From 7d61401285ff386f279ef7d623cc296ad17bcb3a Mon Sep 17 00:00:00 2001
From: Sascha Wildner <saw@online.de>
Date: Wed, 6 Oct 2021 12:33:32 +0200
Subject: [PATCH 16/16] WIP2

---
 Makefile_upgrade.inc                       |    1 -
 contrib/cryptsetup/lib/backends.c          |   10 +-
 contrib/cryptsetup/luks/af.c               |   12 +-
 contrib/cryptsetup/luks/pbkdf.c            |   12 +-
 crypto/openssl/apps/CA.pl                  |  237 +++
 crypto/openssl/apps/cert.pem               |   11 -
 etc/mtree/BSD.usr.dist                     |    4 +
 gnu/sbin/cryptsetup/Makefile               |    1 -
 initrd/mkinitrd.sh                         |    2 +-
 lib/libcrypto/Makefile                     | 1561 +++++++++++++++-----
 lib/libcrypto/engines/Makefile             |   18 +-
 lib/libcrypto/engines/Makefile.inc         |   17 +-
 lib/libcrypto/engines/capi/Makefile        |    7 +
 lib/libcrypto/engines/padlock/Makefile     |   10 +
 lib/libdmsg/crypto.c                       |   34 +-
 lib/libdmsg/dmsg.h                         |    2 +-
 lib/libldns/ldns/config.h                  |   14 +-
 lib/libssh/config.h                        |   16 +-
 lib/libssh/openbsd-compat/openssl-compat.c |   58 +
 lib/libssh/openbsd-compat/openssl-compat.h |   10 +
 lib/libssl/Makefile                        |   14 +-
 lib/libtelnet/pk.c                         |    1 -
 share/examples/etc/README.examples         |    1 -
 share/examples/ssl/Makefile                |    4 +-
 usr.bin/dc/Makefile                        |    3 +-
 usr.bin/dc/bcode.c                         |    6 +-
 usr.bin/dc/bcode.h                         |    1 +
 usr.bin/dc/inout.c                         |   22 +-
 usr.bin/newkey/generic.c                   |    1 -
 usr.bin/openssl/Makefile                   |   27 +-
 usr.bin/openssl/Makefile.etc               |    6 +-
 usr.bin/openssl/Makefile.inc               |    1 +
 usr.bin/openssl/libapps/Makefile           |   14 +
 usr.bin/openssl/openssl/Makefile           |   28 +
 34 files changed, 1683 insertions(+), 483 deletions(-)
 create mode 100755 crypto/openssl/apps/CA.pl
 delete mode 100644 crypto/openssl/apps/cert.pem
 create mode 100644 lib/libcrypto/engines/capi/Makefile
 create mode 100644 lib/libcrypto/engines/padlock/Makefile
 create mode 100644 usr.bin/openssl/Makefile.inc
 create mode 100644 usr.bin/openssl/libapps/Makefile
 create mode 100644 usr.bin/openssl/openssl/Makefile

diff --git a/Makefile_upgrade.inc b/Makefile_upgrade.inc
index 853f652cd7..23c550ccef 100644
--- a/Makefile_upgrade.inc
+++ b/Makefile_upgrade.inc
@@ -3941,7 +3941,6 @@ TO_REMOVE_LATE+=/lib/libcrypto.so.5
 TO_REMOVE_LATE+=/usr/lib/libssl.a
 TO_REMOVE_LATE+=/usr/lib/libssl.so
 TO_REMOVE_LATE+=/usr/lib/libssl.so.5
-TO_REMOVE_LATE+=/usr/lib/engines
 TO_REMOVE_LATE+=/usr/lib/libcrypto.so
 TO_REMOVE_LATE+=/usr/lib/libcrypto.a
 TO_REMOVE_LATE+=/usr/lib/profile/libssl.a
diff --git a/contrib/cryptsetup/lib/backends.c b/contrib/cryptsetup/lib/backends.c
index 488ccef09c..2359349fcf 100644
--- a/contrib/cryptsetup/lib/backends.c
+++ b/contrib/cryptsetup/lib/backends.c
@@ -16,7 +16,7 @@ int hash(const char *backend_name, const char *hash_name,
          char *result, size_t size,
          const char *passphrase, size_t sizep)
 {
-	EVP_MD_CTX mdctx;
+	EVP_MD_CTX *mdctx;
 	const EVP_MD *md;
 	size_t pad = 0;
 	int r = -ENOENT;
@@ -35,9 +35,11 @@ int hash(const char *backend_name, const char *hash_name,
 
 	pad = size - EVP_MD_size(md);
 
-	EVP_DigestInit(&mdctx, md);
-	EVP_DigestUpdate(&mdctx, passphrase, sizep);
-	r = !EVP_DigestFinal(&mdctx, result, NULL);
+	mdctx = EVP_MD_CTX_new();
+	EVP_DigestInit(mdctx, md);
+	EVP_DigestUpdate(mdctx, passphrase, sizep);
+	r = !EVP_DigestFinal(mdctx, result, NULL);
+	EVP_MD_CTX_free(mdctx);
 
 	if (pad) {
 		memset(result+size, 0, pad);
diff --git a/contrib/cryptsetup/luks/af.c b/contrib/cryptsetup/luks/af.c
index 2d3acc0b60..ec1c999072 100644
--- a/contrib/cryptsetup/luks/af.c
+++ b/contrib/cryptsetup/luks/af.c
@@ -38,15 +38,17 @@ static void XORblock(char const *src1, char const *src2, char *dst, size_t n)
 
 static int hash_buf(char *src, char *dst, uint32_t iv, int len, const EVP_MD *hash_id)
 {
-	EVP_MD_CTX mdctx;
+	EVP_MD_CTX *mdctx;
 	unsigned char digest[128];
 
 	iv = htonl(iv);
 
-	EVP_DigestInit(&mdctx, hash_id);
-	EVP_DigestUpdate(&mdctx, (unsigned char *)&iv, sizeof(iv));
-	EVP_DigestUpdate(&mdctx, src, len);
-	EVP_DigestFinal(&mdctx, digest, NULL);
+	mdctx = EVP_MD_CTX_new();
+	EVP_DigestInit(mdctx, hash_id);
+	EVP_DigestUpdate(mdctx, (unsigned char *)&iv, sizeof(iv));
+	EVP_DigestUpdate(mdctx, src, len);
+	EVP_DigestFinal(mdctx, digest, NULL);
+	EVP_MD_CTX_free(mdctx);
 	memcpy(dst, digest, len);
 
 	return 0;
diff --git a/contrib/cryptsetup/luks/pbkdf.c b/contrib/cryptsetup/luks/pbkdf.c
index 31e5da4d51..6b52de848e 100644
--- a/contrib/cryptsetup/luks/pbkdf.c
+++ b/contrib/cryptsetup/luks/pbkdf.c
@@ -72,7 +72,7 @@ static int pkcs5_pbkdf2(const char *hash,
 	char U[MAX_PRF_BLOCK_LEN];
 	char T[MAX_PRF_BLOCK_LEN];
 	const EVP_MD *PRF;
-	HMAC_CTX ctx;
+	HMAC_CTX *ctx;
 	int i, k, rc = -EINVAL;
 	unsigned int u, hLen, l, r;
 	unsigned char *p;
@@ -169,7 +169,7 @@ static int pkcs5_pbkdf2(const char *hash,
 	 *  into a small set of values.
 	 *
 	 */
-	HMAC_CTX_init(&ctx);
+	ctx = HMAC_CTX_new();
 
 	for (i = 1; (uint) i <= l; i++) {
 		memset(T, 0, hLen);
@@ -181,9 +181,9 @@ static int pkcs5_pbkdf2(const char *hash,
 				tmp[Slen + 1] = (i & 0x00ff0000) >> 16;
 				tmp[Slen + 2] = (i & 0x0000ff00) >> 8;
 				tmp[Slen + 3] = (i & 0x000000ff) >> 0;
-				HMAC_Init_ex(&ctx, P, Plen, PRF, NULL);
-				HMAC_Update(&ctx, tmp, tmplen);				
-				HMAC_Final(&ctx, U, NULL);
+				HMAC_Init_ex(ctx, P, Plen, PRF, NULL);
+				HMAC_Update(ctx, tmp, tmplen);				
+				HMAC_Final(ctx, U, NULL);
 			} else {
 				HMAC(PRF, P, Plen, U, hLen, U, NULL);
 			}
@@ -204,7 +204,7 @@ static int pkcs5_pbkdf2(const char *hash,
 	}
 	rc = 0;
 out:
-	HMAC_CTX_cleanup(&ctx);
+	HMAC_CTX_free(ctx);
 	return rc;
 }
 
diff --git a/crypto/openssl/apps/CA.pl b/crypto/openssl/apps/CA.pl
new file mode 100755
index 0000000000..8d95152674
--- /dev/null
+++ b/crypto/openssl/apps/CA.pl
@@ -0,0 +1,237 @@
+#!/usr/bin/env perl
+# Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+#
+# Wrapper around the ca to make it easier to use
+#
+# WARNING: do not edit!
+# Generated by Makefile from apps/CA.pl.in
+
+use strict;
+use warnings;
+
+my $verbose = 1;
+my @OPENSSL_CMDS = ("req", "ca", "pkcs12", "x509", "verify");
+
+my $openssl = $ENV{'OPENSSL'} // "openssl";
+$ENV{'OPENSSL'} = $openssl;
+my $OPENSSL_CONFIG = $ENV{"OPENSSL_CONFIG"} // "";
+
+# Command invocations.
+my $REQ = "$openssl req $OPENSSL_CONFIG";
+my $CA = "$openssl ca $OPENSSL_CONFIG";
+my $VERIFY = "$openssl verify";
+my $X509 = "$openssl x509";
+my $PKCS12 = "$openssl pkcs12";
+
+# Default values for various configuration settings.
+my $CATOP = "./demoCA";
+my $CAKEY = "cakey.pem";
+my $CAREQ = "careq.pem";
+my $CACERT = "cacert.pem";
+my $CACRL = "crl.pem";
+my $DAYS = "-days 365";
+my $CADAYS = "-days 1095";	# 3 years
+my $NEWKEY = "newkey.pem";
+my $NEWREQ = "newreq.pem";
+my $NEWCERT = "newcert.pem";
+my $NEWP12 = "newcert.p12";
+
+# Commandline parsing
+my %EXTRA;
+my $WHAT = shift @ARGV || "";
+@ARGV = parse_extra(@ARGV);
+my $RET = 0;
+
+# Split out "-extra-CMD value", and return new |@ARGV|. Fill in
+# |EXTRA{CMD}| with list of values.
+sub parse_extra
+{
+    foreach ( @OPENSSL_CMDS ) {
+        $EXTRA{$_} = '';
+    }
+
+    my @result;
+    while ( scalar(@_) > 0 ) {
+        my $arg = shift;
+        if ( $arg !~ m/-extra-([a-z0-9]+)/ ) {
+            push @result, $arg;
+            next;
+        }
+        $arg =~ s/-extra-//;
+        die("Unknown \"-${arg}-extra\" option, exiting")
+            unless scalar grep { $arg eq $_ } @OPENSSL_CMDS;
+        $EXTRA{$arg} .= " " . shift;
+    }
+    return @result;
+}
+
+
+# See if reason for a CRL entry is valid; exit if not.
+sub crl_reason_ok
+{
+    my $r = shift;
+
+    if ($r eq 'unspecified' || $r eq 'keyCompromise'
+        || $r eq 'CACompromise' || $r eq 'affiliationChanged'
+        || $r eq 'superseded' || $r eq 'cessationOfOperation'
+        || $r eq 'certificateHold' || $r eq 'removeFromCRL') {
+        return 1;
+    }
+    print STDERR "Invalid CRL reason; must be one of:\n";
+    print STDERR "    unspecified, keyCompromise, CACompromise,\n";
+    print STDERR "    affiliationChanged, superseded, cessationOfOperation\n";
+    print STDERR "    certificateHold, removeFromCRL";
+    exit 1;
+}
+
+# Copy a PEM-format file; return like exit status (zero means ok)
+sub copy_pemfile
+{
+    my ($infile, $outfile, $bound) = @_;
+    my $found = 0;
+
+    open IN, $infile || die "Cannot open $infile, $!";
+    open OUT, ">$outfile" || die "Cannot write to $outfile, $!";
+    while (<IN>) {
+        $found = 1 if /^-----BEGIN.*$bound/;
+        print OUT $_ if $found;
+        $found = 2, last if /^-----END.*$bound/;
+    }
+    close IN;
+    close OUT;
+    return $found == 2 ? 0 : 1;
+}
+
+# Wrapper around system; useful for debugging.  Returns just the exit status
+sub run
+{
+    my $cmd = shift;
+    print "====\n$cmd\n" if $verbose;
+    my $status = system($cmd);
+    print "==> $status\n====\n" if $verbose;
+    return $status >> 8;
+}
+
+
+if ( $WHAT =~ /^(-\?|-h|-help)$/ ) {
+    print STDERR <<EOF;
+Usage:
+    CA.pl -newcert | -newreq | -newreq-nodes | -xsign | -sign | -signCA | -signcert | -crl | -newca [-extra-cmd parameter]
+    CA.pl -pkcs12 [certname]
+    CA.pl -verify certfile ...
+    CA.pl -revoke certfile [reason]
+EOF
+    exit 0;
+}
+
+if ($WHAT eq '-newcert' ) {
+    # create a certificate
+    $RET = run("$REQ -new -x509 -keyout $NEWKEY -out $NEWCERT $DAYS"
+            . " $EXTRA{req}");
+    print "Cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
+} elsif ($WHAT eq '-precert' ) {
+    # create a pre-certificate
+    $RET = run("$REQ -x509 -precert -keyout $NEWKEY -out $NEWCERT $DAYS"
+            . " $EXTRA{req}");
+    print "Pre-cert is in $NEWCERT, private key is in $NEWKEY\n" if $RET == 0;
+} elsif ($WHAT =~ /^\-newreq(\-nodes)?$/ ) {
+    # create a certificate request
+    $RET = run("$REQ -new $1 -keyout $NEWKEY -out $NEWREQ $DAYS $EXTRA{req}");
+    print "Request is in $NEWREQ, private key is in $NEWKEY\n" if $RET == 0;
+} elsif ($WHAT eq '-newca' ) {
+    # create the directory hierarchy
+    my @dirs = ( "${CATOP}", "${CATOP}/certs", "${CATOP}/crl",
+                "${CATOP}/newcerts", "${CATOP}/private" );
+    die "${CATOP}/index.txt exists.\nRemove old sub-tree to proceed,"
+        if -f "${CATOP}/index.txt";
+    die "${CATOP}/serial exists.\nRemove old sub-tree to proceed,"
+        if -f "${CATOP}/serial";
+    foreach my $d ( @dirs ) {
+        if ( -d $d ) {
+            warn "Directory $d exists" if -d $d;
+        } else {
+            mkdir $d or die "Can't mkdir $d, $!";
+        }
+    }
+
+    open OUT, ">${CATOP}/index.txt";
+    close OUT;
+    open OUT, ">${CATOP}/crlnumber";
+    print OUT "01\n";
+    close OUT;
+    # ask user for existing CA certificate
+    print "CA certificate filename (or enter to create)\n";
+    my $FILE;
+    $FILE = "" unless defined($FILE = <STDIN>);
+    $FILE =~ s{\R$}{};
+    if ($FILE ne "") {
+        copy_pemfile($FILE,"${CATOP}/private/$CAKEY", "PRIVATE");
+        copy_pemfile($FILE,"${CATOP}/$CACERT", "CERTIFICATE");
+    } else {
+        print "Making CA certificate ...\n";
+        $RET = run("$REQ -new -keyout ${CATOP}/private/$CAKEY"
+                . " -out ${CATOP}/$CAREQ $EXTRA{req}");
+        $RET = run("$CA -create_serial"
+                . " -out ${CATOP}/$CACERT $CADAYS -batch"
+                . " -keyfile ${CATOP}/private/$CAKEY -selfsign"
+                . " -extensions v3_ca"
+                . " -infiles ${CATOP}/$CAREQ $EXTRA{ca}") if $RET == 0;
+        print "CA certificate is in ${CATOP}/$CACERT\n" if $RET == 0;
+    }
+} elsif ($WHAT eq '-pkcs12' ) {
+    my $cname = $ARGV[0];
+    $cname = "My Certificate" unless defined $cname;
+    $RET = run("$PKCS12 -in $NEWCERT -inkey $NEWKEY"
+            . " -certfile ${CATOP}/$CACERT -out $NEWP12"
+            . " -export -name \"$cname\" $EXTRA{pkcs12}");
+    print "PKCS #12 file is in $NEWP12\n" if $RET == 0;
+} elsif ($WHAT eq '-xsign' ) {
+    $RET = run("$CA -policy policy_anything -infiles $NEWREQ $EXTRA{ca}");
+} elsif ($WHAT eq '-sign' ) {
+    $RET = run("$CA -policy policy_anything -out $NEWCERT"
+            . " -infiles $NEWREQ $EXTRA{ca}");
+    print "Signed certificate is in $NEWCERT\n" if $RET == 0;
+} elsif ($WHAT eq '-signCA' ) {
+    $RET = run("$CA -policy policy_anything -out $NEWCERT"
+            . " -extensions v3_ca -infiles $NEWREQ $EXTRA{ca}");
+    print "Signed CA certificate is in $NEWCERT\n" if $RET == 0;
+} elsif ($WHAT eq '-signcert' ) {
+    $RET = run("$X509 -x509toreq -in $NEWREQ -signkey $NEWREQ"
+            . " -out tmp.pem $EXTRA{x509}");
+    $RET = run("$CA -policy policy_anything -out $NEWCERT"
+            .  "-infiles tmp.pem $EXTRA{ca}") if $RET == 0;
+    print "Signed certificate is in $NEWCERT\n" if $RET == 0;
+} elsif ($WHAT eq '-verify' ) {
+    my @files = @ARGV ? @ARGV : ( $NEWCERT );
+    foreach my $file (@files) {
+        # -CAfile quoted for VMS, since the C RTL downcases all unquoted
+        # arguments to C programs
+        my $status = run("$VERIFY \"-CAfile\" ${CATOP}/$CACERT $file $EXTRA{verify}");
+        $RET = $status if $status != 0;
+    }
+} elsif ($WHAT eq '-crl' ) {
+    $RET = run("$CA -gencrl -out ${CATOP}/crl/$CACRL $EXTRA{ca}");
+    print "Generated CRL is in ${CATOP}/crl/$CACRL\n" if $RET == 0;
+} elsif ($WHAT eq '-revoke' ) {
+    my $cname = $ARGV[0];
+    if (!defined $cname) {
+        print "Certificate filename is required; reason optional.\n";
+        exit 1;
+    }
+    my $reason = $ARGV[1];
+    $reason = " -crl_reason $reason"
+        if defined $reason && crl_reason_ok($reason);
+    $RET = run("$CA -revoke \"$cname\"" . $reason . $EXTRA{ca});
+} else {
+    print STDERR "Unknown arg \"$WHAT\"\n";
+    print STDERR "Use -help for help.\n";
+    exit 1;
+}
+
+exit $RET;
diff --git a/crypto/openssl/apps/cert.pem b/crypto/openssl/apps/cert.pem
deleted file mode 100644
index de4a77ac6d..0000000000
--- a/crypto/openssl/apps/cert.pem
+++ /dev/null
@@ -1,11 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBoDCCAUoCAQAwDQYJKoZIhvcNAQEEBQAwYzELMAkGA1UEBhMCQVUxEzARBgNV
-BAgTClF1ZWVuc2xhbmQxGjAYBgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMSMwIQYD
-VQQDExpTZXJ2ZXIgdGVzdCBjZXJ0ICg1MTIgYml0KTAeFw05NzA5MDkwMzQxMjZa
-Fw05NzEwMDkwMzQxMjZaMF4xCzAJBgNVBAYTAkFVMRMwEQYDVQQIEwpTb21lLVN0
-YXRlMSEwHwYDVQQKExhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxFzAVBgNVBAMT
-DkVyaWMgdGhlIFlvdW5nMFEwCQYFKw4DAgwFAANEAAJBALVEqPODnpI4rShlY8S7
-tB713JNvabvn6Gned7zylwLLiXQAo/PAT6mfdWPTyCX9RlId/Aroh1ou893BA32Q
-sggwDQYJKoZIhvcNAQEEBQADQQCU5SSgapJSdRXJoX+CpCvFy+JVh9HpSjCpSNKO
-19raHv98hKAUJuP9HyM+SUsffO6mAIgitUaqW8/wDMePhEC3
------END CERTIFICATE-----
diff --git a/etc/mtree/BSD.usr.dist b/etc/mtree/BSD.usr.dist
index 74f5d30b9a..f41f77bf41 100644
--- a/etc/mtree/BSD.usr.dist
+++ b/etc/mtree/BSD.usr.dist
@@ -14,6 +14,8 @@
     lib
         debug
         ..
+        engines
+        ..
         gcc47
             plugin
                 include
@@ -56,6 +58,8 @@
         ..
         i18n
         ..
+        ossl-modules
+        ..
         priv
             profile
             ..
diff --git a/gnu/sbin/cryptsetup/Makefile b/gnu/sbin/cryptsetup/Makefile
index 46c17049be..b73d597696 100644
--- a/gnu/sbin/cryptsetup/Makefile
+++ b/gnu/sbin/cryptsetup/Makefile
@@ -1,7 +1,6 @@
 CRYPTSETUP_DIR=		${.CURDIR}/../../../contrib/cryptsetup
 
 PROG=		cryptsetup
-
 .PATH:		${CRYPTSETUP_DIR}/src
 CFLAGS+=	-I${CRYPTSETUP_DIR}/src
 SRCS=		cryptsetup.c
diff --git a/initrd/mkinitrd.sh b/initrd/mkinitrd.sh
index c33b86000d..954a9876fd 100755
--- a/initrd/mkinitrd.sh
+++ b/initrd/mkinitrd.sh
@@ -63,7 +63,7 @@ RESCUE_DIR="/rescue"
 BOOT_DIR="/boot"
 
 # Maximum size (number of MB) allowed for the initrd image
-INITRD_SIZE_MAX="15"  # MB
+INITRD_SIZE_MAX="19"  # MB
 
 # When run from the buildworld/installworld environment do not require that
 # things like uniq, kldload, mount, newfs, etc be in the cross-tools.
diff --git a/lib/libcrypto/Makefile b/lib/libcrypto/Makefile
index c945a3a51e..7168d71bb2 100644
--- a/lib/libcrypto/Makefile
+++ b/lib/libcrypto/Makefile
@@ -2,372 +2,1220 @@ LIB=		private_crypto
 SHLIB_MAJOR=	47
 PRIVATELIB=	shpub
 SHLIBDIR?=	/lib
+INCSDIR=	${INCLUDEDIR}/priv/openssl
 
 WARNS?=		1
 
 OPENSSL_SRC=	${.CURDIR}/../../crypto/openssl
 
-.PATH:	${OPENSSL_SRC}/crypto \
-	${OPENSSL_SRC}/crypto/aes \
-	${OPENSSL_SRC}/crypto/aria \
-	${OPENSSL_SRC}/crypto/asn1 \
-	${OPENSSL_SRC}/crypto/async \
-	${OPENSSL_SRC}/crypto/async/arch \
-	${OPENSSL_SRC}/crypto/bf \
-	${OPENSSL_SRC}/crypto/bio \
-	${OPENSSL_SRC}/crypto/bn \
-	${OPENSSL_SRC}/crypto/bn/asm \
-	${OPENSSL_SRC}/crypto/buffer \
-	${OPENSSL_SRC}/crypto/camellia \
-	${OPENSSL_SRC}/crypto/cast \
-	${OPENSSL_SRC}/crypto/chacha \
-	${OPENSSL_SRC}/crypto/cmac \
-	${OPENSSL_SRC}/crypto/cmp \
-	${OPENSSL_SRC}/crypto/cms \
-	${OPENSSL_SRC}/crypto/comp \
-	${OPENSSL_SRC}/crypto/conf \
-	${OPENSSL_SRC}/crypto/crmf \
-	${OPENSSL_SRC}/crypto/ct \
-	${OPENSSL_SRC}/crypto/des \
-	${OPENSSL_SRC}/crypto/dh \
-	${OPENSSL_SRC}/crypto/dsa \
-	${OPENSSL_SRC}/crypto/dso \
-	${OPENSSL_SRC}/crypto/ec \
-	${OPENSSL_SRC}/crypto/ec/curve448 \
-	${OPENSSL_SRC}/crypto/ec/curve448/arch_32 \
-	${OPENSSL_SRC}/crypto/ec/curve448/arch_64 \
-	${OPENSSL_SRC}/crypto/encode_decode \
-	${OPENSSL_SRC}/crypto/engine \
-	${OPENSSL_SRC}/crypto/err \
-	${OPENSSL_SRC}/crypto/ess \
-	${OPENSSL_SRC}/crypto/evp \
-	${OPENSSL_SRC}/crypto/ffc \
-	${OPENSSL_SRC}/crypto/hmac \
-	${OPENSSL_SRC}/crypto/http \
-	${OPENSSL_SRC}/crypto/idea \
-	${OPENSSL_SRC}/crypto/kdf \
-	${OPENSSL_SRC}/crypto/lhash \
-	${OPENSSL_SRC}/crypto/md4 \
-	${OPENSSL_SRC}/crypto/md5 \
-	${OPENSSL_SRC}/crypto/mdc2 \
-	${OPENSSL_SRC}/crypto/modes \
-	${OPENSSL_SRC}/crypto/objects \
-	${OPENSSL_SRC}/crypto/ocsp \
-	${OPENSSL_SRC}/crypto/pem \
-	${OPENSSL_SRC}/crypto/pkcs12 \
-	${OPENSSL_SRC}/crypto/pkcs7 \
-	${OPENSSL_SRC}/crypto/poly1305 \
-	${OPENSSL_SRC}/crypto/property \
-	${OPENSSL_SRC}/crypto/rand \
-	${OPENSSL_SRC}/crypto/rc2 \
-	${OPENSSL_SRC}/crypto/rc4 \
-	${OPENSSL_SRC}/crypto/ripemd \
-	${OPENSSL_SRC}/crypto/rsa \
-	${OPENSSL_SRC}/crypto/seed \
-	${OPENSSL_SRC}/crypto/sha \
-	${OPENSSL_SRC}/crypto/siphash \
-	${OPENSSL_SRC}/crypto/sm2 \
-	${OPENSSL_SRC}/crypto/sm3 \
-	${OPENSSL_SRC}/crypto/sm4 \
-	${OPENSSL_SRC}/crypto/srp \
-	${OPENSSL_SRC}/crypto/stack \
-	${OPENSSL_SRC}/crypto/store \
-	${OPENSSL_SRC}/crypto/ts \
-	${OPENSSL_SRC}/crypto/txt_db \
-	${OPENSSL_SRC}/crypto/ui \
-	${OPENSSL_SRC}/crypto/whrlpool \
-	${OPENSSL_SRC}/crypto/x509
-
-# base sources
-SRCS+=	asn1_dsa.c bsearch.c context.c core_algorithm.c core_fetch.c \
-	core_namemap.c cpt_err.c cpuid.c cryptlib.c ctype.c cversion.c \
-	der_writer.c ebcdic.c ex_data.c getenv.c ebcdic.c init.c initthread.c \
-	mem.c mem_sec.c o_dir.c o_fopen.c o_init.c o_str.c o_time.c packet.c \
-	param_build.c param_build_set.c params.c params_dup.c \
-	params_from_text.c passphrase.c provider.c provider_child.c \
-	provider_conf.c provider_core.c provider_predefined.c punycode.c \
-	self_test_core.c sparse_array.c threads_lib.c threads_none.c \
-	threads_pthread.c threads_win.c trace.c uid.c x86_64cpuid.s
-
-# aes
-SRCS+=	aes-x86_64.s aes_cfb.c aes_ecb.c aes_ige.c aes_misc.c aes_ofb.c \
-	aes_wrap.c aesni-mb-x86_64.s aesni-sha1-x86_64.s \
-	aesni-sha256-x86_64.s aesni-x86_64.s bsaes-x86_64.s vpaes-x86_64.s
-
-# aria
-SRCS+=	aria.c
-
-# asn1
-SRCS+=	a_bitstr.c a_d2i_fp.c a_digest.c a_dup.c a_gentm.c a_i2d_fp.c a_int.c \
-	a_mbstr.c a_object.c a_octet.c a_print.c a_sign.c a_strex.c \
-	a_strnid.c a_time.c a_type.c a_type.c a_utctm.c a_utf8.c a_verify.c \
-	ameth_lib.c asn1_err.c asn1_gen.c asn1_item_list.c asn1_lib.c \
-	asn1_parse.c asn_mime.c asn_moid.c asn_mstbl.c asn_pack.c bio_asn1.c \
-	bio_ndef.c d2i_param.c d2i_pr.c d2i_pu.c evp_asn1.c f_int.c \
-	f_string.c i2d_evp.c n_pkey.c nsseq.c p5_pbe.c p5_pbev2.c p5_scrypt.c \
-	p8_pkey.c t_bitst.c t_pkey.c t_spki.c tasn_dec.c tasn_enc.c \
-	tasn_fre.c tasn_new.c tasn_prn.c tasn_scn.c tasn_typ.c tasn_utl.c \
-	x_algor.c x_bignum.c x_info.c x_int64.c x_long.c x_pkey.c x_sig.c \
-	x_spki.c x_val.c
-
-# async
-SRCS+=	async.c async_err.c async_wait.c async_null.c async_posix.c async_win.c
-
-# bf
-SRCS+=	bf_cfb64.c bf_ecb.c bf_enc.c bf_ofb64.c bf_skey.c
-
-# bio
-SRCS+=	bf_buff.c bf_lbuf.c bf_nbio.c bf_null.c bf_prefix.c bf_readbuff.c \
-	bio_addr.c bio_cb.c bio_dump.c bio_err.c bio_lib.c bio_meth.c \
-	bio_print.c bio_sock.c bio_sock2.c bss_acpt.c bss_bio.c bss_conn.c \
-	bss_core.c bss_dgram.c bss_fd.c bss_file.c bss_log.c bss_mem.c \
-	bss_null.c bss_sock.c ossl_core_bio.c 
-
-# bn
-SRCS+=	bn_add.c bn_blind.c bn_const.c bn_conv.c bn_ctx.c bn_depr.c bn_dh.c \
-	bn_div.c bn_err.c bn_exp.c bn_exp2.c bn_gcd.c bn_gf2m.c bn_intern.c \
-	bn_kron.c bn_lib.c bn_mod.c bn_mont.c bn_mpi.c bn_mul.c bn_nist.c \
-	bn_prime.c bn_print.c bn_rand.c bn_recp.c bn_rsa_fips186_4.c \
-	bn_shift.c bn_sqr.c bn_sqrt.c bn_srp.c bn_word.c bn_x931p.c \
-	rsaz-avx2.s rsaz-avx512.s rsaz_exp.c rsaz_exp_x2.c rsaz-x86_64.s \
-	x86_64-gf2m.s x86_64-mont.s x86_64-mont5.s x86_64-gcc.c
-
-# buffer
-SRCS+=	buf_err.c buffer.c
-
-# camellia
-SRCS+=	cmll_cfb.c cmll_ctr.c cmll_ecb.c cmll_misc.c cmll_ofb.c cmll-x86_64.s
-
-# cast
-SRCS+=	c_cfb64.c c_ecb.c c_enc.c c_ofb64.c c_skey.c
-
-# chacha
-SRCS+=	chacha-x86_64.s
-
-# cmac
-SRCS+=	cmac.c
-
-# cmp
-SRCS+=	cmp_asn.c cmp_client.c cmp_ctx.c cmp_err.c cmp_hdr.c cmp_http.c \
-	cmp_msg.c cmp_protect.c cmp_server.c cmp_status.c cmp_util.c cmp_vfy.c
-
-# cms
-SRCS+=	cms_asn1.c cms_att.c cms_cd.c cms_dd.c cms_dh.c cms_ec.c cms_enc.c \
-	cms_env.c cms_err.c cms_ess.c cms_io.c cms_kari.c cms_lib.c \
-	cms_pwri.c cms_rsa.c cms_sd.c cms_smime.c
-
-# comp
-SRCS+=	c_zlib.c comp_err.c comp_lib.c
-
-# conf
-SRCS+=	conf_api.c conf_def.c conf_err.c conf_lib.c conf_mall.c conf_mod.c \
-	conf_sap.c conf_ssl.c
-
-# crmf
-SRCS+=	crmf_asn.c crmf_err.c crmf_lib.c crmf_pbm.c
-
-# ct
-SRCS+=	ct_b64.c ct_err.c ct_log.c ct_oct.c ct_policy.c ct_prn.c ct_sct.c \
-	ct_sct_ctx.c ct_vfy.c ct_x509v3.c
-
-# des
-SRCS+=	cbc_cksm.c cbc_enc.c cfb64ede.c cfb64enc.c cfb_enc.c des_enc.c \
-	ecb3_enc.c ecb_enc.c fcrypt.c fcrypt_b.c ofb64ede.c ofb64enc.c \
-	ofb_enc.c pcbc_enc.c qud_cksm.c rand_key.c set_key.c str2key.c \
+# crypto
+.PATH:	${OPENSSL_SRC}/crypto
+SRCS=	\
+	asn1_dsa.c \
+	bsearch.c \
+	context.c \
+	core_algorithm.c \
+	core_fetch.c \
+	core_namemap.c \
+	cpt_err.c \
+	cpuid.c \
+	cryptlib.c \
+	ctype.c \
+	cversion.c \
+	der_writer.c \
+	ebcdic.c \
+	ex_data.c \
+	getenv.c \
+	info.c \
+	init.c \
+	initthread.c \
+	mem.c \
+	mem_sec.c \
+	o_dir.c \
+	o_fopen.c \
+	o_init.c \
+	o_str.c \
+	o_time.c \
+	packet.c \
+	param_build.c \
+	param_build_set.c \
+	params.c \
+	params_dup.c \
+	params_from_text.c \
+	passphrase.c \
+	provider.c \
+	provider_child.c \
+	provider_conf.c \
+	provider_core.c \
+	provider_predefined.c \
+	punycode.c \
+	self_test_core.c \
+	sparse_array.c \
+	threads_lib.c \
+	threads_none.c \
+	threads_pthread.c \
+	threads_win.c \
+	trace.c \
+	uid.c \
+	x86_64cpuid.s
+
+# crypto/aes
+.PATH:	${OPENSSL_SRC}/crypto/aes
+SRCS+=	\
+	aes_cfb.c \
+	aes_ecb.c \
+	aes_ige.c \
+	aes_misc.c \
+	aesni-mb-x86_64.s \
+	aesni-sha1-x86_64.s \
+	aesni-sha256-x86_64.s \
+	aesni-x86_64.s \
+	aes_ofb.c \
+	aes_wrap.c \
+	aes-x86_64.s \
+	bsaes-x86_64.s \
+	vpaes-x86_64.s
+
+# crypto/aria
+.PATH:	${OPENSSL_SRC}/crypto/aria
+SRCS+=	\
+	aria.c
+
+# crypto/asn1
+.PATH:	${OPENSSL_SRC}/crypto/asn1
+SRCS+=	\
+	a_bitstr.c \
+	a_d2i_fp.c \
+	a_digest.c \
+	a_dup.c \
+	a_gentm.c \
+	a_i2d_fp.c \
+	a_int.c \
+	a_mbstr.c \
+	ameth_lib.c \
+	a_object.c \
+	a_octet.c \
+	a_print.c \
+	a_sign.c \
+	asn1_err.c \
+	asn1_gen.c \
+	asn1_item_list.c \
+	asn1_lib.c \
+	asn1_parse.c \
+	asn_mime.c \
+	asn_moid.c \
+	asn_mstbl.c \
+	asn_pack.c \
+	a_strex.c \
+	a_strnid.c \
+	a_time.c \
+	a_type.c \
+	a_utctm.c \
+	a_utf8.c \
+	a_verify.c \
+	bio_asn1.c \
+	bio_ndef.c \
+	d2i_param.c \
+	d2i_pr.c \
+	d2i_pu.c \
+	evp_asn1.c \
+	f_int.c \
+	f_string.c \
+	i2d_evp.c \
+	n_pkey.c \
+	nsseq.c \
+	p5_pbe.c \
+	p5_pbev2.c \
+	p5_scrypt.c \
+	p8_pkey.c \
+	tasn_dec.c \
+	tasn_enc.c \
+	tasn_fre.c \
+	tasn_new.c \
+	tasn_prn.c \
+	tasn_scn.c \
+	tasn_typ.c \
+	tasn_utl.c \
+	t_bitst.c \
+	t_pkey.c \
+	t_spki.c \
+	x_algor.c \
+	x_bignum.c \
+	x_info.c \
+	x_int64.c \
+	x_long.c \
+	x_pkey.c \
+	x_sig.c \
+	x_spki.c \
+	x_val.c
+
+# crypto/async
+.PATH:	${OPENSSL_SRC}/crypto/async
+.PATH:	${OPENSSL_SRC}/crypto/async/arch
+SRCS+=	\
+	async.c \
+	async_err.c \
+	async_null.c \
+	async_posix.c \
+	async_wait.c \
+	async_win.c
+
+# crypto/bf
+.PATH:	${OPENSSL_SRC}/crypto/bf
+SRCS+=	\
+	bf_cfb64.c \
+	bf_ecb.c \
+	bf_enc.c \
+	bf_ofb64.c \
+	bf_skey.c
+
+# crypto/bio
+.PATH:	${OPENSSL_SRC}/crypto/bio
+SRCS+=	\
+	bf_buff.c \
+	bf_lbuf.c \
+	bf_nbio.c \
+	bf_null.c \
+	bf_prefix.c \
+	bf_readbuff.c \
+	bio_addr.c \
+	bio_cb.c \
+	bio_dump.c \
+	bio_err.c \
+	bio_lib.c \
+	bio_meth.c \
+	bio_print.c \
+	bio_sock2.c \
+	bio_sock.c \
+	bss_acpt.c \
+	bss_bio.c \
+	bss_conn.c \
+	bss_core.c \
+	bss_dgram.c \
+	bss_fd.c \
+	bss_file.c \
+	bss_log.c \
+	bss_mem.c \
+	bss_null.c \
+	bss_sock.c \
+	ossl_core_bio.c
+
+# crypto/bn
+.PATH:	${OPENSSL_SRC}/crypto/bn
+.PATH:	${OPENSSL_SRC}/crypto/bn/asm
+SRCS+=	\
+	bn_add.c \
+	bn_blind.c \
+	bn_const.c \
+	bn_conv.c \
+	bn_ctx.c \
+	bn_depr.c \
+	bn_dh.c \
+	bn_div.c \
+	bn_err.c \
+	bn_exp2.c \
+	bn_exp.c \
+	bn_gcd.c \
+	bn_gf2m.c \
+	bn_intern.c \
+	bn_kron.c \
+	bn_lib.c \
+	bn_mod.c \
+	bn_mont.c \
+	bn_mpi.c \
+	bn_mul.c \
+	bn_nist.c \
+	bn_prime.c \
+	bn_print.c \
+	bn_rand.c \
+	bn_recp.c \
+	bn_rsa_fips186_4.c \
+	bn_shift.c \
+	bn_sqr.c \
+	bn_sqrt.c \
+	bn_srp.c \
+	bn_word.c \
+	bn_x931p.c \
+	rsaz-avx2.s \
+	rsaz-avx512.s \
+	rsaz_exp.c \
+	rsaz_exp_x2.c \
+	rsaz-x86_64.s \
+	x86_64-gcc.c \
+	x86_64-gf2m.s \
+	x86_64-mont5.s \
+	x86_64-mont.s
+
+# crypto/buffer
+.PATH:	${OPENSSL_SRC}/crypto/buffer
+SRCS+=	\
+	buf_err.c \
+	buffer.c
+
+# crypto/camellia
+.PATH:	${OPENSSL_SRC}/crypto/camellia
+SRCS+=	\
+	cmll_cfb.c \
+	cmll_ctr.c \
+	cmll_ecb.c \
+	cmll_misc.c \
+	cmll_ofb.c \
+	cmll-x86_64.s
+
+# crypto/cast
+.PATH:	${OPENSSL_SRC}/crypto/cast
+SRCS+=	\
+	c_cfb64.c \
+	c_ecb.c \
+	c_enc.c \
+	c_ofb64.c \
+	c_skey.c
+
+# crypto/chacha
+.PATH:	${OPENSSL_SRC}/crypto/chacha
+SRCS+=	\
+	chacha-x86_64.s
+
+# crypto/cmac
+.PATH:	${OPENSSL_SRC}/crypto/cmac
+SRCS+=	\
+	cmac.c
+
+# crypto/cmp
+.PATH:	${OPENSSL_SRC}/crypto/cmp
+SRCS+=	\
+	cmp_asn.c \
+	cmp_client.c \
+	cmp_ctx.c \
+	cmp_err.c \
+	cmp_hdr.c \
+	cmp_http.c \
+	cmp_msg.c \
+	cmp_protect.c \
+	cmp_server.c \
+	cmp_status.c \
+	cmp_util.c \
+	cmp_vfy.c
+
+# crypto/cms
+.PATH:	${OPENSSL_SRC}/crypto/cms
+SRCS+=	\
+	cms_asn1.c \
+	cms_att.c \
+	cms_cd.c \
+	cms_dd.c \
+	cms_dh.c \
+	cms_ec.c \
+	cms_enc.c \
+	cms_env.c \
+	cms_err.c \
+	cms_ess.c \
+	cms_io.c \
+	cms_kari.c \
+	cms_lib.c \
+	cms_pwri.c \
+	cms_rsa.c \
+	cms_sd.c \
+	cms_smime.c
+
+# crypto/comp
+.PATH:	${OPENSSL_SRC}/crypto/comp
+SRCS+=	\
+	comp_err.c \
+	comp_lib.c \
+	c_zlib.c
+
+# crypto/conf
+.PATH:	${OPENSSL_SRC}/crypto/conf
+SRCS+=	\
+	conf_api.c \
+	conf_def.c \
+	conf_err.c \
+	conf_lib.c \
+	conf_mall.c \
+	conf_mod.c \
+	conf_sap.c \
+	conf_ssl.c
+
+# crypto/crmf
+.PATH:	${OPENSSL_SRC}/crypto/crmf
+SRCS+=	\
+	crmf_asn.c \
+	crmf_err.c \
+	crmf_lib.c \
+	crmf_pbm.c
+
+# crypto/ct
+.PATH:	${OPENSSL_SRC}/crypto/ct
+SRCS+=	\
+	ct_b64.c \
+	ct_err.c \
+	ct_log.c \
+	ct_oct.c \
+	ct_policy.c \
+	ct_prn.c \
+	ct_sct.c \
+	ct_sct_ctx.c \
+	ct_vfy.c \
+	ct_x509v3.c
+
+# crypto/des
+.PATH:	${OPENSSL_SRC}/crypto/des
+SRCS+=	\
+	cbc_cksm.c \
+	cbc_enc.c \
+	cfb64ede.c \
+	cfb64enc.c \
+	cfb_enc.c \
+	des_enc.c \
+	ecb3_enc.c \
+	ecb_enc.c \
+	fcrypt_b.c \
+	fcrypt.c \
+	ofb64ede.c \
+	ofb64enc.c \
+	ofb_enc.c \
+	pcbc_enc.c \
+	qud_cksm.c \
+	rand_key.c \
+	set_key.c \
+	str2key.c \
 	xcbc_enc.c
 
-# dh
-SRCS+=	dh_ameth.c dh_asn1.c dh_backend.c dh_check.c dh_depr.c dh_err.c \
-	dh_gen.c dh_group_params.c dh_kdf.c dh_key.c dh_lib.c dh_meth.c \
-	dh_pmeth.c dh_prn.c dh_rfc5114.c
-
-# dsa
-SRCS+=	dsa_ameth.c dsa_asn1.c dsa_backend.c dsa_check.c dsa_depr.c dsa_err.c \
-	dsa_gen.c dsa_key.c dsa_lib.c dsa_meth.c dsa_ossl.c dsa_pmeth.c \
-	dsa_prn.c dsa_sign.c dsa_vrf.c
-
-# dso
-SRCS+=	dso_dl.c dso_dlfcn.c dso_err.c dso_lib.c dso_openssl.c dso_vms.c \
+# crypto/dh
+.PATH:	${OPENSSL_SRC}/crypto/dh
+SRCS+=	\
+	dh_ameth.c \
+	dh_asn1.c \
+	dh_backend.c \
+	dh_check.c \
+	dh_depr.c \
+	dh_err.c \
+	dh_gen.c \
+	dh_group_params.c \
+	dh_kdf.c \
+	dh_key.c \
+	dh_lib.c \
+	dh_meth.c \
+	dh_pmeth.c \
+	dh_prn.c \
+	dh_rfc5114.c
+
+# crypto/dsa
+.PATH:	${OPENSSL_SRC}/crypto/dsa
+SRCS+=	\
+	dsa_ameth.c \
+	dsa_asn1.c \
+	dsa_backend.c \
+	dsa_check.c \
+	dsa_depr.c \
+	dsa_err.c \
+	dsa_gen.c \
+	dsa_key.c \
+	dsa_lib.c \
+	dsa_meth.c \
+	dsa_ossl.c \
+	dsa_pmeth.c \
+	dsa_prn.c \
+	dsa_sign.c \
+	dsa_vrf.c
+
+# crypto/dso
+.PATH:	${OPENSSL_SRC}/crypto/dso
+SRCS+=	\
+	dso_dl.c \
+	dso_dlfcn.c \
+	dso_err.c \
+	dso_lib.c \
+	dso_openssl.c \
+	dso_vms.c \
 	dso_win32.c
 
-# ec
-SRCS+=	curve25519.c ec2_oct.c ec2_smpl.c ec_ameth.c ec_asn1.c ec_backend.c \
-	ec_check.c ec_curve.c ec_cvt.c ec_deprecated.c ec_err.c ec_key.c \
-	ec_kmeth.c ec_lib.c ec_mult.c ec_oct.c ec_pmeth.c ec_print.c \
-	ecdh_kdf.c ecdh_ossl.c ecdsa_ossl.c ecdsa_sign.c ecdsa_vrf.c \
-	eck_prn.c ecp_mont.c ecp_nist.c ecp_nistz256-x86_64.s x25519-x86_64.s \
-	curve448.c curve448_tables.c eddsa.c f_generic.c scalar.c f_impl32.c \
-	f_impl64.c
-
-# encode_decode
-SRCS+=	decoder_err.c decoder_lib.c decoder_meth.c decoder_pkey.c \
-	encoder_err.c encoder_lib.c encoder_meth.c encoder_pkey.c
-
-# engine
-SRCS+=	eng_all.c eng_cnf.c eng_ctrl.c eng_dyn.c eng_err.c eng_fat.c \
-	eng_init.c eng_lib.c eng_list.c eng_openssl.c eng_pkey.c eng_rdrand.c \
-	eng_table.c tb_asnmth.c tb_cipher.c tb_dh.c tb_digest.c tb_dsa.c \
-	tb_eckey.c tb_pkmeth.c tb_rand.c tb_rsa.c
-
-# err
-SRCS+=	err.c err_all.c err_all_legacy.c err_blocks.c err_prn.c
-
-# ess
-SRCS+=	ess_asn1.c ess_err.c ess_lib.c
-
-# evp
-SRCS+=	asymcipher.c bio_b64.c bio_enc.c bio_md.c bio_ok.c c_allc.c c_alld.c \
-	cmeth_lib.c ctrl_params_translate.c dh_ctrl.c dh_support.c digest.c \
-	dsa_ctrl.c e_aes.c e_aes_cbc_hmac_sha1.c e_aes_cbc_hmac_sha256.c \
-	e_aria.c e_bf.c e_camellia.c e_cast.c e_chacha20_poly1305.c e_des.c \
-	e_des3.c e_idea.c e_null.c e_old.c e_rc2.c e_rc4.c e_rc4_hmac_md5.c \
-	e_rc5.c e_seed.c e_sm4.c e_xcbc_d.c ec_ctrl.c ec_support.c encode.c \
-	evp_cnf.c evp_enc.c evp_err.c evp_fetch.c evp_key.c evp_lib.c \
-	evp_pbe.c  evp_pkey.c evp_rand.c evp_utils.c exchange.c kdf_lib.c \
-	kdf_meth.c kem.c keymgmt_lib.c keymgmt_meth.c legacy_blake2.c \
-	legacy_md4.c legacy_md5.c legacy_md5_sha1.c legacy_mdc2.c \
-	legacy_ripemd.c legacy_sha.c legacy_wp.c m_null.c m_sigver.c \
-	mac_lib.c mac_meth.c names.c p5_crpt.c p5_crpt2.c p_dec.c p_enc.c \
-	p_legacy.c p_lib.c p_open.c p_seal.c p_sign.c p_verify.c pbe_scrypt.c \
-	pmeth_check.c  pmeth_gn.c pmeth_lib.c signature.c
-
-# ffc
-SRCS+=	ffc_backend.c ffc_dh.c ffc_key_generate.c ffc_key_validate.c \
-	ffc_params.c ffc_params_generate.c ffc_params_validate.c
-
-# hmac
-SRCS+=	hmac.c
-
-# http
-SRCS+=	http_client.c http_err.c http_lib.c
-
-# idea
-SRCS+=	i_cbc.c i_cfb64.c i_ecb.c i_ofb64.c i_skey.c
-
-# kdf
-SRCS+=	kdf_err.c
-
-# lhash
-SRCS+=	lh_stats.c lhash.c
-
-# md4
-SRCS+=	md4_dgst.c md4_one.c
-
-# md5
-SRCS+=	md5_dgst.c md5_one.c md5_sha1.c md5-x86_64.s
-
-# mdc2
-SRCS+=	mdc2_one.c mdc2dgst.c
-
-# modes
-SRCS+=	aesni-gcm-x86_64.s cbc128.c ccm128.c cfb128.c ctr128.c cts128.c \
-	gcm128.c ghash-x86_64.s ocb128.c ofb128.c siv128.c wrap128.c \
+# crypto/ec
+.PATH:	${OPENSSL_SRC}/crypto/ec
+.PATH:	${OPENSSL_SRC}/crypto/ec/curve448
+.PATH:	${OPENSSL_SRC}/crypto/ec/curve448/arch_32
+.PATH:	${OPENSSL_SRC}/crypto/ec/curve448/arch_64
+SRCS+=	\
+	curve25519.c \
+	curve448.c \
+	curve448_tables.c \
+	ec2_oct.c \
+	ec2_smpl.c \
+	ec_ameth.c \
+	ec_asn1.c \
+	ec_backend.c \
+	ec_check.c \
+	ec_curve.c \
+	ec_cvt.c \
+	ec_deprecated.c \
+	ecdh_kdf.c \
+	ecdh_ossl.c \
+	ecdsa_ossl.c \
+	ecdsa_sign.c \
+	ecdsa_vrf.c \
+	ec_err.c \
+	ec_key.c \
+	ec_kmeth.c \
+	eck_prn.c \
+	ec_lib.c \
+	ec_mult.c \
+	ec_oct.c \
+	ec_pmeth.c \
+	ecp_mont.c \
+	ecp_nist.c \
+	ecp_nistz256.c \
+	ecp_nistz256-x86_64.s \
+	ecp_oct.c \
+	ec_print.c \
+	ecp_smpl.c \
+	ecx_backend.c \
+	ecx_key.c \
+	ecx_meth.c \
+	eddsa.c \
+	f_generic.c \
+	f_impl32.c \
+	f_impl64.c \
+	scalar.c \
+	x25519-x86_64.s
+
+# crypto/encode_decode
+.PATH:	${OPENSSL_SRC}/crypto/encode_decode
+SRCS+=	\
+	decoder_err.c \
+	decoder_lib.c \
+	decoder_meth.c \
+	decoder_pkey.c \
+	encoder_err.c \
+	encoder_lib.c \
+	encoder_meth.c \
+	encoder_pkey.c
+
+# crypto/engine
+.PATH:	${OPENSSL_SRC}/crypto/engine
+SRCS+=	\
+	eng_all.c \
+	eng_cnf.c \
+	eng_ctrl.c \
+	eng_dyn.c \
+	eng_err.c \
+	eng_fat.c \
+	eng_init.c \
+	eng_lib.c \
+	eng_list.c \
+	eng_openssl.c \
+	eng_pkey.c \
+	eng_rdrand.c \
+	eng_table.c \
+	tb_asnmth.c \
+	tb_cipher.c \
+	tb_dh.c \
+	tb_digest.c \
+	tb_dsa.c \
+	tb_eckey.c \
+	tb_pkmeth.c \
+	tb_rand.c \
+	tb_rsa.c
+
+# crypto/err
+.PATH:	${OPENSSL_SRC}/crypto/err
+SRCS+=	\
+	err_all.c \
+	err_all_legacy.c \
+	err_blocks.c \
+	err.c \
+	err_prn.c
+
+# crypto/ess
+.PATH:	${OPENSSL_SRC}/crypto/ess
+SRCS+=	\
+	ess_asn1.c \
+	ess_err.c \
+	ess_lib.c
+
+# crypto/evp
+.PATH:	${OPENSSL_SRC}/crypto/evp
+SRCS+=	\
+	asymcipher.c \
+	bio_b64.c \
+	bio_enc.c \
+	bio_md.c \
+	bio_ok.c \
+	c_allc.c \
+	c_alld.c \
+	cmeth_lib.c \
+	ctrl_params_translate.c \
+	dh_ctrl.c \
+	dh_support.c \
+	digest.c \
+	dsa_ctrl.c \
+	e_aes.c \
+	e_aes_cbc_hmac_sha1.c \
+	e_aes_cbc_hmac_sha256.c \
+	e_aria.c \
+	e_bf.c \
+	e_camellia.c \
+	e_cast.c \
+	ec_ctrl.c \
+	e_chacha20_poly1305.c \
+	ec_support.c \
+	e_des3.c \
+	e_des.c \
+	e_idea.c \
+	encode.c \
+	e_null.c \
+	e_old.c \
+	e_rc2.c \
+	e_rc4.c \
+	e_rc4_hmac_md5.c \
+	e_rc5.c \
+	e_seed.c \
+	e_sm4.c \
+	evp_cnf.c \
+	evp_enc.c \
+	evp_err.c \
+	evp_fetch.c \
+	evp_key.c \
+	evp_lib.c \
+	evp_pbe.c \
+	evp_pkey.c \
+	evp_rand.c \
+	evp_utils.c \
+	e_xcbc_d.c \
+	exchange.c \
+	kdf_lib.c \
+	kdf_meth.c \
+	kem.c \
+	keymgmt_lib.c \
+	keymgmt_meth.c \
+	legacy_blake2.c \
+	legacy_md4.c \
+	legacy_md5.c \
+	legacy_md5_sha1.c \
+	legacy_mdc2.c \
+	legacy_ripemd.c \
+	legacy_sha.c \
+	legacy_wp.c \
+	mac_lib.c \
+	mac_meth.c \
+	m_null.c \
+	m_sigver.c \
+	names.c \
+	p5_crpt2.c \
+	p5_crpt.c \
+	pbe_scrypt.c \
+	p_dec.c \
+	p_enc.c \
+	p_legacy.c \
+	p_lib.c \
+	pmeth_check.c \
+	pmeth_gn.c \
+	pmeth_lib.c \
+	p_open.c \
+	p_seal.c \
+	p_sign.c \
+	p_verify.c \
+	signature.c
+
+# crypto/ffc
+.PATH:	${OPENSSL_SRC}/crypto/ffc
+SRCS+=	\
+	ffc_backend.c \
+	ffc_dh.c \
+	ffc_key_generate.c \
+	ffc_key_validate.c \
+	ffc_params.c \
+	ffc_params_generate.c \
+	ffc_params_validate.c
+
+# crypto/hmac
+.PATH:	${OPENSSL_SRC}/crypto/hmac
+SRCS+=	\
+	hmac.c
+
+# crypto/http
+.PATH:	${OPENSSL_SRC}/crypto/http
+SRCS+=	\
+	http_client.c \
+	http_err.c \
+	http_lib.c
+
+# crypto/idea
+.PATH:	${OPENSSL_SRC}/crypto/idea
+SRCS+=	\
+	i_cbc.c \
+	i_cfb64.c \
+	i_ecb.c \
+	i_ofb64.c \
+	i_skey.c
+
+# crypto/kdf
+.PATH:	${OPENSSL_SRC}/crypto/kdf
+SRCS+=	\
+	kdf_err.c
+
+# crypto/lhash
+.PATH:	${OPENSSL_SRC}/crypto/lhash
+SRCS+=	\
+	lhash.c \
+	lh_stats.c
+
+# crypto/md4
+.PATH:	${OPENSSL_SRC}/crypto/md4
+SRCS+=	\
+	md4_dgst.c \
+	md4_one.c
+
+# crypto/md5
+.PATH:	${OPENSSL_SRC}/crypto/md5
+SRCS+=	\
+	md5_dgst.c \
+	md5_one.c \
+	md5_sha1.c \
+	md5-x86_64.s
+
+# crypto/mdc2
+.PATH:	${OPENSSL_SRC}/crypto/mdc2
+SRCS+=	\
+	mdc2dgst.c \
+	mdc2_one.c
+
+# crypto/modes
+.PATH:	${OPENSSL_SRC}/crypto/modes
+SRCS+=	\
+	aesni-gcm-x86_64.s \
+	cbc128.c \
+	ccm128.c \
+	cfb128.c \
+	ctr128.c \
+	cts128.c \
+	gcm128.c \
+	ghash-x86_64.s \
+	ocb128.c \
+	ofb128.c \
+	siv128.c \
+	wrap128.c \
 	xts128.c
 
-# objects
-SRCS+=	o_names.c obj_dat.c obj_err.c obj_lib.c obj_xref.c
-
-# ocsp
-SRCS+=	ocsp_asn.c ocsp_cl.c ocsp_err.c ocsp_ext.c ocsp_http.c ocsp_lib.c \
-	ocsp_prn.c ocsp_srv.c ocsp_vfy.c v3_ocsp.c
-
-# pem
-SRCS+=	pem_all.c pem_err.c pem_info.c pem_lib.c pem_oth.c pem_pk8.c \
-	pem_pkey.c pem_sign.c pem_x509.c pem_xaux.c pvkfmt.c
-
-# pkcs12
-SRCS+=	p12_add.c p12_asn.c p12_attr.c p12_crpt.c p12_crt.c p12_decr.c \
-	p12_init.c p12_key.c p12_kiss.c p12_mutl.c p12_npas.c p12_p8d.c \
-	p12_p8e.c p12_sbag.c p12_utl.c pk12err.c
-
-# pkcs7
-SRCS+=	bio_pk7.c pk7_asn1.c pk7_attr.c pk7_doit.c pk7_lib.c pk7_mime.c \
-	pk7_smime.c pkcs7err.c
-
-# poly1305
-SRCS+=	poly1305-x86_64.s poly1305.c
-
-# property
-SRCS+=	defn_cache.c property.c property_err.c property_parse.c \
-	property_query.c property_string.c
-
-# rand
-SRCS+=	prov_seed.c rand_deprecated.c rand_err.c rand_lib.c rand_meth.c \
-	rand_pool.c randfile.c
-
-# rc2
-SRCS+=	rc2_cbc.c rc2_ecb.c rc2_skey.c rc2cfb64.c rc2ofb64.c
-
-# rc4
-SRCS+=	rc4-md5-x86_64.s rc4-x86_64.s
-
-# ripemd
-SRCS+=	rmd_dgst.c rmd_one.c
-
-# rsa
-SRCS+=	rsa_ameth.c rsa_asn1.c rsa_backend.c rsa_chk.c rsa_crpt.c rsa_depr.c \
-	rsa_err.c rsa_gen.c rsa_lib.c rsa_meth.c rsa_mp.c rsa_mp_names.c \
-	rsa_none.c rsa_oaep.c rsa_ossl.c rsa_pk1.c rsa_pmeth.c rsa_prn.c \
-	rsa_pss.c rsa_saos.c rsa_schemes.c rsa_sign.c rsa_sp800_56b_check.c \
-	rsa_sp800_56b_gen.c rsa_x931.c rsa_x931g.c
-
-# seed
-SRCS+=	seed.c seed_cbc.c seed_cfb.c seed_ecb.c seed_ofb.c
-
-# sha
-SRCS+=	keccak1600-x86_64.s sha1-mb-x86_64.s sha1-x86_64.s sha1_one.c \
-	sha1dgst.c sha256-mb-x86_64.s sha256-x86_64.s sha256.c sha3.c \
-	sha512-x86_64.s sha512.c
-
-# siphash
-SRCS+=	siphash.c
-
-# sm2
-SRCS+=	sm2_crypt.c sm2_err.c sm2_key.c sm2_sign.c
-
-# sm3
-SRCS+=	legacy_sm3.c sm3.c
-
-# sm4
-SRCS+=	sm4.c
-
-# srp
-SRCS+=	srp_lib.c srp_vfy.c
-
-# stack
-SRCS+=	stack.c
-
-# store
-SRCS+=	store_err.c store_init.c store_lib.c store_meth.c store_register.c \
-	store_result.c store_strings.c
-
-# ts
-SRCS+=	ts_asn1.c ts_conf.c ts_err.c ts_lib.c ts_req_print.c ts_req_utils.c \
-	ts_rsp_print.c ts_rsp_sign.c ts_rsp_utils.c ts_rsp_verify.c \
+# crypto/objects
+.PATH:	${OPENSSL_SRC}/crypto/objects
+SRCS+=	\
+	obj_dat.c \
+	obj_err.c \
+	obj_lib.c \
+	obj_xref.c \
+	o_names.c
+
+# crypto/ocsp
+.PATH:	${OPENSSL_SRC}/crypto/ocsp
+SRCS+=	\
+	ocsp_asn.c \
+	ocsp_cl.c \
+	ocsp_err.c \
+	ocsp_ext.c \
+	ocsp_http.c \
+	ocsp_lib.c \
+	ocsp_prn.c \
+	ocsp_srv.c \
+	ocsp_vfy.c \
+	v3_ocsp.c
+
+# crypto/pem
+.PATH:	${OPENSSL_SRC}/crypto/pem
+SRCS+=	\
+	pem_all.c \
+	pem_err.c \
+	pem_info.c \
+	pem_lib.c \
+	pem_oth.c \
+	pem_pk8.c \
+	pem_pkey.c \
+	pem_sign.c \
+	pem_x509.c \
+	pem_xaux.c \
+	pvkfmt.c
+
+# crypto/pkcs12
+.PATH:	${OPENSSL_SRC}/crypto/pkcs12
+SRCS+=	\
+	p12_add.c \
+	p12_asn.c \
+	p12_attr.c \
+	p12_crpt.c \
+	p12_crt.c \
+	p12_decr.c \
+	p12_init.c \
+	p12_key.c \
+	p12_kiss.c \
+	p12_mutl.c \
+	p12_npas.c \
+	p12_p8d.c \
+	p12_p8e.c \
+	p12_sbag.c \
+	p12_utl.c \
+	pk12err.c
+
+# crypto/pkcs7
+.PATH:	${OPENSSL_SRC}/crypto/pkcs7
+SRCS+=	\
+	bio_pk7.c \
+	pk7_asn1.c \
+	pk7_attr.c \
+	pk7_doit.c \
+	pk7_lib.c \
+	pk7_mime.c \
+	pk7_smime.c \
+	pkcs7err.c
+
+# crypto/poly1305
+.PATH:	${OPENSSL_SRC}/crypto/poly1305
+SRCS+=	\
+	poly1305.c \
+	poly1305-x86_64.s
+
+# crypto/property
+.PATH:	${OPENSSL_SRC}/crypto/property
+SRCS+=	\
+	defn_cache.c \
+	property.c \
+	property_err.c \
+	property_parse.c \
+	property_query.c \
+	property_string.c
+
+# crypto/rand
+.PATH:	${OPENSSL_SRC}/crypto/rand
+SRCS+=	\
+	prov_seed.c \
+	rand_deprecated.c \
+	rand_err.c \
+	randfile.c \
+	rand_lib.c \
+	rand_meth.c \
+	rand_pool.c
+
+# crypto/rc2
+.PATH:	${OPENSSL_SRC}/crypto/rc2
+SRCS+=	\
+	rc2_cbc.c \
+	rc2cfb64.c \
+	rc2_ecb.c \
+	rc2ofb64.c \
+	rc2_skey.c
+
+# crypto/rc4
+.PATH:	${OPENSSL_SRC}/crypto/rc4
+SRCS+=	\
+	rc4-md5-x86_64.s \
+	rc4-x86_64.s
+
+# crypto/ripemd
+.PATH:	${OPENSSL_SRC}/crypto/ripemd
+SRCS+=	\
+	rmd_dgst.c \
+	rmd_one.c
+
+# crypto/rsa
+.PATH:	${OPENSSL_SRC}/crypto/rsa
+SRCS+=	\
+	rsa_ameth.c \
+	rsa_asn1.c \
+	rsa_backend.c \
+	rsa_chk.c \
+	rsa_crpt.c \
+	rsa_depr.c \
+	rsa_err.c \
+	rsa_gen.c \
+	rsa_lib.c \
+	rsa_meth.c \
+	rsa_mp.c \
+	rsa_mp_names.c \
+	rsa_none.c \
+	rsa_oaep.c \
+	rsa_ossl.c \
+	rsa_pk1.c \
+	rsa_pmeth.c \
+	rsa_prn.c \
+	rsa_pss.c \
+	rsa_saos.c \
+	rsa_schemes.c \
+	rsa_sign.c \
+	rsa_sp800_56b_check.c \
+	rsa_sp800_56b_gen.c \
+	rsa_x931.c \
+	rsa_x931g.c
+
+# crypto/seed
+.PATH:	${OPENSSL_SRC}/crypto/seed
+SRCS+=	\
+	seed.c \
+	seed_cbc.c \
+	seed_cfb.c \
+	seed_ecb.c \
+	seed_ofb.c
+
+# crypto/sha
+.PATH:	${OPENSSL_SRC}/crypto/sha
+SRCS+=	\
+	keccak1600-x86_64.s \
+	sha1dgst.c \
+	sha1-mb-x86_64.s \
+	sha1_one.c \
+	sha1-x86_64.s \
+	sha256.c \
+	sha256-mb-x86_64.s \
+	sha256-x86_64.s \
+	sha3.c \
+	sha512.c \
+	sha512-x86_64.s
+
+# crypto/siphash
+.PATH:	${OPENSSL_SRC}/crypto/siphash
+SRCS+=	\
+	siphash.c
+
+# crypto/sm2
+.PATH:	${OPENSSL_SRC}/crypto/sm2
+SRCS+=	\
+	sm2_crypt.c \
+	sm2_err.c \
+	sm2_key.c \
+	sm2_sign.c
+
+# crypto/sm3
+.PATH:	${OPENSSL_SRC}/crypto/sm3
+SRCS+=	\
+	legacy_sm3.c \
+	sm3.c
+
+# crypto/sm4
+.PATH:	${OPENSSL_SRC}/crypto/sm4
+SRCS+=	\
+	sm4.c
+
+# crypto/srp
+.PATH:	${OPENSSL_SRC}/crypto/srp
+SRCS+=	\
+	srp_lib.c \
+	srp_vfy.c
+
+# crypto/stack
+.PATH:	${OPENSSL_SRC}/crypto/stack
+SRCS+=	\
+	stack.c
+
+# crypto/store
+.PATH:	${OPENSSL_SRC}/crypto/store
+SRCS+=	\
+	store_err.c \
+	store_init.c \
+	store_lib.c \
+	store_meth.c \
+	store_register.c \
+	store_result.c \
+	store_strings.c
+
+# crypto/ts
+.PATH:	${OPENSSL_SRC}/crypto/ts
+SRCS+=	\
+	ts_asn1.c \
+	ts_conf.c \
+	ts_err.c \
+	ts_lib.c \
+	ts_req_print.c \
+	ts_req_utils.c \
+	ts_rsp_print.c \
+	ts_rsp_sign.c \
+	ts_rsp_utils.c \
+	ts_rsp_verify.c \
 	ts_verify_ctx.c
 
-# txt_db
-SRCS+=	txt_db.c
-
-# ui
-SRCS+=	ui_err.c ui_lib.c ui_null.c ui_openssl.c ui_util.c
-
-# whrlpool
-SRCS+=	wp-x86_64.s wp_dgst.c
-
-# x509
-SRCS+=	by_dir.c by_file.c by_store.c pcy_cache.c pcy_data.c pcy_lib.c \
-	pcy_map.c pcy_node.c pcy_tree.c t_crl.c t_req.c t_x509.c v3_addr.c \
-	v3_admis.c v3_akeya.c v3_akid.c v3_asid.c v3_bcons.c v3_bitst.c \
-	v3_conf.c v3_cpols.c v3_crld.c v3_enum.c v3_extku.c v3_genn.c \
-	v3_ia5.c v3_info.c v3_int.c v3_ist.c v3_lib.c v3_ncons.c v3_pci.c \
-	v3_pcia.c v3_pcons.c v3_pku.c v3_pmaps.c v3_prn.c v3_purp.c v3_san.c \
-	v3_skid.c v3_sxnet.c v3_tlsf.c v3_utf8.c v3_utl.c v3err.c x509_att.c \
-	x509_cmp.c x509_d2.c x509_def.c x509_err.c x509_ext.c x509_lu.c \
-	x509_meth.c x509_obj.c x509_r2x.c x509_req.c x509_set.c x509_trust.c \
-	x509_txt.c x509_v3.c x509_vfy.c x509_vpm.c x509cset.c x509name.c \
-	x509rset.c x509spki.c x509type.c x_all.c x_attrib.c x_crl.c x_exten.c \
-	x_name.c x_pubkey.c x_req.c x_x509.c x_x509a.c
+# crypto/txt_db
+.PATH:	${OPENSSL_SRC}/crypto/txt_db
+SRCS+=	\
+	txt_db.c
+
+# crypto/ui
+.PATH:	${OPENSSL_SRC}/crypto/ui
+SRCS+=	\
+	ui_err.c \
+	ui_lib.c \
+	ui_null.c \
+	ui_openssl.c \
+	ui_util.c
+
+# crypto/whrlpool
+.PATH:	${OPENSSL_SRC}/crypto/whrlpool
+SRCS+=	\
+	wp_dgst.c \
+	wp-x86_64.s
+
+# crypto/x509
+.PATH:	${OPENSSL_SRC}/crypto/x509
+SRCS+=	\
+	by_dir.c \
+	by_file.c \
+	by_store.c \
+	pcy_cache.c \
+	pcy_data.c \
+	pcy_lib.c \
+	pcy_map.c \
+	pcy_node.c \
+	pcy_tree.c \
+	t_crl.c \
+	t_req.c \
+	t_x509.c \
+	v3_addr.c \
+	v3_admis.c \
+	v3_akeya.c \
+	v3_akid.c \
+	v3_asid.c \
+	v3_bcons.c \
+	v3_bitst.c \
+	v3_conf.c \
+	v3_cpols.c \
+	v3_crld.c \
+	v3_enum.c \
+	v3err.c \
+	v3_extku.c \
+	v3_genn.c \
+	v3_ia5.c \
+	v3_info.c \
+	v3_int.c \
+	v3_ist.c \
+	v3_lib.c \
+	v3_ncons.c \
+	v3_pcia.c \
+	v3_pci.c \
+	v3_pcons.c \
+	v3_pku.c \
+	v3_pmaps.c \
+	v3_prn.c \
+	v3_purp.c \
+	v3_san.c \
+	v3_skid.c \
+	v3_sxnet.c \
+	v3_tlsf.c \
+	v3_utf8.c \
+	v3_utl.c \
+	x509_att.c \
+	x509_cmp.c \
+	x509cset.c \
+	x509_d2.c \
+	x509_def.c \
+	x509_err.c \
+	x509_ext.c \
+	x509_lu.c \
+	x509_meth.c \
+	x509name.c \
+	x509_obj.c \
+	x509_r2x.c \
+	x509_req.c \
+	x509rset.c \
+	x509_set.c \
+	x509spki.c \
+	x509_trust.c \
+	x509_txt.c \
+	x509type.c \
+	x509_v3.c \
+	x509_vfy.c \
+	x509_vpm.c \
+	x_all.c \
+	x_attrib.c \
+	x_crl.c \
+	x_exten.c \
+	x_name.c \
+	x_pubkey.c \
+	x_req.c \
+	x_x509a.c \
+	x_x509.c
+
+# providers
+.PATH:	${OPENSSL_SRC}/providers
+SRCS+=	\
+	baseprov.c \
+	defltprov.c \
+	nullprov.c \
+	prov_running.c
+
+# providers/common
+.PATH:	${OPENSSL_SRC}/providers/common
+.PATH:	${OPENSSL_SRC}/providers/common/der
+SRCS+=	\
+	bio_prov.c \
+	capabilities.c \
+	der_digests_gen.c \
+	der_dsa_gen.c \
+	der_dsa_key.c \
+	der_dsa_sig.c \
+	der_ec_gen.c \
+	der_ec_key.c \
+	der_ec_sig.c \
+	der_ecx_gen.c \
+	der_ecx_key.c \
+	der_rsa_gen.c \
+	der_rsa_key.c \
+	der_rsa_sig.c \
+	der_sm2_gen.c \
+	der_sm2_key.c \
+	der_sm2_sig.c \
+	der_wrap_gen.c \
+	digest_to_nid.c \
+	provider_ctx.c \
+	provider_err.c \
+	provider_seeding.c \
+	provider_util.c \
+	securitycheck.c \
+	securitycheck_default.c
+
+# providers/implementations
+.PATH:	${OPENSSL_SRC}/providers/implementations/asymciphers
+.PATH:	${OPENSSL_SRC}/providers/implementations/ciphers
+.PATH:	${OPENSSL_SRC}/providers/implementations/digests
+.PATH:	${OPENSSL_SRC}/providers/implementations/encode_decode
+.PATH:	${OPENSSL_SRC}/providers/implementations/exchange
+.PATH:	${OPENSSL_SRC}/providers/implementations/kdfs
+.PATH:	${OPENSSL_SRC}/providers/implementations/kem
+.PATH:	${OPENSSL_SRC}/providers/implementations/keymgmt
+.PATH:	${OPENSSL_SRC}/providers/implementations/macs
+.PATH:	${OPENSSL_SRC}/providers/implementations/rands
+.PATH:	${OPENSSL_SRC}/providers/implementations/rands/seeding
+.PATH:	${OPENSSL_SRC}/providers/implementations/signature
+.PATH:	${OPENSSL_SRC}/providers/implementations/storemgmt
+SRCS+=	\
+	blake2b_mac.c \
+	blake2b_prov.c \
+	blake2_prov.c \
+	blake2s_mac.c \
+	blake2s_prov.c \
+	cipher_aes.c \
+	cipher_aes_cbc_hmac_sha1_hw.c \
+	cipher_aes_cbc_hmac_sha256_hw.c \
+	cipher_aes_cbc_hmac_sha.c \
+	cipher_aes_ccm.c \
+	cipher_aes_ccm_hw.c \
+	cipher_aes_gcm.c \
+	cipher_aes_gcm_hw.c \
+	cipher_aes_hw.c \
+	cipher_aes_ocb.c \
+	cipher_aes_ocb_hw.c \
+	cipher_aes_siv.c \
+	cipher_aes_siv_hw.c \
+	cipher_aes_wrp.c \
+	cipher_aes_xts.c \
+	cipher_aes_xts_fips.c \
+	cipher_aes_xts_hw.c \
+	cipher_aria.c \
+	cipher_aria_ccm.c \
+	cipher_aria_ccm_hw.c \
+	cipher_aria_gcm.c \
+	cipher_aria_gcm_hw.c \
+	cipher_aria_hw.c \
+	cipher_camellia.c \
+	cipher_camellia_hw.c \
+	cipher_chacha20.c \
+	cipher_chacha20_hw.c \
+	cipher_chacha20_poly1305.c \
+	cipher_chacha20_poly1305_hw.c \
+	ciphercommon_block.c \
+	ciphercommon.c \
+	ciphercommon_ccm.c \
+	ciphercommon_ccm_hw.c \
+	ciphercommon_gcm.c \
+	ciphercommon_gcm_hw.c \
+	ciphercommon_hw.c \
+	cipher_cts.c \
+	cipher_null.c \
+	cipher_sm4.c \
+	cipher_sm4_hw.c \
+	cipher_tdes.c \
+	cipher_tdes_common.c \
+	cipher_tdes_default.c \
+	cipher_tdes_default_hw.c \
+	cipher_tdes_hw.c \
+	cipher_tdes_wrap.c \
+	cipher_tdes_wrap_hw.c \
+	cmac_prov.c \
+	crngt.c \
+	decode_der2key.c \
+	decode_epki2pki.c \
+	decode_msblob2key.c \
+	decode_pem2der.c \
+	decode_pvk2key.c \
+	decode_spki2typespki.c \
+	dh_exch.c \
+	dh_kmgmt.c \
+	digestcommon.c \
+	drbg.c \
+	drbg_ctr.c \
+	drbg_hash.c \
+	drbg_hmac.c \
+	dsa_kmgmt.c \
+	dsa_sig.c \
+	ecdh_exch.c \
+	ecdsa_sig.c \
+	ec_kmgmt.c \
+	ecx_exch.c \
+	ecx_kmgmt.c \
+	eddsa_sig.c \
+	encode_key2any.c \
+	encode_key2blob.c \
+	encode_key2ms.c \
+	encode_key2text.c \
+	endecoder_common.c \
+	file_store_any2obj.c \
+	file_store.c \
+	gmac_prov.c \
+	hkdf.c \
+	hmac_prov.c \
+	kbkdf.c \
+	kdf_exch.c \
+	kdf_legacy_kmgmt.c \
+	kmac_prov.c \
+	krb5kdf.c \
+	mac_legacy_kmgmt.c \
+	mac_legacy_sig.c \
+	md5_prov.c \
+	md5_sha1_prov.c \
+	pbkdf2.c \
+	pbkdf2_fips.c \
+	pkcs12kdf.c \
+	poly1305_prov.c \
+	rand_cpu_x86.c \
+	rand_tsc.c \
+	rand_unix.c \
+	rand_win.c \
+	rsa_enc.c \
+	rsa_kem.c \
+	rsa_kmgmt.c \
+	rsa_sig.c \
+	scrypt.c \
+	seed_src.c \
+	sha2_prov.c \
+	sha3_prov.c \
+	siphash_prov.c \
+	sm2_enc.c \
+	sm2_sig.c \
+	sm3_prov.c \
+	sshkdf.c \
+	sskdf.c \
+	test_rng.c \
+	tls1_prf.c \
+	x942kdf.c
+
+# ssl
+.PATH:	${OPENSSL_SRC}/ssl
+SRCS+=	\
+	s3_cbc.c
+
+# ssl/record
+.PATH:	${OPENSSL_SRC}/ssl/record
+SRCS+=	\
+	tls_pad.c
+
+.PATH:	${OPENSSL_SRC}/include/openssl
+INCS=	asn1.h asn1err.h async.h asyncerr.h bio.h bioerr.h bn.h bnerr.h buffer.h buffererr.h comp.h comperr.h conf.h conferr.h configuration.h conftypes.h core.h core_dispatch.h crypto.h cryptoerr.h cryptoerr_legacy.h ct.h cterr.h des.h dh.h dherr.h dsa.h dsaerr.h ebcdic.h ec.h ecerr.h e_os2.h err.h evp.h evperr.h hmac.h http.h lhash.h macros.h md4.h md5.h \
+	objects.h objectserr.h obj_mac.h opensslconf.h opensslv.h ocsp.h ocsperr.h ossl_typ.h params.h pem.h pemerr.h pkcs7.h pkcs7err.h rc4.h ripemd.h rsa.h rsaerr.h safestack.h sha.h stack.h symhacks.h types.h x509.h x509err.h x509v3.h x509v3err.h x509_vfy.h
 
 CFLAGS+=-DAES_ASM \
 	-DBSAES_ASM \
@@ -390,15 +1238,18 @@ CFLAGS+=-DAES_ASM \
 	-DX25519_ASM \
 	-Wa,--noexecstack \
 	-DL_ENDIAN \
+	${PRIVATELIB_CFLAGS} \
 	-I${OPENSSL_SRC} \
 	-I${OPENSSL_SRC}/include \
 	-I${OPENSSL_SRC}/providers/common/include \
 	-I${OPENSSL_SRC}/providers/implementations/include \
 	-DOPENSSLDIR="\"/etc/ssl\"" \
-	-DENGINESDIR="\"/dev/null\"" \
-	-DMODULESDIR="\"/dev/null\""
+	-DENGINESDIR="\"${LIBDIR}/engines\"" \
+	-DMODULESDIR="\"${LIBDIR}/ossl-modules\""
 
 DPADD=	${LIBPTHREAD}
 LDADD=	-lpthread
 
+SUBDIR=	engines
+
 .include <bsd.lib.mk>
diff --git a/lib/libcrypto/engines/Makefile b/lib/libcrypto/engines/Makefile
index 14d92d71b8..fbb72af055 100644
--- a/lib/libcrypto/engines/Makefile
+++ b/lib/libcrypto/engines/Makefile
@@ -1,14 +1,8 @@
-SUBDIR=	lib4758cca \
-	libaep \
-	libatalla \
-	libcapi \
-	libchil \
-	libcswift \
-	libgost \
-	libgmp \
-	libnuron \
-	libpadlock \
-	libsureware \
-	libubsec
+# $FreeBSD$
+
+SUBDIR=		capi
+.if ${MACHINE_ARCH} == "x86_64"
+SUBDIR+=	padlock
+.endif
 
 .include <bsd.subdir.mk>
diff --git a/lib/libcrypto/engines/Makefile.inc b/lib/libcrypto/engines/Makefile.inc
index cae56ecd68..4c91e21070 100644
--- a/lib/libcrypto/engines/Makefile.inc
+++ b/lib/libcrypto/engines/Makefile.inc
@@ -1,4 +1,15 @@
-LCRYPTO_SRC=	${.CURDIR}/../../../../../crypto/openssl
-SHLIBDIR?=	/usr/lib/engines
+# $FreeBSD$
 
-.PATH:	${LCRYPTO_SRC}/engines
+SHLIBDIR=	${LIBDIR}/engines
+
+OPENSSL_SRC=	${.CURDIR}/../../../../crypto/openssl
+
+CFLAGS+=	-I${OPENSSL_SRC}/engines
+CFLAGS+=	-I${OPENSSL_SRC}/include
+CFLAGS+=	-I${OBJTOP}/secure/lib/libcrypto
+CFLAGS+=	-DL_ENDIAN
+CFLAGS+=	-DNDEBUG
+
+.PATH: ${OPENSSL_SRC}/engines
+
+WARNS?=		0
diff --git a/lib/libcrypto/engines/capi/Makefile b/lib/libcrypto/engines/capi/Makefile
new file mode 100644
index 0000000000..85b509e7b6
--- /dev/null
+++ b/lib/libcrypto/engines/capi/Makefile
@@ -0,0 +1,7 @@
+# $FreeBSD$
+
+SHLIB_NAME?=	capi.so
+
+SRCS=	e_capi.c
+
+.include <bsd.lib.mk>
diff --git a/lib/libcrypto/engines/padlock/Makefile b/lib/libcrypto/engines/padlock/Makefile
new file mode 100644
index 0000000000..9d0462115b
--- /dev/null
+++ b/lib/libcrypto/engines/padlock/Makefile
@@ -0,0 +1,10 @@
+# $FreeBSD$
+
+SHLIB_NAME?=	padlock.so
+
+SRCS=	e_padlock.c
+.if ${MACHINE_ARCH} == "x86_64"
+SRCS+=	e_padlock-x86_64.s
+.endif
+
+.include <bsd.lib.mk>
diff --git a/lib/libdmsg/crypto.c b/lib/libdmsg/crypto.c
index 15a1906e22..97bec73b33 100644
--- a/lib/libdmsg/crypto.c
+++ b/lib/libdmsg/crypto.c
@@ -114,13 +114,13 @@ dmsg_crypto_gcm_init(dmsg_ioq_t *ioq, char *key, int klen,
 		dmx_printf(6, "%02x", (unsigned char)iv_fixed[i]);
 	dmx_printf(6, "%s\n", " (fixed part only)");
 
-	EVP_CIPHER_CTX_init(&ioq->ctx);
+	EVP_CIPHER_CTX_init(ioq->ctx);
 
 	if (enc)
-		ok = EVP_EncryptInit_ex(&ioq->ctx, EVP_aes_256_gcm(), NULL,
+		ok = EVP_EncryptInit_ex(ioq->ctx, EVP_aes_256_gcm(), NULL,
 					(unsigned char*)key, NULL);
 	else
-		ok = EVP_DecryptInit_ex(&ioq->ctx, EVP_aes_256_gcm(), NULL,
+		ok = EVP_DecryptInit_ex(ioq->ctx, EVP_aes_256_gcm(), NULL,
 					(unsigned char*)key, NULL);
 	if (!ok)
 		goto fail;
@@ -143,7 +143,7 @@ dmsg_crypto_gcm_init(dmsg_ioq_t *ioq, char *key, int klen,
 	 * With a chunk size of 64 bytes, this adds up to 1 zettabyte of
 	 * traffic.
 	 */
-	ok = EVP_CIPHER_CTX_ctrl(&ioq->ctx, EVP_CTRL_GCM_SET_IVLEN,
+	ok = EVP_CIPHER_CTX_ctrl(ioq->ctx, EVP_CTRL_GCM_SET_IVLEN,
 				 DMSG_CRYPTO_GCM_IV_SIZE, NULL);
 	if (!ok)
 		goto fail;
@@ -159,7 +159,7 @@ dmsg_crypto_gcm_init(dmsg_ioq_t *ioq, char *key, int klen,
 	 * as GCM, will cause an error in _finish if the pt/ct size is not
 	 * a multiple of the cipher block size.
 	 */
-	EVP_CIPHER_CTX_set_padding(&ioq->ctx, 0);
+	EVP_CIPHER_CTX_set_padding(ioq->ctx, 0);
 
 	return 0;
 
@@ -203,24 +203,24 @@ dmsg_crypto_gcm_encrypt_chunk(dmsg_ioq_t *ioq, char *ct, char *pt,
 	*out_size = 0;
 
 	/* Re-initialize with new IV (but without redoing the key schedule) */
-	ok = EVP_EncryptInit_ex(&ioq->ctx, NULL, NULL, NULL,
+	ok = EVP_EncryptInit_ex(ioq->ctx, NULL, NULL, NULL,
 		(unsigned char*)ioq->iv);
 	if (!ok)
 		goto fail;
 
 	u_len = 0;	/* safety */
-	ok = EVP_EncryptUpdate(&ioq->ctx, (unsigned char*)ct, &u_len,
+	ok = EVP_EncryptUpdate(ioq->ctx, (unsigned char*)ct, &u_len,
 		(unsigned char*)pt, in_size);
 	if (!ok)
 		goto fail;
 
 	f_len = 0;	/* safety */
-	ok = EVP_EncryptFinal_ex(&ioq->ctx, (unsigned char*)ct + u_len, &f_len);
+	ok = EVP_EncryptFinal_ex(ioq->ctx, (unsigned char*)ct + u_len, &f_len);
 	if (!ok)
 		goto fail;
 
 	/* Retrieve auth tag */
-	ok = EVP_CIPHER_CTX_ctrl(&ioq->ctx, EVP_CTRL_GCM_GET_TAG,
+	ok = EVP_CIPHER_CTX_ctrl(ioq->ctx, EVP_CTRL_GCM_GET_TAG,
 				 DMSG_CRYPTO_GCM_TAG_SIZE,
 				 ct + u_len + f_len);
 	if (!ok)
@@ -233,14 +233,14 @@ dmsg_crypto_gcm_encrypt_chunk(dmsg_ioq_t *ioq, char *ct, char *pt,
 	}
 
 	*out_size = u_len + f_len + DMSG_CRYPTO_GCM_TAG_SIZE;
-	EVP_CIPHER_CTX_reset(&ioq->ctx);
+	EVP_CIPHER_CTX_reset(ioq->ctx);
 
 	return 0;
 
 fail:
 	ioq->error = DMSG_IOQ_ERROR_ALGO;
 fail_out:
-	EVP_CIPHER_CTX_reset(&ioq->ctx);
+	EVP_CIPHER_CTX_reset(ioq->ctx);
 	dm_printf(1, "%s\n", "error during encrypt_chunk");
 	return -1;
 }
@@ -256,14 +256,14 @@ dmsg_crypto_gcm_decrypt_chunk(dmsg_ioq_t *ioq, char *ct, char *pt,
 	*consume_size = 0;
 
 	/* Re-initialize with new IV (but without redoing the key schedule) */
-	ok = EVP_DecryptInit_ex(&ioq->ctx, NULL, NULL, NULL,
+	ok = EVP_DecryptInit_ex(ioq->ctx, NULL, NULL, NULL,
 		(unsigned char*)ioq->iv);
 	if (!ok) {
 		ioq->error = DMSG_IOQ_ERROR_ALGO;
 		goto fail_out;
 	}
 
-	ok = EVP_CIPHER_CTX_ctrl(&ioq->ctx, EVP_CTRL_GCM_SET_TAG,
+	ok = EVP_CIPHER_CTX_ctrl(ioq->ctx, EVP_CTRL_GCM_SET_TAG,
 				 DMSG_CRYPTO_GCM_TAG_SIZE,
 				 ct + out_size);
 	if (!ok) {
@@ -271,12 +271,12 @@ dmsg_crypto_gcm_decrypt_chunk(dmsg_ioq_t *ioq, char *ct, char *pt,
 		goto fail_out;
 	}
 
-	ok = EVP_DecryptUpdate(&ioq->ctx, (unsigned char*)pt, &u_len,
+	ok = EVP_DecryptUpdate(ioq->ctx, (unsigned char*)pt, &u_len,
 		(unsigned char*)ct, out_size);
 	if (!ok)
 		goto fail;
 
-	ok = EVP_DecryptFinal_ex(&ioq->ctx, (unsigned char*)pt + u_len, &f_len);
+	ok = EVP_DecryptFinal_ex(ioq->ctx, (unsigned char*)pt + u_len, &f_len);
 	if (!ok)
 		goto fail;
 
@@ -287,14 +287,14 @@ dmsg_crypto_gcm_decrypt_chunk(dmsg_ioq_t *ioq, char *ct, char *pt,
 	}
 
 	*consume_size = u_len + f_len + DMSG_CRYPTO_GCM_TAG_SIZE;
-	EVP_CIPHER_CTX_reset(&ioq->ctx);
+	EVP_CIPHER_CTX_reset(ioq->ctx);
 
 	return 0;
 
 fail:
 	ioq->error = DMSG_IOQ_ERROR_MACFAIL;
 fail_out:
-	EVP_CIPHER_CTX_reset(&ioq->ctx);
+	EVP_CIPHER_CTX_reset(ioq->ctx);
 	dm_printf(1, "%s\n",
 		  "error during decrypt_chunk "
 		  "(likely authentication error)");
diff --git a/lib/libdmsg/dmsg.h b/lib/libdmsg/dmsg.h
index cc73a44fa0..7234c5e892 100644
--- a/lib/libdmsg/dmsg.h
+++ b/lib/libdmsg/dmsg.h
@@ -251,7 +251,7 @@ struct dmsg_ioq {
 	int		error;
 	int		seq;			/* salt sequencer */
 	int		msgcount;
-	EVP_CIPHER_CTX	ctx;
+	EVP_CIPHER_CTX	*ctx;
 	char		iv[DMSG_MAX_IV_SIZE]; /* encrypt or decrypt iv[] */
 	dmsg_msg_t	*msg;
 	dmsg_msg_queue_t msgq;
diff --git a/lib/libldns/ldns/config.h b/lib/libldns/ldns/config.h
index 0993c32416..cb4b5a3ec5 100644
--- a/lib/libldns/ldns/config.h
+++ b/lib/libldns/ldns/config.h
@@ -42,11 +42,11 @@
 
 /* Define to 1 if you have the declaration of `NID_ED25519', and to 0 if you
    don't. */
-#define HAVE_DECL_NID_ED25519 0
+#define HAVE_DECL_NID_ED25519 1
 
 /* Define to 1 if you have the declaration of `NID_ED448', and to 0 if you
    don't. */
-#define HAVE_DECL_NID_ED448 0
+#define HAVE_DECL_NID_ED448 1
 
 /* Define to 1 if you have the declaration of `NID_secp384r1', and to 0 if you
    don't. */
@@ -84,10 +84,10 @@
 /* #undef HAVE_ENGINE_LOAD_CRYPTODEV */
 
 /* Define to 1 if you have the `ERR_load_crypto_strings' function. */
-#define HAVE_ERR_LOAD_CRYPTO_STRINGS 1
+/* #undef HAVE_ERR_LOAD_CRYPTO_STRINGS */
 
 /* Define to 1 if you have the `EVP_dss1' function. */
-#define HAVE_EVP_DSS1 1
+/* #undef HAVE_EVP_DSS1 */
 
 /* Define to 1 if you have the `EVP_MD_CTX_new' function. */
 #define HAVE_EVP_MD_CTX_NEW 1
@@ -150,7 +150,7 @@
 /* #undef HAVE_LIBPCAP */
 
 /* Define if we have LibreSSL */
-#define HAVE_LIBRESSL 1
+/* #undef HAVE_LIBRESSL */
 
 /* Define to 1 if you have the `localtime_r' function. */
 #define HAVE_LOCALTIME_R 1
@@ -389,10 +389,10 @@
 #define USE_ECDSA 1
 
 /* Define this to enable ED25519 support. */
-/* #undef USE_ED25519 */
+#define USE_ED25519 1
 
 /* Define this to enable ED448 support. */
-/* #undef USE_ED448 */
+#define USE_ED448 1
 
 /* Define this to enable GOST support. */
 /* #undef USE_GOST */
diff --git a/lib/libssh/config.h b/lib/libssh/config.h
index ea80d48901..df3a718ed6 100644
--- a/lib/libssh/config.h
+++ b/lib/libssh/config.h
@@ -458,7 +458,7 @@
 #define HAVE_ECDSA_SIG_SET0 1
 
 /* Define to 1 if you have the `EC_KEY_METHOD_new' function. */
-#define HAVE_EC_KEY_METHOD_NEW 1
+/* #undef HAVE_EC_KEY_METHOD_NEW */
 
 /* Define to 1 if you have the <elf.h> header file. */
 #define HAVE_ELF_H 1
@@ -494,16 +494,16 @@
 #define HAVE_EVP_CIPHER_CTX_CTRL 1
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_get_iv' function. */
-#define HAVE_EVP_CIPHER_CTX_GET_IV 1
+/* #undef HAVE_EVP_CIPHER_CTX_GET_IV */
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_iv' function. */
-/* #undef HAVE_EVP_CIPHER_CTX_IV */
+#define HAVE_EVP_CIPHER_CTX_IV 1
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_iv_noconst' function. */
-/* #undef HAVE_EVP_CIPHER_CTX_IV_NOCONST */
+#define HAVE_EVP_CIPHER_CTX_IV_NOCONST 1
 
 /* Define to 1 if you have the `EVP_CIPHER_CTX_set_iv' function. */
-#define HAVE_EVP_CIPHER_CTX_SET_IV 1
+/* #undef HAVE_EVP_CIPHER_CTX_SET_IV */
 
 /* Define to 1 if you have the `EVP_DigestFinal_ex' function. */
 #define HAVE_EVP_DIGESTFINAL_EX 1
@@ -512,7 +512,7 @@
 #define HAVE_EVP_DIGESTINIT_EX 1
 
 /* Define to 1 if you have the `EVP_MD_CTX_cleanup' function. */
-#define HAVE_EVP_MD_CTX_CLEANUP 1
+/* #undef HAVE_EVP_MD_CTX_CLEANUP */
 
 /* Define to 1 if you have the `EVP_MD_CTX_copy_ex' function. */
 #define HAVE_EVP_MD_CTX_COPY_EX 1
@@ -521,7 +521,7 @@
 #define HAVE_EVP_MD_CTX_FREE 1
 
 /* Define to 1 if you have the `EVP_MD_CTX_init' function. */
-#define HAVE_EVP_MD_CTX_INIT 1
+/* #undef HAVE_EVP_MD_CTX_INIT */
 
 /* Define to 1 if you have the `EVP_MD_CTX_new' function. */
 #define HAVE_EVP_MD_CTX_NEW 1
@@ -740,7 +740,7 @@
 #define HAVE_HEADER_AD 1
 
 /* Define to 1 if you have the `HMAC_CTX_init' function. */
-#define HAVE_HMAC_CTX_INIT 1
+/* #undef HAVE_HMAC_CTX_INIT */
 
 /* Define if you have ut_host in utmp.h */
 /* #undef HAVE_HOST_IN_UTMP */
diff --git a/lib/libssh/openbsd-compat/openssl-compat.c b/lib/libssh/openbsd-compat/openssl-compat.c
index a37ca61bf2..83b5747d95 100644
--- a/lib/libssh/openbsd-compat/openssl-compat.c
+++ b/lib/libssh/openbsd-compat/openssl-compat.c
@@ -93,4 +93,62 @@ ssh_libcrypto_init(void)
 #endif /* USE_OPENSSL_ENGINE */
 }
 
+#ifndef HAVE_EVP_CIPHER_CTX_GET_IV
+int
+EVP_CIPHER_CTX_get_iv(const EVP_CIPHER_CTX *ctx, unsigned char *iv, size_t len)
+{
+	if (ctx == NULL)
+		return 0;
+	if (EVP_CIPHER_CTX_iv_length(ctx) < 0)
+		return 0;
+	if (len != (size_t)EVP_CIPHER_CTX_iv_length(ctx))
+		return 0;
+	if (len > EVP_MAX_IV_LENGTH)
+		return 0; /* sanity check; shouldn't happen */
+	/*
+	 * Skip the memcpy entirely when the requested IV length is zero,
+	 * since the iv pointer may be NULL or invalid.
+	 */
+	if (len != 0) {
+		if (iv == NULL)
+			return 0;
+# ifdef HAVE_EVP_CIPHER_CTX_IV
+		memcpy(iv, EVP_CIPHER_CTX_iv(ctx), len);
+# else
+		memcpy(iv, ctx->iv, len);
+# endif /* HAVE_EVP_CIPHER_CTX_IV */
+	}
+	return 1;
+}
+#endif /* HAVE_EVP_CIPHER_CTX_GET_IV */
+
+#ifndef HAVE_EVP_CIPHER_CTX_SET_IV
+int
+EVP_CIPHER_CTX_set_iv(EVP_CIPHER_CTX *ctx, const unsigned char *iv, size_t len)
+{
+	if (ctx == NULL)
+		return 0;
+	if (EVP_CIPHER_CTX_iv_length(ctx) < 0)
+		return 0;
+	if (len != (size_t)EVP_CIPHER_CTX_iv_length(ctx))
+		return 0;
+	if (len > EVP_MAX_IV_LENGTH)
+		return 0; /* sanity check; shouldn't happen */
+	/*
+	 * Skip the memcpy entirely when the requested IV length is zero,
+	 * since the iv pointer may be NULL or invalid.
+	 */
+	if (len != 0) {
+		if (iv == NULL)
+			return 0;
+# ifdef HAVE_EVP_CIPHER_CTX_IV_NOCONST
+		memcpy(EVP_CIPHER_CTX_iv_noconst(ctx), iv, len);
+# else
+		memcpy(ctx->iv, iv, len);
+# endif /* HAVE_EVP_CIPHER_CTX_IV_NOCONST */
+	}
+	return 1;
+}
+#endif /* HAVE_EVP_CIPHER_CTX_SET_IV */
+
 #endif /* WITH_OPENSSL */
diff --git a/lib/libssh/openbsd-compat/openssl-compat.h b/lib/libssh/openbsd-compat/openssl-compat.h
index 25638ef827..87d85d8b9f 100644
--- a/lib/libssh/openbsd-compat/openssl-compat.h
+++ b/lib/libssh/openbsd-compat/openssl-compat.h
@@ -46,5 +46,15 @@ void ssh_libcrypto_init(void);
 # define OPENSSL_DSA_MAX_MODULUS_BITS	10000
 #endif
 
+#ifndef HAVE_EVP_CIPHER_CTX_GET_IV
+int EVP_CIPHER_CTX_get_iv(const EVP_CIPHER_CTX *ctx,
+    unsigned char *iv, size_t len);
+#endif /* HAVE_EVP_CIPHER_CTX_GET_IV */
+
+#ifndef HAVE_EVP_CIPHER_CTX_SET_IV
+int EVP_CIPHER_CTX_set_iv(EVP_CIPHER_CTX *ctx,
+    const unsigned char *iv, size_t len);
+#endif /* HAVE_EVP_CIPHER_CTX_SET_IV */
+
 #endif /* WITH_OPENSSL */
 #endif /* _OPENSSL_COMPAT_H */
diff --git a/lib/libssl/Makefile b/lib/libssl/Makefile
index b84e7fab76..7dc39cf3fe 100644
--- a/lib/libssl/Makefile
+++ b/lib/libssl/Makefile
@@ -7,12 +7,13 @@ WARNS?=		2
 
 OPENSSL_SRC=	${.CURDIR}/../../crypto/openssl
 
-.PATH:	${OPENSSL_SRC}/ssl \
+.PATH:	${OPENSSL_SRC}/include/openssl \
+	${OPENSSL_SRC}/ssl \
 	${OPENSSL_SRC}/ssl/record \
 	${OPENSSL_SRC}/ssl/statem
 
 # base sources
-SRCS+=	bio_ssl.c d1_lib.c d1_msg.c d1_srtp.c methods.c pqueue.c s3_enc.c \
+SRCS=	bio_ssl.c d1_lib.c d1_msg.c d1_srtp.c methods.c pqueue.c s3_enc.c \
 	s3_lib.c s3_msg.c ssl_asn1.c ssl_cert.c ssl_ciph.c ssl_conf.c \
 	ssl_err.c ssl_err_legacy.c ssl_init.c ssl_lib.c ssl_mcnf.c ssl_rsa.c \
 	ssl_rsa_legacy.c ssl_sess.c ssl_stat.c ssl_txt.c ssl_utst.c t1_enc.c \
@@ -29,11 +30,14 @@ SRCS+=	extensions.c extensions_clnt.c extensions_cust.c extensions_srvr.c \
 CFLAGS+=-DAES_ASM \
 	-Wa,--noexecstack \
 	-DL_ENDIAN \
+	${PRIVATELIB_CFLAGS} \
 	-I${OPENSSL_SRC} \
 	-I${OPENSSL_SRC}/include \
-	-DOPENSSLDIR="\"/etc/ssl\"" \
-	-DENGINESDIR="\"/dev/null\"" \
-	-DMODULESDIR="\"/dev/null\""
+	-DOPENSSLDIR="\"/etc/ssl\""
+
+INCS=	dtls1.h prov_ssl.h srtp.h ssl.h sslerr.h sslerr_legacy.h ssl2.h \
+	ssl3.h tls1.h
+INCSDIR=${INCLUDEDIR}/priv/openssl
 
 DPADD=	${LIBPTHREAD}
 LDADD=	-lpthread
diff --git a/lib/libtelnet/pk.c b/lib/libtelnet/pk.c
index 8ef55f1906..0b028e3f5b 100644
--- a/lib/libtelnet/pk.c
+++ b/lib/libtelnet/pk.c
@@ -175,7 +175,6 @@ itobn(long i)
 	if ((n = BN_new()) == NULL)
 		errx(1, "could not create BIGNUM: %s",
 		     ERR_error_string(ERR_get_error(), 0));
-	BN_init(n);
 	if (i > 0)
 		BN_add_word(n, (u_long)i);
 	else
diff --git a/share/examples/etc/README.examples b/share/examples/etc/README.examples
index d6405793e1..9c53ab2d74 100644
--- a/share/examples/etc/README.examples
+++ b/share/examples/etc/README.examples
@@ -79,5 +79,4 @@ ssh/moduli		- default prime numbers for sshd(8)
 ssh/ssh_config		- default SSH client configuration
 ssh/sshd_config		- default SSH daemon configuration
 ssl/			- directory containing default ssl files
-ssl/cert.pem		- default certificate bundle
 ssl/openssl.cnf		- default certificate configuration
diff --git a/share/examples/ssl/Makefile b/share/examples/ssl/Makefile
index 05b24abf73..221c0b95e0 100644
--- a/share/examples/ssl/Makefile
+++ b/share/examples/ssl/Makefile
@@ -1,7 +1,7 @@
-.PATH: ${.CURDIR}/../../../crypto/libressl/apps/openssl
+.PATH: ${.CURDIR}/../../../crypto/openssl/apps
 
 NOOBJ=	noobj
-FILES=	cert.pem openssl.cnf
+FILES=	openssl.cnf
 FILESDIR=	/usr/share/examples/etc/ssl
 FILESOWN=	${BINOWN}
 FILESGRP=	${BINGRP}
diff --git a/usr.bin/dc/Makefile b/usr.bin/dc/Makefile
index 63f051cb71..397eeacdf5 100644
--- a/usr.bin/dc/Makefile
+++ b/usr.bin/dc/Makefile
@@ -7,6 +7,7 @@ WARNS?=	2
 DPADD=		${LIBCRYPTO}
 LDADD=		-lprivate_crypto
 LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-CFLAGS+=	-I${.CURDIR}/../../crypto/libressl/include
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl
+CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
 
 .include <bsd.prog.mk>
diff --git a/usr.bin/dc/bcode.c b/usr.bin/dc/bcode.c
index 629e389b1f..13687385d3 100644
--- a/usr.bin/dc/bcode.c
+++ b/usr.bin/dc/bcode.c
@@ -388,7 +388,7 @@ split_number(const struct number *n, BIGNUM *i, BIGNUM *f)
 	bn_checkp(BN_copy(i, n->number));
 
 	if (n->scale == 0 && f != NULL)
-		bn_check(BN_zero(f));
+		bn_check(BN_set_word(f, 0));
 	else if (n->scale < sizeof(factors)/sizeof(factors[0])) {
 		rem = BN_div_word(i, factors[n->scale]);
 		if (f != NULL)
@@ -794,7 +794,7 @@ load(void)
 		v = stack_tos(&bmachine.reg[index]);
 		if (v == NULL) {
 			n = new_number();
-			bn_check(BN_zero(n->number));
+			bn_check(BN_set_word(n->number, 0));
 			push_number(n);
 		} else
 			push(stack_dup_value(v, &copy));
@@ -878,7 +878,7 @@ load_array(void)
 			v = frame_retrieve(stack, index);
 			if (v == NULL || v->type == BCODE_NONE ) {
 				n = new_number();
-				bn_check(BN_zero(n->number));
+				bn_check(BN_set_word(n->number, 0));
 				push_number(n);
 			}
 			else
diff --git a/usr.bin/dc/bcode.h b/usr.bin/dc/bcode.h
index bf4348b254..48565c66aa 100644
--- a/usr.bin/dc/bcode.h
+++ b/usr.bin/dc/bcode.h
@@ -21,6 +21,7 @@
 
 #include <sys/types.h>
 #include <openssl/bn.h>
+#include <crypto/bn/bn_local.h>
 
 
 struct number {
diff --git a/usr.bin/dc/inout.c b/usr.bin/dc/inout.c
index 69739c0f5e..032b2e75b5 100644
--- a/usr.bin/dc/inout.c
+++ b/usr.bin/dc/inout.c
@@ -188,7 +188,7 @@ readnumber(struct source *src, u_int base)
 	BN_ULONG	v;
 
 	n = new_number();
-	bn_check(BN_zero(n->number));
+	bn_check(BN_set_word(n->number, 0));
 
 	while ((ch = (*src->vtable->readchar)(src)) != EOF) {
 
@@ -325,19 +325,19 @@ printnumber(FILE *f, const struct number *b, u_int base)
 	stack_clear(&stack);
 	if (b->scale > 0) {
 		struct number	*num_base;
-		BIGNUM		mult, stop;
+		BIGNUM		*mult, *stop;
 
 		putcharwrap(f, '.');
 		num_base = new_number();
 		bn_check(BN_set_word(num_base->number, base));
-		BN_init(&mult);
-		bn_check(BN_one(&mult));
-		BN_init(&stop);
-		bn_check(BN_one(&stop));
-		scale_number(&stop, b->scale);
+		mult = BN_new();
+		bn_check(BN_one(mult));
+		stop = BN_new();
+		bn_check(BN_one(stop));
+		scale_number(stop, b->scale);
 
 		i = 0;
-		while (BN_cmp(&mult, &stop) < 0) {
+		while (BN_cmp(mult, stop) < 0) {
 			u_long	rem;
 
 			if (i && base > 16)
@@ -355,11 +355,11 @@ printnumber(FILE *f, const struct number *b, u_int base)
 			    int_part->number));
 			printwrap(f, p);
 			free(p);
-			bn_check(BN_mul_word(&mult, base));
+			bn_check(BN_mul_word(mult, base));
 		}
 		free_number(num_base);
-		BN_free(&mult);
-		BN_free(&stop);
+		BN_free(mult);
+		BN_free(stop);
 	}
 	flushwrap(f);
 	free_number(int_part);
diff --git a/usr.bin/newkey/generic.c b/usr.bin/newkey/generic.c
index b2f3c68ced..74d6b2d947 100644
--- a/usr.bin/newkey/generic.c
+++ b/usr.bin/newkey/generic.c
@@ -74,7 +74,6 @@ itobn(long i)
 	if ((n = BN_new()) == NULL)
 		errx(1, "could not create BIGNUM: %s",
 		     ERR_error_string(ERR_get_error(), 0));
-	BN_init(n);
 	if (i > 0)
 		BN_add_word(n, (u_long)i);
 	else
diff --git a/usr.bin/openssl/Makefile b/usr.bin/openssl/Makefile
index 3bc3a52c03..b21c9bba4c 100644
--- a/usr.bin/openssl/Makefile
+++ b/usr.bin/openssl/Makefile
@@ -1,26 +1,3 @@
-# This version of openssl(1) is from LibreSSL
-PROG=	openssl
-WARNS?=	2
-MAN=	openssl.1 openssl.cnf.5
+SUBDIR=	libapps openssl
 
-OPENSSL_SRC=	${.CURDIR}/../../crypto/openssl
-
-CFLAGS+=	-I${.CURDIR}/../../crypto/openssl/include
-CFLAGS+= 	-I${.CURDIR}
-
-DPADD+=		${LIBSSL} ${LIBCRYPTO}
-LDADD+=		-lprivate_ssl -lprivate_crypto
-LDFLAGS+=	${PRIVATELIB_LDFLAGS}
-
-SRCS=	apps_posix.c apps.c asn1pars.c ca.c certhash.c ciphers.c cms.c \
-	crl2p7.c crl.c \
-	dgst.c dh.c dhparam.c dsa.c dsaparam.c ec.c ecparam.c enc.c errstr.c \
-	gendh.c gendsa.c genpkey.c genrsa.c nseq.c ocsp.c openssl.c \
-	passwd.c pkcs12.c pkcs7.c pkcs8.c pkey.c pkeyparam.c pkeyutl.c \
-	prime.c rand.c req.c rsa.c rsautl.c \
-	s_cb.c s_client.c s_server.c s_socket.c s_time.c sess_id.c \
-	smime.c speed.c spkac.c ts.c verify.c version.c x509.c
-
-.include <bsd.prog.mk>
-
-.PATH:	${OPENSSL_SRC}/apps/openssl ${OPENSSL_SRC}/man
+.include <bsd.subdir.mk>
diff --git a/usr.bin/openssl/Makefile.etc b/usr.bin/openssl/Makefile.etc
index c970a5dd89..228f737b9d 100644
--- a/usr.bin/openssl/Makefile.etc
+++ b/usr.bin/openssl/Makefile.etc
@@ -6,5 +6,9 @@ FILESMODE=	644
 
 OPENSSL_SRC=	${.CURDIR}/../../crypto/openssl
 
-.PATH: ${OPENSSL_SRC}/apps/openssl
+SCRIPTS=	CA.pl
+SCRIPTSDIR=	/etc/ssl
+
+.include "../../lib/libcrypto/Makefile.inc"
+.PATH: ${OPENSSL_SRC}/apps
 .include <bsd.prog.mk>
diff --git a/usr.bin/openssl/Makefile.inc b/usr.bin/openssl/Makefile.inc
new file mode 100644
index 0000000000..01b5f23410
--- /dev/null
+++ b/usr.bin/openssl/Makefile.inc
@@ -0,0 +1 @@
+.include "../Makefile.inc"
diff --git a/usr.bin/openssl/libapps/Makefile b/usr.bin/openssl/libapps/Makefile
new file mode 100644
index 0000000000..ad41e9f29e
--- /dev/null
+++ b/usr.bin/openssl/libapps/Makefile
@@ -0,0 +1,14 @@
+LIB=		apps
+INTERNALLIB=
+CFLAGS+=	${PRIVATELIB_CFLAGS}
+CFLAGS+=	-I${OPENSSL_SRC} -I${OPENSSL_SRC}/include
+CFLAGS+=	-I${OPENSSL_SRC}/apps/include
+
+OPENSSL_SRC=	${.CURDIR}/../../../crypto/openssl
+
+.PATH:	${OPENSSL_SRC}/apps/lib
+
+SRCS=	app_libctx.c app_params.c app_provider.c app_rand.c apps.c apps_ui.c app_x509.c columns.c engine.c engine_loader.c fmt.c http_server.c names.c opt.c
+SRCS+=	s_cb.c s_socket.c tlssrp_depr.c
+
+.include <bsd.lib.mk>
diff --git a/usr.bin/openssl/openssl/Makefile b/usr.bin/openssl/openssl/Makefile
new file mode 100644
index 0000000000..c1f2d3db36
--- /dev/null
+++ b/usr.bin/openssl/openssl/Makefile
@@ -0,0 +1,28 @@
+# This version of openssl(1) is from LibreSSL
+PROG=	openssl
+WARNS?=	2
+#MAN=	openssl.1 openssl.cnf.5
+NOMAN=
+
+OPENSSL_SRC=	${.CURDIR}/../../../crypto/openssl
+
+.PATH:	${OPENSSL_SRC}/apps ${OPENSSL_SRC}/apps/lib ${OPENSSL_SRC}/man
+
+.if exists(${.OBJDIR}/../libapps)
+LIBAPPS=${.OBJDIR}/../libapps/libapps.a
+.else
+LIBAPPS=${.CURDIR}/../libapps/libapps.a
+.endif
+
+CFLAGS+=	${PRIVATELIB_CFLAGS}
+CFLAGS+=	-I${OPENSSL_SRC} -I${OPENSSL_SRC}/include
+CFLAGS+=	-I${OPENSSL_SRC}/apps/include
+CFLAGS+= 	-Wa,--noexecstack
+
+DPADD+=		${LIBSSL} ${LIBCRYPTO} ${LIBPTHREAD} ${LIBAPPS}
+LDADD+=		-lprivate_ssl -lprivate_crypto -lpthread ${LIBAPPS}
+LDFLAGS+=	${PRIVATELIB_LDFLAGS}
+
+SRCS=	cmp_mock_srv.c  asn1parse.c ca.c  ciphers.c cmp.c  cms.c crl.c  crl2pkcs7.c dgst.c  dhparam.c dsa.c  dsaparam.c ec.c  ecparam.c enc.c  engine.c errstr.c  fipsinstall.c gendsa.c  genpkey.c genrsa.c  info.c kdf.c  list.c mac.c  nseq.c ocsp.c  openssl.c passwd.c  pkcs12.c pkcs7.c  pkcs8.c pkey.c  pkeyparam.c pkeyutl.c  prime.c progs.c  rand.c rehash.c  req.c rsa.c  rsautl.c s_client.c  s_server.c s_time.c  sess_id.c smime.c  speed.c spkac.c  srp.c storeutl.c  ts.c verify.c  version.c x509.c
+
+.include <bsd.prog.mk>
-- 
2.32.0

