s/assember/assembler/ before someone gets offended.  At the last
hackathon, just saying 'ass ember' was enough to start giggles.
Unfortunately far more offensive stuff remains in here...
More KNF.
BIO_free has an implicit NULL check, so do not bother checking for NULL
before calling it.
Remove another NULL check before a BIO_free().
malloc() result does not need a cast.
ok miod
http://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2016265dfbab162ec30718b5e7480add42598158
Don't know the full story, but it looks like a "can't do random
perfectly, so do it god awful" problem was found in 2013, and
replaced with "only do it badly if a flag is set".  New flags
(SSL_MODE_SEND_SERVERHELLO_TIME and SSL_MODE_SEND_SERVERHELLO_TIME)
were added [Ben Laurie?] to support the old scheme of "use time_t
for first 4 bytes of the random buffer".

Nothing uses these flags [ecosystem scan by sthen]

Fully discourage use of these flags in the future by removing
support & definition of them.  The buflen < 4 check is also interesting,
because no entropy would be returned.  No callers passed such small
buffers.
ok miod sthen
/* on some platforms time_t may be a float */
In the past, time_t's type was underspecified.  But a floating point type
would not have worked in practice.  Newer specifications effectively forbid it.

While cleaning this up, get partly ready for Y2038.
ok miod
Factor out the part of tls1_change_cipher_state() that is specific to
switching cipher states using an EVP_CIPHER. This will facilitate the
addition of cipher state changes for EVP_AEAD. No functional change.

Based on Adam Langley's chromium patches.
Stop using DSO_global_lookup to reach getaddrinfo() and friends
discussed with tedu, ok jsing
Clean up BIO_free() handling in bio_ssl.c - BIO_free() has its own NULL
check, so do not duplicate it here. Make the error handling consistent
by always using 'goto err' rather than returning in certain cases. Also
add a missing BIO_free(ssl) in BIO_new_ssl_connect().

ok deraadt@
No, we will not be building with OPENSSL_NO_X509_VERIFY. Nuke it and
do some other clean up while here.

ok deraadt@
Add a define for the SSLv3 sequence size and use it, rather than sprinkling
magic numbers around.

ok deraadt@
Add an SSL_CIPHER_ALGORITHM2_AEAD flag that is used to mark a cipher as
using EVP_AEAD. Also provide an EVP_AEAD-only equivalent of
ssl_cipher_get_evp().