the form MBSTRING_FLAG|nbyte where "nbyte" is the number of
bytes per character.

Unfortunately this isn't so and we can't change the #defines because
this would break binary compatibility, so for 0.9.7X only translate
between the two.

for the PKCS#9 OID then the non standard MS OID.

crypto/sha/sha_locl.h, where it is in fact an int, we need to check
for less-than-zero as if it was an int...

clearerr().

last, though...

get struct timeval and gettimeofday().

Thanks to Dr Stephen Henson <shenson@drh-consultancy.co.uk> for making
me aware of this error.

around them.

NOTE: because two new locks are added, this adds potential binary
incompatibility with earlier versions in the 0.9.7 series.  However,
those locks will only ever be touched when FIPS_mode_set() is called
and after, thanks to a variable that's only changed from 0 to 1 once
(when FIPS_mode_set() is called).  So basically, as long as FIPS mode
hasn't been engaged explicitely by the calling application, the new
locks are treated as if they didn't exist at all, thus not becoming a
problem.  Applications that are built or rebuilt to use FIPS
functionality will need to be recompiled in any case, thus not being a
problem either.

the fips subdirectory, not the crypto one...

name is defined.

Go up one directory level before dealing with FIPS stuff.

cipher suite is FIPS compatible.

New cipherstring "FIPS" is all FIPS compatible ciphersuites except eNULL.

Only allow FIPS ciphersuites in FIPS mode.

static variable

will either be optimized away or never performed. The trouble is that
compiler first parses code, then optimizes, not both at once...

avoid use of prohibited MD5 algorithm.