13 files changed, 250 insertions, 168 deletions
diff --git a/security/openssl/MESSAGE.SunOS b/security/openssl/MESSAGE.SunOS
deleted file mode 100644
index c95c36df556..00000000000
--- a/security/openssl/MESSAGE.SunOS
+++ /dev/null
@@ -1,16 +0,0 @@
-===========================================================================
-$NetBSD: MESSAGE.SunOS,v 1.1 2011/01/20 16:25:21 tez Exp $
-
-openssl may dump core on SunOS due to a bug in the Solaris linker which
-erroneously pads .init segment with zeros [instead of nops].  Since the
-bug is triggered at initialization, it can be seen with a simple test like
-'openssl version'.
-
-Some versions of gcc already contain a workaround, and the linker may be
-fixed in some release.  If you see the problem, there are details and a
-fix for gcc at http://www.openssl.org/~appro/values.c which solves the
-problem.
-
-See also http://gnats.netbsd.org/43939
-
-===========================================================================
diff --git a/security/openssl/Makefile b/security/openssl/Makefile
index e842ef04169..9e2c1cab6cc 100644
--- a/security/openssl/Makefile
+++ b/security/openssl/Makefile
@@ -1,26 +1,7 @@
-# $NetBSD: Makefile,v 1.172 2013/02/05 15:54:30 taca Exp $
-
-OPENSSL_SNAPSHOT?=	# empty
-OPENSSL_STABLE?=	# empty
-OPENSSL_VERS?=		0.9.8y
-
-.if empty(OPENSSL_SNAPSHOT)
-DISTNAME=	openssl-${OPENSSL_VERS}
-MASTER_SITES=	http://ftp.openssl.org/source/ \
-				ftp://sunsite.cnlab-switch.ch/mirror/openssl/source/ \
-				ftp://sunsite.uio.no/pub/security/openssl/source/
-.else
-.  if !empty(OPENSSL_STABLE:M[yY][eE][sS])
-DISTNAME=	openssl-${OPENSSL_VERS:C/[a-z]$//}-stable-SNAP-${OPENSSL_SNAPSHOT}
-PKGNAME=	openssl-${OPENSSL_VERS}beta${OPENSSL_SNAPSHOT}
-MASTER_SITES=	ftp://ftp.openssl.org/snapshot/
-.  else
-DISTNAME=	openssl-SNAP-${OPENSSL_SNAPSHOT}
-PKGNAME=	openssl-${OPENSSL_VERS}alpha${OPENSSL_SNAPSHOT}
-MASTER_SITES=	ftp://ftp.openssl.org/snapshot/
-.  endif
-.endif
+# $NetBSD: Makefile,v 1.173 2013/02/06 21:40:33 jperkin Exp $
 
+DISTNAME=	openssl-1.0.1d
+MASTER_SITES=	http://ftp.openssl.org/source/
 SVR4_PKGNAME=	ossl
 CATEGORIES=	security
 
diff --git a/security/openssl/PLIST.common b/security/openssl/PLIST.common
index 0c6901258c0..83d63d967af 100644
--- a/security/openssl/PLIST.common
+++ b/security/openssl/PLIST.common
@@ -1,4 +1,4 @@
-@comment $NetBSD: PLIST.common,v 1.17 2010/03/01 08:15:40 taca Exp $
+@comment $NetBSD: PLIST.common,v 1.18 2013/02/06 21:40:33 jperkin Exp $
 bin/c_rehash
 bin/openssl
 include/openssl/aes.h
@@ -9,7 +9,10 @@ include/openssl/bio.h
 include/openssl/blowfish.h
 include/openssl/bn.h
 include/openssl/buffer.h
+include/openssl/camellia.h
 include/openssl/cast.h
+include/openssl/cmac.h
+include/openssl/cms.h
 include/openssl/comp.h
 include/openssl/conf.h
 include/openssl/conf_api.h
@@ -33,10 +36,11 @@ ${PLIST.idea}include/openssl/idea.h
 include/openssl/krb5_asn.h
 include/openssl/kssl.h
 include/openssl/lhash.h
-include/openssl/md2.h
+${PLIST.md2}include/openssl/md2.h
 include/openssl/md4.h
 include/openssl/md5.h
 ${PLIST.mdc2}include/openssl/mdc2.h
+include/openssl/modes.h
 include/openssl/obj_mac.h
 include/openssl/objects.h
 include/openssl/ocsp.h
@@ -47,7 +51,6 @@ include/openssl/pem.h
 include/openssl/pem2.h
 include/openssl/pkcs12.h
 include/openssl/pkcs7.h
-include/openssl/pq_compat.h
 include/openssl/pqueue.h
 include/openssl/rand.h
 include/openssl/rc2.h
@@ -56,19 +59,22 @@ ${PLIST.rc5}include/openssl/rc5.h
 include/openssl/ripemd.h
 include/openssl/rsa.h
 include/openssl/safestack.h
+include/openssl/seed.h
 include/openssl/sha.h
+include/openssl/srp.h
+include/openssl/srtp.h
 include/openssl/ssl.h
 include/openssl/ssl2.h
 include/openssl/ssl23.h
 include/openssl/ssl3.h
 include/openssl/stack.h
-include/openssl/store.h
 include/openssl/symhacks.h
 include/openssl/tls1.h
-include/openssl/tmdiff.h
+include/openssl/ts.h
 include/openssl/txt_db.h
 include/openssl/ui.h
 include/openssl/ui_compat.h
+include/openssl/whrlpool.h
 include/openssl/x509.h
 include/openssl/x509_vfy.h
 include/openssl/x509v3.h
@@ -79,7 +85,9 @@ lib/engines/libcapi.so
 lib/engines/libchil.so
 lib/engines/libcswift.so
 lib/engines/libgmp.so
+lib/engines/libgost.so
 lib/engines/libnuron.so
+lib/engines/libpadlock.so
 lib/engines/libsureware.so
 lib/engines/libubsec.so
 lib/libcrypto.a
@@ -92,6 +100,7 @@ man/man1/openssl.1
 man/man1/openssl_asn1parse.1
 man/man1/openssl_ca.1
 man/man1/openssl_ciphers.1
+man/man1/openssl_cms.1
 man/man1/openssl_crl.1
 man/man1/openssl_crl2pkcs7.1
 man/man1/openssl_dgst.1
@@ -103,6 +112,7 @@ man/man1/openssl_ecparam.1
 man/man1/openssl_enc.1
 man/man1/openssl_errstr.1
 man/man1/openssl_gendsa.1
+man/man1/openssl_genpkey.1
 man/man1/openssl_genrsa.1
 man/man1/openssl_md2.1
 man/man1/openssl_md4.1
@@ -114,6 +124,9 @@ man/man1/openssl_passwd.1
 man/man1/openssl_pkcs12.1
 man/man1/openssl_pkcs7.1
 man/man1/openssl_pkcs8.1
+man/man1/openssl_pkey.1
+man/man1/openssl_pkeyparam.1
+man/man1/openssl_pkeyutl.1
 man/man1/openssl_rand.1
 man/man1/openssl_req.1
 man/man1/openssl_ripemd160.1
@@ -128,6 +141,8 @@ man/man1/openssl_sha1.1
 man/man1/openssl_smime.1
 man/man1/openssl_speed.1
 man/man1/openssl_spkac.1
+man/man1/openssl_ts.1
+man/man1/openssl_tsget.1
 man/man1/openssl_verify.1
 man/man1/openssl_version.1
 man/man1/openssl_x509.1
@@ -207,6 +222,7 @@ man/man3/BIO_gets.3
 man/man3/BIO_int_ctrl.3
 man/man3/BIO_make_bio_pair.3
 man/man3/BIO_new.3
+man/man3/BIO_new_CMS.3
 man/man3/BIO_new_bio_pair.3
 man/man3/BIO_new_buffer_ssl_connect.3
 man/man3/BIO_new_fd.3
@@ -374,11 +390,55 @@ man/man3/BUF_MEM_free.3
 man/man3/BUF_MEM_grow.3
 man/man3/BUF_MEM_new.3
 man/man3/BUF_strdup.3
+man/man3/CMS_ReceiptRequest_create0.3
+man/man3/CMS_ReceiptRequest_get0_values.3
+man/man3/CMS_RecipientInfo_decrypt.3
+man/man3/CMS_RecipientInfo_kekri_get0_id.3
+man/man3/CMS_RecipientInfo_kekri_id_cmp.3
+man/man3/CMS_RecipientInfo_ktri_cert_cmp.3
+man/man3/CMS_RecipientInfo_ktri_get0_signer_id.3
+man/man3/CMS_RecipientInfo_set0_key.3
+man/man3/CMS_RecipientInfo_set0_pkey.3
+man/man3/CMS_RecipientInfo_type.3
+man/man3/CMS_SignerInfo_cert_cmp.3
+man/man3/CMS_SignerInfo_get0_signer_id.3
+man/man3/CMS_SignerInfo_sign.3
+man/man3/CMS_add0_cert.3
+man/man3/CMS_add0_crl.3
+man/man3/CMS_add0_recipient_key.3
+man/man3/CMS_add1_ReceiptRequest.3
+man/man3/CMS_add1_cert.3
+man/man3/CMS_add1_recipient_cert.3
+man/man3/CMS_compress.3
+man/man3/CMS_decrypt.3
+man/man3/CMS_encrypt.3
+man/man3/CMS_final.3
+man/man3/CMS_get0_RecipientInfos.3
+man/man3/CMS_get0_SignerInfos.3
+man/man3/CMS_get0_eContentType.3
+man/man3/CMS_get0_type.3
+man/man3/CMS_get1_ReceiptRequest.3
+man/man3/CMS_get1_certs.3
+man/man3/CMS_get1_crls.3
+man/man3/CMS_set1_eContentType.3
+man/man3/CMS_set1_signer_certs.3
+man/man3/CMS_sign.3
+man/man3/CMS_sign_add1_signer.3
+man/man3/CMS_sign_receipt.3
+man/man3/CMS_uncompress.3
+man/man3/CMS_verify.3
+man/man3/CMS_verify_receipt.3
 man/man3/CONF_modules_finish.3
 man/man3/CONF_modules_free.3
 man/man3/CONF_modules_load.3
 man/man3/CONF_modules_load_file.3
 man/man3/CONF_modules_unload.3
+man/man3/CRYPTO_THREADID_cmp.3
+man/man3/CRYPTO_THREADID_cpy.3
+man/man3/CRYPTO_THREADID_current.3
+man/man3/CRYPTO_THREADID_get_callback.3
+man/man3/CRYPTO_THREADID_hash.3
+man/man3/CRYPTO_THREADID_set_callback.3
 man/man3/CRYPTO_destroy_dynlockid.3
 man/man3/CRYPTO_get_ex_data.3
 man/man3/CRYPTO_get_new_dynlockid.3
@@ -388,7 +448,6 @@ man/man3/CRYPTO_set_dynlock_create_callback.3
 man/man3/CRYPTO_set_dynlock_destroy_callback.3
 man/man3/CRYPTO_set_dynlock_lock_callback.3
 man/man3/CRYPTO_set_ex_data.3
-man/man3/CRYPTO_set_id_callback.3
 man/man3/CRYPTO_set_locking_callback.3
 man/man3/DES_cbc_cksum.3
 man/man3/DES_cfb64_encrypt.3
@@ -533,7 +592,13 @@ man/man3/EVP_DecryptUpdate.3
 man/man3/EVP_DigestFinal_ex.3
 man/man3/EVP_DigestInit.3
 man/man3/EVP_DigestInit_ex.3
+man/man3/EVP_DigestSignFinal.3
+man/man3/EVP_DigestSignInit.3
+man/man3/EVP_DigestSignUpdate.3
 man/man3/EVP_DigestUpdate.3
+man/man3/EVP_DigestVerifyFinal.3
+man/man3/EVP_DigestVerifyInit.3
+man/man3/EVP_DigestVerifyUpdate.3
 man/man3/EVP_EncryptFinal.3
 man/man3/EVP_EncryptFinal_ex.3
 man/man3/EVP_EncryptInit.3
@@ -557,21 +622,59 @@ man/man3/EVP_MD_type.3
 man/man3/EVP_OpenFinal.3
 man/man3/EVP_OpenInit.3
 man/man3/EVP_OpenUpdate.3
+man/man3/EVP_PKEVP_PKEY_CTX_set_app_data.3
+man/man3/EVP_PKEY_CTX_ctrl.3
+man/man3/EVP_PKEY_CTX_dup.3
+man/man3/EVP_PKEY_CTX_free.3
+man/man3/EVP_PKEY_CTX_get_app_data.3
+man/man3/EVP_PKEY_CTX_get_cb.3
+man/man3/EVP_PKEY_CTX_get_keygen_info.3
+man/man3/EVP_PKEY_CTX_new.3
+man/man3/EVP_PKEY_CTX_new_id.3
+man/man3/EVP_PKEY_CTX_set_cb.3
 man/man3/EVP_PKEY_assign_DH.3
 man/man3/EVP_PKEY_assign_DSA.3
 man/man3/EVP_PKEY_assign_EC_KEY.3
 man/man3/EVP_PKEY_assign_RSA.3
+man/man3/EVP_PKEY_cmp.3
+man/man3/EVP_PKEY_cmp_parameters.3
+man/man3/EVP_PKEY_copy_parameters.3
+man/man3/EVP_PKEY_ctrl.3
+man/man3/EVP_PKEY_ctrl_str.3
+man/man3/EVP_PKEY_decrypt.3
+man/man3/EVP_PKEY_decrypt_init.3
+man/man3/EVP_PKEY_derive.3
+man/man3/EVP_PKEY_derive_init.3
+man/man3/EVP_PKEY_derive_set_peer.3
+man/man3/EVP_PKEY_encrypt.3
+man/man3/EVP_PKEY_encrypt_init.3
 man/man3/EVP_PKEY_free.3
 man/man3/EVP_PKEY_get1_DH.3
 man/man3/EVP_PKEY_get1_DSA.3
 man/man3/EVP_PKEY_get1_EC_KEY.3
 man/man3/EVP_PKEY_get1_RSA.3
+man/man3/EVP_PKEY_get_default_digest.3
+man/man3/EVP_PKEY_get_default_digest_nid.3
+man/man3/EVP_PKEY_keygen.3
+man/man3/EVP_PKEY_keygen_init.3
+man/man3/EVP_PKEY_missing_parameters.3
 man/man3/EVP_PKEY_new.3
+man/man3/EVP_PKEY_paramgen.3
+man/man3/EVP_PKEY_paramgen_init.3
+man/man3/EVP_PKEY_print_params.3
+man/man3/EVP_PKEY_print_private.3
+man/man3/EVP_PKEY_print_public.3
 man/man3/EVP_PKEY_set1_DH.3
 man/man3/EVP_PKEY_set1_DSA.3
 man/man3/EVP_PKEY_set1_EC_KEY.3
 man/man3/EVP_PKEY_set1_RSA.3
+man/man3/EVP_PKEY_sign.3
+man/man3/EVP_PKEY_sign_init.3
 man/man3/EVP_PKEY_type.3
+man/man3/EVP_PKEY_verify.3
+man/man3/EVP_PKEY_verify_init.3
+man/man3/EVP_PKEY_verify_recover.3
+man/man3/EVP_PKEY_verify_recover_init.3
 man/man3/EVP_SealFinal.3
 man/man3/EVP_SealInit.3
 man/man3/EVP_SealUpdate.3
@@ -596,6 +699,10 @@ man/man3/EVP_mdc2.3
 man/man3/EVP_ripemd160.3
 man/man3/EVP_sha.3
 man/man3/EVP_sha1.3
+man/man3/EVP_sha224.3
+man/man3/EVP_sha256.3
+man/man3/EVP_sha384.3
+man/man3/EVP_sha512.3
 man/man3/HMAC.3
 man/man3/HMAC_Final.3
 man/man3/HMAC_Init.3
@@ -689,12 +796,14 @@ man/man3/PEM_write_X509_AUX.3
 man/man3/PEM_write_X509_CRL.3
 man/man3/PEM_write_X509_REQ.3
 man/man3/PEM_write_X509_REQ_NEW.3
+man/man3/PEM_write_bio_CMS_stream.3
 man/man3/PEM_write_bio_DHparams.3
 man/man3/PEM_write_bio_DSAPrivateKey.3
 man/man3/PEM_write_bio_DSA_PUBKEY.3
 man/man3/PEM_write_bio_DSAparams.3
 man/man3/PEM_write_bio_NETSCAPE_CERT_SEQUENCE.3
 man/man3/PEM_write_bio_PKCS7.3
+man/man3/PEM_write_bio_PKCS7_stream.3
 man/man3/PEM_write_bio_PKCS8PrivateKey.3
 man/man3/PEM_write_bio_PKCS8PrivateKey_nid.3
 man/man3/PEM_write_bio_PUBKEY.3
@@ -712,6 +821,7 @@ man/man3/PKCS12_parse.3
 man/man3/PKCS7_decrypt.3
 man/man3/PKCS7_encrypt.3
 man/man3/PKCS7_sign.3
+man/man3/PKCS7_sign_add_signer.3
 man/man3/PKCS7_verify.3
 man/man3/RAND_SSLeay.3
 man/man3/RAND_add.3
@@ -776,7 +886,9 @@ man/man3/SHA1.3
 man/man3/SHA1_Final.3
 man/man3/SHA1_Init.3
 man/man3/SHA1_Update.3
+man/man3/SMIME_read_CMS.3
 man/man3/SMIME_read_PKCS7.3
+man/man3/SMIME_write_CMS.3
 man/man3/SMIME_write_PKCS7.3
 man/man3/SSL.3
 man/man3/SSL_CIPHER_description.3
@@ -848,6 +960,8 @@ man/man3/SSL_CTX_set_mode.3
 man/man3/SSL_CTX_set_msg_callback.3
 man/man3/SSL_CTX_set_msg_callback_arg.3
 man/man3/SSL_CTX_set_options.3
+man/man3/SSL_CTX_set_psk_client_callback.3
+man/man3/SSL_CTX_set_psk_server_callback.3
 man/man3/SSL_CTX_set_quiet_shutdown.3
 man/man3/SSL_CTX_set_session_cache_mode.3
 man/man3/SSL_CTX_set_session_id_context.3
@@ -869,6 +983,7 @@ man/man3/SSL_CTX_use_certificate.3
 man/man3/SSL_CTX_use_certificate_ASN1.3
 man/man3/SSL_CTX_use_certificate_chain_file.3
 man/man3/SSL_CTX_use_certificate_file.3
+man/man3/SSL_CTX_use_psk_identity_hint.3
 man/man3/SSL_SESSION_free.3
 man/man3/SSL_SESSION_get_ex_data.3
 man/man3/SSL_SESSION_get_ex_new_index.3
@@ -916,6 +1031,8 @@ man/man3/SSL_get_msg_callback_arg.3
 man/man3/SSL_get_options.3
 man/man3/SSL_get_peer_cert_chain.3
 man/man3/SSL_get_peer_certificate.3
+man/man3/SSL_get_psk_identity.3
+man/man3/SSL_get_psk_identity_hint.3
 man/man3/SSL_get_quiet_shutdown.3
 man/man3/SSL_get_rbio.3
 man/man3/SSL_get_secure_renegotiation_support.3
@@ -951,6 +1068,8 @@ man/man3/SSL_set_max_cert_list.3
 man/man3/SSL_set_mode.3
 man/man3/SSL_set_msg_callback.3
 man/man3/SSL_set_options.3
+man/man3/SSL_set_psk_client_callback.3
+man/man3/SSL_set_psk_server_callback.3
 man/man3/SSL_set_quiet_shutdown.3
 man/man3/SSL_set_session.3
 man/man3/SSL_set_session_id_context.3
@@ -975,6 +1094,7 @@ man/man3/SSL_use_RSAPrivateKey_file.3
 man/man3/SSL_use_certificate.3
 man/man3/SSL_use_certificate_ASN1.3
 man/man3/SSL_use_certificate_file.3
+man/man3/SSL_use_psk_identity_hint.3
 man/man3/SSL_want.3
 man/man3/SSL_want_nothing.3
 man/man3/SSL_want_read.3
@@ -1030,8 +1150,42 @@ man/man3/X509_NAME_oneline.3
 man/man3/X509_NAME_print.3
 man/man3/X509_NAME_print_ex.3
 man/man3/X509_NAME_print_ex_fp.3
+man/man3/X509_STORE_CTX_cleanup.3
+man/man3/X509_STORE_CTX_free.3
+man/man3/X509_STORE_CTX_get0_param.3
+man/man3/X509_STORE_CTX_get1_chain.3
+man/man3/X509_STORE_CTX_get_current_cert.3
+man/man3/X509_STORE_CTX_get_error.3
+man/man3/X509_STORE_CTX_get_error_depth.3
+man/man3/X509_STORE_CTX_get_ex_data.3
+man/man3/X509_STORE_CTX_get_ex_new_index.3
+man/man3/X509_STORE_CTX_init.3
+man/man3/X509_STORE_CTX_new.3
+man/man3/X509_STORE_CTX_set0_crls.3
+man/man3/X509_STORE_CTX_set0_param.3
+man/man3/X509_STORE_CTX_set_cert.3
+man/man3/X509_STORE_CTX_set_chain.3
+man/man3/X509_STORE_CTX_set_default.3
+man/man3/X509_STORE_CTX_set_error.3
+man/man3/X509_STORE_CTX_set_ex_data.3
+man/man3/X509_STORE_CTX_set_verify_cb.3
+man/man3/X509_STORE_CTX_trusted_stack.3
+man/man3/X509_STORE_set_verify_cb.3
+man/man3/X509_STORE_set_verify_cb_func.3
+man/man3/X509_VERIFY_PARAM_add0_policy.3
+man/man3/X509_VERIFY_PARAM_clear_flags.3
+man/man3/X509_VERIFY_PARAM_get_depth.3
+man/man3/X509_VERIFY_PARAM_get_flags.3
+man/man3/X509_VERIFY_PARAM_set1_policies.3
+man/man3/X509_VERIFY_PARAM_set_depth.3
+man/man3/X509_VERIFY_PARAM_set_flags.3
+man/man3/X509_VERIFY_PARAM_set_purpose.3
+man/man3/X509_VERIFY_PARAM_set_time.3
+man/man3/X509_VERIFY_PARAM_set_trust.3
 man/man3/X509_free.3
 man/man3/X509_new.3
+man/man3/X509_verify_cert.3
+man/man3/X509_verify_cert_error_string.3
 man/man3/bn_add_words.3
 man/man3/bn_check_top.3
 man/man3/bn_cmp_words.3
@@ -1093,12 +1247,14 @@ man/man3/des_read_password.3
 man/man3/des_read_pw.3
 man/man3/des_read_pw_string.3
 man/man3/i2d_ASN1_OBJECT.3
+man/man3/i2d_CMS_bio_stream.3
 man/man3/i2d_DHparams.3
 man/man3/i2d_DSAPrivateKey.3
 man/man3/i2d_DSAPublicKey.3
 man/man3/i2d_DSA_PUBKEY.3
 man/man3/i2d_DSA_SIG.3
 man/man3/i2d_Netscape_RSA.3
+man/man3/i2d_PKCS7_bio_stream.3
 man/man3/i2d_PKCS8PrivateKey_bio.3
 man/man3/i2d_PKCS8PrivateKey_fp.3
 man/man3/i2d_PKCS8PrivateKey_nid_bio.3
@@ -1170,3 +1326,4 @@ share/examples/openssl/c_info
 share/examples/openssl/c_issuer
 share/examples/openssl/c_name
 share/examples/openssl/openssl.cnf
+share/examples/openssl/tsget
diff --git a/security/openssl/PLIST.darwin b/security/openssl/PLIST.darwin
deleted file mode 100644
index 71a4a243d04..00000000000
--- a/security/openssl/PLIST.darwin
+++ /dev/null
@@ -1,5 +0,0 @@
-@comment $NetBSD: PLIST.darwin,v 1.6 2008/01/17 06:42:47 tnn Exp $
-lib/libcrypto.${SHLIB_VERSION}.dylib
-lib/libcrypto.dylib
-lib/libssl.${SHLIB_VERSION}.dylib
-lib/libssl.dylib
diff --git a/security/openssl/PLIST.shlib b/security/openssl/PLIST.shlib
index a316223b8f5..9c668e14182 100644
--- a/security/openssl/PLIST.shlib
+++ b/security/openssl/PLIST.shlib
@@ -1,5 +1,5 @@
-@comment $NetBSD: PLIST.shlib,v 1.2 2004/12/24 22:02:38 jlam Exp $
+@comment $NetBSD: PLIST.shlib,v 1.3 2013/02/06 21:40:33 jperkin Exp $
 lib/libcrypto.so
-lib/libcrypto.so.${SHLIB_VERSION}
+lib/libcrypto.so.1.0.0
 lib/libssl.so
-lib/libssl.so.${SHLIB_VERSION}
+lib/libssl.so.1.0.0
diff --git a/security/openssl/buildlink3.mk b/security/openssl/buildlink3.mk
index d9631f8a5f1..a09c6a05404 100644
--- a/security/openssl/buildlink3.mk
+++ b/security/openssl/buildlink3.mk
@@ -1,4 +1,4 @@
-# $NetBSD: buildlink3.mk,v 1.42 2010/01/17 12:02:42 wiz Exp $
+# $NetBSD: buildlink3.mk,v 1.43 2013/02/06 21:40:33 jperkin Exp $
 
 BUILDLINK_TREE+=	openssl
 
@@ -7,8 +7,8 @@ OPENSSL_BUILDLINK3_MK:=
 
 .  include "../../mk/bsd.fast.prefs.mk"
 
-BUILDLINK_API_DEPENDS.openssl+=	openssl>=0.9.6m
-BUILDLINK_ABI_DEPENDS.openssl+=	openssl>=0.9.8knb1
+BUILDLINK_API_DEPENDS.openssl+=	openssl>=1.0.1d
+BUILDLINK_ABI_DEPENDS.openssl+=	openssl>=1.0.1d
 BUILDLINK_PKGSRCDIR.openssl?=	../../security/openssl
 
 # Ensure that -lcrypt comes before -lcrypto when linking so that the
diff --git a/security/openssl/distinfo b/security/openssl/distinfo
index 87f9647d6e5..2de35a1cc46 100644
--- a/security/openssl/distinfo
+++ b/security/openssl/distinfo
@@ -1,13 +1,13 @@
-$NetBSD: distinfo,v 1.91 2013/02/05 15:54:30 taca Exp $
+$NetBSD: distinfo,v 1.92 2013/02/06 21:40:33 jperkin Exp $
 
-SHA1 (openssl-0.9.8y.tar.gz) = 32ec994d626555774548c82e48c5d220bec903c4
-RMD160 (openssl-0.9.8y.tar.gz) = a44d14e32c73ee9451089d06d18d04d8f83660bc
-Size (openssl-0.9.8y.tar.gz) = 3785001 bytes
+SHA1 (openssl-1.0.1d.tar.gz) = 5e586810ea516a5eec1c7d7c730a17fb528de32d
+RMD160 (openssl-1.0.1d.tar.gz) = 37710d9841a9d89e55d01a09083801ee0cc63f76
+Size (openssl-1.0.1d.tar.gz) = 4459791 bytes
 SHA1 (patch-aa) = c4b27857698c108fe495fe65ea8857b77e89a655
-SHA1 (patch-ac) = 6ff4a20440666f5c520837e10547091e1bee2208
+SHA1 (patch-ac) = 89043b9e3369a9781de3a82cefa9b1cacab07510
 SHA1 (patch-ad) = bb86ac463fc4ab8b485df5f1a4fb9c13c1fc41c3
 SHA1 (patch-ae) = 7a58f1765a3761321dcc8dafc5fe2e33207be480
-SHA1 (patch-af) = 2610930b6b06397fa2e3955b3244c02193f5b7a6
-SHA1 (patch-ag) = 5f12c72b85e4b6c6a79dfcf87055e9e029fbd8c8
+SHA1 (patch-af) = 376f474f3809365a20a53cfe1c91eca4bc02a5cd
+SHA1 (patch-ag) = b407200455878a8a151fc9b4f771fe17552d04fc
 SHA1 (patch-ak) = 049250b9bd42e6f155145703135dab39a7ec17e0
-SHA1 (patch-al) = 076a606352bdeaeea1cc64f16be2ac1325882302
+SHA1 (patch-engines_ccgost_Makefile) = 08999f0f40969883482ad9ffc1aa9959ed7d402c
diff --git a/security/openssl/options.mk b/security/openssl/options.mk
index 53dd99a3a07..d6bfe818334 100644
--- a/security/openssl/options.mk
+++ b/security/openssl/options.mk
@@ -1,8 +1,8 @@
-# $NetBSD: options.mk,v 1.8 2012/01/20 17:07:38 drochner Exp $
+# $NetBSD: options.mk,v 1.9 2013/02/06 21:40:33 jperkin Exp $
 
 PKG_OPTIONS_VAR=	PKG_OPTIONS.openssl
-PKG_SUPPORTED_OPTIONS=	idea mdc2 rc5 zlib threads
-PKG_SUGGESTED_OPTIONS=	threads
+PKG_SUPPORTED_OPTIONS=	idea md2 mdc2 rc5 zlib threads
+PKG_SUGGESTED_OPTIONS=	md2 threads
 
 .include "../../mk/bsd.options.mk"
 
@@ -10,36 +10,22 @@ OPENSSL_LICENSE=	# empty
 
 PLIST_VARS+=		${PKG_SUPPORTED_OPTIONS}
 
-###
-### Support for the IDEA algorithm
-###
-.if !empty(PKG_OPTIONS:Midea)
-PLIST.idea=		yes
-.else
-CONFIGURE_ARGS+=	no-idea
-.endif
-
-###
-### Support for the MDC2 algorithm
-###
-.if !empty(PKG_OPTIONS:Mmdc2)
-CONFIGURE_ARGS+=	enable-mdc2
-PLIST.mdc2=		yes
-.else
-CONFIGURE_ARGS+=	no-mdc2
-.endif
+#
+# Support optional algorithms
+#
+.for alg in idea md2 mdc2 rc5
+.  if !empty(PKG_OPTIONS:M${alg})
+CONFIGURE_ARGS+=	enable-${alg}
+PLIST.${alg}=		yes
+.  else
+CONFIGURE_ARGS+=	no-${alg}
+.  endif
+.endfor
 
-###
-### Support for the RC5 algorithm
-###	US Patent: 5724428, 5835600, 6269163
-###
-.if !empty(PKG_OPTIONS:Mrc5)
 # A license file is needed.
+# US Patent: 5724428, 5835600, 6269163
+.if !empty(PKG_OPTIONS:Mrc5)
 OPENSSL_LICENSE+=	rc5-nonlicense
-CONFIGURE_ARGS+=	enable-rc5
-PLIST.rc5=		yes
-.else
-CONFIGURE_ARGS+=	no-rc5
 .endif
 
 .if !empty(PKG_OPTIONS:Mzlib)
diff --git a/security/openssl/patches/patch-ac b/security/openssl/patches/patch-ac
index 13a4b3d636a..a5dddb3b8ce 100644
--- a/security/openssl/patches/patch-ac
+++ b/security/openssl/patches/patch-ac
@@ -1,27 +1,32 @@
-$NetBSD: patch-ac,v 1.38 2010/02/26 03:15:13 taca Exp $
+$NetBSD: patch-ac,v 1.39 2013/02/06 21:40:34 jperkin Exp $
 
---- Configure.orig	2009-11-09 14:14:26.000000000 +0000
+* Avoid -fast on Solaris, creates non-portable packages which depend on
+  host-specific CPU features.
+
+--- Configure.orig	2012-03-14 22:20:40.000000000 +0000
 +++ Configure
-@@ -212,7 +212,7 @@ my %table=(
- "solaris64-x86_64-gcc","gcc:-m64 -O3 -Wall -DL_ENDIAN -DMD32_REG_T=int::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:solaris-shared:-fPIC:-m64 -shared -static-libgcc:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+@@ -223,8 +223,8 @@ my %table=(
+ "solaris64-x86_64-gcc","gcc:-m64 -O3 -Wall -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:solaris-shared:-fPIC:-m64 -shared -static-libgcc:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/64",
   
  #### Solaris x86 with Sun C setups
 -"solaris-x86-cc","cc:-fast -O -Xa::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"solaris64-x86_64-cc","cc:-fast -xarch=amd64 -xstrconst -Xa -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:solaris-shared:-KPIC:-xarch=amd64 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/64",
 +"solaris-x86-cc","cc:-xO5 -Xa::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-KPIC:-G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- "solaris64-x86_64-cc","cc:-fast -xarch=amd64 -xstrconst -Xa -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:solaris-shared:-KPIC:-xarch=amd64 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"solaris64-x86_64-cc","cc:-xO5 -xarch=amd64 -xstrconst -Xa -DL_ENDIAN::-D_REENTRANT::-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:solaris-shared:-KPIC:-xarch=amd64 -G -dy -z text:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::/64",
  
  #### SPARC Solaris with GNU C setups
-@@ -324,6 +324,7 @@ my %table=(
+ "solaris-sparcv7-gcc","gcc:-O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT::-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${no_asm}:dlfcn:solaris-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+@@ -336,6 +336,7 @@ my %table=(
  #
- "osf1-alpha-gcc", "gcc:-O3::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_RISC1:${no_asm}:dlfcn:alpha-osf1-shared:::.so",
- "osf1-alpha-cc",  "cc:-std1 -tune host -O4 -readonly_strings::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${no_asm}:dlfcn:alpha-osf1-shared:::.so",
+ "osf1-alpha-gcc", "gcc:-O3::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_RISC1:${alpha_asm}:dlfcn:alpha-osf1-shared:::.so",
+ "osf1-alpha-cc",  "cc:-std1 -tune host -O4 -readonly_strings::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${alpha_asm}:dlfcn:alpha-osf1-shared:::.so",
 +"tru64-alpha-gcc", "gcc:-O3::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${no_asm}:dlfcn:alpha-osf1-shared::-Wl,-msym:.so",
- "tru64-alpha-cc", "cc:-std1 -tune host -fast -readonly_strings::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${no_asm}:dlfcn:alpha-osf1-shared::-msym:.so",
+ "tru64-alpha-cc", "cc:-std1 -tune host -fast -readonly_strings::-pthread:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${alpha_asm}:dlfcn:alpha-osf1-shared::-msym:.so",
  
  ####
-@@ -386,6 +387,25 @@ my %table=(
- "BSD-ia64",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK:${ia64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
- "BSD-x86_64",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -DMD32_REG_T=int -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+@@ -421,6 +422,25 @@ my %table=(
+ "BSD-ia64",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ "BSD-x86_64",	"gcc:-DL_ENDIAN -DTERMIOS -O3 -Wall::${BSDthreads}:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
  
 +"NetBSD","gcc:-DTERMIOS -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"NetBSD-alpha", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
@@ -36,7 +41,7 @@ $NetBSD: patch-ac,v 1.38 2010/02/26 03:15:13 taca Exp $
 +"NetBSD-sparc", "gcc:-DTERMIOS -DB_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"NetBSD-sparc64", "gcc:-DB_ENDIAN -DTERMIOS -O3 -DMD32_REG_T=int -Wall::(unknown):ULTRASPARC::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2 BF_PTR::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"NetBSD-vax", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::::dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"NetBSD-x86-aout", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"NetBSD-x86-aout", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"NetBSD-x86-elf", "gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"NetBSD-x86_64", "gcc:-DTERMIOS -DL_ENDIAN -DMD32_REG_T=int -O2::(unknown):::SIXTY_FOUR_BIT_LONG RC4_CHUNK BF_PTR2 DES_INT DES_UNROLL:${x86_64_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"Interix","gcc:-DTERMIOS -DL_ENDIAN -O2 -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::::dlfcn:bsd-gcc-shared::-Wl,--image-base,0x5e000000:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
@@ -45,18 +50,7 @@ $NetBSD: patch-ac,v 1.38 2010/02/26 03:15:13 taca Exp $
  "bsdi-elf-gcc",     "gcc:-DPERL5 -DL_ENDIAN -fomit-frame-pointer -O3 -march=i486 -Wall::(unknown)::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
  
  "nextstep",	"cc:-O -Wall:<libc.h>:(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::",
-@@ -821,6 +841,10 @@ PROCESS_ARGS:
- 				{
- 				$libs.=$_." ";
- 				}
-+			elsif (/^-Wl,(.*)$/)
-+				{
-+				$libs.=$_." ";
-+				}
- 			elsif (/^-[^-]/ or /^\+/)
- 				{
- 				$flags.=$_." ";
-@@ -1566,7 +1590,7 @@ while (<IN>)
+@@ -1672,7 +1692,7 @@ while (<IN>)
  	elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
  		{
  		my $sotmp = $1;
diff --git a/security/openssl/patches/patch-af b/security/openssl/patches/patch-af
index c8192041cf8..59b96f686ce 100644
--- a/security/openssl/patches/patch-af
+++ b/security/openssl/patches/patch-af
@@ -1,6 +1,6 @@
-$NetBSD: patch-af,v 1.24 2010/02/26 03:15:14 taca Exp $
+$NetBSD: patch-af,v 1.25 2013/02/06 21:40:34 jperkin Exp $
 
---- Makefile.org.orig	2010-01-27 16:06:36.000000000 +0000
+--- Makefile.org.orig	2012-04-22 13:25:19.000000000 +0000
 +++ Makefile.org
 @@ -28,6 +28,7 @@ INSTALLTOP=/usr/local/ssl
  
@@ -10,18 +10,7 @@ $NetBSD: patch-af,v 1.24 2010/02/26 03:15:14 taca Exp $
  
  # NO_IDEA - Define to build without the IDEA algorithm
  # NO_RC4  - Define to build without the RC4 algorithm
-@@ -132,8 +133,8 @@ FIPSCANLIB=
- 
- BASEADDR=
- 
--DIRS=   crypto fips ssl engines apps test tools
--SHLIBDIRS= crypto ssl fips
-+DIRS=   crypto ssl engines apps test tools # fips
-+SHLIBDIRS= crypto ssl # fips
- 
- # dirs in crypto to build
- SDIRS=  \
-@@ -153,7 +154,7 @@ TESTS = alltests
+@@ -157,7 +158,7 @@ TESTS = alltests
  
  MAKEFILE= Makefile
  
@@ -30,15 +19,15 @@ $NetBSD: patch-af,v 1.24 2010/02/26 03:15:14 taca Exp $
  MAN1=1
  MAN3=3
  MANSUFFIX=
-@@ -169,6 +170,7 @@ SHARED_SSL=libssl$(SHLIB_EXT)
- SHARED_FIPS=
+@@ -174,6 +175,7 @@ SHARED_CRYPTO=libcrypto$(SHLIB_EXT)
+ SHARED_SSL=libssl$(SHLIB_EXT)
  SHARED_LIBS=
  SHARED_LIBS_LINK_EXTS=
 +LIBRPATH=$(INSTALLTOP)/lib
  SHARED_LDFLAGS=
  
  GENERAL=        Makefile
-@@ -615,7 +617,7 @@ dist:   
+@@ -537,7 +539,7 @@ dist:
  dist_pem_h:
  	(cd crypto/pem; $(MAKE) -e $(BUILDENV) pem.h; $(MAKE) clean)
  
@@ -47,7 +36,7 @@ $NetBSD: patch-af,v 1.24 2010/02/26 03:15:14 taca Exp $
  
  install_sw:
  	@$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \
-@@ -695,35 +697,53 @@ install_docs:
+@@ -648,35 +650,53 @@ install_docs:
  	set -e; for i in doc/apps/*.pod; do \
  		fn=`basename $$i .pod`; \
  		sec=`$(PERL) util/extract-section.pl 1 < $$i`; \
@@ -68,12 +57,12 @@ $NetBSD: patch-af,v 1.24 2010/02/26 03:15:14 taca Exp $
  			(grep -v "[	]"; true) | \
  			(cd $(INSTALL_PREFIX)$(MANDIR)/man$$sec/; \
  			 while read n; do \
--				$$here/util/point.sh $$fn.$${sec}$(MANSUFFIX) "$$n".$${sec}$(MANSUFFIX); \
+-				PLATFORM=$(PLATFORM) $$here/util/point.sh $$fn.$${sec}$(MANSUFFIX) "$$n".$${sec}$(MANSUFFIX); \
 +				case "$$n" in \
 +				CA.pl|openssl) on="$$n" ;; \
 +				*) on="openssl_$$n" ;; \
 +				esac; \
-+				$$here/util/point.sh $$ofn.$${sec}$(MANSUFFIX) "$$on".$${sec}$(MANSUFFIX); \
++				PLATFORM=$(PLATFORM) $$here/util/point.sh $$ofn.$${sec}$(MANSUFFIX) "$$on".$${sec}$(MANSUFFIX); \
  			 done); \
  	done; \
  	set -e; for i in doc/crypto/*.pod doc/ssl/*.pod; do \
@@ -97,13 +86,13 @@ $NetBSD: patch-af,v 1.24 2010/02/26 03:15:14 taca Exp $
  			(grep -v "[	]"; true) | \
  			(cd $(INSTALL_PREFIX)$(MANDIR)/man$$sec/; \
  			 while read n; do \
--				$$here/util/point.sh $$fn.$${sec}$(MANSUFFIX) "$$n".$${sec}$(MANSUFFIX); \
+-				PLATFORM=$(PLATFORM) $$here/util/point.sh $$fn.$${sec}$(MANSUFFIX) "$$n".$${sec}$(MANSUFFIX); \
 +				case "$$n" in \
 +				ui*) on="openssl_$$n" ;; \
 +				[A-Z]*|*_*) on="$$n" ;; \
 +				*) on="openssl_$$n" ;; \
 +				esac; \
-+				$$here/util/point.sh $$ofn.$${sec}$(MANSUFFIX) "$$on".$${sec}$(MANSUFFIX); \
++				PLATFORM=$(PLATFORM) $$here/util/point.sh $$ofn.$${sec}$(MANSUFFIX) "$$on".$${sec}$(MANSUFFIX); \
  			 done); \
  	done
  
diff --git a/security/openssl/patches/patch-ag b/security/openssl/patches/patch-ag
index 739bb623b0a..01169d5ec53 100644
--- a/security/openssl/patches/patch-ag
+++ b/security/openssl/patches/patch-ag
@@ -1,9 +1,9 @@
-$NetBSD: patch-ag,v 1.11 2008/02/20 01:10:20 tnn Exp $
+$NetBSD: patch-ag,v 1.12 2013/02/06 21:40:34 jperkin Exp $
 
---- Makefile.shared.orig	2007-09-16 16:11:51.000000000 +0200
+--- Makefile.shared.orig	2010-08-21 11:37:17.000000000 +0000
 +++ Makefile.shared
-@@ -273,6 +273,11 @@ link_o.alpha-osf1:
- 	@ if ${DETECT_GNU_LD}; then \
+@@ -315,6 +315,11 @@ link_o.alpha-osf1:
+ 	@ if $(DETECT_GNU_LD); then \
  		$(DO_GNU_SO); \
  	else \
 +		if ($(CC) -v 2>&1 | grep gcc) > /dev/null; then \
@@ -14,7 +14,7 @@ $NetBSD: patch-ag,v 1.11 2008/02/20 01:10:20 tnn Exp $
  		SHLIB=lib$(LIBNAME).so; \
  		SHLIB_SUFFIX=; \
  		SHLIB_HIST=`echo "$(LIBCOMPATVERSIONS)" | cut -d';' -f2 | sed -e 's/ */:/'`; \
-@@ -282,11 +287,11 @@ link_o.alpha-osf1:
+@@ -324,11 +329,11 @@ link_o.alpha-osf1:
  			SHLIB_HIST="$(LIBVERSION)"; \
  		fi; \
  		SHLIB_SOVER=; \
@@ -29,8 +29,8 @@ $NetBSD: patch-ag,v 1.11 2008/02/20 01:10:20 tnn Exp $
  		fi; \
  	fi; \
  	$(LINK_SO_O)
-@@ -294,6 +299,11 @@ link_a.alpha-osf1:
- 	@ if ${DETECT_GNU_LD}; then \
+@@ -336,6 +341,11 @@ link_a.alpha-osf1:
+ 	@ if $(DETECT_GNU_LD); then \
  		$(DO_GNU_SO); \
  	else \
 +		if ($(CC) -v 2>&1 | grep gcc) > /dev/null; then \
@@ -41,7 +41,7 @@ $NetBSD: patch-ag,v 1.11 2008/02/20 01:10:20 tnn Exp $
  		SHLIB=lib$(LIBNAME).so; \
  		SHLIB_SUFFIX=; \
  		SHLIB_HIST=`echo "$(LIBCOMPATVERSIONS)" | cut -d';' -f2 | sed -e 's/ */:/'`; \
-@@ -303,11 +313,11 @@ link_a.alpha-osf1:
+@@ -345,11 +355,11 @@ link_a.alpha-osf1:
  			SHLIB_HIST="$(LIBVERSION)"; \
  		fi; \
  		SHLIB_SOVER=; \
@@ -56,7 +56,7 @@ $NetBSD: patch-ag,v 1.11 2008/02/20 01:10:20 tnn Exp $
  		fi; \
  	fi; \
  	$(LINK_SO_A)
-@@ -442,7 +452,7 @@ link_a.irix:
+@@ -484,7 +494,7 @@ link_a.irix:
  		($(CC) -v 2>&1 | grep gcc) > /dev/null && MINUSWL="-Wl,"; \
  		ALLSYMSFLAGS="$${MINUSWL}-all"; \
  		NOALLSYMSFLAGS="$${MINUSWL}-none"; \
diff --git a/security/openssl/patches/patch-al b/security/openssl/patches/patch-al
deleted file mode 100644
index 0732091e3a9..00000000000
--- a/security/openssl/patches/patch-al
+++ /dev/null
@@ -1,19 +0,0 @@
-$NetBSD: patch-al,v 1.4 2008/01/17 06:42:49 tnn Exp $
-
---- apps/speed.c.orig	2006-06-09 17:42:11.000000000 +0200
-+++ apps/speed.c	2007-07-31 17:52:43.000000000 +0200
-@@ -108,12 +108,12 @@
- #include <signal.h>
- #endif
- 
--#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(OPENSSL_SYS_MACOSX)
-+#if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) || defined(OPENSSL_SYS_MACOSX) || defined(__DragonFly__)
- # define USE_TOD
- #elif !defined(OPENSSL_SYS_MSDOS) && !defined(OPENSSL_SYS_VXWORKS) && (!defined(OPENSSL_SYS_VMS) || defined(__DECC))
- # define TIMES
- #endif
--#if !defined(_UNICOS) && !defined(__OpenBSD__) && !defined(sgi) && !defined(__FreeBSD__) && !(defined(__bsdi) || defined(__bsdi__)) && !defined(_AIX) && !defined(OPENSSL_SYS_MPE) && !defined(__NetBSD__) && !defined(OPENSSL_SYS_VXWORKS) /* FIXME */
-+#if !defined(_UNICOS) && !defined(__OpenBSD__) && !defined(sgi) && !defined(__FreeBSD__) && !(defined(__bsdi) || defined(__bsdi__)) && !defined(_AIX) && !defined(OPENSSL_SYS_MPE) && !defined(__NetBSD__) && !defined(OPENSSL_SYS_VXWORKS) && !defined(__DragonFly__) /* FIXME */
- # define TIMEB
- #endif
- 
diff --git a/security/openssl/patches/patch-engines_ccgost_Makefile b/security/openssl/patches/patch-engines_ccgost_Makefile
new file mode 100644
index 00000000000..db476d3132b
--- /dev/null
+++ b/security/openssl/patches/patch-engines_ccgost_Makefile
@@ -0,0 +1,15 @@
+$NetBSD: patch-engines_ccgost_Makefile,v 1.1 2013/02/06 21:40:34 jperkin Exp $
+
+* Make sure rpath is set properly on the libgost.so engine lib.
+
+--- engines/ccgost/Makefile.orig	2012-04-26 10:42:20.000000000 +0000
++++ engines/ccgost/Makefile	2013-02-04 13:27:37.220193130 +0000
+@@ -32,7 +32,7 @@ lib: $(LIBOBJ)
+ 		$(MAKE) -f $(TOP)/Makefile.shared -e \
+ 			LIBNAME=$(LIBNAME) \
+ 			LIBEXTRAS='$(LIBOBJ)' \
+-			LIBDEPS='-L$(TOP) -lcrypto' \
++			LIBDEPS='-L$(TOP) -lcrypto $(EX_LIBS)' \
+ 			link_o.$(SHLIB_TARGET); \
+ 	else \
+ 		$(AR) $(LIB) $(LIBOBJ); \