projects / openwrt.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
firewall: fix fallout from r18716 (fixes #6338)
[openwrt.git] / package / openssl / patches / 200-ocf-20080917.patch
1 --- a/Configure
2 +++ b/Configure
3 @@ -34,6 +34,8 @@ my $usage="Usage: Configure [no-<cipher>
4 # (Default: KRB5_DIR/include)
5 # --with-krb5-flavor Declare what flavor of Kerberos 5 is used. Currently
6 # supported values are "MIT" and "Heimdal". A value is required.
7 +# --with-cryptodev Force support for cryptodev (ie., ocf-linux)
8 +# --with-cryptodev-digests Force support for cryptodev digests (generally slow)
9 #
10 # --test-sanity Make a number of sanity checks on the data in this file.
11 # This is a debugging tool for OpenSSL developers.
12 @@ -540,6 +542,9 @@ my %table=(
13 ##### Compaq Non-Stop Kernel (Tandem)
14 "tandem-c89","c89:-Ww -D__TANDEM -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1 -D_TANDEM_SOURCE -DB_ENDIAN::(unknown):::THIRTY_TWO_BIT:::",
15
16 +# uClinux
17 +"uClinux-dist","$ENV{'CC'}:\$(CFLAGS)::-D_REENTRANT::\$(LDFLAGS) \$(LDLIBS):BN_LLONG::::::::::::\$(LIBSSL_dlfcn):linux-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):$ENV{'RANLIB'}",
18 +
19 );
20
21 my @MK1MF_Builds=qw(VC-WIN64I VC-WIN64A
22 @@ -589,6 +594,8 @@ my $montasm=1; # but "no-montasm" is d
23 my $no_asm=0;
24 my $no_dso=0;
25 my $no_gmp=0;
26 +my $have_cryptodev=0;
27 +my $use_cryptodev_digests=0;
28 my @skip=();
29 my $Makefile="Makefile";
30 my $des_locl="crypto/des/des_locl.h";
31 @@ -716,6 +723,14 @@ PROCESS_ARGS:
32 {
33 exit(&test_sanity());
34 }
35 + elsif (/^--with-cryptodev$/)
36 + {
37 + $have_cryptodev = 1;
38 + }
39 + elsif (/^--with-cryptodev-digests$/)
40 + {
41 + $use_cryptodev_digests = 1;
42 + }
43 elsif (/^reconfigure/ || /^reconf/)
44 {
45 if (open(IN,"<$Makefile"))
46 @@ -924,6 +939,7 @@ foreach (sort (keys %disabled))
47 print " OPENSSL_NO_$ALGO";
48
49 if (/^err$/) { $flags .= "-DOPENSSL_NO_ERR "; }
50 + elsif (/^hw$/) { $flags .= "-DOPENSSL_NO_HW "; }
51 elsif (/^asm$/) { $no_asm = 1; }
52 }
53 else
54 @@ -1064,6 +1080,16 @@ if (!$no_krb5)
55 $withargs{"krb5-dir"} ne "";
56 }
57
58 +# enable the linux cryptodev (ocf-linux) support
59 +if ($have_cryptodev)
60 + {
61 + if ($use_cryptodev_digests)
62 + {
63 + $cflags = "-DUSE_CRYPTODEV_DIGESTS $cflags";
64 + }
65 + $cflags = "-DHAVE_CRYPTODEV $cflags";
66 + }
67 +
68 # The DSO code currently always implements all functions so that no
69 # applications will have to worry about that from a compilation point
70 # of view. However, the "method"s may return zero unless that platform
71 --- a/INSTALL
72 +++ b/INSTALL
73 @@ -103,6 +103,12 @@
74 define preprocessor symbols, specify additional libraries,
75 library directories or other compiler options.
76
77 + --with-cryptodev Enabled the BSD cryptodev engine even if we are not using
78 + BSD. Useful if you are running ocf-linux or something
79 + similar. Once enabled you can also enable the use of
80 + cryptodev digests, with is usually slower unless you have
81 + large amounts data. Use --with-cryptodev-digests to force
82 + it.
83
84 Installation in Detail
85 ----------------------
86 --- a/Makefile.org
87 +++ b/Makefile.org
88 @@ -367,7 +367,7 @@ files:
89
90 links:
91 @$(PERL) $(TOP)/util/mkdir-p.pl include/openssl
92 - @$(PERL) $(TOP)/util/mklink.pl include/openssl $(EXHEADER)
93 + @$(PERL) $(TOP)/util/mklink.pl include/openssl $(HEADER) $(EXHEADER)
94 @set -e; target=links; $(RECURSIVE_BUILD_CMD)
95
96 gentests:
97 --- a/Makefile.shared
98 +++ b/Makefile.shared
99 @@ -6,13 +6,13 @@
100 # properly
101
102 # CC contains the current compiler. This one MUST be defined
103 -CC=cc
104 -CFLAGS=$(CFLAG)
105 +CC?=cc
106 +CFLAGS?=$(CFLAG)
107 # LDFLAGS contains flags to be used when temporary object files (when building
108 # shared libraries) are created, or when an application is linked.
109 # SHARED_LDFLAGS contains flags to be used when the shared library is created.
110 -LDFLAGS=
111 -SHARED_LDFLAGS=
112 +LDFLAGS?=
113 +SHARED_LDFLAGS?=
114
115 # LIBNAME contains just the name of the library, without prefix ("lib"
116 # on Unix, "cyg" for certain forms under Cygwin...) or suffix (.a, .so,
117 --- a/config
118 +++ b/config
119 @@ -48,10 +48,10 @@ done
120
121 # First get uname entries that we use below
122
123 -MACHINE=`(uname -m) 2>/dev/null` || MACHINE="unknown"
124 -RELEASE=`(uname -r) 2>/dev/null` || RELEASE="unknown"
125 -SYSTEM=`(uname -s) 2>/dev/null` || SYSTEM="unknown"
126 -VERSION=`(uname -v) 2>/dev/null` || VERSION="unknown"
127 +[ "$MACHINE" ] || MACHINE=`(uname -m) 2>/dev/null` || MACHINE="unknown"
128 +[ "$RELEASE" ] || RELEASE=`(uname -r) 2>/dev/null` || RELEASE="unknown"
129 +[ "$SYSTEM" ] || SYSTEM=`(uname -s) 2>/dev/null` || SYSTEM="unknown"
130 +[ "$VERSION" ] || VERSION=`(uname -v) 2>/dev/null` || VERSION="unknown"
131
132
133 # Now test for ISC and SCO, since it is has a braindamaged uname.
134 @@ -270,7 +270,7 @@ case "${SYSTEM}:${RELEASE}:${VERSION}:${
135 echo "ppc-apple-darwin${VERSION}"
136 ;;
137 *)
138 - echo "i386-apple-darwin${VERSION}"
139 + echo "${MACHINE}-apple-darwin${VERSION}"
140 ;;
141 esac
142 exit 0
143 @@ -401,9 +401,9 @@ exit 0
144
145 # figure out if gcc is available and if so we use it otherwise
146 # we fallback to whatever cc does on the system
147 -GCCVER=`(gcc -dumpversion) 2>/dev/null`
148 +CC="${CC:-gcc}"
149 +GCCVER=`(${CC} -dumpversion) 2>/dev/null`
150 if [ "$GCCVER" != "" ]; then
151 - CC=gcc
152 # then strip off whatever prefix egcs prepends the number with...
153 # Hopefully, this will work for any future prefixes as well.
154 GCCVER=`echo $GCCVER | LC_ALL=C sed 's/^[a-zA-Z]*\-//'`
155 @@ -413,7 +413,7 @@ if [ "$GCCVER" != "" ]; then
156 # peak single digit before and after first dot, e.g. 2.95.1 gives 29
157 GCCVER=`echo $GCCVER | sed 's/\([0-9]\)\.\([0-9]\).*/\1\2/'`
158 else
159 - CC=cc
160 + CC="${CC:-cc}"
161 fi
162 GCCVER=${GCCVER:-0}
163 if [ "$SYSTEM" = "HP-UX" ];then
164 @@ -482,6 +482,9 @@ echo Operating system: $GUESSOS
165 # script above so we end up with values in vars but that would take
166 # more time that I want to waste at the moment
167 case "$GUESSOS" in
168 + uClinux*)
169 + OUT=uClinux-dist
170 + ;;
171 mips2-sgi-irix)
172 CPU=`(hinv -t cpu) 2>/dev/null | head -1 | sed 's/^CPU:[^R]*R\([0-9]*\).*/\1/'`
173 CPU=${CPU:-0}
174 --- /dev/null
175 +++ b/makefile-uclinuxdist
176 @@ -0,0 +1,138 @@
177 +#
178 +# this makefile gets recursed through by various bits of the build
179 +# so we need to only setup some things when invoked from outside
180 +# this directory.
181 +#
182 +# davidm@snapgear.com
183 +#
184 +
185 +IN_LIBSSL := true
186 +export IN_LIBSSL
187 +
188 +CONFIG_OPTS := --prefix=// --install_prefix=$(shell pwd)/build/install
189 +
190 +ifdef CONFIG_USER_FLATFSD_FLATFSD
191 +CONFIG_OPTS += --openssldir=/etc/config
192 +else
193 +CONFIG_OPTS += --openssldir=/etc
194 +endif
195 +ifdef DISABLE_SHARED_SSL
196 +CONFIG_OPTS += no-shared
197 +else
198 +CONFIG_OPTS += shared
199 +endif
200 +
201 +CONFIG_OPTS += no-rc2
202 +CONFIG_OPTS += no-krb5
203 +CONFIG_OPTS += no-rc5
204 +CONFIG_OPTS += no-md2
205 +CONFIG_OPTS += no-idea
206 +#CONFIG_OPTS += no-pem
207 +#CONFIG_OPTS += no-md5
208 +#CONFIG_OPTS += no-sha
209 +#CONFIG_OPTS += no-hmac
210 +#CONFIG_OPTS += no-des
211 +#CONFIG_OPTS += no-aes
212 +#CONFIG_OPTS += no-bn
213 +CONFIG_OPTS += no-ec
214 +#CONFIG_OPTS += no-rsa
215 +#CONFIG_OPTS += no-dsa
216 +CONFIG_OPTS += no-ecdsa
217 +#CONFIG_OPTS += no-dh
218 +CONFIG_OPTS += no-ecdh
219 +CONFIG_OPTS += no-dso
220 +#CONFIG_OPTS += no-engine
221 +#CONFIG_OPTS += no-buffer
222 +#CONFIG_OPTS += no-bio
223 +#CONFIG_OPTS += no-stack
224 +#CONFIG_OPTS += no-lhash
225 +#CONFIG_OPTS += no-rand
226 +CONFIG_OPTS += no-err
227 +#CONFIG_OPTS += no-evp
228 +#CONFIG_OPTS += no-asn1
229 +#CONFIG_OPTS += no-x509
230 +#CONFIG_OPTS += no-x509v3
231 +#CONFIG_OPTS += no-txt_db
232 +#CONFIG_OPTS += no-pkcs7
233 +#CONFIG_OPTS += no-pkcs12
234 +#CONFIG_OPTS += no-comp
235 +#CONFIG_OPTS += no-ocsp
236 +#CONFIG_OPTS += no-ui
237 +#CONFIG_OPTS += no-store
238 +CONFIG_OPTS += no-pqueue
239 +
240 +# REVISIT: It would be better to have OPENSSL config options
241 +# which turn on this support as needed
242 +ifeq ($(CONFIG_USER_NESSUS_NASL)$(CONFIG_USER_SSH_SSH),)
243 +CONFIG_OPTS += no-ripemd
244 +CONFIG_OPTS += no-cast
245 +CONFIG_OPTS += no-rc4
246 +endif
247 +
248 +ifeq ($(CONFIG_USER_NESSUS_NASL)$(CONFIG_USER_SSH_SSH)$(CONFIG_PROP_SSCEP_SSCEP),)
249 +CONFIG_OPTS += no-bf
250 +endif
251 +
252 +ifeq ($(CONFIG_USER_OPENVPN_OPENVPN)$(CONFIG_USER_WGET),)
253 +CONFIG_OPTS += no-md4
254 +endif
255 +
256 +ifdef CONFIG_OCF_OCF
257 +CONFIG_OPTS += --with-cryptodev
258 +#CONFIG_OPTS += --with-cryptodev-digests
259 +endif
260 +
261 +#
262 +# if you want engines (they are dl loaded), a few things
263 +# need to be setup, you will also need to mod everything
264 +# to link against -ldl if it uses libcrypto. By default we
265 +# disable it (cryptodev suport is still included).
266 +#
267 +ifdef YOU_WANT_DYNAMIC_HW_ENGINES_ENABLED
268 +LIBSSL_dlfcn = dlfcn
269 +else
270 +CONFIG_OPTS += no-hw
271 +LIBSSL_dlfcn =
272 +endif
273 +
274 +#
275 +# our libs aren't in the default location yet
276 +#
277 +LDFLAGS += -L$(ROOTDIR)/lib/libssl/build
278 +export LDFLAGS
279 +
280 +all: build/configured
281 + $(MAKE) -C build
282 + $(MAKE) -C build install_sw
283 +
284 +build/configured: makefile config Configure
285 + rm -rf build
286 + find . -type d > .dirs
287 + find . ! -type d | grep -v ./makefile > .files
288 + while read t; do mkdir -p build/$$t; done < .dirs
289 + while read t; do ln -s `pwd`/$$t build/$$t; done < .files
290 + rm -f .dirs .files
291 + chmod +x build/config
292 + cd build; MACHINE=uClinux-dist ./config $(CONFIG_OPTS)
293 + $(MAKE) -C build depend
294 + $(MAKE) -C build links
295 + touch build/configured
296 +
297 +clean:
298 + -rm -rf build
299 +
300 +romfs:
301 + cd build/install/lib; \
302 + for i in *.so*; do \
303 + if [ -L $$i ]; then \
304 + $(ROMFSINST) -s `find $$i -printf %l` /lib/$$i; \
305 + elif [ -f $$i ]; then \
306 + $(ROMFSINST) /lib/$$i; \
307 + fi; \
308 + done
309 +
310 +romfs_user:
311 + $(ROMFSINST) -e CONFIG_USER_OPENSSL_APPS build/install/bin/openssl /bin/openssl
312 + # $(ROMFSINST) -e CONFIG_USER_OPENSSL_APPS build/install/bin/c_rehash /bin/c_rehash
313 +
314 +
315 --- a/apps/apps.h
316 +++ b/apps/apps.h
317 @@ -112,7 +112,7 @@
318 #ifndef HEADER_APPS_H
319 #define HEADER_APPS_H
320
321 -#include "e_os.h"
322 +#include <openssl/e_os.h>
323
324 #include <openssl/bio.h>
325 #include <openssl/x509.h>
326 --- a/apps/progs.h
327 +++ b/apps/progs.h
328 @@ -129,7 +129,9 @@ FUNCTION functions[] = {
329 #ifndef OPENSSL_NO_ENGINE
330 {FUNC_TYPE_GENERAL,"engine",engine_main},
331 #endif
332 +#ifndef OPENSSL_NO_OCSP
333 {FUNC_TYPE_GENERAL,"ocsp",ocsp_main},
334 +#endif
335 {FUNC_TYPE_GENERAL,"prime",prime_main},
336 #ifndef OPENSSL_NO_MD2
337 {FUNC_TYPE_MD,"md2",dgst_main},
338 --- a/apps/speed.c
339 +++ b/apps/speed.c
340 @@ -292,7 +292,7 @@ static const char *names[ALGOR_NUM]={
341 "evp","sha256","sha512",
342 "aes-128 ige","aes-192 ige","aes-256 ige"};
343 static double results[ALGOR_NUM][SIZE_NUM];
344 -static int lengths[SIZE_NUM]={16,64,256,1024,8*1024};
345 +static int lengths[SIZE_NUM]={16,64,256,1024,2*1024,4*1024};
346 static double rsa_results[RSA_NUM][2];
347 static double dsa_results[DSA_NUM][2];
348 #ifndef OPENSSL_NO_ECDSA
349 @@ -328,6 +328,79 @@ static SIGRETTYPE sig_done(int sig)
350 #define START 0
351 #define STOP 1
352
353 +#ifdef __linux__
354 +/*
355 + * record CPU usage as well
356 + */
357 +
358 +static int do_cpu = 0;
359 +
360 +struct cpu_stat {
361 + unsigned int user;
362 + unsigned int nice;
363 + unsigned int system;
364 + unsigned int idle;
365 + unsigned int total;
366 +};
367 +
368 +static unsigned int cpu_usage[ALGOR_NUM][SIZE_NUM];
369 +static unsigned int rsa_cpu_usage[RSA_NUM][2];
370 +static unsigned int dsa_cpu_usage[DSA_NUM][2];
371 +static struct cpu_stat cpu_start, cpu_finish;
372 +
373 +static void
374 +get_cpu(int s)
375 +{
376 + FILE *fp = NULL;
377 + unsigned char buf[80];
378 + struct cpu_stat *st = s == START ? &cpu_start : &cpu_finish;
379 +
380 + memset(st, 0, sizeof(*st));
381 +
382 + if (fp == NULL)
383 + fp = fopen("/proc/stat", "r");
384 + if (!fp)
385 + return;
386 + if (fseek(fp, 0, SEEK_SET) == -1) {
387 + fclose(fp);
388 + return;
389 + }
390 + fscanf(fp, "%s %d %d %d %d", &buf[0], &st->user, &st->nice,
391 + &st->system, &st->idle);
392 + st->total = st->user + st->nice + st->system + st->idle;
393 + fclose(fp);
394 +}
395 +
396 +static unsigned int
397 +calc_cpu()
398 +{
399 + unsigned int total, res;
400 +
401 + total = cpu_finish.total - cpu_start.total;
402 + if (total <= 0)
403 + return 0;
404 +#if 1 // busy
405 + res = ((cpu_finish.system + cpu_finish.user + cpu_finish.nice) -
406 + (cpu_start.system + cpu_start.user + cpu_start.nice)) *
407 + 100 / total;
408 +#endif
409 +#if 0 // system
410 + res = (cpu_finish.system - cpu_start.system) * 100 / total;
411 +#endif
412 +#if 0 // user
413 + res = (cpu_finish.user - cpu_start.user) * 100 / total;
414 +#endif
415 +#if 0 // nice
416 + res = (cpu_finish.nice - cpu_start.nice) * 100 / total;
417 +#endif
418 +#if 0 // idle
419 + res = (cpu_finish.idle - cpu_start.idle) * 100 / total;
420 +#endif
421 + return(res);
422 +}
423 +
424 +#endif
425 +
426 #if defined(OPENSSL_SYS_NETWARE)
427
428 /* for NetWare the best we can do is use clock() which returns the
429 @@ -358,6 +431,11 @@ static double Time_F(int s)
430 {
431 double ret;
432
433 +#ifdef __linux__
434 + if (do_cpu)
435 + get_cpu(s);
436 +#endif
437 +
438 #ifdef USE_TOD
439 if(usertime)
440 {
441 @@ -832,6 +910,14 @@ int MAIN(int argc, char **argv)
442 j--; /* Otherwise, -elapsed gets confused with
443 an algorithm. */
444 }
445 +#ifdef __linux__
446 + else if ((argc > 0) && (strcmp(*argv,"-cpu") == 0))
447 + {
448 + do_cpu = 1;
449 + j--; /* Otherwise, -cpu gets confused with
450 + an algorithm. */
451 + }
452 +#endif
453 else if ((argc > 0) && (strcmp(*argv,"-evp") == 0))
454 {
455 argc--;
456 @@ -1260,6 +1346,9 @@ int MAIN(int argc, char **argv)
457 #ifdef HAVE_FORK
458 BIO_printf(bio_err,"-multi n run n benchmarks in parallel.\n");
459 #endif
460 +#ifdef __linux__
461 + BIO_printf(bio_err,"-cpu calculate cpu utilisation.\n");
462 +#endif
463 goto end;
464 }
465 argc--;
466 @@ -1267,11 +1356,6 @@ int MAIN(int argc, char **argv)
467 j++;
468 }
469
470 -#ifdef HAVE_FORK
471 - if(multi && do_multi(multi))
472 - goto show_res;
473 -#endif
474 -
475 if (j == 0)
476 {
477 for (i=0; i<ALGOR_NUM; i++)
478 @@ -1604,6 +1688,11 @@ int MAIN(int argc, char **argv)
479 signal(SIGALRM,sig_done);
480 #endif /* SIGALRM */
481
482 +#ifdef HAVE_FORK /* DM */
483 + if(multi && do_multi(multi))
484 + goto show_res;
485 +#endif
486 +
487 #ifndef OPENSSL_NO_MD2
488 if (doit[D_MD2])
489 {
490 @@ -2033,8 +2122,6 @@ int MAIN(int argc, char **argv)
491 /* -O3 -fschedule-insns messes up an
492 * optimization here! names[D_EVP]
493 * somehow becomes NULL */
494 - print_message(names[D_EVP],save_count,
495 - lengths[j]);
496
497 EVP_CIPHER_CTX_init(&ctx);
498 if(decrypt)
499 @@ -2043,6 +2130,9 @@ int MAIN(int argc, char **argv)
500 EVP_EncryptInit_ex(&ctx,evp_cipher,NULL,key16,iv);
501 EVP_CIPHER_CTX_set_padding(&ctx, 0);
502
503 + print_message(names[D_EVP],save_count,
504 + lengths[j]);
505 +
506 Time_F(START);
507 if(decrypt)
508 for (count=0,run=1; COND(save_count*4*lengths[0]/lengths[j]); count++)
509 @@ -2107,6 +2197,8 @@ int MAIN(int argc, char **argv)
510 }
511 }
512 d=Time_F(STOP);
513 + if (do_cpu)
514 + rsa_cpu_usage[j][0] = calc_cpu();
515 BIO_printf(bio_err,mr ? "+R1:%ld:%d:%.2f\n"
516 : "%ld %d bit private RSA's in %.2fs\n",
517 count,rsa_bits[j],d);
518 @@ -2142,6 +2234,8 @@ int MAIN(int argc, char **argv)
519 }
520 }
521 d=Time_F(STOP);
522 + if (do_cpu)
523 + rsa_cpu_usage[j][1] = calc_cpu();
524 BIO_printf(bio_err,mr ? "+R2:%ld:%d:%.2f\n"
525 : "%ld %d bit public RSA's in %.2fs\n",
526 count,rsa_bits[j],d);
527 @@ -2201,6 +2295,8 @@ int MAIN(int argc, char **argv)
528 }
529 }
530 d=Time_F(STOP);
531 + if (do_cpu)
532 + dsa_cpu_usage[j][0] = calc_cpu();
533 BIO_printf(bio_err,mr ? "+R3:%ld:%d:%.2f\n"
534 : "%ld %d bit DSA signs in %.2fs\n",
535 count,dsa_bits[j],d);
536 @@ -2236,6 +2332,8 @@ int MAIN(int argc, char **argv)
537 }
538 }
539 d=Time_F(STOP);
540 + if (do_cpu)
541 + dsa_cpu_usage[j][1] = calc_cpu();
542 BIO_printf(bio_err,mr ? "+R4:%ld:%d:%.2f\n"
543 : "%ld %d bit DSA verify in %.2fs\n",
544 count,dsa_bits[j],d);
545 @@ -2530,14 +2628,23 @@ show_res:
546 fprintf(stdout,"The 'numbers' are in 1000s of bytes per second processed.\n");
547 fprintf(stdout,"type ");
548 }
549 - for (j=0; j<SIZE_NUM; j++)
550 + for (j=0; j<SIZE_NUM; j++) {
551 fprintf(stdout,mr ? ":%d" : "%7d bytes",lengths[j]);
552 + if (do_cpu && !mr)
553 + fprintf(stdout, " /cpu");
554 + }
555 fprintf(stdout,"\n");
556 }
557
558 for (k=0; k<ALGOR_NUM; k++)
559 {
560 if (!doit[k]) continue;
561 + if (k == D_EVP) {
562 + if (evp_cipher)
563 + names[D_EVP]=OBJ_nid2ln(evp_cipher->nid);
564 + else
565 + names[D_EVP]=OBJ_nid2ln(evp_md->type);
566 + }
567 if(mr)
568 fprintf(stdout,"+F:%d:%s",k,names[k]);
569 else
570 @@ -2548,6 +2655,8 @@ show_res:
571 fprintf(stdout," %11.2fk",results[k][j]/1e3);
572 else
573 fprintf(stdout,mr ? ":%.2f" : " %11.2f ",results[k][j]);
574 + if (do_cpu)
575 + fprintf(stdout, mr ? "/%d" : "/%%%-3d", cpu_usage[k][j]);
576 }
577 fprintf(stdout,"\n");
578 }
579 @@ -2562,13 +2671,18 @@ show_res:
580 j=0;
581 }
582 if(mr)
583 - fprintf(stdout,"+F2:%u:%u:%f:%f\n",
584 - k,rsa_bits[k],rsa_results[k][0],
585 - rsa_results[k][1]);
586 - else
587 - fprintf(stdout,"rsa %4u bits %8.6fs %8.6fs %8.1f %8.1f\n",
588 - rsa_bits[k],rsa_results[k][0],rsa_results[k][1],
589 - 1.0/rsa_results[k][0],1.0/rsa_results[k][1]);
590 + fprintf(stdout,"+F2:%u:%u:%f", k,rsa_bits[k],rsa_results[k][0]);
591 + else
592 + fprintf(stdout,"rsa %4u bits %8.6fs",rsa_bits[k],rsa_results[k][0]);
593 + if (do_cpu)
594 + fprintf(stdout, mr ? "/%d": "/%%%-3d", rsa_cpu_usage[k][0]);
595 + fprintf(stdout, mr ? ":%f" : " %8.6fs", rsa_results[k][1]);
596 + if (do_cpu)
597 + fprintf(stdout, mr ? "/%d": "/%%%-3d", rsa_cpu_usage[k][1]);
598 + if(!mr)
599 + fprintf(stdout, " %8.1f %8.1f",
600 + 1.0/rsa_results[k][0],1.0/rsa_results[k][1]);
601 + fprintf(stdout, "\n");
602 }
603 #endif
604 #ifndef OPENSSL_NO_DSA
605 @@ -2582,12 +2696,18 @@ show_res:
606 j=0;
607 }
608 if(mr)
609 - fprintf(stdout,"+F3:%u:%u:%f:%f\n",
610 - k,dsa_bits[k],dsa_results[k][0],dsa_results[k][1]);
611 + fprintf(stdout,"+F3:%u:%u:%f", k,dsa_bits[k],dsa_results[k][0]);
612 else
613 - fprintf(stdout,"dsa %4u bits %8.6fs %8.6fs %8.1f %8.1f\n",
614 - dsa_bits[k],dsa_results[k][0],dsa_results[k][1],
615 - 1.0/dsa_results[k][0],1.0/dsa_results[k][1]);
616 + fprintf(stdout,"dsa %4u bits %8.6fs",dsa_bits[k],dsa_results[k][0]);
617 + if (do_cpu)
618 + fprintf(stdout, mr ? "/%d": "/%%%-3d", dsa_cpu_usage[k][0]);
619 + fprintf(stdout, mr ? ":%f" : " %8.6fs", dsa_results[k][1]);
620 + if (do_cpu)
621 + fprintf(stdout, mr ? "/%d": "/%%%-3d", dsa_cpu_usage[k][1]);
622 + if(!mr)
623 + fprintf(stdout, " %8.1f %8.1f",
624 + 1.0/dsa_results[k][0],1.0/dsa_results[k][1]);
625 + fprintf(stdout, "\n");
626 }
627 #endif
628 #ifndef OPENSSL_NO_ECDSA
629 @@ -2712,8 +2832,10 @@ static void pkey_print_message(const cha
630
631 static void print_result(int alg,int run_no,int count,double time_used)
632 {
633 - BIO_printf(bio_err,mr ? "+R:%d:%s:%f\n"
634 - : "%d %s's in %.2fs\n",count,names[alg],time_used);
635 + if (do_cpu)
636 + cpu_usage[alg][run_no] = calc_cpu();
637 + BIO_printf(bio_err,mr ? "+R:%ld:%s:%f\n"
638 + : "%ld %s's in %.2fs\n",count,names[alg],time_used);
639 results[alg][run_no]=((double)count)/time_used*lengths[run_no];
640 }
641
642 @@ -2806,29 +2928,11 @@ static int do_multi(int multi)
643 p=buf+3;
644 alg=atoi(sstrsep(&p,sep));
645 sstrsep(&p,sep);
646 - for(j=0 ; j < SIZE_NUM ; ++j)
647 + for(j=0 ; j < SIZE_NUM ; ++j) {
648 + if (do_cpu && strchr(p, '/'))
649 + cpu_usage[alg][j] = atoi(strchr(p, '/') + 1);
650 results[alg][j]+=atof(sstrsep(&p,sep));
651 }
652 - else if(!strncmp(buf,"+F2:",4))
653 - {
654 - int k;
655 - double d;
656 -
657 - p=buf+4;
658 - k=atoi(sstrsep(&p,sep));
659 - sstrsep(&p,sep);
660 -
661 - d=atof(sstrsep(&p,sep));
662 - if(n)
663 - rsa_results[k][0]=1/(1/rsa_results[k][0]+1/d);
664 - else
665 - rsa_results[k][0]=d;
666 -
667 - d=atof(sstrsep(&p,sep));
668 - if(n)
669 - rsa_results[k][1]=1/(1/rsa_results[k][1]+1/d);
670 - else
671 - rsa_results[k][1]=d;
672 }
673 else if(!strncmp(buf,"+F2:",4))
674 {
675 @@ -2839,12 +2943,18 @@ static int do_multi(int multi)
676 k=atoi(sstrsep(&p,sep));
677 sstrsep(&p,sep);
678
679 + /* before we move the token along */
680 + if (do_cpu && strchr(p, '/'))
681 + rsa_cpu_usage[k][0] = atoi(strchr(p, '/') + 1);
682 d=atof(sstrsep(&p,sep));
683 if(n)
684 rsa_results[k][0]=1/(1/rsa_results[k][0]+1/d);
685 else
686 rsa_results[k][0]=d;
687
688 + /* before we move the token along */
689 + if (do_cpu && strchr(p, '/'))
690 + rsa_cpu_usage[k][1] = atoi(strchr(p, '/') + 1);
691 d=atof(sstrsep(&p,sep));
692 if(n)
693 rsa_results[k][1]=1/(1/rsa_results[k][1]+1/d);
694 @@ -2860,12 +2970,18 @@ static int do_multi(int multi)
695 k=atoi(sstrsep(&p,sep));
696 sstrsep(&p,sep);
697
698 + /* before we move the token along */
699 + if (do_cpu && strchr(p, '/'))
700 + dsa_cpu_usage[k][0] = atoi(strchr(p, '/') + 1);
701 d=atof(sstrsep(&p,sep));
702 if(n)
703 dsa_results[k][0]=1/(1/dsa_results[k][0]+1/d);
704 else
705 dsa_results[k][0]=d;
706
707 + /* before we move the token along */
708 + if (do_cpu && strchr(p, '/'))
709 + dsa_cpu_usage[k][1] = atoi(strchr(p, '/') + 1);
710 d=atof(sstrsep(&p,sep));
711 if(n)
712 dsa_results[k][1]=1/(1/dsa_results[k][1]+1/d);
713 --- a/crypto/cryptlib.h
714 +++ b/crypto/cryptlib.h
715 @@ -62,7 +62,7 @@
716 #include <stdlib.h>
717 #include <string.h>
718
719 -#include "e_os.h"
720 +#include <openssl/e_os.h>
721
722 #ifdef OPENSSL_USE_APPLINK
723 #define BIO_FLAGS_UPLINK 0x8000
724 --- a/crypto/engine/eng_all.c
725 +++ b/crypto/engine/eng_all.c
726 @@ -104,7 +104,7 @@ void ENGINE_load_builtin_engines(void)
727 #endif
728 #endif
729 #ifndef OPENSSL_NO_HW
730 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
731 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
732 ENGINE_load_cryptodev();
733 #endif
734 #if defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_NO_CAPIENG)
735 @@ -113,7 +113,7 @@ void ENGINE_load_builtin_engines(void)
736 #endif
737 }
738
739 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
740 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
741 void ENGINE_setup_bsd_cryptodev(void) {
742 static int bsd_cryptodev_default_loaded = 0;
743 if (!bsd_cryptodev_default_loaded) {
744 --- a/crypto/engine/eng_cryptodev.c
745 +++ b/crypto/engine/eng_cryptodev.c
746 @@ -68,6 +68,16 @@ ENGINE_load_cryptodev(void)
747 struct dev_crypto_state {
748 struct session_op d_sess;
749 int d_fd;
750 +
751 +#ifdef USE_CRYPTODEV_DIGESTS
752 + char dummy_mac_key[20];
753 +
754 + unsigned char digest_res[20];
755 + char *mac_data;
756 + int mac_len;
757 +
758 + int copy;
759 +#endif
760 };
761
762 static u_int32_t cryptodev_asymfeat = 0;
763 @@ -75,9 +85,11 @@ static u_int32_t cryptodev_asymfeat = 0;
764 static int get_asym_dev_crypto(void);
765 static int open_dev_crypto(void);
766 static int get_dev_crypto(void);
767 +#if 0
768 static int cryptodev_max_iv(int cipher);
769 static int cryptodev_key_length_valid(int cipher, int len);
770 static int cipher_nid_to_cryptodev(int nid);
771 +#endif
772 static int get_cryptodev_ciphers(const int **cnids);
773 static int get_cryptodev_digests(const int **cnids);
774 static int cryptodev_usable_ciphers(const int **nids);
775 @@ -100,7 +112,7 @@ static int cryptodev_asym(struct crypt_k
776 static int cryptodev_bn_mod_exp(BIGNUM *r, const BIGNUM *a,
777 const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
778 static int cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I,
779 - RSA *rsa);
780 + RSA *rsa, BN_CTX *ctx);
781 static int cryptodev_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
782 static int cryptodev_dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, BIGNUM *a,
783 const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
784 @@ -130,9 +142,12 @@ static struct {
785 int ivmax;
786 int keylen;
787 } ciphers[] = {
788 + { CRYPTO_ARC4, NID_rc4, 0, 16, },
789 { CRYPTO_DES_CBC, NID_des_cbc, 8, 8, },
790 { CRYPTO_3DES_CBC, NID_des_ede3_cbc, 8, 24, },
791 { CRYPTO_AES_CBC, NID_aes_128_cbc, 16, 16, },
792 + { CRYPTO_AES_CBC, NID_aes_192_cbc, 16, 24, },
793 + { CRYPTO_AES_CBC, NID_aes_256_cbc, 16, 32, },
794 { CRYPTO_BLF_CBC, NID_bf_cbc, 8, 16, },
795 { CRYPTO_CAST_CBC, NID_cast5_cbc, 8, 16, },
796 { CRYPTO_SKIPJACK_CBC, NID_undef, 0, 0, },
797 @@ -142,14 +157,15 @@ static struct {
798 static struct {
799 int id;
800 int nid;
801 + int keylen;
802 } digests[] = {
803 - { CRYPTO_SHA1_HMAC, NID_hmacWithSHA1, },
804 - { CRYPTO_RIPEMD160_HMAC, NID_ripemd160, },
805 - { CRYPTO_MD5_KPDK, NID_undef, },
806 - { CRYPTO_SHA1_KPDK, NID_undef, },
807 - { CRYPTO_MD5, NID_md5, },
808 - { CRYPTO_SHA1, NID_undef, },
809 - { 0, NID_undef, },
810 + { CRYPTO_SHA1_HMAC, NID_hmacWithSHA1, 20},
811 + { CRYPTO_RIPEMD160_HMAC, NID_ripemd160, 16/*?*/},
812 + { CRYPTO_MD5_KPDK, NID_undef, 0},
813 + { CRYPTO_SHA1_KPDK, NID_undef, 0},
814 + { CRYPTO_MD5, NID_md5, 16},
815 + { CRYPTO_SHA1, NID_sha1, 20},
816 + { 0, NID_undef, 0},
817 };
818
819 /*
820 @@ -176,10 +192,17 @@ open_dev_crypto(void)
821 static int
822 get_dev_crypto(void)
823 {
824 - int fd, retfd;
825 + static int fd = -1;
826 + int retfd;
827
828 - if ((fd = open_dev_crypto()) == -1)
829 - return (-1);
830 + if (fd == -1) {
831 + if ((fd = open_dev_crypto()) == -1)
832 + return (-1);
833 + if (fcntl(fd, F_SETFD, 1) == -1) {
834 + close(fd);
835 + return (-1);
836 + }
837 + }
838 if (ioctl(fd, CRIOGET, &retfd) == -1)
839 return (-1);
840
841 @@ -202,6 +225,7 @@ get_asym_dev_crypto(void)
842 return fd;
843 }
844
845 +#if 0
846 /*
847 * XXXX this needs to be set for each alg - and determined from
848 * a running card.
849 @@ -245,6 +269,7 @@ cipher_nid_to_cryptodev(int nid)
850 return (ciphers[i].id);
851 return (0);
852 }
853 +#endif
854
855 /*
856 * Find out what ciphers /dev/crypto will let us have a session for.
857 @@ -264,7 +289,7 @@ get_cryptodev_ciphers(const int **cnids)
858 return (0);
859 }
860 memset(&sess, 0, sizeof(sess));
861 - sess.key = (caddr_t)"123456781234567812345678";
862 + sess.key = (caddr_t)"123456789abcdefghijklmno";
863
864 for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
865 if (ciphers[i].nid == NID_undef)
866 @@ -303,10 +328,12 @@ get_cryptodev_digests(const int **cnids)
867 return (0);
868 }
869 memset(&sess, 0, sizeof(sess));
870 + sess.mackey = (caddr_t)"123456789abcdefghijklmno";
871 for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
872 if (digests[i].nid == NID_undef)
873 continue;
874 sess.mac = digests[i].id;
875 + sess.mackeylen = digests[i].keylen;
876 sess.cipher = 0;
877 if (ioctl(fd, CIOCGSESSION, &sess) != -1 &&
878 ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
879 @@ -351,6 +378,9 @@ cryptodev_usable_ciphers(const int **nid
880 static int
881 cryptodev_usable_digests(const int **nids)
882 {
883 +#ifdef USE_CRYPTODEV_DIGESTS
884 + return (get_cryptodev_digests(nids));
885 +#else
886 /*
887 * XXXX just disable all digests for now, because it sucks.
888 * we need a better way to decide this - i.e. I may not
889 @@ -365,6 +395,7 @@ cryptodev_usable_digests(const int **nid
890 */
891 *nids = NULL;
892 return (0);
893 +#endif
894 }
895
896 static int
897 @@ -427,16 +458,20 @@ cryptodev_init_key(EVP_CIPHER_CTX *ctx,
898 {
899 struct dev_crypto_state *state = ctx->cipher_data;
900 struct session_op *sess = &state->d_sess;
901 - int cipher;
902 + int cipher, i;
903
904 - if ((cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NID_undef)
905 - return (0);
906 -
907 - if (ctx->cipher->iv_len > cryptodev_max_iv(cipher))
908 - return (0);
909 + for (i = 0; ciphers[i].id; i++)
910 + if (ctx->cipher->nid == ciphers[i].nid &&
911 + ctx->cipher->iv_len <= ciphers[i].ivmax &&
912 + ctx->key_len == ciphers[i].keylen) {
913 + cipher = ciphers[i].id;
914 + break;
915 + }
916
917 - if (!cryptodev_key_length_valid(cipher, ctx->key_len))
918 + if (!ciphers[i].id) {
919 + state->d_fd = -1;
920 return (0);
921 + }
922
923 memset(sess, 0, sizeof(struct session_op));
924
925 @@ -496,6 +531,20 @@ cryptodev_cleanup(EVP_CIPHER_CTX *ctx)
926 * gets called when libcrypto requests a cipher NID.
927 */
928
929 +/* RC4 */
930 +const EVP_CIPHER cryptodev_rc4 = {
931 + NID_rc4,
932 + 1, 16, 0,
933 + EVP_CIPH_VARIABLE_LENGTH,
934 + cryptodev_init_key,
935 + cryptodev_cipher,
936 + cryptodev_cleanup,
937 + sizeof(struct dev_crypto_state),
938 + NULL,
939 + NULL,
940 + NULL
941 +};
942 +
943 /* DES CBC EVP */
944 const EVP_CIPHER cryptodev_des_cbc = {
945 NID_des_cbc,
946 @@ -563,6 +612,32 @@ const EVP_CIPHER cryptodev_aes_cbc = {
947 NULL
948 };
949
950 +const EVP_CIPHER cryptodev_aes_192_cbc = {
951 + NID_aes_192_cbc,
952 + 16, 24, 16,
953 + EVP_CIPH_CBC_MODE,
954 + cryptodev_init_key,
955 + cryptodev_cipher,
956 + cryptodev_cleanup,
957 + sizeof(struct dev_crypto_state),
958 + EVP_CIPHER_set_asn1_iv,
959 + EVP_CIPHER_get_asn1_iv,
960 + NULL
961 +};
962 +
963 +const EVP_CIPHER cryptodev_aes_256_cbc = {
964 + NID_aes_256_cbc,
965 + 16, 32, 16,
966 + EVP_CIPH_CBC_MODE,
967 + cryptodev_init_key,
968 + cryptodev_cipher,
969 + cryptodev_cleanup,
970 + sizeof(struct dev_crypto_state),
971 + EVP_CIPHER_set_asn1_iv,
972 + EVP_CIPHER_get_asn1_iv,
973 + NULL
974 +};
975 +
976 /*
977 * Registered by the ENGINE when used to find out how to deal with
978 * a particular NID in the ENGINE. this says what we'll do at the
979 @@ -576,6 +651,9 @@ cryptodev_engine_ciphers(ENGINE *e, cons
980 return (cryptodev_usable_ciphers(nids));
981
982 switch (nid) {
983 + case NID_rc4:
984 + *cipher = &cryptodev_rc4;
985 + break;
986 case NID_des_ede3_cbc:
987 *cipher = &cryptodev_3des_cbc;
988 break;
989 @@ -591,6 +669,12 @@ cryptodev_engine_ciphers(ENGINE *e, cons
990 case NID_aes_128_cbc:
991 *cipher = &cryptodev_aes_cbc;
992 break;
993 + case NID_aes_192_cbc:
994 + *cipher = &cryptodev_aes_192_cbc;
995 + break;
996 + case NID_aes_256_cbc:
997 + *cipher = &cryptodev_aes_256_cbc;
998 + break;
999 default:
1000 *cipher = NULL;
1001 break;
1002 @@ -598,6 +682,234 @@ cryptodev_engine_ciphers(ENGINE *e, cons
1003 return (*cipher != NULL);
1004 }
1005
1006 +
1007 +#ifdef USE_CRYPTODEV_DIGESTS
1008 +
1009 +/* convert digest type to cryptodev */
1010 +static int
1011 +digest_nid_to_cryptodev(int nid)
1012 +{
1013 + int i;
1014 +
1015 + for (i = 0; digests[i].id; i++)
1016 + if (digests[i].nid == nid)
1017 + return (digests[i].id);
1018 + return (0);
1019 +}
1020 +
1021 +
1022 +static int
1023 +digest_key_length(int nid)
1024 +{
1025 + int i;
1026 +
1027 + for (i = 0; digests[i].id; i++)
1028 + if (digests[i].nid == nid)
1029 + return digests[i].keylen;
1030 + return (0);
1031 +}
1032 +
1033 +
1034 +static int cryptodev_digest_init(EVP_MD_CTX *ctx)
1035 +{
1036 + struct dev_crypto_state *state = ctx->md_data;
1037 + struct session_op *sess = &state->d_sess;
1038 + int digest;
1039 +
1040 + if ((digest = digest_nid_to_cryptodev(ctx->digest->type)) == NID_undef){
1041 + printf("cryptodev_digest_init: Can't get digest \n");
1042 + return (0);
1043 + }
1044 +
1045 + memset(state, 0, sizeof(struct dev_crypto_state));
1046 +
1047 + if ((state->d_fd = get_dev_crypto()) < 0) {
1048 + printf("cryptodev_digest_init: Can't get Dev \n");
1049 + return (0);
1050 + }
1051 +
1052 + sess->mackey = state->dummy_mac_key;
1053 + sess->mackeylen = digest_key_length(ctx->digest->type);
1054 + sess->mac = digest;
1055 +
1056 + if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
1057 + close(state->d_fd);
1058 + state->d_fd = -1;
1059 + printf("cryptodev_digest_init: Open session failed\n");
1060 + return (0);
1061 + }
1062 +
1063 + return (1);
1064 +}
1065 +
1066 +static int cryptodev_digest_update(EVP_MD_CTX *ctx, const void *data,
1067 + size_t count)
1068 +{
1069 + struct crypt_op cryp;
1070 + struct dev_crypto_state *state = ctx->md_data;
1071 + struct session_op *sess = &state->d_sess;
1072 +
1073 + if (!data || state->d_fd < 0) {
1074 + printf("cryptodev_digest_update: illegal inputs \n");
1075 + return (0);
1076 + }
1077 +
1078 + if (!count) {
1079 + return (0);
1080 + }
1081 +
1082 + if (!(ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)) {
1083 + /* if application doesn't support one buffer */
1084 + state->mac_data = OPENSSL_realloc(state->mac_data, state->mac_len + count);
1085 +
1086 + if (!state->mac_data) {
1087 + printf("cryptodev_digest_update: realloc failed\n");
1088 + return (0);
1089 + }
1090 +
1091 + memcpy(state->mac_data + state->mac_len, data, count);
1092 + state->mac_len += count;
1093 +
1094 + return (1);
1095 + }
1096 +
1097 + memset(&cryp, 0, sizeof(cryp));
1098 +
1099 + cryp.ses = sess->ses;
1100 + cryp.flags = 0;
1101 + cryp.len = count;
1102 + cryp.src = (caddr_t) data;
1103 + cryp.dst = NULL;
1104 + cryp.mac = state->digest_res;
1105 + if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
1106 + printf("cryptodev_digest_update: digest failed\n");
1107 + return (0);
1108 + }
1109 + return (1);
1110 +}
1111 +
1112 +
1113 +static int cryptodev_digest_final(EVP_MD_CTX *ctx, unsigned char *md)
1114 +{
1115 + struct crypt_op cryp;
1116 + struct dev_crypto_state *state = ctx->md_data;
1117 + struct session_op *sess = &state->d_sess;
1118 +
1119 + int ret = 1;
1120 +
1121 + if (!md || state->d_fd < 0) {
1122 + printf("cryptodev_digest_final: illegal input\n");
1123 + return(0);
1124 + }
1125 +
1126 + if (! (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) ) {
1127 + /* if application doesn't support one buffer */
1128 + memset(&cryp, 0, sizeof(cryp));
1129 +
1130 + cryp.ses = sess->ses;
1131 + cryp.flags = 0;
1132 + cryp.len = state->mac_len;
1133 + cryp.src = state->mac_data;
1134 + cryp.dst = NULL;
1135 + cryp.mac = md;
1136 +
1137 + if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
1138 + printf("cryptodev_digest_final: digest failed\n");
1139 + return (0);
1140 + }
1141 +
1142 + return 1;
1143 + }
1144 +
1145 + memcpy(md, state->digest_res, ctx->digest->md_size);
1146 +
1147 + return (ret);
1148 +}
1149 +
1150 +
1151 +static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
1152 +{
1153 + int ret = 1;
1154 + struct dev_crypto_state *state = ctx->md_data;
1155 + struct session_op *sess = &state->d_sess;
1156 +
1157 + if (state->d_fd < 0) {
1158 + printf("cryptodev_digest_cleanup: illegal input\n");
1159 + return (0);
1160 + }
1161 +
1162 + if (state->mac_data) {
1163 + OPENSSL_free(state->mac_data);
1164 + state->mac_data = NULL;
1165 + state->mac_len = 0;
1166 + }
1167 +
1168 + if (state->copy)
1169 + return 1;
1170 +
1171 + if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) < 0) {
1172 + printf("cryptodev_digest_cleanup: failed to close session\n");
1173 + ret = 0;
1174 + } else {
1175 + ret = 1;
1176 + }
1177 + close(state->d_fd);
1178 + state->d_fd = -1;
1179 +
1180 + return (ret);
1181 +}
1182 +
1183 +static int cryptodev_digest_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from)
1184 +{
1185 + struct dev_crypto_state *fstate = from->md_data;
1186 + struct dev_crypto_state *dstate = to->md_data;
1187 +
1188 + memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
1189 +
1190 + if (fstate->mac_len != 0) {
1191 + dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
1192 + memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
1193 + }
1194 +
1195 + dstate->copy = 1;
1196 +
1197 + return 1;
1198 +}
1199 +
1200 +
1201 +const EVP_MD cryptodev_sha1 = {
1202 + NID_sha1,
1203 + NID_undef,
1204 + SHA_DIGEST_LENGTH,
1205 + EVP_MD_FLAG_ONESHOT,
1206 + cryptodev_digest_init,
1207 + cryptodev_digest_update,
1208 + cryptodev_digest_final,
1209 + cryptodev_digest_copy,
1210 + cryptodev_digest_cleanup,
1211 + EVP_PKEY_NULL_method,
1212 + SHA_CBLOCK,
1213 + sizeof(struct dev_crypto_state),
1214 +};
1215 +
1216 +const EVP_MD cryptodev_md5 = {
1217 + NID_md5,
1218 + NID_undef,
1219 + 16 /* MD5_DIGEST_LENGTH */,
1220 + EVP_MD_FLAG_ONESHOT,
1221 + cryptodev_digest_init,
1222 + cryptodev_digest_update,
1223 + cryptodev_digest_final,
1224 + cryptodev_digest_copy,
1225 + cryptodev_digest_cleanup,
1226 + EVP_PKEY_NULL_method,
1227 + 64 /* MD5_CBLOCK */,
1228 + sizeof(struct dev_crypto_state),
1229 +};
1230 +
1231 +#endif /* USE_CRYPTODEV_DIGESTS */
1232 +
1233 +
1234 static int
1235 cryptodev_engine_digests(ENGINE *e, const EVP_MD **digest,
1236 const int **nids, int nid)
1237 @@ -606,10 +918,15 @@ cryptodev_engine_digests(ENGINE *e, cons
1238 return (cryptodev_usable_digests(nids));
1239
1240 switch (nid) {
1241 +#ifdef USE_CRYPTODEV_DIGESTS
1242 case NID_md5:
1243 - *digest = NULL; /* need to make a clean md5 critter */
1244 + *digest = &cryptodev_md5;
1245 break;
1246 + case NID_sha1:
1247 + *digest = &cryptodev_sha1;
1248 + break;
1249 default:
1250 +#endif /* USE_CRYPTODEV_DIGESTS */
1251 *digest = NULL;
1252 break;
1253 }
1254 @@ -625,7 +942,7 @@ static int
1255 bn2crparam(const BIGNUM *a, struct crparam *crp)
1256 {
1257 int i, j, k;
1258 - ssize_t words, bytes, bits;
1259 + ssize_t bytes, bits;
1260 u_char *b;
1261
1262 crp->crp_p = NULL;
1263 @@ -637,6 +954,7 @@ bn2crparam(const BIGNUM *a, struct crpar
1264 b = malloc(bytes);
1265 if (b == NULL)
1266 return (1);
1267 + memset(b, 0, bytes);
1268
1269 crp->crp_p = b;
1270 crp->crp_nbits = bits;
1271 @@ -681,7 +999,7 @@ zapparams(struct crypt_kop *kop)
1272 {
1273 int i;
1274
1275 - for (i = 0; i <= kop->crk_iparams + kop->crk_oparams; i++) {
1276 + for (i = 0; i < kop->crk_iparams + kop->crk_oparams; i++) {
1277 if (kop->crk_param[i].crp_p)
1278 free(kop->crk_param[i].crp_p);
1279 kop->crk_param[i].crp_p = NULL;
1280 @@ -756,12 +1074,10 @@ err:
1281 }
1282
1283 static int
1284 -cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
1285 +cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
1286 {
1287 int r;
1288 - BN_CTX *ctx;
1289 -
1290 - ctx = BN_CTX_new();
1291 + ctx = BN_CTX_new(); /* not sure why we reallocate this. DM */
1292 r = cryptodev_bn_mod_exp(r0, I, rsa->d, rsa->n, ctx, NULL);
1293 BN_CTX_free(ctx);
1294 return (r);
1295 --- a/crypto/engine/engine.h
1296 +++ b/crypto/engine/engine.h
1297 @@ -703,7 +703,7 @@ typedef int (*dynamic_bind_engine)(ENGIN
1298 * values. */
1299 void *ENGINE_get_static_state(void);
1300
1301 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
1302 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
1303 void ENGINE_setup_bsd_cryptodev(void);
1304 #endif
1305
1306 --- a/crypto/evp/c_all.c
1307 +++ b/crypto/evp/c_all.c
1308 @@ -83,7 +83,7 @@ void OPENSSL_add_all_algorithms_noconf(v
1309 OpenSSL_add_all_ciphers();
1310 OpenSSL_add_all_digests();
1311 #ifndef OPENSSL_NO_ENGINE
1312 -# if defined(__OpenBSD__) || defined(__FreeBSD__)
1313 +# if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
1314 ENGINE_setup_bsd_cryptodev();
1315 # endif
1316 #endif
1317 --- a/crypto/evp/c_alld.c
1318 +++ b/crypto/evp/c_alld.c
1319 @@ -81,7 +81,7 @@ void OpenSSL_add_all_digests(void)
1320 EVP_add_digest(EVP_dss());
1321 #endif
1322 #endif
1323 -#ifndef OPENSSL_NO_SHA
1324 +#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
1325 EVP_add_digest(EVP_sha1());
1326 EVP_add_digest_alias(SN_sha1,"ssl3-sha1");
1327 EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA);
1328 --- a/engines/Makefile
1329 +++ b/engines/Makefile
1330 @@ -96,6 +96,7 @@ install:
1331 ( echo installing $$l; \
1332 if [ "$(PLATFORM)" != "Cygwin" ]; then \
1333 case "$(CFLAGS)" in \
1334 + *OPENSSL_NO_HW*) continue;; \
1335 *DSO_DLFCN*) sfx="so";; \
1336 *DSO_DL*) sfx="sl";; \
1337 *) sfx="bad";; \
1338 --- a/util/domd
1339 +++ b/util/domd
1340 @@ -23,13 +23,17 @@ if [ "$D" = "gcc" ]; then
1341 done
1342 sed -e '/^# DO NOT DELETE.*/,$d' < Makefile > Makefile.tmp
1343 echo '# DO NOT DELETE THIS LINE -- make depend depends on it.' >> Makefile.tmp
1344 - ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND -M $args >> Makefile.tmp
1345 + ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND -M $args >> Makefile.tmp && \
1346 ${PERL} $TOP/util/clean-depend.pl < Makefile.tmp > Makefile.new
1347 + RC=$?
1348 rm -f Makefile.tmp
1349 else
1350 - ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND $@
1351 + ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND $@ && \
1352 ${PERL} $TOP/util/clean-depend.pl < Makefile > Makefile.new
1353 + RC=$?
1354 fi
1355 mv Makefile.new Makefile
1356 # unfake the presence of Kerberos
1357 rm $TOP/krb5.h
1358 +
1359 +exit $RC
Personal OpenWRT clone
This page took 0.086454 seconds and 5 git commands to generate.