Partial mitigation of PR#3200
(cherry picked from commit 0294b2be)

Move the IP, email and host checking fields from the public
X509_VERIFY_PARAM structure into an opaque X509_VERIFY_PARAM_ID
structure. By doing this the structure can be modified in future
without risk of breaking any applications.
(cherry picked from commit adc6bd73e3bd10ce6e76867482e8d137071298d7)

Conflicts:

	crypto/x509/x509_vpm.c

Fix padding calculation for different SSL_METHOD types. Use the
standard name as used in draft-agl-tls-padding-02

For consistency with other cases if we are performing
partial chain verification with just one certificate
notify the callback with ok==1.
(cherry picked from commit 852553d9005e13aed7feb986a5d71cb885b994c7)

New functions to retrieve internal pointers to X509_VERIFY_PARAM
for SSL_CTX and SSL structures.
(cherry picked from commit be0c9270690ed9c1799900643cab91de146de857)

(cherry picked from commit 16898401bd47a153fbf799127ff57fdcfcbd324f)

This also eliminates code duplication between x86_64-mont and x86_64-mont
and optimizes even original non-MULX code.

Suggested by: Marcello Cerri

Suggested by: Marcello Cerri

AIX assembler doesn't hanle .align, which is essential for vpaes module.

PR: 3189
Submitted by: Oscar Ciurana

rsaz_exp.c: harmonize line terminating;
asm/rsaz-*.pl: minor optimizations.

New functions to retrieve current certificate or private key
from an SSL_CTX.

Constify SSL_get_private_key().

(cherry picked from commit 1abfa78a8ba714f7e47bd674db53dbe303cd1ce7)

PR#3106

Some functions such as EVP_VerifyFinal only finalise a copy of the passed
context in case an application wants to digest more data. Doing this when
it is not needed is inefficient and many applications don't require it.

For compatibility the default is to still finalise a copy unless the
flag EVP_MD_CTX_FLAG_FINALISE is set in which case the passed
context is finalised an *no* further data can be digested after
finalisation.

If pointer comparison for current certificate fails check
to see if a match using X509_cmp succeeds for the current
certificate: this is useful for cases where the certificate
pointer is not available.

PR#3169

This patch, which currently applies successfully against master and
1_0_2, adds the following functions:

SSL_[CTX_]select_current_cert() - set the current certificate without
disturbing the existing structure.

SSL_[CTX_]get0_chain_certs() - get the current certificate's chain.

SSL_[CTX_]clear_chain_certs() - clear the current certificate's chain.

The patch also adds these functions to, and fixes some existing errors
in, SSL_CTX_add1_chain_cert.pod.

PR#3172

Submitted by: Marcelo Cerri

PR: 3165
Submitted by: Daniel Richard G.

PR: 3165

If the oid parameter is set to NULL in X509_add1_trust_object
create an empty list of trusted purposes corresponding to
"no purpose" if trust is checked.