Commit this before the head-scratching leads to premature baldness:
    memset(a->data, 0, (unsigned int)a->max);
but the decl is:
    size_t max;
size_t could be larger than int, especially in some of the systems OpenSSL
purports to support.

How do _intentionally truncating_ casts like enter into a codebase?
Lack of understanding of C, at a minimum.  Generally the objects are
small, but this code is _intentionally unready_ for large objects.
ok miod
There is no need for is{upper,lower}() tests before to{lower,uppper}(),
since all other characters are mapped through transparently.
ok jsing
In tls1_setup_key_block(), use the correct IV length for GCM mode, which
results in the key block length calculation also being correct. Rename a
number of variables so that their purpose becomes clear and simplify some
of the code.

Inspired by Adam Langley's chromium diffs.

ok miod@
Overhaul the key block handling in tls1_change_cipher_state() - use
meaningful variable names with pointer arithmitic, rather than n, i, j
and p with array indexing.

Based on Adam Langley's chromium diffs.

ok miod@
Make usage for -quiet match the manpage and fix a misspelling
realloc with NULL is same as malloc
ok guenther
Clean up some of the nightmare of string and pointer arithmatic in
this nasty function.

This gets rid of the nasty tmp variables used to hold temporary strings
and the DECIMAL_SIZE hack. it gets rid of the rather pointless null checks
for buf (since the original code dereferences it before checking). It also
gets rid of the insane possibility this could return -1 when stuff is
using the return values to compute lengths All the failure cases now
return 0 and an empty string like the first error case in the original
code.
ok miod@ tedu@
fix type string conversion warning

ASN1_STRING_data returns an unsigned char *, but strlcat's second
parameter is a const char *
remove unused static datastructures

Neither of these is used anywhere within their object files.
Check output of write() to stdout

Check for errors on write. Since SIGPIPE is ignored, play nicely with
pipelines by aborting on EPIPE.
remove parsing of -rand options in openssl apps

Since the random number generator no longer allows being seeded, remove
support for parsing the unused -rand option and the unused random buffer
variables. Better to fail than to be surprised when the RNG seed does not
function as expected.

This fixes compiler warnings about unused random seed variables.
remove pqueue typedef from dtls1.h, replace with the struct _pqueue *

avoid defining the typedef twice

../include/openssl/dtls1.h:147:25: error: redefinition of typedef 'pqueue' is a C11 feature [-Werror,-Wtypedef-redefinition]
typedef struct _pqueue *pqueue;
                        ^
../include/pqueue.h:63:25: note: previous definition is here
typedef struct _pqueue *pqueue;
properly guard modes.h from multiple inclusion, add C++ linkage support

Noticed while building gcm128test.c and getting redefinition warnings.