Initial version of libressl - a library that provides a clean, simple,
consistent and secure-by-default API for SSL clients (and soon servers).

This is a long way from complete and the interface will likely change
substantially - committing now so that further work can happen in the tree.

Initiated by tedu@ and inspired by discussions with tedu@, beck@ and
other developers.
enough churn, a crank is advised by guenther..
odds are that some ABI change occured today, no matter how careful everyone
is
-DOPENSSL_NO_KRB5 is no longer needed
ok guenther
Make disabling last cipher work.
From Thijs Alkemade via OpenSSL trunk
ok miod@
Place comments in a block above the if statement, rather than attempting
to interleave them within the conditions. Also fix wrapping and
indentation.
typos
Remove remnants from PSK, KRB5 and SRP.

ok beck@ miod@
Solaris uses a symbolic link for /dev/urandom which harms best practice of
using O_NOFOLLOW - cope with it as best as possible by trying two
different paths. - written by deraadt@ and kettenis@
Split arc4random_uniform into it's own file, to assist other projects
now using this as upstream code.  The particular problem is systems
that contain older arc4random derivations lacking arc4random_uniform().
ok tedu miod
remove gratuitous differences, ok beck bcook
remove gratuitous differences, ok beck
Principle of least surprise: make CMAC_CTX_free(), OCSP_REQ_CTX_free() and
X509_STORE_CTX_free() accept NULL pointers as input without dereferencing them,
like all the other well-behaved *_CTX_free() functions do.
guard inclusion of sys/sysctl.h so we can detect at compile time and
keep linux distros happy that don't have it.
ok bcook@
more MLINKs
if (x) FOO_free(x) -> FOO_free(x).
Improves readability, keeps the code smaller so that it is warmer in your
cache.

review & ok deraadt@
Make sure the return value of X509_NAME_oneline(, NULL,) is checked against
NULL.
ok deraadt@ guenther@ jsing@
A few fixes/improvements:
- first, BN_free == BN_clear_free in our libcrypto, so we do not need to
  treat CBIGNUM (crypto BN) separately from BIGNUM (regular BN).
- then, in bn_i2c(), since BN_bn2bin returns BN_num_bytes(input), take
  advantage of this to avoid calling BN_num_bytes() a second time.
  BN_num_bytes() is cheap, but this not a reason to perform redundant
  work.
- finally, in bn_c2i, if bn_new() fails, return early. Otherwise
  BN_bin2bn will try to create a BN too, and although this will probably
  fail since we were already out of memory, if we are on a threaded
  process and suddenly the allocation succeeds, we will leak it since it
  will never be stored in *pval.

ok jsing@
jsing and I are investigating removal of all? most? 'getenv from library'
instances.  This one for OPENSSL_ALLOW_PROXY_CERTS gets turned off first,
especially since it had this special comment:
/* A hack to keep people who don't want to modify their software happy */
ok beck jsing
openssl(1) is only built as a single monolithic binary, so just call
load_config() once when we start.

ok miod@