more MLINKs
if (x) FOO_free(x) -> FOO_free(x).
Improves readability, keeps the code smaller so that it is warmer in your
cache.

review & ok deraadt@
Make sure the return value of X509_NAME_oneline(, NULL,) is checked against
NULL.
ok deraadt@ guenther@ jsing@
A few fixes/improvements:
- first, BN_free == BN_clear_free in our libcrypto, so we do not need to
  treat CBIGNUM (crypto BN) separately from BIGNUM (regular BN).
- then, in bn_i2c(), since BN_bn2bin returns BN_num_bytes(input), take
  advantage of this to avoid calling BN_num_bytes() a second time.
  BN_num_bytes() is cheap, but this not a reason to perform redundant
  work.
- finally, in bn_c2i, if bn_new() fails, return early. Otherwise
  BN_bin2bn will try to create a BN too, and although this will probably
  fail since we were already out of memory, if we are on a threaded
  process and suddenly the allocation succeeds, we will leak it since it
  will never be stored in *pval.

ok jsing@
jsing and I are investigating removal of all? most? 'getenv from library'
instances.  This one for OPENSSL_ALLOW_PROXY_CERTS gets turned off first,
especially since it had this special comment:
/* A hack to keep people who don't want to modify their software happy */
ok beck jsing
openssl(1) is only built as a single monolithic binary, so just call
load_config() once when we start.

ok miod@
Remove #ifndefs for OPENSSL_NO_DH, OPENSSL_NO_ECDH and
OPENSSL_NO_X509_VERIFY. We're not going to build with these and the same
removal has already been done for libssl.
More KNF.
need_cert is now always true, so remove the variable and associated
conditionals.

ok miod@
Remove extra parenthesis.
Wrap "thread_private.h" with #ifdef __OpenBSD__ so that other systems
can copy this file (plus chacha_private.h) directly and reuse it
trivially.  Well, as long as they have a getentropy() as well..
ok beck
Make the BLOCK_CIPHER_{generic,custom} macros expand to more readable struct
definitions using C99 field initializers. No functional change.
In openssl_startup(), call SSL_library_init() and SSL_load_error_strings().
This allows us to remove the ERR_load_crypto_strings() call, along with
the various SSL_load_error_strings() and OpenSSL_add_ssl_algorithms()
calls scattered around the place.

ok beck@
Provide ssl_version_string() function, which uses one of those modern C
constructs (a switch statement) and returns the appropriate string defined
by SSL_TXT_* for the given version, including support for DTLSv1 and
DTLSv1-bad. Use this function in SSL_get_version() and SSL_SESSION_print().

ok beck@
Remove private_{Camellia,RC4}_set_key FIPS indirection tentacles, as has been
done for other symmetric algorithms recently.
We have EVP_CIPH_FLAG_DEFAULT_ASN1 in evp.h; no need to keep constructs to
build on pre-EVP_CIPH_FLAG_DEFAULT_ASN1 codebases.

ok jsing@
Remove signed/unsigned warning, statement before declaration and
add a function to use function pointers that does not take sizeof(fptr).

OK beck@
getentropy on Windows.  It compiles but has not been thoroughly tested yet.

OK: beck@
more MLINKS
Remove this sentence:
``The probability that a randomly generated key is weak is -1/2^52,
  so it is not really worth checking for them.''

This kind of naively optimistic attitude is not compatible with security.