--- openssl-0.9.8g.orig/openssl.ld
+++ openssl-0.9.8g/openssl.ld
@@ -0,0 +1,5 @@
+OPENSSL_0.9.8 {
+	 global:
+		 *;
+};
+
--- openssl-0.9.8g.orig/Makefile.shared
+++ openssl-0.9.8g/Makefile.shared
@@ -151,9 +151,9 @@
 	SHLIB_SUFFIX=; \
 	ALLSYMSFLAGS='-Wl,--whole-archive'; \
 	NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
-	SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-Bsymbolic -Wl,-soname=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"
+	SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-soname=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"
 
-DO_GNU_APP=LDFLAGS="$(CFLAGS) -Wl,-rpath,$(LIBRPATH)"
+DO_GNU_APP=LDFLAGS="$(CFLAGS)"
 
 #This is rather special.  It's a special target with which one can link
 #applications without bothering with any features that have anything to
--- openssl-0.9.8g.orig/Configure
+++ openssl-0.9.8g/Configure
@@ -1,4 +1,4 @@
-:
+#!/usr/local/bin/perl
 eval 'exec perl -S $0 ${1+"$@"}'
     if $running_under_some_shell;
 ##
@@ -118,7 +118,8 @@
 my $x86_coff_asm="x86cpuid-cof.o:bn86-cof.o co86-cof.o:dx86-cof.o yx86-cof.o:ax86-cof.o:bx86-cof.o:mx86-cof.o:sx86-cof.o s512sse2-cof.o:cx86-cof.o:rx86-cof.o:rm86-cof.o:r586-cof.o";
 my $x86_out_asm="x86cpuid-out.o:bn86-out.o co86-out.o:dx86-out.o yx86-out.o:ax86-out.o:bx86-out.o:mx86-out.o:sx86-out.o s512sse2-out.o:cx86-out.o:rx86-out.o:rm86-out.o:r586-out.o";
 
-my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o::::md5-x86_64.o:::rc4-x86_64.o::";
+#my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o::::md5-x86_64.o:::rc4-x86_64.o::";
+my $x86_64_asm="x86_64cpuid.o:x86_64-gcc.o::::md5-x86_64.o:::::";
 my $ia64_asm=":bn-ia64.o::aes_core.o aes_cbc.o aes-ia64.o:::sha1-ia64.o sha256-ia64.o sha512-ia64.o::rc4-ia64.o::";
 
 my $no_asm="::::::::::";
@@ -308,6 +309,47 @@
 "osf1-alpha-cc",  "cc:-std1 -tune host -O4 -readonly_strings::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${no_asm}:dlfcn:alpha-osf1-shared:::.so",
 "tru64-alpha-cc", "cc:-std1 -tune host -fast -readonly_strings::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${no_asm}:dlfcn:alpha-osf1-shared::-msym:.so",
 
+# Debian GNU/* (various architectures)
+"debian-alpha","gcc:-DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-alpha-ev4","gcc:-DTERMIO -O3 -Wa,--noexecstack -mcpu=ev4 -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-alpha-ev5","gcc:-DTERMIO -O3 -Wa,--noexecstack -mcpu=ev5 -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-arm","gcc:-DL_ENDIAN -DTERMIO -O2 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG DES_RISC1::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-armeb","gcc:-DB_ENDIAN -DTERMIO -O2 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG DES_RISC1::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-armel","gcc:-DL_ENDIAN -DTERMIO -O2 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG DES_RISC1::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+#"debian-amd64","gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-amd64", "gcc:-m64 -DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-kfreebsd-amd64","gcc:-m64 -DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -Wall -DMD32_REG_T=int::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+#"debian-freebsd-alpha","gcc:-DTERMIOS -O -Wa,--noexecstack -fomit-frame-pointer::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC2::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-kfreebsd-i386","gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -march=i486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-hppa","gcc:-DB_ENDIAN -DTERMIO -O2 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG MD2_CHAR RC4_INDEX::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-hurd-i386","gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -m486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-ia64","gcc:-DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK RC4_CHAR:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+#"debian-i386","gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -fomit-frame-pointer -m486 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::dlfcn:linux-shared:-fPIC",
+"debian-i386","gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-i386-i486","gcc:-DL_ENDIAN -DTERMIO -O3 -march=i486 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-i386-i586","gcc:-DL_ENDIAN -DTERMIO -O3 -march=i586 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-i386-i686/cmov","gcc:-DL_ENDIAN -DTERMIO -O3 -march=i686 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-m68k","gcc:-DB_ENDIAN -DTERMIO -O2 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG MD2_CHAR RC4_INDEX::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-mips",   "gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-mipsel",   "gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG RC2_CHAR RC4_INDEX DES_INT DES_UNROLL DES_RISC2::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-netbsd-i386",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -m486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-netbsd-m68k",	"gcc:-DB_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-netbsd-sparc",	"gcc:-DB_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -mv8 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-openbsd-alpha","gcc:-DTERMIOS -O3 -Wa,--noexecstack -g::(unknown):::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-openbsd-i386",  "gcc:-DL_ENDIAN -DTERMIOS -O3 -Wa,--noexecstack -g -m486::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-openbsd-mips","gcc:-O2 -Wa,--noexecstack -g -DL_ENDIAN::(unknown)::BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC2 DES_PTR BF_PTR:::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-powerpc","gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG DES_UNROLL DES_RISC2 DES_PTR MD2_CHAR RC4_INDEX::linux_ppc32.o::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-ppc64","gcc:-m64 -DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL::linux_ppc64.o::::::::::dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-s390","gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", 
+"debian-sh3",   "gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-sh4",   "gcc:-DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-sh3eb",   "gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-sh4eb",   "gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-m32r","gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-sparc","gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::::::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-sparc-v8","gcc:-DB_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -mcpu=v8 -g -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8.o:des_enc-sparc.o fcrypt_b.o:::::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+"debian-sparc-v9","gcc:-DB_ENDIAN -DTERMIO -O3 -mcpu=v9 -Wa,--noexecstack -Wa,-Av8plus -g -Wall -DULTRASPARC -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::sparcv8plus.o:des_enc-sparc.o fcrypt_b.o:::md5-sparcv8plus.o::::::dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+
 ####
 #### Variety of LINUX:-)
 ####
@@ -476,7 +518,7 @@
 # Cygwin
 "Cygwin-pre1.3", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::(unknown):CYGWIN32::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:win32",
 "Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall:::CYGWIN32::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_coff_asm}:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
-"debug-Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -march=i486 -Wall -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -g -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror:::CYGWIN32:::${no_asm}:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
+-"debug-Cygwin", "gcc:-DTERMIOS -DL_ENDIAN -march=i486 -Wall -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -DOPENSSL_NO_ASM -g -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror:::CYGWIN32:::${no_asm}:dlfcn:cygwin-shared:-D_WINDLL:-shared:.dll.a",
 
 # NetWare from David Ward (dsward@novell.com) - requires MetroWerks NLM development tools
 # netware-clib => legacy CLib c-runtime support
@@ -1300,6 +1342,8 @@
 	$shlib_minor=$2;
 	}
 
+$shared_ldflag .= " -Wl,--version-script=openssl.ld";
+
 open(IN,'<Makefile.org') || die "unable to read Makefile.org:$!\n";
 unlink("$Makefile.new") || die "unable to remove old $Makefile.new:$!\n" if -e "$Makefile.new";
 open(OUT,">$Makefile.new") || die "unable to create $Makefile.new:$!\n";
@@ -1371,7 +1415,8 @@
 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
 		{
 		my $sotmp = $1;
-		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/;
+#		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/;
+		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp/;
 		}
 	elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/)
 		{
@@ -1490,7 +1535,7 @@
 	if	(/^#define\s+OPENSSLDIR/)
 		{ print OUT "#define OPENSSLDIR \"$openssldir\"\n"; }
 	elsif	(/^#define\s+ENGINESDIR/)
-		{ print OUT "#define ENGINESDIR \"$prefix/lib/engines\"\n"; }
+		{ print OUT "#define ENGINESDIR \"$prefix/lib/ssl/engines\"\n"; }
 	elsif	(/^#((define)|(undef))\s+OPENSSL_EXPORT_VAR_AS_FUNCTION/)
 		{ printf OUT "#undef OPENSSL_EXPORT_VAR_AS_FUNCTION\n"
 			if $export_var_as_fn;
--- openssl-0.9.8g.orig/config
+++ openssl-0.9.8g/config
@@ -162,8 +162,8 @@
 	echo "${MACHINE}-whatever-linux1"; exit 0
 	;;
 
-    GNU*)
-	echo "hurd-x86"; exit 0;
+    GNU:*|GNU/*:*)
+	echo "${MACHINE}-gnuish"; exit 0;
 	;;
 
     LynxOS:*)
--- openssl-0.9.8g.orig/Makefile
+++ openssl-0.9.8g/Makefile
@@ -11,11 +11,11 @@
 SHLIB_VERSION_HISTORY=
 SHLIB_MAJOR=0
 SHLIB_MINOR=9.8
-SHLIB_EXT=
-PLATFORM=dist
-OPTIONS= no-camellia no-gmp no-krb5 no-mdc2 no-rc5 no-rfc3779 no-seed no-shared no-tlsext no-zlib no-zlib-dynamic
-CONFIGURE_ARGS=dist
-SHLIB_TARGET=
+SHLIB_EXT=.so.$(SHLIB_MAJOR).$(SHLIB_MINOR)
+PLATFORM=debian-amd64
+OPTIONS=--prefix=/usr --openssldir=/usr/lib/ssl enable-zlib enable-tlsext no-camellia no-gmp no-idea no-krb5 no-mdc2 no-rc5 no-rfc3779 no-seed no-shared no-zlib-dynamic
+CONFIGURE_ARGS=--prefix=/usr --openssldir=/usr/lib/ssl no-idea no-mdc2 no-rc5 zlib enable-tlsext debian-amd64
+SHLIB_TARGET=linux-shared
 
 # HERE indicates where this Makefile lives.  This can be used to indicate
 # where sub-Makefiles are expected to be.  Currently has very limited usage,
@@ -26,10 +26,10 @@
 # for, say, /usr/ and yet have everything installed to /tmp/somedir/usr/.
 # Normally it is left empty.
 INSTALL_PREFIX=
-INSTALLTOP=/usr/local/ssl
+INSTALLTOP=/usr
 
 # Do not edit this manually. Use Configure --openssldir=DIR do change this!
-OPENSSLDIR=/usr/local/ssl
+OPENSSLDIR=/usr/lib/ssl
 
 # NO_IDEA - Define to build without the IDEA algorithm
 # NO_RC4  - Define to build without the RC4 algorithm
@@ -59,11 +59,11 @@
 # equal 4.
 # PKCS1_CHECK - pkcs1 tests.
 
-CC= cc
-CFLAG= -O
-DEPFLAG= -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_GMP -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED -DOPENSSL_NO_TLSEXT 
+CC= gcc
+CFLAG= -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -m64 -DL_ENDIAN -DTERMIO -O3 -Wa,--noexecstack -g -Wall -DMD32_REG_T=int -DMD5_ASM
+DEPFLAG= -DOPENSSL_NO_CAMELLIA -DOPENSSL_NO_GMP -DOPENSSL_NO_IDEA -DOPENSSL_NO_MDC2 -DOPENSSL_NO_RC5 -DOPENSSL_NO_RFC3779 -DOPENSSL_NO_SEED 
 PEX_LIBS= 
-EX_LIBS= 
+EX_LIBS= -ldl -lz
 EXE_EXT= 
 ARFLAGS= 
 AR=ar $(ARFLAGS) r
@@ -71,7 +71,7 @@
 PERL= /usr/bin/perl
 TAR= tar
 TARFLAGS= --no-recursion
-MAKEDEPPROG=makedepend
+MAKEDEPPROG= gcc
 
 # We let the C compiler driver to take care of .s files. This is done in
 # order to be excused from maintaining a separate set of architecture
@@ -86,15 +86,15 @@
 PROCESSOR= 
 
 # CPUID module collects small commonly used assembler snippets
-CPUID_OBJ= 
-BN_ASM= bn_asm.o
+CPUID_OBJ= x86_64cpuid.o
+BN_ASM= x86_64-gcc.o
 DES_ENC= des_enc.o fcrypt_b.o
 AES_ASM_OBJ= aes_core.o aes_cbc.o
 BF_ENC= bf_enc.o
 CAST_ENC= c_enc.o
 RC4_ENC= rc4_enc.o
 RC5_ENC= rc5_enc.o
-MD5_ASM_OBJ= 
+MD5_ASM_OBJ= md5-x86_64.o
 SHA1_ASM_OBJ= 
 RMD160_ASM_OBJ= 
 
@@ -106,14 +106,14 @@
 ZLIB_INCLUDE=
 LIBZLIB=
 
-DIRS=   crypto ssl engines apps test tools
+DIRS=   crypto ssl engines apps tools
 SHLIBDIRS= crypto ssl
 
 # dirs in crypto to build
 SDIRS=  \
 	objects \
 	md2 md4 md5 sha hmac ripemd \
-	des aes rc2 rc4 idea bf cast \
+	des aes rc2 rc4 bf cast \
 	bn ec rsa dsa ecdsa dh ecdh dso engine \
 	buffer bio stack lhash rand err \
 	evp asn1 pem x509 x509v3 conf txt_db pkcs7 pkcs12 comp ocsp ui krb5 \
@@ -127,10 +127,11 @@
 
 MAKEFILE= Makefile
 
-MANDIR=$(OPENSSLDIR)/man
+MANDIR=/usr/share/man
 MAN1=1
 MAN3=3
-MANSUFFIX=
+MANSUFFIX=ssl
+MANSECTION=SSL
 SHELL=/bin/sh
 
 TOP=    .
@@ -141,8 +142,8 @@
 SHARED_CRYPTO=libcrypto$(SHLIB_EXT)
 SHARED_SSL=libssl$(SHLIB_EXT)
 SHARED_LIBS=
-SHARED_LIBS_LINK_EXTS=
-SHARED_LDFLAGS=
+SHARED_LIBS_LINK_EXTS=.so
+SHARED_LDFLAGS=-m64 -Wl,--version-script=openssl.ld
 
 GENERAL=        Makefile
 BASENAME=       openssl
@@ -310,7 +311,8 @@
 	    echo 'Description: OpenSSL cryptography library'; \
 	    echo 'Version: '$(VERSION); \
 	    echo 'Requires: '; \
-	    echo 'Libs: -L$${libdir} -lcrypto $(EX_LIBS)'; \
+	    echo 'Libs: -L$${libdir} -lcrypto'; \
+	    echo 'Libs.private: $(EX_LIBS)'; \
 	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libcrypto.pc
 
 libssl.pc: Makefile
@@ -323,7 +325,8 @@
 	    echo 'Description: Secure Sockets Layer and cryptography libraries'; \
 	    echo 'Version: '$(VERSION); \
 	    echo 'Requires: '; \
-	    echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \
+	    echo 'Libs: -L$${libdir} -lssl'; \
+	    echo 'Libs.private: -lcrypto $(EX_LIBS)'; \
 	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libssl.pc
 
 openssl.pc: Makefile
@@ -336,7 +339,8 @@
 	    echo 'Description: Secure Sockets Layer and cryptography libraries and tools'; \
 	    echo 'Version: '$(VERSION); \
 	    echo 'Requires: '; \
-	    echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \
+	    echo 'Libs: -L$${libdir} -lssl -lcrypto'; \
+	    echo 'Libs.private: $(EX_LIBS)'; \
 	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > openssl.pc
 
 Makefile: Makefile.org Configure config
@@ -480,7 +484,7 @@
 install_sw:
 	@$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \
 		$(INSTALL_PREFIX)$(INSTALLTOP)/lib \
-		$(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines \
+		$(INSTALL_PREFIX)$(INSTALLTOP)/lib/ssl/engines \
 		$(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig \
 		$(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl \
 		$(INSTALL_PREFIX)$(OPENSSLDIR)/misc \
@@ -558,7 +562,7 @@
 		echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
 		(cd `$(PERL) util/dirname.pl $$i`; \
 		sh -c "$$pod2man \
-			--section=$$sec --center=OpenSSL \
+			--section=$${sec}$(MANSECTION) --center=OpenSSL \
 			--release=$(VERSION) `basename $$i`") \
 			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
 		$(PERL) util/extract-names.pl < $$i | \
@@ -575,7 +579,7 @@
 		echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
 		(cd `$(PERL) util/dirname.pl $$i`; \
 		sh -c "$$pod2man \
-			--section=$$sec --center=OpenSSL \
+			--section=$${sec}$(MANSECTION) --center=OpenSSL \
 			--release=$(VERSION) `basename $$i`") \
 			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
 		$(PERL) util/extract-names.pl < $$i | \
--- openssl-0.9.8g.orig/Makefile.org
+++ openssl-0.9.8g/Makefile.org
@@ -104,7 +104,7 @@
 ZLIB_INCLUDE=
 LIBZLIB=
 
-DIRS=   crypto ssl engines apps test tools
+DIRS=   crypto ssl engines apps tools
 SHLIBDIRS= crypto ssl
 
 # dirs in crypto to build
@@ -125,10 +125,11 @@
 
 MAKEFILE= Makefile
 
-MANDIR=$(OPENSSLDIR)/man
+MANDIR=/usr/share/man
 MAN1=1
 MAN3=3
-MANSUFFIX=
+MANSUFFIX=ssl
+MANSECTION=SSL
 SHELL=/bin/sh
 
 TOP=    .
@@ -308,7 +309,8 @@
 	    echo 'Description: OpenSSL cryptography library'; \
 	    echo 'Version: '$(VERSION); \
 	    echo 'Requires: '; \
-	    echo 'Libs: -L$${libdir} -lcrypto $(EX_LIBS)'; \
+	    echo 'Libs: -L$${libdir} -lcrypto'; \
+	    echo 'Libs.private: $(EX_LIBS)'; \
 	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libcrypto.pc
 
 libssl.pc: Makefile
@@ -321,7 +323,8 @@
 	    echo 'Description: Secure Sockets Layer and cryptography libraries'; \
 	    echo 'Version: '$(VERSION); \
 	    echo 'Requires: '; \
-	    echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \
+	    echo 'Libs: -L$${libdir} -lssl'; \
+	    echo 'Libs.private: -lcrypto $(EX_LIBS)'; \
 	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > libssl.pc
 
 openssl.pc: Makefile
@@ -334,7 +337,8 @@
 	    echo 'Description: Secure Sockets Layer and cryptography libraries and tools'; \
 	    echo 'Version: '$(VERSION); \
 	    echo 'Requires: '; \
-	    echo 'Libs: -L$${libdir} -lssl -lcrypto $(EX_LIBS)'; \
+	    echo 'Libs: -L$${libdir} -lssl -lcrypto'; \
+	    echo 'Libs.private: $(EX_LIBS)'; \
 	    echo 'Cflags: -I$${includedir} $(KRB5_INCLUDES)' ) > openssl.pc
 
 Makefile: Makefile.org Configure config
@@ -478,7 +482,7 @@
 install_sw:
 	@$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \
 		$(INSTALL_PREFIX)$(INSTALLTOP)/lib \
-		$(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines \
+		$(INSTALL_PREFIX)$(INSTALLTOP)/lib/ssl/engines \
 		$(INSTALL_PREFIX)$(INSTALLTOP)/lib/pkgconfig \
 		$(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl \
 		$(INSTALL_PREFIX)$(OPENSSLDIR)/misc \
@@ -556,7 +560,7 @@
 		echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
 		(cd `$(PERL) util/dirname.pl $$i`; \
 		sh -c "$$pod2man \
-			--section=$$sec --center=OpenSSL \
+			--section=$${sec}$(MANSECTION) --center=OpenSSL \
 			--release=$(VERSION) `basename $$i`") \
 			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
 		$(PERL) util/extract-names.pl < $$i | \
@@ -573,7 +577,7 @@
 		echo "installing man$$sec/$$fn.$${sec}$(MANSUFFIX)"; \
 		(cd `$(PERL) util/dirname.pl $$i`; \
 		sh -c "$$pod2man \
-			--section=$$sec --center=OpenSSL \
+			--section=$${sec}$(MANSECTION) --center=OpenSSL \
 			--release=$(VERSION) `basename $$i`") \
 			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
 		$(PERL) util/extract-names.pl < $$i | \
--- openssl-0.9.8g.orig/os2/backwardify.pl
+++ openssl-0.9.8g/os2/backwardify.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/perl -w
+#!/usr/local/bin/perl
 use strict;
 
 # Use as $0
--- openssl-0.9.8g.orig/doc/Makefile
+++ openssl-0.9.8g/doc/Makefile
@@ -0,0 +1,40 @@
+VERSION =
+
+#PODS = $(wildcard *.pod)
+#MANS = $(addsuffix .man, $(basename $(PODS)))
+
+MANS = openssl.1 ssl.3 crypto.3
+
+P2M = pod2man --center='OpenSSL Documentation' --release="OpenSSL $(VERSION)"
+
+all: manpages
+
+.PHONY: manpages 
+
+manpages: openssl.1 crypto.3 ssl.3
+
+openssl.1:
+	$(P2M) --section=1 openssl.pod > openssl.1
+
+crypto.3:
+	$(P2M) --section=3 crypto.pod > crypto.3
+
+ssl.3:
+	$(P2M) --section=3 ssl.pod > ssl.3
+
+.PHONY: install
+install:
+	mkdir -p $(INSTALL_PREFIX)$(INSTALLTOP)/share/man/man1
+	mkdir -p $(INSTALL_PREFIX)$(INSTALLTOP)/share/man/man3
+	install -m 644 -p openssl.1 $(INSTALL_PREFIX)$(INSTALLTOP)/share/man/man1
+	install -m 644 -p crypto.3 $(INSTALL_PREFIX)$(INSTALLTOP)/share/man/man3
+	install -m 644 -p ssl.3 $(INSTALL_PREFIX)$(INSTALLTOP)/share/man/man3
+	rm -f $(MANS)
+
+.PHONY: clean
+clean:
+	rm -f $(MANS)
+
+.PHONY: realclean
+realclean:
+	-$(MAKE) clean
--- openssl-0.9.8g.orig/doc/apps/c_rehash.pod
+++ openssl-0.9.8g/doc/apps/c_rehash.pod
@@ -0,0 +1,55 @@
+
+=pod
+
+=head1 NAME
+
+c_rehash - Create symbolic links to files named by the hash values
+
+=head1 SYNOPSIS
+
+B<c_rehash>
+[directory] ...
+
+=head1 DESCRIPTION
+
+c_rehash scans directories and takes a hash value of each .pem and .crt file in the directory. It then creates symbolic links for each of the files named by the hash value. This is useful as many programs require directories to be set up like this in order to find the certificates they require. 
+
+If any directories are named on the command line then these directories are processed in turn. If not then and the environment variable SSL_CERT_DIR is defined then that is consulted. This variable should be a colon (:) separated list of directories, all of which will be processed. If neither of these conditions are true then /usr/lib/ssl/certs is processed. 
+
+For each directory that is to be processed he user must have write permissions on the directory, if they do not then nothing will be printed for that directory.
+
+Note that this program deletes all the symbolic links that look like ones that it creates before processing a directory. Beware that if you run the program on a directory that contains symbolic links for other purposes that are named in the same format as those created by this program they will be lost.
+
+The hashes for certificate files are of the form <hash>.<n> where n is an integer. If the hash value already exists then n will be incremented, unless the file is a duplicate. Duplicates are detected using the fingerprint of the certificate. A warning will be printed if a duplicate is detected. The hashes for CRL files are of the form <hash>.r<n> and have the same behavior.
+
+The program will also warn if there are files with extension .pem which are not certificate or CRL files.
+
+The program uses the openssl program to compute the hashes and fingerprints. It expects the executable to be named openssl and be on the PATH, or in the /usr/lib/ssl/bin directory. If the OPENSSL environment variable is defined then this is used instead as the executable that provides the hashes and fingerprints. When called as $OPENSSL x509 -hash -fingerprint -noout -in $file it must output the hash of $file on the first line followed by the fingerprint on the second line, optionally prefixed with some text and an equals sign (=). 
+
+=head1 OPTIONS
+
+None
+
+=head1 ENVIRONMENT
+
+=over 4
+
+=item B<OPENSSL>
+
+The name (and path) of an executable to use to generate hashes and fingerprints (see above).
+
+=item B<SSL_CERT_DIR>
+
+Colon separated list of directories to operate on. Ignored if directories are listed on the command line.
+
+=head1 SEE ALSO
+
+L<openssl(1)|openssl(1)>, L<x509(1)|x509(1)>
+
+=back
+
+=head1 BUGS
+
+No known bugs
+
+=cut
--- openssl-0.9.8g.orig/doc/ssl/SSL_CTX_set_options.pod
+++ openssl-0.9.8g/doc/ssl/SSL_CTX_set_options.pod
@@ -2,7 +2,7 @@
 
 =head1 NAME
 
-SSL_CTX_set_options, SSL_set_options, SSL_CTX_get_options, SSL_get_options - manipulate SSL engine options
+SSL_CTX_set_options, SSL_set_options, SSL_CTX_clear_options, SSL_clear_options, SSL_CTX_get_options, SSL_get_options, SSL_get_secure_renegotiation_support - manipulate SSL options
 
 =head1 SYNOPSIS
 
@@ -11,26 +11,41 @@
  long SSL_CTX_set_options(SSL_CTX *ctx, long options);
  long SSL_set_options(SSL *ssl, long options);
 
+ long SSL_CTX_clear_options(SSL_CTX *ctx, long options);
+ long SSL_clear_options(SSL *ssl, long options);
+
  long SSL_CTX_get_options(SSL_CTX *ctx);
  long SSL_get_options(SSL *ssl);
 
+ long SSL_get_secure_renegotiation_support(SSL *ssl);
+
 =head1 DESCRIPTION
 
+Note: all these functions are implemented using macros.
+
 SSL_CTX_set_options() adds the options set via bitmask in B<options> to B<ctx>.
 Options already set before are not cleared!
 
 SSL_set_options() adds the options set via bitmask in B<options> to B<ssl>.
 Options already set before are not cleared!
 
+SSL_CTX_clear_options() clears the options set via bitmask in B<options>
+to B<ctx>.
+
+SSL_clear_options() clears the options set via bitmask in B<options> to B<ssl>.
+
 SSL_CTX_get_options() returns the options set for B<ctx>.
 
 SSL_get_options() returns the options set for B<ssl>.
 
+SSL_get_secure_renegotiation_support() indicates whether the peer supports
+secure renegotiation.
+
 =head1 NOTES
 
 The behaviour of the SSL library can be changed by setting several options.
 The options are coded as bitmasks and can be combined by a logical B<or>
-operation (|). Options can only be added but can never be reset.
+operation (|).
 
 SSL_CTX_set_options() and SSL_set_options() affect the (external)
 protocol behaviour of the SSL library. The (internal) behaviour of
@@ -63,18 +78,7 @@
 
 =item SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
 
-ssl3.netscape.com:443, first a connection is established with RC4-MD5.
-If it is then resumed, we end up using DES-CBC3-SHA.  It should be
-RC4-MD5 according to 7.6.1.3, 'cipher_suite'.
-
-Netscape-Enterprise/2.01 (https://merchant.netscape.com) has this bug.
-It only really shows up when connecting via SSLv2/v3 then reconnecting
-via SSLv3. The cipher list changes....
-
-NEW INFORMATION.  Try connecting with a cipher list of just
-DES-CBC-SHA:RC4-MD5.  For some weird reason, each new connection uses
-RC4-MD5, but a re-connect tries to use DES-CBC-SHA.  So netscape, when
-doing a re-connect, always takes the first cipher in the cipher list.
+As of OpenSSL 0.9.8q and 1.0.0c, this option has no effect.
 
 =item SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG
 
@@ -199,7 +203,7 @@
 
 When performing renegotiation as a server, always start a new session
 (i.e., session resumption requests are only accepted in the initial
-handshake).  This option is not needed for clients.
+handshake). This option is not needed for clients.
 
 =item SSL_OP_NO_TICKET
 
@@ -210,15 +214,107 @@
 If this option is set this functionality is disabled and tickets will
 not be used by clients or servers.
 
+=item SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION
+
+Allow legacy insecure renegotiation between OpenSSL and unpatched clients or
+servers. See the B<SECURE RENEGOTIATION> section for more details.
+
+=item SSL_OP_LEGACY_SERVER_CONNECT
+
+Allow legacy insecure renegotiation between OpenSSL and unpatched servers
+B<only>: this option is currently set by default. See the
+B<SECURE RENEGOTIATION> section for more details.
+
 =back
 
+=head1 SECURE RENEGOTIATION
+
+OpenSSL 0.9.8m and later always attempts to use secure renegotiation as
+described in RFC5746. This counters the prefix attack described in
+CVE-2009-3555 and elsewhere.
+
+The deprecated and highly broken SSLv2 protocol does not support
+renegotiation at all: its use is B<strongly> discouraged.
+
+This attack has far reaching consequences which application writers should be
+aware of. In the description below an implementation supporting secure
+renegotiation is referred to as I<patched>. A server not supporting secure
+renegotiation is referred to as I<unpatched>.
+
+The following sections describe the operations permitted by OpenSSL's secure
+renegotiation implementation.
+
+=head2 Patched client and server
+
+Connections and renegotiation are always permitted by OpenSSL implementations.
+
+=head2 Unpatched client and patched OpenSSL server
+
+The initial connection suceeds but client renegotiation is denied by the
+server with a B<no_renegotiation> warning alert if TLS v1.0 is used or a fatal
+B<handshake_failure> alert in SSL v3.0.
+
+If the patched OpenSSL server attempts to renegotiate a fatal
+B<handshake_failure> alert is sent. This is because the server code may be
+unaware of the unpatched nature of the client.
+
+If the option B<SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION> is set then
+renegotiation B<always> succeeds.
+
+B<NB:> a bug in OpenSSL clients earlier than 0.9.8m (all of which are
+unpatched) will result in the connection hanging if it receives a
+B<no_renegotiation> alert. OpenSSL versions 0.9.8m and later will regard
+a B<no_renegotiation> alert as fatal and respond with a fatal
+B<handshake_failure> alert. This is because the OpenSSL API currently has
+no provision to indicate to an application that a renegotiation attempt
+was refused.
+
+=head2 Patched OpenSSL client and unpatched server.
+
+If the option B<SSL_OP_LEGACY_SERVER_CONNECT> or
+B<SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION> is set then initial connections
+and renegotiation between patched OpenSSL clients and unpatched servers
+succeeds. If neither option is set then initial connections to unpatched
+servers will fail.
+
+The option B<SSL_OP_LEGACY_SERVER_CONNECT> is currently set by default even
+though it has security implications: otherwise it would be impossible to
+connect to unpatched servers (i.e. all of them initially) and this is clearly
+not acceptable. Renegotiation is permitted because this does not add any
+additional security issues: during an attack clients do not see any
+renegotiations anyway.
+
+As more servers become patched the option B<SSL_OP_LEGACY_SERVER_CONNECT> will
+B<not> be set by default in a future version of OpenSSL.
+
+OpenSSL client applications wishing to ensure they can connect to unpatched
+servers should always B<set> B<SSL_OP_LEGACY_SERVER_CONNECT>
+
+OpenSSL client applications that want to ensure they can B<not> connect to
+unpatched servers (and thus avoid any security issues) should always B<clear>
+B<SSL_OP_LEGACY_SERVER_CONNECT> using SSL_CTX_clear_options() or
+SSL_clear_options().
+
+The difference between the B<SSL_OP_LEGACY_SERVER_CONNECT> and
+B<SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION> options is that
+B<SSL_OP_LEGACY_SERVER_CONNECT> enables initial connections and secure
+renegotiation between OpenSSL clients and unpatched servers B<only>, while
+B<SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION> allows initial connections
+and renegotiation between OpenSSL and unpatched clients or servers.
+
 =head1 RETURN VALUES
 
 SSL_CTX_set_options() and SSL_set_options() return the new options bitmask
 after adding B<options>.
 
+SSL_CTX_clear_options() and SSL_clear_options() return the new options bitmask
+after clearing B<options>.
+
 SSL_CTX_get_options() and SSL_get_options() return the current bitmask.
 
+SSL_get_secure_renegotiation_support() returns 1 is the peer supports
+secure renegotiation and 0 if it does not.
+
 =head1 SEE ALSO
 
 L<ssl(3)|ssl(3)>, L<SSL_new(3)|SSL_new(3)>, L<SSL_clear(3)|SSL_clear(3)>,
@@ -241,4 +337,11 @@
 can be disabled with this option (in OpenSSL 0.9.6d, it was always
 enabled).
 
+SSL_CTX_clear_options() and SSL_clear_options() were first added in OpenSSL
+0.9.8m.
+
+B<SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION>, B<SSL_OP_LEGACY_SERVER_CONNECT>
+and the function SSL_get_secure_renegotiation_support() were first added in
+OpenSSL 0.9.8m.
+
 =cut
--- openssl-0.9.8g.orig/VMS/VMSify-conf.pl
+++ openssl-0.9.8g/VMS/VMSify-conf.pl
@@ -1,4 +1,4 @@
-#! /usr/bin/perl
+#!/usr/local/bin/perl
 
 use strict;
 use warnings;
--- openssl-0.9.8g.orig/apps/CA.pl
+++ openssl-0.9.8g/apps/CA.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/perl
+#!/usr/local/bin/perl
 #
 # CA - wrapper around ca to make it easier to use ... basically ca requires
 #      some setup stuff to be done before you can use it and this makes
@@ -65,6 +65,7 @@
 foreach (@ARGV) {
 	if ( /^(-\?|-h|-help)$/ ) {
 	    print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
+	    print STDERR "usage: CA -signcert certfile keyfile|-newcert|-newreq|-newca|-sign|-verify\n";
 	    exit 0;
 	} elsif (/^-newcert$/) {
 	    # create a certificate
@@ -165,6 +166,7 @@
 	} else {
 	    print STDERR "Unknown arg $_\n";
 	    print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
+	    print STDERR "usage: CA -signcert certfile keyfile|-newcert|-newreq|-newca|-sign|-verify\n";
 	    exit 1;
 	}
 }
--- openssl-0.9.8g.orig/apps/s_client.c
+++ openssl-0.9.8g/apps/s_client.c
@@ -241,6 +241,7 @@
 	BIO_printf(bio_err," -tlsextdebug      - hex dump of all TLS extensions received\n");
 	BIO_printf(bio_err," -no_ticket        - disable use of RFC4507bis session tickets\n");
 #endif
+	BIO_printf(bio_err," -legacy_renegotiation - enable use of legacy renegotiation (dangerous)\n");
 	}
 
 #ifndef OPENSSL_NO_TLSEXT
@@ -277,7 +278,7 @@
 
 int MAIN(int argc, char **argv)
 	{
-	int off=0;
+	int off=0, clr = 0;
 	SSL *con=NULL,*con2=NULL;
 	X509_STORE *store = NULL;
 	int s,k,width,state=0;
@@ -517,6 +518,12 @@
 #endif
 		else if (strcmp(*argv,"-serverpref") == 0)
 			off|=SSL_OP_CIPHER_SERVER_PREFERENCE;
+		else if (strcmp(*argv,"-legacy_renegotiation") == 0)
+			off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
+		else if	(strcmp(*argv,"-legacy_server_connect") == 0)
+			{ off|=SSL_OP_LEGACY_SERVER_CONNECT; }
+		else if	(strcmp(*argv,"-no_legacy_server_connect") == 0)
+			{ clr|=SSL_OP_LEGACY_SERVER_CONNECT; }
 		else if	(strcmp(*argv,"-cipher") == 0)
 			{
 			if (--argc < 1) goto bad;
@@ -653,6 +660,9 @@
 		SSL_CTX_set_options(ctx,SSL_OP_ALL|off);
 	else
 		SSL_CTX_set_options(ctx,off);
+
+	if (clr)
+		SSL_CTX_clear_options(ctx, clr);
 	/* DTLS: partial reads end up discarding unread UDP bytes :-( 
 	 * Setting read ahead solves this problem.
 	 */
@@ -1414,6 +1424,8 @@
 							 EVP_PKEY_bits(pktmp));
 		EVP_PKEY_free(pktmp);
 	}
+	BIO_printf(bio, "Secure Renegotiation IS%s supported\n",
+			SSL_get_secure_renegotiation_support(s) ? "" : " NOT");
 #ifndef OPENSSL_NO_COMP
 	comp=SSL_get_current_compression(s);
 	expansion=SSL_get_current_expansion(s);
--- openssl-0.9.8g.orig/apps/CA.pl.in
+++ openssl-0.9.8g/apps/CA.pl.in
@@ -65,6 +65,7 @@
 foreach (@ARGV) {
 	if ( /^(-\?|-h|-help)$/ ) {
 	    print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
+	    print STDERR "usage: CA -signcert certfile keyfile|-newcert|-newreq|-newca|-sign|-verify\n";
 	    exit 0;
 	} elsif (/^-newcert$/) {
 	    # create a certificate
@@ -165,6 +166,7 @@
 	} else {
 	    print STDERR "Unknown arg $_\n";
 	    print STDERR "usage: CA -newcert|-newreq|-newreq-nodes|-newca|-sign|-verify\n";
+	    print STDERR "usage: CA -signcert certfile keyfile|-newcert|-newreq|-newca|-sign|-verify\n";
 	    exit 1;
 	}
 }
--- openssl-0.9.8g.orig/apps/s_server.c
+++ openssl-0.9.8g/apps/s_server.c
@@ -397,6 +397,7 @@
 	BIO_printf(bio_err,"                 not specified (default is %s)\n",TEST_CERT2);
 	BIO_printf(bio_err," -tlsextdebug  - hex dump of all TLS extensions received\n");
 	BIO_printf(bio_err," -no_ticket    - disable use of RFC4507bis session tickets\n");
+	BIO_printf(bio_err," -legacy_renegotiation - enable use of legacy renegotiation (dangerous)\n");
 #endif
 	}
 
@@ -766,6 +767,8 @@
 			}
 		else if	(strcmp(*argv,"-serverpref") == 0)
 			{ off|=SSL_OP_CIPHER_SERVER_PREFERENCE; }
+		else if (strcmp(*argv,"-legacy_renegotiation") == 0)
+			off|=SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION;
 		else if	(strcmp(*argv,"-cipher") == 0)
 			{
 			if (--argc < 1) goto bad;
@@ -1801,6 +1804,8 @@
 			con->kssl_ctx->client_princ);
 		}
 #endif /* OPENSSL_NO_KRB5 */
+	BIO_printf(bio_s_out, "Secure Renegotiation IS%s supported\n",
+		      SSL_get_secure_renegotiation_support(con) ? "" : " NOT");
 	return(1);
 	}
 
--- openssl-0.9.8g.orig/apps/spkac.c
+++ openssl-0.9.8g/apps/spkac.c
@@ -285,7 +285,7 @@
 	pkey = NETSCAPE_SPKI_get_pubkey(spki);
 	if(verify) {
 		i = NETSCAPE_SPKI_verify(spki, pkey);
-		if(i) BIO_printf(bio_err, "Signature OK\n");
+		if (i > 0) BIO_printf(bio_err, "Signature OK\n");
 		else {
 			BIO_printf(bio_err, "Signature Failure\n");
 			ERR_print_errors(bio_err);
--- openssl-0.9.8g.orig/apps/x509.c
+++ openssl-0.9.8g/apps/x509.c
@@ -1144,7 +1144,7 @@
 	/* NOTE: this certificate can/should be self signed, unless it was
 	 * a certificate request in which case it is not. */
 	X509_STORE_CTX_set_cert(&xsc,x);
-	if (!reqfile && !X509_verify_cert(&xsc))
+	if (!reqfile && X509_verify_cert(&xsc) <= 0)
 		goto end;
 
 	if (!X509_check_private_key(xca,pkey))
--- openssl-0.9.8g.orig/apps/s_cb.c
+++ openssl-0.9.8g/apps/s_cb.c
@@ -621,6 +621,9 @@
 		extname = "server ticket";
 		break;
 
+		case TLSEXT_TYPE_renegotiate:
+		extname = "renegotiate";
+		break;
 
 		default:
 		extname = "unknown";
--- openssl-0.9.8g.orig/apps/verify.c
+++ openssl-0.9.8g/apps/verify.c
@@ -266,7 +266,7 @@
 
 	ret=0;
 end:
-	if (i)
+	if (i > 0)
 		{
 		fprintf(stdout,"OK\n");
 		ret=1;
@@ -367,4 +367,3 @@
 		ERR_clear_error();
 	return(ok);
 	}
-
--- openssl-0.9.8g.orig/apps/s_time.c
+++ openssl-0.9.8g/apps/s_time.c
@@ -117,6 +117,7 @@
 
 /* The following if from times(3) man page.  It may need to be changed
 */
+#undef HZ
 #ifndef HZ
 # ifdef _SC_CLK_TCK
 #  define HZ ((double)sysconf(_SC_CLK_TCK))
--- openssl-0.9.8g.orig/apps/speed.c
+++ openssl-0.9.8g/apps/speed.c
@@ -577,7 +577,7 @@
 #define MAX_BLOCK_SIZE 64
 #endif
 	unsigned char DES_iv[8];
-	unsigned char iv[MAX_BLOCK_SIZE/8];
+	unsigned char iv[2*MAX_BLOCK_SIZE/8];
 #ifndef OPENSSL_NO_DES
 	DES_cblock *buf_as_des_cblock = NULL;
 	static DES_cblock key ={0x12,0x34,0x56,0x78,0x9a,0xbc,0xde,0xf0};
@@ -2132,7 +2132,7 @@
 				{
 				ret=RSA_verify(NID_md5_sha1, buf,36, buf2,
 					rsa_num, rsa_key[j]);
-				if (ret == 0)
+				if (ret <= 0)
 					{
 					BIO_printf(bio_err,
 						"RSA verify failure\n");
--- openssl-0.9.8g.orig/apps/CA.sh
+++ openssl-0.9.8g/apps/CA.sh
@@ -91,6 +91,7 @@
 			   -out ${CATOP}/$CAREQ
 	    $CA -out ${CATOP}/$CACERT $CADAYS -batch \
 			   -keyfile ${CATOP}/private/$CAKEY -selfsign \
+			   -extensions v3_ca \
 			   -infiles ${CATOP}/$CAREQ 
 	    RET=$?
 	fi
--- openssl-0.9.8g.orig/ssl/d1_clnt.c
+++ openssl-0.9.8g/ssl/d1_clnt.c
@@ -541,8 +541,14 @@
 	buf=(unsigned char *)s->init_buf->data;
 	if (s->state == SSL3_ST_CW_CLNT_HELLO_A)
 		{
+		SSL_SESSION *sess = s->session;
 		if ((s->session == NULL) ||
 			(s->session->ssl_version != s->version) ||
+#ifdef OPENSSL_NO_TLSEXT
+			!sess->session_id_length ||
+#else
+			(!sess->session_id_length && !sess->tlsext_tick) ||
+#endif
 			(s->session->not_resumable))
 			{
 			if (!ssl_get_new_session(s,0))
@@ -621,7 +627,15 @@
 			*(p++)=comp->id;
 			}
 		*(p++)=0; /* Add the NULL method */
-		
+
+#ifndef OPENSSL_NO_TLSEXT
+		if ((p = ssl_add_clienthello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
+			{
+			SSLerr(SSL_F_DTLS1_CLIENT_HELLO,ERR_R_INTERNAL_ERROR);
+			goto err;
+			}
+#endif		
+
 		l=(p-d);
 		d=buf;
 
--- openssl-0.9.8g.orig/ssl/ssl3.h
+++ openssl-0.9.8g/ssl/ssl3.h
@@ -129,6 +129,9 @@
 extern "C" {
 #endif
 
+/* Signalling cipher suite value: from draft-ietf-tls-renegotiation-03.txt */
+#define SSL3_CK_SCSV				0x030000FF
+
 #define SSL3_CK_RSA_NULL_MD5			0x03000001
 #define SSL3_CK_RSA_NULL_SHA			0x03000002
 #define SSL3_CK_RSA_RC4_40_MD5 			0x03000003
@@ -440,6 +443,12 @@
 		int cert_request;
 		} tmp;
 
+        /* Connection binding to prevent renegotiation attacks */
+        unsigned char previous_client_finished[EVP_MAX_MD_SIZE];
+        unsigned char previous_client_finished_len;
+        unsigned char previous_server_finished[EVP_MAX_MD_SIZE];
+        unsigned char previous_server_finished_len;
+        int send_connection_binding; /* TODOEKR */
 	} SSL3_STATE;
 
 
--- openssl-0.9.8g.orig/ssl/s3_both.c
+++ openssl-0.9.8g/ssl/s3_both.c
@@ -168,6 +168,23 @@
 		p+=i;
 		l=i;
 
+                /* Copy the finished so we can use it for
+                   renegotiation checks */
+                if(s->type == SSL_ST_CONNECT)
+                        {
+                         OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                         memcpy(s->s3->previous_client_finished, 
+                             s->s3->tmp.finish_md, i);
+                         s->s3->previous_client_finished_len=i;
+                        }
+                else
+                        {
+                        OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                        memcpy(s->s3->previous_server_finished, 
+                            s->s3->tmp.finish_md, i);
+                        s->s3->previous_server_finished_len=i;
+                        }
+
 #ifdef OPENSSL_SYS_WIN16
 		/* MSVC 1.5 does not clear the top bytes of the word unless
 		 * I do this.
@@ -232,6 +249,23 @@
 		goto f_err;
 		}
 
+        /* Copy the finished so we can use it for
+           renegotiation checks */
+        if(s->type == SSL_ST_ACCEPT)
+                {
+                OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                memcpy(s->s3->previous_client_finished, 
+                    s->s3->tmp.peer_finish_md, i);
+                s->s3->previous_client_finished_len=i;
+                }
+        else
+                {
+                OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+                memcpy(s->s3->previous_server_finished, 
+                    s->s3->tmp.peer_finish_md, i);
+                s->s3->previous_server_finished_len=i;
+                }
+
 	return(1);
 f_err:
 	ssl3_send_alert(s,SSL3_AL_FATAL,al);
--- openssl-0.9.8g.orig/ssl/ssltest.c
+++ openssl-0.9.8g/ssl/ssltest.c
@@ -2072,7 +2072,7 @@
 
 	if (cb_arg->proxy_auth)
 		{
-		if (ok)
+		if (ok > 0)
 			{
 			const char *cond_end = NULL;
 
--- openssl-0.9.8g.orig/ssl/s2_srvr.c
+++ openssl-0.9.8g/ssl/s2_srvr.c
@@ -1054,7 +1054,7 @@
 
 	i=ssl_verify_cert_chain(s,sk);
 
-	if (i)	/* we like the packet, now check the chksum */
+	if (i > 0)	/* we like the packet, now check the chksum */
 		{
 		EVP_MD_CTX ctx;
 		EVP_PKEY *pkey=NULL;
@@ -1083,7 +1083,7 @@
 		EVP_PKEY_free(pkey);
 		EVP_MD_CTX_cleanup(&ctx);
 
-		if (i) 
+		if (i > 0) 
 			{
 			if (s->session->peer != NULL)
 				X509_free(s->session->peer);
--- openssl-0.9.8g.orig/ssl/ssl.h
+++ openssl-0.9.8g/ssl/ssl.h
@@ -486,6 +486,8 @@
 
 #define SSL_OP_MICROSOFT_SESS_ID_BUG			0x00000001L
 #define SSL_OP_NETSCAPE_CHALLENGE_BUG			0x00000002L
+/* Allow initial connection to servers that don't support RI */
+#define SSL_OP_LEGACY_SERVER_CONNECT			0x00000004L
 #define SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG		0x00000008L
 #define SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG		0x00000010L
 #define SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER		0x00000020L
@@ -514,6 +516,8 @@
 
 /* As server, disallow session resumption on renegotiation */
 #define SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION	0x00010000L
+/* Permit unsafe legacy renegotiation */
+#define SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION	0x00040000L
 /* If set, always create a new key when using tmp_ecdh parameters */
 #define SSL_OP_SINGLE_ECDH_USE				0x00080000L
 /* If set, always create a new key when using tmp_dh parameters */
@@ -562,17 +566,25 @@
 
 #define SSL_CTX_set_options(ctx,op) \
 	SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,(op),NULL)
+#define SSL_CTX_clear_options(ctx,op) \
+	SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_OPTIONS,(op),NULL)
 #define SSL_CTX_get_options(ctx) \
 	SSL_CTX_ctrl((ctx),SSL_CTRL_OPTIONS,0,NULL)
 #define SSL_set_options(ssl,op) \
 	SSL_ctrl((ssl),SSL_CTRL_OPTIONS,(op),NULL)
+#define SSL_clear_options(ssl,op) \
+	SSL_ctrl((ssl),SSL_CTRL_CLEAR_OPTIONS,(op),NULL)
 #define SSL_get_options(ssl) \
         SSL_ctrl((ssl),SSL_CTRL_OPTIONS,0,NULL)
 
 #define SSL_CTX_set_mode(ctx,op) \
 	SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,(op),NULL)
+#define SSL_CTX_clear_mode(ctx,op) \
+	SSL_CTX_ctrl((ctx),SSL_CTRL_CLEAR_MODE,(op),NULL)
 #define SSL_CTX_get_mode(ctx) \
 	SSL_CTX_ctrl((ctx),SSL_CTRL_MODE,0,NULL)
+#define SSL_clear_mode(ssl,op) \
+	SSL_ctrl((ssl),SSL_CTRL_CLEAR_MODE,(op),NULL)
 #define SSL_set_mode(ssl,op) \
 	SSL_ctrl((ssl),SSL_CTRL_MODE,(op),NULL)
 #define SSL_get_mode(ssl) \
@@ -580,6 +592,8 @@
 #define SSL_set_mtu(ssl, mtu) \
         SSL_ctrl((ssl),SSL_CTRL_SET_MTU,(mtu),NULL)
 
+#define SSL_get_secure_renegotiation_support(ssl) \
+	SSL_ctrl((ssl), SSL_CTRL_GET_RI_SUPPORT, 0, NULL)
 
 void SSL_CTX_set_msg_callback(SSL_CTX *ctx, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg));
 void SSL_set_msg_callback(SSL *ssl, void (*cb)(int write_p, int version, int content_type, const void *buf, size_t len, SSL *ssl, void *arg));
@@ -1226,6 +1240,10 @@
 #define SSL_CTRL_SET_TLSEXT_TICKET_KEYS		59
 #endif
 
+#define SSL_CTRL_GET_RI_SUPPORT			76
+#define SSL_CTRL_CLEAR_OPTIONS			77
+#define SSL_CTRL_CLEAR_MODE			78
+
 #define SSL_session_reused(ssl) \
 	SSL_ctrl((ssl),SSL_CTRL_GET_SESSION_REUSED,0,NULL)
 #define SSL_num_renegotiations(ssl) \
@@ -1666,6 +1684,7 @@
 #define SSL_F_SSL3_CONNECT				 132
 #define SSL_F_SSL3_CTRL					 213
 #define SSL_F_SSL3_CTX_CTRL				 133
+#define SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC		 292
 #define SSL_F_SSL3_ENC					 134
 #define SSL_F_SSL3_GENERATE_KEY_BLOCK			 238
 #define SSL_F_SSL3_GET_CERTIFICATE_REQUEST		 135
@@ -1697,9 +1716,11 @@
 #define SSL_F_SSL3_SETUP_KEY_BLOCK			 157
 #define SSL_F_SSL3_WRITE_BYTES				 158
 #define SSL_F_SSL3_WRITE_PENDING			 159
+#define SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT	 285
 #define SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT		 272
 #define SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK	 215
 #define SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK	 216
+#define SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT	 286
 #define SSL_F_SSL_ADD_SERVERHELLO_TLSEXT		 273
 #define SSL_F_SSL_BAD_METHOD				 160
 #define SSL_F_SSL_BYTES_TO_CIPHER_LIST			 161
@@ -1740,6 +1761,10 @@
 #define SSL_F_SSL_INIT_WBIO_BUFFER			 184
 #define SSL_F_SSL_LOAD_CLIENT_CA_FILE			 185
 #define SSL_F_SSL_NEW					 186
+#define SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT	 287
+#define SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT		 290
+#define SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT	 289
+#define SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT		 291
 #define SSL_F_SSL_PEEK					 270
 #define SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT		 275
 #define SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT		 276
@@ -1904,6 +1929,7 @@
 #define SSL_R_NO_PRIVATE_KEY_ASSIGNED			 190
 #define SSL_R_NO_PROTOCOLS_AVAILABLE			 191
 #define SSL_R_NO_PUBLICKEY				 192
+#define SSL_R_NO_RENEGOTIATION				 319
 #define SSL_R_NO_SHARED_CIPHER				 193
 #define SSL_R_NO_VERIFY_CALLBACK			 194
 #define SSL_R_NULL_SSL_CTX				 195
@@ -1931,10 +1957,14 @@
 #define SSL_R_RECORD_LENGTH_MISMATCH			 213
 #define SSL_R_RECORD_TOO_LARGE				 214
 #define SSL_R_RECORD_TOO_SMALL				 298
+#define SSL_R_RENEGOTIATE_EXT_TOO_LONG			 320
+#define SSL_R_RENEGOTIATION_ENCODING_ERR		 321
+#define SSL_R_RENEGOTIATION_MISMATCH			 322
 #define SSL_R_REQUIRED_CIPHER_MISSING			 215
 #define SSL_R_REUSE_CERT_LENGTH_NOT_ZERO		 216
 #define SSL_R_REUSE_CERT_TYPE_NOT_ZERO			 217
 #define SSL_R_REUSE_CIPHER_LIST_NOT_ZERO		 218
+#define SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING		 324
 #define SSL_R_SERVERHELLO_TLSEXT			 224
 #define SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED		 277
 #define SSL_R_SHORT_READ				 219
@@ -2004,6 +2034,7 @@
 #define SSL_R_UNKNOWN_REMOTE_ERROR_TYPE			 253
 #define SSL_R_UNKNOWN_SSL_VERSION			 254
 #define SSL_R_UNKNOWN_STATE				 255
+#define SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED	 323
 #define SSL_R_UNSUPPORTED_CIPHER			 256
 #define SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM		 257
 #define SSL_R_UNSUPPORTED_ELLIPTIC_CURVE		 315
--- openssl-0.9.8g.orig/ssl/s23_srvr.c
+++ openssl-0.9.8g/ssl/s23_srvr.c
@@ -315,7 +315,7 @@
 			 (p[1] == SSL3_VERSION_MAJOR) &&
 			 (p[5] == SSL3_MT_CLIENT_HELLO) &&
 			 ((p[3] == 0 && p[4] < 5 /* silly record length? */)
-				|| (p[9] == p[1])))
+				|| (p[9] >= p[1])))
 			{
 			/*
 			 * SSLv3 or tls1 header
@@ -339,6 +339,13 @@
 				v[1] = TLS1_VERSION_MINOR;
 #endif
 				}
+			/* if major version number > 3 set minor to a value
+			 * which will use the highest version 3 we support.
+			 * If TLS 2.0 ever appears we will need to revise
+			 * this....
+			 */
+			else if (p[9] > SSL3_VERSION_MAJOR)
+				v[1]=0xff;
 			else
 				v[1]=p[10]; /* minor version according to client_version */
 			if (v[1] >= TLS1_VERSION_MINOR)
--- openssl-0.9.8g.orig/ssl/s3_clnt.c
+++ openssl-0.9.8g/ssl/s3_clnt.c
@@ -137,9 +137,6 @@
 
 static SSL_METHOD *ssl3_get_client_method(int ver);
 static int ca_dn_cmp(const X509_NAME * const *a,const X509_NAME * const *b);
-#ifndef OPENSSL_NO_TLSEXT
-static int ssl3_check_finished(SSL *s);
-#endif
 
 #ifndef OPENSSL_NO_ECDH
 static int curve_id2nid(int curve_id);
@@ -784,8 +781,11 @@
 		s->session->cipher_id = s->session->cipher->id;
 	if (s->hit && (s->session->cipher_id != c->id))
 		{
+/* Workaround is now obsolete */
+#if 0
 		if (!(s->options &
 			SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG))
+#endif
 			{
 			al=SSL_AD_ILLEGAL_PARAMETER;
 			SSLerr(SSL_F_SSL3_GET_SERVER_HELLO,SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED);
@@ -823,7 +823,7 @@
 #endif
 #ifndef OPENSSL_NO_TLSEXT
 	/* TLS extensions*/
-	if (s->version > SSL3_VERSION)
+	if (s->version >= SSL3_VERSION)
 		{
 		if (!ssl_parse_serverhello_tlsext(s,&p,d,n, &al))
 			{
@@ -940,7 +940,7 @@
 		}
 
 	i=ssl_verify_cert_chain(s,sk);
-	if ((s->verify_mode != SSL_VERIFY_NONE) && (!i)
+	if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0)
 #ifndef OPENSSL_NO_KRB5
 	        && (s->s3->tmp.new_cipher->algorithms & (SSL_MKEY_MASK|SSL_AUTH_MASK))
 	        != (SSL_aKRB5|SSL_kKRB5)
@@ -1346,6 +1346,7 @@
 		s->session->sess_cert->peer_ecdh_tmp=ecdh;
 		ecdh=NULL;
 		BN_CTX_free(bn_ctx);
+		bn_ctx = NULL;
 		EC_POINT_free(srvr_ecpoint);
 		srvr_ecpoint = NULL;
 		}
@@ -1425,7 +1426,7 @@
 			EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
 			EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
 			EVP_VerifyUpdate(&md_ctx,param,param_len);
-			if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
+			if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
 				{
 				/* bad signature */
 				al=SSL_AD_DECRYPT_ERROR;
@@ -1443,7 +1444,7 @@
 			EVP_VerifyUpdate(&md_ctx,&(s->s3->client_random[0]),SSL3_RANDOM_SIZE);
 			EVP_VerifyUpdate(&md_ctx,&(s->s3->server_random[0]),SSL3_RANDOM_SIZE);
 			EVP_VerifyUpdate(&md_ctx,param,param_len);
-			if (!EVP_VerifyFinal(&md_ctx,p,(int)n,pkey))
+			if (EVP_VerifyFinal(&md_ctx,p,(int)n,pkey) <= 0)
 				{
 				/* bad signature */
 				al=SSL_AD_DECRYPT_ERROR;
@@ -1681,6 +1682,7 @@
 		SSLerr(SSL_F_SSL3_GET_NEW_SESSION_TICKET,SSL_R_LENGTH_MISMATCH);
 		goto f_err;
 		}
+
 	p=d=(unsigned char *)s->init_msg;
 	n2l(p, s->session->tlsext_tick_lifetime_hint);
 	n2s(p, ticklen);
@@ -1967,6 +1969,13 @@
 			{
 			DH *dh_srvr,*dh_clnt;
 
+			if (s->session->sess_cert == NULL)
+			{
+				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_UNEXPECTED_MESSAGE);
+				SSLerr(SSL_F_SSL3_SEND_CLIENT_KEY_EXCHANGE,SSL_R_UNEXPECTED_MESSAGE);
+				goto err;
+			}
+
 			if (s->session->sess_cert->peer_dh_tmp != NULL)
 				dh_srvr=s->session->sess_cert->peer_dh_tmp;
 			else
@@ -2588,7 +2597,7 @@
  */
 
 #ifndef OPENSSL_NO_TLSEXT
-static int ssl3_check_finished(SSL *s)
+int ssl3_check_finished(SSL *s)
 	{
 	int ok;
 	long n;
--- openssl-0.9.8g.orig/ssl/s2_clnt.c
+++ openssl-0.9.8g/ssl/s2_clnt.c
@@ -1044,7 +1044,7 @@
 
 	i=ssl_verify_cert_chain(s,sk);
 		
-	if ((s->verify_mode != SSL_VERIFY_NONE) && (!i))
+	if ((s->verify_mode != SSL_VERIFY_NONE) && (i <= 0))
 		{
 		SSLerr(SSL_F_SSL2_SET_CERTIFICATE,SSL_R_CERTIFICATE_VERIFY_FAILED);
 		goto err;
--- openssl-0.9.8g.orig/ssl/ssl_algs.c
+++ openssl-0.9.8g/ssl/ssl_algs.c
@@ -92,9 +92,6 @@
 	EVP_add_cipher(EVP_seed_cbc());
 #endif
 
-#ifndef OPENSSL_NO_MD2
-	EVP_add_digest(EVP_md2());
-#endif
 #ifndef OPENSSL_NO_MD5
 	EVP_add_digest(EVP_md5());
 	EVP_add_digest_alias(SN_md5,"ssl2-md5");
--- openssl-0.9.8g.orig/ssl/d1_both.c
+++ openssl-0.9.8g/ssl/d1_both.c
@@ -530,13 +530,14 @@
 				frag->fragment,frag->msg_header.frag_len);
 			}
 
+		unsigned long frag_len = frag->msg_header.frag_len;
 		dtls1_hm_fragment_free(frag);
 		pitem_free(item);
 
 		if (al==0)
 			{
 			*ok = 1;
-			return frag->msg_header.frag_len;
+			return frag_len;
 			}
 
 		ssl3_send_alert(s,SSL3_AL_FATAL,al);
@@ -561,7 +562,16 @@
 	if ((msg_hdr->frag_off+frag_len) > msg_hdr->msg_len)
 		goto err;
 
-	if (msg_hdr->seq <= s->d1->handshake_read_seq)
+	/* Try to find item in queue, to prevent duplicate entries */
+	pq_64bit_init(&seq64);
+	pq_64bit_assign_word(&seq64, msg_hdr->seq);
+	item = pqueue_find(s->d1->buffered_messages, seq64);
+	pq_64bit_free(&seq64);
+	
+	/* Discard the message if sequence number was already there, is
+	 * too far in the future or the fragment is already in the queue */
+	if (msg_hdr->seq <= s->d1->handshake_read_seq ||
+		msg_hdr->seq > s->d1->handshake_read_seq + 10 || item != NULL)
 		{
 		unsigned char devnull [256];
 
@@ -575,30 +585,31 @@
 			}
 		}
 
-	frag = dtls1_hm_fragment_new(frag_len);
-	if ( frag == NULL)
-		goto err;
+	if (frag_len)
+	{
+		frag = dtls1_hm_fragment_new(frag_len);
+		if ( frag == NULL)
+			goto err;
 
-	memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
+		memcpy(&(frag->msg_header), msg_hdr, sizeof(*msg_hdr));
 
-	if (frag_len)
-		{
-		/* read the body of the fragment (header has already been read */
+		/* read the body of the fragment (header has already been read) */
 		i = s->method->ssl_read_bytes(s,SSL3_RT_HANDSHAKE,
 			frag->fragment,frag_len,0);
 		if (i<=0 || (unsigned long)i!=frag_len)
 			goto err;
-		}
 
-	pq_64bit_init(&seq64);
-	pq_64bit_assign_word(&seq64, msg_hdr->seq);
+		pq_64bit_init(&seq64);
+		pq_64bit_assign_word(&seq64, msg_hdr->seq);
 
-	item = pitem_new(seq64, frag);
-	pq_64bit_free(&seq64);
-	if ( item == NULL)
-		goto err;
+		item = pitem_new(seq64, frag);
+		pq_64bit_free(&seq64);
+		if ( item == NULL)
+			goto err;
+
+		pqueue_insert(s->d1->buffered_messages, item);
+	}
 
-	pqueue_insert(s->d1->buffered_messages, item);
 	return DTLS1_HM_FRAGMENT_RETRY;
 
 err:
@@ -739,6 +750,24 @@
 		p+=i;
 		l=i;
 
+	/* Copy the finished so we can use it for
+	 * renegotiation checks
+	 */
+	if(s->type == SSL_ST_CONNECT)
+		{
+		OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+		memcpy(s->s3->previous_client_finished, 
+		       s->s3->tmp.finish_md, i);
+		s->s3->previous_client_finished_len=i;
+		}
+	else
+		{
+		OPENSSL_assert(i <= EVP_MAX_MD_SIZE);
+		memcpy(s->s3->previous_server_finished, 
+		       s->s3->tmp.finish_md, i);
+		s->s3->previous_server_finished_len=i;
+		}
+
 #ifdef OPENSSL_SYS_WIN16
 		/* MSVC 1.5 does not clear the top bytes of the word unless
 		 * I do this.
--- openssl-0.9.8g.orig/ssl/tls1.h
+++ openssl-0.9.8g/ssl/tls1.h
@@ -115,6 +115,9 @@
 #define TLSEXT_TYPE_ec_point_formats		11
 #define TLSEXT_TYPE_session_ticket		35
 
+/* Temporary extension type */
+#define TLSEXT_TYPE_renegotiate                 0xff01
+
 /* NameType value from RFC 3546 */
 #define TLSEXT_NAMETYPE_host_name 0
 
--- openssl-0.9.8g.orig/ssl/t1_reneg.c
+++ openssl-0.9.8g/ssl/t1_reneg.c
@@ -0,0 +1,292 @@
+/* ssl/t1_reneg.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+/* ====================================================================
+ * Copyright (c) 1998-2009 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <stdio.h>
+#include <openssl/objects.h>
+#include "ssl_locl.h"
+
+/* Add the client's renegotiation binding */
+int ssl_add_clienthello_renegotiate_ext(SSL *s, unsigned char *p, int *len,
+					int maxlen)
+    {
+    if(p)
+        {
+	if((s->s3->previous_client_finished_len+1) > maxlen)
+            {
+            SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATE_EXT_TOO_LONG);
+            return 0;
+            }
+            
+        /* Length byte */
+	*p = s->s3->previous_client_finished_len;
+        p++;
+
+        memcpy(p, s->s3->previous_client_finished,
+	       s->s3->previous_client_finished_len);
+#ifdef OPENSSL_RI_DEBUG
+    fprintf(stderr, "%s RI extension sent by client\n",
+		s->s3->previous_client_finished_len ? "Non-empty" : "Empty");
+#endif
+        }
+    
+    *len=s->s3->previous_client_finished_len + 1;
+
+ 
+    return 1;
+    }
+
+/* Parse the client's renegotiation binding and abort if it's not
+   right */
+int ssl_parse_clienthello_renegotiate_ext(SSL *s, unsigned char *d, int len,
+					  int *al)
+    {
+    int ilen;
+
+    /* Parse the length byte */
+    if(len < 1)
+        {
+        SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATION_ENCODING_ERR);
+        *al=SSL_AD_ILLEGAL_PARAMETER;
+        return 0;
+        }
+    ilen = *d;
+    d++;
+
+    /* Consistency check */
+    if((ilen+1) != len)
+        {
+        SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATION_ENCODING_ERR);
+        *al=SSL_AD_ILLEGAL_PARAMETER;
+        return 0;
+        }
+
+    /* Check that the extension matches */
+    if(ilen != s->s3->previous_client_finished_len)
+        {
+        SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATION_MISMATCH);
+        *al=SSL_AD_HANDSHAKE_FAILURE;
+        return 0;
+        }
+    
+    if(memcmp(d, s->s3->previous_client_finished,
+	      s->s3->previous_client_finished_len))
+        {
+        SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATION_MISMATCH);
+        *al=SSL_AD_HANDSHAKE_FAILURE;
+        return 0;
+        }
+#ifdef OPENSSL_RI_DEBUG
+    fprintf(stderr, "%s RI extension received by server\n",
+				ilen ? "Non-empty" : "Empty");
+#endif
+
+    s->s3->send_connection_binding=1;
+
+    return 1;
+    }
+
+/* Add the server's renegotiation binding */
+int ssl_add_serverhello_renegotiate_ext(SSL *s, unsigned char *p, int *len,
+					int maxlen)
+    {
+    if(p)
+        {
+        if((s->s3->previous_client_finished_len +
+            s->s3->previous_server_finished_len + 1) > maxlen)
+            {
+            SSLerr(SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATE_EXT_TOO_LONG);
+            return 0;
+            }
+        
+        /* Length byte */
+        *p = s->s3->previous_client_finished_len + s->s3->previous_server_finished_len;
+        p++;
+
+        memcpy(p, s->s3->previous_client_finished,
+	       s->s3->previous_client_finished_len);
+        p += s->s3->previous_client_finished_len;
+
+        memcpy(p, s->s3->previous_server_finished,
+	       s->s3->previous_server_finished_len);
+#ifdef OPENSSL_RI_DEBUG
+    fprintf(stderr, "%s RI extension sent by server\n",
+    		s->s3->previous_client_finished_len ? "Non-empty" : "Empty");
+#endif
+        }
+    
+    *len=s->s3->previous_client_finished_len
+	+ s->s3->previous_server_finished_len + 1;
+    
+    return 1;
+    }
+
+/* Parse the server's renegotiation binding and abort if it's not
+   right */
+int ssl_parse_serverhello_renegotiate_ext(SSL *s, unsigned char *d, int len,
+					  int *al)
+    {
+    int expected_len=s->s3->previous_client_finished_len
+	+ s->s3->previous_server_finished_len;
+    int ilen;
+
+    /* Check for logic errors */
+    OPENSSL_assert(!expected_len || s->s3->previous_client_finished_len);
+    OPENSSL_assert(!expected_len || s->s3->previous_server_finished_len);
+    
+    /* Parse the length byte */
+    if(len < 1)
+        {
+        SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATION_ENCODING_ERR);
+        *al=SSL_AD_ILLEGAL_PARAMETER;
+        return 0;
+        }
+    ilen = *d;
+    d++;
+
+    /* Consistency check */
+    if(ilen+1 != len)
+        {
+        SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATION_ENCODING_ERR);
+        *al=SSL_AD_ILLEGAL_PARAMETER;
+        return 0;
+        }
+    
+    /* Check that the extension matches */
+    if(ilen != expected_len)
+        {
+        SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATION_MISMATCH);
+        *al=SSL_AD_HANDSHAKE_FAILURE;
+        return 0;
+        }
+
+    if(memcmp(d, s->s3->previous_client_finished,
+	      s->s3->previous_client_finished_len))
+        {
+        SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATION_MISMATCH);
+        *al=SSL_AD_HANDSHAKE_FAILURE;
+        return 0;
+        }
+    d += s->s3->previous_client_finished_len;
+
+    if(memcmp(d, s->s3->previous_server_finished,
+	      s->s3->previous_server_finished_len))
+        {
+        SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT,SSL_R_RENEGOTIATION_MISMATCH);
+        *al=SSL_AD_ILLEGAL_PARAMETER;
+        return 0;
+        }
+#ifdef OPENSSL_RI_DEBUG
+    fprintf(stderr, "%s RI extension received by client\n",
+				ilen ? "Non-empty" : "Empty");
+#endif
+    s->s3->send_connection_binding=1;
+
+    return 1;
+    }
--- openssl-0.9.8g.orig/ssl/ssl_locl.h
+++ openssl-0.9.8g/ssl/ssl_locl.h
@@ -862,7 +862,7 @@
 void dtls1_reset_seq_numbers(SSL *s, int rw);
 long dtls1_default_timeout(void);
 SSL_CIPHER *dtls1_get_cipher(unsigned int u);
-
+int dtls1_send_newsession_ticket(SSL *s);
 
 
 /* some client-only functions */
@@ -877,6 +877,9 @@
 int ssl3_get_key_exchange(SSL *s);
 int ssl3_get_server_certificate(SSL *s);
 int ssl3_check_cert_and_algorithm(SSL *s);
+#ifndef OPENSSL_NO_TLSEXT
+int ssl3_check_finished(SSL *s);
+#endif
 
 int dtls1_client_hello(SSL *s);
 int dtls1_send_client_certificate(SSL *s);
@@ -960,6 +963,7 @@
 int ssl_prepare_serverhello_tlsext(SSL *s);
 int ssl_check_clienthello_tlsext(SSL *s);
 int ssl_check_serverhello_tlsext(SSL *s);
+
 #ifdef OPENSSL_NO_SHA256
 #define tlsext_tick_md	EVP_sha1
 #else
@@ -969,6 +973,15 @@
 				const unsigned char *limit, SSL_SESSION **ret);
 EVP_MD_CTX* ssl_replace_hash(EVP_MD_CTX **hash,const EVP_MD *md) ;
 void ssl_clear_hash_ctx(EVP_MD_CTX **hash);
+
+int ssl_add_serverhello_renegotiate_ext(SSL *s, unsigned char *p, int *len,
+					int maxlen);
+int ssl_parse_serverhello_renegotiate_ext(SSL *s, unsigned char *d, int len,
+					  int *al);
+int ssl_add_clienthello_renegotiate_ext(SSL *s, unsigned char *p, int *len,
+					int maxlen);
+int ssl_parse_clienthello_renegotiate_ext(SSL *s, unsigned char *d, int len,
+					  int *al);
 #endif
 
 #endif
--- openssl-0.9.8g.orig/ssl/d1_srvr.c
+++ openssl-0.9.8g/ssl/d1_srvr.c
@@ -267,7 +267,6 @@
 			s->shutdown=0;
 			ret=ssl3_get_client_hello(s);
 			if (ret <= 0) goto end;
-			s->new_session = 2;
 
 			if ( s->d1->send_cookie)
 				s->state = DTLS1_ST_SW_HELLO_VERIFY_REQUEST_A;
@@ -293,6 +292,7 @@
 			
 		case SSL3_ST_SW_SRVR_HELLO_A:
 		case SSL3_ST_SW_SRVR_HELLO_B:
+			s->new_session = 2;
 			ret=dtls1_send_server_hello(s);
 			if (ret <= 0) goto end;
 
@@ -713,6 +713,8 @@
 		p+=sl;
 
 		/* put the cipher */
+		if (s->s3->tmp.new_cipher == NULL)
+			return -1;
 		i=ssl3_put_cipher_by_char(s->s3->tmp.new_cipher,p);
 		p+=i;
 
@@ -726,6 +728,14 @@
 			*(p++)=s->s3->tmp.new_compression->id;
 #endif
 
+#ifndef OPENSSL_NO_TLSEXT
+		if ((p = ssl_add_serverhello_tlsext(s, p, buf+SSL3_RT_MAX_PLAIN_LENGTH)) == NULL)
+			{
+			SSLerr(SSL_F_DTLS1_SEND_SERVER_HELLO,ERR_R_INTERNAL_ERROR);
+			return -1;
+			}
+#endif
+
 		/* do the header */
 		l=(p-d);
 		d=buf;
@@ -1145,3 +1155,4 @@
 	/* SSL3_ST_SW_CERT_B */
 	return(dtls1_do_write(s,SSL3_RT_HANDSHAKE));
 	}
+
--- openssl-0.9.8g.orig/ssl/s3_pkt.c
+++ openssl-0.9.8g/ssl/s3_pkt.c
@@ -1013,7 +1013,25 @@
 		 * now try again to obtain the (application) data we were asked for */
 		goto start;
 		}
-
+	/* If we are a server and get a client hello when renegotiation isn't
+	 * allowed send back a no renegotiation alert and carry on.
+	 * WARNING: experimental code, needs reviewing (steve)
+	 */
+	if (s->server &&
+		SSL_is_init_finished(s) &&
+    		!s->s3->send_connection_binding &&
+		(s->version > SSL3_VERSION) &&
+		(s->s3->handshake_fragment_len >= 4) &&
+		(s->s3->handshake_fragment[0] == SSL3_MT_CLIENT_HELLO) &&
+		(s->session != NULL) && (s->session->cipher != NULL) &&
+		!(s->ctx->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+		
+		{
+		/*s->s3->handshake_fragment_len = 0;*/
+		rr->length = 0;
+		ssl3_send_alert(s,SSL3_AL_WARNING, SSL_AD_NO_RENEGOTIATION);
+		goto start;
+		}
 	if (s->s3->alert_fragment_len >= 2)
 		{
 		int alert_level = s->s3->alert_fragment[0];
@@ -1043,6 +1061,21 @@
 				s->shutdown |= SSL_RECEIVED_SHUTDOWN;
 				return(0);
 				}
+			/* This is a warning but we receive it if we requested
+			 * renegotiation and the peer denied it. Terminate with
+			 * a fatal alert because if application tried to
+			 * renegotiatie it presumably had a good reason and
+			 * expects it to succeed.
+			 *
+			 * In future we might have a renegotiation where we
+			 * don't care if the peer refused it where we carry on.
+			 */
+			else if (alert_descr == SSL_AD_NO_RENEGOTIATION)
+				{
+				al = SSL_AD_HANDSHAKE_FAILURE;
+				SSLerr(SSL_F_SSL3_READ_BYTES,SSL_R_NO_RENEGOTIATION);
+				goto f_err;
+				}
 			}
 		else if (alert_level == 2) /* fatal */
 			{
@@ -1225,6 +1258,13 @@
 
 	if (s->s3->tmp.key_block == NULL)
 		{
+		if (s->session == NULL) 
+			{
+			/* might happen if dtls1_read_bytes() calls this */
+			SSLerr(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC,SSL_R_CCS_RECEIVED_EARLY);
+			return (0);
+			}
+
 		s->session->cipher=s->s3->tmp.new_cipher;
 		if (!s->method->ssl3_enc->setup_key_block(s)) return(0);
 		}
--- openssl-0.9.8g.orig/ssl/ssl_lib.c
+++ openssl-0.9.8g/ssl/ssl_lib.c
@@ -967,8 +967,12 @@
 
 	case SSL_CTRL_OPTIONS:
 		return(s->options|=larg);
+	case SSL_CTRL_CLEAR_OPTIONS:
+		return(s->options&=~larg);
 	case SSL_CTRL_MODE:
 		return(s->mode|=larg);
+	case SSL_CTRL_CLEAR_MODE:
+		return(s->mode &=~larg);
 	case SSL_CTRL_GET_MAX_CERT_LIST:
 		return(s->max_cert_list);
 	case SSL_CTRL_SET_MAX_CERT_LIST:
@@ -982,6 +986,10 @@
 			return larg;
 			}
 		return 0;
+	case SSL_CTRL_GET_RI_SUPPORT:
+		if (s->s3)
+			return s->s3->send_connection_binding;
+		else return 0;
 	default:
 		return(s->method->ssl_ctrl(s,cmd,larg,parg));
 		}
@@ -1068,8 +1076,12 @@
 		return(ctx->stats.sess_cache_full);
 	case SSL_CTRL_OPTIONS:
 		return(ctx->options|=larg);
+	case SSL_CTRL_CLEAR_OPTIONS:
+		return(ctx->options&=~larg);
 	case SSL_CTRL_MODE:
 		return(ctx->mode|=larg);
+	case SSL_CTRL_CLEAR_MODE:
+		return(ctx->mode&=~larg);
 	default:
 		return(ctx->method->ssl_ctx_ctrl(ctx,cmd,larg,parg));
 		}
@@ -1266,6 +1278,22 @@
 		j = put_cb ? put_cb(c,p) : ssl_put_cipher_by_char(s,c,p);
 		p+=j;
 		}
+	/* If p == q, no ciphers and caller indicates an error. Otherwise
+	 * add SCSV if not renegotiating.
+	 */
+	if (p != q && !s->new_session)
+		{
+		static SSL_CIPHER scsv =
+			{
+			0, NULL, SSL3_CK_SCSV, 0, 0, 0, 0, 0, 0, 0,
+			};
+		j = put_cb ? put_cb(&scsv,p) : ssl_put_cipher_by_char(s,&scsv,p);
+		p+=j;
+#ifdef OPENSSL_RI_DEBUG
+		fprintf(stderr, "SCSV sent by client\n");
+#endif
+		}
+
 	return(p-q);
 	}
 
@@ -1275,6 +1303,8 @@
 	SSL_CIPHER *c;
 	STACK_OF(SSL_CIPHER) *sk;
 	int i,n;
+	if (s->s3)
+		s->s3->send_connection_binding = 0;
 
 	n=ssl_put_cipher_by_char(s,NULL,NULL);
 	if ((num%n) != 0)
@@ -1292,6 +1322,26 @@
 
 	for (i=0; i<num; i+=n)
 		{
+		/* Check for SCSV */
+		if (s->s3 && (n != 3 || !p[0]) &&
+			(p[n-2] == ((SSL3_CK_SCSV >> 8) & 0xff)) &&
+			(p[n-1] == (SSL3_CK_SCSV & 0xff)))
+			{
+			/* SCSV fatal if renegotiating */
+			if (s->new_session)
+				{
+				SSLerr(SSL_F_SSL_BYTES_TO_CIPHER_LIST,SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING);
+				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE); 
+				goto err;
+				}
+			s->s3->send_connection_binding = 1;
+			p += n;
+#ifdef OPENSSL_RI_DEBUG
+			fprintf(stderr, "SCSV received by server\n");
+#endif
+			continue;
+			}
+
 		c=ssl_get_cipher_by_char(s,p);
 		p+=n;
 		if (c != NULL)
@@ -1495,6 +1545,10 @@
 		ret->options |= SSL_OP_NO_TICKET;
 
 #endif
+	/* Default is to connect to non-RI servers. When RI is more widely
+	 * deployed might change this.
+	 */
+	ret->options |= SSL_OP_LEGACY_SERVER_CONNECT;
 
 	return(ret);
 err:
--- openssl-0.9.8g.orig/ssl/d1_pkt.c
+++ openssl-0.9.8g/ssl/d1_pkt.c
@@ -167,6 +167,10 @@
     DTLS1_RECORD_DATA *rdata;
 	pitem *item;
 
+	/* Limit the size of the queue to prevent DOS attacks */
+	if (pqueue_size(queue->q) >= 100)
+		return 0;
+		
 	rdata = OPENSSL_malloc(sizeof(DTLS1_RECORD_DATA));
 	item = pitem_new(priority, rdata);
 	if (rdata == NULL || item == NULL)
--- openssl-0.9.8g.orig/ssl/ssl_err.c
+++ openssl-0.9.8g/ssl/ssl_err.c
@@ -138,6 +138,7 @@
 {ERR_FUNC(SSL_F_SSL3_CONNECT),	"SSL3_CONNECT"},
 {ERR_FUNC(SSL_F_SSL3_CTRL),	"SSL3_CTRL"},
 {ERR_FUNC(SSL_F_SSL3_CTX_CTRL),	"SSL3_CTX_CTRL"},
+{ERR_FUNC(SSL_F_SSL3_DO_CHANGE_CIPHER_SPEC),	"SSL3_DO_CHANGE_CIPHER_SPEC"},
 {ERR_FUNC(SSL_F_SSL3_ENC),	"SSL3_ENC"},
 {ERR_FUNC(SSL_F_SSL3_GENERATE_KEY_BLOCK),	"SSL3_GENERATE_KEY_BLOCK"},
 {ERR_FUNC(SSL_F_SSL3_GET_CERTIFICATE_REQUEST),	"SSL3_GET_CERTIFICATE_REQUEST"},
@@ -169,9 +170,11 @@
 {ERR_FUNC(SSL_F_SSL3_SETUP_KEY_BLOCK),	"SSL3_SETUP_KEY_BLOCK"},
 {ERR_FUNC(SSL_F_SSL3_WRITE_BYTES),	"SSL3_WRITE_BYTES"},
 {ERR_FUNC(SSL_F_SSL3_WRITE_PENDING),	"SSL3_WRITE_PENDING"},
+{ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT),	"SSL_ADD_CLIENTHELLO_RENEGOTIATE_EXT"},
 {ERR_FUNC(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT),	"SSL_ADD_CLIENTHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_ADD_DIR_CERT_SUBJECTS_TO_STACK),	"SSL_add_dir_cert_subjects_to_stack"},
 {ERR_FUNC(SSL_F_SSL_ADD_FILE_CERT_SUBJECTS_TO_STACK),	"SSL_add_file_cert_subjects_to_stack"},
+{ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT),	"SSL_ADD_SERVERHELLO_RENEGOTIATE_EXT"},
 {ERR_FUNC(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT),	"SSL_ADD_SERVERHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_BAD_METHOD),	"SSL_BAD_METHOD"},
 {ERR_FUNC(SSL_F_SSL_BYTES_TO_CIPHER_LIST),	"SSL_BYTES_TO_CIPHER_LIST"},
@@ -212,6 +215,10 @@
 {ERR_FUNC(SSL_F_SSL_INIT_WBIO_BUFFER),	"SSL_INIT_WBIO_BUFFER"},
 {ERR_FUNC(SSL_F_SSL_LOAD_CLIENT_CA_FILE),	"SSL_load_client_CA_file"},
 {ERR_FUNC(SSL_F_SSL_NEW),	"SSL_new"},
+{ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT),	"SSL_PARSE_CLIENTHELLO_RENEGOTIATE_EXT"},
+{ERR_FUNC(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT),	"SSL_PARSE_CLIENTHELLO_TLSEXT"},
+{ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT),	"SSL_PARSE_SERVERHELLO_RENEGOTIATE_EXT"},
+{ERR_FUNC(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT),	"SSL_PARSE_SERVERHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_PEEK),	"SSL_peek"},
 {ERR_FUNC(SSL_F_SSL_PREPARE_CLIENTHELLO_TLSEXT),	"SSL_PREPARE_CLIENTHELLO_TLSEXT"},
 {ERR_FUNC(SSL_F_SSL_PREPARE_SERVERHELLO_TLSEXT),	"SSL_PREPARE_SERVERHELLO_TLSEXT"},
@@ -379,6 +386,7 @@
 {ERR_REASON(SSL_R_NO_PRIVATE_KEY_ASSIGNED),"no private key assigned"},
 {ERR_REASON(SSL_R_NO_PROTOCOLS_AVAILABLE),"no protocols available"},
 {ERR_REASON(SSL_R_NO_PUBLICKEY)          ,"no publickey"},
+{ERR_REASON(SSL_R_NO_RENEGOTIATION)      ,"no renegotiation"},
 {ERR_REASON(SSL_R_NO_SHARED_CIPHER)      ,"no shared cipher"},
 {ERR_REASON(SSL_R_NO_VERIFY_CALLBACK)    ,"no verify callback"},
 {ERR_REASON(SSL_R_NULL_SSL_CTX)          ,"null ssl ctx"},
@@ -406,10 +414,14 @@
 {ERR_REASON(SSL_R_RECORD_LENGTH_MISMATCH),"record length mismatch"},
 {ERR_REASON(SSL_R_RECORD_TOO_LARGE)      ,"record too large"},
 {ERR_REASON(SSL_R_RECORD_TOO_SMALL)      ,"record too small"},
+{ERR_REASON(SSL_R_RENEGOTIATE_EXT_TOO_LONG),"renegotiate ext too long"},
+{ERR_REASON(SSL_R_RENEGOTIATION_ENCODING_ERR),"renegotiation encoding err"},
+{ERR_REASON(SSL_R_RENEGOTIATION_MISMATCH),"renegotiation mismatch"},
 {ERR_REASON(SSL_R_REQUIRED_CIPHER_MISSING),"required cipher missing"},
 {ERR_REASON(SSL_R_REUSE_CERT_LENGTH_NOT_ZERO),"reuse cert length not zero"},
 {ERR_REASON(SSL_R_REUSE_CERT_TYPE_NOT_ZERO),"reuse cert type not zero"},
 {ERR_REASON(SSL_R_REUSE_CIPHER_LIST_NOT_ZERO),"reuse cipher list not zero"},
+{ERR_REASON(SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING),"scsv received when renegotiating"},
 {ERR_REASON(SSL_R_SERVERHELLO_TLSEXT)    ,"serverhello tlsext"},
 {ERR_REASON(SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED),"session id context uninitialized"},
 {ERR_REASON(SSL_R_SHORT_READ)            ,"short read"},
@@ -479,6 +491,7 @@
 {ERR_REASON(SSL_R_UNKNOWN_REMOTE_ERROR_TYPE),"unknown remote error type"},
 {ERR_REASON(SSL_R_UNKNOWN_SSL_VERSION)   ,"unknown ssl version"},
 {ERR_REASON(SSL_R_UNKNOWN_STATE)         ,"unknown state"},
+{ERR_REASON(SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED),"unsafe legacy renegotiation disabled"},
 {ERR_REASON(SSL_R_UNSUPPORTED_CIPHER)    ,"unsupported cipher"},
 {ERR_REASON(SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM),"unsupported compression algorithm"},
 {ERR_REASON(SSL_R_UNSUPPORTED_ELLIPTIC_CURVE),"unsupported elliptic curve"},
--- openssl-0.9.8g.orig/ssl/s3_lib.c
+++ openssl-0.9.8g/ssl/s3_lib.c
@@ -1722,11 +1722,17 @@
 		}
 #ifndef OPENSSL_NO_DH
 	if (s->s3->tmp.dh != NULL)
+		{
 		DH_free(s->s3->tmp.dh);
+		s->s3->tmp.dh = NULL;
+		}
 #endif
 #ifndef OPENSSL_NO_ECDH
 	if (s->s3->tmp.ecdh != NULL)
+		{
 		EC_KEY_free(s->s3->tmp.ecdh);
+		s->s3->tmp.ecdh = NULL;
+		}
 #endif
 
 	rp = s->s3->rbuf.buf;
--- openssl-0.9.8g.orig/ssl/Makefile
+++ openssl-0.9.8g/ssl/Makefile
@@ -30,7 +30,7 @@
 	ssl_lib.c ssl_err2.c ssl_cert.c ssl_sess.c \
 	ssl_ciph.c ssl_stat.c ssl_rsa.c \
 	ssl_asn1.c ssl_txt.c ssl_algs.c \
-	bio_ssl.c ssl_err.c kssl.c
+	bio_ssl.c ssl_err.c kssl.c t1_reneg.c
 LIBOBJ= \
 	s2_meth.o  s2_srvr.o  s2_clnt.o  s2_lib.o  s2_enc.o s2_pkt.o \
 	s3_meth.o  s3_srvr.o  s3_clnt.o  s3_lib.o  s3_enc.o s3_pkt.o s3_both.o \
@@ -41,7 +41,7 @@
 	ssl_lib.o ssl_err2.o ssl_cert.o ssl_sess.o \
 	ssl_ciph.o ssl_stat.o ssl_rsa.o \
 	ssl_asn1.o ssl_txt.o ssl_algs.o \
-	bio_ssl.o ssl_err.o kssl.o
+	bio_ssl.o ssl_err.o kssl.o t1_reneg.o
 
 SRC= $(LIBSRC)
 
@@ -949,6 +949,27 @@
 t1_meth.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h
 t1_meth.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h ssl_locl.h
 t1_meth.o: t1_meth.c
+t1_reneg.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
+t1_reneg.o: ../include/openssl/bn.h ../include/openssl/buffer.h
+t1_reneg.o: ../include/openssl/comp.h ../include/openssl/crypto.h
+t1_reneg.o: ../include/openssl/dsa.h ../include/openssl/dtls1.h
+t1_reneg.o: ../include/openssl/e_os2.h ../include/openssl/ec.h
+t1_reneg.o: ../include/openssl/ecdh.h ../include/openssl/ecdsa.h
+t1_reneg.o: ../include/openssl/err.h ../include/openssl/evp.h
+t1_reneg.o: ../include/openssl/hmac.h
+t1_reneg.o: ../include/openssl/kssl.h ../include/openssl/lhash.h
+t1_reneg.o: ../include/openssl/obj_mac.h ../include/openssl/objects.h
+t1_reneg.o: ../include/openssl/opensslconf.h ../include/openssl/opensslv.h
+t1_reneg.o: ../include/openssl/ossl_typ.h ../include/openssl/pem.h
+t1_reneg.o: ../include/openssl/pem2.h ../include/openssl/pkcs7.h
+t1_reneg.o: ../include/openssl/pq_compat.h ../include/openssl/pqueue.h
+t1_reneg.o: ../include/openssl/rsa.h ../include/openssl/safestack.h
+t1_reneg.o: ../include/openssl/sha.h ../include/openssl/ssl.h
+t1_reneg.o: ../include/openssl/ssl2.h ../include/openssl/ssl23.h
+t1_reneg.o: ../include/openssl/ssl3.h ../include/openssl/stack.h
+t1_reneg.o: ../include/openssl/symhacks.h ../include/openssl/tls1.h
+t1_reneg.o: ../include/openssl/x509.h ../include/openssl/x509_vfy.h ssl_locl.h
+t1_reneg.o: t1_reneg.c
 t1_srvr.o: ../e_os.h ../include/openssl/asn1.h ../include/openssl/bio.h
 t1_srvr.o: ../include/openssl/bn.h ../include/openssl/buffer.h
 t1_srvr.o: ../include/openssl/comp.h ../include/openssl/crypto.h
--- openssl-0.9.8g.orig/ssl/t1_lib.c
+++ openssl-0.9.8g/ssl/t1_lib.c
@@ -132,6 +132,11 @@
 	int extdatalen=0;
 	unsigned char *ret = p;
 
+	/* don't add extensions for SSLv3 unless doing secure renegotiation */
+	if (s->client_version == SSL3_VERSION
+					&& !s->s3->send_connection_binding)
+		return p;
+
 	ret+=2;
 
 	if (ret>=limit) return NULL; /* this really never occurs, but ... */
@@ -168,7 +173,33 @@
 		ret+=size_str;
 
 		}
+ 
+        /* Add RI if renegotiating */
+        if (s->new_session)
+          {
+          int el;
+          
+          if(!ssl_add_clienthello_renegotiate_ext(s, 0, &el, 0))
+              {
+              SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+              return NULL;
+              }
+
+          if((limit - p - 4 - el) < 0) return NULL;
+          
+          s2n(TLSEXT_TYPE_renegotiate,ret);
+          s2n(el,ret);
+
+          if(!ssl_add_clienthello_renegotiate_ext(s, ret, &el, el))
+              {
+              SSLerr(SSL_F_SSL_ADD_CLIENTHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+              return NULL;
+              }
+
+          ret += el;
+        }
 
+           
 	if (!(SSL_get_options(s) & SSL_OP_NO_TICKET))
 		{
 		int ticklen;
@@ -202,6 +233,10 @@
 	int extdatalen=0;
 	unsigned char *ret = p;
 
+	/* don't add extensions for SSLv3, unless doing secure renegotiation */
+	if (s->version == SSL3_VERSION && !s->s3->send_connection_binding)
+		return p;
+	
 	ret+=2;
 	if (ret>=limit) return NULL; /* this really never occurs, but ... */
 
@@ -212,6 +247,30 @@
 		s2n(TLSEXT_TYPE_server_name,ret);
 		s2n(0,ret);
 		}
+
+	if(s->s3->send_connection_binding)
+        {
+          int el;
+          
+          if(!ssl_add_serverhello_renegotiate_ext(s, 0, &el, 0))
+              {
+              SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+              return NULL;
+              }
+
+          if((limit - p - 4 - el) < 0) return NULL;
+          
+          s2n(TLSEXT_TYPE_renegotiate,ret);
+          s2n(el,ret);
+
+          if(!ssl_add_serverhello_renegotiate_ext(s, ret, &el, el))
+              {
+              SSLerr(SSL_F_SSL_ADD_SERVERHELLO_TLSEXT, ERR_R_INTERNAL_ERROR);
+              return NULL;
+              }
+
+          ret += el;
+        }
 	
 	if (s->tlsext_ticket_expected
 		&& !(SSL_get_options(s) & SSL_OP_NO_TICKET)) 
@@ -234,14 +293,17 @@
 	unsigned short size;
 	unsigned short len;
 	unsigned char *data = *p;
+	int renegotiate_seen = 0;
+
 	s->servername_done = 0;
 
 	if (data >= (d+n-2))
-		return 1;
+		goto ri_check;
+
 	n2s(data,len);
 
 	if (data > (d+n-len)) 
-		return 1;
+		goto ri_check;
 
 	while (data <= (d+n-4))
 		{
@@ -249,7 +311,7 @@
 		n2s(data,size);
 
 		if (data+size > (d+n))
-	   		return 1;
+	   		goto ri_check;
 
 		if (s->tlsext_debug_cb)
 			s->tlsext_debug_cb(s, 0, type, data, size,
@@ -312,18 +374,28 @@
 				switch (servname_type)
 					{
 				case TLSEXT_NAMETYPE_host_name:
-					if (s->session->tlsext_hostname == NULL)
+					if (!s->hit)
 						{
-						if (len > TLSEXT_MAXLEN_host_name || 
-							((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL))
+						if(s->session->tlsext_hostname)
+							{
+							*al = SSL_AD_DECODE_ERROR;
+							return 0;
+							}
+						if (len > TLSEXT_MAXLEN_host_name)
 							{
 							*al = TLS1_AD_UNRECOGNIZED_NAME;
 							return 0;
 							}
+						if ((s->session->tlsext_hostname = OPENSSL_malloc(len+1)) == NULL)
+							{
+							*al = TLS1_AD_INTERNAL_ERROR;
+							return 0;
+							}
 						memcpy(s->session->tlsext_hostname, sdata, len);
 						s->session->tlsext_hostname[len]='\0';
 						if (strlen(s->session->tlsext_hostname) != len) {
 							OPENSSL_free(s->session->tlsext_hostname);
+							s->session->tlsext_hostname = NULL;
 							*al = TLS1_AD_UNRECOGNIZED_NAME;
 							return 0;
 						}
@@ -331,7 +403,8 @@
 
 						}
 					else 
-						s->servername_done = strlen(s->session->tlsext_hostname) == len 
+						s->servername_done = s->session->tlsext_hostname
+							&& strlen(s->session->tlsext_hostname) == len 
 							&& strncmp(s->session->tlsext_hostname, (char *)sdata, len) == 0;
 					
 					break;
@@ -349,12 +422,32 @@
 				}
 
 			}
+		else if (type == TLSEXT_TYPE_renegotiate)
+			{
+			if(!ssl_parse_clienthello_renegotiate_ext(s, data, size, al))
+				return 0;
+			renegotiate_seen = 1;
+			}
+
 		/* session ticket processed earlier */
 
 		data+=size;		
 		}
-
 	*p = data;
+
+	ri_check:
+
+	/* Need RI if renegotiating */
+
+	if (!renegotiate_seen && s->new_session &&
+		!(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+		{
+		*al = SSL_AD_HANDSHAKE_FAILURE;
+	 	SSLerr(SSL_F_SSL_PARSE_CLIENTHELLO_TLSEXT,
+				SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
+		return 0;
+		}
+
 	return 1;
 	}
 
@@ -364,11 +457,11 @@
 	unsigned short size;
 	unsigned short len;  
 	unsigned char *data = *p;
-
 	int tlsext_servername = 0;
+	int renegotiate_seen = 0;
 
 	if (data >= (d+n-2))
-		return 1;
+		goto ri_check;
 
 	n2s(data,len);
 
@@ -378,7 +471,7 @@
 		n2s(data,size);
 
 		if (data+size > (d+n))
-	   		return 1;
+	   		goto ri_check;
 
 		if (s->tlsext_debug_cb)
 			s->tlsext_debug_cb(s, 1, type, data, size,
@@ -403,7 +496,12 @@
 				}
 			s->tlsext_ticket_expected = 1;
 			}
-
+		else if (type == TLSEXT_TYPE_renegotiate)
+			{
+			if(!ssl_parse_serverhello_renegotiate_ext(s, data, size, al))
+				return 0;
+			renegotiate_seen = 1;
+			}
 		data+=size;		
 		}
 
@@ -435,6 +533,26 @@
 		}
 
 	*p = data;
+
+	ri_check:
+
+	/* Determine if we need to see RI. Strictly speaking if we want to
+	 * avoid an attack we should *always* see RI even on initial server
+	 * hello because the client doesn't see any renegotiation during an
+	 * attack. However this would mean we could not connect to any server
+	 * which doesn't support RI so for the immediate future tolerate RI
+	 * absence on initial connect only.
+	 */
+	if (!renegotiate_seen
+		&& !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)
+		&& !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+		{
+		*al = SSL_AD_HANDSHAKE_FAILURE;
+		SSLerr(SSL_F_SSL_PARSE_SERVERHELLO_TLSEXT,
+				SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
+		return 0;
+		}
+
 	return 1;
 	}
 
--- openssl-0.9.8g.orig/ssl/s3_srvr.c
+++ openssl-0.9.8g/ssl/s3_srvr.c
@@ -248,6 +248,18 @@
 				s->state=SSL3_ST_SR_CLNT_HELLO_A;
 				s->ctx->stats.sess_accept++;
 				}
+			else if (!s->s3->send_connection_binding &&
+				!(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+				{
+				/* Server attempting to renegotiate with
+				 * client that doesn't support secure
+				 * renegotiation.
+				 */
+				SSLerr(SSL_F_SSL3_ACCEPT, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED);
+				ssl3_send_alert(s,SSL3_AL_FATAL,SSL_AD_HANDSHAKE_FAILURE);
+				ret = -1;
+				goto end;
+				}
 			else
 				{
 				/* s->state == SSL_ST_RENEGOTIATE,
@@ -659,9 +671,7 @@
 	if (s->s3->tmp.message_type == SSL3_MT_CLIENT_HELLO)
 		{
 		/* Throw away what we have done so far in the current handshake,
-		 * which will now be aborted. (A full SSL_clear would be too much.)
-		 * I hope that tmp.dh is the only thing that may need to be cleared
-		 * when a handshake is not completed ... */
+		 * which will now be aborted. (A full SSL_clear would be too much.) */
 #ifndef OPENSSL_NO_DH
 		if (s->s3->tmp.dh != NULL)
 			{
@@ -669,6 +679,13 @@
 			s->s3->tmp.dh = NULL;
 			}
 #endif
+#ifndef OPENSSL_NO_ECDH
+		if (s->s3->tmp.ecdh != NULL)
+			{
+			EC_KEY_free(s->s3->tmp.ecdh);
+			s->s3->tmp.ecdh = NULL;
+			}
+#endif
 		return 2;
 		}
 	return 1;
@@ -873,12 +890,17 @@
 			}
 		if (j == 0)
 			{
+/* Disabled because it can be used in a ciphersuite downgrade
+ * attack: CVE-2010-4180.
+ */
+#if 0
 			if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
 				{
 				/* Very bad for multi-threading.... */
 				s->session->cipher=sk_SSL_CIPHER_value(ciphers, 0);
 				}
 			else
+#endif
 				{
 				/* we need to have the cipher in the cipher
 				 * list if we are asked to reuse it */
@@ -915,7 +937,7 @@
 
 #ifndef OPENSSL_NO_TLSEXT
 	/* TLS extensions*/
-	if (s->version > SSL3_VERSION)
+	if (s->version >= SSL3_VERSION)
 		{
 		if (!ssl_parse_clienthello_tlsext(s,&p,d,n, &al))
 			{
@@ -1093,8 +1115,16 @@
 		 * session-id if we want it to be single use.
 		 * Currently I will not implement the '0' length session-id
 		 * 12-Jan-98 - I'll now support the '0' length stuff.
+		 *
+		 * We also have an additional case where stateless session
+		 * resumption is successful: we always send back the old
+		 * session id. In this case s->hit is non zero: this can
+		 * only happen if stateless session resumption is succesful
+		 * if session caching is disabled so existing functionality
+		 * is unaffected.
 		 */
-		if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER))
+		if (!(s->ctx->session_cache_mode & SSL_SESS_CACHE_SERVER)
+			&& !s->hit)
 			s->session->session_id_length=0;
 
 		sl=s->session->session_id_length;
@@ -1254,7 +1284,6 @@
 
 			if (s->s3->tmp.dh != NULL)
 				{
-				DH_free(dh);
 				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
 				goto err;
 				}
@@ -1315,7 +1344,6 @@
 
 			if (s->s3->tmp.ecdh != NULL)
 				{
-				EC_KEY_free(s->s3->tmp.ecdh); 
 				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE, ERR_R_INTERNAL_ERROR);
 				goto err;
 				}
@@ -1326,12 +1354,11 @@
 				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
 				goto err;
 				}
-			if (!EC_KEY_up_ref(ecdhp))
+			if ((ecdh = EC_KEY_dup(ecdhp)) == NULL)
 				{
 				SSLerr(SSL_F_SSL3_SEND_SERVER_KEY_EXCHANGE,ERR_R_ECDH_LIB);
 				goto err;
 				}
-			ecdh = ecdhp;
 
 			s->s3->tmp.ecdh=ecdh;
 			if ((EC_KEY_get0_public_key(ecdh) == NULL) ||
@@ -2185,6 +2212,12 @@
                         /* Get encoded point length */
                         i = *p; 
 			p += 1;
+			if (n != 1 + i)
+				{
+				SSLerr(SSL_F_SSL3_GET_CLIENT_KEY_EXCHANGE,
+				    ERR_R_EC_LIB);
+				goto err;
+				}
                         if (EC_POINT_oct2point(group, 
 			    clnt_ecpoint, p, i, bn_ctx) == 0)
 				{
@@ -2519,7 +2552,7 @@
 	else
 		{
 		i=ssl_verify_cert_chain(s,sk);
-		if (!i)
+		if (i <= 0)
 			{
 			al=ssl_verify_alarm_type(s->verify_result);
 			SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);
--- openssl-0.9.8g.orig/debian/openssl.files
+++ openssl-0.9.8g/debian/openssl.files
@@ -0,0 +1,9 @@
+usr/share/man/man1
+usr/share/man/man5
+usr/share/man/man7
+usr/bin
+usr/lib/ssl/misc
+usr/lib/ssl/certs
+usr/lib/ssl/openssl.cnf
+usr/lib/ssl/private
+etc/ssl
--- openssl-0.9.8g.orig/debian/libssl0.9.8.templates
+++ openssl-0.9.8g/debian/libssl0.9.8.templates
@@ -0,0 +1,30 @@
+Template: libssl0.9.8/restart-services
+Type: string
+_Description: Services to restart to make them use the new libraries:
+ This release of OpenSSL fixes some security issues. Services will not
+ use these fixes until they are restarted. Please note that restarting
+ the SSH server (sshd) should not affect any existing connections.
+ .
+ Please check the list of detected services that need to be restarted
+ and correct it, if needed. The services names must be identical to the
+ initialization script names in /etc/init.d and separated by
+ spaces. No services will be restarted if the list is empty.
+ .
+ Any service that later fails unexpectedly after this upgrade should
+ be restarted. It is recommended to reboot this host to avoid any
+ SSL-related trouble.
+
+Template: libssl0.9.8/restart-failed
+Type: error
+#flag:translate!:3
+#flag:comment:2
+# This paragraph is followed by a (non translatable) paragraph containing
+# a list of services that could not be restarted
+_Description: Failure restarting some services for OpenSSL upgrade
+ The following services could not be restarted for the OpenSSL library upgrade:
+ .
+ ${services}
+ .
+ You will need to start these manually by running
+ '/etc/init.d/<service> start'.
+
--- openssl-0.9.8g.orig/debian/control
+++ openssl-0.9.8g/debian/control
@@ -0,0 +1,70 @@
+Source: openssl
+Build-Depends: debhelper (>= 5.0.22), binutils (>= 2.14.90.0.7), zlib1g-dev, m4, bc
+Section: utils
+Priority: optional
+Maintainer: Debian OpenSSL Team <pkg-openssl-devel@lists.alioth.debian.org>
+Uploaders: Christoph Martin <christoph.martin@uni-mainz.de>, Kurt Roeckx <kurt@roeckx.be>
+Standards-Version: 3.8.0
+Vcs-Browser: http://svn.debian.org/wsvn/pkg-openssl/openssl
+Vcs-Svn: svn://svn.debian.org/pkg-openssl/openssl/
+
+Package: openssl
+Priority: optional
+Architecture: any
+Depends: ${shlibs:Depends}, ${perl:Depends}
+Conflicts: ssleay (<< 0.9.2b)
+Suggests: ca-certificates
+Description: Secure Socket Layer (SSL) binary and related cryptographic tools
+ This package contains the openssl binary and related tools.
+ .
+ It is part of the OpenSSL implementation of SSL.
+ .
+ You need it to perform certain cryptographic actions like:
+  -  Creation of RSA, DH and DSA key parameters;
+  -  Creation of X.509 certificates, CSRs and CRLs;
+  -  Calculation of message digests;
+  -  Encryption and decryption with ciphers;
+  -  SSL/TLS client and server tests;
+  -  Handling of S/MIME signed or encrypted mail.
+
+Package: libssl0.9.8
+Section: libs
+Priority: important
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Conflicts: ssleay (<< 0.9.2b), libssl, openssl (<< 0.9.6-2), libssl096-dev (<< 0.9.6-2)
+Description: SSL shared libraries
+ libssl and libcrypto shared libraries needed by programs like
+ apache-ssl, telnet-ssl and openssh.
+ .
+ It is part of the OpenSSL implementation of SSL.
+
+Package: libcrypto0.9.8-udeb
+XC-Package-Type: udeb
+Section: debian-installer
+Priority: optional
+Architecture: any
+Depends: ${shlibs:Depends}, ${misc:Depends}
+Description: crypto shared library - udeb
+ libcrypto shared library.
+ .
+ Do not install it on a normal system.
+
+Package: libssl-dev
+Section: libdevel
+Priority: optional
+Architecture: any
+Depends: libssl0.9.8 (= ${binary:Version}), zlib1g-dev
+Conflicts: ssleay (<< 0.9.2b), libssl08-dev, libssl09-dev, libssl095a-dev, libssl096-dev
+Description: SSL development libraries, header files and documentation
+ libssl and libcrypto development libraries, header files and manpages.
+ .
+ It is part of the OpenSSL implementation of SSL.
+
+Package: libssl0.9.8-dbg
+Section: libdevel
+Priority: extra
+Architecture: any
+Depends: libssl0.9.8 (= ${binary:Version})
+Description: Symbol tables for libssl and libcrypto
+ This package is part of the OpenSSL implementation of SSL.
--- openssl-0.9.8g.orig/debian/libssl-dev.dirs
+++ openssl-0.9.8g/debian/libssl-dev.dirs
@@ -0,0 +1,3 @@
+usr/lib
+usr/share/doc/libssl-dev
+usr/share/man
--- openssl-0.9.8g.orig/debian/copyright
+++ openssl-0.9.8g/debian/copyright
@@ -0,0 +1,135 @@
+This package was debianized by Christoph Martin martin@uni-mainz.de on
+Fri, 22 Nov 1996 21:29:51 +0100.
+
+Copyright (c) 1998-2004 The OpenSSL Project
+Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
+
+The upstream sources were obtained from http://www.openssl.org/
+
+
+  LICENSE ISSUES
+  ==============
+
+  The OpenSSL toolkit stays under a dual license, i.e. both the conditions of
+  the OpenSSL License and the original SSLeay license apply to the toolkit.
+  See below for the actual license texts. Actually both licenses are BSD-style
+  Open Source licenses. In case of any license issues related to OpenSSL
+  please contact openssl-core@openssl.org.
+
+  OpenSSL License
+  ---------------
+
+/* ====================================================================
+ * Copyright (c) 1998-2004 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+ Original SSLeay License
+ -----------------------
+
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+
--- openssl-0.9.8g.orig/debian/README.optimization
+++ openssl-0.9.8g/debian/README.optimization
@@ -0,0 +1,32 @@
+openssl ships optimized libraries for some cpus. The loading of these
+libraries depends on the ability of the dynamic linker to automaticly
+search additional directories depending on the cpu. If you want to
+find out which are these directories for your computer, run the
+following command:
+
+LD_LIBRARY_PATH=/usr/lib strace true 2>&1 | fgrep "open(\"/usr/lib"
+
+On a Pentium III this gives:
+
+open("/usr/lib/i686/mmx/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
+open("/usr/lib/i686/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
+open("/usr/lib/mmx/libc.so.6", O_RDONLY) = -1 ENOENT (No such file or directory)
+open("/usr/lib/libc.so.6", O_RDONLY)    = -1 ENOENT (No such file or directory)
+
+Following is a list of cpus, library paths and possible optimizations:
+
+486		/usr/lib/i486	-march=i486 -mcpu=i486 +asm
+Pentium 	/usr/lib/i586	-march=i586 -mcpu=i586 +asm
+Pentium MMX	/usr/lib/i586	-march=i586 -mcpu=i586 +asm
+Pentium II	/usr/lib/i686	-march=i686 -mcpu=i686 +asm
+Pentium III	/usr/lib/i686	-march=i686 -mcpu=i686 +asm
+AMD-K6		/usr/lib/i586	-march=i586 -mcpu=i586 +asm
+AMD-K7		/usr/lib/i686	-march=i686 -mcpu=i686 +asm
+
+Sparc v8	/usr/lib/v8	-mcpu=v8              +asm
+Sparc v9	/usr/lib/v9	-mcpu=v9 -Wa,-Av8plus +asm
+
+Alpha EV4	/usr/lib/ev4	-mcpu=ev4
+Alpha EV5	/usr/lib/ev5	-mcpu=ev5
+
++asm means that the handcrafted 586 assembler routines can be used. 
--- openssl-0.9.8g.orig/debian/libssl0.9.8.files
+++ openssl-0.9.8g/debian/libssl0.9.8.files
@@ -0,0 +1,4 @@
+usr/lib/*.so.*.*.*
+usr/lib/*/*.so.*.*.*
+usr/lib/i686/cmov/*.so.*.*.*
+usr/lib/ssl/engines
--- openssl-0.9.8g.orig/debian/openssl.docs
+++ openssl-0.9.8g/debian/openssl.docs
@@ -0,0 +1,2 @@
+doc
+FAQ
--- openssl-0.9.8g.orig/debian/libssl-dev.docs
+++ openssl-0.9.8g/debian/libssl-dev.docs
@@ -0,0 +1 @@
+demos
--- openssl-0.9.8g.orig/debian/rules
+++ openssl-0.9.8g/debian/rules
@@ -0,0 +1,182 @@
+#!/usr/bin/make -f
+# Sample debian.rules file - for GNU Hello (1.3).
+# Copyright 1994,1995 by Ian Jackson.
+# I hereby give you perpetual unlimited permission to copy,
+# modify and relicense this file, provided that you do not remove
+# my name from the file itself.  (I assert my moral right of
+# paternity under the Copyright, Designs and Patents Act 1988.)
+# This file may have to be extensively modified
+#
+# Modified to be a prototype for debmake by Christoph Lameter <clameter@debian.org>
+SHELL=/bin/bash
+
+package=openssl
+
+# For generating the manpages
+export VERSION=$(shell dpkg-parsechangelog | grep '^Version:' | sed -e 's/^.*://' -e 's/-.*//')
+
+# The binary architeture
+DEB_HOST_ARCH = $(shell dpkg-architecture -qDEB_HOST_ARCH)
+
+CONFARGS  = --prefix=/usr --openssldir=/usr/lib/ssl no-idea no-mdc2 no-rc5 zlib  enable-tlsext
+OPT_alpha = ev4 ev5
+OPT_i386  = i486 i586 i686/cmov
+OPT_sparc = v8 v9
+ARCHOPTS  = OPT_$(DEB_HOST_ARCH)
+OPTS      = $($(ARCHOPTS))
+WANTED_LIBC_VERSION = 2.3.1-10
+
+backup-config:
+	dh_testdir
+	for tobkp in crypto/opensslconf.h include/openssl/opensslconf.h Makefile; do \
+	[ -f "$$tobkp".deb-orig ] || cp -a "$$tobkp" "$$tobkp".deb-orig ; \
+	done
+
+build: backup-config
+	dh_testdir
+	perl util/perlpath.pl /usr/bin
+#	perl util/ssldir.pl /usr/lib/ssl
+#	chmod +x debian/libtool
+	./Configure no-shared $(CONFARGS) debian-$(DEB_HOST_ARCH)
+	make -f Makefile all
+	make test
+	mv libcrypto.a libcrypto.static
+	mv libssl.a libssl.static
+	make -f Makefile clean
+	test -z "$(OPTS)" || for opt in $(OPTS); \
+	do \
+		set -xe; \
+		./Configure shared $(CONFARGS) debian-$(DEB_HOST_ARCH)-$$opt; \
+		make -f Makefile all; \
+		make test; \
+		mkdir -p $$opt; \
+		mv libcrypto.so* libssl.so* $$opt/; \
+		make -f Makefile clean; \
+	done
+	./Configure shared $(CONFARGS) debian-$(DEB_HOST_ARCH)
+	#make -f Makefile depend
+	ln -sf apps/openssl.pod crypto/crypto.pod ssl/ssl.pod doc/
+#	make -f Makefile linux-shared
+	make -f Makefile all
+	make test
+#	strip apps/openssl
+#	make -f Makefile clean
+#	./Configure --prefix=/usr --openssldir=/usr/lib/ssl no-idea no-mdc2 no-rc5 debian-$(DEB_HOST_ARCH)
+#	make -f Makefile all
+	touch build
+
+clean: backup-config
+	dh_testdir
+	dh_testroot
+	-rm -f build
+	-perl util/perlpath.pl /usr/bin
+	-./Configure $(CONFARGS) debian-$(DEB_HOST_ARCH)
+	[ ! -f Makefile ] || make -f Makefile  clean clean-shared
+	#-make -f Makefile  dclean
+	-perl util/perlpath.pl /usr/local/bin/perl
+#	perl util/ssldir.pl /usr/local/ssl
+	-rm -f test/.rnd test/testkey.pem test/testreq.pem test/certCA.srl
+	-rm -f util/mk1mf.bak Makefile.bak `find . -name Makefile.save` 
+	-rm -f crypto/pem/ctx_size
+	-rm -f `find . -name "*~"`
+	-rm -f `find . -name "*.orig" -o -name "*.rej"`
+	-rm -f certs/*.0 certs/*.1
+#	-rm -rf debian/tmp debian/files* core `find debian/* -type d`
+	-rm -rf core $(OPTS)
+	-rm doc/*.pod
+	-rm -f libcrypto.* libssl.*
+	-cd test && rm -f .rnd tmp.bntest tmp.bctest *.o *.obj lib tags core .pure .nfs* *.old *.bak fluff bntest ectest  ecdsatest ecdhtest ideatest md2test  md4test md5test hmactest rc2test rc4test rc5test destest shatest sha1test sha256t sha512t mdc2test rmdtest randtest dhtest enginetest bftest casttest ssltest exptest dsatest rsa_test evp_test *.ss *.srl log dummytest newkey.pem igetest
+	for tobkp in crypto/opensslconf.h include/openssl/opensslconf.h Makefile; do \
+	mv "$$tobkp".deb-orig "$$tobkp" ; \
+	done
+	dh_clean
+
+binary-indep:	build
+	dh_testdir
+	dh_testroot
+# There are no architecture-independent files to be uploaded
+# generated by this package.  If there were any they would be
+# made here.
+
+binary-arch:	build
+	dh_testdir
+	dh_testroot
+	dh_clean
+#	-rm -rf debian/tmp `find debian/* -type d`
+	install -d debian/tmp debian/libssl0.9.8 debian/libssl-dev
+#	cd debian/tmp && install -d `cat ../dirs`
+#	cd debian/libssl09 && install -d `cat ../libssl09.dirs`
+#	cd debian/libssl09-dev && install -d `cat ../libssl09-dev.dirs`
+	dh_installdirs
+#openssl install
+	make -f Makefile  install INSTALL_PREFIX=`pwd`/debian/tmp
+#	rm debian/tmp/usr/share/man/man1/openssl.1
+#	rm debian/tmp/usr/share/man/man3/crypto.3
+#	rm debian/tmp/usr/share/man/man3/ssl.3
+#	rm debian/tmp/usr/lib/libcrypto.a
+#	rm debian/tmp/usr/lib/libssl.a
+	# pic static libraries, nobody should need them
+#	mv debian/tmp/usr/lib/libcrypto.a debian/tmp/usr/lib/libcrypto_pic.a
+#	mv debian/tmp/usr/lib/libssl.a debian/tmp/usr/lib/libssl_pic.a
+	cp -pf libcrypto.static debian/tmp/usr/lib/libcrypto.a
+	cp -pf libssl.static debian/tmp/usr/lib/libssl.a
+#	mv debian/tmp/usr/lib/ssl/bin debian/tmp/usr/bin/ssl
+#	(cd debian/tmp/usr/lib/ssl; ln -s /usr/bin/ssl bin)
+#	mv debian/tmp/usr/lib/ssl/include debian/tmp/usr/include/ssl
+#	(cd debian/tmp/usr/lib/ssl; ln -s /usr/include/ssl include)
+#	chmod -x debian/tmp/usr/lib/*.so.*
+#	mv debian/tmp/usr/lib/*.a debian/libssl09-dev/usr/lib/
+#	mv debian/tmp/usr/lib/*.so debian/libssl09-dev/usr/lib/
+#	mv debian/tmp/usr/lib/*.so.*.*.* debian/libssl09/usr/lib/
+#	mv debian/tmp/usr/lib/*.la debian/libssl09-dev/usr/lib/
+#	mv debian/tmp/usr/include debian/libssl09-dev/usr/
+	mkdir -p debian/tmp/etc/ssl
+	mv debian/tmp/usr/lib/ssl/{certs,openssl.cnf,private} debian/tmp/etc/ssl/
+	ln -s /etc/ssl/{certs,openssl.cnf,private} debian/tmp/usr/lib/ssl/
+	cp -pf debian/tmp/usr/lib/libcrypto.so.* debian/libcrypto0.9.8-udeb/usr/lib/
+	cp -auv lib*.so* debian/tmp/usr/lib/
+#	cp -auv lib*.a debian/tmp/usr/lib/
+	for opt in $(OPTS); do set -xe; mkdir -p debian/tmp/usr/lib/$$opt; cp -auv $$opt/lib*.so* debian/tmp/usr/lib/$$opt/; done
+	install debian/copyright debian/libssl0.9.8/usr/share/doc/libssl0.9.8/
+	install debian/changelog debian/libssl0.9.8/usr/share/doc/libssl0.9.8/changelog.Debian
+	install debian/copyright debian/libssl-dev/usr/share/doc/libssl-dev/
+	install debian/changelog debian/libssl-dev/usr/share/doc/libssl-dev/changelog.Debian
+#	(cd debian/tmp/usr/doc/openssl/doc; for f in *.doc*; do mv "$$f" "$$(echo $$f | sed -e 's/doc/txt/')";done)
+#	(cd doc; for f in *; do install "$$f" ../debian/tmp/usr/share/doc/openssl/doc/"$$(echo $$f | sed -e 's/doc/txt/')";done)
+#	debstd -u CHANGES* LICENSE README NEWS
+
+	dh_installdocs CHANGES.SSLeay README NEWS debian/README.optimization
+	dh_installexamples
+	dh_installchangelogs CHANGES
+#	dh_installmenu
+#	dh_installcron
+	dh_installman -popenssl
+	dh_installdebconf
+#	dh_undocumented c_rehash.1
+	dh_movefiles
+#	rmdir debian/tmp/usr/lib/ssl/lib
+#	rmdir debian/tmp/usr/include/openssl
+#	rmdir debian/tmp/usr/include
+#	for opt in $(OPTS); do set -xe; rm -fr debian/tmp/usr/lib/$$opt; done
+	dh_compress
+	chmod 700 debian/openssl/etc/ssl/private
+	dh_fixperms -X etc/ssl/private
+	dh_strip --dbg-package=libssl0.9.8
+	dh_perl -d
+#	dh_suidregister
+	dh_makeshlibs -V "libssl0.9.8 (>= 0.9.8f-5)" --add-udeb="libcrypto0.9.8-udeb"
+	dh_shlibdeps -L libssl0.9.8 -l debian/libssl0.9.8/usr/lib
+	dh_gencontrol
+	dh_installdeb
+	dh_md5sums
+	dh_builddeb
+	echo -en "\a"
+
+# Below here is fairly generic really
+
+binary:		binary-indep binary-arch
+
+source diff:
+	@echo >&2 'source and diff are obsolete - use dpkg-source -b'; false
+
+.PHONY: binary binary-arch binary-indep clean
--- openssl-0.9.8g.orig/debian/libcrypto0.9.8-udeb.dirs
+++ openssl-0.9.8g/debian/libcrypto0.9.8-udeb.dirs
@@ -0,0 +1 @@
+usr/lib
--- openssl-0.9.8g.orig/debian/openssl.postinst
+++ openssl-0.9.8g/debian/openssl.postinst
@@ -0,0 +1,9 @@
+#!/bin/sh -e
+
+if [ ! -e /usr/lib/ssl ]
+then
+  echo Linking /usr/lib/ssl to /etc/ssl
+  ln -sf /etc/ssl /usr/lib/ssl
+fi
+
+#DEBHELPER#
--- openssl-0.9.8g.orig/debian/changelog
+++ openssl-0.9.8g/debian/changelog
@@ -0,0 +1,1306 @@
+openssl (0.9.8g-15+lenny13) lenny; urgency=low
+
+  * Non-maintainer upload by the Security Team.
+  * Fix CVE-2011-3210: SSL memory handling for (EC)DH ciphersuites
+
+ -- Raphael Geissert <geissert@debian.org>  Fri, 23 Sep 2011 23:49:25 -0500
+
+openssl (0.9.8g-15+lenny12) lenny-security; urgency=high
+
+  * Non-maintainer upload by the Security Team.
+  * debian/rules: prevent the build system from adding noise to the
+    package's .diff file.
+  * Block DigiNotar certificates
+  * Fix CVE-2011-1945: timing attacks against ECDHE_ECDSA makes it
+    easier to determine private keys.
+
+ -- Raphael Geissert <geissert@debian.org>  Mon, 12 Sep 2011 19:58:54 -0500
+
+openssl (0.9.8g-15+lenny11) stable-security; urgency=low
+
+  * Apply TLS version tolerance patch.  Upstream cvs commit 19073.
+  * Fix CVE-2010-4180 (Closes: #529221)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun, 05 Dec 2010 15:32:12 +0100
+
+openssl (0.9.8g-15+lenny10) stable-security; urgency=low
+
+  * Add rfc5746 support to fix TLS renegotiation flaw.  Patch based
+    on work done by Marc Deslauriers for Ubuntu backporting the changes.
+    Fixes CVE-2009-3555.  (Closes: #555829)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sat, 04 Dec 2010 15:50:35 +0100
+
+openssl (0.9.8g-15+lenny9) stable-security; urgency=low
+
+  * Fix TLS extension parsing race condition (CVE-2010-3864)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Mon, 15 Nov 2010 20:57:21 +0100
+
+openssl (0.9.8g-15+lenny8) stable-security; urgency=low
+
+  * Fix CVE-2010-2939: Double free using ECDH. (Closes: #594415)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Thu, 26 Aug 2010 19:49:39 +0200
+
+openssl (0.9.8g-15+lenny7) stable-security; urgency=low
+
+  * Check return type of bn_wexpand().  Fixes CVE-2009-3245 
+    (Closes: #575433)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Mon, 07 Jun 2010 20:30:01 +0200
+
+openssl (0.9.8g-15+lenny6) stable-security; urgency=low
+
+  * Clean up zlib state so that it will be reinitialized on next use and
+    not cause a memory leak.  (CVE-2009-4355)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun, 10 Jan 2010 21:10:15 +0100
+
+openssl (0.9.8g-15+lenny5) stable-security; urgency=low
+
+  * Don't check self signed certificate signatures in X509_verify_cert()
+    (Closes: #541735)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Fri, 11 Sep 2009 17:00:05 +0200
+
+openssl (0.9.8g-15+lenny4) stable-security; urgency=low
+
+  * Remove MD2 from digest algorithm table.  (CVE-2009-2409) (Closes: #539899)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Tue, 11 Aug 2009 22:48:02 +0200
+
+openssl (0.9.8g-15+lenny3) stable-security; urgency=low
+
+  * Fix DoS via a DTLS ChangeCipherSpec packet that occurs before ClientHello
+    (CVE-2009-1386)
+  * Fix DoS via an out-of-sequence DTLS handshake message (CVE-2009-1387)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Mon, 08 Jun 2009 19:40:22 +0200
+
+openssl (0.9.8g-15+lenny2) stable-security; urgency=low
+
+  * Fix "DTLS record buffer limitation bug." (CVE-2009-1377)
+  * Fix "DTLS fragment handling" (CVE-2009-1378)
+  * Fix "DTLS use after free" (CVE-2009-1379)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Mon, 01 Jun 2009 14:56:56 +0200
+
+openssl (0.9.8g-15+lenny1) stable-security; urgency=low
+
+  * Properly validate the length of an encoded BMPString and UniversalString
+    (CVE-2009-0590)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Wed, 01 Apr 2009 22:04:53 +0200
+
+openssl (0.9.8g-15) unstable; urgency=low
+
+  * Internal calls to didn't properly check for errors which
+    resulted in malformed DSA and ECDSA signatures being treated as
+    a good signature rather than as an error.  (CVE-2008-5077)
+  * ipv6_from_asc() could write 1 byte longer than the buffer in case
+    the ipv6 address didn't have "::" part.  (Closes: #506111)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Mon, 05 Jan 2009 21:14:31 +0100
+
+openssl (0.9.8g-14) unstable; urgency=low
+
+  * Don't give the warning about security updates when upgrading
+    from etch since it doesn't have any known security problems.
+  * Automaticly use engines that succesfully initialised.  Patch
+    from the 0.9.8h upstream version.  (Closes: #502177)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Fri, 31 Oct 2008 22:45:14 +0100
+
+openssl (0.9.8g-13) unstable; urgency=low
+
+  * Fix a problem with tlsext preventing firefox 3 from connection.
+    Patch from upstream CVS and part of 0.9.8h.
+    (Closes: #492758)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun, 03 Aug 2008 19:47:10 +0200
+
+openssl (0.9.8g-12) unstable; urgency=low
+
+  * add the changelog of the 10.1 NMU to make bugtracking happy
+
+ -- Christoph Martin <Christoph.Martin@Uni-Mainz.DE>  Tue, 22 Jul 2008 14:58:26 +0200
+
+openssl (0.9.8g-11) unstable; urgency=low
+
+  [ Christoph Martin ]
+  * updated cs, gl, sv, ru, ro debconf translation (closes: #480926, #480967,
+    #482465, #484324, #488595)
+  * add Vcs-Svn header (closes: #481654)
+  * fix debian-kfreebsd-i386 build flags (closes: #482275)
+  * add stunnel4 to restart list (closes: #482111)
+  * include fixes from 10.1 NMU by Security team
+    - Fix double free in TLS server name extension which leads to a remote
+      denial of service (CVE-2008-0891; Closes: #483379).
+    - Fix denial of service if the 'Server Key exchange message'
+      is omitted from a TLS handshake which could lead to a client
+      crash (CVE-2008-1672; Closes: #483379).
+      This only works if openssl is compiled with enable-tlsext which is
+      done in Debian.
+  * fix some lintian warnings
+  * update to newest standards version
+
+ -- Christoph Martin <Christoph.Martin@Uni-Mainz.DE>  Thu, 17 Jul 2008 09:53:01 +0200
+
+openssl (0.9.8g-10.1) unstable; urgency=high
+ 
+  * Non-maintainer upload by the Security team.
+  * Fix denial of service if the 'Server Key exchange message'
+    is omitted from a TLS handshake which could lead to a client
+    crash (CVE-2008-1672; Closes: #483379).
+    This only works if openssl is compiled with enable-tlsext which is
+    done in Debian.
+  * Fix double free in TLS server name extension which leads to a remote
+    denial of service (CVE-2008-0891; Closes: #483379).
+ 
+ -- Nico Golde <nion@debian.org>  Tue, 27 May 2008 11:13:44 +0200
+
+openssl (0.9.8g-10) unstable; urgency=low
+
+  * undefine HZ so that the code falls back to sysconf(_SC_CLK_TCK)
+    to fix a build failure on alpha.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Thu, 08 May 2008 17:56:13 +0000
+
+openssl (0.9.8g-9) unstable; urgency=high
+
+  [ Christoph Martin ]
+  * Include updated debconf translations (closes: #473477, #461597,
+    #461880, #462011, #465517, #475439)
+
+  [ Kurt Roeckx ]
+  * ssleay_rand_add() really needs to call MD_Update() for buf.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Wed, 07 May 2008 20:32:12 +0200
+
+openssl (0.9.8g-8) unstable; urgency=high
+
+  * Don't add extentions to ssl v3 connections.  It breaks with some
+    other software.  (Closes: #471681)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun, 23 Mar 2008 17:50:04 +0000
+
+openssl (0.9.8g-7) unstable; urgency=low
+
+  * Upload to unstable.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Wed, 13 Feb 2008 22:22:29 +0000
+
+openssl (0.9.8g-6) experimental; urgency=low
+
+  * Bump shlibs.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sat, 09 Feb 2008 15:42:22 +0100
+
+openssl (0.9.8g-5) experimental; urgency=low
+
+  * Enable tlsext.  This changes the ABI, but should hopefully
+    not cause any problems. (Closes: #462596)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sat, 09 Feb 2008 13:32:49 +0100
+
+openssl (0.9.8g-4) unstable; urgency=low
+
+  * Fix aes ige test speed not to overwrite it's buffer and
+    cause segfauls.  Thanks to Tim Hudson (Closes: #459619)
+  * Mark some strings in the templates as non translatable.
+    Patch from Christian Perrier <bubulle@debian.org> (Closes: #450418)
+  * Update Dutch debconf translation (Closes: #451290)
+  * Update French debconf translation (Closes: #451375)
+  * Update Catalan debconf translation (Closes: #452694)
+  * Update Basque debconf translation (Closes: #457285)
+  * Update Finnish debconf translation (Closes: #458261)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Wed, 16 Jan 2008 21:49:43 +0100
+
+openssl (0.9.8g-3) unstable; urgency=low
+
+  * aes-586.pl: push %ebx on the stack before we put some things on the
+    stack and call a function, giving AES_decrypt() wrong values to work
+    with.  (Closes: #449200)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun, 04 Nov 2007 21:49:00 +0100
+
+openssl (0.9.8g-2) unstable; urgency=low
+
+  * Avoid text relocations on i386 caused by the assembler versions:
+    - x86unix.pl: Create a function_begin_B_static to create a
+      static/local assembler function.
+    - aes-586.pl: Use the function_begin_B_static for _x86_AES_decrypt
+      so that it doesn't get exported and doesn't have any (text) relocations.
+    - aes-586.pl: Set up ebx to point to the GOT and call AES_set_encrypt_key
+      via the PLT to avoid a relocation.
+    - x86unix.pl: Call the init function via the PLT, avoiding a relocation
+      in case of a PIC object.
+    - cbc.pl: Call functions via the PLT.
+    - desboth.pl: Call DES_encrypt2 via the PLT.
+  * CA.sh should use the v3_ca extention when called with -newca
+    (Closes: #428051)
+  * Use -Wa,--noexecstack for all arches in Debian.  (Closes: #430583)
+  * Convert the failure message when services fail restart to a debconf
+    message.
+  * To restart a service, just restart, instead of stop and start.
+    Hopefully fixes #444946
+  * Also remove igetest from the test dir in the clean target.
+    (Closes: #424362)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sat, 03 Nov 2007 13:25:45 +0100
+
+openssl (0.9.8g-1) unstable; urgency=low
+
+  * New upstream release
+    - Fixes version number not to say it's a development version.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sat, 20 Oct 2007 12:47:10 +0200
+
+openssl (0.9.8f-1) unstable; urgency=low
+
+  * New upstream release
+    - Fixes DTLS issues, also fixes CVE-2007-4995 (Closes: #335703, #439737)
+    - Proper inclusion of opensslconf.h in pq_compat.h (Closes: #408686)
+    - New function SSL_set_SSL_CTX: bump shlibs.
+  * Remove build dependency on gcc > 4.2
+  * Remove the openssl preinst, it looks like a workaround
+    for a change in 0.9.2b where config files got moved.  (Closes: #445095)
+  * Update debconf translations:
+    - Vietnamese (Closes: #426988)
+    - Danish (Closes: #426774)
+    - Slovak (Closes: #440723)
+    - Finnish (Closes: #444258)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sat, 13 Oct 2007 00:47:22 +0200
+
+openssl (0.9.8e-9) unstable; urgency=high
+
+  * CVE-2007-5135: Fix off by one error in SSL_get_shared_ciphers().
+    (Closes: #444435)
+  * Add postgresql-8.2 to the list of services to check.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Fri, 28 Sep 2007 19:47:33 +0200
+
+openssl (0.9.8e-8) unstable; urgency=low
+
+  * Fix another case of the "if this code is reached, the program will abort"
+    (Closes: #429740)
+  * Temporary force to build with gcc >= 4.2
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun, 02 Sep 2007 18:12:11 +0200
+
+openssl (0.9.8e-7) unstable; urgency=low
+
+  * Fix problems with gcc-4.2 (Closes: #429740)
+  * Stop using -Bsymbolic to create the shared library.
+  * Make x86_64cpuid.pl use PIC.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun, 02 Sep 2007 16:15:18 +0200
+
+openssl (0.9.8e-6) unstable; urgency=high
+
+  * Add fix for CVE-2007-3108 (Closes: #438142)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Wed, 15 Aug 2007 19:49:54 +0200
+
+openssl (0.9.8e-5) unstable; urgency=low
+
+  [ Christian Perrier ]
+  * Debconf templates proofread and slightly rewritten by
+    the debian-l10n-english team as part of the Smith Review Project.
+    Closes: #418584
+  * Debconf templates translations:
+    - Arabic. Closes: #418669
+    - Russian. Closes: #418670
+    - Galician. Closes: #418671
+    - Swedish. Closes: #418679
+    - Korean. Closes: #418755
+    - Czech. Closes: #418768
+    - Basque. Closes: #418784
+    - German. Closes: #418785
+    - Traditional Chinese. Closes: #419915
+    - Brazilian Portuguese. Closes: #419959
+    - French. Closes: #420429
+    - Italian. Closes: #420461
+    - Japanese. Closes: #420482
+    - Catalan. Closes: #420833
+    - Dutch. Closes: #420925
+    - Malayalam. Closes: #420986
+    - Portuguese. Closes: #421032
+    - Romanian. Closes: #421708
+
+  [ Kurt Roeckx ]
+  * Remove the Provides for the udeb. Patch from Frans Pop. (Closes: #419608)
+  * Updated Spanish debconf template.  (Closes: #421336)
+  * Do the header changes, changing those defines into real functions,
+    and bump the shlibs to match.
+  * Update Japanese debconf translation.  (Closes: #422270)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Tue, 15 May 2007 17:21:08 +0000
+
+openssl (0.9.8e-4) unstable; urgency=low
+
+  * openssl should depend on libssl0.9.8 0.9.8e-1 since it 
+    uses some of the defines that changed to functions.
+    Other things build against libssl or libcrypto shouldn't 
+    have this problem since they use the old headers.
+    (Closes: #414283)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sat, 10 Mar 2007 17:11:46 +0000
+
+openssl (0.9.8e-3) unstable; urgency=low
+
+  * Add nagios-nrpe-server to the list of services to be checked
+    (Closes: #391188)
+  * EVP_CIPHER_CTX_key_length() should return the set key length in the
+    EVP_CIPHER_CTX structure which may not be the same as the underlying
+    cipher key length for variable length ciphers.
+    From upstream CVS.  (Closes: #412979)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun,  4 Mar 2007 23:22:51 +0000
+
+openssl (0.9.8e-2) unstable; urgency=low
+
+  * Undo include changes that change defines into real functions,
+    but keep the new functions in the library.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun, 25 Feb 2007 19:19:19 +0000
+
+openssl (0.9.8e-1) unstable; urgency=low
+
+  * New upstream release
+    - Inludes security fixes for CVE-2006-2937, CVE-2006-2940,
+      CVE-2006-3738, CVE-2006-4343 (Closes: #408902)
+    - s_client now properly works with SMTP.  Also added support
+      for IMAP.  (closes: #221689)
+    - Load padlock modules (Closes: #345656, #368476)
+  * Add clamav-freshclam and clamav-daemon to the list of service that
+    need to be restarted.  (Closes: #391191)
+  * Add armel support.  Thanks to Guillem Jover <guillem.jover@nokia.com>
+    for the patch.  (Closes: #407196)
+  * Add Portuguese translations.  Thanks to Carlos Lisboa.  (Closes: 408157)
+  * Add Norwegian translations.  Thanks to Bjørn Steensrud
+    <bjornst@powertech.no> (Closes: #412326)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun, 25 Feb 2007 18:06:28 +0000
+
+openssl (0.9.8c-4) unstable; urgency=low
+
+  * Add German debconf translation.  Thanks to
+    Johannes Starosta <feedback-an-johannes@arcor.de> (Closes: #388108)
+  * Make c_rehash look for both .pem and .crt files.  Also make it support
+    files in DER format.  Patch by "Yauheni Kaliuta" <y.kaliuta@gmail.com>
+    (Closes: #387089)
+  * Use & instead of && to check a flag in the X509 policy checking.
+    Patch from upstream cvs.  (Closes: #397151)
+  * Also restart slapd for security updates (Closes: #400221)
+  * Add Romanian debconf translation.  Thanks to
+    stan ioan-eugen <stan.ieugen@gmail.com> (Closes: #393507)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Thu, 30 Nov 2006 20:57:46 +0000
+
+openssl (0.9.8c-3) unstable; urgency=low
+
+  * Fix patch for CVE-2006-2940, it left ctx unintiliased.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Mon,  2 Oct 2006 18:05:00 +0200
+
+openssl (0.9.8c-2) unstable; urgency=high
+
+  * Fix security vulnerabilities (CVE-2006-2937, CVE-2006-2940,
+    CVE-2006-3738, CVE-2006-4343).  Urgency set to high.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Wed, 27 Sep 2006 21:24:55 +0000
+
+openssl (0.9.8c-1) unstable; urgency=low
+
+  * New upstream release
+    - block padding bug with compression now fixed upstream, using
+      their patch.
+    - Includes the RSA Signature Forgery (CVE-2006-4339) patch.
+    - New functions AES_bi_ige_encrypt and AES_ige_encrypt:
+      bumping shlibs to require 0.9.8c-1.
+  * Change the postinst script to check that ntp is installed instead
+    of ntp-refclock and ntp-simple.  The binary is now in the ntp
+    package.
+  * Move the modified rand/md_rand.c file to the right place,
+    really fixing #363516.
+  * Add partimage-server conserver-server and tor to the list of service
+    to check for restart.  Add workaround for openssh-server so it finds
+    the init script.  (Closes: #386365, #386400, #386513)
+  * Add manpage for c_rehash.
+    Thanks to James Westby <jw+debian@jameswestby.net> (Closes: #215618)
+  * Add Lithuanian debconf translation.
+    Thanks to Gintautas Miliauskas <gintas@akl.lt>  (Closes: #374364)
+  * Add m32r support.
+    Thanks to Kazuhiro Inaoka <inaoka.kazuhiro@renesas.com>
+    (Closes: #378689)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sun, 17 Sep 2006 14:47:59 +0000
+
+openssl (0.9.8b-3) unstable; urgency=high
+
+  * Fix RSA Signature Forgery (CVE-2006-4339) using patch provided
+    by upstream.
+  * Restart services using a smaller version that 0.9.8b-3, so
+    they get the fixed version.
+  * Change the postinst to check for postfix instead of postfix-tls.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Tue,  5 Sep 2006 18:26:10 +0000
+
+openssl (0.9.8b-2) unstable; urgency=low
+
+  * Don't call gcc with -mcpu on i386, we already use -march, so no need for
+    -mtune either.
+  * Always make all directories when building something:
+    - The engines directory didn't get build for the static directory, so
+      where missing in libcrypo.a
+    - The apps directory didn't always get build, so we didn't have an openssl
+      and a small part of the regression tests failed.
+  * Make the package fail to build if the regression tests fail.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Mon, 15 May 2006 16:00:58 +0000
+
+openssl (0.9.8b-1) unstable; urgency=low
+
+  * New upstream release
+    - New functions added (EVP_CIPHER_CTX_new, EVP_CIPHER_CTX_free), bump shlibs.
+    - CA.pl/CA.sh now calls openssl ca with -extensions v3_ca, setting CA:TRUE
+      instead of FALSE.
+    - CA.pl/CA.sh creates crlnumber now.  (Closes: #347612)
+  * Run debconf-updatepo, which really already was in the 0.9.8a-8 version
+    as it was uploaded.
+  * Add Galician debconf translation.  Patch from
+    Jacobo Tarrio <jtarrio@trasno.net>  (Closes: #361266)
+  * libssl0.9.8.postinst makes uses of bashisms (local variables)
+    so use #!/bin/bash
+  * libssl0.9.8.postinst: Call set -e after sourcing the debconf
+    script.
+  * libssl0.9.8.postinst: Change list of service that may need
+    to be restarted:
+    - Replace ssh by openssh-server
+    - Split postgresql in postgresql-7.4 postgresql-8.0 postgresql-8.1
+    - Add: dovecot-common bind9 ntp-refclock ntp-simple openntpd clamcour
+      fetchmail ftpd-ssl proftpd proftpd-ldap proftpd-mysql proftpd-pgsql
+  * libssl0.9.8.postinst: The check to see if something was installed
+    wasn't working.
+  * libssl0.9.8.postinst: Add workaround to find the name of the init 
+    script for proftpd and dovecot.
+  * libssl0.9.8.postinst: Use invoke-rc.d when it's available.
+  * Change Standards-Version to 3.7.0:
+    - Make use of invoke-rc.d
+  * Add comment to README.Debian that rc5, mdc2 and idea have been
+    disabled (since 0.9.6b-3)  (Closes: #362754)
+  * Don't add uninitialised data to the random number generator.  This stop
+    valgrind from giving error messages in unrelated code.
+    (Closes: #363516)
+  * Put the FAQ in the openssl docs.
+  * Add russian debconf translations from Yuriy Talakan <yt@amur.elektra.ru>
+    (Closes #367216)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Thu,  4 May 2006 20:40:03 +0200
+
+openssl (0.9.8a-8) unstable; urgency=low
+
+  * Call pod2man with the proper section.  Section changed
+    from 1/3/5/7 to 1SSL/3SSL/5SSL/7SSL.  The name of the files
+    already had the ssl in, the section didn't.  The references
+    to other manpage is still wrong.
+  * Don't install the LICENSE file, it's already in the copyright file.
+  * Don't set an rpath on openssl to point to /usr/lib.
+  * Add support for kfreebsd-amd64. (Closes: #355277)
+  * Add udeb to the shlibs.  Patch from Frans Pop <aragorn@tiscali.nl>
+    (Closes: #356908)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sat, 11 Feb 2006 14:14:37 +0100
+
+openssl (0.9.8a-7) unstable; urgency=high
+
+  * Add italian debconf templates.  Thanks to Luca Monducci.
+    (Closes: #350249)
+  * Change the debconf question to use version 0.9.8-3
+    instead of 0.9.8-1, since that's the last version
+    with a security fix.
+  * Call conn_state() if the BIO is not in the BIO_CONN_S_OK state
+    (Closes: #352047).  RC bug affecting testing, so urgency high.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Sat,  9 Feb 2006 19:07:56 +0100
+
+openssl (0.9.8a-6) unstable; urgency=low
+
+  * Remove empty postinst/preinst/prerm scripts.  There is no need
+    to have empty ones, debhelper will add them when needed.
+  * Remove the static pic libraries.  Nobody should be linking
+    it's shared libraries static to libssl or libcrypto.
+    This was added for opensc who now links to it shared.
+  * Do not assume that in case the sequence number is 0 and the
+    packet has an odd number of bytes that the other side has
+    the block padding bug, but try to check that it actually
+    has the bug.  The wrong detection of this bug resulted
+    in an "decryption failed or bad record mac" error in case
+    both sides were using zlib compression.  (Closes: #338006)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Mon, 21 Jan 2006 16:25:41 +0100
+
+openssl (0.9.8a-5) unstable; urgency=low
+
+  * Stop ssh from crashing randomly on sparc (Closes: #335912)
+    Patch from upstream cvs.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Tue, 13 Dec 2005 21:37:42 +0100
+
+openssl (0.9.8a-4) unstable; urgency=low
+
+  * Call dh_makeshlibs with the proper version instead of putting
+    it in shlibs.local, which doesn't seem to do anything.  0.9.8a-1
+    added symbol versioning, so it should have bumped the shlibs.
+    (Closes: #338284)
+  * The openssl package had a duplicate dependency on libssl0.9.8,
+    only require the version as required by the shlibs.
+  * Make libssl-dev depend on zlib1g-dev, since it's now required for
+    static linking. (Closes: #338313)
+  * Generate .pc files that make use of Libs.private, so things only
+    link to the libraries they should when linking shared.
+  * Use -m64 instead of -bpowerpc64-linux on ppc64. (Closes: #335486)
+  * Make powerpc and ppc64 use the assembler version for bn.  ppc64
+    had the location in the string wrong, powerpc had it missing.
+  * Add includes for stddef to get size_t in md2.h, md4.h, md5.h,
+    ripemd.h and sha.h.  (Closes: #333101)
+  * Run make test for each of the versions we build, make it 
+    not fail the build process if an error is found.
+  * Add build dependency on bc for the regression tests.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Wed, 13 Nov 2005 16:01:05 +0100
+
+openssl (0.9.8a-3) unstable; urgency=high
+
+  * Link to libz instead of dynamicly loading it.  It gets loaded
+    at the moment the library is initialised, so there is no point
+    in not linking to it.  It's now failing in some cases since
+    it's not opened by it's soname, but by the symlink to it.
+    This should hopefully solve most of the bugs people have reported
+    since the move to libssl0.9.8.
+    (Closes: #334180, #336140, #335271)
+  * Urgency set to high because it fixes a grave bug affecting testing.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Tue,  1 Nov 2005 14:56:40 +0100
+
+openssl (0.9.8a-2) unstable; urgency=low
+
+  * Add Build-Dependency on m4, since sparc needs it to generate
+    it's assembler files.  (Closes: #334542)
+  * Don't use rc4-x86_64.o on amd64 for now, it seems to be broken
+    and causes a segfault.  (Closes: #334501, #334502)
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Tue, 18 Oct 2005 19:05:53 +0200
+
+openssl (0.9.8a-1) unstable; urgency=low
+
+  Christoph Martin:
+  * fix asm entries for some architectures, fixing #332758 properly.
+  * add noexecstack option to i386 subarch
+  * include symbol versioning in Configure (closes: #330867)
+  * include debian-armeb arch (closes: #333579)
+  * include new upstream patches; includes some minor fixes
+  * fix dh_shlibdeps line, removing the redundant dependency on
+    libssl0.9.8 (closes: #332755)
+  * add swedish debconf template (closes: #330554)
+
+  Kurt Roeckx:
+  * Also add noexecstack option for amd64, since it now has an 
+    executable stack with the assembler fixes for amd64.
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon, 17 Oct 2005 17:01:06 +0200
+
+openssl (0.9.8-3) unstable; urgency=low
+
+  * Apply security fix for CAN-2005-2969. (Closes: #333500)
+  * Change priority of -dbg package to extra.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Wed, 12 Oct 2005 22:38:58 +0200
+
+openssl (0.9.8-2) unstable; urgency=low
+
+  * Don't use arch specific assembler.  Should fix build failure on
+    ia64, sparc and amd64. (Closes: #332758)
+  * Add myself to the uploaders.
+
+ -- Kurt Roeckx <kurt@roeckx.be>  Mon, 10 Oct 2005 19:22:36 +0200
+
+openssl (0.9.8-1) unstable; urgency=low
+
+  * New upstream release (closes: #311826)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu, 29 Sep 2005 14:20:04 +0200
+
+openssl (0.9.7g-3) unstable; urgency=low
+
+  * change Configure line for debian-freebsd-i386 to debian-kfreebsd-i386
+    (closes: #327692)
+  * include -dbg version. That implies compiling with -g and without
+    -fomit-frame-pointer (closes: #293823, #153811)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Fri, 23 Sep 2005 13:51:57 +0200
+
+openssl (0.9.7g-2) unstable; urgency=low
+
+  * really include nl translation
+  * remove special ia64 code from rc4 code to make the abi compatible to
+    older 0.9.7 versions (closes: #310489, #309274)
+  * fix compile flag for debian-ppc64 (closes: #318750)
+  * small fix in libssl0.9.7.postinst (closes: #239956)
+  * fix pk7_mime.c to prevent garbled messages because of to early memory
+    free (closes: #310184)
+  * include vietnamese debconf translation (closes: #316689)
+  * make optimized i386 libraries have non executable stack (closes:
+    #321721)
+  * remove leftover files from ssleay
+  * move from dh_installmanpages to dh_installman
+  * change Maintainer to pkg-openssl-devel@lists.alioth.debian.org
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed,  7 Sep 2005 15:32:54 +0200
+
+openssl (0.9.7g-1) unstable; urgency=low
+
+  * New upstream release
+    * Added support for proxy certificates according to RFC 3820.
+      Because they may be a security thread to unaware applications,
+      they must be explicitely allowed in run-time.  See
+      docs/HOWTO/proxy_certificates.txt for further information.
+    * Prompt for pass phrases when appropriate for PKCS12 input format.
+    * Back-port of selected performance improvements from development
+      branch, as well as improved support for PowerPC platforms.
+    * Add lots of checks for memory allocation failure, error codes to indicate
+      failure and freeing up memory if a failure occurs.
+    * Perform some character comparisons of different types in X509_NAME_cmp:
+      this is needed for some certificates that reencode DNs into UTF8Strings
+      (in violation of RFC3280) and can't or wont issue name rollover
+      certificates.
+  * corrected watchfile
+  * added upstream source url (closes: #292904)
+  * fix typo in CA.pl.1 (closes: #290271)
+  * change debian-powerpc64 to debian-ppc64 and adapt the configure
+    options to be the same like upstream (closes: #289841)
+  * include -signcert option in CA.pl usage
+  * compile with zlib-dynamic to use system zlib (closes: #289872)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon,  9 May 2005 23:32:03 +0200
+
+openssl (0.9.7e-3) unstable; urgency=high
+
+  * really fix der_chop. The fix from -1 was not really included (closes:
+    #281212) 
+  * still fixes security problem CAN-2004-0975 etc.
+    - tempfile raise condition in der_chop
+    - Avoid a race condition when CRLs are checked in a multi threaded 
+      environment.
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu, 16 Dec 2004 18:41:29 +0100
+
+openssl (0.9.7e-2) unstable; urgency=high
+
+  * fix perl path in der_chop and c_rehash (closes: #281212)
+  * still fixes security problem CAN-2004-0975 etc.
+    - tempfile raise condition in der_chop
+    - Avoid a race condition when CRLs are checked in a multi threaded 
+      environment.
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sun, 14 Nov 2004 20:16:21 +0100
+
+openssl (0.9.7e-1) unstable; urgency=high
+
+  * SECURITY UPDATE: fix insecure temporary file handling
+  * apps/der_chop: 
+    - replaced $$-style creation of temporary files with
+      File::Temp::tempfile()
+    - removed unused temporary file name in do_certificate()
+  * References:
+    CAN-2004-0975 (closes: #278260)
+  * fix ASN1_STRING_to_UTF8 with UTF8 (closes: #260357)
+  * New upstream release with security fixes
+    - Avoid a race condition when CRLs are checked in a multi threaded 
+      environment.
+    - Various fixes to s3_pkt.c so alerts are sent properly.
+    - Reduce the chances of duplicate issuer name and serial numbers (in
+      violation of RFC3280) using the OpenSSL certificate creation
+      utilities. 
+  * depends openssl on perl-base instead of perl (closes: #280225)
+  * support powerpc64 in Configure (closes: #275224)
+  * include cs translation (closes: #273517)
+  * include nl translation (closes: #272479)
+  * Fix default dir of c_rehash (closes: #253126)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Fri, 12 Nov 2004 14:11:15 +0100
+
+openssl (0.9.7d-5) unstable; urgency=low
+
+  * Make S/MIME encrypt work again (backport from CVS) (closes: #241407,
+    #241386)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon, 26 Jul 2004 17:22:42 +0200
+
+openssl (0.9.7d-4) unstable; urgency=low
+
+  * add Catalan translation (closes: #248749)
+  * add Spanish translation (closes: #254561)
+  * include NMU fixes: see below
+  * decrease optimisation level for debian-arm to work around gcc bug
+    (closes: #253848) (thanks to Steve Langasek and Thom May)
+  * Add libcrypto0.9.7-udeb. (closes: #250010) (thanks to Bastian Blank)
+  * Add watchfile
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed, 14 Jul 2004 14:31:02 +0200
+
+openssl (0.9.7d-3) unstable; urgency=low
+
+  * rename -pic.a libraries to _pic.a (closes: #250016)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon, 24 May 2004 17:02:29 +0200
+
+openssl (0.9.7d-2) unstable; urgency=low
+
+  * include PIC libs (libcrypto-pic.a and libssl-pic.a) to libssl-dev
+    (closes: #246928, #243999)
+  * add racoon to restart list (closes: #242652)
+  * add Brazilian, Japanese and Danish translations (closes: #242087,
+    #241830, #241705)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Tue, 11 May 2004 10:13:49 +0200
+
+openssl (0.9.7d-1) unstable; urgency=high
+
+  * new upstream
+  * fixes security holes (http://www.openssl.org/news/secadv_20040317.txt)
+    (closes: #238661)
+  * includes support for debian-amd64 (closes: #235551, #232310)
+  * fix typo in pem.pod (closes: #219873)
+  * fix typo in libssl0.9.7.templates (closes: #224690)
+  * openssl suggests ca-certificates (closes: #217180)
+  * change debconf template to gettext format (closes: #219013)
+  * include french debconf template (closes: #219014)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu, 18 Mar 2004 16:18:43 +0100
+
+openssl (0.9.7c-5) unstable; urgency=low
+
+  * include openssl.pc into libssl-dev (closes: #212545)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu, 16 Oct 2003 16:31:32 +0200
+
+openssl (0.9.7c-4) unstable; urgency=low
+
+  * change question to restart services to debconf (closes: #214840)
+  * stop using dh_undocumented (closes: #214831)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Fri, 10 Oct 2003 15:40:48 +0200
+
+openssl (0.9.7c-3) unstable; urgency=low
+
+  * fix POSIX conformance for head in libssl0.9.7.postinst (closes:
+    #214700) 
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed,  8 Oct 2003 14:02:38 +0200
+
+openssl (0.9.7c-2) unstable; urgency=low
+
+  * add filerc macro to libssl0.9.7.postinst (closes: #213906)
+  * restart spamassassins spamd on upgrade (closes: #214106)
+  * restart more services on upgrade
+  * fix EVP_BytesToKey manpage (closes: #213715)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Tue,  7 Oct 2003 15:01:32 +0200
+
+openssl (0.9.7c-1) unstable; urgency=high
+
+  * upstream security fix (closes: #213451)
+   - Fix various bugs revealed by running the NISCC test suite:
+     Stop out of bounds reads in the ASN1 code when presented with
+     invalid tags (CAN-2003-0543 and CAN-2003-0544).
+     Free up ASN1_TYPE correctly if ANY type is invalid (CAN-2003-0545).
+     If verify callback ignores invalid public key errors don't try to check
+     certificate signature with the NULL public key.
+   - In ssl3_accept() (ssl/s3_srvr.c) only accept a client certificate
+     if the server requested one: as stated in TLS 1.0 and SSL 3.0
+     specifications.
+  * more minor upstream bugfixes
+  * fix formatting in c_issuer (closes: #190026)
+  * fix Debian-FreeBSD support (closes: #200381)
+  * restart some services in postinst to make them use the new libraries
+  * remove duplicated openssl.1, crypto.3 and ssl.3 (closes: #198594)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed,  1 Oct 2003 08:54:27 +0200
+
+openssl (0.9.7b-2) unstable; urgency=high
+
+  * fix permission of /etc/ssl/private to 700 again
+  * change section of libssl-dev to libdevel
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed, 23 Apr 2003 11:13:24 +0200
+
+openssl (0.9.7b-1) unstable; urgency=high
+
+  * upstream security fix
+   - Countermeasure against the Klima-Pokorny-Rosa extension of
+     Bleichbacher's attack on PKCS #1 v1.5 padding: treat
+     a protocol version number mismatch like a decryption error
+     in ssl3_get_client_key_exchange (ssl/s3_srvr.c). (CAN-2003-0131)
+    (closes: #189087)
+   - Turn on RSA blinding by default in the default implementation
+     to avoid a timing attack. Applications that don't want it can call
+     RSA_blinding_off() or use the new flag RSA_FLAG_NO_BLINDING.
+     They would be ill-advised to do so in most cases. (CAN-2003-0147)
+   - Change RSA blinding code so that it works when the PRNG is not
+     seeded (in this case, the secret RSA exponent is abused as
+     an unpredictable seed -- if it is not unpredictable, there
+     is no point in blinding anyway).  Make RSA blinding thread-safe
+     by remembering the creator's thread ID in rsa->blinding and
+     having all other threads use local one-time blinding factors
+     (this requires more computation than sharing rsa->blinding, but
+     avoids excessive locking; and if an RSA object is not shared
+     between threads, blinding will still be very fast).
+    for more details see the CHANGES file
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed, 16 Apr 2003 10:32:57 +0200
+
+openssl (0.9.7a-1) unstable; urgency=high
+
+  * upstream Security fix
+    - In ssl3_get_record (ssl/s3_pkt.c), minimize information leaked
+      via timing by performing a MAC computation even if incorrrect
+      block cipher padding has been found.  This is a countermeasure
+      against active attacks where the attacker has to distinguish
+      between bad padding and a MAC verification error. (CAN-2003-0078)
+    for more details see the CHANGES file
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Fri, 21 Feb 2003 22:39:40 +0100
+
+openssl (0.9.7-4) unstable; urgency=low
+
+  * use DH_COMPAT=3 to build
+  * move i686 to i686/cmov to fix problems on Via C3. For that to work we
+    have to depend on the newest libc6 on i386 (closes: #177891)
+  * fix bug in ui_util.c (closes: #177615)
+  * fix typo in md5.h (closes: #178112)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Fri, 24 Jan 2003 10:22:56 +0100
+
+openssl (0.9.7-3) unstable; urgency=low
+
+  * enable build of ultrasparc code on non ultrasparc machines (closes:
+    #177024) 
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Fri, 17 Jan 2003 08:22:13 +0100
+
+openssl (0.9.7-2) unstable; urgency=low
+
+  * include changes between 0.9.6g-9 and -10 
+    * fix problem in build-process on i386 with libc6 version number
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon, 13 Jan 2003 14:26:56 +0100
+
+openssl (0.9.7-1) unstable; urgency=low
+
+  * new upstream
+    * includes engine support
+    * a lot of bugfixes and enhancements, see the CHANGES file
+    * include AES encryption
+    * makes preview of certificate configurable (closes: #176059)
+    * fix x509 manpage (closes: #168070)
+    * fix declaration of ERR_load_PEM_string in pem.h (closes: #141360)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sat, 11 Jan 2003 09:12:16 +0100
+
+openssl (0.9.6g-10) unstable; urgency=low
+
+  * fix problem in build-process on i386 with libc6 version number
+    (closes: #167096)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon,  4 Nov 2002 12:27:21 +0100
+
+openssl (0.9.6g-9) unstable; urgency=low
+
+  * fix typo in i386 libc6 depend (sigh) (closes: #163848)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Tue,  8 Oct 2002 23:29:20 +0200
+
+openssl (0.9.6g-8) unstable; urgency=low
+
+  * fix libc6 depends. Only needed for i386 (closes: #163701)
+  * remove SHLIB section for bsds from Configure (closes: #163585)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Tue,  8 Oct 2002 10:57:35 +0200
+
+openssl (0.9.6g-7) unstable; urgency=low
+
+  * enable i686 optimisation and depend on fixed glibc (closes: #163500)
+  * remove transition package ssleay
+  * include optimisation vor sparcv8 (closes: #139996)
+  * improve optimisation vor sparcv9
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sun,  6 Oct 2002 14:07:12 +0200
+
+openssl (0.9.6g-6) unstable; urgency=low
+
+  * temporarily disable i686 optimisation (See bug in glibc #161788)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sat, 21 Sep 2002 18:56:49 +0200
+
+openssl (0.9.6g-5) unstable; urgency=low
+
+  * i486 can use i586 assembler
+  * include set -xe in the for loops in the rules files to make it abort
+    on error (closes: #161768)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sat, 21 Sep 2002 16:23:11 +0200
+
+openssl (0.9.6g-4) unstable; urgency=low
+
+  * fix optimization for alpha and sparc
+  * add optimization for i486
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Fri, 20 Sep 2002 22:36:19 +0200
+
+openssl (0.9.6g-3) unstable; urgency=low
+
+  * add optimized libraries for i586, i686, ev4, ev5 and v9 (closes: #139783)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu, 19 Sep 2002 18:33:04 +0200
+
+openssl (0.9.6g-2) unstable; urgency=low
+
+  * fix manpage names (closes: #156717, #156718, #156719, #156721)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu, 15 Aug 2002 11:26:37 +0200
+
+openssl (0.9.6g-1) unstable; urgency=low
+
+  * new upstream version
+  * Use proper error handling instead of 'assertions' in buffer
+    overflow checks added in 0.9.6e.  This prevents DoS (the
+    assertions could call abort()). (closes: #155985, #156495)
+  * Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
+    and get fix the header length calculation.
+  * include support for new sh* architectures (closes: #155117)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed, 14 Aug 2002 13:59:22 +0200
+
+openssl (0.9.6e-1) unstable; urgency=high
+
+  * fixes remote exploits (see DSA-136-1)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Tue, 30 Jul 2002 18:32:28 +0200
+
+openssl (0.9.6d-1) unstable; urgency=low
+
+  * new upstream (minor) version
+  * includes Configure lines for debian-*bsd-* (closes: #130413)
+  * fix wrong prototype for BN_pseudo_rand_range in BN_rand(3ssl) (closes:
+    #144586) 
+  * fix typos in package description (closes: #141469)
+  * fix typo in SSL_CTX_set_cert_store manpage (closes: #135297)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon,  3 Jun 2002 19:42:10 +0200
+
+openssl (0.9.6c-2) unstable; urgency=low
+
+  * moved from non-US to main
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Tue, 19 Mar 2002 14:48:39 +0100
+
+openssl (0.9.6c-1) unstable; urgency=low
+
+  * new upstream version with a lot of bugfixes
+  * remove directory /usr/include/openssl from openssl package (closes:
+    bug #121226)  
+  * remove selfdepends from libssl0.9.6
+  * link openssl binary shared again
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sat,  5 Jan 2002 19:04:31 +0100
+
+openssl (0.9.6b-4) unstable; urgency=low
+
+  * build with -D_REENTRANT for threads support on all architectures
+    (closes: #112329, #119239)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sat, 24 Nov 2001 12:17:51 +0100
+
+openssl (0.9.6b-3) unstable; urgency=low
+
+  * disable idea, mdc2 and rc5 because they are not free (closes: #65368) 
+  * ready to be moved from nonus to main
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed, 21 Nov 2001 17:51:41 +0100
+
+openssl (0.9.6b-2) unstable; urgency=high
+
+  * fix definition of crypt in des.h (closes: #107533)
+  * fix descriptions (closes: #109503)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon, 17 Sep 2001 15:38:27 +0200
+
+openssl (0.9.6b-1) unstable; urgency=medium
+
+  * new upstream fixes some security issues (closes: #105835, #100146) 
+  * added support for s390 (closes: #105681)
+  * added support for sh (closes: #100003)
+  * change priority of libssl096 to standard as ssh depends on it (closes:
+    #105440) 
+  * don't optimize for i486 to support i386. (closes: #104127, #82194)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Fri, 20 Jul 2001 15:52:42 +0200
+
+openssl (0.9.6a-3) unstable; urgency=medium
+
+  * add perl-base to builddeps
+  * include static libraries in libssl-dev (closes: #93688)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon, 14 May 2001 20:16:06 +0200
+
+openssl (0.9.6a-2) unstable; urgency=medium
+
+  * change Architecture of ssleay from any to all (closes: #92913)
+  * depend libssl-dev on the exact same version of libssl0.9.6 (closes:
+    #88939) 
+  * remove lib{crypto,ssl}.a from openssl (closes: #93666)
+  * rebuild with newer gcc to fix atexit problem (closes: #94036)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed,  2 May 2001 12:28:39 +0200
+
+openssl (0.9.6a-1) unstable; urgency=medium
+
+  * new upstream, fixes some security bugs (closes: #90584)
+  * fix typo in s_server manpage (closes: #89756)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Tue, 10 Apr 2001 12:13:11 +0200
+
+openssl (0.9.6-2) unstable; urgency=low
+
+  * policy: reorganisation of package names: libssl096 -> libssl0.9.6,
+    libssl096-dev -> libssl-dev (closes: #83426)
+  * libssl0.9.6 drops replaces libssl09 (Closes: #83425)
+  * install upstream CHANGES files (Closes: #83430)
+  * added support for hppa and ia64 (Closes: #88790)
+  * move man3 manpages to libssl-dev (Closes: #87546)
+  * fix formating problem in rand_add(1) (Closes: #87547)
+  * remove manpage duplicates (Closes: #87545, #74986)
+  * make package descriptions clearer (Closes: #83518, #83444)
+  * increase default emailAddress_max from 40 to 60 (Closes: #67238)
+  * removed RSAREF warning (Closes: #84122)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu,  8 Mar 2001 14:24:00 +0100
+
+openssl (0.9.6-1) unstable; urgency=low
+
+  * New upstream version (Thanks to Enrique Zanardi <ezanard@debian.org>)
+    (closes: #72388)
+  * Add support for debian-hurd (closes: #76032)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon, 13 Nov 2000 22:30:46 +0100
+
+openssl (0.9.5a-5) unstable; urgency=low
+
+  * move manpages in standard directories with section ssl (closes:
+    #72152, #69809)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu,  5 Oct 2000 19:56:20 +0200
+
+openssl (0.9.5a-4) unstable; urgency=low
+
+  * include edg_rand_bytes patch from and for apache-ssl 
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sat, 23 Sep 2000 16:48:06 +0200
+
+openssl (0.9.5a-3) unstable; urgency=low
+
+  * fix call to dh_makeshlibs to create correct shlibs file and make
+    dependend programs link correctly (closes: Bug#61658)
+  * include a note in README.debian concerning the location of the
+    subcommand manpages (closes: Bug#69809)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sat, 16 Sep 2000 19:10:50 +0200
+
+openssl (0.9.5a-2) unstable; urgency=low
+
+  * try to fix the sharedlib problem. change soname of library 
+  (closes: Bug#4622, #66102, #66538, #66123) 
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed, 12 Jul 2000 03:26:30 +0200
+
+openssl (0.9.5a-1) unstable; urgency=low
+
+  * new upstream version (major changes see file NEWS) (closes: Bug#63976,
+    #65239, #65358)
+  * new library package libssl095a because of probably changed library
+    interface (closes: Bug#46222)
+  * added architecture mips and mipsel (closes: Bug#62437, #60366)
+  * provide shlibs.local file in build to help build if libraries are not
+    yet installed (closes: Bug#63984)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sun, 11 Jun 2000 15:17:35 +0200
+
+openssl (0.9.4-5) frozen unstable; urgency=medium
+
+  * cleanup of move of doc directories to /usr/share/doc (closes:
+    Bug#56430) 
+  * lintian issues (closes: Bug#49358)
+  * move demos from openssl to libssl09-dev (closes: Bug#59201)
+  * move to debhelpers
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sat, 11 Mar 2000 10:38:04 +0100
+
+openssl (0.9.4-4) unstable; urgency=medium
+
+  * Added 'debian-arm' in 'Configure'. (closes: Bug#54251, #54766)
+  * Fixed Configure for 'debian-m68k' (closes: Bug#53636)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sat, 15 Jan 2000 13:16:18 +0100
+
+openssl (0.9.4-3) unstable; urgency=low
+
+  * define symbol SSLeay_add_ssl_algorithms for backward compatibility
+    (closes: Bug#46882)
+  * remove manpages from /usr/doc/openssl (closes: Bug#46791)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu, 14 Oct 1999 16:51:08 +0200
+
+openssl (0.9.4-2) unstable; urgency=low
+
+  * include some more docu in pod format (Bug #43933)
+  * removed -mv8 from sparc flags (Bug #44769)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Tue, 14 Sep 1999 22:04:06 +0200
+
+openssl (0.9.4-1) unstable; urgency=low
+
+  * new upstream version (Closes: #42926)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sat, 28 Aug 1999 17:04:23 +0200
+
+openssl (0.9.3a-1) unstable; urgency=low
+
+  * new upstream version (Bug #38345, #38627)
+  * sparc is big-endian (Bug #39973)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed,  7 Jul 1999 16:03:37 +0200
+
+openssl (0.9.2b-3) unstable; urgency=low
+
+  * correct move conffiles to /etc/ssl (Bug #38570)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon, 31 May 1999 21:08:07 +0200
+
+openssl (0.9.2b-2) unstable; urgency=low
+
+  * added convenience package ssleay to help upgrade to openssl (Bug
+    #37185, #37623, #36326)
+  * added some missing dependencies from libssl09 (Bug #36681, #35867,
+    #36326) 
+  * move lib*.so to libssl09-dev (Bug #36761)
+  * corrected version numbers of library files
+  * introduce link from /usr/lib/ssl to /etc/ssl (Bug #36710)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sun, 23 May 1999 14:57:48 +0200
+
+openssl (0.9.2b-1) unstable; urgency=medium
+
+  * First openssl version
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed, 31 Mar 1999 15:54:26 +0200
+
+ssleay (0.9.0b-2) unstable; urgency=low
+
+  * Include message about the (not)usage of RSAREF (#24409)
+  * Move configfiles from /usr/lib/ssl to /etc/ssl (#26406)
+  * Change definitions for sparc (#26487)
+  * Added missing dependency (#28591)
+  * Make debian/libtool executable (#29708)
+  * /etc/ssl/lib/ssleay.cnf is now a confile (#32624)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Sun, 21 Mar 1999 19:41:04 +0100
+
+ssleay (0.9.0b-1) unstable; urgency=low
+
+  * new upstream version (Bug #21227, #25971)
+  * build shared libraries with -fPIC (Bug #20027)
+  * support sparc architecture (Bug #28467)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Tue, 13 Oct 1998 10:20:13 +0200
+
+ssleay (0.8.1-7) frozen unstable; urgency=high
+
+  * security fix patch to 0.8.1b (bug #24022)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon,  6 Jul 1998 15:42:15 +0200
+
+ssleay (0.8.1-6) frozen unstable; urgency=low
+
+  * second try to fix bug #15235 (copyright was still missing)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Mon, 22 Jun 1998 08:56:27 +0200
+
+ssleay (0.8.1-5) frozen unstable; urgency=high
+
+  * changed /dev/random to /dev/urandom (Bug #23169, #17817)
+  * copyright contains now the full licence (Bug #15235)
+  * fixed bug #19410 (md5sums-lists-nonexisting-file)
+  * added demos to /usr/doc (Bug #17372)
+  * fixed type in package description (Bug #18969)
+  * fixed bug in adding documentation (Bug #21463)
+  * added patch for support of debian-powerpc (Bug #21579)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu, 18 Jun 1998 23:09:13 +0200
+
+ssleay (0.8.1-4) unstable; urgency=low
+
+  * purged dependency from libc5
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Tue, 11 Nov 1997 15:31:50 +0100
+
+ssleay (0.8.1-3) unstable; urgency=low
+
+  * changed packagename libssl to libssl08 to get better dependancies
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Fri,  7 Nov 1997 14:23:17 +0100
+
+ssleay (0.8.1-2) unstable; urgency=low
+
+  * linked shared libraries against libc6
+  * use /dev/random for randomseed
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed,  5 Nov 1997 11:21:40 +0100
+
+ssleay (0.8.1-1) unstable; urgency=low
+
+  * new upstream version
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Thu, 16 Oct 1997 16:15:43 +0200
+
+ssleay (0.6.6-2) unstable; urgency=low
+
+  * cleanup in diffs
+  * removed INSTALL from docs (bug #13205)
+  * split libssl and libssl-dev (but #13735)
+
+ -- Christoph Martin <christoph.martin@uni-mainz.de>  Wed, 15 Oct 1997 17:38:38 +0200
+
+ssleay (0.6.6-1) unstable; urgency=low
+
+  * New upstream version
+  * added shared libraries for libcrypto and libssl
+
+ -- Christoph Martin <martin@uni-mainz.de>  Thu, 26 Jun 1997 19:26:14 +0200
+
+ssleay (0.6.4-2) unstable; urgency=low
+
+  * changed doc filenames from .doc to .txt to be able to read them
+    over with webbrowser
+
+ -- Christoph Martin <martin@uni-mainz.de>  Tue, 25 Feb 1997 14:02:53 +0100
+
+ssleay (0.6.4-1) unstable; urgency=low
+
+  * Initial Release.
+
+ -- Christoph Martin <martin@uni-mainz.de>  Fri, 22 Nov 1996 21:29:51 +0100
--- openssl-0.9.8g.orig/debian/watch
+++ openssl-0.9.8g/debian/watch
@@ -0,0 +1,2 @@
+version=2
+ftp://ftp.openssl.org/source/openssl-(\d+\.\d+\.\d+[a-z]?)\.tar\.gz
--- openssl-0.9.8g.orig/debian/libssl-dev.files
+++ openssl-0.9.8g/debian/libssl-dev.files
@@ -0,0 +1,7 @@
+usr/lib/libssl.so
+usr/lib/libcrypto.so
+usr/lib/libssl.a
+usr/lib/libcrypto.a
+usr/lib/pkgconfig
+usr/include
+usr/share/man/man3
--- openssl-0.9.8g.orig/debian/compat
+++ openssl-0.9.8g/debian/compat
@@ -0,0 +1 @@
+3
--- openssl-0.9.8g.orig/debian/libssl0.9.8.dirs
+++ openssl-0.9.8g/debian/libssl0.9.8.dirs
@@ -0,0 +1,2 @@
+usr/lib
+usr/share/doc/libssl0.9.8
--- openssl-0.9.8g.orig/debian/openssl.dirs
+++ openssl-0.9.8g/debian/openssl.dirs
@@ -0,0 +1,5 @@
+usr/share/doc/openssl/doc
+usr/bin
+usr/lib
+etc/ssl/certs
+etc/ssl/private
--- openssl-0.9.8g.orig/debian/libssl0.9.8.postinst
+++ openssl-0.9.8g/debian/libssl0.9.8.postinst
@@ -0,0 +1,169 @@
+#!/bin/bash
+
+. /usr/share/debconf/confmodule
+
+set -e
+
+package_name()
+{
+    echo $(basename $0 .postinst)
+}
+
+# element() is a helper function for file-rc:
+element() {
+    local element list IFS
+
+    element="$1"
+
+    [ "$2" = "in" ] && shift
+    list="$2"
+    [ "$list" = "-" ] && return 1
+    [ "$list" = "*" ] && return 0
+
+    IFS=","
+    set -- $list
+    case $element in
+	"$1"|"$2"|"$3"|"$4"|"$5"|"$6"|"$7"|"$8"|"$9")
+	    return 0
+    esac
+    return 1
+}
+
+# filerc (runlevel, service) returns /etc/init.d/service, if service is
+# running in $runlevel:
+filerc() {
+    local runlevel basename
+    runlevel=$1
+    basename=$2
+    while read LINE
+    do
+	case $LINE in
+	    \#*|"") continue
+	esac
+
+	set -- $LINE
+	SORT_NO="$1"; STOP="$2"; START="$3"; CMD="$4"
+	[ "$CMD" = "/etc/init.d/$basename" ] || continue
+
+	if element "$runlevel" in "$START" || element "S" in "$START"
+	then
+	    echo "/etc/init.d/$basename"
+	    return 0
+	fi
+    done < /etc/runlevel.conf
+    echo ""
+}
+
+if [ "$1" = "configure" ]
+then
+    if [ ! -z "$2" ]; then
+	if dpkg --compare-versions "$2" lt 0.9.8g-9 && dpkg --compare-versions "$2" gt 0.9.8c-4etch3; then
+	    db_version 2.0
+
+	    echo -n "Checking for services that may need to be restarted..."
+
+	    check="sendmail openssh-server"
+	    check="$check apache2-common ssh-nonfree exim4"
+	    check="$check apache-ssl libapache-mod-ssl openvpn spamassassin"
+	    check="$check courier-imap-ssl courier-mta-ssl courier-pop-ssl"
+	    check="$check postfix cyrus21-imapd cyrus21-pop3d"
+	    check="$check postgresql-7.4 postgresql-8.0 postgresql-8.1"
+	    check="$check postgresql-8.2"
+	    check="$check racoon dovecot-common bind9"
+	    check="$check ntp openntpd clamcour nagios-nrpe-server"
+	    check="$check clamav-freshclam clamav-daemon"
+	    check="$check fetchmail ftpd-ssl slapd"
+	    check="$check proftpd proftpd-ldap proftpd-mysql proftpd-pgsql"
+	    check="$check partimage-server conserver-server tor"
+	    check="$check stunnel4"
+	    # Only get the ones that are installed, and configured
+	    check=$(dpkg -s $check 2> /dev/null | egrep '^Package:|^Status:' | awk '{if ($1 ~ /^Package:/) { package=$2 } else if ($0 ~ /^Status: .* installed$/) { print package }}')
+	    # apache2 ships its init script in apache2-common, but the
+	    # script is apache2
+	    check=$(echo $check | sed 's/apache2-common/apache2/g')
+	    # For mod-ssl apache has to be restarted
+	    check=$(echo $check | sed 's/libapache-mod-ssl/apache/g')
+	    # The name of proftpd-{ldap,mysql,pgsql} init script is
+	    # same as "proftpd".
+	    check=$(echo $check | sed 's/proftpd-.*/proftpd/g')
+            # dovecot-common ships its init script, but the
+	    # script name is dovecot for dovecot-{imapd,pop3d}.
+	    check=$(echo $check | sed 's/dovecot-common/dovecot/g')
+	    # openssh-server's init script it called ssh
+	    check=$(echo $check | sed 's/openssh-server/ssh/g')
+	    echo "done."
+
+	    echo "Checking init scripts..."
+	    for service in $check; do
+		if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+		   idl=$(ls /etc/init.d/${service} 2> /dev/null | head -n 1)
+		   if [ -n "$idl" ] && [ -x $idl ]; then
+			services="$service $services"
+		   else
+			echo "WARNING: init script for $service not found."
+		   fi
+		else
+		    if [ -f /usr/share/file-rc/rc ] || [ -f /usr/lib/file-rc/rc ] && [ -f /etc/runlevel.conf ]; then
+
+			idl=$(filerc $rl $service)
+		    else
+			idl=$(ls /etc/rc${rl}.d/S??${service} 2> /dev/null | head -n 1)
+		    fi
+		    if [ -n "$idl" ] && [ -x $idl ]; then
+		        services="$service $services"
+		    fi
+		fi
+	    done
+	    if [ -n "$services" ]; then
+		db_reset libssl0.9.8/restart-services
+		db_set libssl0.9.8/restart-services "$services"
+		db_input critical libssl0.9.8/restart-services || true
+		db_go || true
+		db_get libssl0.9.8/restart-services
+		
+		if [ "x$RET" != "x" ]
+		then
+		    services=$RET
+		    answer=yes
+		else
+		    answer=no
+		fi
+		echo
+		if [ "$answer" = yes ] && [ "$services" != "" ]; then
+		    echo "Restarting services possibly affected by the upgrade:"
+		    failed=""
+		    rl=$(runlevel | sed 's/.*\ //')
+		    for service in $services; do
+			if [ -x "`which invoke-rc.d 2>/dev/null`" ]; then
+			    idl="invoke-rc.d ${service}"
+			elif [ -f /usr/share/file-rc/rc ] || [ -f /usr/lib/file-rc/rc ] && [ -f /etc/runlevel.conf ]; then
+			    idl=$(filerc $rl $service)
+			else
+			    idl=$(ls /etc/rc${rl}.d/S??${service} 2> /dev/null | head -n 1)
+			fi
+
+			if ! $idl restart; then
+			    failed="$service $failed"
+			fi
+		    done
+		    echo
+		    if [ -n "$failed" ]; then
+			db_subst libssl0.9.8/restart-failed services "$failed"
+			db_input critical libssl0.9.8/restart-failed || true
+			db_go || true
+		    else
+			echo "Services restarted successfully."
+		    fi
+		    echo
+		fi
+	    else
+		echo "Nothing to restart."
+	    fi
+	    # Shut down the frontend, to make sure none of the
+	    # restarted services keep a connection open to it
+	    db_stop
+	fi # end upgrading and $2 lt 0.9.8c-2
+    fi # Upgrading
+fi
+
+#DEBHELPER#
--- openssl-0.9.8g.orig/debian/README.debian
+++ openssl-0.9.8g/debian/README.debian
@@ -0,0 +1,62 @@
+openssl for DEBIAN
+----------------------
+
+openssl replaces ssleay.
+
+The application links to openssl like req, ca, verify and s_client
+have been removed.
+
+Instead of `<application>` please call now `openssl <application>`
+
+eg: 
+instead of `req` please call `openssl req`
+
+
+PATENT ISSUES
+-------------
+
+Some algorithms used in the library are covered by patents.  As
+a result, the following algorithms in libcrypto have been disabled:
+- RC5
+- MDC2
+- IDEA
+
+Also see the patents section in the README file.
+
+
+Self-signed certs and webservers:
+---------------------------------
+
+If you get with a selfsigned certificate and a webserver:
+ > "The certificate is not approved for the attempted operation."
+
+Bodo_Moeller@public.uni-hamburg.de (Bodo Moeller) writes:
+>Probably you are using a CA certificate for your server; if you use
+>"openssl req" to generate a new key and self-signed certificate with
+>the default openssl.cnf, the certificate you get includes certain
+>X.509v3 extensions that make it unfit for use as a server certificate.
+>This was not so with earlier versions of the software because back
+>then there was far less X.509v3 support.
+>
+>To look at the certificate some HTTPS server presents to its cliens,
+>use "openssl s_client -port 443 -host your.server", store the output
+>(at least the part from "-----BEGIN CERTIFICATE-----" up to "-----END
+>CERTIFICATE-----", including these separators) in a file and use
+>"openssl x509 -in the_file_you_just_stored -text" to look at it in
+>readable form.  If it has in the "X509v3 extensions section" any of
+>the following entries, it is not usable as a server certificate:
+>
+>            X509v3 Basic Constraints:
+>                CA:TRUE
+>
+>            X509v3 Key Usage:
+>                Certificate Sign, CRL Sign
+>
+>To quickly create a new server key and certificate that works with
+>Netscape, you can just copy the original openssl.cnf file and comment
+>out the "x509_extensions" entry in the "[ req ]" section.
+>The, use "openssl req ..." as before to create a new certificate and
+>key.
+
+
+Christoph Martin <martin@uni-mainz.de>, Wed, 31 Mar 1999 16:00:51 +0200
--- openssl-0.9.8g.orig/debian/po/ko.po
+++ openssl-0.9.8g/debian/po/ko.po
@@ -0,0 +1,84 @@
+# Korean translations for openssl package
+# openssl 패키지에 대한 한국어 번역문.
+# Copyright (C) 2007 THE openssl'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the openssl package.
+# Sunjae Park <darehanl@gmail.com>, 2007.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-04-11 13:43-0400\n"
+"Last-Translator: Sunjae Park <darehanl@gmail.com>\n"
+"Language-Team: Korean <debian-l10n-korean@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "새 라이브러리를 사용하도록 재시작할 서비스 목록:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"이번 OpenSSL 릴리즈는 보안 문제를 몇 개 해결합니다. 서비스들을 재시작시킬 때"
+"까지는 이 문제들이 해결되지 않습니다. 참고로 SSH 서버(sshd)를 재시작시키더라"
+"도 기존 연결에는 영향을 주지 않을 것입니다."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"재시작시킬 서비스의 목록을 확인하시고 필요할 경우 목록을 수정하십시오. 서비스"
+"의 이름들은 /etc/init.d에 있는 초기화 스크립트의 이름과 같아야 하며 빈칸으로 "
+"구분되어야 합니다. 목록이 비어있을 경우에는 서비스를 재시작시키지 않습니다."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"이 업그레이드를 적용한 후 갑자기 오동작을 하는 서비스는 재시작시키십시오. "
+"SSL 관련된 문제가 없도록 이 호스트를 재부팅하시길 권장합니다."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
--- openssl-0.9.8g.orig/debian/po/da.po
+++ openssl-0.9.8g/debian/po/da.po
@@ -0,0 +1,97 @@
+# translation of openssl_0.9.7d-1_templates.po to Danish
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans#
+#    Developers do not need to manually edit POT or PO files.
+#
+# Claus Hindsgaul <claus_h@image.dk>, 2004.
+# Claus Hindsgaul <claus.hindsgaul@gmail.com>, 2007.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl_0.9.7d-1_templates\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-05-30 22:26+0200\n"
+"Last-Translator: Claus Hindsgaul <claus.hindsgaul@gmail.com>\n"
+"Language-Team: Danish\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=2; plural=(n != 1);\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr ""
+"Services, der skal genstartes, for at f� dem til at benytte de nye "
+"biblioteker:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Denne version af openssl retter nogle sikkerhedsproblemer. Services vil ikke "
+"benytte disse rettelser, f�r de er blevetgenstartet. Bem�rk at det ikke vil "
+"p�virke eksisterende forbindelser at genstarte SSH-serveren (sshd)."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Tjek listen over fundne services, som skal genstartes, og ret den om "
+"n�dvendigt. Servicenavnene skal v�re identiske med initialiseringsscriptenes "
+"navne i /etc/init.d, og v�re adskilt med mellemrum. Hvis listen er tom, vil "
+"ingen services blive genstartet."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Enhver service, der fejler uden grund efter denne opgradering, b�r "
+"genstartes. Det anbefales at genstarte denne maskine for at undg� SSL-"
+"relaterede problemer."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
--- openssl-0.9.8g.orig/debian/po/ca.po
+++ openssl-0.9.8g/debian/po/ca.po
@@ -0,0 +1,97 @@
+#
+# Catalan translation for openssl package.
+# Copyright (C) 2007 Debian OpenSSL Team.
+# This file is distributed under the same license as the openssl package.
+#
+# Aleix Badia i Bosch <abadia@ica.es>, 2004
+# Jordà Polo <jorda@ettin.org>, 2007.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl_0.9.8g-3\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-11-24 16:43+0100\n"
+"Last-Translator: Jordà Polo <jorda@ettin.org>\n"
+"Language-Team: Català <debian-l10n-catalan@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Serveis que cal reiniciar perquè utilitzin les noves biblioteques:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Aquesta versió d'OpenSSL resol alguns problemes de seguretat. Els serveis no "
+"utilitzaran les correccions fins que no es tornin a iniciar. Fixeu-vos que "
+"reiniciar el servidor SSH (sshd) no hauria d'afectar cap de les connexions "
+"existents."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Si us plau, comproveu la llista de serveis detectats que caldria reiniciar, "
+"i esmeneu-la si és necessari. Els noms dels serveis han de ser idèntics als "
+"noms dels scripts que hi ha al directori /etc/init.d, i haurien d'estar "
+"separats per espais. Si la llista és buida no es reiniciarà cap servei."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Si després de l'actualització fallen altres serveis de forma inesperada, és "
+"possible que també calgui tornar a iniciar-los. Si els problemes relacionats "
+"amb SSL persisteixen, podeu reiniciar l'ordinador."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+"S'ha trobat un error mentre es reiniciaven alguns serveis per "
+"l'actualització de l'OpenSSL"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"No s'han pogut reiniciar els següents serveis per l'actualització de la "
+"biblioteca OpenSSL:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"Aquests els haureu d'iniciar manualment executant «/etc/init.d/<servei> "
+"start»."
+
+#~ msgid "${services}"
+#~ msgstr "${services}"
--- openssl-0.9.8g.orig/debian/po/ja.po
+++ openssl-0.9.8g/debian/po/ja.po
@@ -0,0 +1,81 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl 0.9.8e-4\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2008-01-22 07:37+0900\n"
+"Last-Translator: Hideki Yamane (Debian-JP) <henrich@debian.or.jp>\n"
+"Language-Team: Japanese <debian-japanese@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "新しいライブラリを使うために再起動するサービス:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"OpenSSL は、今回のリリースでセキュリティホールが修正されました。各サービスは"
+"再起動を行わないと、この修正されたライブラリを利用しません。注意: SSH サーバ "
+"(sshd) を再起動しても、現状の接続には何ら影響しません。"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"再起動が必要だと判断されたサービスのリストを確認してください。必要であれば修"
+"正してください。サービス名は /etc/init.d にあるスクリプトの名前を指し、空白で"
+"区切る必要があります。リストが空の場合は、どのサービスも再起動されません。"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"他のサービスがここでのアップグレードの後に何故かエラーを起こし始めた場合、そ"
+"れらも再起動する必要があります。SSL 関連のトラブルを避けるためには、マシンを"
+"再起動するのをお勧めします。"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "OpenSSL のアップグレードによって再起動に失敗したサービス"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"以下のサービスは OpenSSL ライブラリのアップグレードに伴った再起動を行うことが"
+"できませんでした。"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"開始するには '/etc/init.d/<service> start' を手動で実行する必要があります。"
--- openssl-0.9.8g.orig/debian/po/nb.po
+++ openssl-0.9.8g/debian/po/nb.po
@@ -0,0 +1,91 @@
+# translation of openssl_0.9.8c-4_templates.po to Norwegian Bokmål
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Bjørn Steensrud <bjornst@powertech.no>, 2007.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl_0.9.8c-4_templates\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-02-25 12:31+0100\n"
+"Last-Translator: Bjørn Steensrud <bjornst@powertech.no>\n"
+"Language-Team: Norwegian Bokmål <i18n-nb@lister.ping.uio.no>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.2\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+#, fuzzy
+msgid "Services to restart to make them use the new libraries:"
+msgstr ""
+"Hvilke tjenester skal startes på nytt slik at de bruker de nye bibliotekene?"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+#, fuzzy
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Denne utgaven retter sikkerhetsproblemer. Tjenester kan ikke bruke disse "
+"rettelsene før de er startet på nytt. Merk: om sshd startes på nytt blir "
+"antakelig ingen eksisterende tilkoblinger påvirket."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+#, fuzzy
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Her følger en liste over funne tjenester som trenger omstart. Rett på lista "
+"om den er feil. Tjenestenavnene må være lik skript-navnene i /etc/init.d, og "
+"være atskilt med mellomrom. Hvis du tømmer lista blir ingen tjenester "
+"omstartet."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+#, fuzzy
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Hvis andre tjenester begynner å svikte på mystisk måte etter denne "
+"oppgraderingen, så kan det være nødvendig å starte dem på nytt også. Vi "
+"anbefaler sterkt at maskinen stoppes og startes for å unngå vansker i "
+"forbindelse med SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
--- openssl-0.9.8g.orig/debian/po/de.po
+++ openssl-0.9.8g/debian/po/de.po
@@ -0,0 +1,91 @@
+# German translation of openssl's debconf templates
+# Copyright (C) 2006-2008 Johannes Starosta <feedback-an-johannes@arcor.de>
+# This file is distributed under the same license as the openssl package.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl 0.9.8e-4\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2008-03-24 22:48+0100\n"
+"Last-Translator: Johannes Starosta <feedback-an-johannes@arcor.de>\n"
+"Language-Team: German <debian-l10n-german@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr ""
+"Welche Dienste sollen erneut gestartet werden, damit sie die neuen "
+"Bibliotheken verwenden?"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"In dieser Version von OpenSSL wurden Sicherheitsprobleme behoben. Dienste "
+"werden diese Aktualisierungen nicht nutzen, bis sie neugestartet werden. "
+"Hinweis: Den SSH-Server (sshd) neu zu starten, dürfte keine bestehenden "
+"Verbindungen beeinträchtigen."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Es folgt nun eine Liste der erkannten Dienste, die neu gestartet werden "
+"sollten. Bitte berichtigen Sie die Liste, falls Sie glauben, dass sie Fehler "
+"enthält. Die Namen der Dienste müssen den Namen der Skripte in /etc/init.d "
+"entsprechen und werden durch Leerzeichen getrennt. Es wird kein Dienst neu "
+"gestartet, falls die Liste leer bleibt."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Falls andere Dienste nach diesem Upgrade ein merkwürdiges Fehlverhalten "
+"zeigen, könnte es nötig werden, sie ebenfalls neu zu starten. Es wird "
+"empfohlen, den Rechner neu zu starten, um Probleme mit SSL zu vermeiden."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Neustarten einiger Dienste beim OpenSSL-Upgrade fehlgeschlagen"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"Die folgenden Dienste konnten beim Upgrade der OpenSSL-Bibliothek nicht neu "
+"gestartet werden:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"Sie werden sie manuell durch Aufruf von »/etc/init.d/<dienst> start« starten "
+"müssen."
--- openssl-0.9.8g.orig/debian/po/nl.po
+++ openssl-0.9.8g/debian/po/nl.po
@@ -0,0 +1,102 @@
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-11-14 20:03+0100\n"
+"Last-Translator: Bart Cornelis <cobaco@skolelinux.no>\n"
+"Language-Team: debian-l10n-dutch <debian-l10n-dutch@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: Dutch\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr ""
+"Welke diensten moeten herstart worden (zodat ze de nieuwe bibliotheken "
+"gebruiken)?"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Deze uitgave van OpenSSL dicht een aantal veiligheidslekken. Andere "
+"achtergronddiensten maken pas gebruik van de nieuwe versie eens ze herstart "
+"zijn. Herstarten van de SSH-server (sshd) heeft normaal geen gevolgen voor "
+"bestande verbindingen."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Hierna volgt een lijst van gedetecteerde diensten die herstart moeten "
+"worden. Verbeter de lijst, als u denkt dat ze incorrect is. De namen moeten "
+"overeenkomen met de script-namen in /etc/init.d en moeten gescheiden worden "
+"door spaties. Als de lijst leeg is worden er geen diensten herstart."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Als er andere diensten mysterieus beginnen te falen na deze opwaardering, "
+"dient u deze te herstarten. Er wordt u ten zeerste aanbevolen uw machine te "
+"herstarten om SSL-gerelateerde problemen te vermijden."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Herstarten van sommige diensten na de OpenSSL-opwaardering is mislukt."
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"De volgende diensten konden niet herstart worden na de opwaardering van de "
+"OpenSSL-bibliotheek:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"U zult deze handmatig moeten herstarten via het commando '/etc/init.d/"
+"<dienst> start'."
+
+#~ msgid "${services}"
+#~ msgstr "${services}"
--- openssl-0.9.8g.orig/debian/po/es.po
+++ openssl-0.9.8g/debian/po/es.po
@@ -0,0 +1,119 @@
+# openssl translation to spanish
+# Copyright (C) 2004 Software in the Public Interest
+# This file is distributed under the same license as the openssl package.
+#
+# Changes:
+# - Initial translation
+#       Lucas Wall <kthulhu@kadath.com.ar>, 2004
+#
+# - Last revision
+# 		Manuel Porras Peralta «Venturi», 2007
+#               Maximiliano Marín, 2007
+#             
+#
+#  Traductores, si no conoce el formato PO, merece la pena leer la 
+#  documentación de gettext, especialmente las secciones dedicadas a este
+#  formato, por ejemplo ejecutando:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+# Equipo de traducción al español, por favor lean antes de traducir
+# los siguientes documentos:
+#
+# - El proyecto de traducción de Debian al español
+#   http://www.debian.org/intl/spanish/coordinacion
+#   especialmente las notas de traducción en
+#   http://www.debian.org/intl/spanish/notas
+#
+# - La guía de traducción de po's de debconf:
+#   /usr/share/doc/po-debconf/README-trans
+#   o http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl 0.9.7d-3\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-05-01 17:20+0200\n"
+"Last-Translator: Manuel Porras Peralta «Venturi» <venturi.debian@gmail.com>\n"
+"Language-Team: Debian Spanish <debian-l10n-spanish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr ""
+"Servicios que tienen que reiniciarse para que usen las nuevas bibliotecas:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Esta versión de OpenSSL corrige algunos problemas de seguridad. Los "
+"servicios no usarán los arreglos hasta que se reinicien. Tenga en cuenta que "
+"reiniciar el servicio SSH (sshd) no debería afectar a ninguna de las "
+"conexiones existentes."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Por favor, compruebe la lista de los servicios detectados que necesitan "
+"reiniciarse y corríjala si fuese necesario. Los nombres de los servicios "
+"deben ser idénticos a los nombres de los programas de inicio en «/etc/init.d» "
+"y deben estar separados por espacios. No se reiniciará ningún servicio si "
+"deja la lista en blanco."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Tras esta actualización, debería reiniciar más tarde cualquier servicio que "
+"falle inesperadamente. Se recomienda reiniciar el sistema para evitar "
+"cualquier problema relacionado con SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Fallo al reiniciar algunos servicios por la actualización de OpenSSL"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"No fue posible reiniciar los servicios indicados a continuación por la "
+"actualización de OpenSSL: "
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"Tendrá que iniciarlos manualmente ejecutando « /etc/init.d/<servicio> start » "
+
+#~ msgid "${services}"
+#~ msgstr "${services}"
--- openssl-0.9.8g.orig/debian/po/ru.po
+++ openssl-0.9.8g/debian/po/ru.po
@@ -0,0 +1,94 @@
+# translation of openssl_0.9.8g-10.1_ru.po to Russian
+# This file is distributed under the same license as the PACKAGE package.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER.
+#
+# Yuriy Talakan' <yt@amur.elektra.ru>, 2006.
+# Yuriy Talakan' <yt@drsk.ru>, 2007.
+# Yuri Kozlov <kozlov.y@gmail.com>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl 0.9.8g-10.1\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2008-06-03 21:21+0400\n"
+"Last-Translator: Yuri Kozlov <kozlov.y@gmail.com>\n"
+"Language-Team: Russian <debian-l10n-russian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Перезапускаемые службы для использования новой библиотеки:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Этот выпуск OpenSSL исправляет некоторые проблемы безопасности. Службы не "
+"могут использовать эти исправления, пока не будут перезапущены. Обратите "
+"внимание, что перезапуск сервера SSH (sshd) не повлияет на существующие "
+"соединения."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Проверьте список обнаруженных служб, которые надо перезапустить и "
+"поправьте его, если необходимо. Имена служб должны соответствовать именам "
+"сценариев запуска в /etc/init.d и должны быть разделены пробелами. Если "
+"список пустой, службы не будут перезапущены."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Надо перезапустить любую службу, которая после этого обновления неожиданно "
+"начнёт работать с ошибками. Рекомендуется перегрузить машину во избежание "
+"проблем, связанных с SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Не удалось перезапустить некоторые службы при обновлении OpenSSL"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"Следующие службы не удалось перезапустить при обновлении "
+"библиотеки OpenSSL:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"Вам нужно будет перезапустить их вручную с помощью команд '/etc/init.d/<служба> "
+"start'."
+
--- openssl-0.9.8g.orig/debian/po/vi.po
+++ openssl-0.9.8g/debian/po/vi.po
@@ -0,0 +1,84 @@
+# Vietnamese translation for openssl.
+# Copyright © 2007 Free Software Foundation, Inc.
+# Clytie Siddall <clytie@riverland.net.au>, 2005-2007.
+# 
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl_0.9.8e-5\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-06-01 16:14+0930\n"
+"Last-Translator: Clytie Siddall <clytie@riverland.net.au>\n"
+"Language-Team: Vietnamese <vi-VN@googlegroups.com>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"Plural-Forms: nplurals=1; plural=0;\n"
+"X-Generator: LocFactoryEditor 1.6.3b1\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Dịch vụ cần khởi chạy lại để sử dụng thư viện mới:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Phiên bản OpenSSL này sửa chữa một số vấn đề bảo mật. Dịch vụ sẽ chỉ sử dụng "
+"những sự sửa này sau khi khởi chạy lại. Ghi chú rằng việc khởi chạy lại "
+"trình phục vụ SSH (sshd) không nên có tác động kết nối tồn tại nào."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Hãy kiểm tra danh sách các dịch vụ đã phát hiện cần khởi chạy lại, và sửa "
+"chữa nếu cần thiết.  Tên mỗi dịch vụ phải trùng với tên văn lệnh khởi động "
+"trong « /etc/init.d », các tên dịch vụ định giới bằng dấu cách. Bỏ rỗng thì "
+"không khời chạy dịch vụ nào."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Dịch vụ nào bị lỗi bất thường sau khi nâng cấp nên được khởi chạy lại. "
+"Khuyên bạn khởi động máy này để tránh vấn đề liên quan đến SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
--- openssl-0.9.8g.orig/debian/po/cs.po
+++ openssl-0.9.8g/debian/po/cs.po
@@ -0,0 +1,93 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2008-05-12 19:14+0200\n"
+"Last-Translator: Miroslav Kure <kurem@debian.cz>\n"
+"Language-Team: Czech <debian-l10n-czech@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Služby, které se mají restartovat, aby začaly využívat nové knihovny:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Toto vydání OpenSSL opravuje některé bezpečnostní problémy. Tyto opravy se v "
+"programech projeví až po jejich restartu. Poznamenejme, že restart SSH "
+"serveru (sshd) by neměl ovlivnit stávající spojení."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Zkontrolujte prosím seznam rozpoznaných služeb, které je třeba restartovat. "
+"Jestliže se vám zdá, že je seznam chybný, můžete jej upravit. Názvy služeb "
+"musí být shodné s názvy skriptů v adresáři /etc/init.d a musí být odděleny "
+"mezerami. Pokud seznam vymažete, nebude restartována žádná služba."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Jestliže po této aktualizaci začnou neočekávaně selhávat některé služby, "
+"měli byste je taktéž restartovat. Abyste se vyhnuli problémům spojeným se "
+"SSL, doporučujeme restartovat celý počítač."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Chyba při restartu některých služeb po aktualizaci OpenSSL"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"Následující služby se nepodařilo po aktualizaci knihovny OpenSSL restartovat:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr "Budete je muset spustit ručně příkazem „/etc/init.d/<služba> start“."
--- openssl-0.9.8g.orig/debian/po/eu.po
+++ openssl-0.9.8g/debian/po/eu.po
@@ -0,0 +1,94 @@
+# translation of eu.po to Euskara
+# Openssl debconf template basque translation
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Piarres Beobide <pi@beobide.net>, 2007.
+msgid ""
+msgstr ""
+"Project-Id-Version: eu\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-12-21 10:56+0100\n"
+"Last-Translator: Piarres Beobide <pi@beobide.net>\n"
+"Language-Team: Euskara <Librezale@librezale.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms: nplurals=2; plural=(n != 1)\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr ""
+"Liburutegi berriak erabili ditzaten berrabiarazi behar diren zerbitzuak:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"OpenSSL bertsio honek zenbait segurtasun arazo konpontzen ditu. Zerbitzuak "
+"ez dituzte konponketa hauek erabiliko berrabiarazi arte. Kontutan izan SSH "
+"zerbitzua berrabiarazteak ez dituela sorturik dauden konexioei eragingo."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Mesedez egiaztatu antzemandako berrabiarazi beharra dute zerbitzuen zerrenda "
+"eta zuzendu behar izanez gero. Zerbitzu izenak /etc/init.d-eko abiarazte "
+"Script-en berdinak izan behar dira. Zerrenda hutsik utziaz ez da zerbitzurik "
+"berrabiaraziko."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Bertsio berritze honen ondoren esperogabe huts egiten duen edozein zerbitzu "
+"berrabiarazi egin beharko zenuke. Ostalari osoa berrabiaraztea gomendatzen "
+"da SSL inguruko arazoak saihesteko."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Huts OpenSSL bertsio-berritzerako zerbitzu batzuek berrabiaraztean."
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"Hurrengo zerbitzuak ezin izan dira berrabiarazi OpenSSL liburutegi bertsio-"
+"berritzerako:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"Eskuz berrabiarazi beharko dituzu '/etc/ init.d/<zerbitzua> start' eginez."
+
+#~ msgid "${services}"
+#~ msgstr "${services}"
--- openssl-0.9.8g.orig/debian/po/POTFILES.in
+++ openssl-0.9.8g/debian/po/POTFILES.in
@@ -0,0 +1 @@
+[type: gettext/rfc822deb] libssl0.9.8.templates
--- openssl-0.9.8g.orig/debian/po/ml.po
+++ openssl-0.9.8g/debian/po/ml.po
@@ -0,0 +1,86 @@
+# English translation of openssl.
+# Copyright (C) 2007 THE openssl'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the openssl package.
+# Praveen|പ്രവീണ്‍ A|എ <pravi.a@gmail.com>, 2007.
+# 
+# 
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl 20070415\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-04-14 07:15+0530\n"
+"Last-Translator: Praveen|പ്രവീണ്‍ A|എ <pravi.a@gmail.com>\n"
+"Language-Team: Swathanthra|സ്വതന്ത്ര Malayalam|മലയാളം Computing|കമ്പ്യൂട്ടിങ്ങ്  <smc-"
+"discuss@googlegroups.com>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "പുിതിയ ലൈബ്രറികള്‍ ഉപയോഗിയ്ക്കാന്‍ പുനരാരംഭിയ്ക്കേണ്ട സേവനങ്ങള്‍:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"OpenSSL ന്റെ ഈ പതിപ്പ് ചില സുരക്ഷാ പ്രശ്നങ്ങളെ പരിഹരിയ്ക്കുന്നുണ്ട്. പുനരാരംഭിയ്ക്കുന്നത് വരെ "
+"സേവനങ്ങള്‍ ഈ പരിഹാരങ്ങള്‍ ഉപയോഗിയ്ക്കുന്നതല്ല. SSH സേവകന്‍ (sshd) പുനരാരംഭിയ്ക്കുന്നത് "
+"നേരത്തെയുള്ള ബന്ധങ്ങളെ ബാധിയ്ക്കുകയില്ല."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"ദയവായി പുനരാരംഭിയ്ക്കേണ്ടതായി കണ്ടുപിടിയ്ക്കപ്പെട്ട സേവനങ്ങളുടെ പട്ടിക ദയവായി "
+"പരിശോദിയ്ക്കുകയും ആവശ്യമെങ്കില്‍ തിരുത്തുകയും ചെയ്യുക. സേവന നാമങ്ങള്‍ /etc/init.d യിലെ ആരംഭ "
+"സ്ക്രിപ്റ്റ് നാമങ്ങളുമായി സമാനമായിരിയ്ക്കുയും സ്പേയ്സുകള്‍ കൊണ്ട് "
+"വേര്‍തിരിയ്ക്കപ്പെട്ടവയുമായിരിയ്ക്കണം. പട്ടിക ശൂന്യമാണെങ്കില്‍ സേവനങ്ങളൊന്നും പുനരാരംഭിയ്ക്കുന്നതല്ല."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"ഈ പുതുക്കലിന് ശേഷം പിന്നീട് അപ്രതീക്ഷിതമായി മുടങ്ങുന്ന ഏതൊരു സേവനങ്ങളേയും "
+"പുനരാരംഭിയ്ക്കേണ്ടതുണ്ട്. SSL ലുമായി ബന്ധപ്പെട്ട പ്രശ്നം ഒഴിവാക്കാന്‍ ഈ ഹോസ്റ്റിനെ "
+"പുനരാരംഭിയ്ക്കാന്‍ ശുപാര്‍ശ ചെയ്തിരിയ്ക്കുന്നു."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
--- openssl-0.9.8g.orig/debian/po/ar.po
+++ openssl-0.9.8g/debian/po/ar.po
@@ -0,0 +1,86 @@
+# translation of openssl-ar.po to Arabic
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+#
+# Ossama M. Khayat <okhayat@yahoo.com>, 2007.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl-ar\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-04-11 09:47+0300\n"
+"Last-Translator: Ossama M. Khayat <okhayat@yahoo.com>\n"
+"Language-Team: Arabic <support@arabeyes.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms: nplurals=6; plural=n==1 ? 0 : n==0 ? 1 : n==2 ? 2: n%100>=3 && "
+"n%100<=10 ? 3 : n%100>=11 && n%100<=99 ? 4 : 5\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "الخدمات المطلوب إعادة تشغيلها لجعلها تستخدم المكتبات الجديدة:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"هذا الإصدار من OpenSSL يحل بعض المشاكل الأمنية. ولن تستخدم الخدمات هذه "
+"الحلول حتى يتم إعادة تشغيلها. الرجاء التنبه إلى أن إعادة تشغيل خادم SSH "
+"(sshd) لا يؤثر على أية اتصالات حالية."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"الرجاء التحقق من قائمة الخدمات المكتشفة والتي يجب إعادة تشغيلها وقم بتصحيحها "
+"إن كانت هناك حاجة لذلك. يجب أن تكون أسماء الخدمات مطابقة لأسماء ملفات شيفرات "
+"التشغيل في /etc/init.d وتفصلها مسافات. لن تتم إعادة تشغيل أية خدمات إن كانت "
+"القائمة فارغة."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"يجب إعادة تشغيل أية خدمة تفشل بشكل غير متوقع عقب عملية الترقية هذه. كما أنه "
+"من المستحسن إعادة تشغيل هذا الجهاز لتجنب أية مشاكل متعلقة بخدمة SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
--- openssl-0.9.8g.orig/debian/po/sv.po
+++ openssl-0.9.8g/debian/po/sv.po
@@ -0,0 +1,94 @@
+# translation of openssl_0.9.8g-10_sv.po to swedish
+# Translators, if you are not familiar with the PO format, gettext
+# documentation is worth reading, especially sections dedicated to
+# this format, e.g. by running:
+# info -n '(gettext)PO Files'
+# info -n '(gettext)Header Entry'
+# Some information specific to po-debconf are available at
+# /usr/share/doc/po-debconf/README-trans
+# or http://www.debian.org/intl/l10n/po-debconf/README-trans
+# Developers do not need to manually edit POT or PO files.
+#
+# Martin Bagge <martin.bagge@bthstudent.se>, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl_0.9.8g-10_sv\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2008-05-23 00:17+0200\n"
+"Last-Translator: Martin Bagge <martin.bagge@bthstudent.se>\n"
+"Language-Team: swedish <sv@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=ISO-8859-1\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Tj�nster som ska startas om f�r att f� dem att anv�nda de nya biblioteken:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Den h�r utg�van av OpenSSL r�ttar till ett antal s�kerhetsproblem. "
+"Tj�nsterna kommer inte att anv�nda dessa r�ttningar f�rr�n de har startats "
+"om. Observera att omstart av SSH-servern (sshd) inte kommer att p�verka "
+"befintliga anslutningar."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Unders�k listan �ver identifierade tj�nster som beh�ver startas om och g�r "
+"�ndringar i den om det beh�vs. Tj�nstenamnen m�ste vara identiska f�r "
+"initieringsskripten i /etc/init.d och m�ste separeras med blanksteg. Inga "
+"tj�nster kommer att startas om om listan �r tom."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Om andra tj�nster senare b�rjar att f� underliga problem efter denna "
+"uppgradering b�r de startas om.  Vi rekommenderar att du startar om din "
+"dator f�r att undvika SSL-relaterade problem."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Misslyckades med att starta om tj�nster f�r uppgraderingen av OpenSSL"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr "F�ljande tj�nster kunde inte startas om vid uppgraderingen av OpenSSL biblioteket:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr "Du m�ste starta om dessa tj�nster manuellt genom att k�ra '/etc/init.d/<service> start'"
+
--- openssl-0.9.8g.orig/debian/po/pt_BR.po
+++ openssl-0.9.8g/debian/po/pt_BR.po
@@ -0,0 +1,95 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans
+#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-04-18 22:26-0300\n"
+"Last-Translator: André Luís Lopes <andrelop@debian.org>\n"
+"Language-Team: Debian-BR Project <debian-l10n-portuguese@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr ""
+"Serviços a serem reiniciados para que possam utilizar as novas bibliotecas:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Esta versão do OpenSSL corrige alguns problemas de segurança. Os serviços "
+"não utilizarão essas correções até que sejam reiniciados. Por favor, note "
+"que reiniciar o servidor SSH (sshd) não fará com que nenhuma conexão SSH "
+"ativa seja afetada."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Por favor, confira a lista de serviços que precisam ser reiniciados "
+"detectados e corrija a mesma, caso necessário. Os nomes dos serviços devem "
+"ser idênticos aos scripts de inicialização dos mesmos localizados sob o "
+"diretório /etc/init.d e devem ser separados por espaços. Nenhum serviço será "
+"reiniciado caso a lista esteja vazia."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Qualquer serviço que falhar inesperadamente após esta atualização deverá ser "
+"reiniciado. É recomendado reiniciar este host para evitar qualquer problema "
+"relacionado a SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
--- openssl-0.9.8g.orig/debian/po/lt.po
+++ openssl-0.9.8g/debian/po/lt.po
@@ -0,0 +1,104 @@
+# translation of openssl_0.9.8b-2_templates.po to Lithuanian
+# opensll debconf translation templates.
+# Copyright (C) 2003 Christoph Martin <christoph.martin@uni-mainz.de>
+# This file is distributed under the same license as the openssl package.
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'#
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans#
+#    Developers do not need to manually edit POT or PO files.
+#
+# Gintautas Miliauskas <gintas@akl.lt>, 2006.
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl_0.9.8b-2_templates\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2006-06-19 01:32+0300\n"
+"Last-Translator: Gintautas Miliauskas <gintas@akl.lt>\n"
+"Language-Team: Lithuanian <komp_lt@konferencijos.lt>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.2\n"
+"Plural-Forms:  nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && (n%"
+"100<10 || n%100>=20) ? 1 : 2);\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+#, fuzzy
+msgid "Services to restart to make them use the new libraries:"
+msgstr ""
+"Kuriuos servisus norėtumėte paleisti iš naujo, kad jie naudotų naujas "
+"bibliotekas?"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+#, fuzzy
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Šioje versijoje ištaisytos saugumo skylės. Servisai nenaudos šių pataisymų, "
+"kol nebus iš naujo paleisti. Pastaba: sshd paleidimas iš naujo neturėtų "
+"turėti įtakos esamiems prisijungimams."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+#, fuzzy
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Pateiktas servisų, kuriuos reikėtų paleisti iš naujo, sąrašas. Jei matote "
+"klaidų, sąrašą pataisykite. Servisų vardai turi būti identiški atitinkamų "
+"paleidžiamųjų failų /etc/init.d kataloge vardams ir turi būti atskirti "
+"tarpais. Jei sąrašą paliksite tuščią, nė vienas servisas nebus iš naujo "
+"paleistas."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+#, fuzzy
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Jei kiti servisai po šio atnaujinimo sutriks, gali reikėti ir juos paleisti "
+"iš naujo. Rekomenduojame perkrauti sistemą, jei norite išvengti problemų, "
+"susijusių su SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
--- openssl-0.9.8g.orig/debian/po/pt.po
+++ openssl-0.9.8g/debian/po/pt.po
@@ -0,0 +1,88 @@
+# Portuguese translation for openssl's debconf messages
+# Copyright (C) 2007, Carlos Lisboa <carloslisboa@gmail.com>
+# This file is distributed under the same license as the openssl package.
+# Carlos Lisboa <carloslisboa@gmail.com>, 2007.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2008-04-10 20:36+0100\n"
+"Last-Translator: Carlos Lisboa <carloslisboa@gmail.com>\n"
+"Language-Team: Portuguese <traduz@debianpt.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Serviços a reiniciar para que usem as novas bibliotecas:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Este lançamento do OpenSSL resolve alguns problemas de segurança. Os "
+"serviços podem não usar as correcções até que sejam reiniciados. Note que "
+"reiniciar o servidor SSH (sshd) não deve afectar quaisquer ligações "
+"existentes."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Por favor verifique a lista de serviços detectados que necessitam de ser "
+"reiniciados e corrija-a, se necessário. Os nomes dos serviços devem ser "
+"idênticos aos nomes dos scripts de inicialização em /etc/init.d e separados "
+"por espaços. Nennhum serviço será reiniciado se a lista estiver vazia."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Qualquer serviço que mais tarde falhe de forma inesperada após esta "
+"actualização deverá ser reiniciado. É recomendado que reinicie este "
+"computador para evitar qualquer problema relacionado como SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Falha ao reiniciar alguns serviços para a actualização do OpenSSL"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"Os seguintes serviços não poderam ser reiniciados para a actualização "
+"da biblioteca OpenSSL:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"Terá que iniciá-los manualmente correndo '/etc/init.d/<serviço> start'."
--- openssl-0.9.8g.orig/debian/po/fr.po
+++ openssl-0.9.8g/debian/po/fr.po
@@ -0,0 +1,99 @@
+#
+#    Translators, if you are not familiar with the PO format, gettext
+#    documentation is worth reading, especially sections dedicated to
+#    this format, e.g. by running:
+#         info -n '(gettext)PO Files'
+#         info -n '(gettext)Header Entry'
+#    Some information specific to po-debconf are available at
+#            /usr/share/doc/po-debconf/README-trans
+#         or http://www.debian.org/intl/l10n/po-debconf/README-trans#
+#    Developers do not need to manually edit POT or PO files.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl_0.9.8e-4\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-11-11 18:47+0100\n"
+"Last-Translator: Michel Grentzinger <mic.grentz@online.fr>\n"
+"Language-Team: French <debian-l10n-french@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Services à redémarrer afin d'utiliser les nouvelles bibliothèques :"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Cette version d'OpenSSL corrige certaines failles de sécurité. Les services "
+"n'utiliseront pas ces correctifs tant qu'ils n'auront pas été redémarrés. "
+"Veuillez noter que le redémarrage du serveur SSH (sshd) n'affectera aucune "
+"connexion existante."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Veuillez vérifier et corriger si nécessaire la liste des services devant "
+"être redémarrés. Les noms des services doivent être identiques aux noms des "
+"scripts présents dans /etc/init.d et doivent être séparés par des espaces. "
+"Si la liste est vide, aucun service ne sera redémarré."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Si d'autres services ne fonctionnent plus correctement après cette mise à "
+"jour, ils devront être redémarrés. Il est fortement recommandé de redémarrer "
+"le système pour éviter les problèmes liés à SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+"Impossible de redémarrer certains services lors de la mise à jour d'OpenSSL"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"Les services suivants ne peuvent pas être redémarrés lors de la mise à jour "
+"de la bibliothèque OpenSSL :"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"Vous devrez les redémarrer vous-même avec la commande « /etc/init.d/"
+"<service> start »."
+
+#~ msgid "${services}"
+#~ msgstr "${services}"
--- openssl-0.9.8g.orig/debian/po/it.po
+++ openssl-0.9.8g/debian/po/it.po
@@ -0,0 +1,90 @@
+# openssl po-debconf translation to Italian (it)
+# Copyright (C) 2006 Software in the Public Interest
+# This file is distributed under the same license as the openssl package.
+# Luca Monducci <luca.mo@tiscali.it>, 2006-2008.
+# Giuseppe Sacco <eppesuig@debian.org>, 2007
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl 0.9.8g italian debconf templates\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2008-01-19 21:17+0100\n"
+"Last-Translator: Luca Monducci <luca.mo@tiscali.it>\n"
+"Language-Team: Italian <debian-l10n-italian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Servizi da riavviare per l'uso delle nuove librerie:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Questo rilascio di OpenSSL corregge alcuni problemi legati alla sicurezza, "
+"ma i servizi non utilizzeranno queste correzioni finché non verranno "
+"riavviati. Notare che il riavvio del server SSH (sshd) non ha effetti sulle "
+"connessioni attive."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Controllare ed eventualmente correggere l'elenco dei servizi che devono "
+"essere riavviati. Il nome dei servizi, separati da spazi, devono essere gli "
+"stessi degli script di inizializzazione che si trovano in /etc/init.d. Se "
+"l'elenco è vuoto non verrà riavviato nessun servizio."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Qualsiasi servizio che si bloccasse in maniera imprevista dopo questo "
+"aggiornamento dovrà essere riavviato. Si consiglia di riavviare la macchina "
+"per evitare qualsiasi problema legato a SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+"Errore nel riavvio di alcuni servizi per l'aggiornamento di OpenSSL"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"Non è stato possibile riavviare i seguenti servizi per l'aggiornamento "
+"di OpenSSL:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"È necessario avviarli manualmente con \"/etc/init.d/<servizio> start\"."
--- openssl-0.9.8g.orig/debian/po/gl.po
+++ openssl-0.9.8g/debian/po/gl.po
@@ -0,0 +1,88 @@
+# Galician translation of openssl's debconf templates.
+# This file is distributed under the same license as the openssl package.
+# Jacobo Tarrio <jtarrio@debian.org>, 2006, 2007, 2008.
+#
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2008-05-13 00:08+0100\n"
+"Last-Translator: Jacobo Tarrio <jtarrio@debian.org>\n"
+"Language-Team: Galician <proxecto@trasno.net>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Servizos a reiniciar para facer que empreguen as novas bibliotecas:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Esta versión de OpenSSL arranxa algúns fallos de seguridade. Os servizos non "
+"han ter eses fallos arranxados ata que se reinicien. Teña en conta que "
+"reiniciar o servidor de SSH (sshd) non debería afectar a ningunha conexión "
+"existente."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Verifique a lista de servizos detectados que hai que reiniciar e corríxaa se "
+"é preciso. Os nomes dos servizos deben ser idénticos aos nomes dos scripts "
+"de inicialización de /etc/init.d e deben ir separados por espazos. Non se ha "
+"reiniciar ningún servizo se a lista está baleira."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Tamén se debería reiniciar calquera servizo que falle de xeito inesperado "
+"trala actualización. Recoméndase reiniciar esta máquina para evitar "
+"experimentar problemas relacionados con SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Problemas ao reiniciar algúns servizos para a actualización de OpenSSL"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"Non se puido reiniciar os seguintes servizos para a actualización da "
+"biblioteca OpenSSL:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"Ha ter que reinicialos manualmente executando \"/etc/init.d/<servizo> start"
+"\"."
--- openssl-0.9.8g.orig/debian/po/zh_TW.po
+++ openssl-0.9.8g/debian/po/zh_TW.po
@@ -0,0 +1,78 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-04-18 01:10+0800\n"
+"Last-Translator: Tetralet <tetralet@gmail.com>\n"
+"Language-Team: Debian-user in Chinese [Big5] <debian-chinese-big5@lists."
+"debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "必須重新啟動才能使用新函式庫的服務程式："
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"這個 OpenSSL 的釋出版修正了一些安全上的問題。這些服務程式必須重新啟動否則無法"
+"套用這些修正。請注意到，重新啟動 SSH 服務程式 (sshd) 並不會影響到任何現有的連"
+"線。"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"請檢視被偵測到需重新啟動的服務程式之列表，有必要時請加以修正。這些服務程式名"
+"稱必須和 /etc/init.d 裡的初始化 Script 名稱一致，並以空白分隔。如果列表裡空無"
+"一物，就表示沒有服務程式會被重新啟動。"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"在此更新之後，必須將任何預料之外無法成功運行的服務程式重新啟動。建議重新啟動"
+"這台主機以避免發生任何 SSL 相關的問題。"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
--- openssl-0.9.8g.orig/debian/po/sk.po
+++ openssl-0.9.8g/debian/po/sk.po
@@ -0,0 +1,56 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl 0.9.8e-5\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2008-01-21 11:41+0100\n"
+"Last-Translator: Ivan Masár <helix84@centrum.sk>\n"
+"Language-Team: Slovak <sk-i18n@lists.linux.sk>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Služby, ktoré sa majú reštartovať, aby začali používať nové knižnice:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "This release of OpenSSL fixes some security issues. Services will not use these fixes until they are restarted. Please note that restarting the SSH server (sshd) should not affect any existing connections."
+msgstr "Táto verzia OpenSSL opravuje niektoré bezpečnostné problémy. Služby nezačnú používať tieto opravy až pokým nebudú reštartované. Prosím, pamätajte, že reštartovanie SSH servera (sshd) by nemalo mať vplyv na žiadne už nadviazané spojenia."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Please check the list of detected services that need to be restarted and correct it, if needed. The services names must be identical to the initialization script names in /etc/init.d and separated by spaces. No services will be restarted if the list is empty."
+msgstr "Prosím, skontrolujte zoznam zistených služieb, ktoré sa majú reštartovať a ak je to potrebné, opravte ho. Názvy služieb musia byť rovnaké ako názvy inicializačných skriptov v /etc/init.d a oddelené medzerami. Ak tento zoznam bude prázdny, žiadne služby sa nebudú reštartovať."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Any service that later fails unexpectedly after this upgrade should be restarted. It is recommended to reboot this host to avoid any SSL-related trouble."
+msgstr "Každá služba, ktorá po vykonaní tejto aktualizácie zlyhá, by mala byť reštartovaná. Odporúča sa reštartovať tento počítač, aby ste sa vyhli akýmkoľvek problémom týkajúcim sa SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Počas aktualizácie knižnice OpenSSL sa nepodarilo sa reštartovať niektoré služby."
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid "The following services could not be restarted for the OpenSSL library upgrade:"
+msgstr "Nasledovné služby nebolo možné reštartovať počas aktualizácie knižnice OpenSSL:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "You will need to start these manually by running '/etc/init.d/<service> start'."
+msgstr "Budete ich musieť reštartovať ručne spustením „/etc/init.d/<service> start“."
+
--- openssl-0.9.8g.orig/debian/po/ro.po
+++ openssl-0.9.8g/debian/po/ro.po
@@ -0,0 +1,93 @@
+# translation of ro.po to Romanian
+# Romanian translation of openssl.
+# Copyright (C) 2006 THE openssl'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the openssl package.
+#
+# Stan Ioan-Eugen <stan.ieugen@gmail.com>, 2006.
+# Eddy Petrișor <eddy.petrisor@gmail.com>, 2007, 2008.
+msgid ""
+msgstr ""
+"Project-Id-Version: ro\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2008-06-30 02:26+0300\n"
+"Last-Translator: Eddy Petrișor <eddy.petrisor@gmail.com>\n"
+"Language-Team: Romanian <debian-l10n-romanian@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=UTF-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Generator: KBabel 1.11.4\n"
+"Plural-Forms:  nplurals=3; plural=n==1 ? 0 : (n==0 || (n%100 > 0 && n%100 < 20)) ? 1 : 2;\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr "Serviciile repornite pentru a asigura folosirea noilor biblioteci:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Cu această nouă versiune s-au rezolvat probleme de securitate. Serviciile nu "
+"vor folosi aceste îmbunătățiri dacă nu sunt repornite. A se reține că "
+"repornirea serverului SSH (sshd) nu ar trebui să afecteze conexiunile deja "
+"existente."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Verificați și corectați, dacă este nevoie, lista cu serviciile detectate "
+"care ar trebui repornite. Numele serviciilor trebuie să fie identice cu "
+"numele scripturilor de inițializare din /etc/init.d și trebuie să fie "
+"separate prin spații. Dacă lista este goală, nu va fi repornit nici un "
+"serviciu."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Orice alt serviciu care prezintă probleme neașteptate după această "
+"actualizare, ar trebui repornit. Recomandăm să reporniți calculatorul pentru "
+"a evita probleme legate de SSL."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr "Eșec la repornirea unor servicii pentru actualizarea lui OpenSSL"
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr "Următoarele servicii nu au putut fi repornite pentru actualizarea bibliotecii OpenSSL:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"Va trebui să le porniți manual cu o comandă de tipul „/etc/init.d/<serviciu> "
+"start'."
+
--- openssl-0.9.8g.orig/debian/po/templates.pot
+++ openssl-0.9.8g/debian/po/templates.pot
@@ -0,0 +1,75 @@
+# SOME DESCRIPTIVE TITLE.
+# Copyright (C) YEAR THE PACKAGE'S COPYRIGHT HOLDER
+# This file is distributed under the same license as the PACKAGE package.
+# FIRST AUTHOR <EMAIL@ADDRESS>, YEAR.
+#
+#, fuzzy
+msgid ""
+msgstr ""
+"Project-Id-Version: PACKAGE VERSION\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
+"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
+"Language-Team: LANGUAGE <LL@li.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=CHARSET\n"
+"Content-Transfer-Encoding: 8bit\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
--- openssl-0.9.8g.orig/debian/po/fi.po
+++ openssl-0.9.8g/debian/po/fi.po
@@ -0,0 +1,92 @@
+msgid ""
+msgstr ""
+"Project-Id-Version: openssl_0.9.8e-8\n"
+"Report-Msgid-Bugs-To: openssl@packages.debian.org\n"
+"POT-Creation-Date: 2008-01-16 21:40+0100\n"
+"PO-Revision-Date: 2007-12-30 00:00+0200\n"
+"Last-Translator: Esko Arajärvi <edu@iki.fi>\n"
+"Language-Team: Finnish <debian-l10n-finnish@lists.debian.org>\n"
+"MIME-Version: 1.0\n"
+"Content-Type: text/plain; charset=utf-8\n"
+"Content-Transfer-Encoding: 8bit\n"
+"X-Poedit-Language: Finnish\n"
+"X-Poedit-Country: FINLAND\n"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid "Services to restart to make them use the new libraries:"
+msgstr ""
+"Palvelut, jotka käynnistetään uudelleen uusien kirjastojen käyttämiseksi:"
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"This release of OpenSSL fixes some security issues. Services will not use "
+"these fixes until they are restarted. Please note that restarting the SSH "
+"server (sshd) should not affect any existing connections."
+msgstr ""
+"Tämä OpenSSL:n julkaisu sisältää joitain turvapäivityksiä. Palvelut eivät "
+"käytä näitä päivityksiä ennen kuin ne on käynnistetty uudelleen. Huomaa, "
+"että SSH-palvelimen (sshd) uudelleenkäynnistyksen ei pitäisi vaikuttaa "
+"olemassa oleviin yhteyksiin."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Please check the list of detected services that need to be restarted and "
+"correct it, if needed. The services names must be identical to the "
+"initialization script names in /etc/init.d and separated by spaces. No "
+"services will be restarted if the list is empty."
+msgstr ""
+"Tarkista alla oleva lista löydetyistä palveluista, jotka pitää käynnistää "
+"uudelleen, ja korjaa sitä tarvittaessa. Palveluiden nimien pitää täsmätä "
+"hakemistossa /etc/init.d olevien alustustiedostojen nimiin ja olla "
+"välilyönnein eroteltuja. Jos lista on tyhjä, mitään palveluita ei "
+"käynnistetä uudelleen."
+
+#. Type: string
+#. Description
+#: ../libssl0.9.8.templates:1001
+msgid ""
+"Any service that later fails unexpectedly after this upgrade should be "
+"restarted. It is recommended to reboot this host to avoid any SSL-related "
+"trouble."
+msgstr ""
+"Palvelut, joissa esiintyy odottamattomia häiriöitä päivityksen jälkeen "
+"tulisi käynnistää uudelleen. On suositeltavaa käynnistää kone uudelleen SSL:"
+"än liittyvien ongelmien välttämiseksi."
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid "Failure restarting some services for OpenSSL upgrade"
+msgstr ""
+"Joidenkin palveluiden käynnistäminen uudelleen OpenSSL:n päivityksen "
+"yhteydessä epäonnistui."
+
+#. Type: error
+#. Description
+#. This paragraph is followed by a (non translatable) paragraph containing
+#. a list of services that could not be restarted
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"The following services could not be restarted for the OpenSSL library "
+"upgrade:"
+msgstr ""
+"Seuraavia palveluita ei voitu käynnistää uudelleen päivitettäessä OpenSSL-"
+"kirjasto:"
+
+#. Type: error
+#. Description
+#: ../libssl0.9.8.templates:2001
+msgid ""
+"You will need to start these manually by running '/etc/init.d/<service> "
+"start'."
+msgstr ""
+"Nämä tarvitsee käynnistää käsin ajamalla ”/etc/init.d/<palvelu> start”."
+
+#~ msgid "${services}"
+#~ msgstr "${services}"
--- openssl-0.9.8g.orig/tools/c_rehash.in
+++ openssl-0.9.8g/tools/c_rehash.in
@@ -59,12 +59,15 @@
 		}
 	}
 	closedir DIR;
-	FILE: foreach $fname (grep {/\.pem$/} @flist) {
+	FILE: foreach $fname (grep {/\.pem$|\.crt$/} @flist) {
 		# Check to see if certificates and/or CRLs present.
 		my ($cert, $crl) = check_file($fname);
 		if(!$cert && !$crl) {
-			print STDERR "WARNING: $fname does not contain a certificate or CRL: skipping\n";
-			next;
+			($cert, $crl) = check_file("$openssl x509 -in \"$fname\" -inform der  -outform pem | ");
+			if(!$cert && !$crl) {
+				print STDERR "WARNING: $fname does not contain a certificate or CRL: skipping\n";
+				next;
+			}
 		}
 		link_hash_cert($fname) if($cert);
 		link_hash_crl($fname) if($crl);
@@ -102,6 +105,9 @@
 		my $fname = $_[0];
 		$fname =~ s/'/'\\''/g;
 		my ($hash, $fprint) = `"$openssl" x509 -hash -fingerprint -noout -in '$fname'`;
+		if(!$hash || !fprint) {
+			($hash, $fprint) = `"$openssl" x509 -hash -fingerprint -noout -in '$fname' -inform der`;
+		}
 		chomp $hash;
 		chomp $fprint;
 		$fprint =~ s/^.*=//;
--- openssl-0.9.8g.orig/tools/c_rehash
+++ openssl-0.9.8g/tools/c_rehash
@@ -6,7 +6,7 @@
 
 my $openssl;
 
-my $dir = "/usr/local/ssl";
+my $dir = "/usr/lib/ssl";
 
 if(defined $ENV{OPENSSL}) {
 	$openssl = $ENV{OPENSSL};
@@ -59,12 +59,15 @@
 		}
 	}
 	closedir DIR;
-	FILE: foreach $fname (grep {/\.pem$/} @flist) {
+	FILE: foreach $fname (grep {/\.pem$|\.crt$/} @flist) {
 		# Check to see if certificates and/or CRLs present.
 		my ($cert, $crl) = check_file($fname);
 		if(!$cert && !$crl) {
-			print STDERR "WARNING: $fname does not contain a certificate or CRL: skipping\n";
-			next;
+			($cert, $crl) = check_file("$openssl x509 -in \"$fname\" -inform der  -outform pem | ");
+			if(!$cert && !$crl) {
+				print STDERR "WARNING: $fname does not contain a certificate or CRL: skipping\n";
+				next;
+			}
 		}
 		link_hash_cert($fname) if($cert);
 		link_hash_crl($fname) if($crl);
@@ -102,6 +105,9 @@
 		my $fname = $_[0];
 		$fname =~ s/'/'\\''/g;
 		my ($hash, $fprint) = `"$openssl" x509 -hash -fingerprint -noout -in '$fname'`;
+		if(!$hash || !fprint) {
+			($hash, $fprint) = `"$openssl" x509 -hash -fingerprint -noout -in '$fname' -inform der`;
+		}
 		chomp $hash;
 		chomp $fprint;
 		$fprint =~ s/^.*=//;
--- openssl-0.9.8g.orig/demos/tunala/configure.in
+++ openssl-0.9.8g/demos/tunala/configure.in
@@ -1,4 +1,4 @@
-dnl Process this file with autoconf to produce a configure script.
+#!/usr/local/bin/perl
 AC_INIT(tunala.c)
 AM_CONFIG_HEADER(config.h)
 AM_INIT_AUTOMAKE(tunala, 0.0.1-dev)
--- openssl-0.9.8g.orig/ms/uplink.pl
+++ openssl-0.9.8g/ms/uplink.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!/usr/local/bin/perl
 #
 # For Microsoft CL this is implemented as inline assembler. So that
 # even though this script can generate even Win32 code, we'll be
--- openssl-0.9.8g.orig/crypto/x86cpuid.pl
+++ openssl-0.9.8g/crypto/x86cpuid.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!/usr/local/bin/perl
 
 push(@INC,"perlasm");
 require "x86asm.pl";
--- openssl-0.9.8g.orig/crypto/opensslconf.h
+++ openssl-0.9.8g/crypto/opensslconf.h
@@ -10,6 +10,9 @@
 #ifndef OPENSSL_NO_GMP
 # define OPENSSL_NO_GMP
 #endif
+#ifndef OPENSSL_NO_IDEA
+# define OPENSSL_NO_IDEA
+#endif
 #ifndef OPENSSL_NO_KRB5
 # define OPENSSL_NO_KRB5
 #endif
@@ -25,11 +28,11 @@
 #ifndef OPENSSL_NO_SEED
 # define OPENSSL_NO_SEED
 #endif
-#ifndef OPENSSL_NO_TLSEXT
-# define OPENSSL_NO_TLSEXT
-#endif
 
 #endif /* OPENSSL_DOING_MAKEDEPEND */
+#ifndef OPENSSL_THREADS
+# define OPENSSL_THREADS
+#endif
 #ifndef OPENSSL_NO_DYNAMIC_ENGINE
 # define OPENSSL_NO_DYNAMIC_ENGINE
 #endif
@@ -45,6 +48,9 @@
 # if defined(OPENSSL_NO_GMP) && !defined(NO_GMP)
 #  define NO_GMP
 # endif
+# if defined(OPENSSL_NO_IDEA) && !defined(NO_IDEA)
+#  define NO_IDEA
+# endif
 # if defined(OPENSSL_NO_KRB5) && !defined(NO_KRB5)
 #  define NO_KRB5
 # endif
@@ -60,11 +66,10 @@
 # if defined(OPENSSL_NO_SEED) && !defined(NO_SEED)
 #  define NO_SEED
 # endif
-# if defined(OPENSSL_NO_TLSEXT) && !defined(NO_TLSEXT)
-#  define NO_TLSEXT
-# endif
 #endif
 
+#define OPENSSL_CPUID_OBJ
+
 /* crypto/opensslconf.h.in */
 
 /* Generate 80386 code? */
@@ -72,8 +77,8 @@
 
 #if !(defined(VMS) || defined(__VMS)) /* VMS uses logical names instead */
 #if defined(HEADER_CRYPTLIB_H) && !defined(OPENSSLDIR)
-#define ENGINESDIR "/usr/local/ssl/lib/engines"
-#define OPENSSLDIR "/usr/local/ssl"
+#define ENGINESDIR "/usr/lib/ssl/engines"
+#define OPENSSLDIR "/usr/lib/ssl"
 #endif
 #endif
 
@@ -104,14 +109,14 @@
  * - Intel P6 because partial register stalls are very expensive;
  * - elder Alpha because it lacks byte load/store instructions;
  */
-#define RC4_INT unsigned int
+#define RC4_INT unsigned char
 #endif
 #if !defined(RC4_CHUNK)
 /*
  * This enables code handling data aligned at natural CPU word
  * boundary. See crypto/rc4/rc4_enc.c for further details.
  */
-#undef RC4_CHUNK
+#define RC4_CHUNK unsigned long
 #endif
 #endif
 
@@ -119,7 +124,7 @@
 /* If this is set to 'unsigned int' on a DEC Alpha, this gives about a
  * %20 speed up (longs are 8 bytes, int's are 4). */
 #ifndef DES_LONG
-#define DES_LONG unsigned long
+#define DES_LONG unsigned int
 #endif
 #endif
 
@@ -133,9 +138,9 @@
 /* The prime number generation stuff may not work when
  * EIGHT_BIT but I don't care since I've only used this mode
  * for debuging the bignum libraries */
-#undef SIXTY_FOUR_BIT_LONG
+#define SIXTY_FOUR_BIT_LONG
 #undef SIXTY_FOUR_BIT
-#define THIRTY_TWO_BIT
+#undef THIRTY_TWO_BIT
 #undef SIXTEEN_BIT
 #undef EIGHT_BIT
 #endif
@@ -149,7 +154,7 @@
 
 #if defined(HEADER_BF_LOCL_H) && !defined(CONFIG_HEADER_BF_LOCL_H)
 #define CONFIG_HEADER_BF_LOCL_H
-#undef BF_PTR
+#define BF_PTR2
 #endif /* HEADER_BF_LOCL_H */
 
 #if defined(HEADER_DES_LOCL_H) && !defined(CONFIG_HEADER_DES_LOCL_H)
@@ -179,7 +184,7 @@
 /* Unroll the inner loop, this sometimes helps, sometimes hinders.
  * Very mucy CPU dependant */
 #ifndef DES_UNROLL
-#undef DES_UNROLL
+#define DES_UNROLL
 #endif
 
 /* These default values were supplied by
--- openssl-0.9.8g.orig/crypto/Makefile
+++ openssl-0.9.8g/crypto/Makefile
@@ -57,7 +57,7 @@
 	echo "  #define DATE \"`LC_ALL=C LC_TIME=C date`\""; \
 	echo '#endif' ) >buildinf.h
 
-x86cpuid-elf.s:	x86cpuid.pl perlasm/x86asm.pl
+x86cpuid-elf.S:	x86cpuid.pl perlasm/x86asm.pl
 	$(PERL) x86cpuid.pl elf $(CFLAGS) $(PROCESSOR) > $@
 x86cpuid-cof.s: x86cpuid.pl perlasm/x86asm.pl
 	$(PERL) x86cpuid.pl coff $(CFLAGS) $(PROCESSOR) > $@
@@ -70,7 +70,7 @@
 uplink-cof.s:	../ms/uplink.pl
 	$(PERL) ../ms/uplink.pl coff > $@
 
-x86_64cpuid.s: x86_64cpuid.pl
+x86_64cpuid.S: x86_64cpuid.pl
 	$(PERL) x86_64cpuid.pl $@
 ia64cpuid.s: ia64cpuid.S
 	$(CC) $(CFLAGS) -E ia64cpuid.S > $@
--- openssl-0.9.8g.orig/crypto/x86_64cpuid.pl
+++ openssl-0.9.8g/crypto/x86_64cpuid.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!/usr/local/bin/perl
 
 $output=shift;
 $win64a=1 if ($output =~ /win64a\.[s|asm]/);
@@ -134,5 +134,9 @@
 .size	OPENSSL_ia32_cpuid,.-OPENSSL_ia32_cpuid
 
 .section	.init
+#ifdef OPENSSL_PIC
+	call	OPENSSL_cpuid_setup\@PLT
+#else
 	call	OPENSSL_cpuid_setup
+#endif
 ___
--- openssl-0.9.8g.orig/crypto/ecdsa/ecs_ossl.c
+++ openssl-0.9.8g/crypto/ecdsa/ecs_ossl.c
@@ -144,6 +144,14 @@
 			}
 		while (BN_is_zero(k));
 
+		/* We do not want timing information to leak the length of k,
+		 * so we compute G*k using an equivalent scalar of fixed
+		 * bit-length. */
+
+		if (!BN_add(k, k, order)) goto err;
+		if (BN_num_bits(k) <= BN_num_bits(order))
+			if (!BN_add(k, k, order)) goto err;
+
 		/* compute r the x-coordinate of generator * k */
 		if (!EC_POINT_mul(group, tmp_point, k, NULL, NULL, ctx))
 		{
--- openssl-0.9.8g.orig/crypto/md5/asm/md5-x86_64.pl
+++ openssl-0.9.8g/crypto/md5/asm/md5-x86_64.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/perl -w
+#!/usr/local/bin/perl
 #
 # MD5 optimized for AMD64.
 #
--- openssl-0.9.8g.orig/crypto/md5/asm/md5-sparcv9.S
+++ openssl-0.9.8g/crypto/md5/asm/md5-sparcv9.S
@@ -74,14 +74,14 @@
 #define Dval	R8
 
 #if defined(MD5_BLOCK_DATA_ORDER)
-# if defined(OPENSSL_SYSNAME_ULTRASPARC)
+/*# if defined(OPENSSL_SYSNAME_ULTRASPARC)*/
 #  define	LOAD			lda
 #  define	X(i)			[%i1+i*4]%asi
 #  define	md5_block		md5_block_asm_data_order_aligned
 #  define	ASI_PRIMARY_LITTLE	0x88
-# else
+/*# else
 #  error "MD5_BLOCK_DATA_ORDER is supported only on UltraSPARC!"
-# endif
+# endif*/
 #else
 # define	LOAD			ld
 # define	X(i)			[%i1+i*4]
--- openssl-0.9.8g.orig/crypto/pkcs7/pk7_mime.c
+++ openssl-0.9.8g/crypto/pkcs7/pk7_mime.c
@@ -335,9 +335,9 @@
 
 		if(strcmp(hdr->value, "application/x-pkcs7-signature") &&
 			strcmp(hdr->value, "application/pkcs7-signature")) {
-			sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 			PKCS7err(PKCS7_F_SMIME_READ_PKCS7,PKCS7_R_SIG_INVALID_MIME_TYPE);
 			ERR_add_error_data(2, "type: ", hdr->value);
+			sk_MIME_HEADER_pop_free(headers, mime_hdr_free);
 			sk_BIO_pop_free(parts, BIO_vfree);
 			return NULL;
 		}
--- openssl-0.9.8g.orig/crypto/des/asm/desboth.pl
+++ openssl-0.9.8g/crypto/des/asm/desboth.pl
@@ -16,6 +16,11 @@
 
 	&push("edi");
 
+	&call   (&label("pic_point0"));
+	&set_label("pic_point0");
+	&blindpop("ebp");
+	&add    ("ebp", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point0") . "]");
+
 	&comment("");
 	&comment("Load the data words");
 	&mov($L,&DWP(0,"ebx","",0));
@@ -47,15 +52,21 @@
 	&mov(&swtmp(2),	(DWC(($enc)?"1":"0")));
 	&mov(&swtmp(1),	"eax");
 	&mov(&swtmp(0),	"ebx");
-	&call("DES_encrypt2");
+	&exch("ebx", "ebp");
+	&call("DES_encrypt2\@PLT");
+	&exch("ebx", "ebp");
 	&mov(&swtmp(2),	(DWC(($enc)?"0":"1")));
 	&mov(&swtmp(1),	"edi");
 	&mov(&swtmp(0),	"ebx");
-	&call("DES_encrypt2");
+	&exch("ebx", "ebp");
+	&call("DES_encrypt2\@PLT");
+	&exch("ebx", "ebp");
 	&mov(&swtmp(2),	(DWC(($enc)?"1":"0")));
 	&mov(&swtmp(1),	"esi");
 	&mov(&swtmp(0),	"ebx");
-	&call("DES_encrypt2");
+	&exch("ebx", "ebp");
+	&call("DES_encrypt2\@PLT");
+	&exch("ebx", "ebp");
 
 	&stack_pop(3);
 	&mov($L,&DWP(0,"ebx","",0));
--- openssl-0.9.8g.orig/crypto/sha/sha.h
+++ openssl-0.9.8g/crypto/sha/sha.h
@@ -59,6 +59,7 @@
 #ifndef HEADER_SHA_H
 #define HEADER_SHA_H
 
+#include <stddef.h>
 #include <openssl/e_os2.h>
 #include <stddef.h>
 
--- openssl-0.9.8g.orig/crypto/sha/asm/sha1-ia64.pl
+++ openssl-0.9.8g/crypto/sha/asm/sha1-ia64.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!/usr/local/bin/perl
 #
 # ====================================================================
 # Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
--- openssl-0.9.8g.orig/crypto/sha/asm/sha512-sse2.pl
+++ openssl-0.9.8g/crypto/sha/asm/sha512-sse2.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!/usr/local/bin/perl
 #
 # ====================================================================
 # Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
--- openssl-0.9.8g.orig/crypto/sha/asm/sha512-ia64.pl
+++ openssl-0.9.8g/crypto/sha/asm/sha512-ia64.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!/usr/local/bin/perl
 #
 # ====================================================================
 # Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
--- openssl-0.9.8g.orig/crypto/perlasm/x86unix.pl
+++ openssl-0.9.8g/crypto/perlasm/x86unix.pl
@@ -399,6 +399,29 @@
 	$stack=4;
 	}
 
+sub main'function_begin_B_static
+	{
+	local($func,$extra)=@_;
+
+	&main'external_label($func);
+	$func=$under.$func;
+
+	local($tmp)=<<"EOF";
+.text
+EOF
+	push(@out,$tmp);
+	if ($main'cpp)
+		{ push(@out,"TYPE($func,\@function)\n"); }
+	elsif ($main'coff)
+		{ $tmp=push(@out,".def\t$func;\t.scl\t2;\t.type\t32;\t.endef\n"); }
+	elsif ($main'aout and !$main'pic)
+		{ }
+	else	{ push(@out,".type	$func,\@function\n"); }
+	push(@out,".align\t$align\n");
+	push(@out,"$func:\n");
+	$stack=4;
+	}
+
 sub main'function_end
 	{
 	local($func)=@_;
@@ -730,7 +753,17 @@
 		{
 		$tmp=<<___;
 .section	.init
+#ifdef OPENSSL_PIC
+	pushl	%ebx
+	call    .pic_point0
+.pic_point0:
+	popl    %ebx
+	addl    \$_GLOBAL_OFFSET_TABLE_+[.-.pic_point0],%ebx
+	call	$under$f\@PLT
+	popl	%ebx
+#else
 	call	$under$f
+#endif
 	jmp	.Linitalign
 .align	$align
 .Linitalign:
--- openssl-0.9.8g.orig/crypto/perlasm/x86_64-xlate.pl
+++ openssl-0.9.8g/crypto/perlasm/x86_64-xlate.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!/usr/local/bin/perl
 
 # Ascetic x86_64 AT&T to MASM assembler translator by <appro>.
 #
--- openssl-0.9.8g.orig/crypto/perlasm/cbc.pl
+++ openssl-0.9.8g/crypto/perlasm/cbc.pl
@@ -122,7 +122,11 @@
 	&mov(&DWP($data_off,"esp","",0),	"eax");	# put in array for call
 	&mov(&DWP($data_off+4,"esp","",0),	"ebx");	#
 
-	&call($enc_func);
+	&call	(&label("pic_point0"));
+	&set_label("pic_point0");
+	&blindpop("ebx");
+	&add	("ebx", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point0") . "]");
+	&call("$enc_func\@PLT");
 
 	&mov("eax",	&DWP($data_off,"esp","",0));
 	&mov("ebx",	&DWP($data_off+4,"esp","",0));
@@ -187,7 +191,11 @@
 	&mov(&DWP($data_off,"esp","",0),	"eax");	# put in array for call
 	&mov(&DWP($data_off+4,"esp","",0),	"ebx");	#
 
-	&call($enc_func);
+	&call	(&label("pic_point1"));
+	&set_label("pic_point1");
+	&blindpop("ebx");
+	&add	("ebx", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point1") . "]");
+	&call("$enc_func\@PLT");
 
 	&mov("eax",	&DWP($data_off,"esp","",0));
 	&mov("ebx",	&DWP($data_off+4,"esp","",0));
@@ -220,7 +228,11 @@
 	&mov(&DWP($data_off,"esp","",0),	"eax");	# put back
 	&mov(&DWP($data_off+4,"esp","",0),	"ebx");	#
 
-	&call($dec_func);
+	&call	(&label("pic_point2"));
+	&set_label("pic_point2");
+	&blindpop("ebx");
+	&add	("ebx", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point2") . "]");
+	&call("$dec_func\@PLT");
 
 	&mov("eax",	&DWP($data_off,"esp","",0));	# get return
 	&mov("ebx",	&DWP($data_off+4,"esp","",0));	#
@@ -263,7 +275,11 @@
 	&mov(&DWP($data_off,"esp","",0),	"eax");	# put back
 	&mov(&DWP($data_off+4,"esp","",0),	"ebx");	#
 
-	&call($dec_func);
+	&call	(&label("pic_point3"));
+	&set_label("pic_point3");
+	&blindpop("ebx");
+	&add	("ebx", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point3") . "]");
+	&call("$dec_func\@PLT");
 
 	&mov("eax",	&DWP($data_off,"esp","",0));	# get return
 	&mov("ebx",	&DWP($data_off+4,"esp","",0));	#
--- openssl-0.9.8g.orig/crypto/rand/md_rand.c
+++ openssl-0.9.8g/crypto/rand/md_rand.c
@@ -465,8 +465,10 @@
 		MD_Update(&m,local_md,MD_DIGEST_LENGTH);
 		MD_Update(&m,(unsigned char *)&(md_c[0]),sizeof(md_c));
 #ifndef PURIFY
+#if 0 /* Don't add uninitialised data. */
 		MD_Update(&m,buf,j); /* purify complains */
 #endif
+#endif
 		k=(st_idx+MD_DIGEST_LENGTH/2)-st_num;
 		if (k > 0)
 			{
--- openssl-0.9.8g.orig/crypto/evp/c_alld.c
+++ openssl-0.9.8g/crypto/evp/c_alld.c
@@ -64,9 +64,6 @@
 
 void OpenSSL_add_all_digests(void)
 	{
-#ifndef OPENSSL_NO_MD2
-	EVP_add_digest(EVP_md2());
-#endif
 #ifndef OPENSSL_NO_MD4
 	EVP_add_digest(EVP_md4());
 #endif
--- openssl-0.9.8g.orig/crypto/pqueue/pqueue.h
+++ openssl-0.9.8g/crypto/pqueue/pqueue.h
@@ -91,5 +91,6 @@
 pitem *pqueue_next(piterator *iter);
 
 void   pqueue_print(pqueue pq);
+int    pqueue_size(pqueue pq);
 
 #endif /* ! HEADER_PQUEUE_H */
--- openssl-0.9.8g.orig/crypto/pqueue/pqueue.c
+++ openssl-0.9.8g/crypto/pqueue/pqueue.c
@@ -234,3 +234,17 @@
 
 	return ret;
 	}
+
+int
+pqueue_size(pqueue_s *pq)
+{
+	pitem *item = pq->items;
+	int count = 0;
+	
+	while(item != NULL)
+	{
+		count++;
+		item = item->next;
+	}
+	return count;
+}
--- openssl-0.9.8g.orig/crypto/ec/ec2_smpl.c
+++ openssl-0.9.8g/crypto/ec/ec2_smpl.c
@@ -174,8 +174,10 @@
 	dest->poly[2] = src->poly[2];
 	dest->poly[3] = src->poly[3];
 	dest->poly[4] = src->poly[4];
-	bn_wexpand(&dest->a, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2);
-	bn_wexpand(&dest->b, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2);
+	if(bn_wexpand(&dest->a, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL)
+		return 0;
+	if(bn_wexpand(&dest->b, (int)(dest->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL)
+		return 0;
 	for (i = dest->a.top; i < dest->a.dmax; i++) dest->a.d[i] = 0;
 	for (i = dest->b.top; i < dest->b.dmax; i++) dest->b.d[i] = 0;
 	return 1;
@@ -199,12 +201,12 @@
 
 	/* group->a */
 	if (!BN_GF2m_mod_arr(&group->a, a, group->poly)) goto err;
-	bn_wexpand(&group->a, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2);
+	if(bn_wexpand(&group->a, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) goto err;
 	for (i = group->a.top; i < group->a.dmax; i++) group->a.d[i] = 0;
 	
 	/* group->b */
 	if (!BN_GF2m_mod_arr(&group->b, b, group->poly)) goto err;
-	bn_wexpand(&group->b, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2);
+	if(bn_wexpand(&group->b, (int)(group->poly[0] + BN_BITS2 - 1) / BN_BITS2) == NULL) goto err;
 	for (i = group->b.top; i < group->b.dmax; i++) group->b.d[i] = 0;
 		
 	ret = 1;
--- openssl-0.9.8g.orig/crypto/asn1/charmap.pl
+++ openssl-0.9.8g/crypto/asn1/charmap.pl
@@ -1,4 +1,4 @@
-#!/usr/local/bin/perl -w
+#!/usr/local/bin/perl
 
 use strict;
 
--- openssl-0.9.8g.orig/crypto/asn1/tasn_dec.c
+++ openssl-0.9.8g/crypto/asn1/tasn_dec.c
@@ -1012,6 +1012,18 @@
 		case V_ASN1_SET:
 		case V_ASN1_SEQUENCE:
 		default:
+		if (utype == V_ASN1_BMPSTRING && (len & 1))
+			{
+			ASN1err(ASN1_F_ASN1_EX_C2I,
+					ASN1_R_BMPSTRING_IS_WRONG_LENGTH);
+			goto err;
+			}
+		if (utype == V_ASN1_UNIVERSALSTRING && (len & 3))
+			{
+			ASN1err(ASN1_F_ASN1_EX_C2I,
+					ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH);
+			goto err;
+			}
 		/* All based on ASN1_STRING and handled the same */
 		if (!*pval)
 			{
--- openssl-0.9.8g.orig/crypto/asn1/asn1.h
+++ openssl-0.9.8g/crypto/asn1/asn1.h
@@ -1179,6 +1179,7 @@
 #define ASN1_R_BAD_OBJECT_HEADER			 102
 #define ASN1_R_BAD_PASSWORD_READ			 103
 #define ASN1_R_BAD_TAG					 104
+#define ASN1_R_BMPSTRING_IS_WRONG_LENGTH		 210
 #define ASN1_R_BN_LIB					 105
 #define ASN1_R_BOOLEAN_IS_WRONG_LENGTH			 106
 #define ASN1_R_BUFFER_TOO_SMALL				 107
@@ -1258,6 +1259,7 @@
 #define ASN1_R_UNABLE_TO_DECODE_RSA_KEY			 157
 #define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY		 158
 #define ASN1_R_UNEXPECTED_EOC				 159
+#define ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH		 211
 #define ASN1_R_UNKNOWN_FORMAT				 160
 #define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM		 161
 #define ASN1_R_UNKNOWN_OBJECT_TYPE			 162
--- openssl-0.9.8g.orig/crypto/asn1/asn1_err.c
+++ openssl-0.9.8g/crypto/asn1/asn1_err.c
@@ -188,6 +188,7 @@
 {ERR_REASON(ASN1_R_BAD_OBJECT_HEADER)    ,"bad object header"},
 {ERR_REASON(ASN1_R_BAD_PASSWORD_READ)    ,"bad password read"},
 {ERR_REASON(ASN1_R_BAD_TAG)              ,"bad tag"},
+{ERR_REASON(ASN1_R_BMPSTRING_IS_WRONG_LENGTH),"bmpstring is wrong length"},
 {ERR_REASON(ASN1_R_BN_LIB)               ,"bn lib"},
 {ERR_REASON(ASN1_R_BOOLEAN_IS_WRONG_LENGTH),"boolean is wrong length"},
 {ERR_REASON(ASN1_R_BUFFER_TOO_SMALL)     ,"buffer too small"},
@@ -267,6 +268,7 @@
 {ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_KEY),"unable to decode rsa key"},
 {ERR_REASON(ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY),"unable to decode rsa private key"},
 {ERR_REASON(ASN1_R_UNEXPECTED_EOC)       ,"unexpected eoc"},
+{ERR_REASON(ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH),"universalstring is wrong length"},
 {ERR_REASON(ASN1_R_UNKNOWN_FORMAT)       ,"unknown format"},
 {ERR_REASON(ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM),"unknown message digest algorithm"},
 {ERR_REASON(ASN1_R_UNKNOWN_OBJECT_TYPE)  ,"unknown object type"},
--- openssl-0.9.8g.orig/crypto/comp/c_zlib.c
+++ openssl-0.9.8g/crypto/comp/c_zlib.c
@@ -133,15 +133,6 @@
 
 static int zlib_stateful_ex_idx = -1;
 
-static void zlib_stateful_free_ex_data(void *obj, void *item,
-	CRYPTO_EX_DATA *ad, int ind,long argl, void *argp)
-	{
-	struct zlib_state *state = (struct zlib_state *)item;
-	inflateEnd(&state->istream);
-	deflateEnd(&state->ostream);
-	OPENSSL_free(state);
-	}
-
 static int zlib_stateful_init(COMP_CTX *ctx)
 	{
 	int err;
@@ -185,6 +176,12 @@
 
 static void zlib_stateful_finish(COMP_CTX *ctx)
 	{
+	struct zlib_state *state =
+		(struct zlib_state *)CRYPTO_get_ex_data(&ctx->ex_data,
+			zlib_stateful_ex_idx);
+	inflateEnd(&state->istream);
+	deflateEnd(&state->ostream);
+	OPENSSL_free(state);
 	CRYPTO_free_ex_data(CRYPTO_EX_INDEX_COMP,ctx,&ctx->ex_data);
 	}
 
@@ -396,7 +393,7 @@
 			if (zlib_stateful_ex_idx == -1)
 				zlib_stateful_ex_idx =
 					CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_COMP,
-						0,NULL,NULL,NULL,zlib_stateful_free_ex_data);
+						0,NULL,NULL,NULL,NULL);
 			CRYPTO_w_unlock(CRYPTO_LOCK_COMP);
 			if (zlib_stateful_ex_idx == -1)
 				goto err;
--- openssl-0.9.8g.orig/crypto/x509v3/v3_utl.c
+++ openssl-0.9.8g/crypto/x509v3/v3_utl.c
@@ -712,17 +712,20 @@
 
 	/* Format result */
 
-	/* Copy initial part */
-	if (v6stat.zero_pos > 0)
+	if (v6stat.zero_pos >= 0)
+		{
+		/* Copy initial part */
 		memcpy(v6, v6stat.tmp, v6stat.zero_pos);
-	/* Zero middle */
-	if (v6stat.total != 16)
+		/* Zero middle */
 		memset(v6 + v6stat.zero_pos, 0, 16 - v6stat.total);
-	/* Copy final part */
-	if (v6stat.total != v6stat.zero_pos)
-		memcpy(v6 + v6stat.zero_pos + 16 - v6stat.total,
-			v6stat.tmp + v6stat.zero_pos,
-			v6stat.total - v6stat.zero_pos);
+		/* Copy final part */
+		if (v6stat.total != v6stat.zero_pos)
+			memcpy(v6 + v6stat.zero_pos + 16 - v6stat.total,
+				v6stat.tmp + v6stat.zero_pos,
+				v6stat.total - v6stat.zero_pos);
+		}
+	else
+		memcpy(v6, v6stat.tmp, 16);
 
 	return 1;
 	}
--- openssl-0.9.8g.orig/crypto/x509/x509_vfy.c
+++ openssl-0.9.8g/crypto/x509/x509_vfy.c
@@ -78,6 +78,7 @@
 static int check_revocation(X509_STORE_CTX *ctx);
 static int check_cert(X509_STORE_CTX *ctx);
 static int check_policy(X509_STORE_CTX *ctx);
+static int check_ca_blacklist(X509_STORE_CTX *ctx);
 static int internal_verify(X509_STORE_CTX *ctx);
 const char X509_version[]="X.509" OPENSSL_VERSION_PTEXT;
 
@@ -312,6 +313,9 @@
 		ok=internal_verify(ctx);
 	if(!ok) goto end;
 
+	ok = check_ca_blacklist(ctx);
+	if(!ok) goto end;
+
 #ifndef OPENSSL_NO_RFC3779
 	/* RFC 3779 path validation, now that CRL check has been done */
 	ok = v3_asid_validate_path(ctx);
@@ -657,6 +661,29 @@
 	return 1;
 	}
 
+static int check_ca_blacklist(X509_STORE_CTX *ctx)
+	{
+	X509 *x;
+	int i;
+	/* Check all certificates against the blacklist */
+	for (i = sk_X509_num(ctx->chain) - 1; i >= 0; i--)
+		{
+		x = sk_X509_value(ctx->chain, i);
+		/* Mark DigiNotar certificates as revoked, no matter
+		 * where in the chain they are.
+		 */
+		if (x->name && strstr(x->name, "DigiNotar"))
+			{
+			ctx->error = X509_V_ERR_CERT_REVOKED;
+			ctx->error_depth = i;
+			ctx->current_cert = x;
+			if (!ctx->verify_cb(0,ctx))
+				return 0;
+			}
+		}
+	return 1;
+	}
+
 /* Lookup CRLs from the supplied list. Look for matching isser name
  * and validity. If we can't find a valid CRL return the last one
  * with matching name. This gives more meaningful error codes. Otherwise
@@ -982,7 +1009,11 @@
 	while (n >= 0)
 		{
 		ctx->error_depth=n;
-		if (!xs->valid)
+
+		/* Skip signature check for self signed certificates. It
+		 * doesn't add any security and just wastes time.
+		 */
+		if (!xs->valid && xs != xi)
 			{
 			if ((pkey=X509_get_pubkey(xi)) == NULL)
 				{
@@ -992,13 +1023,6 @@
 				if (!ok) goto end;
 				}
 			else if (X509_verify(xs,pkey) <= 0)
-				/* XXX  For the final trusted self-signed cert,
-				 * this is a waste of time.  That check should
-				 * optional so that e.g. 'openssl x509' can be
-				 * used to detect invalid self-signatures, but
-				 * we don't verify again and again in SSL
-				 * handshakes and the like once the cert has
-				 * been declared trusted. */
 				{
 				ctx->error=X509_V_ERR_CERT_SIGNATURE_FAILURE;
 				ctx->current_cert=xs;
--- openssl-0.9.8g.orig/crypto/rc4/asm/rc4-x86_64.pl
+++ openssl-0.9.8g/crypto/rc4/asm/rc4-x86_64.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!/usr/local/bin/perl
 #
 # ====================================================================
 # Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
--- openssl-0.9.8g.orig/crypto/engine/eng_table.c
+++ openssl-0.9.8g/crypto/engine/eng_table.c
@@ -135,7 +135,7 @@
 			{
 			fnd = OPENSSL_malloc(sizeof(ENGINE_PILE));
 			if(!fnd) goto end;
-			fnd->uptodate = 0;
+			fnd->uptodate = 1;
 			fnd->nid = *nids;
 			fnd->sk = sk_ENGINE_new_null();
 			if(!fnd->sk)
@@ -152,7 +152,7 @@
 		if(!sk_ENGINE_push(fnd->sk, e))
 			goto end;
 		/* "touch" this ENGINE_PILE */
-		fnd->uptodate = 1;
+		fnd->uptodate = 0;
 		if(setdefault)
 			{
 			if(!engine_unlocked_init(e))
@@ -164,6 +164,7 @@
 			if(fnd->funct)
 				engine_unlocked_finish(fnd->funct, 0);
 			fnd->funct = e;
+			fnd->uptodate = 1;
 			}
 		nids++;
 		}
@@ -179,8 +180,7 @@
 	while((n = sk_ENGINE_find(pile->sk, e)) >= 0)
 		{
 		(void)sk_ENGINE_delete(pile->sk, n);
-		/* "touch" this ENGINE_CIPHER */
-		pile->uptodate = 1;
+		pile->uptodate = 0;
 		}
 	if(pile->funct == e)
 		{
--- openssl-0.9.8g.orig/crypto/aes/asm/aes-586.pl
+++ openssl-0.9.8g/crypto/aes/asm/aes-586.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!/usr/local/bin/perl
 #
 # ====================================================================
 # Written by Andy Polyakov <appro@fy.chalmers.se> for the OpenSSL
@@ -250,7 +250,7 @@
 sub _data_word() { my $i; while(defined($i=shift)) { &data_word($i,$i); } }
 
 &public_label("AES_Te");
-&function_begin_B("_x86_AES_encrypt");
+&function_begin_B_static("_x86_AES_encrypt");
 	if ($vertical_spin) {
 		# I need high parts of volatile registers to be accessible...
 		&exch	($s1="edi",$key="ebx");
@@ -539,7 +539,7 @@
 }
 
 &public_label("AES_Td");
-&function_begin_B("_x86_AES_decrypt");
+&function_begin_B_static("_x86_AES_decrypt");
 	# note that caller is expected to allocate stack frame for me!
 	&mov	(&DWP(12,"esp"),$key);		# save key
 
@@ -1460,15 +1460,22 @@
 &public_label("AES_Td");
 &public_label("AES_Te");
 &function_begin_B("AES_set_decrypt_key");
+	&push	("ebx");
 	&mov	("eax",&wparam(0));
 	&mov	("ecx",&wparam(1));
 	&mov	("edx",&wparam(2));
 	&sub	("esp",12);
+
+	&call	(&label("pic_point0")); 
+	&set_label("pic_point0");
+	&blindpop("ebx");
+	&add	("ebx", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point0") . "]");
 	&mov	(&DWP(0,"esp"),"eax");
 	&mov	(&DWP(4,"esp"),"ecx");
 	&mov	(&DWP(8,"esp"),"edx");
-	&call	("AES_set_encrypt_key");
+	&call	("AES_set_encrypt_key\@PLT");
 	&add	("esp",12);
+	&pop	("ebx");
 	&cmp	("eax",0);
 	&je	(&label("proceed"));
 	&ret	();
--- openssl-0.9.8g.orig/crypto/bn/bn_mul.c
+++ openssl-0.9.8g/crypto/bn/bn_mul.c
@@ -1025,15 +1025,15 @@
 			t = BN_CTX_get(ctx);
 			if (al > j || bl > j)
 				{
-				bn_wexpand(t,k*4);
-				bn_wexpand(rr,k*4);
+				if (bn_wexpand(t,k*4) == NULL) goto err;
+				if (bn_wexpand(rr,k*4) == NULL) goto err;
 				bn_mul_part_recursive(rr->d,a->d,b->d,
 					j,al-j,bl-j,t->d);
 				}
 			else	/* al <= j || bl <= j */
 				{
-				bn_wexpand(t,k*2);
-				bn_wexpand(rr,k*2);
+				if (bn_wexpand(t,k*2) == NULL) goto err;
+				if (bn_wexpand(rr,k*2) == NULL) goto err;
 				bn_mul_recursive(rr->d,a->d,b->d,
 					j,al-j,bl-j,t->d);
 				}
--- openssl-0.9.8g.orig/crypto/bn/bn_gf2m.c
+++ openssl-0.9.8g/crypto/bn/bn_gf2m.c
@@ -294,7 +294,8 @@
 	if (a->top < b->top) { at = b; bt = a; }
 	else { at = a; bt = b; }
 
-	bn_wexpand(r, at->top);
+	if(bn_wexpand(r, at->top) == NULL)
+		return 0;
 
 	for (i = 0; i < bt->top; i++)
 		{
--- openssl-0.9.8g.orig/crypto/bn/bn_div.c
+++ openssl-0.9.8g/crypto/bn/bn_div.c
@@ -102,7 +102,7 @@
 	/* The next 2 are needed so we can do a dv->d[0]|=1 later
 	 * since BN_lshift1 will only work once there is a value :-) */
 	BN_zero(dv);
-	bn_wexpand(dv,1);
+	if(bn_wexpand(dv,1) == NULL) goto end;
 	dv->top=1;
 
 	if (!BN_lshift(D,D,nm-nd)) goto end;
--- openssl-0.9.8g.orig/crypto/bn/asm/ppc.pl
+++ openssl-0.9.8g/crypto/bn/asm/ppc.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/env perl
+#!/usr/local/bin/perl
 #
 # Implemented as a Perl wrapper as we want to support several different
 # architectures with single file. We pick up the target based on the
--- openssl-0.9.8g.orig/util/extract-section.pl
+++ openssl-0.9.8g/util/extract-section.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/perl
+#!/usr/local/bin/perl
 
 while(<STDIN>) {
 	if (/=for\s+comment\s+openssl_manual_section:(\S+)/)
--- openssl-0.9.8g.orig/util/mkerr.pl
+++ openssl-0.9.8g/util/mkerr.pl
@@ -1,4 +1,4 @@
-#!/usr/local/bin/perl -w
+#!/usr/local/bin/perl
 
 my $config = "crypto/err/openssl.ec";
 my $debug = 0;
--- openssl-0.9.8g.orig/util/selftest.pl
+++ openssl-0.9.8g/util/selftest.pl
@@ -1,4 +1,4 @@
-#!/usr/local/bin/perl -w
+#!/usr/local/bin/perl
 #
 # Run the test suite and generate a report
 #
--- openssl-0.9.8g.orig/util/mkstack.pl
+++ openssl-0.9.8g/util/mkstack.pl
@@ -1,4 +1,4 @@
-#!/usr/local/bin/perl -w
+#!/usr/local/bin/perl
 
 # This is a utility that searches out "DECLARE_STACK_OF()"
 # declarations in .h and .c files, and updates/creates/replaces
--- openssl-0.9.8g.orig/util/clean-depend.pl
+++ openssl-0.9.8g/util/clean-depend.pl
@@ -1,4 +1,4 @@
-#!/usr/local/bin/perl -w
+#!/usr/local/bin/perl
 # Clean the dependency list in a makefile of standard includes...
 # Written by Ben Laurie <ben@algroup.co.uk> 19 Jan 1999
 
--- openssl-0.9.8g.orig/util/extract-names.pl
+++ openssl-0.9.8g/util/extract-names.pl
@@ -1,4 +1,4 @@
-#!/usr/bin/perl
+#!/usr/local/bin/perl
 
 $/ = "";			# Eat a paragraph at once.
 while(<STDIN>) {
--- openssl-0.9.8g.orig/util/pod2man.pl
+++ openssl-0.9.8g/util/pod2man.pl
@@ -1,4 +1,4 @@
-: #!/usr/bin/perl-5.005
+#!/usr/local/bin/perl
     eval 'exec /usr/bin/perl -S $0 ${1+"$@"}'
 	if $running_under_some_shell;
 
--- openssl-0.9.8g.orig/util/mkdef.pl
+++ openssl-0.9.8g/util/mkdef.pl
@@ -1,4 +1,4 @@
-#!/usr/local/bin/perl -w
+#!/usr/local/bin/perl
 #
 # generate a .def file
 #
--- openssl-0.9.8g.orig/util/pl/netware.pl
+++ openssl-0.9.8g/util/pl/netware.pl
@@ -1,4 +1,4 @@
-# Metrowerks Codewarrior for NetWare
+#!/usr/local/bin/perl
 #
 
 # The import files and other misc imports needed to link
--- openssl-0.9.8g.orig/engines/openssl.ld
+++ openssl-0.9.8g/engines/openssl.ld
@@ -0,0 +1,5 @@
+OPENSSL_0.9.8 {
+	 global:
+		 *;
+};
+
--- openssl-0.9.8g.orig/engines/e_ubsec.c
+++ openssl-0.9.8g/engines/e_ubsec.c
@@ -934,7 +934,7 @@
                 priv_key = BN_new();
                 if (priv_key == NULL) goto err;
                 priv_key_len = BN_num_bits(dh->p);
-                bn_wexpand(priv_key, dh->p->top);
+                if(bn_wexpand(priv_key, dh->p->top) == NULL) goto err;
                 do
                         if (!BN_rand_range(priv_key, dh->p)) goto err;
                 while (BN_is_zero(priv_key));
@@ -949,7 +949,7 @@
                 {
                 pub_key = BN_new();
                 pub_key_len = BN_num_bits(dh->p);
-                bn_wexpand(pub_key, dh->p->top);
+                if(bn_wexpand(pub_key, dh->p->top) == NULL) goto err;
                 if(pub_key == NULL) goto err;
                 }
         else
--- openssl-0.9.8g.orig/engines/Makefile
+++ openssl-0.9.8g/engines/Makefile
@@ -97,13 +97,13 @@
 				*DSO_DL*)	sfx="sl";;	\
 				*)		sfx="bad";;	\
 				esac; \
-				cp lib$$l.$$sfx $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines/lib$$l.$$sfx.new; \
+				cp lib$$l.$$sfx $(INSTALL_PREFIX)$(INSTALLTOP)/lib/ssl/engines/lib$$l.$$sfx.new; \
 			  else \
 			  	sfx="so"; \
 				cp cyg$$l.dll $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines/lib$$l.$$sfx.new; \
 			  fi; \
-			  chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines/lib$$l.$$sfx.new; \
-			  mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines/lib$$l.$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/lib/engines/lib$$l.$$sfx ); \
+			  chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/lib/ssl/engines/lib$$l.$$sfx.new; \
+			  mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/lib/ssl/engines/lib$$l.$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/lib/ssl/engines/lib$$l.$$sfx ); \
 		done; \
 	fi
 
--- openssl-0.9.8g.orig/Netware/do_tests.pl
+++ openssl-0.9.8g/Netware/do_tests.pl
@@ -1,4 +1,4 @@
-# perl script to run OpenSSL tests
+#!/usr/local/bin/perl
 
 
 my $base_path      = "\\openssl";
