svn merge ^/branches/released .

4 files changed, 4558 insertions, 4488 deletions

diff --git a/openssl/engines/e_capi.c b/openssl/engines/e_capi.c
index 5871491fd..5c1fbeff3 100644
--- a/openssl/engines/e_capi.c
+++ b/openssl/engines/e_capi.c
@@ -1,1822 +1,1824 @@
-/* engines/e_capi.c */
-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
- * project.
- */
-/* ====================================================================
- * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- */
-
-
-#include <stdio.h>
-#include <string.h>
-#include <openssl/crypto.h>
-#include <openssl/buffer.h>
-#include <openssl/bn.h>
-
-#ifdef OPENSSL_SYS_WIN32
-#ifndef OPENSSL_NO_CAPIENG
-
-#include <openssl/rsa.h>
-
-#include <windows.h>
-
-#ifndef _WIN32_WINNT
-#define _WIN32_WINNT 0x0400
-#endif
-
-#include <wincrypt.h>
-
-/*
- * This module uses several "new" interfaces, among which is
- * CertGetCertificateContextProperty. CERT_KEY_PROV_INFO_PROP_ID is
- * one of possible values you can pass to function in question. By
- * checking if it's defined we can see if wincrypt.h and accompanying
- * crypt32.lib are in shape. The native MingW32 headers up to and
- * including __W32API_VERSION 3.14 lack of struct DSSPUBKEY and the
- * defines CERT_STORE_PROV_SYSTEM_A and CERT_STORE_READONLY_FLAG,
- * so we check for these too and avoid compiling.
- * Yes, it's rather "weak" test and if compilation fails,
- * then re-configure with -DOPENSSL_NO_CAPIENG.
- */
-#if defined(CERT_KEY_PROV_INFO_PROP_ID) && \
-    defined(CERT_STORE_PROV_SYSTEM_A) && \
-    defined(CERT_STORE_READONLY_FLAG)
-# define __COMPILE_CAPIENG
-#endif /* CERT_KEY_PROV_INFO_PROP_ID */
-#endif /* OPENSSL_NO_CAPIENG */
-#endif /* OPENSSL_SYS_WIN32 */
-
-#ifdef __COMPILE_CAPIENG
-
-#undef X509_EXTENSIONS
-#undef X509_CERT_PAIR
-
-/* Definitions which may be missing from earlier version of headers */
-#ifndef CERT_STORE_OPEN_EXISTING_FLAG
-#define CERT_STORE_OPEN_EXISTING_FLAG                   0x00004000
-#endif
-
-#ifndef CERT_STORE_CREATE_NEW_FLAG
-#define CERT_STORE_CREATE_NEW_FLAG                      0x00002000
-#endif
-
-#ifndef CERT_SYSTEM_STORE_CURRENT_USER
-#define CERT_SYSTEM_STORE_CURRENT_USER			0x00010000
-#endif 
-
-#include <openssl/engine.h>
-#include <openssl/pem.h>
-#include <openssl/x509v3.h>
-
-#include "e_capi_err.h"
-#include "e_capi_err.c"
-
-
-static const char *engine_capi_id = "capi";
-static const char *engine_capi_name = "CryptoAPI ENGINE";
-
-typedef struct CAPI_CTX_st CAPI_CTX;
-typedef struct CAPI_KEY_st CAPI_KEY;
-
-static void capi_addlasterror(void);
-static void capi_adderror(DWORD err);
-
-static void CAPI_trace(CAPI_CTX *ctx, char *format, ...);
-
-static int capi_list_providers(CAPI_CTX *ctx, BIO *out);
-static int capi_list_containers(CAPI_CTX *ctx, BIO *out);
-int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *storename);
-void capi_free_key(CAPI_KEY *key);
-
-static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore);
-
-CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id);
-
-static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
-	UI_METHOD *ui_method, void *callback_data);
-static int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
-             unsigned char *sigret, unsigned int *siglen, const RSA *rsa);
-static int capi_rsa_priv_enc(int flen, const unsigned char *from,
-                unsigned char *to, RSA *rsa, int padding);
-static int capi_rsa_priv_dec(int flen, const unsigned char *from,
-                unsigned char *to, RSA *rsa, int padding);
-static int capi_rsa_free(RSA *rsa);
-
-static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
-							DSA *dsa);
-static int capi_dsa_free(DSA *dsa);
-
-static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,
-	STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
-	STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data);
-
-static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);
-#ifdef OPENSSL_CAPIENG_DIALOG
-static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);
-#endif
-
-typedef PCCERT_CONTEXT (WINAPI *CERTDLG)(HCERTSTORE, HWND, LPCWSTR,
-						LPCWSTR, DWORD, DWORD,
-						void *);
-typedef HWND (WINAPI *GETCONSWIN)(void);
-
-/* This structure contains CAPI ENGINE specific data:
- * it contains various global options and affects how
- * other functions behave.
- */
-
-#define CAPI_DBG_TRACE	2
-#define CAPI_DBG_ERROR	1
-
-struct CAPI_CTX_st {
-	int debug_level;
-	char *debug_file;
-	/* Parameters to use for container lookup */
-	DWORD keytype;
-	LPSTR cspname;
-	DWORD csptype;
-	/* Certificate store name to use */
-	LPSTR storename;
-	LPSTR ssl_client_store;
-	/* System store flags */
-	DWORD store_flags;
-
-/* Lookup string meanings in load_private_key */
-/* Substring of subject: uses "storename" */
-#define CAPI_LU_SUBSTR		1
-/* Friendly name: uses storename */
-#define CAPI_LU_FNAME		2
-/* Container name: uses cspname, keytype */
-#define CAPI_LU_CONTNAME	3
-	int lookup_method;
-/* Info to dump with dumpcerts option */
-/* Issuer and serial name strings */
-#define CAPI_DMP_SUMMARY	0x1
-/* Friendly name */
-#define CAPI_DMP_FNAME		0x2
-/* Full X509_print dump */
-#define CAPI_DMP_FULL		0x4
-/* Dump PEM format certificate */
-#define CAPI_DMP_PEM		0x8
-/* Dump pseudo key (if possible) */
-#define CAPI_DMP_PSKEY		0x10
-/* Dump key info (if possible) */
-#define CAPI_DMP_PKEYINFO	0x20
-
-	DWORD dump_flags;
-	int (*client_cert_select)(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);
-
-	CERTDLG certselectdlg;
-	GETCONSWIN getconswindow;
-};
-
-
-static CAPI_CTX *capi_ctx_new();
-static void capi_ctx_free(CAPI_CTX *ctx);
-static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check);
-static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx);
-
-#define CAPI_CMD_LIST_CERTS		ENGINE_CMD_BASE
-#define CAPI_CMD_LOOKUP_CERT		(ENGINE_CMD_BASE + 1)
-#define CAPI_CMD_DEBUG_LEVEL		(ENGINE_CMD_BASE + 2)
-#define CAPI_CMD_DEBUG_FILE		(ENGINE_CMD_BASE + 3)
-#define CAPI_CMD_KEYTYPE		(ENGINE_CMD_BASE + 4)
-#define CAPI_CMD_LIST_CSPS		(ENGINE_CMD_BASE + 5)
-#define CAPI_CMD_SET_CSP_IDX		(ENGINE_CMD_BASE + 6)
-#define CAPI_CMD_SET_CSP_NAME		(ENGINE_CMD_BASE + 7)
-#define CAPI_CMD_SET_CSP_TYPE		(ENGINE_CMD_BASE + 8)
-#define CAPI_CMD_LIST_CONTAINERS	(ENGINE_CMD_BASE + 9)
-#define CAPI_CMD_LIST_OPTIONS		(ENGINE_CMD_BASE + 10)
-#define CAPI_CMD_LOOKUP_METHOD		(ENGINE_CMD_BASE + 11)
-#define CAPI_CMD_STORE_NAME		(ENGINE_CMD_BASE + 12)
-#define CAPI_CMD_STORE_FLAGS		(ENGINE_CMD_BASE + 13)
-
-static const ENGINE_CMD_DEFN capi_cmd_defns[] = {
-	{CAPI_CMD_LIST_CERTS,
-		"list_certs",
-		"List all certificates in store",
-		ENGINE_CMD_FLAG_NO_INPUT},
-	{CAPI_CMD_LOOKUP_CERT,
-		"lookup_cert",
-		"Lookup and output certificates",
-		ENGINE_CMD_FLAG_STRING},
-	{CAPI_CMD_DEBUG_LEVEL,
-		"debug_level",
-		"debug level (1=errors, 2=trace)",
-		ENGINE_CMD_FLAG_NUMERIC},
-	{CAPI_CMD_DEBUG_FILE,
-		"debug_file",
-		"debugging filename)",
-		ENGINE_CMD_FLAG_STRING},
-	{CAPI_CMD_KEYTYPE,
-		"key_type",
-		"Key type: 1=AT_KEYEXCHANGE (default), 2=AT_SIGNATURE",
-		ENGINE_CMD_FLAG_NUMERIC},
-	{CAPI_CMD_LIST_CSPS,
-		"list_csps",
-		"List all CSPs",
-		ENGINE_CMD_FLAG_NO_INPUT},
-	{CAPI_CMD_SET_CSP_IDX,
-		"csp_idx",
-		"Set CSP by index",
-		ENGINE_CMD_FLAG_NUMERIC},
-	{CAPI_CMD_SET_CSP_NAME,
-		"csp_name",
-		"Set CSP name, (default CSP used if not specified)",
-		ENGINE_CMD_FLAG_STRING},
-	{CAPI_CMD_SET_CSP_TYPE,
-		"csp_type",
-		"Set CSP type, (default RSA_PROV_FULL)",
-		ENGINE_CMD_FLAG_NUMERIC},
-	{CAPI_CMD_LIST_CONTAINERS,
-		"list_containers",
-		"list container names",
-		ENGINE_CMD_FLAG_NO_INPUT},
-	{CAPI_CMD_LIST_OPTIONS,
-		"list_options",
-		"Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, "
-		"32=private key info)",
-		ENGINE_CMD_FLAG_NUMERIC},
-	{CAPI_CMD_LOOKUP_METHOD,
-		"lookup_method",
-		"Set key lookup method (1=substring, 2=friendlyname, 3=container name)",
-		ENGINE_CMD_FLAG_NUMERIC},
-	{CAPI_CMD_STORE_NAME,
-		"store_name",
-		"certificate store name, default \"MY\"",
-		ENGINE_CMD_FLAG_STRING},
-	{CAPI_CMD_STORE_FLAGS,
-		"store_flags",
-		"Certificate store flags: 1 = system store",
-		ENGINE_CMD_FLAG_NUMERIC},
-
-	{0, NULL, NULL, 0}
-	};
-
-static int capi_idx = -1;
-static int rsa_capi_idx = -1;
-static int dsa_capi_idx = -1;
-static int cert_capi_idx = -1;
-
-static int capi_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
-	{
-	int ret = 1;
-	CAPI_CTX *ctx;
-	BIO *out;
-	if (capi_idx == -1)
-		{
-		CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_ENGINE_NOT_INITIALIZED);
-		return 0;
-		}
-	ctx = ENGINE_get_ex_data(e, capi_idx);
-	out = BIO_new_fp(stdout, BIO_NOCLOSE);
-	switch (cmd)
-		{
-		case CAPI_CMD_LIST_CSPS:
-		ret = capi_list_providers(ctx, out);
-		break;
-
-		case CAPI_CMD_LIST_CERTS:
-		ret = capi_list_certs(ctx, out, NULL);
-		break;
-
-		case CAPI_CMD_LOOKUP_CERT:
-		ret = capi_list_certs(ctx, out, p);
-		break;
-
-		case CAPI_CMD_LIST_CONTAINERS:
-		ret = capi_list_containers(ctx, out);
-		break;
-
-		case CAPI_CMD_STORE_NAME:
-		if (ctx->storename)
-			OPENSSL_free(ctx->storename);
-		ctx->storename = BUF_strdup(p);
-		CAPI_trace(ctx, "Setting store name to %s\n", p);
-		break;
-
-		case CAPI_CMD_STORE_FLAGS:
-		if (i & 1)
-			{
-			ctx->store_flags |= CERT_SYSTEM_STORE_LOCAL_MACHINE;
-			ctx->store_flags &= ~CERT_SYSTEM_STORE_CURRENT_USER;
-			}
-		else
-			{
-			ctx->store_flags |= CERT_SYSTEM_STORE_CURRENT_USER;
-			ctx->store_flags &= ~CERT_SYSTEM_STORE_LOCAL_MACHINE;
-			}
-		CAPI_trace(ctx, "Setting flags to %d\n", i);
-		break;
-
-		case CAPI_CMD_DEBUG_LEVEL:
-		ctx->debug_level = (int)i;
-		CAPI_trace(ctx, "Setting debug level to %d\n", ctx->debug_level);
-		break;
-
-		case CAPI_CMD_DEBUG_FILE:
-		ctx->debug_file = BUF_strdup(p);
-		CAPI_trace(ctx, "Setting debug file to %s\n", ctx->debug_file);
-		break;
-
-		case CAPI_CMD_KEYTYPE:
-		ctx->keytype = i;
-		CAPI_trace(ctx, "Setting key type to %d\n", ctx->keytype);
-		break;
-
-		case CAPI_CMD_SET_CSP_IDX:
-		ret = capi_ctx_set_provname_idx(ctx, i);
-		break;
-
-		case CAPI_CMD_LIST_OPTIONS:
-		ctx->dump_flags = i;
-		break;
-
-		case CAPI_CMD_LOOKUP_METHOD:
-		if (i < 1 || i > 3)
-			{
-			CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_INVALID_LOOKUP_METHOD);
-			return 0;
-			}
-		ctx->lookup_method = i;
-		break;
-
-		case CAPI_CMD_SET_CSP_NAME:
-		ret = capi_ctx_set_provname(ctx, p, ctx->csptype, 1);
-		break;
-
-		case CAPI_CMD_SET_CSP_TYPE:
-		ctx->csptype = i;
-		break;
-
-		default:
-		CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_UNKNOWN_COMMAND);
-		ret = 0;
-	}
-
-	BIO_free(out);
-	return ret;
-
-	}
-
-static RSA_METHOD capi_rsa_method =
-	{
-	"CryptoAPI RSA method",
-	0,				/* pub_enc */
-	0,				/* pub_dec */
-	capi_rsa_priv_enc,		/* priv_enc */
-	capi_rsa_priv_dec,		/* priv_dec */
-	0,				/* rsa_mod_exp */
-	0,				/* bn_mod_exp */
-	0,				/* init	*/
-	capi_rsa_free,			/* finish */
-	RSA_FLAG_SIGN_VER, 		/* flags */
-	NULL,				/* app_data */
-	capi_rsa_sign,			/* rsa_sign */
-	0				/* rsa_verify */
-	};
-
-static DSA_METHOD capi_dsa_method =
-	{
-	"CryptoAPI DSA method",
-	capi_dsa_do_sign,		/* dsa_do_sign */
-	0,				/* dsa_sign_setup */
-	0,				/* dsa_do_verify */
-	0,				/* dsa_mod_exp */
-	0,				/* bn_mod_exp */
-	0,				/* init	*/
-	capi_dsa_free,			/* finish */
-	0, 				/* flags */
-	NULL,				/* app_data */
-	0,				/* dsa_paramgen */
-	0				/* dsa_keygen */
-	};
-
-static int capi_init(ENGINE *e)
-	{
-	CAPI_CTX *ctx;
-	const RSA_METHOD *ossl_rsa_meth;
-	const DSA_METHOD *ossl_dsa_meth;
-	capi_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, 0);
-	cert_capi_idx = X509_get_ex_new_index(0, NULL, NULL, NULL, 0);
-
-	ctx = capi_ctx_new();
-	if (!ctx || (capi_idx < 0))
-		goto memerr;
-
-	ENGINE_set_ex_data(e, capi_idx, ctx);
-	/* Setup RSA_METHOD */
-	rsa_capi_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
-	ossl_rsa_meth = RSA_PKCS1_SSLeay();
-	capi_rsa_method.rsa_pub_enc = ossl_rsa_meth->rsa_pub_enc;
-	capi_rsa_method.rsa_pub_dec = ossl_rsa_meth->rsa_pub_dec;
-	capi_rsa_method.rsa_mod_exp = ossl_rsa_meth->rsa_mod_exp;
-	capi_rsa_method.bn_mod_exp = ossl_rsa_meth->bn_mod_exp;
-
-	/* Setup DSA Method */
-	dsa_capi_idx = DSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
-	ossl_dsa_meth = DSA_OpenSSL();
-	capi_dsa_method.dsa_do_verify = ossl_dsa_meth->dsa_do_verify;
-	capi_dsa_method.dsa_mod_exp = ossl_dsa_meth->dsa_mod_exp;
-	capi_dsa_method.bn_mod_exp = ossl_dsa_meth->bn_mod_exp;
-
-#ifdef OPENSSL_CAPIENG_DIALOG
-	{
-	HMODULE cryptui = LoadLibrary(TEXT("CRYPTUI.DLL"));
-	HMODULE kernel = GetModuleHandle(TEXT("KERNEL32.DLL"));
-	if (cryptui)
-		ctx->certselectdlg = (CERTDLG)GetProcAddress(cryptui, "CryptUIDlgSelectCertificateFromStore");
-	if (kernel)
-		ctx->getconswindow = (GETCONSWIN)GetProcAddress(kernel, "GetConsoleWindow");
-	if (cryptui && !OPENSSL_isservice())
-		ctx->client_cert_select = cert_select_dialog;
-	}
-#endif
-		
-
-	return 1;
-
-	memerr:
-	CAPIerr(CAPI_F_CAPI_INIT, ERR_R_MALLOC_FAILURE);
-	return 0;
-
-	return 1;
-	}
-
-static int capi_destroy(ENGINE *e)
-	{
-	ERR_unload_CAPI_strings();
-	return 1;
-	}
-
-static int capi_finish(ENGINE *e)
-	{
-	CAPI_CTX *ctx;
-	ctx = ENGINE_get_ex_data(e, capi_idx);
-	capi_ctx_free(ctx);
-	ENGINE_set_ex_data(e, capi_idx, NULL);
-	return 1;
-	}
-
-
-/* CryptoAPI key application data. This contains
- * a handle to the private key container (for sign operations)
- * and a handle to the key (for decrypt operations).
- */
-
-struct CAPI_KEY_st
-	{
-	/* Associated certificate context (if any) */
-	PCCERT_CONTEXT pcert;
-	HCRYPTPROV hprov;
-	HCRYPTKEY key;
-	DWORD keyspec;
-	};
-
-static int bind_capi(ENGINE *e)
-	{
-	if (!ENGINE_set_id(e, engine_capi_id)
-		|| !ENGINE_set_name(e, engine_capi_name)
-		|| !ENGINE_set_init_function(e, capi_init)
-		|| !ENGINE_set_finish_function(e, capi_finish)
-		|| !ENGINE_set_destroy_function(e, capi_destroy)
-		|| !ENGINE_set_RSA(e, &capi_rsa_method)
-		|| !ENGINE_set_DSA(e, &capi_dsa_method)
-		|| !ENGINE_set_load_privkey_function(e, capi_load_privkey)
-		|| !ENGINE_set_load_ssl_client_cert_function(e,
-						capi_load_ssl_client_cert)
-		|| !ENGINE_set_cmd_defns(e, capi_cmd_defns)
-		|| !ENGINE_set_ctrl_function(e, capi_ctrl))
-			return 0;
-	ERR_load_CAPI_strings();
-
-	return 1;
-
-	}
-
-#ifndef OPENSSL_NO_DYNAMIC_ENGINE
-static int bind_helper(ENGINE *e, const char *id)
-	{
-	if(id && (strcmp(id, engine_capi_id) != 0))
-		return 0;
-	if(!bind_capi(e))
-		return 0;
-	return 1;
-	}       
-IMPLEMENT_DYNAMIC_CHECK_FN()
-IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
-#else
-static ENGINE *engine_capi(void)
-	{
-	ENGINE *ret = ENGINE_new();
-	if(!ret)
-		return NULL;
-	if(!bind_capi(ret))
-		{
-		ENGINE_free(ret);
-		return NULL;
-		}
-	return ret;
-	}
-
-void ENGINE_load_capi(void)
-	{
-	/* Copied from eng_[openssl|dyn].c */
-	ENGINE *toadd = engine_capi();
-	if(!toadd) return;
-	ENGINE_add(toadd);
-	ENGINE_free(toadd);
-	ERR_clear_error();
-	}
-#endif
-
-
-static int lend_tobn(BIGNUM *bn, unsigned char *bin, int binlen)
-	{
-	int i;
-	/* Reverse buffer in place: since this is a keyblob structure
-	 * that will be freed up after conversion anyway it doesn't 
-	 * matter if we change it.
-	 */
-	for(i = 0; i < binlen / 2; i++)
-		{
-		unsigned char c;
-		c = bin[i];
-		bin[i] = bin[binlen - i - 1];
-		bin[binlen - i - 1] = c;
-		}
-
-	if (!BN_bin2bn(bin, binlen, bn))
-		return 0;
-	return 1;
-	}
-
-/* Given a CAPI_KEY get an EVP_PKEY structure */
-
-static EVP_PKEY *capi_get_pkey(ENGINE *eng, CAPI_KEY *key)
-	{
-	unsigned char *pubkey = NULL;
-	DWORD len;
-	BLOBHEADER *bh;
-	RSA *rkey = NULL;
-	DSA *dkey = NULL;
-	EVP_PKEY *ret = NULL;
-	if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, NULL, &len))
-		{
-		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR);
-		capi_addlasterror();
-		return NULL;
-		}
-
-	pubkey = OPENSSL_malloc(len);
-
-	if (!pubkey)
-		goto memerr;
-
-	if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, pubkey, &len))
-		{
-		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_ERROR);
-		capi_addlasterror();
-		goto err;
-		}
-
-	bh = (BLOBHEADER *)pubkey;
-	if (bh->bType != PUBLICKEYBLOB)
-		{
-		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_PUBLIC_KEY_BLOB);
-		goto err;
-		}
-	if (bh->aiKeyAlg == CALG_RSA_SIGN || bh->aiKeyAlg == CALG_RSA_KEYX)
-		{
-		RSAPUBKEY *rp;
-		DWORD rsa_modlen;
-		unsigned char *rsa_modulus;
-		rp = (RSAPUBKEY *)(bh + 1);
-		if (rp->magic != 0x31415352)
-			{
-			char magstr[10];
-			BIO_snprintf(magstr, 10, "%lx", rp->magic);
-			CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
-			ERR_add_error_data(2, "magic=0x", magstr);
-			goto err;
-			}
-		rsa_modulus = (unsigned char *)(rp + 1);
-		rkey = RSA_new_method(eng);
-		if (!rkey)
-			goto memerr;
-
-		rkey->e = BN_new();
-		rkey->n = BN_new();
-
-		if (!rkey->e || !rkey->n)
-			goto memerr;
-
-		if (!BN_set_word(rkey->e, rp->pubexp))
-			goto memerr;
-
-		rsa_modlen = rp->bitlen / 8;
-		if (!lend_tobn(rkey->n, rsa_modulus, rsa_modlen))
-			goto memerr;
-
-		RSA_set_ex_data(rkey, rsa_capi_idx, key);
-
-		if (!(ret = EVP_PKEY_new()))
-			goto memerr;
-
-		EVP_PKEY_assign_RSA(ret, rkey);
-		rkey = NULL;
-
-		}
-	else if (bh->aiKeyAlg == CALG_DSS_SIGN)
-		{
-		DSSPUBKEY *dp;
-		DWORD dsa_plen;
-		unsigned char *btmp;
-		dp = (DSSPUBKEY *)(bh + 1);
-		if (dp->magic != 0x31535344)
-			{
-			char magstr[10];
-			BIO_snprintf(magstr, 10, "%lx", dp->magic);
-			CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
-			ERR_add_error_data(2, "magic=0x", magstr);
-			goto err;
-			}
-		dsa_plen = dp->bitlen / 8;
-		btmp = (unsigned char *)(dp + 1);
-		dkey = DSA_new_method(eng);
-		if (!dkey)
-			goto memerr;
-		dkey->p = BN_new();
-		dkey->q = BN_new();
-		dkey->g = BN_new();
-		dkey->pub_key = BN_new();
-		if (!dkey->p || !dkey->q || !dkey->g || !dkey->pub_key)
-			goto memerr;
-		if (!lend_tobn(dkey->p, btmp, dsa_plen))
-			goto memerr;
-		btmp += dsa_plen;
-		if (!lend_tobn(dkey->q, btmp, 20))
-			goto memerr;
-		btmp += 20;
-		if (!lend_tobn(dkey->g, btmp, dsa_plen))
-			goto memerr;
-		btmp += dsa_plen;
-		if (!lend_tobn(dkey->pub_key, btmp, dsa_plen))
-			goto memerr;
-		btmp += dsa_plen;
-
-		DSA_set_ex_data(dkey, dsa_capi_idx, key);
-
-		if (!(ret = EVP_PKEY_new()))
-			goto memerr;
-
-		EVP_PKEY_assign_DSA(ret, dkey);
-		dkey = NULL;
-		}
-	else
-		{
-		char algstr[10];
-		BIO_snprintf(algstr, 10, "%lx", bh->aiKeyAlg);
-		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM);
-		ERR_add_error_data(2, "aiKeyAlg=0x", algstr);
-		goto err;
-		}
-
-
-	err:
-	if (pubkey)
-		OPENSSL_free(pubkey);
-	if (!ret)
-		{
-		if (rkey)
-			RSA_free(rkey);
-		if (dkey)
-			DSA_free(dkey);
-		}
-
-	return ret;
-
-memerr:
-	CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_MALLOC_FAILURE);
-	goto err;
-
-	}
-
-static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
-	UI_METHOD *ui_method, void *callback_data)
-	{
-	CAPI_CTX *ctx;
-	CAPI_KEY *key;
-	EVP_PKEY *ret;
-	ctx = ENGINE_get_ex_data(eng, capi_idx);
-
-	if (!ctx)
-		{
-		CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_CANT_FIND_CAPI_CONTEXT);
-		return NULL;
-		}
-
-	key = capi_find_key(ctx, key_id);
-
-	if (!key)
-		return NULL;
-
-	ret = capi_get_pkey(eng, key);
-
-	if (!ret)
-		capi_free_key(key);
-	return ret;
-
-	}
-
-/* CryptoAPI RSA operations */
-
-int capi_rsa_priv_enc(int flen, const unsigned char *from,
-                unsigned char *to, RSA *rsa, int padding)
-	{
-	CAPIerr(CAPI_F_CAPI_RSA_PRIV_ENC, CAPI_R_FUNCTION_NOT_SUPPORTED);
-	return -1;
-	}
-
-int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
-             unsigned char *sigret, unsigned int *siglen, const RSA *rsa)
-	{
-	ALG_ID alg;
-	HCRYPTHASH hash;
-	DWORD slen;
-	unsigned int i;
-	int ret = -1;
-	CAPI_KEY *capi_key;
-	CAPI_CTX *ctx;
-
-	ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
-
-	CAPI_trace(ctx, "Called CAPI_rsa_sign()\n");
-
-	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
-	if (!capi_key)
-		{
-		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_GET_KEY);
-		return -1;
-		}
-/* Convert the signature type to a CryptoAPI algorithm ID */
-	switch(dtype)
-		{
-	case NID_sha1:
-		alg = CALG_SHA1;
-		break;
-
-	case NID_md5:
-		alg = CALG_MD5;
-		break;
-
-	case NID_md5_sha1:
-		alg = CALG_SSL3_SHAMD5;
-		break;
-	default:
-		{
-		char algstr[10];
-		BIO_snprintf(algstr, 10, "%lx", dtype);
-		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_UNSUPPORTED_ALGORITHM_NID);
-		ERR_add_error_data(2, "NID=0x", algstr);
-		return -1;
-		}
-	}
-
-
-
-/* Create the hash object */
-	if(!CryptCreateHash(capi_key->hprov, alg, 0, 0, &hash))
-		{
-		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
-		capi_addlasterror();
-		return -1;
-		}
-/* Set the hash value to the value passed */
-
-	if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)m, 0))
-		{
-		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
-		capi_addlasterror();
-		goto err;
-		}
-
-
-/* Finally sign it */
-	slen = RSA_size(rsa);
-	if(!CryptSignHashA(hash, capi_key->keyspec, NULL, 0, sigret, &slen))
-		{
-		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_ERROR_SIGNING_HASH);
-		capi_addlasterror();
-		goto err;
-		}
-	else
-		{
-		ret = 1;
-		/* Inplace byte reversal of signature */
-		for(i = 0; i < slen / 2; i++)
-			{
-			unsigned char c;
-			c = sigret[i];
-			sigret[i] = sigret[slen - i - 1];
-			sigret[slen - i - 1] = c;
-			}
-		*siglen = slen;
-		}
-
-	/* Now cleanup */
-
-err:
-	CryptDestroyHash(hash);
-
-	return ret;
-	}
-
-int capi_rsa_priv_dec(int flen, const unsigned char *from,
-                unsigned char *to, RSA *rsa, int padding)
-	{
-	int i;
-	unsigned char *tmpbuf;
-	CAPI_KEY *capi_key;
-	CAPI_CTX *ctx;
-	ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
-
-	CAPI_trace(ctx, "Called capi_rsa_priv_dec()\n");
-
-
-	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
-	if (!capi_key)
-		{
-		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_CANT_GET_KEY);
-		return -1;
-		}
-
-	if(padding != RSA_PKCS1_PADDING)
-		{
-		char errstr[10];
-		BIO_snprintf(errstr, 10, "%d", padding);
-		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_UNSUPPORTED_PADDING);
-		ERR_add_error_data(2, "padding=", errstr);
-		return -1;
-		}
-
-	/* Create temp reverse order version of input */
-	if(!(tmpbuf = OPENSSL_malloc(flen)) ) 
-		{
-		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, ERR_R_MALLOC_FAILURE);
-		return -1;
-		}
-	for(i = 0; i < flen; i++)
-		tmpbuf[flen - i - 1] = from[i];
-	
-	/* Finally decrypt it */
-	if(!CryptDecrypt(capi_key->key, 0, TRUE, 0, tmpbuf, &flen))
-		{
-		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_DECRYPT_ERROR);
-		capi_addlasterror();
-		OPENSSL_free(tmpbuf);
-		return -1;
-		} 
-	else memcpy(to, tmpbuf, flen);
-
-	OPENSSL_free(tmpbuf);
-
-	return flen;
-	}
-
-static int capi_rsa_free(RSA *rsa)
-	{
-	CAPI_KEY *capi_key;
-	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
-	capi_free_key(capi_key);
-	RSA_set_ex_data(rsa, rsa_capi_idx, 0);
-	return 1;
-	}
-
-/* CryptoAPI DSA operations */
-
-static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
-								DSA *dsa)
-	{
-	HCRYPTHASH hash;
-	DWORD slen;
-	DSA_SIG *ret = NULL;
-	CAPI_KEY *capi_key;
-	CAPI_CTX *ctx;
-	unsigned char csigbuf[40];
-
-	ctx = ENGINE_get_ex_data(dsa->engine, capi_idx);
-
-	CAPI_trace(ctx, "Called CAPI_dsa_do_sign()\n");
-
-	capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
-
-	if (!capi_key)
-		{
-		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_GET_KEY);
-		return NULL;
-		}
-
-	if (dlen != 20)
-		{
-		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_INVALID_DIGEST_LENGTH);
-		return NULL;
-		}
-
-	/* Create the hash object */
-	if(!CryptCreateHash(capi_key->hprov, CALG_SHA1, 0, 0, &hash))
-		{
-		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
-		capi_addlasterror();
-		return NULL;
-		}
-
-	/* Set the hash value to the value passed */
-	if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)digest, 0))
-		{
-		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
-		capi_addlasterror();
-		goto err;
-		}
-
-
-	/* Finally sign it */
-	slen = sizeof(csigbuf);
-	if(!CryptSignHashA(hash, capi_key->keyspec, NULL, 0, csigbuf, &slen))
-		{
-		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_ERROR_SIGNING_HASH);
-		capi_addlasterror();
-		goto err;
-		}
-	else
-		{
-		ret = DSA_SIG_new();
-		if (!ret)
-			goto err;
-		ret->r = BN_new();
-		ret->s = BN_new();
-		if (!ret->r || !ret->s)
-			goto err;
-		if (!lend_tobn(ret->r, csigbuf, 20)
-			|| !lend_tobn(ret->s, csigbuf + 20, 20))
-			{
-			DSA_SIG_free(ret);
-			ret = NULL;
-			goto err;
-			}
-		}
-
-	/* Now cleanup */
-
-err:
-	OPENSSL_cleanse(csigbuf, 40);
-	CryptDestroyHash(hash);
-	return ret;
-	}
-
-static int capi_dsa_free(DSA *dsa)
-	{
-	CAPI_KEY *capi_key;
-	capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
-	capi_free_key(capi_key);
-	DSA_set_ex_data(dsa, dsa_capi_idx, 0);
-	return 1;
-	}
-
-static void capi_vtrace(CAPI_CTX *ctx, int level, char *format, va_list argptr)
-	{
-	BIO *out;
-
-	if (!ctx || (ctx->debug_level < level) || (!ctx->debug_file))
-		return;
-	out = BIO_new_file(ctx->debug_file, "a+");
-	BIO_vprintf(out, format, argptr);
-	BIO_free(out);
-	}
-
-static void CAPI_trace(CAPI_CTX *ctx, char *format, ...)
-	{
-	va_list args;
-	va_start(args, format);
-	capi_vtrace(ctx, CAPI_DBG_TRACE, format, args);
-	va_end(args);
-	}
-
-static void capi_addlasterror(void)
-	{
-	capi_adderror(GetLastError());
-	}
-
-static void capi_adderror(DWORD err)
-	{
-	char errstr[10];
-	BIO_snprintf(errstr, 10, "%lX", err);
-	ERR_add_error_data(2, "Error code= 0x", errstr);
-	}
-
-static char *wide_to_asc(LPWSTR wstr)
-	{
-	char *str;
-	int len_0,sz;
-
-	if (!wstr)
-		return NULL;
-	len_0 = (int)wcslen(wstr)+1;	/* WideCharToMultiByte expects int */
-        sz = WideCharToMultiByte(CP_ACP,0,wstr,len_0,NULL,0,NULL,NULL);
-	if (!sz)
-		{
-		CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);
-		return NULL;
-		}
-	str = OPENSSL_malloc(sz);
-	if (!str)
-		{
-		CAPIerr(CAPI_F_WIDE_TO_ASC, ERR_R_MALLOC_FAILURE);
-		return NULL;
-		}
-	if (!WideCharToMultiByte(CP_ACP,0,wstr,len_0,str,sz,NULL,NULL))
-		{
-		OPENSSL_free(str);
-		CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);
-		return NULL;
-		}
-	return str;
-	}
-
-static int capi_get_provname(CAPI_CTX *ctx, LPSTR *pname, DWORD *ptype, DWORD idx)
-	{
-	LPSTR name;
-	DWORD len, err;
-	CAPI_trace(ctx, "capi_get_provname, index=%d\n", idx);
-	if (!CryptEnumProvidersA(idx, NULL, 0, ptype, NULL, &len))
-		{
-		err = GetLastError();
-		if (err == ERROR_NO_MORE_ITEMS)
-			return 2;
-		CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
-		capi_adderror(err);
-		return 0;
-		}
-	name = OPENSSL_malloc(len);
-	if (!CryptEnumProvidersA(idx, NULL, 0, ptype, name, &len))
-		{
-		err = GetLastError();
-		if (err == ERROR_NO_MORE_ITEMS)
-			return 2;
-		CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
-		capi_adderror(err);
-		return 0;
-		}
-	*pname = name;
-	CAPI_trace(ctx, "capi_get_provname, returned name=%s, type=%d\n", name, *ptype);
-
-	return 1;
-	}
-
-static int capi_list_providers(CAPI_CTX *ctx, BIO *out)
-	{
-	DWORD idx, ptype;
-	int ret;
-	LPSTR provname = NULL;
-	CAPI_trace(ctx, "capi_list_providers\n");
-	BIO_printf(out, "Available CSPs:\n");
-	for(idx = 0; ; idx++)
-		{
-		ret = capi_get_provname(ctx, &provname, &ptype, idx);
-		if (ret == 2)
-			break;
-		if (ret == 0)
-			break;
-		BIO_printf(out, "%d. %s, type %d\n", idx, provname, ptype);
-		OPENSSL_free(provname);
-		}
-	return 1;
-	}
-
-static int capi_list_containers(CAPI_CTX *ctx, BIO *out)
-	{
-	int ret = 1;
-	HCRYPTPROV hprov;
-	DWORD err, idx, flags, buflen = 0, clen;
-	LPSTR cname;
-	CAPI_trace(ctx, "Listing containers CSP=%s, type = %d\n", ctx->cspname, ctx->csptype);
-	if (!CryptAcquireContextA(&hprov, NULL, ctx->cspname, ctx->csptype, CRYPT_VERIFYCONTEXT))
-		{
-		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
-		capi_addlasterror();
-		return 0;
-		}
-	if (!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, NULL, &buflen, CRYPT_FIRST))
-		{
-		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
-		capi_addlasterror();
-		return 0;
-		}
-	CAPI_trace(ctx, "Got max container len %d\n", buflen);
-	if (buflen == 0)
-		buflen = 1024;
-	cname = OPENSSL_malloc(buflen);
-	if (!cname)
-		{
-		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, ERR_R_MALLOC_FAILURE);
-		goto err;
-		}
-
-	for (idx = 0;;idx++)
-		{
-		clen = buflen;
-		cname[0] = 0;
-
-		if (idx == 0)
-			flags = CRYPT_FIRST;
-		else
-			flags = 0;
-		if(!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, cname, &clen, flags))
-			{
-			err = GetLastError();
-			if (err == ERROR_NO_MORE_ITEMS)
-				goto done;
-			CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
-			capi_adderror(err);
-			goto err;
-			}
-		CAPI_trace(ctx, "Container name %s, len=%d, index=%d, flags=%d\n", cname, clen, idx, flags);
-		if (!cname[0] && (clen == buflen))
-			{
-			CAPI_trace(ctx, "Enumerate bug: using workaround\n");
-			goto done;
-			}
-		BIO_printf(out, "%d. %s\n", idx, cname);
-		}
-	err:
-
-	ret = 0;
-
-	done:
-	if (cname)
-		OPENSSL_free(cname);
-	CryptReleaseContext(hprov, 0);
-
-	return ret;
-	}
-
-CRYPT_KEY_PROV_INFO *capi_get_prov_info(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
-	{
-	DWORD len;
-	CRYPT_KEY_PROV_INFO *pinfo;
-	
-	if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, NULL, &len))
-		return NULL;
-	pinfo = OPENSSL_malloc(len);
-	if (!pinfo)
-		{
-		CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, ERR_R_MALLOC_FAILURE);
-		return NULL;
-		}
-	if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, pinfo, &len))
-		{
-		CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO);
-		capi_addlasterror();
-		OPENSSL_free(pinfo);
-		return NULL;
-		}
-	return pinfo;
-	}
-
-static void capi_dump_prov_info(CAPI_CTX *ctx, BIO *out, CRYPT_KEY_PROV_INFO *pinfo)
-	{
-	char *provname = NULL, *contname = NULL;
-	if (!pinfo)
-		{
-		BIO_printf(out, "  No Private Key\n");
-		return;
-		}
-	provname = wide_to_asc(pinfo->pwszProvName);
-	contname = wide_to_asc(pinfo->pwszContainerName);
-	if (!provname || !contname)
-		goto err;
-
-	BIO_printf(out, "  Private Key Info:\n");
-	BIO_printf(out, "    Provider Name:  %s, Provider Type %d\n", provname, pinfo->dwProvType);
-	BIO_printf(out, "    Container Name: %s, Key Type %d\n", contname, pinfo->dwKeySpec);
-	err:
-	if (provname)
-		OPENSSL_free(provname);
-	if (contname)
-		OPENSSL_free(contname);
-	}
-
-char * capi_cert_get_fname(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
-	{
-	LPWSTR wfname;
-	DWORD dlen;
-
-	CAPI_trace(ctx, "capi_cert_get_fname\n");
-	if (!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, NULL, &dlen))
-		return NULL;
-	wfname = OPENSSL_malloc(dlen);
-	if (CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, wfname, &dlen))
-		{
-		char *fname = wide_to_asc(wfname);
-		OPENSSL_free(wfname);
-		return fname;
-		}
-	CAPIerr(CAPI_F_CAPI_CERT_GET_FNAME, CAPI_R_ERROR_GETTING_FRIENDLY_NAME);
-	capi_addlasterror();
-
-	OPENSSL_free(wfname);
-	return NULL;
-	}
-
-
-void capi_dump_cert(CAPI_CTX *ctx, BIO *out, PCCERT_CONTEXT cert)
-	{
-	X509 *x;
-	unsigned char *p;
-	unsigned long flags = ctx->dump_flags;
-	if (flags & CAPI_DMP_FNAME)
-		{
-		char *fname;
-		fname = capi_cert_get_fname(ctx, cert);
-		if (fname)
-			{
-			BIO_printf(out, "  Friendly Name \"%s\"\n", fname);
-			OPENSSL_free(fname);
-			}
-		else
-			BIO_printf(out, "  <No Friendly Name>\n");
-		}
-
-	p = cert->pbCertEncoded;
-	x = d2i_X509(NULL, &p, cert->cbCertEncoded);
-	if (!x)
-		BIO_printf(out, "  <Can't parse certificate>\n");
-	if (flags & CAPI_DMP_SUMMARY)
-		{
-		BIO_printf(out, "  Subject: ");
-		X509_NAME_print_ex(out, X509_get_subject_name(x), 0, XN_FLAG_ONELINE);
-		BIO_printf(out, "\n  Issuer: ");
-		X509_NAME_print_ex(out, X509_get_issuer_name(x), 0, XN_FLAG_ONELINE);
-		BIO_printf(out, "\n");
-		}
-	if (flags & CAPI_DMP_FULL)
-		X509_print_ex(out, x, XN_FLAG_ONELINE,0);
-
-	if (flags & CAPI_DMP_PKEYINFO)
-		{
-		CRYPT_KEY_PROV_INFO *pinfo;
-		pinfo = capi_get_prov_info(ctx, cert);
-		capi_dump_prov_info(ctx, out, pinfo);
-		if (pinfo)
-			OPENSSL_free(pinfo);
-		}
-
-	if (flags & CAPI_DMP_PEM)
-		PEM_write_bio_X509(out, x);
-	X509_free(x);
-	}
-
-HCERTSTORE capi_open_store(CAPI_CTX *ctx, char *storename)
-	{
-	HCERTSTORE hstore;
-
-	if (!storename)
-		storename = ctx->storename;
-	if (!storename)
-		storename = "MY";
-	CAPI_trace(ctx, "Opening certificate store %s\n", storename);
-
-	hstore = CertOpenStore(CERT_STORE_PROV_SYSTEM_A, 0, 0, 
-				ctx->store_flags, storename);
-	if (!hstore)
-		{
-		CAPIerr(CAPI_F_CAPI_OPEN_STORE, CAPI_R_ERROR_OPENING_STORE);
-		capi_addlasterror();
-		}
-	return hstore;
-	}
-
-int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *id)
-	{
-	char *storename;
-	int idx;
-	int ret = 1;
-	HCERTSTORE hstore;
-	PCCERT_CONTEXT cert = NULL;
-
-	storename = ctx->storename;
-	if (!storename)
-		storename = "MY";
-	CAPI_trace(ctx, "Listing certs for store %s\n", storename);
-
-	hstore = capi_open_store(ctx, storename);
-	if (!hstore)
-		return 0;
-	if (id)
-		{
-		cert = capi_find_cert(ctx, id, hstore);
-		if (!cert)
-			{
-			ret = 0;
-			goto err;
-			}
-		capi_dump_cert(ctx, out, cert);
-		CertFreeCertificateContext(cert);
-		}
-	else
-		{
-		for(idx = 0;;idx++)
-			{
-			LPWSTR fname = NULL;
-			cert = CertEnumCertificatesInStore(hstore, cert);
-			if (!cert)
-				break;
-			BIO_printf(out, "Certificate %d\n", idx);
-			capi_dump_cert(ctx, out, cert);
-			}
-		}
-	err:
-	CertCloseStore(hstore, 0);
-	return ret;
-	}
-
-static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore)
-	{
-	PCCERT_CONTEXT cert = NULL;
-	char *fname = NULL;
-	int match;
-	switch(ctx->lookup_method)
-		{
-		case CAPI_LU_SUBSTR:
-			return CertFindCertificateInStore(hstore,
-					X509_ASN_ENCODING, 0,
-					CERT_FIND_SUBJECT_STR_A, id, NULL);
-		case CAPI_LU_FNAME:
-			for(;;)
-				{
-				cert = CertEnumCertificatesInStore(hstore, cert);
-				if (!cert)
-					return NULL;
-				fname = capi_cert_get_fname(ctx, cert);
-				if (fname)
-					{
-					if (strcmp(fname, id))
-						match = 0;
-					else
-						match = 1;
-					OPENSSL_free(fname);
-					if (match)
-						return cert;
-					}
-				}
-		default:
-			return NULL;
-		}
-	}
-
-static CAPI_KEY *capi_get_key(CAPI_CTX *ctx, const char *contname, char *provname, DWORD ptype, DWORD keyspec)
-	{
-	CAPI_KEY *key;
-	key = OPENSSL_malloc(sizeof(CAPI_KEY));
-	CAPI_trace(ctx, "capi_get_key, contname=%s, provname=%s, type=%d\n", 
-						contname, provname, ptype);
-	if (!CryptAcquireContextA(&key->hprov, contname, provname, ptype, 0))
-		{
-		CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
-		capi_addlasterror();
-		goto err;
-		}
-	if (!CryptGetUserKey(key->hprov, keyspec, &key->key))
-		{
-		CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_GETUSERKEY_ERROR);
-		capi_addlasterror();
-		CryptReleaseContext(key->hprov, 0);
-		goto err;
-		}
-	key->keyspec = keyspec;
-	key->pcert = NULL;
-	return key;
-
-	err:
-	OPENSSL_free(key);
-	return NULL;
-	}
-
-static CAPI_KEY *capi_get_cert_key(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
-	{
-	CAPI_KEY *key = NULL;
-	CRYPT_KEY_PROV_INFO *pinfo = NULL;
-	char *provname = NULL, *contname = NULL;
-	pinfo = capi_get_prov_info(ctx, cert);
-	if (!pinfo)
-		goto err;
-	provname = wide_to_asc(pinfo->pwszProvName);
-	contname = wide_to_asc(pinfo->pwszContainerName);
-	if (!provname || !contname)
-		goto err;
-	key = capi_get_key(ctx, contname, provname,
-				pinfo->dwProvType, pinfo->dwKeySpec);
-
-	err:
-	if (pinfo)
-		OPENSSL_free(pinfo);
-	if (provname)
-		OPENSSL_free(provname);
-	if (contname)
-		OPENSSL_free(contname);
-	return key;
-	}
-
-CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id)
-	{
-	PCCERT_CONTEXT cert;
-	HCERTSTORE hstore;
-	CAPI_KEY *key = NULL;
-	switch (ctx->lookup_method)
-		{
-		case CAPI_LU_SUBSTR:
-		case CAPI_LU_FNAME:
-		hstore = capi_open_store(ctx, NULL);
-		if (!hstore)
-			return NULL;
-		cert = capi_find_cert(ctx, id, hstore);
-		if (cert)
-			{
-			key = capi_get_cert_key(ctx, cert);
-			CertFreeCertificateContext(cert);
-			}
-		CertCloseStore(hstore, 0);
-		break;
-
-		case CAPI_LU_CONTNAME:
-		key = capi_get_key(ctx, id, ctx->cspname, ctx->csptype,
-							ctx->keytype);
-		break;
-		}
-
-	return key;
-	}
-
-void capi_free_key(CAPI_KEY *key)
-	{
-	if (!key)
-		return;
-	CryptDestroyKey(key->key);
-	CryptReleaseContext(key->hprov, 0);
-	if (key->pcert)
-		CertFreeCertificateContext(key->pcert);
-	OPENSSL_free(key);
-	}
-
-
-/* Initialize a CAPI_CTX structure */
-
-static CAPI_CTX *capi_ctx_new()
-	{
-	CAPI_CTX *ctx;
-	ctx = OPENSSL_malloc(sizeof(CAPI_CTX));
-	if (!ctx)
-		{
-		CAPIerr(CAPI_F_CAPI_CTX_NEW, ERR_R_MALLOC_FAILURE);
-		return NULL;
-		}
-	ctx->cspname = NULL;
-	ctx->csptype = PROV_RSA_FULL;
-	ctx->dump_flags = CAPI_DMP_SUMMARY|CAPI_DMP_FNAME;
-	ctx->keytype = AT_KEYEXCHANGE;
-	ctx->storename = NULL;
-	ctx->ssl_client_store = NULL;
-	ctx->store_flags = CERT_STORE_OPEN_EXISTING_FLAG |
-				CERT_STORE_READONLY_FLAG |
-				CERT_SYSTEM_STORE_CURRENT_USER;
-	ctx->lookup_method = CAPI_LU_SUBSTR;
-	ctx->debug_level = 0;
-	ctx->debug_file = NULL;
-	ctx->client_cert_select = cert_select_simple;
-	return ctx;
-	}
-
-static void capi_ctx_free(CAPI_CTX *ctx)
-	{
-	CAPI_trace(ctx, "Calling capi_ctx_free with %lx\n", ctx);
-	if (!ctx)
-		return;
-	if (ctx->cspname)
-		OPENSSL_free(ctx->cspname);
-	if (ctx->debug_file)
-		OPENSSL_free(ctx->debug_file);
-	if (ctx->storename)
-		OPENSSL_free(ctx->storename);
-	if (ctx->ssl_client_store)
-		OPENSSL_free(ctx->ssl_client_store);
-	OPENSSL_free(ctx);
-	}
-
-static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check)
-	{
-	CAPI_trace(ctx, "capi_ctx_set_provname, name=%s, type=%d\n", pname, type);
-	if (check)
-		{
-		HCRYPTPROV hprov;
-		if (!CryptAcquireContextA(&hprov, NULL, pname, type,
-						CRYPT_VERIFYCONTEXT))
-			{
-			CAPIerr(CAPI_F_CAPI_CTX_SET_PROVNAME, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
-			capi_addlasterror();
-			return 0;
-			}
-		CryptReleaseContext(hprov, 0);
-		}
-	ctx->cspname = BUF_strdup(pname);
-	ctx->csptype = type;
-	return 1;
-	}
-
-static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx)
-	{
-	LPSTR pname;
-	DWORD type;
-	if (capi_get_provname(ctx, &pname, &type, idx) != 1)
-		return 0;
-	return capi_ctx_set_provname(ctx, pname, type, 0);
-	}
-
-static int cert_issuer_match(STACK_OF(X509_NAME) *ca_dn, X509 *x)
-	{
-	int i;
-	X509_NAME *nm;
-	/* Special case: empty list: match anything */
-	if (sk_X509_NAME_num(ca_dn) <= 0)
-		return 1;
-	for (i = 0; i < sk_X509_NAME_num(ca_dn); i++)
-		{
-		nm = sk_X509_NAME_value(ca_dn, i);
-		if (!X509_NAME_cmp(nm, X509_get_issuer_name(x)))
-				return 1;
-		}
-	return 0;
-	}
-
-
-
-static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,
-	STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
-	STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data)
-	{
-	STACK_OF(X509) *certs = NULL;
-	X509 *x;
-	char *storename;
-	const char *p;
-	int i, client_cert_idx;
-	HCERTSTORE hstore;
-	PCCERT_CONTEXT cert = NULL, excert = NULL;
-	CAPI_CTX *ctx;
-	CAPI_KEY *key;
-	ctx = ENGINE_get_ex_data(e, capi_idx);
-
-	*pcert = NULL;
-	*pkey = NULL;
-
-	storename = ctx->ssl_client_store;
-	if (!storename)
-		storename = "MY";
-
-	hstore = capi_open_store(ctx, storename);
-	if (!hstore)
-		return 0;
-	/* Enumerate all certificates collect any matches */
-	for(i = 0;;i++)
-		{
-		cert = CertEnumCertificatesInStore(hstore, cert);
-		if (!cert)
-			break;
-		p = cert->pbCertEncoded;
-		x = d2i_X509(NULL, &p, cert->cbCertEncoded);
-		if (!x)
-			{
-			CAPI_trace(ctx, "Can't Parse Certificate %d\n", i);
-			continue;
-			}
-		if (cert_issuer_match(ca_dn, x)
-			&& X509_check_purpose(x, X509_PURPOSE_SSL_CLIENT, 0))
-			{
-			key = capi_get_cert_key(ctx, cert);
-			if (!key)
-				{
-				X509_free(x);
-				continue;
-				}
-			/* Match found: attach extra data to it so
-			 * we can retrieve the key later.
-			 */
-			excert = CertDuplicateCertificateContext(cert);
-			key->pcert = excert;
-			X509_set_ex_data(x, cert_capi_idx, key);
-
-			if (!certs)
-				certs = sk_X509_new_null();
-
-			sk_X509_push(certs, x);
-			}
-		else
-			X509_free(x);
-
-		}
-
-	if (cert)
-		CertFreeCertificateContext(cert);
-	if (hstore)
-		CertCloseStore(hstore, 0);
-
-	if (!certs)
-		return 0;
-
-
-	/* Select the appropriate certificate */
-
-	client_cert_idx = ctx->client_cert_select(e, ssl, certs);
-
-	/* Set the selected certificate and free the rest */
-
-	for(i = 0; i < sk_X509_num(certs); i++)
-		{
-		x = sk_X509_value(certs, i);
-		if (i == client_cert_idx)
-			*pcert = x;
-		else
-			{
-			key = X509_get_ex_data(x, cert_capi_idx);
-			capi_free_key(key);
-			X509_free(x);
-			}
-		}
-
-	sk_X509_free(certs);
-
-	if (!*pcert)
-		return 0;
-
-	/* Setup key for selected certificate */
-
-	key = X509_get_ex_data(*pcert, cert_capi_idx);
-	*pkey = capi_get_pkey(e, key);
-	X509_set_ex_data(*pcert, cert_capi_idx, NULL);
-
-	return 1;
-
-	}
-
-
-/* Simple client cert selection function: always select first */
-
-static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)
-	{
-	return 0;
-	}
-
-#ifdef OPENSSL_CAPIENG_DIALOG
-
-/* More complex cert selection function, using standard function
- * CryptUIDlgSelectCertificateFromStore() to produce a dialog box.
- */
-
-/* Definitions which are in cryptuiapi.h but this is not present in older
- * versions of headers.
- */
-
-#ifndef CRYPTUI_SELECT_LOCATION_COLUMN
-#define CRYPTUI_SELECT_LOCATION_COLUMN                   0x000000010
-#define CRYPTUI_SELECT_INTENDEDUSE_COLUMN                0x000000004
-#endif
-
-#define dlg_title L"OpenSSL Application SSL Client Certificate Selection"
-#define dlg_prompt L"Select a certificate to use for authentication"
-#define dlg_columns	 CRYPTUI_SELECT_LOCATION_COLUMN \
-			|CRYPTUI_SELECT_INTENDEDUSE_COLUMN
-
-static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)
-	{
-	X509 *x;
-	HCERTSTORE dstore;
-	PCCERT_CONTEXT cert;
-	CAPI_CTX *ctx;
-	CAPI_KEY *key;
-	HWND hwnd;
-	int i, idx = -1;
-	if (sk_X509_num(certs) == 1)
-		return 0;
-	ctx = ENGINE_get_ex_data(e, capi_idx);
-	/* Create an in memory store of certificates */
-	dstore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
-					CERT_STORE_CREATE_NEW_FLAG, NULL);
-	if (!dstore)
-		{
-		CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_CREATING_STORE);
-		capi_addlasterror();
-		goto err;
-		}
-	/* Add all certificates to store */
-	for(i = 0; i < sk_X509_num(certs); i++)
-		{
-		x = sk_X509_value(certs, i);
-		key = X509_get_ex_data(x, cert_capi_idx);
-
-		if (!CertAddCertificateContextToStore(dstore, key->pcert,
-						CERT_STORE_ADD_NEW, NULL))
-			{
-			CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_ADDING_CERT);
-			capi_addlasterror();
-			goto err;
-			}
-
-		}
-	hwnd = GetForegroundWindow();
-	if (!hwnd)
-		hwnd = GetActiveWindow();
-	if (!hwnd && ctx->getconswindow)
-		hwnd = ctx->getconswindow();
-	/* Call dialog to select one */
-	cert = ctx->certselectdlg(dstore, hwnd, dlg_title, dlg_prompt,
-						dlg_columns, 0, NULL);
-
-	/* Find matching cert from list */
-	if (cert)
-		{
-		for(i = 0; i < sk_X509_num(certs); i++)
-			{
-			x = sk_X509_value(certs, i);
-			key = X509_get_ex_data(x, cert_capi_idx);
-			if (CertCompareCertificate(
-				X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
-					cert->pCertInfo,
-					key->pcert->pCertInfo))
-				{
-				idx = i;
-				break;
-				}
-			}
-		}
-
-	err:
-	if (dstore)
-		CertCloseStore(dstore, 0);
-	return idx;
-
-	}
-#endif
-
-#else /* !__COMPILE_CAPIENG */
-#include <openssl/engine.h>
-#ifndef OPENSSL_NO_DYNAMIC_ENGINE
-OPENSSL_EXPORT
-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }
-IMPLEMENT_DYNAMIC_CHECK_FN()
-#else
-void ENGINE_load_capi(void){}
-#endif
-#endif
+/* engines/e_capi.c */

+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL

+ * project.

+ */

+/* ====================================================================

+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ *

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer. 

+ *

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in

+ *    the documentation and/or other materials provided with the

+ *    distribution.

+ *

+ * 3. All advertising materials mentioning features or use of this

+ *    software must display the following acknowledgment:

+ *    "This product includes software developed by the OpenSSL Project

+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

+ *

+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

+ *    endorse or promote products derived from this software without

+ *    prior written permission. For written permission, please contact

+ *    licensing@OpenSSL.org.

+ *

+ * 5. Products derived from this software may not be called "OpenSSL"

+ *    nor may "OpenSSL" appear in their names without prior written

+ *    permission of the OpenSSL Project.

+ *

+ * 6. Redistributions of any form whatsoever must retain the following

+ *    acknowledgment:

+ *    "This product includes software developed by the OpenSSL Project

+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

+ * OF THE POSSIBILITY OF SUCH DAMAGE.

+ * ====================================================================

+ */

+

+

+#include <stdio.h>

+#include <string.h>

+#include <openssl/crypto.h>

+#include <openssl/buffer.h>

+#include <openssl/bn.h>

+

+#ifdef OPENSSL_SYS_WIN32

+#ifndef OPENSSL_NO_CAPIENG

+

+#include <openssl/rsa.h>

+

+#include <windows.h>

+

+#ifndef _WIN32_WINNT

+#define _WIN32_WINNT 0x0400

+#endif

+

+#include <wincrypt.h>

+

+/*

+ * This module uses several "new" interfaces, among which is

+ * CertGetCertificateContextProperty. CERT_KEY_PROV_INFO_PROP_ID is

+ * one of possible values you can pass to function in question. By

+ * checking if it's defined we can see if wincrypt.h and accompanying

+ * crypt32.lib are in shape. The native MingW32 headers up to and

+ * including __W32API_VERSION 3.14 lack of struct DSSPUBKEY and the

+ * defines CERT_STORE_PROV_SYSTEM_A and CERT_STORE_READONLY_FLAG,

+ * so we check for these too and avoid compiling.

+ * Yes, it's rather "weak" test and if compilation fails,

+ * then re-configure with -DOPENSSL_NO_CAPIENG.

+ */

+#if defined(CERT_KEY_PROV_INFO_PROP_ID) && \

+    defined(CERT_STORE_PROV_SYSTEM_A) && \

+    defined(CERT_STORE_READONLY_FLAG)

+# define __COMPILE_CAPIENG

+#endif /* CERT_KEY_PROV_INFO_PROP_ID */

+#endif /* OPENSSL_NO_CAPIENG */

+#endif /* OPENSSL_SYS_WIN32 */

+

+#ifdef __COMPILE_CAPIENG

+

+#undef X509_EXTENSIONS

+#undef X509_CERT_PAIR

+

+/* Definitions which may be missing from earlier version of headers */

+#ifndef CERT_STORE_OPEN_EXISTING_FLAG

+#define CERT_STORE_OPEN_EXISTING_FLAG                   0x00004000

+#endif

+

+#ifndef CERT_STORE_CREATE_NEW_FLAG

+#define CERT_STORE_CREATE_NEW_FLAG                      0x00002000

+#endif

+

+#ifndef CERT_SYSTEM_STORE_CURRENT_USER

+#define CERT_SYSTEM_STORE_CURRENT_USER			0x00010000

+#endif 

+

+#include <openssl/engine.h>

+#include <openssl/pem.h>

+#include <openssl/x509v3.h>

+

+#include "e_capi_err.h"

+#include "e_capi_err.c"

+

+

+static const char *engine_capi_id = "capi";

+static const char *engine_capi_name = "CryptoAPI ENGINE";

+

+typedef struct CAPI_CTX_st CAPI_CTX;

+typedef struct CAPI_KEY_st CAPI_KEY;

+

+static void capi_addlasterror(void);

+static void capi_adderror(DWORD err);

+

+static void CAPI_trace(CAPI_CTX *ctx, char *format, ...);

+

+static int capi_list_providers(CAPI_CTX *ctx, BIO *out);

+static int capi_list_containers(CAPI_CTX *ctx, BIO *out);

+int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *storename);

+void capi_free_key(CAPI_KEY *key);

+

+static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore);

+

+CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id);

+

+static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,

+	UI_METHOD *ui_method, void *callback_data);

+static int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,

+             unsigned char *sigret, unsigned int *siglen, const RSA *rsa);

+static int capi_rsa_priv_enc(int flen, const unsigned char *from,

+                unsigned char *to, RSA *rsa, int padding);

+static int capi_rsa_priv_dec(int flen, const unsigned char *from,

+                unsigned char *to, RSA *rsa, int padding);

+static int capi_rsa_free(RSA *rsa);

+

+static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,

+							DSA *dsa);

+static int capi_dsa_free(DSA *dsa);

+

+static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,

+	STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,

+	STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data);

+

+static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);

+#ifdef OPENSSL_CAPIENG_DIALOG

+static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);

+#endif

+

+typedef PCCERT_CONTEXT (WINAPI *CERTDLG)(HCERTSTORE, HWND, LPCWSTR,

+						LPCWSTR, DWORD, DWORD,

+						void *);

+typedef HWND (WINAPI *GETCONSWIN)(void);

+

+/* This structure contains CAPI ENGINE specific data:

+ * it contains various global options and affects how

+ * other functions behave.

+ */

+

+#define CAPI_DBG_TRACE	2

+#define CAPI_DBG_ERROR	1

+

+struct CAPI_CTX_st {

+	int debug_level;

+	char *debug_file;

+	/* Parameters to use for container lookup */

+	DWORD keytype;

+	LPSTR cspname;

+	DWORD csptype;

+	/* Certificate store name to use */

+	LPSTR storename;

+	LPSTR ssl_client_store;

+	/* System store flags */

+	DWORD store_flags;

+

+/* Lookup string meanings in load_private_key */

+/* Substring of subject: uses "storename" */

+#define CAPI_LU_SUBSTR		1

+/* Friendly name: uses storename */

+#define CAPI_LU_FNAME		2

+/* Container name: uses cspname, keytype */

+#define CAPI_LU_CONTNAME	3

+	int lookup_method;

+/* Info to dump with dumpcerts option */

+/* Issuer and serial name strings */

+#define CAPI_DMP_SUMMARY	0x1

+/* Friendly name */

+#define CAPI_DMP_FNAME		0x2

+/* Full X509_print dump */

+#define CAPI_DMP_FULL		0x4

+/* Dump PEM format certificate */

+#define CAPI_DMP_PEM		0x8

+/* Dump pseudo key (if possible) */

+#define CAPI_DMP_PSKEY		0x10

+/* Dump key info (if possible) */

+#define CAPI_DMP_PKEYINFO	0x20

+

+	DWORD dump_flags;

+	int (*client_cert_select)(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);

+

+	CERTDLG certselectdlg;

+	GETCONSWIN getconswindow;

+};

+

+

+static CAPI_CTX *capi_ctx_new();

+static void capi_ctx_free(CAPI_CTX *ctx);

+static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check);

+static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx);

+

+#define CAPI_CMD_LIST_CERTS		ENGINE_CMD_BASE

+#define CAPI_CMD_LOOKUP_CERT		(ENGINE_CMD_BASE + 1)

+#define CAPI_CMD_DEBUG_LEVEL		(ENGINE_CMD_BASE + 2)

+#define CAPI_CMD_DEBUG_FILE		(ENGINE_CMD_BASE + 3)

+#define CAPI_CMD_KEYTYPE		(ENGINE_CMD_BASE + 4)

+#define CAPI_CMD_LIST_CSPS		(ENGINE_CMD_BASE + 5)

+#define CAPI_CMD_SET_CSP_IDX		(ENGINE_CMD_BASE + 6)

+#define CAPI_CMD_SET_CSP_NAME		(ENGINE_CMD_BASE + 7)

+#define CAPI_CMD_SET_CSP_TYPE		(ENGINE_CMD_BASE + 8)

+#define CAPI_CMD_LIST_CONTAINERS	(ENGINE_CMD_BASE + 9)

+#define CAPI_CMD_LIST_OPTIONS		(ENGINE_CMD_BASE + 10)

+#define CAPI_CMD_LOOKUP_METHOD		(ENGINE_CMD_BASE + 11)

+#define CAPI_CMD_STORE_NAME		(ENGINE_CMD_BASE + 12)

+#define CAPI_CMD_STORE_FLAGS		(ENGINE_CMD_BASE + 13)

+

+static const ENGINE_CMD_DEFN capi_cmd_defns[] = {

+	{CAPI_CMD_LIST_CERTS,

+		"list_certs",

+		"List all certificates in store",

+		ENGINE_CMD_FLAG_NO_INPUT},

+	{CAPI_CMD_LOOKUP_CERT,

+		"lookup_cert",

+		"Lookup and output certificates",

+		ENGINE_CMD_FLAG_STRING},

+	{CAPI_CMD_DEBUG_LEVEL,

+		"debug_level",

+		"debug level (1=errors, 2=trace)",

+		ENGINE_CMD_FLAG_NUMERIC},

+	{CAPI_CMD_DEBUG_FILE,

+		"debug_file",

+		"debugging filename)",

+		ENGINE_CMD_FLAG_STRING},

+	{CAPI_CMD_KEYTYPE,

+		"key_type",

+		"Key type: 1=AT_KEYEXCHANGE (default), 2=AT_SIGNATURE",

+		ENGINE_CMD_FLAG_NUMERIC},

+	{CAPI_CMD_LIST_CSPS,

+		"list_csps",

+		"List all CSPs",

+		ENGINE_CMD_FLAG_NO_INPUT},

+	{CAPI_CMD_SET_CSP_IDX,

+		"csp_idx",

+		"Set CSP by index",

+		ENGINE_CMD_FLAG_NUMERIC},

+	{CAPI_CMD_SET_CSP_NAME,

+		"csp_name",

+		"Set CSP name, (default CSP used if not specified)",

+		ENGINE_CMD_FLAG_STRING},

+	{CAPI_CMD_SET_CSP_TYPE,

+		"csp_type",

+		"Set CSP type, (default RSA_PROV_FULL)",

+		ENGINE_CMD_FLAG_NUMERIC},

+	{CAPI_CMD_LIST_CONTAINERS,

+		"list_containers",

+		"list container names",

+		ENGINE_CMD_FLAG_NO_INPUT},

+	{CAPI_CMD_LIST_OPTIONS,

+		"list_options",

+		"Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, "

+		"32=private key info)",

+		ENGINE_CMD_FLAG_NUMERIC},

+	{CAPI_CMD_LOOKUP_METHOD,

+		"lookup_method",

+		"Set key lookup method (1=substring, 2=friendlyname, 3=container name)",

+		ENGINE_CMD_FLAG_NUMERIC},

+	{CAPI_CMD_STORE_NAME,

+		"store_name",

+		"certificate store name, default \"MY\"",

+		ENGINE_CMD_FLAG_STRING},

+	{CAPI_CMD_STORE_FLAGS,

+		"store_flags",

+		"Certificate store flags: 1 = system store",

+		ENGINE_CMD_FLAG_NUMERIC},

+

+	{0, NULL, NULL, 0}

+	};

+

+static int capi_idx = -1;

+static int rsa_capi_idx = -1;

+static int dsa_capi_idx = -1;

+static int cert_capi_idx = -1;

+

+static int capi_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))

+	{

+	int ret = 1;

+	CAPI_CTX *ctx;

+	BIO *out;

+	if (capi_idx == -1)

+		{

+		CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_ENGINE_NOT_INITIALIZED);

+		return 0;

+		}

+	ctx = ENGINE_get_ex_data(e, capi_idx);

+	out = BIO_new_fp(stdout, BIO_NOCLOSE);

+	switch (cmd)

+		{

+		case CAPI_CMD_LIST_CSPS:

+		ret = capi_list_providers(ctx, out);

+		break;

+

+		case CAPI_CMD_LIST_CERTS:

+		ret = capi_list_certs(ctx, out, NULL);

+		break;

+

+		case CAPI_CMD_LOOKUP_CERT:

+		ret = capi_list_certs(ctx, out, p);

+		break;

+

+		case CAPI_CMD_LIST_CONTAINERS:

+		ret = capi_list_containers(ctx, out);

+		break;

+

+		case CAPI_CMD_STORE_NAME:

+		if (ctx->storename)

+			OPENSSL_free(ctx->storename);

+		ctx->storename = BUF_strdup(p);

+		CAPI_trace(ctx, "Setting store name to %s\n", p);

+		break;

+

+		case CAPI_CMD_STORE_FLAGS:

+		if (i & 1)

+			{

+			ctx->store_flags |= CERT_SYSTEM_STORE_LOCAL_MACHINE;

+			ctx->store_flags &= ~CERT_SYSTEM_STORE_CURRENT_USER;

+			}

+		else

+			{

+			ctx->store_flags |= CERT_SYSTEM_STORE_CURRENT_USER;

+			ctx->store_flags &= ~CERT_SYSTEM_STORE_LOCAL_MACHINE;

+			}

+		CAPI_trace(ctx, "Setting flags to %d\n", i);

+		break;

+

+		case CAPI_CMD_DEBUG_LEVEL:

+		ctx->debug_level = (int)i;

+		CAPI_trace(ctx, "Setting debug level to %d\n", ctx->debug_level);

+		break;

+

+		case CAPI_CMD_DEBUG_FILE:

+		ctx->debug_file = BUF_strdup(p);

+		CAPI_trace(ctx, "Setting debug file to %s\n", ctx->debug_file);

+		break;

+

+		case CAPI_CMD_KEYTYPE:

+		ctx->keytype = i;

+		CAPI_trace(ctx, "Setting key type to %d\n", ctx->keytype);

+		break;

+

+		case CAPI_CMD_SET_CSP_IDX:

+		ret = capi_ctx_set_provname_idx(ctx, i);

+		break;

+

+		case CAPI_CMD_LIST_OPTIONS:

+		ctx->dump_flags = i;

+		break;

+

+		case CAPI_CMD_LOOKUP_METHOD:

+		if (i < 1 || i > 3)

+			{

+			CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_INVALID_LOOKUP_METHOD);

+			return 0;

+			}

+		ctx->lookup_method = i;

+		break;

+

+		case CAPI_CMD_SET_CSP_NAME:

+		ret = capi_ctx_set_provname(ctx, p, ctx->csptype, 1);

+		break;

+

+		case CAPI_CMD_SET_CSP_TYPE:

+		ctx->csptype = i;

+		break;

+

+		default:

+		CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_UNKNOWN_COMMAND);

+		ret = 0;

+	}

+

+	BIO_free(out);

+	return ret;

+

+	}

+

+static RSA_METHOD capi_rsa_method =

+	{

+	"CryptoAPI RSA method",

+	0,				/* pub_enc */

+	0,				/* pub_dec */

+	capi_rsa_priv_enc,		/* priv_enc */

+	capi_rsa_priv_dec,		/* priv_dec */

+	0,				/* rsa_mod_exp */

+	0,				/* bn_mod_exp */

+	0,				/* init	*/

+	capi_rsa_free,			/* finish */

+	RSA_FLAG_SIGN_VER, 		/* flags */

+	NULL,				/* app_data */

+	capi_rsa_sign,			/* rsa_sign */

+	0				/* rsa_verify */

+	};

+

+static DSA_METHOD capi_dsa_method =

+	{

+	"CryptoAPI DSA method",

+	capi_dsa_do_sign,		/* dsa_do_sign */

+	0,				/* dsa_sign_setup */

+	0,				/* dsa_do_verify */

+	0,				/* dsa_mod_exp */

+	0,				/* bn_mod_exp */

+	0,				/* init	*/

+	capi_dsa_free,			/* finish */

+	0, 				/* flags */

+	NULL,				/* app_data */

+	0,				/* dsa_paramgen */

+	0				/* dsa_keygen */

+	};

+

+static int capi_init(ENGINE *e)

+	{

+	CAPI_CTX *ctx;

+	const RSA_METHOD *ossl_rsa_meth;

+	const DSA_METHOD *ossl_dsa_meth;

+	capi_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, 0);

+	cert_capi_idx = X509_get_ex_new_index(0, NULL, NULL, NULL, 0);

+

+	ctx = capi_ctx_new();

+	if (!ctx || (capi_idx < 0))

+		goto memerr;

+

+	ENGINE_set_ex_data(e, capi_idx, ctx);

+	/* Setup RSA_METHOD */

+	rsa_capi_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, 0);

+	ossl_rsa_meth = RSA_PKCS1_SSLeay();

+	capi_rsa_method.rsa_pub_enc = ossl_rsa_meth->rsa_pub_enc;

+	capi_rsa_method.rsa_pub_dec = ossl_rsa_meth->rsa_pub_dec;

+	capi_rsa_method.rsa_mod_exp = ossl_rsa_meth->rsa_mod_exp;

+	capi_rsa_method.bn_mod_exp = ossl_rsa_meth->bn_mod_exp;

+

+	/* Setup DSA Method */

+	dsa_capi_idx = DSA_get_ex_new_index(0, NULL, NULL, NULL, 0);

+	ossl_dsa_meth = DSA_OpenSSL();

+	capi_dsa_method.dsa_do_verify = ossl_dsa_meth->dsa_do_verify;

+	capi_dsa_method.dsa_mod_exp = ossl_dsa_meth->dsa_mod_exp;

+	capi_dsa_method.bn_mod_exp = ossl_dsa_meth->bn_mod_exp;

+

+#ifdef OPENSSL_CAPIENG_DIALOG

+	{

+	HMODULE cryptui = LoadLibrary(TEXT("CRYPTUI.DLL"));

+	HMODULE kernel = GetModuleHandle(TEXT("KERNEL32.DLL"));

+	if (cryptui)

+		ctx->certselectdlg = (CERTDLG)GetProcAddress(cryptui, "CryptUIDlgSelectCertificateFromStore");

+	if (kernel)

+		ctx->getconswindow = (GETCONSWIN)GetProcAddress(kernel, "GetConsoleWindow");

+	if (cryptui && !OPENSSL_isservice())

+		ctx->client_cert_select = cert_select_dialog;

+	}

+#endif

+		

+

+	return 1;

+

+	memerr:

+	CAPIerr(CAPI_F_CAPI_INIT, ERR_R_MALLOC_FAILURE);

+	return 0;

+

+	return 1;

+	}

+

+static int capi_destroy(ENGINE *e)

+	{

+	ERR_unload_CAPI_strings();

+	return 1;

+	}

+

+static int capi_finish(ENGINE *e)

+	{

+	CAPI_CTX *ctx;

+	ctx = ENGINE_get_ex_data(e, capi_idx);

+	capi_ctx_free(ctx);

+	ENGINE_set_ex_data(e, capi_idx, NULL);

+	return 1;

+	}

+

+

+/* CryptoAPI key application data. This contains

+ * a handle to the private key container (for sign operations)

+ * and a handle to the key (for decrypt operations).

+ */

+

+struct CAPI_KEY_st

+	{

+	/* Associated certificate context (if any) */

+	PCCERT_CONTEXT pcert;

+	HCRYPTPROV hprov;

+	HCRYPTKEY key;

+	DWORD keyspec;

+	};

+

+static int bind_capi(ENGINE *e)

+	{

+	if (!ENGINE_set_id(e, engine_capi_id)

+		|| !ENGINE_set_name(e, engine_capi_name)

+		|| !ENGINE_set_init_function(e, capi_init)

+		|| !ENGINE_set_finish_function(e, capi_finish)

+		|| !ENGINE_set_destroy_function(e, capi_destroy)

+		|| !ENGINE_set_RSA(e, &capi_rsa_method)

+		|| !ENGINE_set_DSA(e, &capi_dsa_method)

+		|| !ENGINE_set_load_privkey_function(e, capi_load_privkey)

+		|| !ENGINE_set_load_ssl_client_cert_function(e,

+						capi_load_ssl_client_cert)

+		|| !ENGINE_set_cmd_defns(e, capi_cmd_defns)

+		|| !ENGINE_set_ctrl_function(e, capi_ctrl))

+			return 0;

+	ERR_load_CAPI_strings();

+

+	return 1;

+

+	}

+

+#ifndef OPENSSL_NO_DYNAMIC_ENGINE

+static int bind_helper(ENGINE *e, const char *id)

+	{

+	if(id && (strcmp(id, engine_capi_id) != 0))

+		return 0;

+	if(!bind_capi(e))

+		return 0;

+	return 1;

+	}       

+IMPLEMENT_DYNAMIC_CHECK_FN()

+IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)

+#else

+static ENGINE *engine_capi(void)

+	{

+	ENGINE *ret = ENGINE_new();

+	if(!ret)

+		return NULL;

+	if(!bind_capi(ret))

+		{

+		ENGINE_free(ret);

+		return NULL;

+		}

+	return ret;

+	}

+

+void ENGINE_load_capi(void)

+	{

+	/* Copied from eng_[openssl|dyn].c */

+	ENGINE *toadd = engine_capi();

+	if(!toadd) return;

+	ENGINE_add(toadd);

+	ENGINE_free(toadd);

+	ERR_clear_error();

+	}

+#endif

+

+

+static int lend_tobn(BIGNUM *bn, unsigned char *bin, int binlen)

+	{

+	int i;

+	/* Reverse buffer in place: since this is a keyblob structure

+	 * that will be freed up after conversion anyway it doesn't 

+	 * matter if we change it.

+	 */

+	for(i = 0; i < binlen / 2; i++)

+		{

+		unsigned char c;

+		c = bin[i];

+		bin[i] = bin[binlen - i - 1];

+		bin[binlen - i - 1] = c;

+		}

+

+	if (!BN_bin2bn(bin, binlen, bn))

+		return 0;

+	return 1;

+	}

+

+/* Given a CAPI_KEY get an EVP_PKEY structure */

+

+static EVP_PKEY *capi_get_pkey(ENGINE *eng, CAPI_KEY *key)

+	{

+	unsigned char *pubkey = NULL;

+	DWORD len;

+	BLOBHEADER *bh;

+	RSA *rkey = NULL;

+	DSA *dkey = NULL;

+	EVP_PKEY *ret = NULL;

+	if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, NULL, &len))

+		{

+		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR);

+		capi_addlasterror();

+		return NULL;

+		}

+

+	pubkey = OPENSSL_malloc(len);

+

+	if (!pubkey)

+		goto memerr;

+

+	if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, pubkey, &len))

+		{

+		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_ERROR);

+		capi_addlasterror();

+		goto err;

+		}

+

+	bh = (BLOBHEADER *)pubkey;

+	if (bh->bType != PUBLICKEYBLOB)

+		{

+		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_PUBLIC_KEY_BLOB);

+		goto err;

+		}

+	if (bh->aiKeyAlg == CALG_RSA_SIGN || bh->aiKeyAlg == CALG_RSA_KEYX)

+		{

+		RSAPUBKEY *rp;

+		DWORD rsa_modlen;

+		unsigned char *rsa_modulus;

+		rp = (RSAPUBKEY *)(bh + 1);

+		if (rp->magic != 0x31415352)

+			{

+			char magstr[10];

+			BIO_snprintf(magstr, 10, "%lx", rp->magic);

+			CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);

+			ERR_add_error_data(2, "magic=0x", magstr);

+			goto err;

+			}

+		rsa_modulus = (unsigned char *)(rp + 1);

+		rkey = RSA_new_method(eng);

+		if (!rkey)

+			goto memerr;

+

+		rkey->e = BN_new();

+		rkey->n = BN_new();

+

+		if (!rkey->e || !rkey->n)

+			goto memerr;

+

+		if (!BN_set_word(rkey->e, rp->pubexp))

+			goto memerr;

+

+		rsa_modlen = rp->bitlen / 8;

+		if (!lend_tobn(rkey->n, rsa_modulus, rsa_modlen))

+			goto memerr;

+

+		RSA_set_ex_data(rkey, rsa_capi_idx, key);

+

+		if (!(ret = EVP_PKEY_new()))

+			goto memerr;

+

+		EVP_PKEY_assign_RSA(ret, rkey);

+		rkey = NULL;

+

+		}

+	else if (bh->aiKeyAlg == CALG_DSS_SIGN)

+		{

+		DSSPUBKEY *dp;

+		DWORD dsa_plen;

+		unsigned char *btmp;

+		dp = (DSSPUBKEY *)(bh + 1);

+		if (dp->magic != 0x31535344)

+			{

+			char magstr[10];

+			BIO_snprintf(magstr, 10, "%lx", dp->magic);

+			CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);

+			ERR_add_error_data(2, "magic=0x", magstr);

+			goto err;

+			}

+		dsa_plen = dp->bitlen / 8;

+		btmp = (unsigned char *)(dp + 1);

+		dkey = DSA_new_method(eng);

+		if (!dkey)

+			goto memerr;

+		dkey->p = BN_new();

+		dkey->q = BN_new();

+		dkey->g = BN_new();

+		dkey->pub_key = BN_new();

+		if (!dkey->p || !dkey->q || !dkey->g || !dkey->pub_key)

+			goto memerr;

+		if (!lend_tobn(dkey->p, btmp, dsa_plen))

+			goto memerr;

+		btmp += dsa_plen;

+		if (!lend_tobn(dkey->q, btmp, 20))

+			goto memerr;

+		btmp += 20;

+		if (!lend_tobn(dkey->g, btmp, dsa_plen))

+			goto memerr;

+		btmp += dsa_plen;

+		if (!lend_tobn(dkey->pub_key, btmp, dsa_plen))

+			goto memerr;

+		btmp += dsa_plen;

+

+		DSA_set_ex_data(dkey, dsa_capi_idx, key);

+

+		if (!(ret = EVP_PKEY_new()))

+			goto memerr;

+

+		EVP_PKEY_assign_DSA(ret, dkey);

+		dkey = NULL;

+		}

+	else

+		{

+		char algstr[10];

+		BIO_snprintf(algstr, 10, "%lx", bh->aiKeyAlg);

+		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM);

+		ERR_add_error_data(2, "aiKeyAlg=0x", algstr);

+		goto err;

+		}

+

+

+	err:

+	if (pubkey)

+		OPENSSL_free(pubkey);

+	if (!ret)

+		{

+		if (rkey)

+			RSA_free(rkey);

+		if (dkey)

+			DSA_free(dkey);

+		}

+

+	return ret;

+

+memerr:

+	CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_MALLOC_FAILURE);

+	goto err;

+

+	}

+

+static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,

+	UI_METHOD *ui_method, void *callback_data)

+	{

+	CAPI_CTX *ctx;

+	CAPI_KEY *key;

+	EVP_PKEY *ret;

+	ctx = ENGINE_get_ex_data(eng, capi_idx);

+

+	if (!ctx)

+		{

+		CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_CANT_FIND_CAPI_CONTEXT);

+		return NULL;

+		}

+

+	key = capi_find_key(ctx, key_id);

+

+	if (!key)

+		return NULL;

+

+	ret = capi_get_pkey(eng, key);

+

+	if (!ret)

+		capi_free_key(key);

+	return ret;

+

+	}

+

+/* CryptoAPI RSA operations */

+

+int capi_rsa_priv_enc(int flen, const unsigned char *from,

+                unsigned char *to, RSA *rsa, int padding)

+	{

+	CAPIerr(CAPI_F_CAPI_RSA_PRIV_ENC, CAPI_R_FUNCTION_NOT_SUPPORTED);

+	return -1;

+	}

+

+int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,

+             unsigned char *sigret, unsigned int *siglen, const RSA *rsa)

+	{

+	ALG_ID alg;

+	HCRYPTHASH hash;

+	DWORD slen;

+	unsigned int i;

+	int ret = -1;

+	CAPI_KEY *capi_key;

+	CAPI_CTX *ctx;

+

+	ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);

+

+	CAPI_trace(ctx, "Called CAPI_rsa_sign()\n");

+

+	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);

+	if (!capi_key)

+		{

+		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_GET_KEY);

+		return -1;

+		}

+/* Convert the signature type to a CryptoAPI algorithm ID */

+	switch(dtype)

+		{

+	case NID_sha1:

+		alg = CALG_SHA1;

+		break;

+

+	case NID_md5:

+		alg = CALG_MD5;

+		break;

+

+	case NID_md5_sha1:

+		alg = CALG_SSL3_SHAMD5;

+		break;

+	default:

+		{

+		char algstr[10];

+		BIO_snprintf(algstr, 10, "%lx", dtype);

+		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_UNSUPPORTED_ALGORITHM_NID);

+		ERR_add_error_data(2, "NID=0x", algstr);

+		return -1;

+		}

+	}

+

+

+

+/* Create the hash object */

+	if(!CryptCreateHash(capi_key->hprov, alg, 0, 0, &hash))

+		{

+		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);

+		capi_addlasterror();

+		return -1;

+		}

+/* Set the hash value to the value passed */

+

+	if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)m, 0))

+		{

+		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_SET_HASH_VALUE);

+		capi_addlasterror();

+		goto err;

+		}

+

+

+/* Finally sign it */

+	slen = RSA_size(rsa);

+	if(!CryptSignHashA(hash, capi_key->keyspec, NULL, 0, sigret, &slen))

+		{

+		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_ERROR_SIGNING_HASH);

+		capi_addlasterror();

+		goto err;

+		}

+	else

+		{

+		ret = 1;

+		/* Inplace byte reversal of signature */

+		for(i = 0; i < slen / 2; i++)

+			{

+			unsigned char c;

+			c = sigret[i];

+			sigret[i] = sigret[slen - i - 1];

+			sigret[slen - i - 1] = c;

+			}

+		*siglen = slen;

+		}

+

+	/* Now cleanup */

+

+err:

+	CryptDestroyHash(hash);

+

+	return ret;

+	}

+

+int capi_rsa_priv_dec(int flen, const unsigned char *from,

+                unsigned char *to, RSA *rsa, int padding)

+	{

+	int i;

+	unsigned char *tmpbuf;

+	CAPI_KEY *capi_key;

+	CAPI_CTX *ctx;

+	ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);

+

+	CAPI_trace(ctx, "Called capi_rsa_priv_dec()\n");

+

+

+	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);

+	if (!capi_key)

+		{

+		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_CANT_GET_KEY);

+		return -1;

+		}

+

+	if(padding != RSA_PKCS1_PADDING)

+		{

+		char errstr[10];

+		BIO_snprintf(errstr, 10, "%d", padding);

+		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_UNSUPPORTED_PADDING);

+		ERR_add_error_data(2, "padding=", errstr);

+		return -1;

+		}

+

+	/* Create temp reverse order version of input */

+	if(!(tmpbuf = OPENSSL_malloc(flen)) ) 

+		{

+		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, ERR_R_MALLOC_FAILURE);

+		return -1;

+		}

+	for(i = 0; i < flen; i++)

+		tmpbuf[flen - i - 1] = from[i];

+	

+	/* Finally decrypt it */

+	if(!CryptDecrypt(capi_key->key, 0, TRUE, 0, tmpbuf, &flen))

+		{

+		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_DECRYPT_ERROR);

+		capi_addlasterror();

+		OPENSSL_free(tmpbuf);

+		return -1;

+		} 

+	else memcpy(to, tmpbuf, flen);

+

+	OPENSSL_free(tmpbuf);

+

+	return flen;

+	}

+

+static int capi_rsa_free(RSA *rsa)

+	{

+	CAPI_KEY *capi_key;

+	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);

+	capi_free_key(capi_key);

+	RSA_set_ex_data(rsa, rsa_capi_idx, 0);

+	return 1;

+	}

+

+/* CryptoAPI DSA operations */

+

+static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,

+								DSA *dsa)

+	{

+	HCRYPTHASH hash;

+	DWORD slen;

+	DSA_SIG *ret = NULL;

+	CAPI_KEY *capi_key;

+	CAPI_CTX *ctx;

+	unsigned char csigbuf[40];

+

+	ctx = ENGINE_get_ex_data(dsa->engine, capi_idx);

+

+	CAPI_trace(ctx, "Called CAPI_dsa_do_sign()\n");

+

+	capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);

+

+	if (!capi_key)

+		{

+		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_GET_KEY);

+		return NULL;

+		}

+

+	if (dlen != 20)

+		{

+		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_INVALID_DIGEST_LENGTH);

+		return NULL;

+		}

+

+	/* Create the hash object */

+	if(!CryptCreateHash(capi_key->hprov, CALG_SHA1, 0, 0, &hash))

+		{

+		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);

+		capi_addlasterror();

+		return NULL;

+		}

+

+	/* Set the hash value to the value passed */

+	if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)digest, 0))

+		{

+		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_SET_HASH_VALUE);

+		capi_addlasterror();

+		goto err;

+		}

+

+

+	/* Finally sign it */

+	slen = sizeof(csigbuf);

+	if(!CryptSignHashA(hash, capi_key->keyspec, NULL, 0, csigbuf, &slen))

+		{

+		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_ERROR_SIGNING_HASH);

+		capi_addlasterror();

+		goto err;

+		}

+	else

+		{

+		ret = DSA_SIG_new();

+		if (!ret)

+			goto err;

+		ret->r = BN_new();

+		ret->s = BN_new();

+		if (!ret->r || !ret->s)

+			goto err;

+		if (!lend_tobn(ret->r, csigbuf, 20)

+			|| !lend_tobn(ret->s, csigbuf + 20, 20))

+			{

+			DSA_SIG_free(ret);

+			ret = NULL;

+			goto err;

+			}

+		}

+

+	/* Now cleanup */

+

+err:

+	OPENSSL_cleanse(csigbuf, 40);

+	CryptDestroyHash(hash);

+	return ret;

+	}

+

+static int capi_dsa_free(DSA *dsa)

+	{

+	CAPI_KEY *capi_key;

+	capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);

+	capi_free_key(capi_key);

+	DSA_set_ex_data(dsa, dsa_capi_idx, 0);

+	return 1;

+	}

+

+static void capi_vtrace(CAPI_CTX *ctx, int level, char *format, va_list argptr)

+	{

+	BIO *out;

+

+	if (!ctx || (ctx->debug_level < level) || (!ctx->debug_file))

+		return;

+	out = BIO_new_file(ctx->debug_file, "a+");

+	BIO_vprintf(out, format, argptr);

+	BIO_free(out);

+	}

+

+static void CAPI_trace(CAPI_CTX *ctx, char *format, ...)

+	{

+	va_list args;

+	va_start(args, format);

+	capi_vtrace(ctx, CAPI_DBG_TRACE, format, args);

+	va_end(args);

+	}

+

+static void capi_addlasterror(void)

+	{

+	capi_adderror(GetLastError());

+	}

+

+static void capi_adderror(DWORD err)

+	{

+	char errstr[10];

+	BIO_snprintf(errstr, 10, "%lX", err);

+	ERR_add_error_data(2, "Error code= 0x", errstr);

+	}

+

+static char *wide_to_asc(LPWSTR wstr)

+	{

+	char *str;

+	int len_0,sz;

+

+	if (!wstr)

+		return NULL;

+	len_0 = (int)wcslen(wstr)+1;	/* WideCharToMultiByte expects int */

+        sz = WideCharToMultiByte(CP_ACP,0,wstr,len_0,NULL,0,NULL,NULL);

+	if (!sz)

+		{

+		CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);

+		return NULL;

+		}

+	str = OPENSSL_malloc(sz);

+	if (!str)

+		{

+		CAPIerr(CAPI_F_WIDE_TO_ASC, ERR_R_MALLOC_FAILURE);

+		return NULL;

+		}

+	if (!WideCharToMultiByte(CP_ACP,0,wstr,len_0,str,sz,NULL,NULL))

+		{

+		OPENSSL_free(str);

+		CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);

+		return NULL;

+		}

+	return str;

+	}

+

+static int capi_get_provname(CAPI_CTX *ctx, LPSTR *pname, DWORD *ptype, DWORD idx)

+	{

+	LPSTR name;

+	DWORD len, err;

+	CAPI_trace(ctx, "capi_get_provname, index=%d\n", idx);

+	if (!CryptEnumProvidersA(idx, NULL, 0, ptype, NULL, &len))

+		{

+		err = GetLastError();

+		if (err == ERROR_NO_MORE_ITEMS)

+			return 2;

+		CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);

+		capi_adderror(err);

+		return 0;

+		}

+	name = OPENSSL_malloc(len);

+	if (!CryptEnumProvidersA(idx, NULL, 0, ptype, name, &len))

+		{

+		err = GetLastError();

+		if (err == ERROR_NO_MORE_ITEMS)

+			return 2;

+		CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);

+		capi_adderror(err);

+		return 0;

+		}

+	*pname = name;

+	CAPI_trace(ctx, "capi_get_provname, returned name=%s, type=%d\n", name, *ptype);

+

+	return 1;

+	}

+

+static int capi_list_providers(CAPI_CTX *ctx, BIO *out)

+	{

+	DWORD idx, ptype;

+	int ret;

+	LPSTR provname = NULL;

+	CAPI_trace(ctx, "capi_list_providers\n");

+	BIO_printf(out, "Available CSPs:\n");

+	for(idx = 0; ; idx++)

+		{

+		ret = capi_get_provname(ctx, &provname, &ptype, idx);

+		if (ret == 2)

+			break;

+		if (ret == 0)

+			break;

+		BIO_printf(out, "%d. %s, type %d\n", idx, provname, ptype);

+		OPENSSL_free(provname);

+		}

+	return 1;

+	}

+

+static int capi_list_containers(CAPI_CTX *ctx, BIO *out)

+	{

+	int ret = 1;

+	HCRYPTPROV hprov;

+	DWORD err, idx, flags, buflen = 0, clen;

+	LPSTR cname;

+	CAPI_trace(ctx, "Listing containers CSP=%s, type = %d\n", ctx->cspname, ctx->csptype);

+	if (!CryptAcquireContextA(&hprov, NULL, ctx->cspname, ctx->csptype, CRYPT_VERIFYCONTEXT))

+		{

+		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);

+		capi_addlasterror();

+		return 0;

+		}

+	if (!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, NULL, &buflen, CRYPT_FIRST))

+		{

+		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);

+		capi_addlasterror();

+		return 0;

+		}

+	CAPI_trace(ctx, "Got max container len %d\n", buflen);

+	if (buflen == 0)

+		buflen = 1024;

+	cname = OPENSSL_malloc(buflen);

+	if (!cname)

+		{

+		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, ERR_R_MALLOC_FAILURE);

+		goto err;

+		}

+

+	for (idx = 0;;idx++)

+		{

+		clen = buflen;

+		cname[0] = 0;

+

+		if (idx == 0)

+			flags = CRYPT_FIRST;

+		else

+			flags = 0;

+		if(!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, cname, &clen, flags))

+			{

+			err = GetLastError();

+			if (err == ERROR_NO_MORE_ITEMS)

+				goto done;

+			CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);

+			capi_adderror(err);

+			goto err;

+			}

+		CAPI_trace(ctx, "Container name %s, len=%d, index=%d, flags=%d\n", cname, clen, idx, flags);

+		if (!cname[0] && (clen == buflen))

+			{

+			CAPI_trace(ctx, "Enumerate bug: using workaround\n");

+			goto done;

+			}

+		BIO_printf(out, "%d. %s\n", idx, cname);

+		}

+	err:

+

+	ret = 0;

+

+	done:

+	if (cname)

+		OPENSSL_free(cname);

+	CryptReleaseContext(hprov, 0);

+

+	return ret;

+	}

+

+CRYPT_KEY_PROV_INFO *capi_get_prov_info(CAPI_CTX *ctx, PCCERT_CONTEXT cert)

+	{

+	DWORD len;

+	CRYPT_KEY_PROV_INFO *pinfo;

+	

+	if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, NULL, &len))

+		return NULL;

+	pinfo = OPENSSL_malloc(len);

+	if (!pinfo)

+		{

+		CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, ERR_R_MALLOC_FAILURE);

+		return NULL;

+		}

+	if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, pinfo, &len))

+		{

+		CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO);

+		capi_addlasterror();

+		OPENSSL_free(pinfo);

+		return NULL;

+		}

+	return pinfo;

+	}

+

+static void capi_dump_prov_info(CAPI_CTX *ctx, BIO *out, CRYPT_KEY_PROV_INFO *pinfo)

+	{

+	char *provname = NULL, *contname = NULL;

+	if (!pinfo)

+		{

+		BIO_printf(out, "  No Private Key\n");

+		return;

+		}

+	provname = wide_to_asc(pinfo->pwszProvName);

+	contname = wide_to_asc(pinfo->pwszContainerName);

+	if (!provname || !contname)

+		goto err;

+

+	BIO_printf(out, "  Private Key Info:\n");

+	BIO_printf(out, "    Provider Name:  %s, Provider Type %d\n", provname, pinfo->dwProvType);

+	BIO_printf(out, "    Container Name: %s, Key Type %d\n", contname, pinfo->dwKeySpec);

+	err:

+	if (provname)

+		OPENSSL_free(provname);

+	if (contname)

+		OPENSSL_free(contname);

+	}

+

+char * capi_cert_get_fname(CAPI_CTX *ctx, PCCERT_CONTEXT cert)

+	{

+	LPWSTR wfname;

+	DWORD dlen;

+

+	CAPI_trace(ctx, "capi_cert_get_fname\n");

+	if (!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, NULL, &dlen))

+		return NULL;

+	wfname = OPENSSL_malloc(dlen);

+	if (CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, wfname, &dlen))

+		{

+		char *fname = wide_to_asc(wfname);

+		OPENSSL_free(wfname);

+		return fname;

+		}

+	CAPIerr(CAPI_F_CAPI_CERT_GET_FNAME, CAPI_R_ERROR_GETTING_FRIENDLY_NAME);

+	capi_addlasterror();

+

+	OPENSSL_free(wfname);

+	return NULL;

+	}

+

+

+void capi_dump_cert(CAPI_CTX *ctx, BIO *out, PCCERT_CONTEXT cert)

+	{

+	X509 *x;

+	unsigned char *p;

+	unsigned long flags = ctx->dump_flags;

+	if (flags & CAPI_DMP_FNAME)

+		{

+		char *fname;

+		fname = capi_cert_get_fname(ctx, cert);

+		if (fname)

+			{

+			BIO_printf(out, "  Friendly Name \"%s\"\n", fname);

+			OPENSSL_free(fname);

+			}

+		else

+			BIO_printf(out, "  <No Friendly Name>\n");

+		}

+

+	p = cert->pbCertEncoded;

+	x = d2i_X509(NULL, &p, cert->cbCertEncoded);

+	if (!x)

+		BIO_printf(out, "  <Can't parse certificate>\n");

+	if (flags & CAPI_DMP_SUMMARY)

+		{

+		BIO_printf(out, "  Subject: ");

+		X509_NAME_print_ex(out, X509_get_subject_name(x), 0, XN_FLAG_ONELINE);

+		BIO_printf(out, "\n  Issuer: ");

+		X509_NAME_print_ex(out, X509_get_issuer_name(x), 0, XN_FLAG_ONELINE);

+		BIO_printf(out, "\n");

+		}

+	if (flags & CAPI_DMP_FULL)

+		X509_print_ex(out, x, XN_FLAG_ONELINE,0);

+

+	if (flags & CAPI_DMP_PKEYINFO)

+		{

+		CRYPT_KEY_PROV_INFO *pinfo;

+		pinfo = capi_get_prov_info(ctx, cert);

+		capi_dump_prov_info(ctx, out, pinfo);

+		if (pinfo)

+			OPENSSL_free(pinfo);

+		}

+

+	if (flags & CAPI_DMP_PEM)

+		PEM_write_bio_X509(out, x);

+	X509_free(x);

+	}

+

+HCERTSTORE capi_open_store(CAPI_CTX *ctx, char *storename)

+	{

+	HCERTSTORE hstore;

+

+	if (!storename)

+		storename = ctx->storename;

+	if (!storename)

+		storename = "MY";

+	CAPI_trace(ctx, "Opening certificate store %s\n", storename);

+

+	hstore = CertOpenStore(CERT_STORE_PROV_SYSTEM_A, 0, 0, 

+				ctx->store_flags, storename);

+	if (!hstore)

+		{

+		CAPIerr(CAPI_F_CAPI_OPEN_STORE, CAPI_R_ERROR_OPENING_STORE);

+		capi_addlasterror();

+		}

+	return hstore;

+	}

+

+int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *id)

+	{

+	char *storename;

+	int idx;

+	int ret = 1;

+	HCERTSTORE hstore;

+	PCCERT_CONTEXT cert = NULL;

+

+	storename = ctx->storename;

+	if (!storename)

+		storename = "MY";

+	CAPI_trace(ctx, "Listing certs for store %s\n", storename);

+

+	hstore = capi_open_store(ctx, storename);

+	if (!hstore)

+		return 0;

+	if (id)

+		{

+		cert = capi_find_cert(ctx, id, hstore);

+		if (!cert)

+			{

+			ret = 0;

+			goto err;

+			}

+		capi_dump_cert(ctx, out, cert);

+		CertFreeCertificateContext(cert);

+		}

+	else

+		{

+		for(idx = 0;;idx++)

+			{

+			LPWSTR fname = NULL;

+			cert = CertEnumCertificatesInStore(hstore, cert);

+			if (!cert)

+				break;

+			BIO_printf(out, "Certificate %d\n", idx);

+			capi_dump_cert(ctx, out, cert);

+			}

+		}

+	err:

+	CertCloseStore(hstore, 0);

+	return ret;

+	}

+

+static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore)

+	{

+	PCCERT_CONTEXT cert = NULL;

+	char *fname = NULL;

+	int match;

+	switch(ctx->lookup_method)

+		{

+		case CAPI_LU_SUBSTR:

+			return CertFindCertificateInStore(hstore,

+					X509_ASN_ENCODING, 0,

+					CERT_FIND_SUBJECT_STR_A, id, NULL);

+		case CAPI_LU_FNAME:

+			for(;;)

+				{

+				cert = CertEnumCertificatesInStore(hstore, cert);

+				if (!cert)

+					return NULL;

+				fname = capi_cert_get_fname(ctx, cert);

+				if (fname)

+					{

+					if (strcmp(fname, id))

+						match = 0;

+					else

+						match = 1;

+					OPENSSL_free(fname);

+					if (match)

+						return cert;

+					}

+				}

+		default:

+			return NULL;

+		}

+	}

+

+static CAPI_KEY *capi_get_key(CAPI_CTX *ctx, const char *contname, char *provname, DWORD ptype, DWORD keyspec)

+	{

+	CAPI_KEY *key;

+	key = OPENSSL_malloc(sizeof(CAPI_KEY));

+	CAPI_trace(ctx, "capi_get_key, contname=%s, provname=%s, type=%d\n", 

+						contname, provname, ptype);

+	if (!CryptAcquireContextA(&key->hprov, contname, provname, ptype, 0))

+		{

+		CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);

+		capi_addlasterror();

+		goto err;

+		}

+	if (!CryptGetUserKey(key->hprov, keyspec, &key->key))

+		{

+		CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_GETUSERKEY_ERROR);

+		capi_addlasterror();

+		CryptReleaseContext(key->hprov, 0);

+		goto err;

+		}

+	key->keyspec = keyspec;

+	key->pcert = NULL;

+	return key;

+

+	err:

+	OPENSSL_free(key);

+	return NULL;

+	}

+

+static CAPI_KEY *capi_get_cert_key(CAPI_CTX *ctx, PCCERT_CONTEXT cert)

+	{

+	CAPI_KEY *key = NULL;

+	CRYPT_KEY_PROV_INFO *pinfo = NULL;

+	char *provname = NULL, *contname = NULL;

+	pinfo = capi_get_prov_info(ctx, cert);

+	if (!pinfo)

+		goto err;

+	provname = wide_to_asc(pinfo->pwszProvName);

+	contname = wide_to_asc(pinfo->pwszContainerName);

+	if (!provname || !contname)

+		goto err;

+	key = capi_get_key(ctx, contname, provname,

+				pinfo->dwProvType, pinfo->dwKeySpec);

+

+	err:

+	if (pinfo)

+		OPENSSL_free(pinfo);

+	if (provname)

+		OPENSSL_free(provname);

+	if (contname)

+		OPENSSL_free(contname);

+	return key;

+	}

+

+CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id)

+	{

+	PCCERT_CONTEXT cert;

+	HCERTSTORE hstore;

+	CAPI_KEY *key = NULL;

+	switch (ctx->lookup_method)

+		{

+		case CAPI_LU_SUBSTR:

+		case CAPI_LU_FNAME:

+		hstore = capi_open_store(ctx, NULL);

+		if (!hstore)

+			return NULL;

+		cert = capi_find_cert(ctx, id, hstore);

+		if (cert)

+			{

+			key = capi_get_cert_key(ctx, cert);

+			CertFreeCertificateContext(cert);

+			}

+		CertCloseStore(hstore, 0);

+		break;

+

+		case CAPI_LU_CONTNAME:

+		key = capi_get_key(ctx, id, ctx->cspname, ctx->csptype,

+							ctx->keytype);

+		break;

+		}

+

+	return key;

+	}

+

+void capi_free_key(CAPI_KEY *key)

+	{

+	if (!key)

+		return;

+	CryptDestroyKey(key->key);

+	CryptReleaseContext(key->hprov, 0);

+	if (key->pcert)

+		CertFreeCertificateContext(key->pcert);

+	OPENSSL_free(key);

+	}

+

+

+/* Initialize a CAPI_CTX structure */

+

+static CAPI_CTX *capi_ctx_new()

+	{

+	CAPI_CTX *ctx;

+	ctx = OPENSSL_malloc(sizeof(CAPI_CTX));

+	if (!ctx)

+		{

+		CAPIerr(CAPI_F_CAPI_CTX_NEW, ERR_R_MALLOC_FAILURE);

+		return NULL;

+		}

+	ctx->cspname = NULL;

+	ctx->csptype = PROV_RSA_FULL;

+	ctx->dump_flags = CAPI_DMP_SUMMARY|CAPI_DMP_FNAME;

+	ctx->keytype = AT_KEYEXCHANGE;

+	ctx->storename = NULL;

+	ctx->ssl_client_store = NULL;

+	ctx->store_flags = CERT_STORE_OPEN_EXISTING_FLAG |

+				CERT_STORE_READONLY_FLAG |

+				CERT_SYSTEM_STORE_CURRENT_USER;

+	ctx->lookup_method = CAPI_LU_SUBSTR;

+	ctx->debug_level = 0;

+	ctx->debug_file = NULL;

+	ctx->client_cert_select = cert_select_simple;

+	return ctx;

+	}

+

+static void capi_ctx_free(CAPI_CTX *ctx)

+	{

+	CAPI_trace(ctx, "Calling capi_ctx_free with %lx\n", ctx);

+	if (!ctx)

+		return;

+	if (ctx->cspname)

+		OPENSSL_free(ctx->cspname);

+	if (ctx->debug_file)

+		OPENSSL_free(ctx->debug_file);

+	if (ctx->storename)

+		OPENSSL_free(ctx->storename);

+	if (ctx->ssl_client_store)

+		OPENSSL_free(ctx->ssl_client_store);

+	OPENSSL_free(ctx);

+	}

+

+static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check)

+	{

+	CAPI_trace(ctx, "capi_ctx_set_provname, name=%s, type=%d\n", pname, type);

+	if (check)

+		{

+		HCRYPTPROV hprov;

+		if (!CryptAcquireContextA(&hprov, NULL, pname, type,

+						CRYPT_VERIFYCONTEXT))

+			{

+			CAPIerr(CAPI_F_CAPI_CTX_SET_PROVNAME, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);

+			capi_addlasterror();

+			return 0;

+			}

+		CryptReleaseContext(hprov, 0);

+		}

+	ctx->cspname = BUF_strdup(pname);

+	ctx->csptype = type;

+	return 1;

+	}

+

+static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx)

+	{

+	LPSTR pname;

+	DWORD type;

+	if (capi_get_provname(ctx, &pname, &type, idx) != 1)

+		return 0;

+	return capi_ctx_set_provname(ctx, pname, type, 0);

+	}

+

+static int cert_issuer_match(STACK_OF(X509_NAME) *ca_dn, X509 *x)

+	{

+	int i;

+	X509_NAME *nm;

+	/* Special case: empty list: match anything */

+	if (sk_X509_NAME_num(ca_dn) <= 0)

+		return 1;

+	for (i = 0; i < sk_X509_NAME_num(ca_dn); i++)

+		{

+		nm = sk_X509_NAME_value(ca_dn, i);

+		if (!X509_NAME_cmp(nm, X509_get_issuer_name(x)))

+				return 1;

+		}

+	return 0;

+	}

+

+

+

+static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,

+	STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,

+	STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data)

+	{

+	STACK_OF(X509) *certs = NULL;

+	X509 *x;

+	char *storename;

+	const char *p;

+	int i, client_cert_idx;

+	HCERTSTORE hstore;

+	PCCERT_CONTEXT cert = NULL, excert = NULL;

+	CAPI_CTX *ctx;

+	CAPI_KEY *key;

+	ctx = ENGINE_get_ex_data(e, capi_idx);

+

+	*pcert = NULL;

+	*pkey = NULL;

+

+	storename = ctx->ssl_client_store;

+	if (!storename)

+		storename = "MY";

+

+	hstore = capi_open_store(ctx, storename);

+	if (!hstore)

+		return 0;

+	/* Enumerate all certificates collect any matches */

+	for(i = 0;;i++)

+		{

+		cert = CertEnumCertificatesInStore(hstore, cert);

+		if (!cert)

+			break;

+		p = cert->pbCertEncoded;

+		x = d2i_X509(NULL, &p, cert->cbCertEncoded);

+		if (!x)

+			{

+			CAPI_trace(ctx, "Can't Parse Certificate %d\n", i);

+			continue;

+			}

+		if (cert_issuer_match(ca_dn, x)

+			&& X509_check_purpose(x, X509_PURPOSE_SSL_CLIENT, 0))

+			{

+			key = capi_get_cert_key(ctx, cert);

+			if (!key)

+				{

+				X509_free(x);

+				continue;

+				}

+			/* Match found: attach extra data to it so

+			 * we can retrieve the key later.

+			 */

+			excert = CertDuplicateCertificateContext(cert);

+			key->pcert = excert;

+			X509_set_ex_data(x, cert_capi_idx, key);

+

+			if (!certs)

+				certs = sk_X509_new_null();

+

+			sk_X509_push(certs, x);

+			}

+		else

+			X509_free(x);

+

+		}

+

+	if (cert)

+		CertFreeCertificateContext(cert);

+	if (hstore)

+		CertCloseStore(hstore, 0);

+

+	if (!certs)

+		return 0;

+

+

+	/* Select the appropriate certificate */

+

+	client_cert_idx = ctx->client_cert_select(e, ssl, certs);

+

+	/* Set the selected certificate and free the rest */

+

+	for(i = 0; i < sk_X509_num(certs); i++)

+		{

+		x = sk_X509_value(certs, i);

+		if (i == client_cert_idx)

+			*pcert = x;

+		else

+			{

+			key = X509_get_ex_data(x, cert_capi_idx);

+			capi_free_key(key);

+			X509_free(x);

+			}

+		}

+

+	sk_X509_free(certs);

+

+	if (!*pcert)

+		return 0;

+

+	/* Setup key for selected certificate */

+

+	key = X509_get_ex_data(*pcert, cert_capi_idx);

+	*pkey = capi_get_pkey(e, key);

+	X509_set_ex_data(*pcert, cert_capi_idx, NULL);

+

+	return 1;

+

+	}

+

+

+/* Simple client cert selection function: always select first */

+

+static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)

+	{

+	return 0;

+	}

+

+#ifdef OPENSSL_CAPIENG_DIALOG

+

+/* More complex cert selection function, using standard function

+ * CryptUIDlgSelectCertificateFromStore() to produce a dialog box.

+ */

+

+/* Definitions which are in cryptuiapi.h but this is not present in older

+ * versions of headers.

+ */

+

+#ifndef CRYPTUI_SELECT_LOCATION_COLUMN

+#define CRYPTUI_SELECT_LOCATION_COLUMN                   0x000000010

+#define CRYPTUI_SELECT_INTENDEDUSE_COLUMN                0x000000004

+#endif

+

+#define dlg_title L"OpenSSL Application SSL Client Certificate Selection"

+#define dlg_prompt L"Select a certificate to use for authentication"

+#define dlg_columns	 CRYPTUI_SELECT_LOCATION_COLUMN \

+			|CRYPTUI_SELECT_INTENDEDUSE_COLUMN

+

+static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)

+	{

+	X509 *x;

+	HCERTSTORE dstore;

+	PCCERT_CONTEXT cert;

+	CAPI_CTX *ctx;

+	CAPI_KEY *key;

+	HWND hwnd;

+	int i, idx = -1;

+	if (sk_X509_num(certs) == 1)

+		return 0;

+	ctx = ENGINE_get_ex_data(e, capi_idx);

+	/* Create an in memory store of certificates */

+	dstore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,

+					CERT_STORE_CREATE_NEW_FLAG, NULL);

+	if (!dstore)

+		{

+		CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_CREATING_STORE);

+		capi_addlasterror();

+		goto err;

+		}

+	/* Add all certificates to store */

+	for(i = 0; i < sk_X509_num(certs); i++)

+		{

+		x = sk_X509_value(certs, i);

+		key = X509_get_ex_data(x, cert_capi_idx);

+

+		if (!CertAddCertificateContextToStore(dstore, key->pcert,

+						CERT_STORE_ADD_NEW, NULL))

+			{

+			CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_ADDING_CERT);

+			capi_addlasterror();

+			goto err;

+			}

+

+		}

+	hwnd = GetForegroundWindow();

+	if (!hwnd)

+		hwnd = GetActiveWindow();

+	if (!hwnd && ctx->getconswindow)

+		hwnd = ctx->getconswindow();

+	/* Call dialog to select one */

+	cert = ctx->certselectdlg(dstore, hwnd, dlg_title, dlg_prompt,

+						dlg_columns, 0, NULL);

+

+	/* Find matching cert from list */

+	if (cert)

+		{

+		for(i = 0; i < sk_X509_num(certs); i++)

+			{

+			x = sk_X509_value(certs, i);

+			key = X509_get_ex_data(x, cert_capi_idx);

+			if (CertCompareCertificate(

+				X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,

+					cert->pCertInfo,

+					key->pcert->pCertInfo))

+				{

+				idx = i;

+				break;

+				}

+			}

+		}

+

+	err:

+	if (dstore)

+		CertCloseStore(dstore, 0);

+	return idx;

+

+	}

+#endif

+

+#else /* !__COMPILE_CAPIENG */

+#include <openssl/engine.h>

+#ifndef OPENSSL_NO_DYNAMIC_ENGINE

+OPENSSL_EXPORT

+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);

+OPENSSL_EXPORT

+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }

+IMPLEMENT_DYNAMIC_CHECK_FN()

+#else

+void ENGINE_load_capi(void){}

+#endif

+#endif

diff --git a/openssl/engines/e_gmp.c b/openssl/engines/e_gmp.c
index c1f5601b6..63d68b0c2 100644
--- a/openssl/engines/e_gmp.c
+++ b/openssl/engines/e_gmp.c
@@ -1,478 +1,480 @@
-/* crypto/engine/e_gmp.c */
-/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
- * project 2003.
- */
-/* ====================================================================
- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer. 
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-/* This engine is not (currently) compiled in by default. Do enable it,
- * reconfigure OpenSSL with "enable-gmp -lgmp". The GMP libraries and
- * headers must reside in one of the paths searched by the compiler/linker,
- * otherwise paths must be specified - eg. try configuring with
- * "enable-gmp -I<includepath> -L<libpath> -lgmp". YMMV. */
-
-/* As for what this does - it's a largely unoptimised implementation of an
- * ENGINE that uses the GMP library to perform RSA private key operations. To
- * obtain more information about what "unoptimised" means, see my original mail
- * on the subject (though ignore the build instructions which have since
- * changed);
- *
- *    http://www.mail-archive.com/openssl-dev@openssl.org/msg12227.html
- *
- * On my athlon system at least, it appears the builtin OpenSSL code is now
- * slightly faster, which is to say that the RSA-related MPI performance
- * between OpenSSL's BIGNUM and GMP's mpz implementations is probably pretty
- * balanced for this chip, and so the performance degradation in this ENGINE by
- * having to convert to/from GMP formats (and not being able to cache
- * montgomery forms) is probably the difference. However, if some unconfirmed
- * reports from users is anything to go by, the situation on some other
- * chipsets might be a good deal more favourable to the GMP version (eg. PPC).
- * Feedback welcome. */
-
-#include <stdio.h>
-#include <string.h>
-#include <openssl/crypto.h>
-#include <openssl/buffer.h>
-#include <openssl/engine.h>
-#ifndef OPENSSL_NO_RSA
-#include <openssl/rsa.h>
-#endif
-#include <openssl/bn.h>
-
-#ifndef OPENSSL_NO_HW
-#ifndef OPENSSL_NO_GMP
-
-#include <gmp.h>
-
-#define E_GMP_LIB_NAME "gmp engine"
-#include "e_gmp_err.c"
-
-static int e_gmp_destroy(ENGINE *e);
-static int e_gmp_init(ENGINE *e);
-static int e_gmp_finish(ENGINE *e);
-static int e_gmp_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void)); 
-
-#ifndef OPENSSL_NO_RSA
-/* RSA stuff */
-static int e_gmp_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
-static int e_gmp_rsa_finish(RSA *r);
-#endif
-
-/* The definitions for control commands specific to this engine */
-/* #define E_GMP_CMD_SO_PATH		ENGINE_CMD_BASE */
-static const ENGINE_CMD_DEFN e_gmp_cmd_defns[] = {
-#if 0
-	{E_GMP_CMD_SO_PATH,
-		"SO_PATH",
-		"Specifies the path to the 'e_gmp' shared library",
-		ENGINE_CMD_FLAG_STRING},
-#endif
-	{0, NULL, NULL, 0}
-	};
-
-#ifndef OPENSSL_NO_RSA
-/* Our internal RSA_METHOD that we provide pointers to */
-static RSA_METHOD e_gmp_rsa =
-	{
-	"GMP RSA method",
-	NULL,
-	NULL,
-	NULL,
-	NULL,
-	e_gmp_rsa_mod_exp,
-	NULL,
-	NULL,
-	e_gmp_rsa_finish,
-	/* These flags initialise montgomery crud that GMP ignores, however it
-	 * makes sure the public key ops (which are done in openssl) don't seem
-	 * *slower* than usual :-) */
-	RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE,
-	NULL,
-	NULL,
-	NULL
-	};
-#endif
-
-/* Constants used when creating the ENGINE */
-static const char *engine_e_gmp_id = "gmp";
-static const char *engine_e_gmp_name = "GMP engine support";
-
-/* This internal function is used by ENGINE_gmp() and possibly by the
- * "dynamic" ENGINE support too */
-static int bind_helper(ENGINE *e)
-	{
-#ifndef OPENSSL_NO_RSA
-	const RSA_METHOD *meth1;
-#endif
-	if(!ENGINE_set_id(e, engine_e_gmp_id) ||
-			!ENGINE_set_name(e, engine_e_gmp_name) ||
-#ifndef OPENSSL_NO_RSA
-			!ENGINE_set_RSA(e, &e_gmp_rsa) ||
-#endif
-			!ENGINE_set_destroy_function(e, e_gmp_destroy) ||
-			!ENGINE_set_init_function(e, e_gmp_init) ||
-			!ENGINE_set_finish_function(e, e_gmp_finish) ||
-			!ENGINE_set_ctrl_function(e, e_gmp_ctrl) ||
-			!ENGINE_set_cmd_defns(e, e_gmp_cmd_defns))
-		return 0;
-
-#ifndef OPENSSL_NO_RSA
-	meth1 = RSA_PKCS1_SSLeay();
-	e_gmp_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
-	e_gmp_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
-	e_gmp_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
-	e_gmp_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
-	e_gmp_rsa.bn_mod_exp = meth1->bn_mod_exp;
-#endif
-
-	/* Ensure the e_gmp error handling is set up */
-	ERR_load_GMP_strings();
-	return 1;
-	}
-
-static ENGINE *engine_gmp(void)
-	{
-	ENGINE *ret = ENGINE_new();
-	if(!ret)
-		return NULL;
-	if(!bind_helper(ret))
-		{
-		ENGINE_free(ret);
-		return NULL;
-		}
-	return ret;
-	}
-
-void ENGINE_load_gmp(void)
-	{
-	/* Copied from eng_[openssl|dyn].c */
-	ENGINE *toadd = engine_gmp();
-	if(!toadd) return;
-	ENGINE_add(toadd);
-	ENGINE_free(toadd);
-	ERR_clear_error();
-	}
-
-#ifndef OPENSSL_NO_RSA
-/* Used to attach our own key-data to an RSA structure */
-static int hndidx_rsa = -1;
-#endif
-
-static int e_gmp_destroy(ENGINE *e)
-	{
-	ERR_unload_GMP_strings();
-	return 1;
-	}
-
-/* (de)initialisation functions. */
-static int e_gmp_init(ENGINE *e)
-	{
-#ifndef OPENSSL_NO_RSA
-	if (hndidx_rsa == -1)
-		hndidx_rsa = RSA_get_ex_new_index(0,
-			"GMP-based RSA key handle",
-			NULL, NULL, NULL);
-#endif
-	if (hndidx_rsa == -1)
-		return 0;
-	return 1;
-	}
-
-static int e_gmp_finish(ENGINE *e)
-	{
-	return 1;
-	}
-
-static int e_gmp_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
-	{
-	int to_return = 1;
-
-	switch(cmd)
-		{
-#if 0
-	case E_GMP_CMD_SO_PATH:
-		/* ... */
-#endif
-	/* The command isn't understood by this engine */
-	default:
-		GMPerr(GMP_F_E_GMP_CTRL,
-			GMP_R_CTRL_COMMAND_NOT_IMPLEMENTED);
-		to_return = 0;
-		break;
-		}
-
-	return to_return;
-	}
-
-
-/* Most often limb sizes will be the same. If not, we use hex conversion
- * which is neat, but extremely inefficient. */
-static int bn2gmp(const BIGNUM *bn, mpz_t g)
-	{
-	bn_check_top(bn);
-	if(((sizeof(bn->d[0]) * 8) == GMP_NUMB_BITS) &&
-			(BN_BITS2 == GMP_NUMB_BITS)) 
-		{
-		/* The common case */
-		if(!_mpz_realloc (g, bn->top))
-			return 0;
-		memcpy(&g->_mp_d[0], &bn->d[0], bn->top * sizeof(bn->d[0]));
-		g->_mp_size = bn->top;
-		if(bn->neg)
-			g->_mp_size = -g->_mp_size;
-		return 1;
-		}
-	else
-		{
-		int toret;
-		char *tmpchar = BN_bn2hex(bn);
-		if(!tmpchar) return 0;
-		toret = (mpz_set_str(g, tmpchar, 16) == 0 ? 1 : 0);
-		OPENSSL_free(tmpchar);
-		return toret;
-		}
-	}
-
-static int gmp2bn(mpz_t g, BIGNUM *bn)
-	{
-	if(((sizeof(bn->d[0]) * 8) == GMP_NUMB_BITS) &&
-			(BN_BITS2 == GMP_NUMB_BITS))
-		{
-		/* The common case */
-		int s = (g->_mp_size >= 0) ? g->_mp_size : -g->_mp_size;
-		BN_zero(bn);
-		if(bn_expand2 (bn, s) == NULL)
-			return 0;
-		bn->top = s;
-		memcpy(&bn->d[0], &g->_mp_d[0], s * sizeof(bn->d[0]));
-		bn_correct_top(bn);
-		bn->neg = g->_mp_size >= 0 ? 0 : 1;
-		return 1;
-		}
-	else
-		{
-		int toret;
-		char *tmpchar = OPENSSL_malloc(mpz_sizeinbase(g, 16) + 10);
-		if(!tmpchar) return 0;
-		mpz_get_str(tmpchar, 16, g);
-		toret = BN_hex2bn(&bn, tmpchar);
-		OPENSSL_free(tmpchar);
-		return toret;
-		}
-	}
-
-#ifndef OPENSSL_NO_RSA 
-typedef struct st_e_gmp_rsa_ctx
-	{
-	int public_only;
-	mpz_t n;
-	mpz_t d;
-	mpz_t e;
-	mpz_t p;
-	mpz_t q;
-	mpz_t dmp1;
-	mpz_t dmq1;
-	mpz_t iqmp;
-	mpz_t r0, r1, I0, m1;
-	} E_GMP_RSA_CTX;
-
-static E_GMP_RSA_CTX *e_gmp_get_rsa(RSA *rsa)
-	{
-	E_GMP_RSA_CTX *hptr = RSA_get_ex_data(rsa, hndidx_rsa);
-	if(hptr) return hptr;
-	hptr = OPENSSL_malloc(sizeof(E_GMP_RSA_CTX));
-	if(!hptr) return NULL;
-	/* These inits could probably be replaced by more intelligent
-	 * mpz_init2() versions, to reduce malloc-thrashing. */
-	mpz_init(hptr->n);
-	mpz_init(hptr->d);
-	mpz_init(hptr->e);
-	mpz_init(hptr->p);
-	mpz_init(hptr->q);
-	mpz_init(hptr->dmp1);
-	mpz_init(hptr->dmq1);
-	mpz_init(hptr->iqmp);
-	mpz_init(hptr->r0);
-	mpz_init(hptr->r1);
-	mpz_init(hptr->I0);
-	mpz_init(hptr->m1);
-	if(!bn2gmp(rsa->n, hptr->n) || !bn2gmp(rsa->e, hptr->e))
-		goto err;
-	if(!rsa->p || !rsa->q || !rsa->d || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
-		{
-		hptr->public_only = 1;
-		return hptr;
-		}
-	if(!bn2gmp(rsa->d, hptr->d) || !bn2gmp(rsa->p, hptr->p) ||
-			!bn2gmp(rsa->q, hptr->q) || !bn2gmp(rsa->dmp1, hptr->dmp1) ||
-			!bn2gmp(rsa->dmq1, hptr->dmq1) || !bn2gmp(rsa->iqmp, hptr->iqmp))
-		goto err;
-	hptr->public_only = 0;
-	RSA_set_ex_data(rsa, hndidx_rsa, hptr);
-	return hptr;
-err:
-	mpz_clear(hptr->n);
-	mpz_clear(hptr->d);
-	mpz_clear(hptr->e);
-	mpz_clear(hptr->p);
-	mpz_clear(hptr->q);
-	mpz_clear(hptr->dmp1);
-	mpz_clear(hptr->dmq1);
-	mpz_clear(hptr->iqmp);
-	mpz_clear(hptr->r0);
-	mpz_clear(hptr->r1);
-	mpz_clear(hptr->I0);
-	mpz_clear(hptr->m1);
-	OPENSSL_free(hptr);
-	return NULL;
-	}
-
-static int e_gmp_rsa_finish(RSA *rsa)
-	{
-	E_GMP_RSA_CTX *hptr = RSA_get_ex_data(rsa, hndidx_rsa);
-	if(!hptr) return 0;
-	mpz_clear(hptr->n);
-	mpz_clear(hptr->d);
-	mpz_clear(hptr->e);
-	mpz_clear(hptr->p);
-	mpz_clear(hptr->q);
-	mpz_clear(hptr->dmp1);
-	mpz_clear(hptr->dmq1);
-	mpz_clear(hptr->iqmp);
-	mpz_clear(hptr->r0);
-	mpz_clear(hptr->r1);
-	mpz_clear(hptr->I0);
-	mpz_clear(hptr->m1);
-	OPENSSL_free(hptr);
-	RSA_set_ex_data(rsa, hndidx_rsa, NULL);
-	return 1;
-	}
-
-static int e_gmp_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
-	{
-	E_GMP_RSA_CTX *hptr;
-	int to_return = 0;
-
-	hptr = e_gmp_get_rsa(rsa);
-	if(!hptr)
-		{
-		GMPerr(GMP_F_E_GMP_RSA_MOD_EXP,
-				GMP_R_KEY_CONTEXT_ERROR);
-		return 0;
-		}
-	if(hptr->public_only)
-		{
-		GMPerr(GMP_F_E_GMP_RSA_MOD_EXP,
-				GMP_R_MISSING_KEY_COMPONENTS);
-		return 0;
-		}
-
-	/* ugh!!! */
-	if(!bn2gmp(I, hptr->I0))
-		return 0;
-
-	/* This is basically the CRT logic in crypto/rsa/rsa_eay.c reworded into
-	 * GMP-speak. It may be that GMP's API facilitates cleaner formulations
-	 * of this stuff, eg. better handling of negatives, or functions that
-	 * combine operations. */
-
-	mpz_mod(hptr->r1, hptr->I0, hptr->q);
-	mpz_powm(hptr->m1, hptr->r1, hptr->dmq1, hptr->q);
-
-	mpz_mod(hptr->r1, hptr->I0, hptr->p);
-	mpz_powm(hptr->r0, hptr->r1, hptr->dmp1, hptr->p);
-
-	mpz_sub(hptr->r0, hptr->r0, hptr->m1);
-
-	if(mpz_sgn(hptr->r0) < 0)
-		mpz_add(hptr->r0, hptr->r0, hptr->p);
-	mpz_mul(hptr->r1, hptr->r0, hptr->iqmp);
-	mpz_mod(hptr->r0, hptr->r1, hptr->p);
-
-	if(mpz_sgn(hptr->r0) < 0)
-		mpz_add(hptr->r0, hptr->r0, hptr->p);
-	mpz_mul(hptr->r1, hptr->r0, hptr->q);
-	mpz_add(hptr->r0, hptr->r1, hptr->m1);
-
-	/* ugh!!! */
-	if(gmp2bn(hptr->r0, r))
-		to_return = 1;
-
-	return 1;
-	}
-#endif
-
-#endif /* !OPENSSL_NO_GMP */
-
-/* This stuff is needed if this ENGINE is being compiled into a self-contained
- * shared-library. */	   
-#ifndef OPENSSL_NO_DYNAMIC_ENGINE
-IMPLEMENT_DYNAMIC_CHECK_FN()
-#ifndef OPENSSL_NO_GMP
-static int bind_fn(ENGINE *e, const char *id)
-	{
-	if(id && (strcmp(id, engine_e_gmp_id) != 0))
-		return 0;
-	if(!bind_helper(e))
-		return 0;
-	return 1;
-	}       
-IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
-#else
-OPENSSL_EXPORT
-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }
-#endif
-#endif /* !OPENSSL_NO_DYNAMIC_ENGINE */
-
-#endif /* !OPENSSL_NO_HW */
+/* crypto/engine/e_gmp.c */

+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL

+ * project 2003.

+ */

+/* ====================================================================

+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ *

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer. 

+ *

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in

+ *    the documentation and/or other materials provided with the

+ *    distribution.

+ *

+ * 3. All advertising materials mentioning features or use of this

+ *    software must display the following acknowledgment:

+ *    "This product includes software developed by the OpenSSL Project

+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

+ *

+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

+ *    endorse or promote products derived from this software without

+ *    prior written permission. For written permission, please contact

+ *    licensing@OpenSSL.org.

+ *

+ * 5. Products derived from this software may not be called "OpenSSL"

+ *    nor may "OpenSSL" appear in their names without prior written

+ *    permission of the OpenSSL Project.

+ *

+ * 6. Redistributions of any form whatsoever must retain the following

+ *    acknowledgment:

+ *    "This product includes software developed by the OpenSSL Project

+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

+ * OF THE POSSIBILITY OF SUCH DAMAGE.

+ * ====================================================================

+ *

+ * This product includes cryptographic software written by Eric Young

+ * (eay@cryptsoft.com).  This product includes software written by Tim

+ * Hudson (tjh@cryptsoft.com).

+ *

+ */

+

+/* This engine is not (currently) compiled in by default. Do enable it,

+ * reconfigure OpenSSL with "enable-gmp -lgmp". The GMP libraries and

+ * headers must reside in one of the paths searched by the compiler/linker,

+ * otherwise paths must be specified - eg. try configuring with

+ * "enable-gmp -I<includepath> -L<libpath> -lgmp". YMMV. */

+

+/* As for what this does - it's a largely unoptimised implementation of an

+ * ENGINE that uses the GMP library to perform RSA private key operations. To

+ * obtain more information about what "unoptimised" means, see my original mail

+ * on the subject (though ignore the build instructions which have since

+ * changed);

+ *

+ *    http://www.mail-archive.com/openssl-dev@openssl.org/msg12227.html

+ *

+ * On my athlon system at least, it appears the builtin OpenSSL code is now

+ * slightly faster, which is to say that the RSA-related MPI performance

+ * between OpenSSL's BIGNUM and GMP's mpz implementations is probably pretty

+ * balanced for this chip, and so the performance degradation in this ENGINE by

+ * having to convert to/from GMP formats (and not being able to cache

+ * montgomery forms) is probably the difference. However, if some unconfirmed

+ * reports from users is anything to go by, the situation on some other

+ * chipsets might be a good deal more favourable to the GMP version (eg. PPC).

+ * Feedback welcome. */

+

+#include <stdio.h>

+#include <string.h>

+#include <openssl/crypto.h>

+#include <openssl/buffer.h>

+#include <openssl/engine.h>

+#ifndef OPENSSL_NO_RSA

+#include <openssl/rsa.h>

+#endif

+#include <openssl/bn.h>

+

+#ifndef OPENSSL_NO_HW

+#ifndef OPENSSL_NO_GMP

+

+#include <gmp.h>

+

+#define E_GMP_LIB_NAME "gmp engine"

+#include "e_gmp_err.c"

+

+static int e_gmp_destroy(ENGINE *e);

+static int e_gmp_init(ENGINE *e);

+static int e_gmp_finish(ENGINE *e);

+static int e_gmp_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void)); 

+

+#ifndef OPENSSL_NO_RSA

+/* RSA stuff */

+static int e_gmp_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);

+static int e_gmp_rsa_finish(RSA *r);

+#endif

+

+/* The definitions for control commands specific to this engine */

+/* #define E_GMP_CMD_SO_PATH		ENGINE_CMD_BASE */

+static const ENGINE_CMD_DEFN e_gmp_cmd_defns[] = {

+#if 0

+	{E_GMP_CMD_SO_PATH,

+		"SO_PATH",

+		"Specifies the path to the 'e_gmp' shared library",

+		ENGINE_CMD_FLAG_STRING},

+#endif

+	{0, NULL, NULL, 0}

+	};

+

+#ifndef OPENSSL_NO_RSA

+/* Our internal RSA_METHOD that we provide pointers to */

+static RSA_METHOD e_gmp_rsa =

+	{

+	"GMP RSA method",

+	NULL,

+	NULL,

+	NULL,

+	NULL,

+	e_gmp_rsa_mod_exp,

+	NULL,

+	NULL,

+	e_gmp_rsa_finish,

+	/* These flags initialise montgomery crud that GMP ignores, however it

+	 * makes sure the public key ops (which are done in openssl) don't seem

+	 * *slower* than usual :-) */

+	RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE,

+	NULL,

+	NULL,

+	NULL

+	};

+#endif

+

+/* Constants used when creating the ENGINE */

+static const char *engine_e_gmp_id = "gmp";

+static const char *engine_e_gmp_name = "GMP engine support";

+

+/* This internal function is used by ENGINE_gmp() and possibly by the

+ * "dynamic" ENGINE support too */

+static int bind_helper(ENGINE *e)

+	{

+#ifndef OPENSSL_NO_RSA

+	const RSA_METHOD *meth1;

+#endif

+	if(!ENGINE_set_id(e, engine_e_gmp_id) ||

+			!ENGINE_set_name(e, engine_e_gmp_name) ||

+#ifndef OPENSSL_NO_RSA

+			!ENGINE_set_RSA(e, &e_gmp_rsa) ||

+#endif

+			!ENGINE_set_destroy_function(e, e_gmp_destroy) ||

+			!ENGINE_set_init_function(e, e_gmp_init) ||

+			!ENGINE_set_finish_function(e, e_gmp_finish) ||

+			!ENGINE_set_ctrl_function(e, e_gmp_ctrl) ||

+			!ENGINE_set_cmd_defns(e, e_gmp_cmd_defns))

+		return 0;

+

+#ifndef OPENSSL_NO_RSA

+	meth1 = RSA_PKCS1_SSLeay();

+	e_gmp_rsa.rsa_pub_enc = meth1->rsa_pub_enc;

+	e_gmp_rsa.rsa_pub_dec = meth1->rsa_pub_dec;

+	e_gmp_rsa.rsa_priv_enc = meth1->rsa_priv_enc;

+	e_gmp_rsa.rsa_priv_dec = meth1->rsa_priv_dec;

+	e_gmp_rsa.bn_mod_exp = meth1->bn_mod_exp;

+#endif

+

+	/* Ensure the e_gmp error handling is set up */

+	ERR_load_GMP_strings();

+	return 1;

+	}

+

+static ENGINE *engine_gmp(void)

+	{

+	ENGINE *ret = ENGINE_new();

+	if(!ret)

+		return NULL;

+	if(!bind_helper(ret))

+		{

+		ENGINE_free(ret);

+		return NULL;

+		}

+	return ret;

+	}

+

+void ENGINE_load_gmp(void)

+	{

+	/* Copied from eng_[openssl|dyn].c */

+	ENGINE *toadd = engine_gmp();

+	if(!toadd) return;

+	ENGINE_add(toadd);

+	ENGINE_free(toadd);

+	ERR_clear_error();

+	}

+

+#ifndef OPENSSL_NO_RSA

+/* Used to attach our own key-data to an RSA structure */

+static int hndidx_rsa = -1;

+#endif

+

+static int e_gmp_destroy(ENGINE *e)

+	{

+	ERR_unload_GMP_strings();

+	return 1;

+	}

+

+/* (de)initialisation functions. */

+static int e_gmp_init(ENGINE *e)

+	{

+#ifndef OPENSSL_NO_RSA

+	if (hndidx_rsa == -1)

+		hndidx_rsa = RSA_get_ex_new_index(0,

+			"GMP-based RSA key handle",

+			NULL, NULL, NULL);

+#endif

+	if (hndidx_rsa == -1)

+		return 0;

+	return 1;

+	}

+

+static int e_gmp_finish(ENGINE *e)

+	{

+	return 1;

+	}

+

+static int e_gmp_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))

+	{

+	int to_return = 1;

+

+	switch(cmd)

+		{

+#if 0

+	case E_GMP_CMD_SO_PATH:

+		/* ... */

+#endif

+	/* The command isn't understood by this engine */

+	default:

+		GMPerr(GMP_F_E_GMP_CTRL,

+			GMP_R_CTRL_COMMAND_NOT_IMPLEMENTED);

+		to_return = 0;

+		break;

+		}

+

+	return to_return;

+	}

+

+

+/* Most often limb sizes will be the same. If not, we use hex conversion

+ * which is neat, but extremely inefficient. */

+static int bn2gmp(const BIGNUM *bn, mpz_t g)

+	{

+	bn_check_top(bn);

+	if(((sizeof(bn->d[0]) * 8) == GMP_NUMB_BITS) &&

+			(BN_BITS2 == GMP_NUMB_BITS)) 

+		{

+		/* The common case */

+		if(!_mpz_realloc (g, bn->top))

+			return 0;

+		memcpy(&g->_mp_d[0], &bn->d[0], bn->top * sizeof(bn->d[0]));

+		g->_mp_size = bn->top;

+		if(bn->neg)

+			g->_mp_size = -g->_mp_size;

+		return 1;

+		}

+	else

+		{

+		int toret;

+		char *tmpchar = BN_bn2hex(bn);

+		if(!tmpchar) return 0;

+		toret = (mpz_set_str(g, tmpchar, 16) == 0 ? 1 : 0);

+		OPENSSL_free(tmpchar);

+		return toret;

+		}

+	}

+

+static int gmp2bn(mpz_t g, BIGNUM *bn)

+	{

+	if(((sizeof(bn->d[0]) * 8) == GMP_NUMB_BITS) &&

+			(BN_BITS2 == GMP_NUMB_BITS))

+		{

+		/* The common case */

+		int s = (g->_mp_size >= 0) ? g->_mp_size : -g->_mp_size;

+		BN_zero(bn);

+		if(bn_expand2 (bn, s) == NULL)

+			return 0;

+		bn->top = s;

+		memcpy(&bn->d[0], &g->_mp_d[0], s * sizeof(bn->d[0]));

+		bn_correct_top(bn);

+		bn->neg = g->_mp_size >= 0 ? 0 : 1;

+		return 1;

+		}

+	else

+		{

+		int toret;

+		char *tmpchar = OPENSSL_malloc(mpz_sizeinbase(g, 16) + 10);

+		if(!tmpchar) return 0;

+		mpz_get_str(tmpchar, 16, g);

+		toret = BN_hex2bn(&bn, tmpchar);

+		OPENSSL_free(tmpchar);

+		return toret;

+		}

+	}

+

+#ifndef OPENSSL_NO_RSA 

+typedef struct st_e_gmp_rsa_ctx

+	{

+	int public_only;

+	mpz_t n;

+	mpz_t d;

+	mpz_t e;

+	mpz_t p;

+	mpz_t q;

+	mpz_t dmp1;

+	mpz_t dmq1;

+	mpz_t iqmp;

+	mpz_t r0, r1, I0, m1;

+	} E_GMP_RSA_CTX;

+

+static E_GMP_RSA_CTX *e_gmp_get_rsa(RSA *rsa)

+	{

+	E_GMP_RSA_CTX *hptr = RSA_get_ex_data(rsa, hndidx_rsa);

+	if(hptr) return hptr;

+	hptr = OPENSSL_malloc(sizeof(E_GMP_RSA_CTX));

+	if(!hptr) return NULL;

+	/* These inits could probably be replaced by more intelligent

+	 * mpz_init2() versions, to reduce malloc-thrashing. */

+	mpz_init(hptr->n);

+	mpz_init(hptr->d);

+	mpz_init(hptr->e);

+	mpz_init(hptr->p);

+	mpz_init(hptr->q);

+	mpz_init(hptr->dmp1);

+	mpz_init(hptr->dmq1);

+	mpz_init(hptr->iqmp);

+	mpz_init(hptr->r0);

+	mpz_init(hptr->r1);

+	mpz_init(hptr->I0);

+	mpz_init(hptr->m1);

+	if(!bn2gmp(rsa->n, hptr->n) || !bn2gmp(rsa->e, hptr->e))

+		goto err;

+	if(!rsa->p || !rsa->q || !rsa->d || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)

+		{

+		hptr->public_only = 1;

+		return hptr;

+		}

+	if(!bn2gmp(rsa->d, hptr->d) || !bn2gmp(rsa->p, hptr->p) ||

+			!bn2gmp(rsa->q, hptr->q) || !bn2gmp(rsa->dmp1, hptr->dmp1) ||

+			!bn2gmp(rsa->dmq1, hptr->dmq1) || !bn2gmp(rsa->iqmp, hptr->iqmp))

+		goto err;

+	hptr->public_only = 0;

+	RSA_set_ex_data(rsa, hndidx_rsa, hptr);

+	return hptr;

+err:

+	mpz_clear(hptr->n);

+	mpz_clear(hptr->d);

+	mpz_clear(hptr->e);

+	mpz_clear(hptr->p);

+	mpz_clear(hptr->q);

+	mpz_clear(hptr->dmp1);

+	mpz_clear(hptr->dmq1);

+	mpz_clear(hptr->iqmp);

+	mpz_clear(hptr->r0);

+	mpz_clear(hptr->r1);

+	mpz_clear(hptr->I0);

+	mpz_clear(hptr->m1);

+	OPENSSL_free(hptr);

+	return NULL;

+	}

+

+static int e_gmp_rsa_finish(RSA *rsa)

+	{

+	E_GMP_RSA_CTX *hptr = RSA_get_ex_data(rsa, hndidx_rsa);

+	if(!hptr) return 0;

+	mpz_clear(hptr->n);

+	mpz_clear(hptr->d);

+	mpz_clear(hptr->e);

+	mpz_clear(hptr->p);

+	mpz_clear(hptr->q);

+	mpz_clear(hptr->dmp1);

+	mpz_clear(hptr->dmq1);

+	mpz_clear(hptr->iqmp);

+	mpz_clear(hptr->r0);

+	mpz_clear(hptr->r1);

+	mpz_clear(hptr->I0);

+	mpz_clear(hptr->m1);

+	OPENSSL_free(hptr);

+	RSA_set_ex_data(rsa, hndidx_rsa, NULL);

+	return 1;

+	}

+

+static int e_gmp_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)

+	{

+	E_GMP_RSA_CTX *hptr;

+	int to_return = 0;

+

+	hptr = e_gmp_get_rsa(rsa);

+	if(!hptr)

+		{

+		GMPerr(GMP_F_E_GMP_RSA_MOD_EXP,

+				GMP_R_KEY_CONTEXT_ERROR);

+		return 0;

+		}

+	if(hptr->public_only)

+		{

+		GMPerr(GMP_F_E_GMP_RSA_MOD_EXP,

+				GMP_R_MISSING_KEY_COMPONENTS);

+		return 0;

+		}

+

+	/* ugh!!! */

+	if(!bn2gmp(I, hptr->I0))

+		return 0;

+

+	/* This is basically the CRT logic in crypto/rsa/rsa_eay.c reworded into

+	 * GMP-speak. It may be that GMP's API facilitates cleaner formulations

+	 * of this stuff, eg. better handling of negatives, or functions that

+	 * combine operations. */

+

+	mpz_mod(hptr->r1, hptr->I0, hptr->q);

+	mpz_powm(hptr->m1, hptr->r1, hptr->dmq1, hptr->q);

+

+	mpz_mod(hptr->r1, hptr->I0, hptr->p);

+	mpz_powm(hptr->r0, hptr->r1, hptr->dmp1, hptr->p);

+

+	mpz_sub(hptr->r0, hptr->r0, hptr->m1);

+

+	if(mpz_sgn(hptr->r0) < 0)

+		mpz_add(hptr->r0, hptr->r0, hptr->p);

+	mpz_mul(hptr->r1, hptr->r0, hptr->iqmp);

+	mpz_mod(hptr->r0, hptr->r1, hptr->p);

+

+	if(mpz_sgn(hptr->r0) < 0)

+		mpz_add(hptr->r0, hptr->r0, hptr->p);

+	mpz_mul(hptr->r1, hptr->r0, hptr->q);

+	mpz_add(hptr->r0, hptr->r1, hptr->m1);

+

+	/* ugh!!! */

+	if(gmp2bn(hptr->r0, r))

+		to_return = 1;

+

+	return 1;

+	}

+#endif

+

+#endif /* !OPENSSL_NO_GMP */

+

+/* This stuff is needed if this ENGINE is being compiled into a self-contained

+ * shared-library. */	   

+#ifndef OPENSSL_NO_DYNAMIC_ENGINE

+IMPLEMENT_DYNAMIC_CHECK_FN()

+#ifndef OPENSSL_NO_GMP

+static int bind_fn(ENGINE *e, const char *id)

+	{

+	if(id && (strcmp(id, engine_e_gmp_id) != 0))

+		return 0;

+	if(!bind_helper(e))

+		return 0;

+	return 1;

+	}       

+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)

+#else

+OPENSSL_EXPORT

+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);

+OPENSSL_EXPORT

+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }

+#endif

+#endif /* !OPENSSL_NO_DYNAMIC_ENGINE */

+

+#endif /* !OPENSSL_NO_HW */

diff --git a/openssl/engines/e_padlock.c b/openssl/engines/e_padlock.c
index 381a74605..dbeff3bb8 100644
--- a/openssl/engines/e_padlock.c
+++ b/openssl/engines/e_padlock.c
@@ -1,1227 +1,1233 @@
-/* 
- * Support for VIA PadLock Advanced Cryptography Engine (ACE)
- * Written by Michal Ludvig <michal@logix.cz>
- *            http://www.logix.cz/michal
- *
- * Big thanks to Andy Polyakov for a help with optimization, 
- * assembler fixes, port to MS Windows and a lot of other 
- * valuable work on this engine!
- */
-
-/* ====================================================================
- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-
-
-#include <stdio.h>
-#include <string.h>
-
-#include <openssl/opensslconf.h>
-#include <openssl/crypto.h>
-#include <openssl/dso.h>
-#include <openssl/engine.h>
-#include <openssl/evp.h>
-#ifndef OPENSSL_NO_AES
-#include <openssl/aes.h>
-#endif
-#include <openssl/rand.h>
-#include <openssl/err.h>
-
-#ifndef OPENSSL_NO_HW
-#ifndef OPENSSL_NO_HW_PADLOCK
-
-/* Attempt to have a single source for both 0.9.7 and 0.9.8 :-) */
-#if (OPENSSL_VERSION_NUMBER >= 0x00908000L)
-#  ifndef OPENSSL_NO_DYNAMIC_ENGINE
-#    define DYNAMIC_ENGINE
-#  endif
-#elif (OPENSSL_VERSION_NUMBER >= 0x00907000L)
-#  ifdef ENGINE_DYNAMIC_SUPPORT
-#    define DYNAMIC_ENGINE
-#  endif
-#else
-#  error "Only OpenSSL >= 0.9.7 is supported"
-#endif
-
-/* VIA PadLock AES is available *ONLY* on some x86 CPUs.
-   Not only that it doesn't exist elsewhere, but it
-   even can't be compiled on other platforms!
- 
-   In addition, because of the heavy use of inline assembler,
-   compiler choice is limited to GCC and Microsoft C. */
-#undef COMPILE_HW_PADLOCK
-#if !defined(I386_ONLY) && !defined(OPENSSL_NO_INLINE_ASM)
-# if (defined(__GNUC__) && (defined(__i386__) || defined(__i386))) || \
-     (defined(_MSC_VER) && defined(_M_IX86))
-#  define COMPILE_HW_PADLOCK
-static ENGINE *ENGINE_padlock (void);
-# endif
-#endif
-
-void ENGINE_load_padlock (void)
-{
-/* On non-x86 CPUs it just returns. */
-#ifdef COMPILE_HW_PADLOCK
-	ENGINE *toadd = ENGINE_padlock ();
-	if (!toadd) return;
-	ENGINE_add (toadd);
-	ENGINE_free (toadd);
-	ERR_clear_error ();
-#endif
-}
-
-#ifdef COMPILE_HW_PADLOCK
-/* We do these includes here to avoid header problems on platforms that
-   do not have the VIA padlock anyway... */
-#include <stdlib.h>
-#ifdef _WIN32
-# include <malloc.h>
-# ifndef alloca
-#  define alloca _alloca
-# endif
-#elif defined(__GNUC__)
-# ifndef alloca
-#  define alloca(s) __builtin_alloca(s)
-# endif
-#endif
-
-/* Function for ENGINE detection and control */
-static int padlock_available(void);
-static int padlock_init(ENGINE *e);
-
-/* RNG Stuff */
-static RAND_METHOD padlock_rand;
-
-/* Cipher Stuff */
-#ifndef OPENSSL_NO_AES
-static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid);
-#endif
-
-/* Engine names */
-static const char *padlock_id = "padlock";
-static char padlock_name[100];
-
-/* Available features */
-static int padlock_use_ace = 0;	/* Advanced Cryptography Engine */
-static int padlock_use_rng = 0;	/* Random Number Generator */
-#ifndef OPENSSL_NO_AES
-static int padlock_aes_align_required = 1;
-#endif
-
-/* ===== Engine "management" functions ===== */
-
-/* Prepare the ENGINE structure for registration */
-static int
-padlock_bind_helper(ENGINE *e)
-{
-	/* Check available features */
-	padlock_available();
-
-#if 1	/* disable RNG for now, see commentary in vicinity of RNG code */
-	padlock_use_rng=0;
-#endif
-
-	/* Generate a nice engine name with available features */
-	BIO_snprintf(padlock_name, sizeof(padlock_name),
-		"VIA PadLock (%s, %s)", 
-		 padlock_use_rng ? "RNG" : "no-RNG",
-		 padlock_use_ace ? "ACE" : "no-ACE");
-
-	/* Register everything or return with an error */ 
-	if (!ENGINE_set_id(e, padlock_id) ||
-	    !ENGINE_set_name(e, padlock_name) ||
-
-	    !ENGINE_set_init_function(e, padlock_init) ||
-#ifndef OPENSSL_NO_AES
-	    (padlock_use_ace && !ENGINE_set_ciphers (e, padlock_ciphers)) ||
-#endif
-	    (padlock_use_rng && !ENGINE_set_RAND (e, &padlock_rand))) {
-		return 0;
-	}
-
-	/* Everything looks good */
-	return 1;
-}
-
-/* Constructor */
-static ENGINE *
-ENGINE_padlock(void)
-{
-	ENGINE *eng = ENGINE_new();
-
-	if (!eng) {
-		return NULL;
-	}
-
-	if (!padlock_bind_helper(eng)) {
-		ENGINE_free(eng);
-		return NULL;
-	}
-
-	return eng;
-}
-
-/* Check availability of the engine */
-static int
-padlock_init(ENGINE *e)
-{
-	return (padlock_use_rng || padlock_use_ace);
-}
-
-/* This stuff is needed if this ENGINE is being compiled into a self-contained
- * shared-library.
- */
-#ifdef DYNAMIC_ENGINE
-static int
-padlock_bind_fn(ENGINE *e, const char *id)
-{
-	if (id && (strcmp(id, padlock_id) != 0)) {
-		return 0;
-	}
-
-	if (!padlock_bind_helper(e))  {
-		return 0;
-	}
-
-	return 1;
-}
-
-IMPLEMENT_DYNAMIC_CHECK_FN()
-IMPLEMENT_DYNAMIC_BIND_FN (padlock_bind_fn)
-#endif /* DYNAMIC_ENGINE */
-
-/* ===== Here comes the "real" engine ===== */
-
-#ifndef OPENSSL_NO_AES
-/* Some AES-related constants */
-#define AES_BLOCK_SIZE		16
-#define AES_KEY_SIZE_128	16
-#define AES_KEY_SIZE_192	24
-#define AES_KEY_SIZE_256	32
-
-/* Here we store the status information relevant to the 
-   current context. */
-/* BIG FAT WARNING:
- * 	Inline assembler in PADLOCK_XCRYPT_ASM()
- * 	depends on the order of items in this structure.
- * 	Don't blindly modify, reorder, etc!
- */
-struct padlock_cipher_data
-{
-	unsigned char iv[AES_BLOCK_SIZE];	/* Initialization vector */
-	union {	unsigned int pad[4];
-		struct {
-			int rounds:4;
-			int dgst:1;	/* n/a in C3 */
-			int align:1;	/* n/a in C3 */
-			int ciphr:1;	/* n/a in C3 */
-			unsigned int keygen:1;
-			int interm:1;
-			unsigned int encdec:1;
-			int ksize:2;
-		} b;
-	} cword;		/* Control word */
-	AES_KEY ks;		/* Encryption key */
-};
-
-/*
- * Essentially this variable belongs in thread local storage.
- * Having this variable global on the other hand can only cause
- * few bogus key reloads [if any at all on single-CPU system],
- * so we accept the penatly...
- */
-static volatile struct padlock_cipher_data *padlock_saved_context;
-#endif
-
-/*
- * =======================================================
- * Inline assembler section(s).
- * =======================================================
- * Order of arguments is chosen to facilitate Windows port
- * using __fastcall calling convention. If you wish to add
- * more routines, keep in mind that first __fastcall
- * argument is passed in %ecx and second - in %edx.
- * =======================================================
- */
-#if defined(__GNUC__) && __GNUC__>=2
-/*
- * As for excessive "push %ebx"/"pop %ebx" found all over.
- * When generating position-independent code GCC won't let
- * us use "b" in assembler templates nor even respect "ebx"
- * in "clobber description." Therefore the trouble...
- */
-
-/* Helper function - check if a CPUID instruction
-   is available on this CPU */
-static int
-padlock_insn_cpuid_available(void)
-{
-	int result = -1;
-
-	/* We're checking if the bit #21 of EFLAGS 
-	   can be toggled. If yes = CPUID is available. */
-	asm volatile (
-		"pushf\n"
-		"popl %%eax\n"
-		"xorl $0x200000, %%eax\n"
-		"movl %%eax, %%ecx\n"
-		"andl $0x200000, %%ecx\n"
-		"pushl %%eax\n"
-		"popf\n"
-		"pushf\n"
-		"popl %%eax\n"
-		"andl $0x200000, %%eax\n"
-		"xorl %%eax, %%ecx\n"
-		"movl %%ecx, %0\n"
-		: "=r" (result) : : "eax", "ecx");
-	
-	return (result == 0);
-}
-
-/* Load supported features of the CPU to see if
-   the PadLock is available. */
-static int
-padlock_available(void)
-{
-	char vendor_string[16];
-	unsigned int eax, edx;
-
-	/* First check if the CPUID instruction is available at all... */
-	if (! padlock_insn_cpuid_available())
-		return 0;
-
-	/* Are we running on the Centaur (VIA) CPU? */
-	eax = 0x00000000;
-	vendor_string[12] = 0;
-	asm volatile (
-		"pushl	%%ebx\n"
-		"cpuid\n"
-		"movl	%%ebx,(%%edi)\n"
-		"movl	%%edx,4(%%edi)\n"
-		"movl	%%ecx,8(%%edi)\n"
-		"popl	%%ebx"
-		: "+a"(eax) : "D"(vendor_string) : "ecx", "edx");
-	if (strcmp(vendor_string, "CentaurHauls") != 0)
-		return 0;
-
-	/* Check for Centaur Extended Feature Flags presence */
-	eax = 0xC0000000;
-	asm volatile ("pushl %%ebx; cpuid; popl	%%ebx"
-		: "+a"(eax) : : "ecx", "edx");
-	if (eax < 0xC0000001)
-		return 0;
-
-	/* Read the Centaur Extended Feature Flags */
-	eax = 0xC0000001;
-	asm volatile ("pushl %%ebx; cpuid; popl %%ebx"
-		: "+a"(eax), "=d"(edx) : : "ecx");
-
-	/* Fill up some flags */
-	padlock_use_ace = ((edx & (0x3<<6)) == (0x3<<6));
-	padlock_use_rng = ((edx & (0x3<<2)) == (0x3<<2));
-
-	return padlock_use_ace + padlock_use_rng;
-}
-
-#ifndef OPENSSL_NO_AES
-/* Our own htonl()/ntohl() */
-static inline void
-padlock_bswapl(AES_KEY *ks)
-{
-	size_t i = sizeof(ks->rd_key)/sizeof(ks->rd_key[0]);
-	unsigned int *key = ks->rd_key;
-
-	while (i--) {
-		asm volatile ("bswapl %0" : "+r"(*key));
-		key++;
-	}
-}
-#endif
-
-/* Force key reload from memory to the CPU microcode.
-   Loading EFLAGS from the stack clears EFLAGS[30] 
-   which does the trick. */
-static inline void
-padlock_reload_key(void)
-{
-	asm volatile ("pushfl; popfl");
-}
-
-#ifndef OPENSSL_NO_AES
-/*
- * This is heuristic key context tracing. At first one
- * believes that one should use atomic swap instructions,
- * but it's not actually necessary. Point is that if
- * padlock_saved_context was changed by another thread
- * after we've read it and before we compare it with cdata,
- * our key *shall* be reloaded upon thread context switch
- * and we are therefore set in either case...
- */
-static inline void
-padlock_verify_context(struct padlock_cipher_data *cdata)
-{
-	asm volatile (
-	"pushfl\n"
-"	btl	$30,(%%esp)\n"
-"	jnc	1f\n"
-"	cmpl	%2,%1\n"
-"	je	1f\n"
-"	popfl\n"
-"	subl	$4,%%esp\n"
-"1:	addl	$4,%%esp\n"
-"	movl	%2,%0"
-	:"+m"(padlock_saved_context)
-	: "r"(padlock_saved_context), "r"(cdata) : "cc");
-}
-
-/* Template for padlock_xcrypt_* modes */
-/* BIG FAT WARNING: 
- * 	The offsets used with 'leal' instructions
- * 	describe items of the 'padlock_cipher_data'
- * 	structure.
- */
-#define PADLOCK_XCRYPT_ASM(name,rep_xcrypt)	\
-static inline void *name(size_t cnt,		\
-	struct padlock_cipher_data *cdata,	\
-	void *out, const void *inp) 		\
-{	void *iv; 				\
-	asm volatile ( "pushl	%%ebx\n"	\
-		"	leal	16(%0),%%edx\n"	\
-		"	leal	32(%0),%%ebx\n"	\
-			rep_xcrypt "\n"		\
-		"	popl	%%ebx"		\
-		: "=a"(iv), "=c"(cnt), "=D"(out), "=S"(inp) \
-		: "0"(cdata), "1"(cnt), "2"(out), "3"(inp)  \
-		: "edx", "cc", "memory");	\
-	return iv;				\
-}
-
-/* Generate all functions with appropriate opcodes */
-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb, ".byte 0xf3,0x0f,0xa7,0xc8")	/* rep xcryptecb */
-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc, ".byte 0xf3,0x0f,0xa7,0xd0")	/* rep xcryptcbc */
-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb, ".byte 0xf3,0x0f,0xa7,0xe0")	/* rep xcryptcfb */
-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb, ".byte 0xf3,0x0f,0xa7,0xe8")	/* rep xcryptofb */
-#endif
-
-/* The RNG call itself */
-static inline unsigned int
-padlock_xstore(void *addr, unsigned int edx_in)
-{
-	unsigned int eax_out;
-
-	asm volatile (".byte 0x0f,0xa7,0xc0"	/* xstore */
-	    : "=a"(eax_out),"=m"(*(unsigned *)addr)
-	    : "D"(addr), "d" (edx_in)
-	    );
-
-	return eax_out;
-}
-
-/* Why not inline 'rep movsd'? I failed to find information on what
- * value in Direction Flag one can expect and consequently have to
- * apply "better-safe-than-sorry" approach and assume "undefined."
- * I could explicitly clear it and restore the original value upon
- * return from padlock_aes_cipher, but it's presumably too much
- * trouble for too little gain...
- *
- * In case you wonder 'rep xcrypt*' instructions above are *not*
- * affected by the Direction Flag and pointers advance toward
- * larger addresses unconditionally.
- */ 
-static inline unsigned char *
-padlock_memcpy(void *dst,const void *src,size_t n)
-{
-	long       *d=dst;
-	const long *s=src;
-
-	n /= sizeof(*d);
-	do { *d++ = *s++; } while (--n);
-
-	return dst;
-}
-
-#elif defined(_MSC_VER)
-/*
- * Unlike GCC these are real functions. In order to minimize impact
- * on performance we adhere to __fastcall calling convention in
- * order to get two first arguments passed through %ecx and %edx.
- * Which kind of suits very well, as instructions in question use
- * both %ecx and %edx as input:-)
- */
-#define REP_XCRYPT(code)		\
-	_asm _emit 0xf3			\
-	_asm _emit 0x0f _asm _emit 0xa7	\
-	_asm _emit code
-
-/* BIG FAT WARNING: 
- * 	The offsets used with 'lea' instructions
- * 	describe items of the 'padlock_cipher_data'
- * 	structure.
- */
-#define PADLOCK_XCRYPT_ASM(name,code)	\
-static void * __fastcall 		\
-	name (size_t cnt, void *cdata,	\
-	void *outp, const void *inp)	\
-{	_asm	mov	eax,edx		\
-	_asm	lea	edx,[eax+16]	\
-	_asm	lea	ebx,[eax+32]	\
-	_asm	mov	edi,outp	\
-	_asm	mov	esi,inp		\
-	REP_XCRYPT(code)		\
-}
-
-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb,0xc8)
-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc,0xd0)
-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb,0xe0)
-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb,0xe8)
-
-static int __fastcall
-padlock_xstore(void *outp,unsigned int code)
-{	_asm	mov	edi,ecx
-	_asm _emit 0x0f _asm _emit 0xa7 _asm _emit 0xc0
-}
-
-static void __fastcall
-padlock_reload_key(void)
-{	_asm pushfd _asm popfd		}
-
-static void __fastcall
-padlock_verify_context(void *cdata)
-{	_asm	{
-		pushfd
-		bt	DWORD PTR[esp],30
-		jnc	skip
-		cmp	ecx,padlock_saved_context
-		je	skip
-		popfd
-		sub	esp,4
-	skip:	add	esp,4
-		mov	padlock_saved_context,ecx
-		}
-}
-
-static int
-padlock_available(void)
-{	_asm	{
-		pushfd
-		pop	eax
-		mov	ecx,eax
-		xor	eax,1<<21
-		push	eax
-		popfd
-		pushfd
-		pop	eax
-		xor	eax,ecx
-		bt	eax,21
-		jnc	noluck
-		mov	eax,0
-		cpuid
-		xor	eax,eax
-		cmp	ebx,'tneC'
-		jne	noluck
-		cmp	edx,'Hrua'
-		jne	noluck
-		cmp	ecx,'slua'
-		jne	noluck
-		mov	eax,0xC0000000
-		cpuid
-		mov	edx,eax
-		xor	eax,eax
-		cmp	edx,0xC0000001
-		jb	noluck
-		mov	eax,0xC0000001
-		cpuid
-		xor	eax,eax
-		bt	edx,6
-		jnc	skip_a
-		bt	edx,7
-		jnc	skip_a
-		mov	padlock_use_ace,1
-		inc	eax
-	skip_a:	bt	edx,2
-		jnc	skip_r
-		bt	edx,3
-		jnc	skip_r
-		mov	padlock_use_rng,1
-		inc	eax
-	skip_r:
-	noluck:
-		}
-}
-
-static void __fastcall
-padlock_bswapl(void *key)
-{	_asm	{
-		pushfd
-		cld
-		mov	esi,ecx
-		mov	edi,ecx
-		mov	ecx,60
-	up:	lodsd
-		bswap	eax
-		stosd
-		loop	up
-		popfd
-		}
-}
-
-/* MS actually specifies status of Direction Flag and compiler even
- * manages to compile following as 'rep movsd' all by itself...
- */
-#define padlock_memcpy(o,i,n) ((unsigned char *)memcpy((o),(i),(n)&~3U))
-#endif
-
-/* ===== AES encryption/decryption ===== */
-#ifndef OPENSSL_NO_AES
-
-#if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)
-#define NID_aes_128_cfb	NID_aes_128_cfb128
-#endif
-
-#if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)
-#define NID_aes_128_ofb	NID_aes_128_ofb128
-#endif
-
-#if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)
-#define NID_aes_192_cfb	NID_aes_192_cfb128
-#endif
-
-#if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)
-#define NID_aes_192_ofb	NID_aes_192_ofb128
-#endif
-
-#if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)
-#define NID_aes_256_cfb	NID_aes_256_cfb128
-#endif
-
-#if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)
-#define NID_aes_256_ofb	NID_aes_256_ofb128
-#endif
-
-/* List of supported ciphers. */
-static int padlock_cipher_nids[] = {
-	NID_aes_128_ecb,
-	NID_aes_128_cbc,
-	NID_aes_128_cfb,
-	NID_aes_128_ofb,
-
-	NID_aes_192_ecb,
-	NID_aes_192_cbc,
-	NID_aes_192_cfb,
-	NID_aes_192_ofb,
-
-	NID_aes_256_ecb,
-	NID_aes_256_cbc,
-	NID_aes_256_cfb,
-	NID_aes_256_ofb,
-};
-static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids)/
-				      sizeof(padlock_cipher_nids[0]));
-
-/* Function prototypes ... */
-static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
-				const unsigned char *iv, int enc);
-static int padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
-			      const unsigned char *in, size_t nbytes);
-
-#define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) +		\
-	( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F )	)
-#define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\
-	NEAREST_ALIGNED(ctx->cipher_data))
-
-#define EVP_CIPHER_block_size_ECB	AES_BLOCK_SIZE
-#define EVP_CIPHER_block_size_CBC	AES_BLOCK_SIZE
-#define EVP_CIPHER_block_size_OFB	1
-#define EVP_CIPHER_block_size_CFB	1
-
-/* Declaring so many ciphers by hand would be a pain.
-   Instead introduce a bit of preprocessor magic :-) */
-#define	DECLARE_AES_EVP(ksize,lmode,umode)	\
-static const EVP_CIPHER padlock_aes_##ksize##_##lmode = {	\
-	NID_aes_##ksize##_##lmode,		\
-	EVP_CIPHER_block_size_##umode,	\
-	AES_KEY_SIZE_##ksize,		\
-	AES_BLOCK_SIZE,			\
-	0 | EVP_CIPH_##umode##_MODE,	\
-	padlock_aes_init_key,		\
-	padlock_aes_cipher,		\
-	NULL,				\
-	sizeof(struct padlock_cipher_data) + 16,	\
-	EVP_CIPHER_set_asn1_iv,		\
-	EVP_CIPHER_get_asn1_iv,		\
-	NULL,				\
-	NULL				\
-}
-
-DECLARE_AES_EVP(128,ecb,ECB);
-DECLARE_AES_EVP(128,cbc,CBC);
-DECLARE_AES_EVP(128,cfb,CFB);
-DECLARE_AES_EVP(128,ofb,OFB);
-
-DECLARE_AES_EVP(192,ecb,ECB);
-DECLARE_AES_EVP(192,cbc,CBC);
-DECLARE_AES_EVP(192,cfb,CFB);
-DECLARE_AES_EVP(192,ofb,OFB);
-
-DECLARE_AES_EVP(256,ecb,ECB);
-DECLARE_AES_EVP(256,cbc,CBC);
-DECLARE_AES_EVP(256,cfb,CFB);
-DECLARE_AES_EVP(256,ofb,OFB);
-
-static int
-padlock_ciphers (ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid)
-{
-	/* No specific cipher => return a list of supported nids ... */
-	if (!cipher) {
-		*nids = padlock_cipher_nids;
-		return padlock_cipher_nids_num;
-	}
-
-	/* ... or the requested "cipher" otherwise */
-	switch (nid) {
-	  case NID_aes_128_ecb:
-	    *cipher = &padlock_aes_128_ecb;
-	    break;
-	  case NID_aes_128_cbc:
-	    *cipher = &padlock_aes_128_cbc;
-	    break;
-	  case NID_aes_128_cfb:
-	    *cipher = &padlock_aes_128_cfb;
-	    break;
-	  case NID_aes_128_ofb:
-	    *cipher = &padlock_aes_128_ofb;
-	    break;
-
-	  case NID_aes_192_ecb:
-	    *cipher = &padlock_aes_192_ecb;
-	    break;
-	  case NID_aes_192_cbc:
-	    *cipher = &padlock_aes_192_cbc;
-	    break;
-	  case NID_aes_192_cfb:
-	    *cipher = &padlock_aes_192_cfb;
-	    break;
-	  case NID_aes_192_ofb:
-	    *cipher = &padlock_aes_192_ofb;
-	    break;
-
-	  case NID_aes_256_ecb:
-	    *cipher = &padlock_aes_256_ecb;
-	    break;
-	  case NID_aes_256_cbc:
-	    *cipher = &padlock_aes_256_cbc;
-	    break;
-	  case NID_aes_256_cfb:
-	    *cipher = &padlock_aes_256_cfb;
-	    break;
-	  case NID_aes_256_ofb:
-	    *cipher = &padlock_aes_256_ofb;
-	    break;
-
-	  default:
-	    /* Sorry, we don't support this NID */
-	    *cipher = NULL;
-	    return 0;
-	}
-
-	return 1;
-}
-
-/* Prepare the encryption key for PadLock usage */
-static int
-padlock_aes_init_key (EVP_CIPHER_CTX *ctx, const unsigned char *key,
-		      const unsigned char *iv, int enc)
-{
-	struct padlock_cipher_data *cdata;
-	int key_len = EVP_CIPHER_CTX_key_length(ctx) * 8;
-
-	if (key==NULL) return 0;	/* ERROR */
-
-	cdata = ALIGNED_CIPHER_DATA(ctx);
-	memset(cdata, 0, sizeof(struct padlock_cipher_data));
-
-	/* Prepare Control word. */
-	if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE)
-		cdata->cword.b.encdec = 0;
-	else
-		cdata->cword.b.encdec = (ctx->encrypt == 0);
-	cdata->cword.b.rounds = 10 + (key_len - 128) / 32;
-	cdata->cword.b.ksize = (key_len - 128) / 64;
-
-	switch(key_len) {
-		case 128:
-			/* PadLock can generate an extended key for
-			   AES128 in hardware */
-			memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128);
-			cdata->cword.b.keygen = 0;
-			break;
-
-		case 192:
-		case 256:
-			/* Generate an extended AES key in software.
-			   Needed for AES192/AES256 */
-			/* Well, the above applies to Stepping 8 CPUs
-			   and is listed as hardware errata. They most
-			   likely will fix it at some point and then
-			   a check for stepping would be due here. */
-			if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CFB_MODE ||
-			    EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE ||
-			    enc)
-				AES_set_encrypt_key(key, key_len, &cdata->ks);
-			else
-				AES_set_decrypt_key(key, key_len, &cdata->ks);
-#ifndef AES_ASM
-			/* OpenSSL C functions use byte-swapped extended key. */
-			padlock_bswapl(&cdata->ks);
-#endif
-			cdata->cword.b.keygen = 1;
-			break;
-
-		default:
-			/* ERROR */
-			return 0;
-	}
-
-	/*
-	 * This is done to cover for cases when user reuses the
-	 * context for new key. The catch is that if we don't do
-	 * this, padlock_eas_cipher might proceed with old key...
-	 */
-	padlock_reload_key ();
-
-	return 1;
-}
-
-/* 
- * Simplified version of padlock_aes_cipher() used when
- * 1) both input and output buffers are at aligned addresses.
- * or when
- * 2) running on a newer CPU that doesn't require aligned buffers.
- */
-static int
-padlock_aes_cipher_omnivorous(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
-		const unsigned char *in_arg, size_t nbytes)
-{
-	struct padlock_cipher_data *cdata;
-	void  *iv;
-
-	cdata = ALIGNED_CIPHER_DATA(ctx);
-	padlock_verify_context(cdata);
-
-	switch (EVP_CIPHER_CTX_mode(ctx)) {
-	case EVP_CIPH_ECB_MODE:
-		padlock_xcrypt_ecb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
-		break;
-
-	case EVP_CIPH_CBC_MODE:
-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
-		iv = padlock_xcrypt_cbc(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
-		break;
-
-	case EVP_CIPH_CFB_MODE:
-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
-		iv = padlock_xcrypt_cfb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
-		break;
-
-	case EVP_CIPH_OFB_MODE:
-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
-		padlock_xcrypt_ofb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
-		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
-		break;
-
-	default:
-		return 0;
-	}
-
-	memset(cdata->iv, 0, AES_BLOCK_SIZE);
-
-	return 1;
-}
-
-#ifndef  PADLOCK_CHUNK
-# define PADLOCK_CHUNK	512	/* Must be a power of 2 larger than 16 */
-#endif
-#if PADLOCK_CHUNK<16 || PADLOCK_CHUNK&(PADLOCK_CHUNK-1)
-# error "insane PADLOCK_CHUNK..."
-#endif
-
-/* Re-align the arguments to 16-Bytes boundaries and run the 
-   encryption function itself. This function is not AES-specific. */
-static int
-padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
-		   const unsigned char *in_arg, size_t nbytes)
-{
-	struct padlock_cipher_data *cdata;
-	const  void *inp;
-	unsigned char  *out;
-	void  *iv;
-	int    inp_misaligned, out_misaligned, realign_in_loop;
-	size_t chunk, allocated=0;
-
-	/* ctx->num is maintained in byte-oriented modes,
-	   such as CFB and OFB... */
-	if ((chunk = ctx->num)) { /* borrow chunk variable */
-		unsigned char *ivp=ctx->iv;
-
-		switch (EVP_CIPHER_CTX_mode(ctx)) {
-		case EVP_CIPH_CFB_MODE:
-			if (chunk >= AES_BLOCK_SIZE)
-				return 0; /* bogus value */
-
-			if (ctx->encrypt)
-				while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
-					ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk];
-					chunk++, nbytes--;
-				}
-			else	while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
-					unsigned char c = *(in_arg++);
-					*(out_arg++) = c ^ ivp[chunk];
-					ivp[chunk++] = c, nbytes--;
-				}
-
-			ctx->num = chunk%AES_BLOCK_SIZE;
-			break;
-		case EVP_CIPH_OFB_MODE:
-			if (chunk >= AES_BLOCK_SIZE)
-				return 0; /* bogus value */
-
-			while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
-				*(out_arg++) = *(in_arg++) ^ ivp[chunk];
-				chunk++, nbytes--;
-			}
-
-			ctx->num = chunk%AES_BLOCK_SIZE;
-			break;
-		}
-	}
-
-	if (nbytes == 0)
-		return 1;
-#if 0
-	if (nbytes % AES_BLOCK_SIZE)
-		return 0; /* are we expected to do tail processing? */
-#else
-	/* nbytes is always multiple of AES_BLOCK_SIZE in ECB and CBC
-	   modes and arbitrary value in byte-oriented modes, such as
-	   CFB and OFB... */
-#endif
-
-	/* VIA promises CPUs that won't require alignment in the future.
-	   For now padlock_aes_align_required is initialized to 1 and
-	   the condition is never met... */
-	/* C7 core is capable to manage unaligned input in non-ECB[!]
-	   mode, but performance penalties appear to be approximately
-	   same as for software alignment below or ~3x. They promise to
-	   improve it in the future, but for now we can just as well
-	   pretend that it can only handle aligned input... */
-	if (!padlock_aes_align_required && (nbytes%AES_BLOCK_SIZE)==0)
-		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);
-
-	inp_misaligned = (((size_t)in_arg) & 0x0F);
-	out_misaligned = (((size_t)out_arg) & 0x0F);
-
-	/* Note that even if output is aligned and input not,
-	 * I still prefer to loop instead of copy the whole
-	 * input and then encrypt in one stroke. This is done
-	 * in order to improve L1 cache utilization... */
-	realign_in_loop = out_misaligned|inp_misaligned;
-
-	if (!realign_in_loop && (nbytes%AES_BLOCK_SIZE)==0)
-		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);
-
-	/* this takes one "if" out of the loops */
-	chunk  = nbytes;
-	chunk %= PADLOCK_CHUNK;
-	if (chunk==0) chunk = PADLOCK_CHUNK;
-
-	if (out_misaligned) {
-		/* optmize for small input */
-		allocated = (chunk<nbytes?PADLOCK_CHUNK:nbytes);
-		out = alloca(0x10 + allocated);
-		out = NEAREST_ALIGNED(out);
-	}
-	else
-		out = out_arg;
-
-	cdata = ALIGNED_CIPHER_DATA(ctx);
-	padlock_verify_context(cdata);
-
-	switch (EVP_CIPHER_CTX_mode(ctx)) {
-	case EVP_CIPH_ECB_MODE:
-		do	{
-			if (inp_misaligned)
-				inp = padlock_memcpy(out, in_arg, chunk);
-			else
-				inp = in_arg;
-			in_arg += chunk;
-
-			padlock_xcrypt_ecb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
-
-			if (out_misaligned)
-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
-			else
-				out     = out_arg+=chunk;
-
-			nbytes -= chunk;
-			chunk   = PADLOCK_CHUNK;
-		} while (nbytes);
-		break;
-
-	case EVP_CIPH_CBC_MODE:
-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
-		goto cbc_shortcut;
-		do	{
-			if (iv != cdata->iv)
-				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);
-			chunk = PADLOCK_CHUNK;
-		cbc_shortcut: /* optimize for small input */
-			if (inp_misaligned)
-				inp = padlock_memcpy(out, in_arg, chunk);
-			else
-				inp = in_arg;
-			in_arg += chunk;
-
-			iv = padlock_xcrypt_cbc(chunk/AES_BLOCK_SIZE, cdata, out, inp);
-
-			if (out_misaligned)
-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
-			else
-				out     = out_arg+=chunk;
-
-		} while (nbytes -= chunk);
-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
-		break;
-
-	case EVP_CIPH_CFB_MODE:
-		memcpy (iv = cdata->iv, ctx->iv, AES_BLOCK_SIZE);
-		chunk &= ~(AES_BLOCK_SIZE-1);
-		if (chunk)	goto cfb_shortcut;
-		else		goto cfb_skiploop;
-		do	{
-			if (iv != cdata->iv)
-				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);
-			chunk = PADLOCK_CHUNK;
-		cfb_shortcut: /* optimize for small input */
-			if (inp_misaligned)
-				inp = padlock_memcpy(out, in_arg, chunk);
-			else
-				inp = in_arg;
-			in_arg += chunk;
-
-			iv = padlock_xcrypt_cfb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
-
-			if (out_misaligned)
-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
-			else
-				out     = out_arg+=chunk;
-
-			nbytes -= chunk;
-		} while (nbytes >= AES_BLOCK_SIZE);
-
-		cfb_skiploop:
-		if (nbytes) {
-			unsigned char *ivp = cdata->iv;
-
-			if (iv != ivp) {
-				memcpy(ivp, iv, AES_BLOCK_SIZE);
-				iv = ivp;
-			}
-			ctx->num = nbytes;
-			if (cdata->cword.b.encdec) {
-				cdata->cword.b.encdec=0;
-				padlock_reload_key();
-				padlock_xcrypt_ecb(1,cdata,ivp,ivp);
-				cdata->cword.b.encdec=1;
-				padlock_reload_key();
-				while(nbytes) {
-					unsigned char c = *(in_arg++);
-					*(out_arg++) = c ^ *ivp;
-					*(ivp++) = c, nbytes--;
-				}
-			}
-			else {	padlock_reload_key();
-				padlock_xcrypt_ecb(1,cdata,ivp,ivp);
-				padlock_reload_key();
-				while (nbytes) {
-					*ivp = *(out_arg++) = *(in_arg++) ^ *ivp;
-					ivp++, nbytes--;
-				}
-			}
-		}
-
-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
-		break;
-
-	case EVP_CIPH_OFB_MODE:
-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
-		chunk &= ~(AES_BLOCK_SIZE-1);
-		if (chunk) do	{
-			if (inp_misaligned)
-				inp = padlock_memcpy(out, in_arg, chunk);
-			else
-				inp = in_arg;
-			in_arg += chunk;
-
-			padlock_xcrypt_ofb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
-
-			if (out_misaligned)
-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
-			else
-				out     = out_arg+=chunk;
-
-			nbytes -= chunk;
-			chunk   = PADLOCK_CHUNK;
-		} while (nbytes >= AES_BLOCK_SIZE);
-
-		if (nbytes) {
-			unsigned char *ivp = cdata->iv;
-
-			ctx->num = nbytes;
-			padlock_reload_key();	/* empirically found */
-			padlock_xcrypt_ecb(1,cdata,ivp,ivp);
-			padlock_reload_key();	/* empirically found */
-			while (nbytes) {
-				*(out_arg++) = *(in_arg++) ^ *ivp;
-				ivp++, nbytes--;
-			}
-		}
-
-		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
-		break;
-
-	default:
-		return 0;
-	}
-
-	/* Clean the realign buffer if it was used */
-	if (out_misaligned) {
-		volatile unsigned long *p=(void *)out;
-		size_t   n = allocated/sizeof(*p);
-		while (n--) *p++=0;
-	}
-
-	memset(cdata->iv, 0, AES_BLOCK_SIZE);
-
-	return 1;
-}
-
-#endif /* OPENSSL_NO_AES */
-
-/* ===== Random Number Generator ===== */
-/*
- * This code is not engaged. The reason is that it does not comply
- * with recommendations for VIA RNG usage for secure applications
- * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it
- * provide meaningful error control...
- */
-/* Wrapper that provides an interface between the API and 
-   the raw PadLock RNG */
-static int
-padlock_rand_bytes(unsigned char *output, int count)
-{
-	unsigned int eax, buf;
-
-	while (count >= 8) {
-		eax = padlock_xstore(output, 0);
-		if (!(eax&(1<<6)))	return 0; /* RNG disabled */
-		/* this ---vv--- covers DC bias, Raw Bits and String Filter */
-		if (eax&(0x1F<<10))	return 0;
-		if ((eax&0x1F)==0)	continue; /* no data, retry... */
-		if ((eax&0x1F)!=8)	return 0; /* fatal failure...  */
-		output += 8;
-		count  -= 8;
-	}
-	while (count > 0) {
-		eax = padlock_xstore(&buf, 3);
-		if (!(eax&(1<<6)))	return 0; /* RNG disabled */
-		/* this ---vv--- covers DC bias, Raw Bits and String Filter */
-		if (eax&(0x1F<<10))	return 0;
-		if ((eax&0x1F)==0)	continue; /* no data, retry... */
-		if ((eax&0x1F)!=1)	return 0; /* fatal failure...  */
-		*output++ = (unsigned char)buf;
-		count--;
-	}
-	*(volatile unsigned int *)&buf=0;
-
-	return 1;
-}
-
-/* Dummy but necessary function */
-static int
-padlock_rand_status(void)
-{
-	return 1;
-}
-
-/* Prepare structure for registration */
-static RAND_METHOD padlock_rand = {
-	NULL,			/* seed */
-	padlock_rand_bytes,	/* bytes */
-	NULL,			/* cleanup */
-	NULL,			/* add */
-	padlock_rand_bytes,	/* pseudorand */
-	padlock_rand_status,	/* rand status */
-};
-
-#else  /* !COMPILE_HW_PADLOCK */
-#ifndef OPENSSL_NO_DYNAMIC_ENGINE
-OPENSSL_EXPORT
-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }
-IMPLEMENT_DYNAMIC_CHECK_FN()
-#endif
-#endif /* COMPILE_HW_PADLOCK */
-
-#endif /* !OPENSSL_NO_HW_PADLOCK */
-#endif /* !OPENSSL_NO_HW */
+/* 

+ * Support for VIA PadLock Advanced Cryptography Engine (ACE)

+ * Written by Michal Ludvig <michal@logix.cz>

+ *            http://www.logix.cz/michal

+ *

+ * Big thanks to Andy Polyakov for a help with optimization, 

+ * assembler fixes, port to MS Windows and a lot of other 

+ * valuable work on this engine!

+ */

+

+/* ====================================================================

+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ *

+ * 1. Redistributions of source code must retain the above copyright

+ *    notice, this list of conditions and the following disclaimer.

+ *

+ * 2. Redistributions in binary form must reproduce the above copyright

+ *    notice, this list of conditions and the following disclaimer in

+ *    the documentation and/or other materials provided with the

+ *    distribution.

+ *

+ * 3. All advertising materials mentioning features or use of this

+ *    software must display the following acknowledgment:

+ *    "This product includes software developed by the OpenSSL Project

+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

+ *

+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

+ *    endorse or promote products derived from this software without

+ *    prior written permission. For written permission, please contact

+ *    licensing@OpenSSL.org.

+ *

+ * 5. Products derived from this software may not be called "OpenSSL"

+ *    nor may "OpenSSL" appear in their names without prior written

+ *    permission of the OpenSSL Project.

+ *

+ * 6. Redistributions of any form whatsoever must retain the following

+ *    acknowledgment:

+ *    "This product includes software developed by the OpenSSL Project

+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

+ *

+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

+ * OF THE POSSIBILITY OF SUCH DAMAGE.

+ * ====================================================================

+ *

+ * This product includes cryptographic software written by Eric Young

+ * (eay@cryptsoft.com).  This product includes software written by Tim

+ * Hudson (tjh@cryptsoft.com).

+ *

+ */

+

+

+#include <stdio.h>

+#include <string.h>

+

+#include <openssl/opensslconf.h>

+#include <openssl/crypto.h>

+#include <openssl/dso.h>

+#include <openssl/engine.h>

+#include <openssl/evp.h>

+#ifndef OPENSSL_NO_AES

+#include <openssl/aes.h>

+#endif

+#include <openssl/rand.h>

+#include <openssl/err.h>

+

+#ifndef OPENSSL_NO_HW

+#ifndef OPENSSL_NO_HW_PADLOCK

+

+/* Attempt to have a single source for both 0.9.7 and 0.9.8 :-) */

+#if (OPENSSL_VERSION_NUMBER >= 0x00908000L)

+#  ifndef OPENSSL_NO_DYNAMIC_ENGINE

+#    define DYNAMIC_ENGINE

+#  endif

+#elif (OPENSSL_VERSION_NUMBER >= 0x00907000L)

+#  ifdef ENGINE_DYNAMIC_SUPPORT

+#    define DYNAMIC_ENGINE

+#  endif

+#else

+#  error "Only OpenSSL >= 0.9.7 is supported"

+#endif

+

+/* VIA PadLock AES is available *ONLY* on some x86 CPUs.

+   Not only that it doesn't exist elsewhere, but it

+   even can't be compiled on other platforms!

+ 

+   In addition, because of the heavy use of inline assembler,

+   compiler choice is limited to GCC and Microsoft C. */

+#undef COMPILE_HW_PADLOCK

+#if !defined(I386_ONLY) && !defined(OPENSSL_NO_INLINE_ASM)

+# if (defined(__GNUC__) && (defined(__i386__) || defined(__i386))) || \

+     (defined(_MSC_VER) && defined(_M_IX86))

+#  define COMPILE_HW_PADLOCK

+static ENGINE *ENGINE_padlock (void);

+# endif

+#endif

+

+#ifdef OPENSSL_NO_DYNAMIC_ENGINE

+

+void ENGINE_load_padlock (void)

+{

+/* On non-x86 CPUs it just returns. */

+#ifdef COMPILE_HW_PADLOCK

+	ENGINE *toadd = ENGINE_padlock ();

+	if (!toadd) return;

+	ENGINE_add (toadd);

+	ENGINE_free (toadd);

+	ERR_clear_error ();

+#endif

+}

+

+#endif

+

+#ifdef COMPILE_HW_PADLOCK

+/* We do these includes here to avoid header problems on platforms that

+   do not have the VIA padlock anyway... */

+#include <stdlib.h>

+#ifdef _WIN32

+# include <malloc.h>

+# ifndef alloca

+#  define alloca _alloca

+# endif

+#elif defined(__GNUC__)

+# ifndef alloca

+#  define alloca(s) __builtin_alloca(s)

+# endif

+#endif

+

+/* Function for ENGINE detection and control */

+static int padlock_available(void);

+static int padlock_init(ENGINE *e);

+

+/* RNG Stuff */

+static RAND_METHOD padlock_rand;

+

+/* Cipher Stuff */

+#ifndef OPENSSL_NO_AES

+static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid);

+#endif

+

+/* Engine names */

+static const char *padlock_id = "padlock";

+static char padlock_name[100];

+

+/* Available features */

+static int padlock_use_ace = 0;	/* Advanced Cryptography Engine */

+static int padlock_use_rng = 0;	/* Random Number Generator */

+#ifndef OPENSSL_NO_AES

+static int padlock_aes_align_required = 1;

+#endif

+

+/* ===== Engine "management" functions ===== */

+

+/* Prepare the ENGINE structure for registration */

+static int

+padlock_bind_helper(ENGINE *e)

+{

+	/* Check available features */

+	padlock_available();

+

+#if 1	/* disable RNG for now, see commentary in vicinity of RNG code */

+	padlock_use_rng=0;

+#endif

+

+	/* Generate a nice engine name with available features */

+	BIO_snprintf(padlock_name, sizeof(padlock_name),

+		"VIA PadLock (%s, %s)", 

+		 padlock_use_rng ? "RNG" : "no-RNG",

+		 padlock_use_ace ? "ACE" : "no-ACE");

+

+	/* Register everything or return with an error */ 

+	if (!ENGINE_set_id(e, padlock_id) ||

+	    !ENGINE_set_name(e, padlock_name) ||

+

+	    !ENGINE_set_init_function(e, padlock_init) ||

+#ifndef OPENSSL_NO_AES

+	    (padlock_use_ace && !ENGINE_set_ciphers (e, padlock_ciphers)) ||

+#endif

+	    (padlock_use_rng && !ENGINE_set_RAND (e, &padlock_rand))) {

+		return 0;

+	}

+

+	/* Everything looks good */

+	return 1;

+}

+

+/* Constructor */

+static ENGINE *

+ENGINE_padlock(void)

+{

+	ENGINE *eng = ENGINE_new();

+

+	if (!eng) {

+		return NULL;

+	}

+

+	if (!padlock_bind_helper(eng)) {

+		ENGINE_free(eng);

+		return NULL;

+	}

+

+	return eng;

+}

+

+/* Check availability of the engine */

+static int

+padlock_init(ENGINE *e)

+{

+	return (padlock_use_rng || padlock_use_ace);

+}

+

+/* This stuff is needed if this ENGINE is being compiled into a self-contained

+ * shared-library.

+ */

+#ifdef DYNAMIC_ENGINE

+static int

+padlock_bind_fn(ENGINE *e, const char *id)

+{

+	if (id && (strcmp(id, padlock_id) != 0)) {

+		return 0;

+	}

+

+	if (!padlock_bind_helper(e))  {

+		return 0;

+	}

+

+	return 1;

+}

+

+IMPLEMENT_DYNAMIC_CHECK_FN()

+IMPLEMENT_DYNAMIC_BIND_FN (padlock_bind_fn)

+#endif /* DYNAMIC_ENGINE */

+

+/* ===== Here comes the "real" engine ===== */

+

+#ifndef OPENSSL_NO_AES

+/* Some AES-related constants */

+#define AES_BLOCK_SIZE		16

+#define AES_KEY_SIZE_128	16

+#define AES_KEY_SIZE_192	24

+#define AES_KEY_SIZE_256	32

+

+/* Here we store the status information relevant to the 

+   current context. */

+/* BIG FAT WARNING:

+ * 	Inline assembler in PADLOCK_XCRYPT_ASM()

+ * 	depends on the order of items in this structure.

+ * 	Don't blindly modify, reorder, etc!

+ */

+struct padlock_cipher_data

+{

+	unsigned char iv[AES_BLOCK_SIZE];	/* Initialization vector */

+	union {	unsigned int pad[4];

+		struct {

+			int rounds:4;

+			int dgst:1;	/* n/a in C3 */

+			int align:1;	/* n/a in C3 */

+			int ciphr:1;	/* n/a in C3 */

+			unsigned int keygen:1;

+			int interm:1;

+			unsigned int encdec:1;

+			int ksize:2;

+		} b;

+	} cword;		/* Control word */

+	AES_KEY ks;		/* Encryption key */

+};

+

+/*

+ * Essentially this variable belongs in thread local storage.

+ * Having this variable global on the other hand can only cause

+ * few bogus key reloads [if any at all on single-CPU system],

+ * so we accept the penatly...

+ */

+static volatile struct padlock_cipher_data *padlock_saved_context;

+#endif

+

+/*

+ * =======================================================

+ * Inline assembler section(s).

+ * =======================================================

+ * Order of arguments is chosen to facilitate Windows port

+ * using __fastcall calling convention. If you wish to add

+ * more routines, keep in mind that first __fastcall

+ * argument is passed in %ecx and second - in %edx.

+ * =======================================================

+ */

+#if defined(__GNUC__) && __GNUC__>=2

+/*

+ * As for excessive "push %ebx"/"pop %ebx" found all over.

+ * When generating position-independent code GCC won't let

+ * us use "b" in assembler templates nor even respect "ebx"

+ * in "clobber description." Therefore the trouble...

+ */

+

+/* Helper function - check if a CPUID instruction

+   is available on this CPU */

+static int

+padlock_insn_cpuid_available(void)

+{

+	int result = -1;

+

+	/* We're checking if the bit #21 of EFLAGS 

+	   can be toggled. If yes = CPUID is available. */

+	asm volatile (

+		"pushf\n"

+		"popl %%eax\n"

+		"xorl $0x200000, %%eax\n"

+		"movl %%eax, %%ecx\n"

+		"andl $0x200000, %%ecx\n"

+		"pushl %%eax\n"

+		"popf\n"

+		"pushf\n"

+		"popl %%eax\n"

+		"andl $0x200000, %%eax\n"

+		"xorl %%eax, %%ecx\n"

+		"movl %%ecx, %0\n"

+		: "=r" (result) : : "eax", "ecx");

+	

+	return (result == 0);

+}

+

+/* Load supported features of the CPU to see if

+   the PadLock is available. */

+static int

+padlock_available(void)

+{

+	char vendor_string[16];

+	unsigned int eax, edx;

+

+	/* First check if the CPUID instruction is available at all... */

+	if (! padlock_insn_cpuid_available())

+		return 0;

+

+	/* Are we running on the Centaur (VIA) CPU? */

+	eax = 0x00000000;

+	vendor_string[12] = 0;

+	asm volatile (

+		"pushl	%%ebx\n"

+		"cpuid\n"

+		"movl	%%ebx,(%%edi)\n"

+		"movl	%%edx,4(%%edi)\n"

+		"movl	%%ecx,8(%%edi)\n"

+		"popl	%%ebx"

+		: "+a"(eax) : "D"(vendor_string) : "ecx", "edx");

+	if (strcmp(vendor_string, "CentaurHauls") != 0)

+		return 0;

+

+	/* Check for Centaur Extended Feature Flags presence */

+	eax = 0xC0000000;

+	asm volatile ("pushl %%ebx; cpuid; popl	%%ebx"

+		: "+a"(eax) : : "ecx", "edx");

+	if (eax < 0xC0000001)

+		return 0;

+

+	/* Read the Centaur Extended Feature Flags */

+	eax = 0xC0000001;

+	asm volatile ("pushl %%ebx; cpuid; popl %%ebx"

+		: "+a"(eax), "=d"(edx) : : "ecx");

+

+	/* Fill up some flags */

+	padlock_use_ace = ((edx & (0x3<<6)) == (0x3<<6));

+	padlock_use_rng = ((edx & (0x3<<2)) == (0x3<<2));

+

+	return padlock_use_ace + padlock_use_rng;

+}

+

+#ifndef OPENSSL_NO_AES

+/* Our own htonl()/ntohl() */

+static inline void

+padlock_bswapl(AES_KEY *ks)

+{

+	size_t i = sizeof(ks->rd_key)/sizeof(ks->rd_key[0]);

+	unsigned int *key = ks->rd_key;

+

+	while (i--) {

+		asm volatile ("bswapl %0" : "+r"(*key));

+		key++;

+	}

+}

+#endif

+

+/* Force key reload from memory to the CPU microcode.

+   Loading EFLAGS from the stack clears EFLAGS[30] 

+   which does the trick. */

+static inline void

+padlock_reload_key(void)

+{

+	asm volatile ("pushfl; popfl");

+}

+

+#ifndef OPENSSL_NO_AES

+/*

+ * This is heuristic key context tracing. At first one

+ * believes that one should use atomic swap instructions,

+ * but it's not actually necessary. Point is that if

+ * padlock_saved_context was changed by another thread

+ * after we've read it and before we compare it with cdata,

+ * our key *shall* be reloaded upon thread context switch

+ * and we are therefore set in either case...

+ */

+static inline void

+padlock_verify_context(struct padlock_cipher_data *cdata)

+{

+	asm volatile (

+	"pushfl\n"

+"	btl	$30,(%%esp)\n"

+"	jnc	1f\n"

+"	cmpl	%2,%1\n"

+"	je	1f\n"

+"	popfl\n"

+"	subl	$4,%%esp\n"

+"1:	addl	$4,%%esp\n"

+"	movl	%2,%0"

+	:"+m"(padlock_saved_context)

+	: "r"(padlock_saved_context), "r"(cdata) : "cc");

+}

+

+/* Template for padlock_xcrypt_* modes */

+/* BIG FAT WARNING: 

+ * 	The offsets used with 'leal' instructions

+ * 	describe items of the 'padlock_cipher_data'

+ * 	structure.

+ */

+#define PADLOCK_XCRYPT_ASM(name,rep_xcrypt)	\

+static inline void *name(size_t cnt,		\

+	struct padlock_cipher_data *cdata,	\

+	void *out, const void *inp) 		\

+{	void *iv; 				\

+	asm volatile ( "pushl	%%ebx\n"	\

+		"	leal	16(%0),%%edx\n"	\

+		"	leal	32(%0),%%ebx\n"	\

+			rep_xcrypt "\n"		\

+		"	popl	%%ebx"		\

+		: "=a"(iv), "=c"(cnt), "=D"(out), "=S"(inp) \

+		: "0"(cdata), "1"(cnt), "2"(out), "3"(inp)  \

+		: "edx", "cc", "memory");	\

+	return iv;				\

+}

+

+/* Generate all functions with appropriate opcodes */

+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb, ".byte 0xf3,0x0f,0xa7,0xc8")	/* rep xcryptecb */

+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc, ".byte 0xf3,0x0f,0xa7,0xd0")	/* rep xcryptcbc */

+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb, ".byte 0xf3,0x0f,0xa7,0xe0")	/* rep xcryptcfb */

+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb, ".byte 0xf3,0x0f,0xa7,0xe8")	/* rep xcryptofb */

+#endif

+

+/* The RNG call itself */

+static inline unsigned int

+padlock_xstore(void *addr, unsigned int edx_in)

+{

+	unsigned int eax_out;

+

+	asm volatile (".byte 0x0f,0xa7,0xc0"	/* xstore */

+	    : "=a"(eax_out),"=m"(*(unsigned *)addr)

+	    : "D"(addr), "d" (edx_in)

+	    );

+

+	return eax_out;

+}

+

+/* Why not inline 'rep movsd'? I failed to find information on what

+ * value in Direction Flag one can expect and consequently have to

+ * apply "better-safe-than-sorry" approach and assume "undefined."

+ * I could explicitly clear it and restore the original value upon

+ * return from padlock_aes_cipher, but it's presumably too much

+ * trouble for too little gain...

+ *

+ * In case you wonder 'rep xcrypt*' instructions above are *not*

+ * affected by the Direction Flag and pointers advance toward

+ * larger addresses unconditionally.

+ */ 

+static inline unsigned char *

+padlock_memcpy(void *dst,const void *src,size_t n)

+{

+	long       *d=dst;

+	const long *s=src;

+

+	n /= sizeof(*d);

+	do { *d++ = *s++; } while (--n);

+

+	return dst;

+}

+

+#elif defined(_MSC_VER)

+/*

+ * Unlike GCC these are real functions. In order to minimize impact

+ * on performance we adhere to __fastcall calling convention in

+ * order to get two first arguments passed through %ecx and %edx.

+ * Which kind of suits very well, as instructions in question use

+ * both %ecx and %edx as input:-)

+ */

+#define REP_XCRYPT(code)		\

+	_asm _emit 0xf3			\

+	_asm _emit 0x0f _asm _emit 0xa7	\

+	_asm _emit code

+

+/* BIG FAT WARNING: 

+ * 	The offsets used with 'lea' instructions

+ * 	describe items of the 'padlock_cipher_data'

+ * 	structure.

+ */

+#define PADLOCK_XCRYPT_ASM(name,code)	\

+static void * __fastcall 		\

+	name (size_t cnt, void *cdata,	\

+	void *outp, const void *inp)	\

+{	_asm	mov	eax,edx		\

+	_asm	lea	edx,[eax+16]	\

+	_asm	lea	ebx,[eax+32]	\

+	_asm	mov	edi,outp	\

+	_asm	mov	esi,inp		\

+	REP_XCRYPT(code)		\

+}

+

+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb,0xc8)

+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc,0xd0)

+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb,0xe0)

+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb,0xe8)

+

+static int __fastcall

+padlock_xstore(void *outp,unsigned int code)

+{	_asm	mov	edi,ecx

+	_asm _emit 0x0f _asm _emit 0xa7 _asm _emit 0xc0

+}

+

+static void __fastcall

+padlock_reload_key(void)

+{	_asm pushfd _asm popfd		}

+

+static void __fastcall

+padlock_verify_context(void *cdata)

+{	_asm	{

+		pushfd

+		bt	DWORD PTR[esp],30

+		jnc	skip

+		cmp	ecx,padlock_saved_context

+		je	skip

+		popfd

+		sub	esp,4

+	skip:	add	esp,4

+		mov	padlock_saved_context,ecx

+		}

+}

+

+static int

+padlock_available(void)

+{	_asm	{

+		pushfd

+		pop	eax

+		mov	ecx,eax

+		xor	eax,1<<21

+		push	eax

+		popfd

+		pushfd

+		pop	eax

+		xor	eax,ecx

+		bt	eax,21

+		jnc	noluck

+		mov	eax,0

+		cpuid

+		xor	eax,eax

+		cmp	ebx,'tneC'

+		jne	noluck

+		cmp	edx,'Hrua'

+		jne	noluck

+		cmp	ecx,'slua'

+		jne	noluck

+		mov	eax,0xC0000000

+		cpuid

+		mov	edx,eax

+		xor	eax,eax

+		cmp	edx,0xC0000001

+		jb	noluck

+		mov	eax,0xC0000001

+		cpuid

+		xor	eax,eax

+		bt	edx,6

+		jnc	skip_a

+		bt	edx,7

+		jnc	skip_a

+		mov	padlock_use_ace,1

+		inc	eax

+	skip_a:	bt	edx,2

+		jnc	skip_r

+		bt	edx,3

+		jnc	skip_r

+		mov	padlock_use_rng,1

+		inc	eax

+	skip_r:

+	noluck:

+		}

+}

+

+static void __fastcall

+padlock_bswapl(void *key)

+{	_asm	{

+		pushfd

+		cld

+		mov	esi,ecx

+		mov	edi,ecx

+		mov	ecx,60

+	up:	lodsd

+		bswap	eax

+		stosd

+		loop	up

+		popfd

+		}

+}

+

+/* MS actually specifies status of Direction Flag and compiler even

+ * manages to compile following as 'rep movsd' all by itself...

+ */

+#define padlock_memcpy(o,i,n) ((unsigned char *)memcpy((o),(i),(n)&~3U))

+#endif

+

+/* ===== AES encryption/decryption ===== */

+#ifndef OPENSSL_NO_AES

+

+#if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)

+#define NID_aes_128_cfb	NID_aes_128_cfb128

+#endif

+

+#if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)

+#define NID_aes_128_ofb	NID_aes_128_ofb128

+#endif

+

+#if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)

+#define NID_aes_192_cfb	NID_aes_192_cfb128

+#endif

+

+#if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)

+#define NID_aes_192_ofb	NID_aes_192_ofb128

+#endif

+

+#if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)

+#define NID_aes_256_cfb	NID_aes_256_cfb128

+#endif

+

+#if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)

+#define NID_aes_256_ofb	NID_aes_256_ofb128

+#endif

+

+/* List of supported ciphers. */

+static int padlock_cipher_nids[] = {

+	NID_aes_128_ecb,

+	NID_aes_128_cbc,

+	NID_aes_128_cfb,

+	NID_aes_128_ofb,

+

+	NID_aes_192_ecb,

+	NID_aes_192_cbc,

+	NID_aes_192_cfb,

+	NID_aes_192_ofb,

+

+	NID_aes_256_ecb,

+	NID_aes_256_cbc,

+	NID_aes_256_cfb,

+	NID_aes_256_ofb,

+};

+static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids)/

+				      sizeof(padlock_cipher_nids[0]));

+

+/* Function prototypes ... */

+static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,

+				const unsigned char *iv, int enc);

+static int padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

+			      const unsigned char *in, size_t nbytes);

+

+#define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) +		\

+	( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F )	)

+#define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\

+	NEAREST_ALIGNED(ctx->cipher_data))

+

+#define EVP_CIPHER_block_size_ECB	AES_BLOCK_SIZE

+#define EVP_CIPHER_block_size_CBC	AES_BLOCK_SIZE

+#define EVP_CIPHER_block_size_OFB	1

+#define EVP_CIPHER_block_size_CFB	1

+

+/* Declaring so many ciphers by hand would be a pain.

+   Instead introduce a bit of preprocessor magic :-) */

+#define	DECLARE_AES_EVP(ksize,lmode,umode)	\

+static const EVP_CIPHER padlock_aes_##ksize##_##lmode = {	\

+	NID_aes_##ksize##_##lmode,		\

+	EVP_CIPHER_block_size_##umode,	\

+	AES_KEY_SIZE_##ksize,		\

+	AES_BLOCK_SIZE,			\

+	0 | EVP_CIPH_##umode##_MODE,	\

+	padlock_aes_init_key,		\

+	padlock_aes_cipher,		\

+	NULL,				\

+	sizeof(struct padlock_cipher_data) + 16,	\

+	EVP_CIPHER_set_asn1_iv,		\

+	EVP_CIPHER_get_asn1_iv,		\

+	NULL,				\

+	NULL				\

+}

+

+DECLARE_AES_EVP(128,ecb,ECB);

+DECLARE_AES_EVP(128,cbc,CBC);

+DECLARE_AES_EVP(128,cfb,CFB);

+DECLARE_AES_EVP(128,ofb,OFB);

+

+DECLARE_AES_EVP(192,ecb,ECB);

+DECLARE_AES_EVP(192,cbc,CBC);

+DECLARE_AES_EVP(192,cfb,CFB);

+DECLARE_AES_EVP(192,ofb,OFB);

+

+DECLARE_AES_EVP(256,ecb,ECB);

+DECLARE_AES_EVP(256,cbc,CBC);

+DECLARE_AES_EVP(256,cfb,CFB);

+DECLARE_AES_EVP(256,ofb,OFB);

+

+static int

+padlock_ciphers (ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid)

+{

+	/* No specific cipher => return a list of supported nids ... */

+	if (!cipher) {

+		*nids = padlock_cipher_nids;

+		return padlock_cipher_nids_num;

+	}

+

+	/* ... or the requested "cipher" otherwise */

+	switch (nid) {

+	  case NID_aes_128_ecb:

+	    *cipher = &padlock_aes_128_ecb;

+	    break;

+	  case NID_aes_128_cbc:

+	    *cipher = &padlock_aes_128_cbc;

+	    break;

+	  case NID_aes_128_cfb:

+	    *cipher = &padlock_aes_128_cfb;

+	    break;

+	  case NID_aes_128_ofb:

+	    *cipher = &padlock_aes_128_ofb;

+	    break;

+

+	  case NID_aes_192_ecb:

+	    *cipher = &padlock_aes_192_ecb;

+	    break;

+	  case NID_aes_192_cbc:

+	    *cipher = &padlock_aes_192_cbc;

+	    break;

+	  case NID_aes_192_cfb:

+	    *cipher = &padlock_aes_192_cfb;

+	    break;

+	  case NID_aes_192_ofb:

+	    *cipher = &padlock_aes_192_ofb;

+	    break;

+

+	  case NID_aes_256_ecb:

+	    *cipher = &padlock_aes_256_ecb;

+	    break;

+	  case NID_aes_256_cbc:

+	    *cipher = &padlock_aes_256_cbc;

+	    break;

+	  case NID_aes_256_cfb:

+	    *cipher = &padlock_aes_256_cfb;

+	    break;

+	  case NID_aes_256_ofb:

+	    *cipher = &padlock_aes_256_ofb;

+	    break;

+

+	  default:

+	    /* Sorry, we don't support this NID */

+	    *cipher = NULL;

+	    return 0;

+	}

+

+	return 1;

+}

+

+/* Prepare the encryption key for PadLock usage */

+static int

+padlock_aes_init_key (EVP_CIPHER_CTX *ctx, const unsigned char *key,

+		      const unsigned char *iv, int enc)

+{

+	struct padlock_cipher_data *cdata;

+	int key_len = EVP_CIPHER_CTX_key_length(ctx) * 8;

+

+	if (key==NULL) return 0;	/* ERROR */

+

+	cdata = ALIGNED_CIPHER_DATA(ctx);

+	memset(cdata, 0, sizeof(struct padlock_cipher_data));

+

+	/* Prepare Control word. */

+	if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE)

+		cdata->cword.b.encdec = 0;

+	else

+		cdata->cword.b.encdec = (ctx->encrypt == 0);

+	cdata->cword.b.rounds = 10 + (key_len - 128) / 32;

+	cdata->cword.b.ksize = (key_len - 128) / 64;

+

+	switch(key_len) {

+		case 128:

+			/* PadLock can generate an extended key for

+			   AES128 in hardware */

+			memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128);

+			cdata->cword.b.keygen = 0;

+			break;

+

+		case 192:

+		case 256:

+			/* Generate an extended AES key in software.

+			   Needed for AES192/AES256 */

+			/* Well, the above applies to Stepping 8 CPUs

+			   and is listed as hardware errata. They most

+			   likely will fix it at some point and then

+			   a check for stepping would be due here. */

+			if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CFB_MODE ||

+			    EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE ||

+			    enc)

+				AES_set_encrypt_key(key, key_len, &cdata->ks);

+			else

+				AES_set_decrypt_key(key, key_len, &cdata->ks);

+#ifndef AES_ASM

+			/* OpenSSL C functions use byte-swapped extended key. */

+			padlock_bswapl(&cdata->ks);

+#endif

+			cdata->cword.b.keygen = 1;

+			break;

+

+		default:

+			/* ERROR */

+			return 0;

+	}

+

+	/*

+	 * This is done to cover for cases when user reuses the

+	 * context for new key. The catch is that if we don't do

+	 * this, padlock_eas_cipher might proceed with old key...

+	 */

+	padlock_reload_key ();

+

+	return 1;

+}

+

+/* 

+ * Simplified version of padlock_aes_cipher() used when

+ * 1) both input and output buffers are at aligned addresses.

+ * or when

+ * 2) running on a newer CPU that doesn't require aligned buffers.

+ */

+static int

+padlock_aes_cipher_omnivorous(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,

+		const unsigned char *in_arg, size_t nbytes)

+{

+	struct padlock_cipher_data *cdata;

+	void  *iv;

+

+	cdata = ALIGNED_CIPHER_DATA(ctx);

+	padlock_verify_context(cdata);

+

+	switch (EVP_CIPHER_CTX_mode(ctx)) {

+	case EVP_CIPH_ECB_MODE:

+		padlock_xcrypt_ecb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

+		break;

+

+	case EVP_CIPH_CBC_MODE:

+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

+		iv = padlock_xcrypt_cbc(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

+		break;

+

+	case EVP_CIPH_CFB_MODE:

+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

+		iv = padlock_xcrypt_cfb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

+		break;

+

+	case EVP_CIPH_OFB_MODE:

+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

+		padlock_xcrypt_ofb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

+		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);

+		break;

+

+	default:

+		return 0;

+	}

+

+	memset(cdata->iv, 0, AES_BLOCK_SIZE);

+

+	return 1;

+}

+

+#ifndef  PADLOCK_CHUNK

+# define PADLOCK_CHUNK	512	/* Must be a power of 2 larger than 16 */

+#endif

+#if PADLOCK_CHUNK<16 || PADLOCK_CHUNK&(PADLOCK_CHUNK-1)

+# error "insane PADLOCK_CHUNK..."

+#endif

+

+/* Re-align the arguments to 16-Bytes boundaries and run the 

+   encryption function itself. This function is not AES-specific. */

+static int

+padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,

+		   const unsigned char *in_arg, size_t nbytes)

+{

+	struct padlock_cipher_data *cdata;

+	const  void *inp;

+	unsigned char  *out;

+	void  *iv;

+	int    inp_misaligned, out_misaligned, realign_in_loop;

+	size_t chunk, allocated=0;

+

+	/* ctx->num is maintained in byte-oriented modes,

+	   such as CFB and OFB... */

+	if ((chunk = ctx->num)) { /* borrow chunk variable */

+		unsigned char *ivp=ctx->iv;

+

+		switch (EVP_CIPHER_CTX_mode(ctx)) {

+		case EVP_CIPH_CFB_MODE:

+			if (chunk >= AES_BLOCK_SIZE)

+				return 0; /* bogus value */

+

+			if (ctx->encrypt)

+				while (chunk<AES_BLOCK_SIZE && nbytes!=0) {

+					ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk];

+					chunk++, nbytes--;

+				}

+			else	while (chunk<AES_BLOCK_SIZE && nbytes!=0) {

+					unsigned char c = *(in_arg++);

+					*(out_arg++) = c ^ ivp[chunk];

+					ivp[chunk++] = c, nbytes--;

+				}

+

+			ctx->num = chunk%AES_BLOCK_SIZE;

+			break;

+		case EVP_CIPH_OFB_MODE:

+			if (chunk >= AES_BLOCK_SIZE)

+				return 0; /* bogus value */

+

+			while (chunk<AES_BLOCK_SIZE && nbytes!=0) {

+				*(out_arg++) = *(in_arg++) ^ ivp[chunk];

+				chunk++, nbytes--;

+			}

+

+			ctx->num = chunk%AES_BLOCK_SIZE;

+			break;

+		}

+	}

+

+	if (nbytes == 0)

+		return 1;

+#if 0

+	if (nbytes % AES_BLOCK_SIZE)

+		return 0; /* are we expected to do tail processing? */

+#else

+	/* nbytes is always multiple of AES_BLOCK_SIZE in ECB and CBC

+	   modes and arbitrary value in byte-oriented modes, such as

+	   CFB and OFB... */

+#endif

+

+	/* VIA promises CPUs that won't require alignment in the future.

+	   For now padlock_aes_align_required is initialized to 1 and

+	   the condition is never met... */

+	/* C7 core is capable to manage unaligned input in non-ECB[!]

+	   mode, but performance penalties appear to be approximately

+	   same as for software alignment below or ~3x. They promise to

+	   improve it in the future, but for now we can just as well

+	   pretend that it can only handle aligned input... */

+	if (!padlock_aes_align_required && (nbytes%AES_BLOCK_SIZE)==0)

+		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);

+

+	inp_misaligned = (((size_t)in_arg) & 0x0F);

+	out_misaligned = (((size_t)out_arg) & 0x0F);

+

+	/* Note that even if output is aligned and input not,

+	 * I still prefer to loop instead of copy the whole

+	 * input and then encrypt in one stroke. This is done

+	 * in order to improve L1 cache utilization... */

+	realign_in_loop = out_misaligned|inp_misaligned;

+

+	if (!realign_in_loop && (nbytes%AES_BLOCK_SIZE)==0)

+		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);

+

+	/* this takes one "if" out of the loops */

+	chunk  = nbytes;

+	chunk %= PADLOCK_CHUNK;

+	if (chunk==0) chunk = PADLOCK_CHUNK;

+

+	if (out_misaligned) {

+		/* optmize for small input */

+		allocated = (chunk<nbytes?PADLOCK_CHUNK:nbytes);

+		out = alloca(0x10 + allocated);

+		out = NEAREST_ALIGNED(out);

+	}

+	else

+		out = out_arg;

+

+	cdata = ALIGNED_CIPHER_DATA(ctx);

+	padlock_verify_context(cdata);

+

+	switch (EVP_CIPHER_CTX_mode(ctx)) {

+	case EVP_CIPH_ECB_MODE:

+		do	{

+			if (inp_misaligned)

+				inp = padlock_memcpy(out, in_arg, chunk);

+			else

+				inp = in_arg;

+			in_arg += chunk;

+

+			padlock_xcrypt_ecb(chunk/AES_BLOCK_SIZE, cdata, out, inp);

+

+			if (out_misaligned)

+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

+			else

+				out     = out_arg+=chunk;

+

+			nbytes -= chunk;

+			chunk   = PADLOCK_CHUNK;

+		} while (nbytes);

+		break;

+

+	case EVP_CIPH_CBC_MODE:

+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

+		goto cbc_shortcut;

+		do	{

+			if (iv != cdata->iv)

+				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);

+			chunk = PADLOCK_CHUNK;

+		cbc_shortcut: /* optimize for small input */

+			if (inp_misaligned)

+				inp = padlock_memcpy(out, in_arg, chunk);

+			else

+				inp = in_arg;

+			in_arg += chunk;

+

+			iv = padlock_xcrypt_cbc(chunk/AES_BLOCK_SIZE, cdata, out, inp);

+

+			if (out_misaligned)

+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

+			else

+				out     = out_arg+=chunk;

+

+		} while (nbytes -= chunk);

+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

+		break;

+

+	case EVP_CIPH_CFB_MODE:

+		memcpy (iv = cdata->iv, ctx->iv, AES_BLOCK_SIZE);

+		chunk &= ~(AES_BLOCK_SIZE-1);

+		if (chunk)	goto cfb_shortcut;

+		else		goto cfb_skiploop;

+		do	{

+			if (iv != cdata->iv)

+				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);

+			chunk = PADLOCK_CHUNK;

+		cfb_shortcut: /* optimize for small input */

+			if (inp_misaligned)

+				inp = padlock_memcpy(out, in_arg, chunk);

+			else

+				inp = in_arg;

+			in_arg += chunk;

+

+			iv = padlock_xcrypt_cfb(chunk/AES_BLOCK_SIZE, cdata, out, inp);

+

+			if (out_misaligned)

+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

+			else

+				out     = out_arg+=chunk;

+

+			nbytes -= chunk;

+		} while (nbytes >= AES_BLOCK_SIZE);

+

+		cfb_skiploop:

+		if (nbytes) {

+			unsigned char *ivp = cdata->iv;

+

+			if (iv != ivp) {

+				memcpy(ivp, iv, AES_BLOCK_SIZE);

+				iv = ivp;

+			}

+			ctx->num = nbytes;

+			if (cdata->cword.b.encdec) {

+				cdata->cword.b.encdec=0;

+				padlock_reload_key();

+				padlock_xcrypt_ecb(1,cdata,ivp,ivp);

+				cdata->cword.b.encdec=1;

+				padlock_reload_key();

+				while(nbytes) {

+					unsigned char c = *(in_arg++);

+					*(out_arg++) = c ^ *ivp;

+					*(ivp++) = c, nbytes--;

+				}

+			}

+			else {	padlock_reload_key();

+				padlock_xcrypt_ecb(1,cdata,ivp,ivp);

+				padlock_reload_key();

+				while (nbytes) {

+					*ivp = *(out_arg++) = *(in_arg++) ^ *ivp;

+					ivp++, nbytes--;

+				}

+			}

+		}

+

+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

+		break;

+

+	case EVP_CIPH_OFB_MODE:

+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

+		chunk &= ~(AES_BLOCK_SIZE-1);

+		if (chunk) do	{

+			if (inp_misaligned)

+				inp = padlock_memcpy(out, in_arg, chunk);

+			else

+				inp = in_arg;

+			in_arg += chunk;

+

+			padlock_xcrypt_ofb(chunk/AES_BLOCK_SIZE, cdata, out, inp);

+

+			if (out_misaligned)

+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

+			else

+				out     = out_arg+=chunk;

+

+			nbytes -= chunk;

+			chunk   = PADLOCK_CHUNK;

+		} while (nbytes >= AES_BLOCK_SIZE);

+

+		if (nbytes) {

+			unsigned char *ivp = cdata->iv;

+

+			ctx->num = nbytes;

+			padlock_reload_key();	/* empirically found */

+			padlock_xcrypt_ecb(1,cdata,ivp,ivp);

+			padlock_reload_key();	/* empirically found */

+			while (nbytes) {

+				*(out_arg++) = *(in_arg++) ^ *ivp;

+				ivp++, nbytes--;

+			}

+		}

+

+		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);

+		break;

+

+	default:

+		return 0;

+	}

+

+	/* Clean the realign buffer if it was used */

+	if (out_misaligned) {

+		volatile unsigned long *p=(void *)out;

+		size_t   n = allocated/sizeof(*p);

+		while (n--) *p++=0;

+	}

+

+	memset(cdata->iv, 0, AES_BLOCK_SIZE);

+

+	return 1;

+}

+

+#endif /* OPENSSL_NO_AES */

+

+/* ===== Random Number Generator ===== */

+/*

+ * This code is not engaged. The reason is that it does not comply

+ * with recommendations for VIA RNG usage for secure applications

+ * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it

+ * provide meaningful error control...

+ */

+/* Wrapper that provides an interface between the API and 

+   the raw PadLock RNG */

+static int

+padlock_rand_bytes(unsigned char *output, int count)

+{

+	unsigned int eax, buf;

+

+	while (count >= 8) {

+		eax = padlock_xstore(output, 0);

+		if (!(eax&(1<<6)))	return 0; /* RNG disabled */

+		/* this ---vv--- covers DC bias, Raw Bits and String Filter */

+		if (eax&(0x1F<<10))	return 0;

+		if ((eax&0x1F)==0)	continue; /* no data, retry... */

+		if ((eax&0x1F)!=8)	return 0; /* fatal failure...  */

+		output += 8;

+		count  -= 8;

+	}

+	while (count > 0) {

+		eax = padlock_xstore(&buf, 3);

+		if (!(eax&(1<<6)))	return 0; /* RNG disabled */

+		/* this ---vv--- covers DC bias, Raw Bits and String Filter */

+		if (eax&(0x1F<<10))	return 0;

+		if ((eax&0x1F)==0)	continue; /* no data, retry... */

+		if ((eax&0x1F)!=1)	return 0; /* fatal failure...  */

+		*output++ = (unsigned char)buf;

+		count--;

+	}

+	*(volatile unsigned int *)&buf=0;

+

+	return 1;

+}

+

+/* Dummy but necessary function */

+static int

+padlock_rand_status(void)

+{

+	return 1;

+}

+

+/* Prepare structure for registration */

+static RAND_METHOD padlock_rand = {

+	NULL,			/* seed */

+	padlock_rand_bytes,	/* bytes */

+	NULL,			/* cleanup */

+	NULL,			/* add */

+	padlock_rand_bytes,	/* pseudorand */

+	padlock_rand_status,	/* rand status */

+};

+

+#else  /* !COMPILE_HW_PADLOCK */

+#ifndef OPENSSL_NO_DYNAMIC_ENGINE

+OPENSSL_EXPORT

+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);

+OPENSSL_EXPORT

+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }

+IMPLEMENT_DYNAMIC_CHECK_FN()

+#endif

+#endif /* COMPILE_HW_PADLOCK */

+

+#endif /* !OPENSSL_NO_HW_PADLOCK */

+#endif /* !OPENSSL_NO_HW */

diff --git a/openssl/engines/makeengines.com b/openssl/engines/makeengines.com
index 6cf423607..a7e4aa86d 100644
--- a/openssl/engines/makeengines.com
+++ b/openssl/engines/makeengines.com
@@ -1,961 +1,1021 @@
-$!
-$!  MAKEENGINES.COM
-$!  Written By:  Richard Levitte
-$!               richard@levitte.org
-$!
-$!  This command file compiles and creates the various engines in form
-$!  of shared images.  They are placed in [.xxx.EXE.ENGINES], where "xxx"
-$!  is ALPHA, IA64 or VAX, depending on your hardware.
-$!
-$!  P1	if this is ENGINES or ALL, the engines will build, otherwise not.
-$!
-$!  P2	DEBUG or NODEBUG to compile with or without debugger information.
-$!
-$!  P3  VAXC		for VAX C
-$!	DECC		for DEC C
-$!	GNUC		for GNU C (untested)
-$!
-$!  P4	if defined, sets the TCP/IP libraries to use.  UCX or TCPIP is
-$!	used by default since most other implementations come with a
-$!	compatibility library.  The value must be one of the following:
-$!
-$!	UCX		for UCX
-$!	SOCKETSHR	for SOCKETSHR+NETLIB
-$!	TCPIP		for TCPIP (post UCX)
-$!
-$!  P5	if defined, tells the compiler not to use special threads.
-$!
-$!  P6	if defined, denotes which engines to build.  If not defined,
-$!	all available engines are built.
-$!
-$!-----------------------------------------------------------------------------
-$!
-$! Set the default TCP/IP library to link against if needed
-$!
-$ TCPIP_LIB = ""
-$!
-$! Check What Architecture We Are Using.
-$!
-$ IF (F$GETSYI("CPU").LT.128)
-$ THEN
-$!
-$!  The Architecture Is VAX.
-$!
-$   ARCH = "VAX"
-$!
-$! Else...
-$!
-$ ELSE
-$!
-$!  The Architecture Is Alpha, IA64 or whatever comes in the future.
-$!
-$   ARCH = F$EDIT( F$GETSYI( "ARCH_NAME"), "UPCASE")
-$   IF (ARCH .EQS. "") THEN ARCH = "UNK"
-$!
-$! End The Architecture Check.
-$!
-$ ENDIF
-$!
-$! Set the names of the engines we want to build
-$! NOTE: Some might think this list ugly.  However, it's made this way to
-$! reflect the LIBNAMES variable in Makefile as closely as possible,
-$! thereby making it fairly easy to verify that the lists are the same.
-$! NOTE: gmp isn't built, as it's mostly a test engine and brings in another
-$! library that isn't necessarely ported to VMS.
-$!
-$ ENGINES = "," + P6
-$ IF ENGINES .EQS. "," THEN -
-	ENGINES = ",4758cca,aep,atalla,cswift,chil,nuron,sureware,ubsec,padlock,"
-$!
-$! GOST requires a 64-bit integer type, unavailable on VAX.
-$!
-$ IF (ARCH .NES. "VAX") THEN -
-       ENGINES = ENGINES+ ",ccgost"
-$!
-$! Set the goal directories, and create them if necessary
-$!
-$ OBJ_DIR := SYS$DISK:[-.'ARCH'.OBJ.ENGINES]
-$ EXE_DIR := SYS$DISK:[-.'ARCH'.EXE.ENGINES]
-$ IF F$PARSE(OBJ_DIR) .EQS. "" THEN CREATE/DIRECTORY 'OBJ_DIR'
-$ IF F$PARSE(EXE_DIR) .EQS. "" THEN CREATE/DIRECTORY 'EXE_DIR'
-$!
-$! Set the goal files, and create them if necessary
-$!
-$ CRYPTO_LIB :=SYS$DISK:[-.'ARCH'.EXE.CRYPTO]LIBCRYPTO.OLB
-$ IF F$SEARCH(CRYPTO_LIB) .EQS. "" THEN LIBRARY/CREATE/OBJECT 'CRYPTO_LIB'
-$!
-$! OK, time to check options and initialise
-$!
-$ OPT_PHASE = P1
-$ ACCEPT_PHASE = "ALL,ENGINES"
-$ OPT_DEBUG = P2
-$ OPT_COMPILER = P3
-$ OPT_TCPIP_LIB = P4
-$ OPT_SPECIAL_THREADS = P5
-$
-$ GOSUB CHECK_OPTIONS
-$ GOSUB INITIALISE
-$ GOSUB CHECK_OPT_FILE
-$!
-$! Define what goes into each engine.  VAX includes a transfer vector.
-$!
-$ ENGINE_ = ""
-$ TV_OBJ = ""
-$ IF ARCH .EQS. "VAX"
-$ THEN
-$   ENGINE_ = "engine_vector.mar"
-$   TV_OBJ_NAME = OBJ_DIR + F$PARSE(ENGINE_,,,"NAME","SYNTAX_ONLY") + ".OBJ"
-$   TV_OBJ = ",''TV_OBJ_NAME'"
-$ ENDIF
-$ ENGINE_4758CCA = "e_4758cca"
-$ ENGINE_aep = "e_aep"
-$ ENGINE_atalla = "e_atalla"
-$ ENGINE_cswift = "e_cswift"
-$ ENGINE_chil = "e_chil"
-$ ENGINE_nuron = "e_nuron"
-$ ENGINE_sureware = "e_sureware"
-$ ENGINE_ubsec = "e_ubsec"
-$ ENGINE_padlock = "e_padlock"
-$
-$ ENGINE_ccgost_SUBDIR = "ccgost"
-$ ENGINE_ccgost = "e_gost_err,gost2001_keyx,gost2001,gost89,gost94_keyx,"+ -
-		  "gost_ameth,gost_asn1,gost_crypt,gost_ctl,gost_eng,"+ -
-		  "gosthash,gost_keywrap,gost_md,gost_params,gost_pmeth,"+ -
-		  "gost_sign"
-$!
-$! Define which programs need to be linked with a TCP/IP library
-$!
-$ TCPIP_ENGINES = ",,"
-$ IF COMPILER .EQS. "VAXC" THEN -
-     TCPIP_ENGINES = ",,"
-$!
-$! Set up two loops, one that keeps track of the engines,
-$! and one that keeps track of all the files going into
-$! the current engine.
-$!
-$! Here's the start of the engine loop.
-$!
-$ ENGINE_COUNTER = 0
-$ ENGINE_NEXT:
-$!
-$! Extract the current engine name, and if we've reached the end, stop
-$!
-$ ENGINE_NAME = F$ELEMENT(ENGINE_COUNTER,",",ENGINES)
-$ IF (ENGINE_NAME.EQS.",") THEN GOTO ENGINE_DONE
-$!
-$ ENGINE_COUNTER = ENGINE_COUNTER + 1
-$!
-$! Set up the engine library names.
-$!
-$ LIB_ENGINE = "ENGINE_" + ENGINE_NAME
-$!
-$! Check if the library module name actually is defined
-$!
-$ IF F$TYPE('LIB_ENGINE') .EQS. ""
-$ THEN
-$   WRITE SYS$ERROR ""
-$   WRITE SYS$ERROR "The module ",ENGINE_NAME," does not exist.  Continuing..."
-$   WRITE SYS$ERROR ""
-$   GOTO ENGINE_NEXT
-$ ENDIF
-$!
-$! Talk to the user
-$!
-$ IF ENGINE_NAME .NES. ""
-$ THEN
-$   WRITE SYS$OUTPUT "Compiling The ",ENGINE_NAME," Library Files. (",BUILDALL,")"
-$ ELSE
-$   WRITE SYS$OUTPUT "Compiling Support Files. (",BUILDALL,")"
-$ ENDIF
-$!
-$! Create a .OPT file for the object files (for a real engine name).
-$!
-$ IF ENGINE_NAME .NES. ""
-$ THEN
-$   OPEN/WRITE OBJECTS 'EXE_DIR''ENGINE_NAME'.OPT
-$ ENDIF
-$!
-$! Here's the start of per-engine module loop.
-$!
-$ FILE_COUNTER = 0
-$ FILE_NEXT:
-$!
-$! Extract the file name from the file list, and if we've reached the end, stop
-$!
-$ FILE_NAME = F$ELEMENT(FILE_COUNTER,",",'LIB_ENGINE')
-$ IF (FILE_NAME.EQS.",") THEN GOTO FILE_DONE
-$!
-$ FILE_COUNTER = FILE_COUNTER + 1
-$!
-$ IF FILE_NAME .EQS. "" THEN GOTO FILE_NEXT
-$!
-$! Set up the source and object reference
-$!
-$ IF F$TYPE('LIB_ENGINE'_SUBDIR) .EQS. ""
-$ THEN
-$     SOURCE_FILE = F$PARSE(FILE_NAME,"SYS$DISK:[].C",,,"SYNTAX_ONLY")
-$ ELSE
-$     SOURCE_FILE = F$PARSE(FILE_NAME,"SYS$DISK:[."+'LIB_ENGINE'_SUBDIR+"].C",,,"SYNTAX_ONLY")
-$ ENDIF
-$ OBJECT_FILE = OBJ_DIR + F$PARSE(FILE_NAME,,,"NAME","SYNTAX_ONLY") + ".OBJ"
-$!
-$! If we get some problem, we just go on trying to build the next module.
-$ ON WARNING THEN GOTO FILE_NEXT
-$!
-$! Check if the module we want to compile is actually there.
-$!
-$ IF F$SEARCH(SOURCE_FILE) .EQS. ""
-$ THEN
-$   WRITE SYS$OUTPUT ""
-$   WRITE SYS$OUTPUT "The File ",SOURCE_FILE," Doesn't Exist."
-$   WRITE SYS$OUTPUT ""
-$   GOTO EXIT
-$ ENDIF
-$!
-$! Talk to the user.
-$!
-$ WRITE SYS$OUTPUT "	",FILE_NAME,""
-$!
-$! Do the dirty work.
-$!
-$ ON ERROR THEN GOTO FILE_NEXT
-$ IF F$EDIT(F$PARSE(SOURCE_FILE,,,"TYPE","SYNTAX_ONLY"),"UPCASE") .EQS. ".MAR"
-$ THEN
-$   MACRO/OBJECT='OBJECT_FILE' 'SOURCE_FILE'
-$ ELSE
-$   CC/OBJECT='OBJECT_FILE' 'SOURCE_FILE'
-$ ENDIF
-$!
-$! Write the entry to the .OPT file (for a real engine name).
-$!
-$ IF ENGINE_NAME .NES. ""
-$ THEN
-$   WRITE OBJECTS OBJECT_FILE
-$ ENDIF
-$!
-$! Next file
-$!
-$ GOTO FILE_NEXT
-$!
-$ FILE_DONE:
-$!
-$! Do not link the support files.
-$!
-$ IF ENGINE_NAME .EQS. "" THEN GOTO ENGINE_NEXT
-$!
-$! Close the linker options file (for a real engine name).
-$!
-$ CLOSE OBJECTS
-$!
-$! Now, there are two ways to handle this.  We can either build 
-$! shareable images or stick the engine object file into libcrypto.
-$! For now, the latter is NOT supported.
-$!
-$!!!!! LIBRARY/REPLACE 'CRYPTO_LIB' 'OBJECT_FILE'
-$!
-$! For shareable libraries, we need to do things a little differently
-$! depending on if we link with a TCP/IP library or not.
-$!
-$ ENGINE_OPT := SYS$DISK:[]'ARCH'.OPT
-$ IF TCPIP_LIB .NES. ""
-$ THEN
-$   LINK/'DEBUGGER'/'TRACEBACK' /SHARE='EXE_DIR''ENGINE_NAME'.EXE -
-	'EXE_DIR''ENGINE_NAME'.OPT/OPTION'TV_OBJ', -
-	'CRYPTO_LIB'/LIBRARY, -
-	'ENGINE_OPT'/OPTION,'TCPIP_LIB','OPT_FILE'/OPTION
-$ ELSE
-$   LINK/'DEBUGGER'/'TRACEBACK' /SHARE='EXE_DIR''ENGINE_NAME'.EXE -
-	'EXE_DIR''ENGINE_NAME'.OPT/OPTION'TV_OBJ', -
-        'CRYPTO_LIB'/LIBRARY, -
-	'ENGINE_OPT'/OPTION,'OPT_FILE'/OPTION
-$ ENDIF
-$!
-$! Next engine
-$!
-$ GOTO ENGINE_NEXT
-$!
-$ ENGINE_DONE:
-$!
-$! Talk to the user
-$!
-$ WRITE SYS$OUTPUT "All Done..."
-$ EXIT:
-$ GOSUB CLEANUP
-$ EXIT
-$!
-$! Check For The Link Option FIle.
-$!
-$ CHECK_OPT_FILE:
-$!
-$! Check To See If We Need To Make A VAX C Option File.
-$!
-$ IF (COMPILER.EQS."VAXC")
-$ THEN
-$!
-$!  Check To See If We Already Have A VAX C Linker Option File.
-$!
-$   IF (F$SEARCH(OPT_FILE).EQS."")
-$   THEN
-$!
-$!    We Need A VAX C Linker Option File.
-$!
-$     CREATE 'OPT_FILE'
-$DECK
-!
-! Default System Options File To Link Agianst 
-! The Sharable VAX C Runtime Library.
-!
-SYS$SHARE:VAXCRTL.EXE/SHARE
-$EOD
-$!
-$!  End The Option File Check.
-$!
-$   ENDIF
-$!
-$! End The VAXC Check.
-$!
-$ ENDIF
-$!
-$! Check To See If We Need A GNU C Option File.
-$!
-$ IF (COMPILER.EQS."GNUC")
-$ THEN
-$!
-$!  Check To See If We Already Have A GNU C Linker Option File.
-$!
-$   IF (F$SEARCH(OPT_FILE).EQS."")
-$   THEN
-$!
-$!    We Need A GNU C Linker Option File.
-$!
-$     CREATE 'OPT_FILE'
-$DECK
-!
-! Default System Options File To Link Agianst 
-! The Sharable C Runtime Library.
-!
-GNU_CC:[000000]GCCLIB/LIBRARY
-SYS$SHARE:VAXCRTL/SHARE
-$EOD
-$!
-$!  End The Option File Check.
-$!
-$   ENDIF
-$!
-$! End The GNU C Check.
-$!
-$ ENDIF
-$!
-$! Check To See If We Need A DEC C Option File.
-$!
-$ IF (COMPILER.EQS."DECC")
-$ THEN
-$!
-$!  Check To See If We Already Have A DEC C Linker Option File.
-$!
-$   IF (F$SEARCH(OPT_FILE).EQS."")
-$   THEN
-$!
-$!    Figure Out If We Need A non-VAX Or A VAX Linker Option File.
-$!
-$     IF ARCH .EQS. "VAX"
-$     THEN
-$!
-$!      We Need A DEC C Linker Option File For VAX.
-$!
-$       CREATE 'OPT_FILE'
-$DECK
-!
-! Default System Options File To Link Agianst 
-! The Sharable DEC C Runtime Library.
-!
-SYS$SHARE:DECC$SHR.EXE/SHARE
-$EOD
-$!
-$!    Else...
-$!
-$     ELSE
-$!
-$!      Create The non-VAX Linker Option File.
-$!
-$       CREATE 'OPT_FILE'
-$DECK
-!
-! Default System Options File For non-VAX To Link Agianst 
-! The Sharable C Runtime Library.
-!
-SYS$SHARE:CMA$OPEN_LIB_SHR/SHARE
-SYS$SHARE:CMA$OPEN_RTL/SHARE
-$EOD
-$!
-$!    End The DEC C Option File Check.
-$!
-$     ENDIF
-$!
-$!  End The Option File Search.
-$!
-$   ENDIF
-$!
-$! End The DEC C Check.
-$!
-$ ENDIF
-$!
-$!  Tell The User What Linker Option File We Are Using.
-$!
-$ WRITE SYS$OUTPUT "Using Linker Option File ",OPT_FILE,"."	
-$!
-$! Time To RETURN.
-$!
-$ RETURN
-$!
-$! Check The User's Options.
-$!
-$ CHECK_OPTIONS:
-$!
-$! Check To See If OPT_PHASE Is Blank.
-$!
-$ IF (OPT_PHASE.EQS."ALL")
-$ THEN
-$!
-$!   OPT_PHASE Is Blank, So Build Everything.
-$!
-$    BUILDALL = "ALL"
-$!
-$! Else...
-$!
-$ ELSE
-$!
-$!  Else, Check To See If OPT_PHASE Has A Valid Argument.
-$!
-$   IF ("," + ACCEPT_PHASE + ",") - ("," + OPT_PHASE + ",") -
-       .NES. ("," + ACCEPT_PHASE + ",")
-$   THEN
-$!
-$!    A Valid Argument.
-$!
-$     BUILDALL = OPT_PHASE
-$!
-$!  Else...
-$!
-$   ELSE
-$!
-$!    Tell The User We Don't Know What They Want.
-$!
-$     WRITE SYS$OUTPUT ""
-$     WRITE SYS$OUTPUT "The option ",OPT_PHASE," is invalid.  The valid options are:"
-$     WRITE SYS$OUTPUT ""
-$     IF ("," + ACCEPT_PHASE + ",") - ",ALL," -
-	.NES. ("," + ACCEPT_PHASE + ",") THEN -
-	WRITE SYS$OUTPUT "    ALL      :  just build everything."
-$     IF ("," + ACCEPT_PHASE + ",") - ",ENGINES," -
-	.NES. ("," + ACCEPT_PHASE + ",") THEN -
-	WRITE SYS$OUTPUT "    ENGINES  :  to compile just the [.xxx.EXE.ENGINES]*.EXE hareable images."
-$     WRITE SYS$OUTPUT ""
-$     WRITE SYS$OUTPUT " where 'xxx' stands for:"
-$     WRITE SYS$OUTPUT ""
-$     WRITE SYS$OUTPUT "    ALPHA    :  Alpha architecture."
-$     WRITE SYS$OUTPUT "    IA64     :  IA64 architecture."
-$     WRITE SYS$OUTPUT "    VAX      :  VAX architecture."
-$     WRITE SYS$OUTPUT ""
-$!
-$!    Time To EXIT.
-$!
-$     EXIT
-$!
-$!  End The Valid Argument Check.
-$!
-$   ENDIF
-$!
-$! End The OPT_PHASE Check.
-$!
-$ ENDIF
-$!
-$! Check To See If OPT_DEBUG Is Blank.
-$!
-$ IF (OPT_DEBUG.EQS."NODEBUG")
-$ THEN
-$!
-$!   OPT_DEBUG Is NODEBUG, So Compile Without The Debugger Information.
-$!
-$    DEBUGGER = "NODEBUG"
-$    TRACEBACK = "NOTRACEBACK" 
-$    GCC_OPTIMIZE = "OPTIMIZE"
-$    CC_OPTIMIZE = "OPTIMIZE"
-$    MACRO_OPTIMIZE = "OPTIMIZE"
-$    WRITE SYS$OUTPUT "No Debugger Information Will Be Produced During Compile."
-$    WRITE SYS$OUTPUT "Compiling With Compiler Optimization."
-$ ELSE
-$!
-$!  Check To See If We Are To Compile With Debugger Information.
-$!
-$   IF (OPT_DEBUG.EQS."DEBUG")
-$   THEN
-$!
-$!    Compile With Debugger Information.
-$!
-$     DEBUGGER = "DEBUG"
-$     TRACEBACK = "TRACEBACK"
-$     GCC_OPTIMIZE = "NOOPTIMIZE"
-$     CC_OPTIMIZE = "NOOPTIMIZE"
-$     MACRO_OPTIMIZE = "NOOPTIMIZE"
-$     WRITE SYS$OUTPUT "Debugger Information Will Be Produced During Compile."
-$     WRITE SYS$OUTPUT "Compiling Without Compiler Optimization."
-$   ELSE 
-$!
-$!    They Entered An Invalid Option..
-$!
-$     WRITE SYS$OUTPUT ""
-$     WRITE SYS$OUTPUT "The Option ",OPT_DEBUG," Is Invalid.  The Valid Options Are:"
-$     WRITE SYS$OUTPUT ""
-$     WRITE SYS$OUTPUT "     DEBUG   :  Compile With The Debugger Information."
-$     WRITE SYS$OUTPUT "     NODEBUG :  Compile Without The Debugger Information."
-$     WRITE SYS$OUTPUT ""
-$!
-$!    Time To EXIT.
-$!
-$     EXIT
-$!
-$!  End The Valid Argument Check.
-$!
-$   ENDIF
-$!
-$! End The OPT_DEBUG Check.
-$!
-$ ENDIF
-$!
-$! Special Threads For OpenVMS v7.1 Or Later
-$!
-$! Written By:  Richard Levitte
-$!              richard@levitte.org
-$!
-$!
-$! Check To See If We Have A Option For OPT_SPECIAL_THREADS.
-$!
-$ IF (OPT_SPECIAL_THREADS.EQS."")
-$ THEN
-$!
-$!  Get The Version Of VMS We Are Using.
-$!
-$   ISSEVEN :=
-$   TMP = F$ELEMENT(0,"-",F$EXTRACT(1,4,F$GETSYI("VERSION")))
-$   TMP = F$INTEGER(F$ELEMENT(0,".",TMP)+F$ELEMENT(1,".",TMP))
-$!
-$!  Check To See If The VMS Version Is v7.1 Or Later.
-$!
-$   IF (TMP.GE.71)
-$   THEN
-$!
-$!    We Have OpenVMS v7.1 Or Later, So Use The Special Threads.
-$!
-$     ISSEVEN := ,PTHREAD_USE_D4
-$!
-$!  End The VMS Version Check.
-$!
-$   ENDIF
-$!
-$! End The OPT_SPECIAL_THREADS Check.
-$!
-$ ENDIF
-$!
-$! Check To See If OPT_COMPILER Is Blank.
-$!
-$ IF (OPT_COMPILER.EQS."")
-$ THEN
-$!
-$!  O.K., The User Didn't Specify A Compiler, Let's Try To
-$!  Find Out Which One To Use.
-$!
-$!  Check To See If We Have GNU C.
-$!
-$   IF (F$TRNLNM("GNU_CC").NES."")
-$   THEN
-$!
-$!    Looks Like GNUC, Set To Use GNUC.
-$!
-$     OPT_COMPILER = "GNUC"
-$!
-$!  Else...
-$!
-$   ELSE
-$!
-$!    Check To See If We Have VAXC Or DECC.
-$!
-$     IF (ARCH.NES."VAX").OR.(F$TRNLNM("DECC$CC_DEFAULT").NES."")
-$     THEN 
-$!
-$!      Looks Like DECC, Set To Use DECC.
-$!
-$       OPT_COMPILER = "DECC"
-$!
-$!    Else...
-$!
-$     ELSE
-$!
-$!      Looks Like VAXC, Set To Use VAXC.
-$!
-$       OPT_COMPILER = "VAXC"
-$!
-$!    End The VAXC Compiler Check.
-$!
-$     ENDIF
-$!
-$!  End The DECC & VAXC Compiler Check.
-$!
-$   ENDIF
-$!
-$!  End The Compiler Check.
-$!
-$ ENDIF
-$!
-$! Check To See If We Have A Option For OPT_TCPIP_LIB.
-$!
-$ IF (OPT_TCPIP_LIB.EQS."")
-$ THEN
-$!
-$!  Find out what socket library we have available
-$!
-$   IF F$PARSE("SOCKETSHR:") .NES. ""
-$   THEN
-$!
-$!    We have SOCKETSHR, and it is my opinion that it's the best to use.
-$!
-$     OPT_TCPIP_LIB = "SOCKETSHR"
-$!
-$!    Tell the user
-$!
-$     WRITE SYS$OUTPUT "Using SOCKETSHR for TCP/IP"
-$!
-$!    Else, let's look for something else
-$!
-$   ELSE
-$!
-$!    Like UCX (the reason to do this before Multinet is that the UCX
-$!    emulation is easier to use...)
-$!
-$     IF F$TRNLNM("UCX$IPC_SHR") .NES. "" -
-	 .OR. F$PARSE("SYS$SHARE:UCX$IPC_SHR.EXE") .NES. "" -
-	 .OR. F$PARSE("SYS$LIBRARY:UCX$IPC.OLB") .NES. ""
-$     THEN
-$!
-$!	Last resort: a UCX or UCX-compatible library
-$!
-$	OPT_TCPIP_LIB = "UCX"
-$!
-$!      Tell the user
-$!
-$       WRITE SYS$OUTPUT "Using UCX or an emulation thereof for TCP/IP"
-$!
-$!	That was all...
-$!
-$     ENDIF
-$   ENDIF
-$ ENDIF
-$!
-$! Set Up Initial CC Definitions, Possibly With User Ones
-$!
-$ CCDEFS = "TCPIP_TYPE_''OPT_TCPIP_LIB',DSO_VMS"
-$ IF F$TYPE(USER_CCDEFS) .NES. "" THEN CCDEFS = CCDEFS + "," + USER_CCDEFS
-$ CCEXTRAFLAGS = ""
-$ IF F$TYPE(USER_CCFLAGS) .NES. "" THEN CCEXTRAFLAGS = USER_CCFLAGS
-$ CCDISABLEWARNINGS = "LONGLONGTYPE,LONGLONGSUFX"
-$ IF F$TYPE(USER_CCDISABLEWARNINGS) .NES. "" THEN -
-	CCDISABLEWARNINGS = CCDISABLEWARNINGS + "," + USER_CCDISABLEWARNINGS
-$!
-$!  Check To See If The User Entered A Valid Paramter.
-$!
-$ IF (OPT_COMPILER.EQS."VAXC").OR.(OPT_COMPILER.EQS."DECC").OR.(OPT_COMPILER.EQS."GNUC")
-$ THEN
-$!
-$!    Check To See If The User Wanted DECC.
-$!
-$   IF (OPT_COMPILER.EQS."DECC")
-$   THEN
-$!
-$!    Looks Like DECC, Set To Use DECC.
-$!
-$     COMPILER = "DECC"
-$!
-$!    Tell The User We Are Using DECC.
-$!
-$     WRITE SYS$OUTPUT "Using DECC 'C' Compiler."
-$!
-$!    Use DECC...
-$!
-$     CC = "CC"
-$     IF ARCH.EQS."VAX" .AND. F$TRNLNM("DECC$CC_DEFAULT").NES."/DECC" -
-	 THEN CC = "CC/DECC"
-$     CC = CC + "/''CC_OPTIMIZE'/''DEBUGGER'/STANDARD=ANSI89" + -
-           "/NOLIST/PREFIX=ALL" + -
-	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[.VENDOR_DEFNS])" + -
-	   CCEXTRAFLAGS
-$!
-$!    Define The Linker Options File Name.
-$!
-$     OPT_FILE = "''EXE_DIR'VAX_DECC_OPTIONS.OPT"
-$!
-$!  End DECC Check.
-$!
-$   ENDIF
-$!
-$!  Check To See If We Are To Use VAXC.
-$!
-$   IF (OPT_COMPILER.EQS."VAXC")
-$   THEN
-$!
-$!    Looks Like VAXC, Set To Use VAXC.
-$!
-$     COMPILER = "VAXC"
-$!
-$!    Tell The User We Are Using VAX C.
-$!
-$     WRITE SYS$OUTPUT "Using VAXC 'C' Compiler."
-$!
-$!    Compile Using VAXC.
-$!
-$     CC = "CC"
-$     IF ARCH.NES."VAX"
-$     THEN
-$	WRITE SYS$OUTPUT "There is no VAX C on Alpha!"
-$	EXIT
-$     ENDIF
-$     IF F$TRNLNM("DECC$CC_DEFAULT").EQS."/DECC" THEN CC = "CC/VAXC"
-$     CC = CC + "/''CC_OPTIMIZE'/''DEBUGGER'/NOLIST" + -
-	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[-],SYS$DISK:[.ENGINE.VENDOR_DEFNS])" + -
-	   CCEXTRAFLAGS
-$     CCDEFS = """VAXC""," + CCDEFS
-$!
-$!    Define <sys> As SYS$COMMON:[SYSLIB]
-$!
-$     DEFINE/NOLOG SYS SYS$COMMON:[SYSLIB]
-$!
-$!    Define The Linker Options File Name.
-$!
-$     OPT_FILE = "''EXE_DIR'VAX_VAXC_OPTIONS.OPT"
-$!
-$!  End VAXC Check
-$!
-$   ENDIF
-$!
-$!  Check To See If We Are To Use GNU C.
-$!
-$   IF (OPT_COMPILER.EQS."GNUC")
-$   THEN
-$!
-$!    Looks Like GNUC, Set To Use GNUC.
-$!
-$     COMPILER = "GNUC"
-$!
-$!    Tell The User We Are Using GNUC.
-$!
-$     WRITE SYS$OUTPUT "Using GNU 'C' Compiler."
-$!
-$!    Use GNU C...
-$!
-$     CC = "GCC/NOCASE_HACK/''GCC_OPTIMIZE'/''DEBUGGER'/NOLIST" + -
-	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[-],SYS$DISK:[.ENGINE.VENDOR_DEFNS])" + -
-	   CCEXTRAFLAGS
-$!
-$!    Define The Linker Options File Name.
-$!
-$     OPT_FILE = "''EXE_DIR'VAX_GNUC_OPTIONS.OPT"
-$!
-$!  End The GNU C Check.
-$!
-$   ENDIF
-$!
-$!  Set up default defines
-$!
-$   CCDEFS = """FLAT_INC=1""," + CCDEFS
-$!
-$!  Finish up the definition of CC.
-$!
-$   IF COMPILER .EQS. "DECC"
-$   THEN
-$     IF CCDISABLEWARNINGS .NES. ""
-$     THEN
-$       CCDISABLEWARNINGS = "/WARNING=(DISABLE=(" + CCDISABLEWARNINGS + "))"
-$     ENDIF
-$   ELSE
-$     CCDISABLEWARNINGS = ""
-$   ENDIF
-$   CC = CC + "/DEFINE=(" + CCDEFS + ")" + CCDISABLEWARNINGS
-$!
-$!  Show user the result
-$!
-$   WRITE/SYMBOL SYS$OUTPUT "Main C Compiling Command: ",CC
-$!
-$!  Else The User Entered An Invalid Argument.
-$!
-$ ELSE
-$!
-$!  Tell The User We Don't Know What They Want.
-$!
-$   WRITE SYS$OUTPUT ""
-$   WRITE SYS$OUTPUT "The Option ",OPT_COMPILER," Is Invalid.  The Valid Options Are:"
-$   WRITE SYS$OUTPUT ""
-$   WRITE SYS$OUTPUT "    VAXC  :  To Compile With VAX C."
-$   WRITE SYS$OUTPUT "    DECC  :  To Compile With DEC C."
-$   WRITE SYS$OUTPUT "    GNUC  :  To Compile With GNU C."
-$   WRITE SYS$OUTPUT ""
-$!
-$!  Time To EXIT.
-$!
-$   EXIT
-$!
-$! End The Valid Argument Check.
-$!
-$ ENDIF
-$!
-$! Build a MACRO command for the architecture at hand
-$!
-$ IF ARCH .EQS. "VAX" THEN MACRO = "MACRO/''DEBUGGER'"
-$ IF ARCH .NES. "VAX" THEN MACRO = "MACRO/MIGRATION/''DEBUGGER'/''MACRO_OPTIMIZE'"
-$!
-$!  Show user the result
-$!
-$ WRITE/SYMBOL SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO
-$!
-$! Time to check the contents, and to make sure we get the correct library.
-$!
-$ IF OPT_TCPIP_LIB.EQS."SOCKETSHR" .OR. OPT_TCPIP_LIB.EQS."MULTINET" -
-     .OR. OPT_TCPIP_LIB.EQS."UCX" .OR. OPT_TCPIP_LIB.EQS."TCPIP" -
-     .OR. OPT_TCPIP_LIB.EQS."NONE"
-$ THEN
-$!
-$!  Check to see if SOCKETSHR was chosen
-$!
-$   IF OPT_TCPIP_LIB.EQS."SOCKETSHR"
-$   THEN
-$!
-$!    Set the library to use SOCKETSHR
-$!
-$     TCPIP_LIB = "SYS$DISK:[-.VMS]SOCKETSHR_SHR.OPT/OPT"
-$!
-$!    Done with SOCKETSHR
-$!
-$   ENDIF
-$!
-$!  Check to see if MULTINET was chosen
-$!
-$   IF OPT_TCPIP_LIB.EQS."MULTINET"
-$   THEN
-$!
-$!    Set the library to use UCX emulation.
-$!
-$     OPT_TCPIP_LIB = "UCX"
-$!
-$!    Done with MULTINET
-$!
-$   ENDIF
-$!
-$!  Check to see if UCX was chosen
-$!
-$   IF OPT_TCPIP_LIB.EQS."UCX"
-$   THEN
-$!
-$!    Set the library to use UCX.
-$!
-$     TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_DECC.OPT/OPT"
-$     IF F$TRNLNM("UCX$IPC_SHR") .NES. ""
-$     THEN
-$       TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_DECC_LOG.OPT/OPT"
-$     ELSE
-$       IF COMPILER .NES. "DECC" .AND. ARCH .EQS. "VAX" THEN -
-	  TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_VAXC.OPT/OPT"
-$     ENDIF
-$!
-$!    Done with UCX
-$!
-$   ENDIF
-$!
-$!  Check to see if TCPIP was chosen
-$!
-$   IF OPT_TCPIP_LIB.EQS."TCPIP"
-$   THEN
-$!
-$!    Set the library to use TCPIP (post UCX).
-$!
-$     TCPIP_LIB = "SYS$DISK:[-.VMS]TCPIP_SHR_DECC.OPT/OPT"
-$!
-$!    Done with TCPIP
-$!
-$   ENDIF
-$!
-$!  Check to see if NONE was chosen
-$!
-$   IF OPT_TCPIP_LIB.EQS."NONE"
-$   THEN
-$!
-$!    Do not use a TCPIP library.
-$!
-$     TCPIP_LIB = ""
-$!
-$!    Done with TCPIP
-$!
-$   ENDIF
-$!
-$!  Print info
-$!
-$   WRITE SYS$OUTPUT "TCP/IP library spec: ", TCPIP_LIB
-$!
-$!  Else The User Entered An Invalid Argument.
-$!
-$ ELSE
-$!
-$!  Tell The User We Don't Know What They Want.
-$!
-$   WRITE SYS$OUTPUT ""
-$   WRITE SYS$OUTPUT "The Option ",OPT_TCPIP_LIB," Is Invalid.  The Valid Options Are:"
-$   WRITE SYS$OUTPUT ""
-$   WRITE SYS$OUTPUT "    SOCKETSHR  :  To link with SOCKETSHR TCP/IP library."
-$   WRITE SYS$OUTPUT "    UCX        :  To link with UCX TCP/IP library."
-$   WRITE SYS$OUTPUT "    TCPIP      :  To link with TCPIP (post UCX) TCP/IP library."
-$   WRITE SYS$OUTPUT ""
-$!
-$!  Time To EXIT.
-$!
-$   EXIT
-$!
-$!  Done with TCP/IP libraries
-$!
-$ ENDIF
-$!
-$!  Time To RETURN...
-$!
-$ RETURN
-$!
-$ INITIALISE:
-$!
-$! Save old value of the logical name OPENSSL
-$!
-$ __SAVE_OPENSSL = F$TRNLNM("OPENSSL","LNM$PROCESS_TABLE")
-$!
-$! Save directory information
-$!
-$ __HERE = F$PARSE(F$PARSE("A.;",F$ENVIRONMENT("PROCEDURE"))-"A.;","[]A.;") - "A.;"
-$ __HERE = F$EDIT(__HERE,"UPCASE")
-$ __TOP = __HERE - "ENGINES]"
-$ __INCLUDE = __TOP + "INCLUDE.OPENSSL]"
-$!
-$! Set up the logical name OPENSSL to point at the include directory
-$!
-$ DEFINE OPENSSL/NOLOG '__INCLUDE'
-$!
-$! Done
-$!
-$ RETURN
-$!
-$ CLEANUP:
-$!
-$! Restore the logical name OPENSSL if it had a value
-$!
-$ IF __SAVE_OPENSSL .EQS. ""
-$ THEN
-$   DEASSIGN OPENSSL
-$ ELSE
-$   DEFINE/NOLOG OPENSSL '__SAVE_OPENSSL'
-$ ENDIF
-$!
-$! Done
-$!
-$ RETURN
+$!

+$!  MAKEENGINES.COM

+$!  Written By:  Richard Levitte

+$!               richard@levitte.org

+$!

+$!  This command file compiles and creates the various engines in form

+$!  of shared images.  They are placed in [.xxx.EXE.ENGINES], where "xxx"

+$!  is ALPHA, IA64 or VAX, depending on your hardware.

+$!

+$!  P1	if this is ENGINES or ALL, the engines will build, otherwise not.

+$!

+$!  P2	DEBUG or NODEBUG to compile with or without debugger information.

+$!

+$!  P3  VAXC		for VAX C

+$!	DECC		for DEC C

+$!	GNUC		for GNU C (untested)

+$!

+$!  P4	if defined, sets the TCP/IP libraries to use.  UCX or TCPIP is

+$!	used by default since most other implementations come with a

+$!	compatibility library.  The value must be one of the following:

+$!

+$!	UCX		for UCX

+$!	SOCKETSHR	for SOCKETSHR+NETLIB

+$!	TCPIP		for TCPIP (post UCX)

+$!

+$!  P5	if defined, tells the compiler not to use special threads.

+$!

+$!  P6	if defined, denotes which engines to build.  If not defined,

+$!	all available engines are built.

+$!

+$!  For 64 bit architectures (Alpha and IA64), specify the pointer size as P7.

+$!  For 32 bit architectures (VAX), P7 is ignored.

+$!  Currently supported values are:

+$!

+$!	32	To ge a library compiled with /POINTER_SIZE=32

+$!	64	To ge a library compiled with /POINTER_SIZE=64

+$!

+$!-----------------------------------------------------------------------------

+$!

+$! Set the default TCP/IP library to link against if needed

+$!

+$ TCPIP_LIB = ""

+$!

+$! Check What Architecture We Are Using.

+$!

+$ IF (F$GETSYI("CPU").LT.128)

+$ THEN

+$!

+$!  The Architecture Is VAX.

+$!

+$   ARCH = "VAX"

+$!

+$! Else...

+$!

+$ ELSE

+$!

+$!  The Architecture Is Alpha, IA64 or whatever comes in the future.

+$!

+$   ARCH = F$EDIT( F$GETSYI( "ARCH_NAME"), "UPCASE")

+$   IF (ARCH .EQS. "") THEN ARCH = "UNK"

+$!

+$! End The Architecture Check.

+$!

+$ ENDIF

+$!

+$! Set the names of the engines we want to build

+$! NOTE: Some might think this list ugly.  However, it's made this way to

+$! reflect the LIBNAMES variable in Makefile as closely as possible,

+$! thereby making it fairly easy to verify that the lists are the same.

+$! NOTE: gmp isn't built, as it's mostly a test engine and brings in another

+$! library that isn't necessarely ported to VMS.

+$!

+$ ENGINES = "," + P6

+$ IF ENGINES .EQS. "," THEN -

+	ENGINES = ",4758cca,aep,atalla,cswift,chil,nuron,sureware,ubsec,padlock,"

+$!

+$! GOST requires a 64-bit integer type, unavailable on VAX.

+$!

+$ IF (ARCH .NES. "VAX") THEN -

+       ENGINES = ENGINES+ ",ccgost"

+$!

+$! Set the goal directories, and create them if necessary

+$!

+$ OBJ_DIR := SYS$DISK:[-.'ARCH'.OBJ.ENGINES]

+$ EXE_DIR := SYS$DISK:[-.'ARCH'.EXE.ENGINES]

+$ IF F$PARSE(OBJ_DIR) .EQS. "" THEN CREATE/DIRECTORY 'OBJ_DIR'

+$ IF F$PARSE(EXE_DIR) .EQS. "" THEN CREATE/DIRECTORY 'EXE_DIR'

+$!

+$! Set the goal files, and create them if necessary

+$!

+$ CRYPTO_LIB :=SYS$DISK:[-.'ARCH'.EXE.CRYPTO]LIBCRYPTO'LIB32'.OLB

+$ IF F$SEARCH(CRYPTO_LIB) .EQS. "" THEN LIBRARY/CREATE/OBJECT 'CRYPTO_LIB'

+$!

+$! OK, time to check options and initialise

+$!

+$ OPT_PHASE = P1

+$ ACCEPT_PHASE = "ALL,ENGINES"

+$ OPT_DEBUG = P2

+$ OPT_COMPILER = P3

+$ OPT_TCPIP_LIB = P4

+$ OPT_SPECIAL_THREADS = P5

+$ OPT_POINTER_SIZE = P7

+$

+$ GOSUB CHECK_OPTIONS

+$ GOSUB INITIALISE

+$ GOSUB CHECK_OPT_FILE

+$!

+$! Define what goes into each engine.  VAX includes a transfer vector.

+$!

+$ ENGINE_ = ""

+$ TV_OBJ = ""

+$ IF ARCH .EQS. "VAX"

+$ THEN

+$   ENGINE_ = "engine_vector.mar"

+$   TV_OBJ_NAME = OBJ_DIR + F$PARSE(ENGINE_,,,"NAME","SYNTAX_ONLY") + ".OBJ"

+$   TV_OBJ = ",''TV_OBJ_NAME'"

+$ ENDIF

+$ ENGINE_4758CCA = "e_4758cca"

+$ ENGINE_aep = "e_aep"

+$ ENGINE_atalla = "e_atalla"

+$ ENGINE_cswift = "e_cswift"

+$ ENGINE_chil = "e_chil"

+$ ENGINE_nuron = "e_nuron"

+$ ENGINE_sureware = "e_sureware"

+$ ENGINE_ubsec = "e_ubsec"

+$ ENGINE_padlock = "e_padlock"

+$

+$ ENGINE_ccgost_SUBDIR = "ccgost"

+$ ENGINE_ccgost = "e_gost_err,gost2001_keyx,gost2001,gost89,gost94_keyx,"+ -

+		  "gost_ameth,gost_asn1,gost_crypt,gost_ctl,gost_eng,"+ -

+		  "gosthash,gost_keywrap,gost_md,gost_params,gost_pmeth,"+ -

+		  "gost_sign"

+$!

+$! Define which programs need to be linked with a TCP/IP library

+$!

+$ TCPIP_ENGINES = ",,"

+$ IF COMPILER .EQS. "VAXC" THEN -

+     TCPIP_ENGINES = ",,"

+$!

+$! Set up two loops, one that keeps track of the engines,

+$! and one that keeps track of all the files going into

+$! the current engine.

+$!

+$! Here's the start of the engine loop.

+$!

+$ ENGINE_COUNTER = 0

+$ ENGINE_NEXT:

+$!

+$! Extract the current engine name, and if we've reached the end, stop

+$!

+$ ENGINE_NAME = F$ELEMENT(ENGINE_COUNTER,",",ENGINES)

+$ IF (ENGINE_NAME.EQS.",") THEN GOTO ENGINE_DONE

+$!

+$ ENGINE_COUNTER = ENGINE_COUNTER + 1

+$!

+$! Set up the engine library names.

+$!

+$ LIB_ENGINE = "ENGINE_" + ENGINE_NAME

+$!

+$! Check if the library module name actually is defined

+$!

+$ IF F$TYPE('LIB_ENGINE') .EQS. ""

+$ THEN

+$   WRITE SYS$ERROR ""

+$   WRITE SYS$ERROR "The module ",ENGINE_NAME," does not exist.  Continuing..."

+$   WRITE SYS$ERROR ""

+$   GOTO ENGINE_NEXT

+$ ENDIF

+$!

+$! Talk to the user

+$!

+$ IF ENGINE_NAME .NES. ""

+$ THEN

+$   WRITE SYS$OUTPUT "Compiling The ",ENGINE_NAME," Library Files. (",BUILDALL,")"

+$ ELSE

+$   WRITE SYS$OUTPUT "Compiling Support Files. (",BUILDALL,")"

+$ ENDIF

+$!

+$! Create a .OPT file for the object files (for a real engine name).

+$!

+$ IF ENGINE_NAME .NES. ""

+$ THEN

+$   OPEN/WRITE OBJECTS 'EXE_DIR''ENGINE_NAME'.OPT

+$ ENDIF

+$!

+$! Here's the start of per-engine module loop.

+$!

+$ FILE_COUNTER = 0

+$ FILE_NEXT:

+$!

+$! Extract the file name from the file list, and if we've reached the end, stop

+$!

+$ FILE_NAME = F$ELEMENT(FILE_COUNTER,",",'LIB_ENGINE')

+$ IF (FILE_NAME.EQS.",") THEN GOTO FILE_DONE

+$!

+$ FILE_COUNTER = FILE_COUNTER + 1

+$!

+$ IF FILE_NAME .EQS. "" THEN GOTO FILE_NEXT

+$!

+$! Set up the source and object reference

+$!

+$ IF F$TYPE('LIB_ENGINE'_SUBDIR) .EQS. ""

+$ THEN

+$     SOURCE_FILE = F$PARSE(FILE_NAME,"SYS$DISK:[].C",,,"SYNTAX_ONLY")

+$ ELSE

+$     SOURCE_FILE = F$PARSE(FILE_NAME,"SYS$DISK:[."+'LIB_ENGINE'_SUBDIR+"].C",,,"SYNTAX_ONLY")

+$ ENDIF

+$ OBJECT_FILE = OBJ_DIR + F$PARSE(FILE_NAME,,,"NAME","SYNTAX_ONLY") + ".OBJ"

+$!

+$! If we get some problem, we just go on trying to build the next module.

+$ ON WARNING THEN GOTO FILE_NEXT

+$!

+$! Check if the module we want to compile is actually there.

+$!

+$ IF F$SEARCH(SOURCE_FILE) .EQS. ""

+$ THEN

+$   WRITE SYS$OUTPUT ""

+$   WRITE SYS$OUTPUT "The File ",SOURCE_FILE," Doesn't Exist."

+$   WRITE SYS$OUTPUT ""

+$   GOTO EXIT

+$ ENDIF

+$!

+$! Talk to the user.

+$!

+$ WRITE SYS$OUTPUT "	",FILE_NAME,""

+$!

+$! Do the dirty work.

+$!

+$ ON ERROR THEN GOTO FILE_NEXT

+$ IF F$EDIT(F$PARSE(SOURCE_FILE,,,"TYPE","SYNTAX_ONLY"),"UPCASE") .EQS. ".MAR"

+$ THEN

+$   MACRO/OBJECT='OBJECT_FILE' 'SOURCE_FILE'

+$ ELSE

+$   CC/OBJECT='OBJECT_FILE' 'SOURCE_FILE'

+$ ENDIF

+$!

+$! Write the entry to the .OPT file (for a real engine name).

+$!

+$ IF ENGINE_NAME .NES. ""

+$ THEN

+$   WRITE OBJECTS OBJECT_FILE

+$ ENDIF

+$!

+$! Next file

+$!

+$ GOTO FILE_NEXT

+$!

+$ FILE_DONE:

+$!

+$! Do not link the support files.

+$!

+$ IF ENGINE_NAME .EQS. "" THEN GOTO ENGINE_NEXT

+$!

+$! Close the linker options file (for a real engine name).

+$!

+$ CLOSE OBJECTS

+$!

+$! Now, there are two ways to handle this.  We can either build 

+$! shareable images or stick the engine object file into libcrypto.

+$! For now, the latter is NOT supported.

+$!

+$!!!!! LIBRARY/REPLACE 'CRYPTO_LIB' 'OBJECT_FILE'

+$!

+$! For shareable libraries, we need to do things a little differently

+$! depending on if we link with a TCP/IP library or not.

+$!

+$ ENGINE_OPT := SYS$DISK:[]'ARCH'.OPT

+$ IF TCPIP_LIB .NES. ""

+$ THEN

+$   LINK/'DEBUGGER'/'TRACEBACK' /SHARE='EXE_DIR''ENGINE_NAME'.EXE -

+	'EXE_DIR''ENGINE_NAME'.OPT/OPTION'TV_OBJ', -

+	'CRYPTO_LIB'/LIBRARY, -

+	'ENGINE_OPT'/OPTION,'TCPIP_LIB','OPT_FILE'/OPTION

+$ ELSE

+$   LINK/'DEBUGGER'/'TRACEBACK' /SHARE='EXE_DIR''ENGINE_NAME'.EXE -

+	'EXE_DIR''ENGINE_NAME'.OPT/OPTION'TV_OBJ', -

+        'CRYPTO_LIB'/LIBRARY, -

+	'ENGINE_OPT'/OPTION,'OPT_FILE'/OPTION

+$ ENDIF

+$!

+$! Next engine

+$!

+$ GOTO ENGINE_NEXT

+$!

+$ ENGINE_DONE:

+$!

+$! Talk to the user

+$!

+$ WRITE SYS$OUTPUT "All Done..."

+$ EXIT:

+$ GOSUB CLEANUP

+$ EXIT

+$!

+$! Check For The Link Option FIle.

+$!

+$ CHECK_OPT_FILE:

+$!

+$! Check To See If We Need To Make A VAX C Option File.

+$!

+$ IF (COMPILER.EQS."VAXC")

+$ THEN

+$!

+$!  Check To See If We Already Have A VAX C Linker Option File.

+$!

+$   IF (F$SEARCH(OPT_FILE).EQS."")

+$   THEN

+$!

+$!    We Need A VAX C Linker Option File.

+$!

+$     CREATE 'OPT_FILE'

+$DECK

+!

+! Default System Options File To Link Agianst 

+! The Sharable VAX C Runtime Library.

+!

+SYS$SHARE:VAXCRTL.EXE/SHARE

+$EOD

+$!

+$!  End The Option File Check.

+$!

+$   ENDIF

+$!

+$! End The VAXC Check.

+$!

+$ ENDIF

+$!

+$! Check To See If We Need A GNU C Option File.

+$!

+$ IF (COMPILER.EQS."GNUC")

+$ THEN

+$!

+$!  Check To See If We Already Have A GNU C Linker Option File.

+$!

+$   IF (F$SEARCH(OPT_FILE).EQS."")

+$   THEN

+$!

+$!    We Need A GNU C Linker Option File.

+$!

+$     CREATE 'OPT_FILE'

+$DECK

+!

+! Default System Options File To Link Agianst 

+! The Sharable C Runtime Library.

+!

+GNU_CC:[000000]GCCLIB/LIBRARY

+SYS$SHARE:VAXCRTL/SHARE

+$EOD

+$!

+$!  End The Option File Check.

+$!

+$   ENDIF

+$!

+$! End The GNU C Check.

+$!

+$ ENDIF

+$!

+$! Check To See If We Need A DEC C Option File.

+$!

+$ IF (COMPILER.EQS."DECC")

+$ THEN

+$!

+$!  Check To See If We Already Have A DEC C Linker Option File.

+$!

+$   IF (F$SEARCH(OPT_FILE).EQS."")

+$   THEN

+$!

+$!    Figure Out If We Need A non-VAX Or A VAX Linker Option File.

+$!

+$     IF ARCH .EQS. "VAX"

+$     THEN

+$!

+$!      We Need A DEC C Linker Option File For VAX.

+$!

+$       CREATE 'OPT_FILE'

+$DECK

+!

+! Default System Options File To Link Agianst 

+! The Sharable DEC C Runtime Library.

+!

+SYS$SHARE:DECC$SHR.EXE/SHARE

+$EOD

+$!

+$!    Else...

+$!

+$     ELSE

+$!

+$!      Create The non-VAX Linker Option File.

+$!

+$       CREATE 'OPT_FILE'

+$DECK

+!

+! Default System Options File For non-VAX To Link Agianst 

+! The Sharable C Runtime Library.

+!

+SYS$SHARE:CMA$OPEN_LIB_SHR/SHARE

+SYS$SHARE:CMA$OPEN_RTL/SHARE

+$EOD

+$!

+$!    End The DEC C Option File Check.

+$!

+$     ENDIF

+$!

+$!  End The Option File Search.

+$!

+$   ENDIF

+$!

+$! End The DEC C Check.

+$!

+$ ENDIF

+$!

+$!  Tell The User What Linker Option File We Are Using.

+$!

+$ WRITE SYS$OUTPUT "Using Linker Option File ",OPT_FILE,"."	

+$!

+$! Time To RETURN.

+$!

+$ RETURN

+$!

+$! Check The User's Options.

+$!

+$ CHECK_OPTIONS:

+$!

+$! Check To See If OPT_PHASE Is Blank.

+$!

+$ IF (OPT_PHASE.EQS."ALL")

+$ THEN

+$!

+$!   OPT_PHASE Is Blank, So Build Everything.

+$!

+$    BUILDALL = "ALL"

+$!

+$! Else...

+$!

+$ ELSE

+$!

+$!  Else, Check To See If OPT_PHASE Has A Valid Argument.

+$!

+$   IF ("," + ACCEPT_PHASE + ",") - ("," + OPT_PHASE + ",") -

+       .NES. ("," + ACCEPT_PHASE + ",")

+$   THEN

+$!

+$!    A Valid Argument.

+$!

+$     BUILDALL = OPT_PHASE

+$!

+$!  Else...

+$!

+$   ELSE

+$!

+$!    Tell The User We Don't Know What They Want.

+$!

+$     WRITE SYS$OUTPUT ""

+$     WRITE SYS$OUTPUT "The option ",OPT_PHASE," is invalid.  The valid options are:"

+$     WRITE SYS$OUTPUT ""

+$     IF ("," + ACCEPT_PHASE + ",") - ",ALL," -

+	.NES. ("," + ACCEPT_PHASE + ",") THEN -

+	WRITE SYS$OUTPUT "    ALL      :  just build everything."

+$     IF ("," + ACCEPT_PHASE + ",") - ",ENGINES," -

+	.NES. ("," + ACCEPT_PHASE + ",") THEN -

+	WRITE SYS$OUTPUT "    ENGINES  :  to compile just the [.xxx.EXE.ENGINES]*.EXE hareable images."

+$     WRITE SYS$OUTPUT ""

+$     WRITE SYS$OUTPUT " where 'xxx' stands for:"

+$     WRITE SYS$OUTPUT ""

+$     WRITE SYS$OUTPUT "    ALPHA    :  Alpha architecture."

+$     WRITE SYS$OUTPUT "    IA64     :  IA64 architecture."

+$     WRITE SYS$OUTPUT "    VAX      :  VAX architecture."

+$     WRITE SYS$OUTPUT ""

+$!

+$!    Time To EXIT.

+$!

+$     EXIT

+$!

+$!  End The Valid Argument Check.

+$!

+$   ENDIF

+$!

+$! End The OPT_PHASE Check.

+$!

+$ ENDIF

+$!

+$! Check To See If OPT_DEBUG Is Blank.

+$!

+$ IF (OPT_DEBUG.EQS."NODEBUG")

+$ THEN

+$!

+$!   OPT_DEBUG Is NODEBUG, So Compile Without The Debugger Information.

+$!

+$    DEBUGGER = "NODEBUG"

+$    TRACEBACK = "NOTRACEBACK" 

+$    GCC_OPTIMIZE = "OPTIMIZE"

+$    CC_OPTIMIZE = "OPTIMIZE"

+$    MACRO_OPTIMIZE = "OPTIMIZE"

+$    WRITE SYS$OUTPUT "No Debugger Information Will Be Produced During Compile."

+$    WRITE SYS$OUTPUT "Compiling With Compiler Optimization."

+$ ELSE

+$!

+$!  Check To See If We Are To Compile With Debugger Information.

+$!

+$   IF (OPT_DEBUG.EQS."DEBUG")

+$   THEN

+$!

+$!    Compile With Debugger Information.

+$!

+$     DEBUGGER = "DEBUG"

+$     TRACEBACK = "TRACEBACK"

+$     GCC_OPTIMIZE = "NOOPTIMIZE"

+$     CC_OPTIMIZE = "NOOPTIMIZE"

+$     MACRO_OPTIMIZE = "NOOPTIMIZE"

+$     WRITE SYS$OUTPUT "Debugger Information Will Be Produced During Compile."

+$     WRITE SYS$OUTPUT "Compiling Without Compiler Optimization."

+$   ELSE 

+$!

+$!    They Entered An Invalid Option..

+$!

+$     WRITE SYS$OUTPUT ""

+$     WRITE SYS$OUTPUT "The Option ",OPT_DEBUG," Is Invalid.  The Valid Options Are:"

+$     WRITE SYS$OUTPUT ""

+$     WRITE SYS$OUTPUT "     DEBUG   :  Compile With The Debugger Information."

+$     WRITE SYS$OUTPUT "     NODEBUG :  Compile Without The Debugger Information."

+$     WRITE SYS$OUTPUT ""

+$!

+$!    Time To EXIT.

+$!

+$     EXIT

+$!

+$!  End The Valid Argument Check.

+$!

+$   ENDIF

+$!

+$! End The OPT_DEBUG Check.

+$!

+$ ENDIF

+$!

+$! Special Threads For OpenVMS v7.1 Or Later

+$!

+$! Written By:  Richard Levitte

+$!              richard@levitte.org

+$!

+$!

+$! Check To See If We Have A Option For OPT_SPECIAL_THREADS.

+$!

+$ IF (OPT_SPECIAL_THREADS.EQS."")

+$ THEN

+$!

+$!  Get The Version Of VMS We Are Using.

+$!

+$   ISSEVEN :=

+$   TMP = F$ELEMENT(0,"-",F$EXTRACT(1,4,F$GETSYI("VERSION")))

+$   TMP = F$INTEGER(F$ELEMENT(0,".",TMP)+F$ELEMENT(1,".",TMP))

+$!

+$!  Check To See If The VMS Version Is v7.1 Or Later.

+$!

+$   IF (TMP.GE.71)

+$   THEN

+$!

+$!    We Have OpenVMS v7.1 Or Later, So Use The Special Threads.

+$!

+$     ISSEVEN := ,PTHREAD_USE_D4

+$!

+$!  End The VMS Version Check.

+$!

+$   ENDIF

+$!

+$! End The OPT_SPECIAL_THREADS Check.

+$!

+$ ENDIF

+$!

+$! Check To See If OPT_POINTER_SIZE Is Blank.

+$!

+$ IF (OPT_POINTER_SIZE.EQS."")

+$ THEN

+$   POINTER_SIZE = ""

+$ ELSE

+$!

+$!  Check is OPT_POINTER_SIZE Is Valid

+$!

+$   IF (OPT_POINTER_SIZE.EQS."32")

+$   THEN

+$     POINTER_SIZE = "/POINTER_SIZE=32"

+$     IF ARCH .EQS. "VAX"

+$     THEN

+$       LIB32 = ""

+$     ELSE

+$       LIB32 = "32"

+$     ENDIF

+$   ELSE

+$     IF (OPT_POINTER_SIZE.EQS."64")

+$     THEN

+$       LIB32 = ""

+$       IF ARCH .EQS. "VAX"

+$       THEN

+$         POINTER_SIZE = "/POINTER_SIZE=32"

+$       ELSE

+$         POINTER_SIZE = "/POINTER_SIZE=64"

+$       ENDIF

+$     ELSE

+$!

+$!      Tell The User Entered An Invalid Option..

+$!

+$       WRITE SYS$OUTPUT ""

+$       WRITE SYS$OUTPUT "The Option ",OPT_POINTER_SIZE," Is Invalid.  The Valid Options Are:"

+$       WRITE SYS$OUTPUT ""

+$       WRITE SYS$OUTPUT "    32  :  Compile with 32 bit pointer size"

+$       WRITE SYS$OUTPUT "    64  :  Compile with 64 bit pointer size"

+$       WRITE SYS$OUTPUT ""

+$!

+$!      Time To EXIT.

+$!

+$       GOTO TIDY

+$!

+$!      End The Valid Arguement Check.

+$!

+$     ENDIF

+$   ENDIF

+$!

+$! End The OPT_POINTER_SIZE Check.

+$!

+$ ENDIF

+$!

+$! Check To See If OPT_COMPILER Is Blank.

+$!

+$ IF (OPT_COMPILER.EQS."")

+$ THEN

+$!

+$!  O.K., The User Didn't Specify A Compiler, Let's Try To

+$!  Find Out Which One To Use.

+$!

+$!  Check To See If We Have GNU C.

+$!

+$   IF (F$TRNLNM("GNU_CC").NES."")

+$   THEN

+$!

+$!    Looks Like GNUC, Set To Use GNUC.

+$!

+$     OPT_COMPILER = "GNUC"

+$!

+$!  Else...

+$!

+$   ELSE

+$!

+$!    Check To See If We Have VAXC Or DECC.

+$!

+$     IF (ARCH.NES."VAX").OR.(F$TRNLNM("DECC$CC_DEFAULT").NES."")

+$     THEN 

+$!

+$!      Looks Like DECC, Set To Use DECC.

+$!

+$       OPT_COMPILER = "DECC"

+$!

+$!    Else...

+$!

+$     ELSE

+$!

+$!      Looks Like VAXC, Set To Use VAXC.

+$!

+$       OPT_COMPILER = "VAXC"

+$!

+$!    End The VAXC Compiler Check.

+$!

+$     ENDIF

+$!

+$!  End The DECC & VAXC Compiler Check.

+$!

+$   ENDIF

+$!

+$!  End The Compiler Check.

+$!

+$ ENDIF

+$!

+$! Check To See If We Have A Option For OPT_TCPIP_LIB.

+$!

+$ IF (OPT_TCPIP_LIB.EQS."")

+$ THEN

+$!

+$!  Find out what socket library we have available

+$!

+$   IF F$PARSE("SOCKETSHR:") .NES. ""

+$   THEN

+$!

+$!    We have SOCKETSHR, and it is my opinion that it's the best to use.

+$!

+$     OPT_TCPIP_LIB = "SOCKETSHR"

+$!

+$!    Tell the user

+$!

+$     WRITE SYS$OUTPUT "Using SOCKETSHR for TCP/IP"

+$!

+$!    Else, let's look for something else

+$!

+$   ELSE

+$!

+$!    Like UCX (the reason to do this before Multinet is that the UCX

+$!    emulation is easier to use...)

+$!

+$     IF F$TRNLNM("UCX$IPC_SHR") .NES. "" -

+	 .OR. F$PARSE("SYS$SHARE:UCX$IPC_SHR.EXE") .NES. "" -

+	 .OR. F$PARSE("SYS$LIBRARY:UCX$IPC.OLB") .NES. ""

+$     THEN

+$!

+$!	Last resort: a UCX or UCX-compatible library

+$!

+$	OPT_TCPIP_LIB = "UCX"

+$!

+$!      Tell the user

+$!

+$       WRITE SYS$OUTPUT "Using UCX or an emulation thereof for TCP/IP"

+$!

+$!	That was all...

+$!

+$     ENDIF

+$   ENDIF

+$ ENDIF

+$!

+$! Set Up Initial CC Definitions, Possibly With User Ones

+$!

+$ CCDEFS = "TCPIP_TYPE_''OPT_TCPIP_LIB',DSO_VMS"

+$ IF F$TYPE(USER_CCDEFS) .NES. "" THEN CCDEFS = CCDEFS + "," + USER_CCDEFS

+$ CCEXTRAFLAGS = ""

+$ IF F$TYPE(USER_CCFLAGS) .NES. "" THEN CCEXTRAFLAGS = USER_CCFLAGS

+$ CCDISABLEWARNINGS = "LONGLONGTYPE,LONGLONGSUFX"

+$ IF F$TYPE(USER_CCDISABLEWARNINGS) .NES. "" THEN -

+	CCDISABLEWARNINGS = CCDISABLEWARNINGS + "," + USER_CCDISABLEWARNINGS

+$!

+$!  Check To See If The User Entered A Valid Paramter.

+$!

+$ IF (OPT_COMPILER.EQS."VAXC").OR.(OPT_COMPILER.EQS."DECC").OR.(OPT_COMPILER.EQS."GNUC")

+$ THEN

+$!

+$!    Check To See If The User Wanted DECC.

+$!

+$   IF (OPT_COMPILER.EQS."DECC")

+$   THEN

+$!

+$!    Looks Like DECC, Set To Use DECC.

+$!

+$     COMPILER = "DECC"

+$!

+$!    Tell The User We Are Using DECC.

+$!

+$     WRITE SYS$OUTPUT "Using DECC 'C' Compiler."

+$!

+$!    Use DECC...

+$!

+$     CC = "CC"

+$     IF ARCH.EQS."VAX" .AND. F$TRNLNM("DECC$CC_DEFAULT").NES."/DECC" -

+	 THEN CC = "CC/DECC"

+$     CC = CC + "/''CC_OPTIMIZE'/''DEBUGGER'/STANDARD=ANSI89''POINTER_SIZE'" + -

+           "/NOLIST/PREFIX=ALL" + -

+	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[.VENDOR_DEFNS])" + -

+	   CCEXTRAFLAGS

+$!

+$!    Define The Linker Options File Name.

+$!

+$     OPT_FILE = "''EXE_DIR'VAX_DECC_OPTIONS.OPT"

+$!

+$!  End DECC Check.

+$!

+$   ENDIF

+$!

+$!  Check To See If We Are To Use VAXC.

+$!

+$   IF (OPT_COMPILER.EQS."VAXC")

+$   THEN

+$!

+$!    Looks Like VAXC, Set To Use VAXC.

+$!

+$     COMPILER = "VAXC"

+$!

+$!    Tell The User We Are Using VAX C.

+$!

+$     WRITE SYS$OUTPUT "Using VAXC 'C' Compiler."

+$!

+$!    Compile Using VAXC.

+$!

+$     CC = "CC"

+$     IF ARCH.NES."VAX"

+$     THEN

+$	WRITE SYS$OUTPUT "There is no VAX C on Alpha!"

+$	EXIT

+$     ENDIF

+$     IF F$TRNLNM("DECC$CC_DEFAULT").EQS."/DECC" THEN CC = "CC/VAXC"

+$     CC = CC + "/''CC_OPTIMIZE'/''DEBUGGER'/NOLIST" + -

+	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[-],SYS$DISK:[.VENDOR_DEFNS])" + -

+	   CCEXTRAFLAGS

+$     CCDEFS = """VAXC""," + CCDEFS

+$!

+$!    Define <sys> As SYS$COMMON:[SYSLIB]

+$!

+$     DEFINE/NOLOG SYS SYS$COMMON:[SYSLIB]

+$!

+$!    Define The Linker Options File Name.

+$!

+$     OPT_FILE = "''EXE_DIR'VAX_VAXC_OPTIONS.OPT"

+$!

+$!  End VAXC Check

+$!

+$   ENDIF

+$!

+$!  Check To See If We Are To Use GNU C.

+$!

+$   IF (OPT_COMPILER.EQS."GNUC")

+$   THEN

+$!

+$!    Looks Like GNUC, Set To Use GNUC.

+$!

+$     COMPILER = "GNUC"

+$!

+$!    Tell The User We Are Using GNUC.

+$!

+$     WRITE SYS$OUTPUT "Using GNU 'C' Compiler."

+$!

+$!    Use GNU C...

+$!

+$     CC = "GCC/NOCASE_HACK/''GCC_OPTIMIZE'/''DEBUGGER'/NOLIST" + -

+	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[-],SYS$DISK:[.VENDOR_DEFNS])" + -

+	   CCEXTRAFLAGS

+$!

+$!    Define The Linker Options File Name.

+$!

+$     OPT_FILE = "''EXE_DIR'VAX_GNUC_OPTIONS.OPT"

+$!

+$!  End The GNU C Check.

+$!

+$   ENDIF

+$!

+$!  Set up default defines

+$!

+$   CCDEFS = """FLAT_INC=1""," + CCDEFS

+$!

+$!  Finish up the definition of CC.

+$!

+$   IF COMPILER .EQS. "DECC"

+$   THEN

+$     IF CCDISABLEWARNINGS .NES. ""

+$     THEN

+$       CCDISABLEWARNINGS = "/WARNING=(DISABLE=(" + CCDISABLEWARNINGS + "))"

+$     ENDIF

+$   ELSE

+$     CCDISABLEWARNINGS = ""

+$   ENDIF

+$   CC = CC + "/DEFINE=(" + CCDEFS + ")" + CCDISABLEWARNINGS

+$!

+$!  Show user the result

+$!

+$   WRITE/SYMBOL SYS$OUTPUT "Main C Compiling Command: ",CC

+$!

+$!  Else The User Entered An Invalid Argument.

+$!

+$ ELSE

+$!

+$!  Tell The User We Don't Know What They Want.

+$!

+$   WRITE SYS$OUTPUT ""

+$   WRITE SYS$OUTPUT "The Option ",OPT_COMPILER," Is Invalid.  The Valid Options Are:"

+$   WRITE SYS$OUTPUT ""

+$   WRITE SYS$OUTPUT "    VAXC  :  To Compile With VAX C."

+$   WRITE SYS$OUTPUT "    DECC  :  To Compile With DEC C."

+$   WRITE SYS$OUTPUT "    GNUC  :  To Compile With GNU C."

+$   WRITE SYS$OUTPUT ""

+$!

+$!  Time To EXIT.

+$!

+$   EXIT

+$!

+$! End The Valid Argument Check.

+$!

+$ ENDIF

+$!

+$! Build a MACRO command for the architecture at hand

+$!

+$ IF ARCH .EQS. "VAX" THEN MACRO = "MACRO/''DEBUGGER'"

+$ IF ARCH .NES. "VAX" THEN MACRO = "MACRO/MIGRATION/''DEBUGGER'/''MACRO_OPTIMIZE'"

+$!

+$!  Show user the result

+$!

+$ WRITE/SYMBOL SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO

+$!

+$! Time to check the contents, and to make sure we get the correct library.

+$!

+$ IF OPT_TCPIP_LIB.EQS."SOCKETSHR" .OR. OPT_TCPIP_LIB.EQS."MULTINET" -

+     .OR. OPT_TCPIP_LIB.EQS."UCX" .OR. OPT_TCPIP_LIB.EQS."TCPIP" -

+     .OR. OPT_TCPIP_LIB.EQS."NONE"

+$ THEN

+$!

+$!  Check to see if SOCKETSHR was chosen

+$!

+$   IF OPT_TCPIP_LIB.EQS."SOCKETSHR"

+$   THEN

+$!

+$!    Set the library to use SOCKETSHR

+$!

+$     TCPIP_LIB = "SYS$DISK:[-.VMS]SOCKETSHR_SHR.OPT/OPT"

+$!

+$!    Done with SOCKETSHR

+$!

+$   ENDIF

+$!

+$!  Check to see if MULTINET was chosen

+$!

+$   IF OPT_TCPIP_LIB.EQS."MULTINET"

+$   THEN

+$!

+$!    Set the library to use UCX emulation.

+$!

+$     OPT_TCPIP_LIB = "UCX"

+$!

+$!    Done with MULTINET

+$!

+$   ENDIF

+$!

+$!  Check to see if UCX was chosen

+$!

+$   IF OPT_TCPIP_LIB.EQS."UCX"

+$   THEN

+$!

+$!    Set the library to use UCX.

+$!

+$     TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_DECC.OPT/OPT"

+$     IF F$TRNLNM("UCX$IPC_SHR") .NES. ""

+$     THEN

+$       TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_DECC_LOG.OPT/OPT"

+$     ELSE

+$       IF COMPILER .NES. "DECC" .AND. ARCH .EQS. "VAX" THEN -

+	  TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_VAXC.OPT/OPT"

+$     ENDIF

+$!

+$!    Done with UCX

+$!

+$   ENDIF

+$!

+$!  Check to see if TCPIP was chosen

+$!

+$   IF OPT_TCPIP_LIB.EQS."TCPIP"

+$   THEN

+$!

+$!    Set the library to use TCPIP (post UCX).

+$!

+$     TCPIP_LIB = "SYS$DISK:[-.VMS]TCPIP_SHR_DECC.OPT/OPT"

+$!

+$!    Done with TCPIP

+$!

+$   ENDIF

+$!

+$!  Check to see if NONE was chosen

+$!

+$   IF OPT_TCPIP_LIB.EQS."NONE"

+$   THEN

+$!

+$!    Do not use a TCPIP library.

+$!

+$     TCPIP_LIB = ""

+$!

+$!    Done with TCPIP

+$!

+$   ENDIF

+$!

+$!  Print info

+$!

+$   WRITE SYS$OUTPUT "TCP/IP library spec: ", TCPIP_LIB

+$!

+$!  Else The User Entered An Invalid Argument.

+$!

+$ ELSE

+$!

+$!  Tell The User We Don't Know What They Want.

+$!

+$   WRITE SYS$OUTPUT ""

+$   WRITE SYS$OUTPUT "The Option ",OPT_TCPIP_LIB," Is Invalid.  The Valid Options Are:"

+$   WRITE SYS$OUTPUT ""

+$   WRITE SYS$OUTPUT "    SOCKETSHR  :  To link with SOCKETSHR TCP/IP library."

+$   WRITE SYS$OUTPUT "    UCX        :  To link with UCX TCP/IP library."

+$   WRITE SYS$OUTPUT "    TCPIP      :  To link with TCPIP (post UCX) TCP/IP library."

+$   WRITE SYS$OUTPUT ""

+$!

+$!  Time To EXIT.

+$!

+$   EXIT

+$!

+$!  Done with TCP/IP libraries

+$!

+$ ENDIF

+$!

+$!  Time To RETURN...

+$!

+$ RETURN

+$!

+$ INITIALISE:

+$!

+$! Save old value of the logical name OPENSSL

+$!

+$ __SAVE_OPENSSL = F$TRNLNM("OPENSSL","LNM$PROCESS_TABLE")

+$!

+$! Save directory information

+$!

+$ __HERE = F$PARSE(F$PARSE("A.;",F$ENVIRONMENT("PROCEDURE"))-"A.;","[]A.;") - "A.;"

+$ __HERE = F$EDIT(__HERE,"UPCASE")

+$ __TOP = __HERE - "ENGINES]"

+$ __INCLUDE = __TOP + "INCLUDE.OPENSSL]"

+$!

+$! Set up the logical name OPENSSL to point at the include directory

+$!

+$ DEFINE OPENSSL/NOLOG '__INCLUDE'

+$!

+$! Done

+$!

+$ RETURN

+$!

+$ CLEANUP:

+$!

+$! Restore the logical name OPENSSL if it had a value

+$!

+$ IF __SAVE_OPENSSL .EQS. ""

+$ THEN

+$   DEASSIGN OPENSSL

+$ ELSE

+$   DEFINE/NOLOG OPENSSL '__SAVE_OPENSSL'

+$ ENDIF

+$!

+$! Done

+$!

+$ RETURN