Index: crypto/engine/eng_all.c=================================================================== RCS file: /ttt/cvs/openssl/openssl/crypto/engine/eng_all.c,v retrieving revision 1.4.2.3 Index: crypto/engine/eng_all.c =================================================================== --- crypto/engine/eng_all.c.orig 2004-08-23 15:35:27.121555677 +0200 +++ crypto/engine/eng_all.c 2004-08-23 15:36:46.150930318 +0200 @@ -98,7 +98,7 @@ #ifndef OPENSSL_NO_HW_4758_CCA ENGINE_load_4758cca(); #endif -#if defined(__OpenBSD__) || defined(__FreeBSD__) +#ifndef OPENSSL_NO_HW_CRYPTODEV ENGINE_load_cryptodev(); #endif #ifndef OPENSSL_NO_HW_PADLOCK @@ -107,7 +107,6 @@ #endif } -#if defined(__OpenBSD__) || defined(__FreeBSD__) void ENGINE_setup_bsd_cryptodev(void) { static int bsd_cryptodev_default_loaded = 0; if (!bsd_cryptodev_default_loaded) { @@ -116,4 +115,3 @@ } bsd_cryptodev_default_loaded=1; } -#endif Index: crypto/engine/engine.h =================================================================== --- crypto/engine/engine.h.orig 2004-08-23 15:35:27.209538282 +0200 +++ crypto/engine/engine.h 2004-08-23 15:35:53.906259917 +0200 @@ -634,9 +634,7 @@ if(!fn(e,id)) return 0; \ return 1; } -#if defined(__OpenBSD__) || defined(__FreeBSD__) void ENGINE_setup_bsd_cryptodev(void); -#endif /* BEGIN ERROR CODES */ /* The following lines are auto generated by the script mkerr.pl. Any changes Index: crypto/engine/hw_cryptodev.c =================================================================== --- crypto/engine/hw_cryptodev.c.orig 2004-08-23 15:34:16.617495447 +0200 +++ crypto/engine/hw_cryptodev.c 2004-08-23 15:35:53.998241731 +0200 @@ -33,7 +33,11 @@ #if (defined(__unix__) || defined(unix)) && !defined(USG) #include # if (OpenBSD >= 200112) || ((__FreeBSD_version >= 470101 && __FreeBSD_version < 500000) || __FreeBSD_version >= 500041) -# define HAVE_CRYPTODEV +# define HAVE_CRYPTODEV +# define HAVE_CRYPTODEV_ASYMFEAT +# elif defined(__linux__) +# define HAVE_CRYPTODEV +# define HAVE_CRYPTODEV_NAME # endif # if (OpenBSD >= 200110) # define HAVE_SYSLOG_R @@ -52,7 +56,6 @@ #else #include -#include #include #include #include @@ -63,19 +66,26 @@ #include #include +#if defined(__linux__) +#include +#else +#include +#endif + struct dev_crypto_state { struct session_op d_sess; int d_fd; }; -static u_int32_t cryptodev_asymfeat = 0; - -static int get_asym_dev_crypto(void); static int open_dev_crypto(void); static int get_dev_crypto(void); -static int cryptodev_max_iv(int cipher); -static int cryptodev_key_length_valid(int cipher, int len); +static int cryptodev_max_iv(int nid); +static int cryptodev_key_length_valid(int nid, int len); +#ifndef HAVE_CRYPTODEV_NAME static int cipher_nid_to_cryptodev(int nid); +#else +static char *cipher_nid_to_cryptodev_name(int nid); +#endif static int get_cryptodev_ciphers(const int **cnids); static int get_cryptodev_digests(const int **cnids); static int cryptodev_usable_ciphers(const int **nids); @@ -89,6 +99,15 @@ const int **nids, int nid); static int cryptodev_engine_digests(ENGINE *e, const EVP_MD **digest, const int **nids, int nid); + +static int cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, + void (*f)()); +void ENGINE_load_cryptodev(void); + +#ifdef HAVE_CRYPTODEV_ASYMFEAT +static uint32_t cryptodev_asymfeat = 0; + +static int get_asym_dev_crypto(void); static int bn2crparam(const BIGNUM *a, struct crparam *crp); static int crparam2bn(struct crparam *crp, BIGNUM *a); static void zapparams(struct crypt_kop *kop); @@ -114,41 +133,51 @@ BN_MONT_CTX *m_ctx); static int cryptodev_dh_compute_key(unsigned char *key, const BIGNUM *pub_key, DH *dh); -static int cryptodev_ctrl(ENGINE *e, int cmd, long i, void *p, - void (*f)()); -void ENGINE_load_cryptodev(void); +#endif static const ENGINE_CMD_DEFN cryptodev_defns[] = { { 0, NULL, NULL, 0 } }; +#ifdef HAVE_CRYPTODEV_NAME +#define CIPHER(nid,id,name,ivmax,keylen) { nid, nid, name, ivmax, keylen } +#else +#define CIPHER(nid,id,name,ivmax,keylen) { nid, id, name, ivmax, keylen } +#endif static struct { - int id; int nid; + int id; + char *name; int ivmax; int keylen; } ciphers[] = { - { CRYPTO_DES_CBC, NID_des_cbc, 8, 8, }, - { CRYPTO_3DES_CBC, NID_des_ede3_cbc, 8, 24, }, - { CRYPTO_AES_CBC, NID_aes_128_cbc, 16, 16, }, - { CRYPTO_BLF_CBC, NID_bf_cbc, 8, 16, }, - { CRYPTO_CAST_CBC, NID_cast5_cbc, 8, 16, }, - { CRYPTO_SKIPJACK_CBC, NID_undef, 0, 0, }, - { 0, NID_undef, 0, 0, }, + CIPHER(NID_des_cbc, CRYPTO_DES_CBC, "des", 8, 8), + CIPHER(NID_des_ede3_cbc,CRYPTO_3DES_CBC,"des3_ede", 8, 24), + CIPHER(NID_aes_128_cbc, CRYPTO_AES_CBC, "aes", 16, 16), + CIPHER(NID_bf_cbc, CRYPTO_BLF_CBC, "blowfish", 8, 16), + CIPHER(NID_cast5_cbc, CRYPTO_CAST_CBC,"cast5", 8, 16), + CIPHER(NID_undef, 0, NULL, 0, 0), }; +#define ciphers_count (sizeof(ciphers)/sizeof(ciphers[0])) +#ifdef HAVE_CRYPTODEV_NAME +#define DIGEST(nid,id,name) { nid, nid, name } +#else +#define DIGEST(nid,id,name) { nid, id, name } +#endif static struct { - int id; int nid; + int id; + char *name; } digests[] = { - { CRYPTO_SHA1_HMAC, NID_hmacWithSHA1, }, - { CRYPTO_RIPEMD160_HMAC, NID_ripemd160, }, - { CRYPTO_MD5_KPDK, NID_undef, }, - { CRYPTO_SHA1_KPDK, NID_undef, }, - { CRYPTO_MD5, NID_md5, }, - { CRYPTO_SHA1, NID_undef, }, - { 0, NID_undef, }, + DIGEST(NID_hmacWithSHA1,CRYPTO_SHA1_HMAC, "sha1"), + DIGEST(NID_ripemd160, CRYPTO_RIPEMD160_HMAC, "ripemd160"), + DIGEST(NID_md5, CRYPTO_MD5, "md5"), + DIGEST(NID_undef, 0, NULL), }; +#define digests_count (sizeof(digests)/sizeof(digests[0])) + +#define algorithms_count (ciphers_count+digests_count) /* * Return a fd if /dev/crypto seems usable, 0 otherwise. @@ -189,6 +218,7 @@ return (retfd); } +#ifdef HAVE_CRYPTODEV_ASYMFEAT /* Caching version for asym operations */ static int get_asym_dev_crypto(void) @@ -199,18 +229,19 @@ fd = get_dev_crypto(); return fd; } +#endif /* * XXXX this needs to be set for each alg - and determined from * a running card. */ static int -cryptodev_max_iv(int cipher) +cryptodev_max_iv(int nid) { int i; - for (i = 0; ciphers[i].id; i++) - if (ciphers[i].id == cipher) + for (i = 0; ciphers[i].nid; i++) + if (ciphers[i].nid == nid) return (ciphers[i].ivmax); return (0); } @@ -222,27 +253,40 @@ * sizes the device can handle. */ static int -cryptodev_key_length_valid(int cipher, int len) +cryptodev_key_length_valid(int nid, int len) { int i; - for (i = 0; ciphers[i].id; i++) - if (ciphers[i].id == cipher) + for (i = 0; ciphers[i].nid; i++) + if (ciphers[i].nid == nid) return (ciphers[i].keylen == len); return (0); } +#if !defined(HAVE_CRYPTODEV_NAME) /* convert libcrypto nids to cryptodev */ static int cipher_nid_to_cryptodev(int nid) { int i; - for (i = 0; ciphers[i].id; i++) + for (i = 0; ciphers[i].nid != NID_undef; i++) if (ciphers[i].nid == nid) return (ciphers[i].id); return (0); } +#else +static char * +cipher_nid_to_cryptodev_name(int nid) +{ + int i; + + for (i = 0; ciphers[i].nid != NID_undef; i++) + if (ciphers[i].nid == nid) + return (ciphers[i].name); + return (0); +} +#endif /* * Find out what ciphers /dev/crypto will let us have a session for. @@ -253,21 +297,27 @@ static int get_cryptodev_ciphers(const int **cnids) { - static int nids[CRYPTO_ALGORITHM_MAX]; + static int nids[ciphers_count]; struct session_op sess; int fd, i, count = 0; if ((fd = get_dev_crypto()) < 0) { - *nids = NULL; + *cnids = NULL; return (0); } memset(&sess, 0, sizeof(sess)); - sess.key = (caddr_t)"123456781234567812345678"; + sess.key = (caddr_t)"ABCDEFGH12345678abcdefgh"; - for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) { - if (ciphers[i].nid == NID_undef) + for (i = 0; ciphers[i].nid != NID_undef && count < ciphers_count; i++) { +#ifdef HAVE_CRYPTODEV_NAME + sess.cipher = CRYPTO_CIPHER_NAME_CBC; + sess.alg_name = cipher_nid_to_cryptodev_name(ciphers[i].nid); + if (!sess.alg_name) continue; + sess.alg_namelen = strlen(sess.alg_name); +#else sess.cipher = ciphers[i].id; +#endif sess.keylen = ciphers[i].keylen; sess.mac = 0; if (ioctl(fd, CIOCGSESSION, &sess) != -1 && @@ -292,16 +342,16 @@ static int get_cryptodev_digests(const int **cnids) { - static int nids[CRYPTO_ALGORITHM_MAX]; + static int nids[algorithms_count]; struct session_op sess; int fd, i, count = 0; if ((fd = get_dev_crypto()) < 0) { - *nids = NULL; + *cnids = NULL; return (0); } memset(&sess, 0, sizeof(sess)); - for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) { + for (i = 0; digests[i].id && count < algorithms_count; i++) { if (digests[i].nid == NID_undef) continue; sess.mac = digests[i].id; @@ -425,25 +475,29 @@ { struct dev_crypto_state *state = ctx->cipher_data; struct session_op *sess = &state->d_sess; - int cipher; - if ((cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NID_undef) + if (ctx->cipher->iv_len > cryptodev_max_iv(ctx->cipher->nid)) return (0); - if (ctx->cipher->iv_len > cryptodev_max_iv(cipher)) - return (0); - - if (!cryptodev_key_length_valid(cipher, ctx->key_len)) + if (!cryptodev_key_length_valid(ctx->cipher->nid, ctx->key_len)) return (0); memset(sess, 0, sizeof(struct session_op)); - if ((state->d_fd = get_dev_crypto()) < 0) - return (0); - sess->key = (unsigned char *)key; sess->keylen = ctx->key_len; - sess->cipher = cipher; +#ifdef HAVE_CRYPTODEV_NAME + if ((sess->alg_name = cipher_nid_to_cryptodev_name(ctx->cipher->nid)) == NULL) + return (0); + sess->alg_namelen = strlen(sess->alg_name); + sess->cipher = CRYPTO_CIPHER_NAME_CBC; +#else + if ((sess->cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NID_undef) + return (0); +#endif + + if ((state->d_fd = get_dev_crypto()) < 0) + return (0); if (ioctl(state->d_fd, CIOCGSESSION, sess) == -1) { close(state->d_fd); @@ -614,6 +668,7 @@ return (*digest != NULL); } +#ifdef HAVE_CRYPTODEV_ASYMFEAT /* * Convert a BIGNUM to the representation that /dev/crypto needs. * Upon completion of use, the caller is responsible for freeing @@ -1017,6 +1072,7 @@ 0, /* flags */ NULL /* app_data */ }; +#endif /* HAVE_CRYPTODEV_ASYMFEAT */ /* * ctrl right now is just a wrapper that doesn't do much @@ -1055,6 +1111,7 @@ return; } +#ifdef HAVE_CRYPTODEV_ASYMFEAT /* * find out what asymmetric crypto algorithms we support */ @@ -1063,6 +1120,7 @@ ENGINE_free(engine); return; } +#endif close(fd); if (!ENGINE_set_id(engine, "cryptodev") || @@ -1075,6 +1133,7 @@ return; } +#ifdef HAVE_CRYPTODEV_ASYMFEAT if (ENGINE_set_RSA(engine, &cryptodev_rsa)) { const RSA_METHOD *rsa_meth = RSA_PKCS1_SSLeay(); @@ -1122,6 +1181,7 @@ cryptodev_dh_compute_key; } } +#endif ENGINE_add(engine); ENGINE_free(engine); Index: crypto/evp/c_all.c =================================================================== --- crypto/evp/c_all.c.orig 2004-08-23 15:34:16.813456702 +0200 +++ crypto/evp/c_all.c 2004-08-23 15:35:54.116218405 +0200 @@ -77,8 +77,6 @@ OpenSSL_add_all_ciphers(); OpenSSL_add_all_digests(); #ifndef OPENSSL_NO_ENGINE -# if defined(__OpenBSD__) || defined(__FreeBSD__) ENGINE_setup_bsd_cryptodev(); -# endif #endif }