Merge remote-tracking branch 'origin/master'

10 files changed, 266 insertions, 99 deletions

diff --git a/openssl-sys/Cargo.toml b/openssl-sys/Cargo.toml
index 1153dd5a..9e53ce64 100644
--- a/openssl-sys/Cargo.toml
+++ b/openssl-sys/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "openssl-sys"
-version = "0.9.30"
+version = "0.9.32"
 authors = ["Alex Crichton <[email protected]>",
            "Steven Fackler <[email protected]>"]
 license = "MIT"
@@ -9,6 +9,7 @@ repository = "https://github.com/sfackler/rust-openssl"
 readme = "README.md"
 categories = ["cryptography", "external-ffi-bindings"]
 links = "openssl"
+build = "build/main.rs"
 
 [dependencies]
 libc = "0.2"
diff --git a/openssl-sys/build/cfgs.rs b/openssl-sys/build/cfgs.rs
new file mode 100644
index 00000000..4648f6f5
--- /dev/null
+++ b/openssl-sys/build/cfgs.rs
@@ -0,0 +1,43 @@
+pub fn get(openssl_version: Option<u64>, libressl_version: Option<u64>) -> Vec<&'static str> {
+    let mut cfgs = vec![];
+
+    if let Some(libressl_version) = libressl_version {
+        cfgs.push("libressl");
+
+        if libressl_version >= 0x2_05_01_00_0 {
+            cfgs.push("libressl251");
+        }
+        if libressl_version >= 0x2_06_01_00_0 {
+            cfgs.push("libressl261");
+        }
+        if libressl_version >= 0x2_07_00_00_0 {
+            cfgs.push("libressl270");
+        }
+    } else {
+        let openssl_version = openssl_version.unwrap();
+
+        if openssl_version >= 0x1_00_01_00_0 {
+            cfgs.push("ossl101");
+        }
+        if openssl_version >= 0x1_00_02_00_0 {
+            cfgs.push("ossl102");
+        }
+        if openssl_version >= 0x1_00_02_08_0 {
+            cfgs.push("ossl102h");
+        }
+        if openssl_version >= 0x1_01_00_00_0 {
+            cfgs.push("ossl110");
+        }
+        if openssl_version >= 0x1_01_00_06_0 {
+            cfgs.push("ossl110f");
+        }
+        if openssl_version >= 0x1_01_00_07_0 {
+            cfgs.push("ossl110g");
+        }
+        if openssl_version >= 0x1_01_01_00_0 {
+            cfgs.push("ossl111");
+        }
+    }
+
+    cfgs
+}
diff --git a/openssl-sys/build.rs b/openssl-sys/build/main.rs
index 0b8341fa..e2b3108c 100644
--- a/openssl-sys/build.rs
+++ b/openssl-sys/build/main.rs
@@ -11,6 +11,8 @@ use std::io::{BufWriter, Write};
 use std::path::{Path, PathBuf};
 use std::process::Command;
 
+mod cfgs;
+
 // The set of `OPENSSL_NO_<FOO>`s that we care about.
 const DEFINES: &'static [&'static str] = &[
     "OPENSSL_NO_BUF_FREELISTS",
@@ -104,6 +106,8 @@ fn find_openssl_dir(target: &str) -> OsString {
     let host = env::var("HOST").unwrap();
 
     if host == target && target.contains("apple-darwin") {
+        // Check up default Homebrew installation location first
+        // for quick resolution if possible.
         let homebrew = Path::new("/usr/local/opt/[email protected]");
         if homebrew.exists() {
             return homebrew.to_path_buf().into();
@@ -112,6 +116,22 @@ fn find_openssl_dir(target: &str) -> OsString {
         if homebrew.exists() {
             return homebrew.to_path_buf().into();
         }
+        // Calling `brew --prefix <package>` command usually slow and
+        // takes seconds, and will be used only as a last resort.
+        let output = execute_command_and_get_output("brew", &["--prefix", "[email protected]"]);
+        if let Some(ref output) = output {
+            let homebrew = Path::new(&output);
+            if homebrew.exists() {
+                return homebrew.to_path_buf().into();
+            }
+        }
+        let output = execute_command_and_get_output("brew", &["--prefix", "openssl"]);
+        if let Some(ref output) = output {
+            let homebrew = Path::new(&output);
+            if homebrew.exists() {
+                return homebrew.to_path_buf().into();
+            }
+        }
     }
 
     try_pkg_config();
@@ -409,6 +429,10 @@ See rust-openssl README for more information:
     }
     println!("cargo:conf={}", enabled.join(","));
 
+    for cfg in cfgs::get(openssl_version, libressl_version) {
+        println!("cargo:rustc-cfg={}", cfg);
+    }
+
     if let Some(libressl_version) = libressl_version {
         println!("cargo:libressl_version_number={:x}", libressl_version);
 
@@ -427,8 +451,6 @@ See rust-openssl README for more information:
             _ => version_error(),
         };
 
-        println!("cargo:rustc-cfg=libressl");
-        println!("cargo:rustc-cfg=libressl2{}{}", minor, fix);
         println!("cargo:libressl=true");
         println!("cargo:libressl_version=2{}{}", minor, fix);
         println!("cargo:version=101");
@@ -437,37 +459,22 @@ See rust-openssl README for more information:
         let openssl_version = openssl_version.unwrap();
         println!("cargo:version_number={:x}", openssl_version);
 
-        if openssl_version >= 0x1_00_02_08_0 {
-            println!("cargo:rustc-cfg=ossl102h");
-        }
-
-        if openssl_version >= 0x1_01_00_07_0 {
-            println!("cargo:rustc-cfg=ossl110g");
-        }
-
         if openssl_version >= 0x1_01_02_00_0 {
             version_error()
         } else if openssl_version >= 0x1_01_01_00_0 {
-            println!("cargo:rustc-cfg=ossl111");
-            println!("cargo:rustc-cfg=ossl110");
             println!("cargo:version=111");
             Version::Openssl11x
         } else if openssl_version >= 0x1_01_00_06_0 {
-            println!("cargo:rustc-cfg=ossl110");
-            println!("cargo:rustc-cfg=ossl110f");
             println!("cargo:version=110");
             println!("cargo:patch=f");
             Version::Openssl11x
         } else if openssl_version >= 0x1_01_00_00_0 {
-            println!("cargo:rustc-cfg=ossl110");
             println!("cargo:version=110");
             Version::Openssl11x
         } else if openssl_version >= 0x1_00_02_00_0 {
-            println!("cargo:rustc-cfg=ossl102");
             println!("cargo:version=102");
             Version::Openssl10x
         } else if openssl_version >= 0x1_00_01_00_0 {
-            println!("cargo:rustc-cfg=ossl101");
             println!("cargo:version=101");
             Version::Openssl10x
         } else {
@@ -524,10 +531,12 @@ fn determine_mode(libdir: &Path, libs: &[&str]) -> &'static str {
         .map(|e| e.file_name())
         .filter_map(|e| e.into_string().ok())
         .collect::<HashSet<_>>();
-    let can_static = libs.iter()
+    let can_static = libs
+        .iter()
         .all(|l| files.contains(&format!("lib{}.a", l)) || files.contains(&format!("{}.lib", l)));
     let can_dylib = libs.iter().all(|l| {
-        files.contains(&format!("lib{}.so", l)) || files.contains(&format!("{}.dll", l))
+        files.contains(&format!("lib{}.so", l))
+            || files.contains(&format!("{}.dll", l))
             || files.contains(&format!("lib{}.dylib", l))
     });
     match (can_static, can_dylib) {
@@ -548,3 +557,16 @@ fn determine_mode(libdir: &Path, libs: &[&str]) -> &'static str {
     // practices with security libs", let's link dynamically.
     "dylib"
 }
+
+fn execute_command_and_get_output(cmd: &str, args: &[&str]) -> Option<String> {
+    let out = Command::new(cmd).args(args).output();
+    if let Ok(ref r1) = out {
+        if r1.status.success() {
+            let r2 = String::from_utf8(r1.stdout.clone());
+            if let Ok(r3) = r2 {
+                return Some(r3.trim().to_string());
+            }
+        }
+    }
+    return None;
+}
diff --git a/openssl-sys/src/lib.rs b/openssl-sys/src/lib.rs
index 9f970701..30889a7f 100644
--- a/openssl-sys/src/lib.rs
+++ b/openssl-sys/src/lib.rs
@@ -236,8 +236,10 @@ pub const EVP_PKEY_OP_VERIFYCTX: c_int = 1 << 7;
 pub const EVP_PKEY_OP_ENCRYPT: c_int = 1 << 8;
 pub const EVP_PKEY_OP_DECRYPT: c_int = 1 << 9;
 
-pub const EVP_PKEY_OP_TYPE_SIG: c_int = EVP_PKEY_OP_SIGN | EVP_PKEY_OP_VERIFY
-    | EVP_PKEY_OP_VERIFYRECOVER | EVP_PKEY_OP_SIGNCTX
+pub const EVP_PKEY_OP_TYPE_SIG: c_int = EVP_PKEY_OP_SIGN
+    | EVP_PKEY_OP_VERIFY
+    | EVP_PKEY_OP_VERIFYRECOVER
+    | EVP_PKEY_OP_SIGNCTX
     | EVP_PKEY_OP_VERIFYCTX;
 
 pub const EVP_PKEY_OP_TYPE_CRYPT: c_int = EVP_PKEY_OP_ENCRYPT | EVP_PKEY_OP_DECRYPT;
@@ -1259,21 +1261,23 @@ pub const SSL_VERIFY_NONE: c_int = 0;
 pub const SSL_VERIFY_PEER: c_int = 1;
 pub const SSL_VERIFY_FAIL_IF_NO_PEER_CERT: c_int = 2;
 
-#[cfg(not(any(libressl261, libressl262, libressl26x, libressl27x, ossl101)))]
+#[cfg(any(ossl102, all(libressl, not(libressl261))))]
 pub const SSL_OP_TLSEXT_PADDING: c_ulong = 0x00000010;
-#[cfg(any(libressl261, libressl262, libressl26x, libressl27x))]
+#[cfg(libressl261)]
 pub const SSL_OP_TLSEXT_PADDING: c_ulong = 0x0;
 pub const SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS: c_ulong = 0x00000800;
-#[cfg(not(any(libressl261, libressl262, libressl26x, libressl27x)))]
+#[cfg(not(libressl261))]
 pub const SSL_OP_CRYPTOPRO_TLSEXT_BUG: c_ulong = 0x80000000;
-#[cfg(any(libressl261, libressl262, libressl26x, libressl27x))]
+#[cfg(libressl261)]
 pub const SSL_OP_CRYPTOPRO_TLSEXT_BUG: c_ulong = 0x0;
 pub const SSL_OP_LEGACY_SERVER_CONNECT: c_ulong = 0x00000004;
-#[cfg(not(any(libressl, ossl110f, ossl111)))]
+#[cfg(not(any(libressl, ossl110f)))]
 pub const SSL_OP_ALL: c_ulong = 0x80000BFF;
-#[cfg(any(ossl110f, ossl111))]
-pub const SSL_OP_ALL: c_ulong = SSL_OP_CRYPTOPRO_TLSEXT_BUG | SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
-    | SSL_OP_LEGACY_SERVER_CONNECT | SSL_OP_TLSEXT_PADDING
+#[cfg(ossl110f)]
+pub const SSL_OP_ALL: c_ulong = SSL_OP_CRYPTOPRO_TLSEXT_BUG
+    | SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
+    | SSL_OP_LEGACY_SERVER_CONNECT
+    | SSL_OP_TLSEXT_PADDING
     | SSL_OP_SAFARI_ECDHE_ECDSA_BUG;
 pub const SSL_OP_NO_QUERY_MTU: c_ulong = 0x00001000;
 pub const SSL_OP_COOKIE_EXCHANGE: c_ulong = 0x00002000;
@@ -1285,12 +1289,15 @@ pub const SSL_OP_NO_TLSv1: c_ulong = 0x04000000;
 pub const SSL_OP_NO_TLSv1_1: c_ulong = 0x10000000;
 pub const SSL_OP_NO_TLSv1_2: c_ulong = 0x08000000;
 
-#[cfg(not(any(ossl101, libressl, ossl111)))]
+#[cfg(all(ossl102, not(ossl111)))]
 pub const SSL_OP_NO_SSL_MASK: c_ulong =
     SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2;
 #[cfg(ossl111)]
-pub const SSL_OP_NO_SSL_MASK: c_ulong = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 | SSL_OP_NO_TLSv1
-    | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2
+pub const SSL_OP_NO_SSL_MASK: c_ulong = SSL_OP_NO_SSLv2
+    | SSL_OP_NO_SSLv3
+    | SSL_OP_NO_TLSv1
+    | SSL_OP_NO_TLSv1_1
+    | SSL_OP_NO_TLSv1_2
     | SSL_OP_NO_TLSv1_3;
 
 pub const SSL_FILETYPE_PEM: c_int = X509_FILETYPE_PEM;
@@ -1386,35 +1393,35 @@ pub const X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: c_int = 52;
 pub const X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: c_int = 53;
 pub const X509_V_ERR_CRL_PATH_VALIDATION_ERROR: c_int = 54;
 
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(ossl102)]
 pub const X509_V_ERR_SUITE_B_INVALID_VERSION: c_int = 56;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(ossl102)]
 pub const X509_V_ERR_SUITE_B_INVALID_ALGORITHM: c_int = 57;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(ossl102)]
 pub const X509_V_ERR_SUITE_B_INVALID_CURVE: c_int = 58;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(ossl102)]
 pub const X509_V_ERR_SUITE_B_INVALID_SIGNATURE_ALGORITHM: c_int = 59;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(ossl102)]
 pub const X509_V_ERR_SUITE_B_LOS_NOT_ALLOWED: c_int = 60;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(ossl102)]
 pub const X509_V_ERR_SUITE_B_CANNOT_SIGN_P_384_WITH_P_256: c_int = 61;
 
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(ossl102)]
 pub const X509_V_ERR_HOSTNAME_MISMATCH: c_int = 62;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(ossl102)]
 pub const X509_V_ERR_EMAIL_MISMATCH: c_int = 63;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(ossl102)]
 pub const X509_V_ERR_IP_ADDRESS_MISMATCH: c_int = 64;
 
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(any(ossl102, libressl261))]
 pub const X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT: c_uint = 0x1;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(any(ossl102, libressl261))]
 pub const X509_CHECK_FLAG_NO_WILDCARDS: c_uint = 0x2;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(any(ossl102, libressl261))]
 pub const X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS: c_uint = 0x4;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(any(ossl102, libressl261))]
 pub const X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS: c_uint = 0x8;
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(any(ossl102, libressl261))]
 pub const X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS: c_uint = 0x10;
 
 pub const GEN_OTHERNAME: c_int = 0;
@@ -1446,6 +1453,10 @@ pub unsafe fn BIO_set_retry_write(b: *mut BIO) {
     BIO_set_flags(b, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY)
 }
 
+pub unsafe fn EVP_get_digestbynid(type_: c_int) -> *const EVP_MD {
+    EVP_get_digestbyname(OBJ_nid2sn(type_))
+}
+
 // EVP_PKEY_CTX_ctrl macros
 pub unsafe fn EVP_PKEY_CTX_set_rsa_padding(ctx: *mut EVP_PKEY_CTX, pad: c_int) -> c_int {
     EVP_PKEY_CTX_ctrl(
@@ -1519,7 +1530,7 @@ pub unsafe fn SSL_CTX_add_extra_chain_cert(ctx: *mut SSL_CTX, x509: *mut X509) -
     SSL_CTX_ctrl(ctx, SSL_CTRL_EXTRA_CHAIN_CERT, 0, x509 as *mut c_void)
 }
 
-#[cfg(not(any(ossl101, libressl)))]
+#[cfg(ossl102)]
 pub unsafe fn SSL_CTX_set0_verify_cert_store(ctx: *mut SSL_CTX, st: *mut X509_STORE) -> c_long {
     SSL_CTX_ctrl(ctx, SSL_CTRL_SET_VERIFY_CERT_STORE, 0, st as *mut c_void)
 }
@@ -1634,9 +1645,9 @@ extern "C" {
     pub fn BIO_new_socket(sock: c_int, close_flag: c_int) -> *mut BIO;
     pub fn BIO_read(b: *mut BIO, buf: *mut c_void, len: c_int) -> c_int;
     pub fn BIO_write(b: *mut BIO, buf: *const c_void, len: c_int) -> c_int;
-    #[cfg(any(ossl101, libressl))]
+    #[cfg(not(ossl102))]
     pub fn BIO_new_mem_buf(buf: *mut c_void, len: c_int) -> *mut BIO;
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(ossl102)]
     pub fn BIO_new_mem_buf(buf: *const c_void, len: c_int) -> *mut BIO;
     pub fn BIO_set_flags(b: *mut BIO, flags: c_int);
     pub fn BIO_clear_flags(b: *mut BIO, flags: c_int);
@@ -1767,11 +1778,11 @@ extern "C" {
 
     pub fn DH_new() -> *mut DH;
     pub fn DH_free(dh: *mut DH);
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(ossl102)]
     pub fn DH_get_1024_160() -> *mut DH;
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(ossl102)]
     pub fn DH_get_2048_224() -> *mut DH;
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(ossl102)]
     pub fn DH_get_2048_256() -> *mut DH;
 
     pub fn EC_KEY_new() -> *mut EC_KEY;
@@ -2029,13 +2040,13 @@ extern "C" {
         e: *mut ENGINE,
         pkey: *mut EVP_PKEY,
     ) -> c_int;
-    #[cfg(any(ossl101, libressl))]
+    #[cfg(not(ossl102))]
     pub fn EVP_DigestVerifyFinal(
         ctx: *mut EVP_MD_CTX,
         sigret: *mut c_uchar,
         siglen: size_t,
     ) -> c_int;
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(ossl102)]
     pub fn EVP_DigestVerifyFinal(
         ctx: *mut EVP_MD_CTX,
         sigret: *const c_uchar,
@@ -2095,7 +2106,10 @@ extern "C" {
         a: *const ASN1_OBJECT,
         no_name: c_int,
     ) -> c_int;
+    pub fn OBJ_nid2ln(nid: c_int) -> *const c_char;
     pub fn OBJ_nid2sn(nid: c_int) -> *const c_char;
+    pub fn OBJ_find_sigid_algs(signid: c_int, pdig_nid: *mut c_int, ppkey_nid: *mut c_int)
+        -> c_int;
 
     pub fn OCSP_BASICRESP_new() -> *mut OCSP_BASICRESP;
     pub fn OCSP_BASICRESP_free(r: *mut OCSP_BASICRESP);
@@ -2351,6 +2365,14 @@ extern "C" {
         k: *mut RSA,
     ) -> c_int;
 
+    pub fn RSA_padding_check_PKCS1_type_2(
+        to: *mut c_uchar,
+        tlen: c_int,
+        f: *const c_uchar,
+        fl: c_int,
+        rsa_len: c_int,
+    ) -> c_int;
+
     pub fn DSA_new() -> *mut DSA;
     pub fn DSA_free(dsa: *mut DSA);
     pub fn DSA_size(dsa: *const DSA) -> c_int;
@@ -2439,14 +2461,14 @@ extern "C" {
     pub fn SSL_get_ex_data(ssl: *const SSL, idx: c_int) -> *mut c_void;
     pub fn SSL_get_servername(ssl: *const SSL, name_type: c_int) -> *const c_char;
     pub fn SSL_get_current_cipher(ssl: *const SSL) -> *const SSL_CIPHER;
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(any(ossl102, libressl261))]
     pub fn SSL_get0_param(ssl: *mut SSL) -> *mut X509_VERIFY_PARAM;
     pub fn SSL_get_verify_result(ssl: *const SSL) -> c_long;
     pub fn SSL_shutdown(ssl: *mut SSL) -> c_int;
     pub fn SSL_get_certificate(ssl: *const SSL) -> *mut X509;
-    #[cfg(any(ossl101, libressl))]
+    #[cfg(not(ossl102))]
     pub fn SSL_get_privatekey(ssl: *mut SSL) -> *mut EVP_PKEY;
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(ossl102)]
     pub fn SSL_get_privatekey(ssl: *const SSL) -> *mut EVP_PKEY;
     pub fn SSL_load_client_CA_file(file: *const c_char) -> *mut stack_st_X509_NAME;
     pub fn SSL_set_tmp_dh_callback(
@@ -2539,9 +2561,9 @@ extern "C" {
         remove_session_cb: Option<unsafe extern "C" fn(*mut SSL_CTX, *mut SSL_SESSION)>,
     );
 
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(ossl102)]
     pub fn SSL_CTX_get0_certificate(ctx: *const SSL_CTX) -> *mut X509;
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(ossl102)]
     pub fn SSL_CTX_get0_privatekey(ctx: *const SSL_CTX) -> *mut EVP_PKEY;
 
     pub fn SSL_CTX_set_cipher_list(ssl: *mut SSL_CTX, s: *const c_char) -> c_int;
@@ -2600,10 +2622,12 @@ extern "C" {
     );
     pub fn SSL_get_session(s: *const SSL) -> *mut SSL_SESSION;
     pub fn SSL_set_session(ssl: *mut SSL, session: *mut SSL_SESSION) -> c_int;
-    #[cfg(not(any(ossl101, libressl, ossl110f, ossl111)))]
+    #[cfg(all(ossl102, not(ossl110f)))]
     pub fn SSL_is_server(s: *mut SSL) -> c_int;
-    #[cfg(any(ossl110f, ossl111))]
+    #[cfg(ossl110f)]
     pub fn SSL_is_server(s: *const SSL) -> c_int;
+    pub fn SSL_get_finished(s: *const SSL, buf: *mut c_void, count: size_t) -> size_t;
+    pub fn SSL_get_peer_finished(s: *const SSL, buf: *mut c_void, count: size_t) -> size_t;
 
     pub fn SSL_SESSION_free(s: *mut SSL_SESSION);
     pub fn SSL_SESSION_get_id(s: *const SSL_SESSION, len: *mut c_uint) -> *const c_uchar;
@@ -2615,14 +2639,14 @@ extern "C" {
     ) -> *mut SSL_SESSION;
     pub fn i2d_SSL_SESSION(s: *mut SSL_SESSION, pp: *mut *mut c_uchar) -> c_int;
 
-    #[cfg(not(ossl101))]
+    #[cfg(any(ossl102, libressl261))]
     pub fn SSL_CTX_set_alpn_protos(s: *mut SSL_CTX, data: *const c_uchar, len: c_uint) -> c_int;
 
-    #[cfg(not(ossl101))]
+    #[cfg(any(ossl102, libressl261))]
     pub fn SSL_set_alpn_protos(s: *mut SSL, data: *const c_uchar, len: c_uint) -> c_int;
 
     // FIXME should take an Option<unsafe extern "C" fn>
-    #[cfg(not(ossl101))]
+    #[cfg(any(ossl102, libressl261))]
     pub fn SSL_CTX_set_alpn_select_cb(
         ssl: *mut SSL_CTX,
         cb: extern "C" fn(
@@ -2635,7 +2659,7 @@ extern "C" {
         ) -> c_int,
         arg: *mut c_void,
     );
-    #[cfg(not(ossl101))]
+    #[cfg(any(ossl102, libressl261))]
     pub fn SSL_get0_alpn_selected(s: *const SSL, data: *mut *const c_uchar, len: *mut c_uint);
 
     pub fn X509_add_ext(x: *mut X509, ext: *mut X509_EXTENSION, loc: c_int) -> c_int;
@@ -2727,17 +2751,17 @@ extern "C" {
     pub fn X509_REQ_get_extensions(req: *mut X509_REQ) -> *mut stack_st_X509_EXTENSION;
     pub fn X509_REQ_sign(x: *mut X509_REQ, pkey: *mut EVP_PKEY, md: *const EVP_MD) -> c_int;
 
-    #[cfg(not(ossl101))]
+    #[cfg(any(ossl102, libressl261))]
     pub fn X509_VERIFY_PARAM_free(param: *mut X509_VERIFY_PARAM);
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(any(ossl102, libressl261))]
     pub fn X509_VERIFY_PARAM_set_hostflags(param: *mut X509_VERIFY_PARAM, flags: c_uint);
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(any(ossl102, libressl261))]
     pub fn X509_VERIFY_PARAM_set1_host(
         param: *mut X509_VERIFY_PARAM,
         name: *const c_char,
         namelen: size_t,
     ) -> c_int;
-    #[cfg(not(any(ossl101, libressl)))]
+    #[cfg(any(ossl102, libressl261))]
     pub fn X509_VERIFY_PARAM_set1_ip(
         param: *mut X509_VERIFY_PARAM,
         ip: *const c_uchar,
@@ -2839,5 +2863,9 @@ extern "C" {
     );
 
     pub fn EVP_MD_size(md: *const EVP_MD) -> c_int;
+    pub fn EVP_get_digestbyname(name: *const c_char) -> *const EVP_MD;
     pub fn EVP_get_cipherbyname(name: *const c_char) -> *const EVP_CIPHER;
+
+    pub fn SSL_set_connect_state(s: *mut SSL);
+    pub fn SSL_set_accept_state(s: *mut SSL);
 }
diff --git a/openssl-sys/src/libressl/mod.rs b/openssl-sys/src/libressl/mod.rs
index 366d9502..0080fc7d 100644
--- a/openssl-sys/src/libressl/mod.rs
+++ b/openssl-sys/src/libressl/mod.rs
@@ -1,19 +1,18 @@
+use libc::{c_char, c_int, c_long, c_uchar, c_uint, c_ulong, c_void, size_t};
 use std::mem;
 use std::ptr;
 use std::sync::{Mutex, MutexGuard};
 use std::sync::{Once, ONCE_INIT};
 
-#[cfg(libressl250)]
+#[cfg(not(libressl251))]
 pub use libressl::v250::*;
-#[cfg(not(libressl250))]
-pub use libressl::v25x::*;
-
-use libc::{c_char, c_int, c_long, c_uchar, c_uint, c_ulong, c_void, size_t};
+#[cfg(libressl251)]
+pub use libressl::v251::*;
 
-#[cfg(libressl250)]
+#[cfg(not(libressl251))]
 mod v250;
-#[cfg(not(libressl250))]
-mod v25x;
+#[cfg(libressl251)]
+mod v251;
 
 #[repr(C)]
 pub struct stack_st_ASN1_OBJECT {
@@ -337,9 +336,9 @@ pub const SSL_CTRL_OPTIONS: c_int = 32;
 pub const SSL_CTRL_CLEAR_OPTIONS: c_int = 77;
 pub const SSL_CTRL_SET_ECDH_AUTO: c_int = 94;
 
-#[cfg(any(libressl261, libressl262, libressl26x, libressl27x))]
+#[cfg(libressl261)]
 pub const SSL_OP_ALL: c_ulong = 0x4;
-#[cfg(not(any(libressl261, libressl262, libressl26x, libressl27x)))]
+#[cfg(not(libressl261))]
 pub const SSL_OP_ALL: c_ulong = 0x80000014;
 pub const SSL_OP_CISCO_ANYCONNECT: c_ulong = 0x0;
 pub const SSL_OP_NO_COMPRESSION: c_ulong = 0x0;
@@ -352,9 +351,9 @@ pub const SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER: c_ulong = 0x0;
 pub const SSL_OP_SSLEAY_080_CLIENT_DH_BUG: c_ulong = 0x0;
 pub const SSL_OP_TLS_D5_BUG: c_ulong = 0x0;
 pub const SSL_OP_TLS_BLOCK_PADDING_BUG: c_ulong = 0x0;
-#[cfg(any(libressl261, libressl262, libressl26x, libressl27x))]
+#[cfg(libressl261)]
 pub const SSL_OP_SINGLE_ECDH_USE: c_ulong = 0x0;
-#[cfg(not(any(libressl261, libressl262, libressl26x, libressl27x)))]
+#[cfg(not(libressl261))]
 pub const SSL_OP_SINGLE_ECDH_USE: c_ulong = 0x00080000;
 pub const SSL_OP_SINGLE_DH_USE: c_ulong = 0x00100000;
 pub const SSL_OP_NO_SSLv2: c_ulong = 0x0;
@@ -448,6 +447,28 @@ pub unsafe fn SSL_session_reused(ssl: *mut ::SSL) -> c_int {
     ::SSL_ctrl(ssl, SSL_CTRL_GET_SESSION_REUSED, 0, ptr::null_mut()) as c_int
 }
 
+pub unsafe fn SSL_CTX_get_options(ctx: *const ::SSL_CTX) -> c_ulong {
+    ::SSL_CTX_ctrl(ctx as *mut _, ::SSL_CTRL_OPTIONS, 0, ptr::null_mut()) as c_ulong
+}
+
+pub unsafe fn SSL_CTX_set_options(ctx: *const ::SSL_CTX, op: c_ulong) -> c_ulong {
+    ::SSL_CTX_ctrl(
+        ctx as *mut _,
+        ::SSL_CTRL_OPTIONS,
+        op as c_long,
+        ptr::null_mut(),
+    ) as c_ulong
+}
+
+pub unsafe fn SSL_CTX_clear_options(ctx: *const ::SSL_CTX, op: c_ulong) -> c_ulong {
+    ::SSL_CTX_ctrl(
+        ctx as *mut _,
+        ::SSL_CTRL_CLEAR_OPTIONS,
+        op as c_long,
+        ptr::null_mut(),
+    ) as c_ulong
+}
+
 extern "C" {
     pub fn BIO_new(type_: *mut BIO_METHOD) -> *mut BIO;
     pub fn BIO_s_file() -> *mut BIO_METHOD;
@@ -540,6 +561,15 @@ extern "C" {
             unsafe extern "C" fn(*mut ::SSL, *mut c_uchar, c_int, *mut c_int) -> *mut SSL_SESSION,
         >,
     );
+    #[cfg(libressl261)]
+    pub fn SSL_CTX_set_min_proto_version(ctx: *mut ::SSL_CTX, version: u16) -> c_int;
+    #[cfg(libressl261)]
+    pub fn SSL_CTX_set_max_proto_version(ctx: *mut ::SSL_CTX, version: u16) -> c_int;
+    #[cfg(libressl270)]
+    pub fn SSL_CTX_get_min_proto_version(ctx: *mut ::SSL_CTX) -> c_int;
+    #[cfg(libressl270)]
+    pub fn SSL_CTX_get_max_proto_version(ctx: *mut ::SSL_CTX) -> c_int;
+
     pub fn X509_get_subject_name(x: *mut ::X509) -> *mut ::X509_NAME;
     pub fn X509_get_issuer_name(x: *mut ::X509) -> *mut ::X509_NAME;
     pub fn X509_set_notAfter(x: *mut ::X509, tm: *const ::ASN1_TIME) -> c_int;
diff --git a/openssl-sys/src/libressl/v25x.rs b/openssl-sys/src/libressl/v251.rs
index 7e7023ec..541b61db 100644
--- a/openssl-sys/src/libressl/v25x.rs
+++ b/openssl-sys/src/libressl/v251.rs
@@ -1,4 +1,4 @@
-use libc::{c_int, c_char, c_void, c_long, c_uchar, size_t, c_uint, c_ulong, time_t};
+use libc::{c_char, c_int, c_long, c_uchar, c_uint, c_ulong, c_void, size_t, time_t};
 
 use super::*;
 
@@ -84,6 +84,6 @@ pub struct X509_VERIFY_PARAM {
     pub purpose: c_int,
     pub trust: c_int,
     pub depth: c_int,
-    policies: *mut stack_st_ASN1_OBJECT,
+    pub policies: *mut stack_st_ASN1_OBJECT,
     id: *mut c_void,
 }
diff --git a/openssl-sys/src/openssl/mod.rs b/openssl-sys/src/openssl/mod.rs
index a1e4a345..b65b6129 100644
--- a/openssl-sys/src/openssl/mod.rs
+++ b/openssl-sys/src/openssl/mod.rs
@@ -1,8 +1,8 @@
 use libc::{c_int, c_long, c_uchar, c_uint, c_ulong};
 
-#[cfg(any(ossl101, ossl102))]
+#[cfg(not(ossl110))]
 mod v10x;
-#[cfg(any(ossl101, ossl102))]
+#[cfg(not(ossl110))]
 pub use openssl::v10x::*;
 
 #[cfg(ossl110)]
@@ -15,7 +15,7 @@ mod v111;
 #[cfg(ossl111)]
 pub use openssl::v111::*;
 
-#[cfg(not(ossl101))]
+#[cfg(ossl102)]
 pub const SSL_CTRL_SET_VERIFY_CERT_STORE: c_int = 106;
 
 pub const SSL_MODE_SEND_CLIENTHELLO_TIME: c_long = 0x20;
@@ -28,9 +28,9 @@ pub const SSL_OP_CISCO_ANYCONNECT: c_ulong = 0x00008000;
 pub const SSL_OP_NO_COMPRESSION: c_ulong = 0x00020000;
 pub const SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: c_ulong = 0x00040000;
 pub const SSL_OP_NO_SSLv3: c_ulong = 0x02000000;
-#[cfg(not(ossl101))]
+#[cfg(ossl102)]
 pub const SSL_OP_NO_DTLSv1: c_ulong = 0x04000000;
-#[cfg(not(ossl101))]
+#[cfg(ossl102)]
 pub const SSL_OP_NO_DTLSv1_2: c_ulong = 0x08000000;
 
 pub const X509_V_ERR_UNSPECIFIED: c_int = 1;
@@ -55,7 +55,7 @@ pub const CMS_PARTIAL: c_uint = 0x4000;
 pub const CMS_REUSE_DIGEST: c_uint = 0x8000;
 pub const CMS_USE_KEYID: c_uint = 0x10000;
 pub const CMS_DEBUG_DECRYPT: c_uint = 0x20000;
-#[cfg(not(ossl101))]
+#[cfg(ossl102)]
 pub const CMS_KEY_PARAM: c_uint = 0x40000;
 
 extern "C" {
diff --git a/openssl-sys/src/openssl/v10x.rs b/openssl-sys/src/openssl/v10x.rs
index 6a4d4346..c22bb7fc 100644
--- a/openssl-sys/src/openssl/v10x.rs
+++ b/openssl-sys/src/openssl/v10x.rs
@@ -5,7 +5,7 @@ use std::ptr;
 use std::sync::{Mutex, MutexGuard};
 use std::sync::{Once, ONCE_INIT};
 
-#[cfg(not(ossl101))]
+#[cfg(ossl102)]
 use libc::time_t;
 use libc::{c_char, c_int, c_long, c_uchar, c_uint, c_ulong, c_void, size_t};
 
@@ -573,9 +573,6 @@ pub struct SSL_CTX {
 
     #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), ossl101))]
     srtp_profiles: *mut c_void,
-
-    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), ossl102))]
-    srtp_profiles: *mut c_void,
     #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), ossl102))]
     alpn_select_cb: *mut c_void,
     #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), ossl102))]
@@ -669,7 +666,7 @@ pub struct SRP_CTX {
 }
 
 #[repr(C)]
-#[cfg(not(ossl101))]
+#[cfg(ossl102)]
 pub struct X509_VERIFY_PARAM {
     pub name: *mut c_char,
     pub check_time: time_t,
@@ -682,7 +679,7 @@ pub struct X509_VERIFY_PARAM {
     pub id: *mut X509_VERIFY_PARAM_ID,
 }
 
-#[cfg(not(ossl101))]
+#[cfg(ossl102)]
 pub enum X509_VERIFY_PARAM_ID {}
 pub enum PKCS12 {}
 
@@ -810,6 +807,28 @@ pub unsafe fn SSL_session_reused(ssl: *mut ::SSL) -> c_int {
     ::SSL_ctrl(ssl, SSL_CTRL_GET_SESSION_REUSED, 0, ptr::null_mut()) as c_int
 }
 
+pub unsafe fn SSL_CTX_get_options(ctx: *const ::SSL_CTX) -> c_ulong {
+    ::SSL_CTX_ctrl(ctx as *mut _, ::SSL_CTRL_OPTIONS, 0, ptr::null_mut()) as c_ulong
+}
+
+pub unsafe fn SSL_CTX_set_options(ctx: *const ::SSL_CTX, op: c_ulong) -> c_ulong {
+    ::SSL_CTX_ctrl(
+        ctx as *mut _,
+        ::SSL_CTRL_OPTIONS,
+        op as c_long,
+        ptr::null_mut(),
+    ) as c_ulong
+}
+
+pub unsafe fn SSL_CTX_clear_options(ctx: *const ::SSL_CTX, op: c_ulong) -> c_ulong {
+    ::SSL_CTX_ctrl(
+        ctx as *mut _,
+        ::SSL_CTRL_CLEAR_OPTIONS,
+        op as c_long,
+        ptr::null_mut(),
+    ) as c_ulong
+}
+
 extern "C" {
     pub fn BIO_new(type_: *mut BIO_METHOD) -> *mut BIO;
     pub fn BIO_s_file() -> *mut BIO_METHOD;
@@ -925,15 +944,15 @@ extern "C" {
         loc: c_int,
         set: c_int,
     ) -> c_int;
-    #[cfg(not(ossl101))]
+    #[cfg(ossl102)]
     pub fn X509_get0_signature(
         psig: *mut *mut ::ASN1_BIT_STRING,
         palg: *mut *mut ::X509_ALGOR,
         x: *const ::X509,
     );
-    #[cfg(not(ossl101))]
+    #[cfg(ossl102)]
     pub fn X509_get_signature_nid(x: *const X509) -> c_int;
-    #[cfg(not(ossl101))]
+    #[cfg(ossl102)]
     pub fn X509_ALGOR_get0(
         paobj: *mut *mut ::ASN1_OBJECT,
         pptype: *mut c_int,
diff --git a/openssl-sys/src/openssl/v110.rs b/openssl-sys/src/openssl/v110.rs
index 4f1aa1c1..47d2bee4 100644
--- a/openssl-sys/src/openssl/v110.rs
+++ b/openssl-sys/src/openssl/v110.rs
@@ -280,6 +280,7 @@ extern "C" {
     );
     pub fn SSL_get_client_random(ssl: *const SSL, out: *mut c_uchar, len: size_t) -> size_t;
     pub fn SSL_get_server_random(ssl: *const SSL, out: *mut c_uchar, len: size_t) -> size_t;
+    pub fn SSL_get0_verified_chain(ssl: *const SSL) -> *mut stack_st_X509;
     pub fn X509_getm_notAfter(x: *const ::X509) -> *mut ::ASN1_TIME;
     pub fn X509_getm_notBefore(x: *const ::X509) -> *mut ::ASN1_TIME;
     pub fn X509_get0_signature(
diff --git a/openssl-sys/src/openssl/v111.rs b/openssl-sys/src/openssl/v111.rs
index 8574efc8..36682663 100644
--- a/openssl-sys/src/openssl/v111.rs
+++ b/openssl-sys/src/openssl/v111.rs
@@ -55,6 +55,9 @@ pub const SSL_EXT_TLS1_3_CERTIFICATE: c_uint = 0x1000;
 pub const SSL_EXT_TLS1_3_NEW_SESSION_TICKET: c_uint = 0x2000;
 pub const SSL_EXT_TLS1_3_CERTIFICATE_REQUEST: c_uint = 0x4000;
 
+pub const SSL_READ_EARLY_DATA_ERROR: c_int = 0;
+pub const SSL_READ_EARLY_DATA_SUCCESS: c_int = 1;
+pub const SSL_READ_EARLY_DATA_FINISH: c_int = 2;
 
 extern "C" {
     pub fn SSL_CTX_set_keylog_callback(ctx: *mut ::SSL_CTX, cb: SSL_CTX_keylog_cb_func);
@@ -82,4 +85,24 @@ extern "C" {
             cookie_len: size_t
         ) -> c_int>
     );
+
+    pub fn SSL_CTX_set_max_early_data(ctx: *mut ::SSL_CTX, max_early_data: u32) -> c_int;
+    pub fn SSL_CTX_get_max_early_data(ctx: *const ::SSL_CTX) -> u32;
+    pub fn SSL_set_max_early_data(ctx: *mut ::SSL, max_early_data: u32) -> c_int;
+    pub fn SSL_get_max_early_data(ctx: *const ::SSL) -> u32;
+    pub fn SSL_SESSION_set_max_early_data(ctx: *mut ::SSL_SESSION, max_early_data: u32) -> c_int;
+    pub fn SSL_SESSION_get_max_early_data(ctx: *const ::SSL_SESSION) -> u32;
+
+    pub fn SSL_export_keying_material_early(
+        s: *mut ::SSL,
+        out: *mut c_uchar,
+        olen: size_t,
+        label: *const c_char,
+        llen: size_t,
+        context: *const c_uchar,
+        contextlen: size_t,
+    ) -> c_int;
+
+    pub fn SSL_write_early_data(s: *mut ::SSL, buf: *const c_void, num: size_t, written: *mut size_t) -> c_int;
+    pub fn SSL_read_early_data(s: *mut ::SSL, buf: *mut c_void, num: size_t, readbytes: *mut size_t) -> c_int;
 }