build.zig: address some Windows/Linux compilation issues

A variety of linker issues (specifically missing symbol errors) don't show up with static libraries, so it was a bit hard to track this down without having something to link to. These have only been tested in cross-compilation setups, so there may still be lurking horrors.
build.zig: fix header search paths
2023-08-31 23:43:46 -07:00 · 2023-08-31 22:14:27 -07:00 · 2023-08-31 21:45:39 -07:00 · 2023-08-30 21:48:11 -07:00
61 changed files with 876 additions and 1708 deletions
--- a/.github/rust-openssl.patch
+++ b/.github/rust-openssl.patch
@@ -1,13 +1,13 @@
 diff --git a/openssl-sys/build/main.rs b/openssl-sys/build/main.rs
-index 21ccf3d0..1cf2d184 100644
+index ba149c17..5274dc44 100644
 --- a/openssl-sys/build/main.rs
 +++ b/openssl-sys/build/main.rs
-@@ -272,7 +272,7 @@ See rust-openssl documentation for more information:
+@@ -285,7 +285,7 @@ See rust-openssl documentation for more information:
             (3, 7, 0) => ('3', '7', '0'),
             (3, 7, 1) => ('3', '7', '1'),
             (3, 7, _) => ('3', '7', 'x'),
-            (3, 8, 0) => ('3', '8', '0'),
-+            (3, 8, _) => ('3', '8', '0'),
-             _ => version_error(),
+-            _ => version_error(),
+            _ => ('3', '7', 'x'),
         };
 
+         println!("cargo:libressl=true");
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -1,10 +1,5 @@
 name: CIFuzz
-
-on:
-  workflow_dispatch:
-  schedule:
-  - cron: "0 0 * * *"
-
+on: [pull_request]
 jobs:
  Fuzzing:
    runs-on: ubuntu-latest
--- a/.github/workflows/cmake_config.yml
+++ b/.github/workflows/cmake_config.yml
@@ -1,85 +0,0 @@
-name: cmake_config
-
-on: [push, pull_request]
-
-jobs:
-  cmake-check:
-    defaults:
-      run:
-        shell: bash
-    strategy:
-      matrix:
-        os: [windows-latest, macos-latest, ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    continue-on-error: false
-    name: ${{ matrix.os }}
-    steps:
-      - name: Setup Windows dependencies
-        if: runner.os == 'Windows'
-        uses: msys2/setup-msys2@v2
-        with:
-          update: true
-          install: >-
-            autoconf
-            automake
-            diffutils
-            libtool
-            gcc
-            git
-            patch
-            perl
-
-      - name: Setup macOS dependencies
-        if: runner.os == 'macOS'
-        run: brew install automake
-
-      - uses: actions/checkout@main
-
-      - name: Prepare source tree for build (Windows)
-        if: runner.os == 'Windows'
-        run: ./autogen.sh
-        shell: msys2 {0}
-
-      - name: Prepare source tree for build (Unix)
-        if: runner.os != 'Windows'
-        run: ./autogen.sh
-
-      - name: Configure
-        run: |
-          cmake -S . \
-                -B build \
-                -D CMAKE_BUILD_TYPE=Release \
-                -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local
-
-      - name: Build
-        run: cmake --build build --config Release --verbose
-
-      - name: Install
-        run: cmake --install build --config Release
-
-      - name: Consume from the build directory - Configure
-        run: |
-          cmake -S tests/cmake \
-                -B consumer-build \
-                -D CMAKE_BUILD_TYPE=Release \
-                -D LibreSSL_DIR=$GITHUB_WORKSPACE/build
-      - name: Consume from the build directory - Build
-        run: cmake --build consumer-build --config Release --verbose
-
-      - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Configure
-        run: |
-          cmake -S tests/cmake \
-            -B consumer-install-prefix \
-            -D CMAKE_BUILD_TYPE=Release \
-            -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local
-      - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Build
-        run: cmake --build consumer-install-prefix --config Release --verbose
-
-      - name: Consume from the install directory (LibreSSL_DIR) - Configure
-        run: |
-          cmake -S tests/cmake \
-                -B consumer-install-dir \
-                -D CMAKE_BUILD_TYPE=Release \
-                -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL
-      - name: Consume from the install directory (LibreSSL_DIR) - Build
-        run: cmake --build consumer-install-dir --config Release --verbose
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -9,40 +9,20 @@ jobs:
  scan:
    runs-on: ubuntu-latest
    if: ${{ github.repository_owner == 'libressl' }}
+    env:
+      COVERITY_SCAN_PROJECT_NAME: 'libressl-portable/portable'
+      COVERITY_SCAN_BRANCH_PATTERN: '*'
+      COVERITY_SCAN_NOTIFICATION_EMAIL: 'libressl-security@openbsd.org'
+      COVERITY_SCAN_BUILD_COMMAND_PREPEND: "./autogen.sh && ./configure && make dist && tar zxf libressl-*.tar.gz && rm libressl-*.tar.gz && cd libressl-* && mkdir build-static && mkdir build-shared && cmake -GNinja -DBUILD_SHARED_LIBS=ON .."
+      COVERITY_SCAN_BUILD_COMMAND: "ninja"
    steps:
    - uses: actions/checkout@main
    - name: Install apt dependencies
      run: |
        sudo apt-get update
        sudo apt-get install -y cmake ninja-build
-    - name: Download Coverity build tool
+    - name: Run Coverity Scan
+      env:
+        COVERITY_SCAN_TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
      run: |
-        wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=${{ secrets.COVERITY_SCAN_TOKEN }}&project=libressl-portable%2Fportable" -O coverity_tool.tar.gz
-        mkdir coverity_tool
-        tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool
-    - name: Configure
-      run: |
-        ./autogen.sh
-        ./configure
-        make dist
-        tar zxf libressl-*.tar.gz
-        rm libressl-*.tar.gz
-        cd libressl-*
-        mkdir build-static
-        mkdir build-shared 
-        cmake -GNinja -DBUILD_SHARED_LIBS=ON ..
-    - name: Build with Coverity build tool
-      run: |
-        export PATH=`pwd`/coverity_tool/bin:$PATH
-        cd libressl-*
-        cov-build --dir cov-int ninja
-    - name: Submit build result to Coverity Scan
-      run: |
-        cd libressl-*
-        tar czvf cov.tar.gz cov-int
-        curl --form token=${{ secrets.COVERITY_SCAN_TOKEN }} \
-          --form email=libressl-security@openbsd.org \
-          --form file=@cov.tar.gz \
-          --form version="Commit $GITHUB_SHA" \
-          --form description="Build submitted via CI" \
-          https://scan.coverity.com/builds?project=libressl-portable%2Fportable
+        curl -fsSL "https://scan.coverity.com/scripts/travisci_build_coverity_scan.sh" | bash || true
--- a/.github/workflows/fedora-rawhide.yml
+++ b/.github/workflows/fedora-rawhide.yml
@@ -1,34 +0,0 @@
-name: Fedora/Rawhide
-
-on:
-  workflow_dispatch:
-  schedule:
-  - cron: "0 0 * * *"
-
-permissions:
-  contents: read
-
-jobs:
-  build_and_test:
-    strategy:
-      matrix:
-        cc: [ gcc, clang ]
-    name: ${{ matrix.cc }}
-    runs-on: ubuntu-latest
-    container:
-      image: fedora:rawhide
-    steps:
-    - uses: actions/checkout@v3
-    - name: Install dependencies
-      run: |
-        dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch
-    - name: Pull upstream source
-      run: |
-        ./update.sh
-    - name: Build
-      run: |
-         CC=${{ matrix.cc }} cmake -GNinja -DBUILD_SHARED_LIBS=ON .
-         ninja
-    - name: Test
-      run: |
-         ninja test
--- a/.github/workflows/macos_test.yml
+++ b/.github/workflows/macos_test.yml
@@ -6,13 +6,14 @@ jobs:
  build-native:
    strategy:
      matrix:
-        os: [macos-13, macos-12]
-        arch: [arm64, x86_64]
+        os: [macos-12, macos-11]
+        compiler: [clang, gcc]
    runs-on: ${{ matrix.os }}
    continue-on-error: false
    env:
-      ARCH: ${{ matrix.arch }}
-    name: ${{ matrix.os }} - ${{ matrix.arch }}
+      CC: ${{ matrix.compiler }}
+      ARCH: native
+    name: ${{ matrix.compiler }} - ${{ matrix.os }}
    steps:
    - name: Install packages for macos
      run: brew install automake
--- a/.github/workflows/rust_regress.yml
+++ b/.github/workflows/rust_regress.yml
@@ -1,4 +1,4 @@
-name: rust regress tests
+name: regress testing

 on:
  schedule:
--- a/.github/workflows/solaris_test.yml
+++ b/.github/workflows/solaris_test.yml
@@ -1,30 +0,0 @@
-name: solaris_ci
-
-on:
-  workflow_dispatch:
-  schedule:
-  - cron: "0 0 * * *"
-
-jobs:
-  build-native:
-    strategy:
-      matrix:
-        release: [11.4]
-    runs-on: macos-12
-    continue-on-error: false
-    name: Solaris ${{ matrix.release }}
-    steps:
-    - name: Checkout source
-      uses: actions/checkout@main
-    - name: Configure source
-      run: |
-        brew install automake autoconf libtool
-        ./autogen.sh
-    - name: Build on VM
-      uses: vmactions/solaris-vm@v0
-      with:
-        prepare: |
-          pkg install gcc make
-        run: |
-          MAKE=gmake ./configure
-          gmake -j2 check || (cat tests/test-suite.log && exit 1)
--- a/.github/workflows/windows_test.yml
+++ b/.github/workflows/windows_test.yml
@@ -1,45 +0,0 @@
-name: windows_ci
-
-on: [push, pull_request]
-
-jobs:
-  build-native:
-    strategy:
-      matrix:
-        os: [windows-2019, windows-2022]
-        arch: [Win32, x64, ARM64]
-        include:
-          - generator: "Visual Studio 16 2019"
-            os: windows-2019
-          - generator: "Visual Studio 17 2022"
-            os: windows-2022
-    runs-on: ${{ matrix.os }}
-    continue-on-error: false
-    name: ${{ matrix.os }} - ${{ matrix.arch }}
-    steps:
-      - uses: msys2/setup-msys2@v2
-        with:
-          update: true
-          install: >-
-            autoconf
-            automake
-            diffutils
-            libtool
-            gcc
-            git
-            patch
-            perl
-      - uses: actions/checkout@main
-      - shell: msys2 {0}
-        run: ./autogen.sh
-      - shell: cmd
-        run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -DCMAKE_INSTALL_PREFIX=../local
-      - shell: cmd
-        run: cmake --build build --config Release
-      - shell: cmd
-        if: ${{ matrix.arch != 'ARM64' }}
-        run: ctest --test-dir build -C Release --output-on-failure
-      - uses: actions/upload-artifact@v3
-        with:
-          name: windows-build-results-${{ matrix.os }}-${{ matrix.arch }}
-          path: build
--- a/.gitignore
+++ b/.gitignore
@@ -82,17 +82,14 @@ tests/bio_mem*
 tests/bnaddsub*
 tests/bn_add_sub*
 tests/bn_cmp*
-tests/bn_convert*
 tests/bn_gcd*
 tests/bn_isqrt*
 tests/bn_mod_exp*
 tests/bn_mod_exp_zero*
 tests/bn_mod_exp2_mont*
-tests/bn_mod_inverse*
 tests/bn_mod_sqrt*
 tests/bn_mont*
 tests/bn_primes*
-tests/bn_print*
 tests/bn_rand_interval*
 tests/bn_shift*
 tests/bn_to_string*
@@ -104,7 +101,6 @@ tests/constraints*
 tests/ctlog.conf
 tests/*.crt
 tests/ec_point_conversion*
-tests/ecc_cdh*
 tests/evp_pkey_check*
 tests/evp_pkey_cleanup*
 tests/explicit_bzero*
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,6 +1,8 @@
-cmake_minimum_required (VERSION 3.16.4)
 if(MSVC)
+	cmake_minimum_required (VERSION 3.16.4)
 	cmake_policy(SET CMP0091 NEW)
+else()
+	cmake_minimum_required (VERSION 3.0)
 endif()

 project (LibreSSL C ASM)
@@ -39,7 +41,6 @@ option(ENABLE_ASM "Enable assembly" ON)
 option(ENABLE_EXTRATESTS "Enable extra tests that may be unreliable on some platforms" OFF)
 option(ENABLE_NC "Enable installing TLS-enabled nc(1)" OFF)
 set(OPENSSLDIR ${OPENSSLDIR} CACHE PATH "Set the default openssl directory" FORCE)
-set(LIBRESSL_INSTALL_CMAKEDIR "${CMAKE_INSTALL_LIBDIR}/cmake/LibreSSL" CACHE STRING "Installation directory for the CMake targets")

 option(USE_STATIC_MSVC_RUNTIMES "Use /MT instead of /MD in MSVC" OFF)
 if(USE_STATIC_MSVC_RUNTIMES)
@@ -50,24 +51,6 @@ if(NOT LIBRESSL_SKIP_INSTALL)
 	set( ENABLE_LIBRESSL_INSTALL ON )
 endif(NOT LIBRESSL_SKIP_INSTALL)

-# Set a default build type if none was specified
-set(default_build_type "Release")
-
-if(NOT CMAKE_BUILD_TYPE AND NOT CMAKE_CONFIGURATION_TYPES)
-  message(STATUS "Setting build type to '${default_build_type}' as none was specified.")
-  set(CMAKE_BUILD_TYPE "${default_build_type}" CACHE
-      STRING "Choose the type of build." FORCE)
-  # Set the possible values of build type for cmake-gui
-  set_property(CACHE CMAKE_BUILD_TYPE PROPERTY
-	  STRINGS "Debug" "Release" "MinSizeRel" "RelWithDebInfo")
-endif()
-
-# Enable asserts regardless of build type
-if(MSVC)
-	add_definitions(/UNDEBUG)
-else()
-	add_definitions(-UNDEBUG)
-endif()

 set(BUILD_NC true)

@@ -96,7 +79,7 @@ if(WIN32 OR (CMAKE_SYSTEM_NAME MATCHES "MINGW"))
 	add_definitions(-D__USE_MINGW_ANSI_STDIO)
 endif()

-set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall")
+set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -O2 -Wall")

 if(CMAKE_SYSTEM_NAME MATCHES "HP-UX")
 	if(CMAKE_C_COMPILER MATCHES "gcc")
@@ -138,7 +121,7 @@ if(WIN32)
 	if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore")
 		add_definitions(-D_WIN32_WINNT=0x0600)
 	endif()
-	set(PLATFORM_LIBS ${PLATFORM_LIBS} ws2_32 ntdll bcrypt)
+	set(PLATFORM_LIBS ${PLATFORM_LIBS} ws2_32 bcrypt)
 endif()

 if(MSVC)
@@ -193,11 +176,6 @@ if(HAVE_ASPRINTF)
 	add_definitions(-DHAVE_ASPRINTF)
 endif()

-check_function_exists(getopt HAVE_GETOPT)
-if(HAVE_GETOPT)
-	add_definitions(-DHAVE_GETOPT)
-endif()
-
 check_function_exists(reallocarray HAVE_REALLOCARRAY)
 if(HAVE_REALLOCARRAY)
 	add_definitions(-DHAVE_REALLOCARRAY)
@@ -328,15 +306,6 @@ if(HAVE_NETINET_IP_H)
 	add_definitions(-DHAVE_NETINET_IP_H)
 endif()

-# This isn't ready for universal binaries yet, since we do conditional
-# compilation based on the architecture, but this makes cross compiling for a
-# single architecture work on macOS at least.
-#
-# Don't set CMAKE_OSX_ARCHITECTURES to more than a single value for now.
-if(APPLE)
-	set(CMAKE_SYSTEM_PROCESSOR "${CMAKE_OSX_ARCHITECTURES}")
-endif()
-
 if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "(aarch64|arm64)")
 	set(HOST_AARCH64 true)
 elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "arm")
@@ -379,7 +348,7 @@ if(ENABLE_ASM)
 	elseif(MSVC AND ("${CMAKE_GENERATOR}" MATCHES "Win64" OR "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64"))
 		set(HOST_ASM_MASM_X86_64 true)
 		ENABLE_LANGUAGE(ASM_MASM)
-	elseif(MINGW AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64")
+	elseif(CMAKE_SYSTEM_NAME MATCHES "MINGW" AND "${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "x86_64")
 		set(HOST_ASM_MINGW64_X86_64 true)
 	endif()
 endif()
@@ -447,38 +416,6 @@ if (BUILD_APPLE_XCFRAMEWORK)
 	endif(ENABLE_LIBRESSL_INSTALL)
 endif(BUILD_APPLE_XCFRAMEWORK)

-file(STRINGS "VERSION" VERSION LIMIT_COUNT 1)
-include(CMakePackageConfigHelpers)
-write_basic_package_version_file(
-	"LibreSSLConfigVersion.cmake"
-	VERSION "${VERSION}"
-	COMPATIBILITY SameMajorVersion
-)
-
-set(INCLUDE_DIRECTORY "${CMAKE_BINARY_DIR}/include")
-configure_package_config_file(
-  "${CMAKE_CURRENT_LIST_DIR}/LibreSSLConfig.cmake.in"
-  "${CMAKE_CURRENT_BINARY_DIR}/LibreSSLConfig.cmake"
-	PATH_VARS INCLUDE_DIRECTORY
-  INSTALL_DESTINATION "${CMAKE_CURRENT_BINARY_DIR}"
-	INSTALL_PREFIX "${CMAKE_CURRENT_BINARY_DIR}"
-)
-
-if(ENABLE_LIBRESSL_INSTALL)
-	set(INCLUDE_DIRECTORY "${CMAKE_INSTALL_INCLUDEDIR}")
-	configure_package_config_file(
-  	"${CMAKE_CURRENT_LIST_DIR}/LibreSSLConfig.cmake.in"
-  	"${CMAKE_CURRENT_BINARY_DIR}/install-config/LibreSSLConfig.cmake"
-		PATH_VARS INCLUDE_DIRECTORY
-  	INSTALL_DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
-	)
-	install(FILES
-		"${CMAKE_BINARY_DIR}/install-config/LibreSSLConfig.cmake"
-		"${CMAKE_BINARY_DIR}/LibreSSLConfigVersion.cmake"
-		DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
-	)
-endif()
-
 if(ENABLE_LIBRESSL_INSTALL)
 	if(NOT MSVC)
 		# Create pkgconfig files.
@@ -489,6 +426,7 @@ if(ENABLE_LIBRESSL_INSTALL)
 		if(PLATFORM_LIBS)
 			string(REGEX REPLACE ";" " -l" PLATFORM_LDADD ";${PLATFORM_LIBS}")
 		endif()
+		file(STRINGS    "VERSION" VERSION LIMIT_COUNT 1)
 		file(GLOB       OPENSSL_PKGCONFIGS "*.pc.in")
 		foreach(file ${OPENSSL_PKGCONFIGS})
 			get_filename_component(filename ${file} NAME)
--- a/114
+++ b/114
@@ -28,103 +28,11 @@ history is also available from Git.

 LibreSSL Portable Release Notes:

-3.8.1 - In development
-
-	* Portable changes
-	  - Applications bundled as part of the LibreSSL package internally,
-	    nc(1) and openssl(1), now are linked statically if static libraries
-	    are built.
-	  - Internal compatibility function symbols are no longer exported from
-	    libcrypto. Instead, the libcompat library is linked to libcrypto,
-	    libssl, and libtls separately. This increases size a little, but
-	    ensures that the libraries are not exporting symbols to programs
-	    unintentionally.
-	  - Selective removal of CET implementation on platforms where it is
-	    not supported (macOS).
-	  - Integrated four more tests.
-	  - Added Windows ARM64 architecture to tested platforms.
-	  - Removed Solaris 10 support, fixed Solaris 11.
-	  - libtls no longer links statically to libcrypto / libssl unless
-	    '--enable-libtls-only' is specified at configure time.
-	  - Improved Windows compatibility library, namely handling of files vs
-	    sockets, correcting an exception when operating on a closed socket.
-	  - CMake builds no longer hardcode '-O2' into the compiler flags, instead
-	    using flags from the CMake build type instead.
-	  - Set the CMake default build type to 'Release'. This can be overridden
-	    during configuration.
-	  - Fixed broken ASM support with MinGW builds.
-	* Internal improvements
-	  - Fixed alignment handling in SHA-512.
-	  - Moved the verified_chain to the correct internal struct.
-	  - Improved checks for commonName in libtls.
-	  - Fixed error check for X509_get_ext_d2i() failure in libtls.
-	  - Improved BIGNUM internals and performance.
-	  - Significantly improved Montgomery multiplication performance.
-	  - Initial cleanup passes for SHA-256 internals.
-	  - Converted more libcrypto internals API using CBB and CBS.
-	  - Removed code guarded by #ifdef ZLIB.
-	  - Changed ASN1_item_sign_ctx() and ASN1_item_verify() to work with
-	    Ed25519 and fixed a few bugs in there.
-	  - Fixed various issues with EVP_PKEY_CTX_{new,dup}().
-	  - Improved X.509 certificate version checks.
-	  - Cleaned up handling of elliptic curve cofactors.
-	  - Made BN_num_bits() independent of bn->top.
-	  - Rewrote and simplified bn_sqr().
-	  - Removed EC_GROUP precomp machinery.
-	  - Ensure no X.509v3 extensions appear more than once in certificates.
-	  - Cleaned up various ECDH, ECDSA and EC internals.
-	  - Replaced ASN1_bn_print with a cleaner internal implementation.
-	  - Simplified ASN1_item_sign_ctx().
-	  - Rewrote OBJ_find_sigid_algs() and OBJ_find_sigid_by_algs().
-	  - Various improvements in the 'simple' EC code.
-	  - Fix OPENSSL_cpuid_setup() invocations on arm/aarch64.
-	  - Reduced the dependency of hash implementations on many layers of
-	    macros. This results in significant speedups since modern compilers
-	    are now less confused.
-	  - Significantly simplified the BN_BLINDING internals used in RSA.
-	* New features
-	* Compatibility changes
-	  - X509_NAME_get_text_by_{NID,OBJ}() now only succeed if they contain
-	    valid UTF-8 without embedded NUL.
-	  - Moved libtls from ECDSA_METHOD to EC_KEY_METHOD.
-	  - Removed support for ECDH_METHOD and ECDSA_METHOD.
-	  - BN_is_prime{,_fasttest}_ex() refuse to check numbers larger than
-	    32 kbits for primality. This mitigates various DoS vectors.
-	  - Comp was removed.
-	  - Dynamic loading of conf modules is no longer supported.
-	  - DSO was removed and OPENSSL_NO_DSO is defined.
-	  - ENGINE support was removed and OPENSSL_NO_ENGINE is set. In spite
-	    of this, some stub functions are provided to avoid patching some
-	    applications that do not honor OPENSSL_NO_ENGINE.
-	  - It is no longer possible to make the library use your own error
-	    stack or ex_data implementation.
-	* Bug fixes
-	  - Fixed aliasing issue in BN_mod_inverse().
-	  - Made CRYPTO_get_ex_new_index() not return 0 to allow applications
-	    to use *_{get,set}_app_data() and *_{get,set}_ex_data() alongside
-	    each other.
-	  - Made EVP_PKEY_set1_hkdf_key() fail on a NULL key.
-	  - Plugged leaks in BIO_chain_dup().
-	  - Fixed numerous leaks and other minor bugs in RSA, DH, DSA and EC
-	    ASN.1 methods. Unified the coding style.
-	  - On socket errors in the poll loop, netcat could issue system calls
-	    on invalidated file descriptors.
-	* Documentation improvements
-	  - Made it very explicit that the verify callback should not be used.
-	  - Called out that the CRL lastUpdate is standardized as thisUpdate.
-	* Testing and Proactive Security
-	  - As always, new test coverage is added as bugs are fixed and subsystems
-	    are cleaned up.
-	* Security fixes
-	  - Disabled TLSv1.0 and TLSv1.1 in libssl so that they may no longer
-	    be selected for use.
-
 3.8.0 - Development release

 	* Portable changes
 	  - Extended the endian.h compat header with hto* and *toh macros.
 	  - Adapted more tests to the portable framework.
-	  - Internal tools are now statically linked.
 	* Internal improvements
 	  - Improved sieve of Eratosthenes script used for generating a table
 	    of small primes.
@@ -187,14 +95,6 @@ LibreSSL Portable Release Notes:
 	  - As always, new test coverage is added as bugs are fixed and subsystems
 	    are cleaned up.

-3.7.3 - Bug and reliability fixes
-
-	* Bug fix
-	  - Hostflags in the verify parameters would not propagate from an
-	    SSL_CTX to newly created SSL.
-	* Reliability fix
-	  - A double free or use after free could occur after SSL_clear(3).
-
 3.7.2 - Stable release

 	* Portable changes
@@ -309,20 +209,6 @@ LibreSSL Portable Release Notes:
 	    support for EVP_PKEY_ED25519, EVP_PKEY_HMAC and EVP_PKEY_X25519.
 	    Poly1305 is not currently supported via this interface.

-3.6.3 - Bug and reliability fixes
-
-	* Bug fix
-	  - Hostflags in the verify parameters would not propagate from an
-	    SSL_CTX to newly created SSL.
-	* Reliability fix
-	  - A double free or use after free could occur after SSL_clear(3).
-
-3.6.2 - Security release
-
-	* Security fix
-	  - A malicious certificate revocation list or timestamp response token
-	    would allow an attacker to read arbitrary memory.
-
 3.6.1 - Stable release

 	* Bug fixes
--- a/LibreSSLConfig.cmake.in
+++ b/LibreSSLConfig.cmake.in
@@ -1,33 +0,0 @@
-@PACKAGE_INIT@
-
-set(LIBRESSL_VERSION @VERSION@)
-set_and_check(LIBRESSL_INCLUDE_DIR @PACKAGE_INCLUDE_DIRECTORY@)
-
-if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake")
-  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-Crypto.cmake")
-  set(LIBRESSL_CRYPTO_LIBRARY LibreSSL::Crypto)
-endif()
-
-if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake")
-  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-SSL.cmake")
-  set(LIBRESSL_SSL_LIBRARY LibreSSL::SSL)
-endif()
-
-if(EXISTS "${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake")
-  include("${CMAKE_CURRENT_LIST_DIR}/LibreSSL-TLS.cmake")
-  set(LIBRESSL_TLS_LIBRARY LibreSSL::TLS)
-endif()
-
-set(LIBRESSL_LIBRARIES
-  ${LIBRESSL_CRYPTO_LIBRARY}
-  ${LIBRESSL_SSL_LIBRARY}
-  ${LIBRESSL_TLS_LIBRARY}
-)
-
-check_required_components(
-  Crypto
-  SSL
-  TLS
-)
-
-set(LIBRESSL_FOUND TRUE)
--- a/Makefile.am
+++ b/Makefile.am
@@ -11,7 +11,7 @@ pkgconfig_DATA += libcrypto.pc libssl.pc openssl.pc
 endif

 EXTRA_DIST = README.md README.windows VERSION config scripts
-EXTRA_DIST += CMakeLists.txt cmake_export_symbol.cmake cmake_uninstall.cmake.in FindLibreSSL.cmake LibreSSLConfig.cmake.in
+EXTRA_DIST += CMakeLists.txt cmake_export_symbol.cmake cmake_uninstall.cmake.in FindLibreSSL.cmake
 EXTRA_DIST += cert.pem openssl.cnf x509v3.cnf

 .PHONY: install_sw
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ This is a somewhat hacky port of the LibreSSL build system to Zig. It builds Lib

 Notes:

-1. In order for this to work, `.\update.sh` must have first been run to bring in the LibreSSL OpenBSD sources. (Or, if you trust me, you may use the `zig-3.8.1` branch which has the upstream sources committed to the repository, for ease of use with the Zig package manager).
+1. In order for this to work, `.\update.sh` must have first been run to bring in the LibreSSL OpenBSD sources.

 2. I don't know if this causes LibreSSL to be compiled in a way that Compromises Its Cryptographic Integrity. Hopefully it is not even possible to do such a thing in the first place. But I am not an expert, and I ain't looking to port the tests.

--- a/README.windows
+++ b/README.windows
@@ -55,11 +55,11 @@ cv2pdb to generate Visual Studio and windbg compatible debug files. cv2pdb is a
 tool developed for the D language and can be found here:
 https://github.com/rainers/cv2pdb

-The mingw-w64 code is largely, but not 100%, compatible with code built from
-Visual Studio. Notably, FILE * pointers cannot be shared between code built for
-Mingw-w64 and Visual Studio.
+Pre-built Windows binaries are available with LibreSSL releases if you do not
+have a mingw-w64 build environment. Mingw-w64 code is largely, but not 100%,
+compatible with code built from Visual Studio. Notably, FILE * pointers cannot
+be shared between code built for Mingw-w64 and Visual Studio.

-As of LibreSSL 2.2.2, Visual Studio Native builds can also be produced using
-CMake. This produces ABI-compatible libraries for linking with native code
-generated by Visual Studio. Currently tested versions are VS 2019 and 2022,
-though earlier versions may work as well.
+As of LibreSSL 2.2.2, Visual Studio Native builds can be produced using CMake.
+This produces ABI-compatible libraries for linking with native code generated
+by Visual Studio.
--- a/apps/nc/CMakeLists.txt
+++ b/apps/nc/CMakeLists.txt
@@ -36,14 +36,8 @@ else()
 endif()

 add_executable(nc ${NC_SRC})
-target_include_directories(nc
-	PRIVATE
-		.
-		./compat
-		../../include/compat
-	PUBLIC
-		../../include
-		${CMAKE_BINARY_DIR}/include)
+target_include_directories(nc PUBLIC ../../include)
+target_include_directories(nc PRIVATE . ./compat ../../include/compat)
 target_link_libraries(nc ${LIBTLS_LIBS})

 if(ENABLE_NC)
--- a/apps/ocspcheck/CMakeLists.txt
+++ b/apps/ocspcheck/CMakeLists.txt
@@ -8,9 +8,9 @@ set(

 check_function_exists(memmem HAVE_MEMMEM)
 if(HAVE_MEMMEM)
-	add_definitions(-DHAVE_MEMMEM)
+        add_definitions(-DHAVE_MEMMEM)
 else()
-	set(OCSPCHECK_SRC ${OCSPCHECK_SRC} compat/memmem.c)
+        set(OCSPCHECK_SRC ${OCSPCHECK_SRC} compat/memmem.c)
 endif()

 if(NOT "${OPENSSLDIR}" STREQUAL "")
@@ -20,12 +20,8 @@ else()
 endif()

 add_executable(ocspcheck ${OCSPCHECK_SRC})
-target_include_directories(ocspcheck
-	PRIVATE
-		../../include/compat
-	PUBLIC
-		../../include
-		${CMAKE_BINARY_DIR}/include)
+target_include_directories(ocspcheck PUBLIC ../../include)
+target_include_directories(ocspcheck PRIVATE . ./compat ../../include/compat)
 target_link_libraries(ocspcheck tls ${OPENSSL_LIBS})

 if(ENABLE_LIBRESSL_INSTALL)
--- a/apps/openssl/CMakeLists.txt
+++ b/apps/openssl/CMakeLists.txt
@@ -61,20 +61,15 @@ if(WIN32)
 endif()

 if(CMAKE_SYSTEM_NAME MATCHES "Darwin")
-	check_function_exists(clock_gettime HAVE_CLOCK_GETTIME)
-	if(NOT HAVE_CLOCK_GETTIME)
-			set(OPENSSL_SRC ${OPENSSL_SRC} compat/clock_gettime_osx.c)
-	endif()
+        check_function_exists(clock_gettime HAVE_CLOCK_GETTIME)
+        if(NOT HAVE_CLOCK_GETTIME)
+                set(OPENSSL_SRC ${OPENSSL_SRC} compat/clock_gettime_osx.c)
+        endif()
 endif()

 add_executable(openssl ${OPENSSL_SRC})
-target_include_directories(openssl
-	PRIVATE
-		.
-		../../include/compat
-	PUBLIC
-		../../include
-		${CMAKE_BINARY_DIR}/include)
+target_include_directories(openssl PUBLIC ../../include)
+target_include_directories(openssl PRIVATE . ../../include/compat)
 target_link_libraries(openssl ${OPENSSL_LIBS})

 if(ENABLE_LIBRESSL_INSTALL)
--- a/build.zig
+++ b/build.zig
@@ -234,22 +234,23 @@ pub fn libresslBuild(
        else => @panic("unsupported target OS"),
    }

-    const conf_header = switch (tinfo.cpu.arch) {
-        .aarch64, .aarch64_be, .aarch64_32 => source_header_prefix ++ "arch/aarch64/opensslconf.h",
-        .x86 => source_header_prefix ++ "arch/i386/opensslconf.h",
-        .riscv64 => source_header_prefix ++ "arch/riscv64/opensslconf.h",
-        .x86_64 => source_header_prefix ++ "arch/amd64/opensslconf.h",
+    const header = switch (tinfo.cpu.arch) {
+        .aarch64, .aarch64_be, .aarch64_32 => install_header_prefix ++ "arch/aarch64/opensslconf.h",
+        .x86 => install_header_prefix ++ "arch/i386/opensslconf.h",
+        .riscv64 => install_header_prefix ++ "arch/riscv64/opensslconf.h",
+        .x86_64 => install_header_prefix ++ "arch/amd64/opensslconf.h",

        else => @panic("unsupported target CPU arch"),
    };

-    libressl_libs.libcrypto.installHeader(conf_header, "openssl/opensslconf.h");
-    libressl_libs.libssl.installHeader(conf_header, "openssl/opensslconf.h");
-    libressl_libs.libtls.installHeader(conf_header, "openssl/opensslconf.h");
+    // TODO: can we just add this as an install header instead? It's needed during this
+    // build. This mutates the source tree, which is really gross.
+    const include_dir = try b.build_root.handle.openDir(install_header_prefix ++ "openssl", .{});
+    try b.build_root.handle.copyFile(header, include_dir, "opensslconf.h", .{});

    try libressl_libs.header_search(
        b,
-        source_header_prefix,
+        install_header_prefix,
        &.{
            .{ .starts_with = "compat" },
            .{ .starts_with = "arch" },
@@ -346,7 +347,7 @@ const SkipSpec = union(enum) {

 const base_src_prefix = "./";
 const libcrypto_src_prefix = base_src_prefix ++ "crypto/";
-const source_header_prefix = base_src_prefix ++ "include/";
+const install_header_prefix = base_src_prefix ++ "include/";
 const libssl_src_prefix = base_src_prefix ++ "ssl/";
 const libtls_src_prefix = base_src_prefix ++ "tls/";

@@ -380,8 +381,8 @@ const libcrypto_include_paths = [_][]const u8{
    // these are order-dependent and they have to go after the "hidden" directory
    // because the "openssl" include directory is masked inside the "hidden" directory
    // in the source tree. cool.
-    source_header_prefix ++ "compat",
-    source_header_prefix,
+    install_header_prefix ++ "compat",
+    install_header_prefix,
 };

 // these are used on armv4 with asm, or a nonasm build
@@ -533,6 +534,7 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "aes/aes_ctr.c",
    libcrypto_src_prefix ++ "aes/aes_ecb.c",
    libcrypto_src_prefix ++ "aes/aes_ige.c",
+    libcrypto_src_prefix ++ "aes/aes_misc.c",
    libcrypto_src_prefix ++ "aes/aes_ofb.c",
    libcrypto_src_prefix ++ "aes/aes_wrap.c",
    libcrypto_src_prefix ++ "asn1/a_bitstr.c",
@@ -569,6 +571,7 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "asn1/p5_pbev2.c",
    libcrypto_src_prefix ++ "asn1/p8_pkey.c",
    libcrypto_src_prefix ++ "asn1/t_crl.c",
+    libcrypto_src_prefix ++ "asn1/t_pkey.c",
    libcrypto_src_prefix ++ "asn1/t_req.c",
    libcrypto_src_prefix ++ "asn1/t_spki.c",
    libcrypto_src_prefix ++ "asn1/t_x509.c",
@@ -621,6 +624,7 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "bio/bss_null.c",
    libcrypto_src_prefix ++ "bio/bss_sock.c",
    libcrypto_src_prefix ++ "bn/bn_add.c",
+    libcrypto_src_prefix ++ "bn/bn_blind.c",
    libcrypto_src_prefix ++ "bn/bn_bpsw.c",
    libcrypto_src_prefix ++ "bn/bn_const.c",
    libcrypto_src_prefix ++ "bn/bn_convert.c",
@@ -637,8 +641,6 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "bn/bn_mont.c",
    libcrypto_src_prefix ++ "bn/bn_mul.c",
    libcrypto_src_prefix ++ "bn/bn_prime.c",
-    libcrypto_src_prefix ++ "bn/bn_primitives.c",
-    libcrypto_src_prefix ++ "bn/bn_print.c",
    libcrypto_src_prefix ++ "bn/bn_rand.c",
    libcrypto_src_prefix ++ "bn/bn_recp.c",
    libcrypto_src_prefix ++ "bn/bn_shift.c",
@@ -646,6 +648,7 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "bn/bn_sqr.c",
    libcrypto_src_prefix ++ "bn/bn_word.c",
    libcrypto_src_prefix ++ "buffer/buf_err.c",
+    libcrypto_src_prefix ++ "buffer/buf_str.c",
    libcrypto_src_prefix ++ "buffer/buffer.c",
    libcrypto_src_prefix ++ "bytestring/bs_ber.c",
    libcrypto_src_prefix ++ "bytestring/bs_cbb.c",
@@ -666,6 +669,7 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "cmac/cmac.c",
    libcrypto_src_prefix ++ "cms/cms_asn1.c",
    libcrypto_src_prefix ++ "cms/cms_att.c",
+    libcrypto_src_prefix ++ "cms/cms_cd.c",
    libcrypto_src_prefix ++ "cms/cms_dd.c",
    libcrypto_src_prefix ++ "cms/cms_enc.c",
    libcrypto_src_prefix ++ "cms/cms_env.c",
@@ -677,6 +681,10 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "cms/cms_pwri.c",
    libcrypto_src_prefix ++ "cms/cms_sd.c",
    libcrypto_src_prefix ++ "cms/cms_smime.c",
+    libcrypto_src_prefix ++ "comp/c_rle.c",
+    libcrypto_src_prefix ++ "comp/c_zlib.c",
+    libcrypto_src_prefix ++ "comp/comp_err.c",
+    libcrypto_src_prefix ++ "comp/comp_lib.c",
    libcrypto_src_prefix ++ "conf/conf_api.c",
    libcrypto_src_prefix ++ "conf/conf_def.c",
    libcrypto_src_prefix ++ "conf/conf_err.c",
@@ -736,6 +744,11 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "dsa/dsa_ossl.c",
    libcrypto_src_prefix ++ "dsa/dsa_pmeth.c",
    libcrypto_src_prefix ++ "dsa/dsa_prn.c",
+    libcrypto_src_prefix ++ "dso/dso_dlfcn.c",
+    libcrypto_src_prefix ++ "dso/dso_err.c",
+    libcrypto_src_prefix ++ "dso/dso_lib.c",
+    libcrypto_src_prefix ++ "dso/dso_null.c",
+    libcrypto_src_prefix ++ "dso/dso_openssl.c",
    libcrypto_src_prefix ++ "ec/ec_ameth.c",
    libcrypto_src_prefix ++ "ec/ec_asn1.c",
    libcrypto_src_prefix ++ "ec/ec_check.c",
@@ -754,9 +767,38 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "ec/ecp_oct.c",
    libcrypto_src_prefix ++ "ec/ecp_smpl.c",
    libcrypto_src_prefix ++ "ec/ecx_methods.c",
-    libcrypto_src_prefix ++ "ecdh/ecdh.c",
-    libcrypto_src_prefix ++ "ecdsa/ecdsa.c",
-    libcrypto_src_prefix ++ "engine/engine_stubs.c",
+    libcrypto_src_prefix ++ "ecdh/ecdh_kdf.c",
+    libcrypto_src_prefix ++ "ecdh/ech_err.c",
+    libcrypto_src_prefix ++ "ecdh/ech_key.c",
+    libcrypto_src_prefix ++ "ecdh/ech_lib.c",
+    libcrypto_src_prefix ++ "ecdsa/ecs_asn1.c",
+    libcrypto_src_prefix ++ "ecdsa/ecs_err.c",
+    libcrypto_src_prefix ++ "ecdsa/ecs_lib.c",
+    libcrypto_src_prefix ++ "ecdsa/ecs_ossl.c",
+    libcrypto_src_prefix ++ "engine/eng_all.c",
+    libcrypto_src_prefix ++ "engine/eng_cnf.c",
+    libcrypto_src_prefix ++ "engine/eng_ctrl.c",
+    libcrypto_src_prefix ++ "engine/eng_dyn.c",
+    libcrypto_src_prefix ++ "engine/eng_err.c",
+    libcrypto_src_prefix ++ "engine/eng_fat.c",
+    libcrypto_src_prefix ++ "engine/eng_init.c",
+    libcrypto_src_prefix ++ "engine/eng_lib.c",
+    libcrypto_src_prefix ++ "engine/eng_list.c",
+    libcrypto_src_prefix ++ "engine/eng_openssl.c",
+    libcrypto_src_prefix ++ "engine/eng_pkey.c",
+    libcrypto_src_prefix ++ "engine/eng_table.c",
+    libcrypto_src_prefix ++ "engine/tb_asnmth.c",
+    libcrypto_src_prefix ++ "engine/tb_cipher.c",
+    libcrypto_src_prefix ++ "engine/tb_dh.c",
+    libcrypto_src_prefix ++ "engine/tb_digest.c",
+    libcrypto_src_prefix ++ "engine/tb_dsa.c",
+    libcrypto_src_prefix ++ "engine/tb_ecdh.c",
+    libcrypto_src_prefix ++ "engine/tb_ecdsa.c",
+    libcrypto_src_prefix ++ "engine/tb_eckey.c",
+    libcrypto_src_prefix ++ "engine/tb_pkmeth.c",
+    libcrypto_src_prefix ++ "engine/tb_rand.c",
+    libcrypto_src_prefix ++ "engine/tb_rsa.c",
+    libcrypto_src_prefix ++ "engine/tb_store.c",
    libcrypto_src_prefix ++ "err/err.c",
    libcrypto_src_prefix ++ "err/err_all.c",
    libcrypto_src_prefix ++ "err/err_prn.c",
@@ -844,8 +886,10 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "kdf/kdf_err.c",
    libcrypto_src_prefix ++ "lhash/lh_stats.c",
    libcrypto_src_prefix ++ "lhash/lhash.c",
-    libcrypto_src_prefix ++ "md4/md4.c",
-    libcrypto_src_prefix ++ "md5/md5.c",
+    libcrypto_src_prefix ++ "md4/md4_dgst.c",
+    libcrypto_src_prefix ++ "md4/md4_one.c",
+    libcrypto_src_prefix ++ "md5/md5_dgst.c",
+    libcrypto_src_prefix ++ "md5/md5_one.c",
    libcrypto_src_prefix ++ "modes/cbc128.c",
    libcrypto_src_prefix ++ "modes/ccm128.c",
    libcrypto_src_prefix ++ "modes/cfb128.c",
@@ -910,11 +954,12 @@ const libcrypto_sources = [_][]const u8{
    libcrypto_src_prefix ++ "rc2/rc2_skey.c",
    libcrypto_src_prefix ++ "rc2/rc2cfb64.c",
    libcrypto_src_prefix ++ "rc2/rc2ofb64.c",
-    libcrypto_src_prefix ++ "ripemd/ripemd.c",
+    libcrypto_src_prefix ++ "ripemd/rmd_dgst.c",
+    libcrypto_src_prefix ++ "ripemd/rmd_one.c",
    libcrypto_src_prefix ++ "rsa/rsa_ameth.c",
    libcrypto_src_prefix ++ "rsa/rsa_asn1.c",
-    libcrypto_src_prefix ++ "rsa/rsa_blinding.c",
    libcrypto_src_prefix ++ "rsa/rsa_chk.c",
+    libcrypto_src_prefix ++ "rsa/rsa_crpt.c",
    libcrypto_src_prefix ++ "rsa/rsa_eay.c",
    libcrypto_src_prefix ++ "rsa/rsa_err.c",
    libcrypto_src_prefix ++ "rsa/rsa_gen.c",
@@ -1018,8 +1063,8 @@ const libssl_include_paths = [_][]const u8{
    // these are order-dependent and they have to go after the "hidden" directory
    // because the "openssl" include directory is masked inside the "hidden" directory
    // in the source tree. cool.
-    source_header_prefix ++ "compat",
-    source_header_prefix,
+    install_header_prefix ++ "compat",
+    install_header_prefix,
 };

 const libssl_sources = [_][]const u8{
@@ -1086,8 +1131,8 @@ const libssl_sources = [_][]const u8{

 const libtls_include_paths = [_][]const u8{
    libssl_src_prefix,
-    source_header_prefix ++ "compat",
-    source_header_prefix,
+    install_header_prefix ++ "compat",
+    install_header_prefix,
 };

 const libtls_sources = [_][]const u8{
--- a/crypto/CMakeLists.txt
+++ b/crypto/CMakeLists.txt
@@ -111,7 +111,6 @@ if(HOST_ASM_MACOSX_X86_64)
 		bn/arch/amd64/word_clz.S
 		bn/arch/amd64/bn_arch.c
 	)
-	add_definitions(-Dendbr64=)
 	add_definitions(-DAES_ASM)
 	add_definitions(-DBSAES_ASM)
 	add_definitions(-DVPAES_ASM)
@@ -257,6 +256,7 @@ set(
 	aes/aes_ctr.c
 	aes/aes_ecb.c
 	aes/aes_ige.c
+	aes/aes_misc.c
 	aes/aes_ofb.c
 	aes/aes_wrap.c
 	asn1/a_bitstr.c
@@ -293,6 +293,7 @@ set(
 	asn1/p5_pbev2.c
 	asn1/p8_pkey.c
 	asn1/t_crl.c
+	asn1/t_pkey.c
 	asn1/t_req.c
 	asn1/t_spki.c
 	asn1/t_x509.c
@@ -345,6 +346,7 @@ set(
 	bio/bss_null.c
 	bio/bss_sock.c
 	bn/bn_add.c
+	bn/bn_blind.c
 	bn/bn_bpsw.c
 	bn/bn_const.c
 	bn/bn_convert.c
@@ -361,8 +363,6 @@ set(
 	bn/bn_mont.c
 	bn/bn_mul.c
 	bn/bn_prime.c
-	bn/bn_primitives.c
-	bn/bn_print.c
 	bn/bn_rand.c
 	bn/bn_recp.c
 	bn/bn_shift.c
@@ -370,6 +370,7 @@ set(
 	bn/bn_sqr.c
 	bn/bn_word.c
 	buffer/buf_err.c
+	buffer/buf_str.c
 	buffer/buffer.c
 	bytestring/bs_ber.c
 	bytestring/bs_cbb.c
@@ -390,6 +391,7 @@ set(
 	cmac/cmac.c
 	cms/cms_asn1.c
 	cms/cms_att.c
+	cms/cms_cd.c
 	cms/cms_dd.c
 	cms/cms_enc.c
 	cms/cms_env.c
@@ -401,6 +403,10 @@ set(
 	cms/cms_pwri.c
 	cms/cms_sd.c
 	cms/cms_smime.c
+	comp/c_rle.c
+	comp/c_zlib.c
+	comp/comp_err.c
+	comp/comp_lib.c
 	conf/conf_api.c
 	conf/conf_def.c
 	conf/conf_err.c
@@ -460,6 +466,11 @@ set(
 	dsa/dsa_ossl.c
 	dsa/dsa_pmeth.c
 	dsa/dsa_prn.c
+	dso/dso_dlfcn.c
+	dso/dso_err.c
+	dso/dso_lib.c
+	dso/dso_null.c
+	dso/dso_openssl.c
 	ec/ec_ameth.c
 	ec/ec_asn1.c
 	ec/ec_check.c
@@ -478,9 +489,38 @@ set(
 	ec/ecp_oct.c
 	ec/ecp_smpl.c
 	ec/ecx_methods.c
-	ecdh/ecdh.c
-	ecdsa/ecdsa.c
-	engine/engine_stubs.c
+	ecdh/ecdh_kdf.c
+	ecdh/ech_err.c
+	ecdh/ech_key.c
+	ecdh/ech_lib.c
+	ecdsa/ecs_asn1.c
+	ecdsa/ecs_err.c
+	ecdsa/ecs_lib.c
+	ecdsa/ecs_ossl.c
+	engine/eng_all.c
+	engine/eng_cnf.c
+	engine/eng_ctrl.c
+	engine/eng_dyn.c
+	engine/eng_err.c
+	engine/eng_fat.c
+	engine/eng_init.c
+	engine/eng_lib.c
+	engine/eng_list.c
+	engine/eng_openssl.c
+	engine/eng_pkey.c
+	engine/eng_table.c
+	engine/tb_asnmth.c
+	engine/tb_cipher.c
+	engine/tb_dh.c
+	engine/tb_digest.c
+	engine/tb_dsa.c
+	engine/tb_ecdh.c
+	engine/tb_ecdsa.c
+	engine/tb_eckey.c
+	engine/tb_pkmeth.c
+	engine/tb_rand.c
+	engine/tb_rsa.c
+	engine/tb_store.c
 	err/err.c
 	err/err_all.c
 	err/err_prn.c
@@ -568,8 +608,10 @@ set(
 	kdf/kdf_err.c
 	lhash/lh_stats.c
 	lhash/lhash.c
-	md4/md4.c
-	md5/md5.c
+	md4/md4_dgst.c
+	md4/md4_one.c
+	md5/md5_dgst.c
+	md5/md5_one.c
 	modes/cbc128.c
 	modes/ccm128.c
 	modes/cfb128.c
@@ -634,11 +676,12 @@ set(
 	rc2/rc2_skey.c
 	rc2/rc2cfb64.c
 	rc2/rc2ofb64.c
-	ripemd/ripemd.c
+	ripemd/rmd_dgst.c
+	ripemd/rmd_one.c
 	rsa/rsa_ameth.c
 	rsa/rsa_asn1.c
-	rsa/rsa_blinding.c
 	rsa/rsa_chk.c
+	rsa/rsa_crpt.c
 	rsa/rsa_eay.c
 	rsa/rsa_err.c
 	rsa/rsa_gen.c
@@ -775,11 +818,6 @@ if(NOT HAVE_FREEZERO)
 	set(EXTRA_EXPORT ${EXTRA_EXPORT} freezero)
 endif()

-if(NOT HAVE_GETOPT)
-	set(CRYPTO_SRC ${CRYPTO_SRC} compat/getopt_long.c)
-	set(EXTRA_EXPORT ${EXTRA_EXPORT} getopt)
-endif()
-
 if(NOT HAVE_GETPAGESIZE)
 	set(CRYPTO_SRC ${CRYPTO_SRC} compat/getpagesize.c)
 endif()
@@ -904,7 +942,7 @@ else()
 		   (NOT "${CMAKE_GENERATOR_PLATFORM}" STREQUAL "x64"))
 			add_definitions(-DOPENSSL_NO_ASM)
 		endif()
-	elseif(WIN32 AND NOT MINGW)
+	elseif(WIN32)
 		add_definitions(-DOPENSSL_NO_ASM)
 	endif()
 endif()
@@ -958,8 +996,7 @@ target_include_directories(crypto_obj
 		x509
 		../include/compat
 	PUBLIC
-		../include
-		${CMAKE_BINARY_DIR}/include)
+		../include)

 if(HOST_AARCH64)
 	target_include_directories(crypto_obj PRIVATE bn/arch/aarch64/)
@@ -986,33 +1023,13 @@ add_library(crypto $<TARGET_OBJECTS:crypto_obj> empty.c)
 export_symbol(crypto ${CMAKE_CURRENT_BINARY_DIR}/crypto_p.sym)
 target_link_libraries(crypto ${PLATFORM_LIBS})
 if (WIN32)
-	set(CRYPTO_POSTFIX -${CRYPTO_MAJOR_VERSION} PARENT_SCOPE)
+	set(CRYPTO_POSTFIX -${CRYPTO_MAJOR_VERSION})
 endif()
 set_target_properties(crypto PROPERTIES
 	OUTPUT_NAME crypto${CRYPTO_POSTFIX}
-	ARCHIVE_OUTPUT_NAME crypto${CRYPTO_POSTFIX}
-	EXPORT_NAME Crypto
-	VERSION ${CRYPTO_VERSION}
-	SOVERSION ${CRYPTO_MAJOR_VERSION}
-)
-
-target_include_directories(
-	crypto
-	PUBLIC
-	$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/include>
-	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
-)
-
-install(
-	TARGETS crypto
-	EXPORT Crypto-target
-)
-
-export(
-	EXPORT Crypto-target
-	FILE "${LibreSSL_BINARY_DIR}/LibreSSL-Crypto.cmake"
-	NAMESPACE LibreSSL::
-)
+	ARCHIVE_OUTPUT_NAME crypto${CRYPTO_POSTFIX})
+set_target_properties(crypto PROPERTIES VERSION
+	${CRYPTO_VERSION} SOVERSION ${CRYPTO_MAJOR_VERSION})

 if(ENABLE_LIBRESSL_INSTALL)
 	install(
@@ -1021,12 +1038,6 @@ if(ENABLE_LIBRESSL_INSTALL)
 		LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
 		RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
 	)
-	install(
-		EXPORT Crypto-target
-		FILE "LibreSSL-Crypto.cmake"
-		NAMESPACE LibreSSL::
-		DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
-	)
 endif(ENABLE_LIBRESSL_INSTALL)

 # build static library for regression test
--- a/crypto/Makefile.am
+++ b/crypto/Makefile.am
@@ -236,6 +236,7 @@ libcrypto_la_SOURCES += aes/aes_cfb.c
 libcrypto_la_SOURCES += aes/aes_ctr.c
 libcrypto_la_SOURCES += aes/aes_ecb.c
 libcrypto_la_SOURCES += aes/aes_ige.c
+libcrypto_la_SOURCES += aes/aes_misc.c
 libcrypto_la_SOURCES += aes/aes_ofb.c
 libcrypto_la_SOURCES += aes/aes_wrap.c
 noinst_HEADERS += aes/aes_local.h
@@ -275,6 +276,7 @@ libcrypto_la_SOURCES += asn1/p5_pbe.c
 libcrypto_la_SOURCES += asn1/p5_pbev2.c
 libcrypto_la_SOURCES += asn1/p8_pkey.c
 libcrypto_la_SOURCES += asn1/t_crl.c
+libcrypto_la_SOURCES += asn1/t_pkey.c
 libcrypto_la_SOURCES += asn1/t_req.c
 libcrypto_la_SOURCES += asn1/t_spki.c
 libcrypto_la_SOURCES += asn1/t_x509.c
@@ -346,6 +348,7 @@ noinst_HEADERS += bio/bio_local.h

 # bn
 libcrypto_la_SOURCES += bn/bn_add.c
+libcrypto_la_SOURCES += bn/bn_blind.c
 libcrypto_la_SOURCES += bn/bn_bpsw.c
 libcrypto_la_SOURCES += bn/bn_const.c
 libcrypto_la_SOURCES += bn/bn_convert.c
@@ -362,8 +365,6 @@ libcrypto_la_SOURCES += bn/bn_mod_sqrt.c
 libcrypto_la_SOURCES += bn/bn_mont.c
 libcrypto_la_SOURCES += bn/bn_mul.c
 libcrypto_la_SOURCES += bn/bn_prime.c
-libcrypto_la_SOURCES += bn/bn_primitives.c
-libcrypto_la_SOURCES += bn/bn_print.c
 libcrypto_la_SOURCES += bn/bn_rand.c
 libcrypto_la_SOURCES += bn/bn_recp.c
 libcrypto_la_SOURCES += bn/bn_shift.c
@@ -429,6 +430,7 @@ noinst_HEADERS += bn/arch/amd64/bn_arch.h

 # buffer
 libcrypto_la_SOURCES += buffer/buf_err.c
+libcrypto_la_SOURCES += buffer/buf_str.c
 libcrypto_la_SOURCES += buffer/buffer.c
 noinst_HEADERS += bytestring/bytestring.h

@@ -467,6 +469,7 @@ libcrypto_la_SOURCES += cmac/cmac.c
 # cms
 libcrypto_la_SOURCES += cms/cms_asn1.c
 libcrypto_la_SOURCES += cms/cms_att.c
+libcrypto_la_SOURCES += cms/cms_cd.c
 libcrypto_la_SOURCES += cms/cms_dd.c
 libcrypto_la_SOURCES += cms/cms_enc.c
 libcrypto_la_SOURCES += cms/cms_env.c
@@ -480,6 +483,13 @@ libcrypto_la_SOURCES += cms/cms_sd.c
 libcrypto_la_SOURCES += cms/cms_smime.c
 noinst_HEADERS += cms/cms_local.h

+# comp
+libcrypto_la_SOURCES += comp/c_rle.c
+libcrypto_la_SOURCES += comp/c_zlib.c
+libcrypto_la_SOURCES += comp/comp_err.c
+libcrypto_la_SOURCES += comp/comp_lib.c
+noinst_HEADERS += comp/comp_local.h
+
 # conf
 libcrypto_la_SOURCES += conf/conf_api.c
 libcrypto_la_SOURCES += conf/conf_def.c
@@ -560,6 +570,13 @@ libcrypto_la_SOURCES += dsa/dsa_pmeth.c
 libcrypto_la_SOURCES += dsa/dsa_prn.c
 noinst_HEADERS += dsa/dsa_local.h

+# dso
+libcrypto_la_SOURCES += dso/dso_dlfcn.c
+libcrypto_la_SOURCES += dso/dso_err.c
+libcrypto_la_SOURCES += dso/dso_lib.c
+libcrypto_la_SOURCES += dso/dso_null.c
+libcrypto_la_SOURCES += dso/dso_openssl.c
+
 # ec
 libcrypto_la_SOURCES += ec/ec_ameth.c
 libcrypto_la_SOURCES += ec/ec_asn1.c
@@ -582,14 +599,45 @@ libcrypto_la_SOURCES += ec/ecx_methods.c
 noinst_HEADERS += ec/ec_local.h

 # ecdh
-libcrypto_la_SOURCES += ecdh/ecdh.c
+libcrypto_la_SOURCES += ecdh/ecdh_kdf.c
+libcrypto_la_SOURCES += ecdh/ech_err.c
+libcrypto_la_SOURCES += ecdh/ech_key.c
+libcrypto_la_SOURCES += ecdh/ech_lib.c
+noinst_HEADERS += ecdh/ech_local.h

 # ecdsa
-libcrypto_la_SOURCES += ecdsa/ecdsa.c
-noinst_HEADERS += ecdsa/ecdsa_local.h
+libcrypto_la_SOURCES += ecdsa/ecs_asn1.c
+libcrypto_la_SOURCES += ecdsa/ecs_err.c
+libcrypto_la_SOURCES += ecdsa/ecs_lib.c
+libcrypto_la_SOURCES += ecdsa/ecs_ossl.c
+noinst_HEADERS += ecdsa/ecs_local.h

 # engine
-libcrypto_la_SOURCES += engine/engine_stubs.c
+libcrypto_la_SOURCES += engine/eng_all.c
+libcrypto_la_SOURCES += engine/eng_cnf.c
+libcrypto_la_SOURCES += engine/eng_ctrl.c
+libcrypto_la_SOURCES += engine/eng_dyn.c
+libcrypto_la_SOURCES += engine/eng_err.c
+libcrypto_la_SOURCES += engine/eng_fat.c
+libcrypto_la_SOURCES += engine/eng_init.c
+libcrypto_la_SOURCES += engine/eng_lib.c
+libcrypto_la_SOURCES += engine/eng_list.c
+libcrypto_la_SOURCES += engine/eng_openssl.c
+libcrypto_la_SOURCES += engine/eng_pkey.c
+libcrypto_la_SOURCES += engine/eng_table.c
+libcrypto_la_SOURCES += engine/tb_asnmth.c
+libcrypto_la_SOURCES += engine/tb_cipher.c
+libcrypto_la_SOURCES += engine/tb_dh.c
+libcrypto_la_SOURCES += engine/tb_digest.c
+libcrypto_la_SOURCES += engine/tb_dsa.c
+libcrypto_la_SOURCES += engine/tb_ecdh.c
+libcrypto_la_SOURCES += engine/tb_ecdsa.c
+libcrypto_la_SOURCES += engine/tb_eckey.c
+libcrypto_la_SOURCES += engine/tb_pkmeth.c
+libcrypto_la_SOURCES += engine/tb_rand.c
+libcrypto_la_SOURCES += engine/tb_rsa.c
+libcrypto_la_SOURCES += engine/tb_store.c
+noinst_HEADERS += engine/eng_int.h

 # err
 libcrypto_la_SOURCES += err/err.c
@@ -676,46 +724,10 @@ noinst_HEADERS += gost/gost_local.h

 # hidden
 noinst_HEADERS += hidden/crypto_namespace.h
-noinst_HEADERS += hidden/openssl/asn1.h
-noinst_HEADERS += hidden/openssl/asn1t.h
-noinst_HEADERS += hidden/openssl/bio.h
-noinst_HEADERS += hidden/openssl/bn.h
-noinst_HEADERS += hidden/openssl/buffer.h
-noinst_HEADERS += hidden/openssl/cast.h
-noinst_HEADERS += hidden/openssl/chacha.h
-noinst_HEADERS += hidden/openssl/cmac.h
-noinst_HEADERS += hidden/openssl/cms.h
-noinst_HEADERS += hidden/openssl/conf_api.h
-noinst_HEADERS += hidden/openssl/crypto.h
-noinst_HEADERS += hidden/openssl/ct.h
-noinst_HEADERS += hidden/openssl/curve25519.h
-noinst_HEADERS += hidden/openssl/dh.h
-noinst_HEADERS += hidden/openssl/dsa.h
-noinst_HEADERS += hidden/openssl/ec.h
-noinst_HEADERS += hidden/openssl/err.h
-noinst_HEADERS += hidden/openssl/gost.h
-noinst_HEADERS += hidden/openssl/hkdf.h
 noinst_HEADERS += hidden/openssl/hmac.h
-noinst_HEADERS += hidden/openssl/idea.h
-noinst_HEADERS += hidden/openssl/lhash.h
-noinst_HEADERS += hidden/openssl/md4.h
-noinst_HEADERS += hidden/openssl/md5.h
-noinst_HEADERS += hidden/openssl/modes.h
-noinst_HEADERS += hidden/openssl/objects.h
-noinst_HEADERS += hidden/openssl/ocsp.h
-noinst_HEADERS += hidden/openssl/pem.h
 noinst_HEADERS += hidden/openssl/pkcs12.h
 noinst_HEADERS += hidden/openssl/pkcs7.h
-noinst_HEADERS += hidden/openssl/poly1305.h
-noinst_HEADERS += hidden/openssl/rand.h
-noinst_HEADERS += hidden/openssl/rc2.h
-noinst_HEADERS += hidden/openssl/rsa.h
-noinst_HEADERS += hidden/openssl/sha.h
-noinst_HEADERS += hidden/openssl/sm3.h
-noinst_HEADERS += hidden/openssl/sm4.h
 noinst_HEADERS += hidden/openssl/stack.h
-noinst_HEADERS += hidden/openssl/ts.h
-noinst_HEADERS += hidden/openssl/txt_db.h
 noinst_HEADERS += hidden/openssl/ui.h
 noinst_HEADERS += hidden/openssl/x509.h
 noinst_HEADERS += hidden/openssl/x509_vfy.h
@@ -747,10 +759,14 @@ libcrypto_la_SOURCES += lhash/lh_stats.c
 libcrypto_la_SOURCES += lhash/lhash.c

 # md4
-libcrypto_la_SOURCES += md4/md4.c
+libcrypto_la_SOURCES += md4/md4_dgst.c
+libcrypto_la_SOURCES += md4/md4_one.c
+noinst_HEADERS += md4/md4_local.h

 # md5
-libcrypto_la_SOURCES += md5/md5.c
+libcrypto_la_SOURCES += md5/md5_dgst.c
+libcrypto_la_SOURCES += md5/md5_one.c
+noinst_HEADERS += md5/md5_local.h

 # modes
 libcrypto_la_SOURCES += modes/cbc128.c
@@ -769,6 +785,7 @@ libcrypto_la_SOURCES += objects/obj_err.c
 libcrypto_la_SOURCES += objects/obj_lib.c
 libcrypto_la_SOURCES += objects/obj_xref.c
 noinst_HEADERS += objects/obj_dat.h
+noinst_HEADERS += objects/obj_xref.h

 # ocsp
 libcrypto_la_SOURCES += ocsp/ocsp_asn.c
@@ -844,13 +861,16 @@ noinst_HEADERS += rc2/rc2_local.h
 noinst_HEADERS += rc4/rc4_local.h

 # ripemd
-libcrypto_la_SOURCES += ripemd/ripemd.c
+libcrypto_la_SOURCES += ripemd/rmd_dgst.c
+libcrypto_la_SOURCES += ripemd/rmd_one.c
+noinst_HEADERS += ripemd/rmd_local.h
+noinst_HEADERS += ripemd/rmdconst.h

 # rsa
 libcrypto_la_SOURCES += rsa/rsa_ameth.c
 libcrypto_la_SOURCES += rsa/rsa_asn1.c
-libcrypto_la_SOURCES += rsa/rsa_blinding.c
 libcrypto_la_SOURCES += rsa/rsa_chk.c
+libcrypto_la_SOURCES += rsa/rsa_crpt.c
 libcrypto_la_SOURCES += rsa/rsa_eay.c
 libcrypto_la_SOURCES += rsa/rsa_err.c
 libcrypto_la_SOURCES += rsa/rsa_gen.c
@@ -877,6 +897,7 @@ noinst_HEADERS += sha/sha3_internal.h

 # sm3
 libcrypto_la_SOURCES += sm3/sm3.c
+noinst_HEADERS += sm3/sm3_local.h

 # sm4
 libcrypto_la_SOURCES += sm4/sm4.c
--- a/crypto/Makefile.am.macosx-x86_64
+++ b/crypto/Makefile.am.macosx-x86_64
@@ -34,7 +34,6 @@ ASM_X86_64_MACOSX += bn/arch/amd64/bn_arch.c
 EXTRA_DIST += $(ASM_X86_64_MACOSX)

 if HOST_ASM_MACOSX_X86_64
-libcrypto_la_CPPFLAGS += -Dendbr64=
 libcrypto_la_CPPFLAGS += -DAES_ASM
 libcrypto_la_CPPFLAGS += -DBSAES_ASM
 libcrypto_la_CPPFLAGS += -DVPAES_ASM
--- a/crypto/compat/getopt_long.c
+++ b/crypto/compat/getopt_long.c
@@ -1,528 +0,0 @@
-/*	$OpenBSD: getopt_long.c,v 1.32 2020/05/27 22:25:09 schwarze Exp $	*/
-/*	$NetBSD: getopt_long.c,v 1.15 2002/01/31 22:43:40 tv Exp $	*/
-
-/*
- * Copyright (c) 2002 Todd C. Miller <millert@openbsd.org>
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * Sponsored in part by the Defense Advanced Research Projects
- * Agency (DARPA) and Air Force Research Laboratory, Air Force
- * Materiel Command, USAF, under agreement number F39502-99-1-0512.
- */
-/*-
- * Copyright (c) 2000 The NetBSD Foundation, Inc.
- * All rights reserved.
- *
- * This code is derived from software contributed to The NetBSD Foundation
- * by Dieter Baron and Thomas Klausner.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include <err.h>
-#include <errno.h>
-#include <getopt.h>
-#include <stdlib.h>
-#include <string.h>
-
-#define no_argument        0
-#define required_argument  1
-#define optional_argument  2
-
-struct option {
-    /* name of long option */
-    const char *name;
-    /*
-     * one of no_argument, required_argument, and optional_argument:
-     * whether option takes an argument
-     */
-    int has_arg;
-    /* if not NULL, set *flag to val when option found */
-    int *flag;
-    /* if flag not NULL, value to set *flag to; else return value */
-    int val;
-};
-
-int	opterr = 1;		/* if error message should be printed */
-int	optind = 1;		/* index into parent argv vector */
-int	optopt = '?';		/* character checked for validity */
-int	optreset;		/* reset getopt */
-char    *optarg;		/* argument associated with option */
-
-#if 0
-/* DEF_* only work on initialized (non-COMMON) variables */
-#endif
-
-#define PRINT_ERROR	((opterr) && (*options != ':'))
-
-#define FLAG_PERMUTE	0x01	/* permute non-options to the end of argv */
-#define FLAG_ALLARGS	0x02	/* treat non-options as args to option "-1" */
-#define FLAG_LONGONLY	0x04	/* operate as getopt_long_only */
-
-/* return values */
-#define	BADCH		(int)'?'
-#define	BADARG		((*options == ':') ? (int)':' : (int)'?')
-#define	INORDER 	(int)1
-
-#define	EMSG		""
-
-static int getopt_internal(int, char * const *, const char *,
-			   const struct option *, int *, int);
-static int parse_long_options(char * const *, const char *,
-			      const struct option *, int *, int, int);
-static int gcd(int, int);
-static void permute_args(int, int, int, char * const *);
-
-static char *place = EMSG; /* option letter processing */
-
-/* XXX: set optreset to 1 rather than these two */
-static int nonopt_start = -1; /* first non option argument (for permute) */
-static int nonopt_end = -1;   /* first option after non options (for permute) */
-
-/* Error messages */
-static const char recargchar[] = "option requires an argument -- %c";
-static const char recargstring[] = "option requires an argument -- %s";
-static const char ambig[] = "ambiguous option -- %.*s";
-static const char noarg[] = "option doesn't take an argument -- %.*s";
-static const char illoptchar[] = "unknown option -- %c";
-static const char illoptstring[] = "unknown option -- %s";
-
-/*
- * Compute the greatest common divisor of a and b.
- */
-static int
-gcd(int a, int b)
-{
-	int c;
-
-	c = a % b;
-	while (c != 0) {
-		a = b;
-		b = c;
-		c = a % b;
-	}
-
-	return (b);
-}
-
-/*
- * Exchange the block from nonopt_start to nonopt_end with the block
- * from nonopt_end to opt_end (keeping the same order of arguments
- * in each block).
- */
-static void
-permute_args(int panonopt_start, int panonopt_end, int opt_end,
-	char * const *nargv)
-{
-	int cstart, cyclelen, i, j, ncycle, nnonopts, nopts, pos;
-	char *swap;
-
-	/*
-	 * compute lengths of blocks and number and size of cycles
-	 */
-	nnonopts = panonopt_end - panonopt_start;
-	nopts = opt_end - panonopt_end;
-	ncycle = gcd(nnonopts, nopts);
-	cyclelen = (opt_end - panonopt_start) / ncycle;
-
-	for (i = 0; i < ncycle; i++) {
-		cstart = panonopt_end+i;
-		pos = cstart;
-		for (j = 0; j < cyclelen; j++) {
-			if (pos >= panonopt_end)
-				pos -= nnonopts;
-			else
-				pos += nopts;
-			swap = nargv[pos];
-			((char **)nargv)[pos] = nargv[cstart];
-			((char **)nargv)[cstart] = swap;
-		}
-	}
-}
-
-/*
- * parse_long_options --
- *	Parse long options in argc/argv argument vector.
- * Returns -1 if short_too is set and the option does not match long_options.
- */
-static int
-parse_long_options(char * const *nargv, const char *options,
-	const struct option *long_options, int *idx, int short_too, int flags)
-{
-	char *current_argv, *has_equal;
-	size_t current_argv_len;
-	int i, match, exact_match, second_partial_match;
-
-	current_argv = place;
-	match = -1;
-	exact_match = 0;
-	second_partial_match = 0;
-
-	optind++;
-
-	if ((has_equal = strchr(current_argv, '=')) != NULL) {
-		/* argument found (--option=arg) */
-		current_argv_len = has_equal - current_argv;
-		has_equal++;
-	} else
-		current_argv_len = strlen(current_argv);
-
-	for (i = 0; long_options[i].name; i++) {
-		/* find matching long option */
-		if (strncmp(current_argv, long_options[i].name,
-		    current_argv_len))
-			continue;
-
-		if (strlen(long_options[i].name) == current_argv_len) {
-			/* exact match */
-			match = i;
-			exact_match = 1;
-			break;
-		}
-		/*
-		 * If this is a known short option, don't allow
-		 * a partial match of a single character.
-		 */
-		if (short_too && current_argv_len == 1)
-			continue;
-
-		if (match == -1)	/* first partial match */
-			match = i;
-		else if ((flags & FLAG_LONGONLY) ||
-		    long_options[i].has_arg != long_options[match].has_arg ||
-		    long_options[i].flag != long_options[match].flag ||
-		    long_options[i].val != long_options[match].val)
-			second_partial_match = 1;
-	}
-	if (!exact_match && second_partial_match) {
-		/* ambiguous abbreviation */
-		if (PRINT_ERROR)
-			warnx(ambig, (int)current_argv_len, current_argv);
-		optopt = 0;
-		return (BADCH);
-	}
-	if (match != -1) {		/* option found */
-		if (long_options[match].has_arg == no_argument
-		    && has_equal) {
-			if (PRINT_ERROR)
-				warnx(noarg, (int)current_argv_len,
-				     current_argv);
-			/*
-			 * XXX: GNU sets optopt to val regardless of flag
-			 */
-			if (long_options[match].flag == NULL)
-				optopt = long_options[match].val;
-			else
-				optopt = 0;
-			return (BADARG);
-		}
-		if (long_options[match].has_arg == required_argument ||
-		    long_options[match].has_arg == optional_argument) {
-			if (has_equal)
-				optarg = has_equal;
-			else if (long_options[match].has_arg ==
-			    required_argument) {
-				/*
-				 * optional argument doesn't use next nargv
-				 */
-				optarg = nargv[optind++];
-			}
-		}
-		if ((long_options[match].has_arg == required_argument)
-		    && (optarg == NULL)) {
-			/*
-			 * Missing argument; leading ':' indicates no error
-			 * should be generated.
-			 */
-			if (PRINT_ERROR)
-				warnx(recargstring,
-				    current_argv);
-			/*
-			 * XXX: GNU sets optopt to val regardless of flag
-			 */
-			if (long_options[match].flag == NULL)
-				optopt = long_options[match].val;
-			else
-				optopt = 0;
-			--optind;
-			return (BADARG);
-		}
-	} else {			/* unknown option */
-		if (short_too) {
-			--optind;
-			return (-1);
-		}
-		if (PRINT_ERROR)
-			warnx(illoptstring, current_argv);
-		optopt = 0;
-		return (BADCH);
-	}
-	if (idx)
-		*idx = match;
-	if (long_options[match].flag) {
-		*long_options[match].flag = long_options[match].val;
-		return (0);
-	} else
-		return (long_options[match].val);
-}
-
-/*
- * getopt_internal --
- *	Parse argc/argv argument vector.  Called by user level routines.
- */
-static int
-getopt_internal(int nargc, char * const *nargv, const char *options,
-	const struct option *long_options, int *idx, int flags)
-{
-	char *oli;				/* option letter list index */
-	int optchar, short_too;
-	static int posixly_correct = -1;
-
-	if (options == NULL)
-		return (-1);
-
-	/*
-	 * XXX Some GNU programs (like cvs) set optind to 0 instead of
-	 * XXX using optreset.  Work around this braindamage.
-	 */
-	if (optind == 0)
-		optind = optreset = 1;
-
-	/*
-	 * Disable GNU extensions if POSIXLY_CORRECT is set or options
-	 * string begins with a '+'.
-	 */
-	if (posixly_correct == -1 || optreset)
-		posixly_correct = (getenv("POSIXLY_CORRECT") != NULL);
-	if (*options == '-')
-		flags |= FLAG_ALLARGS;
-	else if (posixly_correct || *options == '+')
-		flags &= ~FLAG_PERMUTE;
-	if (*options == '+' || *options == '-')
-		options++;
-
-	optarg = NULL;
-	if (optreset)
-		nonopt_start = nonopt_end = -1;
-start:
-	if (optreset || !*place) {		/* update scanning pointer */
-		optreset = 0;
-		if (optind >= nargc) {          /* end of argument vector */
-			place = EMSG;
-			if (nonopt_end != -1) {
-				/* do permutation, if we have to */
-				permute_args(nonopt_start, nonopt_end,
-				    optind, nargv);
-				optind -= nonopt_end - nonopt_start;
-			}
-			else if (nonopt_start != -1) {
-				/*
-				 * If we skipped non-options, set optind
-				 * to the first of them.
-				 */
-				optind = nonopt_start;
-			}
-			nonopt_start = nonopt_end = -1;
-			return (-1);
-		}
-		if (*(place = nargv[optind]) != '-' ||
-		    (place[1] == '\0' && strchr(options, '-') == NULL)) {
-			place = EMSG;		/* found non-option */
-			if (flags & FLAG_ALLARGS) {
-				/*
-				 * GNU extension:
-				 * return non-option as argument to option 1
-				 */
-				optarg = nargv[optind++];
-				return (INORDER);
-			}
-			if (!(flags & FLAG_PERMUTE)) {
-				/*
-				 * If no permutation wanted, stop parsing
-				 * at first non-option.
-				 */
-				return (-1);
-			}
-			/* do permutation */
-			if (nonopt_start == -1)
-				nonopt_start = optind;
-			else if (nonopt_end != -1) {
-				permute_args(nonopt_start, nonopt_end,
-				    optind, nargv);
-				nonopt_start = optind -
-				    (nonopt_end - nonopt_start);
-				nonopt_end = -1;
-			}
-			optind++;
-			/* process next argument */
-			goto start;
-		}
-		if (nonopt_start != -1 && nonopt_end == -1)
-			nonopt_end = optind;
-
-		/*
-		 * If we have "-" do nothing, if "--" we are done.
-		 */
-		if (place[1] != '\0' && *++place == '-' && place[1] == '\0') {
-			optind++;
-			place = EMSG;
-			/*
-			 * We found an option (--), so if we skipped
-			 * non-options, we have to permute.
-			 */
-			if (nonopt_end != -1) {
-				permute_args(nonopt_start, nonopt_end,
-				    optind, nargv);
-				optind -= nonopt_end - nonopt_start;
-			}
-			nonopt_start = nonopt_end = -1;
-			return (-1);
-		}
-	}
-
-	/*
-	 * Check long options if:
-	 *  1) we were passed some
-	 *  2) the arg is not just "-"
-	 *  3) either the arg starts with -- we are getopt_long_only()
-	 */
-	if (long_options != NULL && place != nargv[optind] &&
-	    (*place == '-' || (flags & FLAG_LONGONLY))) {
-		short_too = 0;
-		if (*place == '-')
-			place++;		/* --foo long option */
-		else if (*place != ':' && strchr(options, *place) != NULL)
-			short_too = 1;		/* could be short option too */
-
-		optchar = parse_long_options(nargv, options, long_options,
-		    idx, short_too, flags);
-		if (optchar != -1) {
-			place = EMSG;
-			return (optchar);
-		}
-	}
-
-	if ((optchar = (int)*place++) == (int)':' ||
-	    (oli = strchr(options, optchar)) == NULL) {
-		if (!*place)
-			++optind;
-		if (PRINT_ERROR)
-			warnx(illoptchar, optchar);
-		optopt = optchar;
-		return (BADCH);
-	}
-	if (long_options != NULL && optchar == 'W' && oli[1] == ';') {
-		/* -W long-option */
-		if (*place)			/* no space */
-			/* NOTHING */;
-		else if (++optind >= nargc) {	/* no arg */
-			place = EMSG;
-			if (PRINT_ERROR)
-				warnx(recargchar, optchar);
-			optopt = optchar;
-			return (BADARG);
-		} else				/* white space */
-			place = nargv[optind];
-		optchar = parse_long_options(nargv, options, long_options,
-		    idx, 0, flags);
-		place = EMSG;
-		return (optchar);
-	}
-	if (*++oli != ':') {			/* doesn't take argument */
-		if (!*place)
-			++optind;
-	} else {				/* takes (optional) argument */
-		optarg = NULL;
-		if (*place)			/* no white space */
-			optarg = place;
-		else if (oli[1] != ':') {	/* arg not optional */
-			if (++optind >= nargc) {	/* no arg */
-				place = EMSG;
-				if (PRINT_ERROR)
-					warnx(recargchar, optchar);
-				optopt = optchar;
-				return (BADARG);
-			} else
-				optarg = nargv[optind];
-		}
-		place = EMSG;
-		++optind;
-	}
-	/* dump back option letter */
-	return (optchar);
-}
-
-/*
- * getopt --
- *	Parse argc/argv argument vector.
- */
-int
-getopt(int nargc, char * const *nargv, const char *options)
-{
-
-	/*
-	 * We don't pass FLAG_PERMUTE to getopt_internal() since
-	 * the BSD getopt(3) (unlike GNU) has never done this.
-	 *
-	 * Furthermore, since many privileged programs call getopt()
-	 * before dropping privileges it makes sense to keep things
-	 * as simple (and bug-free) as possible.
-	 */
-	return (getopt_internal(nargc, nargv, options, NULL, NULL, 0));
-}
-
-/*
- * getopt_long --
- *	Parse argc/argv argument vector.
- */
-int
-getopt_long(int nargc, char * const *nargv, const char *options,
-    const struct option *long_options, int *idx)
-{
-
-	return (getopt_internal(nargc, nargv, options, long_options, idx,
-	    FLAG_PERMUTE));
-}
-
-/*
- * getopt_long_only --
- *	Parse argc/argv argument vector.
- */
-int
-getopt_long_only(int nargc, char * const *nargv, const char *options,
-    const struct option *long_options, int *idx)
-{
-
-	return (getopt_internal(nargc, nargv, options, long_options, idx,
-	    FLAG_PERMUTE|FLAG_LONGONLY));
-}
--- a/crypto/compat/posix_win.c
+++ b/crypto/compat/posix_win.c
@@ -148,49 +148,6 @@ wsa_errno(int err)
 	return -1;
 }

-/*
- * Employ a similar trick to cpython (pycore_fileutils.h) where the CRT report
- * handler is disabled while checking if a descriptor is a socket or a file
- */
-#if defined _MSC_VER && _MSC_VER >= 1900
-
-#include <crtdbg.h>
-#include <stdlib.h>
-
-static void noop_handler(const wchar_t *expression,	const wchar_t *function,
-    const wchar_t *file, unsigned int line, uintptr_t pReserved)
-{
-	return;
-}
-
-#define BEGIN_SUPPRESS_IPH \
-	_invalid_parameter_handler old_handler = _set_thread_local_invalid_parameter_handler(noop_handler)
-#define END_SUPPRESS_IPH \
-	_set_thread_local_invalid_parameter_handler(old_handler)
-
-#else
-
-#define BEGIN_SUPPRESS_IPH
-#define END_SUPPRESS_IPH
-
-#endif
-
-static int
-is_socket(int fd)
-{
-	intptr_t hd;
-
-	BEGIN_SUPPRESS_IPH;
-	hd = _get_osfhandle(fd);
-	END_SUPPRESS_IPH;
-
-	if (hd == (intptr_t)INVALID_HANDLE_VALUE) {
-		return 1; /* fd is not file descriptor */
-	}
-
-	return 0;
-}
-
 int
 posix_connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
 {
@@ -203,31 +160,24 @@ posix_connect(int sockfd, const struct sockaddr *addr, socklen_t addrlen)
 int
 posix_close(int fd)
 {
-	int rc;
-
-	if (is_socket(fd)) {
-		if ((rc = closesocket(fd)) == SOCKET_ERROR) {
-			int err = WSAGetLastError();
-			rc = wsa_errno(err);
-		}
-	} else {
-		rc = close(fd);
+	if (closesocket(fd) == SOCKET_ERROR) {
+		int err = WSAGetLastError();
+		return (err == WSAENOTSOCK || err == WSAEBADF ||
+		    err == WSANOTINITIALISED) ?
+			close(fd) : wsa_errno(err);
 	}
-	return rc;
+	return 0;
 }

 ssize_t
 posix_read(int fd, void *buf, size_t count)
 {
-	ssize_t rc;
-
-	if (is_socket(fd)) {
-		if ((rc = recv(fd, buf, count, 0)) == SOCKET_ERROR) {
-			int err = WSAGetLastError();
-			rc = wsa_errno(err);
-		}
-	} else {
-		rc = read(fd, buf, count);
+	ssize_t rc = recv(fd, buf, count, 0);
+	if (rc == SOCKET_ERROR) {
+		int err = WSAGetLastError();
+		return (err == WSAENOTSOCK || err == WSAEBADF ||
+		    err == WSANOTINITIALISED) ?
+			read(fd, buf, count) : wsa_errno(err);
 	}
 	return rc;
 }
@@ -235,13 +185,12 @@ posix_read(int fd, void *buf, size_t count)
 ssize_t
 posix_write(int fd, const void *buf, size_t count)
 {
-	ssize_t rc;
-	if (is_socket(fd)) {
-		if ((rc = send(fd, buf, count, 0)) == SOCKET_ERROR) {
-			rc = wsa_errno(WSAGetLastError());
-		}
-	} else {
-		rc = write(fd, buf, count);
+	ssize_t rc = send(fd, buf, count, 0);
+	if (rc == SOCKET_ERROR) {
+		int err = WSAGetLastError();
+		return (err == WSAENOTSOCK || err == WSAEBADF ||
+		    err == WSANOTINITIALISED) ?
+			write(fd, buf, count) : wsa_errno(err);
 	}
 	return rc;
 }
@@ -250,32 +199,17 @@ int
 posix_getsockopt(int sockfd, int level, int optname,
 	void *optval, socklen_t *optlen)
 {
-	int rc;
-	if (is_socket(sockfd)) {
-		rc = getsockopt(sockfd, level, optname, (char *)optval, optlen);
-		if (rc != 0) {
-			rc = wsa_errno(WSAGetLastError());
-		}
-	} else {
-		rc = -1;
-	}
-	return rc;
+	int rc = getsockopt(sockfd, level, optname, (char *)optval, optlen);
+	return rc == 0 ? 0 : wsa_errno(WSAGetLastError());
+
 }

 int
 posix_setsockopt(int sockfd, int level, int optname,
 	const void *optval, socklen_t optlen)
 {
-	int rc;
-	if (is_socket(sockfd)) {
-		rc = setsockopt(sockfd, level, optname, (char *)optval, optlen);
-		if (rc != 0) {
-			rc = wsa_errno(WSAGetLastError());
-		}
-	} else {
-		rc = -1;
-	}
-	return rc;
+	int rc = setsockopt(sockfd, level, optname, (char *)optval, optlen);
+	return rc == 0 ? 0 : wsa_errno(WSAGetLastError());
 }

 uid_t getuid(void)
@@ -307,4 +241,5 @@ int gettimeofday(struct timeval * tp, struct timezone * tzp)
 	tp->tv_usec = (long)(system_time.wMilliseconds * 1000);
 	return 0;
 }
+
 #endif
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -4,20 +4,9 @@ if(ENABLE_LIBRESSL_INSTALL)
 	        PATTERN "CMakeLists.txt" EXCLUDE
 	        PATTERN "compat" EXCLUDE
 	        PATTERN "pqueue.h" EXCLUDE
-	        PATTERN "Makefile*" EXCLUDE
-	        PATTERN "arch" EXCLUDE)
-	install(FILES ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h
-	        DESTINATION "${CMAKE_INSTALL_INCLUDEDIR}/openssl")
+	        PATTERN "Makefile*" EXCLUDE)
 endif(ENABLE_LIBRESSL_INSTALL)

-file(COPY .
-	DESTINATION "${CMAKE_BINARY_DIR}/include"
-	PATTERN "CMakeLists.txt" EXCLUDE
-	PATTERN "compat" EXCLUDE
-	PATTERN "pqueue.h" EXCLUDE
-	PATTERN "Makefile*" EXCLUDE
-	PATTERN "arch" EXCLUDE)
-
 if(HOST_AARCH64)
 	file(READ arch/aarch64/opensslconf.h OPENSSLCONF)
 elseif(HOST_ARM)
@@ -39,4 +28,4 @@ elseif(HOST_SPARC64)
 elseif(HOST_X86_64)
 	file(READ arch/amd64/opensslconf.h OPENSSLCONF)
 endif()
-file(WRITE ${CMAKE_BINARY_DIR}/include/openssl/opensslconf.h "${OPENSSLCONF}")
+file(WRITE openssl/opensslconf.h "${OPENSSLCONF}")
--- a/include/compat/endian.h
+++ b/include/compat/endian.h
@@ -8,9 +8,9 @@

 #if defined(_WIN32)

-#define LITTLE_ENDIAN 1234
+#define LITTLE_ENDIAN  1234
 #define BIG_ENDIAN 4321
-#define PDP_ENDIAN 3412
+#define PDP_ENDIAN	3412

 /*
 * Use GCC and Visual Studio compiler defines to determine endian.
@@ -28,8 +28,8 @@
 #include_next <machine/endian.h>

 #elif defined(__sun) || defined(_AIX) || defined(__hpux)
-#include <arpa/nameser_compat.h>
 #include <sys/types.h>
+#include <arpa/nameser_compat.h>

 #elif defined(__sgi)
 #include <standards.h>
@@ -39,9 +39,10 @@

 #ifndef __STRICT_ALIGNMENT
 #define __STRICT_ALIGNMENT
-#if defined(__i386) || defined(__i386__) || defined(__x86_64) ||               \
-    defined(__x86_64__) || defined(__s390__) || defined(__s390x__) ||          \
-    defined(__aarch64__) ||                                                    \
+#if defined(__i386)    || defined(__i386__)    || \
+    defined(__x86_64)  || defined(__x86_64__)  || \
+    defined(__s390__)  || defined(__s390x__)   || \
+    defined(__aarch64__)                       || \
    ((defined(__arm__) || defined(__arm)) && __ARM_ARCH >= 6)
 #undef __STRICT_ALIGNMENT
 #endif
@@ -51,9 +52,7 @@
 #include <libkern/OSByteOrder.h>
 #define be16toh(x) OSSwapBigToHostInt16((x))
 #define htobe16(x) OSSwapHostToBigInt16((x))
-#define le32toh(x) OSSwapLittleToHostInt32((x))
 #define be32toh(x) OSSwapBigToHostInt32((x))
-#define htole32(x) OSSwapHostToLittleInt32(x)
 #define htobe32(x) OSSwapHostToBigInt32(x)
 #define htole64(x) OSSwapHostToLittleInt64(x)
 #define htobe64(x) OSSwapHostToBigInt64(x)
@@ -66,23 +65,15 @@

 #define be16toh(x) ntohs((x))
 #define htobe16(x) htons((x))
-#define le32toh(x) (x)
 #define be32toh(x) ntohl((x))
-#define htole32(x) (x)
 #define htobe32(x) ntohl((x))
 #define be64toh(x) ntohll((x))

 #if !defined(ntohll)
-#define ntohll(x)                                                              \
-  ((1 == htonl(1))                                                             \
-       ? (x)                                                                   \
-       : ((uint64_t)ntohl((x)&0xFFFFFFFF) << 32) | ntohl((x) >> 32))
+#define ntohll(x) ((1==htonl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32))
 #endif
 #if !defined(htonll)
-#define htonll(x)                                                              \
-  ((1 == ntohl(1))                                                             \
-       ? (x)                                                                   \
-       : ((uint64_t)htonl((x)&0xFFFFFFFF) << 32) | htonl((x) >> 32))
+#define htonll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32))
 #endif

 #define htobe64(x) ntohll((x))
@@ -90,13 +81,13 @@

 #ifdef __linux__
 #if !defined(betoh16)
-#define betoh16(x) be16toh(x)
+#define betoh16	be16toh
 #endif
 #if !defined(betoh32)
-#define betoh32(x) be32toh(x)
+#define betoh32	be32toh
 #endif
 #if !defined(betoh64)
-#define betoh64(x) be64toh(x)
+#define betoh64	be64toh
 #endif
 #endif /* __linux__ */

@@ -105,38 +96,26 @@
 #include <sys/endian.h>
 #endif
 #if !defined(betoh16)
-#define betoh16(x) be16toh(x)
+#define betoh16	be16toh
 #endif
 #if !defined(betoh32)
-#define betoh32(x) be32toh(x)
+#define betoh32	be32toh
 #endif
 #if !defined(betoh64)
-#define betoh64(x) be64toh(x)
+#define betoh64	be64toh
 #endif
 #endif

 #if defined(__NetBSD__)
 #if !defined(betoh16)
-#define betoh16(x) be16toh(x)
+#define betoh16	be16toh
 #endif
 #if !defined(betoh32)
-#define betoh32(x) be32toh(x)
+#define betoh32	be32toh
 #endif
 #if !defined(betoh64)
-#define betoh64(x) be64toh(x)
+#define betoh64	be64toh
 #endif
 #endif

-#if defined(__sun)
-#include <sys/byteorder.h>
-#define be16toh(x) BE_16(x)
-#define htobe16(x) BE_16(x)
-#define le32toh(x) LE_32(x)
-#define be32toh(x) BE_32(x)
-#define htole32(x) LE_32(x)
-#define htobe32(x) BE_32(x)
-#define be64toh(x) BE_64(x)
-#define htobe64(x) BE_64(x)
-#endif
-
 #endif
--- a/include/compat/getopt.h
+++ b/include/compat/getopt.h
@@ -1,50 +0,0 @@
-/*	$OpenBSD: getopt.h,v 1.3 2013/11/22 21:32:49 millert Exp $	*/
-/*	$NetBSD: getopt.h,v 1.4 2000/07/07 10:43:54 ad Exp $	*/
-
-/*-
- * Copyright (c) 2000 The NetBSD Foundation, Inc.
- * All rights reserved.
- *
- * This code is derived from software contributed to The NetBSD Foundation
- * by Dieter Baron and Thomas Klausner.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
- * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
- * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifdef HAVE_GETOPT
-
-#include_next <getopt.h>
-
-#else
-
-#ifndef _GETOPT_DEFINED_
-#define _GETOPT_DEFINED_
-int	 getopt(int, char * const *, const char *);
-
-extern   char *optarg;                  /* getopt(3) external variables */
-extern   int opterr;
-extern   int optind;
-extern   int optopt;
-extern   int optreset;
-#endif
-
-#endif /* HAVE_GETOPT */
--- a/include/compat/stdint.h
+++ b/include/compat/stdint.h
@@ -16,16 +16,4 @@
 #include <limits.h>
 #endif

-#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__bounded__)
-# define __bounded__(x, y, z)
-#endif
-
-#if !defined(HAVE_ATTRIBUTE__DEAD) && !defined(__dead)
-#ifdef _MSC_VER
-#define __dead      __declspec(noreturn)
-#else
-#define __dead      __attribute__((__noreturn__))
-#endif
-#endif
-
 #endif
--- a/include/compat/sys/types.h
+++ b/include/compat/sys/types.h
@@ -45,6 +45,18 @@ typedef SSIZE_T ssize_t;

 #endif

+#if !defined(HAVE_ATTRIBUTE__BOUNDED__) && !defined(__bounded__)
+# define __bounded__(x, y, z)
+#endif
+
+#if !defined(HAVE_ATTRIBUTE__DEAD) && !defined(__dead)
+#ifdef _MSC_VER
+#define __dead      __declspec(noreturn)
+#else
+#define __dead      __attribute__((__noreturn__))
+#endif
+#endif
+
 #ifdef _WIN32
 #define __warn_references(sym,msg)
 #else
--- a/include/compat/unistd.h
+++ b/include/compat/unistd.h
@@ -64,10 +64,6 @@ int getentropy(void *buf, size_t buflen);
 #endif
 #endif

-#ifndef HAVE_GETOPT
-#include <getopt.h>
-#endif
-
 #ifndef HAVE_GETPAGESIZE
 int getpagesize(void);
 #endif
--- a/m4/check-libc.m4
+++ b/m4/check-libc.m4
@@ -11,7 +11,7 @@ AC_CHECK_FUNCS([asprintf freezero memmem])
 AC_CHECK_FUNCS([readpassphrase reallocarray recallocarray])
 AC_CHECK_FUNCS([strlcat strlcpy strndup strnlen strsep strtonum])
 AC_CHECK_FUNCS([timegm _mkgmtime timespecsub])
-AC_CHECK_FUNCS([getopt getprogname syslog syslog_r])
+AC_CHECK_FUNCS([getprogname syslog syslog_r])
 AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [
 	AC_LINK_IFELSE([AC_LANG_PROGRAM([[
 #include <unistd.h>
@@ -25,7 +25,6 @@ AC_CACHE_CHECK([for getpagesize], ac_cv_func_getpagesize, [
 AM_CONDITIONAL([HAVE_ASPRINTF], [test "x$ac_cv_func_asprintf" = xyes])
 AM_CONDITIONAL([HAVE_FREEZERO], [test "x$ac_cv_func_freezero" = xyes])
 AM_CONDITIONAL([HAVE_GETPAGESIZE], [test "x$ac_cv_func_getpagesize" = xyes])
-AM_CONDITIONAL([HAVE_GETOPT], [test "x$ac_cv_func_getopt" = xyes])
 AM_CONDITIONAL([HAVE_MEMMEM], [test "x$ac_cv_func_memmem" = xyes])
 AM_CONDITIONAL([HAVE_READPASSPHRASE], [test "x$ac_cv_func_readpassphrase" = xyes])
 AM_CONDITIONAL([HAVE_REALLOCARRAY], [test "x$ac_cv_func_reallocarray" = xyes])
--- a/man/links
+++ b/man/links
@@ -6,6 +6,9 @@ AES_encrypt.3,AES_cbc_encrypt.3
 AES_encrypt.3,AES_decrypt.3
 AES_encrypt.3,AES_set_decrypt_key.3
 AES_encrypt.3,AES_set_encrypt_key.3
+ASN1_BIT_STRING_num_asc.3,ASN1_BIT_STRING_name_print.3
+ASN1_BIT_STRING_num_asc.3,ASN1_BIT_STRING_set_asc.3
+ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_check.3
 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_get_bit.3
 ASN1_BIT_STRING_set.3,ASN1_BIT_STRING_set_bit.3
 ASN1_INTEGER_get.3,ASN1_ENUMERATED_get.3
@@ -145,6 +148,7 @@ BF_set_key.3,BF_decrypt.3
 BF_set_key.3,BF_ecb_encrypt.3
 BF_set_key.3,BF_encrypt.3
 BF_set_key.3,BF_ofb64_encrypt.3
+BF_set_key.3,BF_options.3
 BIO_accept.3,BIO_get_accept_socket.3
 BIO_accept.3,BIO_get_host_ip.3
 BIO_accept.3,BIO_get_port.3
@@ -175,6 +179,11 @@ BIO_dump.3,BIO_dump_fp.3
 BIO_dump.3,BIO_dump_indent.3
 BIO_dump.3,BIO_dump_indent_fp.3
 BIO_dup_chain.3,BIO_dup_state.3
+BIO_f_asn1.3,BIO_asn1_get_prefix.3
+BIO_f_asn1.3,BIO_asn1_get_suffix.3
+BIO_f_asn1.3,BIO_asn1_set_prefix.3
+BIO_f_asn1.3,BIO_asn1_set_suffix.3
+BIO_f_asn1.3,asn1_ps_func.3
 BIO_f_buffer.3,BIO_get_buffer_num_lines.3
 BIO_f_buffer.3,BIO_set_buffer_read_data.3
 BIO_f_buffer.3,BIO_set_buffer_size.3
@@ -221,6 +230,12 @@ BIO_get_ex_new_index.3,BIO_get_app_data.3
 BIO_get_ex_new_index.3,BIO_get_ex_data.3
 BIO_get_ex_new_index.3,BIO_set_app_data.3
 BIO_get_ex_new_index.3,BIO_set_ex_data.3
+BIO_get_ex_new_index.3,ECDH_get_ex_data.3
+BIO_get_ex_new_index.3,ECDH_get_ex_new_index.3
+BIO_get_ex_new_index.3,ECDH_set_ex_data.3
+BIO_get_ex_new_index.3,ECDSA_get_ex_data.3
+BIO_get_ex_new_index.3,ECDSA_get_ex_new_index.3
+BIO_get_ex_new_index.3,ECDSA_set_ex_data.3
 BIO_get_ex_new_index.3,EC_KEY_get_ex_data.3
 BIO_get_ex_new_index.3,EC_KEY_get_ex_new_index.3
 BIO_get_ex_new_index.3,EC_KEY_set_ex_data.3
@@ -344,9 +359,39 @@ BIO_should_retry.3,BIO_set_retry_reason.3
 BIO_should_retry.3,BIO_should_io_special.3
 BIO_should_retry.3,BIO_should_read.3
 BIO_should_retry.3,BIO_should_write.3
+BN_BLINDING_new.3,BN_BLINDING_convert.3
+BN_BLINDING_new.3,BN_BLINDING_convert_ex.3
+BN_BLINDING_new.3,BN_BLINDING_create_param.3
+BN_BLINDING_new.3,BN_BLINDING_free.3
+BN_BLINDING_new.3,BN_BLINDING_get_flags.3
+BN_BLINDING_new.3,BN_BLINDING_invert.3
+BN_BLINDING_new.3,BN_BLINDING_invert_ex.3
+BN_BLINDING_new.3,BN_BLINDING_set_flags.3
+BN_BLINDING_new.3,BN_BLINDING_thread_id.3
+BN_BLINDING_new.3,BN_BLINDING_update.3
 BN_CTX_new.3,BN_CTX_free.3
 BN_CTX_start.3,BN_CTX_end.3
 BN_CTX_start.3,BN_CTX_get.3
+BN_GF2m_add.3,BN_GF2m_arr2poly.3
+BN_GF2m_add.3,BN_GF2m_cmp.3
+BN_GF2m_add.3,BN_GF2m_mod.3
+BN_GF2m_add.3,BN_GF2m_mod_arr.3
+BN_GF2m_add.3,BN_GF2m_mod_div.3
+BN_GF2m_add.3,BN_GF2m_mod_div_arr.3
+BN_GF2m_add.3,BN_GF2m_mod_exp.3
+BN_GF2m_add.3,BN_GF2m_mod_exp_arr.3
+BN_GF2m_add.3,BN_GF2m_mod_inv.3
+BN_GF2m_add.3,BN_GF2m_mod_inv_arr.3
+BN_GF2m_add.3,BN_GF2m_mod_mul.3
+BN_GF2m_add.3,BN_GF2m_mod_mul_arr.3
+BN_GF2m_add.3,BN_GF2m_mod_solve_quad.3
+BN_GF2m_add.3,BN_GF2m_mod_solve_quad_arr.3
+BN_GF2m_add.3,BN_GF2m_mod_sqr.3
+BN_GF2m_add.3,BN_GF2m_mod_sqr_arr.3
+BN_GF2m_add.3,BN_GF2m_mod_sqrt.3
+BN_GF2m_add.3,BN_GF2m_mod_sqrt_arr.3
+BN_GF2m_add.3,BN_GF2m_poly2arr.3
+BN_GF2m_add.3,BN_GF2m_sub.3
 BN_add.3,BN_div.3
 BN_add.3,BN_exp.3
 BN_add.3,BN_gcd.3
@@ -402,13 +447,10 @@ BN_generate_prime.3,BN_GENCB_set_old.3
 BN_generate_prime.3,BN_generate_prime_ex.3
 BN_generate_prime.3,BN_is_prime_ex.3
 BN_generate_prime.3,BN_is_prime_fasttest_ex.3
-BN_get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_1024.3
-BN_get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_768.3
-BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_1536.3
-BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_2048.3
-BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_3072.3
-BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_4096.3
-BN_get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_6144.3
+BN_get0_nist_prime_521.3,BN_get0_nist_prime_192.3
+BN_get0_nist_prime_521.3,BN_get0_nist_prime_224.3
+BN_get0_nist_prime_521.3,BN_get0_nist_prime_256.3
+BN_get0_nist_prime_521.3,BN_get0_nist_prime_384.3
 BN_mod_mul_montgomery.3,BN_MONT_CTX_copy.3
 BN_mod_mul_montgomery.3,BN_MONT_CTX_free.3
 BN_mod_mul_montgomery.3,BN_MONT_CTX_new.3
@@ -416,9 +458,19 @@ BN_mod_mul_montgomery.3,BN_MONT_CTX_set.3
 BN_mod_mul_montgomery.3,BN_MONT_CTX_set_locked.3
 BN_mod_mul_montgomery.3,BN_from_montgomery.3
 BN_mod_mul_montgomery.3,BN_to_montgomery.3
+BN_mod_mul_reciprocal.3,BN_RECP_CTX_free.3
+BN_mod_mul_reciprocal.3,BN_RECP_CTX_init.3
+BN_mod_mul_reciprocal.3,BN_RECP_CTX_new.3
+BN_mod_mul_reciprocal.3,BN_RECP_CTX_set.3
+BN_mod_mul_reciprocal.3,BN_div_recp.3
+BN_mod_mul_reciprocal.3,BN_reciprocal.3
 BN_new.3,BN_clear.3
 BN_new.3,BN_clear_free.3
 BN_new.3,BN_free.3
+BN_nist_mod_521.3,BN_nist_mod_192.3
+BN_nist_mod_521.3,BN_nist_mod_224.3
+BN_nist_mod_521.3,BN_nist_mod_256.3
+BN_nist_mod_521.3,BN_nist_mod_384.3
 BN_num_bytes.3,BN_num_bits.3
 BN_num_bytes.3,BN_num_bits_word.3
 BN_rand.3,BN_pseudo_rand.3
@@ -441,6 +493,8 @@ BN_zero.3,BN_value_one.3
 BUF_MEM_new.3,BUF_MEM_free.3
 BUF_MEM_new.3,BUF_MEM_grow.3
 BUF_MEM_new.3,BUF_MEM_grow_clean.3
+BUF_MEM_new.3,BUF_reverse.3
+BUF_MEM_new.3,BUF_strdup.3
 CMAC_Init.3,CMAC_CTX_cleanup.3
 CMAC_Init.3,CMAC_CTX_copy.3
 CMAC_Init.3,CMAC_CTX_free.3
@@ -474,11 +528,9 @@ CMS_get0_RecipientInfos.3,CMS_RecipientInfo_type.3
 CMS_get0_SignerInfos.3,CMS_SignerInfo_cert_cmp.3
 CMS_get0_SignerInfos.3,CMS_SignerInfo_get0_signature.3
 CMS_get0_SignerInfos.3,CMS_SignerInfo_get0_signer_id.3
-CMS_get0_SignerInfos.3,CMS_SignerInfo_get_version.3
 CMS_get0_SignerInfos.3,CMS_SignerInfo_set1_signer_cert.3
 CMS_get0_type.3,CMS_get0_content.3
 CMS_get0_type.3,CMS_get0_eContentType.3
-CMS_get0_type.3,CMS_get_version.3
 CMS_get0_type.3,CMS_set1_eContentType.3
 CMS_get1_ReceiptRequest.3,CMS_ReceiptRequest_create0.3
 CMS_get1_ReceiptRequest.3,CMS_ReceiptRequest_get0_values.3
@@ -614,14 +666,21 @@ DSA_sign.3,DSA_sign_setup.3
 DSA_sign.3,DSA_verify.3
 DSA_size.3,DSA_bits.3
 ECDH_compute_key.3,ECDH_size.3
+ECDSA_SIG_new.3,ECDSA_OpenSSL.3
 ECDSA_SIG_new.3,ECDSA_SIG_free.3
 ECDSA_SIG_new.3,ECDSA_SIG_get0.3
 ECDSA_SIG_new.3,ECDSA_SIG_get0_r.3
 ECDSA_SIG_new.3,ECDSA_SIG_get0_s.3
 ECDSA_SIG_new.3,ECDSA_SIG_set0.3
 ECDSA_SIG_new.3,ECDSA_do_sign.3
+ECDSA_SIG_new.3,ECDSA_do_sign_ex.3
 ECDSA_SIG_new.3,ECDSA_do_verify.3
+ECDSA_SIG_new.3,ECDSA_get_default_method.3
+ECDSA_SIG_new.3,ECDSA_set_default_method.3
+ECDSA_SIG_new.3,ECDSA_set_method.3
 ECDSA_SIG_new.3,ECDSA_sign.3
+ECDSA_SIG_new.3,ECDSA_sign_ex.3
+ECDSA_SIG_new.3,ECDSA_sign_setup.3
 ECDSA_SIG_new.3,ECDSA_size.3
 ECDSA_SIG_new.3,ECDSA_verify.3
 ECDSA_SIG_new.3,d2i_ECDSA_SIG.3
@@ -640,8 +699,10 @@ EC_GROUP_copy.3,EC_GROUP_get_cofactor.3
 EC_GROUP_copy.3,EC_GROUP_get_curve_name.3
 EC_GROUP_copy.3,EC_GROUP_get_degree.3
 EC_GROUP_copy.3,EC_GROUP_get_order.3
+EC_GROUP_copy.3,EC_GROUP_get_pentanomial_basis.3
 EC_GROUP_copy.3,EC_GROUP_get_point_conversion_form.3
 EC_GROUP_copy.3,EC_GROUP_get_seed_len.3
+EC_GROUP_copy.3,EC_GROUP_get_trinomial_basis.3
 EC_GROUP_copy.3,EC_GROUP_method_of.3
 EC_GROUP_copy.3,EC_GROUP_order_bits.3
 EC_GROUP_copy.3,EC_GROUP_set_asn1_flag.3
@@ -753,7 +814,8 @@ ENGINE_ctrl.3,ENGINE_set_ctrl_function.3
 ENGINE_get_default_RSA.3,ENGINE_get_cipher_engine.3
 ENGINE_get_default_RSA.3,ENGINE_get_default_DH.3
 ENGINE_get_default_RSA.3,ENGINE_get_default_DSA.3
-ENGINE_get_default_RSA.3,ENGINE_get_default_EC.3
+ENGINE_get_default_RSA.3,ENGINE_get_default_ECDH.3
+ENGINE_get_default_RSA.3,ENGINE_get_default_ECDSA.3
 ENGINE_get_default_RSA.3,ENGINE_get_default_RAND.3
 ENGINE_get_default_RSA.3,ENGINE_get_digest_engine.3
 ENGINE_get_default_RSA.3,ENGINE_get_table_flags.3
@@ -793,7 +855,8 @@ ENGINE_set_RSA.3,ENGINE_CIPHERS_PTR.3
 ENGINE_set_RSA.3,ENGINE_DIGESTS_PTR.3
 ENGINE_set_RSA.3,ENGINE_get_DH.3
 ENGINE_set_RSA.3,ENGINE_get_DSA.3
-ENGINE_set_RSA.3,ENGINE_get_EC.3
+ENGINE_set_RSA.3,ENGINE_get_ECDH.3
+ENGINE_set_RSA.3,ENGINE_get_ECDSA.3
 ENGINE_set_RSA.3,ENGINE_get_RAND.3
 ENGINE_set_RSA.3,ENGINE_get_RSA.3
 ENGINE_set_RSA.3,ENGINE_get_STORE.3
@@ -803,7 +866,8 @@ ENGINE_set_RSA.3,ENGINE_get_digest.3
 ENGINE_set_RSA.3,ENGINE_get_digests.3
 ENGINE_set_RSA.3,ENGINE_set_DH.3
 ENGINE_set_RSA.3,ENGINE_set_DSA.3
-ENGINE_set_RSA.3,ENGINE_set_EC.3
+ENGINE_set_RSA.3,ENGINE_set_ECDH.3
+ENGINE_set_RSA.3,ENGINE_set_ECDSA.3
 ENGINE_set_RSA.3,ENGINE_set_RAND.3
 ENGINE_set_RSA.3,ENGINE_set_STORE.3
 ENGINE_set_RSA.3,ENGINE_set_ciphers.3
@@ -869,11 +933,6 @@ EVP_AEAD_CTX_init.3,EVP_aead_aes_128_gcm.3
 EVP_AEAD_CTX_init.3,EVP_aead_aes_256_gcm.3
 EVP_AEAD_CTX_init.3,EVP_aead_chacha20_poly1305.3
 EVP_AEAD_CTX_init.3,EVP_aead_xchacha20_poly1305.3
-EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_buf_noconst.3
-EVP_CIPHER_CTX_get_cipher_data.3,EVP_CIPHER_CTX_set_cipher_data.3
-EVP_CIPHER_do_all.3,EVP_CIPHER_do_all_sorted.3
-EVP_CIPHER_do_all.3,EVP_MD_do_all.3
-EVP_CIPHER_do_all.3,EVP_MD_do_all_sorted.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_dup.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_free.3
 EVP_CIPHER_meth_new.3,EVP_CIPHER_meth_set_cleanup.3
@@ -893,7 +952,6 @@ EVP_DigestInit.3,EVP_DigestUpdate.3
 EVP_DigestInit.3,EVP_MAX_MD_SIZE.3
 EVP_DigestInit.3,EVP_MD_CTX_block_size.3
 EVP_DigestInit.3,EVP_MD_CTX_cleanup.3
-EVP_DigestInit.3,EVP_MD_CTX_clear_flags.3
 EVP_DigestInit.3,EVP_MD_CTX_copy.3
 EVP_DigestInit.3,EVP_MD_CTX_copy_ex.3
 EVP_DigestInit.3,EVP_MD_CTX_create.3
@@ -902,25 +960,22 @@ EVP_DigestInit.3,EVP_MD_CTX_destroy.3
 EVP_DigestInit.3,EVP_MD_CTX_free.3
 EVP_DigestInit.3,EVP_MD_CTX_init.3
 EVP_DigestInit.3,EVP_MD_CTX_md.3
-EVP_DigestInit.3,EVP_MD_CTX_md_data.3
 EVP_DigestInit.3,EVP_MD_CTX_new.3
-EVP_DigestInit.3,EVP_MD_CTX_pkey_ctx.3
 EVP_DigestInit.3,EVP_MD_CTX_reset.3
-EVP_DigestInit.3,EVP_MD_CTX_set_flags.3
-EVP_DigestInit.3,EVP_MD_CTX_set_pkey_ctx.3
 EVP_DigestInit.3,EVP_MD_CTX_size.3
-EVP_DigestInit.3,EVP_MD_CTX_test_flags.3
 EVP_DigestInit.3,EVP_MD_CTX_type.3
 EVP_DigestInit.3,EVP_MD_block_size.3
-EVP_DigestInit.3,EVP_MD_flags.3
 EVP_DigestInit.3,EVP_MD_pkey_type.3
 EVP_DigestInit.3,EVP_MD_size.3
 EVP_DigestInit.3,EVP_MD_type.3
 EVP_DigestInit.3,EVP_get_digestbyname.3
 EVP_DigestInit.3,EVP_get_digestbynid.3
 EVP_DigestInit.3,EVP_get_digestbyobj.3
+EVP_DigestInit.3,EVP_md5.3
+EVP_DigestInit.3,EVP_md5_sha1.3
 EVP_DigestInit.3,EVP_md_null.3
 EVP_DigestInit.3,EVP_ripemd160.3
+EVP_DigestInit.3,EVP_sha1.3
 EVP_DigestInit.3,EVP_sha224.3
 EVP_DigestInit.3,EVP_sha256.3
 EVP_DigestInit.3,EVP_sha384.3
@@ -946,9 +1001,7 @@ EVP_EncryptInit.3,EVP_CIPHER_CTX_block_size.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_cipher.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_cleanup.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_clear_flags.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_copy.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_ctrl.3
-EVP_EncryptInit.3,EVP_CIPHER_CTX_encrypting.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_flags.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_free.3
 EVP_EncryptInit.3,EVP_CIPHER_CTX_get_app_data.3
@@ -1002,6 +1055,7 @@ EVP_EncryptInit.3,EVP_cast5_cfb.3
 EVP_EncryptInit.3,EVP_cast5_cfb64.3
 EVP_EncryptInit.3,EVP_cast5_ecb.3
 EVP_EncryptInit.3,EVP_cast5_ofb.3
+EVP_EncryptInit.3,EVP_chacha20.3
 EVP_EncryptInit.3,EVP_enc_null.3
 EVP_EncryptInit.3,EVP_get_cipherbyname.3
 EVP_EncryptInit.3,EVP_get_cipherbynid.3
@@ -1018,18 +1072,6 @@ EVP_EncryptInit.3,EVP_rc2_cfb.3
 EVP_EncryptInit.3,EVP_rc2_cfb64.3
 EVP_EncryptInit.3,EVP_rc2_ecb.3
 EVP_EncryptInit.3,EVP_rc2_ofb.3
-EVP_MD_meth_new.3,EVP_MD_meth_dup.3
-EVP_MD_meth_new.3,EVP_MD_meth_free.3
-EVP_MD_meth_new.3,EVP_MD_meth_set_app_datasize.3
-EVP_MD_meth_new.3,EVP_MD_meth_set_cleanup.3
-EVP_MD_meth_new.3,EVP_MD_meth_set_copy.3
-EVP_MD_meth_new.3,EVP_MD_meth_set_ctrl.3
-EVP_MD_meth_new.3,EVP_MD_meth_set_final.3
-EVP_MD_meth_new.3,EVP_MD_meth_set_flags.3
-EVP_MD_meth_new.3,EVP_MD_meth_set_init.3
-EVP_MD_meth_new.3,EVP_MD_meth_set_input_blocksize.3
-EVP_MD_meth_new.3,EVP_MD_meth_set_result_size.3
-EVP_MD_meth_new.3,EVP_MD_meth_set_update.3
 EVP_OpenInit.3,EVP_OpenFinal.3
 EVP_OpenInit.3,EVP_OpenUpdate.3
 EVP_PKCS82PKEY.3,EVP_PKEY2PKCS8.3
@@ -1158,7 +1200,6 @@ EVP_PKEY_set1_RSA.3,EVP_PKEY_set1_DH.3
 EVP_PKEY_set1_RSA.3,EVP_PKEY_set1_DSA.3
 EVP_PKEY_set1_RSA.3,EVP_PKEY_set1_EC_KEY.3
 EVP_PKEY_set1_RSA.3,EVP_PKEY_set_type.3
-EVP_PKEY_set1_RSA.3,EVP_PKEY_set_type_str.3
 EVP_PKEY_set1_RSA.3,EVP_PKEY_type.3
 EVP_PKEY_sign.3,EVP_PKEY_sign_init.3
 EVP_PKEY_size.3,EVP_PKEY_bits.3
@@ -1173,11 +1214,6 @@ EVP_SignInit.3,EVP_SignUpdate.3
 EVP_VerifyInit.3,EVP_VerifyFinal.3
 EVP_VerifyInit.3,EVP_VerifyInit_ex.3
 EVP_VerifyInit.3,EVP_VerifyUpdate.3
-EVP_add_cipher.3,EVP_add_cipher_alias.3
-EVP_add_cipher.3,EVP_add_digest.3
-EVP_add_cipher.3,EVP_add_digest_alias.3
-EVP_add_cipher.3,EVP_delete_cipher_alias.3
-EVP_add_cipher.3,EVP_delete_digest_alias.3
 EVP_aes_128_cbc.3,EVP_aes_128_cbc_hmac_sha1.3
 EVP_aes_128_cbc.3,EVP_aes_128_ccm.3
 EVP_aes_128_cbc.3,EVP_aes_128_cfb.3
@@ -1234,7 +1270,6 @@ EVP_camellia_128_cbc.3,EVP_camellia_256_cfb128.3
 EVP_camellia_128_cbc.3,EVP_camellia_256_cfb8.3
 EVP_camellia_128_cbc.3,EVP_camellia_256_ecb.3
 EVP_camellia_128_cbc.3,EVP_camellia_256_ofb.3
-EVP_chacha20.3,EVP_chacha20_poly1305.3
 EVP_des_cbc.3,EVP_des_cfb.3
 EVP_des_cbc.3,EVP_des_cfb1.3
 EVP_des_cbc.3,EVP_des_cfb64.3
@@ -1258,12 +1293,6 @@ EVP_des_cbc.3,EVP_des_ofb.3
 EVP_des_cbc.3,EVP_desx_cbc.3
 EVP_rc4.3,EVP_rc4_40.3
 EVP_rc4.3,EVP_rc4_hmac_md5.3
-EVP_sha1.3,EVP_md4.3
-EVP_sha1.3,EVP_md5.3
-EVP_sha1.3,EVP_md5_sha1.3
-EVP_sha3_224.3,EVP_sha3_256.3
-EVP_sha3_224.3,EVP_sha3_384.3
-EVP_sha3_224.3,EVP_sha3_512.3
 EVP_sm4_cbc.3,EVP_sm4_cfb.3
 EVP_sm4_cbc.3,EVP_sm4_cfb128.3
 EVP_sm4_cbc.3,EVP_sm4_ctr.3
@@ -1305,13 +1334,15 @@ OBJ_NAME_add.3,OBJ_NAME_get.3
 OBJ_NAME_add.3,OBJ_NAME_init.3
 OBJ_NAME_add.3,OBJ_NAME_new_index.3
 OBJ_NAME_add.3,OBJ_NAME_remove.3
+OBJ_add_sigid.3,OBJ_find_sigid_algs.3
+OBJ_add_sigid.3,OBJ_find_sigid_by_algs.3
+OBJ_add_sigid.3,OBJ_sigid_free.3
 OBJ_create.3,OBJ_add_object.3
 OBJ_create.3,OBJ_cleanup.3
 OBJ_create.3,OBJ_create_objects.3
 OBJ_create.3,OBJ_new_nid.3
 OBJ_create.3,check_defer.3
 OBJ_create.3,obj_cleanup_defer.3
-OBJ_find_sigid_algs.3,OBJ_find_sigid_by_algs.3
 OBJ_nid2obj.3,OBJ_cmp.3
 OBJ_nid2obj.3,OBJ_dup.3
 OBJ_nid2obj.3,OBJ_ln2nid.3
@@ -1578,6 +1609,9 @@ POLICYINFO_new.3,POLICY_MAPPING_free.3
 POLICYINFO_new.3,POLICY_MAPPING_new.3
 POLICYINFO_new.3,USERNOTICE_free.3
 POLICYINFO_new.3,USERNOTICE_new.3
+PROXY_POLICY_new.3,PROXY_CERT_INFO_EXTENSION_free.3
+PROXY_POLICY_new.3,PROXY_CERT_INFO_EXTENSION_new.3
+PROXY_POLICY_new.3,PROXY_POLICY_free.3
 RAND_add.3,RAND_cleanup.3
 RAND_add.3,RAND_poll.3
 RAND_add.3,RAND_seed.3
@@ -2003,6 +2037,13 @@ SSL_want.3,SSL_want_read.3
 SSL_want.3,SSL_want_write.3
 SSL_want.3,SSL_want_x509_lookup.3
 SSL_write.3,SSL_write_ex.3
+SXNET_new.3,SXNETID_free.3
+SXNET_new.3,SXNETID_new.3
+SXNET_new.3,SXNET_free.3
+SXNET_new.3,d2i_SXNET.3
+SXNET_new.3,d2i_SXNETID.3
+SXNET_new.3,i2d_SXNET.3
+SXNET_new.3,i2d_SXNETID.3
 TS_REQ_new.3,TS_ACCURACY_free.3
 TS_REQ_new.3,TS_ACCURACY_new.3
 TS_REQ_new.3,TS_MSG_IMPRINT_free.3
@@ -2278,8 +2319,6 @@ X509_STORE_CTX_set_verify.3,X509_STORE_set_verify.3
 X509_STORE_CTX_set_verify.3,X509_STORE_set_verify_func.3
 X509_STORE_CTX_set_verify_cb.3,X509_STORE_CTX_get_verify_cb.3
 X509_STORE_CTX_set_verify_cb.3,X509_STORE_CTX_verify_cb.3
-X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_certs.3
-X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_crls.3
 X509_STORE_get_by_subject.3,X509_STORE_CTX_get1_issuer.3
 X509_STORE_get_by_subject.3,X509_STORE_CTX_get_by_subject.3
 X509_STORE_get_by_subject.3,X509_STORE_CTX_get_obj_by_subject.3
@@ -2425,6 +2464,14 @@ X509_new.3,X509_chain_up_ref.3
 X509_new.3,X509_dup.3
 X509_new.3,X509_free.3
 X509_new.3,X509_up_ref.3
+X509_policy_check.3,X509_policy_tree_free.3
+X509_policy_tree_get0_policies.3,X509_policy_tree_get0_user_policies.3
+X509_policy_tree_level_count.3,X509_policy_level_get0_node.3
+X509_policy_tree_level_count.3,X509_policy_level_node_count.3
+X509_policy_tree_level_count.3,X509_policy_node_get0_parent.3
+X509_policy_tree_level_count.3,X509_policy_node_get0_policy.3
+X509_policy_tree_level_count.3,X509_policy_node_get0_qualifiers.3
+X509_policy_tree_level_count.3,X509_policy_tree_get0_level.3
 X509_print_ex.3,X509_CERT_AUX_print.3
 X509_print_ex.3,X509_print.3
 X509_print_ex.3,X509_print_ex_fp.3
@@ -2501,8 +2548,6 @@ bn_dump.3,mul.3
 bn_dump.3,mul_add.3
 bn_dump.3,sqr.3
 d2i_ASN1_NULL.3,i2d_ASN1_NULL.3
-d2i_ASN1_OBJECT.3,OBJ_get0_data.3
-d2i_ASN1_OBJECT.3,OBJ_length.3
 d2i_ASN1_OBJECT.3,i2d_ASN1_OBJECT.3
 d2i_ASN1_OCTET_STRING.3,d2i_ASN1_BIT_STRING.3
 d2i_ASN1_OCTET_STRING.3,d2i_ASN1_BMPSTRING.3
@@ -2706,6 +2751,9 @@ d2i_POLICYINFO.3,i2d_NOTICEREF.3
 d2i_POLICYINFO.3,i2d_POLICYINFO.3
 d2i_POLICYINFO.3,i2d_POLICYQUALINFO.3
 d2i_POLICYINFO.3,i2d_USERNOTICE.3
+d2i_PROXY_POLICY.3,d2i_PROXY_CERT_INFO_EXTENSION.3
+d2i_PROXY_POLICY.3,i2d_PROXY_CERT_INFO_EXTENSION.3
+d2i_PROXY_POLICY.3,i2d_PROXY_POLICY.3
 d2i_PrivateKey.3,d2i_AutoPrivateKey.3
 d2i_PrivateKey.3,d2i_PrivateKey_bio.3
 d2i_PrivateKey.3,d2i_PrivateKey_fp.3
@@ -2819,6 +2867,21 @@ d2i_X509_SIG.3,i2d_X509_SIG.3
 des_read_pw.3,EVP_read_pw_string.3
 des_read_pw.3,EVP_read_pw_string_min.3
 des_read_pw.3,des_read_pw_string.3
+get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_1024.3
+get_rfc3526_prime_8192.3,BN_get_rfc2409_prime_768.3
+get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_1536.3
+get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_2048.3
+get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_3072.3
+get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_4096.3
+get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_6144.3
+get_rfc3526_prime_8192.3,BN_get_rfc3526_prime_8192.3
+get_rfc3526_prime_8192.3,get_rfc2409_prime_1024.3
+get_rfc3526_prime_8192.3,get_rfc2409_prime_768.3
+get_rfc3526_prime_8192.3,get_rfc3526_prime_1536.3
+get_rfc3526_prime_8192.3,get_rfc3526_prime_2048.3
+get_rfc3526_prime_8192.3,get_rfc3526_prime_3072.3
+get_rfc3526_prime_8192.3,get_rfc3526_prime_4096.3
+get_rfc3526_prime_8192.3,get_rfc3526_prime_6144.3
 i2a_ASN1_STRING.3,a2i_ASN1_ENUMERATED.3
 i2a_ASN1_STRING.3,a2i_ASN1_INTEGER.3
 i2a_ASN1_STRING.3,a2i_ASN1_STRING.3
--- a/patches/aeadtest.c.patch
+++ b/patches/aeadtest.c.patch
@@ -0,0 +1,15 @@
+--- tests/aeadtest.c.orig	Mon Sep  5 22:30:33 2022
+++ tests/aeadtest.c	Mon Sep  5 23:51:27 2022
+@@ -48,6 +48,12 @@
+ 
+ #define BUF_MAX 1024
+ 
+#ifdef _MSC_VER
+#ifdef IN
+#undef IN
+#endif
+#endif
+
+ /* These are the different types of line that are found in the input file. */
+ enum {
+ 	AEAD = 0,	/* name of the AEAD algorithm. */
--- a/patches/bio.h.patch
+++ b/patches/bio.h.patch
@@ -0,0 +1,35 @@
+--- include/openssl/bio.h.orig	Tue Nov 22 21:08:27 2022
+++ include/openssl/bio.h	Tue Nov 22 21:08:48 2022
+@@ -667,8 +667,24 @@ void BIO_copy_next_retry(BIO *b);
+ 
+ /*long BIO_ghbn_ctrl(int cmd,int iarg,char *parg);*/
+ 
+#ifdef __MINGW_PRINTF_FORMAT
+ int
+ BIO_printf(BIO *bio, const char *format, ...)
+	__attribute__((__format__(__MINGW_PRINTF_FORMAT, 2, 3), __nonnull__(2)));
+int
+BIO_vprintf(BIO *bio, const char *format, va_list args)
+	__attribute__((__format__(__MINGW_PRINTF_FORMAT, 2, 0), __nonnull__(2)));
+int
+BIO_snprintf(char *buf, size_t n, const char *format, ...)
+	__attribute__((__deprecated__, __format__(__MINGW_PRINTF_FORMAT, 3, 4),
+	    __nonnull__(3)));
+int
+BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
+	__attribute__((__deprecated__, __format__(__MINGW_PRINTF_FORMAT, 3, 0),
+	    __nonnull__(3)));
+#else
+int
+BIO_printf(BIO *bio, const char *format, ...)
+ 	__attribute__((__format__(__printf__, 2, 3), __nonnull__(2)));
+ int
+ BIO_vprintf(BIO *bio, const char *format, va_list args)
+@@ -681,6 +697,7 @@ int
+ BIO_vsnprintf(char *buf, size_t n, const char *format, va_list args)
+ 	__attribute__((__deprecated__, __format__(__printf__, 3, 0),
+ 	    __nonnull__(3)));
+#endif
+ 
+ void ERR_load_BIO_strings(void);
+ 
--- a/patches/bn_isqrt.c.patch
+++ b/patches/bn_isqrt.c.patch
@@ -0,0 +1,18 @@
+--- tests/bn_isqrt.c.orig	Fri Dec  9 11:05:26 2022
+++ tests/bn_isqrt.c	Fri Dec  9 11:12:37 2022
+@@ -306,6 +306,7 @@ main(int argc, char *argv[])
+ 	int ch;
+ 	int failed = 0, print = 0;
+ 
+#ifndef _MSC_VER
+ 	while ((ch = getopt(argc, argv, "C")) != -1) {
+ 		switch (ch) {
+ 		case 'C':
+@@ -316,6 +317,7 @@ main(int argc, char *argv[])
+ 			break;
+ 		}
+ 	}
+#endif
+ 
+ 	if (print)
+ 		return check_tables(1);
--- a/patches/handshake_table.c.patch
+++ b/patches/handshake_table.c.patch
@@ -0,0 +1,18 @@
+--- tests/handshake_table.c.orig	Tue Mar 15 11:37:03 2022
+++ tests/handshake_table.c	Mon Mar 21 05:26:15 2022
+@@ -518,6 +518,7 @@
+ 	unsigned int	depth = 0;
+ 	int		ch, graphviz = 0, print = 0;
+ 
+#ifndef _MSC_VER
+ 	while ((ch = getopt(argc, argv, "Cg")) != -1) {
+ 		switch (ch) {
+ 		case 'C':
+@@ -535,6 +536,7 @@
+ 
+ 	if (argc != 0)
+ 		usage();
+#endif
+ 
+ 	if (graphviz && print)
+ 		usage();
--- a/patches/libcrypto.hidden.patch
+++ b/patches/libcrypto.hidden.patch
@@ -0,0 +1,120 @@
+diff -u openbsd/src/lib/libcrypto/hidden/openssl/hmac.h crypto/hidden/openssl/hmac.h
+--- openbsd/src/lib/libcrypto/hidden/openssl/hmac.h	2023-03-15 11:41:37.632580800 -0600
+++ crypto/hidden/openssl/hmac.h	2023-03-15 16:49:29.144080400 -0600
+@@ -18,7 +18,11 @@
+ #ifndef _LIBCRYPTO_HMAC_H_
+ #define _LIBCRYPTO_HMAC_H_
+ 
+#ifdef _MSC_VER
+#include <../include/openssl/hmac.h>
+#else
+ #include_next <openssl/hmac.h>
+#endif
+ #include "crypto_namespace.h"
+ 
+ LCRYPTO_USED(HMAC_CTX_new);
+diff -u openbsd/src/lib/libcrypto/hidden/openssl/pkcs12.h crypto/hidden/openssl/pkcs12.h
+--- openbsd/src/lib/libcrypto/hidden/openssl/pkcs12.h	2023-03-15 11:41:37.648024900 -0600
+++ crypto/hidden/openssl/pkcs12.h	2023-03-15 17:15:36.015981800 -0600
+@@ -18,7 +18,11 @@
+ #ifndef _LIBCRYPTO_PKCS12_H
+ #define _LIBCRYPTO_PKCS12_H
+ 
+#ifdef _MSC_VER
+#include <../include/openssl/pkcs12.h>
+#else
+ #include_next <openssl/pkcs12.h>
+#endif
+ #include "crypto_namespace.h"
+ 
+ LCRYPTO_USED(PKCS12_SAFEBAG_get0_attr);
+diff -u openbsd/src/lib/libcrypto/hidden/openssl/pkcs7.h crypto/hidden/openssl/pkcs7.h
+--- openbsd/src/lib/libcrypto/hidden/openssl/pkcs7.h	2023-03-15 11:41:37.663599200 -0600
+++ crypto/hidden/openssl/pkcs7.h	2023-03-15 16:53:43.232866600 -0600
+@@ -18,7 +18,11 @@
+ #ifndef _LIBCRYPTO_PKCS7_H
+ #define _LIBCRYPTO_PKCS7_H
+ 
+#ifdef _MSC_VER
+#include <../include/openssl/pkcs7.h>
+#else
+ #include_next <openssl/pkcs7.h>
+#endif
+ #include "crypto_namespace.h"
+ 
+ LCRYPTO_USED(PKCS7_ISSUER_AND_SERIAL_new);
+diff -u openbsd/src/lib/libcrypto/hidden/openssl/stack.h crypto/hidden/openssl/stack.h
+--- openbsd/src/lib/libcrypto/hidden/openssl/stack.h	2023-03-15 11:41:37.680453800 -0600
+++ crypto/hidden/openssl/stack.h	2023-03-15 16:49:29.200142600 -0600
+@@ -18,7 +18,11 @@
+ #ifndef _LIBCRYPTO_STACK_H
+ #define _LIBCRYPTO_STACK_H
+ 
+#ifdef _MSC_VER
+#include <../include/openssl/stack.h>
+#else
+ #include_next <openssl/stack.h>
+#endif
+ #include "crypto_namespace.h"
+ 
+ LCRYPTO_USED(sk_num);
+diff -u openbsd/src/lib/libcrypto/hidden/openssl/ui.h crypto/hidden/openssl/ui.h
+--- openbsd/src/lib/libcrypto/hidden/openssl/ui.h	2023-03-15 11:41:37.696291800 -0600
+++ crypto/hidden/openssl/ui.h	2023-03-15 16:49:29.222310800 -0600
+@@ -18,7 +18,11 @@
+ #ifndef _LIBCRYPTO_UI_H
+ #define _LIBCRYPTO_UI_H
+ 
+#ifdef _MSC_VER
+#include <../include/openssl/ui.h>
+#else
+ #include_next <openssl/ui.h>
+#endif
+ #include "crypto_namespace.h"
+ 
+ LCRYPTO_USED(UI_new);
+diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509.h crypto/hidden/openssl/x509.h
+--- openbsd/src/lib/libcrypto/hidden/openssl/x509.h	2023-03-15 11:41:37.713302600 -0600
+++ crypto/hidden/openssl/x509.h	2023-03-15 16:49:29.238904200 -0600
+@@ -18,7 +18,11 @@
+ #ifndef _LIBCRYPTO_X509_H
+ #define _LIBCRYPTO_X509_H
+ 
+#ifdef _MSC_VER
+#include <../include/openssl/x509.h>
+#else
+ #include_next <openssl/x509.h>
+#endif
+ #include "crypto_namespace.h"
+ 
+ LCRYPTO_USED(X509_CRL_up_ref);
+diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509v3.h crypto/hidden/openssl/x509v3.h
+--- openbsd/src/lib/libcrypto/hidden/openssl/x509v3.h	2023-03-15 11:41:37.756379100 -0600
+++ crypto/hidden/openssl/x509v3.h	2023-03-15 16:49:29.264482800 -0600
+@@ -18,7 +18,11 @@
+ #ifndef _LIBCRYPTO_X509V3_H
+ #define _LIBCRYPTO_X509V3_H
+ 
+#ifdef _MSC_VER
+#include <../include/openssl/x509v3.h>
+#else
+ #include_next <openssl/x509v3.h>
+#endif
+ #include "crypto_namespace.h"
+ 
+ LCRYPTO_USED(PROXY_POLICY_new);
+diff -u openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h crypto/hidden/openssl/x509_vfy.h
+--- openbsd/src/lib/libcrypto/hidden/openssl/x509_vfy.h	2023-03-15 11:41:37.735995100 -0600
+++ crypto/hidden/openssl/x509_vfy.h	2023-03-15 16:49:29.300450300 -0600
+@@ -18,7 +18,11 @@
+ #ifndef _LIBCRYPTO_X509_VFY_H
+ #define _LIBCRYPTO_X509_VFY_H
+ 
+#ifdef _MSC_VER
+#include <../include/openssl/x509_vfy.h>
+#else
+ #include_next <openssl/x509_vfy.h>
+#endif
+ #include "crypto_namespace.h"
+ 
+ LCRYPTO_USED(X509_STORE_set_depth);
--- a/patches/libssl.hidden.patch
+++ b/patches/libssl.hidden.patch
@@ -0,0 +1,15 @@
+diff -u openbsd/src/lib/libssl/hidden/openssl/ssl.h ssl/hidden/openssl/ssl.h
+--- openbsd/src/lib/libssl/hidden/openssl/ssl.h	2023-03-15 11:41:52.466146400 -0600
+++ ssl/hidden/openssl/ssl.h	2023-03-15 16:49:29.358377300 -0600
+@@ -18,7 +18,11 @@
+ #ifndef _LIBSSL_SSL_H_
+ #define _LIBSSL_SSL_H_
+ 
+#ifdef _MSC_VER
+#include <../include/openssl/ssl.h>
+#else
+ #include_next <openssl/ssl.h>
+#endif
+ #include "ssl_namespace.h"
+ 
+ LSSL_USED(BIO_f_ssl);
--- a/patches/modes_local.h.patch
+++ b/patches/modes_local.h.patch
@@ -1,16 +1,19 @@
--- crypto/modes/modes_local.h.orig	Sat Jul  8 14:03:53 2023
-+++ crypto/modes/modes_local.h	Sat Jul  8 14:10:56 2023
-@@ -45,6 +45,7 @@
- 			asm ("bswapl %0"				\
+--- crypto/modes/modes_local.h.orig	Tue Nov 14 10:25:15 2017
+++ crypto/modes/modes_local.h	Sat Jan 19 22:19:23 2019
+@@ -45,14 +45,16 @@
+ 			asm ("bswapl %0"		\
 			: "+r"(ret));	ret;		})
 # elif (defined(__arm__) || defined(__arm)) && !defined(__STRICT_ALIGNMENT)
+-#  define BSWAP8(x) ({	u32 lo=(u64)(x)>>32,hi=(x);	\
 +#  if (__ARM_ARCH >= 6)
- #  define BSWAP8(x) ({	u32 lo=(u64)(x)>>32,hi=(x);			\
- 			asm ("rev %0,%0; rev %1,%1"			\
- 			: "+r"(hi),"+r"(lo));				\
-@@ -53,6 +54,7 @@
- 			asm ("rev %0,%1"				\
- 			: "=r"(ret) : "r"((u32)(x)));			\
+#   define BSWAP8(x) ({	u32 lo=(u64)(x)>>32,hi=(x);	\
+ 			asm ("rev %0,%0; rev %1,%1"	\
+ 			: "+r"(hi),"+r"(lo));		\
+ 			(u64)hi<<32|lo;			})
+-#  define BSWAP4(x) ({	u32 ret;			\
+#   define BSWAP4(x) ({	u32 ret;			\
+ 			asm ("rev %0,%1"		\
+ 			: "=r"(ret) : "r"((u32)(x)));	\
 			ret;				})
 +#  endif
 # endif
--- a/patches/netcat.c.patch
+++ b/patches/netcat.c.patch
@@ -1,5 +1,5 @@
--- apps/nc/netcat.c.orig	Tue Aug 15 15:17:28 2023
-+++ apps/nc/netcat.c	Tue Aug 15 15:17:54 2023
+--- apps/nc/netcat.c.orig	Thu Feb  9 18:42:55 2023
+++ apps/nc/netcat.c	Thu Feb  9 18:43:08 2023
@@ -93,9 +93,13 @@ int	zflag;					/* Port Scan Flag */
 int	Dflag;					/* sodebug */
 int	Iflag;					/* TCP receive buffer size */
@@ -100,7 +100,7 @@
 
 		set_common_sockopts(s, res->ai_family);
 
-@@ -1563,11 +1583,13 @@ set_common_sockopts(int s, int af)
+@@ -1557,11 +1577,13 @@ set_common_sockopts(int s, int af)
 {
 	int x = 1;
 
@@ -114,7 +114,7 @@
 	if (Dflag) {
 		if (setsockopt(s, SOL_SOCKET, SO_DEBUG,
 		    &x, sizeof(x)) == -1)
-@@ -1578,9 +1600,16 @@ set_common_sockopts(int s, int af)
+@@ -1572,9 +1594,16 @@ set_common_sockopts(int s, int af)
 		    IP_TOS, &Tflag, sizeof(Tflag)) == -1)
 			err(1, "set IP ToS");
 
@@ -131,7 +131,7 @@
 	}
 	if (Iflag) {
 		if (setsockopt(s, SOL_SOCKET, SO_RCVBUF,
-@@ -1604,13 +1633,17 @@ set_common_sockopts(int s, int af)
+@@ -1598,13 +1627,17 @@ set_common_sockopts(int s, int af)
 	}
 
 	if (minttl != -1) {
@@ -150,7 +150,7 @@
 	}
 }
 
-@@ -1835,15 +1868,19 @@ help(void)
+@@ -1829,15 +1862,19 @@ help(void)
 	\t-P proxyuser\tUsername for proxy authentication\n\
 	\t-p port\t	Specify local port for remote connects\n\
 	\t-R CAfile	CA bundle\n\
--- a/patches/ocsp_test.c.patch
+++ b/patches/ocsp_test.c.patch
@@ -0,0 +1,14 @@
+--- tests/ocsp_test.c.orig	2018-07-24 21:59:17.000000000 -0500
+++ tests/ocsp_test.c	2018-11-07 18:44:43.000000000 -0600
+@@ -35,6 +35,11 @@
+ 	hints.ai_family = AF_INET;
+ 	hints.ai_socktype = SOCK_STREAM;
+
+#ifdef _MSC_VER
+	if (BIO_sock_init() != 1)
+		exit(-1);
+#endif
+
+ 	error = getaddrinfo(host, port, &hints, &res);
+ 	if (error != 0) {
+ 		perror("getaddrinfo()");
--- a/patches/openssl.c.patch
+++ b/patches/openssl.c.patch
@@ -1,6 +1,6 @@
--- apps/openssl/openssl.c.orig	Sat Jun 17 13:06:00 2023
-+++ apps/openssl/openssl.c	Sat Jun 24 04:44:55 2023
-@@ -354,7 +354,9 @@
+--- apps/openssl/openssl.c.orig	Tue Apr 25 16:50:41 2023
+++ apps/openssl/openssl.c	Tue Apr 25 16:51:01 2023
+@@ -358,7 +358,9 @@
 static void
 openssl_startup(void)
 {
--- a/patches/opensslfeatures.h.patch
+++ b/patches/opensslfeatures.h.patch
@@ -1,6 +1,6 @@
--- include/openssl/opensslfeatures.h.orig	Fri Jul 28 06:04:42 2023
-+++ include/openssl/opensslfeatures.h	Fri Jul 28 06:09:00 2023
-@@ -8,6 +8,13 @@
+--- openbsd/src/lib/libcrypto/opensslfeatures.h	2023-03-15 11:41:47.301015100 -0600
+++ include/openssl/opensslfeatures.h	2023-03-15 18:27:57.740024800 -0600
+@@ -7,6 +7,13 @@
 #define LIBRESSL_HAS_TLS1_3
 #define LIBRESSL_HAS_DTLS1_2
 
--- a/patches/speed.c.patch
+++ b/patches/speed.c.patch
@@ -1,5 +1,5 @@
--- apps/openssl/speed.c.orig	Fri Jul 28 06:04:45 2023
-+++ apps/openssl/speed.c	Fri Jul 28 06:09:00 2023
+--- apps/openssl/speed.c.orig	Sun May 21 12:13:46 2023
+++ apps/openssl/speed.c	Sun May 21 12:31:50 2023
@@ -161,7 +161,16 @@ static void
 pkey_print_message(const char *str, const char *str2,
     long num, int bits, int sec);
@@ -74,7 +74,7 @@
 	if (!mr) {
 		fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_VERSION));
 		fprintf(stdout, "%s\n", SSLeay_version(SSLEAY_BUILT_ON));
-@@ -1898,11 +1917,15 @@ pkey_print_message(const char *str, const char *str2, 
+@@ -1915,11 +1934,15 @@ pkey_print_message(const char *str, const char *str2, 
 static void
 print_result(int alg, int run_no, int count, double time_used)
 {
@@ -90,7 +90,7 @@
 static char *
 sstrsep(char **string, const char *delim)
 {
-@@ -2109,4 +2132,5 @@ do_multi(int multi)
+@@ -2126,4 +2149,5 @@ do_multi(int multi)
 	free(fds);
 	return 1;
 }
--- a/patches/ssl_txt.c.patch
+++ b/patches/ssl_txt.c.patch
@@ -0,0 +1,21 @@
+--- ssl/ssl_txt.c.orig	Wed Jun 22 11:37:59 2022
+++ ssl/ssl_txt.c	Wed Jun 22 11:37:59 2022
+@@ -82,6 +82,7 @@
+  * OTHERWISE.
+  */
+ 
+#include <inttypes.h>
+ #include <stdio.h>
+ 
+ #include <openssl/buffer.h>
+@@ -174,8 +174,8 @@
+ 	}
+ 
+ 	if (x->time != 0) {
+-		if (BIO_printf(bp, "\n    Start Time: %lld",
+-		    (long long)x->time) <= 0)
+		if (BIO_printf(bp, "\n    Start Time: %"PRId64,
+		    (int64_t)x->time) <= 0)
+ 			goto err;
+ 	}
+ 
--- a/patches/tlsexttest.c.patch
+++ b/patches/tlsexttest.c.patch
@@ -0,0 +1,76 @@
+--- tests/tlsexttest.c.orig	Fri Apr 28 11:42:38 2023
+++ tests/tlsexttest.c	Fri Apr 28 11:55:27 2023
+@@ -1775,7 +1775,9 @@
+ };
+ 
+ static const unsigned char tlsext_sni_server[] = {
+	0x00
+ };
+const size_t sizeof_tlsext_sni_server = 0;
+ 
+ static int
+ test_tlsext_sni_client(void)
+@@ -1973,9 +1975,9 @@
+ 	if (!CBB_finish(&cbb, &data, &dlen))
+ 		errx(1, "failed to finish CBB");
+ 
+-	if (dlen != sizeof(tlsext_sni_server)) {
+	if (dlen != sizeof_tlsext_sni_server) {
+ 		FAIL("got server SNI with length %zu, "
+-		    "want length %zu\n", dlen, sizeof(tlsext_sni_server));
+		    "want length %zu\n", dlen, sizeof_tlsext_sni_server);
+ 		goto err;
+ 	}
+ 
+@@ -1984,14 +1986,14 @@
+ 		fprintf(stderr, "received:\n");
+ 		hexdump(data, dlen);
+ 		fprintf(stderr, "test data:\n");
+-		hexdump(tlsext_sni_server, sizeof(tlsext_sni_server));
+		hexdump(tlsext_sni_server, sizeof_tlsext_sni_server);
+ 		goto err;
+ 	}
+ 
+ 	free(ssl->session->tlsext_hostname);
+ 	ssl->session->tlsext_hostname = NULL;
+ 
+-	CBS_init(&cbs, tlsext_sni_server, sizeof(tlsext_sni_server));
+	CBS_init(&cbs, tlsext_sni_server, sizeof_tlsext_sni_server);
+ 	if (!client_funcs->parse(ssl, SSL_TLSEXT_MSG_SH, &cbs, &alert)) {
+ 		FAIL("failed to parse server SNI\n");
+ 		goto err;
+@@ -3196,7 +3198,10 @@
+ 	0x04, 0x03, 0x02, 0x01, 0x02, 0x03,
+ };
+ 
+-unsigned char tlsext_clienthello_disabled[] = {};
+unsigned char tlsext_clienthello_disabled[] = {
+	0x00
+};
+const size_t sizeof_tlsext_clienthello_disabled = 0;
+ 
+ static int
+ test_tlsext_clienthello_build(void)
+@@ -3287,18 +3292,18 @@
+ 		goto err;
+ 	}
+ 
+-	if (dlen != sizeof(tlsext_clienthello_disabled)) {
+	if (dlen != sizeof_tlsext_clienthello_disabled) {
+ 		FAIL("got clienthello extensions with length %zu, "
+ 		    "want length %zu\n", dlen,
+-		    sizeof(tlsext_clienthello_disabled));
+		    sizeof_tlsext_clienthello_disabled);
+ 		compare_data(data, dlen, tlsext_clienthello_disabled,
+-		    sizeof(tlsext_clienthello_disabled));
+		    sizeof_tlsext_clienthello_disabled);
+ 		goto err;
+ 	}
+ 	if (memcmp(data, tlsext_clienthello_disabled, dlen) != 0) {
+ 		FAIL("clienthello extensions differs:\n");
+ 		compare_data(data, dlen, tlsext_clienthello_disabled,
+-		    sizeof(tlsext_clienthello_disabled));
+		    sizeof_tlsext_clienthello_disabled);
+ 		goto err;
+ 	}
+ 
--- a/patches/windows_headers.patch
+++ b/patches/windows_headers.patch
@@ -60,9 +60,10 @@ diff -u include/openssl.orig/pkcs7.h include/openssl/pkcs7.h
 /*
 Encryption_ID		DES-CBC
 Digest_ID		MD5
--- include/openssl/x509.h.orig	Thu Aug  3 13:35:00 2023
-+++ include/openssl/x509.h	Thu Aug  3 13:35:18 2023
-@@ -100,6 +100,19 @@
+diff -u include/openssl.orig/x509.h include/openssl/x509.h
+--- include/openssl.orig/x509.h	Tue Apr 18 03:26:56 2023
+++ include/openssl/x509.h	Tue Apr 18 03:27:14 2023
+@@ -106,6 +106,19 @@
 extern "C" {
 #endif
 
--- a/scripts/test
+++ b/scripts/test
@@ -10,77 +10,46 @@ if type apt-get >/dev/null 2>&1; then
 	sudo apt-get install -y cmake ninja-build
 fi

-# generate source tree
 ./autogen.sh

-if [ "$ARCH" = "" ]; then
-	ARCH=`uname -m`
-fi
-
-# test macOS
-if [ `uname` = "Darwin" ]; then
+if [ "x$ARCH" = "xnative" ]; then
 	# test autotools
 	./configure
-
-	# make distribution
 	make -j 4 distcheck

-	# test cmake
-	tar zxvf libressl-*.tar.gz
-	cd libressl-*
-
-	(
-		mkdir build-static
-		cd build-static
-		cmake -DCMAKE_OSX_ARCHITECTURES=$ARCH ..
-		make -j 4
-		if [ "$ARCH" = "x86_64" ]; then
-			make test
-		fi
-	)
-
-	(
-		mkdir build-shared
-		cd build-shared
-		cmake -DBUILD_SHARED_LIBS=ON -DCMAKE_OSX_ARCHITECTURES=$ARCH ..
-		make -j 4
-		if [ "$ARCH" = "x86_64" ]; then
-			make test
-		fi
-	)
-
-# assuming Linux below
-elif [ "$ARCH" = "native" ]; then
-	# test autotools
-	./configure
-
 	# make distribution
-	make -j 4 distcheck
-
+	make dist
 	tar zxvf libressl-*.tar.gz
 	cd libressl-*
+	mkdir build-static
+	mkdir build-shared

+	cd build-static

 	# test cmake and ninja
-	(
-		mkdir build-static
-		cd build-static
+	if [ `uname` = "Darwin" ]; then
+		cmake -DENABLE_ASM=${ENABLE_ASM} ..
+		make -j 4
+		make test
+
+		cd ../build-shared
+		cmake -DBUILD_SHARED_LIBS=ON -DENABLE_ASM=${ENABLE_ASM} ..
+		make -j 4
+		make test
+	else
 		cmake -GNinja -DENABLE_ASM=${ENABLE_ASM} ..
-		ninja
+		ninja -j 4
 		ninja test
-	)

-	(
-		mkdir build-shared
-		cd build-shared
+		cd ../build-shared
 		cmake -GNinja -DBUILD_SHARED_LIBS=ON -DENABLE_ASM=${ENABLE_ASM} ..
-		ninja
+		ninja -j 4
 		ninja test
-	)
+	fi

-elif [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" ]; then
+elif [ "x$ARCH" = "xmingw32" -o "x$ARCH" = "xmingw64" ]; then
 	CPU=i686
-	if [ "$ARCH" = "mingw64" ]; then
+	if [ "x$ARCH" = "xmingw64" ]; then
 		CPU=x86_64
 	fi

@@ -106,10 +75,10 @@ elif [ "$ARCH" = "mingw32" -o "$ARCH" = "mingw64" ]; then
 	 ninja -j 4
 	)

-elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then
+elif [ "x$ARCH" = "xarm32" -o "x$ARCH" = "xarm64" ]; then
 	sudo apt-get install -y qemu-user-static binfmt-support

-	if [ "$ARCH" = "arm32" ]; then
+	if [ "x$ARCH" = "xarm32" ]; then
 		sudo apt-get install -y g++-arm-linux-gnueabihf
 		sudo ln -sf /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/
 		./configure --host=arm-linux-gnueabihf
@@ -123,10 +92,10 @@ elif [ "$ARCH" = "arm32" -o "$ARCH" = "arm64" ]; then

 	file apps/openssl/.libs/openssl

-elif [ "$ARCH" = "mips32" -o "$ARCH" = "mips64" ]; then
+elif [ "x$ARCH" = "xmips32" -o "x$ARCH" = "xmips64" ]; then
 	sudo apt-get install -y qemu-user-static binfmt-support

-	if [ "$ARCH" = "mips32" ]; then
+	if [ "x$ARCH" = "xmips32" ]; then
 		sudo apt-get install -y g++-mips-linux-gnu
 		sudo ln -sf /usr/mipsel-linux-gnu/lib/ld.so.1 /lib/
 		./configure --host=mipsel-linux-gnu
@@ -140,7 +109,7 @@ elif [ "$ARCH" = "mips32" -o "$ARCH" = "mips64" ]; then

 	file apps/openssl/.libs/openssl

-elif [ "$ARCH" = "android" ]; then
+elif [ "x$ARCH" = "xandroid" ]; then
 	export TC_FILE=$ANDROID_NDK_HOME/build/cmake/android.toolchain.cmake

 	# set target API level and architecture
--- a/ssl/CMakeLists.txt
+++ b/ssl/CMakeLists.txt
@@ -69,8 +69,7 @@ target_include_directories(ssl_obj
 		../crypto/bio
 		../include/compat
 	PUBLIC
-		../include
-		${CMAKE_BINARY_DIR}/include)
+		../include)

 add_library(bs_obj OBJECT ${BS_SRC})
 target_include_directories(bs_obj
@@ -87,33 +86,13 @@ endif()
 export_symbol(ssl ${CMAKE_CURRENT_SOURCE_DIR}/ssl.sym)
 target_link_libraries(ssl crypto ${PLATFORM_LIBS})
 if (WIN32)
-	set(SSL_POSTFIX -${SSL_MAJOR_VERSION} PARENT_SCOPE)
+	set(SSL_POSTFIX -${SSL_MAJOR_VERSION})
 endif()
 set_target_properties(ssl PROPERTIES
 	OUTPUT_NAME ssl${SSL_POSTFIX}
-	ARCHIVE_OUTPUT_NAME ssl${SSL_POSTFIX}
-	EXPORT_NAME SSL
-	VERSION ${SSL_VERSION}
-	SOVERSION ${SSL_MAJOR_VERSION}
-)
-
-target_include_directories(
-	ssl
-	PUBLIC
-	$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/include>
-	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
-)
-
-install(
-	TARGETS ssl
-	EXPORT SSL-target
-)
-
-export(
-	EXPORT SSL-target
-	FILE "${LibreSSL_BINARY_DIR}/LibreSSL-SSL.cmake"
-	NAMESPACE LibreSSL::
-)
+	ARCHIVE_OUTPUT_NAME ssl${SSL_POSTFIX})
+set_target_properties(ssl PROPERTIES VERSION ${SSL_VERSION}
+	SOVERSION ${SSL_MAJOR_VERSION})

 if(ENABLE_LIBRESSL_INSTALL)
 	install(
@@ -122,12 +101,6 @@ if(ENABLE_LIBRESSL_INSTALL)
 		LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
 		RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
 	)
-	install(
-		EXPORT SSL-target
-		FILE "LibreSSL-SSL.cmake"
-		NAMESPACE LibreSSL::
-		DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
-	)
 endif(ENABLE_LIBRESSL_INSTALL)

 # build static library for regression test
--- a/ssl/Makefile.am
+++ b/ssl/Makefile.am
@@ -46,8 +46,6 @@ libbs_la_SOURCES += bs_cbs.c
 noinst_HEADERS = bytestring.h

 noinst_HEADERS += hidden/ssl_namespace.h
-noinst_HEADERS += hidden/openssl/srtp.h
-noinst_HEADERS += hidden/openssl/tls1.h
 noinst_HEADERS += hidden/openssl/ssl.h

 libssl_la_SOURCES = bio_ssl.c
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -13,7 +13,6 @@ include_directories(
 	../apps/openssl
 	../apps/openssl/compat
 	../include
-	${CMAKE_BINARY_DIR}/include
 	../include/compat
 )

@@ -154,11 +153,6 @@ add_executable(bn_cmp bn_cmp.c)
 target_link_libraries(bn_cmp ${OPENSSL_TEST_LIBS})
 add_test(bn_cmp bn_cmp)

-# bn_convert
-add_executable(bn_convert bn_convert.c)
-target_link_libraries(bn_convert ${OPENSSL_TEST_LIBS})
-add_test(bn_convert bn_convert)
-
 # bn_gcd
 add_executable(bn_gcd bn_cmp.c)
 target_link_libraries(bn_gcd ${OPENSSL_TEST_LIBS})
@@ -178,11 +172,6 @@ set_source_files_properties(bn_mod_exp.c PROPERTIES COMPILE_FLAGS
 target_link_libraries(bn_mod_exp ${OPENSSL_TEST_LIBS})
 add_test(bn_mod_exp bn_mod_exp)

-# bn_mod_inverse
-add_executable(bn_mod_inverse bn_mod_inverse.c)
-target_link_libraries(bn_mod_inverse ${OPENSSL_TEST_LIBS})
-add_test(bn_mod_inverse bn_mod_inverse)
-
 # bn_mod_sqrt
 add_executable(bn_mod_sqrt bn_mod_sqrt.c)
 target_link_libraries(bn_mod_sqrt ${OPENSSL_TEST_LIBS})
@@ -198,10 +187,10 @@ add_executable(bn_primes bn_primes.c)
 target_link_libraries(bn_primes ${OPENSSL_TEST_LIBS})
 add_test(bn_primes bn_primes)

-# bn_print
-add_executable(bn_print bn_print.c)
-target_link_libraries(bn_print ${OPENSSL_TEST_LIBS})
-add_test(bn_print bn_print)
+# bn_rand_interval
+add_executable(bn_rand_interval bn_rand_interval.c)
+target_link_libraries(bn_rand_interval ${OPENSSL_TEST_LIBS})
+add_test(bn_rand_interval bn_rand_interval)

 # bn_shift
 add_executable(bn_shift bn_shift.c)
@@ -314,11 +303,6 @@ add_test(dsatest dsatest)
 # 	set_tests_properties(dtlstest PROPERTIES ENVIRONMENT "srcdir=${TEST_SOURCE_DIR}")
 # endif()

-# ecc_cdh
-add_executable(ecc_cdh ecc_cdh.c)
-target_link_libraries(ecc_cdh ${OPENSSL_TEST_LIBS})
-add_test(ecc_cdh ecc_cdh)
-
 # ec_asn1_test
 add_executable(ec_asn1_test ec_asn1_test.c)
 target_link_libraries(ec_asn1_test ${OPENSSL_TEST_LIBS})
@@ -601,23 +585,14 @@ add_executable(sha_test sha_test.c)
 target_link_libraries(sha_test ${OPENSSL_TEST_LIBS})
 add_test(sha_test sha_test)

+# XXX HAVE_SOCKETPAIR
 # signertest
-if(NOT CMAKE_SYSTEM_NAME MATCHES "WindowsStore")
-	set(SIGNERTEST_SRC signertest.c)
-	check_function_exists(pipe2 HAVE_PIPE2)
-	if(HAVE_PIPE2)
-		add_definitions(-DHAVE_PIPE2)
-	else()
-		set(SIGNERTEST_SRC ${SIGNERTEST_SRC} compat/pipe2.c)
-	endif()
-
-	set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS
-	      -DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\")
-	add_executable(signertest ${SIGNERTEST_SRC})
-	target_link_libraries(signertest ${LIBTLS_TEST_LIBS})
-	target_include_directories(signertest BEFORE PUBLIC ../tls)
-	add_test(signertest signertest)
-endif()
+# add_executable(signertest signertest.c)
+# target_link_libraries(signertest ${LIBTLS_TEST_LIBS})
+# target_include_directories(signertest BEFORE PUBLIC ../tls)
+# set_source_files_properties(signertest.c PROPERTIES COMPILE_FLAGS
+#	-DCERTSDIR=\\"${CMAKE_CURRENT_SOURCE_DIR}\\")
+# add_test(signertest signertest)

 # sm2crypttest
 # sm2evptest
--- a/tests/Makefile.am
+++ b/tests/Makefile.am
@@ -170,11 +170,6 @@ TESTS += bn_cmp
 check_PROGRAMS += bn_cmp
 bn_cmp_SOURCES = bn_cmp.c

-# bn_convert
-TESTS += bn_convert
-check_PROGRAMS += bn_convert
-bn_convert_SOURCES = bn_convert.c
-
 # bn_gcd
 TESTS += bn_gcd
 check_PROGRAMS += bn_gcd
@@ -193,11 +188,6 @@ check_PROGRAMS += bn_mod_exp
 bn_mod_exp_CPPFLAGS = $(AM_CPPFLAGS) -ULIBRESSL_INTERNAL
 bn_mod_exp_SOURCES = bn_mod_exp.c

-# bn_mod_inverse
-TESTS += bn_mod_inverse
-check_PROGRAMS += bn_mod_inverse
-bn_mod_inverse_SOURCES = bn_mod_inverse.c
-
 # bn_mod_sqrt
 TESTS += bn_mod_sqrt
 check_PROGRAMS += bn_mod_sqrt
@@ -213,10 +203,10 @@ TESTS += bn_primes
 check_PROGRAMS += bn_primes
 bn_primes_SOURCES = bn_primes.c

-# bn_print
-TESTS += bn_print
-check_PROGRAMS += bn_print
-bn_print_SOURCES = bn_print.c
+# bn_rand_interval
+TESTS += bn_rand_interval
+check_PROGRAMS += bn_rand_interval
+bn_rand_interval_SOURCES = bn_rand_interval.c

 # bn_shift
 TESTS += bn_shift
@@ -331,11 +321,6 @@ dsatest_SOURCES = dsatest.c
 #endif
 #EXTRA_DIST += dtlstest.sh

-# ecc_cdh
-TESTS += ecc_cdh
-check_PROGRAMS += ecc_cdh
-ecc_cdh_SOURCES = ecc_cdh.c
-
 # ec_asn1_test
 TESTS += ec_asn1_test
 check_PROGRAMS += ec_asn1_test
@@ -631,14 +616,12 @@ TESTS += sha_test
 check_PROGRAMS += sha_test
 sha_test_SOURCES = sha_test.c

+# XXX HAVE_SOCKETPAIR
 # signertest
-TESTS += signertest
-check_PROGRAMS += signertest
-signertest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\"
-signertest_SOURCES = signertest.c
-if !HAVE_PIPE2
-signertest_SOURCES += compat/pipe2.c
-endif
+# TESTS += signertest
+# check_PROGRAMS += signertest
+# signertest_CPPFLAGS = -I $(top_srcdir)/tls $(AM_CPPFLAGS) -DCERTSDIR=\"$(srcdir)\"
+# signertest_SOURCES = signertest.c

 # sm2crypttest
 # sm2evptest
@@ -698,6 +681,7 @@ EXTRA_DIST += server2-ecdsa.pem server2-rsa-chain.pem server2-rsa.pem
 EXTRA_DIST += server3-ecdsa-chain.pem server3-ecdsa.pem server3-rsa-chain.pem
 EXTRA_DIST += server3-rsa.pem

+
 # string_table
 TESTS += string_table
 check_PROGRAMS += string_table
--- a/tests/cmake/CMakeLists.txt
+++ b/tests/cmake/CMakeLists.txt
@@ -1,37 +0,0 @@
-cmake_minimum_required(VERSION 3.5)
-
-project(LibreSSL_Consumer LANGUAGES C)
-
-find_package(
-  LibreSSL
-  CONFIG
-  REQUIRED
-  COMPONENTS Crypto SSL TLS
-)
-
-set(RESULTS_TO_CHECK
-  "LIBRESSL_VERSION"
-  "LIBRESSL_FOUND"
-  "LIBRESSL_INCLUDE_DIR"
-  "LIBRESSL_LIBRARIES"
-  "LIBRESSL_CRYPTO_LIBRARY"
-  "LIBRESSL_SSL_LIBRARY"
-  "LIBRESSL_TLS_LIBRARY"
-)
-
-foreach(RESULT_VAR IN LISTS RESULTS_TO_CHECK)
-  if(${RESULT_VAR})
-    message(STATUS "${RESULT_VAR}: ${${RESULT_VAR}}")
-  else()
-    message(FATAL_ERROR "${RESULT_VAR} was not set by the package.")
-  endif()
-endforeach()
-
-add_executable(crypto crypto.c)
-target_link_libraries(crypto PRIVATE LibreSSL::Crypto)
-
-add_executable(ssl ssl.c)
-target_link_libraries(ssl PRIVATE LibreSSL::SSL)
-
-add_executable(tls tls.c)
-target_link_libraries(tls PRIVATE LibreSSL::TLS)
--- a/tests/cmake/crypto.c
+++ b/tests/cmake/crypto.c
@@ -1,7 +0,0 @@
-#include <openssl/crypto.h>
-
-int main(void) {
-  OPENSSL_init_crypto(0, NULL);
-  OPENSSL_cleanup();
-  return 0;
-}
--- a/tests/cmake/ssl.c
+++ b/tests/cmake/ssl.c
@@ -1,6 +0,0 @@
-#include <openssl/ssl.h>
-
-int main(void) {
-  SSL_library_init();
-  return 0;
-}
--- a/tests/cmake/tls.c
+++ b/tests/cmake/tls.c
@@ -1,6 +0,0 @@
-#include <tls.h>
-
-int main(void) {
-  tls_init();
-  return 0;
-}
--- a/tests/testssl.bat
+++ b/tests/testssl.bat
@@ -1,4 +1,4 @@
-@echo on
+@echo off
 setlocal enabledelayedexpansion
 REM	testssl.bat

@@ -88,7 +88,8 @@ for /f "usebackq" %%s in (`%openssl% no-dh`) do set nodh=%%s
 if %nodh%==no-dh (
  echo skipping anonymous DH tests
 ) else (
-  echo skipping tls1 tests.
+  echo test tls1 with 1024bit anonymous DH, multiple handshakes
+  %ssltest% -v -bio_pair -tls1 -cipher ADH -dhe1024dsa -num 10 -f -time %extra% & if !errorlevel! neq 0 exit /b 1
 )

 REM #for /f "usebackq" %%s in (`%openssl% no-rsa`) do set norsa=%%s
@@ -111,24 +112,24 @@ REM #
 REM # DTLS tests
 REM #

-echo test dtlsv1_2
-%ssltest% -dtls1_2 %extra% & if !errorlevel! neq 0 exit /b 1
+echo test dtlsv1
+%ssltest% -dtls1 %extra% & if !errorlevel! neq 0 exit /b 1

-echo test dtlsv1_2 with server authentication
-%ssltest% -dtls1_2 -server_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1
+echo test dtlsv1 with server authentication
+%ssltest% -dtls1 -server_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1

-echo test dtlsv1_2 with client authentication
-%ssltest% -dtls1_2 -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1
+echo test dtlsv1 with client authentication
+%ssltest% -dtls1 -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1

-echo test dtlsv1_2 with both client and server authentication
-%ssltest% -dtls1_2 -server_auth -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1
+echo test dtlsv1 with both client and server authentication
+%ssltest% -dtls1 -server_auth -client_auth %CA% %extra% & if !errorlevel! neq 0 exit /b 1

 echo "Testing DTLS ciphersuites"
 for %%p in ( SSLv3 ) do (
  echo "Testing ciphersuites for %%p"
  for /f "usebackq" %%c in (`%openssl% ciphers -v "RSA+%%p:-RC4" ^| find "%%p"`) do (
    echo "Testing %%c"
-    %ssltest% -cipher %%c -dtls1_2
+    %ssltest% -cipher %%c -dtls1
    if !errorlevel! neq 0 (
      echo "Failed %%c"
      exit /b 1
@@ -140,19 +141,19 @@ REM #
 REM # ALPN tests
 REM #
 echo "Testing ALPN..."
-%ssltest% -bio_pair -alpn_client foo -alpn_server bar & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -alpn_client foo -alpn_server foo ^
+%ssltest% -bio_pair -tls1 -alpn_client foo -alpn_server bar & if !errorlevel! neq 0 exit /b 1
+%ssltest% -bio_pair -tls1 -alpn_client foo -alpn_server foo ^
  -alpn_expected foo & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -alpn_client foo,bar -alpn_server foo ^
+%ssltest% -bio_pair -tls1 -alpn_client foo,bar -alpn_server foo ^
  -alpn_expected foo & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -alpn_client bar,foo -alpn_server foo ^
+%ssltest% -bio_pair -tls1 -alpn_client bar,foo -alpn_server foo ^
  -alpn_expected foo & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -alpn_client bar,foo -alpn_server foo,bar ^
+%ssltest% -bio_pair -tls1 -alpn_client bar,foo -alpn_server foo,bar ^
  -alpn_expected foo & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -alpn_client bar,foo -alpn_server bar,foo ^
+%ssltest% -bio_pair -tls1 -alpn_client bar,foo -alpn_server bar,foo ^
  -alpn_expected bar & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -alpn_client foo,bar -alpn_server bar,foo ^
+%ssltest% -bio_pair -tls1 -alpn_client foo,bar -alpn_server bar,foo ^
  -alpn_expected bar & if !errorlevel! neq 0 exit /b 1
-%ssltest% -bio_pair -alpn_client baz -alpn_server bar,foo & if !errorlevel! neq 0 exit /b 1
+%ssltest% -bio_pair -tls1 -alpn_client baz -alpn_server bar,foo & if !errorlevel! neq 0 exit /b 1

 endlocal
--- a/tls/CMakeLists.txt
+++ b/tls/CMakeLists.txt
@@ -45,8 +45,7 @@ target_include_directories(tls_obj
 		.
 		../include/compat
 	PUBLIC
-		../include
-		${CMAKE_BINARY_DIR}/include)
+		../include)

 add_library(tls $<TARGET_OBJECTS:tls_obj> $<TARGET_OBJECTS:ssl_obj>
 	$<TARGET_OBJECTS:crypto_obj> empty.c)
@@ -54,33 +53,13 @@ add_library(tls $<TARGET_OBJECTS:tls_obj> $<TARGET_OBJECTS:ssl_obj>
 export_symbol(tls ${CMAKE_CURRENT_BINARY_DIR}/tls.sym)
 target_link_libraries(tls ${PLATFORM_LIBS})
 if (WIN32)
-	set(TLS_POSTFIX -${TLS_MAJOR_VERSION} PARENT_SCOPE)
+	set(TLS_POSTFIX -${TLS_MAJOR_VERSION})
 endif()
 set_target_properties(tls PROPERTIES
 	OUTPUT_NAME tls${TLS_POSTFIX}
-	ARCHIVE_OUTPUT_NAME tls${TLS_POSTFIX}
-	EXPORT_NAME TLS
-	VERSION ${TLS_VERSION}
-	SOVERSION ${TLS_MAJOR_VERSION}
-)
-
-target_include_directories(
-	tls
-	PUBLIC
-	$<BUILD_INTERFACE:${CMAKE_BINARY_DIR}/include>
-	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
-)
-
-install(
-	TARGETS tls
-	EXPORT TLS-target
-)
-
-export(
-	EXPORT TLS-target
-	FILE "${LibreSSL_BINARY_DIR}/LibreSSL-TLS.cmake"
-	NAMESPACE LibreSSL::
-)
+	ARCHIVE_OUTPUT_NAME tls${TLS_POSTFIX})
+set_target_properties(tls PROPERTIES VERSION ${TLS_VERSION}
+	SOVERSION ${TLS_MAJOR_VERSION})

 if(ENABLE_LIBRESSL_INSTALL)
 	install(
@@ -89,12 +68,6 @@ if(ENABLE_LIBRESSL_INSTALL)
 		LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
 		RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
 	)
-	install(
-		EXPORT TLS-target
-		FILE "LibreSSL-TLS.cmake"
-		NAMESPACE LibreSSL::
-		DESTINATION "${LIBRESSL_INSTALL_CMAKEDIR}"
-	)
 endif(ENABLE_LIBRESSL_INSTALL)

 # build static library for regression test
--- a/tls/Makefile.am
+++ b/tls/Makefile.am
@@ -20,17 +20,10 @@ libtls_la_objects.mk: Makefile
 	  > libtls_la_objects.mk

 libtls_la_LDFLAGS = -version-info @LIBTLS_VERSION@ -no-undefined -export-symbols $(top_srcdir)/tls/tls.sym
-
-if ENABLE_LIBTLS_ONLY
 libtls_la_LIBADD = $(libcrypto_la_objects)
-libtls_la_LIBADD += $(libssl_la_objects)
-else
-libtls_la_LIBADD = $(abs_top_builddir)/crypto/libcrypto.la
-libtls_la_LIBADD += $(abs_top_builddir)/ssl/libssl.la
-endif
-
 libtls_la_LIBADD += $(libcompat_la_objects)
 libtls_la_LIBADD += $(libcompatnoopt_la_objects)
+libtls_la_LIBADD += $(libssl_la_objects)
 libtls_la_LIBADD += $(PLATFORM_LDADD)

 libtls_la_CPPFLAGS = $(AM_CPPFLAGS)
--- a/update.sh
+++ b/update.sh
@@ -18,7 +18,7 @@ set +e
 tag=`git describe --exact-match --tags HEAD 2>/dev/null`
 is_tag=$?
 # adjust for 9 hour time delta between trees
-release_ts=$((`git show -s --format=%ct $tag|tail -1` + 32400))
+release_ts=$((`git show -s --format=%ct $tag|tail -n1` + 32400))
 commit=`git -C openbsd rev-list -n 1 --before=$release_ts $openbsd_branch`
 git -C openbsd fetch
 if [ $is_tag -eq 0 ]; then
@@ -133,7 +133,7 @@ copy_hdrs $libcrypto_src "stack/stack.h lhash/lhash.h stack/safestack.h
 	ecdh/ecdh.h rsa/rsa.h sha/sha.h x509/x509_vfy.h pkcs7/pkcs7.h pem/pem.h
 	pem/pem2.h hkdf/hkdf.h hmac/hmac.h rand/rand.h md5/md5.h
 	x509/x509v3.h conf/conf.h ocsp/ocsp.h
-	aes/aes.h modes/modes.h asn1/asn1t.h bf/blowfish.h
+	aes/aes.h modes/modes.h asn1/asn1t.h dso/dso.h bf/blowfish.h
 	bio/bio.h cast/cast.h cmac/cmac.h cms/cms.h conf/conf_api.h des/des.h dh/dh.h
 	dsa/dsa.h engine/engine.h ui/ui.h pkcs12/pkcs12.h ts/ts.h
 	md4/md4.h ripemd/ripemd.h whrlpool/whrlpool.h idea/idea.h
@@ -194,6 +194,11 @@ fixup_masm() {
 		> $2
 }

+fixup_macosx() {
+	echo Fixing up $2
+	sed -e 's/endbr64//' $1 > $2
+}
+
 # generate assembly crypto algorithms
 asm_src=$libcrypto_src
 gen_asm_stdout() {
@@ -205,6 +210,8 @@ gen_asm_stdout() {
 	EOF
 	if [ $1 = "masm" ]; then
 		fixup_masm crypto/$3.tmp crypto/$3
+	elif [ $1 = "macosx" ]; then
+		fixup_macosx crypto/$3.tmp crypto/$3
 	else
 		$MV crypto/$3.tmp crypto/$3
 	fi
@@ -231,6 +238,8 @@ gen_asm() {
 	EOF
 	if [ $1 = "masm" ]; then
 		fixup_masm crypto/$3.tmp crypto/$3
+	elif [ $1 = "macosx" ]; then
+		fixup_macosx crypto/$3.tmp crypto/$3
 	else
 		$MV crypto/$3.tmp crypto/$3
 	fi
Author	SHA1	Message	Date
torque	4ed04478c1	build.zig: address some Windows/Linux compilation issues A variety of linker issues (specifically missing symbol errors) don't show up with static libraries, so it was a bit hard to track this down without having something to link to. These have only been tested in cross-compilation setups, so there may still be lurking horrors.	2023-08-31 23:43:46 -07:00
torque	79c3d595d2	build.zig: fix header search paths These are not handled properly when used as a dependency unless they are attached to all of the artifacts because if a user only depends on libssl, it doesn't include the headers attached to libcrypto.	2023-08-31 22:14:27 -07:00
torque	dd538e896b	build.zig: fix erroneous cwd references This worked fine building libressl by itself, but it references the wrong directory when executed as a dependency of another library. The builder object seems to have its build root set correctly, so use that.	2023-08-31 21:45:39 -07:00
torque	6582b5efe9	add build.zig	2023-08-30 21:48:11 -07:00