diff --git a/lib/dns/Makefile.in b/lib/dns/Makefile.in
index 3eb23131f9..0cb12c1094 100644
--- a/lib/dns/Makefile.in
+++ b/lib/dns/Makefile.in
@@ -46,7 +46,7 @@ OPENSSLOBJS =	sec/openssl/bn_add.@O@ sec/openssl/bn_asm.@O@ \
 		sec/openssl/bn_comba.@O@ sec/openssl/bn_div.@O@ \
 		sec/openssl/bn_err.@O@ sec/openssl/bn_exp.@O@ \
 		sec/openssl/bn_exp2.@O@ sec/openssl/bn_gcd.@O@ \
-		sec/openssl/bn_lib.@O@ sec/openssl/bn_m.@O@ \
+		sec/openssl/bn_lib.@O@ \
 		sec/openssl/bn_mont.@O@ sec/openssl/bn_mul.@O@ \
 		sec/openssl/bn_prime.@O@ sec/openssl/bn_rand.@O@ \
 		sec/openssl/bn_recp.@O@ sec/openssl/bn_shift.@O@ \
diff --git a/lib/dns/sec/openssl/Makefile.in b/lib/dns/sec/openssl/Makefile.in
index 40ec3a7727..2350430fe2 100644
--- a/lib/dns/sec/openssl/Makefile.in
+++ b/lib/dns/sec/openssl/Makefile.in
@@ -38,7 +38,7 @@ LIBS =		@LIBS@
 # Alphabetically
 OBJS =		bn_add.@O@ bn_asm.@O@ bn_comba.@O@ bn_div.@O@ \
 		bn_err.@O@ bn_exp.@O@ bn_exp2.@O@ bn_gcd.@O@ \
-		bn_lib.@O@ bn_m.@O@ bn_mont.@O@ bn_mul.@O@ \
+		bn_lib.@O@ bn_mont.@O@ bn_mul.@O@ \
 		bn_prime.@O@ bn_rand.@O@ bn_recp.@O@ \
 		bn_shift.@O@ bn_sqr.@O@ bn_word.@O@ buffer.@O@ \
 		cryptlib.@O@ dsa_asn1.@O@ dsa_err.@O@ dsa_gen.@O@ \
@@ -49,7 +49,7 @@ OBJS =		bn_add.@O@ bn_asm.@O@ bn_comba.@O@ bn_div.@O@ \
 
 SRCS =		bn_add.c bn_asm.c bn_comba.c bn_div.c \
 		bn_err.c bn_exp.c bn_exp2.c bn_gcd.c \
-		bn_lib.c bn_m.c bn_mont.c bn_mul.c \
+		bn_lib.c bn_mont.c bn_mul.c \
 		bn_prime.c bn_rand.c bn_recp.c \
 		bn_shift.c bn_sqr.c bn_word.c buffer.c \
 		cryptlib.c dsa_asn1.c dsa_err.c dsa_gen.c \
diff --git a/lib/dns/sec/openssl/bn_add.c b/lib/dns/sec/openssl/bn_add.c
index cd7d48d71e..c5ab066c9e 100644
--- a/lib/dns/sec/openssl/bn_add.c
+++ b/lib/dns/sec/openssl/bn_add.c
@@ -104,12 +104,12 @@ int BN_add(BIGNUM *r, BIGNUM *a, BIGNUM *b)
 	}
 
 /* unsigned add of b to a, r must be large enough */
-int BN_uadd(BIGNUM *r, BIGNUM *a, BIGNUM *b)
+int BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
 	{
 	register int i;
 	int max,min;
 	BN_ULONG *ap,*bp,*rp,carry,t1;
-	BIGNUM *tmp;
+	const BIGNUM *tmp;
 
 	bn_check_top(a);
 	bn_check_top(b);
@@ -164,7 +164,7 @@ int BN_uadd(BIGNUM *r, BIGNUM *a, BIGNUM *b)
 	}
 
 /* unsigned subtraction of b from a, a must be larger than b. */
-int BN_usub(BIGNUM *r, BIGNUM *a, BIGNUM *b)
+int BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
 	{
 	int max,min;
 	register BN_ULONG t1,t2,*ap,*bp,*rp;
@@ -255,11 +255,11 @@ int BN_usub(BIGNUM *r, BIGNUM *a, BIGNUM *b)
 	return(1);
 	}
 
-int BN_sub(BIGNUM *r, BIGNUM *a, BIGNUM *b)
+int BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b)
 	{
 	int max;
 	int add=0,neg=0;
-	BIGNUM *tmp;
+	const BIGNUM *tmp;
 
 	bn_check_top(a);
 	bn_check_top(b);
diff --git a/lib/dns/sec/openssl/bn_asm.c b/lib/dns/sec/openssl/bn_asm.c
index 7f4c3ff3b2..4d3da16a0c 100644
--- a/lib/dns/sec/openssl/bn_asm.c
+++ b/lib/dns/sec/openssl/bn_asm.c
@@ -264,18 +264,20 @@ BN_ULONG bn_div_words(BN_ULONG h, BN_ULONG l, BN_ULONG d)
 		else
 			q=h/dh;
 
+		th=q*dh;
+		tl=dl*q;
 		for (;;)
 			{
-			t=(h-q*dh);
+			t=h-th;
 			if ((t&BN_MASK2h) ||
-				((dl*q) <= (
-					(t<<BN_BITS4)+
+				((tl) <= (
+					(t<<BN_BITS4)|
 					((l&BN_MASK2h)>>BN_BITS4))))
 				break;
 			q--;
+			th-=dh;
+			tl-=dl;
 			}
-		th=q*dh;
-		tl=q*dl;
 		t=(tl>>BN_BITS4);
 		tl=(tl<<BN_BITS4)&BN_MASK2h;
 		th+=t;
diff --git a/lib/dns/sec/openssl/bn_div.c b/lib/dns/sec/openssl/bn_div.c
index bffa9f3e61..150dd289a5 100644
--- a/lib/dns/sec/openssl/bn_div.c
+++ b/lib/dns/sec/openssl/bn_div.c
@@ -57,6 +57,7 @@
  */
 
 #include <stdio.h>
+#include <openssl/bn.h>
 #include "cryptlib.h"
 #include "bn_lcl.h"
 
@@ -117,8 +118,8 @@ int BN_div(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BIGNUM *d, BN_CTX *ctx)
 
 #else
 
-int BN_div(BIGNUM *dv, BIGNUM *rm, BIGNUM *num, BIGNUM *divisor,
-	     BN_CTX *ctx)
+int BN_div(BIGNUM *dv, BIGNUM *rm, const BIGNUM *num, const BIGNUM *divisor,
+	   BN_CTX *ctx)
 	{
 	int norm_shift,i,j,loop;
 	BIGNUM *tmp,wnum,*snum,*sdiv,*res;
@@ -199,56 +200,98 @@ int BN_div(BIGNUM *dv, BIGNUM *rm, BIGNUM *num, BIGNUM *divisor,
 
 	for (i=0; i<loop-1; i++)
 		{
-		BN_ULONG q,n0,n1;
-		BN_ULONG l0;
+		BN_ULONG q,l0;
+#ifdef BN_DIV3W
+		q=bn_div_3_words(wnump,d0,d1);
+#else
+
+#if !defined(NO_ASM) && !defined(PEDANTIC)
+# if defined(__GNUC__) && __GNUC__>=2
+#  if defined(__i386)
+   /*
+    * There were two reasons for implementing this template:
+    * - GNU C generates a call to a function (__udivdi3 to be exact)
+    *   in reply to ((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0 (I fail to
+    *   understand why...);
+    * - divl doesn't only calculate quotient, but also leaves
+    *   remainder in %edx which we can definitely use here:-)
+    *
+    *					<appro@fy.chalmers.se>
+    */
+#  define bn_div_words(n0,n1,d0)		\
+	({  asm volatile (			\
+		"divl	%4"			\
+		: "=a"(q), "=d"(rem)		\
+		: "a"(n1), "d"(n0), "g"(d0)	\
+		: "cc");			\
+	    q;					\
+	})
+#  define REMINDER_IS_ALREADY_CALCULATED
+#  endif /* __<cpu> */
+# endif /* __GNUC__ */
+#endif /* NO_ASM */
+		BN_ULONG n0,n1,rem=0;
 
-		wnum.d--; wnum.top++;
 		n0=wnump[0];
 		n1=wnump[-1];
 		if (n0 == d0)
 			q=BN_MASK2;
 		else
+#if defined(BN_LLONG) && defined(BN_DIV2W) && !defined(bn_div_words)
+			q=((((BN_ULLONG)n0)<<BN_BITS2)|n1)/d0;
+#else
 			q=bn_div_words(n0,n1,d0);
+#endif
 		{
 #ifdef BN_LLONG
-		BN_ULLONG t1,t2,rem;
-		t1=((BN_ULLONG)n0<<BN_BITS2)|n1;
+		BN_ULLONG t2;
+
+#ifndef REMINDER_IS_ALREADY_CALCULATED
+		/*
+		 * rem doesn't have to be BN_ULLONG. The least we
+		 * know it's less that d0, isn't it?
+		 */
+		rem=(n1-q*d0)&BN_MASK2;
+#endif
+		t2=(BN_ULLONG)d1*q;
+
 		for (;;)
 			{
-			t2=(BN_ULLONG)d1*q;
-			rem=t1-(BN_ULLONG)q*d0;
-			if ((rem>>BN_BITS2) ||
-				(t2 <= ((BN_ULLONG)(rem<<BN_BITS2)+wnump[-2])))
+                        if (t2 <= ((((BN_ULLONG)rem)<<BN_BITS2)|wnump[-2]))
 				break;
 			q--;
+			rem += d0;
+			if (rem < d0) break; /* don't let rem overflow */
+			t2 -= d1;
 			}
 #else
-		BN_ULONG t1l,t1h,t2l,t2h,t3l,t3h,ql,qh,t3t;
-		t1h=n0;
-		t1l=n1;
+		BN_ULONG t2l,t2h,ql,qh;
+
+#ifndef REMINDER_IS_ALREADY_CALCULATED
+		/*
+		 * It's more than enough with the only multiplication.
+		 * See the comment above in BN_LLONG section...
+		 */
+		rem=(n1-q*d0)&BN_MASK2;
+#endif
+		t2l=LBITS(d1); t2h=HBITS(d1);
+		ql =LBITS(q);  qh =HBITS(q);
+		mul64(t2l,t2h,ql,qh); /* t2=(BN_ULLONG)d1*q; */
+
 		for (;;)
 			{
-			t2l=LBITS(d1); t2h=HBITS(d1);
-			ql =LBITS(q);  qh =HBITS(q);
-			mul64(t2l,t2h,ql,qh); /* t2=(BN_ULLONG)d1*q; */
-
-			t3t=LBITS(d0); t3h=HBITS(d0);
-			mul64(t3t,t3h,ql,qh); /* t3=t1-(BN_ULLONG)q*d0; */
-			t3l=(t1l-t3t)&BN_MASK2;
-			if (t3l > t1l) t3h++;
-			t3h=(t1h-t3h)&BN_MASK2;
-
-			/*if ((t3>>BN_BITS2) ||
-				(t2 <= ((t3<<BN_BITS2)+wnump[-2])))
-				break; */
-			if (t3h) break;
-			if (t2h < t3l) break;
-			if ((t2h == t3l) && (t2l <= wnump[-2])) break;
-
+			if ((t2h < rem) ||
+				((t2h == rem) && (t2l <= wnump[-2])))
+				break;
 			q--;
+			rem += d0;
+			if (rem < d0) break; /* don't let rem overflow */
+			if (t2l < d1) t2h--; t2l -= d1;
 			}
 #endif
 		}
+#endif /* !BN_DIV3W */
+		wnum.d--; wnum.top++;
 		l0=bn_mul_words(tmp->d,sdiv->d,div_n,q);
 		tmp->d[div_n]=l0;
 		for (j=div_n+1; j>0; j--)
@@ -283,7 +326,7 @@ err:
 #endif
 
 /* rem != m */
-int BN_mod(BIGNUM *rem, BIGNUM *m, BIGNUM *d, BN_CTX *ctx)
+int BN_mod(BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx)
 	{
 #if 0 /* The old slow way */
 	int i,nm,nd;
diff --git a/lib/dns/sec/openssl/bn_exp.c b/lib/dns/sec/openssl/bn_exp.c
index 9833037384..2df1614ada 100644
--- a/lib/dns/sec/openssl/bn_exp.c
+++ b/lib/dns/sec/openssl/bn_exp.c
@@ -63,7 +63,7 @@
 #define TABLE_SIZE	16
 
 /* slow but works */
-int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, BIGNUM *m, BN_CTX *ctx)
+int BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx)
 	{
 	BIGNUM *t;
 	int r=0;
@@ -154,7 +154,8 @@ err:
 	return(ret);
 	}
 
-int BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
+int BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p, const BIGNUM *m,
+	       BN_CTX *ctx)
 	{
 	int ret;
 
@@ -183,7 +184,8 @@ int BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
 	}
 
 /* #ifdef RECP_MUL_MOD */
-int BN_mod_exp_recp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx)
+int BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+		    const BIGNUM *m, BN_CTX *ctx)
 	{
 	int i,j,bits,ret=0,wstart,wend,window,wvalue;
 	int start=1,ts=0;
@@ -296,12 +298,13 @@ err:
 /* #endif */
 
 /* #ifdef MONT_MUL_MOD */
-int BN_mod_exp_mont(BIGNUM *rr, BIGNUM *a, BIGNUM *p, BIGNUM *m, BN_CTX *ctx,
-	     BN_MONT_CTX *in_mont)
+int BN_mod_exp_mont(BIGNUM *rr, BIGNUM *a, const BIGNUM *p,
+		    const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
 	{
 	int i,j,bits,ret=0,wstart,wend,window,wvalue;
 	int start=1,ts=0;
-	BIGNUM *d,*aa,*r;
+	BIGNUM *d,*r;
+	BIGNUM *aa;
 	BIGNUM val[TABLE_SIZE];
 	BN_MONT_CTX *mont=NULL;
 
diff --git a/lib/dns/sec/openssl/bn_gcd.c b/lib/dns/sec/openssl/bn_gcd.c
index 6aac204433..64a76f4498 100644
--- a/lib/dns/sec/openssl/bn_gcd.c
+++ b/lib/dns/sec/openssl/bn_gcd.c
@@ -140,7 +140,7 @@ err:
 	}
 
 /* solves ax == 1 (mod n) */
-BIGNUM *BN_mod_inverse(BIGNUM *in, BIGNUM *a, BIGNUM *n, BN_CTX *ctx)
+BIGNUM *BN_mod_inverse(BIGNUM *in, BIGNUM *a, const BIGNUM *n, BN_CTX *ctx)
 	{
 	BIGNUM *A,*B,*X,*Y,*M,*D,*R;
 	BIGNUM *T,*ret=NULL;
diff --git a/lib/dns/sec/openssl/bn_lib.c b/lib/dns/sec/openssl/bn_lib.c
index 64c9fd9dc1..ee85603024 100644
--- a/lib/dns/sec/openssl/bn_lib.c
+++ b/lib/dns/sec/openssl/bn_lib.c
@@ -84,28 +84,28 @@ void BN_set_params(int mult, int high, int low, int mont)
 	{
 	if (mult >= 0)
 		{
-		if (mult > (sizeof(int)*8)-1)
+		if ((unsigned int)mult > (sizeof(int)*8)-1)
 			mult=sizeof(int)*8-1;
 		bn_limit_bits=mult;
 		bn_limit_num=1<<mult;
 		}
 	if (high >= 0)
 		{
-		if (high > (sizeof(int)*8)-1)
+		if ((unsigned int)high > (sizeof(int)*8)-1)
 			high=sizeof(int)*8-1;
 		bn_limit_bits_high=high;
 		bn_limit_num_high=1<<high;
 		}
 	if (low >= 0)
 		{
-		if (low > (sizeof(int)*8)-1)
+		if ((unsigned int)low > (sizeof(int)*8)-1)
 			low=sizeof(int)*8-1;
 		bn_limit_bits_low=low;
 		bn_limit_num_low=1<<low;
 		}
 	if (mont >= 0)
 		{
-		if (mont > (sizeof(int)*8)-1)
+		if ((unsigned int)mont > (sizeof(int)*8)-1)
 			mont=sizeof(int)*8-1;
 		bn_limit_bits_mont=mont;
 		bn_limit_num_mont=1<<mont;
@@ -235,7 +235,7 @@ int BN_num_bits_word(BN_ULONG l)
 		}
 	}
 
-int BN_num_bits(BIGNUM *a)
+int BN_num_bits(const BIGNUM *a)
 	{
 	BN_ULONG l;
 	int i;
@@ -485,10 +485,12 @@ BIGNUM *bn_expand2(BIGNUM *b, int words)
 	return(b);
 	}
 
-BIGNUM *BN_dup(BIGNUM *a)
+BIGNUM *BN_dup(const BIGNUM *a)
 	{
 	BIGNUM *r;
 
+	if (a == NULL) return NULL;
+
 	bn_check_top(a);
 
 	r=BN_new();
@@ -496,7 +498,7 @@ BIGNUM *BN_dup(BIGNUM *a)
 	return((BIGNUM *)BN_copy(r,a));
 	}
 
-BIGNUM *BN_copy(BIGNUM *a, BIGNUM *b)
+BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b)
 	{
 	int i;
 	BN_ULONG *A;
@@ -549,7 +551,7 @@ BN_ULONG BN_get_word(BIGNUM *a)
 	BN_ULONG ret=0;
 
 	n=BN_num_bytes(a);
-	if (n > sizeof(BN_ULONG))
+	if ((unsigned int)n > sizeof(BN_ULONG))
 		return(BN_MASK2);
 	for (i=a->top-1; i>=0; i--)
 		{
@@ -567,7 +569,7 @@ BN_ULONG BN_get_word(BIGNUM *a)
 int BN_set_word(BIGNUM *a, BN_ULONG w)
 	{
 	int i,n;
-	if (bn_expand(a,sizeof(BN_ULONG)*8) == NULL) return(0);
+	if (bn_expand(a,(int)sizeof(BN_ULONG)*8) == NULL) return(0);
 
 	n=sizeof(BN_ULONG)/BN_BYTES;
 	a->neg=0;
@@ -629,7 +631,7 @@ BIGNUM *BN_bin2bn(const unsigned char *s, int len, BIGNUM *ret)
 	}
 
 /* ignore negative */
-int BN_bn2bin(BIGNUM *a, unsigned char *to)
+int BN_bn2bin(const BIGNUM *a, unsigned char *to)
 	{
 	int n,i;
 	BN_ULONG l;
@@ -643,7 +645,7 @@ int BN_bn2bin(BIGNUM *a, unsigned char *to)
 	return(n);
 	}
 
-int BN_ucmp(BIGNUM *a, BIGNUM *b)
+int BN_ucmp(const BIGNUM *a, const BIGNUM *b)
 	{
 	int i;
 	BN_ULONG t1,t2,*ap,*bp;
@@ -665,7 +667,7 @@ int BN_ucmp(BIGNUM *a, BIGNUM *b)
 	return(0);
 	}
 
-int BN_cmp(BIGNUM *a, BIGNUM *b)
+int BN_cmp(const BIGNUM *a, const BIGNUM *b)
 	{
 	int i;
 	int gt,lt;
@@ -737,7 +739,7 @@ int BN_clear_bit(BIGNUM *a, int n)
 	return(1);
 	}
 
-int BN_is_bit_set(BIGNUM *a, int n)
+int BN_is_bit_set(const BIGNUM *a, int n)
 	{
 	int i,j;
 
diff --git a/lib/dns/sec/openssl/bn_m.c b/lib/dns/sec/openssl/bn_m.c
deleted file mode 100644
index ca6ccb055d..0000000000
--- a/lib/dns/sec/openssl/bn_m.c
+++ /dev/null
@@ -1,165 +0,0 @@
-/* crypto/bn/bn_m.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-
-#include <stdio.h>
-#include "cryptlib.h"
-#include "bn_lcl.h"
-#include <openssl/stack.h>
-
-int limit=16;
-
-typedef struct bn_pool_st
-	{
-	int used;
-	int tos;
-	STACK *sk; 
-	} BN_POOL;
-
-BIGNUM *BN_POOL_push(BN_POOL *bp)
-	{
-	BIGNUM *ret;
-
-	if (bp->used >= bp->tos)
-		{
-		ret=BN_new();
-		sk_push(bp->sk,(char *)ret);
-		bp->tos++;
-		bp->used++;
-		}
-	else
-		{
-		ret=(BIGNUM *)sk_value(bp->sk,bp->used);
-		bp->used++;
-		}
-	return(ret);
-	}
-
-void BN_POOL_pop(BN_POOL *bp, int num)
-	{
-	bp->used-=num;
-	}
-
-int BN_m(BIGNUM *r, BIGNUM *a, BIGNUM *b)
-	{
-	static BN_POOL bp;
-	static init=1;
-
-	if (init)
-		{
-		bp.used=0;
-		bp.tos=0;
-		bp.sk=sk_new_null();
-		init=0;
-		}
-	return(BN_mm(r,a,b,&bp));
-	}
-
-/* r must be different to a and b */
-int BN_mm(BIGNUM *m, BIGNUM *A, BIGNUM *B, BN_POOL *bp)
-	{
-	int i,num;
-	int an,bn;
-	BIGNUM *a,*b,*c,*d,*ac,*bd;
-
-	an=A->top;
-	bn=B->top;
-	if ((an <= limit) || (bn <= limit))
-		{
-		/* BEW */
-		BN_CTX ctx;
-		return(BN_mul(m,A,B, &ctx));
-		}
-
-	a=BN_POOL_push(bp);
-	b=BN_POOL_push(bp);
-	c=BN_POOL_push(bp);
-	d=BN_POOL_push(bp);
-	ac=BN_POOL_push(bp);
-	bd=BN_POOL_push(bp);
-
-	num=(an <= bn)?an:bn;
-	num=1<<(BN_num_bits_word(num-1)-1);
-
-	/* Are going to now chop things into 'num' word chunks. */
-	num*=BN_BITS2;
-
-	BN_copy(a,A);
-	BN_mask_bits(a,num);
-	BN_rshift(b,A,num);
-
-	BN_copy(c,B);
-	BN_mask_bits(c,num);
-	BN_rshift(d,B,num);
-
-	BN_sub(ac ,b,a);
-	BN_sub(bd,c,d);
-	BN_mm(m,ac,bd,bp);
-	BN_mm(ac,a,c,bp);
-	BN_mm(bd,b,d,bp);
-
-	BN_add(m,m,ac);
-	BN_add(m,m,bd);
-	BN_lshift(m,m,num);
-	BN_lshift(bd,bd,num*2);
-
-	BN_add(m,m,ac);
-	BN_add(m,m,bd);
-	BN_POOL_pop(bp,6);
-	return(1);
-	}
-
diff --git a/lib/dns/sec/openssl/bn_mont.c b/lib/dns/sec/openssl/bn_mont.c
index 5bdac17e6c..ee0f410c22 100644
--- a/lib/dns/sec/openssl/bn_mont.c
+++ b/lib/dns/sec/openssl/bn_mont.c
@@ -68,8 +68,8 @@
 
 #define MONT_WORD
 
-int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b, BN_MONT_CTX *mont,
-	     BN_CTX *ctx)
+int BN_mod_mul_montgomery(BIGNUM *r, BIGNUM *a, BIGNUM *b,
+			  BN_MONT_CTX *mont, BN_CTX *ctx)
 	{
 	BIGNUM *tmp,*tmp2;
 
@@ -298,7 +298,7 @@ void BN_MONT_CTX_free(BN_MONT_CTX *mont)
 		Free(mont);
 	}
 
-int BN_MONT_CTX_set(BN_MONT_CTX *mont, BIGNUM *mod, BN_CTX *ctx)
+int BN_MONT_CTX_set(BN_MONT_CTX *mont, const BIGNUM *mod, BN_CTX *ctx)
 	{
 	BIGNUM Ri,*R;
 
diff --git a/lib/dns/sec/openssl/bn_mul.c b/lib/dns/sec/openssl/bn_mul.c
index 4b19c9f043..38c47f3d1f 100644
--- a/lib/dns/sec/openssl/bn_mul.c
+++ b/lib/dns/sec/openssl/bn_mul.c
@@ -597,14 +597,14 @@ printf("BN_mul %d * %d\n",a->top,b->top);
 /*		if (al == 4)
 			{
 			if (bn_wexpand(rr,8) == NULL) return(0);
-			r->top=8;
+			rr->top=8;
 			bn_mul_comba4(rr->d,a->d,b->d);
 			goto end;
 			}
 		else */ if (al == 8)
 			{
 			if (bn_wexpand(rr,16) == NULL) return(0);
-			r->top=16;
+			rr->top=16;
 			bn_mul_comba8(rr->d,a->d,b->d);
 			goto end;
 			}
diff --git a/lib/dns/sec/openssl/bn_prime.c b/lib/dns/sec/openssl/bn_prime.c
index 118eb35159..6fa0f9be1e 100644
--- a/lib/dns/sec/openssl/bn_prime.c
+++ b/lib/dns/sec/openssl/bn_prime.c
@@ -76,7 +76,7 @@ static int probable_prime_dh(BIGNUM *rnd, int bits,
 static int probable_prime_dh_strong(BIGNUM *rnd, int bits,
 	BIGNUM *add, BIGNUM *rem, BN_CTX *ctx);
 BIGNUM *BN_generate_prime(BIGNUM *ret, int bits, int strong, BIGNUM *add,
-	     BIGNUM *rem, void (*callback)(int,int,char *), char *cb_arg)
+	     BIGNUM *rem, void (*callback)(int,int,void *), void *cb_arg)
 	{
 	BIGNUM *rnd=NULL;
 	BIGNUM t;
@@ -151,8 +151,8 @@ err:
 	return(ret);
 	}
 
-int BN_is_prime(BIGNUM *a, int checks, void (*callback)(int,int,char *),
-	     BN_CTX *ctx_passed, char *cb_arg)
+int BN_is_prime(BIGNUM *a, int checks, void (*callback)(int,int,void *),
+	     BN_CTX *ctx_passed, void *cb_arg)
 	{
 	int i,j,c2=0,ret= -1;
 	BIGNUM *check;
diff --git a/lib/dns/sec/openssl/bn_recp.c b/lib/dns/sec/openssl/bn_recp.c
index 85b4ac8148..c1b0e230ea 100644
--- a/lib/dns/sec/openssl/bn_recp.c
+++ b/lib/dns/sec/openssl/bn_recp.c
@@ -91,7 +91,7 @@ void BN_RECP_CTX_free(BN_RECP_CTX *recp)
 		Free(recp);
 	}
 
-int BN_RECP_CTX_set(BN_RECP_CTX *recp, BIGNUM *d, BN_CTX *ctx)
+int BN_RECP_CTX_set(BN_RECP_CTX *recp, const BIGNUM *d, BN_CTX *ctx)
 	{
 	BN_copy(&(recp->N),d);
 	BN_zero(&(recp->Nr));
diff --git a/lib/dns/sec/openssl/bn_shift.c b/lib/dns/sec/openssl/bn_shift.c
index 6dbe77b50f..61aae65a6b 100644
--- a/lib/dns/sec/openssl/bn_shift.c
+++ b/lib/dns/sec/openssl/bn_shift.c
@@ -121,7 +121,7 @@ int BN_rshift1(BIGNUM *r, BIGNUM *a)
 	return(1);
 	}
 
-int BN_lshift(BIGNUM *r, BIGNUM *a, int n)
+int BN_lshift(BIGNUM *r, const BIGNUM *a, int n)
 	{
 	int i,nw,lb,rb;
 	BN_ULONG *t,*f;
diff --git a/lib/dns/sec/openssl/include/openssl/bn.h b/lib/dns/sec/openssl/include/openssl/bn.h
index 75081c7f84..36b748273c 100644
--- a/lib/dns/sec/openssl/include/openssl/bn.h
+++ b/lib/dns/sec/openssl/include/openssl/bn.h
@@ -78,6 +78,7 @@ extern "C" {
 #define RECP_MUL_MOD
 #define MONT_MUL_MOD
 #define SIXTY_FOUR_BIT /* BEW */
+#define NO_ASM /* BEW */
 
 /* This next option uses the C libraries (2 word)/(1 word) function.
  * If it is not defined, I use my C version (which is slower).
@@ -143,7 +144,7 @@ extern "C" {
 #endif
 
 #ifdef THIRTY_TWO_BIT
-#ifdef WIN32
+#if defined(WIN32) && !defined(__GNUC__)
 #define BN_ULLONG	unsigned _int64
 #else
 #define BN_ULLONG	unsigned long long
@@ -317,22 +318,23 @@ BN_CTX *BN_CTX_new(void);
 void	BN_CTX_init(BN_CTX *c);
 void	BN_CTX_free(BN_CTX *c);
 int     BN_rand(BIGNUM *rnd, int bits, int top,int bottom);
-int	BN_num_bits(BIGNUM *a);
+int	BN_num_bits(const BIGNUM *a);
 int	BN_num_bits_word(BN_ULONG);
 BIGNUM *BN_new(void);
 void	BN_init(BIGNUM *);
 void	BN_clear_free(BIGNUM *a);
-BIGNUM *BN_copy(BIGNUM *a, BIGNUM *b);
+BIGNUM *BN_copy(BIGNUM *a, const BIGNUM *b);
 BIGNUM *BN_bin2bn(const unsigned char *s,int len,BIGNUM *ret);
-int	BN_bn2bin(BIGNUM *a, unsigned char *to);
+int	BN_bn2bin(const BIGNUM *a, unsigned char *to);
 BIGNUM *BN_mpi2bn(unsigned char *s,int len,BIGNUM *ret);
-int	BN_bn2mpi(BIGNUM *a, unsigned char *to);
-int	BN_sub(BIGNUM *r, BIGNUM *a, BIGNUM *b);
-int	BN_usub(BIGNUM *r, BIGNUM *a, BIGNUM *b);
-int	BN_uadd(BIGNUM *r, BIGNUM *a, BIGNUM *b);
+int	BN_bn2mpi(const BIGNUM *a, unsigned char *to);
+int	BN_sub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
+int	BN_usub(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
+int	BN_uadd(BIGNUM *r, const BIGNUM *a, const BIGNUM *b);
 int	BN_add(BIGNUM *r, BIGNUM *a, BIGNUM *b);
-int	BN_mod(BIGNUM *rem, BIGNUM *m, BIGNUM *d, BN_CTX *ctx);
-int	BN_div(BIGNUM *dv, BIGNUM *rem, BIGNUM *m, BIGNUM *d, BN_CTX *ctx);
+int	BN_mod(BIGNUM *rem, const BIGNUM *m, const BIGNUM *d, BN_CTX *ctx);
+int	BN_div(BIGNUM *dv, BIGNUM *rem, const BIGNUM *m, const BIGNUM *d,
+	       BN_CTX *ctx);
 int	BN_mul(BIGNUM *r, BIGNUM *a, BIGNUM *b,BN_CTX *ctx);
 int	BN_sqr(BIGNUM *r, BIGNUM *a,BN_CTX *ctx);
 BN_ULONG BN_mod_word(BIGNUM *a, BN_ULONG w);
@@ -342,49 +344,49 @@ int	BN_add_word(BIGNUM *a, BN_ULONG w);
 int	BN_sub_word(BIGNUM *a, BN_ULONG w);
 int	BN_set_word(BIGNUM *a, BN_ULONG w);
 BN_ULONG BN_get_word(BIGNUM *a);
-int	BN_cmp(BIGNUM *a, BIGNUM *b);
+int	BN_cmp(const BIGNUM *a, const BIGNUM *b);
 void	BN_free(BIGNUM *a);
-int	BN_is_bit_set(BIGNUM *a, int n);
-int	BN_lshift(BIGNUM *r, BIGNUM *a, int n);
+int	BN_is_bit_set(const BIGNUM *a, int n);
+int	BN_lshift(BIGNUM *r, const BIGNUM *a, int n);
 int	BN_lshift1(BIGNUM *r, BIGNUM *a);
 int	BN_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p,BN_CTX *ctx);
-int	BN_mod_exp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,BN_CTX *ctx);
-int	BN_mod_exp_mont(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,BN_CTX *ctx,
-		BN_MONT_CTX *m_ctx);
+int	BN_mod_exp(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+		   const BIGNUM *m,BN_CTX *ctx);
+int	BN_mod_exp_mont(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+			const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 int	BN_mod_exp2_mont(BIGNUM *r, BIGNUM *a1, BIGNUM *p1,BIGNUM *a2,
 		BIGNUM *p2,BIGNUM *m,BN_CTX *ctx,BN_MONT_CTX *m_ctx);
 int	BN_mod_exp_simple(BIGNUM *r, BIGNUM *a, BIGNUM *p,
 	BIGNUM *m,BN_CTX *ctx);
 int	BN_mask_bits(BIGNUM *a,int n);
-int	BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, BIGNUM *m,
-	BN_CTX *ctx);
+int	BN_mod_mul(BIGNUM *ret, BIGNUM *a, BIGNUM *b, const BIGNUM *m, BN_CTX *ctx);
 #ifndef WIN16
 int	BN_print_fp(FILE *fp, BIGNUM *a);
 #endif
 #ifdef HEADER_BIO_H
-int	BN_print(BIO *fp, BIGNUM *a);
+int	BN_print(BIO *fp, const BIGNUM *a);
 #else
-int	BN_print(char *fp, BIGNUM *a);
+int	BN_print(char *fp, const BIGNUM *a);
 #endif
 int	BN_reciprocal(BIGNUM *r, BIGNUM *m, int len, BN_CTX *ctx);
 int	BN_rshift(BIGNUM *r, BIGNUM *a, int n);
 int	BN_rshift1(BIGNUM *r, BIGNUM *a);
 void	BN_clear(BIGNUM *a);
 BIGNUM *bn_expand2(BIGNUM *b, int bits);
-BIGNUM *BN_dup(BIGNUM *a);
-int	BN_ucmp(BIGNUM *a, BIGNUM *b);
+BIGNUM *BN_dup(const BIGNUM *a);
+int	BN_ucmp(const BIGNUM *a, const BIGNUM *b);
 int	BN_set_bit(BIGNUM *a, int n);
 int	BN_clear_bit(BIGNUM *a, int n);
-char *	BN_bn2hex(BIGNUM *a);
-char *	BN_bn2dec(BIGNUM *a);
-int 	BN_hex2bn(BIGNUM **a,char *str);
-int 	BN_dec2bn(BIGNUM **a,char *str);
+char *	BN_bn2hex(const BIGNUM *a);
+char *	BN_bn2dec(const BIGNUM *a);
+int 	BN_hex2bn(BIGNUM **a, const char *str);
+int 	BN_dec2bn(BIGNUM **a, const char *str);
 int	BN_gcd(BIGNUM *r,BIGNUM *in_a,BIGNUM *in_b,BN_CTX *ctx);
-BIGNUM *BN_mod_inverse(BIGNUM *ret,BIGNUM *a, BIGNUM *n,BN_CTX *ctx);
+BIGNUM *BN_mod_inverse(BIGNUM *ret,BIGNUM *a, const BIGNUM *n,BN_CTX *ctx);
 BIGNUM *BN_generate_prime(BIGNUM *ret,int bits,int strong,BIGNUM *add,
-		BIGNUM *rem,void (*callback)(int,int,char *),char *cb_arg);
-int	BN_is_prime(BIGNUM *p,int nchecks,void (*callback)(int,int,char *),
-		BN_CTX *ctx,char *cb_arg);
+		BIGNUM *rem,void (*callback)(int,int,void *),void *cb_arg);
+int	BN_is_prime(BIGNUM *p,int nchecks,void (*callback)(int,int,void *),
+		BN_CTX *ctx,void *cb_arg);
 void	ERR_load_BN_strings(void );
 
 BN_ULONG bn_mul_add_words(BN_ULONG *rp, BN_ULONG *ap, int num, BN_ULONG w);
@@ -397,10 +399,10 @@ BN_ULONG bn_sub_words(BN_ULONG *rp, BN_ULONG *ap, BN_ULONG *bp,int num);
 BN_MONT_CTX *BN_MONT_CTX_new(void );
 void BN_MONT_CTX_init(BN_MONT_CTX *ctx);
 int BN_mod_mul_montgomery(BIGNUM *r,BIGNUM *a,BIGNUM *b,BN_MONT_CTX *mont,
-	BN_CTX *ctx);
+			  BN_CTX *ctx);
 int BN_from_montgomery(BIGNUM *r,BIGNUM *a,BN_MONT_CTX *mont,BN_CTX *ctx);
 void BN_MONT_CTX_free(BN_MONT_CTX *mont);
-int BN_MONT_CTX_set(BN_MONT_CTX *mont,BIGNUM *modulus,BN_CTX *ctx);
+int BN_MONT_CTX_set(BN_MONT_CTX *mont,const BIGNUM *modulus,BN_CTX *ctx);
 BN_MONT_CTX *BN_MONT_CTX_copy(BN_MONT_CTX *to,BN_MONT_CTX *from);
 
 BN_BLINDING *BN_BLINDING_new(BIGNUM *A,BIGNUM *Ai,BIGNUM *mod);
@@ -415,10 +417,11 @@ int BN_get_params(int which); /* 0, mul, 1 high, 2 low, 3 mont */
 void	BN_RECP_CTX_init(BN_RECP_CTX *recp);
 BN_RECP_CTX *BN_RECP_CTX_new(void);
 void	BN_RECP_CTX_free(BN_RECP_CTX *recp);
-int	BN_RECP_CTX_set(BN_RECP_CTX *recp,BIGNUM *rdiv,BN_CTX *ctx);
+int	BN_RECP_CTX_set(BN_RECP_CTX *recp,const BIGNUM *rdiv,BN_CTX *ctx);
 int	BN_mod_mul_reciprocal(BIGNUM *r, BIGNUM *x, BIGNUM *y,
 		BN_RECP_CTX *recp,BN_CTX *ctx);
-int	BN_mod_exp_recp(BIGNUM *r, BIGNUM *a, BIGNUM *p, BIGNUM *m,BN_CTX *ctx);
+int	BN_mod_exp_recp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+			const BIGNUM *m, BN_CTX *ctx);
 int	BN_div_recp(BIGNUM *dv, BIGNUM *rem, BIGNUM *m,
 		BN_RECP_CTX *recp, BN_CTX *ctx);
 
diff --git a/lib/dns/sec/openssl/mem.c b/lib/dns/sec/openssl/mem.c
index 5f235b4d3e..2121b42022 100644
--- a/lib/dns/sec/openssl/mem.c
+++ b/lib/dns/sec/openssl/mem.c
@@ -259,6 +259,9 @@ void *CRYPTO_dbg_realloc(void *addr, int num, const char *file, int line)
 	char *ret;
 	MEM m,*mp;
 
+	file = file; /* BEW - quiet the compiler */
+	line = line;
+
 	ret=realloc_func(addr,num);
 	if (ret == addr) return(ret);
 
diff --git a/lib/dns/sec/openssl/th-lock.c b/lib/dns/sec/openssl/th-lock.c
index 27f6d9610a..ed976db3ba 100644
--- a/lib/dns/sec/openssl/th-lock.c
+++ b/lib/dns/sec/openssl/th-lock.c
@@ -83,14 +83,21 @@
 int CRYPTO_thread_setup(void);
 void CRYPTO_thread_cleanup(void);
 
+#ifdef IRIX
 static void irix_locking_callback(int mode,int type,char *file,int line);
-static void solaris_locking_callback(int mode,int type,char *file,int line);
-static void win32_locking_callback(int mode,int type,char *file,int line);
-static void pthreads_locking_callback(int mode,int type,char *file,int line);
-
 static unsigned long irix_thread_id(void );
+#endif
+#ifdef SOLARIS
+static void solaris_locking_callback(int mode,int type,char *file,int line);
 static unsigned long solaris_thread_id(void );
+#endif
+#ifdef WIN32
+static void win32_locking_callback(int mode,int type,char *file,int line);
+#endif
+#ifdef PTHREADS
+static void pthreads_locking_callback(int mode,int type,char *file,int line);
 static unsigned long pthreads_thread_id(void );
+#endif
 
 /* usage:
  * CRYPTO_thread_setup();