Add support for policy checking in verify utility.

This tidies up verify parameters and adds support for integrated policy
checking.

Add support for policy related command line options. Currently only in smime
application.

WARNING: experimental code subject to change.

and include bn.h in those C files that need bignum functionality.

initial serial numbers.

PR: 842

in the middle of the code on Windows, and that disrupts operations in functions
later that use rename()...
PR: 853

functions and macros.

This change has associated tags: LEVITTE_before_const and
LEVITTE_after_const.  Those will be removed when this change has been
properly reviewed.

Use BUF_strlcat() instead of strcat().
Use BIO_snprintf() instead of sprintf().
In some cases, keep better track of buffer lengths.
This is part of a large change submitted by Markus Friedl <markus@openbsd.org>

to apps.c, and give it the hopefully descriptive name parse_yesno().

rationale behind the move is that it's use by several applications.
The rationale behind the name change is that it describes what the
function does a bit better.

PR: 780
Submitted by: Verdon Walker <VWalker@novell.com>
Reviewed by: Richard Levitte

Submitted by: Goetz Babin-Ebell <babin-ebell@trustcenter.de>

PR: #766

platforms that don't (necessarely) have it.  In the case of VMS, this
means moving a couple of functions from apps/ to crypto/ and make them
general (although only used privately).

rotate_serial() that works like rotate_index().

subject.

PR: 287

I've covered all the memset()s I felt safe modifying, but may have missed some.

apps.h.  For those, it's better to include apps.h after the system
headers where those symbols may be defined, since there's otherwise a
chance that the C compiler will barf when it sees something that looks
like this after expansion:

int VMS_strcasecmp((str1),(str2))(const char *, const char *);

PR: 184

Make -nameopt work in req and add support for -reqopt

functionality in the programs that had that before.
Part fo PR 164

PR: 147

differently.
Unixware 2 needs to link with libresolv.
PR: 148

Submitted by: Goetz Babin-Ebell <babinebell@trustcenter.de>
PR: 89

this wasn't checked and could possibly be exploitable (slim chance, but still)

Fix dsaparam usage output.

Submitted by: Nils Larsch

Fix the Win32_rename() function so it correctly
returns an error code. Use the same code in Win9X
and NT.

Fix some ca.c options so they work under Win32:
unlink/rename wont work under Win32 unless the file
is closed.

CONF_modules_unload() now calls CONF_modules_finish()
automatically.

Default use of section openssl_conf moved to
CONF_modules_load()

Load config file in several openssl utilities.

Most utilities now load modules from the config file,
though in a few (such as version) this isn't done
because it couldn't be used for anything.

In the case of ca and req the config file used is
the same as the utility itself: that is the -config
command line option can be used to specify an
alternative file.

* make openssl rsa work with -engine chil
* misc changes, including debug-linux-ppro Configure target
  and FORMAT_NETSCAPE-aware load_{,pub}key()

This completes the application of his changes.

released.

instead.  This also makes it possible for users to simply give said
shareable library as argument for the -engine option.

New macros SSL[_CTX]_set_msg_callback_arg().

Message callback imlementation for SSL 3.0/TLS 1.0 (no SSL 2.0 yet).

New '-msg' option for 'openssl s_client' and 'openssl s_server'
that enable a message callback that displays all protocol messages.


In ssl3_get_client_hello (ssl/s3_srvr.c), generate a fatal alert if
client_version is smaller than the protocol version in use.
Also change ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0
if the client demanded SSL 3.0 but only TLS 1.0 is enabled; then the
client will at least see that alert.

Fix SSL[_CTX]_ctrl prototype (void * instead of char * for generic
pointer).

Add/update some OpenSSL copyright notices.