	@@ -873,29 +873,29 @@ bad:		@@ -873,29 +873,29 @@ bad:
873	}	873	}
874		874
875	/*****************************************************************/	875	/*****************************************************************/
876	/* we need to load the database file */	876	/* we need to load the database file */
877	if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)	877	if ((dbfile=NCONF_get_string(conf,section,ENV_DATABASE)) == NULL)
878	{	878	{
879	lookup_fail(section,ENV_DATABASE);	879	lookup_fail(section,ENV_DATABASE);
880	goto err;	880	goto err;
881	}	881	}
882	db = load_index(dbfile, &db_attr);	882	db = load_index(dbfile, &db_attr);
883	if (db == NULL) goto err;	883	if (db == NULL) goto err;
884		884
885	/* Lets check some fields */	885	/* Lets check some fields */
886	for (i=0; i<sk_PSTRING_num(db->db->data); i++)	886	for (i=0; i<sk_OPENSSL_PSTRING_num(db->db->data); i++)
887	{	887	{
888	pp=sk_PSTRING_value(db->db->data,i);	888	pp=sk_OPENSSL_PSTRING_value(db->db->data,i);
889	if ((pp[DB_type][0] != DB_TYPE_REV) &&	889	if ((pp[DB_type][0] != DB_TYPE_REV) &&
890	(pp[DB_rev_date][0] != '\0'))	890	(pp[DB_rev_date][0] != '\0'))
891	{	891	{
892	BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);	892	BIO_printf(bio_err,"entry %d: not revoked yet, but has a revocation date\n",i+1);
893	goto err;	893	goto err;
894	}	894	}
895	if ((pp[DB_type][0] == DB_TYPE_REV) &&	895	if ((pp[DB_type][0] == DB_TYPE_REV) &&
896	!make_revoked(NULL, pp[DB_rev_date]))	896	!make_revoked(NULL, pp[DB_rev_date]))
897	{	897	{
898	BIO_printf(bio_err," in entry %d\n", i+1);	898	BIO_printf(bio_err," in entry %d\n", i+1);
899	goto err;	899	goto err;
900	}	900	}
901	if (!check_time_format((char *)pp[DB_exp_date]))	901	if (!check_time_format((char *)pp[DB_exp_date]))
	@@ -928,27 +928,27 @@ bad:		@@ -928,27 +928,27 @@ bad:
928	}	928	}
929	}	929	}
930	if (verbose)	930	if (verbose)
931	{	931	{
932	BIO_set_fp(out,stdout,BIO_NOCLOSE\|BIO_FP_TEXT); /* cannot fail */	932	BIO_set_fp(out,stdout,BIO_NOCLOSE\|BIO_FP_TEXT); /* cannot fail */
933	#ifdef OPENSSL_SYS_VMS	933	#ifdef OPENSSL_SYS_VMS
934	{	934	{
935	BIO *tmpbio = BIO_new(BIO_f_linebuffer());	935	BIO *tmpbio = BIO_new(BIO_f_linebuffer());
936	out = BIO_push(tmpbio, out);	936	out = BIO_push(tmpbio, out);
937	}	937	}
938	#endif	938	#endif
939	TXT_DB_write(out,db->db);	939	TXT_DB_write(out,db->db);
940	BIO_printf(bio_err,"%d entries loaded from the database\n",	940	BIO_printf(bio_err,"%d entries loaded from the database\n",
941	sk_PSTRING_num(db->db->data));	941	sk_OPENSSL_PSTRING_num(db->db->data));
942	BIO_printf(bio_err,"generating index\n");	942	BIO_printf(bio_err,"generating index\n");
943	}	943	}
944		944
945	if (!index_index(db)) goto err;	945	if (!index_index(db)) goto err;
946		946
947	/*****************************************************************/	947	/*****************************************************************/
948	/* Update the db file for expired certificates */	948	/* Update the db file for expired certificates */
949	if (doupdatedb)	949	if (doupdatedb)
950	{	950	{
951	if (verbose)	951	if (verbose)
952	BIO_printf(bio_err, "Updating %s ...\n",	952	BIO_printf(bio_err, "Updating %s ...\n",
953	dbfile);	953	dbfile);
954		954
	@@ -1398,29 +1398,29 @@ bad:		@@ -1398,29 +1398,29 @@ bad:
1398	if (verbose) BIO_printf(bio_err,"making CRL\n");	1398	if (verbose) BIO_printf(bio_err,"making CRL\n");
1399	if ((crl=X509_CRL_new()) == NULL) goto err;	1399	if ((crl=X509_CRL_new()) == NULL) goto err;
1400	if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509))) goto err;	1400	if (!X509_CRL_set_issuer_name(crl, X509_get_subject_name(x509))) goto err;
1401		1401
1402	tmptm = ASN1_TIME_new();	1402	tmptm = ASN1_TIME_new();
1403	if (!tmptm) goto err;	1403	if (!tmptm) goto err;
1404	X509_gmtime_adj(tmptm,0);	1404	X509_gmtime_adj(tmptm,0);
1405	X509_CRL_set_lastUpdate(crl, tmptm);	1405	X509_CRL_set_lastUpdate(crl, tmptm);
1406	X509_time_adj_ex(tmptm, crldays, crlhours6060 + crlsec, NULL);	1406	X509_time_adj_ex(tmptm, crldays, crlhours6060 + crlsec, NULL);
1407	X509_CRL_set_nextUpdate(crl, tmptm);	1407	X509_CRL_set_nextUpdate(crl, tmptm);
1408		1408
1409	ASN1_TIME_free(tmptm);	1409	ASN1_TIME_free(tmptm);
1410		1410
1411	for (i=0; i<sk_PSTRING_num(db->db->data); i++)	1411	for (i=0; i<sk_OPENSSL_PSTRING_num(db->db->data); i++)
1412	{	1412	{
1413	pp=sk_PSTRING_value(db->db->data,i);	1413	pp=sk_OPENSSL_PSTRING_value(db->db->data,i);
1414	if (pp[DB_type][0] == DB_TYPE_REV)	1414	if (pp[DB_type][0] == DB_TYPE_REV)
1415	{	1415	{
1416	if ((r=X509_REVOKED_new()) == NULL) goto err;	1416	if ((r=X509_REVOKED_new()) == NULL) goto err;
1417	j = make_revoked(r, pp[DB_rev_date]);	1417	j = make_revoked(r, pp[DB_rev_date]);
1418	if (!j) goto err;	1418	if (!j) goto err;
1419	if (j == 2) crl_v2 = 1;	1419	if (j == 2) crl_v2 = 1;
1420	if (!BN_hex2bn(&serial, pp[DB_serial]))	1420	if (!BN_hex2bn(&serial, pp[DB_serial]))
1421	goto err;	1421	goto err;
1422	tmpser = BN_to_ASN1_INTEGER(serial, NULL);	1422	tmpser = BN_to_ASN1_INTEGER(serial, NULL);
1423	BN_free(serial);	1423	BN_free(serial);
1424	serial = NULL;	1424	serial = NULL;
1425	if (!tmpser)	1425	if (!tmpser)
1426	goto err;	1426	goto err;
	@@ -1675,29 +1675,29 @@ static int do_body(X509 **xret, EVP_PKEY		@@ -1675,29 +1675,29 @@ static int do_body(X509 **xret, EVP_PKEY
1675	{	1675	{
1676	X509_NAME name=NULL,CAname=NULL,subject=NULL, dn_subject=NULL;	1676	X509_NAME name=NULL,CAname=NULL,subject=NULL, dn_subject=NULL;
1677	ASN1_UTCTIME tm,tmptm;	1677	ASN1_UTCTIME tm,tmptm;
1678	ASN1_STRING str,str2;	1678	ASN1_STRING str,str2;
1679	ASN1_OBJECT *obj;	1679	ASN1_OBJECT *obj;
1680	X509 *ret=NULL;	1680	X509 *ret=NULL;
1681	X509_CINF *ci;	1681	X509_CINF *ci;
1682	X509_NAME_ENTRY *ne;	1682	X509_NAME_ENTRY *ne;
1683	X509_NAME_ENTRY tne,push;	1683	X509_NAME_ENTRY tne,push;
1684	EVP_PKEY *pktmp;	1684	EVP_PKEY *pktmp;
1685	int ok= -1,i,j,last,nid;	1685	int ok= -1,i,j,last,nid;
1686	const char *p;	1686	const char *p;
1687	CONF_VALUE *cv;	1687	CONF_VALUE *cv;
1688	STRING row[DB_NUMBER];	1688	OPENSSL_STRING row[DB_NUMBER];
1689	STRING *irow=NULL;	1689	OPENSSL_STRING *irow=NULL;
1690	STRING *rrow=NULL;	1690	OPENSSL_STRING *rrow=NULL;
1691	char buf[25];	1691	char buf[25];
1692		1692
1693	tmptm=ASN1_UTCTIME_new();	1693	tmptm=ASN1_UTCTIME_new();
1694	if (tmptm == NULL)	1694	if (tmptm == NULL)
1695	{	1695	{
1696	BIO_printf(bio_err,"malloc error\n");	1696	BIO_printf(bio_err,"malloc error\n");
1697	return(0);	1697	return(0);
1698	}	1698	}
1699		1699
1700	for (i=0; i<DB_NUMBER; i++)	1700	for (i=0; i<DB_NUMBER; i++)
1701	row[i]=NULL;	1701	row[i]=NULL;
1702		1702
1703	if (subj)	1703	if (subj)
	@@ -1919,27 +1919,27 @@ again2:		@@ -1919,27 +1919,27 @@ again2:
1919		1919
1920	if (BN_is_zero(serial))	1920	if (BN_is_zero(serial))
1921	row[DB_serial]=BUF_strdup("00");	1921	row[DB_serial]=BUF_strdup("00");
1922	else	1922	else
1923	row[DB_serial]=BN_bn2hex(serial);	1923	row[DB_serial]=BN_bn2hex(serial);
1924	if (row[DB_serial] == NULL)	1924	if (row[DB_serial] == NULL)
1925	{	1925	{
1926	BIO_printf(bio_err,"Memory allocation failure\n");	1926	BIO_printf(bio_err,"Memory allocation failure\n");
1927	goto err;	1927	goto err;
1928	}	1928	}
1929		1929
1930	if (db->attributes.unique_subject)	1930	if (db->attributes.unique_subject)
1931	{	1931	{
1932	STRING *crow=row;	1932	OPENSSL_STRING *crow=row;
1933		1933
1934	rrow=TXT_DB_get_by_index(db->db,DB_name,crow);	1934	rrow=TXT_DB_get_by_index(db->db,DB_name,crow);
1935	if (rrow != NULL)	1935	if (rrow != NULL)
1936	{	1936	{
1937	BIO_printf(bio_err,	1937	BIO_printf(bio_err,
1938	"ERROR:There is already a certificate for %s\n",	1938	"ERROR:There is already a certificate for %s\n",
1939	row[DB_name]);	1939	row[DB_name]);
1940	}	1940	}
1941	}	1941	}
1942	if (rrow == NULL)	1942	if (rrow == NULL)
1943	{	1943	{
1944	rrow=TXT_DB_get_by_index(db->db,DB_serial,row);	1944	rrow=TXT_DB_get_by_index(db->db,DB_serial,row);
1945	if (rrow != NULL)	1945	if (rrow != NULL)
	@@ -2622,29 +2622,29 @@ static int do_updatedb (CA_DB *db)		@@ -2622,29 +2622,29 @@ static int do_updatedb (CA_DB *db)
2622	{	2622	{
2623	cnt = -1;	2623	cnt = -1;
2624	goto err;	2624	goto err;
2625	}	2625	}
2626		2626
2627	memcpy(a_tm_s, a_tm->data, a_tm->length);	2627	memcpy(a_tm_s, a_tm->data, a_tm->length);
2628	a_tm_s[a_tm->length] = '\0';	2628	a_tm_s[a_tm->length] = '\0';
2629		2629
2630	if (strncmp(a_tm_s, "49", 2) <= 0)	2630	if (strncmp(a_tm_s, "49", 2) <= 0)
2631	a_y2k = 1;	2631	a_y2k = 1;
2632	else	2632	else
2633	a_y2k = 0;	2633	a_y2k = 0;
2634		2634
2635	for (i = 0; i < sk_PSTRING_num(db->db->data); i++)	2635	for (i = 0; i < sk_OPENSSL_PSTRING_num(db->db->data); i++)
2636	{	2636	{
2637	rrow = sk_PSTRING_value(db->db->data, i);	2637	rrow = sk_OPENSSL_PSTRING_value(db->db->data, i);
2638		2638
2639	if (rrow[DB_type][0] == 'V')	2639	if (rrow[DB_type][0] == 'V')
2640	{	2640	{
2641	/* ignore entries that are not valid */	2641	/* ignore entries that are not valid */
2642	if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)	2642	if (strncmp(rrow[DB_exp_date], "49", 2) <= 0)
2643	db_y2k = 1;	2643	db_y2k = 1;
2644	else	2644	else
2645	db_y2k = 0;	2645	db_y2k = 0;
2646		2646
2647	if (db_y2k == a_y2k)	2647	if (db_y2k == a_y2k)
2648	{	2648	{
2649	/* all on the same y2k side */	2649	/* all on the same y2k side */
2650	if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)	2650	if (strcmp(rrow[DB_exp_date], a_tm_s) <= 0)

 @@ -23,27 +23,27 @@
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ *
  */
 #include <openssl/objects.h>
 #include <openssl/engine.h>
 #include <openssl/evp.h>
 #include <openssl/bn.h>
 #if (defined(__unix__) || defined(unix)) && !defined(USG) && \
-	(defined(OpenBSD) || defined(__FreeBSD_version))
+	(defined(OpenBSD) || defined(__FreeBSD__))
 #include <sys/param.h>
 # if (OpenBSD >= 200112) || ((__FreeBSD_version >= 470101 && __FreeBSD_version < 500000) || __FreeBSD_version >= 500041) || defined(__NetBSD__)
 #  define HAVE_CRYPTODEV
 # endif
 # if (OpenBSD >= 200110)
 #  define HAVE_SYSLOG_R
 # endif
 #endif
 #ifndef HAVE_CRYPTODEV
 void
 ENGINE_load_cryptodev(void)
 @@ -76,27 +76,27 @@ struct dev_crypto_state {
 	unsigned char digest_res[HASH_MAX_LEN];
 	char *mac_data;
 	int mac_len;
 	int copy;
 #endif
 };
 static u_int32_t cryptodev_asymfeat = 0;
 static int open_dev_crypto(void);
 static int get_dev_crypto(void);
 static int get_cryptodev_ciphers(const int **cnids);
-static int get_cryptodev_digests(const int **cnids);
+/*static int get_cryptodev_digests(const int **cnids);*/
 static int cryptodev_usable_ciphers(const int **nids);
 static int cryptodev_usable_digests(const int **nids);
 static int cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
     const unsigned char *in, size_t inl);
 static int cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
     const unsigned char *iv, int enc);
 static int cryptodev_cleanup(EVP_CIPHER_CTX *ctx);
 static int cryptodev_engine_ciphers(ENGINE *e, const EVP_CIPHER **cipher,
     const int **nids, int nid);
 static int cryptodev_engine_digests(ENGINE *e, const EVP_MD **digest,
     const int **nids, int nid);
 static int bn2crparam(const BIGNUM *a, struct crparam *crp);
 static int crparam2bn(struct crparam *crp, BIGNUM *a);
 @@ -114,65 +114,67 @@ static int cryptodev_dsa_bn_mod_exp(DSA
 static int cryptodev_dsa_dsa_mod_exp(DSA *dsa, BIGNUM *t1, BIGNUM *g,
     BIGNUM *u1, BIGNUM *pub_key, BIGNUM *u2, BIGNUM *p,
     BN_CTX *ctx, BN_MONT_CTX *mont);
 static DSA_SIG *cryptodev_dsa_do_sign(const unsigned char *dgst,
     int dlen, DSA *dsa);
 static int cryptodev_dsa_verify(const unsigned char *dgst, int dgst_len,
     DSA_SIG *sig, DSA *dsa);
 static int cryptodev_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
     const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
     BN_MONT_CTX *m_ctx);
 static int cryptodev_dh_compute_key(unsigned char *key,
     const BIGNUM *pub_key, DH *dh);
 static int cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p,
-    void (*f)());
+    void (*f)(void));
 void ENGINE_load_cryptodev(void);
 static const ENGINE_CMD_DEFN cryptodev_defns[] = {
 	{ 0, NULL, NULL, 0 }
 };
 static struct {
 	int	id;
 	int	nid;
 	int	ivmax;
 	int	keylen;
 } ciphers[] = {
 	{ CRYPTO_ARC4,			NID_rc4,		0,	16, },
 	{ CRYPTO_DES_CBC,		NID_des_cbc,		8,	 8, },
 	{ CRYPTO_3DES_CBC,		NID_des_ede3_cbc,	8,	24, },
 	{ CRYPTO_AES_CBC,		NID_aes_128_cbc,	16,	16, },
 	{ CRYPTO_AES_CBC,		NID_aes_192_cbc,	16,	24, },
 	{ CRYPTO_AES_CBC,		NID_aes_256_cbc,	16,	32, },
 	{ CRYPTO_BLF_CBC,		NID_bf_cbc,		8,	16, },
 	{ CRYPTO_CAST_CBC,		NID_cast5_cbc,		8,	16, },
 	{ CRYPTO_SKIPJACK_CBC,		NID_undef,		0,	 0, },
 	{ 0,				NID_undef,		0,	 0, },
 };
 #if 0  /* not (yet?) used */
 static struct {
 	int	id;
 	int	nid;
 	int 	keylen;
 } digests[] = {
 	{ CRYPTO_MD5_HMAC,		NID_hmacWithMD5,	16},
 	{ CRYPTO_SHA1_HMAC,		NID_hmacWithSHA1,	20},
 	{ CRYPTO_RIPEMD160_HMAC,	NID_ripemd160,		16/*?*/},
 	{ CRYPTO_MD5_KPDK,		NID_undef,		0},
 	{ CRYPTO_SHA1_KPDK,		NID_undef,		0},
 	{ CRYPTO_MD5,			NID_md5,		16},
 	{ CRYPTO_SHA1,			NID_sha1,		20},
 	{ 0,				NID_undef,		0},
 };
 #endif  /* 0 */
 /*
  * Return a fd if /dev/crypto seems usable, 0 otherwise.
  */
 static int
 open_dev_crypto(void)
+{
 	static int fd = -1;
 	if (fd == -1) {
 		if ((fd = open("/dev/crypto", O_RDWR, 0)) == -1)
 			return (-1);
 		/* close on exec */
 @@ -231,26 +233,27 @@ get_cryptodev_ciphers(const int **cnids)
 	if (count > 0)
 		*cnids = nids;
 	else
 		*cnids = NULL;
 	return (count);
+}
 /*
  * Find out what digests /dev/crypto will let us have a session for.
  * XXX note, that some of these openssl doesn't deal with yet!
  * returning them here is harmless, as long as we return NULL
  * when asked for a handler in the cryptodev_engine_digests routine
  */
 #if 0  /* not (yet?) used */
 static int
 get_cryptodev_digests(const int **cnids)
+{
 	static int nids[CRYPTO_ALGORITHM_MAX];
 	struct session_op sess;
 	int fd, i, count = 0;
 	if ((fd = get_dev_crypto()) < 0) {
 		*cnids = NULL;
 		return (0);
+	}
 	memset(&sess, 0, sizeof(sess));
 	sess.mackey = (void *)"123456789abcdefghijklmno";
 @@ -261,26 +264,27 @@ get_cryptodev_digests(const int **cnids)
 		sess.mackeylen = digests[i].keylen;
 		sess.cipher = 0;
 		if (ioctl(fd, CIOCGSESSION, &sess) != -1 &&
 		    ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
 			nids[count++] = digests[i].nid;
+	}
 	if (count > 0)
 		*cnids = nids;
 	else
 		*cnids = NULL;
 	return (count);
+}
 #endif  /* 0 */
 /*
  * Find the useable ciphers|digests from dev/crypto - this is the first
  * thing called by the engine init crud which determines what it
  * can use for ciphers from this engine. We want to return
  * only what we can do, anythine else is handled by software.
+ *
  * If we can't initialize the device to do anything useful for
  * any reason, we want to return a NULL array, and 0 length,
  * which forces everything to be done is software. By putting
  * the initalization of the device in here, we ensure we can
  * use this engine as the default, and if for whatever reason
  * /dev/crypto won't do what we want it will just be done in
 @@ -319,80 +323,80 @@ cryptodev_usable_digests(const int **nid
 	 */
 	*nids = NULL;
 	return (0);
 #endif
+}
 static int
 cryptodev_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
     const unsigned char *in, size_t inl)
+{
 	struct crypt_op cryp;
 	struct dev_crypto_state *state = ctx->cipher_data;
 	struct session_op *sess = &state->d_sess;
-	void *iiv;
+	const void *iiv;
 	unsigned char save_iv[EVP_MAX_IV_LENGTH];
 	if (state->d_fd < 0)
 		return (0);
 	if (!inl)
 		return (1);
 	if ((inl % ctx->cipher->block_size) != 0)
 		return (0);
 	memset(&cryp, 0, sizeof(cryp));
 	cryp.ses = sess->ses;
 	cryp.flags = 0;
 	cryp.len = inl;
 	cryp.src = (void *) in;
 	cryp.dst = (void *) out;
 	cryp.mac = 0;
 	cryp.op = ctx->encrypt ? COP_ENCRYPT : COP_DECRYPT;
 	if (ctx->cipher->iv_len) {
 		cryp.iv = (void *) ctx->iv;
 		if (!ctx->encrypt) {
-			iiv = (char *) in + inl - ctx->cipher->iv_len;
+			iiv = in + inl - ctx->cipher->iv_len;
 			memcpy(save_iv, iiv, ctx->cipher->iv_len);
+		}
 	} else
 		cryp.iv = NULL;
 	if (ioctl(state->d_fd, CIOCCRYPT, &cryp) == -1) {
 		/* XXX need better errror handling
 		 * this can fail for a number of different reasons.
 		 */
 		return (0);
+	}
 	if (ctx->cipher->iv_len) {
 		if (ctx->encrypt)
-			iiv = (char *) out + inl - ctx->cipher->iv_len;
+			iiv = out + inl - ctx->cipher->iv_len;
 		else
 			iiv = save_iv;
 		memcpy(ctx->iv, iiv, ctx->cipher->iv_len);
+	}
 	return (1);
+}
 static int
 cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
     const unsigned char *iv, int enc)
+{
 	struct dev_crypto_state *state = ctx->cipher_data;
 	struct session_op *sess = &state->d_sess;
-	int cipher, i;
+	int cipher = -1, i;
 	for (i = 0; ciphers[i].id; i++)
 		if (ctx->cipher->nid == ciphers[i].nid &&
 		    ctx->cipher->iv_len <= ciphers[i].ivmax &&
 		    ctx->key_len == ciphers[i].keylen) {
 			cipher = ciphers[i].id;
 			break;
+		}
 	if (!ciphers[i].id) {
 		state->d_fd = -1;
 		return (0);
+	}
 @@ -1251,27 +1255,27 @@ static DH_METHOD cryptodev_dh = {
 	NULL,
 	NULL,
 	NULL,
 	NULL,
 ,	/* flags */
 	NULL	/* app_data */
 };
 /*
  * ctrl right now is just a wrapper that doesn't do much
  * but I expect we'll want some options soon.
  */
 static int
-cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
+cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+{
 #ifdef HAVE_SYSLOG_R
 	struct syslog_data sd = SYSLOG_DATA_INIT;
 #endif
 	switch (cmd) {
 	default:
 #ifdef HAVE_SYSLOG_R
 		syslog_r(LOG_ERR, &sd,
 		    "cryptodev_ctrl: unknown command %d", cmd);
 #else
 		syslog(LOG_ERR, "cryptodev_ctrl: unknown command %d", cmd);
 #endif

 @@ -150,82 +150,90 @@ int ssl3_read_n(SSL *s, int n, int max,
 	if (!extend)
+		{
 		/* start with empty packet ... */
 		if (left == 0)
 			rb->offset = align;
 		else if (align != 0 && left >= SSL3_RT_HEADER_LENGTH)
+			{
 			/* check if next packet length is large
 			 * enough to justify payload alignment... */
 			pkt = rb->buf + rb->offset;
 			if (pkt[0] == SSL3_RT_APPLICATION_DATA
 			    && (pkt[3]<<8|pkt[4]) >= 128)
+				{
-			 	/* Note that even if packet is corrupted
+				/* Note that even if packet is corrupted
 				 * and its length field is insane, we can
 				 * only be led to wrong decision about
 				 * whether memmove will occur or not.
 				 * Header values has no effect on memmove
 				 * arguments and therefore no buffer
 				 * overrun can be triggered. */
 				memmove (rb->buf+align,pkt,left);
 				rb->offset = align;
+				}
+			}
 		s->packet = rb->buf + rb->offset;
 		s->packet_length = 0;
 		/* ... now we can act as if 'extend' was set */
+		}
-	/* extend reads should not span multiple packets for DTLS */
+	/* For DTLS/UDP reads should not span multiple packets
-	if ( (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
+	 * because the read operation returns the whole packet
-	     &&	extend)
+	 * at once (as long as it fits into the buffer). */
 	if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
+		{
-		if ( left > 0 && n > left)
+		if (left > 0 && n > left)
 			n = left;
+		}
 	/* if there is enough in the buffer from a previous read, take some */
 	if (left >= n)
+		{
 		s->packet_length+=n;
 		rb->left=left-n;
 		rb->offset+=n;
 		return(n);
+		}
 	/* else we need to read more data */
 	len = s->packet_length;
 	pkt = rb->buf+align;
 	/* Move any available bytes to front of buffer:
 	 * 'len' bytes already pointed to by 'packet',
 	 * 'left' extra ones at the end */
 	if (s->packet != pkt) /* len > 0 */
+		{
 		memmove(pkt, s->packet, len+left);
 		s->packet = pkt;
 		rb->offset = len + align;
+		}
-	max = rb->len - rb->offset;
+	if (n > (int)(rb->len - rb->offset)) /* does not happen */
 	if (n > max) /* does not happen */
+		{
 		SSLerr(SSL_F_SSL3_READ_N,ERR_R_INTERNAL_ERROR);
 		return -1;
+		}
 	if (!s->read_ahead)
-		max=n;
+		/* ignore max parameter */
 		max = n;
 	else
+		{
 		if (max < n)
 			max = n;
 		if (max > (int)(rb->len - rb->offset))
 			max = rb->len - rb->offset;
+		}
 	while (left < n)
+		{
 		/* Now we have len+left bytes at the front of s->s3->rbuf.buf
 		 * and need to read in more until we have len+n (up to
 		 * len+max if possible) */
 		clear_sys_error();
 		if (s->rbio != NULL)
+			{
 			s->rwstate=SSL_READING;
 			i=BIO_read(s->rbio,pkt+len+left, max-left);
+			}
 @@ -234,26 +242,34 @@ int ssl3_read_n(SSL *s, int n, int max,
 			SSLerr(SSL_F_SSL3_READ_N,SSL_R_READ_BIO_NOT_SET);
 			i = -1;
+			}
 		if (i <= 0)
+			{
 			rb->left = left;
 			if (s->mode & SSL_MODE_RELEASE_BUFFERS)
 				if (len+left == 0)
 					ssl3_release_read_buffer(s);
 			return(i);
+			}
 		left+=i;
 		/* reads should *never* span multiple packets for DTLS because
 		 * the underlying transport protocol is message oriented as opposed
 		 * to byte oriented as in the TLS case. */
 		if (SSL_version(s) == DTLS1_VERSION || SSL_version(s) == DTLS1_BAD_VER)
+			{
 			if (n > left)
 				n = left; /* makes the while condition false */
+			}
+		}
 	/* done reading, now the book-keeping */
 	rb->offset += n;
 	rb->left = left - n;
 	s->packet_length += n;
 	s->rwstate=SSL_NOTHING;
 	return(n);
+	}
 /* Call this to get a new input record.
  * It will return <= 0 if more data is needed, normally due to an error
  * or non-blocking IO.

	@@ -341,54 +341,63 @@ static char dlfcn_merger(DSO dso, cons		@@ -341,54 +341,63 @@ static char dlfcn_merger(DSO dso, cons
341	if(!merged)	341	if(!merged)
342	{	342	{
343	DSOerr(DSO_F_DLFCN_MERGER,	343	DSOerr(DSO_F_DLFCN_MERGER,
344	ERR_R_MALLOC_FAILURE);	344	ERR_R_MALLOC_FAILURE);
345	return(NULL);	345	return(NULL);
346	}	346	}
347	strcpy(merged, filespec2);	347	strcpy(merged, filespec2);
348	merged[spec2len] = '/';	348	merged[spec2len] = '/';
349	strcpy(&merged[spec2len + 1], filespec1);	349	strcpy(&merged[spec2len + 1], filespec1);
350	}	350	}
351	return(merged);	351	return(merged);
352	}	352	}
353		353
		354	#ifdef OPENSSL_SYS_MACOSX
		355	#define DSO_ext ".dylib"
		356	#define DSO_extlen 6
		357	#else
		358	#define DSO_ext ".so"
		359	#define DSO_extlen 3
		360	#endif
		361
		362
354	static char dlfcn_name_converter(DSO dso, const char *filename)	363	static char dlfcn_name_converter(DSO dso, const char *filename)
355	{	364	{
356	char *translated;	365	char *translated;
357	int len, rsize, transform;	366	int len, rsize, transform;
358		367
359	len = strlen(filename);	368	len = strlen(filename);
360	rsize = len + 1;	369	rsize = len + 1;
361	transform = (strstr(filename, "/") == NULL);	370	transform = (strstr(filename, "/") == NULL);
362	if(transform)	371	if(transform)
363	{	372	{
364	/* We will convert this to "%s.so" or "lib%s.so" */	373	/* We will convert this to "%s.so" or "lib%s.so" etc */
365	rsize += 3; /* The length of ".so" */	374	rsize += DSO_extlen; /* The length of ".so" */
366	if ((DSO_flags(dso) & DSO_FLAG_NAME_TRANSLATION_EXT_ONLY) == 0)	375	if ((DSO_flags(dso) & DSO_FLAG_NAME_TRANSLATION_EXT_ONLY) == 0)
367	rsize += 3; /* The length of "lib" */	376	rsize += 3; /* The length of "lib" */
368	}	377	}
369	translated = OPENSSL_malloc(rsize);	378	translated = OPENSSL_malloc(rsize);
370	if(translated == NULL)	379	if(translated == NULL)
371	{	380	{
372	DSOerr(DSO_F_DLFCN_NAME_CONVERTER,	381	DSOerr(DSO_F_DLFCN_NAME_CONVERTER,
373	DSO_R_NAME_TRANSLATION_FAILED);	382	DSO_R_NAME_TRANSLATION_FAILED);
374	return(NULL);	383	return(NULL);
375	}	384	}
376	if(transform)	385	if(transform)
377	{	386	{
378	if ((DSO_flags(dso) & DSO_FLAG_NAME_TRANSLATION_EXT_ONLY) == 0)	387	if ((DSO_flags(dso) & DSO_FLAG_NAME_TRANSLATION_EXT_ONLY) == 0)
379	snprintf(translated, rsize, "lib%s.so", filename);	388	snprintf(translated, rsize, "lib%s" DSO_ext, filename);
380	else	389	else
381	snprintf(translated, rsize, "%s.so", filename);	390	snprintf(translated, rsize, "%s" DSO_ext, filename);
382	}	391	}
383	else	392	else
384	snprintf(translated, rsize, "%s", filename);	393	snprintf(translated, rsize, "%s", filename);
385	return(translated);	394	return(translated);
386	}	395	}
387		396
388	#ifdef __sgi	397	#ifdef __sgi
389	/*	398	/*
390	This is a quote from IRIX manual for dladdr(3c):	399	This is a quote from IRIX manual for dladdr(3c):
391		400
392	<dlfcn.h> does not contain a prototype for dladdr or definition of	401	<dlfcn.h> does not contain a prototype for dladdr or definition of
393	Dl_info. The #include <dlfcn.h> in the SYNOPSIS line is traditional,	402	Dl_info. The #include <dlfcn.h> in the SYNOPSIS line is traditional,
394	but contains no dladdr prototype and no IRIX library contains an	403	but contains no dladdr prototype and no IRIX library contains an

 @@ -220,22 +220,22 @@ void lh_node_usage_stats_bio(const _LHAS
 #define LHM_lh_doall(type, lh,fn) lh_doall(CHECKED_LHASH_OF(type, lh), fn)
 #define LHM_lh_doall_arg(type, lh, fn, arg_type, arg) \
   lh_doall_arg(CHECKED_LHASH_OF(type, lh), fn, CHECKED_PTR_OF(arg_type, arg))
 #define LHM_lh_num_items(type, lh) lh_num_items(CHECKED_LHASH_OF(type, lh))
 #define LHM_lh_down_load(type, lh) (CHECKED_LHASH_OF(type, lh)->down_load)
 #define LHM_lh_node_stats_bio(type, lh, out) \
   lh_node_stats_bio(CHECKED_LHASH_OF(type, lh), out)
 #define LHM_lh_node_usage_stats_bio(type, lh, out) \
   lh_node_usage_stats_bio(CHECKED_LHASH_OF(type, lh), out)
 #define LHM_lh_stats_bio(type, lh, out) \
   lh_stats_bio(CHECKED_LHASH_OF(type, lh), out)
 #define LHM_lh_free(type, lh) lh_free(CHECKED_LHASH_OF(type, lh))
-DECLARE_LHASH_OF(STRING);
+DECLARE_LHASH_OF(OPENSSL_STRING);
-DECLARE_LHASH_OF(CSTRING);
+DECLARE_LHASH_OF(OPENSSL_CSTRING);
 #ifdef  __cplusplus
+}
 #endif
 #endif