Merge remote-tracking branch 'origin/master' into x509-builder

6 files changed, 1545 insertions, 188 deletions

diff --git a/openssl-sys/Cargo.toml b/openssl-sys/Cargo.toml
index 11c20a1c..76bd9172 100644
--- a/openssl-sys/Cargo.toml
+++ b/openssl-sys/Cargo.toml
@@ -1,12 +1,13 @@
 [package]
 name = "openssl-sys"
-version = "0.9.0"
+version = "0.9.6"
 authors = ["Alex Crichton <[email protected]>",
            "Steven Fackler <[email protected]>"]
 license = "MIT"
 description = "FFI bindings to OpenSSL"
 repository = "https://github.com/sfackler/rust-openssl"
-documentation = "https://sfackler.github.io/rust-openssl/doc/v0.9.0/openssl_sys"
+documentation = "https://docs.rs/openssl-sys/0.9.6/openssl_sys"
+categories = ["cryptography", "external-ffi-bindings"]
 links = "openssl"
 build = "build.rs"
 
@@ -14,8 +15,13 @@ build = "build.rs"
 libc = "0.2"
 
 [build-dependencies]
-pkg-config = "0.3"
+pkg-config = "0.3.9"
+gcc = "0.3.42"
 
 [target.'cfg(windows)'.dependencies]
 user32-sys = "0.2"
 gdi32-sys = "0.2"
+
+# We don't actually use metadeps for annoying reasons but this is still here for tooling
+[package.metadata.pkg-config]
+openssl = "1.0.1"
diff --git a/openssl-sys/build.rs b/openssl-sys/build.rs
index b6c8c2de..fc0f4680 100644
--- a/openssl-sys/build.rs
+++ b/openssl-sys/build.rs
@@ -1,27 +1,60 @@
 extern crate pkg_config;
+extern crate gcc;
 
 use std::collections::HashSet;
 use std::env;
 use std::ffi::OsString;
 use std::fs::File;
-use std::io::Read;
+use std::io::{BufWriter, Write};
 use std::path::{Path, PathBuf};
+use std::panic::{self, AssertUnwindSafe};
 use std::process::Command;
 
+// The set of `OPENSSL_NO_<FOO>`s that we care about.
+const DEFINES: &'static [&'static str] = &[
+    "OPENSSL_NO_BUF_FREELISTS",
+    "OPENSSL_NO_COMP",
+    "OPENSSL_NO_EC",
+    "OPENSSL_NO_ENGINE",
+    "OPENSSL_NO_KRB5",
+    "OPENSSL_NO_NEXTPROTONEG",
+    "OPENSSL_NO_PSK",
+    "OPENSSL_NO_RFC3779",
+    "OPENSSL_NO_SHA",
+    "OPENSSL_NO_SRP",
+    "OPENSSL_NO_SSL3_METHOD",
+    "OPENSSL_NO_TLSEXT",
+];
+
+enum Version {
+    Openssl110,
+    Openssl102,
+    Openssl101,
+    Libressl,
+}
+
 fn main() {
     let target = env::var("TARGET").unwrap();
 
-    let openssl_dir = env::var_os("OPENSSL_DIR").unwrap_or_else(|| {
-        find_openssl_dir(&target)
-    });
+    let lib_dir = env::var_os("OPENSSL_LIB_DIR").map(PathBuf::from);
+    let include_dir = env::var_os("OPENSSL_INCLUDE_DIR").map(PathBuf::from);
+
+    let (lib_dir, include_dir) = if lib_dir.is_none() || include_dir.is_none() {
+        let openssl_dir = env::var_os("OPENSSL_DIR").unwrap_or_else(|| {
+            find_openssl_dir(&target)
+        });
+        let openssl_dir = Path::new(&openssl_dir);
+        let lib_dir = lib_dir.unwrap_or_else(|| openssl_dir.join("lib"));
+        let include_dir = include_dir.unwrap_or_else(|| openssl_dir.join("include"));
+        (lib_dir, include_dir)
+    } else {
+        (lib_dir.unwrap(), include_dir.unwrap())
+    };
 
-    let lib_dir = Path::new(&openssl_dir).join("lib");
-    let include_dir = Path::new(&openssl_dir).join("include");
     if !Path::new(&lib_dir).exists() {
         panic!("OpenSSL library directory does not exist: {}",
                lib_dir.to_string_lossy());
     }
-
     if !Path::new(&include_dir).exists() {
         panic!("OpenSSL include directory does not exist: {}",
                include_dir.to_string_lossy());
@@ -30,17 +63,14 @@ fn main() {
     println!("cargo:rustc-link-search=native={}", lib_dir.to_string_lossy());
     println!("cargo:include={}", include_dir.to_string_lossy());
 
-    let version = validate_headers(&[include_dir.clone().into()],
-                                   &[lib_dir.clone().into()]);
+    let version = validate_headers(&[include_dir.clone().into()]);
 
-    let libs = if (version.contains("0x10001") ||
-                   version.contains("0x10002")) &&
-                  target.contains("windows") {
-        ["ssleay32", "libeay32"]
-    } else if target.contains("windows") {
-        ["libssl", "libcrypto"]
-    } else {
-        ["ssl", "crypto"]
+    let libs = match version {
+        Version::Openssl101 | Version::Openssl102 if target.contains("windows") => {
+            ["ssleay32", "libeay32"]
+        }
+        Version::Openssl110 if target.contains("windows") => ["libssl", "libcrypto"],
+        _ => ["ssl", "crypto"],
     };
 
     let kind = determine_mode(Path::new(&lib_dir), &libs);
@@ -160,29 +190,12 @@ fn try_pkg_config() {
         return
     }
 
-    // We're going to be looking at header files, so show us all the system
-    // cflags dirs for showing us lots of `-I`.
-    env::set_var("PKG_CONFIG_ALLOW_SYSTEM_CFLAGS", "1");
-
-    let lib = match pkg_config::find_library("openssl") {
-        Ok(lib) => lib,
-        Err(_) => return,
-    };
+    let lib = pkg_config::Config::new()
+        .print_system_libs(false)
+        .find("openssl")
+        .unwrap();
 
-    if lib.include_paths.len() == 0 {
-        panic!("
-
-Used pkg-config to discover the OpenSSL installation, but pkg-config did not
-return any include paths for the installation. This crate needs to take a peek
-at the header files so it cannot proceed unless they're found.
-
-You can try fixing this by setting the `OPENSSL_DIR` environment variable
-pointing to your OpenSSL installation.
-
-");
-    }
-
-    validate_headers(&lib.include_paths, &lib.link_paths);
+    validate_headers(&lib.include_paths);
 
     for include in lib.include_paths.iter() {
         println!("cargo:include={}", include.display());
@@ -193,65 +206,11 @@ pointing to your OpenSSL installation.
 
 /// Validates the header files found in `include_dir` and then returns the
 /// version string of OpenSSL.
-fn validate_headers(include_dirs: &[PathBuf],
-                    libdirs: &[PathBuf]) -> String {
+fn validate_headers(include_dirs: &[PathBuf]) -> Version {
     // This `*-sys` crate only works with OpenSSL 1.0.1, 1.0.2, and 1.1.0. To
     // correctly expose the right API from this crate, take a look at
     // `opensslv.h` to see what version OpenSSL claims to be.
-    let mut version_header = String::new();
-    let mut include = include_dirs.iter()
-                                  .map(|p| p.join("openssl/opensslv.h"))
-                                  .filter(|p| p.exists());
-    let mut f = match include.next() {
-        Some(f) => File::open(f).unwrap(),
-        None => {
-            panic!("failed to open header file at `openssl/opensslv.h` to learn
-                    about OpenSSL's version number, looked inside:\n\n{:#?}\n\n",
-                   include_dirs);
-        }
-    };
-    f.read_to_string(&mut version_header).unwrap();
-
-    // Do a bit of string parsing to find `#define OPENSSL_VERSION_NUMBER ...`
-    let version_line = version_header.lines().find(|l| {
-        l.contains("define ") && l.contains("OPENSSL_VERSION_NUMBER")
-    }).and_then(|line| {
-        let start = match line.find("0x") {
-            Some(start) => start,
-            None => return None,
-        };
-        Some(line[start..].trim())
-    });
-    let version_text = match version_line {
-        Some(text) => text,
-        None => {
-            panic!("header file at `{}` did not include `OPENSSL_VERSION_NUMBER` \
-                    that this crate recognized, failed to learn about the \
-                    OpenSSL version number");
-        }
-    };
-    if version_text.contains("0x10001") {
-        println!("cargo:rustc-cfg=ossl101");
-        println!("cargo:version=101");
-    } else if version_text.contains("0x10002") {
-        println!("cargo:rustc-cfg=ossl102");
-        println!("cargo:version=102");
-    } else if version_text.contains("0x10100") {
-        println!("cargo:rustc-cfg=ossl110");
-        println!("cargo:version=110");
-    } else {
-        panic!("
-
-This crate is only compatible with OpenSSL 1.0.1, 1.0.2, and 1.1.0, but a
-different version of OpenSSL was found:
-
-    {}
-
-The build is now aborting due to this version mismatch.
-
-", version_text);
-    }
-
+    //
     // OpenSSL has a number of build-time configuration options which affect
     // various structs and such. Since OpenSSL 1.1.0 this isn't really a problem
     // as the library is much more FFI-friendly, but 1.0.{1,2} suffer this problem.
@@ -260,56 +219,105 @@ The build is now aborting due to this version mismatch.
     // file of OpenSSL, `opensslconf.h`, and then dump out everything it defines
     // as our own #[cfg] directives. That way the `ossl10x.rs` bindings can
     // account for compile differences and such.
-    let mut conf_header = String::new();
-    let mut include = include_dirs.iter()
-                                  .map(|p| p.join("openssl/opensslconf.h"))
-                                  .filter(|p| p.exists());
-    let mut f = match include.next() {
-        Some(f) => File::open(f).unwrap(),
-        None => {
-            // It's been seen that on linux the include dir printed out by
-            // `pkg-config` doesn't actually have opensslconf.h. Instead
-            // it's in an architecture-specific include directory.
-            //
-            // Try to detect that case to see if it exists.
-            let mut libdirs = libdirs.iter().map(|p| {
-                p.iter()
-                 .map(|p| if p == "lib" {"include".as_ref()} else {p})
-                 .collect::<PathBuf>()
-            }).map(|p| {
-                p.join("openssl/opensslconf.h")
-            }).filter(|p| p.exists());
-            match libdirs.next() {
-                Some(f) => File::open(f).unwrap(),
-                None => {
-                    panic!("failed to open header file at
-                            `openssl/opensslconf.h` to learn about \
-                            OpenSSL's version number, looked \
-                            inside:\n\n{:#?}\n\n",
-                           include_dirs);
-                }
-            }
+    let mut path = PathBuf::from(env::var_os("OUT_DIR").unwrap());
+    path.push("expando.c");
+    let mut file = BufWriter::new(File::create(&path).unwrap());
+
+    write!(file, "\
+#include <openssl/opensslv.h>
+#include <openssl/opensslconf.h>
+
+#ifdef LIBRESSL_VERSION_NUMBER
+RUST_LIBRESSL
+#elif OPENSSL_VERSION_NUMBER >= 0x10200000
+RUST_OPENSSL_NEW
+#elif OPENSSL_VERSION_NUMBER >= 0x10100000
+RUST_OPENSSL_110
+#elif OPENSSL_VERSION_NUMBER >= 0x10002000
+RUST_OPENSSL_102
+#elif OPENSSL_VERSION_NUMBER >= 0x10001000
+RUST_OPENSSL_101
+#else
+RUST_OPENSSL_OLD
+#endif
+").unwrap();
+
+    for define in DEFINES {
+        write!(file, "\
+#ifdef {define}
+RUST_{define}
+#endif
+", define = define).unwrap();
+    }
+
+    file.flush().unwrap();
+    drop(file);
+
+    let mut gcc = gcc::Config::new();
+    for include_dir in include_dirs {
+        gcc.include(include_dir);
+    }
+    // https://github.com/alexcrichton/gcc-rs/issues/133
+    let expanded = match panic::catch_unwind(AssertUnwindSafe(|| gcc.file(&path).expand())) {
+        Ok(expanded) => expanded,
+        Err(_) => {
+            panic!("
+Failed to find OpenSSL development headers.
+
+You can try fixing this setting the `OPENSSL_DIR` environment variable
+pointing to your OpenSSL installation or installing OpenSSL headers package
+specific to your distribution:
+
+    # On Ubuntu
+    sudo apt-get install libssl-dev
+    # On Arch Linux
+    sudo pacman -S openssl
+    # On Fedora
+    sudo dnf install openssl-devel
+
+See rust-openssl README for more information:
+
+    https://github.com/sfackler/rust-openssl#linux
+");
         }
     };
-    f.read_to_string(&mut conf_header).unwrap();
-
-    // Look for `#define OPENSSL_FOO`, print out everything as our own
-    // #[cfg] flag.
-    let mut vars = vec![];
-    for line in conf_header.lines() {
-        let i = match line.find("define ") {
-            Some(i) => i,
-            None => continue,
-        };
-        let var = line[i + "define ".len()..].trim();
-        if var.starts_with("OPENSSL") && !var.contains(" ") {
-            println!("cargo:rustc-cfg=osslconf=\"{}\"", var);
-            vars.push(var);
+    let expanded = String::from_utf8(expanded).unwrap();
+
+    let mut enabled = vec![];
+    for &define in DEFINES {
+        if expanded.contains(&format!("RUST_{}", define)) {
+            println!("cargo:rustc-cfg=osslconf=\"{}\"", define);
+            enabled.push(define);
         }
     }
-    println!("cargo:conf={}", vars.join(","));
+    println!("cargo:conf={}", enabled.join(","));
+
+    if expanded.contains("RUST_LIBRESSL") {
+        println!("cargo:rustc-cfg=libressl");
+        println!("cargo:libressl=true");
+        println!("cargo:version=101");
+        Version::Libressl
+    } else if expanded.contains("RUST_OPENSSL_110") {
+        println!("cargo:rustc-cfg=ossl110");
+        println!("cargo:version=110");
+        Version::Openssl110
+    } else if expanded.contains("RUST_OPENSSL_102") {
+        println!("cargo:rustc-cfg=ossl102");
+        println!("cargo:version=102");
+        Version::Openssl102
+    } else if expanded.contains("RUST_OPENSSL_101") {
+        println!("cargo:rustc-cfg=ossl101");
+        println!("cargo:version=101");
+        Version::Openssl101
+    } else {
+        panic!("
 
-    return version_text.to_string()
+This crate is only compatible with OpenSSL 1.0.1, 1.0.2, and 1.1.0, or LibreSSL,
+but a different version of OpenSSL was found. The build is now aborting due to
+this version mismatch.
+
+");
+    }
 }
 
 /// Given a libdir for OpenSSL (where artifacts are located) as well as the name
diff --git a/openssl-sys/src/lib.rs b/openssl-sys/src/lib.rs
index 5852e7d0..3d90461b 100644
--- a/openssl-sys/src/lib.rs
+++ b/openssl-sys/src/lib.rs
@@ -1,11 +1,12 @@
 #![allow(non_camel_case_types, non_upper_case_globals, non_snake_case)]
 #![allow(dead_code, overflowing_literals)]
-#![doc(html_root_url="https://sfackler.github.io/rust-openssl/doc/v0.9.0")]
+#![doc(html_root_url="https://docs.rs/openssl-sys/0.9.6")]
 
 extern crate libc;
 
 use libc::{c_void, c_int, c_char, c_ulong, c_long, c_uint, c_uchar, size_t, FILE};
 use std::ptr;
+use std::mem;
 
 #[cfg(any(ossl101, ossl102))]
 mod ossl10x;
@@ -17,46 +18,72 @@ mod ossl110;
 #[cfg(ossl110)]
 pub use ossl110::*;
 
+#[cfg(libressl)]
+mod libressl;
+#[cfg(libressl)]
+pub use libressl::*;
+
 pub enum ASN1_INTEGER {}
+pub enum ASN1_GENERALIZEDTIME {}
 pub enum ASN1_STRING {}
+pub enum ASN1_BIT_STRING {}
 pub enum ASN1_TIME {}
 pub enum ASN1_TYPE {}
+pub enum ASN1_OBJECT {}
 pub enum BN_CTX {}
 pub enum BN_GENCB {}
 pub enum CONF {}
 pub enum CONF_METHOD {}
 pub enum COMP_METHOD {}
 pub enum EC_KEY {}
+pub enum EC_GROUP {}
+pub enum EC_METHOD {}
+pub enum EC_POINT {}
 pub enum ENGINE {}
 pub enum EVP_CIPHER_CTX {}
 pub enum EVP_MD {}
 pub enum EVP_PKEY_CTX {}
-pub enum SSL {}
+pub enum OCSP_BASICRESP {}
+pub enum OCSP_CERTID {}
+pub enum OCSP_RESPONSE {}
+pub enum OCSP_REQUEST {}
+pub enum OCSP_ONEREQ {}
 pub enum SSL_CIPHER {}
 pub enum SSL_METHOD {}
 pub enum X509_CRL {}
 pub enum X509_EXTENSION {}
 pub enum X509_NAME {}
 pub enum X509_NAME_ENTRY {}
-pub enum X509_REQ {}
+pub enum X509_STORE {}
 pub enum X509_STORE_CTX {}
 pub enum bio_st {}
-pub enum PKCS12 {}
 pub enum DH_METHOD {}
-
-pub type bio_info_cb = Option<unsafe extern "C" fn(*mut BIO,
-                                                   c_int,
-                                                   *const c_char,
-                                                   c_int,
-                                                   c_long,
-                                                   c_long)>;
-
 pub enum RSA_METHOD {}
 pub enum BN_MONT_CTX {}
 pub enum BN_BLINDING {}
 pub enum DSA_METHOD {}
 pub enum EVP_PKEY_ASN1_METHOD {}
 
+pub type bio_info_cb = Option<unsafe extern fn(*mut BIO, c_int, *const c_char, c_int, c_long, c_long)>;
+pub type GEN_SESSION_CB = Option<unsafe extern fn(*const SSL, *mut c_uchar, *mut c_uint) -> c_int>;
+pub type tls_session_ticket_ext_cb_fn = Option<unsafe extern fn(*mut SSL, *const c_uchar, c_int, *mut c_void) -> c_int>;
+pub type tls_session_secret_cb_fn = Option<unsafe extern fn(*mut SSL, *mut c_void, *mut c_int, *mut stack_st_SSL_CIPHER, *mut *mut SSL_CIPHER, *mut c_void) -> c_int>;
+
+#[repr(C)]
+#[derive(Copy, Clone)]
+pub enum point_conversion_form_t {
+    POINT_CONVERSION_COMPRESSED = 2,
+    POINT_CONVERSION_UNCOMPRESSED = 4,
+    POINT_CONVERSION_HYBRID = 6,
+}
+
+#[repr(C)]
+pub struct AES_KEY {
+    // There is some business with AES_LONG which is there to ensure the values here are 32 bits
+    rd_key: [u32; 4 * (AES_MAXNR as usize + 1)],
+    rounds: c_int,
+}
+
 #[repr(C)]
 pub struct GENERAL_NAME {
     pub type_: c_int,
@@ -95,6 +122,12 @@ pub type PasswordCallback = unsafe extern fn(buf: *mut c_char, size: c_int,
                                              rwflag: c_int, user_data: *mut c_void)
                                              -> c_int;
 
+pub const AES_ENCRYPT: c_int = 1;
+pub const AES_DECRYPT: c_int = 0;
+
+pub const AES_MAXNR: c_int = 14;
+pub const AES_BLOCK_SIZE: c_int = 16;
+
 pub const BIO_TYPE_NONE: c_int = 0;
 
 pub const BIO_CTRL_EOF: c_int = 2;
@@ -110,10 +143,25 @@ pub const BIO_FLAGS_SHOULD_RETRY: c_int = 0x08;
 
 pub const CRYPTO_LOCK: c_int = 1;
 
+pub const ERR_LIB_PEM: c_int = 9;
+pub const PEM_R_NO_START_LINE: c_int = 108;
+
 pub const EVP_MAX_MD_SIZE: c_uint = 64;
 pub const EVP_PKEY_RSA: c_int = NID_rsaEncryption;
 pub const EVP_PKEY_HMAC: c_int = NID_hmac;
 pub const EVP_PKEY_DSA: c_int = NID_dsa;
+pub const EVP_PKEY_DH: c_int = NID_dhKeyAgreement;
+pub const EVP_PKEY_EC: c_int = NID_X9_62_id_ecPublicKey;
+
+pub const EVP_PKEY_ALG_CTRL: c_int = 0x1000;
+
+pub const EVP_PKEY_CTRL_RSA_PADDING: c_int = EVP_PKEY_ALG_CTRL + 1;
+
+pub const EVP_PKEY_CTRL_GET_RSA_PADDING: c_int = EVP_PKEY_ALG_CTRL + 6;
+
+pub const EVP_CTRL_GCM_SET_IVLEN: c_int = 0x9;
+pub const EVP_CTRL_GCM_GET_TAG: c_int = 0x10;
+pub const EVP_CTRL_GCM_SET_TAG: c_int = 0x11;
 
 pub const MBSTRING_ASC:  c_int = MBSTRING_FLAG | 1;
 pub const MBSTRING_BMP:  c_int = MBSTRING_FLAG | 2;
@@ -1034,7 +1082,44 @@ pub const NID_aes_128_cbc_hmac_sha1: c_int = 916;
 pub const NID_aes_192_cbc_hmac_sha1: c_int = 917;
 pub const NID_aes_256_cbc_hmac_sha1: c_int = 918;
 
+pub const OCSP_NOCERTS: c_ulong = 0x1;
+pub const OCSP_NOINTERN: c_ulong = 0x2;
+pub const OCSP_NOSIGS: c_ulong = 0x4;
+pub const OCSP_NOCHAIN: c_ulong = 0x8;
+pub const OCSP_NOVERIFY: c_ulong = 0x10;
+pub const OCSP_NOEXPLICIT: c_ulong = 0x20;
+pub const OCSP_NOCASIGN: c_ulong = 0x40;
+pub const OCSP_NODELEGATED: c_ulong = 0x80;
+pub const OCSP_NOCHECKS: c_ulong = 0x100;
+pub const OCSP_TRUSTOTHER: c_ulong = 0x200;
+pub const OCSP_RESPID_KEY: c_ulong = 0x400;
+pub const OCSP_NOTIME: c_ulong = 0x800;
+
+pub const V_OCSP_CERTSTATUS_GOOD: c_int = 0;
+pub const V_OCSP_CERTSTATUS_REVOKED: c_int = 1;
+pub const V_OCSP_CERTSTATUS_UNKNOWN: c_int = 2;
+
+pub const OCSP_REVOKED_STATUS_NOSTATUS: c_int = -1;
+pub const OCSP_REVOKED_STATUS_UNSPECIFIED: c_int = 0;
+pub const OCSP_REVOKED_STATUS_KEYCOMPROMISE: c_int = 1;
+pub const OCSP_REVOKED_STATUS_CACOMPROMISE: c_int = 2;
+pub const OCSP_REVOKED_STATUS_AFFILIATIONCHANGED: c_int = 3;
+pub const OCSP_REVOKED_STATUS_SUPERSEDED: c_int = 4;
+pub const OCSP_REVOKED_STATUS_CESSATIONOFOPERATION: c_int = 5;
+pub const OCSP_REVOKED_STATUS_CERTIFICATEHOLD: c_int = 6;
+pub const OCSP_REVOKED_STATUS_REMOVEFROMCRL: c_int = 8;
+
+pub const OCSP_RESPONSE_STATUS_SUCCESSFUL: c_int = 0;
+pub const OCSP_RESPONSE_STATUS_MALFORMEDREQUEST: c_int = 1;
+pub const OCSP_RESPONSE_STATUS_INTERNALERROR: c_int = 2;
+pub const OCSP_RESPONSE_STATUS_TRYLATER: c_int = 3;
+pub const OCSP_RESPONSE_STATUS_SIGREQUIRED: c_int = 5;
+pub const OCSP_RESPONSE_STATUS_UNAUTHORIZED: c_int = 6;
+
+pub const OPENSSL_EC_NAMED_CURVE: c_int = 1;
+
 pub const PKCS5_SALT_LEN: c_int = 8;
+pub const PKCS12_DEFAULT_ITER: c_int = 2048;
 
 pub const RSA_F4: c_long = 0x10001;
 
@@ -1052,14 +1137,23 @@ pub const SSL_CTRL_SET_READ_AHEAD: c_int = 41;
 pub const SSL_CTRL_SET_TLSEXT_SERVERNAME_CB:  c_int = 53;
 pub const SSL_CTRL_SET_TLSEXT_SERVERNAME_ARG: c_int = 54;
 pub const SSL_CTRL_SET_TLSEXT_HOSTNAME: c_int = 55;
+pub const SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB: c_int = 63;
+pub const SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG: c_int = 64;
+pub const SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE: c_int = 65;
+pub const SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP: c_int = 70;
+pub const SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP: c_int = 71;
+pub const SSL_CTRL_GET_EXTRA_CHAIN_CERTS: c_int = 82;
 
 pub const SSL_MODE_ENABLE_PARTIAL_WRITE: c_long = 0x1;
 pub const SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER: c_long = 0x2;
 pub const SSL_MODE_AUTO_RETRY: c_long = 0x4;
 pub const SSL_MODE_NO_AUTO_CHAIN: c_long = 0x8;
 pub const SSL_MODE_RELEASE_BUFFERS: c_long = 0x10;
+#[cfg(not(libressl))]
 pub const SSL_MODE_SEND_CLIENTHELLO_TIME: c_long = 0x20;
+#[cfg(not(libressl))]
 pub const SSL_MODE_SEND_SERVERHELLO_TIME: c_long = 0x40;
+#[cfg(not(libressl))]
 pub const SSL_MODE_SEND_FALLBACK_SCSV: c_long = 0x80;
 
 pub const SSL_ERROR_NONE: c_int = 0;
@@ -1078,31 +1172,38 @@ pub const SSL_VERIFY_FAIL_IF_NO_PEER_CERT: c_int = 2;
 #[cfg(not(ossl101))]
 pub const SSL_OP_TLSEXT_PADDING: c_ulong =                          0x00000010;
 pub const SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS: c_ulong =             0x00000800;
+#[cfg(not(libressl))]
 pub const SSL_OP_ALL: c_ulong =                                     0x80000BFF;
 pub const SSL_OP_NO_QUERY_MTU: c_ulong =                            0x00001000;
 pub const SSL_OP_COOKIE_EXCHANGE: c_ulong =                         0x00002000;
 pub const SSL_OP_NO_TICKET: c_ulong =                               0x00004000;
+#[cfg(not(libressl))]
 pub const SSL_OP_CISCO_ANYCONNECT: c_ulong =                        0x00008000;
 pub const SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION: c_ulong =  0x00010000;
+#[cfg(not(libressl))]
 pub const SSL_OP_NO_COMPRESSION: c_ulong =                          0x00020000;
+#[cfg(not(libressl))]
 pub const SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: c_ulong =       0x00040000;
 pub const SSL_OP_CIPHER_SERVER_PREFERENCE: c_ulong =                0x00400000;
 pub const SSL_OP_TLS_ROLLBACK_BUG: c_ulong =                        0x00800000;
+#[cfg(not(libressl))]
 pub const SSL_OP_NO_SSLv3: c_ulong =                                0x02000000;
 pub const SSL_OP_NO_TLSv1: c_ulong =                                0x04000000;
 pub const SSL_OP_NO_TLSv1_2: c_ulong =                              0x08000000;
 pub const SSL_OP_NO_TLSv1_1: c_ulong =                              0x10000000;
 
-#[cfg(not(ossl101))]
+#[cfg(not(any(ossl101, libressl)))]
 pub const SSL_OP_NO_DTLSv1: c_ulong =                               0x04000000;
-#[cfg(not(ossl101))]
+#[cfg(not(any(ossl101, libressl)))]
 pub const SSL_OP_NO_DTLSv1_2: c_ulong =                             0x08000000;
-#[cfg(not(ossl101))]
+#[cfg(not(any(ossl101, libressl)))]
 pub const SSL_OP_NO_SSL_MASK: c_ulong = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3 |
     SSL_OP_NO_TLSv1 | SSL_OP_NO_TLSv1_1 | SSL_OP_NO_TLSv1_2;
 
 pub const TLSEXT_NAMETYPE_host_name: c_int = 0;
 
+pub const TLSEXT_STATUSTYPE_ocsp: c_int = 1;
+
 pub const SSL_TLSEXT_ERR_OK: c_int = 0;
 pub const SSL_TLSEXT_ERR_ALERT_WARNING: c_int = 1;
 pub const SSL_TLSEXT_ERR_ALERT_FATAL: c_int = 2;
@@ -1173,15 +1274,15 @@ pub const X509_V_ERR_UNSUPPORTED_EXTENSION_FEATURE: c_int = 45;
 pub const X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: c_int = 53;
 pub const X509_V_OK: c_int = 0;
 
-#[cfg(not(ossl101))]
+#[cfg(not(any(ossl101, libressl)))]
 pub const X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT: c_uint = 0x1;
-#[cfg(not(ossl101))]
+#[cfg(not(any(ossl101, libressl)))]
 pub const X509_CHECK_FLAG_NO_WILDCARDS: c_uint = 0x2;
-#[cfg(not(ossl101))]
+#[cfg(not(any(ossl101, libressl)))]
 pub const X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS: c_uint = 0x4;
-#[cfg(not(ossl101))]
+#[cfg(not(any(ossl101, libressl)))]
 pub const X509_CHECK_FLAG_MULTI_LABEL_WILDCARDS: c_uint = 0x8;
-#[cfg(not(ossl101))]
+#[cfg(not(any(ossl101, libressl)))]
 pub const X509_CHECK_FLAG_SINGLE_LABEL_SUBDOMAINS: c_uint = 0x10;
 
 pub const GEN_OTHERNAME: c_int = 0;
@@ -1211,6 +1312,15 @@ pub unsafe fn BIO_set_retry_write(b: *mut BIO) {
     BIO_set_flags(b, BIO_FLAGS_WRITE | BIO_FLAGS_SHOULD_RETRY)
 }
 
+// EVP_PKEY_CTX_ctrl macros
+pub unsafe fn EVP_PKEY_CTX_set_rsa_padding(ctx: *mut EVP_PKEY_CTX, pad: c_int) -> c_int {
+    EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_RSA_PADDING, pad, ptr::null_mut())
+}
+
+pub unsafe fn EVP_PKEY_CTX_get_rsa_padding(ctx: *mut EVP_PKEY_CTX, ppad: *mut c_int) -> c_int {
+    EVP_PKEY_CTX_ctrl(ctx, EVP_PKEY_RSA, -1, EVP_PKEY_CTRL_GET_RSA_PADDING, 0, ppad as *mut c_void)
+}
+
 pub unsafe fn SSL_CTX_set_mode(ctx: *mut SSL_CTX, op: c_long) -> c_long {
     SSL_CTX_ctrl(ctx, SSL_CTRL_MODE, op, ptr::null_mut())
 }
@@ -1227,12 +1337,20 @@ pub unsafe fn SSL_CTX_set_tmp_ecdh(ctx: *mut SSL_CTX, key: *mut EC_KEY) -> c_lon
     SSL_CTX_ctrl(ctx, SSL_CTRL_SET_TMP_ECDH, 0, key as *mut c_void)
 }
 
+pub unsafe fn SSL_set_tmp_dh(ssl: *mut SSL, dh: *mut DH) -> c_long {
+    SSL_ctrl(ssl, SSL_CTRL_SET_TMP_DH, 0, dh as *mut c_void)
+}
+
+pub unsafe fn SSL_set_tmp_ecdh(ssl: *mut SSL, key: *mut EC_KEY) -> c_long {
+    SSL_ctrl(ssl, SSL_CTRL_SET_TMP_ECDH, 0, key as *mut c_void)
+}
+
 pub unsafe fn SSL_CTX_add_extra_chain_cert(ctx: *mut SSL_CTX, x509: *mut X509) -> c_long {
     SSL_CTX_ctrl(ctx, SSL_CTRL_EXTRA_CHAIN_CERT, 0, x509 as *mut c_void)
 }
 
 pub unsafe fn SSL_CTX_set_tlsext_servername_callback(ctx: *mut SSL_CTX,
-                                                     cb: Option<extern "C" fn()>)
+                                                     cb: Option<extern fn()>)
                                                      -> c_long {
     SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TLSEXT_SERVERNAME_CB, cb)
 }
@@ -1243,6 +1361,32 @@ pub unsafe fn SSL_set_tlsext_host_name(s: *mut SSL, name: *mut c_char) -> c_long
              name as *mut c_void)
 }
 
+pub unsafe fn SSL_set_tlsext_status_type(s: *mut SSL, type_: c_int) -> c_long {
+    SSL_ctrl(s, SSL_CTRL_SET_TLSEXT_STATUS_REQ_TYPE, type_ as c_long, ptr::null_mut())
+}
+
+pub unsafe fn SSL_CTX_set_tlsext_status_cb(ctx: *mut SSL_CTX,
+                                           cb: Option<unsafe extern fn(*mut SSL, *mut c_void) -> c_int>)
+                                           -> c_long {
+    SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB, mem::transmute(cb))
+}
+
+pub unsafe fn SSL_CTX_set_tlsext_status_arg(ctx: *mut SSL_CTX, arg: *mut c_void) -> c_long {
+    SSL_CTX_ctrl(ctx, SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB_ARG, 0, arg)
+}
+
+pub unsafe fn SSL_CTX_get_extra_chain_certs(ctx: *mut SSL_CTX, chain: *mut *mut stack_st_X509) -> c_long {
+    SSL_CTX_ctrl(ctx, SSL_CTRL_GET_EXTRA_CHAIN_CERTS, 0, chain as *mut c_void)
+}
+
+pub unsafe fn SSL_get_tlsext_status_ocsp_resp(ssl: *mut SSL, resp: *mut *mut c_uchar) -> c_long {
+    SSL_ctrl(ssl, SSL_CTRL_GET_TLSEXT_STATUS_REQ_OCSP_RESP, 0, resp as *mut c_void)
+}
+
+pub unsafe fn SSL_set_tlsext_status_ocsp_resp(ssl: *mut SSL, resp: *mut c_uchar, len: c_long) -> c_long {
+    SSL_ctrl(ssl, SSL_CTRL_SET_TLSEXT_STATUS_REQ_OCSP_RESP, len, resp as *mut c_void)
+}
+
 pub fn ERR_GET_LIB(l: c_ulong) -> c_int {
     ((l >> 24) & 0x0FF) as c_int
 }
@@ -1256,11 +1400,19 @@ pub fn ERR_GET_REASON(l: c_ulong) -> c_int {
 }
 
 extern {
+    pub fn AES_set_encrypt_key(userKey: *const c_uchar, bits: c_int, key: *mut AES_KEY) -> c_int;
+    pub fn AES_set_decrypt_key(userKey: *const c_uchar, bits: c_int, key: *mut AES_KEY) -> c_int;
+    pub fn AES_ige_encrypt(in_: *const c_uchar, out: *mut c_uchar, length: size_t, key: *const AES_KEY, ivec: *mut c_uchar, enc: c_int);
+
+    pub fn ASN1_INTEGER_get(dest: *const ASN1_INTEGER) -> c_long;
     pub fn ASN1_INTEGER_set(dest: *mut ASN1_INTEGER, value: c_long) -> c_int;
+    pub fn ASN1_GENERALIZEDTIME_free(tm: *mut ASN1_GENERALIZEDTIME);
+    pub fn ASN1_GENERALIZEDTIME_print(b: *mut BIO, tm: *const ASN1_GENERALIZEDTIME) -> c_int;
     pub fn ASN1_STRING_type_new(ty: c_int) -> *mut ASN1_STRING;
     pub fn ASN1_TIME_free(tm: *mut ASN1_TIME);
     pub fn ASN1_TIME_print(b: *mut BIO, tm: *const ASN1_TIME) -> c_int;
-    pub fn ASN1_INTEGER_free(x: *mut ASN1_INTEGER);
+    pub fn ASN1_BIT_STRING_free(x: *mut ASN1_BIT_STRING);
+    pub fn ASN1_OBJECT_free(x: *mut ASN1_OBJECT);
 
     pub fn BIO_ctrl(b: *mut BIO, cmd: c_int, larg: c_long, parg: *mut c_void) -> c_long;
     pub fn BIO_free_all(b: *mut BIO);
@@ -1268,9 +1420,9 @@ extern {
     pub fn BIO_new_socket(sock: c_int, close_flag: c_int) -> *mut BIO;
     pub fn BIO_read(b: *mut BIO, buf: *mut c_void, len: c_int) -> c_int;
     pub fn BIO_write(b: *mut BIO, buf: *const c_void, len: c_int) -> c_int;
-    #[cfg(ossl101)]
+    #[cfg(any(ossl101, libressl))]
     pub fn BIO_new_mem_buf(buf: *mut c_void, len: c_int) -> *mut BIO;
-    #[cfg(not(ossl101))]
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn BIO_new_mem_buf(buf: *const c_void, len: c_int) -> *mut BIO;
     pub fn BIO_set_flags(b: *mut BIO, flags: c_int);
     pub fn BIO_clear_flags(b: *mut BIO, flags: c_int);
@@ -1339,20 +1491,54 @@ extern {
 
     pub fn DH_new() -> *mut DH;
     pub fn DH_free(dh: *mut DH);
-    #[cfg(not(ossl101))]
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn DH_get_1024_160() -> *mut DH;
-    #[cfg(not(ossl101))]
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn DH_get_2048_224() -> *mut DH;
-    #[cfg(not(ossl101))]
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn DH_get_2048_256() -> *mut DH;
 
+    pub fn EC_KEY_new() -> *mut EC_KEY;
     pub fn EC_KEY_new_by_curve_name(nid: c_int) -> *mut EC_KEY;
+    pub fn EC_KEY_set_group(key: *mut EC_KEY, group: *const EC_GROUP) -> c_int;
+    pub fn EC_KEY_get0_group(key: *const EC_KEY) -> *const EC_GROUP;
+    pub fn EC_KEY_set_public_key(key: *mut EC_KEY, key: *const EC_POINT) -> c_int;
+    pub fn EC_KEY_get0_public_key(key: *const EC_KEY) -> *const EC_POINT;
+    pub fn EC_KEY_set_private_key(key: *mut EC_KEY, key: *const BIGNUM) -> c_int;
+    pub fn EC_KEY_get0_private_key(key: *const EC_KEY) -> *const BIGNUM;
+    pub fn EC_KEY_generate_key(key: *mut EC_KEY) -> c_int;
+    pub fn EC_KEY_check_key(key: *const EC_KEY) -> c_int;
     pub fn EC_KEY_free(key: *mut EC_KEY);
 
+    pub fn EC_GF2m_simple_method() -> *const EC_METHOD;
+
+    pub fn EC_GROUP_new(meth: *const EC_METHOD) -> *mut EC_GROUP;
+    pub fn EC_GROUP_new_curve_GFp(p: *const BIGNUM, a: *const BIGNUM, b: *const BIGNUM, ctx: *mut BN_CTX) -> *mut EC_GROUP;
+    pub fn EC_GROUP_new_curve_GF2m(p: *const BIGNUM, a: *const BIGNUM, b: *const BIGNUM, ctx: *mut BN_CTX) -> *mut EC_GROUP;
+    pub fn EC_GROUP_new_by_curve_name(nid: c_int) -> *mut EC_GROUP;
+    pub fn EC_GROUP_get_curve_GFp(group: *const EC_GROUP, p: *mut BIGNUM, a: *mut BIGNUM, b: *mut BIGNUM, ctx: *mut BN_CTX) -> c_int;
+    pub fn EC_GROUP_get_curve_GF2m(group: *const EC_GROUP, p: *mut BIGNUM, a: *mut BIGNUM, b: *mut BIGNUM, ctx: *mut BN_CTX) -> c_int;
+    pub fn EC_GROUP_get_degree(group: *const EC_GROUP) -> c_int;
+    pub fn EC_GROUP_get_order(group: *const EC_GROUP, order: *mut BIGNUM, ctx: *mut BN_CTX) -> c_int;
+    pub fn EC_GROUP_set_asn1_flag(key: *mut EC_GROUP, flag: c_int);
+
+    pub fn EC_GROUP_free(group: *mut EC_GROUP);
+
+    pub fn EC_POINT_new(group: *const EC_GROUP) -> *mut EC_POINT;
+    pub fn EC_POINT_add(group: *const EC_GROUP, r: *mut EC_POINT, a: *const EC_POINT, b: *const EC_POINT, ctx: *mut BN_CTX) -> c_int;
+    pub fn EC_POINT_mul(group: *const EC_GROUP, r: *mut EC_POINT, n: *const BIGNUM, q: *const EC_POINT, m: *const BIGNUM, ctx: *mut BN_CTX) -> c_int;
+    pub fn EC_POINT_invert(group: *const EC_GROUP, r: *mut EC_POINT, ctx: *mut BN_CTX) -> c_int;
+    pub fn EC_POINT_point2oct(group: *const EC_GROUP, p: *const EC_POINT, form: point_conversion_form_t, buf: *mut c_uchar, len: size_t, ctx: *mut BN_CTX) -> size_t;
+    pub fn EC_POINT_oct2point(group: *const EC_GROUP, p: *mut EC_POINT, buf: *const c_uchar, len: size_t, ctx: *mut BN_CTX) -> c_int;
+    pub fn EC_POINT_cmp(group: *const EC_GROUP, a: *const EC_POINT, b: *const EC_POINT, ctx: *mut BN_CTX) -> c_int;
+    pub fn EC_POINT_free(point: *mut EC_POINT);
+
+    pub fn ERR_peek_last_error() -> c_ulong;
     pub fn ERR_get_error() -> c_ulong;
     pub fn ERR_lib_error_string(err: c_ulong) -> *const c_char;
     pub fn ERR_func_error_string(err: c_ulong) -> *const c_char;
     pub fn ERR_reason_error_string(err: c_ulong) -> *const c_char;
+    pub fn ERR_clear_error();
 
     pub fn EVP_md5() -> *const EVP_MD;
     pub fn EVP_ripemd160() -> *const EVP_MD;
@@ -1378,6 +1564,10 @@ extern {
     pub fn EVP_aes_256_cfb1() -> *const EVP_CIPHER;
     pub fn EVP_aes_256_cfb128() -> *const EVP_CIPHER;
     pub fn EVP_aes_256_cfb8() -> *const EVP_CIPHER;
+    pub fn EVP_bf_cbc() -> *const EVP_CIPHER;
+    pub fn EVP_bf_ecb() -> *const EVP_CIPHER;
+    pub fn EVP_bf_cfb64() -> *const EVP_CIPHER;
+    pub fn EVP_bf_ofb() -> *const EVP_CIPHER;
     pub fn EVP_rc4() -> *const EVP_CIPHER;
 
     pub fn EVP_des_cbc() -> *const EVP_CIPHER;
@@ -1390,6 +1580,7 @@ extern {
     pub fn EVP_CIPHER_CTX_new() -> *mut EVP_CIPHER_CTX;
     pub fn EVP_CIPHER_CTX_set_padding(ctx: *mut EVP_CIPHER_CTX, padding: c_int) -> c_int;
     pub fn EVP_CIPHER_CTX_set_key_length(ctx: *mut EVP_CIPHER_CTX, keylen: c_int) -> c_int;
+    pub fn EVP_CIPHER_CTX_ctrl(ctx: *mut EVP_CIPHER_CTX, type_: c_int, arg: c_int, ptr: *mut c_void) -> c_int;
     pub fn EVP_CIPHER_CTX_free(ctx: *mut EVP_CIPHER_CTX);
 
     pub fn EVP_CipherInit(ctx: *mut EVP_CIPHER_CTX, evp: *const EVP_CIPHER,
@@ -1423,11 +1614,11 @@ extern {
                                 type_: *const EVP_MD,
                                 e: *mut ENGINE,
                                 pkey: *mut EVP_PKEY) -> c_int;
-    #[cfg(ossl101)]
+    #[cfg(any(ossl101, libressl))]
     pub fn EVP_DigestVerifyFinal(ctx: *mut EVP_MD_CTX,
                                  sigret: *mut c_uchar,
                                  siglen: size_t) -> c_int;
-    #[cfg(not(ossl101))]
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn EVP_DigestVerifyFinal(ctx: *mut EVP_MD_CTX,
                                  sigret: *const c_uchar,
                                  siglen: size_t) -> c_int;
@@ -1440,14 +1631,47 @@ extern {
     pub fn EVP_PKEY_copy_parameters(to: *mut EVP_PKEY, from: *const EVP_PKEY) -> c_int;
     pub fn EVP_PKEY_get1_RSA(k: *mut EVP_PKEY) -> *mut RSA;
     pub fn EVP_PKEY_set1_RSA(k: *mut EVP_PKEY, r: *mut RSA) -> c_int;
+    pub fn EVP_PKEY_get1_DSA(k: *mut EVP_PKEY) -> *mut DSA;
+    pub fn EVP_PKEY_get1_DH(k: *mut EVP_PKEY) -> *mut DH;
+    pub fn EVP_PKEY_get1_EC_KEY(k: *mut EVP_PKEY) -> *mut EC_KEY;
     pub fn EVP_PKEY_cmp(a: *const EVP_PKEY, b: *const EVP_PKEY) -> c_int;
     pub fn EVP_PKEY_new_mac_key(type_: c_int,
                                 e: *mut ENGINE,
                                 key: *const c_uchar,
                                 keylen: c_int) -> *mut EVP_PKEY;
 
+
+    pub fn EVP_PKEY_CTX_ctrl(ctx: *mut EVP_PKEY_CTX, keytype: c_int, optype: c_int, cmd: c_int, p1: c_int, p2: *mut c_void) -> c_int;
+
     pub fn HMAC_CTX_copy(dst: *mut HMAC_CTX, src: *mut HMAC_CTX) -> c_int;
 
+    pub fn OBJ_obj2nid(o: *const ASN1_OBJECT) -> c_int;
+    pub fn OBJ_obj2txt(buf: *mut c_char, buf_len: c_int, a: *const ASN1_OBJECT, no_name: c_int) -> c_int;
+
+    pub fn OCSP_BASICRESP_new() -> *mut OCSP_BASICRESP;
+    pub fn OCSP_BASICRESP_free(r: *mut OCSP_BASICRESP);
+    pub fn OCSP_basic_verify(bs: *mut OCSP_BASICRESP, certs: *mut stack_st_X509, st: *mut X509_STORE, flags: c_ulong) -> c_int;
+    pub fn OCSP_resp_find_status(bs: *mut OCSP_BASICRESP, id: *mut OCSP_CERTID, status: *mut c_int, reason: *mut c_int, revtime: *mut *mut ASN1_GENERALIZEDTIME, thisupd: *mut *mut ASN1_GENERALIZEDTIME, nextupd: *mut *mut ASN1_GENERALIZEDTIME) -> c_int;
+    pub fn OCSP_check_validity(thisupd: *mut ASN1_GENERALIZEDTIME, nextupd: *mut ASN1_GENERALIZEDTIME, sec: c_long, maxsec: c_long) -> c_int;
+
+    pub fn OCSP_CERTID_free(id: *mut OCSP_CERTID);
+
+    pub fn OCSP_RESPONSE_new() -> *mut OCSP_RESPONSE;
+    pub fn OCSP_RESPONSE_free(r: *mut OCSP_RESPONSE);
+    pub fn i2d_OCSP_RESPONSE(a: *mut OCSP_RESPONSE, pp: *mut *mut c_uchar) -> c_int;
+    pub fn d2i_OCSP_RESPONSE(a: *mut *mut OCSP_RESPONSE, pp: *mut *const c_uchar, length: c_long) -> *mut OCSP_RESPONSE;
+    pub fn OCSP_response_create(status: c_int, bs: *mut OCSP_BASICRESP) -> *mut OCSP_RESPONSE;
+    pub fn OCSP_response_status(resp: *mut OCSP_RESPONSE) -> c_int;
+    pub fn OCSP_response_get1_basic(resp: *mut OCSP_RESPONSE) -> *mut OCSP_BASICRESP;
+
+    pub fn OCSP_REQUEST_new() -> *mut OCSP_REQUEST;
+    pub fn OCSP_REQUEST_free(r: *mut OCSP_REQUEST);
+    pub fn i2d_OCSP_REQUEST(a: *mut OCSP_REQUEST, pp: *mut *mut c_uchar) -> c_int;
+    pub fn d2i_OCSP_REQUEST(a: *mut *mut OCSP_REQUEST, pp: *mut *const c_uchar, length: c_long) -> *mut OCSP_REQUEST;
+    pub fn OCSP_request_add0_id(r: *mut OCSP_REQUEST, id: *mut OCSP_CERTID) -> *mut OCSP_ONEREQ;
+
+    pub fn OCSP_ONEREQ_free(r: *mut OCSP_ONEREQ);
+
     pub fn PEM_read_bio_DHparams(bio: *mut BIO, out: *mut *mut DH, callback: Option<PasswordCallback>,
                              user_data: *mut c_void) -> *mut DH;
     pub fn PEM_read_bio_X509(bio: *mut BIO, out: *mut *mut X509, callback: Option<PasswordCallback>,
@@ -1467,6 +1691,10 @@ extern {
                                     kstr: *mut c_uchar, klen: c_int,
                                     callback: Option<PasswordCallback>,
                                     user_data: *mut c_void) -> c_int;
+    pub fn PEM_write_bio_PKCS8PrivateKey(bio: *mut BIO, pkey: *mut EVP_PKEY, cipher: *const EVP_CIPHER,
+                                        kstr: *mut c_char, klen: c_int,
+                                        callback: Option<PasswordCallback>,
+                                        user_data: *mut c_void) -> c_int;
     pub fn PEM_write_bio_PUBKEY(bp: *mut BIO, x: *mut EVP_PKEY) -> c_int;
     pub fn PEM_write_bio_RSAPrivateKey(bp: *mut BIO, rsa: *mut RSA, cipher: *const EVP_CIPHER,
                                         kstr: *mut c_uchar, klen: c_int,
@@ -1484,11 +1712,19 @@ extern {
                                        user_data: *mut c_void) -> c_int;
     pub fn PEM_write_bio_DSA_PUBKEY(bp: *mut BIO, dsa: *mut DSA) -> c_int;
 
-
-
     pub fn PEM_write_bio_X509(bio: *mut BIO, x509: *mut X509) -> c_int;
     pub fn PEM_write_bio_X509_REQ(bio: *mut BIO, x509: *mut X509_REQ) -> c_int;
 
+    pub fn PEM_write_bio_ECPrivateKey(bio: *mut BIO,
+                                      key: *mut EC_KEY,
+                                      cipher: *const EVP_CIPHER,
+                                      kstr: *mut c_uchar,
+                                      klen: c_int,
+                                      callback: Option<PasswordCallback>,
+                                      user_data: *mut c_void)
+                                      -> c_int;
+    pub fn PEM_read_bio_ECPrivateKey(bio: *mut BIO, key: *mut *mut EC_KEY, callback: Option<PasswordCallback>, user_data: *mut c_void) -> *mut EC_KEY;
+
     pub fn PKCS5_PBKDF2_HMAC_SHA1(pass: *const c_char, passlen: c_int,
                                   salt: *const u8, saltlen: c_int,
                                   iter: c_int, keylen: c_int,
@@ -1547,8 +1783,10 @@ extern {
     pub fn SSL_get_ex_data_X509_STORE_CTX_idx() -> c_int;
     pub fn SSL_get_SSL_CTX(ssl: *const SSL) -> *mut SSL_CTX;
     pub fn SSL_set_SSL_CTX(ssl: *mut SSL, ctx: *mut SSL_CTX) -> *mut SSL_CTX;
-    #[cfg(not(osslconf = "OPENSSL_NO_COMP"))]
+    #[cfg(not(any(osslconf = "OPENSSL_NO_COMP", libressl)))]
     pub fn SSL_get_current_compression(ssl: *mut SSL) -> *const COMP_METHOD;
+    #[cfg(libressl)]
+    pub fn SSL_get_current_compression(ssl: *mut SSL) -> *const libc::c_void;
     pub fn SSL_get_peer_certificate(ssl: *const SSL) -> *mut X509;
     pub fn SSL_get_ssl_method(ssl: *mut SSL) -> *const SSL_METHOD;
     pub fn SSL_get_version(ssl: *const SSL) -> *const c_char;
@@ -1561,19 +1799,26 @@ extern {
     pub fn SSL_get_ex_data(ssl: *const SSL, idx: c_int) -> *mut c_void;
     pub fn SSL_get_servername(ssl: *const SSL, name_type: c_int) -> *const c_char;
     pub fn SSL_get_current_cipher(ssl: *const SSL) -> *const SSL_CIPHER;
-    #[cfg(not(ossl101))]
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn SSL_get0_param(ssl: *mut SSL) -> *mut X509_VERIFY_PARAM;
     pub fn SSL_get_verify_result(ssl: *const SSL) -> c_long;
     pub fn SSL_shutdown(ssl: *mut SSL) -> c_int;
     pub fn SSL_get_certificate(ssl: *const SSL) -> *mut X509;
-    #[cfg(ossl101)]
+    #[cfg(any(ossl101, libressl))]
     pub fn SSL_get_privatekey(ssl: *mut SSL) -> *mut EVP_PKEY;
-    #[cfg(not(ossl101))]
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn SSL_get_privatekey(ssl: *const SSL) -> *mut EVP_PKEY;
     pub fn SSL_load_client_CA_file(file: *const c_char) -> *mut stack_st_X509_NAME;
+    pub fn SSL_set_tmp_dh_callback(ctx: *mut SSL,
+                                   dh: unsafe extern fn(ssl: *mut SSL,
+                                                        is_export: c_int,
+                                                        keylength: c_int)
+                                                        -> *mut DH);
 
-    #[cfg(not(osslconf = "OPENSSL_NO_COMP"))]
+    #[cfg(not(any(osslconf = "OPENSSL_NO_COMP", libressl)))]
     pub fn SSL_COMP_get_name(comp: *const COMP_METHOD) -> *const c_char;
+    #[cfg(libressl)]
+    pub fn SSL_COMP_get_name(comp: *const libc::c_void) -> *const c_char;
 
     pub fn SSL_CIPHER_get_name(cipher: *const SSL_CIPHER) -> *const c_char;
     pub fn SSL_CIPHER_get_bits(cipher: *const SSL_CIPHER, alg_bits: *mut c_int) -> c_int;
@@ -1582,7 +1827,7 @@ extern {
     pub fn SSL_CTX_new(method: *const SSL_METHOD) -> *mut SSL_CTX;
     pub fn SSL_CTX_free(ctx: *mut SSL_CTX);
     pub fn SSL_CTX_ctrl(ctx: *mut SSL_CTX, cmd: c_int, larg: c_long, parg: *mut c_void) -> c_long;
-    pub fn SSL_CTX_callback_ctrl(ctx: *mut SSL_CTX, cmd: c_int, fp: Option<extern "C" fn()>) -> c_long;
+    pub fn SSL_CTX_callback_ctrl(ctx: *mut SSL_CTX, cmd: c_int, fp: Option<extern fn()>) -> c_long;
     pub fn SSL_CTX_set_verify(ctx: *mut SSL_CTX, mode: c_int,
                               verify_callback: Option<extern fn(c_int, *mut X509_STORE_CTX) -> c_int>);
     pub fn SSL_CTX_set_verify_depth(ctx: *mut SSL_CTX, depth: c_int);
@@ -1602,10 +1847,16 @@ extern {
     pub fn SSL_CTX_use_PrivateKey(ctx: *mut SSL_CTX, key: *mut EVP_PKEY) -> c_int;
     pub fn SSL_CTX_check_private_key(ctx: *const SSL_CTX) -> c_int;
     pub fn SSL_CTX_set_client_CA_list(ctx: *mut SSL_CTX, list: *mut stack_st_X509_NAME);
-
-    #[cfg(not(ossl101))]
+    pub fn SSL_CTX_get_cert_store(ctx: *const SSL_CTX) -> *mut X509_STORE;
+    pub fn SSL_CTX_set_tmp_dh_callback(ctx: *mut SSL_CTX,
+                                       dh: unsafe extern fn(ssl: *mut SSL,
+                                                            is_export: c_int,
+                                                            keylength: c_int)
+                                                            -> *mut DH);
+
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn SSL_CTX_get0_certificate(ctx: *const SSL_CTX) -> *mut X509;
-    #[cfg(not(ossl101))]
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn SSL_CTX_get0_privatekey(ctx: *const SSL_CTX) -> *mut EVP_PKEY;
 
     pub fn SSL_CTX_set_cipher_list(ssl: *mut SSL_CTX, s: *const c_char) -> c_int;
@@ -1628,6 +1879,12 @@ extern {
                                  inbuf: *const c_uchar, inlen: c_uint,
                                  client: *const c_uchar, client_len: c_uint) -> c_int;
     pub fn SSL_get0_next_proto_negotiated(s: *const SSL, data: *mut *const c_uchar, len: *mut c_uint);
+    pub fn SSL_get_session(s: *const SSL) -> *mut SSL_SESSION;
+    #[cfg(not(any(ossl101, libressl)))]
+    pub fn SSL_is_server(s: *mut SSL) -> c_int;
+
+    pub fn SSL_SESSION_free(s: *mut SSL_SESSION);
+    pub fn SSL_SESSION_get_id(s: *const SSL_SESSION, len: *mut c_uint) -> *const c_uchar;
 
     #[cfg(not(ossl101))]
     pub fn SSL_CTX_set_alpn_protos(s: *mut SSL_CTX, data: *const c_uchar, len: c_uint) -> c_int;
@@ -1663,6 +1920,10 @@ extern {
     pub fn X509_get_pubkey(x: *mut X509) -> *mut EVP_PKEY;
     pub fn X509_to_X509_REQ(x: *mut X509, pkey: *mut EVP_PKEY, md: *const EVP_MD) -> *mut X509_REQ;
     pub fn X509_verify_cert_error_string(n: c_long) -> *const c_char;
+    pub fn X509_get1_ocsp(x: *mut X509) -> *mut stack_st_OPENSSL_STRING;
+    pub fn X509_check_issued(issuer: *mut X509, subject: *mut X509) -> c_int;
+
+    pub fn X509_ALGOR_free(x: *mut X509_ALGOR);
 
     pub fn X509_EXTENSION_free(ext: *mut X509_EXTENSION);
 
@@ -1676,6 +1937,13 @@ extern {
     pub fn ASN1_STRING_free(x: *mut ASN1_STRING);
     pub fn ASN1_STRING_length(x: *const ASN1_STRING) -> c_int;
 
+    pub fn ASN1_INTEGER_free(x: *mut ASN1_INTEGER);
+
+    pub fn X509_STORE_new() -> *mut X509_STORE;
+    pub fn X509_STORE_free(store: *mut X509_STORE);
+    pub fn X509_STORE_add_cert(store: *mut X509_STORE, x: *mut X509) -> c_int;
+    pub fn X509_STORE_set_default_paths(store: *mut X509_STORE) -> c_int;
+
     pub fn X509_STORE_CTX_free(ctx: *mut X509_STORE_CTX);
     pub fn X509_STORE_CTX_get_current_cert(ctx: *mut X509_STORE_CTX) -> *mut X509;
     pub fn X509_STORE_CTX_get_error(ctx: *mut X509_STORE_CTX) -> c_int;
@@ -1694,24 +1962,43 @@ extern {
 
     #[cfg(not(ossl101))]
     pub fn X509_VERIFY_PARAM_free(param: *mut X509_VERIFY_PARAM);
-    #[cfg(not(ossl101))]
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn X509_VERIFY_PARAM_set_hostflags(param: *mut X509_VERIFY_PARAM, flags: c_uint);
-    #[cfg(not(ossl101))]
+    #[cfg(not(any(ossl101, libressl)))]
     pub fn X509_VERIFY_PARAM_set1_host(param: *mut X509_VERIFY_PARAM,
                                        name: *const c_char,
                                        namelen: size_t) -> c_int;
 
+    pub fn d2i_DHparams(k: *mut *mut DH, pp: *mut *const c_uchar, length: c_long) -> *mut DH;
+    pub fn i2d_DHparams(dh: *const DH, pp: *mut *mut c_uchar) -> c_int;
+
+    pub fn d2i_DSAPublicKey(a: *mut *mut DSA, pp: *mut *const c_uchar, length: c_long) -> *mut DSA;
+    pub fn i2d_DSAPublicKey(a: *const DSA, pp: *mut *mut c_uchar) -> c_int;
+    pub fn d2i_DSAPrivateKey(a: *mut *mut DSA, pp: *mut *const c_uchar, length: c_long) -> *mut DSA;
+    pub fn i2d_DSAPrivateKey(a: *const DSA, pp: *mut *mut c_uchar) -> c_int;
+
+    pub fn d2i_ECPrivateKey(k: *mut *mut EC_KEY, pp: *mut *const c_uchar, length: c_long) -> *mut EC_KEY;
+    pub fn i2d_ECPrivateKey(ec_key: *mut EC_KEY, pp: *mut *mut c_uchar) -> c_int;
+
     pub fn d2i_X509(a: *mut *mut X509, pp: *mut *const c_uchar, length: c_long) -> *mut X509;
+    pub fn d2i_X509_REQ(a: *mut *mut X509_REQ, pp: *mut *const c_uchar, length: c_long) -> *mut X509_REQ;
     pub fn i2d_X509_bio(b: *mut BIO, x: *mut X509) -> c_int;
+    pub fn i2d_X509(x: *mut X509, buf: *mut *mut u8) -> c_int;
     pub fn i2d_X509_REQ_bio(b: *mut BIO, x: *mut X509_REQ) -> c_int;
+    pub fn i2d_X509_REQ(x: *mut X509_REQ, buf: *mut *mut u8) -> c_int;
 
     pub fn i2d_PUBKEY_bio(b: *mut BIO, x: *mut EVP_PKEY) -> c_int;
+    pub fn i2d_PrivateKey_bio(b: *mut BIO, x: *mut EVP_PKEY) -> c_int;
+    pub fn i2d_PUBKEY(k: *mut EVP_PKEY, buf: *mut *mut u8) -> c_int;
+    pub fn i2d_PrivateKey(k: *mut EVP_PKEY, buf: *mut *mut u8) -> c_int;
 
     pub fn i2d_RSA_PUBKEY(k: *mut RSA, buf: *mut *mut u8) -> c_int;
     pub fn d2i_RSA_PUBKEY(k: *mut *mut RSA, buf: *mut *const u8, len: c_long) -> *mut RSA;
     pub fn i2d_RSAPrivateKey(k: *const RSA, buf: *mut *mut u8) -> c_int;
     pub fn d2i_RSAPrivateKey(k: *mut *mut RSA, buf: *mut *const u8, len: c_long) -> *mut RSA;
 
+    pub fn i2d_PKCS12_bio(b: *mut BIO, a: *mut PKCS12) -> c_int;
+    pub fn i2d_PKCS12(a: *mut PKCS12, buf: *mut *mut u8) -> c_int;
     pub fn d2i_PKCS12(a: *mut *mut PKCS12, pp: *mut *const u8, length: c_long) -> *mut PKCS12;
     pub fn PKCS12_parse(p12: *mut PKCS12,
                         pass: *const c_char,
diff --git a/openssl-sys/src/libressl.rs b/openssl-sys/src/libressl.rs
new file mode 100644
index 00000000..197d2c22
--- /dev/null
+++ b/openssl-sys/src/libressl.rs
@@ -0,0 +1,734 @@
+use std::sync::{Mutex, MutexGuard};
+use std::sync::{Once, ONCE_INIT};
+use std::mem;
+
+use libc::{c_int, c_char, c_void, c_long, c_uchar, size_t, c_uint, c_ulong};
+use libc::time_t;
+
+#[repr(C)]
+pub struct stack_st_ASN1_OBJECT {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
+pub struct stack_st_X509 {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
+pub struct stack_st_X509_NAME {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
+pub struct stack_st_X509_ATTRIBUTE {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
+pub struct stack_st_X509_EXTENSION {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
+pub struct stack_st_GENERAL_NAME {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
+pub struct stack_st_void {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
+pub struct stack_st_SSL_CIPHER {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
+pub struct stack_st_OPENSSL_STRING {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
+pub struct _STACK {
+    pub num: c_int,
+    pub data: *mut *mut c_char,
+    pub sorted: c_int,
+    pub num_alloc: c_int,
+    pub comp: Option<unsafe extern fn(*const c_void, *const c_void) -> c_int>,
+}
+
+#[repr(C)]
+pub struct BIO_METHOD {
+    pub type_: c_int,
+    pub name: *const c_char,
+    pub bwrite: Option<unsafe extern fn(*mut ::BIO, *const c_char, c_int) -> c_int>,
+    pub bread: Option<unsafe extern fn(*mut ::BIO, *mut c_char, c_int) -> c_int>,
+    pub bputs: Option<unsafe extern fn(*mut ::BIO, *const c_char) -> c_int>,
+    pub bgets: Option<unsafe extern fn(*mut ::BIO, *mut c_char, c_int) -> c_int>,
+    pub ctrl: Option<unsafe extern fn(*mut ::BIO, c_int, c_long, *mut c_void) -> c_long>,
+    pub create: Option<unsafe extern fn(*mut ::BIO) -> c_int>,
+    pub destroy: Option<unsafe extern fn(*mut ::BIO) -> c_int>,
+    pub callback_ctrl: Option<unsafe extern fn(*mut ::BIO, c_int, ::bio_info_cb) -> c_long>,
+}
+
+#[repr(C)]
+pub struct RSA {
+    pub pad: c_int,
+    pub version: c_long,
+    pub meth: *const ::RSA_METHOD,
+
+    pub engine: *mut ::ENGINE,
+    pub n: *mut ::BIGNUM,
+    pub e: *mut ::BIGNUM,
+    pub d: *mut ::BIGNUM,
+    pub p: *mut ::BIGNUM,
+    pub q: *mut ::BIGNUM,
+    pub dmp1: *mut ::BIGNUM,
+    pub dmq1: *mut ::BIGNUM,
+    pub iqmp: *mut ::BIGNUM,
+
+    pub ex_data: ::CRYPTO_EX_DATA,
+    pub references: c_int,
+    pub flags: c_int,
+
+    pub _method_mod_n: *mut ::BN_MONT_CTX,
+    pub _method_mod_p: *mut ::BN_MONT_CTX,
+    pub _method_mod_q: *mut ::BN_MONT_CTX,
+
+    pub blinding: *mut ::BN_BLINDING,
+    pub mt_blinding: *mut ::BN_BLINDING,
+}
+
+#[repr(C)]
+pub struct DSA {
+    pub pad: c_int,
+    pub version: c_long,
+    pub write_params: c_int,
+
+    pub p: *mut ::BIGNUM,
+    pub q: *mut ::BIGNUM,
+    pub g: *mut ::BIGNUM,
+    pub pub_key: *mut ::BIGNUM,
+    pub priv_key: *mut ::BIGNUM,
+    pub kinv: *mut ::BIGNUM,
+    pub r: *mut ::BIGNUM,
+
+    pub flags: c_int,
+    pub method_mont_p: *mut ::BN_MONT_CTX,
+    pub references: c_int,
+    pub ex_data: ::CRYPTO_EX_DATA,
+    pub meth: *const ::DSA_METHOD,
+    pub engine: *mut ::ENGINE,
+}
+
+#[repr(C)]
+pub struct EVP_PKEY {
+    pub type_: c_int,
+    pub save_type: c_int,
+    pub references: c_int,
+    pub ameth: *const ::EVP_PKEY_ASN1_METHOD,
+    pub engine: *mut ::ENGINE,
+    pub pkey: *mut c_void,
+    pub save_parameters: c_int,
+    pub attributes: *mut stack_st_X509_ATTRIBUTE,
+}
+
+#[repr(C)]
+pub struct BIO {
+    pub method: *mut ::BIO_METHOD,
+    pub callback: Option<unsafe extern fn(*mut ::BIO,
+                                              c_int,
+                                              *const c_char,
+                                              c_int,
+                                              c_long,
+                                              c_long)
+                                              -> c_long>,
+    pub cb_arg: *mut c_char,
+    pub init: c_int,
+    pub shutdown: c_int,
+    pub flags: c_int,
+    pub retry_reason: c_int,
+    pub num: c_int,
+    pub ptr: *mut c_void,
+    pub next_bio: *mut ::BIO,
+    pub prev_bio: *mut ::BIO,
+    pub references: c_int,
+    pub num_read: c_ulong,
+    pub num_write: c_ulong,
+    pub ex_data: ::CRYPTO_EX_DATA,
+}
+
+#[repr(C)]
+pub struct CRYPTO_EX_DATA {
+    pub sk: *mut ::stack_st_void,
+}
+
+#[repr(C)]
+pub struct EVP_MD_CTX {
+    digest: *mut ::EVP_MD,
+    engine: *mut ::ENGINE,
+    flags: c_ulong,
+    md_data: *mut c_void,
+    pctx: *mut ::EVP_PKEY_CTX,
+    update: *mut c_void
+}
+
+#[repr(C)]
+pub struct EVP_CIPHER {
+    pub nid: c_int,
+    pub block_size: c_int,
+    pub key_len: c_int,
+    pub iv_len: c_int,
+    pub flags: c_ulong,
+    pub init: Option<unsafe extern fn(*mut ::EVP_CIPHER_CTX,
+                                      *const c_uchar,
+                                      *const c_uchar,
+                                      c_int) -> c_int>,
+    pub do_cipher: Option<unsafe extern fn(*mut ::EVP_CIPHER_CTX,
+                                           *mut c_uchar,
+                                           *const c_uchar,
+                                           size_t) -> c_int>,
+    pub cleanup: Option<unsafe extern fn(*mut ::EVP_CIPHER_CTX) -> c_int>,
+    pub ctx_size: c_int,
+    pub set_asn1_parameters: Option<unsafe extern fn(*mut ::EVP_CIPHER_CTX,
+                                                     *mut ::ASN1_TYPE) -> c_int>,
+    pub get_asn1_parameters: Option<unsafe extern fn(*mut ::EVP_CIPHER_CTX,
+                                                     *mut ::ASN1_TYPE) -> c_int>,
+    pub ctrl: Option<unsafe extern fn(*mut ::EVP_CIPHER_CTX,
+                                      c_int,
+                                      c_int,
+                                      *mut c_void) -> c_int>,
+    pub app_data: *mut c_void,
+}
+
+#[repr(C)]
+pub struct HMAC_CTX {
+    md: *mut ::EVP_MD,
+    md_ctx: ::EVP_MD_CTX,
+    i_ctx: ::EVP_MD_CTX,
+    o_ctx: ::EVP_MD_CTX,
+    key_length: c_uint,
+    key: [c_uchar; 128]
+}
+
+#[repr(C)]
+pub struct BIGNUM {
+    pub d: *mut ::BN_ULONG,
+    pub top: c_int,
+    pub dmax: c_int,
+    pub neg: c_int,
+    pub flags: c_int,
+}
+
+#[repr(C)]
+pub struct DH {
+    pub pad: c_int,
+    pub version: c_int,
+    pub p: *mut ::BIGNUM,
+    pub g: *mut ::BIGNUM,
+    pub length: c_long,
+    pub pub_key: *mut ::BIGNUM,
+    pub priv_key: *mut ::BIGNUM,
+    pub flags: c_int,
+    pub method_mont_p: *mut ::BN_MONT_CTX,
+    pub q: *mut ::BIGNUM,
+    pub j: *mut ::BIGNUM,
+    pub seed: *mut c_uchar,
+    pub seedlen: c_int,
+    pub counter: *mut ::BIGNUM,
+    pub references: c_int,
+    pub ex_data: ::CRYPTO_EX_DATA,
+    pub meth: *const ::DH_METHOD,
+    pub engine: *mut ::ENGINE,
+}
+
+#[repr(C)]
+pub struct X509 {
+    pub cert_info: *mut X509_CINF,
+    pub sig_alg: *mut ::X509_ALGOR,
+    pub signature: *mut ::ASN1_BIT_STRING,
+    pub valid: c_int,
+    pub references: c_int,
+    pub name: *mut c_char,
+    pub ex_data: ::CRYPTO_EX_DATA,
+    pub ex_pathlen: c_long,
+    pub ex_pcpathlen: c_long,
+    pub ex_flags: c_ulong,
+    pub ex_kusage: c_ulong,
+    pub ex_xkusage: c_ulong,
+    pub ex_nscert: c_ulong,
+    skid: *mut c_void,
+    akid: *mut c_void,
+    policy_cache: *mut c_void,
+    crldp: *mut c_void,
+    altname: *mut c_void,
+    nc: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_SHA"))]
+    sha1_hash: [c_uchar; 20],
+    aux: *mut c_void,
+}
+
+#[repr(C)]
+pub struct X509_CINF {
+    version: *mut c_void,
+    serialNumber: *mut c_void,
+    signature: *mut c_void,
+    issuer: *mut c_void,
+    pub validity: *mut X509_VAL,
+    subject: *mut c_void,
+    key: *mut c_void,
+    issuerUID: *mut c_void,
+    subjectUID: *mut c_void,
+    pub extensions: *mut stack_st_X509_EXTENSION,
+    enc: ASN1_ENCODING,
+}
+
+#[repr(C)]
+pub struct X509_ALGOR {
+    pub algorithm: *mut ::ASN1_OBJECT,
+    parameter: *mut c_void,
+}
+
+#[repr(C)]
+pub struct ASN1_ENCODING {
+    pub enc: *mut c_uchar,
+    pub len: c_long,
+    pub modified: c_int,
+}
+
+#[repr(C)]
+pub struct X509_VAL {
+    pub notBefore: *mut ::ASN1_TIME,
+    pub notAfter: *mut ::ASN1_TIME,
+}
+
+#[repr(C)]
+pub struct X509_REQ_INFO {
+    pub enc: ASN1_ENCODING,
+    pub version: *mut ::ASN1_INTEGER,
+    pub subject: *mut ::X509_NAME,
+    pubkey: *mut c_void,
+    pub attributes: *mut stack_st_X509_ATTRIBUTE
+}
+
+#[repr(C)]
+pub struct X509_REQ {
+    pub req_info: *mut X509_REQ_INFO,
+    sig_alg: *mut c_void,
+    signature: *mut c_void,
+    references: c_int
+}
+
+#[repr(C)]
+pub struct SSL {
+    version: c_int,
+    type_: c_int,
+    method: *const ::SSL_METHOD,
+    rbio: *mut c_void,
+    wbio: *mut c_void,
+    bbio: *mut c_void,
+    rwstate: c_int,
+    in_handshake: c_int,
+    handshake_func: Option<unsafe extern fn(*mut SSL) -> c_int>,
+    pub server: c_int,
+    new_session: c_int,
+    quiet_shutdown: c_int,
+    shutdown: c_int,
+    state: c_int,
+    rstate: c_int,
+    init_buf: *mut c_void,
+    init_msg: *mut c_void,
+    init_num: c_int,
+    init_off: c_int,
+    packet: *mut c_uchar,
+    packet_length: c_uint,
+    s3: *mut c_void,
+    d1: *mut c_void,
+    read_ahead: c_int,
+    msg_callback: Option<unsafe extern fn(c_int, c_int, c_int, *const c_void, size_t, *mut SSL, *mut c_void)>,
+    msg_callback_arg: *mut c_void,
+    hit: c_int,
+    param: *mut c_void,
+    cipher_list: *mut stack_st_SSL_CIPHER,
+    cipher_list_by_id: *mut stack_st_SSL_CIPHER,
+    mac_flags: c_int,
+    aead_read_ctx: *mut c_void,
+    enc_read_ctx: *mut ::EVP_CIPHER_CTX,
+    read_hash: *mut ::EVP_MD_CTX,
+    aead_write_ctx: *mut c_void,
+    enc_write_ctx: *mut ::EVP_CIPHER_CTX,
+    write_hash: *mut ::EVP_MD_CTX,
+    cert: *mut c_void,
+    sid_ctx_length: c_uint,
+    sid_ctx: [c_uchar; ::SSL_MAX_SID_CTX_LENGTH as usize],
+    session: *mut ::SSL_SESSION,
+    generate_session_id: ::GEN_SESSION_CB,
+    verify_mode: c_int,
+    verify_callback: Option<unsafe extern fn(c_int, *mut ::X509_STORE_CTX) -> c_int>,
+    info_callback: Option<unsafe extern fn(*mut SSL, c_int, c_int)>,
+    error: c_int,
+    error_code: c_int,
+    ctx: *mut ::SSL_CTX,
+    debug: c_int,
+    verify_result: c_long,
+    ex_data: ::CRYPTO_EX_DATA,
+    client_CA: *mut stack_st_X509_NAME,
+    references: c_int,
+    options: c_ulong,
+    mode: c_ulong,
+    max_cert_list: c_long,
+    first_packet: c_int,
+    client_version: c_int,
+    max_send_fragment: c_uint,
+    tlsext_debug_cb: Option<unsafe extern fn(*mut SSL, c_int, c_int, *mut c_uchar, c_int, *mut c_void)>,
+    tlsext_debug_arg: *mut c_void,
+    tlsext_hostname: *mut c_char,
+    servername_done: c_int,
+    tlsext_status_type: c_int,
+    tlsext_status_expected: c_int,
+    tlsext_ocsp_ids: *mut c_void,
+    tlsext_ocsp_exts: *mut c_void,
+    tlsext_ocsp_resp: *mut c_uchar,
+    tlsext_ocsp_resplen: c_int,
+    tlsext_ticket_expected: c_int,
+    tlsext_ecpointformatlist_length: size_t,
+    tlsext_ecpointformatlist: *mut c_uchar,
+    tlsext_ellipticcurvelist_length: size_t,
+    tlsext_ellipticcurvelist: *mut c_uchar,
+    tlsext_session_ticket: *mut c_void,
+    tlsext_session_ticket_ext_cb: ::tls_session_ticket_ext_cb_fn,
+    tls_session_ticket_ext_cb_arg: *mut c_void,
+    tls_session_secret_cb: ::tls_session_secret_cb_fn,
+    tls_session_secret_cb_arg: *mut c_void,
+    initial_ctx: *mut ::SSL_CTX,
+    next_proto_negotiated: *mut c_uchar,
+    next_proto_negotiated_len: c_uchar,
+    srtp_profiles: *mut c_void,
+    srtp_profile: *mut c_void,
+    tlsext_heartbeat: c_uint,
+    tlsext_hb_pending: c_uint,
+    tlsext_hb_seq: c_uint,
+    alpn_client_proto_list: *mut c_uchar,
+    alpn_client_proto_list_len: c_uint,
+    renegotiate: c_int,
+}
+
+#[repr(C)]
+pub struct SSL_CTX {
+    method: *mut c_void,
+    cipher_list: *mut c_void,
+    cipher_list_by_id: *mut c_void,
+    cert_store: *mut c_void,
+    sessions: *mut c_void,
+    session_cache_size: c_ulong,
+    session_cache_head: *mut c_void,
+    session_cache_tail: *mut c_void,
+    session_cache_mode: c_int,
+    session_timeout: c_long,
+    new_session_cb: *mut c_void,
+    remove_session_cb: *mut c_void,
+    get_session_cb: *mut c_void,
+    stats: [c_int; 11],
+    pub references: c_int,
+    app_verify_callback: *mut c_void,
+    app_verify_arg: *mut c_void,
+    default_passwd_callback: *mut c_void,
+    default_passwd_callback_userdata: *mut c_void,
+    client_cert_cb: *mut c_void,
+    app_gen_cookie_cb: *mut c_void,
+    app_verify_cookie_cb: *mut c_void,
+    ex_dat: ::CRYPTO_EX_DATA,
+    rsa_md5: *mut c_void,
+    md5: *mut c_void,
+    sha1: *mut c_void,
+    extra_certs: *mut c_void,
+    comp_methods: *mut c_void,
+    info_callback: *mut c_void,
+    client_CA: *mut c_void,
+    options: c_ulong,
+    mode: c_ulong,
+    max_cert_list: c_long,
+    cert: *mut c_void,
+    read_ahead: c_int,
+    msg_callback: *mut c_void,
+    msg_callback_arg: *mut c_void,
+    verify_mode: c_int,
+    sid_ctx_length: c_uint,
+    sid_ctx: [c_uchar; 32],
+    default_verify_callback: *mut c_void,
+    generate_session_id: *mut c_void,
+    param: *mut c_void,
+    quiet_shutdown: c_int,
+    max_send_fragment: c_uint,
+
+    #[cfg(not(osslconf = "OPENSSL_NO_ENGINE"))]
+    client_cert_engine: *mut c_void,
+
+    tlsext_servername_callback: *mut c_void,
+    tlsect_servername_arg: *mut c_void,
+    tlsext_tick_key_name: [c_uchar; 16],
+    tlsext_tick_hmac_key: [c_uchar; 16],
+    tlsext_tick_aes_key: [c_uchar; 16],
+    tlsext_ticket_key_cb: *mut c_void,
+    tlsext_status_cb: *mut c_void,
+    tlsext_status_arg: *mut c_void,
+    tlsext_opaque_prf_input_callback: *mut c_void,
+    tlsext_opaque_prf_input_callback_arg: *mut c_void,
+
+    next_protos_advertised_cb: *mut c_void,
+    next_protos_advertised_cb_arg: *mut c_void,
+    next_proto_select_cb: *mut c_void,
+    next_proto_select_cb_arg: *mut c_void,
+
+    srtp_profiles: *mut c_void,
+}
+
+#[repr(C)]
+pub struct SSL_SESSION {
+    ssl_version: c_int,
+    pub master_key_length: c_int,
+    pub master_key: [c_uchar; 48],
+    session_id_length: c_uint,
+    session_id: [c_uchar; SSL_MAX_SSL_SESSION_ID_LENGTH as usize],
+    sid_ctx_length: c_uint,
+    sid_ctx: [c_uchar; SSL_MAX_SID_CTX_LENGTH as usize],
+    not_resumable: c_int,
+    sess_cert: *mut c_void,
+    peer: *mut X509,
+    verify_result: c_long,
+    timeout: c_long,
+    time: time_t,
+    references: c_int,
+    cipher: *const c_void,
+    cipher_id: c_ulong,
+    ciphers: *mut c_void,
+    ex_data: ::CRYPTO_EX_DATA,
+    prev: *mut c_void,
+    next: *mut c_void,
+    tlsext_hostname: *mut c_char,
+    tlsext_ecpointformatlist_length: size_t,
+    tlsext_ecpointformatlist: *mut u8,
+    tlsext_ellipticcurvelist_length: size_t,
+    tlsext_ellipticcurvelist: *mut u16,
+    tlsext_tick: *mut c_uchar,
+    tlsext_ticklen: size_t,
+    tlsext_tick_lifetime_hint: c_long,
+}
+
+#[repr(C)]
+pub struct X509_VERIFY_PARAM {
+    pub name: *mut c_char,
+    pub check_time: time_t,
+    pub inh_flags: c_ulong,
+    pub flags: c_ulong,
+    pub purpose: c_int,
+    pub trust: c_int,
+    pub depth: c_int,
+    pub policies: *mut stack_st_ASN1_OBJECT,
+    //pub id: *mut X509_VERIFY_PARAM_ID,
+}
+
+pub enum X509_VERIFY_PARAM_ID {}
+pub enum PKCS12 {}
+
+pub const SSL_CTRL_OPTIONS: c_int = 32;
+pub const SSL_CTRL_CLEAR_OPTIONS: c_int = 77;
+pub const SSL_CTRL_SET_ECDH_AUTO: c_int = 94;
+
+pub const SSL_OP_ALL: c_ulong =                                     0x80000014;
+pub const SSL_OP_CISCO_ANYCONNECT: c_ulong =                        0x0;
+pub const SSL_OP_NO_COMPRESSION: c_ulong =                          0x0;
+pub const SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION: c_ulong =       0x0;
+pub const SSL_OP_NO_SSLv3: c_ulong =                                0x0;
+pub const SSL_OP_MICROSOFT_SESS_ID_BUG: c_ulong =                   0x0;
+pub const SSL_OP_NETSCAPE_CHALLENGE_BUG: c_ulong =                  0x0;
+pub const SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG: c_ulong =        0x0;
+pub const SSL_OP_MICROSOFT_BIG_SSLV3_BUFFER: c_ulong =              0x0;
+pub const SSL_OP_SSLEAY_080_CLIENT_DH_BUG: c_ulong =                0x0;
+pub const SSL_OP_TLS_D5_BUG: c_ulong =                              0x0;
+pub const SSL_OP_TLS_BLOCK_PADDING_BUG: c_ulong =                   0x0;
+pub const SSL_OP_SINGLE_ECDH_USE: c_ulong =                         0x00080000;
+pub const SSL_OP_SINGLE_DH_USE: c_ulong =                           0x00100000;
+pub const SSL_OP_NO_SSLv2: c_ulong =                                0x0;
+
+pub const SSL_MAX_SSL_SESSION_ID_LENGTH: c_int = 32;
+pub const SSL_MAX_SID_CTX_LENGTH: c_int = 32;
+pub const SSL_MAX_MASTER_KEY_LENGTH: c_int = 48;
+
+pub const SSLEAY_VERSION : c_int = 0;
+pub const SSLEAY_CFLAGS : c_int = 2;
+pub const SSLEAY_BUILT_ON : c_int = 3;
+pub const SSLEAY_PLATFORM : c_int = 4;
+pub const SSLEAY_DIR : c_int = 5;
+
+pub const CRYPTO_LOCK_X509: c_int = 3;
+pub const CRYPTO_LOCK_SSL_CTX: c_int = 12;
+
+static mut MUTEXES: *mut Vec<Mutex<()>> = 0 as *mut Vec<Mutex<()>>;
+static mut GUARDS: *mut Vec<Option<MutexGuard<'static, ()>>> = 0 as *mut Vec<Option<MutexGuard<'static, ()>>>;
+
+unsafe extern fn locking_function(mode: c_int, n: c_int, _file: *const c_char,
+                               _line: c_int) {
+    let mutex = &(*MUTEXES)[n as usize];
+
+    if mode & ::CRYPTO_LOCK != 0 {
+        (*GUARDS)[n as usize] = Some(mutex.lock().unwrap());
+    } else {
+        &(*GUARDS)[n as usize].take();
+    }
+}
+
+pub fn init() {
+    static INIT: Once = ONCE_INIT;
+
+    INIT.call_once(|| {
+        unsafe {
+            SSL_library_init();
+            SSL_load_error_strings();
+            OPENSSL_add_all_algorithms_noconf();
+
+            let num_locks = ::CRYPTO_num_locks();
+            let mut mutexes = Box::new(Vec::new());
+            for _ in 0..num_locks {
+                mutexes.push(Mutex::new(()));
+            }
+            MUTEXES = mem::transmute(mutexes);
+            let guards: Box<Vec<Option<MutexGuard<()>>>> =
+                Box::new((0..num_locks).map(|_| None).collect());
+            GUARDS = mem::transmute(guards);
+
+            CRYPTO_set_locking_callback(locking_function);
+            set_id_callback();
+        }
+    })
+}
+
+#[cfg(unix)]
+fn set_id_callback() {
+    unsafe extern fn thread_id() -> c_ulong {
+        ::libc::pthread_self() as c_ulong
+    }
+
+    unsafe {
+        CRYPTO_set_id_callback(thread_id);
+    }
+}
+
+#[cfg(not(unix))]
+fn set_id_callback() {}
+
+// macros
+
+pub unsafe fn SSL_CTX_set_ecdh_auto(ctx: *mut SSL_CTX, onoff: c_int) -> c_int {
+    ::SSL_CTX_ctrl(ctx, SSL_CTRL_SET_ECDH_AUTO, onoff as c_long, ::std::ptr::null_mut()) as c_int
+}
+
+pub unsafe fn SSL_set_ecdh_auto(ssl: *mut ::SSL, onoff: c_int) -> c_int {
+    ::SSL_ctrl(ssl, SSL_CTRL_SET_ECDH_AUTO, onoff as c_long, ::std::ptr::null_mut()) as c_int
+}
+
+extern {
+    pub fn BIO_new(type_: *mut BIO_METHOD) -> *mut BIO;
+    pub fn BIO_s_file() -> *mut BIO_METHOD;
+    pub fn BIO_s_mem() -> *mut BIO_METHOD;
+
+    pub fn get_rfc2409_prime_768(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc2409_prime_1024(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_1536(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_2048(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_3072(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_4096(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_6144(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_8192(bn: *mut BIGNUM) -> *mut BIGNUM;
+
+    pub fn CRYPTO_malloc(num: c_int, file: *const c_char, line: c_int) -> *mut c_void;
+    pub fn CRYPTO_free(buf: *mut c_void);
+    pub fn CRYPTO_num_locks() -> c_int;
+    pub fn CRYPTO_set_locking_callback(func: unsafe extern "C" fn(mode: c_int,
+                                                                  n: c_int,
+                                                                  file: *const c_char,
+                                                                  line: c_int));
+    pub fn CRYPTO_set_id_callback(func: unsafe extern "C" fn() -> c_ulong);
+
+    pub fn ERR_load_crypto_strings();
+
+    pub fn RSA_generate_key(modsz: c_int,
+                            e: c_ulong,
+                            cb: Option<extern fn(c_int, c_int, *mut c_void)>,
+                            cbarg: *mut c_void) -> *mut RSA;
+
+    pub fn OCSP_cert_to_id(dgst: *const ::EVP_MD, subject: *mut ::X509, issuer: *mut ::X509) -> *mut ::OCSP_CERTID;
+
+    pub fn PKCS12_create(pass: *mut c_char,
+                         friendly_name: *mut c_char,
+                         pkey: *mut EVP_PKEY,
+                         cert: *mut X509,
+                         ca: *mut stack_st_X509,
+                         nid_key: c_int,
+                         nid_cert: c_int,
+                         iter: c_int,
+                         mac_iter: c_int,
+                         keytype: c_int) -> *mut PKCS12;
+
+    pub fn SSL_library_init() -> c_int;
+    pub fn SSL_load_error_strings();
+    pub fn OPENSSL_add_all_algorithms_noconf();
+    pub fn HMAC_CTX_init(ctx: *mut ::HMAC_CTX);
+    pub fn HMAC_CTX_cleanup(ctx: *mut ::HMAC_CTX);
+    pub fn TLSv1_method() -> *const ::SSL_METHOD;
+    pub fn SSLv23_method() -> *const ::SSL_METHOD;
+    pub fn TLSv1_1_method() -> *const ::SSL_METHOD;
+    pub fn TLSv1_2_method() -> *const ::SSL_METHOD;
+    pub fn DTLSv1_method() -> *const ::SSL_METHOD;
+    pub fn SSL_get_ex_new_index(argl: c_long, argp: *mut c_void,
+                                new_func: Option<::CRYPTO_EX_new>,
+                                dup_func: Option<::CRYPTO_EX_dup>,
+                                free_func: Option<::CRYPTO_EX_free>)
+                                -> c_int;
+    pub fn SSL_set_tmp_ecdh_callback(ssl: *mut ::SSL,
+                                     ecdh: unsafe extern fn(ssl: *mut ::SSL,
+                                                            is_export: c_int,
+                                                            keylength: c_int)
+                                                            -> *mut ::EC_KEY);
+    pub fn SSL_CIPHER_get_version(cipher: *const ::SSL_CIPHER) -> *mut c_char;
+    pub fn SSL_CTX_get_ex_new_index(argl: c_long, argp: *mut c_void,
+                                    new_func: Option<::CRYPTO_EX_new>,
+                                    dup_func: Option<::CRYPTO_EX_dup>,
+                                    free_func: Option<::CRYPTO_EX_free>)
+                                    -> c_int;
+    pub fn SSL_CTX_set_tmp_ecdh_callback(ctx: *mut ::SSL_CTX,
+                                         ecdh: unsafe extern fn(ssl: *mut ::SSL,
+                                                                is_export: c_int,
+                                                                keylength: c_int)
+                                                                -> *mut ::EC_KEY);
+    pub fn X509_get_subject_name(x: *mut ::X509) -> *mut ::X509_NAME;
+    pub fn X509_set_notAfter(x: *mut ::X509, tm: *const ::ASN1_TIME) -> c_int;
+    pub fn X509_set_notBefore(x: *mut ::X509, tm: *const ::ASN1_TIME) -> c_int;
+    pub fn X509_get_ext_d2i(x: *mut ::X509, nid: c_int, crit: *mut c_int, idx: *mut c_int) -> *mut c_void;
+    pub fn X509_NAME_get_entry(n: *mut ::X509_NAME, loc: c_int) -> *mut ::X509_NAME_ENTRY;
+    pub fn X509_NAME_ENTRY_get_data(ne: *mut ::X509_NAME_ENTRY) -> *mut ::ASN1_STRING;
+    pub fn X509_STORE_CTX_get_chain(ctx: *mut ::X509_STORE_CTX) -> *mut stack_st_X509;
+    pub fn X509V3_EXT_nconf_nid(conf: *mut ::CONF, ctx: *mut ::X509V3_CTX, ext_nid: c_int, value: *mut c_char) -> *mut ::X509_EXTENSION;
+    pub fn X509V3_EXT_nconf(conf: *mut ::CONF, ctx: *mut ::X509V3_CTX, name: *mut c_char, value: *mut c_char) -> *mut ::X509_EXTENSION;
+    pub fn ASN1_STRING_to_UTF8(out: *mut *mut c_uchar, s: *mut ::ASN1_STRING) -> c_int;
+    pub fn ASN1_STRING_data(x: *mut ::ASN1_STRING) -> *mut c_uchar;
+    pub fn CRYPTO_add_lock(pointer: *mut c_int,
+                           amount: c_int,
+                           type_: c_int,
+                           file: *const c_char,
+                           line: c_int) -> c_int;
+    pub fn EVP_MD_CTX_create() -> *mut EVP_MD_CTX;
+    pub fn EVP_MD_CTX_destroy(ctx: *mut EVP_MD_CTX);
+    pub fn EVP_PKEY_bits(key: *mut EVP_PKEY) -> c_int;
+
+    pub fn sk_num(st: *const _STACK) -> c_int;
+    pub fn sk_value(st: *const _STACK, n: c_int) -> *mut c_void;
+    pub fn sk_free(st: *mut _STACK);
+    pub fn sk_pop_free(st: *mut _STACK, free: Option<unsafe extern "C" fn (*mut c_void)>);
+    pub fn sk_pop(st: *mut _STACK) -> *mut c_void;
+
+    pub fn SSLeay() -> c_ulong;
+    pub fn SSLeay_version(key: c_int) -> *const c_char;
+}
diff --git a/openssl-sys/src/ossl10x.rs b/openssl-sys/src/ossl10x.rs
index f552be01..128689e5 100644
--- a/openssl-sys/src/ossl10x.rs
+++ b/openssl-sys/src/ossl10x.rs
@@ -42,6 +42,16 @@ pub struct stack_st_void {
 }
 
 #[repr(C)]
+pub struct stack_st_SSL_CIPHER {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
+pub struct stack_st_OPENSSL_STRING {
+    pub stack: _STACK,
+}
+
+#[repr(C)]
 pub struct _STACK {
     pub num: c_int,
     pub data: *mut *mut c_char,
@@ -240,8 +250,8 @@ pub struct DH {
 #[repr(C)]
 pub struct X509 {
     pub cert_info: *mut X509_CINF,
-    sig_alg: *mut c_void,
-    signature: *mut c_void,
+    pub sig_alg: *mut ::X509_ALGOR,
+    pub signature: *mut ::ASN1_BIT_STRING,
     pub valid: c_int,
     pub references: c_int,
     pub name: *mut c_char,
@@ -283,6 +293,12 @@ pub struct X509_CINF {
 }
 
 #[repr(C)]
+pub struct X509_ALGOR {
+    pub algorithm: *mut ::ASN1_OBJECT,
+    parameter: *mut c_void,
+}
+
+#[repr(C)]
 pub struct ASN1_ENCODING {
     pub enc: *mut c_uchar,
     pub len: c_long,
@@ -296,6 +312,160 @@ pub struct X509_VAL {
 }
 
 #[repr(C)]
+pub struct X509_REQ_INFO {
+    pub enc: ASN1_ENCODING,
+    pub version: *mut ::ASN1_INTEGER,
+    pub subject: *mut ::X509_NAME,
+    pubkey: *mut c_void,
+    pub attributes: *mut stack_st_X509_ATTRIBUTE
+}
+
+#[repr(C)]
+pub struct X509_REQ {
+    pub req_info: *mut X509_REQ_INFO,
+    sig_alg: *mut c_void,
+    signature: *mut c_void,
+    references: c_int
+}
+
+#[repr(C)]
+pub struct SSL {
+    version: c_int,
+    type_: c_int,
+    method: *const ::SSL_METHOD,
+    rbio: *mut c_void,
+    wbio: *mut c_void,
+    bbio: *mut c_void,
+    rwstate: c_int,
+    in_handshake: c_int,
+    handshake_func: Option<unsafe extern fn(*mut SSL) -> c_int>,
+    pub server: c_int,
+    new_session: c_int,
+    quiet_session: c_int,
+    shutdown: c_int,
+    state: c_int,
+    rstate: c_int,
+    init_buf: *mut c_void,
+    init_msg: *mut c_void,
+    init_num: c_int,
+    init_off: c_int,
+    packet: *mut c_uchar,
+    packet_length: c_uint,
+    s2: *mut c_void,
+    s3: *mut c_void,
+    d1: *mut c_void,
+    read_ahead: c_int,
+    msg_callback: Option<unsafe extern fn(c_int, c_int, c_int, *const c_void, size_t, *mut SSL, *mut c_void)>,
+    msg_callback_arg: *mut c_void,
+    hit: c_int,
+    param: *mut c_void,
+    cipher_list: *mut stack_st_SSL_CIPHER,
+    cipher_list_by_id: *mut stack_st_SSL_CIPHER,
+    mac_flags: c_int,
+    enc_read_ctx: *mut ::EVP_CIPHER_CTX,
+    read_hash: *mut ::EVP_MD_CTX,
+    expand: *mut c_void,
+    enc_write_ctx: *mut ::EVP_CIPHER_CTX,
+    write_hash: *mut ::EVP_MD_CTX,
+    compress: *mut c_void,
+    cert: *mut c_void,
+    sid_ctx_length: c_uint,
+    sid_ctx: [c_uchar; ::SSL_MAX_SID_CTX_LENGTH as usize],
+    session: *mut ::SSL_SESSION,
+    generate_session_id: ::GEN_SESSION_CB,
+    verify_mode: c_int,
+    verify_callback: Option<unsafe extern fn(c_int, *mut ::X509_STORE_CTX) -> c_int>,
+    info_callback: Option<unsafe extern fn(*mut SSL, c_int, c_int)>,
+    error: c_int,
+    error_code: c_int,
+    #[cfg(not(osslconf = "OPENSSL_NO_KRB5"))]
+    kssl_ctx: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_PSK"))]
+    psk_client_callback: Option<unsafe extern fn(*mut SSL, *const c_char, *mut c_char, c_uint, *mut c_uchar, c_uint) -> c_uint>,
+    #[cfg(not(osslconf = "OPENSSL_NO_PSK"))]
+    psk_server_callback: Option<unsafe extern fn(*mut SSL, *const c_char, *mut c_uchar, c_uint) -> c_uint>,
+    ctx: *mut ::SSL_CTX,
+    debug: c_int,
+    verify_result: c_long,
+    ex_data: ::CRYPTO_EX_DATA,
+    client_CA: *mut stack_st_X509_NAME,
+    references: c_int,
+    options: c_ulong,
+    mode: c_ulong,
+    max_cert_list: c_long,
+    first_packet: c_int,
+    client_version: c_int,
+    max_send_fragment: c_uint,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_debug_cb: Option<unsafe extern fn(*mut SSL, c_int, c_int, *mut c_uchar, c_int, *mut c_void)>,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_debug_arg: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_hostname: *mut c_char,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    servername_done: c_int,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_status_type: c_int,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_status_expected: c_int,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_ocsp_ids: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_ocsp_exts: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_ocsp_resp: *mut c_uchar,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_ocsp_resplen: c_int,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_ticket_expected: c_int,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), not(osslconf = "OPENSSL_NO_EC")))]
+    tlsext_ecpointformatlist_length: size_t,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), not(osslconf = "OPENSSL_NO_EC")))]
+    tlsext_ecpointformatlist: *mut c_uchar,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), not(osslconf = "OPENSSL_NO_EC")))]
+    tlsext_ellipticcurvelist_length: size_t,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), not(osslconf = "OPENSSL_NO_EC")))]
+    tlsext_ellipticcurvelist: *mut c_uchar,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_opaque_prf_input: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_opaque_prf_input_len: size_t,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_session_ticket: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_session_ticket_ext_cb: ::tls_session_ticket_ext_cb_fn,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tls_session_ticket_ext_cb_arg: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tls_session_secret_cb: ::tls_session_secret_cb_fn,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tls_session_secret_cb_arg: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    initial_ctx: *mut ::SSL_CTX,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), not(osslconf = "OPENSSL_NO_NEXTPROTONEG")))]
+    next_proto_negotiated: *mut c_uchar,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), not(osslconf = "OPENSSL_NO_NEXTPROTONEG")))]
+    next_proto_negotiated_len: c_uchar,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    srtp_profiles: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    srtp_profile: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_heartbeat: c_uint,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_hb_pending: c_uint,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_hb_seq: c_uint,
+    renegotiate: c_int,
+    #[cfg(not(osslconf = "OPENSSL_NO_SRP"))]
+    srp_ctx: ::SRP_CTX,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), ossl102))]
+    alpn_client_proto_list: *mut c_uchar,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), ossl102))]
+    alpn_client_proto_list_len: c_uint,
+}
+
+#[repr(C)]
 pub struct SSL_CTX {
     method: *mut c_void,
     cipher_list: *mut c_void,
@@ -418,6 +588,59 @@ pub struct SSL_CTX {
 }
 
 #[repr(C)]
+pub struct SSL_SESSION {
+    ssl_version: c_int,
+    key_arg_length: c_uint,
+    key_arg: [c_uchar; SSL_MAX_KEY_ARG_LENGTH as usize],
+    pub master_key_length: c_int,
+    pub master_key: [c_uchar; 48],
+    session_id_length: c_uint,
+    session_id: [c_uchar; SSL_MAX_SSL_SESSION_ID_LENGTH as usize],
+    sid_ctx_length: c_uint,
+    sid_ctx: [c_uchar; SSL_MAX_SID_CTX_LENGTH as usize],
+    #[cfg(not(osslconf = "OPENSSL_NO_KRB5"))]
+    krb5_client_princ_len: c_uint,
+    #[cfg(not(osslconf = "OPENSSL_NO_KRB5"))]
+    krb5_client_princ: [c_uchar; SSL_MAX_KRB5_PRINCIPAL_LENGTH as usize],
+    #[cfg(not(osslconf = "OPENSSL_NO_PSK"))]
+    psk_identity_hint: *mut c_char,
+    #[cfg(not(osslconf = "OPENSSL_NO_PSK"))]
+    psk_identity: *mut c_char,
+    not_resumable: c_int,
+    sess_cert: *mut c_void,
+    peer: *mut X509,
+    verify_result: c_long,
+    references: c_int,
+    timeout: c_long,
+    time: c_long,
+    compress_meth: c_uint,
+    cipher: *const c_void,
+    cipher_id: c_ulong,
+    ciphers: *mut c_void,
+    ex_data: ::CRYPTO_EX_DATA,
+    prev: *mut c_void,
+    next: *mut c_void,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_hostname: *mut c_char,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), not(osslconf = "OPENSSL_NO_EC")))]
+    tlsext_ecpointformatlist_length: size_t,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), not(osslconf = "OPENSSL_NO_EC")))]
+    tlsext_ecpointformatlist: *mut c_uchar,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), not(osslconf = "OPENSSL_NO_EC")))]
+    tlsext_ellipticcurvelist_length: size_t,
+    #[cfg(all(not(osslconf = "OPENSSL_NO_TLSEXT"), not(osslconf = "OPENSSL_NO_EC")))]
+    tlsext_ellipticcurvelist: *mut c_uchar,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_tick: *mut c_uchar,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_ticklen: size_t,
+    #[cfg(not(osslconf = "OPENSSL_NO_TLSEXT"))]
+    tlsext_tick_lifetime_hint: c_long,
+    #[cfg(not(osslconf = "OPENSSL_NO_SRP"))]
+    srp_username: *mut c_char,
+}
+
+#[repr(C)]
 pub struct SRP_CTX {
     SRP_cb_arg: *mut c_void,
     TLS_ext_srp_username_callback: *mut c_void,
@@ -453,6 +676,7 @@ pub struct X509_VERIFY_PARAM {
 
 #[cfg(not(ossl101))]
 pub enum X509_VERIFY_PARAM_ID {}
+pub enum PKCS12 {}
 
 pub const SSL_CTRL_OPTIONS: c_int = 32;
 pub const SSL_CTRL_CLEAR_OPTIONS: c_int = 77;
@@ -470,6 +694,12 @@ pub const SSL_OP_SINGLE_ECDH_USE: c_ulong =                         0x00080000;
 pub const SSL_OP_SINGLE_DH_USE: c_ulong =                           0x00100000;
 pub const SSL_OP_NO_SSLv2: c_ulong =                                0x01000000;
 
+pub const SSL_MAX_SSL_SESSION_ID_LENGTH: c_int = 32;
+pub const SSL_MAX_SID_CTX_LENGTH: c_int = 32;
+pub const SSL_MAX_KEY_ARG_LENGTH: c_int = 8;
+pub const SSL_MAX_MASTER_KEY_LENGTH: c_int = 48;
+pub const SSL_MAX_KRB5_PRINCIPAL_LENGTH: c_int = 256;
+
 pub const SSLEAY_VERSION : c_int = 0;
 pub const SSLEAY_CFLAGS : c_int = 2;
 pub const SSLEAY_BUILT_ON : c_int = 3;
@@ -533,15 +763,32 @@ fn set_id_callback() {
 fn set_id_callback() {}
 
 // macros
+
 #[cfg(ossl102)]
 pub unsafe fn SSL_CTX_set_ecdh_auto(ctx: *mut SSL_CTX, onoff: c_int) -> c_int {
     ::SSL_CTX_ctrl(ctx, SSL_CTRL_SET_ECDH_AUTO, onoff as c_long, ::std::ptr::null_mut()) as c_int
 }
 
+#[cfg(ossl102)]
+pub unsafe fn SSL_set_ecdh_auto(ssl: *mut ::SSL, onoff: c_int) -> c_int {
+    ::SSL_ctrl(ssl, SSL_CTRL_SET_ECDH_AUTO, onoff as c_long, ::std::ptr::null_mut()) as c_int
+}
+
 extern {
     pub fn BIO_new(type_: *mut BIO_METHOD) -> *mut BIO;
     pub fn BIO_s_file() -> *mut BIO_METHOD;
     pub fn BIO_s_mem() -> *mut BIO_METHOD;
+
+    pub fn get_rfc2409_prime_768(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc2409_prime_1024(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_1536(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_2048(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_3072(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_4096(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_6144(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn get_rfc3526_prime_8192(bn: *mut BIGNUM) -> *mut BIGNUM;
+
+    pub fn CRYPTO_malloc(num: c_int, file: *const c_char, line: c_int) -> *mut c_void;
     pub fn CRYPTO_free(buf: *mut c_void);
     pub fn CRYPTO_num_locks() -> c_int;
     pub fn CRYPTO_set_locking_callback(func: unsafe extern "C" fn(mode: c_int,
@@ -557,6 +804,19 @@ extern {
                             cb: Option<extern fn(c_int, c_int, *mut c_void)>,
                             cbarg: *mut c_void) -> *mut RSA;
 
+    pub fn OCSP_cert_to_id(dgst: *const ::EVP_MD, subject: *mut ::X509, issuer: *mut ::X509) -> *mut ::OCSP_CERTID;
+
+    pub fn PKCS12_create(pass: *mut c_char,
+                         friendly_name: *mut c_char,
+                         pkey: *mut EVP_PKEY,
+                         cert: *mut X509,
+                         ca: *mut stack_st_X509,
+                         nid_key: c_int,
+                         nid_cert: c_int,
+                         iter: c_int,
+                         mac_iter: c_int,
+                         keytype: c_int) -> *mut PKCS12;
+
     pub fn SSL_library_init() -> c_int;
     pub fn SSL_load_error_strings();
     pub fn OPENSSL_add_all_algorithms_noconf();
@@ -576,17 +836,33 @@ extern {
                                 dup_func: Option<::CRYPTO_EX_dup>,
                                 free_func: Option<::CRYPTO_EX_free>)
                                 -> c_int;
+    pub fn SSL_set_tmp_ecdh_callback(ssl: *mut ::SSL,
+                                     ecdh: unsafe extern fn(ssl: *mut ::SSL,
+                                                            is_export: c_int,
+                                                            keylength: c_int)
+                                                            -> *mut ::EC_KEY);
     pub fn SSL_CIPHER_get_version(cipher: *const ::SSL_CIPHER) -> *mut c_char;
     pub fn SSL_CTX_get_ex_new_index(argl: c_long, argp: *mut c_void,
                                     new_func: Option<::CRYPTO_EX_new>,
                                     dup_func: Option<::CRYPTO_EX_dup>,
                                     free_func: Option<::CRYPTO_EX_free>)
                                     -> c_int;
+    pub fn SSL_CTX_set_tmp_ecdh_callback(ctx: *mut ::SSL_CTX,
+                                         ecdh: unsafe extern fn(ssl: *mut ::SSL,
+                                                                is_export: c_int,
+                                                                keylength: c_int)
+                                                                -> *mut ::EC_KEY);
     pub fn X509_get_subject_name(x: *mut ::X509) -> *mut ::X509_NAME;
     pub fn X509_set_notAfter(x: *mut ::X509, tm: *const ::ASN1_TIME) -> c_int;
     pub fn X509_set_notBefore(x: *mut ::X509, tm: *const ::ASN1_TIME) -> c_int;
     pub fn X509_get_ext_d2i(x: *mut ::X509, nid: c_int, crit: *mut c_int, idx: *mut c_int) -> *mut c_void;
     pub fn X509_NAME_add_entry_by_NID(x: *mut ::X509_NAME, field: c_int, ty: c_int, bytes: *mut c_uchar, len: c_int, loc: c_int, set: c_int) -> c_int;
+    #[cfg(not(ossl101))]
+    pub fn X509_get0_signature(psig: *mut *mut ::ASN1_BIT_STRING, palg: *mut *mut ::X509_ALGOR, x: *const ::X509);
+    #[cfg(not(ossl101))]
+    pub fn X509_get_signature_nid(x: *const X509) -> c_int;
+    #[cfg(not(ossl101))]
+    pub fn X509_ALGOR_get0(paobj: *mut *mut ::ASN1_OBJECT, pptype: *mut c_int, ppval: *mut *mut c_void, alg: *mut ::X509_ALGOR);
     pub fn X509_NAME_get_entry(n: *mut ::X509_NAME, loc: c_int) -> *mut ::X509_NAME_ENTRY;
     pub fn X509_NAME_ENTRY_get_data(ne: *mut ::X509_NAME_ENTRY) -> *mut ::ASN1_STRING;
     pub fn X509_STORE_CTX_get_chain(ctx: *mut ::X509_STORE_CTX) -> *mut stack_st_X509;
@@ -601,6 +877,7 @@ extern {
                            line: c_int) -> c_int;
     pub fn EVP_MD_CTX_create() -> *mut EVP_MD_CTX;
     pub fn EVP_MD_CTX_destroy(ctx: *mut EVP_MD_CTX);
+    pub fn EVP_PKEY_bits(key: *mut EVP_PKEY) -> c_int;
 
     pub fn sk_new_null() -> *mut _STACK;
     pub fn sk_num(st: *const _STACK) -> c_int;
diff --git a/openssl-sys/src/ossl110.rs b/openssl-sys/src/ossl110.rs
index eca4c84e..24ac47d2 100644
--- a/openssl-sys/src/ossl110.rs
+++ b/openssl-sys/src/ossl110.rs
@@ -1,4 +1,4 @@
-use libc::{c_int, c_void, c_char, c_uchar, c_ulong, c_long, c_uint};
+use libc::{c_int, c_void, c_char, c_uchar, c_ulong, c_long, c_uint, size_t};
 
 pub enum BIGNUM {}
 pub enum BIO {}
@@ -11,8 +11,11 @@ pub enum EVP_MD_CTX {}
 pub enum EVP_PKEY {}
 pub enum HMAC_CTX {}
 pub enum OPENSSL_STACK {}
+pub enum PKCS12 {}
 pub enum RSA {}
+pub enum SSL {}
 pub enum SSL_CTX {}
+pub enum SSL_SESSION {}
 pub enum stack_st_ASN1_OBJECT {}
 pub enum stack_st_GENERAL_NAME {}
 pub enum stack_st_OPENSSL_STRING {}
@@ -21,8 +24,11 @@ pub enum stack_st_X509 {}
 pub enum stack_st_X509_NAME {}
 pub enum stack_st_X509_ATTRIBUTE {}
 pub enum stack_st_X509_EXTENSION {}
+pub enum stack_st_SSL_CIPHER {}
 pub enum X509 {}
+pub enum X509_ALGOR {}
 pub enum X509_VERIFY_PARAM {}
+pub enum X509_REQ {}
 
 pub const SSL_OP_MICROSOFT_SESS_ID_BUG: c_ulong =                   0x00000000;
 pub const SSL_OP_NETSCAPE_CHALLENGE_BUG: c_ulong =                  0x00000000;
@@ -52,9 +58,27 @@ extern {
     pub fn BIO_new(type_: *const BIO_METHOD) -> *mut BIO;
     pub fn BIO_s_file() -> *const BIO_METHOD;
     pub fn BIO_s_mem() -> *const BIO_METHOD;
+
+    pub fn BN_get_rfc2409_prime_768(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn BN_get_rfc2409_prime_1024(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn BN_get_rfc3526_prime_1536(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn BN_get_rfc3526_prime_2048(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn BN_get_rfc3526_prime_3072(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn BN_get_rfc3526_prime_4096(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn BN_get_rfc3526_prime_6144(bn: *mut BIGNUM) -> *mut BIGNUM;
+    pub fn BN_get_rfc3526_prime_8192(bn: *mut BIGNUM) -> *mut BIGNUM;
+
+    pub fn CRYPTO_malloc(num: size_t, file: *const c_char, line: c_int) -> *mut c_void;
     pub fn CRYPTO_free(buf: *mut c_void, file: *const c_char, line: c_int);
+
+    pub fn EVP_chacha20() -> *const ::EVP_CIPHER;
+    pub fn EVP_chacha20_poly1305() -> *const ::EVP_CIPHER;
+
     pub fn HMAC_CTX_new() -> *mut HMAC_CTX;
     pub fn HMAC_CTX_free(ctx: *mut HMAC_CTX);
+
+    pub fn OCSP_cert_to_id(dgst: *const ::EVP_MD, subject: *const ::X509, issuer: *const ::X509) -> *mut ::OCSP_CERTID;
+
     pub fn TLS_method() -> *const ::SSL_METHOD;
     pub fn DTLS_method() -> *const ::SSL_METHOD;
     pub fn SSL_CIPHER_get_version(cipher: *const ::SSL_CIPHER) -> *const c_char;
@@ -63,6 +87,8 @@ extern {
     pub fn X509_set1_notBefore(x: *mut ::X509, tm: *const ::ASN1_TIME) -> c_int;
     pub fn X509_get_ext_d2i(x: *const ::X509, nid: c_int, crit: *mut c_int, idx: *mut c_int) -> *mut c_void;
     pub fn X509_NAME_add_entry_by_NID(x: *mut ::X509_NAME, field: c_int, ty: c_int, bytes: *const c_uchar, len: c_int, loc: c_int, set: c_int) -> c_int;
+    pub fn X509_get_signature_nid(x: *const X509) -> c_int;
+    pub fn X509_ALGOR_get0(paobj: *mut *const ::ASN1_OBJECT, pptype: *mut c_int, ppval: *mut *const c_void, alg: *const ::X509_ALGOR);
     pub fn X509_NAME_get_entry(n: *const ::X509_NAME, loc: c_int) -> *mut ::X509_NAME_ENTRY;
     pub fn X509_NAME_ENTRY_get_data(ne: *const ::X509_NAME_ENTRY) -> *mut ::ASN1_STRING;
     pub fn X509V3_EXT_nconf_nid(conf: *mut ::CONF, ctx: *mut ::X509V3_CTX, ext_nid: c_int, value: *const c_char) -> *mut ::X509_EXTENSION;
@@ -106,6 +132,7 @@ extern {
     pub fn SSL_CTX_clear_options(ctx: *mut ::SSL_CTX, op: c_ulong) -> c_ulong;
     pub fn X509_getm_notAfter(x: *const ::X509) -> *mut ::ASN1_TIME;
     pub fn X509_getm_notBefore(x: *const ::X509) -> *mut ::ASN1_TIME;
+    pub fn X509_get0_signature(psig: *mut *const ::ASN1_BIT_STRING, palg: *mut *const ::X509_ALGOR, x: *const ::X509);
     pub fn DH_set0_pqg(dh: *mut ::DH,
                        p: *mut ::BIGNUM,
                        q: *mut ::BIGNUM,
@@ -144,10 +171,15 @@ extern {
                                    -> c_int;
     pub fn X509_up_ref(x: *mut X509) -> c_int;
     pub fn SSL_CTX_up_ref(x: *mut SSL_CTX) -> c_int;
+    pub fn SSL_SESSION_get_master_key(session: *const SSL_SESSION,
+                                      out: *mut c_uchar,
+                                      outlen: size_t)
+                                      -> size_t;
     pub fn X509_get0_extensions(req: *const ::X509) -> *const stack_st_X509_EXTENSION;
     pub fn X509_STORE_CTX_get0_chain(ctx: *mut ::X509_STORE_CTX) -> *mut stack_st_X509;
     pub fn EVP_MD_CTX_new() -> *mut EVP_MD_CTX;
     pub fn EVP_MD_CTX_free(ctx: *mut EVP_MD_CTX);
+    pub fn EVP_PKEY_bits(key: *const EVP_PKEY) -> c_int;
 
     pub fn OpenSSL_version_num() -> c_ulong;
     pub fn OpenSSL_version(key: c_int) -> *const c_char;
@@ -156,4 +188,17 @@ extern {
     pub fn OPENSSL_sk_pop_free(st: *mut ::OPENSSL_STACK, free: Option<unsafe extern "C" fn (*mut c_void)>);
     pub fn OPENSSL_sk_push(st: *mut ::OPENSSL_STACK, data: *const c_void) -> c_int;
     pub fn OPENSSL_sk_pop(st: *mut ::OPENSSL_STACK) -> *mut c_void;
+
+    pub fn PKCS12_create(pass: *const c_char,
+                         friendly_name: *const c_char,
+                         pkey: *mut EVP_PKEY,
+                         cert: *mut X509,
+                         ca: *mut stack_st_X509,
+                         nid_key: c_int,
+                         nid_cert: c_int,
+                         iter: c_int,
+                         mac_iter: c_int,
+                         keytype: c_int) -> *mut PKCS12;
+    pub fn X509_REQ_get_version(req: *const X509_REQ) -> c_long;
+    pub fn X509_REQ_get_subject_name(req: *const X509_REQ) -> *mut ::X509_NAME;
 }