5 files changed, 102 insertions, 27 deletions

diff --git a/src/lib/libcrypto/engine/Makefile b/src/lib/libcrypto/engine/Makefile
index 9c214824eb..d29bdd09a0 100644
--- a/src/lib/libcrypto/engine/Makefile
+++ b/src/lib/libcrypto/engine/Makefile
@@ -21,12 +21,14 @@ LIBSRC= eng_err.c eng_lib.c eng_list.c eng_init.c eng_ctrl.c \
         eng_table.c eng_pkey.c eng_fat.c eng_all.c \
         tb_rsa.c tb_dsa.c tb_ecdsa.c tb_dh.c tb_ecdh.c tb_rand.c tb_store.c \
         tb_cipher.c tb_digest.c tb_pkmeth.c tb_asnmth.c \
-        eng_openssl.c eng_cnf.c eng_dyn.c eng_cryptodev.c
+        eng_openssl.c eng_cnf.c eng_dyn.c eng_cryptodev.c \
+        eng_rsax.c eng_rdrand.c
 LIBOBJ= eng_err.o eng_lib.o eng_list.o eng_init.o eng_ctrl.o \
         eng_table.o eng_pkey.o eng_fat.o eng_all.o \
         tb_rsa.o tb_dsa.o tb_ecdsa.o tb_dh.o tb_ecdh.o tb_rand.o tb_store.o \
         tb_cipher.o tb_digest.o tb_pkmeth.o tb_asnmth.o \
-        eng_openssl.o eng_cnf.o eng_dyn.o eng_cryptodev.o
+        eng_openssl.o eng_cnf.o eng_dyn.o eng_cryptodev.o \
+        eng_rsax.o eng_rdrand.o
 
 SRC= $(LIBSRC)
 
@@ -249,6 +251,34 @@ eng_pkey.o: ../../include/openssl/pkcs7.h ../../include/openssl/safestack.h
 eng_pkey.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 eng_pkey.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
 eng_pkey.o: ../../include/openssl/x509_vfy.h ../cryptlib.h eng_int.h eng_pkey.c
+eng_rdrand.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+eng_rdrand.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+eng_rdrand.o: ../../include/openssl/e_os2.h ../../include/openssl/ec.h
+eng_rdrand.o: ../../include/openssl/ecdh.h ../../include/openssl/ecdsa.h
+eng_rdrand.o: ../../include/openssl/engine.h ../../include/openssl/err.h
+eng_rdrand.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
+eng_rdrand.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+eng_rdrand.o: ../../include/openssl/opensslconf.h
+eng_rdrand.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+eng_rdrand.o: ../../include/openssl/pkcs7.h ../../include/openssl/rand.h
+eng_rdrand.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+eng_rdrand.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+eng_rdrand.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+eng_rdrand.o: eng_rdrand.c
+eng_rsax.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+eng_rsax.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+eng_rsax.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
+eng_rsax.o: ../../include/openssl/ec.h ../../include/openssl/ecdh.h
+eng_rsax.o: ../../include/openssl/ecdsa.h ../../include/openssl/engine.h
+eng_rsax.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+eng_rsax.o: ../../include/openssl/lhash.h ../../include/openssl/obj_mac.h
+eng_rsax.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+eng_rsax.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+eng_rsax.o: ../../include/openssl/pkcs7.h ../../include/openssl/rsa.h
+eng_rsax.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+eng_rsax.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+eng_rsax.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+eng_rsax.o: eng_rsax.c
 eng_table.o: ../../e_os.h ../../include/openssl/asn1.h
 eng_table.o: ../../include/openssl/bio.h ../../include/openssl/buffer.h
 eng_table.o: ../../include/openssl/crypto.h ../../include/openssl/e_os2.h
diff --git a/src/lib/libcrypto/engine/eng_all.c b/src/lib/libcrypto/engine/eng_all.c
index 79d1f2beff..0ae5d672b1 100644
--- a/src/lib/libcrypto/engine/eng_all.c
+++ b/src/lib/libcrypto/engine/eng_all.c
@@ -61,6 +61,8 @@
 
 void ENGINE_load_builtin_engines(void)
         {
+        /* Some ENGINEs need this */
+        OPENSSL_cpuid_setup();
 #if 0
         /* There's no longer any need for an "openssl" ENGINE unless, one day,
          * it is the *only* way for standard builtin implementations to be be
@@ -72,10 +74,12 @@ void ENGINE_load_builtin_engines(void)
         ENGINE_load_cryptodev();
 #endif
 
-#if !defined(OPENSSL_NO_HW) && !defined(OPENSSL_NO_HW_AESNI)
-        ENGINE_load_aesni();
+#ifndef OPENSSL_NO_RSAX
+        ENGINE_load_rsax();
+#endif
+#ifndef OPENSSL_NO_RDRAND
+        ENGINE_load_rdrand();
 #endif
-
         ENGINE_load_dynamic();
 #ifndef OPENSSL_NO_STATIC_ENGINE
 #ifndef OPENSSL_NO_HW
@@ -117,6 +121,7 @@ void ENGINE_load_builtin_engines(void)
         ENGINE_load_capi();
 #endif
 #endif
+        ENGINE_register_all_complete();
         }
 
 #if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
diff --git a/src/lib/libcrypto/engine/eng_cryptodev.c b/src/lib/libcrypto/engine/eng_cryptodev.c
index 10b3856b4e..a7abac1a7b 100644
--- a/src/lib/libcrypto/engine/eng_cryptodev.c
+++ b/src/lib/libcrypto/engine/eng_cryptodev.c
@@ -79,8 +79,6 @@ struct dev_crypto_state {
         unsigned char digest_res[HASH_MAX_LEN];
         char *mac_data;
         int mac_len;
-
-        int copy;
 #endif
 };
 
@@ -199,6 +197,7 @@ get_dev_crypto(void)
 
         if ((fd = open_dev_crypto()) == -1)
                 return (-1);
+#ifndef CRIOGET_NOT_NEEDED
         if (ioctl(fd, CRIOGET, &retfd) == -1)
                 return (-1);
 
@@ -207,9 +206,19 @@ get_dev_crypto(void)
                 close(retfd);
                 return (-1);
         }
+#else
+        retfd = fd;
+#endif
         return (retfd);
 }
 
+static void put_dev_crypto(int fd)
+{
+#ifndef CRIOGET_NOT_NEEDED
+        close(fd);
+#endif
+}
+
 /* Caching version for asym operations */
 static int
 get_asym_dev_crypto(void)
@@ -251,7 +260,7 @@ get_cryptodev_ciphers(const int **cnids)
                     ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
                         nids[count++] = ciphers[i].nid;
         }
-        close(fd);
+        put_dev_crypto(fd);
 
         if (count > 0)
                 *cnids = nids;
@@ -290,7 +299,7 @@ get_cryptodev_digests(const int **cnids)
                     ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
                         nids[count++] = digests[i].nid;
         }
-        close(fd);
+        put_dev_crypto(fd);
 
         if (count > 0)
                 *cnids = nids;
@@ -435,7 +444,7 @@ cryptodev_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
         sess->cipher = cipher;
 
         if (ioctl(state->d_fd, CIOCGSESSION, sess) == -1) {
-                close(state->d_fd);
+                put_dev_crypto(state->d_fd);
                 state->d_fd = -1;
                 return (0);
         }
@@ -472,7 +481,7 @@ cryptodev_cleanup(EVP_CIPHER_CTX *ctx)
         } else {
                 ret = 1;
         }
-        close(state->d_fd);
+        put_dev_crypto(state->d_fd);
         state->d_fd = -1;
 
         return (ret);
@@ -685,7 +694,7 @@ static int cryptodev_digest_init(EVP_MD_CTX *ctx)
         sess->mac = digest;
 
         if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
-                close(state->d_fd);
+                put_dev_crypto(state->d_fd);
                 state->d_fd = -1;
                 printf("cryptodev_digest_init: Open session failed\n");
                 return (0);
@@ -757,14 +766,12 @@ static int cryptodev_digest_final(EVP_MD_CTX *ctx, unsigned char *md)
         if (! (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) ) {
                 /* if application doesn't support one buffer */
                 memset(&cryp, 0, sizeof(cryp));
-
                 cryp.ses = sess->ses;
                 cryp.flags = 0;
                 cryp.len = state->mac_len;
                 cryp.src = state->mac_data;
                 cryp.dst = NULL;
                 cryp.mac = (caddr_t)md;
-
                 if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
                         printf("cryptodev_digest_final: digest failed\n");
                         return (0);
@@ -785,6 +792,9 @@ static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
         struct dev_crypto_state *state = ctx->md_data;
         struct session_op *sess = &state->d_sess;
 
+        if (state == NULL)
+          return 0;
+
         if (state->d_fd < 0) {
                 printf("cryptodev_digest_cleanup: illegal input\n");
                 return (0);
@@ -796,16 +806,13 @@ static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
                 state->mac_len = 0;
         }
 
-        if (state->copy)
-                return 1;
-
         if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) < 0) {
                 printf("cryptodev_digest_cleanup: failed to close session\n");
                 ret = 0;
         } else {
                 ret = 1;
         }
-        close(state->d_fd);     
+        put_dev_crypto(state->d_fd);    
         state->d_fd = -1;
 
         return (ret);
@@ -815,15 +822,39 @@ static int cryptodev_digest_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from)
 {
         struct dev_crypto_state *fstate = from->md_data;
         struct dev_crypto_state *dstate = to->md_data;
+        struct session_op *sess;
+        int digest;
 
-        memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
+        if (dstate == NULL || fstate == NULL)
+          return 1;
 
-        if (fstate->mac_len != 0) {
-                dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
-                memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
+        memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
+
+        sess = &dstate->d_sess;
+
+        digest = digest_nid_to_cryptodev(to->digest->type);
+
+        sess->mackey = dstate->dummy_mac_key;
+        sess->mackeylen = digest_key_length(to->digest->type);
+        sess->mac = digest;
+
+        dstate->d_fd = get_dev_crypto();
+
+        if (ioctl(dstate->d_fd, CIOCGSESSION, sess) < 0) {
+                put_dev_crypto(dstate->d_fd);
+                dstate->d_fd = -1;
+                printf("cryptodev_digest_init: Open session failed\n");
+                return (0);
         }
 
-        dstate->copy = 1;
+        if (fstate->mac_len != 0) {
+                if (fstate->mac_data != NULL)
+                        {
+                        dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
+                        memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
+                        dstate->mac_len = fstate->mac_len;
+                        }
+        }
 
         return 1;
 }
@@ -1346,11 +1377,11 @@ ENGINE_load_cryptodev(void)
          * find out what asymmetric crypto algorithms we support
          */
         if (ioctl(fd, CIOCASYMFEAT, &cryptodev_asymfeat) == -1) {
-                close(fd);
+                put_dev_crypto(fd);
                 ENGINE_free(engine);
                 return;
         }
-        close(fd);
+        put_dev_crypto(fd);
 
         if (!ENGINE_set_id(engine, "cryptodev") ||
             !ENGINE_set_name(engine, "BSD cryptodev engine") ||
diff --git a/src/lib/libcrypto/engine/eng_fat.c b/src/lib/libcrypto/engine/eng_fat.c
index db66e62350..789b8d57e5 100644
--- a/src/lib/libcrypto/engine/eng_fat.c
+++ b/src/lib/libcrypto/engine/eng_fat.c
@@ -176,6 +176,7 @@ int ENGINE_register_all_complete(void)
         ENGINE *e;
 
         for(e=ENGINE_get_first() ; e ; e=ENGINE_get_next(e))
-                ENGINE_register_complete(e);
+                if (!(e->flags & ENGINE_FLAGS_NO_REGISTER_ALL))
+                        ENGINE_register_complete(e);
         return 1;
         }
diff --git a/src/lib/libcrypto/engine/engine.h b/src/lib/libcrypto/engine/engine.h
index 9d73abac8e..f8be497724 100644
--- a/src/lib/libcrypto/engine/engine.h
+++ b/src/lib/libcrypto/engine/engine.h
@@ -141,6 +141,13 @@ extern "C" {
  * the existing ENGINE's structural reference count. */
 #define ENGINE_FLAGS_BY_ID_COPY         (int)0x0004
 
+/* This flag if for an ENGINE that does not want its methods registered as 
+ * part of ENGINE_register_all_complete() for example if the methods are
+ * not usable as default methods.
+ */
+
+#define ENGINE_FLAGS_NO_REGISTER_ALL    (int)0x0008
+
 /* ENGINEs can support their own command types, and these flags are used in
  * ENGINE_CTRL_GET_CMD_FLAGS to indicate to the caller what kind of input each
  * command expects. Currently only numeric and string input is supported. If a
@@ -344,7 +351,8 @@ void ENGINE_load_gost(void);
 #endif
 #endif
 void ENGINE_load_cryptodev(void);
-void ENGINE_load_aesni(void);
+void ENGINE_load_rsax(void);
+void ENGINE_load_rdrand(void);
 void ENGINE_load_builtin_engines(void);
 
 /* Get and set global flags (ENGINE_TABLE_FLAG_***) for the implementation