package/openssl/patches/200-ocf.patch

   1 diff -Naur openssl-0.9.8i.orig/Configure openssl-0.9.8i/Configure
   2 --- openssl-0.9.8i.orig/Configure       2008-10-01 04:16:01.000000000 +0200
   3 +++ openssl-0.9.8i/Configure    2008-10-01 04:16:12.000000000 +0200
   4 @@ -34,6 +34,8 @@
   5  #              (Default: KRB5_DIR/include)
   6  # --with-krb5-flavor  Declare what flavor of Kerberos 5 is used.  Currently
   7  #              supported values are "MIT" and "Heimdal".  A value is required.
   8 +# --with-cryptodev Force support for cryptodev (ie., ocf-linux)
   9 +# --with-cryptodev-digests Force support for cryptodev digests (generally slow)
  10  #
  11  # --test-sanity Make a number of sanity checks on the data in this file.
  12  #               This is a debugging tool for OpenSSL developers.
  13 @@ -540,6 +542,9 @@
  14  ##### Compaq Non-Stop Kernel (Tandem)
  15  "tandem-c89","c89:-Ww -D__TANDEM -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1 -D_TANDEM_SOURCE -DB_ENDIAN::(unknown):::THIRTY_TWO_BIT:::",
  16
  17 +# uClinux
  18 +"uClinux-dist","$ENV{'CC'}:\$(CFLAGS)::-D_REENTRANT::\$(LDFLAGS) \$(LDLIBS):BN_LLONG::::::::::::\$(LIBSSL_dlfcn):linux-shared:-fPIC:-shared:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):$ENV{'RANLIB'}",
  19 +
  20  );
  21
  22  my @MK1MF_Builds=qw(VC-WIN64I VC-WIN64A
  23 @@ -589,6 +594,8 @@
  24  my $no_asm=0;
  25  my $no_dso=0;
  26  my $no_gmp=0;
  27 +my $have_cryptodev=0;
  28 +my $use_cryptodev_digests=0;
  29  my @skip=();
  30  my $Makefile="Makefile";
  31  my $des_locl="crypto/des/des_locl.h";
  32 @@ -716,6 +723,14 @@
  33                         {
  34                         exit(&test_sanity());
  35                         }
  36 +               elsif (/^--with-cryptodev$/)
  37 +                       {
  38 +                               $have_cryptodev = 1;
  39 +                       }
  40 +               elsif (/^--with-cryptodev-digests$/)
  41 +                       {
  42 +                               $use_cryptodev_digests = 1;
  43 +                       }
  44                 elsif (/^reconfigure/ || /^reconf/)
  45                         {
  46                         if (open(IN,"<$Makefile"))
  47 @@ -924,6 +939,7 @@
  48                         print " OPENSSL_NO_$ALGO";
  49
  50                         if (/^err$/)    { $flags .= "-DOPENSSL_NO_ERR "; }
  51 +                       elsif (/^hw$/)  { $flags .= "-DOPENSSL_NO_HW "; }
  52                         elsif (/^asm$/) { $no_asm = 1; }
  53                         }
  54                 else
  55 @@ -1064,6 +1080,16 @@
  56                    $withargs{"krb5-dir"} ne "";
  57         }
  58
  59 +# enable the linux cryptodev (ocf-linux) support
  60 +if ($have_cryptodev)
  61 +       {
  62 +       if ($use_cryptodev_digests)
  63 +               {
  64 +               $cflags = "-DUSE_CRYPTODEV_DIGESTS $cflags";
  65 +               }
  66 +       $cflags = "-DHAVE_CRYPTODEV $cflags";
  67 +       }
  68 +
  69  # The DSO code currently always implements all functions so that no
  70  # applications will have to worry about that from a compilation point
  71  # of view. However, the "method"s may return zero unless that platform
  72 diff -Naur openssl-0.9.8i.orig/INSTALL openssl-0.9.8i/INSTALL
  73 --- openssl-0.9.8i.orig/INSTALL 2008-10-01 04:16:01.000000000 +0200
  74 +++ openssl-0.9.8i/INSTALL      2008-10-01 04:16:12.000000000 +0200
  75 @@ -103,6 +103,12 @@
  76                  define preprocessor symbols, specify additional libraries,
  77                  library directories or other compiler options.
  78
  79 +  --with-cryptodev Enabled the BSD cryptodev engine even if we are not using
  80 +               BSD.  Useful if you are running ocf-linux or something
  81 +               similar.  Once enabled you can also enable the use of
  82 +               cryptodev digests,  with is usually slower unless you have
  83 +               large amounts data.  Use --with-cryptodev-digests to force
  84 +               it.
  85
  86   Installation in Detail
  87   ----------------------
  88 diff -Naur openssl-0.9.8i.orig/Makefile.org openssl-0.9.8i/Makefile.org
  89 --- openssl-0.9.8i.orig/Makefile.org    2008-10-01 04:16:02.000000000 +0200
  90 +++ openssl-0.9.8i/Makefile.org 2008-10-01 04:16:12.000000000 +0200
  91 @@ -367,7 +367,7 @@
  92
  93  links:
  94         @$(PERL) $(TOP)/util/mkdir-p.pl include/openssl
  95 -       @$(PERL) $(TOP)/util/mklink.pl include/openssl $(EXHEADER)
  96 +       @$(PERL) $(TOP)/util/mklink.pl include/openssl $(HEADER) $(EXHEADER)
  97         @set -e; target=links; $(RECURSIVE_BUILD_CMD)
  98
  99  gentests:
 100 diff -Naur openssl-0.9.8i.orig/Makefile.shared openssl-0.9.8i/Makefile.shared
 101 --- openssl-0.9.8i.orig/Makefile.shared 2008-10-01 04:16:01.000000000 +0200
 102 +++ openssl-0.9.8i/Makefile.shared      2008-10-01 04:16:12.000000000 +0200
 103 @@ -6,13 +6,13 @@
 104  # properly
 105
 106  # CC contains the current compiler.  This one MUST be defined
 107 -CC=cc
 108 -CFLAGS=$(CFLAG)
 109 +CC?=cc
 110 +CFLAGS?=$(CFLAG)
 111  # LDFLAGS contains flags to be used when temporary object files (when building
 112  # shared libraries) are created, or when an application is linked.
 113  # SHARED_LDFLAGS contains flags to be used when the shared library is created.
 114 -LDFLAGS=
 115 -SHARED_LDFLAGS=
 116 +LDFLAGS?=
 117 +SHARED_LDFLAGS?=
 118
 119  # LIBNAME contains just the name of the library, without prefix ("lib"
 120  # on Unix, "cyg" for certain forms under Cygwin...) or suffix (.a, .so,
 121 diff -Naur openssl-0.9.8i.orig/apps/apps.h openssl-0.9.8i/apps/apps.h
 122 --- openssl-0.9.8i.orig/apps/apps.h     2008-10-01 04:16:02.000000000 +0200
 123 +++ openssl-0.9.8i/apps/apps.h  2008-10-01 04:16:12.000000000 +0200
 124 @@ -112,7 +112,7 @@
 125  #ifndef HEADER_APPS_H
 126  #define HEADER_APPS_H
 127
 128 -#include "e_os.h"
 129 +#include <openssl/e_os.h>
 130
 131  #include <openssl/bio.h>
 132  #include <openssl/x509.h>
 133 diff -Naur openssl-0.9.8i.orig/apps/progs.h openssl-0.9.8i/apps/progs.h
 134 --- openssl-0.9.8i.orig/apps/progs.h    2008-10-01 04:16:02.000000000 +0200
 135 +++ openssl-0.9.8i/apps/progs.h 2008-10-01 04:16:12.000000000 +0200
 136 @@ -129,7 +129,9 @@
 137  #ifndef OPENSSL_NO_ENGINE
 138         {FUNC_TYPE_GENERAL,"engine",engine_main},
 139  #endif
 140 +#ifndef OPENSSL_NO_OCSP
 141         {FUNC_TYPE_GENERAL,"ocsp",ocsp_main},
 142 +#endif
 143         {FUNC_TYPE_GENERAL,"prime",prime_main},
 144  #ifndef OPENSSL_NO_MD2
 145         {FUNC_TYPE_MD,"md2",dgst_main},
 146 diff -Naur openssl-0.9.8i.orig/apps/speed.c openssl-0.9.8i/apps/speed.c
 147 --- openssl-0.9.8i.orig/apps/speed.c    2008-10-01 04:16:02.000000000 +0200
 148 +++ openssl-0.9.8i/apps/speed.c 2008-10-01 04:16:12.000000000 +0200
 149 @@ -292,7 +292,7 @@
 150    "evp","sha256","sha512",
 151    "aes-128 ige","aes-192 ige","aes-256 ige"};
 152  static double results[ALGOR_NUM][SIZE_NUM];
 153 -static int lengths[SIZE_NUM]={16,64,256,1024,8*1024};
 154 +static int lengths[SIZE_NUM]={16,64,256,1024,2*1024,4*1024};
 155  static double rsa_results[RSA_NUM][2];
 156  static double dsa_results[DSA_NUM][2];
 157  #ifndef OPENSSL_NO_ECDSA
 158 @@ -328,6 +328,79 @@
 159  #define START  0
 160  #define STOP   1
 161
 162 +#ifdef __linux__
 163 +/*
 164 + * record CPU usage as well
 165 + */
 166 +
 167 +static int do_cpu = 0;
 168 +
 169 +struct cpu_stat {
 170 +       unsigned int    user;
 171 +       unsigned int    nice;
 172 +       unsigned int    system;
 173 +       unsigned int    idle;
 174 +       unsigned int    total;
 175 +};
 176 +
 177 +static unsigned int cpu_usage[ALGOR_NUM][SIZE_NUM];
 178 +static unsigned int rsa_cpu_usage[RSA_NUM][2];
 179 +static unsigned int dsa_cpu_usage[DSA_NUM][2];
 180 +static struct cpu_stat cpu_start, cpu_finish;
 181 +
 182 +static void
 183 +get_cpu(int s)
 184 +{
 185 +       FILE *fp = NULL;
 186 +       unsigned char   buf[80];
 187 +       struct cpu_stat *st = s == START ? &cpu_start : &cpu_finish;
 188 +
 189 +       memset(st, 0, sizeof(*st));
 190 +
 191 +       if (fp == NULL)
 192 +               fp = fopen("/proc/stat", "r");
 193 +       if (!fp)
 194 +               return;
 195 +       if (fseek(fp, 0, SEEK_SET) == -1) {
 196 +               fclose(fp);
 197 +               return;
 198 +       }
 199 +       fscanf(fp, "%s %d %d %d %d", &buf[0], &st->user, &st->nice,
 200 +               &st->system, &st->idle);
 201 +       st->total = st->user + st->nice + st->system + st->idle;
 202 +       fclose(fp);
 203 +}
 204 +
 205 +static unsigned int
 206 +calc_cpu()
 207 +{
 208 +       unsigned int total, res;
 209 +
 210 +       total  = cpu_finish.total - cpu_start.total;
 211 +       if (total <= 0)
 212 +               return 0;
 213 +#if 1 // busy
 214 +       res   = ((cpu_finish.system + cpu_finish.user + cpu_finish.nice) -
 215 +                        (cpu_start.system + cpu_start.user + cpu_start.nice)) *
 216 +                        100 / total;
 217 +#endif
 218 +#if 0 // system
 219 +       res   = (cpu_finish.system - cpu_start.system) * 100 / total;
 220 +#endif
 221 +#if 0 // user
 222 +       res   = (cpu_finish.user   - cpu_start.user)   * 100 / total;
 223 +#endif
 224 +#if 0 // nice
 225 +       res   = (cpu_finish.nice   - cpu_start.nice)   * 100 / total;
 226 +#endif
 227 +#if 0 // idle
 228 +       res   = (cpu_finish.idle   - cpu_start.idle)   * 100 / total;
 229 +#endif
 230 +       return(res);
 231 +}
 232 +
 233 +#endif
 234 +
 235  #if defined(OPENSSL_SYS_NETWARE)
 236
 237     /* for NetWare the best we can do is use clock() which returns the
 238 @@ -358,6 +431,11 @@
 239         {
 240         double ret;
 241
 242 +#ifdef __linux__
 243 +       if (do_cpu)
 244 +               get_cpu(s);
 245 +#endif
 246 +
 247  #ifdef USE_TOD
 248         if(usertime)
 249                 {
 250 @@ -832,6 +910,14 @@
 251                         j--;    /* Otherwise, -elapsed gets confused with
 252                                    an algorithm. */
 253                         }
 254 +#ifdef __linux__
 255 +               else if ((argc > 0) && (strcmp(*argv,"-cpu") == 0))
 256 +                       {
 257 +                       do_cpu = 1;
 258 +                       j--;    /* Otherwise, -cpu gets confused with
 259 +                                  an algorithm. */
 260 +                       }
 261 +#endif
 262                 else if ((argc > 0) && (strcmp(*argv,"-evp") == 0))
 263                         {
 264                         argc--;
 265 @@ -1260,6 +1346,9 @@
 266  #ifdef HAVE_FORK
 267                         BIO_printf(bio_err,"-multi n        run n benchmarks in parallel.\n");
 268  #endif
 269 +#ifdef __linux__
 270 +                       BIO_printf(bio_err,"-cpu            calculate cpu utilisation.\n");
 271 +#endif
 272                         goto end;
 273                         }
 274                 argc--;
 275 @@ -1267,11 +1356,6 @@
 276                 j++;
 277                 }
 278
 279 -#ifdef HAVE_FORK
 280 -       if(multi && do_multi(multi))
 281 -               goto show_res;
 282 -#endif
 283 -
 284         if (j == 0)
 285                 {
 286                 for (i=0; i<ALGOR_NUM; i++)
 287 @@ -1604,6 +1688,11 @@
 288         signal(SIGALRM,sig_done);
 289  #endif /* SIGALRM */
 290
 291 +#ifdef HAVE_FORK /* DM */
 292 +       if(multi && do_multi(multi))
 293 +               goto show_res;
 294 +#endif
 295 +
 296  #ifndef OPENSSL_NO_MD2
 297         if (doit[D_MD2])
 298                 {
 299 @@ -2033,8 +2122,6 @@
 300                                 /* -O3 -fschedule-insns messes up an
 301                                  * optimization here!  names[D_EVP]
 302                                  * somehow becomes NULL */
 303 -                               print_message(names[D_EVP],save_count,
 304 -                                       lengths[j]);
 305
 306                                 EVP_CIPHER_CTX_init(&ctx);
 307                                 if(decrypt)
 308 @@ -2043,6 +2130,9 @@
 309                                         EVP_EncryptInit_ex(&ctx,evp_cipher,NULL,key16,iv);
 310                                 EVP_CIPHER_CTX_set_padding(&ctx, 0);
 311
 312 +                               print_message(names[D_EVP],save_count,
 313 +                                       lengths[j]);
 314 +
 315                                 Time_F(START);
 316                                 if(decrypt)
 317                                         for (count=0,run=1; COND(save_count*4*lengths[0]/lengths[j]); count++)
 318 @@ -2107,6 +2197,8 @@
 319                                         }
 320                                 }
 321                         d=Time_F(STOP);
 322 +                       if (do_cpu)
 323 +                               rsa_cpu_usage[j][0] = calc_cpu();
 324                         BIO_printf(bio_err,mr ? "+R1:%ld:%d:%.2f\n"
 325                                    : "%ld %d bit private RSA's in %.2fs\n",
 326                                    count,rsa_bits[j],d);
 327 @@ -2142,6 +2234,8 @@
 328                                         }
 329                                 }
 330                         d=Time_F(STOP);
 331 +                       if (do_cpu)
 332 +                               rsa_cpu_usage[j][1] = calc_cpu();
 333                         BIO_printf(bio_err,mr ? "+R2:%ld:%d:%.2f\n"
 334                                    : "%ld %d bit public RSA's in %.2fs\n",
 335                                    count,rsa_bits[j],d);
 336 @@ -2201,6 +2295,8 @@
 337                                         }
 338                                 }
 339                         d=Time_F(STOP);
 340 +                       if (do_cpu)
 341 +                               dsa_cpu_usage[j][0] = calc_cpu();
 342                         BIO_printf(bio_err,mr ? "+R3:%ld:%d:%.2f\n"
 343                                    : "%ld %d bit DSA signs in %.2fs\n",
 344                                    count,dsa_bits[j],d);
 345 @@ -2236,6 +2332,8 @@
 346                                         }
 347                                 }
 348                         d=Time_F(STOP);
 349 +                       if (do_cpu)
 350 +                               dsa_cpu_usage[j][1] = calc_cpu();
 351                         BIO_printf(bio_err,mr ? "+R4:%ld:%d:%.2f\n"
 352                                    : "%ld %d bit DSA verify in %.2fs\n",
 353                                    count,dsa_bits[j],d);
 354 @@ -2530,14 +2628,23 @@
 355                         fprintf(stdout,"The 'numbers' are in 1000s of bytes per second processed.\n");
 356                         fprintf(stdout,"type        ");
 357                         }
 358 -               for (j=0;  j<SIZE_NUM; j++)
 359 +               for (j=0;  j<SIZE_NUM; j++) {
 360                         fprintf(stdout,mr ? ":%d" : "%7d bytes",lengths[j]);
 361 +                       if (do_cpu && !mr)
 362 +                               fprintf(stdout, " /cpu");
 363 +               }
 364                 fprintf(stdout,"\n");
 365                 }
 366
 367         for (k=0; k<ALGOR_NUM; k++)
 368                 {
 369                 if (!doit[k]) continue;
 370 +               if (k == D_EVP) {
 371 +                       if (evp_cipher)
 372 +                               names[D_EVP]=OBJ_nid2ln(evp_cipher->nid);
 373 +                       else
 374 +                               names[D_EVP]=OBJ_nid2ln(evp_md->type);
 375 +               }
 376                 if(mr)
 377                         fprintf(stdout,"+F:%d:%s",k,names[k]);
 378                 else
 379 @@ -2548,6 +2655,8 @@
 380                                 fprintf(stdout," %11.2fk",results[k][j]/1e3);
 381                         else
 382                                 fprintf(stdout,mr ? ":%.2f" : " %11.2f ",results[k][j]);
 383 +                       if (do_cpu)
 384 +                               fprintf(stdout, mr ? "/%d" : "/%%%-3d", cpu_usage[k][j]);
 385                         }
 386                 fprintf(stdout,"\n");
 387                 }
 388 @@ -2562,13 +2671,18 @@
 389                         j=0;
 390                         }
 391                 if(mr)
 392 -                       fprintf(stdout,"+F2:%u:%u:%f:%f\n",
 393 -                               k,rsa_bits[k],rsa_results[k][0],
 394 -                               rsa_results[k][1]);
 395 -               else
 396 -                       fprintf(stdout,"rsa %4u bits %8.6fs %8.6fs %8.1f %8.1f\n",
 397 -                               rsa_bits[k],rsa_results[k][0],rsa_results[k][1],
 398 -                               1.0/rsa_results[k][0],1.0/rsa_results[k][1]);
 399 +                       fprintf(stdout,"+F2:%u:%u:%f", k,rsa_bits[k],rsa_results[k][0]);
 400 +               else
 401 +                       fprintf(stdout,"rsa %4u bits %8.6fs",rsa_bits[k],rsa_results[k][0]);
 402 +               if (do_cpu)
 403 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", rsa_cpu_usage[k][0]);
 404 +               fprintf(stdout, mr ? ":%f" : " %8.6fs", rsa_results[k][1]);
 405 +               if (do_cpu)
 406 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", rsa_cpu_usage[k][1]);
 407 +               if(!mr)
 408 +                       fprintf(stdout, " %8.1f %8.1f",
 409 +                                       1.0/rsa_results[k][0],1.0/rsa_results[k][1]);
 410 +               fprintf(stdout, "\n");
 411                 }
 412  #endif
 413  #ifndef OPENSSL_NO_DSA
 414 @@ -2582,12 +2696,18 @@
 415                         j=0;
 416                         }
 417                 if(mr)
 418 -                       fprintf(stdout,"+F3:%u:%u:%f:%f\n",
 419 -                               k,dsa_bits[k],dsa_results[k][0],dsa_results[k][1]);
 420 +                       fprintf(stdout,"+F3:%u:%u:%f", k,dsa_bits[k],dsa_results[k][0]);
 421                 else
 422 -                       fprintf(stdout,"dsa %4u bits %8.6fs %8.6fs %8.1f %8.1f\n",
 423 -                               dsa_bits[k],dsa_results[k][0],dsa_results[k][1],
 424 -                               1.0/dsa_results[k][0],1.0/dsa_results[k][1]);
 425 +                       fprintf(stdout,"dsa %4u bits %8.6fs",dsa_bits[k],dsa_results[k][0]);
 426 +               if (do_cpu)
 427 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", dsa_cpu_usage[k][0]);
 428 +               fprintf(stdout, mr ? ":%f" : " %8.6fs", dsa_results[k][1]);
 429 +               if (do_cpu)
 430 +                       fprintf(stdout, mr ? "/%d": "/%%%-3d", dsa_cpu_usage[k][1]);
 431 +               if(!mr)
 432 +                       fprintf(stdout, " %8.1f %8.1f",
 433 +                                       1.0/dsa_results[k][0],1.0/dsa_results[k][1]);
 434 +               fprintf(stdout, "\n");
 435                 }
 436  #endif
 437  #ifndef OPENSSL_NO_ECDSA
 438 @@ -2712,8 +2832,10 @@
 439
 440  static void print_result(int alg,int run_no,int count,double time_used)
 441         {
 442 -       BIO_printf(bio_err,mr ? "+R:%d:%s:%f\n"
 443 -                  : "%d %s's in %.2fs\n",count,names[alg],time_used);
 444 +       if (do_cpu)
 445 +           cpu_usage[alg][run_no] = calc_cpu();
 446 +       BIO_printf(bio_err,mr ? "+R:%ld:%s:%f\n"
 447 +                  : "%ld %s's in %.2fs\n",count,names[alg],time_used);
 448         results[alg][run_no]=((double)count)/time_used*lengths[run_no];
 449         }
 450
 451 @@ -2806,29 +2928,11 @@
 452                                 p=buf+3;
 453                                 alg=atoi(sstrsep(&p,sep));
 454                                 sstrsep(&p,sep);
 455 -                               for(j=0 ; j < SIZE_NUM ; ++j)
 456 +                               for(j=0 ; j < SIZE_NUM ; ++j) {
 457 +                                       if (do_cpu && strchr(p, '/'))
 458 +                                               cpu_usage[alg][j] = atoi(strchr(p, '/') + 1);
 459                                         results[alg][j]+=atof(sstrsep(&p,sep));
 460                                 }
 461 -                       else if(!strncmp(buf,"+F2:",4))
 462 -                               {
 463 -                               int k;
 464 -                               double d;
 465 -
 466 -                               p=buf+4;
 467 -                               k=atoi(sstrsep(&p,sep));
 468 -                               sstrsep(&p,sep);
 469 -
 470 -                               d=atof(sstrsep(&p,sep));
 471 -                               if(n)
 472 -                                       rsa_results[k][0]=1/(1/rsa_results[k][0]+1/d);
 473 -                               else
 474 -                                       rsa_results[k][0]=d;
 475 -
 476 -                               d=atof(sstrsep(&p,sep));
 477 -                               if(n)
 478 -                                       rsa_results[k][1]=1/(1/rsa_results[k][1]+1/d);
 479 -                               else
 480 -                                       rsa_results[k][1]=d;
 481                                 }
 482                         else if(!strncmp(buf,"+F2:",4))
 483                                 {
 484 @@ -2839,12 +2943,18 @@
 485                                 k=atoi(sstrsep(&p,sep));
 486                                 sstrsep(&p,sep);
 487
 488 +                               /* before we move the token along */
 489 +                               if (do_cpu && strchr(p, '/'))
 490 +                                       rsa_cpu_usage[k][0] = atoi(strchr(p, '/') + 1);
 491                                 d=atof(sstrsep(&p,sep));
 492                                 if(n)
 493                                         rsa_results[k][0]=1/(1/rsa_results[k][0]+1/d);
 494                                 else
 495                                         rsa_results[k][0]=d;
 496
 497 +                               /* before we move the token along */
 498 +                               if (do_cpu && strchr(p, '/'))
 499 +                                       rsa_cpu_usage[k][1] = atoi(strchr(p, '/') + 1);
 500                                 d=atof(sstrsep(&p,sep));
 501                                 if(n)
 502                                         rsa_results[k][1]=1/(1/rsa_results[k][1]+1/d);
 503 @@ -2860,12 +2970,18 @@
 504                                 k=atoi(sstrsep(&p,sep));
 505                                 sstrsep(&p,sep);
 506
 507 +                               /* before we move the token along */
 508 +                               if (do_cpu && strchr(p, '/'))
 509 +                                       dsa_cpu_usage[k][0] = atoi(strchr(p, '/') + 1);
 510                                 d=atof(sstrsep(&p,sep));
 511                                 if(n)
 512                                         dsa_results[k][0]=1/(1/dsa_results[k][0]+1/d);
 513                                 else
 514                                         dsa_results[k][0]=d;
 515
 516 +                               /* before we move the token along */
 517 +                               if (do_cpu && strchr(p, '/'))
 518 +                                       dsa_cpu_usage[k][1] = atoi(strchr(p, '/') + 1);
 519                                 d=atof(sstrsep(&p,sep));
 520                                 if(n)
 521                                         dsa_results[k][1]=1/(1/dsa_results[k][1]+1/d);
 522 diff -Naur openssl-0.9.8i.orig/config openssl-0.9.8i/config
 523 --- openssl-0.9.8i.orig/config  2008-10-01 04:16:01.000000000 +0200
 524 +++ openssl-0.9.8i/config       2008-10-01 04:16:12.000000000 +0200
 525 @@ -48,10 +48,10 @@
 526
 527  # First get uname entries that we use below
 528
 529 -MACHINE=`(uname -m) 2>/dev/null` || MACHINE="unknown"
 530 -RELEASE=`(uname -r) 2>/dev/null` || RELEASE="unknown"
 531 -SYSTEM=`(uname -s) 2>/dev/null`  || SYSTEM="unknown"
 532 -VERSION=`(uname -v) 2>/dev/null` || VERSION="unknown"
 533 +[ "$MACHINE" ] || MACHINE=`(uname -m) 2>/dev/null` || MACHINE="unknown"
 534 +[ "$RELEASE" ] || RELEASE=`(uname -r) 2>/dev/null` || RELEASE="unknown"
 535 +[ "$SYSTEM" ]  || SYSTEM=`(uname -s) 2>/dev/null`  || SYSTEM="unknown"
 536 +[ "$VERSION" ] || VERSION=`(uname -v) 2>/dev/null` || VERSION="unknown"
 537
 538
 539  # Now test for ISC and SCO, since it is has a braindamaged uname.
 540 @@ -270,7 +270,7 @@
 541                 echo "ppc-apple-darwin${VERSION}"
 542                 ;;
 543             *)
 544 -               echo "i386-apple-darwin${VERSION}"
 545 +               echo "${MACHINE}-apple-darwin${VERSION}"
 546                 ;;
 547         esac
 548         exit 0
 549 @@ -401,9 +401,9 @@
 550
 551  # figure out if gcc is available and if so we use it otherwise
 552  # we fallback to whatever cc does on the system
 553 -GCCVER=`(gcc -dumpversion) 2>/dev/null`
 554 +CC="${CC:-gcc}"
 555 +GCCVER=`(${CC} -dumpversion) 2>/dev/null`
 556  if [ "$GCCVER" != "" ]; then
 557 -  CC=gcc
 558    # then strip off whatever prefix egcs prepends the number with...
 559    # Hopefully, this will work for any future prefixes as well.
 560    GCCVER=`echo $GCCVER | LC_ALL=C sed 's/^[a-zA-Z]*\-//'`
 561 @@ -413,7 +413,7 @@
 562    # peak single digit before and after first dot, e.g. 2.95.1 gives 29
 563    GCCVER=`echo $GCCVER | sed 's/\([0-9]\)\.\([0-9]\).*/\1\2/'`
 564  else
 565 -  CC=cc
 566 +  CC="${CC:-cc}"
 567  fi
 568  GCCVER=${GCCVER:-0}
 569  if [ "$SYSTEM" = "HP-UX" ];then
 570 @@ -482,6 +482,9 @@
 571  # script above so we end up with values in vars but that would take
 572  # more time that I want to waste at the moment
 573  case "$GUESSOS" in
 574 +  uClinux*)
 575 +    OUT=uClinux-dist
 576 +       ;;
 577    mips2-sgi-irix)
 578         CPU=`(hinv -t cpu) 2>/dev/null | head -1 | sed 's/^CPU:[^R]*R\([0-9]*\).*/\1/'`
 579         CPU=${CPU:-0}
 580 diff -Naur openssl-0.9.8i.orig/crypto/cryptlib.h openssl-0.9.8i/crypto/cryptlib.h
 581 --- openssl-0.9.8i.orig/crypto/cryptlib.h       2008-10-01 04:16:01.000000000 +0200
 582 +++ openssl-0.9.8i/crypto/cryptlib.h    2008-10-01 04:16:12.000000000 +0200
 583 @@ -62,7 +62,7 @@
 584  #include <stdlib.h>
 585  #include <string.h>
 586
 587 -#include "e_os.h"
 588 +#include <openssl/e_os.h>
 589
 590  #ifdef OPENSSL_USE_APPLINK
 591  #define BIO_FLAGS_UPLINK 0x8000
 592 diff -Naur openssl-0.9.8i.orig/crypto/engine/eng_all.c openssl-0.9.8i/crypto/engine/eng_all.c
 593 --- openssl-0.9.8i.orig/crypto/engine/eng_all.c 2008-10-01 04:16:01.000000000 +0200
 594 +++ openssl-0.9.8i/crypto/engine/eng_all.c      2008-10-01 04:17:20.000000000 +0200
 595 @@ -104,7 +104,7 @@
 596  #endif
 597  #endif
 598  #ifndef OPENSSL_NO_HW
 599 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
 600 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
 601         ENGINE_load_cryptodev();
 602  #endif
 603  #if defined(OPENSSL_SYS_WIN32) && !defined(OPENSSL_NO_CAPIENG)
 604 @@ -113,7 +113,7 @@
 605  #endif
 606         }
 607
 608 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
 609 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
 610  void ENGINE_setup_bsd_cryptodev(void) {
 611         static int bsd_cryptodev_default_loaded = 0;
 612         if (!bsd_cryptodev_default_loaded) {
 613 diff -Naur openssl-0.9.8i.orig/crypto/engine/eng_cryptodev.c openssl-0.9.8i/crypto/engine/eng_cryptodev.c
 614 --- openssl-0.9.8i.orig/crypto/engine/eng_cryptodev.c   2008-10-01 04:16:01.000000000 +0200
 615 +++ openssl-0.9.8i/crypto/engine/eng_cryptodev.c        2008-10-01 04:16:12.000000000 +0200
 616 @@ -68,6 +68,16 @@
 617  struct dev_crypto_state {
 618         struct session_op d_sess;
 619         int d_fd;
 620 +
 621 +#ifdef USE_CRYPTODEV_DIGESTS
 622 +       char dummy_mac_key[20];
 623 +
 624 +       unsigned char digest_res[20];
 625 +       char *mac_data;
 626 +       int mac_len;
 627 +
 628 +       int copy;
 629 +#endif
 630  };
 631
 632  static u_int32_t cryptodev_asymfeat = 0;
 633 @@ -75,9 +85,11 @@
 634  static int get_asym_dev_crypto(void);
 635  static int open_dev_crypto(void);
 636  static int get_dev_crypto(void);
 637 +#if 0
 638  static int cryptodev_max_iv(int cipher);
 639  static int cryptodev_key_length_valid(int cipher, int len);
 640  static int cipher_nid_to_cryptodev(int nid);
 641 +#endif
 642  static int get_cryptodev_ciphers(const int **cnids);
 643  static int get_cryptodev_digests(const int **cnids);
 644  static int cryptodev_usable_ciphers(const int **nids);
 645 @@ -100,7 +112,7 @@
 646  static int cryptodev_bn_mod_exp(BIGNUM *r, const BIGNUM *a,
 647      const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 648  static int cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I,
 649 -    RSA *rsa);
 650 +    RSA *rsa, BN_CTX *ctx);
 651  static int cryptodev_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
 652  static int cryptodev_dsa_bn_mod_exp(DSA *dsa, BIGNUM *r, BIGNUM *a,
 653      const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
 654 @@ -133,6 +145,7 @@
 655         { CRYPTO_DES_CBC,               NID_des_cbc,            8,       8, },
 656         { CRYPTO_3DES_CBC,              NID_des_ede3_cbc,       8,      24, },
 657         { CRYPTO_AES_CBC,               NID_aes_128_cbc,        16,     16, },
 658 +       { CRYPTO_AES_CBC,               NID_aes_256_cbc,        16,     32, },
 659         { CRYPTO_BLF_CBC,               NID_bf_cbc,             8,      16, },
 660         { CRYPTO_CAST_CBC,              NID_cast5_cbc,          8,      16, },
 661         { CRYPTO_SKIPJACK_CBC,          NID_undef,              0,       0, },
 662 @@ -142,14 +155,15 @@
 663  static struct {
 664         int     id;
 665         int     nid;
 666 +       int     keylen;
 667  } digests[] = {
 668 -       { CRYPTO_SHA1_HMAC,             NID_hmacWithSHA1,       },
 669 -       { CRYPTO_RIPEMD160_HMAC,        NID_ripemd160,          },
 670 -       { CRYPTO_MD5_KPDK,              NID_undef,              },
 671 -       { CRYPTO_SHA1_KPDK,             NID_undef,              },
 672 -       { CRYPTO_MD5,                   NID_md5,                },
 673 -       { CRYPTO_SHA1,                  NID_undef,              },
 674 -       { 0,                            NID_undef,              },
 675 +       { CRYPTO_SHA1_HMAC,             NID_hmacWithSHA1,       20},
 676 +       { CRYPTO_RIPEMD160_HMAC,        NID_ripemd160,          16/*?*/},
 677 +       { CRYPTO_MD5_KPDK,              NID_undef,              0},
 678 +       { CRYPTO_SHA1_KPDK,             NID_undef,              0},
 679 +       { CRYPTO_MD5,                   NID_md5,                16},
 680 +       { CRYPTO_SHA1,                  NID_sha1,               20},
 681 +       { 0,                            NID_undef,              0},
 682  };
 683
 684  /*
 685 @@ -176,10 +190,17 @@
 686  static int
 687  get_dev_crypto(void)
 688  {
 689 -       int fd, retfd;
 690 +       static int fd = -1;
 691 +       int retfd;
 692
 693 -       if ((fd = open_dev_crypto()) == -1)
 694 -               return (-1);
 695 +       if (fd == -1) {
 696 +               if ((fd = open_dev_crypto()) == -1)
 697 +                       return (-1);
 698 +               if (fcntl(fd, F_SETFD, 1) == -1) {
 699 +                       close(fd);
 700 +                       return (-1);
 701 +               }
 702 +       }
 703         if (ioctl(fd, CRIOGET, &retfd) == -1)
 704                 return (-1);
 705
 706 @@ -202,6 +223,7 @@
 707         return fd;
 708  }
 709
 710 +#if 0
 711  /*
 712   * XXXX this needs to be set for each alg - and determined from
 713   * a running card.
 714 @@ -245,6 +267,7 @@
 715                         return (ciphers[i].id);
 716         return (0);
 717  }
 718 +#endif
 719
 720  /*
 721   * Find out what ciphers /dev/crypto will let us have a session for.
 722 @@ -264,7 +287,7 @@
 723                 return (0);
 724         }
 725         memset(&sess, 0, sizeof(sess));
 726 -       sess.key = (caddr_t)"123456781234567812345678";
 727 +       sess.key = (caddr_t)"123456789abcdefghijklmno";
 728
 729         for (i = 0; ciphers[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
 730                 if (ciphers[i].nid == NID_undef)
 731 @@ -303,10 +326,12 @@
 732                 return (0);
 733         }
 734         memset(&sess, 0, sizeof(sess));
 735 +       sess.mackey = (caddr_t)"123456789abcdefghijklmno";
 736         for (i = 0; digests[i].id && count < CRYPTO_ALGORITHM_MAX; i++) {
 737                 if (digests[i].nid == NID_undef)
 738                         continue;
 739                 sess.mac = digests[i].id;
 740 +               sess.mackeylen = digests[i].keylen;
 741                 sess.cipher = 0;
 742                 if (ioctl(fd, CIOCGSESSION, &sess) != -1 &&
 743                     ioctl(fd, CIOCFSESSION, &sess.ses) != -1)
 744 @@ -351,6 +376,9 @@
 745  static int
 746  cryptodev_usable_digests(const int **nids)
 747  {
 748 +#ifdef USE_CRYPTODEV_DIGESTS
 749 +       return (get_cryptodev_digests(nids));
 750 +#else
 751         /*
 752          * XXXX just disable all digests for now, because it sucks.
 753          * we need a better way to decide this - i.e. I may not
 754 @@ -365,6 +393,7 @@
 755          */
 756         *nids = NULL;
 757         return (0);
 758 +#endif
 759  }
 760
 761  static int
 762 @@ -427,16 +456,20 @@
 763  {
 764         struct dev_crypto_state *state = ctx->cipher_data;
 765         struct session_op *sess = &state->d_sess;
 766 -       int cipher;
 767 -
 768 -       if ((cipher = cipher_nid_to_cryptodev(ctx->cipher->nid)) == NID_undef)
 769 -               return (0);
 770 +       int cipher, i;
 771
 772 -       if (ctx->cipher->iv_len > cryptodev_max_iv(cipher))
 773 -               return (0);
 774 +       for (i = 0; ciphers[i].id; i++)
 775 +               if (ctx->cipher->nid == ciphers[i].nid &&
 776 +                   ctx->cipher->iv_len <= ciphers[i].ivmax &&
 777 +                   ctx->key_len == ciphers[i].keylen) {
 778 +                       cipher = ciphers[i].id;
 779 +                       break;
 780 +               }
 781
 782 -       if (!cryptodev_key_length_valid(cipher, ctx->key_len))
 783 +       if (!ciphers[i].id) {
 784 +               state->d_fd = -1;
 785                 return (0);
 786 +       }
 787
 788         memset(sess, 0, sizeof(struct session_op));
 789
 790 @@ -563,6 +596,19 @@
 791         NULL
 792  };
 793
 794 +const EVP_CIPHER cryptodev_aes_256_cbc = {
 795 +       NID_aes_256_cbc,
 796 +       16, 32, 16,
 797 +       EVP_CIPH_CBC_MODE,
 798 +       cryptodev_init_key,
 799 +       cryptodev_cipher,
 800 +       cryptodev_cleanup,
 801 +       sizeof(struct dev_crypto_state),
 802 +       EVP_CIPHER_set_asn1_iv,
 803 +       EVP_CIPHER_get_asn1_iv,
 804 +       NULL
 805 +};
 806 +
 807  /*
 808   * Registered by the ENGINE when used to find out how to deal with
 809   * a particular NID in the ENGINE. this says what we'll do at the
 810 @@ -591,6 +637,9 @@
 811         case NID_aes_128_cbc:
 812                 *cipher = &cryptodev_aes_cbc;
 813                 break;
 814 +       case NID_aes_256_cbc:
 815 +               *cipher = &cryptodev_aes_256_cbc;
 816 +               break;
 817         default:
 818                 *cipher = NULL;
 819                 break;
 820 @@ -598,6 +647,234 @@
 821         return (*cipher != NULL);
 822  }
 823
 824 +
 825 +#ifdef USE_CRYPTODEV_DIGESTS
 826 +
 827 +/* convert digest type to cryptodev */
 828 +static int
 829 +digest_nid_to_cryptodev(int nid)
 830 +{
 831 +       int i;
 832 +
 833 +       for (i = 0; digests[i].id; i++)
 834 +               if (digests[i].nid == nid)
 835 +                       return (digests[i].id);
 836 +       return (0);
 837 +}
 838 +
 839 +
 840 +static int
 841 +digest_key_length(int nid)
 842 +{
 843 +       int i;
 844 +
 845 +       for (i = 0; digests[i].id; i++)
 846 +               if (digests[i].nid == nid)
 847 +                       return digests[i].keylen;
 848 +       return (0);
 849 +}
 850 +
 851 +
 852 +static int cryptodev_digest_init(EVP_MD_CTX *ctx)
 853 +{
 854 +       struct dev_crypto_state *state = ctx->md_data;
 855 +       struct session_op *sess = &state->d_sess;
 856 +       int digest;
 857 +
 858 +       if ((digest = digest_nid_to_cryptodev(ctx->digest->type)) == NID_undef){
 859 +               printf("cryptodev_digest_init: Can't get digest \n");
 860 +               return (0);
 861 +       }
 862 +
 863 +       memset(state, 0, sizeof(struct dev_crypto_state));
 864 +
 865 +       if ((state->d_fd = get_dev_crypto()) < 0) {
 866 +               printf("cryptodev_digest_init: Can't get Dev \n");
 867 +               return (0);
 868 +       }
 869 +
 870 +       sess->mackey = state->dummy_mac_key;
 871 +       sess->mackeylen = digest_key_length(ctx->digest->type);
 872 +       sess->mac = digest;
 873 +
 874 +       if (ioctl(state->d_fd, CIOCGSESSION, sess) < 0) {
 875 +               close(state->d_fd);
 876 +               state->d_fd = -1;
 877 +               printf("cryptodev_digest_init: Open session failed\n");
 878 +               return (0);
 879 +       }
 880 +
 881 +       return (1);
 882 +}
 883 +
 884 +static int cryptodev_digest_update(EVP_MD_CTX *ctx, const void *data,
 885 +               size_t count)
 886 +{
 887 +       struct crypt_op cryp;
 888 +       struct dev_crypto_state *state = ctx->md_data;
 889 +       struct session_op *sess = &state->d_sess;
 890 +
 891 +       if (!data || state->d_fd < 0) {
 892 +               printf("cryptodev_digest_update: illegal inputs \n");
 893 +               return (0);
 894 +       }
 895 +
 896 +       if (!count) {
 897 +               return (0);
 898 +       }
 899 +
 900 +       if (!(ctx->flags & EVP_MD_CTX_FLAG_ONESHOT)) {
 901 +               /* if application doesn't support one buffer */
 902 +               state->mac_data = OPENSSL_realloc(state->mac_data, state->mac_len + count);
 903 +
 904 +               if (!state->mac_data) {
 905 +                       printf("cryptodev_digest_update: realloc failed\n");
 906 +                       return (0);
 907 +               }
 908 +
 909 +               memcpy(state->mac_data + state->mac_len, data, count);
 910 +               state->mac_len += count;
 911 +
 912 +               return (1);
 913 +       }
 914 +
 915 +       memset(&cryp, 0, sizeof(cryp));
 916 +
 917 +       cryp.ses = sess->ses;
 918 +       cryp.flags = 0;
 919 +       cryp.len = count;
 920 +       cryp.src = (caddr_t) data;
 921 +       cryp.dst = NULL;
 922 +       cryp.mac = state->digest_res;
 923 +       if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
 924 +               printf("cryptodev_digest_update: digest failed\n");
 925 +               return (0);
 926 +       }
 927 +       return (1);
 928 +}
 929 +
 930 +
 931 +static int cryptodev_digest_final(EVP_MD_CTX *ctx, unsigned char *md)
 932 +{
 933 +       struct crypt_op cryp;
 934 +       struct dev_crypto_state *state = ctx->md_data;
 935 +       struct session_op *sess = &state->d_sess;
 936 +
 937 +       int ret = 1;
 938 +
 939 +       if (!md || state->d_fd < 0) {
 940 +               printf("cryptodev_digest_final: illegal input\n");
 941 +               return(0);
 942 +       }
 943 +
 944 +       if (! (ctx->flags & EVP_MD_CTX_FLAG_ONESHOT) ) {
 945 +               /* if application doesn't support one buffer */
 946 +               memset(&cryp, 0, sizeof(cryp));
 947 +
 948 +               cryp.ses = sess->ses;
 949 +               cryp.flags = 0;
 950 +               cryp.len = state->mac_len;
 951 +               cryp.src = state->mac_data;
 952 +               cryp.dst = NULL;
 953 +               cryp.mac = md;
 954 +
 955 +               if (ioctl(state->d_fd, CIOCCRYPT, &cryp) < 0) {
 956 +                       printf("cryptodev_digest_final: digest failed\n");
 957 +                       return (0);
 958 +               }
 959 +
 960 +               return 1;
 961 +       }
 962 +
 963 +       memcpy(md, state->digest_res, ctx->digest->md_size);
 964 +
 965 +       return (ret);
 966 +}
 967 +
 968 +
 969 +static int cryptodev_digest_cleanup(EVP_MD_CTX *ctx)
 970 +{
 971 +       int ret = 1;
 972 +       struct dev_crypto_state *state = ctx->md_data;
 973 +       struct session_op *sess = &state->d_sess;
 974 +
 975 +       if (state->d_fd < 0) {
 976 +               printf("cryptodev_digest_cleanup: illegal input\n");
 977 +               return (0);
 978 +       }
 979 +
 980 +       if (state->mac_data) {
 981 +               OPENSSL_free(state->mac_data);
 982 +               state->mac_data = NULL;
 983 +               state->mac_len = 0;
 984 +       }
 985 +
 986 +       if (state->copy)
 987 +               return 1;
 988 +
 989 +       if (ioctl(state->d_fd, CIOCFSESSION, &sess->ses) < 0) {
 990 +               printf("cryptodev_digest_cleanup: failed to close session\n");
 991 +               ret = 0;
 992 +       } else {
 993 +               ret = 1;
 994 +       }
 995 +       close(state->d_fd);
 996 +       state->d_fd = -1;
 997 +
 998 +       return (ret);
 999 +}
1000 +
1001 +static int cryptodev_digest_copy(EVP_MD_CTX *to,const EVP_MD_CTX *from)
1002 +{
1003 +       struct dev_crypto_state *fstate = from->md_data;
1004 +       struct dev_crypto_state *dstate = to->md_data;
1005 +
1006 +       memcpy(dstate, fstate, sizeof(struct dev_crypto_state));
1007 +
1008 +       if (fstate->mac_len != 0) {
1009 +               dstate->mac_data = OPENSSL_malloc(fstate->mac_len);
1010 +               memcpy(dstate->mac_data, fstate->mac_data, fstate->mac_len);
1011 +       }
1012 +
1013 +       dstate->copy = 1;
1014 +
1015 +       return 1;
1016 +}
1017 +
1018 +
1019 +const EVP_MD cryptodev_sha1 = {
1020 +       NID_sha1,
1021 +       NID_undef,
1022 +       SHA_DIGEST_LENGTH,
1023 +       EVP_MD_FLAG_ONESHOT,
1024 +       cryptodev_digest_init,
1025 +       cryptodev_digest_update,
1026 +       cryptodev_digest_final,
1027 +       cryptodev_digest_copy,
1028 +       cryptodev_digest_cleanup,
1029 +       EVP_PKEY_NULL_method,
1030 +       SHA_CBLOCK,
1031 +       sizeof(struct dev_crypto_state),
1032 +};
1033 +
1034 +const EVP_MD cryptodev_md5 = {
1035 +       NID_md5,
1036 +       NID_undef,
1037 +       16 /* MD5_DIGEST_LENGTH */,
1038 +       EVP_MD_FLAG_ONESHOT,
1039 +       cryptodev_digest_init,
1040 +       cryptodev_digest_update,
1041 +       cryptodev_digest_final,
1042 +       cryptodev_digest_copy,
1043 +       cryptodev_digest_cleanup,
1044 +       EVP_PKEY_NULL_method,
1045 +       64 /* MD5_CBLOCK */,
1046 +       sizeof(struct dev_crypto_state),
1047 +};
1048 +
1049 +#endif /* USE_CRYPTODEV_DIGESTS */
1050 +
1051 +
1052  static int
1053  cryptodev_engine_digests(ENGINE *e, const EVP_MD **digest,
1054      const int **nids, int nid)
1055 @@ -606,10 +883,15 @@
1056                 return (cryptodev_usable_digests(nids));
1057
1058         switch (nid) {
1059 +#ifdef USE_CRYPTODEV_DIGESTS
1060         case NID_md5:
1061 -               *digest = NULL; /* need to make a clean md5 critter */
1062 +               *digest = &cryptodev_md5;
1063                 break;
1064 +       case NID_sha1:
1065 +               *digest = &cryptodev_sha1;
1066 +               break;
1067         default:
1068 +#endif /* USE_CRYPTODEV_DIGESTS */
1069                 *digest = NULL;
1070                 break;
1071         }
1072 @@ -625,7 +907,7 @@
1073  bn2crparam(const BIGNUM *a, struct crparam *crp)
1074  {
1075         int i, j, k;
1076 -       ssize_t words, bytes, bits;
1077 +       ssize_t bytes, bits;
1078         u_char *b;
1079
1080         crp->crp_p = NULL;
1081 @@ -637,6 +919,7 @@
1082         b = malloc(bytes);
1083         if (b == NULL)
1084                 return (1);
1085 +       memset(b, 0, bytes);
1086
1087         crp->crp_p = b;
1088         crp->crp_nbits = bits;
1089 @@ -681,7 +964,7 @@
1090  {
1091         int i;
1092
1093 -       for (i = 0; i <= kop->crk_iparams + kop->crk_oparams; i++) {
1094 +       for (i = 0; i < kop->crk_iparams + kop->crk_oparams; i++) {
1095                 if (kop->crk_param[i].crp_p)
1096                         free(kop->crk_param[i].crp_p);
1097                 kop->crk_param[i].crp_p = NULL;
1098 @@ -756,12 +1039,10 @@
1099  }
1100
1101  static int
1102 -cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
1103 +cryptodev_rsa_nocrt_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
1104  {
1105         int r;
1106 -       BN_CTX *ctx;
1107 -
1108 -       ctx = BN_CTX_new();
1109 +       ctx = BN_CTX_new(); /* not sure why we reallocate this. DM */
1110         r = cryptodev_bn_mod_exp(r0, I, rsa->d, rsa->n, ctx, NULL);
1111         BN_CTX_free(ctx);
1112         return (r);
1113 diff -Naur openssl-0.9.8i.orig/crypto/engine/eng_table.c openssl-0.9.8i/crypto/engine/eng_table.c
1114 --- openssl-0.9.8i.orig/crypto/engine/eng_table.c       2008-10-01 04:16:01.000000000 +0200
1115 +++ openssl-0.9.8i/crypto/engine/eng_table.c    2008-10-01 04:16:12.000000000 +0200
1116 @@ -186,6 +186,8 @@
1117                 {
1118                 engine_unlocked_finish(e, 0);
1119                 pile->funct = NULL;
1120 +               /* "touch" this ENGINE_CIPHER */
1121 +               pile->uptodate = 0;
1122                 }
1123         }
1124  static IMPLEMENT_LHASH_DOALL_ARG_FN(int_unregister_cb,ENGINE_PILE *,ENGINE *)
1125 diff -Naur openssl-0.9.8i.orig/crypto/engine/engine.h openssl-0.9.8i/crypto/engine/engine.h
1126 --- openssl-0.9.8i.orig/crypto/engine/engine.h  2008-10-01 04:16:01.000000000 +0200
1127 +++ openssl-0.9.8i/crypto/engine/engine.h       2008-10-01 04:16:12.000000000 +0200
1128 @@ -703,7 +703,7 @@
1129   * values. */
1130  void *ENGINE_get_static_state(void);
1131
1132 -#if defined(__OpenBSD__) || defined(__FreeBSD__)
1133 +#if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
1134  void ENGINE_setup_bsd_cryptodev(void);
1135  #endif
1136
1137 diff -Naur openssl-0.9.8i.orig/crypto/evp/c_all.c openssl-0.9.8i/crypto/evp/c_all.c
1138 --- openssl-0.9.8i.orig/crypto/evp/c_all.c      2008-10-01 04:16:01.000000000 +0200
1139 +++ openssl-0.9.8i/crypto/evp/c_all.c   2008-10-01 04:16:12.000000000 +0200
1140 @@ -83,7 +83,7 @@
1141         OpenSSL_add_all_ciphers();
1142         OpenSSL_add_all_digests();
1143  #ifndef OPENSSL_NO_ENGINE
1144 -# if defined(__OpenBSD__) || defined(__FreeBSD__)
1145 +# if defined(__OpenBSD__) || defined(__FreeBSD__) || defined(HAVE_CRYPTODEV)
1146         ENGINE_setup_bsd_cryptodev();
1147  # endif
1148  #endif
1149 diff -Naur openssl-0.9.8i.orig/crypto/evp/c_alld.c openssl-0.9.8i/crypto/evp/c_alld.c
1150 --- openssl-0.9.8i.orig/crypto/evp/c_alld.c     2008-10-01 04:16:01.000000000 +0200
1151 +++ openssl-0.9.8i/crypto/evp/c_alld.c  2008-10-01 04:16:12.000000000 +0200
1152 @@ -81,7 +81,7 @@
1153         EVP_add_digest(EVP_dss());
1154  #endif
1155  #endif
1156 -#ifndef OPENSSL_NO_SHA
1157 +#if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA1)
1158         EVP_add_digest(EVP_sha1());
1159         EVP_add_digest_alias(SN_sha1,"ssl3-sha1");
1160         EVP_add_digest_alias(SN_sha1WithRSAEncryption,SN_sha1WithRSA);
1161 diff -Naur openssl-0.9.8i.orig/engines/Makefile openssl-0.9.8i/engines/Makefile
1162 --- openssl-0.9.8i.orig/engines/Makefile        2008-10-01 04:16:01.000000000 +0200
1163 +++ openssl-0.9.8i/engines/Makefile     2008-10-01 04:16:12.000000000 +0200
1164 @@ -96,6 +96,7 @@
1165                         ( echo installing $$l; \
1166                           if [ "$(PLATFORM)" != "Cygwin" ]; then \
1167                                 case "$(CFLAGS)" in \
1168 +                               *OPENSSL_NO_HW*)        continue;;      \
1169                                 *DSO_DLFCN*)    sfx="so";;      \
1170                                 *DSO_DL*)       sfx="sl";;      \
1171                                 *)              sfx="bad";;     \
1172 diff -Naur openssl-0.9.8i.orig/util/domd openssl-0.9.8i/util/domd
1173 --- openssl-0.9.8i.orig/util/domd       2008-10-01 04:16:01.000000000 +0200
1174 +++ openssl-0.9.8i/util/domd    2008-10-01 04:16:13.000000000 +0200
1175 @@ -23,13 +23,17 @@
1176      done
1177      sed -e '/^# DO NOT DELETE.*/,$d' < Makefile > Makefile.tmp
1178      echo '# DO NOT DELETE THIS LINE -- make depend depends on it.' >> Makefile.tmp
1179 -    ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND -M $args >> Makefile.tmp
1180 +    ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND -M $args >> Makefile.tmp &&
1181      ${PERL} $TOP/util/clean-depend.pl < Makefile.tmp > Makefile.new
1182 +       RC=$?
1183      rm -f Makefile.tmp
1184  else
1185 -    ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND $@
1186 +    ${MAKEDEPEND} -D OPENSSL_DOING_MAKEDEPEND $@ && \
1187      ${PERL} $TOP/util/clean-depend.pl < Makefile > Makefile.new
1188 +       RC=$?
1189  fi
1190  mv Makefile.new Makefile
1191  # unfake the presence of Kerberos
1192  rm $TOP/krb5.h
1193 +
1194 +exit $RC