(cherry picked from commit f3a39032)

(cherry picked from commit 5a7652c3)

This can be used to speed up SRTP with libsrtp, e.g. on TI omap/sitara based devices.
(cherry picked from commit be2c4d9b)

If you use "-newkey rsa" it's supposed to read the default number of bits from the
config file.  However the value isn't used to generate the key, but it does
print it's generating such a key.  The set_keygen_ctx() doesn't call
EVP_PKEY_CTX_set_rsa_keygen_bits() and you end up with the default set in
pkey_rsa_init() (1024).  Afterwards the number of bits gets read from the config
file, but nothing is done with that anymore.

We now read the config first and use the value from the config file when no size
is given.

PR: 2592
(cherry picked from commit 33432203)

(cherry picked from commit e547c45f)

(cherry picked from commit 2b4ffc65)

apps/pkcs12.c accepts -password as an argument.  The document author
almost certainly meant to write "-password, -passin".

However, that is not correct, either.  Actually the code treats
-password as equivalent to -passin, EXCEPT when -export is also
specified, in which case -password as equivalent to -passout.
(cherry picked from commit 856c6dfb)

(cherry picked from commit 70113432)

(cherry picked from commit f4d45640)

Improve CBC decrypt and CTR by ~13/16%, which adds up to ~25/33%
improvement over "pre-Silvermont" version. [Add performance table to
aesni-x86.pl].
(cherry picked from commit 5599c733)

as issuer and subject names. Although this is an incompatible change
it should have little impact in pratice because self-issued certificates
that are not self-signed are rarely encountered.
(cherry picked from commit b1efb716)

When a chain is complete and ends in a trusted root checks are also
performed on the TA and the callback notified with ok==1. For
consistency do the same for chains where the TA is not self signed.
(cherry picked from commit 385b3486)

(from master)

(and remove duplicates).

(cherry picked from commit 9587429f)

(other processors unaffected).
(cherry picked from commit 98e143f1)

Revert libssl ordinals to OpenSSL 1.0.1 values first to tidy up and
avoid entries for deleted functions.

Merge branch '102_stable_tlsext_suppdata_changes' of git://github.com/scottdeboy/openssl into scottdeboy-102_stable_tlsext_suppdata_changes

(cherry picked from commit 5eda213e)
Conflicts:
	apps/s_client.c
	apps/s_server.c

(cherry picked from commit a6a48e87)
Conflicts:
	ssl/s3_clnt.c
	ssl/t1_lib.c

Reverting 1.0.2-only changes supporting the prior authz RFC5878-based tests from commit 835d104f

The contract for custom extension callbacks has changed - all custom extension callbacks are triggered

Whitespace fixes

(cherry picked from commit e9add063)
Conflicts:
	ssl/s3_clnt.c

If multiple TLS extensions are expected but not received, the TLS extension and supplemental data 'generate' callbacks are the only chance for the receive-side to trigger a specific TLS alert during the handshake.

Removed logic which no-op'd TLS extension generate callbacks (as the generate callbacks need to always be called in order to trigger alerts), and updated the serverinfo-specific custom TLS extension callbacks to track which custom TLS extensions were received by the client, where no-ops for 'generate' callbacks are appropriate.

(cherry picked from commit ac20719d)
Conflicts:
	ssl/t1_lib.c

Free generated supp data after handshake completion, add comment regarding use of num_renegotiations in TLS and supp data generation callbacks

(cherry picked from commit 67c408ce)
Conflicts:
	apps/s_client.c
	apps/s_server.c