= CMS_USE_KEYID;
             break;
@@ -379,12 +433,18 @@ int cms_main(int argc, char **argv)
         case OPT_CAPATH:
             CApath = opt_arg();
             break;
+        case OPT_CASTORE:
+            CAstore = opt_arg();
+            break;
         case OPT_NOCAFILE:
             noCAfile = 1;
             break;
         case OPT_NOCAPATH:
             noCApath = 1;
             break;
+        case OPT_NOCASTORE:
+            noCAstore = 1;
+            break;
         case OPT_IN:
             infile = opt_arg();
             break;
@@ -486,6 +546,9 @@ int cms_main(int argc, char **argv)
             }
             signerfile = opt_arg();
             break;
+        case OPT_ORIGINATOR:
+             originatorfile = opt_arg();
+             break;
         case OPT_INKEY:
             /* If previous -inkey argument add signer to list */
             if (keyfile != NULL) {
@@ -513,7 +576,7 @@ int cms_main(int argc, char **argv)
             if (operation == SMIME_ENCRYPT) {
                 if (encerts == NULL && (encerts = sk_X509_new_null()) == NULL)
                     goto end;
-                cert = load_cert(opt_arg(), FORMAT_PEM,
+                cert = load_cert(opt_arg(), FORMAT_UNDEF,
                                  "recipient certificate file");
                 if (cert == NULL)
                     goto end;
@@ -566,6 +629,10 @@ int cms_main(int argc, char **argv)
             if (!opt_rand(o))
                 goto end;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         case OPT_3DES_WRAP:
 # ifndef OPENSSL_NO_DES
             wrap_cipher = EVP_des_ede3_wrap();
@@ -580,6 +647,10 @@ int cms_main(int argc, char **argv)
         case OPT_AES256_WRAP:
             wrap_cipher = EVP_aes_256_wrap();
             break;
+        case OPT_WRAP:
+            if (!opt_cipher(opt_unknown(), &wrap_cipher))
+                goto end;
+            break;
         }
     }
     argc = opt_num_rest();
@@ -599,6 +670,20 @@ int cms_main(int argc, char **argv)
         goto opthelp;
     }
 
+    if ((flags & CMS_CADES) != 0) {
+        if ((flags & CMS_NOATTR) != 0) {
+            BIO_puts(bio_err, "Incompatible options: "
+                     "CAdES required signed attributes\n");
+            goto opthelp;
+        }
+        if (operation == SMIME_VERIFY
+                && (flags & (CMS_NO_SIGNER_CERT_VERIFY | CMS_NO_ATTR_VERIFY)) != 0) {
+            BIO_puts(bio_err, "Incompatible options: CAdES validation require"
+                     " certs and signed attributes validations\n");
+            goto opthelp;
+        }
+    }
+
     if (operation & SMIME_SIGNERS) {
         if (keyfile != NULL && signerfile == NULL) {
             BIO_puts(bio_err, "Illegal -inkey without -signer\n");
@@ -636,6 +721,7 @@ int cms_main(int argc, char **argv)
             goto opthelp;
         }
     } else if (!operation) {
+        BIO_printf(bio_err, "No operation option (-encrypt|-decrypt|-sign|-verify|...) specified.\n");
         goto opthelp;
     }
 
@@ -676,7 +762,7 @@ int cms_main(int argc, char **argv)
             if ((encerts = sk_X509_new_null()) == NULL)
                 goto end;
         while (*argv) {
-            if ((cert = load_cert(*argv, FORMAT_PEM,
+            if ((cert = load_cert(*argv, FORMAT_UNDEF,
                                   "recipient certificate file")) == NULL)
                 goto end;
             sk_X509_push(encerts, cert);
@@ -694,22 +780,30 @@ int cms_main(int argc, char **argv)
     }
 
     if (recipfile != NULL && (operation == SMIME_DECRYPT)) {
-        if ((recip = load_cert(recipfile, FORMAT_PEM,
+        if ((recip = load_cert(recipfile, FORMAT_UNDEF,
                                "recipient certificate file")) == NULL) {
             ERR_print_errors(bio_err);
             goto end;
         }
     }
 
+    if (originatorfile != NULL) {
+        if ((originator = load_cert(originatorfile, FORMAT_UNDEF,
+                                    "originator certificate file")) == NULL) {
+             ERR_print_errors(bio_err);
+             goto end;
+        }
+    }
+
     if (operation == SMIME_SIGN_RECEIPT) {
-        if ((signer = load_cert(signerfile, FORMAT_PEM,
+        if ((signer = load_cert(signerfile, FORMAT_UNDEF,
                                 "receipt signer certificate file")) == NULL) {
             ERR_print_errors(bio_err);
             goto end;
         }
     }
 
-    if (operation == SMIME_DECRYPT) {
+    if ((operation == SMIME_DECRYPT) || (operation == SMIME_ENCRYPT)) {
         if (keyfile == NULL)
             keyfile = recipfile;
     } else if ((operation == SMIME_SIGN) || (operation == SMIME_SIGN_RECEIPT)) {
@@ -794,7 +888,8 @@ int cms_main(int argc, char **argv)
         goto end;
 
     if ((operation == SMIME_VERIFY) || (operation == SMIME_VERIFY_RECEIPT)) {
-        if ((store = setup_verify(CAfile, CApath, noCAfile, noCApath)) == NULL)
+        if ((store = setup_verify(CAfile, noCAfile, CApath, noCApath,
+                                  CAstore, noCAstore)) == NULL)
             goto end;
         X509_STORE_set_verify_cb(store, cms_cb);
         if (vpmtouched)
@@ -818,23 +913,32 @@ int cms_main(int argc, char **argv)
         for (i = 0; i < sk_X509_num(encerts); i++) {
             CMS_RecipientInfo *ri;
             cms_key_param *kparam;
-            int tflags = flags;
+            int tflags = flags | CMS_KEY_PARAM; /* This flag enforces allocating the EVP_PKEY_CTX for the recipient here */
+            EVP_PKEY_CTX *pctx;
             X509 *x = sk_X509_value(encerts, i);
+            int res;
+
             for (kparam = key_first; kparam; kparam = kparam->next) {
                 if (kparam->idx == i) {
-                    tflags |= CMS_KEY_PARAM;
                     break;
                 }
             }
-            ri = CMS_add1_recipient_cert(cms, x, tflags);
+            ri = CMS_add1_recipient(cms, x, key, originator, tflags);
             if (ri == NULL)
                 goto end;
+
+            pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
             if (kparam != NULL) {
-                EVP_PKEY_CTX *pctx;
-                pctx = CMS_RecipientInfo_get0_pkey_ctx(ri);
                 if (!cms_set_pkey_param(pctx, kparam->param))
                     goto end;
             }
+
+            res = EVP_PKEY_CTX_ctrl(pctx, -1, -1,
+                                    EVP_PKEY_CTRL_CIPHER,
+                                    EVP_CIPHER_nid(cipher), NULL);
+            if (res <= 0 && res != -2)
+                goto end;
+
             if (CMS_RecipientInfo_type(ri) == CMS_RECIPINFO_AGREE
                 && wrap_cipher) {
                 EVP_CIPHER_CTX *wctx;
@@ -921,7 +1025,8 @@ int cms_main(int argc, char **argv)
             signerfile = sk_OPENSSL_STRING_value(sksigners, i);
             keyfile = sk_OPENSSL_STRING_value(skkeys, i);
 
-            signer = load_cert(signerfile, FORMAT_PEM, "signer certificate");
+            signer = load_cert(signerfile, FORMAT_UNDEF,
+                               "signer certificate");
             if (signer == NULL) {
                 ret = 2;
                 goto end;
@@ -980,7 +1085,7 @@ int cms_main(int argc, char **argv)
         }
 
         if (key != NULL) {
-            if (!CMS_decrypt_set1_pkey(cms, key, recip)) {
+            if (!CMS_decrypt_set1_pkey_and_peer(cms, key, recip, originator)) {
                 BIO_puts(bio_err, "Error decrypting CMS using private key\n");
                 goto end;
             }
@@ -1016,7 +1121,8 @@ int cms_main(int argc, char **argv)
             goto end;
     } else if (operation == SMIME_VERIFY) {
         if (CMS_verify(cms, other, store, indata, out, flags) > 0) {
-            BIO_printf(bio_err, "Verification successful\n");
+            BIO_printf(bio_err, "%s Verification successful\n",
+                       (flags & CMS_CADES) ? "CAdES" : "CMS");
         } else {
             BIO_printf(bio_err, "Verification failure\n");
             if (verify_retcode)

apps/crl.c

@@ -1,7 +1,7 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -22,19 +22,34 @@ typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_INFORM, OPT_IN, OPT_OUTFORM, OPT_OUT, OPT_KEYFORM, OPT_KEY,
     OPT_ISSUER, OPT_LASTUPDATE, OPT_NEXTUPDATE, OPT_FINGERPRINT,
-    OPT_CRLNUMBER, OPT_BADSIG, OPT_GENDELTA, OPT_CAPATH, OPT_CAFILE,
-    OPT_NOCAPATH, OPT_NOCAFILE, OPT_VERIFY, OPT_TEXT, OPT_HASH, OPT_HASH_OLD,
-    OPT_NOOUT, OPT_NAMEOPT, OPT_MD
+    OPT_CRLNUMBER, OPT_BADSIG, OPT_GENDELTA, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE,
+    OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_VERIFY, OPT_TEXT, OPT_HASH,
+    OPT_HASH_OLD, OPT_NOOUT, OPT_NAMEOPT, OPT_MD, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS crl_options[] = {
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-    {"inform", OPT_INFORM, 'F', "Input format; default PEM"},
+    {"verify", OPT_VERIFY, '-', "Verify CRL signature"},
+
+    OPT_SECTION("Input"),
     {"in", OPT_IN, '<', "Input file - default stdin"},
-    {"outform", OPT_OUTFORM, 'F', "Output format - default PEM"},
-    {"out", OPT_OUT, '>', "output file - default stdout"},
-    {"keyform", OPT_KEYFORM, 'F', "Private key file format (PEM or ENGINE)"},
+    {"inform", OPT_INFORM, 'F', "CRL input format (DER or PEM); has no effect"},
     {"key", OPT_KEY, '<', "CRL signing Private key to use"},
+    {"keyform", OPT_KEYFORM, 'F', "Private key file format (DER/PEM/P12); has no effect"},
+
+    OPT_SECTION("Output"),
+    {"out", OPT_OUT, '>', "output file - default stdout"},
+    {"outform", OPT_OUTFORM, 'F', "Output format - default PEM"},
+    {"text", OPT_TEXT, '-', "Print out a text format version"},
+    {"hash", OPT_HASH, '-', "Print hash value"},
+#ifndef OPENSSL_NO_MD5
+    {"hash_old", OPT_HASH_OLD, '-', "Print old-style (MD5) hash value"},
+#endif
+    {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
+    {"", OPT_MD, '-', "Any supported digest"},
+
+    OPT_SECTION("CRL"),
     {"issuer", OPT_ISSUER, '-', "Print issuer DN"},
     {"lastupdate", OPT_LASTUPDATE, '-', "Set lastUpdate field"},
     {"nextupdate", OPT_NEXTUPDATE, '-', "Set nextUpdate field"},
@@ -43,20 +58,18 @@ const OPTIONS crl_options[] = {
     {"crlnumber", OPT_CRLNUMBER, '-', "Print CRL number"},
     {"badsig", OPT_BADSIG, '-', "Corrupt last byte of loaded CRL signature (for test)" },
     {"gendelta", OPT_GENDELTA, '<', "Other CRL to compare/diff to the Input one"},
+
+    OPT_SECTION("Certificate"),
     {"CApath", OPT_CAPATH, '/', "Verify CRL using certificates in dir"},
     {"CAfile", OPT_CAFILE, '<', "Verify CRL using certificates in file name"},
+    {"CAstore", OPT_CASTORE, ':', "Verify CRL using certificates in store URI"},
     {"no-CAfile", OPT_NOCAFILE, '-',
      "Do not load the default certificates file"},
     {"no-CApath", OPT_NOCAPATH, '-',
      "Do not load certificates from the default certificates directory"},
-    {"verify", OPT_VERIFY, '-', "Verify CRL signature"},
-    {"text", OPT_TEXT, '-', "Print out a text format version"},
-    {"hash", OPT_HASH, '-', "Print hash value"},
-    {"nameopt", OPT_NAMEOPT, 's', "Various certificate name options"},
-    {"", OPT_MD, '-', "Any supported digest"},
-#ifndef OPENSSL_NO_MD5
-    {"hash_old", OPT_HASH_OLD, '-', "Print old-style (MD5) hash value"},
-#endif
+    {"no-CAstore", OPT_NOCASTORE, '-',
+     "Do not load certificates from the default certificates store"},
+    OPT_PROV_OPTIONS,
     {NULL}
 };
 
@@ -71,12 +84,12 @@ int crl_main(int argc, char **argv)
     EVP_PKEY *pkey;
     const EVP_MD *digest = EVP_sha1();
     char *infile = NULL, *outfile = NULL, *crldiff = NULL, *keyfile = NULL;
-    const char *CAfile = NULL, *CApath = NULL, *prog;
+    const char *CAfile = NULL, *CApath = NULL, *CAstore = NULL, *prog;
     OPTION_CHOICE o;
     int hash = 0, issuer = 0, lastupdate = 0, nextupdate = 0, noout = 0;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, keyformat = FORMAT_PEM;
     int ret = 1, num = 0, badsig = 0, fingerprint = 0, crlnumber = 0;
-    int text = 0, do_ver = 0, noCAfile = 0, noCApath = 0;
+    int text = 0, do_ver = 0, noCAfile = 0, noCApath = 0, noCAstore = 0;
     int i;
 #ifndef OPENSSL_NO_MD5
     int hash_old = 0;
@@ -109,7 +122,7 @@ int crl_main(int argc, char **argv)
             outfile = opt_arg();
             break;
         case OPT_KEYFORM:
-            if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &keyformat))
+            if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyformat))
                 goto opthelp;
             break;
         case OPT_KEY:
@@ -126,12 +139,19 @@ int crl_main(int argc, char **argv)
             CAfile = opt_arg();
             do_ver = 1;
             break;
+        case OPT_CASTORE:
+            CAstore = opt_arg();
+            do_ver = 1;
+            break;
         case OPT_NOCAPATH:
             noCApath =  1;
             break;
         case OPT_NOCAFILE:
             noCAfile =  1;
             break;
+        case OPT_NOCASTORE:
+            noCAstore =  1;
+            break;
         case OPT_HASH_OLD:
 #ifndef OPENSSL_NO_MD5
             hash_old = ++num;
@@ -174,18 +194,24 @@ int crl_main(int argc, char **argv)
         case OPT_MD:
             if (!opt_md(opt_unknown(), &digest))
                 goto opthelp;
+            break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         }
     }
     argc = opt_num_rest();
     if (argc != 0)
         goto opthelp;
 
-    x = load_crl(infile, informat);
+    x = load_crl(infile, informat, "CRL");
     if (x == NULL)
         goto end;
 
     if (do_ver) {
-        if ((store = setup_verify(CAfile, CApath, noCAfile, noCApath)) == NULL)
+        if ((store = setup_verify(CAfile, noCAfile, CApath, noCApath,
+                                  CAstore, noCAstore)) == NULL)
             goto end;
         lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
         if (lookup == NULL)
@@ -204,7 +230,7 @@ int crl_main(int argc, char **argv)
         }
         pkey = X509_get_pubkey(X509_OBJECT_get0_X509(xobj));
         X509_OBJECT_free(xobj);
-        if (!pkey) {
+        if (pkey == NULL) {
             BIO_printf(bio_err, "Error getting CRL issuer public key\n");
             goto end;
         }
@@ -224,11 +250,11 @@ int crl_main(int argc, char **argv)
             BIO_puts(bio_err, "Missing CRL signing key\n");
             goto end;
         }
-        newcrl = load_crl(crldiff, informat);
+        newcrl = load_crl(crldiff, informat, "other CRL");
         if (!newcrl)
             goto end;
         pkey = load_key(keyfile, keyformat, 0, NULL, NULL, "CRL signing key");
-        if (!pkey) {
+        if (pkey == NULL) {
             X509_CRL_free(newcrl);
             goto end;
         }

apps/crl2p7.c

@@ -1,7 +1,7 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -19,22 +19,35 @@
 #include <openssl/pem.h>
 #include <openssl/objects.h>
 
+DEFINE_STACK_OF(X509_CRL)
+DEFINE_STACK_OF(X509)
+DEFINE_STACK_OF(X509_INFO)
+DEFINE_STACK_OF_STRING()
+
 static int add_certs_from_file(STACK_OF(X509) *stack, char *certfile);
 
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
-    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE
+    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOCRL, OPT_CERTFILE,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS crl2pkcs7_options[] = {
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-    {"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
-    {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
+
+    OPT_SECTION("Input"),
     {"in", OPT_IN, '<', "Input file"},
-    {"out", OPT_OUT, '>', "Output file"},
+    {"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
     {"nocrl", OPT_NOCRL, '-', "No crl to load, just certs from '-certfile'"},
     {"certfile", OPT_CERTFILE, '<',
      "File of chain of certs to a trusted CA; can be repeated"},
+
+    OPT_SECTION("Output"),
+    {"out", OPT_OUT, '>', "Output file"},
+    {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
+
+    OPT_PROV_OPTIONS,
     {NULL}
 };
 
@@ -88,6 +101,10 @@ int crl2pkcs7_main(int argc, char **argv)
             if (!sk_OPENSSL_STRING_push(certflst, opt_arg()))
                 goto end;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         }
     }
     argc = opt_num_rest();

apps/ct_log_list.cnf

@@ -2,8 +2,8 @@
 # that are to be trusted.
 
 # Google's list of logs can be found here:
-#       www.certificate-transparency.org/known-logs 
+#       www.certificate-transparency.org/known-logs
 # A Python program to convert the log list to OpenSSL's format can be
 # found here:
-#       https://github.com/google/certificate-transparency/blob/master/python/utilities/log_list/print_log_list.py 
+#       https://github.com/google/certificate-transparency/blob/master/python/utilities/log_list/print_log_list.py
 # Use the "--openssl_output" flag.

apps/demoSRP/srp_verifier.txt

@@ -3,4 +3,4 @@
 # records starting with a I followed by the g and N values and the id.
 # The exact values ... you have to dig this out from the source of srp.c
 # or srp_vfy.c
-# The last value of an I is used as the default group for new users.  
+# The last value of an I is used as the default group for new users.

apps/dgst.c

@@ -1,7 +1,7 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -19,6 +19,9 @@
 #include <openssl/x509.h>
 #include <openssl/pem.h>
 #include <openssl/hmac.h>
+#include <ctype.h>
+
+DEFINE_STACK_OF_STRING()
 
 #undef BUFSIZE
 #define BUFSIZE 1024*8
@@ -27,50 +30,64 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
           EVP_PKEY *key, unsigned char *sigin, int siglen,
           const char *sig_name, const char *md_name,
           const char *file);
+static void show_digests(const OBJ_NAME *name, void *bio_);
+
+struct doall_dgst_digests {
+    BIO *bio;
+    int n;
+};
 
 typedef enum OPTION_choice {
-    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
+    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP, OPT_LIST,
     OPT_C, OPT_R, OPT_OUT, OPT_SIGN, OPT_PASSIN, OPT_VERIFY,
     OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_ENGINE, OPT_ENGINE_IMPL,
     OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
     OPT_HMAC, OPT_MAC, OPT_SIGOPT, OPT_MACOPT,
     OPT_DIGEST,
-    OPT_R_ENUM
+    OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS dgst_options[] = {
     {OPT_HELP_STR, 1, '-', "Usage: %s [options] [file...]\n"},
-    {OPT_HELP_STR, 1, '-',
-        "  file... files to digest (default is stdin)\n"},
+
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-    {"c", OPT_C, '-', "Print the digest with separating colons"},
-    {"r", OPT_R, '-', "Print the digest in coreutils format"},
-    {"out", OPT_OUT, '>', "Output to filename rather than stdout"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"sign", OPT_SIGN, 's', "Sign digest using private key"},
-    {"verify", OPT_VERIFY, 's',
-     "Verify a signature using public key"},
-    {"prverify", OPT_PRVERIFY, 's',
-     "Verify a signature using private key"},
-    {"signature", OPT_SIGNATURE, '<', "File with signature to verify"},
-    {"keyform", OPT_KEYFORM, 'f', "Key file format (PEM or ENGINE)"},
-    {"hex", OPT_HEX, '-', "Print as hex dump"},
-    {"binary", OPT_BINARY, '-', "Print in binary form"},
-    {"d", OPT_DEBUG, '-', "Print debug info"},
-    {"debug", OPT_DEBUG, '-', "Print debug info"},
-    {"fips-fingerprint", OPT_FIPS_FINGERPRINT, '-',
-     "Compute HMAC with the key used in OpenSSL-FIPS fingerprint"},
-    {"hmac", OPT_HMAC, 's', "Create hashed MAC with key"},
-    {"mac", OPT_MAC, 's', "Create MAC (not necessarily HMAC)"},
-    {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
-    {"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form or key"},
-    {"", OPT_DIGEST, '-', "Any supported digest"},
-    OPT_R_OPTIONS,
+    {"list", OPT_LIST, '-', "List digests"},
 #ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
     {"engine_impl", OPT_ENGINE_IMPL, '-',
      "Also use engine given by -engine for digest operations"},
 #endif
+    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
+
+    OPT_SECTION("Output"),
+    {"c", OPT_C, '-', "Print the digest with separating colons"},
+    {"r", OPT_R, '-', "Print the digest in coreutils format"},
+    {"out", OPT_OUT, '>', "Output to filename rather than stdout"},
+    {"keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)"},
+    {"hex", OPT_HEX, '-', "Print as hex dump"},
+    {"binary", OPT_BINARY, '-', "Print in binary form"},
+    {"d", OPT_DEBUG, '-', "Print debug info"},
+    {"debug", OPT_DEBUG, '-', "Print debug info"},
+
+    OPT_SECTION("Signing"),
+    {"sign", OPT_SIGN, 's', "Sign digest using private key"},
+    {"verify", OPT_VERIFY, 's', "Verify a signature using public key"},
+    {"prverify", OPT_PRVERIFY, 's', "Verify a signature using private key"},
+    {"sigopt", OPT_SIGOPT, 's', "Signature parameter in n:v form"},
+    {"signature", OPT_SIGNATURE, '<', "File with signature to verify"},
+    {"hmac", OPT_HMAC, 's', "Create hashed MAC with key"},
+    {"mac", OPT_MAC, 's', "Create MAC (not necessarily HMAC)"},
+    {"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form or key"},
+    {"", OPT_DIGEST, '-', "Any supported digest"},
+    {"fips-fingerprint", OPT_FIPS_FINGERPRINT, '-',
+     "Compute HMAC with the key used in OpenSSL-FIPS fingerprint"},
+
+    OPT_R_OPTIONS,
+    OPT_PROV_OPTIONS,
+
+    OPT_PARAMETERS(),
+    {"file", 0, 0, "Files to digest (optional; default is stdin)"},
     {NULL}
 };
 
@@ -86,11 +103,13 @@ int dgst_main(int argc, char **argv)
     const EVP_MD *md = NULL, *m;
     const char *outfile = NULL, *keyfile = NULL, *prog = NULL;
     const char *sigfile = NULL;
+    const char *md_name = NULL;
     OPTION_CHOICE o;
     int separator = 0, debug = 0, keyform = FORMAT_PEM, siglen = 0;
     int i, ret = 1, out_bin = -1, want_pub = 0, do_verify = 0;
     unsigned char *buf = NULL, *sigbuf = NULL;
     int engine_impl = 0;
+    struct doall_dgst_digests dec;
 
     prog = opt_progname(argv[0]);
     buf = app_malloc(BUFSIZE, "I/O buffer");
@@ -108,6 +127,15 @@ int dgst_main(int argc, char **argv)
             opt_help(dgst_options);
             ret = 0;
             goto end;
+        case OPT_LIST:
+            BIO_printf(bio_out, "Supported digests:\n");
+            dec.bio = bio_out;
+            dec.n = 0;
+            OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_MD_METH,
+                                   show_digests, &dec);
+            BIO_printf(bio_out, "\n");
+            ret = 0;
+            goto end;
         case OPT_C:
             separator = 1;
             break;
@@ -183,6 +211,10 @@ int dgst_main(int argc, char **argv)
                 goto opthelp;
             md = m;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         }
     }
     argc = opt_num_rest();
@@ -365,13 +397,15 @@ int dgst_main(int argc, char **argv)
         BIO_get_md_ctx(bmd, &tctx);
         md = EVP_MD_CTX_md(tctx);
     }
+    if (md != NULL)
+        md_name = EVP_MD_name(md);
 
     if (argc == 0) {
         BIO_set_fp(in, stdin, BIO_NOCLOSE);
         ret = do_fp(out, buf, inp, separator, out_bin, sigkey, sigbuf,
-                    siglen, NULL, NULL, "stdin");
+                    siglen, NULL, md_name, "stdin");
     } else {
-        const char *md_name = NULL, *sig_name = NULL;
+        const char *sig_name = NULL;
         if (!out_bin) {
             if (sigkey != NULL) {
                 const EVP_PKEY_ASN1_METHOD *ameth;
@@ -380,8 +414,6 @@ int dgst_main(int argc, char **argv)
                     EVP_PKEY_asn1_get0_info(NULL, NULL,
                                             NULL, NULL, &sig_name, ameth);
             }
-            if (md != NULL)
-                md_name = EVP_MD_name(md);
         }
         ret = 0;
         for (i = 0; i < argc; i++) {
@@ -413,20 +445,86 @@ int dgst_main(int argc, char **argv)
     return ret;
 }
 
+static void show_digests(const OBJ_NAME *name, void *arg)
+{
+    struct doall_dgst_digests *dec = (struct doall_dgst_digests *)arg;
+    const EVP_MD *md = NULL;
+
+    /* Filter out signed digests (a.k.a signature algorithms) */
+    if (strstr(name->name, "rsa") != NULL || strstr(name->name, "RSA") != NULL)
+        return;
+
+    if (!islower((unsigned char)*name->name))
+        return;
+
+    /* Filter out message digests that we cannot use */
+    md = EVP_get_digestbyname(name->name);
+    if (md == NULL)
+        return;
+
+    BIO_printf(dec->bio, "-%-25s", name->name);
+    if (++dec->n == 3) {
+        BIO_printf(dec->bio, "\n");
+        dec->n = 0;
+    } else {
+        BIO_printf(dec->bio, " ");
+    }
+}
+
+/*
+ * The newline_escape_filename function performs newline escaping for any
+ * filename that contains a newline.  This function also takes a pointer
+ * to backslash. The backslash pointer is a flag to indicating whether a newline
+ * is present in the filename.  If a newline is present, the backslash flag is
+ * set and the output format will contain a backslash at the beginning of the
+ * digest output. This output format is to replicate the output format found
+ * in the '*sum' checksum programs. This aims to preserve backward
+ * compatibility.
+ */
+static const char *newline_escape_filename(const char *file, int * backslash)
+{
+    size_t i, e = 0, length = strlen(file), newline_count = 0, mem_len = 0;
+    char *file_cpy = NULL;
+
+    for (i = 0; i < length; i++)
+        if (file[i] == '\n')
+            newline_count++;
+
+    mem_len = length + newline_count + 1;
+    file_cpy = app_malloc(mem_len, file);
+    i = 0;
+
+    while(e < length) {
+        const char c = file[e];
+        if (c == '\n') {
+            file_cpy[i++] = '\\';
+            file_cpy[i++] = 'n';
+            *backslash = 1;
+        } else {
+            file_cpy[i++] = c;
+        }
+        e++;
+    }
+    file_cpy[i] = '\0';
+    return (const char*)file_cpy;
+}
+
+
 int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
           EVP_PKEY *key, unsigned char *sigin, int siglen,
           const char *sig_name, const char *md_name,
           const char *file)
 {
-    size_t len;
-    int i;
+    size_t len = BUFSIZE;
+    int i, backslash = 0, ret = 1;
+    unsigned char *sigbuf = NULL;
 
-    for (;;) {
+    while (BIO_pending(bp) || !BIO_eof(bp)) {
         i = BIO_read(bp, (char *)buf, BUFSIZE);
         if (i < 0) {
             BIO_printf(bio_err, "Read Error in %s\n", file);
             ERR_print_errors(bio_err);
-            return 1;
+            goto end;
         }
         if (i == 0)
             break;
@@ -439,37 +537,56 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
             BIO_printf(out, "Verified OK\n");
         } else if (i == 0) {
             BIO_printf(out, "Verification Failure\n");
-            return 1;
+            goto end;
         } else {
             BIO_printf(bio_err, "Error Verifying Data\n");
             ERR_print_errors(bio_err);
-            return 1;
+            goto end;
         }
-        return 0;
+        ret = 0;
+        goto end;
     }
     if (key != NULL) {
         EVP_MD_CTX *ctx;
+        size_t tmplen;
+
         BIO_get_md_ctx(bp, &ctx);
-        len = BUFSIZE;
+        if (!EVP_DigestSignFinal(ctx, NULL, &tmplen)) {
+            BIO_printf(bio_err, "Error Signing Data\n");
+            ERR_print_errors(bio_err);
+            goto end;
+        }
+        if (tmplen > BUFSIZE) {
+            len = tmplen;
+            sigbuf = app_malloc(len, "Signature buffer");
+            buf = sigbuf;
+        }
         if (!EVP_DigestSignFinal(ctx, buf, &len)) {
             BIO_printf(bio_err, "Error Signing Data\n");
             ERR_print_errors(bio_err);
-            return 1;
+            goto end;
         }
     } else {
         len = BIO_gets(bp, (char *)buf, BUFSIZE);
         if ((int)len < 0) {
             ERR_print_errors(bio_err);
-            return 1;
+            goto end;
         }
     }
 
     if (binout) {
         BIO_write(out, buf, len);
     } else if (sep == 2) {
+        file = newline_escape_filename(file, &backslash);
+
+        if (backslash == 1)
+            BIO_puts(out, "\\");
+
         for (i = 0; i < (int)len; i++)
             BIO_printf(out, "%02x", buf[i]);
+
         BIO_printf(out, " *%s\n", file);
+        OPENSSL_free((char *)file);
     } else {
         if (sig_name != NULL) {
             BIO_puts(out, sig_name);
@@ -488,5 +605,11 @@ int do_fp(BIO *out, unsigned char *buf, BIO *bp, int sep, int binout,
         }
         BIO_printf(out, "\n");
     }
-    return 0;
+
+    ret = 0;
+ end:
+    if (sigbuf != NULL)
+        OPENSSL_clear_free(sigbuf, len);
+
+    return ret;
 }

apps/dh1024.pem

@@ -1,10 +0,0 @@
------BEGIN DH PARAMETERS-----
-MIGHAoGBAP//////////yQ/aoiFowjTExmKLgNwc0SkCTgiKZ8x0Agu+pjsTmyJR
-Sgh5jjQE3e+VGbPNOkMbMCsKbfJfFDdP4TVtbVHCReSFtXZiXn7G9ExC6aY37WsL
-/1y29Aa37e44a/taiZ+lrp8kEXxLH+ZJKGZR7OZTgf//////////AgEC
------END DH PARAMETERS-----
-
-These are the 1024-bit DH parameters from "Internet Key Exchange 
-Protocol Version 2 (IKEv2)": https://tools.ietf.org/html/rfc5996
-
-See https://tools.ietf.org/html/rfc2412 for how they were generated.

apps/dh2048.pem

@@ -1,14 +0,0 @@
------BEGIN DH PARAMETERS-----
-MIIBCAKCAQEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb
-IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft
-awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT
-mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh
-fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq
-5RXSJhiY+gUQFXKOWoqsqmj//////////wIBAg==
------END DH PARAMETERS-----
-
-These are the 2048-bit DH parameters from "More Modular Exponential 
-(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)": 
-https://tools.ietf.org/html/rfc3526
-
-See https://tools.ietf.org/html/rfc2412 for how they were generated.

apps/dh4096.pem

@@ -1,19 +0,0 @@
------BEGIN DH PARAMETERS-----
-MIICCAKCAgEA///////////JD9qiIWjCNMTGYouA3BzRKQJOCIpnzHQCC76mOxOb
-IlFKCHmONATd75UZs806QxswKwpt8l8UN0/hNW1tUcJF5IW1dmJefsb0TELppjft
-awv/XLb0Brft7jhr+1qJn6WunyQRfEsf5kkoZlHs5Fs9wgB8uKFjvwWY2kg2HFXT
-mmkWP6j9JM9fg2VdI9yjrZYcYvNWIIVSu57VKQdwlpZtZww1Tkq8mATxdGwIyhgh
-fDKQXkYuNs474553LBgOhgObJ4Oi7Aeij7XFXfBvTFLJ3ivL9pVYFxg5lUl86pVq
-5RXSJhiY+gUQFXKOWoqqxC2tMxcNBFB6M6hVIavfHLpk7PuFBFjb7wqK6nFXXQYM
-fbOXD4Wm4eTHq/WujNsJM9cejJTgSiVhnc7j0iYa0u5r8S/6BtmKCGTYdgJzPshq
-ZFIfKxgXeyAMu+EXV3phXWx3CYjAutlG4gjiT6B05asxQ9tb/OD9EI5LgtEgqSEI
-ARpyPBKnh+bXiHGaEL26WyaZwycYavTiPBqUaDS2FQvaJYPpyirUTOjbu8LbBN6O
-+S6O/BQfvsqmKHxZR05rwF2ZspZPoJDDoiM7oYZRW+ftH2EpcM7i16+4G912IXBI
-HNAGkSfVsFqpk7TqmI2P3cGG/7fckKbAj030Nck0BjGZ//////////8CAQI=
------END DH PARAMETERS-----
-
-These are the 4096-bit DH parameters from "More Modular Exponential 
-(MODP) Diffie-Hellman groups for Internet Key Exchange (IKE)": 
-https://tools.ietf.org/html/rfc3526
-
-See https://tools.ietf.org/html/rfc2412 for how they were generated.

apps/dhparam.c

@@ -1,78 +1,95 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
  */
 
+#ifndef OPENSSL_NO_DEPRECATED_3_0
+/* We need to use some deprecated APIs */
+# define OPENSSL_SUPPRESS_DEPRECATED
+#endif
 #include <openssl/opensslconf.h>
-#ifdef OPENSSL_NO_DH
-NON_EMPTY_TRANSLATION_UNIT
-#else
 
-# include <stdio.h>
-# include <stdlib.h>
-# include <time.h>
-# include <string.h>
-# include "apps.h"
-# include "progs.h"
-# include <openssl/bio.h>
-# include <openssl/err.h>
-# include <openssl/bn.h>
-# include <openssl/dh.h>
-# include <openssl/x509.h>
-# include <openssl/pem.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <string.h>
+#include "apps.h"
+#include "progs.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/bn.h>
+#include <openssl/dh.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
 
-# ifndef OPENSSL_NO_DSA
-#  include <openssl/dsa.h>
-# endif
+#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
+# include <openssl/dsa.h>
+#endif
 
-# define DEFBITS 2048
+#define DEFBITS 2048
 
+#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
 static int dh_cb(int p, int n, BN_GENCB *cb);
+#endif
+static int gendh_cb(EVP_PKEY_CTX *ctx);
 
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
     OPT_ENGINE, OPT_CHECK, OPT_TEXT, OPT_NOOUT,
-    OPT_DSAPARAM, OPT_C, OPT_2, OPT_5,
-    OPT_R_ENUM
+    OPT_DSAPARAM, OPT_C, OPT_2, OPT_3, OPT_5,
+    OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS dhparam_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [flags] [numbits]\n"},
-    {OPT_HELP_STR, 1, '-', "Valid options are:\n"},
+    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [numbits]\n"},
+
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-    {"in", OPT_IN, '<', "Input file"},
-    {"inform", OPT_INFORM, 'F', "Input format, DER or PEM"},
-    {"outform", OPT_OUTFORM, 'F', "Output format, DER or PEM"},
-    {"out", OPT_OUT, '>', "Output file"},
     {"check", OPT_CHECK, '-', "Check the DH parameters"},
-    {"text", OPT_TEXT, '-', "Print a text form of the DH parameters"},
-    {"noout", OPT_NOOUT, '-', "Don't output any DH parameters"},
-    OPT_R_OPTIONS,
-    {"C", OPT_C, '-', "Print C code"},
-    {"2", OPT_2, '-', "Generate parameters using 2 as the generator value"},
-    {"5", OPT_5, '-', "Generate parameters using 5 as the generator value"},
-# ifndef OPENSSL_NO_DSA
+#ifndef OPENSSL_NO_DSA
     {"dsaparam", OPT_DSAPARAM, '-',
      "Read or generate DSA parameters, convert to DH"},
-# endif
-# ifndef OPENSSL_NO_ENGINE
+#endif
+#ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-# endif
+#endif
+
+    OPT_SECTION("Input"),
+    {"in", OPT_IN, '<', "Input file"},
+    {"inform", OPT_INFORM, 'F', "Input format, DER or PEM"},
+
+    OPT_SECTION("Output"),
+    {"out", OPT_OUT, '>', "Output file"},
+    {"outform", OPT_OUTFORM, 'F', "Output format, DER or PEM"},
+    {"text", OPT_TEXT, '-', "Print a text form of the DH parameters"},
+    {"noout", OPT_NOOUT, '-', "Don't output any DH parameters"},
+    {"C", OPT_C, '-', "Print C code"},
+    {"2", OPT_2, '-', "Generate parameters using 2 as the generator value"},
+    {"3", OPT_3, '-', "Generate parameters using 3 as the generator value"},
+    {"5", OPT_5, '-', "Generate parameters using 5 as the generator value"},
+
+    OPT_R_OPTIONS,
+    OPT_PROV_OPTIONS,
+
+    OPT_PARAMETERS(),
+    {"numbits", 0, 0, "Number of bits if generating parameters (optional)"},
     {NULL}
 };
 
 int dhparam_main(int argc, char **argv)
 {
     BIO *in = NULL, *out = NULL;
-    DH *dh = NULL;
+    DH *dh = NULL, *alloc_dh = NULL;
+    EVP_PKEY *pkey = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
     char *infile = NULL, *outfile = NULL, *prog;
     ENGINE *e = NULL;
-#ifndef OPENSSL_NO_DSA
+#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
     int dsaparam = 0;
 #endif
     int i, text = 0, C = 0, ret = 1, num = 0, g = 0;
@@ -116,7 +133,11 @@ int dhparam_main(int argc, char **argv)
             break;
         case OPT_DSAPARAM:
 #ifndef OPENSSL_NO_DSA
+# ifdef OPENSSL_NO_DEPRECATED_3_0
+            BIO_printf(bio_err, "The dsaparam option is deprecated.\n");
+# else
             dsaparam = 1;
+# endif
 #endif
             break;
         case OPT_C:
@@ -125,6 +146,9 @@ int dhparam_main(int argc, char **argv)
         case OPT_2:
             g = 2;
             break;
+        case OPT_3:
+            g = 3;
+            break;
         case OPT_5:
             g = 5;
             break;
@@ -135,6 +159,10 @@ int dhparam_main(int argc, char **argv)
             if (!opt_rand(o))
                 goto end;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         }
     }
     argc = opt_num_rest();
@@ -146,13 +174,13 @@ int dhparam_main(int argc, char **argv)
     if (g && !num)
         num = DEFBITS;
 
-# ifndef OPENSSL_NO_DSA
+#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
     if (dsaparam && g) {
         BIO_printf(bio_err,
-                   "generator may not be chosen for DSA parameters\n");
+                   "Error, generator may not be chosen for DSA parameters\n");
         goto end;
     }
-# endif
+#endif
 
     out = bio_open_default(outfile, 'w', outformat);
     if (out == NULL)
@@ -164,18 +192,16 @@ int dhparam_main(int argc, char **argv)
 
     if (num) {
 
-        BN_GENCB *cb;
-        cb = BN_GENCB_new();
-        if (cb == NULL) {
-            ERR_print_errors(bio_err);
-            goto end;
-        }
 
-        BN_GENCB_set(cb, dh_cb, bio_err);
-
-# ifndef OPENSSL_NO_DSA
+#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
         if (dsaparam) {
             DSA *dsa = DSA_new();
+            BN_GENCB *cb  = BN_GENCB_new();
+
+            if (cb == NULL)
+                goto end;
+
+            BN_GENCB_set(cb, dh_cb, bio_err);
 
             BIO_printf(bio_err,
                        "Generating DSA parameters, %d bit long prime\n", num);
@@ -184,40 +210,52 @@ int dhparam_main(int argc, char **argv)
                                                cb)) {
                 DSA_free(dsa);
                 BN_GENCB_free(cb);
-                ERR_print_errors(bio_err);
+                BIO_printf(bio_err, "Error, unable to generate DSA parameters\n");
                 goto end;
             }
 
-            dh = DSA_dup_DH(dsa);
+            dh = alloc_dh = DSA_dup_DH(dsa);
             DSA_free(dsa);
-            if (dh == NULL) {
-                BN_GENCB_free(cb);
-                ERR_print_errors(bio_err);
+            BN_GENCB_free(cb);
+            if (dh == NULL)
+                goto end;
+        } else
+#endif
+        {
+            ctx = EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL);
+            if (ctx == NULL) {
+                BIO_printf(bio_err,
+                           "Error, DH key generation context allocation failed\n");
                 goto end;
             }
-        } else
-# endif
-        {
-            dh = DH_new();
+            EVP_PKEY_CTX_set_cb(ctx, gendh_cb);
+            EVP_PKEY_CTX_set_app_data(ctx, bio_err);
             BIO_printf(bio_err,
                        "Generating DH parameters, %d bit long safe prime, generator %d\n",
                        num, g);
             BIO_printf(bio_err, "This is going to take a long time\n");
-            if (dh == NULL || !DH_generate_parameters_ex(dh, num, g, cb)) {
-                BN_GENCB_free(cb);
-                ERR_print_errors(bio_err);
+            if (!EVP_PKEY_paramgen_init(ctx)) {
+                BIO_printf(bio_err,
+                           "Error, unable to initialise DH param generation\n");
                 goto end;
             }
+
+            if (!EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx, num)) {
+                BIO_printf(bio_err, "Error, unable to set DH prime length\n");
+                goto end;
+            }
+            if (!EVP_PKEY_paramgen(ctx, &pkey)) {
+                BIO_printf(bio_err, "Error, DH generation failed\n");
+                goto end;
+            }
+            dh = EVP_PKEY_get0_DH(pkey);
         }
-
-        BN_GENCB_free(cb);
     } else {
-
         in = bio_open_default(infile, 'r', informat);
         if (in == NULL)
             goto end;
 
-# ifndef OPENSSL_NO_DSA
+#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
         if (dsaparam) {
             DSA *dsa;
 
@@ -227,76 +265,54 @@ int dhparam_main(int argc, char **argv)
                 dsa = PEM_read_bio_DSAparams(in, NULL, NULL, NULL);
 
             if (dsa == NULL) {
-                BIO_printf(bio_err, "unable to load DSA parameters\n");
-                ERR_print_errors(bio_err);
+                BIO_printf(bio_err, "Error, unable to load DSA parameters\n");
                 goto end;
             }
 
-            dh = DSA_dup_DH(dsa);
+            dh = alloc_dh = DSA_dup_DH(dsa);
             DSA_free(dsa);
-            if (dh == NULL) {
-                ERR_print_errors(bio_err);
+            if (dh == NULL)
                 goto end;
-            }
         } else
-# endif
+#endif
         {
             if (informat == FORMAT_ASN1) {
                 /*
                  * We have no PEM header to determine what type of DH params it
                  * is. We'll just try both.
                  */
-                dh = d2i_DHparams_bio(in, NULL);
+                dh = alloc_dh = ASN1_d2i_bio_of(DH, DH_new, d2i_DHparams, in, NULL);
                 /* BIO_reset() returns 0 for success for file BIOs only!!! */
                 if (dh == NULL && BIO_reset(in) == 0)
-                    dh = d2i_DHxparams_bio(in, NULL);
+                    dh = alloc_dh = ASN1_d2i_bio_of(DH, DH_new, d2i_DHxparams, in, NULL);
             } else {
                 /* informat == FORMAT_PEM */
-                dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
+                dh = alloc_dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
             }
 
             if (dh == NULL) {
-                BIO_printf(bio_err, "unable to load DH parameters\n");
-                ERR_print_errors(bio_err);
+                BIO_printf(bio_err, "Error, unable to load DH parameters\n");
                 goto end;
             }
         }
-
         /* dh != NULL */
     }
 
-    if (text) {
-        DHparams_print(out, dh);
-    }
+    if (text)
+        EVP_PKEY_print_params(out, pkey, 4, NULL);
 
     if (check) {
-        if (!DH_check(dh, &i)) {
-            ERR_print_errors(bio_err);
+        if (!EVP_PKEY_param_check(ctx) /* DH_check(dh, &i) */) {
+            BIO_printf(bio_err, "Error, invalid parameters generated\n");
             goto end;
         }
-        if (i & DH_CHECK_P_NOT_PRIME)
-            BIO_printf(bio_err, "WARNING: p value is not prime\n");
-        if (i & DH_CHECK_P_NOT_SAFE_PRIME)
-            BIO_printf(bio_err, "WARNING: p value is not a safe prime\n");
-        if (i & DH_CHECK_Q_NOT_PRIME)
-            BIO_printf(bio_err, "WARNING: q value is not a prime\n");
-        if (i & DH_CHECK_INVALID_Q_VALUE)
-            BIO_printf(bio_err, "WARNING: q value is invalid\n");
-        if (i & DH_CHECK_INVALID_J_VALUE)
-            BIO_printf(bio_err, "WARNING: j value is invalid\n");
-        if (i & DH_UNABLE_TO_CHECK_GENERATOR)
-            BIO_printf(bio_err,
-                       "WARNING: unable to check the generator value\n");
-        if (i & DH_NOT_SUITABLE_GENERATOR)
-            BIO_printf(bio_err, "WARNING: the g value is not a generator\n");
-        if (i == 0)
-            BIO_printf(bio_err, "DH parameters appear to be ok.\n");
-        if (num != 0 && i != 0) {
+        BIO_printf(bio_err, "DH parameters appear to be ok.\n");
+        if (num != 0) {
             /*
              * We have generated parameters but DH_check() indicates they are
              * invalid! This should never happen!
              */
-            BIO_printf(bio_err, "ERROR: Invalid parameters generated\n");
+            BIO_printf(bio_err, "Error, invalid parameters generated\n");
             goto end;
         }
     }
@@ -305,8 +321,9 @@ int dhparam_main(int argc, char **argv)
         int len, bits;
         const BIGNUM *pbn, *gbn;
 
-        len = DH_size(dh);
-        bits = DH_bits(dh);
+        dh = EVP_PKEY_get0_DH(pkey);
+        len = EVP_PKEY_size(pkey);
+        bits = EVP_PKEY_size(pkey);
         DH_get0_pqg(dh, &pbn, NULL, &gbn);
         data = app_malloc(len, "print a BN");
 
@@ -344,36 +361,51 @@ int dhparam_main(int argc, char **argv)
         DH_get0_pqg(dh, NULL, &q, NULL);
         if (outformat == FORMAT_ASN1) {
             if (q != NULL)
-                i = i2d_DHxparams_bio(out, dh);
+                i = ASN1_i2d_bio_of(DH, i2d_DHxparams, out, dh);
             else
-                i = i2d_DHparams_bio(out, dh);
+                i = ASN1_i2d_bio_of(DH, i2d_DHparams, out, dh);
         } else if (q != NULL) {
             i = PEM_write_bio_DHxparams(out, dh);
         } else {
             i = PEM_write_bio_DHparams(out, dh);
         }
         if (!i) {
-            BIO_printf(bio_err, "unable to write DH parameters\n");
-            ERR_print_errors(bio_err);
+            BIO_printf(bio_err, "Error, unable to write DH parameters\n");
             goto end;
         }
     }
     ret = 0;
  end:
+    if (ret != 0)
+        ERR_print_errors(bio_err);
+    DH_free(alloc_dh);
     BIO_free(in);
     BIO_free_all(out);
-    DH_free(dh);
+    EVP_PKEY_free(pkey);
+    EVP_PKEY_CTX_free(ctx);
     release_engine(e);
     return ret;
 }
 
-static int dh_cb(int p, int n, BN_GENCB *cb)
+static int common_dh_cb(int p, BIO *b)
 {
     static const char symbols[] = ".+*\n";
     char c = (p >= 0 && (size_t)p < sizeof(symbols) - 1) ? symbols[p] : '?';
 
-    BIO_write(BN_GENCB_get_arg(cb), &c, 1);
-    (void)BIO_flush(BN_GENCB_get_arg(cb));
+    BIO_write(b, &c, 1);
+    (void)BIO_flush(b);
     return 1;
 }
+
+#if !defined(OPENSSL_NO_DSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
+static int dh_cb(int p, int n, BN_GENCB *cb)
+{
+    return common_dh_cb(p, BN_GENCB_get_arg(cb));
+}
 #endif
+
+static int gendh_cb(EVP_PKEY_CTX *ctx)
+{
+    return common_dh_cb(EVP_PKEY_CTX_get_keygen_info(ctx, 0),
+                        EVP_PKEY_CTX_get_app_data(ctx));
+}

apps/dsa.c

@@ -1,30 +1,27 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
  */
 
 #include <openssl/opensslconf.h>
-#ifdef OPENSSL_NO_DSA
-NON_EMPTY_TRANSLATION_UNIT
-#else
 
-# include <stdio.h>
-# include <stdlib.h>
-# include <string.h>
-# include <time.h>
-# include "apps.h"
-# include "progs.h"
-# include <openssl/bio.h>
-# include <openssl/err.h>
-# include <openssl/dsa.h>
-# include <openssl/evp.h>
-# include <openssl/x509.h>
-# include <openssl/pem.h>
-# include <openssl/bn.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <time.h>
+#include "apps.h"
+#include "progs.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/dsa.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+#include <openssl/bn.h>
 
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
@@ -32,31 +29,39 @@ typedef enum OPTION_choice {
     /* Do not change the order here; see case statements below */
     OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG,
     OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_PUBIN,
-    OPT_PUBOUT, OPT_CIPHER, OPT_PASSIN, OPT_PASSOUT
+    OPT_PUBOUT, OPT_CIPHER, OPT_PASSIN, OPT_PASSOUT,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS dsa_options[] = {
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-    {"inform", OPT_INFORM, 'f', "Input format, DER PEM PVK"},
-    {"outform", OPT_OUTFORM, 'f', "Output format, DER PEM PVK"},
-    {"in", OPT_IN, 's', "Input key"},
-    {"out", OPT_OUT, '>', "Output file"},
-    {"noout", OPT_NOOUT, '-', "Don't print key out"},
-    {"text", OPT_TEXT, '-', "Print the key in text"},
-    {"modulus", OPT_MODULUS, '-', "Print the DSA public value"},
-    {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
-    {"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
     {"", OPT_CIPHER, '-', "Any supported cipher"},
-# ifndef OPENSSL_NO_RC4
+#ifndef OPENSSL_NO_RC4
     {"pvk-strong", OPT_PVK_STRONG, '-', "Enable 'Strong' PVK encoding level (default)"},
     {"pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level"},
     {"pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding"},
-# endif
-# ifndef OPENSSL_NO_ENGINE
+#endif
+#ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-# endif
+#endif
+
+    OPT_SECTION("Input"),
+    {"in", OPT_IN, 's', "Input key"},
+    {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/PVK); has no effect"},
+    {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
+    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
+
+    OPT_SECTION("Output"),
+    {"out", OPT_OUT, '>', "Output file"},
+    {"outform", OPT_OUTFORM, 'f', "Output format, DER PEM PVK"},
+    {"noout", OPT_NOOUT, '-', "Don't print key out"},
+    {"text", OPT_TEXT, '-', "Print the key in text"},
+    {"modulus", OPT_MODULUS, '-', "Print the DSA public value"},
+    {"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
+    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
+
+    OPT_PROV_OPTIONS,
     {NULL}
 };
 
@@ -65,15 +70,16 @@ int dsa_main(int argc, char **argv)
     BIO *out = NULL;
     DSA *dsa = NULL;
     ENGINE *e = NULL;
+    EVP_PKEY *pkey = NULL;
     const EVP_CIPHER *enc = NULL;
     char *infile = NULL, *outfile = NULL, *prog;
     char *passin = NULL, *passout = NULL, *passinarg = NULL, *passoutarg = NULL;
     OPTION_CHOICE o;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, text = 0, noout = 0;
     int i, modulus = 0, pubin = 0, pubout = 0, ret = 1;
-# ifndef OPENSSL_NO_RC4
+#ifndef OPENSSL_NO_RC4
     int pvk_encr = 2;
-# endif
+#endif
     int private = 0;
 
     prog = opt_init(argc, argv, dsa_options);
@@ -138,6 +144,10 @@ int dsa_main(int argc, char **argv)
             if (!opt_cipher(opt_unknown(), &enc))
                 goto end;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         }
     }
     argc = opt_num_rest();
@@ -154,19 +164,14 @@ int dsa_main(int argc, char **argv)
     }
 
     BIO_printf(bio_err, "read DSA key\n");
-    {
-        EVP_PKEY *pkey;
+    if (pubin)
+        pkey = load_pubkey(infile, informat, 1, passin, e, "Public Key");
+    else
+        pkey = load_key(infile, informat, 1, passin, e, "Private Key");
 
-        if (pubin)
-            pkey = load_pubkey(infile, informat, 1, passin, e, "Public Key");
-        else
-            pkey = load_key(infile, informat, 1, passin, e, "Private Key");
+    if (pkey != NULL)
+        dsa = EVP_PKEY_get1_DSA(pkey);
 
-        if (pkey != NULL) {
-            dsa = EVP_PKEY_get1_DSA(pkey);
-            EVP_PKEY_free(pkey);
-        }
-    }
     if (dsa == NULL) {
         BIO_printf(bio_err, "unable to load Key\n");
         ERR_print_errors(bio_err);
@@ -179,7 +184,8 @@ int dsa_main(int argc, char **argv)
 
     if (text) {
         assert(pubin || private);
-        if (!DSA_print(out, dsa, 0)) {
+        if ((pubin && EVP_PKEY_print_public(out, pkey, 0, NULL) <= 0)
+            || (!pubin && EVP_PKEY_print_private(out, pkey, 0, NULL) <= 0)) {
             perror(outfile);
             ERR_print_errors(bio_err);
             goto end;
@@ -214,7 +220,7 @@ int dsa_main(int argc, char **argv)
             i = PEM_write_bio_DSAPrivateKey(out, dsa, enc,
                                             NULL, 0, NULL, passout);
         }
-# ifndef OPENSSL_NO_RSA
+#ifndef OPENSSL_NO_RSA
     } else if (outformat == FORMAT_MSBLOB || outformat == FORMAT_PVK) {
         EVP_PKEY *pk;
         pk = EVP_PKEY_new();
@@ -229,13 +235,13 @@ int dsa_main(int argc, char **argv)
                 goto end;
             }
             assert(private);
-#  ifdef OPENSSL_NO_RC4
+# ifdef OPENSSL_NO_RC4
             BIO_printf(bio_err, "PVK format not supported\n");
             EVP_PKEY_free(pk);
             goto end;
-#  else
+# else
             i = i2b_PVK_bio(out, pk, pvk_encr, 0, passout);
-#  endif
+# endif
         } else if (pubin || pubout) {
             i = i2b_PublicKey_bio(out, pk);
         } else {
@@ -243,7 +249,7 @@ int dsa_main(int argc, char **argv)
             i = i2b_PrivateKey_bio(out, pk);
         }
         EVP_PKEY_free(pk);
-# endif
+#endif
     } else {
         BIO_printf(bio_err, "bad output format specified for outfile\n");
         goto end;
@@ -256,10 +262,10 @@ int dsa_main(int argc, char **argv)
     ret = 0;
  end:
     BIO_free_all(out);
+    EVP_PKEY_free(pkey);
     DSA_free(dsa);
     release_engine(e);
     OPENSSL_free(passin);
     OPENSSL_free(passout);
     return ret;
 }
-#endif

apps/dsaparam.c

@@ -1,61 +1,74 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
  */
 
 #include <openssl/opensslconf.h>
-#ifdef OPENSSL_NO_DSA
-NON_EMPTY_TRANSLATION_UNIT
-#else
 
-# include <stdio.h>
-# include <stdlib.h>
-# include <time.h>
-# include <string.h>
-# include "apps.h"
-# include "progs.h"
-# include <openssl/bio.h>
-# include <openssl/err.h>
-# include <openssl/bn.h>
-# include <openssl/dsa.h>
-# include <openssl/x509.h>
-# include <openssl/pem.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <string.h>
+#include "apps.h"
+#include "progs.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/bn.h>
+#include <openssl/dsa.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
 
-static int dsa_cb(int p, int n, BN_GENCB *cb);
+static int verbose = 0;
+
+static int gendsa_cb(EVP_PKEY_CTX *ctx);
 
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C,
-    OPT_NOOUT, OPT_GENKEY, OPT_ENGINE, OPT_R_ENUM
+    OPT_NOOUT, OPT_GENKEY, OPT_ENGINE, OPT_VERBOSE,
+    OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS dsaparam_options[] = {
+    {OPT_HELP_STR, 1, '-', "Usage: %s [options] [numbits]\n"},
+
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-    {"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
+#endif
+
+    OPT_SECTION("Input"),
     {"in", OPT_IN, '<', "Input file"},
-    {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
+    {"inform", OPT_INFORM, 'F', "Input format - DER or PEM"},
+
+    OPT_SECTION("Output"),
     {"out", OPT_OUT, '>', "Output file"},
+    {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
     {"text", OPT_TEXT, '-', "Print as text"},
     {"C", OPT_C, '-', "Output C code"},
     {"noout", OPT_NOOUT, '-', "No output"},
+    {"verbose", OPT_VERBOSE, '-', "Verbose output"},
     {"genkey", OPT_GENKEY, '-', "Generate a DSA key"},
+
     OPT_R_OPTIONS,
-# ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-# endif
+    OPT_PROV_OPTIONS,
+
+    OPT_PARAMETERS(),
+    {"numbits", 0, 0, "Number of bits if generating parameters (optional)"},
     {NULL}
 };
 
 int dsaparam_main(int argc, char **argv)
 {
     ENGINE *e = NULL;
-    DSA *dsa = NULL;
     BIO *in = NULL, *out = NULL;
-    BN_GENCB *cb = NULL;
+    EVP_PKEY *params = NULL, *pkey = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
     int numbits = -1, num = 0, genkey = 0;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0;
     int ret = 1, i, text = 0, private = 0;
@@ -104,9 +117,16 @@ int dsaparam_main(int argc, char **argv)
             if (!opt_rand(o))
                 goto end;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         case OPT_NOOUT:
             noout = 1;
             break;
+        case OPT_VERBOSE:
+            verbose = 1;
+            break;
         }
     }
     argc = opt_num_rest();
@@ -127,6 +147,12 @@ int dsaparam_main(int argc, char **argv)
     if (out == NULL)
         goto end;
 
+    ctx = EVP_PKEY_CTX_new_from_name(NULL, "DSA", NULL);
+    if (ctx == NULL) {
+        BIO_printf(bio_err,
+                   "Error, DSA parameter generation context allocation failed\n");
+        goto end;
+    }
     if (numbits > 0) {
         if (numbits > OPENSSL_DSA_MAX_MODULUS_BITS)
             BIO_printf(bio_err,
@@ -134,46 +160,49 @@ int dsaparam_main(int argc, char **argv)
                        "         Your key size is %d! Larger key size may behave not as expected.\n",
                        OPENSSL_DSA_MAX_MODULUS_BITS, numbits);
 
-        cb = BN_GENCB_new();
-        if (cb == NULL) {
-            BIO_printf(bio_err, "Error allocating BN_GENCB object\n");
+        EVP_PKEY_CTX_set_cb(ctx, gendsa_cb);
+        EVP_PKEY_CTX_set_app_data(ctx, bio_err);
+        if (verbose) {
+            BIO_printf(bio_err, "Generating DSA parameters, %d bit long prime\n",
+                       num);
+            BIO_printf(bio_err, "This could take some time\n");
+        }
+        if (EVP_PKEY_paramgen_init(ctx) <= 0) {
+            BIO_printf(bio_err,
+                       "Error, DSA key generation paramgen init failed\n");
             goto end;
         }
-        BN_GENCB_set(cb, dsa_cb, bio_err);
-        dsa = DSA_new();
-        if (dsa == NULL) {
-            BIO_printf(bio_err, "Error allocating DSA object\n");
+        if (!EVP_PKEY_CTX_set_dsa_paramgen_bits(ctx, num)) {
+            BIO_printf(bio_err,
+                       "Error, DSA key generation setting bit length failed\n");
             goto end;
         }
-        BIO_printf(bio_err, "Generating DSA parameters, %d bit long prime\n",
-                   num);
-        BIO_printf(bio_err, "This could take some time\n");
-        if (!DSA_generate_parameters_ex(dsa, num, NULL, 0, NULL, NULL, cb)) {
-            ERR_print_errors(bio_err);
+        if (EVP_PKEY_paramgen(ctx, &params) <= 0) {
             BIO_printf(bio_err, "Error, DSA key generation failed\n");
             goto end;
         }
     } else if (informat == FORMAT_ASN1) {
-        dsa = d2i_DSAparams_bio(in, NULL);
+        params = d2i_KeyParams_bio(EVP_PKEY_DSA, NULL, in);
     } else {
-        dsa = PEM_read_bio_DSAparams(in, NULL, NULL, NULL);
+        params = PEM_read_bio_Parameters(in, NULL);
     }
-    if (dsa == NULL) {
-        BIO_printf(bio_err, "unable to load DSA parameters\n");
-        ERR_print_errors(bio_err);
+    if (params == NULL) {
+        BIO_printf(bio_err, "Error, unable to load DSA parameters\n");
         goto end;
     }
 
     if (text) {
-        DSAparams_print(out, dsa);
+        EVP_PKEY_print_params(out, params, 0, NULL);
     }
 
     if (C) {
-        const BIGNUM *p = NULL, *q = NULL, *g = NULL;
+        BIGNUM *p = NULL, *q = NULL, *g = NULL;
         unsigned char *data;
         int len, bits_p;
 
-        DSA_get0_pqg(dsa, &p, &q, &g);
+        EVP_PKEY_get_bn_param(params, "p", &p);
+        EVP_PKEY_get_bn_param(params, "q", &q);
+        EVP_PKEY_get_bn_param(params, "g", &g);
         len = BN_num_bytes(p);
         bits_p = BN_num_bits(p);
 
@@ -209,50 +238,65 @@ int dsaparam_main(int argc, char **argv)
 
     if (!noout) {
         if (outformat == FORMAT_ASN1)
-            i = i2d_DSAparams_bio(out, dsa);
+            i = i2d_KeyParams_bio(out, params);
         else
-            i = PEM_write_bio_DSAparams(out, dsa);
+            i = PEM_write_bio_Parameters(out, params);
         if (!i) {
-            BIO_printf(bio_err, "unable to write DSA parameters\n");
-            ERR_print_errors(bio_err);
+            BIO_printf(bio_err, "Error, unable to write DSA parameters\n");
             goto end;
         }
     }
     if (genkey) {
-        DSA *dsakey;
-
-        if ((dsakey = DSAparams_dup(dsa)) == NULL)
+        EVP_PKEY_CTX_free(ctx);
+        ctx = EVP_PKEY_CTX_new(params, NULL);
+        if (ctx == NULL) {
+            BIO_printf(bio_err,
+                       "Error, DSA key generation context allocation failed\n");
             goto end;
-        if (!DSA_generate_key(dsakey)) {
-            ERR_print_errors(bio_err);
-            DSA_free(dsakey);
+        }
+        if (!EVP_PKEY_keygen_init(ctx)) {
+            BIO_printf(bio_err,
+                       "Error, unable to initialise for key generation\n");
+            goto end;
+        }
+        if (!EVP_PKEY_keygen(ctx, &pkey)) {
+            BIO_printf(bio_err, "Error, unable to generate key\n");
             goto end;
         }
         assert(private);
         if (outformat == FORMAT_ASN1)
-            i = i2d_DSAPrivateKey_bio(out, dsakey);
+            i = i2d_PrivateKey_bio(out, pkey);
         else
-            i = PEM_write_bio_DSAPrivateKey(out, dsakey, NULL, NULL, 0, NULL,
-                                            NULL);
-        DSA_free(dsakey);
+            i = PEM_write_bio_PrivateKey(out, pkey, NULL, NULL, 0, NULL, NULL);
     }
     ret = 0;
  end:
-    BN_GENCB_free(cb);
+    if (ret != 0)
+        ERR_print_errors(bio_err);
     BIO_free(in);
     BIO_free_all(out);
-    DSA_free(dsa);
+    EVP_PKEY_CTX_free(ctx);
+    EVP_PKEY_free(pkey);
+    EVP_PKEY_free(params);
     release_engine(e);
     return ret;
 }
 
-static int dsa_cb(int p, int n, BN_GENCB *cb)
+static int gendsa_cb(EVP_PKEY_CTX *ctx)
 {
     static const char symbols[] = ".+*\n";
-    char c = (p >= 0 && (size_t)p < sizeof(symbols) - 1) ? symbols[p] : '?';
+    int p;
+    char c;
+    BIO *b;
 
-    BIO_write(BN_GENCB_get_arg(cb), &c, 1);
-    (void)BIO_flush(BN_GENCB_get_arg(cb));
+    if (!verbose)
+        return 1;
+
+    b = EVP_PKEY_CTX_get_app_data(ctx);
+    p = EVP_PKEY_CTX_get_keygen_info(ctx, 0);
+    c = (p >= 0 && (size_t)p < sizeof(symbols) - 1) ? symbols[p] : '?';
+
+    BIO_write(b, &c, 1);
+    (void)BIO_flush(b);
     return 1;
 }
-#endif

apps/ec.c

@@ -1,26 +1,23 @@
 /*
- * Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
  */
 
 #include <openssl/opensslconf.h>
-#ifdef OPENSSL_NO_EC
-NON_EMPTY_TRANSLATION_UNIT
-#else
 
-# include <stdio.h>
-# include <stdlib.h>
-# include <string.h>
-# include "apps.h"
-# include "progs.h"
-# include <openssl/bio.h>
-# include <openssl/err.h>
-# include <openssl/evp.h>
-# include <openssl/pem.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "apps.h"
+#include "progs.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
 
 static OPT_PAIR conv_forms[] = {
     {"compressed", POINT_CONVERSION_COMPRESSED},
@@ -40,31 +37,38 @@ typedef enum OPTION_choice {
     OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
     OPT_NOOUT, OPT_TEXT, OPT_PARAM_OUT, OPT_PUBIN, OPT_PUBOUT,
     OPT_PASSIN, OPT_PASSOUT, OPT_PARAM_ENC, OPT_CONV_FORM, OPT_CIPHER,
-    OPT_NO_PUBLIC, OPT_CHECK
+    OPT_NO_PUBLIC, OPT_CHECK, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS ec_options[] = {
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+#endif
+
+    OPT_SECTION("Input"),
     {"in", OPT_IN, 's', "Input file"},
-    {"inform", OPT_INFORM, 'f', "Input format - DER or PEM"},
+    {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)"},
+    {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
+    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
+    {"check", OPT_CHECK, '-', "check key consistency"},
+    {"", OPT_CIPHER, '-', "Any supported cipher"},
+    {"param_enc", OPT_PARAM_ENC, 's',
+     "Specifies the way the ec parameters are encoded"},
+    {"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "},
+
+    OPT_SECTION("Output"),
     {"out", OPT_OUT, '>', "Output file"},
     {"outform", OPT_OUTFORM, 'F', "Output format - DER or PEM"},
     {"noout", OPT_NOOUT, '-', "Don't print key out"},
     {"text", OPT_TEXT, '-', "Print the key"},
     {"param_out", OPT_PARAM_OUT, '-', "Print the elliptic curve parameters"},
-    {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
     {"pubout", OPT_PUBOUT, '-', "Output public key, not private"},
     {"no_public", OPT_NO_PUBLIC, '-', "exclude public key from private key"},
-    {"check", OPT_CHECK, '-', "check key consistency"},
-    {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
     {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
-    {"param_enc", OPT_PARAM_ENC, 's',
-     "Specifies the way the ec parameters are encoded"},
-    {"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "},
-    {"", OPT_CIPHER, '-', "Any supported cipher"},
-# ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-# endif
+
+    OPT_PROV_OPTIONS,
     {NULL}
 };
 
@@ -156,6 +160,10 @@ int ec_main(int argc, char **argv)
         case OPT_CHECK:
             check = 1;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         }
     }
     argc = opt_num_rest();
@@ -280,4 +288,3 @@ int ec_main(int argc, char **argv)
     OPENSSL_free(passout);
     return ret;
 }
-#endif

apps/ecparam.c

@@ -1,63 +1,70 @@
 /*
- * Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
  */
 
 #include <openssl/opensslconf.h>
-#ifdef OPENSSL_NO_EC
-NON_EMPTY_TRANSLATION_UNIT
-#else
 
-# include <stdio.h>
-# include <stdlib.h>
-# include <time.h>
-# include <string.h>
-# include "apps.h"
-# include "progs.h"
-# include <openssl/bio.h>
-# include <openssl/err.h>
-# include <openssl/bn.h>
-# include <openssl/ec.h>
-# include <openssl/x509.h>
-# include <openssl/pem.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <time.h>
+#include <string.h>
+#include "apps.h"
+#include "progs.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/bn.h>
+#include <openssl/ec.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
 
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT, OPT_C,
     OPT_CHECK, OPT_LIST_CURVES, OPT_NO_SEED, OPT_NOOUT, OPT_NAME,
-    OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE,
-    OPT_R_ENUM
+    OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE, OPT_CHECK_NAMED,
+    OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS ecparam_options[] = {
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-    {"inform", OPT_INFORM, 'F', "Input format - default PEM (DER or PEM)"},
-    {"outform", OPT_OUTFORM, 'F', "Output format - default PEM"},
-    {"in", OPT_IN, '<', "Input file  - default stdin"},
-    {"out", OPT_OUT, '>', "Output file - default stdout"},
-    {"text", OPT_TEXT, '-', "Print the ec parameters in text form"},
-    {"C", OPT_C, '-', "Print a 'C' function creating the parameters"},
-    {"check", OPT_CHECK, '-', "Validate the ec parameters"},
     {"list_curves", OPT_LIST_CURVES, '-',
      "Prints a list of all curve 'short names'"},
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+#endif
+
+    {"genkey", OPT_GENKEY, '-', "Generate ec key"},
+    {"in", OPT_IN, '<', "Input file  - default stdin"},
+    {"inform", OPT_INFORM, 'F', "Input format - default PEM (DER or PEM)"},
+    {"out", OPT_OUT, '>', "Output file - default stdout"},
+    {"outform", OPT_OUTFORM, 'F', "Output format - default PEM"},
+
+    OPT_SECTION("Output"),
+    {"text", OPT_TEXT, '-', "Print the ec parameters in text form"},
+    {"C", OPT_C, '-', "Print a 'C' function creating the parameters"},
+    {"noout", OPT_NOOUT, '-', "Do not print the ec parameter"},
+    {"param_enc", OPT_PARAM_ENC, 's',
+     "Specifies the way the ec parameters are encoded"},
+
+    OPT_SECTION("Parameter"),
+    {"check", OPT_CHECK, '-', "Validate the ec parameters"},
+    {"check_named", OPT_CHECK_NAMED, '-',
+     "Check that named EC curve parameters have not been modified"},
     {"no_seed", OPT_NO_SEED, '-',
      "If 'explicit' parameters are chosen do not use the seed"},
-    {"noout", OPT_NOOUT, '-', "Do not print the ec parameter"},
     {"name", OPT_NAME, 's',
      "Use the ec parameters with specified 'short name'"},
     {"conv_form", OPT_CONV_FORM, 's', "Specifies the point conversion form "},
-    {"param_enc", OPT_PARAM_ENC, 's',
-     "Specifies the way the ec parameters are encoded"},
-    {"genkey", OPT_GENKEY, '-', "Generate ec key"},
+
     OPT_R_OPTIONS,
-# ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-# endif
+    OPT_PROV_OPTIONS,
     {NULL}
 };
 
@@ -90,7 +97,7 @@ int ecparam_main(int argc, char **argv)
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, noout = 0, C = 0;
     int ret = 1, private = 0;
     int list_curves = 0, no_seed = 0, check = 0, new_form = 0;
-    int text = 0, i, genkey = 0;
+    int text = 0, i, genkey = 0, check_named = 0;
 
     prog = opt_init(argc, argv, ecparam_options);
     while ((o = opt_next()) != OPT_EOF) {
@@ -127,6 +134,9 @@ int ecparam_main(int argc, char **argv)
         case OPT_CHECK:
             check = 1;
             break;
+        case OPT_CHECK_NAMED:
+            check_named = 1;
+            break;
         case OPT_LIST_CURVES:
             list_curves = 1;
             break;
@@ -157,6 +167,10 @@ int ecparam_main(int argc, char **argv)
             if (!opt_rand(o))
                 goto end;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         case OPT_ENGINE:
             e = setup_engine(opt_arg(), 0);
             break;
@@ -266,6 +280,16 @@ int ecparam_main(int argc, char **argv)
             goto end;
     }
 
+    if (check_named) {
+        BIO_printf(bio_err, "validating named elliptic curve parameters: ");
+        if (EC_GROUP_check_named_curve(group, 0, NULL) <= 0) {
+            BIO_printf(bio_err, "failed\n");
+            ERR_print_errors(bio_err);
+            goto end;
+        }
+        BIO_printf(bio_err, "ok\n");
+    }
+
     if (check) {
         BIO_printf(bio_err, "checking elliptic curve parameters: ");
         if (!EC_GROUP_check(group, NULL)) {
@@ -281,7 +305,6 @@ int ecparam_main(int argc, char **argv)
         size_t buf_len = 0, tmp_len = 0;
         const EC_POINT *point;
         int is_prime, len = 0;
-        const EC_METHOD *meth = EC_GROUP_method_of(group);
 
         if ((ec_p = BN_new()) == NULL
                 || (ec_a = BN_new()) == NULL
@@ -293,7 +316,7 @@ int ecparam_main(int argc, char **argv)
             goto end;
         }
 
-        is_prime = (EC_METHOD_get_field_type(meth) == NID_X9_62_prime_field);
+        is_prime = (EC_GROUP_get_field_type(group) == NID_X9_62_prime_field);
         if (!is_prime) {
             BIO_printf(bio_err, "Can only handle X9.62 prime fields\n");
             goto end;
@@ -446,5 +469,3 @@ int ecparam_main(int argc, char **argv)
     BIO_free_all(out);
     return ret;
 }
-
-#endif

apps/enc.c

@@ -1,7 +1,7 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -45,31 +45,45 @@ typedef enum OPTION_choice {
     OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A,
     OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE,
     OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER,
-    OPT_R_ENUM
+    OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS enc_options[] = {
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-    {"ciphers", OPT_LIST, '-', "List ciphers"},
-    {"in", OPT_IN, '<', "Input file"},
-    {"out", OPT_OUT, '>', "Output file"},
-    {"pass", OPT_PASS, 's', "Passphrase source"},
+    {"list", OPT_LIST, '-', "List ciphers"},
+#ifndef OPENSSL_NO_DEPRECATED_3_0
+    {"ciphers", OPT_LIST, '-', "Alias for -list"},
+#endif
     {"e", OPT_E, '-', "Encrypt"},
     {"d", OPT_D, '-', "Decrypt"},
     {"p", OPT_P, '-', "Print the iv/key"},
     {"P", OPT_UPPER_P, '-', "Print the iv/key and exit"},
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+#endif
+
+    OPT_SECTION("Input"),
+    {"in", OPT_IN, '<', "Input file"},
+    {"k", OPT_K, 's', "Passphrase"},
+    {"kfile", OPT_KFILE, '<', "Read passphrase from file"},
+
+    OPT_SECTION("Output"),
+    {"out", OPT_OUT, '>', "Output file"},
+    {"pass", OPT_PASS, 's', "Passphrase source"},
     {"v", OPT_V, '-', "Verbose output"},
-    {"nopad", OPT_NOPAD, '-', "Disable standard block padding"},
-    {"salt", OPT_SALT, '-', "Use salt in the KDF (default)"},
-    {"nosalt", OPT_NOSALT, '-', "Do not use salt in the KDF"},
-    {"debug", OPT_DEBUG, '-', "Print debug info"},
     {"a", OPT_A, '-', "Base64 encode/decode, depending on encryption flag"},
     {"base64", OPT_A, '-', "Same as option -a"},
     {"A", OPT_UPPER_A, '-',
      "Used with -[base64|a] to specify base64 buffer as a single line"},
+
+    OPT_SECTION("Encryption"),
+    {"nopad", OPT_NOPAD, '-', "Disable standard block padding"},
+    {"salt", OPT_SALT, '-', "Use salt in the KDF (default)"},
+    {"nosalt", OPT_NOSALT, '-', "Do not use salt in the KDF"},
+    {"debug", OPT_DEBUG, '-', "Print debug info"},
+
     {"bufsize", OPT_BUFSIZE, 's', "Buffer size"},
-    {"k", OPT_K, 's', "Passphrase"},
-    {"kfile", OPT_KFILE, '<', "Read passphrase from file"},
     {"K", OPT_UPPER_K, 's', "Raw key, in hex"},
     {"S", OPT_UPPER_S, 's', "Salt, in hex"},
     {"iv", OPT_IV, 's', "IV in hex"},
@@ -77,14 +91,13 @@ const OPTIONS enc_options[] = {
     {"iter", OPT_ITER, 'p', "Specify the iteration count and force use of PBKDF2"},
     {"pbkdf2", OPT_PBKDF2, '-', "Use password-based key derivation function 2"},
     {"none", OPT_NONE, '-', "Don't encrypt"},
-    {"", OPT_CIPHER, '-', "Any supported cipher"},
-    OPT_R_OPTIONS,
 #ifdef ZLIB
     {"z", OPT_Z, '-', "Use zlib as the 'encryption'"},
 #endif
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
+    {"", OPT_CIPHER, '-', "Any supported cipher"},
+
+    OPT_R_OPTIONS,
+    OPT_PROV_OPTIONS,
     {NULL}
 };
 
@@ -276,6 +289,10 @@ int enc_main(int argc, char **argv)
             if (!opt_rand(o))
                 goto end;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         }
     }
     if (opt_num_rest() != 0) {
@@ -500,7 +517,7 @@ int enc_main(int argc, char **argv)
         if (hiv != NULL) {
             int siz = EVP_CIPHER_iv_length(cipher);
             if (siz == 0) {
-                BIO_printf(bio_err, "warning: iv not use by this cipher\n");
+                BIO_printf(bio_err, "warning: iv not used by this cipher\n");
             } else if (!set_hex(hiv, iv, siz)) {
                 BIO_printf(bio_err, "invalid hex iv value\n");
                 goto end;
@@ -521,7 +538,7 @@ int enc_main(int argc, char **argv)
                 goto end;
             }
             /* wiping secret data as we no longer need it */
-            OPENSSL_cleanse(hkey, strlen(hkey));
+            cleanse(hkey);
         }
 
         if ((benc = BIO_new(BIO_f_cipher())) == NULL)
@@ -586,7 +603,7 @@ int enc_main(int argc, char **argv)
     if (benc != NULL)
         wbio = BIO_push(benc, wbio);
 
-    for (;;) {
+    while (BIO_pending(rbio) || !BIO_eof(rbio)) {
         inl = BIO_read(rbio, (char *)buff, bsize);
         if (inl <= 0)
             break;

apps/engine.c

@@ -1,26 +1,26 @@
 /*
- * Copyright 2000-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2000-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
  */
 
 #include <openssl/opensslconf.h>
-#ifdef OPENSSL_NO_ENGINE
-NON_EMPTY_TRANSLATION_UNIT
-#else
 
-# include "apps.h"
-# include "progs.h"
-# include <stdio.h>
-# include <stdlib.h>
-# include <string.h>
-# include <openssl/err.h>
-# include <openssl/engine.h>
-# include <openssl/ssl.h>
-# include <openssl/store.h>
+#include "apps.h"
+#include "progs.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <openssl/err.h>
+#include <openssl/engine.h>
+#include <openssl/ssl.h>
+#include <openssl/store.h>
+
+DEFINE_STACK_OF_STRING()
+DEFINE_STACK_OF_CSTRING()
 
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
@@ -30,20 +30,25 @@ typedef enum OPTION_choice {
 
 const OPTIONS engine_options[] = {
     {OPT_HELP_STR, 1, '-', "Usage: %s [options] engine...\n"},
-    {OPT_HELP_STR, 1, '-',
-        "  engine... Engines to load\n"},
+
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
+    {"t", OPT_T, '-', "Check that specified engine is available"},
+    {"pre", OPT_PRE, 's', "Run command against the ENGINE before loading it"},
+    {"post", OPT_POST, 's', "Run command against the ENGINE after loading it"},
+
+    OPT_SECTION("Output"),
     {"v", OPT_V, '-', "List 'control commands' For each specified engine"},
     {"vv", OPT_VV, '-', "Also display each command's description"},
     {"vvv", OPT_VVV, '-', "Also add the input flags for each command"},
     {"vvvv", OPT_VVVV, '-', "Also show internal input flags"},
     {"c", OPT_C, '-', "List the capabilities of specified engine"},
-    {"t", OPT_T, '-', "Check that specified engine is available"},
     {"tt", OPT_TT, '-', "Display error trace for unavailable engines"},
-    {"pre", OPT_PRE, 's', "Run command against the ENGINE before loading it"},
-    {"post", OPT_POST, 's', "Run command against the ENGINE after loading it"},
     {OPT_MORE_STR, OPT_EOF, 1,
      "Commands are like \"SO_PATH:/lib/libdriver.so\""},
+
+    OPT_PARAMETERS(),
+    {"engine", 0, 0, "ID of engine(s) to load"},
     {NULL}
 };
 
@@ -486,4 +491,3 @@ int engine_main(int argc, char **argv)
     BIO_free_all(out);
     return ret;
 }
-#endif

apps/errstr.c

@@ -1,7 +1,7 @@
 /*
  * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -22,8 +22,12 @@ typedef enum OPTION_choice {
 
 const OPTIONS errstr_options[] = {
     {OPT_HELP_STR, 1, '-', "Usage: %s [options] errnum...\n"},
-    {OPT_HELP_STR, 1, '-', "  errnum  Error number\n"},
+
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
+
+    OPT_PARAMETERS(),
+    {"errnum", 0, 0, "Error number(s) to decode"},
     {NULL}
 };
 

apps/fipsinstall.c

@@ -0,0 +1,508 @@
+/*
+ * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <string.h>
+#include <openssl/evp.h>
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#include <openssl/params.h>
+#include <openssl/fips_names.h>
+#include <openssl/core_names.h>
+#include <openssl/self_test.h>
+#include "apps.h"
+#include "progs.h"
+
+DEFINE_STACK_OF_STRING()
+
+#define BUFSIZE 4096
+#define DEFAULT_MAC_NAME "HMAC"
+#define DEFAULT_FIPS_SECTION "fips_check_section"
+
+/* Configuration file values */
+#define VERSION_KEY  "version"
+#define VERSION_VAL  "1"
+#define INSTALL_STATUS_VAL "INSTALL_SELF_TEST_KATS_RUN"
+
+static OSSL_CALLBACK self_test_events;
+static char *self_test_corrupt_desc = NULL;
+static char *self_test_corrupt_type = NULL;
+static int self_test_log = 1;
+static int quiet = 0;
+
+typedef enum OPTION_choice {
+    OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
+    OPT_IN, OPT_OUT, OPT_MODULE,
+    OPT_PROV_NAME, OPT_SECTION_NAME, OPT_MAC_NAME, OPT_MACOPT, OPT_VERIFY,
+    OPT_NO_LOG, OPT_CORRUPT_DESC, OPT_CORRUPT_TYPE, OPT_QUIET
+} OPTION_CHOICE;
+
+const OPTIONS fipsinstall_options[] = {
+    OPT_SECTION("General"),
+    {"help", OPT_HELP, '-', "Display this summary"},
+    {"verify", OPT_VERIFY, '-',
+        "Verify a config file instead of generating one"},
+    {"module", OPT_MODULE, '<', "File name of the provider module"},
+    {"provider_name", OPT_PROV_NAME, 's', "FIPS provider name"},
+    {"section_name", OPT_SECTION_NAME, 's',
+     "FIPS Provider config section name (optional)"},
+
+    OPT_SECTION("Input"),
+    {"in", OPT_IN, '<', "Input config file, used when verifying"},
+
+    OPT_SECTION("Output"),
+    {"out", OPT_OUT, '>', "Output config file, used when generating"},
+    {"mac_name", OPT_MAC_NAME, 's', "MAC name"},
+    {"macopt", OPT_MACOPT, 's', "MAC algorithm parameters in n:v form. "
+                                "See 'PARAMETER NAMES' in the EVP_MAC_ docs"},
+    {"noout", OPT_NO_LOG, '-', "Disable logging of self test events"},
+    {"corrupt_desc", OPT_CORRUPT_DESC, 's', "Corrupt a self test by description"},
+    {"corrupt_type", OPT_CORRUPT_TYPE, 's', "Corrupt a self test by type"},
+    {"quiet", OPT_QUIET, '-', "No messages, just exit status"},
+    {NULL}
+};
+
+static int do_mac(EVP_MAC_CTX *ctx, unsigned char *tmp, BIO *in,
+                  unsigned char *out, size_t *out_len)
+{
+    int ret = 0;
+    int i;
+    size_t outsz = *out_len;
+
+    if (!EVP_MAC_init(ctx))
+        goto err;
+    if (EVP_MAC_size(ctx) > outsz)
+        goto end;
+    while ((i = BIO_read(in, (char *)tmp, BUFSIZE)) != 0) {
+        if (i < 0 || !EVP_MAC_update(ctx, tmp, i))
+            goto err;
+    }
+end:
+    if (!EVP_MAC_final(ctx, out, out_len, outsz))
+        goto err;
+    ret = 1;
+err:
+    return ret;
+}
+
+static int load_fips_prov_and_run_self_test(const char *prov_name)
+{
+    int ret = 0;
+    OSSL_PROVIDER *prov = NULL;
+
+    prov = OSSL_PROVIDER_load(NULL, prov_name);
+    if (prov == NULL) {
+        BIO_printf(bio_err, "Failed to load FIPS module\n");
+        goto end;
+    }
+    ret = 1;
+end:
+    OSSL_PROVIDER_unload(prov);
+    return ret;
+}
+
+static int print_mac(BIO *bio, const char *label, const unsigned char *mac,
+                     size_t len)
+{
+    int ret;
+    char *hexstr = NULL;
+
+    hexstr = OPENSSL_buf2hexstr(mac, (long)len);
+    if (hexstr == NULL)
+        return 0;
+    ret = BIO_printf(bio, "%s = %s\n", label, hexstr);
+    OPENSSL_free(hexstr);
+    return ret;
+}
+
+static int write_config_header(BIO *out, const char *prov_name,
+                               const char *section)
+{
+    return BIO_printf(out, "openssl_conf = openssl_init\n\n")
+           && BIO_printf(out, "[openssl_init]\n")
+           && BIO_printf(out, "providers = provider_section\n\n")
+           && BIO_printf(out, "[provider_section]\n")
+           && BIO_printf(out, "%s = %s\n\n", prov_name, section);
+}
+
+/*
+ * Outputs a fips related config file that contains entries for the fips
+ * module checksum and the installation indicator checksum.
+ *
+ * Returns 1 if the config file is written otherwise it returns 0 on error.
+ */
+static int write_config_fips_section(BIO *out, const char *section,
+                                     unsigned char *module_mac,
+                                     size_t module_mac_len,
+                                     unsigned char *install_mac,
+                                     size_t install_mac_len)
+{
+    int ret = 0;
+
+    if (!(BIO_printf(out, "[%s]\n", section) > 0
+          && BIO_printf(out, "activate = 1\n") > 0
+          && BIO_printf(out, "%s = %s\n", OSSL_PROV_FIPS_PARAM_INSTALL_VERSION,
+                        VERSION_VAL) > 0
+          && print_mac(out, OSSL_PROV_FIPS_PARAM_MODULE_MAC, module_mac,
+                       module_mac_len)))
+        goto end;
+
+    if (install_mac != NULL) {
+        if (!(print_mac(out, OSSL_PROV_FIPS_PARAM_INSTALL_MAC, install_mac,
+                      install_mac_len)
+              && BIO_printf(out, "%s = %s\n",
+                            OSSL_PROV_FIPS_PARAM_INSTALL_STATUS,
+                            INSTALL_STATUS_VAL) > 0))
+        goto end;
+    }
+    ret = 1;
+end:
+    return ret;
+}
+
+static CONF *generate_config_and_load(const char *prov_name,
+                                      const char *section,
+                                      unsigned char *module_mac,
+                                      size_t module_mac_len)
+{
+    BIO *mem_bio = NULL;
+    CONF *conf = NULL;
+
+    mem_bio = BIO_new(BIO_s_mem());
+    if (mem_bio  == NULL)
+        return 0;
+    if (!write_config_header(mem_bio, prov_name, section)
+         || !write_config_fips_section(mem_bio, section, module_mac,
+                                       module_mac_len, NULL, 0))
+        goto end;
+
+    conf = app_load_config_bio(mem_bio, NULL);
+    if (conf == NULL)
+        goto end;
+
+    if (CONF_modules_load(conf, NULL, 0) <= 0)
+        goto end;
+    BIO_free(mem_bio);
+    return conf;
+end:
+    NCONF_free(conf);
+    BIO_free(mem_bio);
+    return NULL;
+}
+
+static void free_config_and_unload(CONF *conf)
+{
+    if (conf != NULL) {
+        NCONF_free(conf);
+        CONF_modules_unload(1);
+    }
+}
+
+/*
+ * Returns 1 if the config file entries match the passed in module_mac and
+ * install_mac values, otherwise it returns 0.
+ */
+static int verify_config(const char *infile, const char *section,
+                         unsigned char *module_mac, size_t module_mac_len,
+                         unsigned char *install_mac, size_t install_mac_len)
+{
+    int ret = 0;
+    char *s = NULL;
+    unsigned char *buf1 = NULL, *buf2 = NULL;
+    long len;
+    CONF *conf = NULL;
+
+    /* read in the existing values and check they match the saved values */
+    conf = app_load_config(infile);
+    if (conf == NULL)
+        goto end;
+
+    s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_VERSION);
+    if (s == NULL || strcmp(s, VERSION_VAL) != 0) {
+        BIO_printf(bio_err, "version not found\n");
+        goto end;
+    }
+    s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_STATUS);
+    if (s == NULL || strcmp(s, INSTALL_STATUS_VAL) != 0) {
+        BIO_printf(bio_err, "install status not found\n");
+        goto end;
+    }
+    s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_MODULE_MAC);
+    if (s == NULL) {
+        BIO_printf(bio_err, "Module integrity MAC not found\n");
+        goto end;
+    }
+    buf1 = OPENSSL_hexstr2buf(s, &len);
+    if (buf1 == NULL
+            || (size_t)len != module_mac_len
+            || memcmp(module_mac, buf1, module_mac_len) != 0) {
+        BIO_printf(bio_err, "Module integrity mismatch\n");
+        goto end;
+    }
+    s = NCONF_get_string(conf, section, OSSL_PROV_FIPS_PARAM_INSTALL_MAC);
+    if (s == NULL) {
+        BIO_printf(bio_err, "Install indicator MAC not found\n");
+        goto end;
+    }
+    buf2 = OPENSSL_hexstr2buf(s, &len);
+    if (buf2 == NULL
+            || (size_t)len != install_mac_len
+            || memcmp(install_mac, buf2, install_mac_len) != 0) {
+        BIO_printf(bio_err, "Install indicator status mismatch\n");
+        goto end;
+    }
+    ret = 1;
+end:
+    OPENSSL_free(buf1);
+    OPENSSL_free(buf2);
+    NCONF_free(conf);
+    return ret;
+}
+
+int fipsinstall_main(int argc, char **argv)
+{
+    int ret = 1, verify = 0;
+    BIO *module_bio = NULL, *mem_bio = NULL, *fout = NULL;
+    char *in_fname = NULL, *out_fname = NULL, *prog, *section_name = NULL;
+    char *prov_name = NULL, *module_fname = NULL;
+    static const char *mac_name = DEFAULT_MAC_NAME;
+    EVP_MAC_CTX *ctx = NULL, *ctx2 = NULL;
+    STACK_OF(OPENSSL_STRING) *opts = NULL;
+    OPTION_CHOICE o;
+    unsigned char *read_buffer = NULL;
+    unsigned char module_mac[EVP_MAX_MD_SIZE];
+    size_t module_mac_len = EVP_MAX_MD_SIZE;
+    unsigned char install_mac[EVP_MAX_MD_SIZE];
+    size_t install_mac_len = EVP_MAX_MD_SIZE;
+    EVP_MAC *mac = NULL;
+    CONF *conf = NULL;
+
+    section_name = DEFAULT_FIPS_SECTION;
+
+    prog = opt_init(argc, argv, fipsinstall_options);
+    while ((o = opt_next()) != OPT_EOF) {
+        switch (o) {
+        case OPT_EOF:
+        case OPT_ERR:
+opthelp:
+            BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
+            goto cleanup;
+        case OPT_HELP:
+            opt_help(fipsinstall_options);
+            ret = 0;
+            goto end;
+        case OPT_IN:
+            in_fname = opt_arg();
+            break;
+        case OPT_OUT:
+            out_fname = opt_arg();
+            break;
+        case OPT_QUIET:
+            quiet = 1;
+            /* FALLTHROUGH */
+        case OPT_NO_LOG:
+            self_test_log = 0;
+            break;
+        case OPT_CORRUPT_DESC:
+            self_test_corrupt_desc = opt_arg();
+            break;
+        case OPT_CORRUPT_TYPE:
+            self_test_corrupt_type = opt_arg();
+            break;
+        case OPT_PROV_NAME:
+            prov_name = opt_arg();
+            break;
+        case OPT_MODULE:
+            module_fname = opt_arg();
+            break;
+        case OPT_SECTION_NAME:
+            section_name = opt_arg();
+            break;
+        case OPT_MAC_NAME:
+            mac_name = opt_arg();
+            break;
+        case OPT_MACOPT:
+            if (opts == NULL)
+                opts = sk_OPENSSL_STRING_new_null();
+            if (opts == NULL || !sk_OPENSSL_STRING_push(opts, opt_arg()))
+                goto opthelp;
+            break;
+        case OPT_VERIFY:
+            verify = 1;
+            break;
+        }
+    }
+    argc = opt_num_rest();
+    if (module_fname == NULL
+        || (verify && in_fname == NULL)
+        || (!verify && (out_fname == NULL || prov_name == NULL))
+        || opts == NULL
+        || argc != 0)
+        goto opthelp;
+
+    if (self_test_log
+            || self_test_corrupt_desc != NULL
+            || self_test_corrupt_type != NULL)
+        OSSL_SELF_TEST_set_callback(NULL, self_test_events, NULL);
+
+    module_bio = bio_open_default(module_fname, 'r', FORMAT_BINARY);
+    if (module_bio == NULL) {
+        BIO_printf(bio_err, "Failed to open module file\n");
+        goto end;
+    }
+
+    read_buffer = app_malloc(BUFSIZE, "I/O buffer");
+    if (read_buffer == NULL)
+        goto end;
+
+    mac = EVP_MAC_fetch(NULL, mac_name, NULL);
+    if (mac == NULL) {
+        BIO_printf(bio_err, "Unable to get MAC of type %s\n", mac_name);
+        goto end;
+    }
+
+    ctx = EVP_MAC_new_ctx(mac);
+    if (ctx == NULL) {
+        BIO_printf(bio_err, "Unable to create MAC CTX for module check\n");
+        goto end;
+    }
+
+    if (opts != NULL) {
+        int ok = 1;
+        OSSL_PARAM *params =
+            app_params_new_from_opts(opts, EVP_MAC_settable_ctx_params(mac));
+
+        if (params == NULL)
+            goto end;
+
+        if (!EVP_MAC_set_ctx_params(ctx, params)) {
+            BIO_printf(bio_err, "MAC parameter error\n");
+            ERR_print_errors(bio_err);
+            ok = 0;
+        }
+        app_params_free(params);
+        if (!ok)
+            goto end;
+    }
+
+    ctx2 = EVP_MAC_dup_ctx(ctx);
+    if (ctx2 == NULL) {
+        BIO_printf(bio_err, "Unable to create MAC CTX for install indicator\n");
+        goto end;
+    }
+
+    if (!do_mac(ctx, read_buffer, module_bio, module_mac, &module_mac_len))
+        goto end;
+
+    mem_bio = BIO_new_mem_buf((const void *)INSTALL_STATUS_VAL,
+                              strlen(INSTALL_STATUS_VAL));
+    if (mem_bio == NULL) {
+        BIO_printf(bio_err, "Unable to create memory BIO\n");
+        goto end;
+    }
+    if (!do_mac(ctx2, read_buffer, mem_bio, install_mac, &install_mac_len))
+        goto end;
+
+    if (verify) {
+        if (!verify_config(in_fname, section_name, module_mac, module_mac_len,
+                           install_mac, install_mac_len))
+            goto end;
+        if (!quiet)
+            BIO_printf(bio_out, "VERIFY PASSED\n");
+    } else {
+
+        conf = generate_config_and_load(prov_name, section_name, module_mac,
+                                        module_mac_len);
+        if (conf == NULL)
+            goto end;
+        if (!load_fips_prov_and_run_self_test(prov_name))
+            goto end;
+
+        fout = bio_open_default(out_fname, 'w', FORMAT_TEXT);
+        if (fout == NULL) {
+            BIO_printf(bio_err, "Failed to open file\n");
+            goto end;
+        }
+        if (!write_config_fips_section(fout, section_name, module_mac,
+                                       module_mac_len, install_mac,
+                                       install_mac_len))
+            goto end;
+        if (!quiet)
+            BIO_printf(bio_out, "INSTALL PASSED\n");
+    }
+
+    ret = 0;
+end:
+    if (ret == 1) {
+        if (!quiet)
+            BIO_printf(bio_err, "%s FAILED\n", verify ? "VERIFY" : "INSTALL");
+        ERR_print_errors(bio_err);
+    }
+
+cleanup:
+    BIO_free(fout);
+    BIO_free(mem_bio);
+    BIO_free(module_bio);
+    sk_OPENSSL_STRING_free(opts);
+    EVP_MAC_free(mac);
+    EVP_MAC_free_ctx(ctx2);
+    EVP_MAC_free_ctx(ctx);
+    OPENSSL_free(read_buffer);
+    free_config_and_unload(conf);
+    return ret;
+}
+
+static int self_test_events(const OSSL_PARAM params[], void *arg)
+{
+    const OSSL_PARAM *p = NULL;
+    const char *phase = NULL, *type = NULL, *desc = NULL;
+    int ret = 0;
+
+    p = OSSL_PARAM_locate_const(params, OSSL_PROV_PARAM_SELF_TEST_PHASE);
+    if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING)
+        goto err;
+    phase = (const char *)p->data;
+
+    p = OSSL_PARAM_locate_const(params, OSSL_PROV_PARAM_SELF_TEST_DESC);
+    if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING)
+        goto err;
+    desc = (const char *)p->data;
+
+    p = OSSL_PARAM_locate_const(params, OSSL_PROV_PARAM_SELF_TEST_TYPE);
+    if (p == NULL || p->data_type != OSSL_PARAM_UTF8_STRING)
+        goto err;
+    type = (const char *)p->data;
+
+    if (self_test_log) {
+        if (strcmp(phase, OSSL_SELF_TEST_PHASE_START) == 0)
+            BIO_printf(bio_out, "%s : (%s) : ", desc, type);
+        else if (strcmp(phase, OSSL_SELF_TEST_PHASE_PASS) == 0
+                 || strcmp(phase, OSSL_SELF_TEST_PHASE_FAIL) == 0)
+            BIO_printf(bio_out, "%s\n", phase);
+    }
+    /*
+     * The self test code will internally corrupt the KAT test result if an
+     * error is returned during the corrupt phase.
+     */
+    if (strcmp(phase, OSSL_SELF_TEST_PHASE_CORRUPT) == 0
+            && (self_test_corrupt_desc != NULL
+                || self_test_corrupt_type != NULL)) {
+        if (self_test_corrupt_desc != NULL
+                && strcmp(self_test_corrupt_desc, desc) != 0)
+            goto end;
+        if (self_test_corrupt_type != NULL
+                && strcmp(self_test_corrupt_type, type) != 0)
+            goto end;
+        BIO_printf(bio_out, "%s ", phase);
+        goto err;
+    }
+end:
+    ret = 1;
+err:
+    return ret;
+}

apps/gendsa.c

@@ -1,47 +1,52 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
  */
 
 #include <openssl/opensslconf.h>
-#ifdef OPENSSL_NO_DSA
-NON_EMPTY_TRANSLATION_UNIT
-#else
 
-# include <stdio.h>
-# include <string.h>
-# include <sys/types.h>
-# include <sys/stat.h>
-# include "apps.h"
-# include "progs.h"
-# include <openssl/bio.h>
-# include <openssl/err.h>
-# include <openssl/bn.h>
-# include <openssl/dsa.h>
-# include <openssl/x509.h>
-# include <openssl/pem.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include "apps.h"
+#include "progs.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/bn.h>
+#include <openssl/dsa.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
 
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
-    OPT_OUT, OPT_PASSOUT, OPT_ENGINE, OPT_CIPHER,
-    OPT_R_ENUM
+    OPT_OUT, OPT_PASSOUT, OPT_ENGINE, OPT_CIPHER, OPT_VERBOSE,
+    OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS gendsa_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [args] dsaparam-file\n"},
-    {OPT_HELP_STR, 1, '-', "Valid options are:\n"},
+    {OPT_HELP_STR, 1, '-', "Usage: %s [options] dsaparam-file\n"},
+
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+#endif
+
+    OPT_SECTION("Output"),
     {"out", OPT_OUT, '>', "Output the key to the specified file"},
     {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
     OPT_R_OPTIONS,
+    OPT_PROV_OPTIONS,
     {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
-# ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-# endif
+    {"verbose", OPT_VERBOSE, '-', "Verbose output"},
+
+    OPT_PARAMETERS(),
+    {"dsaparam-file", 0, 0, "File containing DSA parameters"},
     {NULL}
 };
 
@@ -50,11 +55,13 @@ int gendsa_main(int argc, char **argv)
     ENGINE *e = NULL;
     BIO *out = NULL, *in = NULL;
     DSA *dsa = NULL;
+    EVP_PKEY *pkey = NULL;
+    EVP_PKEY_CTX *ctx = NULL;
     const EVP_CIPHER *enc = NULL;
     char *dsaparams = NULL;
     char *outfile = NULL, *passoutarg = NULL, *passout = NULL, *prog;
     OPTION_CHOICE o;
-    int ret = 1, private = 0;
+    int ret = 1, private = 0, verbose = 0;
     const BIGNUM *p = NULL;
 
     prog = opt_init(argc, argv, gendsa_options);
@@ -82,10 +89,17 @@ int gendsa_main(int argc, char **argv)
             if (!opt_rand(o))
                 goto end;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         case OPT_CIPHER:
             if (!opt_cipher(opt_unknown(), &enc))
                 goto end;
             break;
+        case OPT_VERBOSE:
+            verbose = 1;
+            break;
         }
     }
     argc = opt_num_rest();
@@ -124,13 +138,38 @@ int gendsa_main(int argc, char **argv)
                    "         Your key size is %d! Larger key size may behave not as expected.\n",
                    OPENSSL_DSA_MAX_MODULUS_BITS, BN_num_bits(p));
 
-    BIO_printf(bio_err, "Generating DSA key, %d bits\n", BN_num_bits(p));
-    if (!DSA_generate_key(dsa))
+    pkey = EVP_PKEY_new();
+    if (pkey == NULL) {
+        BIO_printf(bio_err, "unable to allocate PKEY\n");
         goto end;
+    }
+    if (!EVP_PKEY_set1_DSA(pkey, dsa)) {
+        BIO_printf(bio_err, "unable to associate DSA parameters with PKEY\n");
+        goto end;
+    }
+    ctx = EVP_PKEY_CTX_new(pkey, NULL);
+    if (ctx == NULL) {
+        BIO_printf(bio_err, "unable to create PKEY context\n");
+        goto end;
+    }
+    EVP_PKEY_free(pkey);
+    pkey = NULL;
+    if (EVP_PKEY_keygen_init(ctx) <= 0) {
+        BIO_printf(bio_err, "unable to set up for key generation\n");
+        goto end;
+    }
+    if (verbose)
+        BIO_printf(bio_err, "Generating DSA key, %d bits\n", BN_num_bits(p));
+    if (EVP_PKEY_keygen(ctx, &pkey) <= 0) {
+        BIO_printf(bio_err, "unable to generate key\n");
+        goto end;
+    }
 
     assert(private);
-    if (!PEM_write_bio_DSAPrivateKey(out, dsa, enc, NULL, 0, NULL, passout))
+    if (!PEM_write_bio_PrivateKey(out, pkey, enc, NULL, 0, NULL, passout)) {
+        BIO_printf(bio_err, "unable to output generated key\n");
         goto end;
+    }
     ret = 0;
  end:
     if (ret != 0)
@@ -139,8 +178,9 @@ int gendsa_main(int argc, char **argv)
     BIO_free(in);
     BIO_free_all(out);
     DSA_free(dsa);
+    EVP_PKEY_free(pkey);
+    EVP_PKEY_CTX_free(ctx);
     release_engine(e);
     OPENSSL_free(passout);
     return ret;
 }
-#endif

apps/genpkey.c

@@ -1,7 +1,7 @@
 /*
- * Copyright 2006-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2006-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
@@ -24,24 +24,31 @@ static int genpkey_cb(EVP_PKEY_CTX *ctx);
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
     OPT_ENGINE, OPT_OUTFORM, OPT_OUT, OPT_PASS, OPT_PARAMFILE,
-    OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER
+    OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER,
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS genpkey_options[] = {
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-    {"out", OPT_OUT, '>', "Output file"},
-    {"outform", OPT_OUTFORM, 'F', "output format (DER or PEM)"},
-    {"pass", OPT_PASS, 's', "Output file pass phrase source"},
+#ifndef OPENSSL_NO_ENGINE
+    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
+#endif
     {"paramfile", OPT_PARAMFILE, '<', "Parameters file"},
     {"algorithm", OPT_ALGORITHM, 's', "The public key algorithm"},
     {"pkeyopt", OPT_PKEYOPT, 's',
      "Set the public key algorithm option as opt:value"},
+
+    OPT_SECTION("Output"),
+    {"out", OPT_OUT, '>', "Output file"},
+    {"outform", OPT_OUTFORM, 'F', "output format (DER or PEM)"},
+    {"pass", OPT_PASS, 's', "Output file pass phrase source"},
     {"genparam", OPT_GENPARAM, '-', "Generate parameters, not key"},
     {"text", OPT_TEXT, '-', "Print the in text"},
     {"", OPT_CIPHER, '-', "Cipher to use to encrypt the key"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
+
+    OPT_PROV_OPTIONS,
+
     /* This is deliberately last. */
     {OPT_HELP_STR, 1, 1,
      "Order of options may be important!  See the documentation.\n"},
@@ -127,6 +134,11 @@ int genpkey_main(int argc, char **argv)
                 BIO_printf(bio_err, "%s: cipher mode not supported\n", prog);
                 goto end;
             }
+            break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         }
     }
     argc = opt_num_rest();
@@ -217,7 +229,7 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e)
     }
 
     pbio = BIO_new_file(file, "r");
-    if (!pbio) {
+    if (pbio == NULL) {
         BIO_printf(bio_err, "Can't open parameter file %s\n", file);
         return 0;
     }
@@ -225,7 +237,7 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e)
     pkey = PEM_read_bio_Parameters(pbio, NULL);
     BIO_free(pbio);
 
-    if (!pkey) {
+    if (pkey == NULL) {
         BIO_printf(bio_err, "Error reading parameter file %s\n", file);
         return 0;
     }

apps/genrsa.c

@@ -1,57 +1,74 @@
 /*
- * Copyright 1995-2018 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
  *
- * Licensed under the OpenSSL license (the "License").  You may not use
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
  * in the file LICENSE in the source distribution or at
  * https://www.openssl.org/source/license.html
  */
 
 #include <openssl/opensslconf.h>
-#ifdef OPENSSL_NO_RSA
-NON_EMPTY_TRANSLATION_UNIT
-#else
 
-# include <stdio.h>
-# include <string.h>
-# include <sys/types.h>
-# include <sys/stat.h>
-# include "apps.h"
-# include "progs.h"
-# include <openssl/bio.h>
-# include <openssl/err.h>
-# include <openssl/bn.h>
-# include <openssl/rsa.h>
-# include <openssl/evp.h>
-# include <openssl/x509.h>
-# include <openssl/pem.h>
-# include <openssl/rand.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include "apps.h"
+#include "progs.h"
+#include <openssl/bio.h>
+#include <openssl/err.h>
+#include <openssl/bn.h>
+#include <openssl/rsa.h>
+#include <openssl/evp.h>
+#include <openssl/x509.h>
+#include <openssl/pem.h>
+#include <openssl/rand.h>
 
-# define DEFBITS 2048
-# define DEFPRIMES 2
+#define DEFBITS 2048
+#define DEFPRIMES 2
+
+static int verbose = 0;
 
 static int genrsa_cb(int p, int n, BN_GENCB *cb);
 
 typedef enum OPTION_choice {
     OPT_ERR = -1, OPT_EOF = 0, OPT_HELP,
-    OPT_3, OPT_F4, OPT_ENGINE,
-    OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_PRIMES,
-    OPT_R_ENUM
+#ifndef OPENSSL_NO_DEPRECATED_3_0
+    OPT_3,
+#endif
+    OPT_F4, OPT_ENGINE,
+    OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_PRIMES, OPT_VERBOSE,
+    OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS genrsa_options[] = {
+    {OPT_HELP_STR, 1, '-', "Usage: %s [options] numbits\n"},
+
+    OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-    {"3", OPT_3, '-', "Use 3 for the E value"},
-    {"F4", OPT_F4, '-', "Use F4 (0x10001) for the E value"},
-    {"f4", OPT_F4, '-', "Use F4 (0x10001) for the E value"},
-    {"out", OPT_OUT, '>', "Output the key to specified file"},
-    OPT_R_OPTIONS,
-    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
-    {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
-# ifndef OPENSSL_NO_ENGINE
+#ifndef OPENSSL_NO_ENGINE
     {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-# endif
+#endif
+
+    OPT_SECTION("Input"),
+#ifndef OPENSSL_NO_DEPRECATED_3_0
+    {"3", OPT_3, '-', "(deprecated) Use 3 for the E value"},
+#endif
+    {"F4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value"},
+    {"f4", OPT_F4, '-', "Use the Fermat number F4 (0x10001) for the E value"},
+
+    OPT_SECTION("Output"),
+    {"out", OPT_OUT, '>', "Output the key to specified file"},
+    {"passout", OPT_PASSOUT, 's', "Output file pass phrase source"},
     {"primes", OPT_PRIMES, 'p', "Specify number of primes"},
+    {"verbose", OPT_VERBOSE, '-', "Verbose output"},
+    {"", OPT_CIPHER, '-', "Encrypt the output with any supported cipher"},
+
+    OPT_R_OPTIONS,
+    OPT_PROV_OPTIONS,
+
+    OPT_PARAMETERS(),
+    {"numbits", 0, 0, "Size of key in bits"},
     {NULL}
 };
 
@@ -88,9 +105,11 @@ opthelp:
             ret = 0;
             opt_help(genrsa_options);
             goto end;
+#ifndef OPENSSL_NO_DEPRECATED_3_0
         case OPT_3:
             f4 = 3;
             break;
+#endif
         case OPT_F4:
             f4 = RSA_F4;
             break;
@@ -104,6 +123,10 @@ opthelp:
             if (!opt_rand(o))
                 goto end;
             break;
+        case OPT_PROV_CASES:
+            if (!opt_provider(o))
+                goto end;
+            break;
         case OPT_PASSOUT:
             passoutarg = opt_arg();
             break;
@@ -115,6 +138,9 @@ opthelp:
             if (!opt_int(opt_arg(), &primes))
                 goto end;
             break;
+        case OPT_VERBOSE:
+            verbose = 1;
+            break;
         }
     }
     argc = opt_num_rest();
@@ -143,8 +169,9 @@ opthelp:
     if (out == NULL)
         goto end;
 
-    BIO_printf(bio_err, "Generating RSA private key, %d bit long modulus (%d primes)\n",
-               num, primes);
+    if (verbose)
+        BIO_printf(bio_err, "Generating RSA private key, %d bit long modulus (%d primes)\n",
+                   num, primes);
     rsa = eng ? RSA_new_method(eng) : RSA_new();
     if (rsa == NULL)
         goto end;
@@ -156,7 +183,7 @@ opthelp:
     RSA_get0_key(rsa, NULL, &e, NULL);
     hexe = BN_bn2hex(e);
     dece = BN_bn2dec(e);
-    if (hexe && dece) {
+    if (hexe && dece && verbose) {
         BIO_printf(bio_err, "e is %s (0x%s)\n", dece, hexe);
     }
     OPENSSL_free(hexe);
@@ -186,6 +213,9 @@ static int genrsa_cb(int p, int n, BN_GENCB *cb)
 {
     char c = '*';
 
+    if (!verbose)
+        return 1;
+
     if (p == 0)
         c = '.';
     if (p == 1)
@@ -198,4 +228,3 @@ static int genrsa_cb(int p, int n, BN_GENCB *cb)
     (void)BIO_flush(BN_GENCB_get_arg(cb));
     return 1;
 }
-#endif

apps/include/app_params.h

@@ -0,0 +1,13 @@
+/*
+ * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/core.h>
+
+int print_param_types(const char *thing, const OSSL_PARAM *pdefs, int indent);
+

apps/include/apps.h

@@ -0,0 +1,273 @@
+/*
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef OSSL_APPS_H
+# define OSSL_APPS_H
+
+# include "e_os.h" /* struct timeval for DTLS */
+# include "internal/nelem.h"
+# include "internal/sockets.h" /* for openssl_fdset() */
+# include <assert.h>
+
+# include <stdarg.h>
+# include <sys/types.h>
+# ifndef OPENSSL_NO_POSIX_IO
+#  include <sys/stat.h>
+#  include <fcntl.h>
+# endif
+
+# include <openssl/e_os2.h>
+# include <openssl/types.h>
+# include <openssl/bio.h>
+# include <openssl/x509.h>
+# include <openssl/conf.h>
+# include <openssl/txt_db.h>
+# include <openssl/engine.h>
+# include <openssl/ocsp.h>
+# include <signal.h>
+# include "apps_ui.h"
+# include "opt.h"
+# include "fmt.h"
+# include "platform.h"
+
+/*
+ * quick macro when you need to pass an unsigned char instead of a char.
+ * this is true for some implementations of the is*() functions, for
+ * example.
+ */
+# define _UC(c) ((unsigned char)(c))
+
+void app_RAND_load_conf(CONF *c, const char *section);
+void app_RAND_write(void);
+
+extern char *default_config_file;
+extern BIO *bio_in;
+extern BIO *bio_out;
+extern BIO *bio_err;
+extern const unsigned char tls13_aes128gcmsha256_id[];
+extern const unsigned char tls13_aes256gcmsha384_id[];
+extern BIO_ADDR *ourpeer;
+
+BIO *dup_bio_in(int format);
+BIO *dup_bio_out(int format);
+BIO *dup_bio_err(int format);
+BIO *bio_open_owner(const char *filename, int format, int private);
+BIO *bio_open_default(const char *filename, char mode, int format);
+BIO *bio_open_default_quiet(const char *filename, char mode, int format);
+CONF *app_load_config_bio(BIO *in, const char *filename);
+CONF *app_load_config(const char *filename);
+CONF *app_load_config_quiet(const char *filename);
+int app_load_modules(const CONF *config);
+void unbuffer(FILE *fp);
+void wait_for_async(SSL *s);
+# if defined(OPENSSL_SYS_MSDOS)
+int has_stdin_waiting(void);
+# endif
+
+void corrupt_signature(const ASN1_STRING *signature);
+int set_cert_times(X509 *x, const char *startdate, const char *enddate,
+                   int days);
+
+typedef struct args_st {
+    int size;
+    int argc;
+    char **argv;
+} ARGS;
+
+/* We need both wrap and the "real" function because libcrypto uses both. */
+int wrap_password_callback(char *buf, int bufsiz, int verify, void *cb_data);
+
+int chopup_args(ARGS *arg, char *buf);
+int dump_cert_text(BIO *out, X509 *x);
+void print_name(BIO *out, const char *title, const X509_NAME *nm,
+                unsigned long lflags);
+void print_bignum_var(BIO *, const BIGNUM *, const char*,
+                      int, unsigned char *);
+void print_array(BIO *, const char *, int, const unsigned char *);
+int set_nameopt(const char *arg);
+unsigned long get_nameopt(void);
+int set_cert_ex(unsigned long *flags, const char *arg);
+int set_name_ex(unsigned long *flags, const char *arg);
+int set_ext_copy(int *copy_type, const char *arg);
+int copy_extensions(X509 *x, X509_REQ *req, int copy_type);
+char *get_passwd(const char *pass, const char *desc);
+int app_passwd(const char *arg1, const char *arg2, char **pass1, char **pass2);
+int add_oid_section(CONF *conf);
+X509_REQ *load_csr(const char *file, int format, const char *desc);
+X509 *load_cert_pass(const char *uri, int maybe_stdin,
+                     const char *pass, const char *desc);
+/* the format parameter is meanwhile not needed anymore and thus ignored */
+X509 *load_cert(const char *uri, int format, const char *desc);
+X509_CRL *load_crl(const char *uri, int format, const char *desc);
+void cleanse(char *str);
+void clear_free(char *str);
+EVP_PKEY *load_key(const char *uri, int format, int maybe_stdin,
+                   const char *pass, ENGINE *e, const char *desc);
+EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin,
+                      const char *pass, ENGINE *e, const char *desc);
+int load_certs(const char *file, STACK_OF(X509) **certs, int format,
+               const char *pass, const char *desc);
+int load_crls(const char *file, STACK_OF(X509_CRL) **crls, int format,
+              const char *pass, const char *desc);
+int load_key_cert_crl(const char *uri, int maybe_stdin,
+                      const char *pass, const char *desc,
+                      EVP_PKEY **ppkey, X509 **pcert, X509_CRL **pcrl);
+X509_STORE *setup_verify(const char *CAfile, int noCAfile,
+                         const char *CApath, int noCApath,
+                         const char *CAstore, int noCAstore);
+__owur int ctx_set_verify_locations(SSL_CTX *ctx,
+                                    const char *CAfile, int noCAfile,
+                                    const char *CApath, int noCApath,
+                                    const char *CAstore, int noCAstore);
+
+# ifndef OPENSSL_NO_CT
+
+/*
+ * Sets the file to load the Certificate Transparency log list from.
+ * If path is NULL, loads from the default file path.
+ * Returns 1 on success, 0 otherwise.
+ */
+__owur int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path);
+
+# endif
+
+ENGINE *setup_engine_methods(const char *id, unsigned int methods, int debug);
+# define setup_engine(e, debug) setup_engine_methods(e, (unsigned int)-1, debug)
+void release_engine(ENGINE *e);
+
+# ifndef OPENSSL_NO_OCSP
+OCSP_RESPONSE *process_responder(OCSP_REQUEST *req,
+                                 const char *host, const char *path,
+                                 const char *port, int use_ssl,
+                                 STACK_OF(CONF_VALUE) *headers,
+                                 int req_timeout);
+# endif
+
+/* Functions defined in ca.c and also used in ocsp.c */
+int unpack_revinfo(ASN1_TIME **prevtm, int *preason, ASN1_OBJECT **phold,
+                   ASN1_GENERALIZEDTIME **pinvtm, const char *str);
+
+# define DB_type         0
+# define DB_exp_date     1
+# define DB_rev_date     2
+# define DB_serial       3      /* index - unique */
+# define DB_file         4
+# define DB_name         5      /* index - unique when active and not
+                                 * disabled */
+# define DB_NUMBER       6
+
+# define DB_TYPE_REV     'R'    /* Revoked  */
+# define DB_TYPE_EXP     'E'    /* Expired  */
+# define DB_TYPE_VAL     'V'    /* Valid ; inserted with: ca ... -valid */
+# define DB_TYPE_SUSP    'S'    /* Suspended  */
+
+typedef struct db_attr_st {
+    int unique_subject;
+} DB_ATTR;
+typedef struct ca_db_st {
+    DB_ATTR attributes;
+    TXT_DB *db;
+    char *dbfname;
+# ifndef OPENSSL_NO_POSIX_IO
+    struct stat dbst;
+# endif
+} CA_DB;
+
+void app_bail_out(char *fmt, ...);
+void* app_malloc(int sz, const char *what);
+BIGNUM *load_serial(const char *serialfile, int create, ASN1_INTEGER **retai);
+int save_serial(const char *serialfile, const char *suffix, const BIGNUM *serial,
+                ASN1_INTEGER **retai);
+int rotate_serial(const char *serialfile, const char *new_suffix,
+                  const char *old_suffix);
+int rand_serial(BIGNUM *b, ASN1_INTEGER *ai);
+CA_DB *load_index(const char *dbfile, DB_ATTR *dbattr);
+int index_index(CA_DB *db);
+int save_index(const char *dbfile, const char *suffix, CA_DB *db);
+int rotate_index(const char *dbfile, const char *new_suffix,
+                 const char *old_suffix);
+void free_index(CA_DB *db);
+# define index_name_cmp_noconst(a, b) \
+        index_name_cmp((const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, a), \
+        (const OPENSSL_CSTRING *)CHECKED_PTR_OF(OPENSSL_STRING, b))
+int index_name_cmp(const OPENSSL_CSTRING *a, const OPENSSL_CSTRING *b);
+int parse_yesno(const char *str, int def);
+
+X509_NAME *parse_name(const char *str, long chtype, int multirdn);
+void policies_print(X509_STORE_CTX *ctx);
+int bio_to_mem(unsigned char **out, int maxlen, BIO *in);
+int pkey_ctrl_string(EVP_PKEY_CTX *ctx, const char *value);
+int x509_ctrl_string(X509 *x, const char *value);
+int x509_req_ctrl_string(X509_REQ *x, const char *value);
+int init_gen_str(EVP_PKEY_CTX **pctx,
+                 const char *algname, ENGINE *e, int do_param);
+int do_X509_sign(X509 *x, EVP_PKEY *pkey, const EVP_MD *md,
+                 STACK_OF(OPENSSL_STRING) *sigopts);
+int do_X509_verify(X509 *x, EVP_PKEY *pkey, STACK_OF(OPENSSL_STRING) *vfyopts);
+int do_X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md,
+                     STACK_OF(OPENSSL_STRING) *sigopts);
+int do_X509_REQ_verify(X509_REQ *x, EVP_PKEY *pkey,
+                       STACK_OF(OPENSSL_STRING) *vfyopts);
+int do_X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md,
+                     STACK_OF(OPENSSL_STRING) *sigopts);
+
+extern char *psk_key;
+
+
+unsigned char *next_protos_parse(size_t *outlen, const char *in);
+
+void print_cert_checks(BIO *bio, X509 *x,
+                       const char *checkhost,
+                       const char *checkemail, const char *checkip);
+
+void store_setup_crl_download(X509_STORE *st);
+
+# define EXT_COPY_NONE   0
+# define EXT_COPY_ADD    1
+# define EXT_COPY_ALL    2
+
+# define NETSCAPE_CERT_HDR       "certificate"
+
+# define APP_PASS_LEN    1024
+
+/*
+ * IETF RFC 5280 says serial number must be <= 20 bytes. Use 159 bits
+ * so that the first bit will never be one, so that the DER encoding
+ * rules won't force a leading octet.
+ */
+# define SERIAL_RAND_BITS        159
+
+int app_isdir(const char *);
+int app_access(const char *, int flag);
+int fileno_stdin(void);
+int fileno_stdout(void);
+int raw_read_stdin(void *, int);
+int raw_write_stdout(const void *, int);
+
+# define TM_START        0
+# define TM_STOP         1
+double app_tminterval(int stop, int usertime);
+
+void make_uppercase(char *string);
+
+typedef struct verify_options_st {
+    int depth;
+    int quiet;
+    int error;
+    int return_error;
+} VERIFY_CB_ARGS;
+
+extern VERIFY_CB_ARGS verify_args;
+
+OSSL_PARAM *app_params_new_from_opts(STACK_OF(OPENSSL_STRING) *opts,
+                                     const OSSL_PARAM *paramdefs);
+void app_params_free(OSSL_PARAM *params);
+void app_providers_cleanup(void);
+
+#endif

apps/include/apps_ui.h

@@ -0,0 +1,28 @@
+/*
+ * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef OSSL_APPS_UI_H
+# define OSSL_APPS_UI_H
+
+
+# define PW_MIN_LENGTH 4
+typedef struct pw_cb_data {
+    const void *password;
+    const char *prompt_info;
+} PW_CB_DATA;
+
+int password_callback(char *buf, int bufsiz, int verify, PW_CB_DATA *cb_data);
+
+int setup_ui_method(void);
+void destroy_ui_method(void);
+const UI_METHOD *get_ui_method(void);
+
+extern BIO *bio_err;
+
+#endif

apps/include/fmt.h

@@ -0,0 +1,44 @@
+/*
+ * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+/*
+ * Options are shared by apps (see apps.h) and the test system
+ * (see test/testutil.h').
+ * In order to remove the dependency between apps and options, the following
+ * shared fields have been moved into this file.
+ */
+
+#ifndef OSSL_APPS_FMT_H
+#define OSSL_APPS_FMT_H
+
+/* On some platforms, it's important to distinguish between text and binary
+ * files.  On some, there might even be specific file formats for different
+ * contents.  The FORMAT_xxx macros are meant to express an intent with the
+ * file being read or created.
+ */
+# define B_FORMAT_TEXT   0x8000
+# define FORMAT_UNDEF    0
+# define FORMAT_TEXT    (1 | B_FORMAT_TEXT)     /* Generic text */
+# define FORMAT_BINARY   2                      /* Generic binary */
+# define FORMAT_BASE64  (3 | B_FORMAT_TEXT)     /* Base64 */
+# define FORMAT_ASN1     4                      /* ASN.1/DER */
+# define FORMAT_PEM     (5 | B_FORMAT_TEXT)
+# define FORMAT_PKCS12   6
+# define FORMAT_SMIME   (7 | B_FORMAT_TEXT)
+# define FORMAT_ENGINE   8                      /* Not really a file format */
+# define FORMAT_PEMRSA  (9 | B_FORMAT_TEXT)     /* PEM RSAPublicKey format */
+# define FORMAT_ASN1RSA  10                     /* DER RSAPublicKey format */
+# define FORMAT_MSBLOB   11                     /* MS Key blob format */
+# define FORMAT_PVK      12                     /* MS PVK file format */
+# define FORMAT_HTTP     13                     /* Download using HTTP */
+# define FORMAT_NSS      14                     /* NSS keylog format */
+
+int FMT_istext(int format);
+
+#endif /* OSSL_APPS_FMT_H_ */

apps/include/function.h

@@ -0,0 +1,44 @@
+/*
+ * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef OSSL_APPS_FUNCTION_H
+# define OSSL_APPS_FUNCTION_H
+
+# include <openssl/lhash.h>
+# include "opt.h"
+
+#define DEPRECATED_NO_ALTERNATIVE   "unknown"
+
+typedef enum FUNC_TYPE {
+    FT_none, FT_general, FT_md, FT_cipher, FT_pkey,
+    FT_md_alg, FT_cipher_alg
+} FUNC_TYPE;
+
+typedef struct function_st {
+    FUNC_TYPE type;
+    const char *name;
+    int (*func)(int argc, char *argv[]);
+    const OPTIONS *help;
+    const char *deprecated_alternative;
+    const char *deprecated_version;
+} FUNCTION;
+
+DEFINE_LHASH_OF(FUNCTION);
+
+/* Structure to hold the number of columns to be displayed and the
+ * field width used to display them.
+ */
+typedef struct {
+    int columns;
+    int width;
+} DISPLAY_COLUMNS;
+
+void calculate_columns(FUNCTION *functions, DISPLAY_COLUMNS *dc);
+
+#endif

apps/include/http_server.h

@@ -0,0 +1,118 @@
+/*
+ * Copyright 1995-2020 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef OSSL_HTTP_SERVER_H
+# define OSSL_HTTP_SERVER_H
+
+# include "apps.h"
+
+# ifndef HAVE_FORK
+#  if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_WINDOWS)
+#   define HAVE_FORK 0
+#  else
+#   define HAVE_FORK 1
+#  endif
+# endif
+
+# if HAVE_FORK
+#  undef NO_FORK
+# else
+#  define NO_FORK
+# endif
+
+# if !defined(NO_FORK) && !defined(OPENSSL_NO_SOCK) \
+    && !defined(OPENSSL_NO_POSIX_IO)
+#  define HTTP_DAEMON
+#  include <sys/types.h>
+#  include <sys/wait.h>
+#  include <syslog.h>
+#  include <signal.h>
+#  define MAXERRLEN 1000 /* limit error text sent to syslog to 1000 bytes */
+# else
+#  undef LOG_INFO
+#  undef LOG_WARNING
+#  undef LOG_ERR
+#  define LOG_INFO      0
+#  define LOG_WARNING   1
+#  define LOG_ERR       2
+# endif
+
+/*-
+ * Log a message to syslog if multi-threaded HTTP_DAEMON, else to bio_err
+ * prog: the name of the current app
+ * level: the severity of the message, e.g., LOG_ERR
+ * fmt: message with potential extra parameters like with printf()
+ * returns nothing
+ */
+void log_message(const char *prog, int level, const char *fmt, ...);
+
+# ifndef OPENSSL_NO_SOCK
+/*-
+ * Initialize an HTTP server by setting up its listening BIO
+ * prog: the name of the current app
+ * port: the port to listen on
+ * returns a BIO for accepting requests, NULL on error
+ */
+BIO *http_server_init_bio(const char *prog, const char *port);
+
+/*-
+ * Accept an ASN.1-formatted HTTP request
+ * it: the expected request ASN.1 type
+ * preq: pointer to variable where to place the parsed request
+ * pcbio: pointer to variable where to place the BIO for sending the response to
+ * ppath: pointer to variable where to place the request path, or NULL
+ * acbio: the listening bio (typically as returned by http_server_init_bio())
+ * prog: the name of the current app
+ * accept_get: whether to accept GET requests (in addition to POST requests)
+ * timeout: connection timeout (in seconds), or 0 for none/infinite
+ * returns 0 in case caller should retry, then *preq == *ppath == *pcbio == NULL
+ * returns -1 on fatal error; also then holds *preq == *ppath == *pcbio == NULL
+ * returns 1 otherwise. In this case it is guaranteed that *pcbio != NULL while
+ * *ppath == NULL and *preq == NULL if and only if the request is invalid,
+ * On return value 1 the caller is responsible for sending an HTTP response,
+ * using http_server_send_asn1_resp() or http_server_send_status().
+ * The caller must free any non-NULL *preq, *ppath, and *pcbio pointers.
+ */
+int http_server_get_asn1_req(const ASN1_ITEM *it, ASN1_VALUE **preq,
+                             char **ppath, BIO **pcbio, BIO *acbio,
+                             const char *prog, int accept_get, int timeout);
+
+/*-
+ * Send an ASN.1-formatted HTTP response
+ * cbio: destination BIO (typically as returned by http_server_get_asn1_req())
+ *       note: cbio should not do an encoding that changes the output length
+ * content_type: string identifying the type of the response
+ * it: the response ASN.1 type
+ * valit: the response ASN.1 type
+ * resp: the response to send
+ * returns 1 on success, 0 on failure
+ */
+int http_server_send_asn1_resp(BIO *cbio, const char *content_type,
+                               const ASN1_ITEM *it, const ASN1_VALUE *resp);
+
+/*-
+ * Send a trivial HTTP response, typically to report an error or OK
+ * cbio: destination BIO (typically as returned by http_server_get_asn1_req())
+ * status: the status code to send
+ * reason: the corresponding human-readable string
+ * returns 1 on success, 0 on failure
+ */
+int http_server_send_status(BIO *cbio, int status, const char *reason);
+
+# endif
+
+# ifdef HTTP_DAEMON
+extern int multi;
+extern int acfd;
+
+void socket_timeout(int signum);
+void spawn_loop(const char *prog);
+# endif
+
+#endif

apps/include/names.h

@@ -0,0 +1,17 @@
+/*
+ * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/safestack.h>
+
+/* Standard comparing function for names */
+int name_cmp(const char * const *a, const char * const *b);
+/* collect_names is meant to be used with EVP_{type}_doall_names */
+void collect_names(const char *name, void *vdata);
+/* Sorts and prints a stack of names to |out| */
+void print_names(BIO *out, STACK_OF(OPENSSL_CSTRING) *names);

apps/include/opt.h

@@ -0,0 +1,378 @@
+/*
+ * Copyright 2018-2020 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+#ifndef OSSL_APPS_OPT_H
+#define OSSL_APPS_OPT_H
+
+#include <sys/types.h>
+#include <openssl/e_os2.h>
+#include <openssl/types.h>
+#include <stdarg.h>
+
+/*
+ * Common verification options.
+ */
+# define OPT_V_ENUM \
+        OPT_V__FIRST=2000, \
+        OPT_V_POLICY, OPT_V_PURPOSE, OPT_V_VERIFY_NAME, OPT_V_VERIFY_DEPTH, \
+        OPT_V_ATTIME, OPT_V_VERIFY_HOSTNAME, OPT_V_VERIFY_EMAIL, \
+        OPT_V_VERIFY_IP, OPT_V_IGNORE_CRITICAL, OPT_V_ISSUER_CHECKS, \
+        OPT_V_CRL_CHECK, OPT_V_CRL_CHECK_ALL, OPT_V_POLICY_CHECK, \
+        OPT_V_EXPLICIT_POLICY, OPT_V_INHIBIT_ANY, OPT_V_INHIBIT_MAP, \
+        OPT_V_X509_STRICT, OPT_V_EXTENDED_CRL, OPT_V_USE_DELTAS, \
+        OPT_V_POLICY_PRINT, OPT_V_CHECK_SS_SIG, OPT_V_TRUSTED_FIRST, \
+        OPT_V_SUITEB_128_ONLY, OPT_V_SUITEB_128, OPT_V_SUITEB_192, \
+        OPT_V_PARTIAL_CHAIN, OPT_V_NO_ALT_CHAINS, OPT_V_NO_CHECK_TIME, \
+        OPT_V_VERIFY_AUTH_LEVEL, OPT_V_ALLOW_PROXY_CERTS, \
+        OPT_V__LAST
+
+# define OPT_V_OPTIONS \
+        OPT_SECTION("Validation"), \
+        { "policy", OPT_V_POLICY, 's', "adds policy to the acceptable policy set"}, \
+        { "purpose", OPT_V_PURPOSE, 's', \
+            "certificate chain purpose"}, \
+        { "verify_name", OPT_V_VERIFY_NAME, 's', "verification policy name"}, \
+        { "verify_depth", OPT_V_VERIFY_DEPTH, 'n', \
+            "chain depth limit" }, \
+        { "auth_level", OPT_V_VERIFY_AUTH_LEVEL, 'n', \
+            "chain authentication security level" }, \
+        { "attime", OPT_V_ATTIME, 'M', "verification epoch time" }, \
+        { "verify_hostname", OPT_V_VERIFY_HOSTNAME, 's', \
+            "expected peer hostname" }, \
+        { "verify_email", OPT_V_VERIFY_EMAIL, 's', \
+            "expected peer email" }, \
+        { "verify_ip", OPT_V_VERIFY_IP, 's', \
+            "expected peer IP address" }, \
+        { "ignore_critical", OPT_V_IGNORE_CRITICAL, '-', \
+            "permit unhandled critical extensions"}, \
+        { "issuer_checks", OPT_V_ISSUER_CHECKS, '-', "(deprecated)"}, \
+        { "crl_check", OPT_V_CRL_CHECK, '-', "check leaf certificate revocation" }, \
+        { "crl_check_all", OPT_V_CRL_CHECK_ALL, '-', "check full chain revocation" }, \
+        { "policy_check", OPT_V_POLICY_CHECK, '-', "perform rfc5280 policy checks"}, \
+        { "explicit_policy", OPT_V_EXPLICIT_POLICY, '-', \
+            "set policy variable require-explicit-policy"}, \
+        { "inhibit_any", OPT_V_INHIBIT_ANY, '-', \
+            "set policy variable inhibit-any-policy"}, \
+        { "inhibit_map", OPT_V_INHIBIT_MAP, '-', \
+            "set policy variable inhibit-policy-mapping"}, \
+        { "x509_strict", OPT_V_X509_STRICT, '-', \
+            "disable certificate compatibility work-arounds"}, \
+        { "extended_crl", OPT_V_EXTENDED_CRL, '-', \
+            "enable extended CRL features"}, \
+        { "use_deltas", OPT_V_USE_DELTAS, '-', \
+            "use delta CRLs"}, \
+        { "policy_print", OPT_V_POLICY_PRINT, '-', \
+            "print policy processing diagnostics"}, \
+        { "check_ss_sig", OPT_V_CHECK_SS_SIG, '-', \
+            "check root CA self-signatures"}, \
+        { "trusted_first", OPT_V_TRUSTED_FIRST, '-', \
+            "search trust store first (default)" }, \
+        { "suiteB_128_only", OPT_V_SUITEB_128_ONLY, '-', "Suite B 128-bit-only mode"}, \
+        { "suiteB_128", OPT_V_SUITEB_128, '-', \
+            "Suite B 128-bit mode allowing 192-bit algorithms"}, \
+        { "suiteB_192", OPT_V_SUITEB_192, '-', "Suite B 192-bit-only mode" }, \
+        { "partial_chain", OPT_V_PARTIAL_CHAIN, '-', \
+            "accept chains anchored by intermediate trust-store CAs"}, \
+        { "no_alt_chains", OPT_V_NO_ALT_CHAINS, '-', "(deprecated)" }, \
+        { "no_check_time", OPT_V_NO_CHECK_TIME, '-', "ignore certificate validity time" }, \
+        { "allow_proxy_certs", OPT_V_ALLOW_PROXY_CERTS, '-', "allow the use of proxy certificates" }
+
+# define OPT_V_CASES \
+        OPT_V__FIRST: case OPT_V__LAST: break; \
+        case OPT_V_POLICY: \
+        case OPT_V_PURPOSE: \
+        case OPT_V_VERIFY_NAME: \
+        case OPT_V_VERIFY_DEPTH: \
+        case OPT_V_VERIFY_AUTH_LEVEL: \
+        case OPT_V_ATTIME: \
+        case OPT_V_VERIFY_HOSTNAME: \
+        case OPT_V_VERIFY_EMAIL: \
+        case OPT_V_VERIFY_IP: \
+        case OPT_V_IGNORE_CRITICAL: \
+        case OPT_V_ISSUER_CHECKS: \
+        case OPT_V_CRL_CHECK: \
+        case OPT_V_CRL_CHECK_ALL: \
+        case OPT_V_POLICY_CHECK: \
+        case OPT_V_EXPLICIT_POLICY: \
+        case OPT_V_INHIBIT_ANY: \
+        case OPT_V_INHIBIT_MAP: \
+        case OPT_V_X509_STRICT: \
+        case OPT_V_EXTENDED_CRL: \
+        case OPT_V_USE_DELTAS: \
+        case OPT_V_POLICY_PRINT: \
+        case OPT_V_CHECK_SS_SIG: \
+        case OPT_V_TRUSTED_FIRST: \
+        case OPT_V_SUITEB_128_ONLY: \
+        case OPT_V_SUITEB_128: \
+        case OPT_V_SUITEB_192: \
+        case OPT_V_PARTIAL_CHAIN: \
+        case OPT_V_NO_ALT_CHAINS: \
+        case OPT_V_NO_CHECK_TIME: \
+        case OPT_V_ALLOW_PROXY_CERTS
+
+/*
+ * Common "extended validation" options.
+ */
+# define OPT_X_ENUM \
+        OPT_X__FIRST=1000, \
+        OPT_X_KEY, OPT_X_CERT, OPT_X_CHAIN, OPT_X_CHAIN_BUILD, \
+        OPT_X_CERTFORM, OPT_X_KEYFORM, \
+        OPT_X__LAST
+
+# define OPT_X_OPTIONS \
+        OPT_SECTION("Extended certificate"), \
+        { "xkey", OPT_X_KEY, '<', "key for Extended certificates"}, \
+        { "xcert", OPT_X_CERT, '<', "cert for Extended certificates"}, \
+        { "xchain", OPT_X_CHAIN, '<', "chain for Extended certificates"}, \
+        { "xchain_build", OPT_X_CHAIN_BUILD, '-', \
+            "build certificate chain for the extended certificates"}, \
+        { "xcertform", OPT_X_CERTFORM, 'F', \
+            "format of Extended certificate (PEM/DER/P12); has no effect" }, \
+        { "xkeyform", OPT_X_KEYFORM, 'F', \
+            "format of Extended certificate's key (DER/PEM/P12); has no effect"}
+
+# define OPT_X_CASES \
+        OPT_X__FIRST: case OPT_X__LAST: break; \
+        case OPT_X_KEY: \
+        case OPT_X_CERT: \
+        case OPT_X_CHAIN: \
+        case OPT_X_CHAIN_BUILD: \
+        case OPT_X_CERTFORM: \
+        case OPT_X_KEYFORM
+
+/*
+ * Common SSL options.
+ * Any changes here must be coordinated with ../ssl/ssl_conf.c
+ */
+# define OPT_S_ENUM \
+        OPT_S__FIRST=3000, \
+        OPT_S_NOSSL3, OPT_S_NOTLS1, OPT_S_NOTLS1_1, OPT_S_NOTLS1_2, \
+        OPT_S_NOTLS1_3, OPT_S_BUGS, OPT_S_NO_COMP, OPT_S_NOTICKET, \
+        OPT_S_SERVERPREF, OPT_S_LEGACYRENEG, OPT_S_LEGACYCONN, \
+        OPT_S_ONRESUMP, OPT_S_NOLEGACYCONN, OPT_S_ALLOW_NO_DHE_KEX, \
+        OPT_S_PRIORITIZE_CHACHA, \
+        OPT_S_STRICT, OPT_S_SIGALGS, OPT_S_CLIENTSIGALGS, OPT_S_GROUPS, \
+        OPT_S_CURVES, OPT_S_NAMEDCURVE, OPT_S_CIPHER, OPT_S_CIPHERSUITES, \
+        OPT_S_RECORD_PADDING, OPT_S_DEBUGBROKE, OPT_S_COMP, \
+        OPT_S_MINPROTO, OPT_S_MAXPROTO, \
+        OPT_S_NO_RENEGOTIATION, OPT_S_NO_MIDDLEBOX, OPT_S__LAST
+
+# define OPT_S_OPTIONS \
+        OPT_SECTION("TLS/SSL"), \
+        {"no_ssl3", OPT_S_NOSSL3, '-',"Just disable SSLv3" }, \
+        {"no_tls1", OPT_S_NOTLS1, '-', "Just disable TLSv1"}, \
+        {"no_tls1_1", OPT_S_NOTLS1_1, '-', "Just disable TLSv1.1" }, \
+        {"no_tls1_2", OPT_S_NOTLS1_2, '-', "Just disable TLSv1.2"}, \
+        {"no_tls1_3", OPT_S_NOTLS1_3, '-', "Just disable TLSv1.3"}, \
+        {"bugs", OPT_S_BUGS, '-', "Turn on SSL bug compatibility"}, \
+        {"no_comp", OPT_S_NO_COMP, '-', "Disable SSL/TLS compression (default)" }, \
+        {"comp", OPT_S_COMP, '-', "Use SSL/TLS-level compression" }, \
+        {"no_ticket", OPT_S_NOTICKET, '-', \
+            "Disable use of TLS session tickets"}, \
+        {"serverpref", OPT_S_SERVERPREF, '-', "Use server's cipher preferences"}, \
+        {"legacy_renegotiation", OPT_S_LEGACYRENEG, '-', \
+            "Enable use of legacy renegotiation (dangerous)"}, \
+        {"no_renegotiation", OPT_S_NO_RENEGOTIATION, '-', \
+            "Disable all renegotiation."}, \
+        {"legacy_server_connect", OPT_S_LEGACYCONN, '-', \
+            "Allow initial connection to servers that don't support RI"}, \
+        {"no_resumption_on_reneg", OPT_S_ONRESUMP, '-', \
+            "Disallow session resumption on renegotiation"}, \
+        {"no_legacy_server_connect", OPT_S_NOLEGACYCONN, '-', \
+            "Disallow initial connection to servers that don't support RI"}, \
+        {"allow_no_dhe_kex", OPT_S_ALLOW_NO_DHE_KEX, '-', \
+            "In TLSv1.3 allow non-(ec)dhe based key exchange on resumption"}, \
+        {"prioritize_chacha", OPT_S_PRIORITIZE_CHACHA, '-', \
+            "Prioritize ChaCha ciphers when preferred by clients"}, \
+        {"strict", OPT_S_STRICT, '-', \
+            "Enforce strict certificate checks as per TLS standard"}, \
+        {"sigalgs", OPT_S_SIGALGS, 's', \
+            "Signature algorithms to support (colon-separated list)" }, \
+        {"client_sigalgs", OPT_S_CLIENTSIGALGS, 's', \
+            "Signature algorithms to support for client certificate" \
+            " authentication (colon-separated list)" }, \
+        {"groups", OPT_S_GROUPS, 's', \
+            "Groups to advertise (colon-separated list)" }, \
+        {"curves", OPT_S_CURVES, 's', \
+            "Groups to advertise (colon-separated list)" }, \
+        {"named_curve", OPT_S_NAMEDCURVE, 's', \
+            "Elliptic curve used for ECDHE (server-side only)" }, \
+        {"cipher", OPT_S_CIPHER, 's', "Specify TLSv1.2 and below cipher list to be used"}, \
+        {"ciphersuites", OPT_S_CIPHERSUITES, 's', "Specify TLSv1.3 ciphersuites to be used"}, \
+        {"min_protocol", OPT_S_MINPROTO, 's', "Specify the minimum protocol version to be used"}, \
+        {"max_protocol", OPT_S_MAXPROTO, 's', "Specify the maximum protocol version to be used"}, \
+        {"record_padding", OPT_S_RECORD_PADDING, 's', \
+            "Block size to pad TLS 1.3 records to."}, \
+        {"debug_broken_protocol", OPT_S_DEBUGBROKE, '-', \
+            "Perform all sorts of protocol violations for testing purposes"}, \
+        {"no_middlebox", OPT_S_NO_MIDDLEBOX, '-', \
+            "Disable TLSv1.3 middlebox compat mode" }
+
+# define OPT_S_CASES \
+        OPT_S__FIRST: case OPT_S__LAST: break; \
+        case OPT_S_NOSSL3: \
+        case OPT_S_NOTLS1: \
+        case OPT_S_NOTLS1_1: \
+        case OPT_S_NOTLS1_2: \
+        case OPT_S_NOTLS1_3: \
+        case OPT_S_BUGS: \
+        case OPT_S_NO_COMP: \
+        case OPT_S_COMP: \
+        case OPT_S_NOTICKET: \
+        case OPT_S_SERVERPREF: \
+        case OPT_S_LEGACYRENEG: \
+        case OPT_S_LEGACYCONN: \
+        case OPT_S_ONRESUMP: \
+        case OPT_S_NOLEGACYCONN: \
+        case OPT_S_ALLOW_NO_DHE_KEX: \
+        case OPT_S_PRIORITIZE_CHACHA: \
+        case OPT_S_STRICT: \
+        case OPT_S_SIGALGS: \
+        case OPT_S_CLIENTSIGALGS: \
+        case OPT_S_GROUPS: \
+        case OPT_S_CURVES: \
+        case OPT_S_NAMEDCURVE: \
+        case OPT_S_CIPHER: \
+        case OPT_S_CIPHERSUITES: \
+        case OPT_S_RECORD_PADDING: \
+        case OPT_S_NO_RENEGOTIATION: \
+        case OPT_S_MINPROTO: \
+        case OPT_S_MAXPROTO: \
+        case OPT_S_DEBUGBROKE: \
+        case OPT_S_NO_MIDDLEBOX
+
+#define IS_NO_PROT_FLAG(o) \
+ (o == OPT_S_NOSSL3 || o == OPT_S_NOTLS1 || o == OPT_S_NOTLS1_1 \
+  || o == OPT_S_NOTLS1_2 || o == OPT_S_NOTLS1_3)
+
+/*
+ * Random state options.
+ */
+# define OPT_R_ENUM \
+        OPT_R__FIRST=1500, OPT_R_RAND, OPT_R_WRITERAND, OPT_R__LAST
+
+# define OPT_R_OPTIONS \
+    OPT_SECTION("Random state"), \
+    {"rand", OPT_R_RAND, 's', "Load the file(s) into the random number generator"}, \
+    {"writerand", OPT_R_WRITERAND, '>', "Write random data to the specified file"}
+
+# define OPT_R_CASES \
+        OPT_R__FIRST: case OPT_R__LAST: break; \
+        case OPT_R_RAND: case OPT_R_WRITERAND
+
+/*
+ * Provider options.
+ */
+# define OPT_PROV_ENUM \
+        OPT_PROV__FIRST=1600, \
+        OPT_PROV_PROVIDER, OPT_PROV_PROVIDER_PATH, \
+        OPT_PROV__LAST
+
+# define OPT_PROV_OPTIONS \
+        OPT_SECTION("Provider"), \
+        { "provider_path", OPT_PROV_PROVIDER_PATH, 's', "Provider load path (must be before 'provider' argument if required)" }, \
+        { "provider", OPT_PROV_PROVIDER, 's', "Provider to load (can be specified multiple times)" }
+
+# define OPT_PROV_CASES \
+        OPT_PROV__FIRST: case OPT_PROV__LAST: break; \
+        case OPT_PROV_PROVIDER: \
+        case OPT_PROV_PROVIDER_PATH
+
+/*
+ * Option parsing.
+ */
+extern const char OPT_HELP_STR[];
+extern const char OPT_MORE_STR[];
+extern const char OPT_SECTION_STR[];
+extern const char OPT_PARAM_STR[];
+
+typedef struct options_st {
+    const char *name;
+    int retval;
+    /*
+     * value type: - no value (also the value zero), n number, p positive
+     * number, u unsigned, l long, s string, < input file, > output file,
+     * f any format, F der/pem format, E der/pem/engine format identifier.
+     * l, n and u include zero; p does not.
+     */
+    int valtype;
+    const char *helpstr;
+} OPTIONS;
+
+/*
+ * A string/int pairing; widely use for option value lookup, hence the
+ * name OPT_PAIR. But that name is misleading in s_cb.c, so we also use
+ * the "generic" name STRINT_PAIR.
+ */
+typedef struct string_int_pair_st {
+    const char *name;
+    int retval;
+} OPT_PAIR, STRINT_PAIR;
+
+/* Flags to pass into opt_format; see FORMAT_xxx, below. */
+# define OPT_FMT_PEMDER          (1L <<  1)
+# define OPT_FMT_PKCS12          (1L <<  2)
+# define OPT_FMT_SMIME           (1L <<  3)
+# define OPT_FMT_ENGINE          (1L <<  4)
+# define OPT_FMT_MSBLOB          (1L <<  5)
+/* (1L <<  6) was OPT_FMT_NETSCAPE, but wasn't used */
+# define OPT_FMT_NSS             (1L <<  7)
+# define OPT_FMT_TEXT            (1L <<  8)
+# define OPT_FMT_HTTP            (1L <<  9)
+# define OPT_FMT_PVK             (1L << 10)
+# define OPT_FMT_PDE     (OPT_FMT_PEMDER | OPT_FMT_ENGINE)
+# define OPT_FMT_PDS     (OPT_FMT_PEMDER | OPT_FMT_SMIME)
+# define OPT_FMT_ANY     ( \
+        OPT_FMT_PEMDER | OPT_FMT_PKCS12 | OPT_FMT_SMIME | \
+        OPT_FMT_ENGINE | OPT_FMT_MSBLOB | OPT_FMT_NSS   | \
+        OPT_FMT_TEXT   | OPT_FMT_HTTP   | OPT_FMT_PVK)
+
+/* Divide options into sections when displaying usage */
+#define OPT_SECTION(sec) { OPT_SECTION_STR, 1, '-', sec " options:\n" }
+#define OPT_PARAMETERS() { OPT_PARAM_STR, 1, '-', "Parameters:\n" }
+
+char *opt_progname(const char *argv0);
+char *opt_getprog(void);
+char *opt_init(int ac, char **av, const OPTIONS * o);
+int opt_next(void);
+void opt_begin(void);
+int opt_format(const char *s, unsigned long flags, int *result);
+const char *format2str(int format);
+int opt_int(const char *arg, int *result);
+int opt_ulong(const char *arg, unsigned long *result);
+int opt_long(const char *arg, long *result);
+#if defined(__STDC_VERSION__) && __STDC_VERSION__ >= 199901L && \
+    defined(INTMAX_MAX) && defined(UINTMAX_MAX) && \
+    !defined(OPENSSL_NO_INTTYPES_H)
+int opt_imax(const char *arg, intmax_t *result);
+int opt_umax(const char *arg, uintmax_t *result);
+#else
+# define opt_imax opt_long
+# define opt_umax opt_ulong
+# define intmax_t long
+# define uintmax_t unsigned long
+#endif
+int opt_pair(const char *arg, const OPT_PAIR * pairs, int *result);
+int opt_cipher(const char *name, const EVP_CIPHER **cipherp);
+int opt_md(const char *name, const EVP_MD **mdp);
+char *opt_arg(void);
+char *opt_flag(void);
+char *opt_unknown(void);
+char **opt_rest(void);
+int opt_num_rest(void);
+int opt_verify(int i, X509_VERIFY_PARAM *vpm);
+int opt_rand(int i);
+int opt_provider(int i);
+void opt_help(const OPTIONS * list);
+void opt_print(const OPTIONS * opt, int doingparams, int width);
+int opt_format_error(const char *s, unsigned long flags);
+void print_format_error(int format, unsigned long flags);
+int opt_isdir(const char *name);
+int opt_printf_stderr(const char *fmt, ...);
+
+#endif /* OSSL_APPS_OPT_H */