that were never part of the engine framework.
The aep and sureware implementations are taken directly from 0.9.6c
[engine] and have been modified to fit the newer engine framework and
to be possible to build shared libraries of.
The aep implementation has gone through quite a bunch of tests and is
cleaned up (there were some misunderstandings in it about how to use
locks).
The sureware hasn't been tested at all in this incarnation and is
basically a quick hack to get it to compile properly.
tb_rsa.c tb_dsa.c tb_dh.c tb_rand.c tb_cipher.c tb_digest.c \
eng_openssl.c eng_dyn.c eng_cnf.c \
hw_atalla.c hw_cswift.c hw_ncipher.c hw_nuron.c hw_ubsec.c \
- hw_openbsd_dev_crypto.c #hw_aep.c hw_sureware.c
+ hw_openbsd_dev_crypto.c hw_aep.c hw_sureware.c
LIBOBJ= eng_err.o eng_lib.o eng_list.o eng_init.o eng_ctrl.o \
eng_table.o eng_pkey.o eng_fat.o eng_all.o \
tb_rsa.o tb_dsa.o tb_dh.o tb_rand.o tb_cipher.o tb_digest.o \
eng_openssl.o eng_dyn.o eng_cnf.o \
hw_atalla.o hw_cswift.o hw_ncipher.o hw_nuron.o hw_ubsec.o \
- hw_openbsd_dev_crypto.o #hw_aep.o hw_sureware.o
+ hw_openbsd_dev_crypto.o hw_aep.o hw_sureware.o
SRC= $(LIBSRC)
eng_table.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
eng_table.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h
eng_table.o: eng_int.h eng_table.c
+hw_aep.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+hw_aep.o: ../../include/openssl/bn.h ../../include/openssl/crypto.h
+hw_aep.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+hw_aep.o: ../../include/openssl/dso.h ../../include/openssl/e_os2.h
+hw_aep.o: ../../include/openssl/engine.h ../../include/openssl/err.h
+hw_aep.o: ../../include/openssl/lhash.h ../../include/openssl/opensslconf.h
+hw_aep.o: ../../include/openssl/opensslv.h ../../include/openssl/ossl_typ.h
+hw_aep.o: ../../include/openssl/rand.h ../../include/openssl/rsa.h
+hw_aep.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+hw_aep.o: ../../include/openssl/symhacks.h ../../include/openssl/ui.h hw_aep.c
+hw_aep.o: hw_aep_err.c hw_aep_err.h vendor_defns/aep.h
hw_atalla.o: ../../e_os.h ../../include/openssl/asn1.h
hw_atalla.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
hw_atalla.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
hw_openbsd_dev_crypto.o: ../../include/openssl/symhacks.h
hw_openbsd_dev_crypto.o: ../../include/openssl/ui.h ../evp/evp_locl.h eng_int.h
hw_openbsd_dev_crypto.o: hw_openbsd_dev_crypto.c
+hw_sureware.o: ../../e_os.h ../../include/openssl/asn1.h
+hw_sureware.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
+hw_sureware.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
+hw_sureware.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+hw_sureware.o: ../../include/openssl/dso.h ../../include/openssl/e_os2.h
+hw_sureware.o: ../../include/openssl/engine.h ../../include/openssl/err.h
+hw_sureware.o: ../../include/openssl/evp.h ../../include/openssl/lhash.h
+hw_sureware.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+hw_sureware.o: ../../include/openssl/opensslconf.h
+hw_sureware.o: ../../include/openssl/opensslv.h
+hw_sureware.o: ../../include/openssl/ossl_typ.h ../../include/openssl/pem.h
+hw_sureware.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs7.h
+hw_sureware.o: ../../include/openssl/rand.h ../../include/openssl/rsa.h
+hw_sureware.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+hw_sureware.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+hw_sureware.o: ../../include/openssl/ui.h ../../include/openssl/x509.h
+hw_sureware.o: ../../include/openssl/x509_vfy.h ../cryptlib.h eng_int.h
+hw_sureware.o: engine.h hw_sureware.c hw_sureware_err.c hw_sureware_err.h
+hw_sureware.o: vendor_defns/sureware.h
hw_ubsec.o: ../../e_os.h ../../include/openssl/asn1.h
hw_ubsec.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
hw_ubsec.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
#ifndef OPENSSL_NO_HW_UBSEC
ENGINE_load_ubsec();
#endif
+#ifndef OPENSSL_NO_HW_AEP
+ ENGINE_load_aep();
+#endif
+#ifndef OPENSSL_NO_HW_SUREWARE
+ ENGINE_load_sureware();
+#endif
#ifdef OPENSSL_OPENBSD_DEV_CRYPTO
ENGINE_load_openbsd_dev_crypto();
#endif
{
{ENGINE_R_ALREADY_LOADED ,"already loaded"},
{ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER ,"argument is not a number"},
-{ENGINE_R_BIO_WAS_FREED ,"bio was freed"},
-{ENGINE_R_BN_CTX_FULL ,"BN_CTX full"},
-{ENGINE_R_BN_EXPAND_FAIL ,"bn_expand fail"},
-{ENGINE_R_CHIL_ERROR ,"chil error"},
{ENGINE_R_CMD_NOT_EXECUTABLE ,"cmd not executable"},
{ENGINE_R_COMMAND_TAKES_INPUT ,"command takes input"},
{ENGINE_R_COMMAND_TAKES_NO_INPUT ,"command takes no input"},
{ENGINE_R_DH_NOT_IMPLEMENTED ,"dh not implemented"},
{ENGINE_R_DSA_NOT_IMPLEMENTED ,"dsa not implemented"},
{ENGINE_R_DSO_FAILURE ,"DSO failure"},
-{ENGINE_R_DSO_FUNCTION_NOT_FOUND ,"dso function not found"},
{ENGINE_R_DSO_NOT_FOUND ,"dso not found"},
{ENGINE_R_ENGINES_SECTION_ERROR ,"engines section error"},
{ENGINE_R_ENGINE_IS_NOT_IN_LIST ,"engine is not in the list"},
{ENGINE_R_INVALID_CMD_NAME ,"invalid cmd name"},
{ENGINE_R_INVALID_CMD_NUMBER ,"invalid cmd number"},
{ENGINE_R_INVALID_STRING ,"invalid string"},
-{ENGINE_R_MISSING_KEY_COMPONENTS ,"missing key components"},
{ENGINE_R_NOT_INITIALISED ,"not initialised"},
{ENGINE_R_NOT_LOADED ,"not loaded"},
-{ENGINE_R_NO_CALLBACK ,"no callback"},
{ENGINE_R_NO_CONTROL_FUNCTION ,"no control function"},
{ENGINE_R_NO_INDEX ,"no index"},
-{ENGINE_R_NO_KEY ,"no key"},
{ENGINE_R_NO_LOAD_FUNCTION ,"no load function"},
{ENGINE_R_NO_REFERENCE ,"no reference"},
{ENGINE_R_NO_SUCH_ENGINE ,"no such engine"},
{ENGINE_R_NO_UNLOAD_FUNCTION ,"no unload function"},
-{ENGINE_R_PRIVATE_KEY_ALGORITHMS_DISABLED,"private key algorithms disabled"},
{ENGINE_R_PROVIDE_PARAMETERS ,"provide parameters"},
-{ENGINE_R_REQUEST_FAILED ,"request failed"},
-{ENGINE_R_REQUEST_FALLBACK ,"request fallback"},
{ENGINE_R_RSA_NOT_IMPLEMENTED ,"rsa not implemented"},
-{ENGINE_R_SIZE_TOO_LARGE_OR_TOO_SMALL ,"size too large or too small"},
{ENGINE_R_UNIMPLEMENTED_CIPHER ,"unimplemented cipher"},
{ENGINE_R_UNIMPLEMENTED_DIGEST ,"unimplemented digest"},
-{ENGINE_R_UNIT_FAILURE ,"unit failure"},
{ENGINE_R_VERSION_INCOMPATIBILITY ,"version incompatibility"},
{0,NULL}
};
void ENGINE_load_atalla(void);
void ENGINE_load_nuron(void);
void ENGINE_load_ubsec(void);
+void ENGINE_load_aep(void);
+void ENGINE_load_sureware(void);
void ENGINE_load_openbsd_dev_crypto(void);
void ENGINE_load_builtin_engines(void);
/* Reason codes. */
#define ENGINE_R_ALREADY_LOADED 100
#define ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER 133
-#define ENGINE_R_BIO_WAS_FREED 121
-#define ENGINE_R_BN_CTX_FULL 101
-#define ENGINE_R_BN_EXPAND_FAIL 102
-#define ENGINE_R_CHIL_ERROR 123
#define ENGINE_R_CMD_NOT_EXECUTABLE 134
#define ENGINE_R_COMMAND_TAKES_INPUT 135
#define ENGINE_R_COMMAND_TAKES_NO_INPUT 136
#define ENGINE_R_DH_NOT_IMPLEMENTED 139
#define ENGINE_R_DSA_NOT_IMPLEMENTED 140
#define ENGINE_R_DSO_FAILURE 104
-#define ENGINE_R_DSO_FUNCTION_NOT_FOUND 131
#define ENGINE_R_DSO_NOT_FOUND 132
#define ENGINE_R_ENGINES_SECTION_ERROR 148
#define ENGINE_R_ENGINE_IS_NOT_IN_LIST 105
#define ENGINE_R_INVALID_CMD_NAME 137
#define ENGINE_R_INVALID_CMD_NUMBER 138
#define ENGINE_R_INVALID_STRING 150
-#define ENGINE_R_MISSING_KEY_COMPONENTS 111
#define ENGINE_R_NOT_INITIALISED 117
#define ENGINE_R_NOT_LOADED 112
-#define ENGINE_R_NO_CALLBACK 127
#define ENGINE_R_NO_CONTROL_FUNCTION 120
#define ENGINE_R_NO_INDEX 144
-#define ENGINE_R_NO_KEY 124
#define ENGINE_R_NO_LOAD_FUNCTION 125
#define ENGINE_R_NO_REFERENCE 130
#define ENGINE_R_NO_SUCH_ENGINE 116
#define ENGINE_R_NO_UNLOAD_FUNCTION 126
-#define ENGINE_R_PRIVATE_KEY_ALGORITHMS_DISABLED 142
#define ENGINE_R_PROVIDE_PARAMETERS 113
-#define ENGINE_R_REQUEST_FAILED 114
-#define ENGINE_R_REQUEST_FALLBACK 118
#define ENGINE_R_RSA_NOT_IMPLEMENTED 141
-#define ENGINE_R_SIZE_TOO_LARGE_OR_TOO_SMALL 122
#define ENGINE_R_UNIMPLEMENTED_CIPHER 146
#define ENGINE_R_UNIMPLEMENTED_DIGEST 147
-#define ENGINE_R_UNIT_FAILURE 115
#define ENGINE_R_VERSION_INCOMPATIBILITY 145
#ifdef __cplusplus
+L AEP hw_aep_err.h hw_aep_err.c
L ATALLA hw_atalla_err.h hw_atalla_err.c
L CSWIFT hw_cswift_err.h hw_cswift_err.c
L HWCRHK hw_ncipher_err.h hw_ncipher_err.c
L NURON hw_nuron_err.h hw_nuron_err.c
+L SUREWARE hw_sureware_err.h hw_sureware_err.c
L UBSEC hw_ubsec_err.h hw_ubsec_err.c
--- /dev/null
+/* crypto/engine/hw_aep.c */
+/*
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ * software must display the following acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ * endorse or promote products derived from this software without
+ * prior written permission. For written permission, please contact
+ * licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ * nor may "OpenSSL" appear in their names without prior written
+ * permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ * acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com). This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#include <stdio.h>
+#include <openssl/bn.h>
+#include <string.h>
+
+#include <openssl/e_os2.h>
+#ifndef OPENSSL_SYS_MSDOS
+#include <sys/types.h>
+#include <unistd.h>
+#else
+#include <process.h>
+typedef int pid_t;
+#endif
+
+#include <openssl/crypto.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_AEP
+#ifdef FLAT_INC
+#include "aep.h"
+#else
+#include "vendor_defns/aep.h"
+#endif
+
+#define AEP_LIB_NAME "aep engine"
+#include "hw_aep_err.c"
+
+static int aep_init(ENGINE *e);
+static int aep_finish(ENGINE *e);
+static int aep_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
+static int aep_destroy(ENGINE *e);
+
+static AEP_RV aep_get_connection(AEP_CONNECTION_HNDL_PTR hConnection);
+static AEP_RV aep_return_connection(AEP_CONNECTION_HNDL hConnection);
+static AEP_RV aep_close_all_connections(int use_engine_lock, int *in_use);
+
+/* BIGNUM stuff */
+static int aep_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+ const BIGNUM *m, BN_CTX *ctx);
+
+static AEP_RV aep_mod_exp_crt(BIGNUM *r,const BIGNUM *a, const BIGNUM *p,
+ const BIGNUM *q, const BIGNUM *dmp1,const BIGNUM *dmq1,
+ const BIGNUM *iqmp, BN_CTX *ctx);
+
+/* RSA stuff */
+#ifndef OPENSSL_NO_RSA
+static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
+#endif
+
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int aep_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+ const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+
+/* DSA stuff */
+#ifndef OPENSSL_NO_DSA
+static int aep_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+ BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+ BN_CTX *ctx, BN_MONT_CTX *in_mont);
+
+static int aep_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+ const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+ BN_MONT_CTX *m_ctx);
+#endif
+
+/* DH stuff */
+/* This function is aliased to mod_exp (with the DH and mont dropped). */
+#ifndef OPENSSL_NO_DH
+static int aep_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
+ const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+
+/* rand stuff */
+#ifdef AEPRAND
+static int aep_rand(unsigned char *buf, int num);
+static int aep_rand_status(void);
+#endif
+
+/* Bignum conversion stuff */
+static AEP_RV GetBigNumSize(void* ArbBigNum, AEP_U32* BigNumSize);
+static AEP_RV MakeAEPBigNum(void* ArbBigNum, AEP_U32 BigNumSize,
+ unsigned char* AEP_BigNum);
+static AEP_RV ConvertAEPBigNum(void* ArbBigNum, AEP_U32 BigNumSize,
+ unsigned char* AEP_BigNum);
+
+/* The definitions for control commands specific to this engine */
+#define AEP_CMD_SO_PATH ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN aep_cmd_defns[] =
+ {
+ { AEP_CMD_SO_PATH,
+ "SO_PATH",
+ "Specifies the path to the 'aep' shared library",
+ ENGINE_CMD_FLAG_STRING
+ },
+ {0, NULL, NULL, 0}
+ };
+
+#ifndef OPENSSL_NO_RSA
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD aep_rsa =
+ {
+ "Aep RSA method",
+ NULL, /*rsa_pub_encrypt*/
+ NULL, /*rsa_pub_decrypt*/
+ NULL, /*rsa_priv_encrypt*/
+ NULL, /*rsa_priv_encrypt*/
+ aep_rsa_mod_exp, /*rsa_mod_exp*/
+ aep_mod_exp_mont, /*bn_mod_exp*/
+ NULL, /*init*/
+ NULL, /*finish*/
+ 0, /*flags*/
+ NULL, /*app_data*/
+ NULL, /*rsa_sign*/
+ NULL /*rsa_verify*/
+ };
+#endif
+
+#ifndef OPENSSL_NO_DSA
+/* Our internal DSA_METHOD that we provide pointers to */
+static DSA_METHOD aep_dsa =
+ {
+ "Aep DSA method",
+ NULL, /* dsa_do_sign */
+ NULL, /* dsa_sign_setup */
+ NULL, /* dsa_do_verify */
+ aep_dsa_mod_exp, /* dsa_mod_exp */
+ aep_mod_exp_dsa, /* bn_mod_exp */
+ NULL, /* init */
+ NULL, /* finish */
+ 0, /* flags */
+ NULL /* app_data */
+ };
+#endif
+
+#ifndef OPENSSL_NO_DH
+/* Our internal DH_METHOD that we provide pointers to */
+static DH_METHOD aep_dh =
+ {
+ "Aep DH method",
+ NULL,
+ NULL,
+ aep_mod_exp_dh,
+ NULL,
+ NULL,
+ 0,
+ NULL
+ };
+#endif
+
+#ifdef AEPRAND
+/* our internal RAND_method that we provide pointers to */
+static RAND_METHOD aep_random =
+ {
+ /*"AEP RAND method", */
+ NULL,
+ aep_rand,
+ NULL,
+ NULL,
+ aep_rand,
+ aep_rand_status,
+ };
+#endif
+
+/*Define an array of structures to hold connections*/
+static AEP_CONNECTION_ENTRY aep_app_conn_table[MAX_PROCESS_CONNECTIONS];
+
+/*Used to determine if this is a new process*/
+static pid_t recorded_pid = 0;
+
+#ifdef AEPRAND
+static AEP_U8 rand_block[RAND_BLK_SIZE];
+static AEP_U32 rand_block_bytes = 0;
+#endif
+
+/* Constants used when creating the ENGINE */
+static const char *engine_aep_id = "aep";
+static const char *engine_aep_name = "Aep hardware engine support";
+
+
+/* This internal function is used by ENGINE_aep() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_aep(ENGINE *e)
+ {
+#ifndef OPENSSL_NO_RSA
+ const RSA_METHOD *meth1;
+#endif
+#ifndef OPENSSL_NO_DSA
+ const DSA_METHOD *meth2;
+#endif
+#ifndef OPENSSL_NO_DH
+ const DH_METHOD *meth3;
+#endif
+
+ if(!ENGINE_set_id(e, engine_aep_id) ||
+ !ENGINE_set_name(e, engine_aep_name) ||
+#ifndef OPENSSL_NO_RSA
+ !ENGINE_set_RSA(e, &aep_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+ !ENGINE_set_DSA(e, &aep_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+ !ENGINE_set_DH(e, &aep_dh) ||
+#endif
+#ifdef AEPRAND
+ !ENGINE_set_RAND(e, &aep_random) ||
+#endif
+ !ENGINE_set_init_function(e, aep_init) ||
+ !ENGINE_set_destroy_function(e, aep_destroy) ||
+ !ENGINE_set_finish_function(e, aep_finish) ||
+ !ENGINE_set_ctrl_function(e, aep_ctrl) ||
+ !ENGINE_set_cmd_defns(e, aep_cmd_defns))
+ return 0;
+
+#ifndef OPENSSL_NO_RSA
+ /* We know that the "PKCS1_SSLeay()" functions hook properly
+ * to the aep-specific mod_exp and mod_exp_crt so we use
+ * those functions. NB: We don't use ENGINE_openssl() or
+ * anything "more generic" because something like the RSAref
+ * code may not hook properly, and if you own one of these
+ * cards then you have the right to do RSA operations on it
+ * anyway! */
+ meth1 = RSA_PKCS1_SSLeay();
+ aep_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+ aep_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+ aep_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
+ aep_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
+#endif
+
+
+#ifndef OPENSSL_NO_DSA
+ /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
+ * bits. */
+ meth2 = DSA_OpenSSL();
+ aep_dsa.dsa_do_sign = meth2->dsa_do_sign;
+ aep_dsa.dsa_sign_setup = meth2->dsa_sign_setup;
+ aep_dsa.dsa_do_verify = meth2->dsa_do_verify;
+
+ aep_dsa = *DSA_get_default_method();
+ aep_dsa.dsa_mod_exp = aep_dsa_mod_exp;
+ aep_dsa.bn_mod_exp = aep_mod_exp_dsa;
+#endif
+
+#ifndef OPENSSL_NO_DH
+ /* Much the same for Diffie-Hellman */
+ meth3 = DH_OpenSSL();
+ aep_dh.generate_key = meth3->generate_key;
+ aep_dh.compute_key = meth3->compute_key;
+ aep_dh.bn_mod_exp = meth3->bn_mod_exp;
+#endif
+
+ /* Ensure the aep error handling is set up */
+ ERR_load_AEP_strings();
+
+ return 1;
+}
+
+#ifdef ENGINE_DYNAMIC_SUPPORT
+static int bind_helper(ENGINE *e, const char *id)
+ {
+ if(id && (strcmp(id, engine_aep_id) != 0))
+ return 0;
+ if(!bind_aep(e))
+ return 0;
+ return 1;
+ }
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
+#else
+static ENGINE *engine_aep(void)
+ {
+ ENGINE *ret = ENGINE_new();
+ if(!ret)
+ return NULL;
+ if(!bind_aep(ret))
+ {
+ ENGINE_free(ret);
+ return NULL;
+ }
+ return ret;
+ }
+
+void ENGINE_load_aep(void)
+ {
+ /* Copied from eng_[openssl|dyn].c */
+ ENGINE *toadd = engine_aep();
+ if(!toadd) return;
+ ENGINE_add(toadd);
+ ENGINE_free(toadd);
+ ERR_clear_error();
+ }
+#endif
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the Aep library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+static DSO *aep_dso = NULL;
+
+/* These are the static string constants for the DSO file name and the function
+ * symbol names to bind to.
+*/
+static const char *AEP_LIBNAME = "aep";
+
+static const char *AEP_F1 = "AEP_ModExp";
+static const char *AEP_F2 = "AEP_ModExpCrt";
+#ifdef AEPRAND
+static const char *AEP_F3 = "AEP_GenRandom";
+#endif
+static const char *AEP_F4 = "AEP_Finalize";
+static const char *AEP_F5 = "AEP_Initialize";
+static const char *AEP_F6 = "AEP_OpenConnection";
+static const char *AEP_F7 = "AEP_SetBNCallBacks";
+static const char *AEP_F8 = "AEP_CloseConnection";
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+static t_AEP_OpenConnection *p_AEP_OpenConnection = NULL;
+static t_AEP_CloseConnection *p_AEP_CloseConnection = NULL;
+static t_AEP_ModExp *p_AEP_ModExp = NULL;
+static t_AEP_ModExpCrt *p_AEP_ModExpCrt = NULL;
+#ifdef AEPRAND
+static t_AEP_GenRandom *p_AEP_GenRandom = NULL;
+#endif
+static t_AEP_Initialize *p_AEP_Initialize = NULL;
+static t_AEP_Finalize *p_AEP_Finalize = NULL;
+static t_AEP_SetBNCallBacks *p_AEP_SetBNCallBacks = NULL;
+
+/* (de)initialisation functions. */
+static int aep_init(ENGINE *e)
+ {
+ t_AEP_ModExp *p1;
+ t_AEP_ModExpCrt *p2;
+#ifdef AEPRAND
+ t_AEP_GenRandom *p3;
+#endif
+ t_AEP_Finalize *p4;
+ t_AEP_Initialize *p5;
+ t_AEP_OpenConnection *p6;
+ t_AEP_SetBNCallBacks *p7;
+ t_AEP_CloseConnection *p8;
+
+ int to_return = 0;
+
+ if(aep_dso != NULL)
+ {
+ AEPerr(AEP_F_AEP_INIT,AEP_R_ALREADY_LOADED);
+ goto err;
+ }
+ /* Attempt to load libaep.so. */
+
+ aep_dso = DSO_load(NULL, AEP_LIBNAME, NULL, 0);
+
+ if(aep_dso == NULL)
+ {
+ AEPerr(AEP_F_AEP_INIT,AEP_R_NOT_LOADED);
+ goto err;
+ }
+
+ if( !(p1 = (t_AEP_ModExp *) DSO_bind_func( aep_dso,AEP_F1)) ||
+ !(p2 = (t_AEP_ModExpCrt*) DSO_bind_func( aep_dso,AEP_F2)) ||
+#ifdef AEPRAND
+ !(p3 = (t_AEP_GenRandom*) DSO_bind_func( aep_dso,AEP_F3)) ||
+#endif
+ !(p4 = (t_AEP_Finalize*) DSO_bind_func( aep_dso,AEP_F4)) ||
+ !(p5 = (t_AEP_Initialize*) DSO_bind_func( aep_dso,AEP_F5)) ||
+ !(p6 = (t_AEP_OpenConnection*) DSO_bind_func( aep_dso,AEP_F6)) ||
+ !(p7 = (t_AEP_SetBNCallBacks*) DSO_bind_func( aep_dso,AEP_F7)) ||
+ !(p8 = (t_AEP_CloseConnection*) DSO_bind_func( aep_dso,AEP_F8)))
+ {
+ AEPerr(AEP_F_AEP_INIT,AEP_R_NOT_LOADED);
+ goto err;
+ }
+
+ /* Copy the pointers */
+
+ p_AEP_ModExp = p1;
+ p_AEP_ModExpCrt = p2;
+#ifdef AEPRAND
+ p_AEP_GenRandom = p3;
+#endif
+ p_AEP_Finalize = p4;
+ p_AEP_Initialize = p5;
+ p_AEP_OpenConnection = p6;
+ p_AEP_SetBNCallBacks = p7;
+ p_AEP_CloseConnection = p8;
+
+ to_return = 1;
+
+ return to_return;
+
+ err:
+
+ if(aep_dso)
+ DSO_free(aep_dso);
+
+ p_AEP_OpenConnection = NULL;
+ p_AEP_ModExp = NULL;
+ p_AEP_ModExpCrt = NULL;
+#ifdef AEPRAND
+ p_AEP_GenRandom = NULL;
+#endif
+ p_AEP_Initialize = NULL;
+ p_AEP_Finalize = NULL;
+ p_AEP_SetBNCallBacks = NULL;
+ p_AEP_CloseConnection = NULL;
+
+ return to_return;
+ }
+
+/* Destructor (complements the "ENGINE_aep()" constructor) */
+static int aep_destroy(ENGINE *e)
+ {
+ ERR_unload_AEP_strings();
+ return 1;
+ }
+
+static int aep_finish(ENGINE *e)
+ {
+ int to_return = 0, in_use;
+ AEP_RV rv;
+
+ if(aep_dso == NULL)
+ {
+ AEPerr(AEP_F_AEP_FINISH,AEP_R_NOT_LOADED);
+ goto err;
+ }
+
+ rv = aep_close_all_connections(0, &in_use);
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_FINISH,AEP_R_CLOSE_HANDLES_FAILED);
+ goto err;
+ }
+ if (in_use)
+ {
+ AEPerr(AEP_F_AEP_FINISH,AEP_R_CONNECTIONS_IN_USE);
+ goto err;
+ }
+
+ rv = p_AEP_Finalize();
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_FINISH,AEP_R_FINALIZE_FAILED);
+ goto err;
+ }
+
+ if(!DSO_free(aep_dso))
+ {
+ AEPerr(AEP_F_AEP_FINISH,AEP_R_UNIT_FAILURE);
+ goto err;
+ }
+
+ aep_dso = NULL;
+ p_AEP_CloseConnection = NULL;
+ p_AEP_OpenConnection = NULL;
+ p_AEP_ModExp = NULL;
+ p_AEP_ModExpCrt = NULL;
+#ifdef AEPRAND
+ p_AEP_GenRandom = NULL;
+#endif
+ p_AEP_Initialize = NULL;
+ p_AEP_Finalize = NULL;
+ p_AEP_SetBNCallBacks = NULL;
+
+ to_return = 1;
+ err:
+ return to_return;
+ }
+
+static int aep_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
+ {
+ int initialised = ((aep_dso == NULL) ? 0 : 1);
+ switch(cmd)
+ {
+ case AEP_CMD_SO_PATH:
+ if(p == NULL)
+ {
+ AEPerr(AEP_F_AEP_CTRL,
+ ERR_R_PASSED_NULL_PARAMETER);
+ return 0;
+ }
+ if(initialised)
+ {
+ AEPerr(AEP_F_AEP_CTRL,
+ AEP_R_ALREADY_LOADED);
+ return 0;
+ }
+ AEP_LIBNAME = (const char *)p;
+ return 1;
+ default:
+ break;
+ }
+ AEPerr(AEP_F_AEP_CTRL,AEP_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+ return 0;
+ }
+
+static int aep_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+ const BIGNUM *m, BN_CTX *ctx)
+ {
+ int to_return = 0;
+ AEP_CONNECTION_HNDL hConnection;
+ AEP_RV rv;
+
+ /*Grab a connection from the pool*/
+ rv = aep_get_connection(&hConnection);
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_MOD_EXP,AEP_R_GET_HANDLE_FAILED);
+ goto err;
+ }
+
+ /*To the card with the mod exp*/
+ rv = p_AEP_ModExp(hConnection,(void*)a, (void*)p,(void*)m, (void*)r,NULL);
+
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_MOD_EXP,AEP_R_MOD_EXP_FAILED);
+ rv = aep_return_connection(hConnection);
+ goto err;
+ }
+
+ /*Return the connection to the pool*/
+ rv = aep_return_connection(hConnection);
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_RAND,AEP_R_RETURN_CONNECTION_FAILED);
+ goto err;
+ }
+
+ to_return = 1;
+ err:
+ return to_return;
+ }
+
+static AEP_RV aep_mod_exp_crt(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+ const BIGNUM *q, const BIGNUM *dmp1,
+ const BIGNUM *dmq1,const BIGNUM *iqmp, BN_CTX *ctx)
+ {
+ AEP_RV rv = AEP_R_OK;
+ AEP_CONNECTION_HNDL hConnection;
+
+ /*Grab a connection from the pool*/
+ rv = aep_get_connection(&hConnection);
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_MOD_EXP_CRT,AEP_R_GET_HANDLE_FAILED);
+ goto err;
+ }
+
+ /*To the card with the mod exp*/
+ rv = p_AEP_ModExpCrt(hConnection,(void*)a, (void*)p, (void*)q, (void*)dmp1,(void*)dmq1,
+ (void*)iqmp,(void*)r,NULL);
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_MOD_EXP_CRT,AEP_R_MOD_EXP_CRT_FAILED);
+ rv = aep_return_connection(hConnection);
+ goto err;
+ }
+
+ /*Return the connection to the pool*/
+ rv = aep_return_connection(hConnection);
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_RAND,AEP_R_RETURN_CONNECTION_FAILED);
+ goto err;
+ }
+
+ err:
+ return rv;
+ }
+
+
+#ifdef AEPRAND
+static int aep_rand(unsigned char *buf,int len )
+ {
+ AEP_RV rv = AEP_R_OK;
+ AEP_CONNECTION_HNDL hConnection;
+
+ int to_return = 0;
+
+
+ CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+
+ /*Can the request be serviced with what's already in the buffer?*/
+ if (len <= rand_block_bytes)
+ {
+ memcpy(buf, &rand_block[RAND_BLK_SIZE - rand_block_bytes], len);
+ rand_block_bytes -= len;
+ CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+ }
+ else
+ /*If not the get another block of random bytes*/
+ {
+ CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+
+ rv = aep_get_connection(&hConnection);
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_RAND,AEP_R_GET_HANDLE_FAILED);
+ goto err_nounlock;
+ }
+
+ if (len > RAND_BLK_SIZE)
+ {
+ rv = p_AEP_GenRandom(hConnection, len, 2, buf, NULL);
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_RAND,AEP_R_GET_RANDOM_FAILED);
+ goto err_nounlock;
+ }
+ }
+ else
+ {
+ CRYPTO_w_lock(CRYPTO_LOCK_RAND);
+
+ rv = p_AEP_GenRandom(hConnection, RAND_BLK_SIZE, 2, &rand_block[0], NULL);
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_RAND,AEP_R_GET_RANDOM_FAILED);
+
+ goto err;
+ }
+
+ rand_block_bytes = RAND_BLK_SIZE;
+
+ memcpy(buf, &rand_block[RAND_BLK_SIZE - rand_block_bytes], len);
+ rand_block_bytes -= len;
+
+ CRYPTO_w_unlock(CRYPTO_LOCK_RAND);
+ }
+
+ rv = aep_return_connection(hConnection);
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_RAND,AEP_R_RETURN_CONNECTION_FAILED);
+
+ goto err_nounlock;
+ }
+ }
+
+ return 1;
+ err:
+ CRYPTO_w_unlock(CRYPTO_LOCK_DYNLOCK);
+ err_nounlock:
+ return 0;
+ }
+
+static int aep_rand_status(void)
+{
+ return 1;
+}
+#endif
+
+#ifndef OPENSSL_NO_RSA
+static int aep_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
+ {
+ BN_CTX *ctx = NULL;
+ int to_return = 0;
+ AEP_RV rv = AEP_R_OK;
+
+ if ((ctx = BN_CTX_new()) == NULL)
+ goto err;
+
+ if (!aep_dso)
+ {
+ AEPerr(AEP_F_AEP_RSA_MOD_EXP,AEP_R_NOT_LOADED);
+ goto err;
+ }
+
+ /*See if we have all the necessary bits for a crt*/
+ if (rsa->q && rsa->dmp1 && rsa->dmq1 && rsa->iqmp)
+ {
+ rv = aep_mod_exp_crt(r0,I,rsa->p,rsa->q, rsa->dmp1,rsa->dmq1,rsa->iqmp,ctx);
+ if (rv != AEP_R_OK)
+ goto err;
+ }
+ else
+ {
+ if (!rsa->d || !rsa->n)
+ {
+ AEPerr(AEP_F_AEP_RSA_MOD_EXP,AEP_R_MISSING_KEY_COMPONENTS);
+ goto err;
+ }
+
+ rv = aep_mod_exp(r0,I,rsa->d,rsa->n,ctx);
+ if (rv != AEP_R_OK)
+ goto err;
+
+ }
+
+ to_return = 1;
+
+ err:
+ if(ctx)
+ BN_CTX_free(ctx);
+ return to_return;
+}
+#endif
+
+#ifndef OPENSSL_NO_DSA
+static int aep_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+ BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+ BN_CTX *ctx, BN_MONT_CTX *in_mont)
+ {
+ BIGNUM t;
+ int to_return = 0;
+ BN_init(&t);
+
+ /* let rr = a1 ^ p1 mod m */
+ if (!aep_mod_exp(rr,a1,p1,m,ctx)) goto end;
+ /* let t = a2 ^ p2 mod m */
+ if (!aep_mod_exp(&t,a2,p2,m,ctx)) goto end;
+ /* let rr = rr * t mod m */
+ if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
+ to_return = 1;
+ end:
+ BN_free(&t);
+ return to_return;
+ }
+
+static int aep_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+ const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+ BN_MONT_CTX *m_ctx)
+ {
+ return aep_mod_exp(r, a, p, m, ctx);
+ }
+#endif
+
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int aep_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+ const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+ {
+ return aep_mod_exp(r, a, p, m, ctx);
+ }
+
+#ifndef OPENSSL_NO_DH
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int aep_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
+ const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+ BN_MONT_CTX *m_ctx)
+ {
+ return aep_mod_exp(r, a, p, m, ctx);
+ }
+#endif
+
+static AEP_RV aep_get_connection(AEP_CONNECTION_HNDL_PTR phConnection)
+ {
+ int count;
+ AEP_RV rv = AEP_R_OK;
+
+ /*Get the current process id*/
+ pid_t curr_pid;
+
+ CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+
+ curr_pid = getpid();
+
+ /*Check if this is the first time this is being called from the current
+ process*/
+ if (recorded_pid != curr_pid)
+ {
+ /*Remember our pid so we can check if we're in a new process*/
+ recorded_pid = curr_pid;
+
+ /*Call Finalize to make sure we have not inherited some data
+ from a parent process*/
+ p_AEP_Finalize();
+
+ /*Initialise the AEP API*/
+ rv = p_AEP_Initialize(NULL);
+
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_INIT,AEP_R_INIT_FAILURE);
+ recorded_pid = 0;
+ goto end;
+ }
+
+ /*Set the AEP big num call back functions*/
+ rv = p_AEP_SetBNCallBacks(&GetBigNumSize, &MakeAEPBigNum,
+ &ConvertAEPBigNum);
+
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_INIT,AEP_R_SETBNCALLBACK_FAILURE);
+ recorded_pid = 0;
+ goto end;
+ }
+
+#ifdef AEPRAND
+ /*Reset the rand byte count*/
+ rand_block_bytes = 0;
+#endif
+
+ /*Init the structures*/
+ for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+ {
+ aep_app_conn_table[count].conn_state = NotConnected;
+ aep_app_conn_table[count].conn_hndl = 0;
+ }
+
+ /*Open a connection*/
+ rv = p_AEP_OpenConnection(phConnection);
+
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_INIT,AEP_R_UNIT_FAILURE);
+ recorded_pid = 0;
+ goto end;
+ }
+
+ aep_app_conn_table[0].conn_state = InUse;
+ aep_app_conn_table[0].conn_hndl = *phConnection;
+ goto end;
+ }
+ /*Check the existing connections to see if we can find a free one*/
+ for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+ {
+ if (aep_app_conn_table[count].conn_state == Connected)
+ {
+ aep_app_conn_table[count].conn_state = InUse;
+ *phConnection = aep_app_conn_table[count].conn_hndl;
+ goto end;
+ }
+ }
+ /*If no connections available, we're going to have to try
+ to open a new one*/
+ for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+ {
+ if (aep_app_conn_table[count].conn_state == NotConnected)
+ {
+ /*Open a connection*/
+ rv = p_AEP_OpenConnection(phConnection);
+
+ if (rv != AEP_R_OK)
+ {
+ AEPerr(AEP_F_AEP_INIT,AEP_R_UNIT_FAILURE);
+ goto end;
+ }
+
+ aep_app_conn_table[count].conn_state = InUse;
+ aep_app_conn_table[count].conn_hndl = *phConnection;
+ goto end;
+ }
+ }
+ rv = AEP_R_GENERAL_ERROR;
+ end:
+ CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+ return rv;
+ }
+
+
+static AEP_RV aep_return_connection(AEP_CONNECTION_HNDL hConnection)
+ {
+ int count;
+
+ CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+
+ /*Find the connection item that matches this connection handle*/
+ for(count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+ {
+ if (aep_app_conn_table[count].conn_hndl == hConnection)
+ {
+ aep_app_conn_table[count].conn_state = Connected;
+ break;
+ }
+ }
+
+ CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+
+ return AEP_R_OK;
+ }
+
+static AEP_RV aep_close_all_connections(int use_engine_lock, int *in_use)
+ {
+ int count;
+ AEP_RV rv;
+
+ *in_use = 0;
+ if (use_engine_lock) CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+ for (count = 0;count < MAX_PROCESS_CONNECTIONS;count ++)
+ {
+ switch (aep_app_conn_table[count].conn_state)
+ {
+ case Connected:
+ rv = p_AEP_CloseConnection(aep_app_conn_table[count].conn_hndl);
+ if (rv != AEP_R_OK)
+ return rv;
+ aep_app_conn_table[count].conn_state = NotConnected;
+ aep_app_conn_table[count].conn_hndl = 0;
+ break;
+ case InUse:
+ (*in_use)++;
+ break;
+ case NotConnected:
+ break;
+ }
+ }
+ if (use_engine_lock) CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+ return AEP_R_OK;
+ }
+
+/*BigNum call back functions, used to convert OpenSSL bignums into AEP bignums.
+ Note only 32bit Openssl build support*/
+
+static AEP_RV GetBigNumSize(void* ArbBigNum, AEP_U32* BigNumSize)
+ {
+ BIGNUM* bn;
+
+ /*Cast the ArbBigNum pointer to our BIGNUM struct*/
+ bn = (BIGNUM*) ArbBigNum;
+
+#ifdef SIXTY_FOUR_BIT_LONG
+ *BigNumSize = bn->top << 3;
+#else
+ /*Size of the bignum in bytes is equal to the bn->top (no of 32 bit
+ words) multiplies by 4*/
+ *BigNumSize = bn->top << 2;
+#endif
+
+ return AEP_R_OK;
+ }
+
+static AEP_RV MakeAEPBigNum(void* ArbBigNum, AEP_U32 BigNumSize,
+ unsigned char* AEP_BigNum)
+ {
+ BIGNUM* bn;
+
+#ifndef SIXTY_FOUR_BIT_LONG
+ unsigned char* buf;
+ int i;
+#endif
+
+ /*Cast the ArbBigNum pointer to our BIGNUM struct*/
+ bn = (BIGNUM*) ArbBigNum;
+
+#ifdef SIXTY_FOUR_BIT_LONG
+ memcpy(AEP_BigNum, bn->d, BigNumSize);
+#else
+ /*Must copy data into a (monotone) least significant byte first format
+ performing endian conversion if necessary*/
+ for(i=0;i<bn->top;i++)
+ {
+ buf = (unsigned char*)&bn->d[i];
+
+ *((AEP_U32*)AEP_BigNum) =
+ (AEP_U32) ((unsigned) buf[1] << 8 | buf[0]) |
+ ((unsigned) buf[3] << 8 | buf[2]) << 16;
+
+ AEP_BigNum += 4;
+ }
+#endif
+
+ return AEP_R_OK;
+ }
+
+/*Turn an AEP Big Num back to a user big num*/
+static AEP_RV ConvertAEPBigNum(void* ArbBigNum, AEP_U32 BigNumSize,
+ unsigned char* AEP_BigNum)
+ {
+ BIGNUM* bn;
+#ifndef SIXTY_FOUR_BIT_LONG
+ int i;
+#endif
+
+ bn = (BIGNUM*)ArbBigNum;
+
+ /*Expand the result bn so that it can hold our big num.
+ Size is in bits*/
+ bn_expand(bn, (int)(BigNumSize << 3));
+
+#ifdef SIXTY_FOUR_BIT_LONG
+ bn->top = BigNumSize >> 3;
+
+ if((BigNumSize & 7) != 0)
+ bn->top++;
+
+ memset(bn->d, 0, bn->top << 3);
+
+ memcpy(bn->d, AEP_BigNum, BigNumSize);
+#else
+ bn->top = BigNumSize >> 2;
+
+ for(i=0;i<bn->top;i++)
+ {
+ bn->d[i] = (AEP_U32)
+ ((unsigned) AEP_BigNum[3] << 8 | AEP_BigNum[2]) << 16 |
+ ((unsigned) AEP_BigNum[1] << 8 | AEP_BigNum[0]);
+ AEP_BigNum += 4;
+ }
+#endif
+
+ return AEP_R_OK;
+}
+
+#endif /* !OPENSSL_NO_HW_AEP */
+#endif /* !OPENSSL_NO_HW */
--- /dev/null
+/* hw_aep_err.c */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ * software must display the following acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ * endorse or promote products derived from this software without
+ * prior written permission. For written permission, please contact
+ * openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ * nor may "OpenSSL" appear in their names without prior written
+ * permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ * acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com). This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "hw_aep_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+static ERR_STRING_DATA AEP_str_functs[]=
+ {
+{ERR_PACK(0,AEP_F_AEP_CTRL,0), "AEP_CTRL"},
+{ERR_PACK(0,AEP_F_AEP_FINISH,0), "AEP_FINISH"},
+{ERR_PACK(0,AEP_F_AEP_INIT,0), "AEP_INIT"},
+{ERR_PACK(0,AEP_F_AEP_MOD_EXP,0), "AEP_MOD_EXP"},
+{ERR_PACK(0,AEP_F_AEP_MOD_EXP_CRT,0), "AEP_MOD_EXP_CRT"},
+{ERR_PACK(0,AEP_F_AEP_RAND,0), "AEP_RAND"},
+{ERR_PACK(0,AEP_F_AEP_RSA_MOD_EXP,0), "AEP_RSA_MOD_EXP"},
+{0,NULL}
+ };
+
+static ERR_STRING_DATA AEP_str_reasons[]=
+ {
+{AEP_R_ALREADY_LOADED ,"already loaded"},
+{AEP_R_CLOSE_HANDLES_FAILED ,"close handles failed"},
+{AEP_R_CONNECTIONS_IN_USE ,"connections in use"},
+{AEP_R_CTRL_COMMAND_NOT_IMPLEMENTED ,"ctrl command not implemented"},
+{AEP_R_FINALIZE_FAILED ,"finalize failed"},
+{AEP_R_GENERAL_ERROR ,"general error"},
+{AEP_R_GET_HANDLE_FAILED ,"get handle failed"},
+{AEP_R_GET_RANDOM_FAILED ,"get random failed"},
+{AEP_R_INIT_FAILURE ,"init failure"},
+{AEP_R_MISSING_KEY_COMPONENTS ,"missing key components"},
+{AEP_R_MOD_EXP_CRT_FAILED ,"mod exp crt failed"},
+{AEP_R_MOD_EXP_FAILED ,"mod exp failed"},
+{AEP_R_NOT_LOADED ,"not loaded"},
+{AEP_R_OK ,"ok"},
+{AEP_R_RETURN_CONNECTION_FAILED ,"return connection failed"},
+{AEP_R_SETBNCALLBACK_FAILURE ,"setbncallback failure"},
+{AEP_R_UNIT_FAILURE ,"unit failure"},
+{0,NULL}
+ };
+
+#endif
+
+#ifdef AEP_LIB_NAME
+static ERR_STRING_DATA AEP_lib_name[]=
+ {
+{0 ,AEP_LIB_NAME},
+{0,NULL}
+ };
+#endif
+
+
+static int AEP_lib_error_code=0;
+static int AEP_error_init=1;
+
+static void ERR_load_AEP_strings(void)
+ {
+ if (AEP_lib_error_code == 0)
+ AEP_lib_error_code=ERR_get_next_error_library();
+
+ if (AEP_error_init)
+ {
+ AEP_error_init=0;
+#ifndef OPENSSL_NO_ERR
+ ERR_load_strings(AEP_lib_error_code,AEP_str_functs);
+ ERR_load_strings(AEP_lib_error_code,AEP_str_reasons);
+#endif
+
+#ifdef AEP_LIB_NAME
+ AEP_lib_name->error = ERR_PACK(AEP_lib_error_code,0,0);
+ ERR_load_strings(0,AEP_lib_name);
+#endif
+ }
+ }
+
+static void ERR_unload_AEP_strings(void)
+ {
+ if (AEP_error_init == 0)
+ {
+#ifndef OPENSSL_NO_ERR
+ ERR_unload_strings(AEP_lib_error_code,AEP_str_functs);
+ ERR_unload_strings(AEP_lib_error_code,AEP_str_reasons);
+#endif
+
+#ifdef AEP_LIB_NAME
+ ERR_unload_strings(0,AEP_lib_name);
+#endif
+ AEP_error_init=1;
+ }
+ }
+
+static void ERR_AEP_error(int function, int reason, char *file, int line)
+ {
+ if (AEP_lib_error_code == 0)
+ AEP_lib_error_code=ERR_get_next_error_library();
+ ERR_PUT_error(AEP_lib_error_code,function,reason,file,line);
+ }
--- /dev/null
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ * software must display the following acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ * endorse or promote products derived from this software without
+ * prior written permission. For written permission, please contact
+ * openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ * nor may "OpenSSL" appear in their names without prior written
+ * permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ * acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com). This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_AEP_ERR_H
+#define HEADER_AEP_ERR_H
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_AEP_strings(void);
+static void ERR_unload_AEP_strings(void);
+static void ERR_AEP_error(int function, int reason, char *file, int line);
+#define AEPerr(f,r) ERR_AEP_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the AEP functions. */
+
+/* Function codes. */
+#define AEP_F_AEP_CTRL 100
+#define AEP_F_AEP_FINISH 101
+#define AEP_F_AEP_INIT 102
+#define AEP_F_AEP_MOD_EXP 103
+#define AEP_F_AEP_MOD_EXP_CRT 104
+#define AEP_F_AEP_RAND 105
+#define AEP_F_AEP_RSA_MOD_EXP 106
+
+/* Reason codes. */
+#define AEP_R_ALREADY_LOADED 100
+#define AEP_R_CLOSE_HANDLES_FAILED 101
+#define AEP_R_CONNECTIONS_IN_USE 102
+#define AEP_R_CTRL_COMMAND_NOT_IMPLEMENTED 103
+#define AEP_R_FINALIZE_FAILED 104
+#define AEP_R_GENERAL_ERROR 105
+#define AEP_R_GET_HANDLE_FAILED 106
+#define AEP_R_GET_RANDOM_FAILED 107
+#define AEP_R_INIT_FAILURE 108
+#define AEP_R_MISSING_KEY_COMPONENTS 109
+#define AEP_R_MOD_EXP_CRT_FAILED 110
+#define AEP_R_MOD_EXP_FAILED 111
+#define AEP_R_NOT_LOADED 112
+#define AEP_R_OK 113
+#define AEP_R_RETURN_CONNECTION_FAILED 114
+#define AEP_R_SETBNCALLBACK_FAILURE 115
+#define AEP_R_UNIT_FAILURE 116
+
+#ifdef __cplusplus
+}
+#endif
+#endif
--- /dev/null
+/* Written by Corinne Dive-Reclus(cdive@baltimore.com)
+*
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions
+* are met:
+*
+* 1. Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*
+* 2. Redistributions in binary form must reproduce the above copyright
+* notice, this list of conditions and the following disclaimer in
+* the documentation and/or other materials provided with the
+* distribution.
+*
+* 3. All advertising materials mentioning features or use of this
+* software must display the following acknowledgment:
+* "This product includes software developed by the OpenSSL Project
+* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+*
+* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+* endorse or promote products derived from this software without
+* prior written permission. For written permission, please contact
+* licensing@OpenSSL.org.
+*
+* 5. Products derived from this software may not be called "OpenSSL"
+* nor may "OpenSSL" appear in their names without prior written
+* permission of the OpenSSL Project.
+*
+* 6. Redistributions of any form whatsoever must retain the following
+* acknowledgment:
+* "This product includes software developed by the OpenSSL Project
+* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+*
+* Written by Corinne Dive-Reclus(cdive@baltimore.com)
+*
+* Copyright@2001 Baltimore Technologies Ltd.
+* All right Reserved.
+* *
+* THIS FILE IS PROVIDED BY BALTIMORE TECHNOLOGIES ``AS IS'' AND *
+* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE *
+* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE *
+* ARE DISCLAIMED. IN NO EVENT SHALL BALTIMORE TECHNOLOGIES BE LIABLE *
+* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL *
+* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS *
+* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) *
+* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT *
+* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY *
+* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF *
+* SUCH DAMAGE. *
+====================================================================*/
+
+#include <stdio.h>
+#include <openssl/crypto.h>
+#include <openssl/pem.h>
+#include "cryptlib.h"
+#include <openssl/dso.h>
+#include "eng_int.h"
+#include "engine.h"
+#include <openssl/engine.h>
+
+#ifndef NO_HW
+#ifndef NO_HW_SUREWARE
+
+#ifdef FLAT_INC
+#include "sureware.h"
+#else
+#include "vendor_defns/sureware.h"
+#endif
+
+#define SUREWARE_LIB_NAME "sureware engine"
+#include "hw_sureware_err.c"
+
+static int surewarehk_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
+static int surewarehk_destroy(ENGINE *e);
+static int surewarehk_init(ENGINE *e);
+static int surewarehk_finish(ENGINE *e);
+static int surewarehk_modexp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+ const BIGNUM *m, BN_CTX *ctx);
+
+/* RSA stuff */
+static int surewarehk_rsa_priv_dec(int flen,const unsigned char *from,unsigned char *to,
+ RSA *rsa,int padding);
+static int surewarehk_rsa_sign(int flen,const unsigned char *from,unsigned char *to,
+ RSA *rsa,int padding);
+
+/* RAND stuff */
+static int surewarehk_rand_bytes(unsigned char *buf, int num);
+static void surewarehk_rand_seed(const void *buf, int num);
+static void surewarehk_rand_add(const void *buf, int num, double entropy);
+
+/* KM stuff */
+static EVP_PKEY *surewarehk_load_privkey(ENGINE *e, const char *key_id,
+ UI_METHOD *ui_method, void *callback_data);
+static EVP_PKEY *surewarehk_load_pubkey(ENGINE *e, const char *key_id,
+ UI_METHOD *ui_method, void *callback_data);
+static void surewarehk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+ int index,long argl, void *argp);
+static void surewarehk_dh_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+ int index,long argl, void *argp);
+
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int surewarehk_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+ const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+{
+ return surewarehk_modexp(r, a, p, m, ctx);
+}
+
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD surewarehk_rsa =
+ {
+ "SureWare RSA method",
+ NULL, /* pub_enc*/
+ NULL, /* pub_dec*/
+ surewarehk_rsa_sign, /* our rsa_sign is OpenSSL priv_enc*/
+ surewarehk_rsa_priv_dec, /* priv_dec*/
+ NULL, /*mod_exp*/
+ surewarehk_mod_exp_mont, /*mod_exp_mongomery*/
+ NULL, /* init*/
+ NULL, /* finish*/
+ 0, /* RSA flag*/
+ NULL,
+ NULL, /* OpenSSL sign*/
+ NULL /* OpenSSL verify*/
+ };
+/* Our internal DH_METHOD that we provide pointers to */
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int surewarehk_modexp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a,
+ const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+{
+ return surewarehk_modexp(r, a, p, m, ctx);
+}
+static DH_METHOD surewarehk_dh =
+ {
+ "SureWare DH method",
+ NULL,/*gen_key*/
+ NULL,/*agree,*/
+ surewarehk_modexp_dh, /*dh mod exp*/
+ NULL, /* init*/
+ NULL, /* finish*/
+ 0, /* flags*/
+ NULL
+ };
+static RAND_METHOD surewarehk_rand =
+ {
+ /* "SureWare RAND method", */
+ surewarehk_rand_seed,
+ surewarehk_rand_bytes,
+ NULL,/*cleanup*/
+ surewarehk_rand_add,
+ surewarehk_rand_bytes,
+ NULL,/*rand_status*/
+ };
+/* DSA stuff */
+static DSA_SIG * surewarehk_dsa_do_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+static int surewarehk_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+ BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+ BN_CTX *ctx, BN_MONT_CTX *in_mont)
+{
+ BIGNUM t;
+ int to_return = 0;
+ BN_init(&t);
+ /* let rr = a1 ^ p1 mod m */
+ if (!surewarehk_modexp(rr,a1,p1,m,ctx)) goto end;
+ /* let t = a2 ^ p2 mod m */
+ if (!surewarehk_modexp(&t,a2,p2,m,ctx)) goto end;
+ /* let rr = rr * t mod m */
+ if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
+ to_return = 1;
+end:
+ BN_free(&t);
+ return to_return;
+}
+
+static DSA_METHOD surewarehk_dsa =
+ {
+ "SureWare DSA method",
+ surewarehk_dsa_do_sign,
+ NULL,/*sign setup*/
+ NULL,/*verify,*/
+ surewarehk_dsa_mod_exp,/*mod exp*/
+ NULL,/*bn mod exp*/
+ NULL, /*init*/
+ NULL,/*finish*/
+ 0,
+ NULL,
+ };
+
+static const char *engine_sureware_id = "sureware";
+static const char *engine_sureware_name = "SureWare hardware engine support";
+
+/* Now, to our own code */
+
+/* As this is only ever called once, there's no need for locking
+ * (indeed - the lock will already be held by our caller!!!) */
+static int bind_sureware(ENGINE *e)
+{
+ const RSA_METHOD *meth1;
+ const DSA_METHOD *meth2;
+ const DH_METHOD *meth3;
+
+ if(!ENGINE_set_id(e, engine_sureware_id) ||
+ !ENGINE_set_name(e, engine_sureware_name) ||
+#ifndef OPENSSL_NO_RSA
+ !ENGINE_set_RSA(e, &surewarehk_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+ !ENGINE_set_DSA(e, &surewarehk_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+ !ENGINE_set_DH(e, &surewarehk_dh) ||
+#endif
+ !ENGINE_set_RAND(e, &surewarehk_rand) ||
+ !ENGINE_set_destroy_function(e, surewarehk_destroy) ||
+ !ENGINE_set_init_function(e, surewarehk_init) ||
+ !ENGINE_set_finish_function(e, surewarehk_finish) ||
+ !ENGINE_set_ctrl_function(e, surewarehk_ctrl) ||
+ !ENGINE_set_load_privkey_function(e, surewarehk_load_privkey) ||
+ !ENGINE_set_load_pubkey_function(e, surewarehk_load_pubkey))
+ return 0;
+
+ /* We know that the "PKCS1_SSLeay()" functions hook properly
+ * to the cswift-specific mod_exp and mod_exp_crt so we use
+ * those functions. NB: We don't use ENGINE_openssl() or
+ * anything "more generic" because something like the RSAref
+ * code may not hook properly, and if you own one of these
+ * cards then you have the right to do RSA operations on it
+ * anyway! */
+ meth1 = RSA_PKCS1_SSLeay();
+ if (meth1)
+ {
+ surewarehk_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+ surewarehk_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+ }
+ /* Use the DSA_OpenSSL() method and just hook the mod_exp-ish
+ * bits. */
+ meth2 = DSA_OpenSSL();
+ if (meth2)
+ {
+ surewarehk_dsa.dsa_do_verify = meth2->dsa_do_verify;
+ }
+ /* Much the same for Diffie-Hellman */
+ meth3 = DH_OpenSSL();
+ if (meth3)
+ {
+ surewarehk_dh.generate_key = meth3->generate_key;
+ surewarehk_dh.compute_key = meth3->compute_key;
+ }
+
+ /* Ensure the sureware error handling is set up */
+ ERR_load_SUREWARE_strings();
+ return 1;
+}
+
+#ifdef ENGINE_DYNAMIC_SUPPORT
+static int bind_helper(ENGINE *e, const char *id)
+ {
+ if(id && (strcmp(id, engine_sureware_id) != 0))
+ return 0;
+ if(!bind_sureware(e))
+ return 0;
+ return 1;
+ }
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
+#else
+static ENGINE *engine_sureware(void)
+ {
+ ENGINE *ret = ENGINE_new();
+ if(!ret)
+ return NULL;
+ if(!bind_sureware(ret))
+ {
+ ENGINE_free(ret);
+ return NULL;
+ }
+ return ret;
+ }
+
+void ENGINE_load_sureware(void)
+ {
+ /* Copied from eng_[openssl|dyn].c */
+ ENGINE *toadd = engine_sureware();
+ if(!toadd) return;
+ ENGINE_add(toadd);
+ ENGINE_free(toadd);
+ ERR_clear_error();
+ }
+#endif
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the SureWareHook library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+static DSO *surewarehk_dso = NULL;
+static int rsaHndidx = -1; /* Index for KM handle. Not really used yet. */
+static int dsaHndidx = -1; /* Index for KM handle. Not really used yet. */
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+static SureWareHook_Init_t *p_surewarehk_Init = NULL;
+static SureWareHook_Finish_t *p_surewarehk_Finish = NULL;
+static SureWareHook_Rand_Bytes_t *p_surewarehk_Rand_Bytes = NULL;
+static SureWareHook_Rand_Seed_t *p_surewarehk_Rand_Seed = NULL;
+static SureWareHook_Load_Privkey_t *p_surewarehk_Load_Privkey = NULL;
+static SureWareHook_Info_Pubkey_t *p_surewarehk_Info_Pubkey = NULL;
+static SureWareHook_Load_Rsa_Pubkey_t *p_surewarehk_Load_Rsa_Pubkey = NULL;
+static SureWareHook_Load_Dsa_Pubkey_t *p_surewarehk_Load_Dsa_Pubkey = NULL;
+static SureWareHook_Free_t *p_surewarehk_Free=NULL;
+static SureWareHook_Rsa_Priv_Dec_t *p_surewarehk_Rsa_Priv_Dec=NULL;
+static SureWareHook_Rsa_Sign_t *p_surewarehk_Rsa_Sign=NULL;
+static SureWareHook_Dsa_Sign_t *p_surewarehk_Dsa_Sign=NULL;
+static SureWareHook_Mod_Exp_t *p_surewarehk_Mod_Exp=NULL;
+
+/* Used in the DSO operations. */
+static const char *surewarehk_LIBNAME = "SureWareHook";
+static const char *n_surewarehk_Init = "SureWareHook_Init";
+static const char *n_surewarehk_Finish = "SureWareHook_Finish";
+static const char *n_surewarehk_Rand_Bytes="SureWareHook_Rand_Bytes";
+static const char *n_surewarehk_Rand_Seed="SureWareHook_Rand_Seed";
+static const char *n_surewarehk_Load_Privkey="SureWareHook_Load_Privkey";
+static const char *n_surewarehk_Info_Pubkey="SureWareHook_Info_Pubkey";
+static const char *n_surewarehk_Load_Rsa_Pubkey="SureWareHook_Load_Rsa_Pubkey";
+static const char *n_surewarehk_Load_Dsa_Pubkey="SureWareHook_Load_Dsa_Pubkey";
+static const char *n_surewarehk_Free="SureWareHook_Free";
+static const char *n_surewarehk_Rsa_Priv_Dec="SureWareHook_Rsa_Priv_Dec";
+static const char *n_surewarehk_Rsa_Sign="SureWareHook_Rsa_Sign";
+static const char *n_surewarehk_Dsa_Sign="SureWareHook_Dsa_Sign";
+static const char *n_surewarehk_Mod_Exp="SureWareHook_Mod_Exp";
+static BIO *logstream = NULL;
+
+/* SureWareHook library functions and mechanics - these are used by the
+ * higher-level functions further down. NB: As and where there's no
+ * error checking, take a look lower down where these functions are
+ * called, the checking and error handling is probably down there.
+*/
+static int threadsafe=1;
+static int surewarehk_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
+{
+ int to_return = 1;
+
+ switch(cmd)
+ {
+ case ENGINE_CTRL_SET_LOGSTREAM:
+ {
+ BIO *bio = (BIO *)p;
+ CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+ if (logstream)
+ {
+ BIO_free(logstream);
+ logstream = NULL;
+ }
+ if (CRYPTO_add(&bio->references,1,CRYPTO_LOCK_BIO) > 1)
+ logstream = bio;
+ else
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_CTRL,SUREWARE_R_BIO_WAS_FREED);
+ }
+ CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+ break;
+ /* This will prevent the initialisation function from "installing"
+ * the mutex-handling callbacks, even if they are available from
+ * within the library (or were provided to the library from the
+ * calling application). This is to remove any baggage for
+ * applications not using multithreading. */
+ case ENGINE_CTRL_CHIL_NO_LOCKING:
+ CRYPTO_w_lock(CRYPTO_LOCK_ENGINE);
+ threadsafe = 0;
+ CRYPTO_w_unlock(CRYPTO_LOCK_ENGINE);
+ break;
+
+ /* The command isn't understood by this engine */
+ default:
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_CTRL,
+ ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+ to_return = 0;
+ break;
+ }
+
+ return to_return;
+}
+
+/* Destructor (complements the "ENGINE_surewarehk()" constructor) */
+static int surewarehk_destroy(ENGINE *e)
+{
+ ERR_unload_SUREWARE_strings();
+ return 1;
+}
+
+/* (de)initialisation functions. */
+static int surewarehk_init(ENGINE *e)
+{
+ char msg[64]="ENGINE_init";
+ SureWareHook_Init_t *p1=NULL;
+ SureWareHook_Finish_t *p2=NULL;
+ SureWareHook_Rand_Bytes_t *p3=NULL;
+ SureWareHook_Rand_Seed_t *p4=NULL;
+ SureWareHook_Load_Privkey_t *p5=NULL;
+ SureWareHook_Load_Rsa_Pubkey_t *p6=NULL;
+ SureWareHook_Free_t *p7=NULL;
+ SureWareHook_Rsa_Priv_Dec_t *p8=NULL;
+ SureWareHook_Rsa_Sign_t *p9=NULL;
+ SureWareHook_Dsa_Sign_t *p12=NULL;
+ SureWareHook_Info_Pubkey_t *p13=NULL;
+ SureWareHook_Load_Dsa_Pubkey_t *p14=NULL;
+ SureWareHook_Mod_Exp_t *p15=NULL;
+
+ if(surewarehk_dso != NULL)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,ENGINE_R_ALREADY_LOADED);
+ goto err;
+ }
+ /* Attempt to load libsurewarehk.so/surewarehk.dll/whatever. */
+ surewarehk_dso = DSO_load(NULL, surewarehk_LIBNAME, NULL, 0);
+ if(surewarehk_dso == NULL)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,ENGINE_R_DSO_FAILURE);
+ goto err;
+ }
+ if(!(p1=(SureWareHook_Init_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Init)) ||
+ !(p2=(SureWareHook_Finish_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Finish)) ||
+ !(p3=(SureWareHook_Rand_Bytes_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rand_Bytes)) ||
+ !(p4=(SureWareHook_Rand_Seed_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rand_Seed)) ||
+ !(p5=(SureWareHook_Load_Privkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Privkey)) ||
+ !(p6=(SureWareHook_Load_Rsa_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Rsa_Pubkey)) ||
+ !(p7=(SureWareHook_Free_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Free)) ||
+ !(p8=(SureWareHook_Rsa_Priv_Dec_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rsa_Priv_Dec)) ||
+ !(p9=(SureWareHook_Rsa_Sign_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Rsa_Sign)) ||
+ !(p12=(SureWareHook_Dsa_Sign_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Dsa_Sign)) ||
+ !(p13=(SureWareHook_Info_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Info_Pubkey)) ||
+ !(p14=(SureWareHook_Load_Dsa_Pubkey_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Load_Dsa_Pubkey)) ||
+ !(p15=(SureWareHook_Mod_Exp_t*)DSO_bind_func(surewarehk_dso, n_surewarehk_Mod_Exp)))
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,ENGINE_R_DSO_FAILURE);
+ goto err;
+ }
+ /* Copy the pointers */
+ p_surewarehk_Init = p1;
+ p_surewarehk_Finish = p2;
+ p_surewarehk_Rand_Bytes = p3;
+ p_surewarehk_Rand_Seed = p4;
+ p_surewarehk_Load_Privkey = p5;
+ p_surewarehk_Load_Rsa_Pubkey = p6;
+ p_surewarehk_Free = p7;
+ p_surewarehk_Rsa_Priv_Dec = p8;
+ p_surewarehk_Rsa_Sign = p9;
+ p_surewarehk_Dsa_Sign = p12;
+ p_surewarehk_Info_Pubkey = p13;
+ p_surewarehk_Load_Dsa_Pubkey = p14;
+ p_surewarehk_Mod_Exp = p15;
+ /* Contact the hardware and initialises it. */
+ if(p_surewarehk_Init(msg,threadsafe)==SUREWAREHOOK_ERROR_UNIT_FAILURE)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,SUREWARE_R_UNIT_FAILURE);
+ goto err;
+ }
+ if(p_surewarehk_Init(msg,threadsafe)==SUREWAREHOOK_ERROR_UNIT_FAILURE)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_INIT,SUREWARE_R_UNIT_FAILURE);
+ goto err;
+ }
+ /* try to load the default private key, if failed does not return a failure but
+ wait for an explicit ENGINE_load_privakey */
+ surewarehk_load_privkey(e,NULL,NULL,NULL);
+
+ /* Everything's fine. */
+ if (rsaHndidx == -1)
+ rsaHndidx = RSA_get_ex_new_index(0,
+ "SureWareHook RSA key handle",
+ NULL, NULL, surewarehk_ex_free);
+ if (dsaHndidx == -1)
+ dsaHndidx = DSA_get_ex_new_index(0,
+ "SureWareHook DSA key handle",
+ NULL, NULL, surewarehk_ex_free);
+ return 1;
+err:
+ if(surewarehk_dso)
+ DSO_free(surewarehk_dso);
+ surewarehk_dso = NULL;
+ p_surewarehk_Init = NULL;
+ p_surewarehk_Finish = NULL;
+ p_surewarehk_Rand_Bytes = NULL;
+ p_surewarehk_Rand_Seed = NULL;
+ p_surewarehk_Load_Privkey = NULL;
+ p_surewarehk_Load_Rsa_Pubkey = NULL;
+ p_surewarehk_Free = NULL;
+ p_surewarehk_Rsa_Priv_Dec = NULL;
+ p_surewarehk_Rsa_Sign = NULL;
+ p_surewarehk_Dsa_Sign = NULL;
+ p_surewarehk_Info_Pubkey = NULL;
+ p_surewarehk_Load_Dsa_Pubkey = NULL;
+ p_surewarehk_Mod_Exp = NULL;
+ return 0;
+}
+
+static int surewarehk_finish(ENGINE *e)
+{
+ int to_return = 1;
+ if(surewarehk_dso == NULL)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_FINISH,ENGINE_R_NOT_LOADED);
+ to_return = 0;
+ goto err;
+ }
+ p_surewarehk_Finish();
+ if(!DSO_free(surewarehk_dso))
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_FINISH,ENGINE_R_DSO_FAILURE);
+ to_return = 0;
+ goto err;
+ }
+ err:
+ if (logstream)
+ BIO_free(logstream);
+ surewarehk_dso = NULL;
+ p_surewarehk_Init = NULL;
+ p_surewarehk_Finish = NULL;
+ p_surewarehk_Rand_Bytes = NULL;
+ p_surewarehk_Rand_Seed = NULL;
+ p_surewarehk_Load_Privkey = NULL;
+ p_surewarehk_Load_Rsa_Pubkey = NULL;
+ p_surewarehk_Free = NULL;
+ p_surewarehk_Rsa_Priv_Dec = NULL;
+ p_surewarehk_Rsa_Sign = NULL;
+ p_surewarehk_Dsa_Sign = NULL;
+ p_surewarehk_Info_Pubkey = NULL;
+ p_surewarehk_Load_Dsa_Pubkey = NULL;
+ p_surewarehk_Mod_Exp = NULL;
+ return to_return;
+}
+static void surewarehk_error_handling(char *const msg,int func,int ret)
+{
+ switch (ret)
+ {
+ case SUREWAREHOOK_ERROR_UNIT_FAILURE:
+ ENGINEerr(func,SUREWARE_R_UNIT_FAILURE);
+ break;
+ case SUREWAREHOOK_ERROR_FALLBACK:
+ ENGINEerr(func,SUREWARE_R_REQUEST_FALLBACK);
+ break;
+ case SUREWAREHOOK_ERROR_DATA_SIZE:
+ ENGINEerr(func,SUREWARE_R_SIZE_TOO_LARGE_OR_TOO_SMALL);
+ break;
+ case SUREWAREHOOK_ERROR_INVALID_PAD:
+ ENGINEerr(func,RSA_R_PADDING_CHECK_FAILED);
+ break;
+ default:
+ ENGINEerr(func,SUREWARE_R_REQUEST_FAILED);
+ break;
+ case 1:/*nothing*/
+ msg[0]='\0';
+ }
+ if (*msg)
+ {
+ ERR_add_error_data(1,msg);
+ if (logstream)
+ {
+ CRYPTO_w_lock(CRYPTO_LOCK_BIO);
+ BIO_write(logstream, msg, strlen(msg));
+ CRYPTO_w_unlock(CRYPTO_LOCK_BIO);
+ }
+ }
+}
+static int surewarehk_rand_bytes(unsigned char *buf, int num)
+{
+ int ret=0;
+ char msg[64]="ENGINE_rand_bytes";
+ if(!p_surewarehk_Rand_Bytes)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_RAND_BYTES,ENGINE_R_NOT_INITIALISED);
+ }
+ else
+ {
+ ret = p_surewarehk_Rand_Bytes(msg,buf, num);
+ surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RAND_BYTES,ret);
+ }
+ return ret==1 ? 1 : 0;
+}
+
+static void surewarehk_rand_seed(const void *buf, int num)
+{
+ int ret=0;
+ char msg[64]="ENGINE_rand_seed";
+ if(!p_surewarehk_Rand_Seed)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_RAND_SEED,ENGINE_R_NOT_INITIALISED);
+ }
+ else
+ {
+ ret = p_surewarehk_Rand_Seed(msg,buf, num);
+ surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RAND_SEED,ret);
+ }
+}
+static void surewarehk_rand_add(const void *buf, int num, double entropy)
+{
+ surewarehk_rand_seed(buf,num);
+}
+static EVP_PKEY* sureware_load_public(ENGINE *e,const char *key_id,char *hptr,unsigned long el,char keytype)
+{
+ EVP_PKEY *res = NULL;
+ RSA *rsatmp = NULL;
+ DSA *dsatmp=NULL;
+ char msg[64]="sureware_load_public";
+ int ret=0;
+ if(!p_surewarehk_Load_Rsa_Pubkey || !p_surewarehk_Load_Dsa_Pubkey)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ENGINE_R_NOT_INITIALISED);
+ goto err;
+ }
+ switch (keytype)
+ {
+ case 1: /*RSA*/
+ /* set private external reference */
+ rsatmp = RSA_new_method(e);
+ RSA_set_ex_data(rsatmp,rsaHndidx,hptr);
+ rsatmp->flags |= RSA_FLAG_EXT_PKEY;
+
+ /* set public big nums*/
+ rsatmp->e = BN_new();
+ rsatmp->n = BN_new();
+ bn_expand2(rsatmp->e, el/sizeof(BN_ULONG));
+ bn_expand2(rsatmp->n, el/sizeof(BN_ULONG));
+ if (!rsatmp->e || rsatmp->e->dmax!=(int)(el/sizeof(BN_ULONG))||
+ !rsatmp->n || rsatmp->n->dmax!=(int)(el/sizeof(BN_ULONG)))
+ goto err;
+ ret=p_surewarehk_Load_Rsa_Pubkey(msg,key_id,el,rsatmp->n->d, rsatmp->e->d);
+ surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ret);
+ if (ret!=1)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PUBLIC_KEY);
+ goto err;
+ }
+ /* normalise pub e and pub n */
+ rsatmp->e->top=el/sizeof(BN_ULONG);
+ bn_fix_top(rsatmp->e);
+ rsatmp->n->top=el/sizeof(BN_ULONG);
+ bn_fix_top(rsatmp->n);
+ /* create an EVP object: engine + rsa key */
+ res = EVP_PKEY_new();
+ EVP_PKEY_assign_RSA(res, rsatmp);
+ break;
+ case 2:/*DSA*/
+ /* set private/public external reference */
+ dsatmp = DSA_new_method(e);
+ DSA_set_ex_data(dsatmp,dsaHndidx,hptr);
+ /*dsatmp->flags |= DSA_FLAG_EXT_PKEY;*/
+
+ /* set public key*/
+ dsatmp->pub_key = BN_new();
+ dsatmp->p = BN_new();
+ dsatmp->q = BN_new();
+ dsatmp->g = BN_new();
+ bn_expand2(dsatmp->pub_key, el/sizeof(BN_ULONG));
+ bn_expand2(dsatmp->p, el/sizeof(BN_ULONG));
+ bn_expand2(dsatmp->q, 20/sizeof(BN_ULONG));
+ bn_expand2(dsatmp->g, el/sizeof(BN_ULONG));
+ if (!dsatmp->pub_key || dsatmp->pub_key->dmax!=(int)(el/sizeof(BN_ULONG))||
+ !dsatmp->p || dsatmp->p->dmax!=(int)(el/sizeof(BN_ULONG)) ||
+ !dsatmp->q || dsatmp->q->dmax!=20/sizeof(BN_ULONG) ||
+ !dsatmp->g || dsatmp->g->dmax!=(int)(el/sizeof(BN_ULONG)))
+ goto err;
+
+ ret=p_surewarehk_Load_Dsa_Pubkey(msg,key_id,el,
+ dsatmp->pub_key->d,
+ dsatmp->p->d,
+ dsatmp->q->d,
+ dsatmp->g->d);
+ surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ret);
+ if (ret!=1)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PUBLIC_KEY);
+ goto err;
+ }
+ /* set parameters */
+ /* normalise pubkey and parameters in case of */
+ dsatmp->pub_key->top=el/sizeof(BN_ULONG);
+ bn_fix_top(dsatmp->pub_key);
+ dsatmp->p->top=el/sizeof(BN_ULONG);
+ bn_fix_top(dsatmp->p);
+ dsatmp->q->top=20/sizeof(BN_ULONG);
+ bn_fix_top(dsatmp->q);
+ dsatmp->g->top=el/sizeof(BN_ULONG);
+ bn_fix_top(dsatmp->g);
+
+ /* create an EVP object: engine + rsa key */
+ res = EVP_PKEY_new();
+ EVP_PKEY_assign_DSA(res, dsatmp);
+ break;
+ default:
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PRIVATE_KEY);
+ goto err;
+ }
+ return res;
+ err:
+ if (res)
+ EVP_PKEY_free(res);
+ if (rsatmp)
+ RSA_free(rsatmp);
+ if (dsatmp)
+ DSA_free(dsatmp);
+ return NULL;
+}
+static EVP_PKEY *surewarehk_load_privkey(ENGINE *e, const char *key_id,
+ UI_METHOD *ui_method, void *callback_data)
+{
+ EVP_PKEY *res = NULL;
+ int ret=0;
+ unsigned long el=0;
+ char *hptr=NULL;
+ char keytype=0;
+ char msg[64]="ENGINE_load_privkey";
+
+ if(!p_surewarehk_Load_Privkey)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_NOT_INITIALISED);
+ }
+ else
+ {
+ ret=p_surewarehk_Load_Privkey(msg,key_id,&hptr,&el,&keytype);
+ if (ret!=1)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,ENGINE_R_FAILED_LOADING_PRIVATE_KEY);
+ ERR_add_error_data(1,msg);
+ }
+ else
+ res=sureware_load_public(e,key_id,hptr,el,keytype);
+ }
+ return res;
+}
+static EVP_PKEY *surewarehk_load_pubkey(ENGINE *e, const char *key_id,
+ UI_METHOD *ui_method, void *callback_data)
+{
+ EVP_PKEY *res = NULL;
+ int ret=0;
+ unsigned long el=0;
+ char *hptr=NULL;
+ char keytype=0;
+ char msg[64]="ENGINE_load_pubkey";
+
+ if(!p_surewarehk_Info_Pubkey)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ENGINE_R_NOT_INITIALISED);
+ }
+ else
+ {
+ /* call once to identify if DSA or RSA */
+ ret=p_surewarehk_Info_Pubkey(msg,key_id,&el,&keytype);
+ if (ret!=1)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,ENGINE_R_FAILED_LOADING_PUBLIC_KEY);
+ ERR_add_error_data(1,msg);
+ }
+ else
+ res=sureware_load_public(e,key_id,hptr,el,keytype);
+ }
+ return res;
+}
+
+/* This cleans up an RSA/DSA KM key(do not destroy the key into the hardware)
+, called when ex_data is freed */
+static void surewarehk_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+ int index,long argl, void *argp)
+{
+ if(!p_surewarehk_Free)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_EX_FREE,ENGINE_R_NOT_INITIALISED);
+ }
+ else
+ p_surewarehk_Free((char *)item,0);
+}
+/* This cleans up an DH KM key (destroys the key into hardware),
+called when ex_data is freed */
+static void surewarehk_dh_ex_free(void *obj, void *item, CRYPTO_EX_DATA *ad,
+ int index,long argl, void *argp)
+{
+ if(!p_surewarehk_Free)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_EX_FREE,ENGINE_R_NOT_INITIALISED);
+ }
+ else
+ p_surewarehk_Free((char *)item,1);
+}
+/*
+* return number of decrypted bytes
+*/
+static int surewarehk_rsa_priv_dec(int flen,const unsigned char *from,unsigned char *to,
+ RSA *rsa,int padding)
+{
+ int ret=0,tlen;
+ char *buf=NULL,*hptr=NULL;
+ char msg[64]="ENGINE_rsa_priv_dec";
+ if (!p_surewarehk_Rsa_Priv_Dec)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ENGINE_R_NOT_INITIALISED);
+ }
+ /* extract ref to private key */
+ else if (!(hptr=RSA_get_ex_data(rsa, rsaHndidx)))
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,SUREWARE_R_MISSING_KEY_COMPONENTS);
+ goto err;
+ }
+ /* analyse what padding we can do into the hardware */
+ if (padding==RSA_PKCS1_PADDING)
+ {
+ /* do it one shot */
+ ret=p_surewarehk_Rsa_Priv_Dec(msg,flen,(unsigned char *)from,&tlen,to,hptr,SUREWARE_PKCS1_PAD);
+ surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ret);
+ if (ret!=1)
+ goto err;
+ ret=tlen;
+ }
+ else /* do with no padding into hardware */
+ {
+ ret=p_surewarehk_Rsa_Priv_Dec(msg,flen,(unsigned char *)from,&tlen,to,hptr,SUREWARE_NO_PAD);
+ surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ret);
+ if (ret!=1)
+ goto err;
+ /* intermediate buffer for padding */
+ if ((buf=OPENSSL_malloc(tlen)) == NULL)
+ {
+ RSAerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+ memcpy(buf,to,tlen);/* transfert to into buf */
+ switch (padding) /* check padding in software */
+ {
+#ifndef NO_SHA
+ case RSA_PKCS1_OAEP_PADDING:
+ ret=RSA_padding_check_PKCS1_OAEP(to,tlen,(unsigned char *)buf,tlen,tlen,NULL,0);
+ break;
+#endif
+ case RSA_SSLV23_PADDING:
+ ret=RSA_padding_check_SSLv23(to,tlen,(unsigned char *)buf,flen,tlen);
+ break;
+ case RSA_NO_PADDING:
+ ret=RSA_padding_check_none(to,tlen,(unsigned char *)buf,flen,tlen);
+ break;
+ default:
+ RSAerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,RSA_R_UNKNOWN_PADDING_TYPE);
+ goto err;
+ }
+ if (ret < 0)
+ RSAerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,RSA_R_PADDING_CHECK_FAILED);
+ }
+err:
+ if (buf)
+ {
+ memset(buf,0,tlen);
+ OPENSSL_free(buf);
+ }
+ return ret;
+}
+/*
+* Does what OpenSSL rsa_priv_enc does.
+*/
+static int surewarehk_rsa_sign(int flen,const unsigned char *from,unsigned char *to,
+ RSA *rsa,int padding)
+{
+ int ret=0,tlen;
+ char *hptr=NULL;
+ char msg[64]="ENGINE_rsa_sign";
+ if (!p_surewarehk_Rsa_Sign)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC,ENGINE_R_NOT_INITIALISED);
+ }
+ /* extract ref to private key */
+ else if (!(hptr=RSA_get_ex_data(rsa, rsaHndidx)))
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC,SUREWARE_R_MISSING_KEY_COMPONENTS);
+ }
+ else
+ {
+ switch (padding)
+ {
+ case RSA_PKCS1_PADDING: /* do it in one shot */
+ ret=p_surewarehk_Rsa_Sign(msg,flen,(unsigned char *)from,&tlen,to,hptr,SUREWARE_PKCS1_PAD);
+ surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC,ret);
+ break;
+ case RSA_NO_PADDING:
+ default:
+ RSAerr(SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC,RSA_R_UNKNOWN_PADDING_TYPE);
+ }
+ }
+ return ret==1 ? tlen : ret;
+}
+/* DSA sign and verify */
+static DSA_SIG * surewarehk_dsa_do_sign(const unsigned char *from, int flen, DSA *dsa)
+{
+ int ret=0;
+ char *hptr=NULL;
+ DSA_SIG *psign=NULL;
+ char msg[64]="ENGINE_dsa_do_sign";
+ if (!p_surewarehk_Dsa_Sign)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,ENGINE_R_NOT_INITIALISED);
+ }
+ /* extract ref to private key */
+ else if (!(hptr=DSA_get_ex_data(dsa, dsaHndidx)))
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,SUREWARE_R_MISSING_KEY_COMPONENTS);
+ }
+ else
+ {
+ if((psign = DSA_SIG_new()) == NULL)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+ psign->r=BN_new();
+ psign->s=BN_new();
+ bn_expand2(psign->r, 20/sizeof(BN_ULONG));
+ bn_expand2(psign->s, 20/sizeof(BN_ULONG));
+ if (!psign->r || psign->r->dmax!=20/sizeof(BN_ULONG) ||
+ !psign->s || psign->s->dmax!=20/sizeof(BN_ULONG))
+ goto err;
+ ret=p_surewarehk_Dsa_Sign(msg,flen,from,psign->r->d,psign->s->d,hptr);
+ surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,ret);
+ }
+ psign->r->top=20/sizeof(BN_ULONG);
+ bn_fix_top(psign->r);
+ psign->s->top=20/sizeof(BN_ULONG);
+ bn_fix_top(psign->s);
+
+err:
+ if (psign)
+ {
+ DSA_SIG_free(psign);
+ psign=NULL;
+ }
+ return psign;
+}
+static int surewarehk_modexp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+ const BIGNUM *m, BN_CTX *ctx)
+{
+ int ret=0;
+ char msg[64]="ENGINE_modexp";
+ if (!p_surewarehk_Mod_Exp)
+ {
+ SUREWAREerr(SUREWARE_F_SUREWAREHK_MOD_EXP,ENGINE_R_NOT_INITIALISED);
+ }
+ else
+ {
+ bn_expand2(r,m->top);
+ if (r && r->dmax==m->top)
+ {
+ /* do it*/
+ ret=p_surewarehk_Mod_Exp(msg,m->top*sizeof(BN_ULONG),m->d,p->top*sizeof(BN_ULONG),
+ p->d,a->top*sizeof(BN_ULONG),a->d,r->d);
+ surewarehk_error_handling(msg,SUREWARE_F_SUREWAREHK_MOD_EXP,ret);
+ if (ret==1)
+ {
+ /* normalise result */
+ r->top=m->top;
+ bn_fix_top(r);
+ }
+ }
+ }
+ return ret;
+}
+#endif /* !NO_HW_SureWare */
+#endif /* !NO_HW */
--- /dev/null
+/* hw_sureware_err.c */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ * software must display the following acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ * endorse or promote products derived from this software without
+ * prior written permission. For written permission, please contact
+ * openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ * nor may "OpenSSL" appear in their names without prior written
+ * permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ * acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com). This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* NOTE: this file was auto generated by the mkerr.pl script: any changes
+ * made to it will be overwritten when the script next updates this file,
+ * only reason strings will be preserved.
+ */
+
+#include <stdio.h>
+#include <openssl/err.h>
+#include "hw_sureware_err.h"
+
+/* BEGIN ERROR CODES */
+#ifndef OPENSSL_NO_ERR
+static ERR_STRING_DATA SUREWARE_str_functs[]=
+ {
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_CTRL,0), "SUREWAREHK_CTRL"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_DSA_DO_SIGN,0), "SUREWAREHK_DSA_DO_SIGN"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_EX_FREE,0), "SUREWAREHK_EX_FREE"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_FINISH,0), "SUREWAREHK_FINISH"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_INIT,0), "SUREWAREHK_INIT"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY,0), "SUREWAREHK_LOAD_PRIVATE_KEY"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY,0), "SUREWAREHK_LOAD_PUBLIC_KEY"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_MOD_EXP,0), "SUREWAREHK_MOD_EXP"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_RAND_BYTES,0), "SUREWAREHK_RAND_BYTES"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_RAND_SEED,0), "SUREWAREHK_RAND_SEED"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC,0), "SUREWAREHK_RSA_PRIV_DEC"},
+{ERR_PACK(0,SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC,0), "SUREWAREHK_RSA_PRIV_ENC"},
+{0,NULL}
+ };
+
+static ERR_STRING_DATA SUREWARE_str_reasons[]=
+ {
+{SUREWARE_R_BIO_WAS_FREED ,"bio was freed"},
+{SUREWARE_R_MISSING_KEY_COMPONENTS ,"missing key components"},
+{SUREWARE_R_REQUEST_FAILED ,"request failed"},
+{SUREWARE_R_REQUEST_FALLBACK ,"request fallback"},
+{SUREWARE_R_SIZE_TOO_LARGE_OR_TOO_SMALL ,"size too large or too small"},
+{SUREWARE_R_UNIT_FAILURE ,"unit failure"},
+{0,NULL}
+ };
+
+#endif
+
+#ifdef SUREWARE_LIB_NAME
+static ERR_STRING_DATA SUREWARE_lib_name[]=
+ {
+{0 ,SUREWARE_LIB_NAME},
+{0,NULL}
+ };
+#endif
+
+
+static int SUREWARE_lib_error_code=0;
+static int SUREWARE_error_init=1;
+
+static void ERR_load_SUREWARE_strings(void)
+ {
+ if (SUREWARE_lib_error_code == 0)
+ SUREWARE_lib_error_code=ERR_get_next_error_library();
+
+ if (SUREWARE_error_init)
+ {
+ SUREWARE_error_init=0;
+#ifndef OPENSSL_NO_ERR
+ ERR_load_strings(SUREWARE_lib_error_code,SUREWARE_str_functs);
+ ERR_load_strings(SUREWARE_lib_error_code,SUREWARE_str_reasons);
+#endif
+
+#ifdef SUREWARE_LIB_NAME
+ SUREWARE_lib_name->error = ERR_PACK(SUREWARE_lib_error_code,0,0);
+ ERR_load_strings(0,SUREWARE_lib_name);
+#endif
+ }
+ }
+
+static void ERR_unload_SUREWARE_strings(void)
+ {
+ if (SUREWARE_error_init == 0)
+ {
+#ifndef OPENSSL_NO_ERR
+ ERR_unload_strings(SUREWARE_lib_error_code,SUREWARE_str_functs);
+ ERR_unload_strings(SUREWARE_lib_error_code,SUREWARE_str_reasons);
+#endif
+
+#ifdef SUREWARE_LIB_NAME
+ ERR_unload_strings(0,SUREWARE_lib_name);
+#endif
+ SUREWARE_error_init=1;
+ }
+ }
+
+static void ERR_SUREWARE_error(int function, int reason, char *file, int line)
+ {
+ if (SUREWARE_lib_error_code == 0)
+ SUREWARE_lib_error_code=ERR_get_next_error_library();
+ ERR_PUT_error(SUREWARE_lib_error_code,function,reason,file,line);
+ }
--- /dev/null
+/* ====================================================================
+ * Copyright (c) 2001 The OpenSSL Project. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ * software must display the following acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit. (http://www.openssl.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ * endorse or promote products derived from this software without
+ * prior written permission. For written permission, please contact
+ * openssl-core@openssl.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ * nor may "OpenSSL" appear in their names without prior written
+ * permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ * acknowledgment:
+ * "This product includes software developed by the OpenSSL Project
+ * for use in the OpenSSL Toolkit (http://www.openssl.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com). This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#ifndef HEADER_SUREWARE_ERR_H
+#define HEADER_SUREWARE_ERR_H
+
+/* BEGIN ERROR CODES */
+/* The following lines are auto generated by the script mkerr.pl. Any changes
+ * made after this point may be overwritten when the script is next run.
+ */
+static void ERR_load_SUREWARE_strings(void);
+static void ERR_unload_SUREWARE_strings(void);
+static void ERR_SUREWARE_error(int function, int reason, char *file, int line);
+#define SUREWAREerr(f,r) ERR_SUREWARE_error((f),(r),__FILE__,__LINE__)
+
+/* Error codes for the SUREWARE functions. */
+
+/* Function codes. */
+#define SUREWARE_F_SUREWAREHK_CTRL 100
+#define SUREWARE_F_SUREWAREHK_DSA_DO_SIGN 101
+#define SUREWARE_F_SUREWAREHK_EX_FREE 102
+#define SUREWARE_F_SUREWAREHK_FINISH 103
+#define SUREWARE_F_SUREWAREHK_INIT 104
+#define SUREWARE_F_SUREWAREHK_LOAD_PRIVATE_KEY 105
+#define SUREWARE_F_SUREWAREHK_LOAD_PUBLIC_KEY 106
+#define SUREWARE_F_SUREWAREHK_MOD_EXP 107
+#define SUREWARE_F_SUREWAREHK_RAND_BYTES 108
+#define SUREWARE_F_SUREWAREHK_RAND_SEED 109
+#define SUREWARE_F_SUREWAREHK_RSA_PRIV_DEC 110
+#define SUREWARE_F_SUREWAREHK_RSA_PRIV_ENC 111
+
+/* Reason codes. */
+#define SUREWARE_R_BIO_WAS_FREED 100
+#define SUREWARE_R_MISSING_KEY_COMPONENTS 105
+#define SUREWARE_R_REQUEST_FAILED 101
+#define SUREWARE_R_REQUEST_FALLBACK 102
+#define SUREWARE_R_SIZE_TOO_LARGE_OR_TOO_SMALL 103
+#define SUREWARE_R_UNIT_FAILURE 104
+
+#ifdef __cplusplus
+}
+#endif
+#endif
projects / oweals / openssl.git / commitdiff