but has been omitted from HEAD (0.9.9), see commit
  http://cvs.openssl.org/chngview?cn=16627
by appro.

(Firstly... ommitted)

Secondly, it wasn't even _dropping_ the offending packets, in the
non-blocking case. It was just returning garbage instead.
PR: #1752
Submitted by: David Woodhouse <dwmw2@infradead.org>

offending record queued as 'pending'. The DTLS code doesn't expect this,
and we end up hitting an OPENSSL_assert() in do_dtls1_write().

The simple fix is just _not_ to leave it queued. In DTLS, dropping
packets is perfectly acceptable -- and even preferable. If we wanted a
service with retries and guaranteed delivery, we'd be using TCP.
PR: #1703
Submitted by: David Woodhouse <dwmw2@infradead.org>

and should avoid any OS date limitations such as the year 2038 bug.

Submitted by: Amadeu A. Barbosa Jr <amadeu@tecgraf.puc-rio.br>

enable disabled ciphersuites.

Also, fix CHANGES (consistency with stable branch).

PR: 1648

overall.
PR: 1604

Submitted by: Nagendra Modadugu

Also, "CHANGES" clean-ups.

PR: 1632

strength "FIPS" to represent all FIPS approved ciphersuites without NULL
encryption.

they are used for mac computation.

test suite.

a delta CRL in addition to a full CRL. Check and search delta in addition to
the base.

Tidy CRL scoring system.

Add new CRL path validation error.

and don't unnecessarily fail on input size 0.