Since deraadt@ remembers seeing strdup() on one particular 4.2BSD machine,
i looked a bit closer and found instances before Reno, so correct HISTORY.

References:
http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.1cBSD/usr/src/ucb/dbx/defs.h
http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD/usr/src/etc/inetd.c
http://minnie.tuhs.org/cgi-bin/utree.pl?file=4.3BSD-Reno/src/lib/libc/string/strdup.c

ok deraadt@
include header needed by older linux kernels

not all versions of <linux/random.h> include <linux/types.h> by default
Convert libssl manpages from pod to mdoc(7).

libcrypto has not been started yet.

ok schwarze@ miod@
Paranoia: in ASN1_mbstring_ncopy(), check for len < 0 instead of len == -1,
in order to catch all negative sizes.
Remove useless comments in DES_is_weak_key(). Do we really care that this
function was found broken in 1993, and later on in 1997?
Use O_NONBLOCK over FIONBIO.

Prefer this because it is the POSIX standard and has consistent behavior
across platforms.

Use BIO_socket_nbio consistently across the tree.

from Jonas 'Sortie' Termansen, ok deraadt@
prefer C99 array initialization syntax.

use C99 array initialization syntax for strict C compilers.

from kinichiro, found building with HP/UX compiler

ok deraadt@, guenther@
The return value on success of fcntl(F_SETFL) is not actually specified,
only that it returns -1 on failure.

pointed out by guenther@
Add NPN regress tests from OpenSSL. However, unlike OpenSSL, actually exit
with a failure if the NPN verification fails.
BIO_free() and SSL_CTX_free() have explicit NULL checks, so there is no
need to have additional checks here.
Remove _XOPEN_SOURCE_EXTENDED since we're not too concerned about
gethostname being declared properly on Compaq platforms that use DEC C...
remove unused variable

ok tedu@
Bump libressl version string to 2.1.

This makes 'openssl version' print a string that matches the -portable
release number.  Thanks to @blakkeim for pointing it out.

The version integer is left alone, with the idea of discouraging software from
relying on magic numbers for detecting features. Software configuration should
do explicit feature tests instead.

ok beck@, deraadt@
seems like a good time to make the ressl default TLSv1 only.
ok guenther