Synchronised line endinge with release branch

4 files changed, 4558 insertions, 4558 deletions

diff --git a/openssl/engines/e_capi.c b/openssl/engines/e_capi.c
index 5c1fbeff3..24b620fc0 100644
--- a/openssl/engines/e_capi.c
+++ b/openssl/engines/e_capi.c
@@ -1,1824 +1,1824 @@
-/* engines/e_capi.c */

-/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL

- * project.

- */

-/* ====================================================================

- * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.

- *

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- *

- * 1. Redistributions of source code must retain the above copyright

- *    notice, this list of conditions and the following disclaimer. 

- *

- * 2. Redistributions in binary form must reproduce the above copyright

- *    notice, this list of conditions and the following disclaimer in

- *    the documentation and/or other materials provided with the

- *    distribution.

- *

- * 3. All advertising materials mentioning features or use of this

- *    software must display the following acknowledgment:

- *    "This product includes software developed by the OpenSSL Project

- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

- *

- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

- *    endorse or promote products derived from this software without

- *    prior written permission. For written permission, please contact

- *    licensing@OpenSSL.org.

- *

- * 5. Products derived from this software may not be called "OpenSSL"

- *    nor may "OpenSSL" appear in their names without prior written

- *    permission of the OpenSSL Project.

- *

- * 6. Redistributions of any form whatsoever must retain the following

- *    acknowledgment:

- *    "This product includes software developed by the OpenSSL Project

- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

- *

- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

- * OF THE POSSIBILITY OF SUCH DAMAGE.

- * ====================================================================

- */

-

-

-#include <stdio.h>

-#include <string.h>

-#include <openssl/crypto.h>

-#include <openssl/buffer.h>

-#include <openssl/bn.h>

-

-#ifdef OPENSSL_SYS_WIN32

-#ifndef OPENSSL_NO_CAPIENG

-

-#include <openssl/rsa.h>

-

-#include <windows.h>

-

-#ifndef _WIN32_WINNT

-#define _WIN32_WINNT 0x0400

-#endif

-

-#include <wincrypt.h>

-

-/*

- * This module uses several "new" interfaces, among which is

- * CertGetCertificateContextProperty. CERT_KEY_PROV_INFO_PROP_ID is

- * one of possible values you can pass to function in question. By

- * checking if it's defined we can see if wincrypt.h and accompanying

- * crypt32.lib are in shape. The native MingW32 headers up to and

- * including __W32API_VERSION 3.14 lack of struct DSSPUBKEY and the

- * defines CERT_STORE_PROV_SYSTEM_A and CERT_STORE_READONLY_FLAG,

- * so we check for these too and avoid compiling.

- * Yes, it's rather "weak" test and if compilation fails,

- * then re-configure with -DOPENSSL_NO_CAPIENG.

- */

-#if defined(CERT_KEY_PROV_INFO_PROP_ID) && \

-    defined(CERT_STORE_PROV_SYSTEM_A) && \

-    defined(CERT_STORE_READONLY_FLAG)

-# define __COMPILE_CAPIENG

-#endif /* CERT_KEY_PROV_INFO_PROP_ID */

-#endif /* OPENSSL_NO_CAPIENG */

-#endif /* OPENSSL_SYS_WIN32 */

-

-#ifdef __COMPILE_CAPIENG

-

-#undef X509_EXTENSIONS

-#undef X509_CERT_PAIR

-

-/* Definitions which may be missing from earlier version of headers */

-#ifndef CERT_STORE_OPEN_EXISTING_FLAG

-#define CERT_STORE_OPEN_EXISTING_FLAG                   0x00004000

-#endif

-

-#ifndef CERT_STORE_CREATE_NEW_FLAG

-#define CERT_STORE_CREATE_NEW_FLAG                      0x00002000

-#endif

-

-#ifndef CERT_SYSTEM_STORE_CURRENT_USER

-#define CERT_SYSTEM_STORE_CURRENT_USER			0x00010000

-#endif 

-

-#include <openssl/engine.h>

-#include <openssl/pem.h>

-#include <openssl/x509v3.h>

-

-#include "e_capi_err.h"

-#include "e_capi_err.c"

-

-

-static const char *engine_capi_id = "capi";

-static const char *engine_capi_name = "CryptoAPI ENGINE";

-

-typedef struct CAPI_CTX_st CAPI_CTX;

-typedef struct CAPI_KEY_st CAPI_KEY;

-

-static void capi_addlasterror(void);

-static void capi_adderror(DWORD err);

-

-static void CAPI_trace(CAPI_CTX *ctx, char *format, ...);

-

-static int capi_list_providers(CAPI_CTX *ctx, BIO *out);

-static int capi_list_containers(CAPI_CTX *ctx, BIO *out);

-int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *storename);

-void capi_free_key(CAPI_KEY *key);

-

-static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore);

-

-CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id);

-

-static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,

-	UI_METHOD *ui_method, void *callback_data);

-static int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,

-             unsigned char *sigret, unsigned int *siglen, const RSA *rsa);

-static int capi_rsa_priv_enc(int flen, const unsigned char *from,

-                unsigned char *to, RSA *rsa, int padding);

-static int capi_rsa_priv_dec(int flen, const unsigned char *from,

-                unsigned char *to, RSA *rsa, int padding);

-static int capi_rsa_free(RSA *rsa);

-

-static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,

-							DSA *dsa);

-static int capi_dsa_free(DSA *dsa);

-

-static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,

-	STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,

-	STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data);

-

-static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);

-#ifdef OPENSSL_CAPIENG_DIALOG

-static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);

-#endif

-

-typedef PCCERT_CONTEXT (WINAPI *CERTDLG)(HCERTSTORE, HWND, LPCWSTR,

-						LPCWSTR, DWORD, DWORD,

-						void *);

-typedef HWND (WINAPI *GETCONSWIN)(void);

-

-/* This structure contains CAPI ENGINE specific data:

- * it contains various global options and affects how

- * other functions behave.

- */

-

-#define CAPI_DBG_TRACE	2

-#define CAPI_DBG_ERROR	1

-

-struct CAPI_CTX_st {

-	int debug_level;

-	char *debug_file;

-	/* Parameters to use for container lookup */

-	DWORD keytype;

-	LPSTR cspname;

-	DWORD csptype;

-	/* Certificate store name to use */

-	LPSTR storename;

-	LPSTR ssl_client_store;

-	/* System store flags */

-	DWORD store_flags;

-

-/* Lookup string meanings in load_private_key */

-/* Substring of subject: uses "storename" */

-#define CAPI_LU_SUBSTR		1

-/* Friendly name: uses storename */

-#define CAPI_LU_FNAME		2

-/* Container name: uses cspname, keytype */

-#define CAPI_LU_CONTNAME	3

-	int lookup_method;

-/* Info to dump with dumpcerts option */

-/* Issuer and serial name strings */

-#define CAPI_DMP_SUMMARY	0x1

-/* Friendly name */

-#define CAPI_DMP_FNAME		0x2

-/* Full X509_print dump */

-#define CAPI_DMP_FULL		0x4

-/* Dump PEM format certificate */

-#define CAPI_DMP_PEM		0x8

-/* Dump pseudo key (if possible) */

-#define CAPI_DMP_PSKEY		0x10

-/* Dump key info (if possible) */

-#define CAPI_DMP_PKEYINFO	0x20

-

-	DWORD dump_flags;

-	int (*client_cert_select)(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);

-

-	CERTDLG certselectdlg;

-	GETCONSWIN getconswindow;

-};

-

-

-static CAPI_CTX *capi_ctx_new();

-static void capi_ctx_free(CAPI_CTX *ctx);

-static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check);

-static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx);

-

-#define CAPI_CMD_LIST_CERTS		ENGINE_CMD_BASE

-#define CAPI_CMD_LOOKUP_CERT		(ENGINE_CMD_BASE + 1)

-#define CAPI_CMD_DEBUG_LEVEL		(ENGINE_CMD_BASE + 2)

-#define CAPI_CMD_DEBUG_FILE		(ENGINE_CMD_BASE + 3)

-#define CAPI_CMD_KEYTYPE		(ENGINE_CMD_BASE + 4)

-#define CAPI_CMD_LIST_CSPS		(ENGINE_CMD_BASE + 5)

-#define CAPI_CMD_SET_CSP_IDX		(ENGINE_CMD_BASE + 6)

-#define CAPI_CMD_SET_CSP_NAME		(ENGINE_CMD_BASE + 7)

-#define CAPI_CMD_SET_CSP_TYPE		(ENGINE_CMD_BASE + 8)

-#define CAPI_CMD_LIST_CONTAINERS	(ENGINE_CMD_BASE + 9)

-#define CAPI_CMD_LIST_OPTIONS		(ENGINE_CMD_BASE + 10)

-#define CAPI_CMD_LOOKUP_METHOD		(ENGINE_CMD_BASE + 11)

-#define CAPI_CMD_STORE_NAME		(ENGINE_CMD_BASE + 12)

-#define CAPI_CMD_STORE_FLAGS		(ENGINE_CMD_BASE + 13)

-

-static const ENGINE_CMD_DEFN capi_cmd_defns[] = {

-	{CAPI_CMD_LIST_CERTS,

-		"list_certs",

-		"List all certificates in store",

-		ENGINE_CMD_FLAG_NO_INPUT},

-	{CAPI_CMD_LOOKUP_CERT,

-		"lookup_cert",

-		"Lookup and output certificates",

-		ENGINE_CMD_FLAG_STRING},

-	{CAPI_CMD_DEBUG_LEVEL,

-		"debug_level",

-		"debug level (1=errors, 2=trace)",

-		ENGINE_CMD_FLAG_NUMERIC},

-	{CAPI_CMD_DEBUG_FILE,

-		"debug_file",

-		"debugging filename)",

-		ENGINE_CMD_FLAG_STRING},

-	{CAPI_CMD_KEYTYPE,

-		"key_type",

-		"Key type: 1=AT_KEYEXCHANGE (default), 2=AT_SIGNATURE",

-		ENGINE_CMD_FLAG_NUMERIC},

-	{CAPI_CMD_LIST_CSPS,

-		"list_csps",

-		"List all CSPs",

-		ENGINE_CMD_FLAG_NO_INPUT},

-	{CAPI_CMD_SET_CSP_IDX,

-		"csp_idx",

-		"Set CSP by index",

-		ENGINE_CMD_FLAG_NUMERIC},

-	{CAPI_CMD_SET_CSP_NAME,

-		"csp_name",

-		"Set CSP name, (default CSP used if not specified)",

-		ENGINE_CMD_FLAG_STRING},

-	{CAPI_CMD_SET_CSP_TYPE,

-		"csp_type",

-		"Set CSP type, (default RSA_PROV_FULL)",

-		ENGINE_CMD_FLAG_NUMERIC},

-	{CAPI_CMD_LIST_CONTAINERS,

-		"list_containers",

-		"list container names",

-		ENGINE_CMD_FLAG_NO_INPUT},

-	{CAPI_CMD_LIST_OPTIONS,

-		"list_options",

-		"Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, "

-		"32=private key info)",

-		ENGINE_CMD_FLAG_NUMERIC},

-	{CAPI_CMD_LOOKUP_METHOD,

-		"lookup_method",

-		"Set key lookup method (1=substring, 2=friendlyname, 3=container name)",

-		ENGINE_CMD_FLAG_NUMERIC},

-	{CAPI_CMD_STORE_NAME,

-		"store_name",

-		"certificate store name, default \"MY\"",

-		ENGINE_CMD_FLAG_STRING},

-	{CAPI_CMD_STORE_FLAGS,

-		"store_flags",

-		"Certificate store flags: 1 = system store",

-		ENGINE_CMD_FLAG_NUMERIC},

-

-	{0, NULL, NULL, 0}

-	};

-

-static int capi_idx = -1;

-static int rsa_capi_idx = -1;

-static int dsa_capi_idx = -1;

-static int cert_capi_idx = -1;

-

-static int capi_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))

-	{

-	int ret = 1;

-	CAPI_CTX *ctx;

-	BIO *out;

-	if (capi_idx == -1)

-		{

-		CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_ENGINE_NOT_INITIALIZED);

-		return 0;

-		}

-	ctx = ENGINE_get_ex_data(e, capi_idx);

-	out = BIO_new_fp(stdout, BIO_NOCLOSE);

-	switch (cmd)

-		{

-		case CAPI_CMD_LIST_CSPS:

-		ret = capi_list_providers(ctx, out);

-		break;

-

-		case CAPI_CMD_LIST_CERTS:

-		ret = capi_list_certs(ctx, out, NULL);

-		break;

-

-		case CAPI_CMD_LOOKUP_CERT:

-		ret = capi_list_certs(ctx, out, p);

-		break;

-

-		case CAPI_CMD_LIST_CONTAINERS:

-		ret = capi_list_containers(ctx, out);

-		break;

-

-		case CAPI_CMD_STORE_NAME:

-		if (ctx->storename)

-			OPENSSL_free(ctx->storename);

-		ctx->storename = BUF_strdup(p);

-		CAPI_trace(ctx, "Setting store name to %s\n", p);

-		break;

-

-		case CAPI_CMD_STORE_FLAGS:

-		if (i & 1)

-			{

-			ctx->store_flags |= CERT_SYSTEM_STORE_LOCAL_MACHINE;

-			ctx->store_flags &= ~CERT_SYSTEM_STORE_CURRENT_USER;

-			}

-		else

-			{

-			ctx->store_flags |= CERT_SYSTEM_STORE_CURRENT_USER;

-			ctx->store_flags &= ~CERT_SYSTEM_STORE_LOCAL_MACHINE;

-			}

-		CAPI_trace(ctx, "Setting flags to %d\n", i);

-		break;

-

-		case CAPI_CMD_DEBUG_LEVEL:

-		ctx->debug_level = (int)i;

-		CAPI_trace(ctx, "Setting debug level to %d\n", ctx->debug_level);

-		break;

-

-		case CAPI_CMD_DEBUG_FILE:

-		ctx->debug_file = BUF_strdup(p);

-		CAPI_trace(ctx, "Setting debug file to %s\n", ctx->debug_file);

-		break;

-

-		case CAPI_CMD_KEYTYPE:

-		ctx->keytype = i;

-		CAPI_trace(ctx, "Setting key type to %d\n", ctx->keytype);

-		break;

-

-		case CAPI_CMD_SET_CSP_IDX:

-		ret = capi_ctx_set_provname_idx(ctx, i);

-		break;

-

-		case CAPI_CMD_LIST_OPTIONS:

-		ctx->dump_flags = i;

-		break;

-

-		case CAPI_CMD_LOOKUP_METHOD:

-		if (i < 1 || i > 3)

-			{

-			CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_INVALID_LOOKUP_METHOD);

-			return 0;

-			}

-		ctx->lookup_method = i;

-		break;

-

-		case CAPI_CMD_SET_CSP_NAME:

-		ret = capi_ctx_set_provname(ctx, p, ctx->csptype, 1);

-		break;

-

-		case CAPI_CMD_SET_CSP_TYPE:

-		ctx->csptype = i;

-		break;

-

-		default:

-		CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_UNKNOWN_COMMAND);

-		ret = 0;

-	}

-

-	BIO_free(out);

-	return ret;

-

-	}

-

-static RSA_METHOD capi_rsa_method =

-	{

-	"CryptoAPI RSA method",

-	0,				/* pub_enc */

-	0,				/* pub_dec */

-	capi_rsa_priv_enc,		/* priv_enc */

-	capi_rsa_priv_dec,		/* priv_dec */

-	0,				/* rsa_mod_exp */

-	0,				/* bn_mod_exp */

-	0,				/* init	*/

-	capi_rsa_free,			/* finish */

-	RSA_FLAG_SIGN_VER, 		/* flags */

-	NULL,				/* app_data */

-	capi_rsa_sign,			/* rsa_sign */

-	0				/* rsa_verify */

-	};

-

-static DSA_METHOD capi_dsa_method =

-	{

-	"CryptoAPI DSA method",

-	capi_dsa_do_sign,		/* dsa_do_sign */

-	0,				/* dsa_sign_setup */

-	0,				/* dsa_do_verify */

-	0,				/* dsa_mod_exp */

-	0,				/* bn_mod_exp */

-	0,				/* init	*/

-	capi_dsa_free,			/* finish */

-	0, 				/* flags */

-	NULL,				/* app_data */

-	0,				/* dsa_paramgen */

-	0				/* dsa_keygen */

-	};

-

-static int capi_init(ENGINE *e)

-	{

-	CAPI_CTX *ctx;

-	const RSA_METHOD *ossl_rsa_meth;

-	const DSA_METHOD *ossl_dsa_meth;

-	capi_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, 0);

-	cert_capi_idx = X509_get_ex_new_index(0, NULL, NULL, NULL, 0);

-

-	ctx = capi_ctx_new();

-	if (!ctx || (capi_idx < 0))

-		goto memerr;

-

-	ENGINE_set_ex_data(e, capi_idx, ctx);

-	/* Setup RSA_METHOD */

-	rsa_capi_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, 0);

-	ossl_rsa_meth = RSA_PKCS1_SSLeay();

-	capi_rsa_method.rsa_pub_enc = ossl_rsa_meth->rsa_pub_enc;

-	capi_rsa_method.rsa_pub_dec = ossl_rsa_meth->rsa_pub_dec;

-	capi_rsa_method.rsa_mod_exp = ossl_rsa_meth->rsa_mod_exp;

-	capi_rsa_method.bn_mod_exp = ossl_rsa_meth->bn_mod_exp;

-

-	/* Setup DSA Method */

-	dsa_capi_idx = DSA_get_ex_new_index(0, NULL, NULL, NULL, 0);

-	ossl_dsa_meth = DSA_OpenSSL();

-	capi_dsa_method.dsa_do_verify = ossl_dsa_meth->dsa_do_verify;

-	capi_dsa_method.dsa_mod_exp = ossl_dsa_meth->dsa_mod_exp;

-	capi_dsa_method.bn_mod_exp = ossl_dsa_meth->bn_mod_exp;

-

-#ifdef OPENSSL_CAPIENG_DIALOG

-	{

-	HMODULE cryptui = LoadLibrary(TEXT("CRYPTUI.DLL"));

-	HMODULE kernel = GetModuleHandle(TEXT("KERNEL32.DLL"));

-	if (cryptui)

-		ctx->certselectdlg = (CERTDLG)GetProcAddress(cryptui, "CryptUIDlgSelectCertificateFromStore");

-	if (kernel)

-		ctx->getconswindow = (GETCONSWIN)GetProcAddress(kernel, "GetConsoleWindow");

-	if (cryptui && !OPENSSL_isservice())

-		ctx->client_cert_select = cert_select_dialog;

-	}

-#endif

-		

-

-	return 1;

-

-	memerr:

-	CAPIerr(CAPI_F_CAPI_INIT, ERR_R_MALLOC_FAILURE);

-	return 0;

-

-	return 1;

-	}

-

-static int capi_destroy(ENGINE *e)

-	{

-	ERR_unload_CAPI_strings();

-	return 1;

-	}

-

-static int capi_finish(ENGINE *e)

-	{

-	CAPI_CTX *ctx;

-	ctx = ENGINE_get_ex_data(e, capi_idx);

-	capi_ctx_free(ctx);

-	ENGINE_set_ex_data(e, capi_idx, NULL);

-	return 1;

-	}

-

-

-/* CryptoAPI key application data. This contains

- * a handle to the private key container (for sign operations)

- * and a handle to the key (for decrypt operations).

- */

-

-struct CAPI_KEY_st

-	{

-	/* Associated certificate context (if any) */

-	PCCERT_CONTEXT pcert;

-	HCRYPTPROV hprov;

-	HCRYPTKEY key;

-	DWORD keyspec;

-	};

-

-static int bind_capi(ENGINE *e)

-	{

-	if (!ENGINE_set_id(e, engine_capi_id)

-		|| !ENGINE_set_name(e, engine_capi_name)

-		|| !ENGINE_set_init_function(e, capi_init)

-		|| !ENGINE_set_finish_function(e, capi_finish)

-		|| !ENGINE_set_destroy_function(e, capi_destroy)

-		|| !ENGINE_set_RSA(e, &capi_rsa_method)

-		|| !ENGINE_set_DSA(e, &capi_dsa_method)

-		|| !ENGINE_set_load_privkey_function(e, capi_load_privkey)

-		|| !ENGINE_set_load_ssl_client_cert_function(e,

-						capi_load_ssl_client_cert)

-		|| !ENGINE_set_cmd_defns(e, capi_cmd_defns)

-		|| !ENGINE_set_ctrl_function(e, capi_ctrl))

-			return 0;

-	ERR_load_CAPI_strings();

-

-	return 1;

-

-	}

-

-#ifndef OPENSSL_NO_DYNAMIC_ENGINE

-static int bind_helper(ENGINE *e, const char *id)

-	{

-	if(id && (strcmp(id, engine_capi_id) != 0))

-		return 0;

-	if(!bind_capi(e))

-		return 0;

-	return 1;

-	}       

-IMPLEMENT_DYNAMIC_CHECK_FN()

-IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)

-#else

-static ENGINE *engine_capi(void)

-	{

-	ENGINE *ret = ENGINE_new();

-	if(!ret)

-		return NULL;

-	if(!bind_capi(ret))

-		{

-		ENGINE_free(ret);

-		return NULL;

-		}

-	return ret;

-	}

-

-void ENGINE_load_capi(void)

-	{

-	/* Copied from eng_[openssl|dyn].c */

-	ENGINE *toadd = engine_capi();

-	if(!toadd) return;

-	ENGINE_add(toadd);

-	ENGINE_free(toadd);

-	ERR_clear_error();

-	}

-#endif

-

-

-static int lend_tobn(BIGNUM *bn, unsigned char *bin, int binlen)

-	{

-	int i;

-	/* Reverse buffer in place: since this is a keyblob structure

-	 * that will be freed up after conversion anyway it doesn't 

-	 * matter if we change it.

-	 */

-	for(i = 0; i < binlen / 2; i++)

-		{

-		unsigned char c;

-		c = bin[i];

-		bin[i] = bin[binlen - i - 1];

-		bin[binlen - i - 1] = c;

-		}

-

-	if (!BN_bin2bn(bin, binlen, bn))

-		return 0;

-	return 1;

-	}

-

-/* Given a CAPI_KEY get an EVP_PKEY structure */

-

-static EVP_PKEY *capi_get_pkey(ENGINE *eng, CAPI_KEY *key)

-	{

-	unsigned char *pubkey = NULL;

-	DWORD len;

-	BLOBHEADER *bh;

-	RSA *rkey = NULL;

-	DSA *dkey = NULL;

-	EVP_PKEY *ret = NULL;

-	if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, NULL, &len))

-		{

-		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR);

-		capi_addlasterror();

-		return NULL;

-		}

-

-	pubkey = OPENSSL_malloc(len);

-

-	if (!pubkey)

-		goto memerr;

-

-	if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, pubkey, &len))

-		{

-		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_ERROR);

-		capi_addlasterror();

-		goto err;

-		}

-

-	bh = (BLOBHEADER *)pubkey;

-	if (bh->bType != PUBLICKEYBLOB)

-		{

-		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_PUBLIC_KEY_BLOB);

-		goto err;

-		}

-	if (bh->aiKeyAlg == CALG_RSA_SIGN || bh->aiKeyAlg == CALG_RSA_KEYX)

-		{

-		RSAPUBKEY *rp;

-		DWORD rsa_modlen;

-		unsigned char *rsa_modulus;

-		rp = (RSAPUBKEY *)(bh + 1);

-		if (rp->magic != 0x31415352)

-			{

-			char magstr[10];

-			BIO_snprintf(magstr, 10, "%lx", rp->magic);

-			CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);

-			ERR_add_error_data(2, "magic=0x", magstr);

-			goto err;

-			}

-		rsa_modulus = (unsigned char *)(rp + 1);

-		rkey = RSA_new_method(eng);

-		if (!rkey)

-			goto memerr;

-

-		rkey->e = BN_new();

-		rkey->n = BN_new();

-

-		if (!rkey->e || !rkey->n)

-			goto memerr;

-

-		if (!BN_set_word(rkey->e, rp->pubexp))

-			goto memerr;

-

-		rsa_modlen = rp->bitlen / 8;

-		if (!lend_tobn(rkey->n, rsa_modulus, rsa_modlen))

-			goto memerr;

-

-		RSA_set_ex_data(rkey, rsa_capi_idx, key);

-

-		if (!(ret = EVP_PKEY_new()))

-			goto memerr;

-

-		EVP_PKEY_assign_RSA(ret, rkey);

-		rkey = NULL;

-

-		}

-	else if (bh->aiKeyAlg == CALG_DSS_SIGN)

-		{

-		DSSPUBKEY *dp;

-		DWORD dsa_plen;

-		unsigned char *btmp;

-		dp = (DSSPUBKEY *)(bh + 1);

-		if (dp->magic != 0x31535344)

-			{

-			char magstr[10];

-			BIO_snprintf(magstr, 10, "%lx", dp->magic);

-			CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);

-			ERR_add_error_data(2, "magic=0x", magstr);

-			goto err;

-			}

-		dsa_plen = dp->bitlen / 8;

-		btmp = (unsigned char *)(dp + 1);

-		dkey = DSA_new_method(eng);

-		if (!dkey)

-			goto memerr;

-		dkey->p = BN_new();

-		dkey->q = BN_new();

-		dkey->g = BN_new();

-		dkey->pub_key = BN_new();

-		if (!dkey->p || !dkey->q || !dkey->g || !dkey->pub_key)

-			goto memerr;

-		if (!lend_tobn(dkey->p, btmp, dsa_plen))

-			goto memerr;

-		btmp += dsa_plen;

-		if (!lend_tobn(dkey->q, btmp, 20))

-			goto memerr;

-		btmp += 20;

-		if (!lend_tobn(dkey->g, btmp, dsa_plen))

-			goto memerr;

-		btmp += dsa_plen;

-		if (!lend_tobn(dkey->pub_key, btmp, dsa_plen))

-			goto memerr;

-		btmp += dsa_plen;

-

-		DSA_set_ex_data(dkey, dsa_capi_idx, key);

-

-		if (!(ret = EVP_PKEY_new()))

-			goto memerr;

-

-		EVP_PKEY_assign_DSA(ret, dkey);

-		dkey = NULL;

-		}

-	else

-		{

-		char algstr[10];

-		BIO_snprintf(algstr, 10, "%lx", bh->aiKeyAlg);

-		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM);

-		ERR_add_error_data(2, "aiKeyAlg=0x", algstr);

-		goto err;

-		}

-

-

-	err:

-	if (pubkey)

-		OPENSSL_free(pubkey);

-	if (!ret)

-		{

-		if (rkey)

-			RSA_free(rkey);

-		if (dkey)

-			DSA_free(dkey);

-		}

-

-	return ret;

-

-memerr:

-	CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_MALLOC_FAILURE);

-	goto err;

-

-	}

-

-static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,

-	UI_METHOD *ui_method, void *callback_data)

-	{

-	CAPI_CTX *ctx;

-	CAPI_KEY *key;

-	EVP_PKEY *ret;

-	ctx = ENGINE_get_ex_data(eng, capi_idx);

-

-	if (!ctx)

-		{

-		CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_CANT_FIND_CAPI_CONTEXT);

-		return NULL;

-		}

-

-	key = capi_find_key(ctx, key_id);

-

-	if (!key)

-		return NULL;

-

-	ret = capi_get_pkey(eng, key);

-

-	if (!ret)

-		capi_free_key(key);

-	return ret;

-

-	}

-

-/* CryptoAPI RSA operations */

-

-int capi_rsa_priv_enc(int flen, const unsigned char *from,

-                unsigned char *to, RSA *rsa, int padding)

-	{

-	CAPIerr(CAPI_F_CAPI_RSA_PRIV_ENC, CAPI_R_FUNCTION_NOT_SUPPORTED);

-	return -1;

-	}

-

-int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,

-             unsigned char *sigret, unsigned int *siglen, const RSA *rsa)

-	{

-	ALG_ID alg;

-	HCRYPTHASH hash;

-	DWORD slen;

-	unsigned int i;

-	int ret = -1;

-	CAPI_KEY *capi_key;

-	CAPI_CTX *ctx;

-

-	ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);

-

-	CAPI_trace(ctx, "Called CAPI_rsa_sign()\n");

-

-	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);

-	if (!capi_key)

-		{

-		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_GET_KEY);

-		return -1;

-		}

-/* Convert the signature type to a CryptoAPI algorithm ID */

-	switch(dtype)

-		{

-	case NID_sha1:

-		alg = CALG_SHA1;

-		break;

-

-	case NID_md5:

-		alg = CALG_MD5;

-		break;

-

-	case NID_md5_sha1:

-		alg = CALG_SSL3_SHAMD5;

-		break;

-	default:

-		{

-		char algstr[10];

-		BIO_snprintf(algstr, 10, "%lx", dtype);

-		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_UNSUPPORTED_ALGORITHM_NID);

-		ERR_add_error_data(2, "NID=0x", algstr);

-		return -1;

-		}

-	}

-

-

-

-/* Create the hash object */

-	if(!CryptCreateHash(capi_key->hprov, alg, 0, 0, &hash))

-		{

-		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);

-		capi_addlasterror();

-		return -1;

-		}

-/* Set the hash value to the value passed */

-

-	if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)m, 0))

-		{

-		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_SET_HASH_VALUE);

-		capi_addlasterror();

-		goto err;

-		}

-

-

-/* Finally sign it */

-	slen = RSA_size(rsa);

-	if(!CryptSignHashA(hash, capi_key->keyspec, NULL, 0, sigret, &slen))

-		{

-		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_ERROR_SIGNING_HASH);

-		capi_addlasterror();

-		goto err;

-		}

-	else

-		{

-		ret = 1;

-		/* Inplace byte reversal of signature */

-		for(i = 0; i < slen / 2; i++)

-			{

-			unsigned char c;

-			c = sigret[i];

-			sigret[i] = sigret[slen - i - 1];

-			sigret[slen - i - 1] = c;

-			}

-		*siglen = slen;

-		}

-

-	/* Now cleanup */

-

-err:

-	CryptDestroyHash(hash);

-

-	return ret;

-	}

-

-int capi_rsa_priv_dec(int flen, const unsigned char *from,

-                unsigned char *to, RSA *rsa, int padding)

-	{

-	int i;

-	unsigned char *tmpbuf;

-	CAPI_KEY *capi_key;

-	CAPI_CTX *ctx;

-	ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);

-

-	CAPI_trace(ctx, "Called capi_rsa_priv_dec()\n");

-

-

-	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);

-	if (!capi_key)

-		{

-		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_CANT_GET_KEY);

-		return -1;

-		}

-

-	if(padding != RSA_PKCS1_PADDING)

-		{

-		char errstr[10];

-		BIO_snprintf(errstr, 10, "%d", padding);

-		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_UNSUPPORTED_PADDING);

-		ERR_add_error_data(2, "padding=", errstr);

-		return -1;

-		}

-

-	/* Create temp reverse order version of input */

-	if(!(tmpbuf = OPENSSL_malloc(flen)) ) 

-		{

-		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, ERR_R_MALLOC_FAILURE);

-		return -1;

-		}

-	for(i = 0; i < flen; i++)

-		tmpbuf[flen - i - 1] = from[i];

-	

-	/* Finally decrypt it */

-	if(!CryptDecrypt(capi_key->key, 0, TRUE, 0, tmpbuf, &flen))

-		{

-		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_DECRYPT_ERROR);

-		capi_addlasterror();

-		OPENSSL_free(tmpbuf);

-		return -1;

-		} 

-	else memcpy(to, tmpbuf, flen);

-

-	OPENSSL_free(tmpbuf);

-

-	return flen;

-	}

-

-static int capi_rsa_free(RSA *rsa)

-	{

-	CAPI_KEY *capi_key;

-	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);

-	capi_free_key(capi_key);

-	RSA_set_ex_data(rsa, rsa_capi_idx, 0);

-	return 1;

-	}

-

-/* CryptoAPI DSA operations */

-

-static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,

-								DSA *dsa)

-	{

-	HCRYPTHASH hash;

-	DWORD slen;

-	DSA_SIG *ret = NULL;

-	CAPI_KEY *capi_key;

-	CAPI_CTX *ctx;

-	unsigned char csigbuf[40];

-

-	ctx = ENGINE_get_ex_data(dsa->engine, capi_idx);

-

-	CAPI_trace(ctx, "Called CAPI_dsa_do_sign()\n");

-

-	capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);

-

-	if (!capi_key)

-		{

-		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_GET_KEY);

-		return NULL;

-		}

-

-	if (dlen != 20)

-		{

-		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_INVALID_DIGEST_LENGTH);

-		return NULL;

-		}

-

-	/* Create the hash object */

-	if(!CryptCreateHash(capi_key->hprov, CALG_SHA1, 0, 0, &hash))

-		{

-		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);

-		capi_addlasterror();

-		return NULL;

-		}

-

-	/* Set the hash value to the value passed */

-	if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)digest, 0))

-		{

-		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_SET_HASH_VALUE);

-		capi_addlasterror();

-		goto err;

-		}

-

-

-	/* Finally sign it */

-	slen = sizeof(csigbuf);

-	if(!CryptSignHashA(hash, capi_key->keyspec, NULL, 0, csigbuf, &slen))

-		{

-		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_ERROR_SIGNING_HASH);

-		capi_addlasterror();

-		goto err;

-		}

-	else

-		{

-		ret = DSA_SIG_new();

-		if (!ret)

-			goto err;

-		ret->r = BN_new();

-		ret->s = BN_new();

-		if (!ret->r || !ret->s)

-			goto err;

-		if (!lend_tobn(ret->r, csigbuf, 20)

-			|| !lend_tobn(ret->s, csigbuf + 20, 20))

-			{

-			DSA_SIG_free(ret);

-			ret = NULL;

-			goto err;

-			}

-		}

-

-	/* Now cleanup */

-

-err:

-	OPENSSL_cleanse(csigbuf, 40);

-	CryptDestroyHash(hash);

-	return ret;

-	}

-

-static int capi_dsa_free(DSA *dsa)

-	{

-	CAPI_KEY *capi_key;

-	capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);

-	capi_free_key(capi_key);

-	DSA_set_ex_data(dsa, dsa_capi_idx, 0);

-	return 1;

-	}

-

-static void capi_vtrace(CAPI_CTX *ctx, int level, char *format, va_list argptr)

-	{

-	BIO *out;

-

-	if (!ctx || (ctx->debug_level < level) || (!ctx->debug_file))

-		return;

-	out = BIO_new_file(ctx->debug_file, "a+");

-	BIO_vprintf(out, format, argptr);

-	BIO_free(out);

-	}

-

-static void CAPI_trace(CAPI_CTX *ctx, char *format, ...)

-	{

-	va_list args;

-	va_start(args, format);

-	capi_vtrace(ctx, CAPI_DBG_TRACE, format, args);

-	va_end(args);

-	}

-

-static void capi_addlasterror(void)

-	{

-	capi_adderror(GetLastError());

-	}

-

-static void capi_adderror(DWORD err)

-	{

-	char errstr[10];

-	BIO_snprintf(errstr, 10, "%lX", err);

-	ERR_add_error_data(2, "Error code= 0x", errstr);

-	}

-

-static char *wide_to_asc(LPWSTR wstr)

-	{

-	char *str;

-	int len_0,sz;

-

-	if (!wstr)

-		return NULL;

-	len_0 = (int)wcslen(wstr)+1;	/* WideCharToMultiByte expects int */

-        sz = WideCharToMultiByte(CP_ACP,0,wstr,len_0,NULL,0,NULL,NULL);

-	if (!sz)

-		{

-		CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);

-		return NULL;

-		}

-	str = OPENSSL_malloc(sz);

-	if (!str)

-		{

-		CAPIerr(CAPI_F_WIDE_TO_ASC, ERR_R_MALLOC_FAILURE);

-		return NULL;

-		}

-	if (!WideCharToMultiByte(CP_ACP,0,wstr,len_0,str,sz,NULL,NULL))

-		{

-		OPENSSL_free(str);

-		CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);

-		return NULL;

-		}

-	return str;

-	}

-

-static int capi_get_provname(CAPI_CTX *ctx, LPSTR *pname, DWORD *ptype, DWORD idx)

-	{

-	LPSTR name;

-	DWORD len, err;

-	CAPI_trace(ctx, "capi_get_provname, index=%d\n", idx);

-	if (!CryptEnumProvidersA(idx, NULL, 0, ptype, NULL, &len))

-		{

-		err = GetLastError();

-		if (err == ERROR_NO_MORE_ITEMS)

-			return 2;

-		CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);

-		capi_adderror(err);

-		return 0;

-		}

-	name = OPENSSL_malloc(len);

-	if (!CryptEnumProvidersA(idx, NULL, 0, ptype, name, &len))

-		{

-		err = GetLastError();

-		if (err == ERROR_NO_MORE_ITEMS)

-			return 2;

-		CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);

-		capi_adderror(err);

-		return 0;

-		}

-	*pname = name;

-	CAPI_trace(ctx, "capi_get_provname, returned name=%s, type=%d\n", name, *ptype);

-

-	return 1;

-	}

-

-static int capi_list_providers(CAPI_CTX *ctx, BIO *out)

-	{

-	DWORD idx, ptype;

-	int ret;

-	LPSTR provname = NULL;

-	CAPI_trace(ctx, "capi_list_providers\n");

-	BIO_printf(out, "Available CSPs:\n");

-	for(idx = 0; ; idx++)

-		{

-		ret = capi_get_provname(ctx, &provname, &ptype, idx);

-		if (ret == 2)

-			break;

-		if (ret == 0)

-			break;

-		BIO_printf(out, "%d. %s, type %d\n", idx, provname, ptype);

-		OPENSSL_free(provname);

-		}

-	return 1;

-	}

-

-static int capi_list_containers(CAPI_CTX *ctx, BIO *out)

-	{

-	int ret = 1;

-	HCRYPTPROV hprov;

-	DWORD err, idx, flags, buflen = 0, clen;

-	LPSTR cname;

-	CAPI_trace(ctx, "Listing containers CSP=%s, type = %d\n", ctx->cspname, ctx->csptype);

-	if (!CryptAcquireContextA(&hprov, NULL, ctx->cspname, ctx->csptype, CRYPT_VERIFYCONTEXT))

-		{

-		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);

-		capi_addlasterror();

-		return 0;

-		}

-	if (!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, NULL, &buflen, CRYPT_FIRST))

-		{

-		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);

-		capi_addlasterror();

-		return 0;

-		}

-	CAPI_trace(ctx, "Got max container len %d\n", buflen);

-	if (buflen == 0)

-		buflen = 1024;

-	cname = OPENSSL_malloc(buflen);

-	if (!cname)

-		{

-		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, ERR_R_MALLOC_FAILURE);

-		goto err;

-		}

-

-	for (idx = 0;;idx++)

-		{

-		clen = buflen;

-		cname[0] = 0;

-

-		if (idx == 0)

-			flags = CRYPT_FIRST;

-		else

-			flags = 0;

-		if(!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, cname, &clen, flags))

-			{

-			err = GetLastError();

-			if (err == ERROR_NO_MORE_ITEMS)

-				goto done;

-			CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);

-			capi_adderror(err);

-			goto err;

-			}

-		CAPI_trace(ctx, "Container name %s, len=%d, index=%d, flags=%d\n", cname, clen, idx, flags);

-		if (!cname[0] && (clen == buflen))

-			{

-			CAPI_trace(ctx, "Enumerate bug: using workaround\n");

-			goto done;

-			}

-		BIO_printf(out, "%d. %s\n", idx, cname);

-		}

-	err:

-

-	ret = 0;

-

-	done:

-	if (cname)

-		OPENSSL_free(cname);

-	CryptReleaseContext(hprov, 0);

-

-	return ret;

-	}

-

-CRYPT_KEY_PROV_INFO *capi_get_prov_info(CAPI_CTX *ctx, PCCERT_CONTEXT cert)

-	{

-	DWORD len;

-	CRYPT_KEY_PROV_INFO *pinfo;

-	

-	if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, NULL, &len))

-		return NULL;

-	pinfo = OPENSSL_malloc(len);

-	if (!pinfo)

-		{

-		CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, ERR_R_MALLOC_FAILURE);

-		return NULL;

-		}

-	if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, pinfo, &len))

-		{

-		CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO);

-		capi_addlasterror();

-		OPENSSL_free(pinfo);

-		return NULL;

-		}

-	return pinfo;

-	}

-

-static void capi_dump_prov_info(CAPI_CTX *ctx, BIO *out, CRYPT_KEY_PROV_INFO *pinfo)

-	{

-	char *provname = NULL, *contname = NULL;

-	if (!pinfo)

-		{

-		BIO_printf(out, "  No Private Key\n");

-		return;

-		}

-	provname = wide_to_asc(pinfo->pwszProvName);

-	contname = wide_to_asc(pinfo->pwszContainerName);

-	if (!provname || !contname)

-		goto err;

-

-	BIO_printf(out, "  Private Key Info:\n");

-	BIO_printf(out, "    Provider Name:  %s, Provider Type %d\n", provname, pinfo->dwProvType);

-	BIO_printf(out, "    Container Name: %s, Key Type %d\n", contname, pinfo->dwKeySpec);

-	err:

-	if (provname)

-		OPENSSL_free(provname);

-	if (contname)

-		OPENSSL_free(contname);

-	}

-

-char * capi_cert_get_fname(CAPI_CTX *ctx, PCCERT_CONTEXT cert)

-	{

-	LPWSTR wfname;

-	DWORD dlen;

-

-	CAPI_trace(ctx, "capi_cert_get_fname\n");

-	if (!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, NULL, &dlen))

-		return NULL;

-	wfname = OPENSSL_malloc(dlen);

-	if (CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, wfname, &dlen))

-		{

-		char *fname = wide_to_asc(wfname);

-		OPENSSL_free(wfname);

-		return fname;

-		}

-	CAPIerr(CAPI_F_CAPI_CERT_GET_FNAME, CAPI_R_ERROR_GETTING_FRIENDLY_NAME);

-	capi_addlasterror();

-

-	OPENSSL_free(wfname);

-	return NULL;

-	}

-

-

-void capi_dump_cert(CAPI_CTX *ctx, BIO *out, PCCERT_CONTEXT cert)

-	{

-	X509 *x;

-	unsigned char *p;

-	unsigned long flags = ctx->dump_flags;

-	if (flags & CAPI_DMP_FNAME)

-		{

-		char *fname;

-		fname = capi_cert_get_fname(ctx, cert);

-		if (fname)

-			{

-			BIO_printf(out, "  Friendly Name \"%s\"\n", fname);

-			OPENSSL_free(fname);

-			}

-		else

-			BIO_printf(out, "  <No Friendly Name>\n");

-		}

-

-	p = cert->pbCertEncoded;

-	x = d2i_X509(NULL, &p, cert->cbCertEncoded);

-	if (!x)

-		BIO_printf(out, "  <Can't parse certificate>\n");

-	if (flags & CAPI_DMP_SUMMARY)

-		{

-		BIO_printf(out, "  Subject: ");

-		X509_NAME_print_ex(out, X509_get_subject_name(x), 0, XN_FLAG_ONELINE);

-		BIO_printf(out, "\n  Issuer: ");

-		X509_NAME_print_ex(out, X509_get_issuer_name(x), 0, XN_FLAG_ONELINE);

-		BIO_printf(out, "\n");

-		}

-	if (flags & CAPI_DMP_FULL)

-		X509_print_ex(out, x, XN_FLAG_ONELINE,0);

-

-	if (flags & CAPI_DMP_PKEYINFO)

-		{

-		CRYPT_KEY_PROV_INFO *pinfo;

-		pinfo = capi_get_prov_info(ctx, cert);

-		capi_dump_prov_info(ctx, out, pinfo);

-		if (pinfo)

-			OPENSSL_free(pinfo);

-		}

-

-	if (flags & CAPI_DMP_PEM)

-		PEM_write_bio_X509(out, x);

-	X509_free(x);

-	}

-

-HCERTSTORE capi_open_store(CAPI_CTX *ctx, char *storename)

-	{

-	HCERTSTORE hstore;

-

-	if (!storename)

-		storename = ctx->storename;

-	if (!storename)

-		storename = "MY";

-	CAPI_trace(ctx, "Opening certificate store %s\n", storename);

-

-	hstore = CertOpenStore(CERT_STORE_PROV_SYSTEM_A, 0, 0, 

-				ctx->store_flags, storename);

-	if (!hstore)

-		{

-		CAPIerr(CAPI_F_CAPI_OPEN_STORE, CAPI_R_ERROR_OPENING_STORE);

-		capi_addlasterror();

-		}

-	return hstore;

-	}

-

-int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *id)

-	{

-	char *storename;

-	int idx;

-	int ret = 1;

-	HCERTSTORE hstore;

-	PCCERT_CONTEXT cert = NULL;

-

-	storename = ctx->storename;

-	if (!storename)

-		storename = "MY";

-	CAPI_trace(ctx, "Listing certs for store %s\n", storename);

-

-	hstore = capi_open_store(ctx, storename);

-	if (!hstore)

-		return 0;

-	if (id)

-		{

-		cert = capi_find_cert(ctx, id, hstore);

-		if (!cert)

-			{

-			ret = 0;

-			goto err;

-			}

-		capi_dump_cert(ctx, out, cert);

-		CertFreeCertificateContext(cert);

-		}

-	else

-		{

-		for(idx = 0;;idx++)

-			{

-			LPWSTR fname = NULL;

-			cert = CertEnumCertificatesInStore(hstore, cert);

-			if (!cert)

-				break;

-			BIO_printf(out, "Certificate %d\n", idx);

-			capi_dump_cert(ctx, out, cert);

-			}

-		}

-	err:

-	CertCloseStore(hstore, 0);

-	return ret;

-	}

-

-static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore)

-	{

-	PCCERT_CONTEXT cert = NULL;

-	char *fname = NULL;

-	int match;

-	switch(ctx->lookup_method)

-		{

-		case CAPI_LU_SUBSTR:

-			return CertFindCertificateInStore(hstore,

-					X509_ASN_ENCODING, 0,

-					CERT_FIND_SUBJECT_STR_A, id, NULL);

-		case CAPI_LU_FNAME:

-			for(;;)

-				{

-				cert = CertEnumCertificatesInStore(hstore, cert);

-				if (!cert)

-					return NULL;

-				fname = capi_cert_get_fname(ctx, cert);

-				if (fname)

-					{

-					if (strcmp(fname, id))

-						match = 0;

-					else

-						match = 1;

-					OPENSSL_free(fname);

-					if (match)

-						return cert;

-					}

-				}

-		default:

-			return NULL;

-		}

-	}

-

-static CAPI_KEY *capi_get_key(CAPI_CTX *ctx, const char *contname, char *provname, DWORD ptype, DWORD keyspec)

-	{

-	CAPI_KEY *key;

-	key = OPENSSL_malloc(sizeof(CAPI_KEY));

-	CAPI_trace(ctx, "capi_get_key, contname=%s, provname=%s, type=%d\n", 

-						contname, provname, ptype);

-	if (!CryptAcquireContextA(&key->hprov, contname, provname, ptype, 0))

-		{

-		CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);

-		capi_addlasterror();

-		goto err;

-		}

-	if (!CryptGetUserKey(key->hprov, keyspec, &key->key))

-		{

-		CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_GETUSERKEY_ERROR);

-		capi_addlasterror();

-		CryptReleaseContext(key->hprov, 0);

-		goto err;

-		}

-	key->keyspec = keyspec;

-	key->pcert = NULL;

-	return key;

-

-	err:

-	OPENSSL_free(key);

-	return NULL;

-	}

-

-static CAPI_KEY *capi_get_cert_key(CAPI_CTX *ctx, PCCERT_CONTEXT cert)

-	{

-	CAPI_KEY *key = NULL;

-	CRYPT_KEY_PROV_INFO *pinfo = NULL;

-	char *provname = NULL, *contname = NULL;

-	pinfo = capi_get_prov_info(ctx, cert);

-	if (!pinfo)

-		goto err;

-	provname = wide_to_asc(pinfo->pwszProvName);

-	contname = wide_to_asc(pinfo->pwszContainerName);

-	if (!provname || !contname)

-		goto err;

-	key = capi_get_key(ctx, contname, provname,

-				pinfo->dwProvType, pinfo->dwKeySpec);

-

-	err:

-	if (pinfo)

-		OPENSSL_free(pinfo);

-	if (provname)

-		OPENSSL_free(provname);

-	if (contname)

-		OPENSSL_free(contname);

-	return key;

-	}

-

-CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id)

-	{

-	PCCERT_CONTEXT cert;

-	HCERTSTORE hstore;

-	CAPI_KEY *key = NULL;

-	switch (ctx->lookup_method)

-		{

-		case CAPI_LU_SUBSTR:

-		case CAPI_LU_FNAME:

-		hstore = capi_open_store(ctx, NULL);

-		if (!hstore)

-			return NULL;

-		cert = capi_find_cert(ctx, id, hstore);

-		if (cert)

-			{

-			key = capi_get_cert_key(ctx, cert);

-			CertFreeCertificateContext(cert);

-			}

-		CertCloseStore(hstore, 0);

-		break;

-

-		case CAPI_LU_CONTNAME:

-		key = capi_get_key(ctx, id, ctx->cspname, ctx->csptype,

-							ctx->keytype);

-		break;

-		}

-

-	return key;

-	}

-

-void capi_free_key(CAPI_KEY *key)

-	{

-	if (!key)

-		return;

-	CryptDestroyKey(key->key);

-	CryptReleaseContext(key->hprov, 0);

-	if (key->pcert)

-		CertFreeCertificateContext(key->pcert);

-	OPENSSL_free(key);

-	}

-

-

-/* Initialize a CAPI_CTX structure */

-

-static CAPI_CTX *capi_ctx_new()

-	{

-	CAPI_CTX *ctx;

-	ctx = OPENSSL_malloc(sizeof(CAPI_CTX));

-	if (!ctx)

-		{

-		CAPIerr(CAPI_F_CAPI_CTX_NEW, ERR_R_MALLOC_FAILURE);

-		return NULL;

-		}

-	ctx->cspname = NULL;

-	ctx->csptype = PROV_RSA_FULL;

-	ctx->dump_flags = CAPI_DMP_SUMMARY|CAPI_DMP_FNAME;

-	ctx->keytype = AT_KEYEXCHANGE;

-	ctx->storename = NULL;

-	ctx->ssl_client_store = NULL;

-	ctx->store_flags = CERT_STORE_OPEN_EXISTING_FLAG |

-				CERT_STORE_READONLY_FLAG |

-				CERT_SYSTEM_STORE_CURRENT_USER;

-	ctx->lookup_method = CAPI_LU_SUBSTR;

-	ctx->debug_level = 0;

-	ctx->debug_file = NULL;

-	ctx->client_cert_select = cert_select_simple;

-	return ctx;

-	}

-

-static void capi_ctx_free(CAPI_CTX *ctx)

-	{

-	CAPI_trace(ctx, "Calling capi_ctx_free with %lx\n", ctx);

-	if (!ctx)

-		return;

-	if (ctx->cspname)

-		OPENSSL_free(ctx->cspname);

-	if (ctx->debug_file)

-		OPENSSL_free(ctx->debug_file);

-	if (ctx->storename)

-		OPENSSL_free(ctx->storename);

-	if (ctx->ssl_client_store)

-		OPENSSL_free(ctx->ssl_client_store);

-	OPENSSL_free(ctx);

-	}

-

-static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check)

-	{

-	CAPI_trace(ctx, "capi_ctx_set_provname, name=%s, type=%d\n", pname, type);

-	if (check)

-		{

-		HCRYPTPROV hprov;

-		if (!CryptAcquireContextA(&hprov, NULL, pname, type,

-						CRYPT_VERIFYCONTEXT))

-			{

-			CAPIerr(CAPI_F_CAPI_CTX_SET_PROVNAME, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);

-			capi_addlasterror();

-			return 0;

-			}

-		CryptReleaseContext(hprov, 0);

-		}

-	ctx->cspname = BUF_strdup(pname);

-	ctx->csptype = type;

-	return 1;

-	}

-

-static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx)

-	{

-	LPSTR pname;

-	DWORD type;

-	if (capi_get_provname(ctx, &pname, &type, idx) != 1)

-		return 0;

-	return capi_ctx_set_provname(ctx, pname, type, 0);

-	}

-

-static int cert_issuer_match(STACK_OF(X509_NAME) *ca_dn, X509 *x)

-	{

-	int i;

-	X509_NAME *nm;

-	/* Special case: empty list: match anything */

-	if (sk_X509_NAME_num(ca_dn) <= 0)

-		return 1;

-	for (i = 0; i < sk_X509_NAME_num(ca_dn); i++)

-		{

-		nm = sk_X509_NAME_value(ca_dn, i);

-		if (!X509_NAME_cmp(nm, X509_get_issuer_name(x)))

-				return 1;

-		}

-	return 0;

-	}

-

-

-

-static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,

-	STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,

-	STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data)

-	{

-	STACK_OF(X509) *certs = NULL;

-	X509 *x;

-	char *storename;

-	const char *p;

-	int i, client_cert_idx;

-	HCERTSTORE hstore;

-	PCCERT_CONTEXT cert = NULL, excert = NULL;

-	CAPI_CTX *ctx;

-	CAPI_KEY *key;

-	ctx = ENGINE_get_ex_data(e, capi_idx);

-

-	*pcert = NULL;

-	*pkey = NULL;

-

-	storename = ctx->ssl_client_store;

-	if (!storename)

-		storename = "MY";

-

-	hstore = capi_open_store(ctx, storename);

-	if (!hstore)

-		return 0;

-	/* Enumerate all certificates collect any matches */

-	for(i = 0;;i++)

-		{

-		cert = CertEnumCertificatesInStore(hstore, cert);

-		if (!cert)

-			break;

-		p = cert->pbCertEncoded;

-		x = d2i_X509(NULL, &p, cert->cbCertEncoded);

-		if (!x)

-			{

-			CAPI_trace(ctx, "Can't Parse Certificate %d\n", i);

-			continue;

-			}

-		if (cert_issuer_match(ca_dn, x)

-			&& X509_check_purpose(x, X509_PURPOSE_SSL_CLIENT, 0))

-			{

-			key = capi_get_cert_key(ctx, cert);

-			if (!key)

-				{

-				X509_free(x);

-				continue;

-				}

-			/* Match found: attach extra data to it so

-			 * we can retrieve the key later.

-			 */

-			excert = CertDuplicateCertificateContext(cert);

-			key->pcert = excert;

-			X509_set_ex_data(x, cert_capi_idx, key);

-

-			if (!certs)

-				certs = sk_X509_new_null();

-

-			sk_X509_push(certs, x);

-			}

-		else

-			X509_free(x);

-

-		}

-

-	if (cert)

-		CertFreeCertificateContext(cert);

-	if (hstore)

-		CertCloseStore(hstore, 0);

-

-	if (!certs)

-		return 0;

-

-

-	/* Select the appropriate certificate */

-

-	client_cert_idx = ctx->client_cert_select(e, ssl, certs);

-

-	/* Set the selected certificate and free the rest */

-

-	for(i = 0; i < sk_X509_num(certs); i++)

-		{

-		x = sk_X509_value(certs, i);

-		if (i == client_cert_idx)

-			*pcert = x;

-		else

-			{

-			key = X509_get_ex_data(x, cert_capi_idx);

-			capi_free_key(key);

-			X509_free(x);

-			}

-		}

-

-	sk_X509_free(certs);

-

-	if (!*pcert)

-		return 0;

-

-	/* Setup key for selected certificate */

-

-	key = X509_get_ex_data(*pcert, cert_capi_idx);

-	*pkey = capi_get_pkey(e, key);

-	X509_set_ex_data(*pcert, cert_capi_idx, NULL);

-

-	return 1;

-

-	}

-

-

-/* Simple client cert selection function: always select first */

-

-static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)

-	{

-	return 0;

-	}

-

-#ifdef OPENSSL_CAPIENG_DIALOG

-

-/* More complex cert selection function, using standard function

- * CryptUIDlgSelectCertificateFromStore() to produce a dialog box.

- */

-

-/* Definitions which are in cryptuiapi.h but this is not present in older

- * versions of headers.

- */

-

-#ifndef CRYPTUI_SELECT_LOCATION_COLUMN

-#define CRYPTUI_SELECT_LOCATION_COLUMN                   0x000000010

-#define CRYPTUI_SELECT_INTENDEDUSE_COLUMN                0x000000004

-#endif

-

-#define dlg_title L"OpenSSL Application SSL Client Certificate Selection"

-#define dlg_prompt L"Select a certificate to use for authentication"

-#define dlg_columns	 CRYPTUI_SELECT_LOCATION_COLUMN \

-			|CRYPTUI_SELECT_INTENDEDUSE_COLUMN

-

-static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)

-	{

-	X509 *x;

-	HCERTSTORE dstore;

-	PCCERT_CONTEXT cert;

-	CAPI_CTX *ctx;

-	CAPI_KEY *key;

-	HWND hwnd;

-	int i, idx = -1;

-	if (sk_X509_num(certs) == 1)

-		return 0;

-	ctx = ENGINE_get_ex_data(e, capi_idx);

-	/* Create an in memory store of certificates */

-	dstore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,

-					CERT_STORE_CREATE_NEW_FLAG, NULL);

-	if (!dstore)

-		{

-		CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_CREATING_STORE);

-		capi_addlasterror();

-		goto err;

-		}

-	/* Add all certificates to store */

-	for(i = 0; i < sk_X509_num(certs); i++)

-		{

-		x = sk_X509_value(certs, i);

-		key = X509_get_ex_data(x, cert_capi_idx);

-

-		if (!CertAddCertificateContextToStore(dstore, key->pcert,

-						CERT_STORE_ADD_NEW, NULL))

-			{

-			CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_ADDING_CERT);

-			capi_addlasterror();

-			goto err;

-			}

-

-		}

-	hwnd = GetForegroundWindow();

-	if (!hwnd)

-		hwnd = GetActiveWindow();

-	if (!hwnd && ctx->getconswindow)

-		hwnd = ctx->getconswindow();

-	/* Call dialog to select one */

-	cert = ctx->certselectdlg(dstore, hwnd, dlg_title, dlg_prompt,

-						dlg_columns, 0, NULL);

-

-	/* Find matching cert from list */

-	if (cert)

-		{

-		for(i = 0; i < sk_X509_num(certs); i++)

-			{

-			x = sk_X509_value(certs, i);

-			key = X509_get_ex_data(x, cert_capi_idx);

-			if (CertCompareCertificate(

-				X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,

-					cert->pCertInfo,

-					key->pcert->pCertInfo))

-				{

-				idx = i;

-				break;

-				}

-			}

-		}

-

-	err:

-	if (dstore)

-		CertCloseStore(dstore, 0);

-	return idx;

-

-	}

-#endif

-

-#else /* !__COMPILE_CAPIENG */

-#include <openssl/engine.h>

-#ifndef OPENSSL_NO_DYNAMIC_ENGINE

-OPENSSL_EXPORT

-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);

-OPENSSL_EXPORT

-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }

-IMPLEMENT_DYNAMIC_CHECK_FN()

-#else

-void ENGINE_load_capi(void){}

-#endif

-#endif

+/* engines/e_capi.c */
+/* Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL
+ * project.
+ */
+/* ====================================================================
+ * Copyright (c) 2008 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ */
+
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/buffer.h>
+#include <openssl/bn.h>
+
+#ifdef OPENSSL_SYS_WIN32
+#ifndef OPENSSL_NO_CAPIENG
+
+#include <openssl/rsa.h>
+
+#include <windows.h>
+
+#ifndef _WIN32_WINNT
+#define _WIN32_WINNT 0x0400
+#endif
+
+#include <wincrypt.h>
+
+/*
+ * This module uses several "new" interfaces, among which is
+ * CertGetCertificateContextProperty. CERT_KEY_PROV_INFO_PROP_ID is
+ * one of possible values you can pass to function in question. By
+ * checking if it's defined we can see if wincrypt.h and accompanying
+ * crypt32.lib are in shape. The native MingW32 headers up to and
+ * including __W32API_VERSION 3.14 lack of struct DSSPUBKEY and the
+ * defines CERT_STORE_PROV_SYSTEM_A and CERT_STORE_READONLY_FLAG,
+ * so we check for these too and avoid compiling.
+ * Yes, it's rather "weak" test and if compilation fails,
+ * then re-configure with -DOPENSSL_NO_CAPIENG.
+ */
+#if defined(CERT_KEY_PROV_INFO_PROP_ID) && \
+    defined(CERT_STORE_PROV_SYSTEM_A) && \
+    defined(CERT_STORE_READONLY_FLAG)
+# define __COMPILE_CAPIENG
+#endif /* CERT_KEY_PROV_INFO_PROP_ID */
+#endif /* OPENSSL_NO_CAPIENG */
+#endif /* OPENSSL_SYS_WIN32 */
+
+#ifdef __COMPILE_CAPIENG
+
+#undef X509_EXTENSIONS
+#undef X509_CERT_PAIR
+
+/* Definitions which may be missing from earlier version of headers */
+#ifndef CERT_STORE_OPEN_EXISTING_FLAG
+#define CERT_STORE_OPEN_EXISTING_FLAG                   0x00004000
+#endif
+
+#ifndef CERT_STORE_CREATE_NEW_FLAG
+#define CERT_STORE_CREATE_NEW_FLAG                      0x00002000
+#endif
+
+#ifndef CERT_SYSTEM_STORE_CURRENT_USER
+#define CERT_SYSTEM_STORE_CURRENT_USER			0x00010000
+#endif 
+
+#include <openssl/engine.h>
+#include <openssl/pem.h>
+#include <openssl/x509v3.h>
+
+#include "e_capi_err.h"
+#include "e_capi_err.c"
+
+
+static const char *engine_capi_id = "capi";
+static const char *engine_capi_name = "CryptoAPI ENGINE";
+
+typedef struct CAPI_CTX_st CAPI_CTX;
+typedef struct CAPI_KEY_st CAPI_KEY;
+
+static void capi_addlasterror(void);
+static void capi_adderror(DWORD err);
+
+static void CAPI_trace(CAPI_CTX *ctx, char *format, ...);
+
+static int capi_list_providers(CAPI_CTX *ctx, BIO *out);
+static int capi_list_containers(CAPI_CTX *ctx, BIO *out);
+int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *storename);
+void capi_free_key(CAPI_KEY *key);
+
+static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore);
+
+CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id);
+
+static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
+	UI_METHOD *ui_method, void *callback_data);
+static int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
+             unsigned char *sigret, unsigned int *siglen, const RSA *rsa);
+static int capi_rsa_priv_enc(int flen, const unsigned char *from,
+                unsigned char *to, RSA *rsa, int padding);
+static int capi_rsa_priv_dec(int flen, const unsigned char *from,
+                unsigned char *to, RSA *rsa, int padding);
+static int capi_rsa_free(RSA *rsa);
+
+static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
+							DSA *dsa);
+static int capi_dsa_free(DSA *dsa);
+
+static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,
+	STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
+	STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data);
+
+static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);
+#ifdef OPENSSL_CAPIENG_DIALOG
+static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);
+#endif
+
+typedef PCCERT_CONTEXT (WINAPI *CERTDLG)(HCERTSTORE, HWND, LPCWSTR,
+						LPCWSTR, DWORD, DWORD,
+						void *);
+typedef HWND (WINAPI *GETCONSWIN)(void);
+
+/* This structure contains CAPI ENGINE specific data:
+ * it contains various global options and affects how
+ * other functions behave.
+ */
+
+#define CAPI_DBG_TRACE	2
+#define CAPI_DBG_ERROR	1
+
+struct CAPI_CTX_st {
+	int debug_level;
+	char *debug_file;
+	/* Parameters to use for container lookup */
+	DWORD keytype;
+	LPSTR cspname;
+	DWORD csptype;
+	/* Certificate store name to use */
+	LPSTR storename;
+	LPSTR ssl_client_store;
+	/* System store flags */
+	DWORD store_flags;
+
+/* Lookup string meanings in load_private_key */
+/* Substring of subject: uses "storename" */
+#define CAPI_LU_SUBSTR		1
+/* Friendly name: uses storename */
+#define CAPI_LU_FNAME		2
+/* Container name: uses cspname, keytype */
+#define CAPI_LU_CONTNAME	3
+	int lookup_method;
+/* Info to dump with dumpcerts option */
+/* Issuer and serial name strings */
+#define CAPI_DMP_SUMMARY	0x1
+/* Friendly name */
+#define CAPI_DMP_FNAME		0x2
+/* Full X509_print dump */
+#define CAPI_DMP_FULL		0x4
+/* Dump PEM format certificate */
+#define CAPI_DMP_PEM		0x8
+/* Dump pseudo key (if possible) */
+#define CAPI_DMP_PSKEY		0x10
+/* Dump key info (if possible) */
+#define CAPI_DMP_PKEYINFO	0x20
+
+	DWORD dump_flags;
+	int (*client_cert_select)(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs);
+
+	CERTDLG certselectdlg;
+	GETCONSWIN getconswindow;
+};
+
+
+static CAPI_CTX *capi_ctx_new();
+static void capi_ctx_free(CAPI_CTX *ctx);
+static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check);
+static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx);
+
+#define CAPI_CMD_LIST_CERTS		ENGINE_CMD_BASE
+#define CAPI_CMD_LOOKUP_CERT		(ENGINE_CMD_BASE + 1)
+#define CAPI_CMD_DEBUG_LEVEL		(ENGINE_CMD_BASE + 2)
+#define CAPI_CMD_DEBUG_FILE		(ENGINE_CMD_BASE + 3)
+#define CAPI_CMD_KEYTYPE		(ENGINE_CMD_BASE + 4)
+#define CAPI_CMD_LIST_CSPS		(ENGINE_CMD_BASE + 5)
+#define CAPI_CMD_SET_CSP_IDX		(ENGINE_CMD_BASE + 6)
+#define CAPI_CMD_SET_CSP_NAME		(ENGINE_CMD_BASE + 7)
+#define CAPI_CMD_SET_CSP_TYPE		(ENGINE_CMD_BASE + 8)
+#define CAPI_CMD_LIST_CONTAINERS	(ENGINE_CMD_BASE + 9)
+#define CAPI_CMD_LIST_OPTIONS		(ENGINE_CMD_BASE + 10)
+#define CAPI_CMD_LOOKUP_METHOD		(ENGINE_CMD_BASE + 11)
+#define CAPI_CMD_STORE_NAME		(ENGINE_CMD_BASE + 12)
+#define CAPI_CMD_STORE_FLAGS		(ENGINE_CMD_BASE + 13)
+
+static const ENGINE_CMD_DEFN capi_cmd_defns[] = {
+	{CAPI_CMD_LIST_CERTS,
+		"list_certs",
+		"List all certificates in store",
+		ENGINE_CMD_FLAG_NO_INPUT},
+	{CAPI_CMD_LOOKUP_CERT,
+		"lookup_cert",
+		"Lookup and output certificates",
+		ENGINE_CMD_FLAG_STRING},
+	{CAPI_CMD_DEBUG_LEVEL,
+		"debug_level",
+		"debug level (1=errors, 2=trace)",
+		ENGINE_CMD_FLAG_NUMERIC},
+	{CAPI_CMD_DEBUG_FILE,
+		"debug_file",
+		"debugging filename)",
+		ENGINE_CMD_FLAG_STRING},
+	{CAPI_CMD_KEYTYPE,
+		"key_type",
+		"Key type: 1=AT_KEYEXCHANGE (default), 2=AT_SIGNATURE",
+		ENGINE_CMD_FLAG_NUMERIC},
+	{CAPI_CMD_LIST_CSPS,
+		"list_csps",
+		"List all CSPs",
+		ENGINE_CMD_FLAG_NO_INPUT},
+	{CAPI_CMD_SET_CSP_IDX,
+		"csp_idx",
+		"Set CSP by index",
+		ENGINE_CMD_FLAG_NUMERIC},
+	{CAPI_CMD_SET_CSP_NAME,
+		"csp_name",
+		"Set CSP name, (default CSP used if not specified)",
+		ENGINE_CMD_FLAG_STRING},
+	{CAPI_CMD_SET_CSP_TYPE,
+		"csp_type",
+		"Set CSP type, (default RSA_PROV_FULL)",
+		ENGINE_CMD_FLAG_NUMERIC},
+	{CAPI_CMD_LIST_CONTAINERS,
+		"list_containers",
+		"list container names",
+		ENGINE_CMD_FLAG_NO_INPUT},
+	{CAPI_CMD_LIST_OPTIONS,
+		"list_options",
+		"Set list options (1=summary,2=friendly name, 4=full printout, 8=PEM output, 16=XXX, "
+		"32=private key info)",
+		ENGINE_CMD_FLAG_NUMERIC},
+	{CAPI_CMD_LOOKUP_METHOD,
+		"lookup_method",
+		"Set key lookup method (1=substring, 2=friendlyname, 3=container name)",
+		ENGINE_CMD_FLAG_NUMERIC},
+	{CAPI_CMD_STORE_NAME,
+		"store_name",
+		"certificate store name, default \"MY\"",
+		ENGINE_CMD_FLAG_STRING},
+	{CAPI_CMD_STORE_FLAGS,
+		"store_flags",
+		"Certificate store flags: 1 = system store",
+		ENGINE_CMD_FLAG_NUMERIC},
+
+	{0, NULL, NULL, 0}
+	};
+
+static int capi_idx = -1;
+static int rsa_capi_idx = -1;
+static int dsa_capi_idx = -1;
+static int cert_capi_idx = -1;
+
+static int capi_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+	{
+	int ret = 1;
+	CAPI_CTX *ctx;
+	BIO *out;
+	if (capi_idx == -1)
+		{
+		CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_ENGINE_NOT_INITIALIZED);
+		return 0;
+		}
+	ctx = ENGINE_get_ex_data(e, capi_idx);
+	out = BIO_new_fp(stdout, BIO_NOCLOSE);
+	switch (cmd)
+		{
+		case CAPI_CMD_LIST_CSPS:
+		ret = capi_list_providers(ctx, out);
+		break;
+
+		case CAPI_CMD_LIST_CERTS:
+		ret = capi_list_certs(ctx, out, NULL);
+		break;
+
+		case CAPI_CMD_LOOKUP_CERT:
+		ret = capi_list_certs(ctx, out, p);
+		break;
+
+		case CAPI_CMD_LIST_CONTAINERS:
+		ret = capi_list_containers(ctx, out);
+		break;
+
+		case CAPI_CMD_STORE_NAME:
+		if (ctx->storename)
+			OPENSSL_free(ctx->storename);
+		ctx->storename = BUF_strdup(p);
+		CAPI_trace(ctx, "Setting store name to %s\n", p);
+		break;
+
+		case CAPI_CMD_STORE_FLAGS:
+		if (i & 1)
+			{
+			ctx->store_flags |= CERT_SYSTEM_STORE_LOCAL_MACHINE;
+			ctx->store_flags &= ~CERT_SYSTEM_STORE_CURRENT_USER;
+			}
+		else
+			{
+			ctx->store_flags |= CERT_SYSTEM_STORE_CURRENT_USER;
+			ctx->store_flags &= ~CERT_SYSTEM_STORE_LOCAL_MACHINE;
+			}
+		CAPI_trace(ctx, "Setting flags to %d\n", i);
+		break;
+
+		case CAPI_CMD_DEBUG_LEVEL:
+		ctx->debug_level = (int)i;
+		CAPI_trace(ctx, "Setting debug level to %d\n", ctx->debug_level);
+		break;
+
+		case CAPI_CMD_DEBUG_FILE:
+		ctx->debug_file = BUF_strdup(p);
+		CAPI_trace(ctx, "Setting debug file to %s\n", ctx->debug_file);
+		break;
+
+		case CAPI_CMD_KEYTYPE:
+		ctx->keytype = i;
+		CAPI_trace(ctx, "Setting key type to %d\n", ctx->keytype);
+		break;
+
+		case CAPI_CMD_SET_CSP_IDX:
+		ret = capi_ctx_set_provname_idx(ctx, i);
+		break;
+
+		case CAPI_CMD_LIST_OPTIONS:
+		ctx->dump_flags = i;
+		break;
+
+		case CAPI_CMD_LOOKUP_METHOD:
+		if (i < 1 || i > 3)
+			{
+			CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_INVALID_LOOKUP_METHOD);
+			return 0;
+			}
+		ctx->lookup_method = i;
+		break;
+
+		case CAPI_CMD_SET_CSP_NAME:
+		ret = capi_ctx_set_provname(ctx, p, ctx->csptype, 1);
+		break;
+
+		case CAPI_CMD_SET_CSP_TYPE:
+		ctx->csptype = i;
+		break;
+
+		default:
+		CAPIerr(CAPI_F_CAPI_CTRL, CAPI_R_UNKNOWN_COMMAND);
+		ret = 0;
+	}
+
+	BIO_free(out);
+	return ret;
+
+	}
+
+static RSA_METHOD capi_rsa_method =
+	{
+	"CryptoAPI RSA method",
+	0,				/* pub_enc */
+	0,				/* pub_dec */
+	capi_rsa_priv_enc,		/* priv_enc */
+	capi_rsa_priv_dec,		/* priv_dec */
+	0,				/* rsa_mod_exp */
+	0,				/* bn_mod_exp */
+	0,				/* init	*/
+	capi_rsa_free,			/* finish */
+	RSA_FLAG_SIGN_VER, 		/* flags */
+	NULL,				/* app_data */
+	capi_rsa_sign,			/* rsa_sign */
+	0				/* rsa_verify */
+	};
+
+static DSA_METHOD capi_dsa_method =
+	{
+	"CryptoAPI DSA method",
+	capi_dsa_do_sign,		/* dsa_do_sign */
+	0,				/* dsa_sign_setup */
+	0,				/* dsa_do_verify */
+	0,				/* dsa_mod_exp */
+	0,				/* bn_mod_exp */
+	0,				/* init	*/
+	capi_dsa_free,			/* finish */
+	0, 				/* flags */
+	NULL,				/* app_data */
+	0,				/* dsa_paramgen */
+	0				/* dsa_keygen */
+	};
+
+static int capi_init(ENGINE *e)
+	{
+	CAPI_CTX *ctx;
+	const RSA_METHOD *ossl_rsa_meth;
+	const DSA_METHOD *ossl_dsa_meth;
+	capi_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL, 0);
+	cert_capi_idx = X509_get_ex_new_index(0, NULL, NULL, NULL, 0);
+
+	ctx = capi_ctx_new();
+	if (!ctx || (capi_idx < 0))
+		goto memerr;
+
+	ENGINE_set_ex_data(e, capi_idx, ctx);
+	/* Setup RSA_METHOD */
+	rsa_capi_idx = RSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
+	ossl_rsa_meth = RSA_PKCS1_SSLeay();
+	capi_rsa_method.rsa_pub_enc = ossl_rsa_meth->rsa_pub_enc;
+	capi_rsa_method.rsa_pub_dec = ossl_rsa_meth->rsa_pub_dec;
+	capi_rsa_method.rsa_mod_exp = ossl_rsa_meth->rsa_mod_exp;
+	capi_rsa_method.bn_mod_exp = ossl_rsa_meth->bn_mod_exp;
+
+	/* Setup DSA Method */
+	dsa_capi_idx = DSA_get_ex_new_index(0, NULL, NULL, NULL, 0);
+	ossl_dsa_meth = DSA_OpenSSL();
+	capi_dsa_method.dsa_do_verify = ossl_dsa_meth->dsa_do_verify;
+	capi_dsa_method.dsa_mod_exp = ossl_dsa_meth->dsa_mod_exp;
+	capi_dsa_method.bn_mod_exp = ossl_dsa_meth->bn_mod_exp;
+
+#ifdef OPENSSL_CAPIENG_DIALOG
+	{
+	HMODULE cryptui = LoadLibrary(TEXT("CRYPTUI.DLL"));
+	HMODULE kernel = GetModuleHandle(TEXT("KERNEL32.DLL"));
+	if (cryptui)
+		ctx->certselectdlg = (CERTDLG)GetProcAddress(cryptui, "CryptUIDlgSelectCertificateFromStore");
+	if (kernel)
+		ctx->getconswindow = (GETCONSWIN)GetProcAddress(kernel, "GetConsoleWindow");
+	if (cryptui && !OPENSSL_isservice())
+		ctx->client_cert_select = cert_select_dialog;
+	}
+#endif
+		
+
+	return 1;
+
+	memerr:
+	CAPIerr(CAPI_F_CAPI_INIT, ERR_R_MALLOC_FAILURE);
+	return 0;
+
+	return 1;
+	}
+
+static int capi_destroy(ENGINE *e)
+	{
+	ERR_unload_CAPI_strings();
+	return 1;
+	}
+
+static int capi_finish(ENGINE *e)
+	{
+	CAPI_CTX *ctx;
+	ctx = ENGINE_get_ex_data(e, capi_idx);
+	capi_ctx_free(ctx);
+	ENGINE_set_ex_data(e, capi_idx, NULL);
+	return 1;
+	}
+
+
+/* CryptoAPI key application data. This contains
+ * a handle to the private key container (for sign operations)
+ * and a handle to the key (for decrypt operations).
+ */
+
+struct CAPI_KEY_st
+	{
+	/* Associated certificate context (if any) */
+	PCCERT_CONTEXT pcert;
+	HCRYPTPROV hprov;
+	HCRYPTKEY key;
+	DWORD keyspec;
+	};
+
+static int bind_capi(ENGINE *e)
+	{
+	if (!ENGINE_set_id(e, engine_capi_id)
+		|| !ENGINE_set_name(e, engine_capi_name)
+		|| !ENGINE_set_init_function(e, capi_init)
+		|| !ENGINE_set_finish_function(e, capi_finish)
+		|| !ENGINE_set_destroy_function(e, capi_destroy)
+		|| !ENGINE_set_RSA(e, &capi_rsa_method)
+		|| !ENGINE_set_DSA(e, &capi_dsa_method)
+		|| !ENGINE_set_load_privkey_function(e, capi_load_privkey)
+		|| !ENGINE_set_load_ssl_client_cert_function(e,
+						capi_load_ssl_client_cert)
+		|| !ENGINE_set_cmd_defns(e, capi_cmd_defns)
+		|| !ENGINE_set_ctrl_function(e, capi_ctrl))
+			return 0;
+	ERR_load_CAPI_strings();
+
+	return 1;
+
+	}
+
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+static int bind_helper(ENGINE *e, const char *id)
+	{
+	if(id && (strcmp(id, engine_capi_id) != 0))
+		return 0;
+	if(!bind_capi(e))
+		return 0;
+	return 1;
+	}       
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_helper)
+#else
+static ENGINE *engine_capi(void)
+	{
+	ENGINE *ret = ENGINE_new();
+	if(!ret)
+		return NULL;
+	if(!bind_capi(ret))
+		{
+		ENGINE_free(ret);
+		return NULL;
+		}
+	return ret;
+	}
+
+void ENGINE_load_capi(void)
+	{
+	/* Copied from eng_[openssl|dyn].c */
+	ENGINE *toadd = engine_capi();
+	if(!toadd) return;
+	ENGINE_add(toadd);
+	ENGINE_free(toadd);
+	ERR_clear_error();
+	}
+#endif
+
+
+static int lend_tobn(BIGNUM *bn, unsigned char *bin, int binlen)
+	{
+	int i;
+	/* Reverse buffer in place: since this is a keyblob structure
+	 * that will be freed up after conversion anyway it doesn't 
+	 * matter if we change it.
+	 */
+	for(i = 0; i < binlen / 2; i++)
+		{
+		unsigned char c;
+		c = bin[i];
+		bin[i] = bin[binlen - i - 1];
+		bin[binlen - i - 1] = c;
+		}
+
+	if (!BN_bin2bn(bin, binlen, bn))
+		return 0;
+	return 1;
+	}
+
+/* Given a CAPI_KEY get an EVP_PKEY structure */
+
+static EVP_PKEY *capi_get_pkey(ENGINE *eng, CAPI_KEY *key)
+	{
+	unsigned char *pubkey = NULL;
+	DWORD len;
+	BLOBHEADER *bh;
+	RSA *rkey = NULL;
+	DSA *dkey = NULL;
+	EVP_PKEY *ret = NULL;
+	if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, NULL, &len))
+		{
+		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_LENGTH_ERROR);
+		capi_addlasterror();
+		return NULL;
+		}
+
+	pubkey = OPENSSL_malloc(len);
+
+	if (!pubkey)
+		goto memerr;
+
+	if (!CryptExportKey(key->key, 0, PUBLICKEYBLOB, 0, pubkey, &len))
+		{
+		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_PUBKEY_EXPORT_ERROR);
+		capi_addlasterror();
+		goto err;
+		}
+
+	bh = (BLOBHEADER *)pubkey;
+	if (bh->bType != PUBLICKEYBLOB)
+		{
+		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_PUBLIC_KEY_BLOB);
+		goto err;
+		}
+	if (bh->aiKeyAlg == CALG_RSA_SIGN || bh->aiKeyAlg == CALG_RSA_KEYX)
+		{
+		RSAPUBKEY *rp;
+		DWORD rsa_modlen;
+		unsigned char *rsa_modulus;
+		rp = (RSAPUBKEY *)(bh + 1);
+		if (rp->magic != 0x31415352)
+			{
+			char magstr[10];
+			BIO_snprintf(magstr, 10, "%lx", rp->magic);
+			CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_RSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
+			ERR_add_error_data(2, "magic=0x", magstr);
+			goto err;
+			}
+		rsa_modulus = (unsigned char *)(rp + 1);
+		rkey = RSA_new_method(eng);
+		if (!rkey)
+			goto memerr;
+
+		rkey->e = BN_new();
+		rkey->n = BN_new();
+
+		if (!rkey->e || !rkey->n)
+			goto memerr;
+
+		if (!BN_set_word(rkey->e, rp->pubexp))
+			goto memerr;
+
+		rsa_modlen = rp->bitlen / 8;
+		if (!lend_tobn(rkey->n, rsa_modulus, rsa_modlen))
+			goto memerr;
+
+		RSA_set_ex_data(rkey, rsa_capi_idx, key);
+
+		if (!(ret = EVP_PKEY_new()))
+			goto memerr;
+
+		EVP_PKEY_assign_RSA(ret, rkey);
+		rkey = NULL;
+
+		}
+	else if (bh->aiKeyAlg == CALG_DSS_SIGN)
+		{
+		DSSPUBKEY *dp;
+		DWORD dsa_plen;
+		unsigned char *btmp;
+		dp = (DSSPUBKEY *)(bh + 1);
+		if (dp->magic != 0x31535344)
+			{
+			char magstr[10];
+			BIO_snprintf(magstr, 10, "%lx", dp->magic);
+			CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_INVALID_DSA_PUBLIC_KEY_BLOB_MAGIC_NUMBER);
+			ERR_add_error_data(2, "magic=0x", magstr);
+			goto err;
+			}
+		dsa_plen = dp->bitlen / 8;
+		btmp = (unsigned char *)(dp + 1);
+		dkey = DSA_new_method(eng);
+		if (!dkey)
+			goto memerr;
+		dkey->p = BN_new();
+		dkey->q = BN_new();
+		dkey->g = BN_new();
+		dkey->pub_key = BN_new();
+		if (!dkey->p || !dkey->q || !dkey->g || !dkey->pub_key)
+			goto memerr;
+		if (!lend_tobn(dkey->p, btmp, dsa_plen))
+			goto memerr;
+		btmp += dsa_plen;
+		if (!lend_tobn(dkey->q, btmp, 20))
+			goto memerr;
+		btmp += 20;
+		if (!lend_tobn(dkey->g, btmp, dsa_plen))
+			goto memerr;
+		btmp += dsa_plen;
+		if (!lend_tobn(dkey->pub_key, btmp, dsa_plen))
+			goto memerr;
+		btmp += dsa_plen;
+
+		DSA_set_ex_data(dkey, dsa_capi_idx, key);
+
+		if (!(ret = EVP_PKEY_new()))
+			goto memerr;
+
+		EVP_PKEY_assign_DSA(ret, dkey);
+		dkey = NULL;
+		}
+	else
+		{
+		char algstr[10];
+		BIO_snprintf(algstr, 10, "%lx", bh->aiKeyAlg);
+		CAPIerr(CAPI_F_CAPI_GET_PKEY, CAPI_R_UNSUPPORTED_PUBLIC_KEY_ALGORITHM);
+		ERR_add_error_data(2, "aiKeyAlg=0x", algstr);
+		goto err;
+		}
+
+
+	err:
+	if (pubkey)
+		OPENSSL_free(pubkey);
+	if (!ret)
+		{
+		if (rkey)
+			RSA_free(rkey);
+		if (dkey)
+			DSA_free(dkey);
+		}
+
+	return ret;
+
+memerr:
+	CAPIerr(CAPI_F_CAPI_GET_PKEY, ERR_R_MALLOC_FAILURE);
+	goto err;
+
+	}
+
+static EVP_PKEY *capi_load_privkey(ENGINE *eng, const char *key_id,
+	UI_METHOD *ui_method, void *callback_data)
+	{
+	CAPI_CTX *ctx;
+	CAPI_KEY *key;
+	EVP_PKEY *ret;
+	ctx = ENGINE_get_ex_data(eng, capi_idx);
+
+	if (!ctx)
+		{
+		CAPIerr(CAPI_F_CAPI_LOAD_PRIVKEY, CAPI_R_CANT_FIND_CAPI_CONTEXT);
+		return NULL;
+		}
+
+	key = capi_find_key(ctx, key_id);
+
+	if (!key)
+		return NULL;
+
+	ret = capi_get_pkey(eng, key);
+
+	if (!ret)
+		capi_free_key(key);
+	return ret;
+
+	}
+
+/* CryptoAPI RSA operations */
+
+int capi_rsa_priv_enc(int flen, const unsigned char *from,
+                unsigned char *to, RSA *rsa, int padding)
+	{
+	CAPIerr(CAPI_F_CAPI_RSA_PRIV_ENC, CAPI_R_FUNCTION_NOT_SUPPORTED);
+	return -1;
+	}
+
+int capi_rsa_sign(int dtype, const unsigned char *m, unsigned int m_len,
+             unsigned char *sigret, unsigned int *siglen, const RSA *rsa)
+	{
+	ALG_ID alg;
+	HCRYPTHASH hash;
+	DWORD slen;
+	unsigned int i;
+	int ret = -1;
+	CAPI_KEY *capi_key;
+	CAPI_CTX *ctx;
+
+	ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
+
+	CAPI_trace(ctx, "Called CAPI_rsa_sign()\n");
+
+	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
+	if (!capi_key)
+		{
+		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_GET_KEY);
+		return -1;
+		}
+/* Convert the signature type to a CryptoAPI algorithm ID */
+	switch(dtype)
+		{
+	case NID_sha1:
+		alg = CALG_SHA1;
+		break;
+
+	case NID_md5:
+		alg = CALG_MD5;
+		break;
+
+	case NID_md5_sha1:
+		alg = CALG_SSL3_SHAMD5;
+		break;
+	default:
+		{
+		char algstr[10];
+		BIO_snprintf(algstr, 10, "%lx", dtype);
+		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_UNSUPPORTED_ALGORITHM_NID);
+		ERR_add_error_data(2, "NID=0x", algstr);
+		return -1;
+		}
+	}
+
+
+
+/* Create the hash object */
+	if(!CryptCreateHash(capi_key->hprov, alg, 0, 0, &hash))
+		{
+		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
+		capi_addlasterror();
+		return -1;
+		}
+/* Set the hash value to the value passed */
+
+	if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)m, 0))
+		{
+		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
+		capi_addlasterror();
+		goto err;
+		}
+
+
+/* Finally sign it */
+	slen = RSA_size(rsa);
+	if(!CryptSignHashA(hash, capi_key->keyspec, NULL, 0, sigret, &slen))
+		{
+		CAPIerr(CAPI_F_CAPI_RSA_SIGN, CAPI_R_ERROR_SIGNING_HASH);
+		capi_addlasterror();
+		goto err;
+		}
+	else
+		{
+		ret = 1;
+		/* Inplace byte reversal of signature */
+		for(i = 0; i < slen / 2; i++)
+			{
+			unsigned char c;
+			c = sigret[i];
+			sigret[i] = sigret[slen - i - 1];
+			sigret[slen - i - 1] = c;
+			}
+		*siglen = slen;
+		}
+
+	/* Now cleanup */
+
+err:
+	CryptDestroyHash(hash);
+
+	return ret;
+	}
+
+int capi_rsa_priv_dec(int flen, const unsigned char *from,
+                unsigned char *to, RSA *rsa, int padding)
+	{
+	int i;
+	unsigned char *tmpbuf;
+	CAPI_KEY *capi_key;
+	CAPI_CTX *ctx;
+	ctx = ENGINE_get_ex_data(rsa->engine, capi_idx);
+
+	CAPI_trace(ctx, "Called capi_rsa_priv_dec()\n");
+
+
+	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
+	if (!capi_key)
+		{
+		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_CANT_GET_KEY);
+		return -1;
+		}
+
+	if(padding != RSA_PKCS1_PADDING)
+		{
+		char errstr[10];
+		BIO_snprintf(errstr, 10, "%d", padding);
+		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_UNSUPPORTED_PADDING);
+		ERR_add_error_data(2, "padding=", errstr);
+		return -1;
+		}
+
+	/* Create temp reverse order version of input */
+	if(!(tmpbuf = OPENSSL_malloc(flen)) ) 
+		{
+		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, ERR_R_MALLOC_FAILURE);
+		return -1;
+		}
+	for(i = 0; i < flen; i++)
+		tmpbuf[flen - i - 1] = from[i];
+	
+	/* Finally decrypt it */
+	if(!CryptDecrypt(capi_key->key, 0, TRUE, 0, tmpbuf, &flen))
+		{
+		CAPIerr(CAPI_F_CAPI_RSA_PRIV_DEC, CAPI_R_DECRYPT_ERROR);
+		capi_addlasterror();
+		OPENSSL_free(tmpbuf);
+		return -1;
+		} 
+	else memcpy(to, tmpbuf, flen);
+
+	OPENSSL_free(tmpbuf);
+
+	return flen;
+	}
+
+static int capi_rsa_free(RSA *rsa)
+	{
+	CAPI_KEY *capi_key;
+	capi_key = RSA_get_ex_data(rsa, rsa_capi_idx);
+	capi_free_key(capi_key);
+	RSA_set_ex_data(rsa, rsa_capi_idx, 0);
+	return 1;
+	}
+
+/* CryptoAPI DSA operations */
+
+static DSA_SIG *capi_dsa_do_sign(const unsigned char *digest, int dlen,
+								DSA *dsa)
+	{
+	HCRYPTHASH hash;
+	DWORD slen;
+	DSA_SIG *ret = NULL;
+	CAPI_KEY *capi_key;
+	CAPI_CTX *ctx;
+	unsigned char csigbuf[40];
+
+	ctx = ENGINE_get_ex_data(dsa->engine, capi_idx);
+
+	CAPI_trace(ctx, "Called CAPI_dsa_do_sign()\n");
+
+	capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
+
+	if (!capi_key)
+		{
+		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_GET_KEY);
+		return NULL;
+		}
+
+	if (dlen != 20)
+		{
+		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_INVALID_DIGEST_LENGTH);
+		return NULL;
+		}
+
+	/* Create the hash object */
+	if(!CryptCreateHash(capi_key->hprov, CALG_SHA1, 0, 0, &hash))
+		{
+		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_CREATE_HASH_OBJECT);
+		capi_addlasterror();
+		return NULL;
+		}
+
+	/* Set the hash value to the value passed */
+	if(!CryptSetHashParam(hash, HP_HASHVAL, (unsigned char *)digest, 0))
+		{
+		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_CANT_SET_HASH_VALUE);
+		capi_addlasterror();
+		goto err;
+		}
+
+
+	/* Finally sign it */
+	slen = sizeof(csigbuf);
+	if(!CryptSignHashA(hash, capi_key->keyspec, NULL, 0, csigbuf, &slen))
+		{
+		CAPIerr(CAPI_F_CAPI_DSA_DO_SIGN, CAPI_R_ERROR_SIGNING_HASH);
+		capi_addlasterror();
+		goto err;
+		}
+	else
+		{
+		ret = DSA_SIG_new();
+		if (!ret)
+			goto err;
+		ret->r = BN_new();
+		ret->s = BN_new();
+		if (!ret->r || !ret->s)
+			goto err;
+		if (!lend_tobn(ret->r, csigbuf, 20)
+			|| !lend_tobn(ret->s, csigbuf + 20, 20))
+			{
+			DSA_SIG_free(ret);
+			ret = NULL;
+			goto err;
+			}
+		}
+
+	/* Now cleanup */
+
+err:
+	OPENSSL_cleanse(csigbuf, 40);
+	CryptDestroyHash(hash);
+	return ret;
+	}
+
+static int capi_dsa_free(DSA *dsa)
+	{
+	CAPI_KEY *capi_key;
+	capi_key = DSA_get_ex_data(dsa, dsa_capi_idx);
+	capi_free_key(capi_key);
+	DSA_set_ex_data(dsa, dsa_capi_idx, 0);
+	return 1;
+	}
+
+static void capi_vtrace(CAPI_CTX *ctx, int level, char *format, va_list argptr)
+	{
+	BIO *out;
+
+	if (!ctx || (ctx->debug_level < level) || (!ctx->debug_file))
+		return;
+	out = BIO_new_file(ctx->debug_file, "a+");
+	BIO_vprintf(out, format, argptr);
+	BIO_free(out);
+	}
+
+static void CAPI_trace(CAPI_CTX *ctx, char *format, ...)
+	{
+	va_list args;
+	va_start(args, format);
+	capi_vtrace(ctx, CAPI_DBG_TRACE, format, args);
+	va_end(args);
+	}
+
+static void capi_addlasterror(void)
+	{
+	capi_adderror(GetLastError());
+	}
+
+static void capi_adderror(DWORD err)
+	{
+	char errstr[10];
+	BIO_snprintf(errstr, 10, "%lX", err);
+	ERR_add_error_data(2, "Error code= 0x", errstr);
+	}
+
+static char *wide_to_asc(LPWSTR wstr)
+	{
+	char *str;
+	int len_0,sz;
+
+	if (!wstr)
+		return NULL;
+	len_0 = (int)wcslen(wstr)+1;	/* WideCharToMultiByte expects int */
+        sz = WideCharToMultiByte(CP_ACP,0,wstr,len_0,NULL,0,NULL,NULL);
+	if (!sz)
+		{
+		CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);
+		return NULL;
+		}
+	str = OPENSSL_malloc(sz);
+	if (!str)
+		{
+		CAPIerr(CAPI_F_WIDE_TO_ASC, ERR_R_MALLOC_FAILURE);
+		return NULL;
+		}
+	if (!WideCharToMultiByte(CP_ACP,0,wstr,len_0,str,sz,NULL,NULL))
+		{
+		OPENSSL_free(str);
+		CAPIerr(CAPI_F_WIDE_TO_ASC, CAPI_R_WIN32_ERROR);
+		return NULL;
+		}
+	return str;
+	}
+
+static int capi_get_provname(CAPI_CTX *ctx, LPSTR *pname, DWORD *ptype, DWORD idx)
+	{
+	LPSTR name;
+	DWORD len, err;
+	CAPI_trace(ctx, "capi_get_provname, index=%d\n", idx);
+	if (!CryptEnumProvidersA(idx, NULL, 0, ptype, NULL, &len))
+		{
+		err = GetLastError();
+		if (err == ERROR_NO_MORE_ITEMS)
+			return 2;
+		CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
+		capi_adderror(err);
+		return 0;
+		}
+	name = OPENSSL_malloc(len);
+	if (!CryptEnumProvidersA(idx, NULL, 0, ptype, name, &len))
+		{
+		err = GetLastError();
+		if (err == ERROR_NO_MORE_ITEMS)
+			return 2;
+		CAPIerr(CAPI_F_CAPI_GET_PROVNAME, CAPI_R_CRYPTENUMPROVIDERS_ERROR);
+		capi_adderror(err);
+		return 0;
+		}
+	*pname = name;
+	CAPI_trace(ctx, "capi_get_provname, returned name=%s, type=%d\n", name, *ptype);
+
+	return 1;
+	}
+
+static int capi_list_providers(CAPI_CTX *ctx, BIO *out)
+	{
+	DWORD idx, ptype;
+	int ret;
+	LPSTR provname = NULL;
+	CAPI_trace(ctx, "capi_list_providers\n");
+	BIO_printf(out, "Available CSPs:\n");
+	for(idx = 0; ; idx++)
+		{
+		ret = capi_get_provname(ctx, &provname, &ptype, idx);
+		if (ret == 2)
+			break;
+		if (ret == 0)
+			break;
+		BIO_printf(out, "%d. %s, type %d\n", idx, provname, ptype);
+		OPENSSL_free(provname);
+		}
+	return 1;
+	}
+
+static int capi_list_containers(CAPI_CTX *ctx, BIO *out)
+	{
+	int ret = 1;
+	HCRYPTPROV hprov;
+	DWORD err, idx, flags, buflen = 0, clen;
+	LPSTR cname;
+	CAPI_trace(ctx, "Listing containers CSP=%s, type = %d\n", ctx->cspname, ctx->csptype);
+	if (!CryptAcquireContextA(&hprov, NULL, ctx->cspname, ctx->csptype, CRYPT_VERIFYCONTEXT))
+		{
+		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
+		capi_addlasterror();
+		return 0;
+		}
+	if (!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, NULL, &buflen, CRYPT_FIRST))
+		{
+		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
+		capi_addlasterror();
+		return 0;
+		}
+	CAPI_trace(ctx, "Got max container len %d\n", buflen);
+	if (buflen == 0)
+		buflen = 1024;
+	cname = OPENSSL_malloc(buflen);
+	if (!cname)
+		{
+		CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, ERR_R_MALLOC_FAILURE);
+		goto err;
+		}
+
+	for (idx = 0;;idx++)
+		{
+		clen = buflen;
+		cname[0] = 0;
+
+		if (idx == 0)
+			flags = CRYPT_FIRST;
+		else
+			flags = 0;
+		if(!CryptGetProvParam(hprov, PP_ENUMCONTAINERS, cname, &clen, flags))
+			{
+			err = GetLastError();
+			if (err == ERROR_NO_MORE_ITEMS)
+				goto done;
+			CAPIerr(CAPI_F_CAPI_LIST_CONTAINERS, CAPI_R_ENUMCONTAINERS_ERROR);
+			capi_adderror(err);
+			goto err;
+			}
+		CAPI_trace(ctx, "Container name %s, len=%d, index=%d, flags=%d\n", cname, clen, idx, flags);
+		if (!cname[0] && (clen == buflen))
+			{
+			CAPI_trace(ctx, "Enumerate bug: using workaround\n");
+			goto done;
+			}
+		BIO_printf(out, "%d. %s\n", idx, cname);
+		}
+	err:
+
+	ret = 0;
+
+	done:
+	if (cname)
+		OPENSSL_free(cname);
+	CryptReleaseContext(hprov, 0);
+
+	return ret;
+	}
+
+CRYPT_KEY_PROV_INFO *capi_get_prov_info(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
+	{
+	DWORD len;
+	CRYPT_KEY_PROV_INFO *pinfo;
+	
+	if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, NULL, &len))
+		return NULL;
+	pinfo = OPENSSL_malloc(len);
+	if (!pinfo)
+		{
+		CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, ERR_R_MALLOC_FAILURE);
+		return NULL;
+		}
+	if(!CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, pinfo, &len))
+		{
+		CAPIerr(CAPI_F_CAPI_GET_PROV_INFO, CAPI_R_ERROR_GETTING_KEY_PROVIDER_INFO);
+		capi_addlasterror();
+		OPENSSL_free(pinfo);
+		return NULL;
+		}
+	return pinfo;
+	}
+
+static void capi_dump_prov_info(CAPI_CTX *ctx, BIO *out, CRYPT_KEY_PROV_INFO *pinfo)
+	{
+	char *provname = NULL, *contname = NULL;
+	if (!pinfo)
+		{
+		BIO_printf(out, "  No Private Key\n");
+		return;
+		}
+	provname = wide_to_asc(pinfo->pwszProvName);
+	contname = wide_to_asc(pinfo->pwszContainerName);
+	if (!provname || !contname)
+		goto err;
+
+	BIO_printf(out, "  Private Key Info:\n");
+	BIO_printf(out, "    Provider Name:  %s, Provider Type %d\n", provname, pinfo->dwProvType);
+	BIO_printf(out, "    Container Name: %s, Key Type %d\n", contname, pinfo->dwKeySpec);
+	err:
+	if (provname)
+		OPENSSL_free(provname);
+	if (contname)
+		OPENSSL_free(contname);
+	}
+
+char * capi_cert_get_fname(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
+	{
+	LPWSTR wfname;
+	DWORD dlen;
+
+	CAPI_trace(ctx, "capi_cert_get_fname\n");
+	if (!CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, NULL, &dlen))
+		return NULL;
+	wfname = OPENSSL_malloc(dlen);
+	if (CertGetCertificateContextProperty(cert, CERT_FRIENDLY_NAME_PROP_ID, wfname, &dlen))
+		{
+		char *fname = wide_to_asc(wfname);
+		OPENSSL_free(wfname);
+		return fname;
+		}
+	CAPIerr(CAPI_F_CAPI_CERT_GET_FNAME, CAPI_R_ERROR_GETTING_FRIENDLY_NAME);
+	capi_addlasterror();
+
+	OPENSSL_free(wfname);
+	return NULL;
+	}
+
+
+void capi_dump_cert(CAPI_CTX *ctx, BIO *out, PCCERT_CONTEXT cert)
+	{
+	X509 *x;
+	unsigned char *p;
+	unsigned long flags = ctx->dump_flags;
+	if (flags & CAPI_DMP_FNAME)
+		{
+		char *fname;
+		fname = capi_cert_get_fname(ctx, cert);
+		if (fname)
+			{
+			BIO_printf(out, "  Friendly Name \"%s\"\n", fname);
+			OPENSSL_free(fname);
+			}
+		else
+			BIO_printf(out, "  <No Friendly Name>\n");
+		}
+
+	p = cert->pbCertEncoded;
+	x = d2i_X509(NULL, &p, cert->cbCertEncoded);
+	if (!x)
+		BIO_printf(out, "  <Can't parse certificate>\n");
+	if (flags & CAPI_DMP_SUMMARY)
+		{
+		BIO_printf(out, "  Subject: ");
+		X509_NAME_print_ex(out, X509_get_subject_name(x), 0, XN_FLAG_ONELINE);
+		BIO_printf(out, "\n  Issuer: ");
+		X509_NAME_print_ex(out, X509_get_issuer_name(x), 0, XN_FLAG_ONELINE);
+		BIO_printf(out, "\n");
+		}
+	if (flags & CAPI_DMP_FULL)
+		X509_print_ex(out, x, XN_FLAG_ONELINE,0);
+
+	if (flags & CAPI_DMP_PKEYINFO)
+		{
+		CRYPT_KEY_PROV_INFO *pinfo;
+		pinfo = capi_get_prov_info(ctx, cert);
+		capi_dump_prov_info(ctx, out, pinfo);
+		if (pinfo)
+			OPENSSL_free(pinfo);
+		}
+
+	if (flags & CAPI_DMP_PEM)
+		PEM_write_bio_X509(out, x);
+	X509_free(x);
+	}
+
+HCERTSTORE capi_open_store(CAPI_CTX *ctx, char *storename)
+	{
+	HCERTSTORE hstore;
+
+	if (!storename)
+		storename = ctx->storename;
+	if (!storename)
+		storename = "MY";
+	CAPI_trace(ctx, "Opening certificate store %s\n", storename);
+
+	hstore = CertOpenStore(CERT_STORE_PROV_SYSTEM_A, 0, 0, 
+				ctx->store_flags, storename);
+	if (!hstore)
+		{
+		CAPIerr(CAPI_F_CAPI_OPEN_STORE, CAPI_R_ERROR_OPENING_STORE);
+		capi_addlasterror();
+		}
+	return hstore;
+	}
+
+int capi_list_certs(CAPI_CTX *ctx, BIO *out, char *id)
+	{
+	char *storename;
+	int idx;
+	int ret = 1;
+	HCERTSTORE hstore;
+	PCCERT_CONTEXT cert = NULL;
+
+	storename = ctx->storename;
+	if (!storename)
+		storename = "MY";
+	CAPI_trace(ctx, "Listing certs for store %s\n", storename);
+
+	hstore = capi_open_store(ctx, storename);
+	if (!hstore)
+		return 0;
+	if (id)
+		{
+		cert = capi_find_cert(ctx, id, hstore);
+		if (!cert)
+			{
+			ret = 0;
+			goto err;
+			}
+		capi_dump_cert(ctx, out, cert);
+		CertFreeCertificateContext(cert);
+		}
+	else
+		{
+		for(idx = 0;;idx++)
+			{
+			LPWSTR fname = NULL;
+			cert = CertEnumCertificatesInStore(hstore, cert);
+			if (!cert)
+				break;
+			BIO_printf(out, "Certificate %d\n", idx);
+			capi_dump_cert(ctx, out, cert);
+			}
+		}
+	err:
+	CertCloseStore(hstore, 0);
+	return ret;
+	}
+
+static PCCERT_CONTEXT capi_find_cert(CAPI_CTX *ctx, const char *id, HCERTSTORE hstore)
+	{
+	PCCERT_CONTEXT cert = NULL;
+	char *fname = NULL;
+	int match;
+	switch(ctx->lookup_method)
+		{
+		case CAPI_LU_SUBSTR:
+			return CertFindCertificateInStore(hstore,
+					X509_ASN_ENCODING, 0,
+					CERT_FIND_SUBJECT_STR_A, id, NULL);
+		case CAPI_LU_FNAME:
+			for(;;)
+				{
+				cert = CertEnumCertificatesInStore(hstore, cert);
+				if (!cert)
+					return NULL;
+				fname = capi_cert_get_fname(ctx, cert);
+				if (fname)
+					{
+					if (strcmp(fname, id))
+						match = 0;
+					else
+						match = 1;
+					OPENSSL_free(fname);
+					if (match)
+						return cert;
+					}
+				}
+		default:
+			return NULL;
+		}
+	}
+
+static CAPI_KEY *capi_get_key(CAPI_CTX *ctx, const char *contname, char *provname, DWORD ptype, DWORD keyspec)
+	{
+	CAPI_KEY *key;
+	key = OPENSSL_malloc(sizeof(CAPI_KEY));
+	CAPI_trace(ctx, "capi_get_key, contname=%s, provname=%s, type=%d\n", 
+						contname, provname, ptype);
+	if (!CryptAcquireContextA(&key->hprov, contname, provname, ptype, 0))
+		{
+		CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
+		capi_addlasterror();
+		goto err;
+		}
+	if (!CryptGetUserKey(key->hprov, keyspec, &key->key))
+		{
+		CAPIerr(CAPI_F_CAPI_GET_KEY, CAPI_R_GETUSERKEY_ERROR);
+		capi_addlasterror();
+		CryptReleaseContext(key->hprov, 0);
+		goto err;
+		}
+	key->keyspec = keyspec;
+	key->pcert = NULL;
+	return key;
+
+	err:
+	OPENSSL_free(key);
+	return NULL;
+	}
+
+static CAPI_KEY *capi_get_cert_key(CAPI_CTX *ctx, PCCERT_CONTEXT cert)
+	{
+	CAPI_KEY *key = NULL;
+	CRYPT_KEY_PROV_INFO *pinfo = NULL;
+	char *provname = NULL, *contname = NULL;
+	pinfo = capi_get_prov_info(ctx, cert);
+	if (!pinfo)
+		goto err;
+	provname = wide_to_asc(pinfo->pwszProvName);
+	contname = wide_to_asc(pinfo->pwszContainerName);
+	if (!provname || !contname)
+		goto err;
+	key = capi_get_key(ctx, contname, provname,
+				pinfo->dwProvType, pinfo->dwKeySpec);
+
+	err:
+	if (pinfo)
+		OPENSSL_free(pinfo);
+	if (provname)
+		OPENSSL_free(provname);
+	if (contname)
+		OPENSSL_free(contname);
+	return key;
+	}
+
+CAPI_KEY *capi_find_key(CAPI_CTX *ctx, const char *id)
+	{
+	PCCERT_CONTEXT cert;
+	HCERTSTORE hstore;
+	CAPI_KEY *key = NULL;
+	switch (ctx->lookup_method)
+		{
+		case CAPI_LU_SUBSTR:
+		case CAPI_LU_FNAME:
+		hstore = capi_open_store(ctx, NULL);
+		if (!hstore)
+			return NULL;
+		cert = capi_find_cert(ctx, id, hstore);
+		if (cert)
+			{
+			key = capi_get_cert_key(ctx, cert);
+			CertFreeCertificateContext(cert);
+			}
+		CertCloseStore(hstore, 0);
+		break;
+
+		case CAPI_LU_CONTNAME:
+		key = capi_get_key(ctx, id, ctx->cspname, ctx->csptype,
+							ctx->keytype);
+		break;
+		}
+
+	return key;
+	}
+
+void capi_free_key(CAPI_KEY *key)
+	{
+	if (!key)
+		return;
+	CryptDestroyKey(key->key);
+	CryptReleaseContext(key->hprov, 0);
+	if (key->pcert)
+		CertFreeCertificateContext(key->pcert);
+	OPENSSL_free(key);
+	}
+
+
+/* Initialize a CAPI_CTX structure */
+
+static CAPI_CTX *capi_ctx_new()
+	{
+	CAPI_CTX *ctx;
+	ctx = OPENSSL_malloc(sizeof(CAPI_CTX));
+	if (!ctx)
+		{
+		CAPIerr(CAPI_F_CAPI_CTX_NEW, ERR_R_MALLOC_FAILURE);
+		return NULL;
+		}
+	ctx->cspname = NULL;
+	ctx->csptype = PROV_RSA_FULL;
+	ctx->dump_flags = CAPI_DMP_SUMMARY|CAPI_DMP_FNAME;
+	ctx->keytype = AT_KEYEXCHANGE;
+	ctx->storename = NULL;
+	ctx->ssl_client_store = NULL;
+	ctx->store_flags = CERT_STORE_OPEN_EXISTING_FLAG |
+				CERT_STORE_READONLY_FLAG |
+				CERT_SYSTEM_STORE_CURRENT_USER;
+	ctx->lookup_method = CAPI_LU_SUBSTR;
+	ctx->debug_level = 0;
+	ctx->debug_file = NULL;
+	ctx->client_cert_select = cert_select_simple;
+	return ctx;
+	}
+
+static void capi_ctx_free(CAPI_CTX *ctx)
+	{
+	CAPI_trace(ctx, "Calling capi_ctx_free with %lx\n", ctx);
+	if (!ctx)
+		return;
+	if (ctx->cspname)
+		OPENSSL_free(ctx->cspname);
+	if (ctx->debug_file)
+		OPENSSL_free(ctx->debug_file);
+	if (ctx->storename)
+		OPENSSL_free(ctx->storename);
+	if (ctx->ssl_client_store)
+		OPENSSL_free(ctx->ssl_client_store);
+	OPENSSL_free(ctx);
+	}
+
+static int capi_ctx_set_provname(CAPI_CTX *ctx, LPSTR pname, DWORD type, int check)
+	{
+	CAPI_trace(ctx, "capi_ctx_set_provname, name=%s, type=%d\n", pname, type);
+	if (check)
+		{
+		HCRYPTPROV hprov;
+		if (!CryptAcquireContextA(&hprov, NULL, pname, type,
+						CRYPT_VERIFYCONTEXT))
+			{
+			CAPIerr(CAPI_F_CAPI_CTX_SET_PROVNAME, CAPI_R_CRYPTACQUIRECONTEXT_ERROR);
+			capi_addlasterror();
+			return 0;
+			}
+		CryptReleaseContext(hprov, 0);
+		}
+	ctx->cspname = BUF_strdup(pname);
+	ctx->csptype = type;
+	return 1;
+	}
+
+static int capi_ctx_set_provname_idx(CAPI_CTX *ctx, int idx)
+	{
+	LPSTR pname;
+	DWORD type;
+	if (capi_get_provname(ctx, &pname, &type, idx) != 1)
+		return 0;
+	return capi_ctx_set_provname(ctx, pname, type, 0);
+	}
+
+static int cert_issuer_match(STACK_OF(X509_NAME) *ca_dn, X509 *x)
+	{
+	int i;
+	X509_NAME *nm;
+	/* Special case: empty list: match anything */
+	if (sk_X509_NAME_num(ca_dn) <= 0)
+		return 1;
+	for (i = 0; i < sk_X509_NAME_num(ca_dn); i++)
+		{
+		nm = sk_X509_NAME_value(ca_dn, i);
+		if (!X509_NAME_cmp(nm, X509_get_issuer_name(x)))
+				return 1;
+		}
+	return 0;
+	}
+
+
+
+static int capi_load_ssl_client_cert(ENGINE *e, SSL *ssl,
+	STACK_OF(X509_NAME) *ca_dn, X509 **pcert, EVP_PKEY **pkey,
+	STACK_OF(X509) **pother, UI_METHOD *ui_method, void *callback_data)
+	{
+	STACK_OF(X509) *certs = NULL;
+	X509 *x;
+	char *storename;
+	const char *p;
+	int i, client_cert_idx;
+	HCERTSTORE hstore;
+	PCCERT_CONTEXT cert = NULL, excert = NULL;
+	CAPI_CTX *ctx;
+	CAPI_KEY *key;
+	ctx = ENGINE_get_ex_data(e, capi_idx);
+
+	*pcert = NULL;
+	*pkey = NULL;
+
+	storename = ctx->ssl_client_store;
+	if (!storename)
+		storename = "MY";
+
+	hstore = capi_open_store(ctx, storename);
+	if (!hstore)
+		return 0;
+	/* Enumerate all certificates collect any matches */
+	for(i = 0;;i++)
+		{
+		cert = CertEnumCertificatesInStore(hstore, cert);
+		if (!cert)
+			break;
+		p = cert->pbCertEncoded;
+		x = d2i_X509(NULL, &p, cert->cbCertEncoded);
+		if (!x)
+			{
+			CAPI_trace(ctx, "Can't Parse Certificate %d\n", i);
+			continue;
+			}
+		if (cert_issuer_match(ca_dn, x)
+			&& X509_check_purpose(x, X509_PURPOSE_SSL_CLIENT, 0))
+			{
+			key = capi_get_cert_key(ctx, cert);
+			if (!key)
+				{
+				X509_free(x);
+				continue;
+				}
+			/* Match found: attach extra data to it so
+			 * we can retrieve the key later.
+			 */
+			excert = CertDuplicateCertificateContext(cert);
+			key->pcert = excert;
+			X509_set_ex_data(x, cert_capi_idx, key);
+
+			if (!certs)
+				certs = sk_X509_new_null();
+
+			sk_X509_push(certs, x);
+			}
+		else
+			X509_free(x);
+
+		}
+
+	if (cert)
+		CertFreeCertificateContext(cert);
+	if (hstore)
+		CertCloseStore(hstore, 0);
+
+	if (!certs)
+		return 0;
+
+
+	/* Select the appropriate certificate */
+
+	client_cert_idx = ctx->client_cert_select(e, ssl, certs);
+
+	/* Set the selected certificate and free the rest */
+
+	for(i = 0; i < sk_X509_num(certs); i++)
+		{
+		x = sk_X509_value(certs, i);
+		if (i == client_cert_idx)
+			*pcert = x;
+		else
+			{
+			key = X509_get_ex_data(x, cert_capi_idx);
+			capi_free_key(key);
+			X509_free(x);
+			}
+		}
+
+	sk_X509_free(certs);
+
+	if (!*pcert)
+		return 0;
+
+	/* Setup key for selected certificate */
+
+	key = X509_get_ex_data(*pcert, cert_capi_idx);
+	*pkey = capi_get_pkey(e, key);
+	X509_set_ex_data(*pcert, cert_capi_idx, NULL);
+
+	return 1;
+
+	}
+
+
+/* Simple client cert selection function: always select first */
+
+static int cert_select_simple(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)
+	{
+	return 0;
+	}
+
+#ifdef OPENSSL_CAPIENG_DIALOG
+
+/* More complex cert selection function, using standard function
+ * CryptUIDlgSelectCertificateFromStore() to produce a dialog box.
+ */
+
+/* Definitions which are in cryptuiapi.h but this is not present in older
+ * versions of headers.
+ */
+
+#ifndef CRYPTUI_SELECT_LOCATION_COLUMN
+#define CRYPTUI_SELECT_LOCATION_COLUMN                   0x000000010
+#define CRYPTUI_SELECT_INTENDEDUSE_COLUMN                0x000000004
+#endif
+
+#define dlg_title L"OpenSSL Application SSL Client Certificate Selection"
+#define dlg_prompt L"Select a certificate to use for authentication"
+#define dlg_columns	 CRYPTUI_SELECT_LOCATION_COLUMN \
+			|CRYPTUI_SELECT_INTENDEDUSE_COLUMN
+
+static int cert_select_dialog(ENGINE *e, SSL *ssl, STACK_OF(X509) *certs)
+	{
+	X509 *x;
+	HCERTSTORE dstore;
+	PCCERT_CONTEXT cert;
+	CAPI_CTX *ctx;
+	CAPI_KEY *key;
+	HWND hwnd;
+	int i, idx = -1;
+	if (sk_X509_num(certs) == 1)
+		return 0;
+	ctx = ENGINE_get_ex_data(e, capi_idx);
+	/* Create an in memory store of certificates */
+	dstore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0,
+					CERT_STORE_CREATE_NEW_FLAG, NULL);
+	if (!dstore)
+		{
+		CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_CREATING_STORE);
+		capi_addlasterror();
+		goto err;
+		}
+	/* Add all certificates to store */
+	for(i = 0; i < sk_X509_num(certs); i++)
+		{
+		x = sk_X509_value(certs, i);
+		key = X509_get_ex_data(x, cert_capi_idx);
+
+		if (!CertAddCertificateContextToStore(dstore, key->pcert,
+						CERT_STORE_ADD_NEW, NULL))
+			{
+			CAPIerr(CAPI_F_CERT_SELECT_DIALOG, CAPI_R_ERROR_ADDING_CERT);
+			capi_addlasterror();
+			goto err;
+			}
+
+		}
+	hwnd = GetForegroundWindow();
+	if (!hwnd)
+		hwnd = GetActiveWindow();
+	if (!hwnd && ctx->getconswindow)
+		hwnd = ctx->getconswindow();
+	/* Call dialog to select one */
+	cert = ctx->certselectdlg(dstore, hwnd, dlg_title, dlg_prompt,
+						dlg_columns, 0, NULL);
+
+	/* Find matching cert from list */
+	if (cert)
+		{
+		for(i = 0; i < sk_X509_num(certs); i++)
+			{
+			x = sk_X509_value(certs, i);
+			key = X509_get_ex_data(x, cert_capi_idx);
+			if (CertCompareCertificate(
+				X509_ASN_ENCODING | PKCS_7_ASN_ENCODING,
+					cert->pCertInfo,
+					key->pcert->pCertInfo))
+				{
+				idx = i;
+				break;
+				}
+			}
+		}
+
+	err:
+	if (dstore)
+		CertCloseStore(dstore, 0);
+	return idx;
+
+	}
+#endif
+
+#else /* !__COMPILE_CAPIENG */
+#include <openssl/engine.h>
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+OPENSSL_EXPORT
+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);
+OPENSSL_EXPORT
+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }
+IMPLEMENT_DYNAMIC_CHECK_FN()
+#else
+void ENGINE_load_capi(void){}
+#endif
+#endif
diff --git a/openssl/engines/e_gmp.c b/openssl/engines/e_gmp.c
index 63d68b0c2..a3d47151e 100644
--- a/openssl/engines/e_gmp.c
+++ b/openssl/engines/e_gmp.c
@@ -1,480 +1,480 @@
-/* crypto/engine/e_gmp.c */

-/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL

- * project 2003.

- */

-/* ====================================================================

- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.

- *

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- *

- * 1. Redistributions of source code must retain the above copyright

- *    notice, this list of conditions and the following disclaimer. 

- *

- * 2. Redistributions in binary form must reproduce the above copyright

- *    notice, this list of conditions and the following disclaimer in

- *    the documentation and/or other materials provided with the

- *    distribution.

- *

- * 3. All advertising materials mentioning features or use of this

- *    software must display the following acknowledgment:

- *    "This product includes software developed by the OpenSSL Project

- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

- *

- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

- *    endorse or promote products derived from this software without

- *    prior written permission. For written permission, please contact

- *    licensing@OpenSSL.org.

- *

- * 5. Products derived from this software may not be called "OpenSSL"

- *    nor may "OpenSSL" appear in their names without prior written

- *    permission of the OpenSSL Project.

- *

- * 6. Redistributions of any form whatsoever must retain the following

- *    acknowledgment:

- *    "This product includes software developed by the OpenSSL Project

- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

- *

- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

- * OF THE POSSIBILITY OF SUCH DAMAGE.

- * ====================================================================

- *

- * This product includes cryptographic software written by Eric Young

- * (eay@cryptsoft.com).  This product includes software written by Tim

- * Hudson (tjh@cryptsoft.com).

- *

- */

-

-/* This engine is not (currently) compiled in by default. Do enable it,

- * reconfigure OpenSSL with "enable-gmp -lgmp". The GMP libraries and

- * headers must reside in one of the paths searched by the compiler/linker,

- * otherwise paths must be specified - eg. try configuring with

- * "enable-gmp -I<includepath> -L<libpath> -lgmp". YMMV. */

-

-/* As for what this does - it's a largely unoptimised implementation of an

- * ENGINE that uses the GMP library to perform RSA private key operations. To

- * obtain more information about what "unoptimised" means, see my original mail

- * on the subject (though ignore the build instructions which have since

- * changed);

- *

- *    http://www.mail-archive.com/openssl-dev@openssl.org/msg12227.html

- *

- * On my athlon system at least, it appears the builtin OpenSSL code is now

- * slightly faster, which is to say that the RSA-related MPI performance

- * between OpenSSL's BIGNUM and GMP's mpz implementations is probably pretty

- * balanced for this chip, and so the performance degradation in this ENGINE by

- * having to convert to/from GMP formats (and not being able to cache

- * montgomery forms) is probably the difference. However, if some unconfirmed

- * reports from users is anything to go by, the situation on some other

- * chipsets might be a good deal more favourable to the GMP version (eg. PPC).

- * Feedback welcome. */

-

-#include <stdio.h>

-#include <string.h>

-#include <openssl/crypto.h>

-#include <openssl/buffer.h>

-#include <openssl/engine.h>

-#ifndef OPENSSL_NO_RSA

-#include <openssl/rsa.h>

-#endif

-#include <openssl/bn.h>

-

-#ifndef OPENSSL_NO_HW

-#ifndef OPENSSL_NO_GMP

-

-#include <gmp.h>

-

-#define E_GMP_LIB_NAME "gmp engine"

-#include "e_gmp_err.c"

-

-static int e_gmp_destroy(ENGINE *e);

-static int e_gmp_init(ENGINE *e);

-static int e_gmp_finish(ENGINE *e);

-static int e_gmp_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void)); 

-

-#ifndef OPENSSL_NO_RSA

-/* RSA stuff */

-static int e_gmp_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);

-static int e_gmp_rsa_finish(RSA *r);

-#endif

-

-/* The definitions for control commands specific to this engine */

-/* #define E_GMP_CMD_SO_PATH		ENGINE_CMD_BASE */

-static const ENGINE_CMD_DEFN e_gmp_cmd_defns[] = {

-#if 0

-	{E_GMP_CMD_SO_PATH,

-		"SO_PATH",

-		"Specifies the path to the 'e_gmp' shared library",

-		ENGINE_CMD_FLAG_STRING},

-#endif

-	{0, NULL, NULL, 0}

-	};

-

-#ifndef OPENSSL_NO_RSA

-/* Our internal RSA_METHOD that we provide pointers to */

-static RSA_METHOD e_gmp_rsa =

-	{

-	"GMP RSA method",

-	NULL,

-	NULL,

-	NULL,

-	NULL,

-	e_gmp_rsa_mod_exp,

-	NULL,

-	NULL,

-	e_gmp_rsa_finish,

-	/* These flags initialise montgomery crud that GMP ignores, however it

-	 * makes sure the public key ops (which are done in openssl) don't seem

-	 * *slower* than usual :-) */

-	RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE,

-	NULL,

-	NULL,

-	NULL

-	};

-#endif

-

-/* Constants used when creating the ENGINE */

-static const char *engine_e_gmp_id = "gmp";

-static const char *engine_e_gmp_name = "GMP engine support";

-

-/* This internal function is used by ENGINE_gmp() and possibly by the

- * "dynamic" ENGINE support too */

-static int bind_helper(ENGINE *e)

-	{

-#ifndef OPENSSL_NO_RSA

-	const RSA_METHOD *meth1;

-#endif

-	if(!ENGINE_set_id(e, engine_e_gmp_id) ||

-			!ENGINE_set_name(e, engine_e_gmp_name) ||

-#ifndef OPENSSL_NO_RSA

-			!ENGINE_set_RSA(e, &e_gmp_rsa) ||

-#endif

-			!ENGINE_set_destroy_function(e, e_gmp_destroy) ||

-			!ENGINE_set_init_function(e, e_gmp_init) ||

-			!ENGINE_set_finish_function(e, e_gmp_finish) ||

-			!ENGINE_set_ctrl_function(e, e_gmp_ctrl) ||

-			!ENGINE_set_cmd_defns(e, e_gmp_cmd_defns))

-		return 0;

-

-#ifndef OPENSSL_NO_RSA

-	meth1 = RSA_PKCS1_SSLeay();

-	e_gmp_rsa.rsa_pub_enc = meth1->rsa_pub_enc;

-	e_gmp_rsa.rsa_pub_dec = meth1->rsa_pub_dec;

-	e_gmp_rsa.rsa_priv_enc = meth1->rsa_priv_enc;

-	e_gmp_rsa.rsa_priv_dec = meth1->rsa_priv_dec;

-	e_gmp_rsa.bn_mod_exp = meth1->bn_mod_exp;

-#endif

-

-	/* Ensure the e_gmp error handling is set up */

-	ERR_load_GMP_strings();

-	return 1;

-	}

-

-static ENGINE *engine_gmp(void)

-	{

-	ENGINE *ret = ENGINE_new();

-	if(!ret)

-		return NULL;

-	if(!bind_helper(ret))

-		{

-		ENGINE_free(ret);

-		return NULL;

-		}

-	return ret;

-	}

-

-void ENGINE_load_gmp(void)

-	{

-	/* Copied from eng_[openssl|dyn].c */

-	ENGINE *toadd = engine_gmp();

-	if(!toadd) return;

-	ENGINE_add(toadd);

-	ENGINE_free(toadd);

-	ERR_clear_error();

-	}

-

-#ifndef OPENSSL_NO_RSA

-/* Used to attach our own key-data to an RSA structure */

-static int hndidx_rsa = -1;

-#endif

-

-static int e_gmp_destroy(ENGINE *e)

-	{

-	ERR_unload_GMP_strings();

-	return 1;

-	}

-

-/* (de)initialisation functions. */

-static int e_gmp_init(ENGINE *e)

-	{

-#ifndef OPENSSL_NO_RSA

-	if (hndidx_rsa == -1)

-		hndidx_rsa = RSA_get_ex_new_index(0,

-			"GMP-based RSA key handle",

-			NULL, NULL, NULL);

-#endif

-	if (hndidx_rsa == -1)

-		return 0;

-	return 1;

-	}

-

-static int e_gmp_finish(ENGINE *e)

-	{

-	return 1;

-	}

-

-static int e_gmp_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))

-	{

-	int to_return = 1;

-

-	switch(cmd)

-		{

-#if 0

-	case E_GMP_CMD_SO_PATH:

-		/* ... */

-#endif

-	/* The command isn't understood by this engine */

-	default:

-		GMPerr(GMP_F_E_GMP_CTRL,

-			GMP_R_CTRL_COMMAND_NOT_IMPLEMENTED);

-		to_return = 0;

-		break;

-		}

-

-	return to_return;

-	}

-

-

-/* Most often limb sizes will be the same. If not, we use hex conversion

- * which is neat, but extremely inefficient. */

-static int bn2gmp(const BIGNUM *bn, mpz_t g)

-	{

-	bn_check_top(bn);

-	if(((sizeof(bn->d[0]) * 8) == GMP_NUMB_BITS) &&

-			(BN_BITS2 == GMP_NUMB_BITS)) 

-		{

-		/* The common case */

-		if(!_mpz_realloc (g, bn->top))

-			return 0;

-		memcpy(&g->_mp_d[0], &bn->d[0], bn->top * sizeof(bn->d[0]));

-		g->_mp_size = bn->top;

-		if(bn->neg)

-			g->_mp_size = -g->_mp_size;

-		return 1;

-		}

-	else

-		{

-		int toret;

-		char *tmpchar = BN_bn2hex(bn);

-		if(!tmpchar) return 0;

-		toret = (mpz_set_str(g, tmpchar, 16) == 0 ? 1 : 0);

-		OPENSSL_free(tmpchar);

-		return toret;

-		}

-	}

-

-static int gmp2bn(mpz_t g, BIGNUM *bn)

-	{

-	if(((sizeof(bn->d[0]) * 8) == GMP_NUMB_BITS) &&

-			(BN_BITS2 == GMP_NUMB_BITS))

-		{

-		/* The common case */

-		int s = (g->_mp_size >= 0) ? g->_mp_size : -g->_mp_size;

-		BN_zero(bn);

-		if(bn_expand2 (bn, s) == NULL)

-			return 0;

-		bn->top = s;

-		memcpy(&bn->d[0], &g->_mp_d[0], s * sizeof(bn->d[0]));

-		bn_correct_top(bn);

-		bn->neg = g->_mp_size >= 0 ? 0 : 1;

-		return 1;

-		}

-	else

-		{

-		int toret;

-		char *tmpchar = OPENSSL_malloc(mpz_sizeinbase(g, 16) + 10);

-		if(!tmpchar) return 0;

-		mpz_get_str(tmpchar, 16, g);

-		toret = BN_hex2bn(&bn, tmpchar);

-		OPENSSL_free(tmpchar);

-		return toret;

-		}

-	}

-

-#ifndef OPENSSL_NO_RSA 

-typedef struct st_e_gmp_rsa_ctx

-	{

-	int public_only;

-	mpz_t n;

-	mpz_t d;

-	mpz_t e;

-	mpz_t p;

-	mpz_t q;

-	mpz_t dmp1;

-	mpz_t dmq1;

-	mpz_t iqmp;

-	mpz_t r0, r1, I0, m1;

-	} E_GMP_RSA_CTX;

-

-static E_GMP_RSA_CTX *e_gmp_get_rsa(RSA *rsa)

-	{

-	E_GMP_RSA_CTX *hptr = RSA_get_ex_data(rsa, hndidx_rsa);

-	if(hptr) return hptr;

-	hptr = OPENSSL_malloc(sizeof(E_GMP_RSA_CTX));

-	if(!hptr) return NULL;

-	/* These inits could probably be replaced by more intelligent

-	 * mpz_init2() versions, to reduce malloc-thrashing. */

-	mpz_init(hptr->n);

-	mpz_init(hptr->d);

-	mpz_init(hptr->e);

-	mpz_init(hptr->p);

-	mpz_init(hptr->q);

-	mpz_init(hptr->dmp1);

-	mpz_init(hptr->dmq1);

-	mpz_init(hptr->iqmp);

-	mpz_init(hptr->r0);

-	mpz_init(hptr->r1);

-	mpz_init(hptr->I0);

-	mpz_init(hptr->m1);

-	if(!bn2gmp(rsa->n, hptr->n) || !bn2gmp(rsa->e, hptr->e))

-		goto err;

-	if(!rsa->p || !rsa->q || !rsa->d || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)

-		{

-		hptr->public_only = 1;

-		return hptr;

-		}

-	if(!bn2gmp(rsa->d, hptr->d) || !bn2gmp(rsa->p, hptr->p) ||

-			!bn2gmp(rsa->q, hptr->q) || !bn2gmp(rsa->dmp1, hptr->dmp1) ||

-			!bn2gmp(rsa->dmq1, hptr->dmq1) || !bn2gmp(rsa->iqmp, hptr->iqmp))

-		goto err;

-	hptr->public_only = 0;

-	RSA_set_ex_data(rsa, hndidx_rsa, hptr);

-	return hptr;

-err:

-	mpz_clear(hptr->n);

-	mpz_clear(hptr->d);

-	mpz_clear(hptr->e);

-	mpz_clear(hptr->p);

-	mpz_clear(hptr->q);

-	mpz_clear(hptr->dmp1);

-	mpz_clear(hptr->dmq1);

-	mpz_clear(hptr->iqmp);

-	mpz_clear(hptr->r0);

-	mpz_clear(hptr->r1);

-	mpz_clear(hptr->I0);

-	mpz_clear(hptr->m1);

-	OPENSSL_free(hptr);

-	return NULL;

-	}

-

-static int e_gmp_rsa_finish(RSA *rsa)

-	{

-	E_GMP_RSA_CTX *hptr = RSA_get_ex_data(rsa, hndidx_rsa);

-	if(!hptr) return 0;

-	mpz_clear(hptr->n);

-	mpz_clear(hptr->d);

-	mpz_clear(hptr->e);

-	mpz_clear(hptr->p);

-	mpz_clear(hptr->q);

-	mpz_clear(hptr->dmp1);

-	mpz_clear(hptr->dmq1);

-	mpz_clear(hptr->iqmp);

-	mpz_clear(hptr->r0);

-	mpz_clear(hptr->r1);

-	mpz_clear(hptr->I0);

-	mpz_clear(hptr->m1);

-	OPENSSL_free(hptr);

-	RSA_set_ex_data(rsa, hndidx_rsa, NULL);

-	return 1;

-	}

-

-static int e_gmp_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)

-	{

-	E_GMP_RSA_CTX *hptr;

-	int to_return = 0;

-

-	hptr = e_gmp_get_rsa(rsa);

-	if(!hptr)

-		{

-		GMPerr(GMP_F_E_GMP_RSA_MOD_EXP,

-				GMP_R_KEY_CONTEXT_ERROR);

-		return 0;

-		}

-	if(hptr->public_only)

-		{

-		GMPerr(GMP_F_E_GMP_RSA_MOD_EXP,

-				GMP_R_MISSING_KEY_COMPONENTS);

-		return 0;

-		}

-

-	/* ugh!!! */

-	if(!bn2gmp(I, hptr->I0))

-		return 0;

-

-	/* This is basically the CRT logic in crypto/rsa/rsa_eay.c reworded into

-	 * GMP-speak. It may be that GMP's API facilitates cleaner formulations

-	 * of this stuff, eg. better handling of negatives, or functions that

-	 * combine operations. */

-

-	mpz_mod(hptr->r1, hptr->I0, hptr->q);

-	mpz_powm(hptr->m1, hptr->r1, hptr->dmq1, hptr->q);

-

-	mpz_mod(hptr->r1, hptr->I0, hptr->p);

-	mpz_powm(hptr->r0, hptr->r1, hptr->dmp1, hptr->p);

-

-	mpz_sub(hptr->r0, hptr->r0, hptr->m1);

-

-	if(mpz_sgn(hptr->r0) < 0)

-		mpz_add(hptr->r0, hptr->r0, hptr->p);

-	mpz_mul(hptr->r1, hptr->r0, hptr->iqmp);

-	mpz_mod(hptr->r0, hptr->r1, hptr->p);

-

-	if(mpz_sgn(hptr->r0) < 0)

-		mpz_add(hptr->r0, hptr->r0, hptr->p);

-	mpz_mul(hptr->r1, hptr->r0, hptr->q);

-	mpz_add(hptr->r0, hptr->r1, hptr->m1);

-

-	/* ugh!!! */

-	if(gmp2bn(hptr->r0, r))

-		to_return = 1;

-

-	return 1;

-	}

-#endif

-

-#endif /* !OPENSSL_NO_GMP */

-

-/* This stuff is needed if this ENGINE is being compiled into a self-contained

- * shared-library. */	   

-#ifndef OPENSSL_NO_DYNAMIC_ENGINE

-IMPLEMENT_DYNAMIC_CHECK_FN()

-#ifndef OPENSSL_NO_GMP

-static int bind_fn(ENGINE *e, const char *id)

-	{

-	if(id && (strcmp(id, engine_e_gmp_id) != 0))

-		return 0;

-	if(!bind_helper(e))

-		return 0;

-	return 1;

-	}       

-IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)

-#else

-OPENSSL_EXPORT

-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);

-OPENSSL_EXPORT

-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }

-#endif

-#endif /* !OPENSSL_NO_DYNAMIC_ENGINE */

-

-#endif /* !OPENSSL_NO_HW */

+/* crypto/engine/e_gmp.c */
+/* Written by Geoff Thorpe (geoff@geoffthorpe.net) for the OpenSSL
+ * project 2003.
+ */
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+/* This engine is not (currently) compiled in by default. Do enable it,
+ * reconfigure OpenSSL with "enable-gmp -lgmp". The GMP libraries and
+ * headers must reside in one of the paths searched by the compiler/linker,
+ * otherwise paths must be specified - eg. try configuring with
+ * "enable-gmp -I<includepath> -L<libpath> -lgmp". YMMV. */
+
+/* As for what this does - it's a largely unoptimised implementation of an
+ * ENGINE that uses the GMP library to perform RSA private key operations. To
+ * obtain more information about what "unoptimised" means, see my original mail
+ * on the subject (though ignore the build instructions which have since
+ * changed);
+ *
+ *    http://www.mail-archive.com/openssl-dev@openssl.org/msg12227.html
+ *
+ * On my athlon system at least, it appears the builtin OpenSSL code is now
+ * slightly faster, which is to say that the RSA-related MPI performance
+ * between OpenSSL's BIGNUM and GMP's mpz implementations is probably pretty
+ * balanced for this chip, and so the performance degradation in this ENGINE by
+ * having to convert to/from GMP formats (and not being able to cache
+ * montgomery forms) is probably the difference. However, if some unconfirmed
+ * reports from users is anything to go by, the situation on some other
+ * chipsets might be a good deal more favourable to the GMP version (eg. PPC).
+ * Feedback welcome. */
+
+#include <stdio.h>
+#include <string.h>
+#include <openssl/crypto.h>
+#include <openssl/buffer.h>
+#include <openssl/engine.h>
+#ifndef OPENSSL_NO_RSA
+#include <openssl/rsa.h>
+#endif
+#include <openssl/bn.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_GMP
+
+#include <gmp.h>
+
+#define E_GMP_LIB_NAME "gmp engine"
+#include "e_gmp_err.c"
+
+static int e_gmp_destroy(ENGINE *e);
+static int e_gmp_init(ENGINE *e);
+static int e_gmp_finish(ENGINE *e);
+static int e_gmp_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void)); 
+
+#ifndef OPENSSL_NO_RSA
+/* RSA stuff */
+static int e_gmp_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx);
+static int e_gmp_rsa_finish(RSA *r);
+#endif
+
+/* The definitions for control commands specific to this engine */
+/* #define E_GMP_CMD_SO_PATH		ENGINE_CMD_BASE */
+static const ENGINE_CMD_DEFN e_gmp_cmd_defns[] = {
+#if 0
+	{E_GMP_CMD_SO_PATH,
+		"SO_PATH",
+		"Specifies the path to the 'e_gmp' shared library",
+		ENGINE_CMD_FLAG_STRING},
+#endif
+	{0, NULL, NULL, 0}
+	};
+
+#ifndef OPENSSL_NO_RSA
+/* Our internal RSA_METHOD that we provide pointers to */
+static RSA_METHOD e_gmp_rsa =
+	{
+	"GMP RSA method",
+	NULL,
+	NULL,
+	NULL,
+	NULL,
+	e_gmp_rsa_mod_exp,
+	NULL,
+	NULL,
+	e_gmp_rsa_finish,
+	/* These flags initialise montgomery crud that GMP ignores, however it
+	 * makes sure the public key ops (which are done in openssl) don't seem
+	 * *slower* than usual :-) */
+	RSA_FLAG_CACHE_PUBLIC|RSA_FLAG_CACHE_PRIVATE,
+	NULL,
+	NULL,
+	NULL
+	};
+#endif
+
+/* Constants used when creating the ENGINE */
+static const char *engine_e_gmp_id = "gmp";
+static const char *engine_e_gmp_name = "GMP engine support";
+
+/* This internal function is used by ENGINE_gmp() and possibly by the
+ * "dynamic" ENGINE support too */
+static int bind_helper(ENGINE *e)
+	{
+#ifndef OPENSSL_NO_RSA
+	const RSA_METHOD *meth1;
+#endif
+	if(!ENGINE_set_id(e, engine_e_gmp_id) ||
+			!ENGINE_set_name(e, engine_e_gmp_name) ||
+#ifndef OPENSSL_NO_RSA
+			!ENGINE_set_RSA(e, &e_gmp_rsa) ||
+#endif
+			!ENGINE_set_destroy_function(e, e_gmp_destroy) ||
+			!ENGINE_set_init_function(e, e_gmp_init) ||
+			!ENGINE_set_finish_function(e, e_gmp_finish) ||
+			!ENGINE_set_ctrl_function(e, e_gmp_ctrl) ||
+			!ENGINE_set_cmd_defns(e, e_gmp_cmd_defns))
+		return 0;
+
+#ifndef OPENSSL_NO_RSA
+	meth1 = RSA_PKCS1_SSLeay();
+	e_gmp_rsa.rsa_pub_enc = meth1->rsa_pub_enc;
+	e_gmp_rsa.rsa_pub_dec = meth1->rsa_pub_dec;
+	e_gmp_rsa.rsa_priv_enc = meth1->rsa_priv_enc;
+	e_gmp_rsa.rsa_priv_dec = meth1->rsa_priv_dec;
+	e_gmp_rsa.bn_mod_exp = meth1->bn_mod_exp;
+#endif
+
+	/* Ensure the e_gmp error handling is set up */
+	ERR_load_GMP_strings();
+	return 1;
+	}
+
+static ENGINE *engine_gmp(void)
+	{
+	ENGINE *ret = ENGINE_new();
+	if(!ret)
+		return NULL;
+	if(!bind_helper(ret))
+		{
+		ENGINE_free(ret);
+		return NULL;
+		}
+	return ret;
+	}
+
+void ENGINE_load_gmp(void)
+	{
+	/* Copied from eng_[openssl|dyn].c */
+	ENGINE *toadd = engine_gmp();
+	if(!toadd) return;
+	ENGINE_add(toadd);
+	ENGINE_free(toadd);
+	ERR_clear_error();
+	}
+
+#ifndef OPENSSL_NO_RSA
+/* Used to attach our own key-data to an RSA structure */
+static int hndidx_rsa = -1;
+#endif
+
+static int e_gmp_destroy(ENGINE *e)
+	{
+	ERR_unload_GMP_strings();
+	return 1;
+	}
+
+/* (de)initialisation functions. */
+static int e_gmp_init(ENGINE *e)
+	{
+#ifndef OPENSSL_NO_RSA
+	if (hndidx_rsa == -1)
+		hndidx_rsa = RSA_get_ex_new_index(0,
+			"GMP-based RSA key handle",
+			NULL, NULL, NULL);
+#endif
+	if (hndidx_rsa == -1)
+		return 0;
+	return 1;
+	}
+
+static int e_gmp_finish(ENGINE *e)
+	{
+	return 1;
+	}
+
+static int e_gmp_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)(void))
+	{
+	int to_return = 1;
+
+	switch(cmd)
+		{
+#if 0
+	case E_GMP_CMD_SO_PATH:
+		/* ... */
+#endif
+	/* The command isn't understood by this engine */
+	default:
+		GMPerr(GMP_F_E_GMP_CTRL,
+			GMP_R_CTRL_COMMAND_NOT_IMPLEMENTED);
+		to_return = 0;
+		break;
+		}
+
+	return to_return;
+	}
+
+
+/* Most often limb sizes will be the same. If not, we use hex conversion
+ * which is neat, but extremely inefficient. */
+static int bn2gmp(const BIGNUM *bn, mpz_t g)
+	{
+	bn_check_top(bn);
+	if(((sizeof(bn->d[0]) * 8) == GMP_NUMB_BITS) &&
+			(BN_BITS2 == GMP_NUMB_BITS)) 
+		{
+		/* The common case */
+		if(!_mpz_realloc (g, bn->top))
+			return 0;
+		memcpy(&g->_mp_d[0], &bn->d[0], bn->top * sizeof(bn->d[0]));
+		g->_mp_size = bn->top;
+		if(bn->neg)
+			g->_mp_size = -g->_mp_size;
+		return 1;
+		}
+	else
+		{
+		int toret;
+		char *tmpchar = BN_bn2hex(bn);
+		if(!tmpchar) return 0;
+		toret = (mpz_set_str(g, tmpchar, 16) == 0 ? 1 : 0);
+		OPENSSL_free(tmpchar);
+		return toret;
+		}
+	}
+
+static int gmp2bn(mpz_t g, BIGNUM *bn)
+	{
+	if(((sizeof(bn->d[0]) * 8) == GMP_NUMB_BITS) &&
+			(BN_BITS2 == GMP_NUMB_BITS))
+		{
+		/* The common case */
+		int s = (g->_mp_size >= 0) ? g->_mp_size : -g->_mp_size;
+		BN_zero(bn);
+		if(bn_expand2 (bn, s) == NULL)
+			return 0;
+		bn->top = s;
+		memcpy(&bn->d[0], &g->_mp_d[0], s * sizeof(bn->d[0]));
+		bn_correct_top(bn);
+		bn->neg = g->_mp_size >= 0 ? 0 : 1;
+		return 1;
+		}
+	else
+		{
+		int toret;
+		char *tmpchar = OPENSSL_malloc(mpz_sizeinbase(g, 16) + 10);
+		if(!tmpchar) return 0;
+		mpz_get_str(tmpchar, 16, g);
+		toret = BN_hex2bn(&bn, tmpchar);
+		OPENSSL_free(tmpchar);
+		return toret;
+		}
+	}
+
+#ifndef OPENSSL_NO_RSA 
+typedef struct st_e_gmp_rsa_ctx
+	{
+	int public_only;
+	mpz_t n;
+	mpz_t d;
+	mpz_t e;
+	mpz_t p;
+	mpz_t q;
+	mpz_t dmp1;
+	mpz_t dmq1;
+	mpz_t iqmp;
+	mpz_t r0, r1, I0, m1;
+	} E_GMP_RSA_CTX;
+
+static E_GMP_RSA_CTX *e_gmp_get_rsa(RSA *rsa)
+	{
+	E_GMP_RSA_CTX *hptr = RSA_get_ex_data(rsa, hndidx_rsa);
+	if(hptr) return hptr;
+	hptr = OPENSSL_malloc(sizeof(E_GMP_RSA_CTX));
+	if(!hptr) return NULL;
+	/* These inits could probably be replaced by more intelligent
+	 * mpz_init2() versions, to reduce malloc-thrashing. */
+	mpz_init(hptr->n);
+	mpz_init(hptr->d);
+	mpz_init(hptr->e);
+	mpz_init(hptr->p);
+	mpz_init(hptr->q);
+	mpz_init(hptr->dmp1);
+	mpz_init(hptr->dmq1);
+	mpz_init(hptr->iqmp);
+	mpz_init(hptr->r0);
+	mpz_init(hptr->r1);
+	mpz_init(hptr->I0);
+	mpz_init(hptr->m1);
+	if(!bn2gmp(rsa->n, hptr->n) || !bn2gmp(rsa->e, hptr->e))
+		goto err;
+	if(!rsa->p || !rsa->q || !rsa->d || !rsa->dmp1 || !rsa->dmq1 || !rsa->iqmp)
+		{
+		hptr->public_only = 1;
+		return hptr;
+		}
+	if(!bn2gmp(rsa->d, hptr->d) || !bn2gmp(rsa->p, hptr->p) ||
+			!bn2gmp(rsa->q, hptr->q) || !bn2gmp(rsa->dmp1, hptr->dmp1) ||
+			!bn2gmp(rsa->dmq1, hptr->dmq1) || !bn2gmp(rsa->iqmp, hptr->iqmp))
+		goto err;
+	hptr->public_only = 0;
+	RSA_set_ex_data(rsa, hndidx_rsa, hptr);
+	return hptr;
+err:
+	mpz_clear(hptr->n);
+	mpz_clear(hptr->d);
+	mpz_clear(hptr->e);
+	mpz_clear(hptr->p);
+	mpz_clear(hptr->q);
+	mpz_clear(hptr->dmp1);
+	mpz_clear(hptr->dmq1);
+	mpz_clear(hptr->iqmp);
+	mpz_clear(hptr->r0);
+	mpz_clear(hptr->r1);
+	mpz_clear(hptr->I0);
+	mpz_clear(hptr->m1);
+	OPENSSL_free(hptr);
+	return NULL;
+	}
+
+static int e_gmp_rsa_finish(RSA *rsa)
+	{
+	E_GMP_RSA_CTX *hptr = RSA_get_ex_data(rsa, hndidx_rsa);
+	if(!hptr) return 0;
+	mpz_clear(hptr->n);
+	mpz_clear(hptr->d);
+	mpz_clear(hptr->e);
+	mpz_clear(hptr->p);
+	mpz_clear(hptr->q);
+	mpz_clear(hptr->dmp1);
+	mpz_clear(hptr->dmq1);
+	mpz_clear(hptr->iqmp);
+	mpz_clear(hptr->r0);
+	mpz_clear(hptr->r1);
+	mpz_clear(hptr->I0);
+	mpz_clear(hptr->m1);
+	OPENSSL_free(hptr);
+	RSA_set_ex_data(rsa, hndidx_rsa, NULL);
+	return 1;
+	}
+
+static int e_gmp_rsa_mod_exp(BIGNUM *r, const BIGNUM *I, RSA *rsa, BN_CTX *ctx)
+	{
+	E_GMP_RSA_CTX *hptr;
+	int to_return = 0;
+
+	hptr = e_gmp_get_rsa(rsa);
+	if(!hptr)
+		{
+		GMPerr(GMP_F_E_GMP_RSA_MOD_EXP,
+				GMP_R_KEY_CONTEXT_ERROR);
+		return 0;
+		}
+	if(hptr->public_only)
+		{
+		GMPerr(GMP_F_E_GMP_RSA_MOD_EXP,
+				GMP_R_MISSING_KEY_COMPONENTS);
+		return 0;
+		}
+
+	/* ugh!!! */
+	if(!bn2gmp(I, hptr->I0))
+		return 0;
+
+	/* This is basically the CRT logic in crypto/rsa/rsa_eay.c reworded into
+	 * GMP-speak. It may be that GMP's API facilitates cleaner formulations
+	 * of this stuff, eg. better handling of negatives, or functions that
+	 * combine operations. */
+
+	mpz_mod(hptr->r1, hptr->I0, hptr->q);
+	mpz_powm(hptr->m1, hptr->r1, hptr->dmq1, hptr->q);
+
+	mpz_mod(hptr->r1, hptr->I0, hptr->p);
+	mpz_powm(hptr->r0, hptr->r1, hptr->dmp1, hptr->p);
+
+	mpz_sub(hptr->r0, hptr->r0, hptr->m1);
+
+	if(mpz_sgn(hptr->r0) < 0)
+		mpz_add(hptr->r0, hptr->r0, hptr->p);
+	mpz_mul(hptr->r1, hptr->r0, hptr->iqmp);
+	mpz_mod(hptr->r0, hptr->r1, hptr->p);
+
+	if(mpz_sgn(hptr->r0) < 0)
+		mpz_add(hptr->r0, hptr->r0, hptr->p);
+	mpz_mul(hptr->r1, hptr->r0, hptr->q);
+	mpz_add(hptr->r0, hptr->r1, hptr->m1);
+
+	/* ugh!!! */
+	if(gmp2bn(hptr->r0, r))
+		to_return = 1;
+
+	return 1;
+	}
+#endif
+
+#endif /* !OPENSSL_NO_GMP */
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */	   
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+IMPLEMENT_DYNAMIC_CHECK_FN()
+#ifndef OPENSSL_NO_GMP
+static int bind_fn(ENGINE *e, const char *id)
+	{
+	if(id && (strcmp(id, engine_e_gmp_id) != 0))
+		return 0;
+	if(!bind_helper(e))
+		return 0;
+	return 1;
+	}       
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#else
+OPENSSL_EXPORT
+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);
+OPENSSL_EXPORT
+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }
+#endif
+#endif /* !OPENSSL_NO_DYNAMIC_ENGINE */
+
+#endif /* !OPENSSL_NO_HW */
diff --git a/openssl/engines/e_padlock.c b/openssl/engines/e_padlock.c
index dbeff3bb8..7d0941980 100644
--- a/openssl/engines/e_padlock.c
+++ b/openssl/engines/e_padlock.c
@@ -1,1233 +1,1233 @@
-/* 

- * Support for VIA PadLock Advanced Cryptography Engine (ACE)

- * Written by Michal Ludvig <michal@logix.cz>

- *            http://www.logix.cz/michal

- *

- * Big thanks to Andy Polyakov for a help with optimization, 

- * assembler fixes, port to MS Windows and a lot of other 

- * valuable work on this engine!

- */

-

-/* ====================================================================

- * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.

- *

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- *

- * 1. Redistributions of source code must retain the above copyright

- *    notice, this list of conditions and the following disclaimer.

- *

- * 2. Redistributions in binary form must reproduce the above copyright

- *    notice, this list of conditions and the following disclaimer in

- *    the documentation and/or other materials provided with the

- *    distribution.

- *

- * 3. All advertising materials mentioning features or use of this

- *    software must display the following acknowledgment:

- *    "This product includes software developed by the OpenSSL Project

- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

- *

- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

- *    endorse or promote products derived from this software without

- *    prior written permission. For written permission, please contact

- *    licensing@OpenSSL.org.

- *

- * 5. Products derived from this software may not be called "OpenSSL"

- *    nor may "OpenSSL" appear in their names without prior written

- *    permission of the OpenSSL Project.

- *

- * 6. Redistributions of any form whatsoever must retain the following

- *    acknowledgment:

- *    "This product includes software developed by the OpenSSL Project

- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

- *

- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

- * OF THE POSSIBILITY OF SUCH DAMAGE.

- * ====================================================================

- *

- * This product includes cryptographic software written by Eric Young

- * (eay@cryptsoft.com).  This product includes software written by Tim

- * Hudson (tjh@cryptsoft.com).

- *

- */

-

-

-#include <stdio.h>

-#include <string.h>

-

-#include <openssl/opensslconf.h>

-#include <openssl/crypto.h>

-#include <openssl/dso.h>

-#include <openssl/engine.h>

-#include <openssl/evp.h>

-#ifndef OPENSSL_NO_AES

-#include <openssl/aes.h>

-#endif

-#include <openssl/rand.h>

-#include <openssl/err.h>

-

-#ifndef OPENSSL_NO_HW

-#ifndef OPENSSL_NO_HW_PADLOCK

-

-/* Attempt to have a single source for both 0.9.7 and 0.9.8 :-) */

-#if (OPENSSL_VERSION_NUMBER >= 0x00908000L)

-#  ifndef OPENSSL_NO_DYNAMIC_ENGINE

-#    define DYNAMIC_ENGINE

-#  endif

-#elif (OPENSSL_VERSION_NUMBER >= 0x00907000L)

-#  ifdef ENGINE_DYNAMIC_SUPPORT

-#    define DYNAMIC_ENGINE

-#  endif

-#else

-#  error "Only OpenSSL >= 0.9.7 is supported"

-#endif

-

-/* VIA PadLock AES is available *ONLY* on some x86 CPUs.

-   Not only that it doesn't exist elsewhere, but it

-   even can't be compiled on other platforms!

- 

-   In addition, because of the heavy use of inline assembler,

-   compiler choice is limited to GCC and Microsoft C. */

-#undef COMPILE_HW_PADLOCK

-#if !defined(I386_ONLY) && !defined(OPENSSL_NO_INLINE_ASM)

-# if (defined(__GNUC__) && (defined(__i386__) || defined(__i386))) || \

-     (defined(_MSC_VER) && defined(_M_IX86))

-#  define COMPILE_HW_PADLOCK

-static ENGINE *ENGINE_padlock (void);

-# endif

-#endif

-

-#ifdef OPENSSL_NO_DYNAMIC_ENGINE

-

-void ENGINE_load_padlock (void)

-{

-/* On non-x86 CPUs it just returns. */

-#ifdef COMPILE_HW_PADLOCK

-	ENGINE *toadd = ENGINE_padlock ();

-	if (!toadd) return;

-	ENGINE_add (toadd);

-	ENGINE_free (toadd);

-	ERR_clear_error ();

-#endif

-}

-

-#endif

-

-#ifdef COMPILE_HW_PADLOCK

-/* We do these includes here to avoid header problems on platforms that

-   do not have the VIA padlock anyway... */

-#include <stdlib.h>

-#ifdef _WIN32

-# include <malloc.h>

-# ifndef alloca

-#  define alloca _alloca

-# endif

-#elif defined(__GNUC__)

-# ifndef alloca

-#  define alloca(s) __builtin_alloca(s)

-# endif

-#endif

-

-/* Function for ENGINE detection and control */

-static int padlock_available(void);

-static int padlock_init(ENGINE *e);

-

-/* RNG Stuff */

-static RAND_METHOD padlock_rand;

-

-/* Cipher Stuff */

-#ifndef OPENSSL_NO_AES

-static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid);

-#endif

-

-/* Engine names */

-static const char *padlock_id = "padlock";

-static char padlock_name[100];

-

-/* Available features */

-static int padlock_use_ace = 0;	/* Advanced Cryptography Engine */

-static int padlock_use_rng = 0;	/* Random Number Generator */

-#ifndef OPENSSL_NO_AES

-static int padlock_aes_align_required = 1;

-#endif

-

-/* ===== Engine "management" functions ===== */

-

-/* Prepare the ENGINE structure for registration */

-static int

-padlock_bind_helper(ENGINE *e)

-{

-	/* Check available features */

-	padlock_available();

-

-#if 1	/* disable RNG for now, see commentary in vicinity of RNG code */

-	padlock_use_rng=0;

-#endif

-

-	/* Generate a nice engine name with available features */

-	BIO_snprintf(padlock_name, sizeof(padlock_name),

-		"VIA PadLock (%s, %s)", 

-		 padlock_use_rng ? "RNG" : "no-RNG",

-		 padlock_use_ace ? "ACE" : "no-ACE");

-

-	/* Register everything or return with an error */ 

-	if (!ENGINE_set_id(e, padlock_id) ||

-	    !ENGINE_set_name(e, padlock_name) ||

-

-	    !ENGINE_set_init_function(e, padlock_init) ||

-#ifndef OPENSSL_NO_AES

-	    (padlock_use_ace && !ENGINE_set_ciphers (e, padlock_ciphers)) ||

-#endif

-	    (padlock_use_rng && !ENGINE_set_RAND (e, &padlock_rand))) {

-		return 0;

-	}

-

-	/* Everything looks good */

-	return 1;

-}

-

-/* Constructor */

-static ENGINE *

-ENGINE_padlock(void)

-{

-	ENGINE *eng = ENGINE_new();

-

-	if (!eng) {

-		return NULL;

-	}

-

-	if (!padlock_bind_helper(eng)) {

-		ENGINE_free(eng);

-		return NULL;

-	}

-

-	return eng;

-}

-

-/* Check availability of the engine */

-static int

-padlock_init(ENGINE *e)

-{

-	return (padlock_use_rng || padlock_use_ace);

-}

-

-/* This stuff is needed if this ENGINE is being compiled into a self-contained

- * shared-library.

- */

-#ifdef DYNAMIC_ENGINE

-static int

-padlock_bind_fn(ENGINE *e, const char *id)

-{

-	if (id && (strcmp(id, padlock_id) != 0)) {

-		return 0;

-	}

-

-	if (!padlock_bind_helper(e))  {

-		return 0;

-	}

-

-	return 1;

-}

-

-IMPLEMENT_DYNAMIC_CHECK_FN()

-IMPLEMENT_DYNAMIC_BIND_FN (padlock_bind_fn)

-#endif /* DYNAMIC_ENGINE */

-

-/* ===== Here comes the "real" engine ===== */

-

-#ifndef OPENSSL_NO_AES

-/* Some AES-related constants */

-#define AES_BLOCK_SIZE		16

-#define AES_KEY_SIZE_128	16

-#define AES_KEY_SIZE_192	24

-#define AES_KEY_SIZE_256	32

-

-/* Here we store the status information relevant to the 

-   current context. */

-/* BIG FAT WARNING:

- * 	Inline assembler in PADLOCK_XCRYPT_ASM()

- * 	depends on the order of items in this structure.

- * 	Don't blindly modify, reorder, etc!

- */

-struct padlock_cipher_data

-{

-	unsigned char iv[AES_BLOCK_SIZE];	/* Initialization vector */

-	union {	unsigned int pad[4];

-		struct {

-			int rounds:4;

-			int dgst:1;	/* n/a in C3 */

-			int align:1;	/* n/a in C3 */

-			int ciphr:1;	/* n/a in C3 */

-			unsigned int keygen:1;

-			int interm:1;

-			unsigned int encdec:1;

-			int ksize:2;

-		} b;

-	} cword;		/* Control word */

-	AES_KEY ks;		/* Encryption key */

-};

-

-/*

- * Essentially this variable belongs in thread local storage.

- * Having this variable global on the other hand can only cause

- * few bogus key reloads [if any at all on single-CPU system],

- * so we accept the penatly...

- */

-static volatile struct padlock_cipher_data *padlock_saved_context;

-#endif

-

-/*

- * =======================================================

- * Inline assembler section(s).

- * =======================================================

- * Order of arguments is chosen to facilitate Windows port

- * using __fastcall calling convention. If you wish to add

- * more routines, keep in mind that first __fastcall

- * argument is passed in %ecx and second - in %edx.

- * =======================================================

- */

-#if defined(__GNUC__) && __GNUC__>=2

-/*

- * As for excessive "push %ebx"/"pop %ebx" found all over.

- * When generating position-independent code GCC won't let

- * us use "b" in assembler templates nor even respect "ebx"

- * in "clobber description." Therefore the trouble...

- */

-

-/* Helper function - check if a CPUID instruction

-   is available on this CPU */

-static int

-padlock_insn_cpuid_available(void)

-{

-	int result = -1;

-

-	/* We're checking if the bit #21 of EFLAGS 

-	   can be toggled. If yes = CPUID is available. */

-	asm volatile (

-		"pushf\n"

-		"popl %%eax\n"

-		"xorl $0x200000, %%eax\n"

-		"movl %%eax, %%ecx\n"

-		"andl $0x200000, %%ecx\n"

-		"pushl %%eax\n"

-		"popf\n"

-		"pushf\n"

-		"popl %%eax\n"

-		"andl $0x200000, %%eax\n"

-		"xorl %%eax, %%ecx\n"

-		"movl %%ecx, %0\n"

-		: "=r" (result) : : "eax", "ecx");

-	

-	return (result == 0);

-}

-

-/* Load supported features of the CPU to see if

-   the PadLock is available. */

-static int

-padlock_available(void)

-{

-	char vendor_string[16];

-	unsigned int eax, edx;

-

-	/* First check if the CPUID instruction is available at all... */

-	if (! padlock_insn_cpuid_available())

-		return 0;

-

-	/* Are we running on the Centaur (VIA) CPU? */

-	eax = 0x00000000;

-	vendor_string[12] = 0;

-	asm volatile (

-		"pushl	%%ebx\n"

-		"cpuid\n"

-		"movl	%%ebx,(%%edi)\n"

-		"movl	%%edx,4(%%edi)\n"

-		"movl	%%ecx,8(%%edi)\n"

-		"popl	%%ebx"

-		: "+a"(eax) : "D"(vendor_string) : "ecx", "edx");

-	if (strcmp(vendor_string, "CentaurHauls") != 0)

-		return 0;

-

-	/* Check for Centaur Extended Feature Flags presence */

-	eax = 0xC0000000;

-	asm volatile ("pushl %%ebx; cpuid; popl	%%ebx"

-		: "+a"(eax) : : "ecx", "edx");

-	if (eax < 0xC0000001)

-		return 0;

-

-	/* Read the Centaur Extended Feature Flags */

-	eax = 0xC0000001;

-	asm volatile ("pushl %%ebx; cpuid; popl %%ebx"

-		: "+a"(eax), "=d"(edx) : : "ecx");

-

-	/* Fill up some flags */

-	padlock_use_ace = ((edx & (0x3<<6)) == (0x3<<6));

-	padlock_use_rng = ((edx & (0x3<<2)) == (0x3<<2));

-

-	return padlock_use_ace + padlock_use_rng;

-}

-

-#ifndef OPENSSL_NO_AES

-/* Our own htonl()/ntohl() */

-static inline void

-padlock_bswapl(AES_KEY *ks)

-{

-	size_t i = sizeof(ks->rd_key)/sizeof(ks->rd_key[0]);

-	unsigned int *key = ks->rd_key;

-

-	while (i--) {

-		asm volatile ("bswapl %0" : "+r"(*key));

-		key++;

-	}

-}

-#endif

-

-/* Force key reload from memory to the CPU microcode.

-   Loading EFLAGS from the stack clears EFLAGS[30] 

-   which does the trick. */

-static inline void

-padlock_reload_key(void)

-{

-	asm volatile ("pushfl; popfl");

-}

-

-#ifndef OPENSSL_NO_AES

-/*

- * This is heuristic key context tracing. At first one

- * believes that one should use atomic swap instructions,

- * but it's not actually necessary. Point is that if

- * padlock_saved_context was changed by another thread

- * after we've read it and before we compare it with cdata,

- * our key *shall* be reloaded upon thread context switch

- * and we are therefore set in either case...

- */

-static inline void

-padlock_verify_context(struct padlock_cipher_data *cdata)

-{

-	asm volatile (

-	"pushfl\n"

-"	btl	$30,(%%esp)\n"

-"	jnc	1f\n"

-"	cmpl	%2,%1\n"

-"	je	1f\n"

-"	popfl\n"

-"	subl	$4,%%esp\n"

-"1:	addl	$4,%%esp\n"

-"	movl	%2,%0"

-	:"+m"(padlock_saved_context)

-	: "r"(padlock_saved_context), "r"(cdata) : "cc");

-}

-

-/* Template for padlock_xcrypt_* modes */

-/* BIG FAT WARNING: 

- * 	The offsets used with 'leal' instructions

- * 	describe items of the 'padlock_cipher_data'

- * 	structure.

- */

-#define PADLOCK_XCRYPT_ASM(name,rep_xcrypt)	\

-static inline void *name(size_t cnt,		\

-	struct padlock_cipher_data *cdata,	\

-	void *out, const void *inp) 		\

-{	void *iv; 				\

-	asm volatile ( "pushl	%%ebx\n"	\

-		"	leal	16(%0),%%edx\n"	\

-		"	leal	32(%0),%%ebx\n"	\

-			rep_xcrypt "\n"		\

-		"	popl	%%ebx"		\

-		: "=a"(iv), "=c"(cnt), "=D"(out), "=S"(inp) \

-		: "0"(cdata), "1"(cnt), "2"(out), "3"(inp)  \

-		: "edx", "cc", "memory");	\

-	return iv;				\

-}

-

-/* Generate all functions with appropriate opcodes */

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb, ".byte 0xf3,0x0f,0xa7,0xc8")	/* rep xcryptecb */

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc, ".byte 0xf3,0x0f,0xa7,0xd0")	/* rep xcryptcbc */

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb, ".byte 0xf3,0x0f,0xa7,0xe0")	/* rep xcryptcfb */

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb, ".byte 0xf3,0x0f,0xa7,0xe8")	/* rep xcryptofb */

-#endif

-

-/* The RNG call itself */

-static inline unsigned int

-padlock_xstore(void *addr, unsigned int edx_in)

-{

-	unsigned int eax_out;

-

-	asm volatile (".byte 0x0f,0xa7,0xc0"	/* xstore */

-	    : "=a"(eax_out),"=m"(*(unsigned *)addr)

-	    : "D"(addr), "d" (edx_in)

-	    );

-

-	return eax_out;

-}

-

-/* Why not inline 'rep movsd'? I failed to find information on what

- * value in Direction Flag one can expect and consequently have to

- * apply "better-safe-than-sorry" approach and assume "undefined."

- * I could explicitly clear it and restore the original value upon

- * return from padlock_aes_cipher, but it's presumably too much

- * trouble for too little gain...

- *

- * In case you wonder 'rep xcrypt*' instructions above are *not*

- * affected by the Direction Flag and pointers advance toward

- * larger addresses unconditionally.

- */ 

-static inline unsigned char *

-padlock_memcpy(void *dst,const void *src,size_t n)

-{

-	long       *d=dst;

-	const long *s=src;

-

-	n /= sizeof(*d);

-	do { *d++ = *s++; } while (--n);

-

-	return dst;

-}

-

-#elif defined(_MSC_VER)

-/*

- * Unlike GCC these are real functions. In order to minimize impact

- * on performance we adhere to __fastcall calling convention in

- * order to get two first arguments passed through %ecx and %edx.

- * Which kind of suits very well, as instructions in question use

- * both %ecx and %edx as input:-)

- */

-#define REP_XCRYPT(code)		\

-	_asm _emit 0xf3			\

-	_asm _emit 0x0f _asm _emit 0xa7	\

-	_asm _emit code

-

-/* BIG FAT WARNING: 

- * 	The offsets used with 'lea' instructions

- * 	describe items of the 'padlock_cipher_data'

- * 	structure.

- */

-#define PADLOCK_XCRYPT_ASM(name,code)	\

-static void * __fastcall 		\

-	name (size_t cnt, void *cdata,	\

-	void *outp, const void *inp)	\

-{	_asm	mov	eax,edx		\

-	_asm	lea	edx,[eax+16]	\

-	_asm	lea	ebx,[eax+32]	\

-	_asm	mov	edi,outp	\

-	_asm	mov	esi,inp		\

-	REP_XCRYPT(code)		\

-}

-

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb,0xc8)

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc,0xd0)

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb,0xe0)

-PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb,0xe8)

-

-static int __fastcall

-padlock_xstore(void *outp,unsigned int code)

-{	_asm	mov	edi,ecx

-	_asm _emit 0x0f _asm _emit 0xa7 _asm _emit 0xc0

-}

-

-static void __fastcall

-padlock_reload_key(void)

-{	_asm pushfd _asm popfd		}

-

-static void __fastcall

-padlock_verify_context(void *cdata)

-{	_asm	{

-		pushfd

-		bt	DWORD PTR[esp],30

-		jnc	skip

-		cmp	ecx,padlock_saved_context

-		je	skip

-		popfd

-		sub	esp,4

-	skip:	add	esp,4

-		mov	padlock_saved_context,ecx

-		}

-}

-

-static int

-padlock_available(void)

-{	_asm	{

-		pushfd

-		pop	eax

-		mov	ecx,eax

-		xor	eax,1<<21

-		push	eax

-		popfd

-		pushfd

-		pop	eax

-		xor	eax,ecx

-		bt	eax,21

-		jnc	noluck

-		mov	eax,0

-		cpuid

-		xor	eax,eax

-		cmp	ebx,'tneC'

-		jne	noluck

-		cmp	edx,'Hrua'

-		jne	noluck

-		cmp	ecx,'slua'

-		jne	noluck

-		mov	eax,0xC0000000

-		cpuid

-		mov	edx,eax

-		xor	eax,eax

-		cmp	edx,0xC0000001

-		jb	noluck

-		mov	eax,0xC0000001

-		cpuid

-		xor	eax,eax

-		bt	edx,6

-		jnc	skip_a

-		bt	edx,7

-		jnc	skip_a

-		mov	padlock_use_ace,1

-		inc	eax

-	skip_a:	bt	edx,2

-		jnc	skip_r

-		bt	edx,3

-		jnc	skip_r

-		mov	padlock_use_rng,1

-		inc	eax

-	skip_r:

-	noluck:

-		}

-}

-

-static void __fastcall

-padlock_bswapl(void *key)

-{	_asm	{

-		pushfd

-		cld

-		mov	esi,ecx

-		mov	edi,ecx

-		mov	ecx,60

-	up:	lodsd

-		bswap	eax

-		stosd

-		loop	up

-		popfd

-		}

-}

-

-/* MS actually specifies status of Direction Flag and compiler even

- * manages to compile following as 'rep movsd' all by itself...

- */

-#define padlock_memcpy(o,i,n) ((unsigned char *)memcpy((o),(i),(n)&~3U))

-#endif

-

-/* ===== AES encryption/decryption ===== */

-#ifndef OPENSSL_NO_AES

-

-#if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)

-#define NID_aes_128_cfb	NID_aes_128_cfb128

-#endif

-

-#if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)

-#define NID_aes_128_ofb	NID_aes_128_ofb128

-#endif

-

-#if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)

-#define NID_aes_192_cfb	NID_aes_192_cfb128

-#endif

-

-#if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)

-#define NID_aes_192_ofb	NID_aes_192_ofb128

-#endif

-

-#if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)

-#define NID_aes_256_cfb	NID_aes_256_cfb128

-#endif

-

-#if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)

-#define NID_aes_256_ofb	NID_aes_256_ofb128

-#endif

-

-/* List of supported ciphers. */

-static int padlock_cipher_nids[] = {

-	NID_aes_128_ecb,

-	NID_aes_128_cbc,

-	NID_aes_128_cfb,

-	NID_aes_128_ofb,

-

-	NID_aes_192_ecb,

-	NID_aes_192_cbc,

-	NID_aes_192_cfb,

-	NID_aes_192_ofb,

-

-	NID_aes_256_ecb,

-	NID_aes_256_cbc,

-	NID_aes_256_cfb,

-	NID_aes_256_ofb,

-};

-static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids)/

-				      sizeof(padlock_cipher_nids[0]));

-

-/* Function prototypes ... */

-static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,

-				const unsigned char *iv, int enc);

-static int padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,

-			      const unsigned char *in, size_t nbytes);

-

-#define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) +		\

-	( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F )	)

-#define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\

-	NEAREST_ALIGNED(ctx->cipher_data))

-

-#define EVP_CIPHER_block_size_ECB	AES_BLOCK_SIZE

-#define EVP_CIPHER_block_size_CBC	AES_BLOCK_SIZE

-#define EVP_CIPHER_block_size_OFB	1

-#define EVP_CIPHER_block_size_CFB	1

-

-/* Declaring so many ciphers by hand would be a pain.

-   Instead introduce a bit of preprocessor magic :-) */

-#define	DECLARE_AES_EVP(ksize,lmode,umode)	\

-static const EVP_CIPHER padlock_aes_##ksize##_##lmode = {	\

-	NID_aes_##ksize##_##lmode,		\

-	EVP_CIPHER_block_size_##umode,	\

-	AES_KEY_SIZE_##ksize,		\

-	AES_BLOCK_SIZE,			\

-	0 | EVP_CIPH_##umode##_MODE,	\

-	padlock_aes_init_key,		\

-	padlock_aes_cipher,		\

-	NULL,				\

-	sizeof(struct padlock_cipher_data) + 16,	\

-	EVP_CIPHER_set_asn1_iv,		\

-	EVP_CIPHER_get_asn1_iv,		\

-	NULL,				\

-	NULL				\

-}

-

-DECLARE_AES_EVP(128,ecb,ECB);

-DECLARE_AES_EVP(128,cbc,CBC);

-DECLARE_AES_EVP(128,cfb,CFB);

-DECLARE_AES_EVP(128,ofb,OFB);

-

-DECLARE_AES_EVP(192,ecb,ECB);

-DECLARE_AES_EVP(192,cbc,CBC);

-DECLARE_AES_EVP(192,cfb,CFB);

-DECLARE_AES_EVP(192,ofb,OFB);

-

-DECLARE_AES_EVP(256,ecb,ECB);

-DECLARE_AES_EVP(256,cbc,CBC);

-DECLARE_AES_EVP(256,cfb,CFB);

-DECLARE_AES_EVP(256,ofb,OFB);

-

-static int

-padlock_ciphers (ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid)

-{

-	/* No specific cipher => return a list of supported nids ... */

-	if (!cipher) {

-		*nids = padlock_cipher_nids;

-		return padlock_cipher_nids_num;

-	}

-

-	/* ... or the requested "cipher" otherwise */

-	switch (nid) {

-	  case NID_aes_128_ecb:

-	    *cipher = &padlock_aes_128_ecb;

-	    break;

-	  case NID_aes_128_cbc:

-	    *cipher = &padlock_aes_128_cbc;

-	    break;

-	  case NID_aes_128_cfb:

-	    *cipher = &padlock_aes_128_cfb;

-	    break;

-	  case NID_aes_128_ofb:

-	    *cipher = &padlock_aes_128_ofb;

-	    break;

-

-	  case NID_aes_192_ecb:

-	    *cipher = &padlock_aes_192_ecb;

-	    break;

-	  case NID_aes_192_cbc:

-	    *cipher = &padlock_aes_192_cbc;

-	    break;

-	  case NID_aes_192_cfb:

-	    *cipher = &padlock_aes_192_cfb;

-	    break;

-	  case NID_aes_192_ofb:

-	    *cipher = &padlock_aes_192_ofb;

-	    break;

-

-	  case NID_aes_256_ecb:

-	    *cipher = &padlock_aes_256_ecb;

-	    break;

-	  case NID_aes_256_cbc:

-	    *cipher = &padlock_aes_256_cbc;

-	    break;

-	  case NID_aes_256_cfb:

-	    *cipher = &padlock_aes_256_cfb;

-	    break;

-	  case NID_aes_256_ofb:

-	    *cipher = &padlock_aes_256_ofb;

-	    break;

-

-	  default:

-	    /* Sorry, we don't support this NID */

-	    *cipher = NULL;

-	    return 0;

-	}

-

-	return 1;

-}

-

-/* Prepare the encryption key for PadLock usage */

-static int

-padlock_aes_init_key (EVP_CIPHER_CTX *ctx, const unsigned char *key,

-		      const unsigned char *iv, int enc)

-{

-	struct padlock_cipher_data *cdata;

-	int key_len = EVP_CIPHER_CTX_key_length(ctx) * 8;

-

-	if (key==NULL) return 0;	/* ERROR */

-

-	cdata = ALIGNED_CIPHER_DATA(ctx);

-	memset(cdata, 0, sizeof(struct padlock_cipher_data));

-

-	/* Prepare Control word. */

-	if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE)

-		cdata->cword.b.encdec = 0;

-	else

-		cdata->cword.b.encdec = (ctx->encrypt == 0);

-	cdata->cword.b.rounds = 10 + (key_len - 128) / 32;

-	cdata->cword.b.ksize = (key_len - 128) / 64;

-

-	switch(key_len) {

-		case 128:

-			/* PadLock can generate an extended key for

-			   AES128 in hardware */

-			memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128);

-			cdata->cword.b.keygen = 0;

-			break;

-

-		case 192:

-		case 256:

-			/* Generate an extended AES key in software.

-			   Needed for AES192/AES256 */

-			/* Well, the above applies to Stepping 8 CPUs

-			   and is listed as hardware errata. They most

-			   likely will fix it at some point and then

-			   a check for stepping would be due here. */

-			if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CFB_MODE ||

-			    EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE ||

-			    enc)

-				AES_set_encrypt_key(key, key_len, &cdata->ks);

-			else

-				AES_set_decrypt_key(key, key_len, &cdata->ks);

-#ifndef AES_ASM

-			/* OpenSSL C functions use byte-swapped extended key. */

-			padlock_bswapl(&cdata->ks);

-#endif

-			cdata->cword.b.keygen = 1;

-			break;

-

-		default:

-			/* ERROR */

-			return 0;

-	}

-

-	/*

-	 * This is done to cover for cases when user reuses the

-	 * context for new key. The catch is that if we don't do

-	 * this, padlock_eas_cipher might proceed with old key...

-	 */

-	padlock_reload_key ();

-

-	return 1;

-}

-

-/* 

- * Simplified version of padlock_aes_cipher() used when

- * 1) both input and output buffers are at aligned addresses.

- * or when

- * 2) running on a newer CPU that doesn't require aligned buffers.

- */

-static int

-padlock_aes_cipher_omnivorous(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,

-		const unsigned char *in_arg, size_t nbytes)

-{

-	struct padlock_cipher_data *cdata;

-	void  *iv;

-

-	cdata = ALIGNED_CIPHER_DATA(ctx);

-	padlock_verify_context(cdata);

-

-	switch (EVP_CIPHER_CTX_mode(ctx)) {

-	case EVP_CIPH_ECB_MODE:

-		padlock_xcrypt_ecb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

-		break;

-

-	case EVP_CIPH_CBC_MODE:

-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		iv = padlock_xcrypt_cbc(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

-		break;

-

-	case EVP_CIPH_CFB_MODE:

-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		iv = padlock_xcrypt_cfb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

-		break;

-

-	case EVP_CIPH_OFB_MODE:

-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		padlock_xcrypt_ofb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);

-		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);

-		break;

-

-	default:

-		return 0;

-	}

-

-	memset(cdata->iv, 0, AES_BLOCK_SIZE);

-

-	return 1;

-}

-

-#ifndef  PADLOCK_CHUNK

-# define PADLOCK_CHUNK	512	/* Must be a power of 2 larger than 16 */

-#endif

-#if PADLOCK_CHUNK<16 || PADLOCK_CHUNK&(PADLOCK_CHUNK-1)

-# error "insane PADLOCK_CHUNK..."

-#endif

-

-/* Re-align the arguments to 16-Bytes boundaries and run the 

-   encryption function itself. This function is not AES-specific. */

-static int

-padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,

-		   const unsigned char *in_arg, size_t nbytes)

-{

-	struct padlock_cipher_data *cdata;

-	const  void *inp;

-	unsigned char  *out;

-	void  *iv;

-	int    inp_misaligned, out_misaligned, realign_in_loop;

-	size_t chunk, allocated=0;

-

-	/* ctx->num is maintained in byte-oriented modes,

-	   such as CFB and OFB... */

-	if ((chunk = ctx->num)) { /* borrow chunk variable */

-		unsigned char *ivp=ctx->iv;

-

-		switch (EVP_CIPHER_CTX_mode(ctx)) {

-		case EVP_CIPH_CFB_MODE:

-			if (chunk >= AES_BLOCK_SIZE)

-				return 0; /* bogus value */

-

-			if (ctx->encrypt)

-				while (chunk<AES_BLOCK_SIZE && nbytes!=0) {

-					ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk];

-					chunk++, nbytes--;

-				}

-			else	while (chunk<AES_BLOCK_SIZE && nbytes!=0) {

-					unsigned char c = *(in_arg++);

-					*(out_arg++) = c ^ ivp[chunk];

-					ivp[chunk++] = c, nbytes--;

-				}

-

-			ctx->num = chunk%AES_BLOCK_SIZE;

-			break;

-		case EVP_CIPH_OFB_MODE:

-			if (chunk >= AES_BLOCK_SIZE)

-				return 0; /* bogus value */

-

-			while (chunk<AES_BLOCK_SIZE && nbytes!=0) {

-				*(out_arg++) = *(in_arg++) ^ ivp[chunk];

-				chunk++, nbytes--;

-			}

-

-			ctx->num = chunk%AES_BLOCK_SIZE;

-			break;

-		}

-	}

-

-	if (nbytes == 0)

-		return 1;

-#if 0

-	if (nbytes % AES_BLOCK_SIZE)

-		return 0; /* are we expected to do tail processing? */

-#else

-	/* nbytes is always multiple of AES_BLOCK_SIZE in ECB and CBC

-	   modes and arbitrary value in byte-oriented modes, such as

-	   CFB and OFB... */

-#endif

-

-	/* VIA promises CPUs that won't require alignment in the future.

-	   For now padlock_aes_align_required is initialized to 1 and

-	   the condition is never met... */

-	/* C7 core is capable to manage unaligned input in non-ECB[!]

-	   mode, but performance penalties appear to be approximately

-	   same as for software alignment below or ~3x. They promise to

-	   improve it in the future, but for now we can just as well

-	   pretend that it can only handle aligned input... */

-	if (!padlock_aes_align_required && (nbytes%AES_BLOCK_SIZE)==0)

-		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);

-

-	inp_misaligned = (((size_t)in_arg) & 0x0F);

-	out_misaligned = (((size_t)out_arg) & 0x0F);

-

-	/* Note that even if output is aligned and input not,

-	 * I still prefer to loop instead of copy the whole

-	 * input and then encrypt in one stroke. This is done

-	 * in order to improve L1 cache utilization... */

-	realign_in_loop = out_misaligned|inp_misaligned;

-

-	if (!realign_in_loop && (nbytes%AES_BLOCK_SIZE)==0)

-		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);

-

-	/* this takes one "if" out of the loops */

-	chunk  = nbytes;

-	chunk %= PADLOCK_CHUNK;

-	if (chunk==0) chunk = PADLOCK_CHUNK;

-

-	if (out_misaligned) {

-		/* optmize for small input */

-		allocated = (chunk<nbytes?PADLOCK_CHUNK:nbytes);

-		out = alloca(0x10 + allocated);

-		out = NEAREST_ALIGNED(out);

-	}

-	else

-		out = out_arg;

-

-	cdata = ALIGNED_CIPHER_DATA(ctx);

-	padlock_verify_context(cdata);

-

-	switch (EVP_CIPHER_CTX_mode(ctx)) {

-	case EVP_CIPH_ECB_MODE:

-		do	{

-			if (inp_misaligned)

-				inp = padlock_memcpy(out, in_arg, chunk);

-			else

-				inp = in_arg;

-			in_arg += chunk;

-

-			padlock_xcrypt_ecb(chunk/AES_BLOCK_SIZE, cdata, out, inp);

-

-			if (out_misaligned)

-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

-			else

-				out     = out_arg+=chunk;

-

-			nbytes -= chunk;

-			chunk   = PADLOCK_CHUNK;

-		} while (nbytes);

-		break;

-

-	case EVP_CIPH_CBC_MODE:

-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		goto cbc_shortcut;

-		do	{

-			if (iv != cdata->iv)

-				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);

-			chunk = PADLOCK_CHUNK;

-		cbc_shortcut: /* optimize for small input */

-			if (inp_misaligned)

-				inp = padlock_memcpy(out, in_arg, chunk);

-			else

-				inp = in_arg;

-			in_arg += chunk;

-

-			iv = padlock_xcrypt_cbc(chunk/AES_BLOCK_SIZE, cdata, out, inp);

-

-			if (out_misaligned)

-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

-			else

-				out     = out_arg+=chunk;

-

-		} while (nbytes -= chunk);

-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

-		break;

-

-	case EVP_CIPH_CFB_MODE:

-		memcpy (iv = cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		chunk &= ~(AES_BLOCK_SIZE-1);

-		if (chunk)	goto cfb_shortcut;

-		else		goto cfb_skiploop;

-		do	{

-			if (iv != cdata->iv)

-				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);

-			chunk = PADLOCK_CHUNK;

-		cfb_shortcut: /* optimize for small input */

-			if (inp_misaligned)

-				inp = padlock_memcpy(out, in_arg, chunk);

-			else

-				inp = in_arg;

-			in_arg += chunk;

-

-			iv = padlock_xcrypt_cfb(chunk/AES_BLOCK_SIZE, cdata, out, inp);

-

-			if (out_misaligned)

-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

-			else

-				out     = out_arg+=chunk;

-

-			nbytes -= chunk;

-		} while (nbytes >= AES_BLOCK_SIZE);

-

-		cfb_skiploop:

-		if (nbytes) {

-			unsigned char *ivp = cdata->iv;

-

-			if (iv != ivp) {

-				memcpy(ivp, iv, AES_BLOCK_SIZE);

-				iv = ivp;

-			}

-			ctx->num = nbytes;

-			if (cdata->cword.b.encdec) {

-				cdata->cword.b.encdec=0;

-				padlock_reload_key();

-				padlock_xcrypt_ecb(1,cdata,ivp,ivp);

-				cdata->cword.b.encdec=1;

-				padlock_reload_key();

-				while(nbytes) {

-					unsigned char c = *(in_arg++);

-					*(out_arg++) = c ^ *ivp;

-					*(ivp++) = c, nbytes--;

-				}

-			}

-			else {	padlock_reload_key();

-				padlock_xcrypt_ecb(1,cdata,ivp,ivp);

-				padlock_reload_key();

-				while (nbytes) {

-					*ivp = *(out_arg++) = *(in_arg++) ^ *ivp;

-					ivp++, nbytes--;

-				}

-			}

-		}

-

-		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);

-		break;

-

-	case EVP_CIPH_OFB_MODE:

-		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);

-		chunk &= ~(AES_BLOCK_SIZE-1);

-		if (chunk) do	{

-			if (inp_misaligned)

-				inp = padlock_memcpy(out, in_arg, chunk);

-			else

-				inp = in_arg;

-			in_arg += chunk;

-

-			padlock_xcrypt_ofb(chunk/AES_BLOCK_SIZE, cdata, out, inp);

-

-			if (out_misaligned)

-				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;

-			else

-				out     = out_arg+=chunk;

-

-			nbytes -= chunk;

-			chunk   = PADLOCK_CHUNK;

-		} while (nbytes >= AES_BLOCK_SIZE);

-

-		if (nbytes) {

-			unsigned char *ivp = cdata->iv;

-

-			ctx->num = nbytes;

-			padlock_reload_key();	/* empirically found */

-			padlock_xcrypt_ecb(1,cdata,ivp,ivp);

-			padlock_reload_key();	/* empirically found */

-			while (nbytes) {

-				*(out_arg++) = *(in_arg++) ^ *ivp;

-				ivp++, nbytes--;

-			}

-		}

-

-		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);

-		break;

-

-	default:

-		return 0;

-	}

-

-	/* Clean the realign buffer if it was used */

-	if (out_misaligned) {

-		volatile unsigned long *p=(void *)out;

-		size_t   n = allocated/sizeof(*p);

-		while (n--) *p++=0;

-	}

-

-	memset(cdata->iv, 0, AES_BLOCK_SIZE);

-

-	return 1;

-}

-

-#endif /* OPENSSL_NO_AES */

-

-/* ===== Random Number Generator ===== */

-/*

- * This code is not engaged. The reason is that it does not comply

- * with recommendations for VIA RNG usage for secure applications

- * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it

- * provide meaningful error control...

- */

-/* Wrapper that provides an interface between the API and 

-   the raw PadLock RNG */

-static int

-padlock_rand_bytes(unsigned char *output, int count)

-{

-	unsigned int eax, buf;

-

-	while (count >= 8) {

-		eax = padlock_xstore(output, 0);

-		if (!(eax&(1<<6)))	return 0; /* RNG disabled */

-		/* this ---vv--- covers DC bias, Raw Bits and String Filter */

-		if (eax&(0x1F<<10))	return 0;

-		if ((eax&0x1F)==0)	continue; /* no data, retry... */

-		if ((eax&0x1F)!=8)	return 0; /* fatal failure...  */

-		output += 8;

-		count  -= 8;

-	}

-	while (count > 0) {

-		eax = padlock_xstore(&buf, 3);

-		if (!(eax&(1<<6)))	return 0; /* RNG disabled */

-		/* this ---vv--- covers DC bias, Raw Bits and String Filter */

-		if (eax&(0x1F<<10))	return 0;

-		if ((eax&0x1F)==0)	continue; /* no data, retry... */

-		if ((eax&0x1F)!=1)	return 0; /* fatal failure...  */

-		*output++ = (unsigned char)buf;

-		count--;

-	}

-	*(volatile unsigned int *)&buf=0;

-

-	return 1;

-}

-

-/* Dummy but necessary function */

-static int

-padlock_rand_status(void)

-{

-	return 1;

-}

-

-/* Prepare structure for registration */

-static RAND_METHOD padlock_rand = {

-	NULL,			/* seed */

-	padlock_rand_bytes,	/* bytes */

-	NULL,			/* cleanup */

-	NULL,			/* add */

-	padlock_rand_bytes,	/* pseudorand */

-	padlock_rand_status,	/* rand status */

-};

-

-#else  /* !COMPILE_HW_PADLOCK */

-#ifndef OPENSSL_NO_DYNAMIC_ENGINE

-OPENSSL_EXPORT

-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);

-OPENSSL_EXPORT

-int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }

-IMPLEMENT_DYNAMIC_CHECK_FN()

-#endif

-#endif /* COMPILE_HW_PADLOCK */

-

-#endif /* !OPENSSL_NO_HW_PADLOCK */

-#endif /* !OPENSSL_NO_HW */

+/* 
+ * Support for VIA PadLock Advanced Cryptography Engine (ACE)
+ * Written by Michal Ludvig <michal@logix.cz>
+ *            http://www.logix.cz/michal
+ *
+ * Big thanks to Andy Polyakov for a help with optimization, 
+ * assembler fixes, port to MS Windows and a lot of other 
+ * valuable work on this engine!
+ */
+
+/* ====================================================================
+ * Copyright (c) 1999-2001 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+
+#include <stdio.h>
+#include <string.h>
+
+#include <openssl/opensslconf.h>
+#include <openssl/crypto.h>
+#include <openssl/dso.h>
+#include <openssl/engine.h>
+#include <openssl/evp.h>
+#ifndef OPENSSL_NO_AES
+#include <openssl/aes.h>
+#endif
+#include <openssl/rand.h>
+#include <openssl/err.h>
+
+#ifndef OPENSSL_NO_HW
+#ifndef OPENSSL_NO_HW_PADLOCK
+
+/* Attempt to have a single source for both 0.9.7 and 0.9.8 :-) */
+#if (OPENSSL_VERSION_NUMBER >= 0x00908000L)
+#  ifndef OPENSSL_NO_DYNAMIC_ENGINE
+#    define DYNAMIC_ENGINE
+#  endif
+#elif (OPENSSL_VERSION_NUMBER >= 0x00907000L)
+#  ifdef ENGINE_DYNAMIC_SUPPORT
+#    define DYNAMIC_ENGINE
+#  endif
+#else
+#  error "Only OpenSSL >= 0.9.7 is supported"
+#endif
+
+/* VIA PadLock AES is available *ONLY* on some x86 CPUs.
+   Not only that it doesn't exist elsewhere, but it
+   even can't be compiled on other platforms!
+ 
+   In addition, because of the heavy use of inline assembler,
+   compiler choice is limited to GCC and Microsoft C. */
+#undef COMPILE_HW_PADLOCK
+#if !defined(I386_ONLY) && !defined(OPENSSL_NO_INLINE_ASM)
+# if (defined(__GNUC__) && (defined(__i386__) || defined(__i386))) || \
+     (defined(_MSC_VER) && defined(_M_IX86))
+#  define COMPILE_HW_PADLOCK
+static ENGINE *ENGINE_padlock (void);
+# endif
+#endif
+
+#ifdef OPENSSL_NO_DYNAMIC_ENGINE
+
+void ENGINE_load_padlock (void)
+{
+/* On non-x86 CPUs it just returns. */
+#ifdef COMPILE_HW_PADLOCK
+	ENGINE *toadd = ENGINE_padlock ();
+	if (!toadd) return;
+	ENGINE_add (toadd);
+	ENGINE_free (toadd);
+	ERR_clear_error ();
+#endif
+}
+
+#endif
+
+#ifdef COMPILE_HW_PADLOCK
+/* We do these includes here to avoid header problems on platforms that
+   do not have the VIA padlock anyway... */
+#include <stdlib.h>
+#ifdef _WIN32
+# include <malloc.h>
+# ifndef alloca
+#  define alloca _alloca
+# endif
+#elif defined(__GNUC__)
+# ifndef alloca
+#  define alloca(s) __builtin_alloca(s)
+# endif
+#endif
+
+/* Function for ENGINE detection and control */
+static int padlock_available(void);
+static int padlock_init(ENGINE *e);
+
+/* RNG Stuff */
+static RAND_METHOD padlock_rand;
+
+/* Cipher Stuff */
+#ifndef OPENSSL_NO_AES
+static int padlock_ciphers(ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid);
+#endif
+
+/* Engine names */
+static const char *padlock_id = "padlock";
+static char padlock_name[100];
+
+/* Available features */
+static int padlock_use_ace = 0;	/* Advanced Cryptography Engine */
+static int padlock_use_rng = 0;	/* Random Number Generator */
+#ifndef OPENSSL_NO_AES
+static int padlock_aes_align_required = 1;
+#endif
+
+/* ===== Engine "management" functions ===== */
+
+/* Prepare the ENGINE structure for registration */
+static int
+padlock_bind_helper(ENGINE *e)
+{
+	/* Check available features */
+	padlock_available();
+
+#if 1	/* disable RNG for now, see commentary in vicinity of RNG code */
+	padlock_use_rng=0;
+#endif
+
+	/* Generate a nice engine name with available features */
+	BIO_snprintf(padlock_name, sizeof(padlock_name),
+		"VIA PadLock (%s, %s)", 
+		 padlock_use_rng ? "RNG" : "no-RNG",
+		 padlock_use_ace ? "ACE" : "no-ACE");
+
+	/* Register everything or return with an error */ 
+	if (!ENGINE_set_id(e, padlock_id) ||
+	    !ENGINE_set_name(e, padlock_name) ||
+
+	    !ENGINE_set_init_function(e, padlock_init) ||
+#ifndef OPENSSL_NO_AES
+	    (padlock_use_ace && !ENGINE_set_ciphers (e, padlock_ciphers)) ||
+#endif
+	    (padlock_use_rng && !ENGINE_set_RAND (e, &padlock_rand))) {
+		return 0;
+	}
+
+	/* Everything looks good */
+	return 1;
+}
+
+/* Constructor */
+static ENGINE *
+ENGINE_padlock(void)
+{
+	ENGINE *eng = ENGINE_new();
+
+	if (!eng) {
+		return NULL;
+	}
+
+	if (!padlock_bind_helper(eng)) {
+		ENGINE_free(eng);
+		return NULL;
+	}
+
+	return eng;
+}
+
+/* Check availability of the engine */
+static int
+padlock_init(ENGINE *e)
+{
+	return (padlock_use_rng || padlock_use_ace);
+}
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library.
+ */
+#ifdef DYNAMIC_ENGINE
+static int
+padlock_bind_fn(ENGINE *e, const char *id)
+{
+	if (id && (strcmp(id, padlock_id) != 0)) {
+		return 0;
+	}
+
+	if (!padlock_bind_helper(e))  {
+		return 0;
+	}
+
+	return 1;
+}
+
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN (padlock_bind_fn)
+#endif /* DYNAMIC_ENGINE */
+
+/* ===== Here comes the "real" engine ===== */
+
+#ifndef OPENSSL_NO_AES
+/* Some AES-related constants */
+#define AES_BLOCK_SIZE		16
+#define AES_KEY_SIZE_128	16
+#define AES_KEY_SIZE_192	24
+#define AES_KEY_SIZE_256	32
+
+/* Here we store the status information relevant to the 
+   current context. */
+/* BIG FAT WARNING:
+ * 	Inline assembler in PADLOCK_XCRYPT_ASM()
+ * 	depends on the order of items in this structure.
+ * 	Don't blindly modify, reorder, etc!
+ */
+struct padlock_cipher_data
+{
+	unsigned char iv[AES_BLOCK_SIZE];	/* Initialization vector */
+	union {	unsigned int pad[4];
+		struct {
+			int rounds:4;
+			int dgst:1;	/* n/a in C3 */
+			int align:1;	/* n/a in C3 */
+			int ciphr:1;	/* n/a in C3 */
+			unsigned int keygen:1;
+			int interm:1;
+			unsigned int encdec:1;
+			int ksize:2;
+		} b;
+	} cword;		/* Control word */
+	AES_KEY ks;		/* Encryption key */
+};
+
+/*
+ * Essentially this variable belongs in thread local storage.
+ * Having this variable global on the other hand can only cause
+ * few bogus key reloads [if any at all on single-CPU system],
+ * so we accept the penatly...
+ */
+static volatile struct padlock_cipher_data *padlock_saved_context;
+#endif
+
+/*
+ * =======================================================
+ * Inline assembler section(s).
+ * =======================================================
+ * Order of arguments is chosen to facilitate Windows port
+ * using __fastcall calling convention. If you wish to add
+ * more routines, keep in mind that first __fastcall
+ * argument is passed in %ecx and second - in %edx.
+ * =======================================================
+ */
+#if defined(__GNUC__) && __GNUC__>=2
+/*
+ * As for excessive "push %ebx"/"pop %ebx" found all over.
+ * When generating position-independent code GCC won't let
+ * us use "b" in assembler templates nor even respect "ebx"
+ * in "clobber description." Therefore the trouble...
+ */
+
+/* Helper function - check if a CPUID instruction
+   is available on this CPU */
+static int
+padlock_insn_cpuid_available(void)
+{
+	int result = -1;
+
+	/* We're checking if the bit #21 of EFLAGS 
+	   can be toggled. If yes = CPUID is available. */
+	asm volatile (
+		"pushf\n"
+		"popl %%eax\n"
+		"xorl $0x200000, %%eax\n"
+		"movl %%eax, %%ecx\n"
+		"andl $0x200000, %%ecx\n"
+		"pushl %%eax\n"
+		"popf\n"
+		"pushf\n"
+		"popl %%eax\n"
+		"andl $0x200000, %%eax\n"
+		"xorl %%eax, %%ecx\n"
+		"movl %%ecx, %0\n"
+		: "=r" (result) : : "eax", "ecx");
+	
+	return (result == 0);
+}
+
+/* Load supported features of the CPU to see if
+   the PadLock is available. */
+static int
+padlock_available(void)
+{
+	char vendor_string[16];
+	unsigned int eax, edx;
+
+	/* First check if the CPUID instruction is available at all... */
+	if (! padlock_insn_cpuid_available())
+		return 0;
+
+	/* Are we running on the Centaur (VIA) CPU? */
+	eax = 0x00000000;
+	vendor_string[12] = 0;
+	asm volatile (
+		"pushl	%%ebx\n"
+		"cpuid\n"
+		"movl	%%ebx,(%%edi)\n"
+		"movl	%%edx,4(%%edi)\n"
+		"movl	%%ecx,8(%%edi)\n"
+		"popl	%%ebx"
+		: "+a"(eax) : "D"(vendor_string) : "ecx", "edx");
+	if (strcmp(vendor_string, "CentaurHauls") != 0)
+		return 0;
+
+	/* Check for Centaur Extended Feature Flags presence */
+	eax = 0xC0000000;
+	asm volatile ("pushl %%ebx; cpuid; popl	%%ebx"
+		: "+a"(eax) : : "ecx", "edx");
+	if (eax < 0xC0000001)
+		return 0;
+
+	/* Read the Centaur Extended Feature Flags */
+	eax = 0xC0000001;
+	asm volatile ("pushl %%ebx; cpuid; popl %%ebx"
+		: "+a"(eax), "=d"(edx) : : "ecx");
+
+	/* Fill up some flags */
+	padlock_use_ace = ((edx & (0x3<<6)) == (0x3<<6));
+	padlock_use_rng = ((edx & (0x3<<2)) == (0x3<<2));
+
+	return padlock_use_ace + padlock_use_rng;
+}
+
+#ifndef OPENSSL_NO_AES
+/* Our own htonl()/ntohl() */
+static inline void
+padlock_bswapl(AES_KEY *ks)
+{
+	size_t i = sizeof(ks->rd_key)/sizeof(ks->rd_key[0]);
+	unsigned int *key = ks->rd_key;
+
+	while (i--) {
+		asm volatile ("bswapl %0" : "+r"(*key));
+		key++;
+	}
+}
+#endif
+
+/* Force key reload from memory to the CPU microcode.
+   Loading EFLAGS from the stack clears EFLAGS[30] 
+   which does the trick. */
+static inline void
+padlock_reload_key(void)
+{
+	asm volatile ("pushfl; popfl");
+}
+
+#ifndef OPENSSL_NO_AES
+/*
+ * This is heuristic key context tracing. At first one
+ * believes that one should use atomic swap instructions,
+ * but it's not actually necessary. Point is that if
+ * padlock_saved_context was changed by another thread
+ * after we've read it and before we compare it with cdata,
+ * our key *shall* be reloaded upon thread context switch
+ * and we are therefore set in either case...
+ */
+static inline void
+padlock_verify_context(struct padlock_cipher_data *cdata)
+{
+	asm volatile (
+	"pushfl\n"
+"	btl	$30,(%%esp)\n"
+"	jnc	1f\n"
+"	cmpl	%2,%1\n"
+"	je	1f\n"
+"	popfl\n"
+"	subl	$4,%%esp\n"
+"1:	addl	$4,%%esp\n"
+"	movl	%2,%0"
+	:"+m"(padlock_saved_context)
+	: "r"(padlock_saved_context), "r"(cdata) : "cc");
+}
+
+/* Template for padlock_xcrypt_* modes */
+/* BIG FAT WARNING: 
+ * 	The offsets used with 'leal' instructions
+ * 	describe items of the 'padlock_cipher_data'
+ * 	structure.
+ */
+#define PADLOCK_XCRYPT_ASM(name,rep_xcrypt)	\
+static inline void *name(size_t cnt,		\
+	struct padlock_cipher_data *cdata,	\
+	void *out, const void *inp) 		\
+{	void *iv; 				\
+	asm volatile ( "pushl	%%ebx\n"	\
+		"	leal	16(%0),%%edx\n"	\
+		"	leal	32(%0),%%ebx\n"	\
+			rep_xcrypt "\n"		\
+		"	popl	%%ebx"		\
+		: "=a"(iv), "=c"(cnt), "=D"(out), "=S"(inp) \
+		: "0"(cdata), "1"(cnt), "2"(out), "3"(inp)  \
+		: "edx", "cc", "memory");	\
+	return iv;				\
+}
+
+/* Generate all functions with appropriate opcodes */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb, ".byte 0xf3,0x0f,0xa7,0xc8")	/* rep xcryptecb */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc, ".byte 0xf3,0x0f,0xa7,0xd0")	/* rep xcryptcbc */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb, ".byte 0xf3,0x0f,0xa7,0xe0")	/* rep xcryptcfb */
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb, ".byte 0xf3,0x0f,0xa7,0xe8")	/* rep xcryptofb */
+#endif
+
+/* The RNG call itself */
+static inline unsigned int
+padlock_xstore(void *addr, unsigned int edx_in)
+{
+	unsigned int eax_out;
+
+	asm volatile (".byte 0x0f,0xa7,0xc0"	/* xstore */
+	    : "=a"(eax_out),"=m"(*(unsigned *)addr)
+	    : "D"(addr), "d" (edx_in)
+	    );
+
+	return eax_out;
+}
+
+/* Why not inline 'rep movsd'? I failed to find information on what
+ * value in Direction Flag one can expect and consequently have to
+ * apply "better-safe-than-sorry" approach and assume "undefined."
+ * I could explicitly clear it and restore the original value upon
+ * return from padlock_aes_cipher, but it's presumably too much
+ * trouble for too little gain...
+ *
+ * In case you wonder 'rep xcrypt*' instructions above are *not*
+ * affected by the Direction Flag and pointers advance toward
+ * larger addresses unconditionally.
+ */ 
+static inline unsigned char *
+padlock_memcpy(void *dst,const void *src,size_t n)
+{
+	long       *d=dst;
+	const long *s=src;
+
+	n /= sizeof(*d);
+	do { *d++ = *s++; } while (--n);
+
+	return dst;
+}
+
+#elif defined(_MSC_VER)
+/*
+ * Unlike GCC these are real functions. In order to minimize impact
+ * on performance we adhere to __fastcall calling convention in
+ * order to get two first arguments passed through %ecx and %edx.
+ * Which kind of suits very well, as instructions in question use
+ * both %ecx and %edx as input:-)
+ */
+#define REP_XCRYPT(code)		\
+	_asm _emit 0xf3			\
+	_asm _emit 0x0f _asm _emit 0xa7	\
+	_asm _emit code
+
+/* BIG FAT WARNING: 
+ * 	The offsets used with 'lea' instructions
+ * 	describe items of the 'padlock_cipher_data'
+ * 	structure.
+ */
+#define PADLOCK_XCRYPT_ASM(name,code)	\
+static void * __fastcall 		\
+	name (size_t cnt, void *cdata,	\
+	void *outp, const void *inp)	\
+{	_asm	mov	eax,edx		\
+	_asm	lea	edx,[eax+16]	\
+	_asm	lea	ebx,[eax+32]	\
+	_asm	mov	edi,outp	\
+	_asm	mov	esi,inp		\
+	REP_XCRYPT(code)		\
+}
+
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ecb,0xc8)
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cbc,0xd0)
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_cfb,0xe0)
+PADLOCK_XCRYPT_ASM(padlock_xcrypt_ofb,0xe8)
+
+static int __fastcall
+padlock_xstore(void *outp,unsigned int code)
+{	_asm	mov	edi,ecx
+	_asm _emit 0x0f _asm _emit 0xa7 _asm _emit 0xc0
+}
+
+static void __fastcall
+padlock_reload_key(void)
+{	_asm pushfd _asm popfd		}
+
+static void __fastcall
+padlock_verify_context(void *cdata)
+{	_asm	{
+		pushfd
+		bt	DWORD PTR[esp],30
+		jnc	skip
+		cmp	ecx,padlock_saved_context
+		je	skip
+		popfd
+		sub	esp,4
+	skip:	add	esp,4
+		mov	padlock_saved_context,ecx
+		}
+}
+
+static int
+padlock_available(void)
+{	_asm	{
+		pushfd
+		pop	eax
+		mov	ecx,eax
+		xor	eax,1<<21
+		push	eax
+		popfd
+		pushfd
+		pop	eax
+		xor	eax,ecx
+		bt	eax,21
+		jnc	noluck
+		mov	eax,0
+		cpuid
+		xor	eax,eax
+		cmp	ebx,'tneC'
+		jne	noluck
+		cmp	edx,'Hrua'
+		jne	noluck
+		cmp	ecx,'slua'
+		jne	noluck
+		mov	eax,0xC0000000
+		cpuid
+		mov	edx,eax
+		xor	eax,eax
+		cmp	edx,0xC0000001
+		jb	noluck
+		mov	eax,0xC0000001
+		cpuid
+		xor	eax,eax
+		bt	edx,6
+		jnc	skip_a
+		bt	edx,7
+		jnc	skip_a
+		mov	padlock_use_ace,1
+		inc	eax
+	skip_a:	bt	edx,2
+		jnc	skip_r
+		bt	edx,3
+		jnc	skip_r
+		mov	padlock_use_rng,1
+		inc	eax
+	skip_r:
+	noluck:
+		}
+}
+
+static void __fastcall
+padlock_bswapl(void *key)
+{	_asm	{
+		pushfd
+		cld
+		mov	esi,ecx
+		mov	edi,ecx
+		mov	ecx,60
+	up:	lodsd
+		bswap	eax
+		stosd
+		loop	up
+		popfd
+		}
+}
+
+/* MS actually specifies status of Direction Flag and compiler even
+ * manages to compile following as 'rep movsd' all by itself...
+ */
+#define padlock_memcpy(o,i,n) ((unsigned char *)memcpy((o),(i),(n)&~3U))
+#endif
+
+/* ===== AES encryption/decryption ===== */
+#ifndef OPENSSL_NO_AES
+
+#if defined(NID_aes_128_cfb128) && ! defined (NID_aes_128_cfb)
+#define NID_aes_128_cfb	NID_aes_128_cfb128
+#endif
+
+#if defined(NID_aes_128_ofb128) && ! defined (NID_aes_128_ofb)
+#define NID_aes_128_ofb	NID_aes_128_ofb128
+#endif
+
+#if defined(NID_aes_192_cfb128) && ! defined (NID_aes_192_cfb)
+#define NID_aes_192_cfb	NID_aes_192_cfb128
+#endif
+
+#if defined(NID_aes_192_ofb128) && ! defined (NID_aes_192_ofb)
+#define NID_aes_192_ofb	NID_aes_192_ofb128
+#endif
+
+#if defined(NID_aes_256_cfb128) && ! defined (NID_aes_256_cfb)
+#define NID_aes_256_cfb	NID_aes_256_cfb128
+#endif
+
+#if defined(NID_aes_256_ofb128) && ! defined (NID_aes_256_ofb)
+#define NID_aes_256_ofb	NID_aes_256_ofb128
+#endif
+
+/* List of supported ciphers. */
+static int padlock_cipher_nids[] = {
+	NID_aes_128_ecb,
+	NID_aes_128_cbc,
+	NID_aes_128_cfb,
+	NID_aes_128_ofb,
+
+	NID_aes_192_ecb,
+	NID_aes_192_cbc,
+	NID_aes_192_cfb,
+	NID_aes_192_ofb,
+
+	NID_aes_256_ecb,
+	NID_aes_256_cbc,
+	NID_aes_256_cfb,
+	NID_aes_256_ofb,
+};
+static int padlock_cipher_nids_num = (sizeof(padlock_cipher_nids)/
+				      sizeof(padlock_cipher_nids[0]));
+
+/* Function prototypes ... */
+static int padlock_aes_init_key(EVP_CIPHER_CTX *ctx, const unsigned char *key,
+				const unsigned char *iv, int enc);
+static int padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,
+			      const unsigned char *in, size_t nbytes);
+
+#define NEAREST_ALIGNED(ptr) ( (unsigned char *)(ptr) +		\
+	( (0x10 - ((size_t)(ptr) & 0x0F)) & 0x0F )	)
+#define ALIGNED_CIPHER_DATA(ctx) ((struct padlock_cipher_data *)\
+	NEAREST_ALIGNED(ctx->cipher_data))
+
+#define EVP_CIPHER_block_size_ECB	AES_BLOCK_SIZE
+#define EVP_CIPHER_block_size_CBC	AES_BLOCK_SIZE
+#define EVP_CIPHER_block_size_OFB	1
+#define EVP_CIPHER_block_size_CFB	1
+
+/* Declaring so many ciphers by hand would be a pain.
+   Instead introduce a bit of preprocessor magic :-) */
+#define	DECLARE_AES_EVP(ksize,lmode,umode)	\
+static const EVP_CIPHER padlock_aes_##ksize##_##lmode = {	\
+	NID_aes_##ksize##_##lmode,		\
+	EVP_CIPHER_block_size_##umode,	\
+	AES_KEY_SIZE_##ksize,		\
+	AES_BLOCK_SIZE,			\
+	0 | EVP_CIPH_##umode##_MODE,	\
+	padlock_aes_init_key,		\
+	padlock_aes_cipher,		\
+	NULL,				\
+	sizeof(struct padlock_cipher_data) + 16,	\
+	EVP_CIPHER_set_asn1_iv,		\
+	EVP_CIPHER_get_asn1_iv,		\
+	NULL,				\
+	NULL				\
+}
+
+DECLARE_AES_EVP(128,ecb,ECB);
+DECLARE_AES_EVP(128,cbc,CBC);
+DECLARE_AES_EVP(128,cfb,CFB);
+DECLARE_AES_EVP(128,ofb,OFB);
+
+DECLARE_AES_EVP(192,ecb,ECB);
+DECLARE_AES_EVP(192,cbc,CBC);
+DECLARE_AES_EVP(192,cfb,CFB);
+DECLARE_AES_EVP(192,ofb,OFB);
+
+DECLARE_AES_EVP(256,ecb,ECB);
+DECLARE_AES_EVP(256,cbc,CBC);
+DECLARE_AES_EVP(256,cfb,CFB);
+DECLARE_AES_EVP(256,ofb,OFB);
+
+static int
+padlock_ciphers (ENGINE *e, const EVP_CIPHER **cipher, const int **nids, int nid)
+{
+	/* No specific cipher => return a list of supported nids ... */
+	if (!cipher) {
+		*nids = padlock_cipher_nids;
+		return padlock_cipher_nids_num;
+	}
+
+	/* ... or the requested "cipher" otherwise */
+	switch (nid) {
+	  case NID_aes_128_ecb:
+	    *cipher = &padlock_aes_128_ecb;
+	    break;
+	  case NID_aes_128_cbc:
+	    *cipher = &padlock_aes_128_cbc;
+	    break;
+	  case NID_aes_128_cfb:
+	    *cipher = &padlock_aes_128_cfb;
+	    break;
+	  case NID_aes_128_ofb:
+	    *cipher = &padlock_aes_128_ofb;
+	    break;
+
+	  case NID_aes_192_ecb:
+	    *cipher = &padlock_aes_192_ecb;
+	    break;
+	  case NID_aes_192_cbc:
+	    *cipher = &padlock_aes_192_cbc;
+	    break;
+	  case NID_aes_192_cfb:
+	    *cipher = &padlock_aes_192_cfb;
+	    break;
+	  case NID_aes_192_ofb:
+	    *cipher = &padlock_aes_192_ofb;
+	    break;
+
+	  case NID_aes_256_ecb:
+	    *cipher = &padlock_aes_256_ecb;
+	    break;
+	  case NID_aes_256_cbc:
+	    *cipher = &padlock_aes_256_cbc;
+	    break;
+	  case NID_aes_256_cfb:
+	    *cipher = &padlock_aes_256_cfb;
+	    break;
+	  case NID_aes_256_ofb:
+	    *cipher = &padlock_aes_256_ofb;
+	    break;
+
+	  default:
+	    /* Sorry, we don't support this NID */
+	    *cipher = NULL;
+	    return 0;
+	}
+
+	return 1;
+}
+
+/* Prepare the encryption key for PadLock usage */
+static int
+padlock_aes_init_key (EVP_CIPHER_CTX *ctx, const unsigned char *key,
+		      const unsigned char *iv, int enc)
+{
+	struct padlock_cipher_data *cdata;
+	int key_len = EVP_CIPHER_CTX_key_length(ctx) * 8;
+
+	if (key==NULL) return 0;	/* ERROR */
+
+	cdata = ALIGNED_CIPHER_DATA(ctx);
+	memset(cdata, 0, sizeof(struct padlock_cipher_data));
+
+	/* Prepare Control word. */
+	if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE)
+		cdata->cword.b.encdec = 0;
+	else
+		cdata->cword.b.encdec = (ctx->encrypt == 0);
+	cdata->cword.b.rounds = 10 + (key_len - 128) / 32;
+	cdata->cword.b.ksize = (key_len - 128) / 64;
+
+	switch(key_len) {
+		case 128:
+			/* PadLock can generate an extended key for
+			   AES128 in hardware */
+			memcpy(cdata->ks.rd_key, key, AES_KEY_SIZE_128);
+			cdata->cword.b.keygen = 0;
+			break;
+
+		case 192:
+		case 256:
+			/* Generate an extended AES key in software.
+			   Needed for AES192/AES256 */
+			/* Well, the above applies to Stepping 8 CPUs
+			   and is listed as hardware errata. They most
+			   likely will fix it at some point and then
+			   a check for stepping would be due here. */
+			if (EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_CFB_MODE ||
+			    EVP_CIPHER_CTX_mode(ctx) == EVP_CIPH_OFB_MODE ||
+			    enc)
+				AES_set_encrypt_key(key, key_len, &cdata->ks);
+			else
+				AES_set_decrypt_key(key, key_len, &cdata->ks);
+#ifndef AES_ASM
+			/* OpenSSL C functions use byte-swapped extended key. */
+			padlock_bswapl(&cdata->ks);
+#endif
+			cdata->cword.b.keygen = 1;
+			break;
+
+		default:
+			/* ERROR */
+			return 0;
+	}
+
+	/*
+	 * This is done to cover for cases when user reuses the
+	 * context for new key. The catch is that if we don't do
+	 * this, padlock_eas_cipher might proceed with old key...
+	 */
+	padlock_reload_key ();
+
+	return 1;
+}
+
+/* 
+ * Simplified version of padlock_aes_cipher() used when
+ * 1) both input and output buffers are at aligned addresses.
+ * or when
+ * 2) running on a newer CPU that doesn't require aligned buffers.
+ */
+static int
+padlock_aes_cipher_omnivorous(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
+		const unsigned char *in_arg, size_t nbytes)
+{
+	struct padlock_cipher_data *cdata;
+	void  *iv;
+
+	cdata = ALIGNED_CIPHER_DATA(ctx);
+	padlock_verify_context(cdata);
+
+	switch (EVP_CIPHER_CTX_mode(ctx)) {
+	case EVP_CIPH_ECB_MODE:
+		padlock_xcrypt_ecb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+		break;
+
+	case EVP_CIPH_CBC_MODE:
+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		iv = padlock_xcrypt_cbc(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+		break;
+
+	case EVP_CIPH_CFB_MODE:
+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		iv = padlock_xcrypt_cfb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+		break;
+
+	case EVP_CIPH_OFB_MODE:
+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		padlock_xcrypt_ofb(nbytes/AES_BLOCK_SIZE, cdata, out_arg, in_arg);
+		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
+		break;
+
+	default:
+		return 0;
+	}
+
+	memset(cdata->iv, 0, AES_BLOCK_SIZE);
+
+	return 1;
+}
+
+#ifndef  PADLOCK_CHUNK
+# define PADLOCK_CHUNK	512	/* Must be a power of 2 larger than 16 */
+#endif
+#if PADLOCK_CHUNK<16 || PADLOCK_CHUNK&(PADLOCK_CHUNK-1)
+# error "insane PADLOCK_CHUNK..."
+#endif
+
+/* Re-align the arguments to 16-Bytes boundaries and run the 
+   encryption function itself. This function is not AES-specific. */
+static int
+padlock_aes_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out_arg,
+		   const unsigned char *in_arg, size_t nbytes)
+{
+	struct padlock_cipher_data *cdata;
+	const  void *inp;
+	unsigned char  *out;
+	void  *iv;
+	int    inp_misaligned, out_misaligned, realign_in_loop;
+	size_t chunk, allocated=0;
+
+	/* ctx->num is maintained in byte-oriented modes,
+	   such as CFB and OFB... */
+	if ((chunk = ctx->num)) { /* borrow chunk variable */
+		unsigned char *ivp=ctx->iv;
+
+		switch (EVP_CIPHER_CTX_mode(ctx)) {
+		case EVP_CIPH_CFB_MODE:
+			if (chunk >= AES_BLOCK_SIZE)
+				return 0; /* bogus value */
+
+			if (ctx->encrypt)
+				while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
+					ivp[chunk] = *(out_arg++) = *(in_arg++) ^ ivp[chunk];
+					chunk++, nbytes--;
+				}
+			else	while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
+					unsigned char c = *(in_arg++);
+					*(out_arg++) = c ^ ivp[chunk];
+					ivp[chunk++] = c, nbytes--;
+				}
+
+			ctx->num = chunk%AES_BLOCK_SIZE;
+			break;
+		case EVP_CIPH_OFB_MODE:
+			if (chunk >= AES_BLOCK_SIZE)
+				return 0; /* bogus value */
+
+			while (chunk<AES_BLOCK_SIZE && nbytes!=0) {
+				*(out_arg++) = *(in_arg++) ^ ivp[chunk];
+				chunk++, nbytes--;
+			}
+
+			ctx->num = chunk%AES_BLOCK_SIZE;
+			break;
+		}
+	}
+
+	if (nbytes == 0)
+		return 1;
+#if 0
+	if (nbytes % AES_BLOCK_SIZE)
+		return 0; /* are we expected to do tail processing? */
+#else
+	/* nbytes is always multiple of AES_BLOCK_SIZE in ECB and CBC
+	   modes and arbitrary value in byte-oriented modes, such as
+	   CFB and OFB... */
+#endif
+
+	/* VIA promises CPUs that won't require alignment in the future.
+	   For now padlock_aes_align_required is initialized to 1 and
+	   the condition is never met... */
+	/* C7 core is capable to manage unaligned input in non-ECB[!]
+	   mode, but performance penalties appear to be approximately
+	   same as for software alignment below or ~3x. They promise to
+	   improve it in the future, but for now we can just as well
+	   pretend that it can only handle aligned input... */
+	if (!padlock_aes_align_required && (nbytes%AES_BLOCK_SIZE)==0)
+		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);
+
+	inp_misaligned = (((size_t)in_arg) & 0x0F);
+	out_misaligned = (((size_t)out_arg) & 0x0F);
+
+	/* Note that even if output is aligned and input not,
+	 * I still prefer to loop instead of copy the whole
+	 * input and then encrypt in one stroke. This is done
+	 * in order to improve L1 cache utilization... */
+	realign_in_loop = out_misaligned|inp_misaligned;
+
+	if (!realign_in_loop && (nbytes%AES_BLOCK_SIZE)==0)
+		return padlock_aes_cipher_omnivorous(ctx, out_arg, in_arg, nbytes);
+
+	/* this takes one "if" out of the loops */
+	chunk  = nbytes;
+	chunk %= PADLOCK_CHUNK;
+	if (chunk==0) chunk = PADLOCK_CHUNK;
+
+	if (out_misaligned) {
+		/* optmize for small input */
+		allocated = (chunk<nbytes?PADLOCK_CHUNK:nbytes);
+		out = alloca(0x10 + allocated);
+		out = NEAREST_ALIGNED(out);
+	}
+	else
+		out = out_arg;
+
+	cdata = ALIGNED_CIPHER_DATA(ctx);
+	padlock_verify_context(cdata);
+
+	switch (EVP_CIPHER_CTX_mode(ctx)) {
+	case EVP_CIPH_ECB_MODE:
+		do	{
+			if (inp_misaligned)
+				inp = padlock_memcpy(out, in_arg, chunk);
+			else
+				inp = in_arg;
+			in_arg += chunk;
+
+			padlock_xcrypt_ecb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+			if (out_misaligned)
+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+			else
+				out     = out_arg+=chunk;
+
+			nbytes -= chunk;
+			chunk   = PADLOCK_CHUNK;
+		} while (nbytes);
+		break;
+
+	case EVP_CIPH_CBC_MODE:
+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		goto cbc_shortcut;
+		do	{
+			if (iv != cdata->iv)
+				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);
+			chunk = PADLOCK_CHUNK;
+		cbc_shortcut: /* optimize for small input */
+			if (inp_misaligned)
+				inp = padlock_memcpy(out, in_arg, chunk);
+			else
+				inp = in_arg;
+			in_arg += chunk;
+
+			iv = padlock_xcrypt_cbc(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+			if (out_misaligned)
+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+			else
+				out     = out_arg+=chunk;
+
+		} while (nbytes -= chunk);
+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+		break;
+
+	case EVP_CIPH_CFB_MODE:
+		memcpy (iv = cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		chunk &= ~(AES_BLOCK_SIZE-1);
+		if (chunk)	goto cfb_shortcut;
+		else		goto cfb_skiploop;
+		do	{
+			if (iv != cdata->iv)
+				memcpy(cdata->iv, iv, AES_BLOCK_SIZE);
+			chunk = PADLOCK_CHUNK;
+		cfb_shortcut: /* optimize for small input */
+			if (inp_misaligned)
+				inp = padlock_memcpy(out, in_arg, chunk);
+			else
+				inp = in_arg;
+			in_arg += chunk;
+
+			iv = padlock_xcrypt_cfb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+			if (out_misaligned)
+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+			else
+				out     = out_arg+=chunk;
+
+			nbytes -= chunk;
+		} while (nbytes >= AES_BLOCK_SIZE);
+
+		cfb_skiploop:
+		if (nbytes) {
+			unsigned char *ivp = cdata->iv;
+
+			if (iv != ivp) {
+				memcpy(ivp, iv, AES_BLOCK_SIZE);
+				iv = ivp;
+			}
+			ctx->num = nbytes;
+			if (cdata->cword.b.encdec) {
+				cdata->cword.b.encdec=0;
+				padlock_reload_key();
+				padlock_xcrypt_ecb(1,cdata,ivp,ivp);
+				cdata->cword.b.encdec=1;
+				padlock_reload_key();
+				while(nbytes) {
+					unsigned char c = *(in_arg++);
+					*(out_arg++) = c ^ *ivp;
+					*(ivp++) = c, nbytes--;
+				}
+			}
+			else {	padlock_reload_key();
+				padlock_xcrypt_ecb(1,cdata,ivp,ivp);
+				padlock_reload_key();
+				while (nbytes) {
+					*ivp = *(out_arg++) = *(in_arg++) ^ *ivp;
+					ivp++, nbytes--;
+				}
+			}
+		}
+
+		memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
+		break;
+
+	case EVP_CIPH_OFB_MODE:
+		memcpy(cdata->iv, ctx->iv, AES_BLOCK_SIZE);
+		chunk &= ~(AES_BLOCK_SIZE-1);
+		if (chunk) do	{
+			if (inp_misaligned)
+				inp = padlock_memcpy(out, in_arg, chunk);
+			else
+				inp = in_arg;
+			in_arg += chunk;
+
+			padlock_xcrypt_ofb(chunk/AES_BLOCK_SIZE, cdata, out, inp);
+
+			if (out_misaligned)
+				out_arg = padlock_memcpy(out_arg, out, chunk) + chunk;
+			else
+				out     = out_arg+=chunk;
+
+			nbytes -= chunk;
+			chunk   = PADLOCK_CHUNK;
+		} while (nbytes >= AES_BLOCK_SIZE);
+
+		if (nbytes) {
+			unsigned char *ivp = cdata->iv;
+
+			ctx->num = nbytes;
+			padlock_reload_key();	/* empirically found */
+			padlock_xcrypt_ecb(1,cdata,ivp,ivp);
+			padlock_reload_key();	/* empirically found */
+			while (nbytes) {
+				*(out_arg++) = *(in_arg++) ^ *ivp;
+				ivp++, nbytes--;
+			}
+		}
+
+		memcpy(ctx->iv, cdata->iv, AES_BLOCK_SIZE);
+		break;
+
+	default:
+		return 0;
+	}
+
+	/* Clean the realign buffer if it was used */
+	if (out_misaligned) {
+		volatile unsigned long *p=(void *)out;
+		size_t   n = allocated/sizeof(*p);
+		while (n--) *p++=0;
+	}
+
+	memset(cdata->iv, 0, AES_BLOCK_SIZE);
+
+	return 1;
+}
+
+#endif /* OPENSSL_NO_AES */
+
+/* ===== Random Number Generator ===== */
+/*
+ * This code is not engaged. The reason is that it does not comply
+ * with recommendations for VIA RNG usage for secure applications
+ * (posted at http://www.via.com.tw/en/viac3/c3.jsp) nor does it
+ * provide meaningful error control...
+ */
+/* Wrapper that provides an interface between the API and 
+   the raw PadLock RNG */
+static int
+padlock_rand_bytes(unsigned char *output, int count)
+{
+	unsigned int eax, buf;
+
+	while (count >= 8) {
+		eax = padlock_xstore(output, 0);
+		if (!(eax&(1<<6)))	return 0; /* RNG disabled */
+		/* this ---vv--- covers DC bias, Raw Bits and String Filter */
+		if (eax&(0x1F<<10))	return 0;
+		if ((eax&0x1F)==0)	continue; /* no data, retry... */
+		if ((eax&0x1F)!=8)	return 0; /* fatal failure...  */
+		output += 8;
+		count  -= 8;
+	}
+	while (count > 0) {
+		eax = padlock_xstore(&buf, 3);
+		if (!(eax&(1<<6)))	return 0; /* RNG disabled */
+		/* this ---vv--- covers DC bias, Raw Bits and String Filter */
+		if (eax&(0x1F<<10))	return 0;
+		if ((eax&0x1F)==0)	continue; /* no data, retry... */
+		if ((eax&0x1F)!=1)	return 0; /* fatal failure...  */
+		*output++ = (unsigned char)buf;
+		count--;
+	}
+	*(volatile unsigned int *)&buf=0;
+
+	return 1;
+}
+
+/* Dummy but necessary function */
+static int
+padlock_rand_status(void)
+{
+	return 1;
+}
+
+/* Prepare structure for registration */
+static RAND_METHOD padlock_rand = {
+	NULL,			/* seed */
+	padlock_rand_bytes,	/* bytes */
+	NULL,			/* cleanup */
+	NULL,			/* add */
+	padlock_rand_bytes,	/* pseudorand */
+	padlock_rand_status,	/* rand status */
+};
+
+#else  /* !COMPILE_HW_PADLOCK */
+#ifndef OPENSSL_NO_DYNAMIC_ENGINE
+OPENSSL_EXPORT
+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns);
+OPENSSL_EXPORT
+int bind_engine(ENGINE *e, const char *id, const dynamic_fns *fns) { return 0; }
+IMPLEMENT_DYNAMIC_CHECK_FN()
+#endif
+#endif /* COMPILE_HW_PADLOCK */
+
+#endif /* !OPENSSL_NO_HW_PADLOCK */
+#endif /* !OPENSSL_NO_HW */
diff --git a/openssl/engines/makeengines.com b/openssl/engines/makeengines.com
index a7e4aa86d..0d3174257 100644
--- a/openssl/engines/makeengines.com
+++ b/openssl/engines/makeengines.com
@@ -1,1021 +1,1021 @@
-$!

-$!  MAKEENGINES.COM

-$!  Written By:  Richard Levitte

-$!               richard@levitte.org

-$!

-$!  This command file compiles and creates the various engines in form

-$!  of shared images.  They are placed in [.xxx.EXE.ENGINES], where "xxx"

-$!  is ALPHA, IA64 or VAX, depending on your hardware.

-$!

-$!  P1	if this is ENGINES or ALL, the engines will build, otherwise not.

-$!

-$!  P2	DEBUG or NODEBUG to compile with or without debugger information.

-$!

-$!  P3  VAXC		for VAX C

-$!	DECC		for DEC C

-$!	GNUC		for GNU C (untested)

-$!

-$!  P4	if defined, sets the TCP/IP libraries to use.  UCX or TCPIP is

-$!	used by default since most other implementations come with a

-$!	compatibility library.  The value must be one of the following:

-$!

-$!	UCX		for UCX

-$!	SOCKETSHR	for SOCKETSHR+NETLIB

-$!	TCPIP		for TCPIP (post UCX)

-$!

-$!  P5	if defined, tells the compiler not to use special threads.

-$!

-$!  P6	if defined, denotes which engines to build.  If not defined,

-$!	all available engines are built.

-$!

-$!  For 64 bit architectures (Alpha and IA64), specify the pointer size as P7.

-$!  For 32 bit architectures (VAX), P7 is ignored.

-$!  Currently supported values are:

-$!

-$!	32	To ge a library compiled with /POINTER_SIZE=32

-$!	64	To ge a library compiled with /POINTER_SIZE=64

-$!

-$!-----------------------------------------------------------------------------

-$!

-$! Set the default TCP/IP library to link against if needed

-$!

-$ TCPIP_LIB = ""

-$!

-$! Check What Architecture We Are Using.

-$!

-$ IF (F$GETSYI("CPU").LT.128)

-$ THEN

-$!

-$!  The Architecture Is VAX.

-$!

-$   ARCH = "VAX"

-$!

-$! Else...

-$!

-$ ELSE

-$!

-$!  The Architecture Is Alpha, IA64 or whatever comes in the future.

-$!

-$   ARCH = F$EDIT( F$GETSYI( "ARCH_NAME"), "UPCASE")

-$   IF (ARCH .EQS. "") THEN ARCH = "UNK"

-$!

-$! End The Architecture Check.

-$!

-$ ENDIF

-$!

-$! Set the names of the engines we want to build

-$! NOTE: Some might think this list ugly.  However, it's made this way to

-$! reflect the LIBNAMES variable in Makefile as closely as possible,

-$! thereby making it fairly easy to verify that the lists are the same.

-$! NOTE: gmp isn't built, as it's mostly a test engine and brings in another

-$! library that isn't necessarely ported to VMS.

-$!

-$ ENGINES = "," + P6

-$ IF ENGINES .EQS. "," THEN -

-	ENGINES = ",4758cca,aep,atalla,cswift,chil,nuron,sureware,ubsec,padlock,"

-$!

-$! GOST requires a 64-bit integer type, unavailable on VAX.

-$!

-$ IF (ARCH .NES. "VAX") THEN -

-       ENGINES = ENGINES+ ",ccgost"

-$!

-$! Set the goal directories, and create them if necessary

-$!

-$ OBJ_DIR := SYS$DISK:[-.'ARCH'.OBJ.ENGINES]

-$ EXE_DIR := SYS$DISK:[-.'ARCH'.EXE.ENGINES]

-$ IF F$PARSE(OBJ_DIR) .EQS. "" THEN CREATE/DIRECTORY 'OBJ_DIR'

-$ IF F$PARSE(EXE_DIR) .EQS. "" THEN CREATE/DIRECTORY 'EXE_DIR'

-$!

-$! Set the goal files, and create them if necessary

-$!

-$ CRYPTO_LIB :=SYS$DISK:[-.'ARCH'.EXE.CRYPTO]LIBCRYPTO'LIB32'.OLB

-$ IF F$SEARCH(CRYPTO_LIB) .EQS. "" THEN LIBRARY/CREATE/OBJECT 'CRYPTO_LIB'

-$!

-$! OK, time to check options and initialise

-$!

-$ OPT_PHASE = P1

-$ ACCEPT_PHASE = "ALL,ENGINES"

-$ OPT_DEBUG = P2

-$ OPT_COMPILER = P3

-$ OPT_TCPIP_LIB = P4

-$ OPT_SPECIAL_THREADS = P5

-$ OPT_POINTER_SIZE = P7

-$

-$ GOSUB CHECK_OPTIONS

-$ GOSUB INITIALISE

-$ GOSUB CHECK_OPT_FILE

-$!

-$! Define what goes into each engine.  VAX includes a transfer vector.

-$!

-$ ENGINE_ = ""

-$ TV_OBJ = ""

-$ IF ARCH .EQS. "VAX"

-$ THEN

-$   ENGINE_ = "engine_vector.mar"

-$   TV_OBJ_NAME = OBJ_DIR + F$PARSE(ENGINE_,,,"NAME","SYNTAX_ONLY") + ".OBJ"

-$   TV_OBJ = ",''TV_OBJ_NAME'"

-$ ENDIF

-$ ENGINE_4758CCA = "e_4758cca"

-$ ENGINE_aep = "e_aep"

-$ ENGINE_atalla = "e_atalla"

-$ ENGINE_cswift = "e_cswift"

-$ ENGINE_chil = "e_chil"

-$ ENGINE_nuron = "e_nuron"

-$ ENGINE_sureware = "e_sureware"

-$ ENGINE_ubsec = "e_ubsec"

-$ ENGINE_padlock = "e_padlock"

-$

-$ ENGINE_ccgost_SUBDIR = "ccgost"

-$ ENGINE_ccgost = "e_gost_err,gost2001_keyx,gost2001,gost89,gost94_keyx,"+ -

-		  "gost_ameth,gost_asn1,gost_crypt,gost_ctl,gost_eng,"+ -

-		  "gosthash,gost_keywrap,gost_md,gost_params,gost_pmeth,"+ -

-		  "gost_sign"

-$!

-$! Define which programs need to be linked with a TCP/IP library

-$!

-$ TCPIP_ENGINES = ",,"

-$ IF COMPILER .EQS. "VAXC" THEN -

-     TCPIP_ENGINES = ",,"

-$!

-$! Set up two loops, one that keeps track of the engines,

-$! and one that keeps track of all the files going into

-$! the current engine.

-$!

-$! Here's the start of the engine loop.

-$!

-$ ENGINE_COUNTER = 0

-$ ENGINE_NEXT:

-$!

-$! Extract the current engine name, and if we've reached the end, stop

-$!

-$ ENGINE_NAME = F$ELEMENT(ENGINE_COUNTER,",",ENGINES)

-$ IF (ENGINE_NAME.EQS.",") THEN GOTO ENGINE_DONE

-$!

-$ ENGINE_COUNTER = ENGINE_COUNTER + 1

-$!

-$! Set up the engine library names.

-$!

-$ LIB_ENGINE = "ENGINE_" + ENGINE_NAME

-$!

-$! Check if the library module name actually is defined

-$!

-$ IF F$TYPE('LIB_ENGINE') .EQS. ""

-$ THEN

-$   WRITE SYS$ERROR ""

-$   WRITE SYS$ERROR "The module ",ENGINE_NAME," does not exist.  Continuing..."

-$   WRITE SYS$ERROR ""

-$   GOTO ENGINE_NEXT

-$ ENDIF

-$!

-$! Talk to the user

-$!

-$ IF ENGINE_NAME .NES. ""

-$ THEN

-$   WRITE SYS$OUTPUT "Compiling The ",ENGINE_NAME," Library Files. (",BUILDALL,")"

-$ ELSE

-$   WRITE SYS$OUTPUT "Compiling Support Files. (",BUILDALL,")"

-$ ENDIF

-$!

-$! Create a .OPT file for the object files (for a real engine name).

-$!

-$ IF ENGINE_NAME .NES. ""

-$ THEN

-$   OPEN/WRITE OBJECTS 'EXE_DIR''ENGINE_NAME'.OPT

-$ ENDIF

-$!

-$! Here's the start of per-engine module loop.

-$!

-$ FILE_COUNTER = 0

-$ FILE_NEXT:

-$!

-$! Extract the file name from the file list, and if we've reached the end, stop

-$!

-$ FILE_NAME = F$ELEMENT(FILE_COUNTER,",",'LIB_ENGINE')

-$ IF (FILE_NAME.EQS.",") THEN GOTO FILE_DONE

-$!

-$ FILE_COUNTER = FILE_COUNTER + 1

-$!

-$ IF FILE_NAME .EQS. "" THEN GOTO FILE_NEXT

-$!

-$! Set up the source and object reference

-$!

-$ IF F$TYPE('LIB_ENGINE'_SUBDIR) .EQS. ""

-$ THEN

-$     SOURCE_FILE = F$PARSE(FILE_NAME,"SYS$DISK:[].C",,,"SYNTAX_ONLY")

-$ ELSE

-$     SOURCE_FILE = F$PARSE(FILE_NAME,"SYS$DISK:[."+'LIB_ENGINE'_SUBDIR+"].C",,,"SYNTAX_ONLY")

-$ ENDIF

-$ OBJECT_FILE = OBJ_DIR + F$PARSE(FILE_NAME,,,"NAME","SYNTAX_ONLY") + ".OBJ"

-$!

-$! If we get some problem, we just go on trying to build the next module.

-$ ON WARNING THEN GOTO FILE_NEXT

-$!

-$! Check if the module we want to compile is actually there.

-$!

-$ IF F$SEARCH(SOURCE_FILE) .EQS. ""

-$ THEN

-$   WRITE SYS$OUTPUT ""

-$   WRITE SYS$OUTPUT "The File ",SOURCE_FILE," Doesn't Exist."

-$   WRITE SYS$OUTPUT ""

-$   GOTO EXIT

-$ ENDIF

-$!

-$! Talk to the user.

-$!

-$ WRITE SYS$OUTPUT "	",FILE_NAME,""

-$!

-$! Do the dirty work.

-$!

-$ ON ERROR THEN GOTO FILE_NEXT

-$ IF F$EDIT(F$PARSE(SOURCE_FILE,,,"TYPE","SYNTAX_ONLY"),"UPCASE") .EQS. ".MAR"

-$ THEN

-$   MACRO/OBJECT='OBJECT_FILE' 'SOURCE_FILE'

-$ ELSE

-$   CC/OBJECT='OBJECT_FILE' 'SOURCE_FILE'

-$ ENDIF

-$!

-$! Write the entry to the .OPT file (for a real engine name).

-$!

-$ IF ENGINE_NAME .NES. ""

-$ THEN

-$   WRITE OBJECTS OBJECT_FILE

-$ ENDIF

-$!

-$! Next file

-$!

-$ GOTO FILE_NEXT

-$!

-$ FILE_DONE:

-$!

-$! Do not link the support files.

-$!

-$ IF ENGINE_NAME .EQS. "" THEN GOTO ENGINE_NEXT

-$!

-$! Close the linker options file (for a real engine name).

-$!

-$ CLOSE OBJECTS

-$!

-$! Now, there are two ways to handle this.  We can either build 

-$! shareable images or stick the engine object file into libcrypto.

-$! For now, the latter is NOT supported.

-$!

-$!!!!! LIBRARY/REPLACE 'CRYPTO_LIB' 'OBJECT_FILE'

-$!

-$! For shareable libraries, we need to do things a little differently

-$! depending on if we link with a TCP/IP library or not.

-$!

-$ ENGINE_OPT := SYS$DISK:[]'ARCH'.OPT

-$ IF TCPIP_LIB .NES. ""

-$ THEN

-$   LINK/'DEBUGGER'/'TRACEBACK' /SHARE='EXE_DIR''ENGINE_NAME'.EXE -

-	'EXE_DIR''ENGINE_NAME'.OPT/OPTION'TV_OBJ', -

-	'CRYPTO_LIB'/LIBRARY, -

-	'ENGINE_OPT'/OPTION,'TCPIP_LIB','OPT_FILE'/OPTION

-$ ELSE

-$   LINK/'DEBUGGER'/'TRACEBACK' /SHARE='EXE_DIR''ENGINE_NAME'.EXE -

-	'EXE_DIR''ENGINE_NAME'.OPT/OPTION'TV_OBJ', -

-        'CRYPTO_LIB'/LIBRARY, -

-	'ENGINE_OPT'/OPTION,'OPT_FILE'/OPTION

-$ ENDIF

-$!

-$! Next engine

-$!

-$ GOTO ENGINE_NEXT

-$!

-$ ENGINE_DONE:

-$!

-$! Talk to the user

-$!

-$ WRITE SYS$OUTPUT "All Done..."

-$ EXIT:

-$ GOSUB CLEANUP

-$ EXIT

-$!

-$! Check For The Link Option FIle.

-$!

-$ CHECK_OPT_FILE:

-$!

-$! Check To See If We Need To Make A VAX C Option File.

-$!

-$ IF (COMPILER.EQS."VAXC")

-$ THEN

-$!

-$!  Check To See If We Already Have A VAX C Linker Option File.

-$!

-$   IF (F$SEARCH(OPT_FILE).EQS."")

-$   THEN

-$!

-$!    We Need A VAX C Linker Option File.

-$!

-$     CREATE 'OPT_FILE'

-$DECK

-!

-! Default System Options File To Link Agianst 

-! The Sharable VAX C Runtime Library.

-!

-SYS$SHARE:VAXCRTL.EXE/SHARE

-$EOD

-$!

-$!  End The Option File Check.

-$!

-$   ENDIF

-$!

-$! End The VAXC Check.

-$!

-$ ENDIF

-$!

-$! Check To See If We Need A GNU C Option File.

-$!

-$ IF (COMPILER.EQS."GNUC")

-$ THEN

-$!

-$!  Check To See If We Already Have A GNU C Linker Option File.

-$!

-$   IF (F$SEARCH(OPT_FILE).EQS."")

-$   THEN

-$!

-$!    We Need A GNU C Linker Option File.

-$!

-$     CREATE 'OPT_FILE'

-$DECK

-!

-! Default System Options File To Link Agianst 

-! The Sharable C Runtime Library.

-!

-GNU_CC:[000000]GCCLIB/LIBRARY

-SYS$SHARE:VAXCRTL/SHARE

-$EOD

-$!

-$!  End The Option File Check.

-$!

-$   ENDIF

-$!

-$! End The GNU C Check.

-$!

-$ ENDIF

-$!

-$! Check To See If We Need A DEC C Option File.

-$!

-$ IF (COMPILER.EQS."DECC")

-$ THEN

-$!

-$!  Check To See If We Already Have A DEC C Linker Option File.

-$!

-$   IF (F$SEARCH(OPT_FILE).EQS."")

-$   THEN

-$!

-$!    Figure Out If We Need A non-VAX Or A VAX Linker Option File.

-$!

-$     IF ARCH .EQS. "VAX"

-$     THEN

-$!

-$!      We Need A DEC C Linker Option File For VAX.

-$!

-$       CREATE 'OPT_FILE'

-$DECK

-!

-! Default System Options File To Link Agianst 

-! The Sharable DEC C Runtime Library.

-!

-SYS$SHARE:DECC$SHR.EXE/SHARE

-$EOD

-$!

-$!    Else...

-$!

-$     ELSE

-$!

-$!      Create The non-VAX Linker Option File.

-$!

-$       CREATE 'OPT_FILE'

-$DECK

-!

-! Default System Options File For non-VAX To Link Agianst 

-! The Sharable C Runtime Library.

-!

-SYS$SHARE:CMA$OPEN_LIB_SHR/SHARE

-SYS$SHARE:CMA$OPEN_RTL/SHARE

-$EOD

-$!

-$!    End The DEC C Option File Check.

-$!

-$     ENDIF

-$!

-$!  End The Option File Search.

-$!

-$   ENDIF

-$!

-$! End The DEC C Check.

-$!

-$ ENDIF

-$!

-$!  Tell The User What Linker Option File We Are Using.

-$!

-$ WRITE SYS$OUTPUT "Using Linker Option File ",OPT_FILE,"."	

-$!

-$! Time To RETURN.

-$!

-$ RETURN

-$!

-$! Check The User's Options.

-$!

-$ CHECK_OPTIONS:

-$!

-$! Check To See If OPT_PHASE Is Blank.

-$!

-$ IF (OPT_PHASE.EQS."ALL")

-$ THEN

-$!

-$!   OPT_PHASE Is Blank, So Build Everything.

-$!

-$    BUILDALL = "ALL"

-$!

-$! Else...

-$!

-$ ELSE

-$!

-$!  Else, Check To See If OPT_PHASE Has A Valid Argument.

-$!

-$   IF ("," + ACCEPT_PHASE + ",") - ("," + OPT_PHASE + ",") -

-       .NES. ("," + ACCEPT_PHASE + ",")

-$   THEN

-$!

-$!    A Valid Argument.

-$!

-$     BUILDALL = OPT_PHASE

-$!

-$!  Else...

-$!

-$   ELSE

-$!

-$!    Tell The User We Don't Know What They Want.

-$!

-$     WRITE SYS$OUTPUT ""

-$     WRITE SYS$OUTPUT "The option ",OPT_PHASE," is invalid.  The valid options are:"

-$     WRITE SYS$OUTPUT ""

-$     IF ("," + ACCEPT_PHASE + ",") - ",ALL," -

-	.NES. ("," + ACCEPT_PHASE + ",") THEN -

-	WRITE SYS$OUTPUT "    ALL      :  just build everything."

-$     IF ("," + ACCEPT_PHASE + ",") - ",ENGINES," -

-	.NES. ("," + ACCEPT_PHASE + ",") THEN -

-	WRITE SYS$OUTPUT "    ENGINES  :  to compile just the [.xxx.EXE.ENGINES]*.EXE hareable images."

-$     WRITE SYS$OUTPUT ""

-$     WRITE SYS$OUTPUT " where 'xxx' stands for:"

-$     WRITE SYS$OUTPUT ""

-$     WRITE SYS$OUTPUT "    ALPHA    :  Alpha architecture."

-$     WRITE SYS$OUTPUT "    IA64     :  IA64 architecture."

-$     WRITE SYS$OUTPUT "    VAX      :  VAX architecture."

-$     WRITE SYS$OUTPUT ""

-$!

-$!    Time To EXIT.

-$!

-$     EXIT

-$!

-$!  End The Valid Argument Check.

-$!

-$   ENDIF

-$!

-$! End The OPT_PHASE Check.

-$!

-$ ENDIF

-$!

-$! Check To See If OPT_DEBUG Is Blank.

-$!

-$ IF (OPT_DEBUG.EQS."NODEBUG")

-$ THEN

-$!

-$!   OPT_DEBUG Is NODEBUG, So Compile Without The Debugger Information.

-$!

-$    DEBUGGER = "NODEBUG"

-$    TRACEBACK = "NOTRACEBACK" 

-$    GCC_OPTIMIZE = "OPTIMIZE"

-$    CC_OPTIMIZE = "OPTIMIZE"

-$    MACRO_OPTIMIZE = "OPTIMIZE"

-$    WRITE SYS$OUTPUT "No Debugger Information Will Be Produced During Compile."

-$    WRITE SYS$OUTPUT "Compiling With Compiler Optimization."

-$ ELSE

-$!

-$!  Check To See If We Are To Compile With Debugger Information.

-$!

-$   IF (OPT_DEBUG.EQS."DEBUG")

-$   THEN

-$!

-$!    Compile With Debugger Information.

-$!

-$     DEBUGGER = "DEBUG"

-$     TRACEBACK = "TRACEBACK"

-$     GCC_OPTIMIZE = "NOOPTIMIZE"

-$     CC_OPTIMIZE = "NOOPTIMIZE"

-$     MACRO_OPTIMIZE = "NOOPTIMIZE"

-$     WRITE SYS$OUTPUT "Debugger Information Will Be Produced During Compile."

-$     WRITE SYS$OUTPUT "Compiling Without Compiler Optimization."

-$   ELSE 

-$!

-$!    They Entered An Invalid Option..

-$!

-$     WRITE SYS$OUTPUT ""

-$     WRITE SYS$OUTPUT "The Option ",OPT_DEBUG," Is Invalid.  The Valid Options Are:"

-$     WRITE SYS$OUTPUT ""

-$     WRITE SYS$OUTPUT "     DEBUG   :  Compile With The Debugger Information."

-$     WRITE SYS$OUTPUT "     NODEBUG :  Compile Without The Debugger Information."

-$     WRITE SYS$OUTPUT ""

-$!

-$!    Time To EXIT.

-$!

-$     EXIT

-$!

-$!  End The Valid Argument Check.

-$!

-$   ENDIF

-$!

-$! End The OPT_DEBUG Check.

-$!

-$ ENDIF

-$!

-$! Special Threads For OpenVMS v7.1 Or Later

-$!

-$! Written By:  Richard Levitte

-$!              richard@levitte.org

-$!

-$!

-$! Check To See If We Have A Option For OPT_SPECIAL_THREADS.

-$!

-$ IF (OPT_SPECIAL_THREADS.EQS."")

-$ THEN

-$!

-$!  Get The Version Of VMS We Are Using.

-$!

-$   ISSEVEN :=

-$   TMP = F$ELEMENT(0,"-",F$EXTRACT(1,4,F$GETSYI("VERSION")))

-$   TMP = F$INTEGER(F$ELEMENT(0,".",TMP)+F$ELEMENT(1,".",TMP))

-$!

-$!  Check To See If The VMS Version Is v7.1 Or Later.

-$!

-$   IF (TMP.GE.71)

-$   THEN

-$!

-$!    We Have OpenVMS v7.1 Or Later, So Use The Special Threads.

-$!

-$     ISSEVEN := ,PTHREAD_USE_D4

-$!

-$!  End The VMS Version Check.

-$!

-$   ENDIF

-$!

-$! End The OPT_SPECIAL_THREADS Check.

-$!

-$ ENDIF

-$!

-$! Check To See If OPT_POINTER_SIZE Is Blank.

-$!

-$ IF (OPT_POINTER_SIZE.EQS."")

-$ THEN

-$   POINTER_SIZE = ""

-$ ELSE

-$!

-$!  Check is OPT_POINTER_SIZE Is Valid

-$!

-$   IF (OPT_POINTER_SIZE.EQS."32")

-$   THEN

-$     POINTER_SIZE = "/POINTER_SIZE=32"

-$     IF ARCH .EQS. "VAX"

-$     THEN

-$       LIB32 = ""

-$     ELSE

-$       LIB32 = "32"

-$     ENDIF

-$   ELSE

-$     IF (OPT_POINTER_SIZE.EQS."64")

-$     THEN

-$       LIB32 = ""

-$       IF ARCH .EQS. "VAX"

-$       THEN

-$         POINTER_SIZE = "/POINTER_SIZE=32"

-$       ELSE

-$         POINTER_SIZE = "/POINTER_SIZE=64"

-$       ENDIF

-$     ELSE

-$!

-$!      Tell The User Entered An Invalid Option..

-$!

-$       WRITE SYS$OUTPUT ""

-$       WRITE SYS$OUTPUT "The Option ",OPT_POINTER_SIZE," Is Invalid.  The Valid Options Are:"

-$       WRITE SYS$OUTPUT ""

-$       WRITE SYS$OUTPUT "    32  :  Compile with 32 bit pointer size"

-$       WRITE SYS$OUTPUT "    64  :  Compile with 64 bit pointer size"

-$       WRITE SYS$OUTPUT ""

-$!

-$!      Time To EXIT.

-$!

-$       GOTO TIDY

-$!

-$!      End The Valid Arguement Check.

-$!

-$     ENDIF

-$   ENDIF

-$!

-$! End The OPT_POINTER_SIZE Check.

-$!

-$ ENDIF

-$!

-$! Check To See If OPT_COMPILER Is Blank.

-$!

-$ IF (OPT_COMPILER.EQS."")

-$ THEN

-$!

-$!  O.K., The User Didn't Specify A Compiler, Let's Try To

-$!  Find Out Which One To Use.

-$!

-$!  Check To See If We Have GNU C.

-$!

-$   IF (F$TRNLNM("GNU_CC").NES."")

-$   THEN

-$!

-$!    Looks Like GNUC, Set To Use GNUC.

-$!

-$     OPT_COMPILER = "GNUC"

-$!

-$!  Else...

-$!

-$   ELSE

-$!

-$!    Check To See If We Have VAXC Or DECC.

-$!

-$     IF (ARCH.NES."VAX").OR.(F$TRNLNM("DECC$CC_DEFAULT").NES."")

-$     THEN 

-$!

-$!      Looks Like DECC, Set To Use DECC.

-$!

-$       OPT_COMPILER = "DECC"

-$!

-$!    Else...

-$!

-$     ELSE

-$!

-$!      Looks Like VAXC, Set To Use VAXC.

-$!

-$       OPT_COMPILER = "VAXC"

-$!

-$!    End The VAXC Compiler Check.

-$!

-$     ENDIF

-$!

-$!  End The DECC & VAXC Compiler Check.

-$!

-$   ENDIF

-$!

-$!  End The Compiler Check.

-$!

-$ ENDIF

-$!

-$! Check To See If We Have A Option For OPT_TCPIP_LIB.

-$!

-$ IF (OPT_TCPIP_LIB.EQS."")

-$ THEN

-$!

-$!  Find out what socket library we have available

-$!

-$   IF F$PARSE("SOCKETSHR:") .NES. ""

-$   THEN

-$!

-$!    We have SOCKETSHR, and it is my opinion that it's the best to use.

-$!

-$     OPT_TCPIP_LIB = "SOCKETSHR"

-$!

-$!    Tell the user

-$!

-$     WRITE SYS$OUTPUT "Using SOCKETSHR for TCP/IP"

-$!

-$!    Else, let's look for something else

-$!

-$   ELSE

-$!

-$!    Like UCX (the reason to do this before Multinet is that the UCX

-$!    emulation is easier to use...)

-$!

-$     IF F$TRNLNM("UCX$IPC_SHR") .NES. "" -

-	 .OR. F$PARSE("SYS$SHARE:UCX$IPC_SHR.EXE") .NES. "" -

-	 .OR. F$PARSE("SYS$LIBRARY:UCX$IPC.OLB") .NES. ""

-$     THEN

-$!

-$!	Last resort: a UCX or UCX-compatible library

-$!

-$	OPT_TCPIP_LIB = "UCX"

-$!

-$!      Tell the user

-$!

-$       WRITE SYS$OUTPUT "Using UCX or an emulation thereof for TCP/IP"

-$!

-$!	That was all...

-$!

-$     ENDIF

-$   ENDIF

-$ ENDIF

-$!

-$! Set Up Initial CC Definitions, Possibly With User Ones

-$!

-$ CCDEFS = "TCPIP_TYPE_''OPT_TCPIP_LIB',DSO_VMS"

-$ IF F$TYPE(USER_CCDEFS) .NES. "" THEN CCDEFS = CCDEFS + "," + USER_CCDEFS

-$ CCEXTRAFLAGS = ""

-$ IF F$TYPE(USER_CCFLAGS) .NES. "" THEN CCEXTRAFLAGS = USER_CCFLAGS

-$ CCDISABLEWARNINGS = "LONGLONGTYPE,LONGLONGSUFX"

-$ IF F$TYPE(USER_CCDISABLEWARNINGS) .NES. "" THEN -

-	CCDISABLEWARNINGS = CCDISABLEWARNINGS + "," + USER_CCDISABLEWARNINGS

-$!

-$!  Check To See If The User Entered A Valid Paramter.

-$!

-$ IF (OPT_COMPILER.EQS."VAXC").OR.(OPT_COMPILER.EQS."DECC").OR.(OPT_COMPILER.EQS."GNUC")

-$ THEN

-$!

-$!    Check To See If The User Wanted DECC.

-$!

-$   IF (OPT_COMPILER.EQS."DECC")

-$   THEN

-$!

-$!    Looks Like DECC, Set To Use DECC.

-$!

-$     COMPILER = "DECC"

-$!

-$!    Tell The User We Are Using DECC.

-$!

-$     WRITE SYS$OUTPUT "Using DECC 'C' Compiler."

-$!

-$!    Use DECC...

-$!

-$     CC = "CC"

-$     IF ARCH.EQS."VAX" .AND. F$TRNLNM("DECC$CC_DEFAULT").NES."/DECC" -

-	 THEN CC = "CC/DECC"

-$     CC = CC + "/''CC_OPTIMIZE'/''DEBUGGER'/STANDARD=ANSI89''POINTER_SIZE'" + -

-           "/NOLIST/PREFIX=ALL" + -

-	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[.VENDOR_DEFNS])" + -

-	   CCEXTRAFLAGS

-$!

-$!    Define The Linker Options File Name.

-$!

-$     OPT_FILE = "''EXE_DIR'VAX_DECC_OPTIONS.OPT"

-$!

-$!  End DECC Check.

-$!

-$   ENDIF

-$!

-$!  Check To See If We Are To Use VAXC.

-$!

-$   IF (OPT_COMPILER.EQS."VAXC")

-$   THEN

-$!

-$!    Looks Like VAXC, Set To Use VAXC.

-$!

-$     COMPILER = "VAXC"

-$!

-$!    Tell The User We Are Using VAX C.

-$!

-$     WRITE SYS$OUTPUT "Using VAXC 'C' Compiler."

-$!

-$!    Compile Using VAXC.

-$!

-$     CC = "CC"

-$     IF ARCH.NES."VAX"

-$     THEN

-$	WRITE SYS$OUTPUT "There is no VAX C on Alpha!"

-$	EXIT

-$     ENDIF

-$     IF F$TRNLNM("DECC$CC_DEFAULT").EQS."/DECC" THEN CC = "CC/VAXC"

-$     CC = CC + "/''CC_OPTIMIZE'/''DEBUGGER'/NOLIST" + -

-	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[-],SYS$DISK:[.VENDOR_DEFNS])" + -

-	   CCEXTRAFLAGS

-$     CCDEFS = """VAXC""," + CCDEFS

-$!

-$!    Define <sys> As SYS$COMMON:[SYSLIB]

-$!

-$     DEFINE/NOLOG SYS SYS$COMMON:[SYSLIB]

-$!

-$!    Define The Linker Options File Name.

-$!

-$     OPT_FILE = "''EXE_DIR'VAX_VAXC_OPTIONS.OPT"

-$!

-$!  End VAXC Check

-$!

-$   ENDIF

-$!

-$!  Check To See If We Are To Use GNU C.

-$!

-$   IF (OPT_COMPILER.EQS."GNUC")

-$   THEN

-$!

-$!    Looks Like GNUC, Set To Use GNUC.

-$!

-$     COMPILER = "GNUC"

-$!

-$!    Tell The User We Are Using GNUC.

-$!

-$     WRITE SYS$OUTPUT "Using GNU 'C' Compiler."

-$!

-$!    Use GNU C...

-$!

-$     CC = "GCC/NOCASE_HACK/''GCC_OPTIMIZE'/''DEBUGGER'/NOLIST" + -

-	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[-],SYS$DISK:[.VENDOR_DEFNS])" + -

-	   CCEXTRAFLAGS

-$!

-$!    Define The Linker Options File Name.

-$!

-$     OPT_FILE = "''EXE_DIR'VAX_GNUC_OPTIONS.OPT"

-$!

-$!  End The GNU C Check.

-$!

-$   ENDIF

-$!

-$!  Set up default defines

-$!

-$   CCDEFS = """FLAT_INC=1""," + CCDEFS

-$!

-$!  Finish up the definition of CC.

-$!

-$   IF COMPILER .EQS. "DECC"

-$   THEN

-$     IF CCDISABLEWARNINGS .NES. ""

-$     THEN

-$       CCDISABLEWARNINGS = "/WARNING=(DISABLE=(" + CCDISABLEWARNINGS + "))"

-$     ENDIF

-$   ELSE

-$     CCDISABLEWARNINGS = ""

-$   ENDIF

-$   CC = CC + "/DEFINE=(" + CCDEFS + ")" + CCDISABLEWARNINGS

-$!

-$!  Show user the result

-$!

-$   WRITE/SYMBOL SYS$OUTPUT "Main C Compiling Command: ",CC

-$!

-$!  Else The User Entered An Invalid Argument.

-$!

-$ ELSE

-$!

-$!  Tell The User We Don't Know What They Want.

-$!

-$   WRITE SYS$OUTPUT ""

-$   WRITE SYS$OUTPUT "The Option ",OPT_COMPILER," Is Invalid.  The Valid Options Are:"

-$   WRITE SYS$OUTPUT ""

-$   WRITE SYS$OUTPUT "    VAXC  :  To Compile With VAX C."

-$   WRITE SYS$OUTPUT "    DECC  :  To Compile With DEC C."

-$   WRITE SYS$OUTPUT "    GNUC  :  To Compile With GNU C."

-$   WRITE SYS$OUTPUT ""

-$!

-$!  Time To EXIT.

-$!

-$   EXIT

-$!

-$! End The Valid Argument Check.

-$!

-$ ENDIF

-$!

-$! Build a MACRO command for the architecture at hand

-$!

-$ IF ARCH .EQS. "VAX" THEN MACRO = "MACRO/''DEBUGGER'"

-$ IF ARCH .NES. "VAX" THEN MACRO = "MACRO/MIGRATION/''DEBUGGER'/''MACRO_OPTIMIZE'"

-$!

-$!  Show user the result

-$!

-$ WRITE/SYMBOL SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO

-$!

-$! Time to check the contents, and to make sure we get the correct library.

-$!

-$ IF OPT_TCPIP_LIB.EQS."SOCKETSHR" .OR. OPT_TCPIP_LIB.EQS."MULTINET" -

-     .OR. OPT_TCPIP_LIB.EQS."UCX" .OR. OPT_TCPIP_LIB.EQS."TCPIP" -

-     .OR. OPT_TCPIP_LIB.EQS."NONE"

-$ THEN

-$!

-$!  Check to see if SOCKETSHR was chosen

-$!

-$   IF OPT_TCPIP_LIB.EQS."SOCKETSHR"

-$   THEN

-$!

-$!    Set the library to use SOCKETSHR

-$!

-$     TCPIP_LIB = "SYS$DISK:[-.VMS]SOCKETSHR_SHR.OPT/OPT"

-$!

-$!    Done with SOCKETSHR

-$!

-$   ENDIF

-$!

-$!  Check to see if MULTINET was chosen

-$!

-$   IF OPT_TCPIP_LIB.EQS."MULTINET"

-$   THEN

-$!

-$!    Set the library to use UCX emulation.

-$!

-$     OPT_TCPIP_LIB = "UCX"

-$!

-$!    Done with MULTINET

-$!

-$   ENDIF

-$!

-$!  Check to see if UCX was chosen

-$!

-$   IF OPT_TCPIP_LIB.EQS."UCX"

-$   THEN

-$!

-$!    Set the library to use UCX.

-$!

-$     TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_DECC.OPT/OPT"

-$     IF F$TRNLNM("UCX$IPC_SHR") .NES. ""

-$     THEN

-$       TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_DECC_LOG.OPT/OPT"

-$     ELSE

-$       IF COMPILER .NES. "DECC" .AND. ARCH .EQS. "VAX" THEN -

-	  TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_VAXC.OPT/OPT"

-$     ENDIF

-$!

-$!    Done with UCX

-$!

-$   ENDIF

-$!

-$!  Check to see if TCPIP was chosen

-$!

-$   IF OPT_TCPIP_LIB.EQS."TCPIP"

-$   THEN

-$!

-$!    Set the library to use TCPIP (post UCX).

-$!

-$     TCPIP_LIB = "SYS$DISK:[-.VMS]TCPIP_SHR_DECC.OPT/OPT"

-$!

-$!    Done with TCPIP

-$!

-$   ENDIF

-$!

-$!  Check to see if NONE was chosen

-$!

-$   IF OPT_TCPIP_LIB.EQS."NONE"

-$   THEN

-$!

-$!    Do not use a TCPIP library.

-$!

-$     TCPIP_LIB = ""

-$!

-$!    Done with TCPIP

-$!

-$   ENDIF

-$!

-$!  Print info

-$!

-$   WRITE SYS$OUTPUT "TCP/IP library spec: ", TCPIP_LIB

-$!

-$!  Else The User Entered An Invalid Argument.

-$!

-$ ELSE

-$!

-$!  Tell The User We Don't Know What They Want.

-$!

-$   WRITE SYS$OUTPUT ""

-$   WRITE SYS$OUTPUT "The Option ",OPT_TCPIP_LIB," Is Invalid.  The Valid Options Are:"

-$   WRITE SYS$OUTPUT ""

-$   WRITE SYS$OUTPUT "    SOCKETSHR  :  To link with SOCKETSHR TCP/IP library."

-$   WRITE SYS$OUTPUT "    UCX        :  To link with UCX TCP/IP library."

-$   WRITE SYS$OUTPUT "    TCPIP      :  To link with TCPIP (post UCX) TCP/IP library."

-$   WRITE SYS$OUTPUT ""

-$!

-$!  Time To EXIT.

-$!

-$   EXIT

-$!

-$!  Done with TCP/IP libraries

-$!

-$ ENDIF

-$!

-$!  Time To RETURN...

-$!

-$ RETURN

-$!

-$ INITIALISE:

-$!

-$! Save old value of the logical name OPENSSL

-$!

-$ __SAVE_OPENSSL = F$TRNLNM("OPENSSL","LNM$PROCESS_TABLE")

-$!

-$! Save directory information

-$!

-$ __HERE = F$PARSE(F$PARSE("A.;",F$ENVIRONMENT("PROCEDURE"))-"A.;","[]A.;") - "A.;"

-$ __HERE = F$EDIT(__HERE,"UPCASE")

-$ __TOP = __HERE - "ENGINES]"

-$ __INCLUDE = __TOP + "INCLUDE.OPENSSL]"

-$!

-$! Set up the logical name OPENSSL to point at the include directory

-$!

-$ DEFINE OPENSSL/NOLOG '__INCLUDE'

-$!

-$! Done

-$!

-$ RETURN

-$!

-$ CLEANUP:

-$!

-$! Restore the logical name OPENSSL if it had a value

-$!

-$ IF __SAVE_OPENSSL .EQS. ""

-$ THEN

-$   DEASSIGN OPENSSL

-$ ELSE

-$   DEFINE/NOLOG OPENSSL '__SAVE_OPENSSL'

-$ ENDIF

-$!

-$! Done

-$!

-$ RETURN

+$!
+$!  MAKEENGINES.COM
+$!  Written By:  Richard Levitte
+$!               richard@levitte.org
+$!
+$!  This command file compiles and creates the various engines in form
+$!  of shared images.  They are placed in [.xxx.EXE.ENGINES], where "xxx"
+$!  is ALPHA, IA64 or VAX, depending on your hardware.
+$!
+$!  P1	if this is ENGINES or ALL, the engines will build, otherwise not.
+$!
+$!  P2	DEBUG or NODEBUG to compile with or without debugger information.
+$!
+$!  P3  VAXC		for VAX C
+$!	DECC		for DEC C
+$!	GNUC		for GNU C (untested)
+$!
+$!  P4	if defined, sets the TCP/IP libraries to use.  UCX or TCPIP is
+$!	used by default since most other implementations come with a
+$!	compatibility library.  The value must be one of the following:
+$!
+$!	UCX		for UCX
+$!	SOCKETSHR	for SOCKETSHR+NETLIB
+$!	TCPIP		for TCPIP (post UCX)
+$!
+$!  P5	if defined, tells the compiler not to use special threads.
+$!
+$!  P6	if defined, denotes which engines to build.  If not defined,
+$!	all available engines are built.
+$!
+$!  For 64 bit architectures (Alpha and IA64), specify the pointer size as P7.
+$!  For 32 bit architectures (VAX), P7 is ignored.
+$!  Currently supported values are:
+$!
+$!	32	To ge a library compiled with /POINTER_SIZE=32
+$!	64	To ge a library compiled with /POINTER_SIZE=64
+$!
+$!-----------------------------------------------------------------------------
+$!
+$! Set the default TCP/IP library to link against if needed
+$!
+$ TCPIP_LIB = ""
+$!
+$! Check What Architecture We Are Using.
+$!
+$ IF (F$GETSYI("CPU").LT.128)
+$ THEN
+$!
+$!  The Architecture Is VAX.
+$!
+$   ARCH = "VAX"
+$!
+$! Else...
+$!
+$ ELSE
+$!
+$!  The Architecture Is Alpha, IA64 or whatever comes in the future.
+$!
+$   ARCH = F$EDIT( F$GETSYI( "ARCH_NAME"), "UPCASE")
+$   IF (ARCH .EQS. "") THEN ARCH = "UNK"
+$!
+$! End The Architecture Check.
+$!
+$ ENDIF
+$!
+$! Set the names of the engines we want to build
+$! NOTE: Some might think this list ugly.  However, it's made this way to
+$! reflect the LIBNAMES variable in Makefile as closely as possible,
+$! thereby making it fairly easy to verify that the lists are the same.
+$! NOTE: gmp isn't built, as it's mostly a test engine and brings in another
+$! library that isn't necessarely ported to VMS.
+$!
+$ ENGINES = "," + P6
+$ IF ENGINES .EQS. "," THEN -
+	ENGINES = ",4758cca,aep,atalla,cswift,chil,nuron,sureware,ubsec,padlock,"
+$!
+$! GOST requires a 64-bit integer type, unavailable on VAX.
+$!
+$ IF (ARCH .NES. "VAX") THEN -
+       ENGINES = ENGINES+ ",ccgost"
+$!
+$! Set the goal directories, and create them if necessary
+$!
+$ OBJ_DIR := SYS$DISK:[-.'ARCH'.OBJ.ENGINES]
+$ EXE_DIR := SYS$DISK:[-.'ARCH'.EXE.ENGINES]
+$ IF F$PARSE(OBJ_DIR) .EQS. "" THEN CREATE/DIRECTORY 'OBJ_DIR'
+$ IF F$PARSE(EXE_DIR) .EQS. "" THEN CREATE/DIRECTORY 'EXE_DIR'
+$!
+$! Set the goal files, and create them if necessary
+$!
+$ CRYPTO_LIB :=SYS$DISK:[-.'ARCH'.EXE.CRYPTO]LIBCRYPTO'LIB32'.OLB
+$ IF F$SEARCH(CRYPTO_LIB) .EQS. "" THEN LIBRARY/CREATE/OBJECT 'CRYPTO_LIB'
+$!
+$! OK, time to check options and initialise
+$!
+$ OPT_PHASE = P1
+$ ACCEPT_PHASE = "ALL,ENGINES"
+$ OPT_DEBUG = P2
+$ OPT_COMPILER = P3
+$ OPT_TCPIP_LIB = P4
+$ OPT_SPECIAL_THREADS = P5
+$ OPT_POINTER_SIZE = P7
+$
+$ GOSUB CHECK_OPTIONS
+$ GOSUB INITIALISE
+$ GOSUB CHECK_OPT_FILE
+$!
+$! Define what goes into each engine.  VAX includes a transfer vector.
+$!
+$ ENGINE_ = ""
+$ TV_OBJ = ""
+$ IF ARCH .EQS. "VAX"
+$ THEN
+$   ENGINE_ = "engine_vector.mar"
+$   TV_OBJ_NAME = OBJ_DIR + F$PARSE(ENGINE_,,,"NAME","SYNTAX_ONLY") + ".OBJ"
+$   TV_OBJ = ",''TV_OBJ_NAME'"
+$ ENDIF
+$ ENGINE_4758CCA = "e_4758cca"
+$ ENGINE_aep = "e_aep"
+$ ENGINE_atalla = "e_atalla"
+$ ENGINE_cswift = "e_cswift"
+$ ENGINE_chil = "e_chil"
+$ ENGINE_nuron = "e_nuron"
+$ ENGINE_sureware = "e_sureware"
+$ ENGINE_ubsec = "e_ubsec"
+$ ENGINE_padlock = "e_padlock"
+$
+$ ENGINE_ccgost_SUBDIR = "ccgost"
+$ ENGINE_ccgost = "e_gost_err,gost2001_keyx,gost2001,gost89,gost94_keyx,"+ -
+		  "gost_ameth,gost_asn1,gost_crypt,gost_ctl,gost_eng,"+ -
+		  "gosthash,gost_keywrap,gost_md,gost_params,gost_pmeth,"+ -
+		  "gost_sign"
+$!
+$! Define which programs need to be linked with a TCP/IP library
+$!
+$ TCPIP_ENGINES = ",,"
+$ IF COMPILER .EQS. "VAXC" THEN -
+     TCPIP_ENGINES = ",,"
+$!
+$! Set up two loops, one that keeps track of the engines,
+$! and one that keeps track of all the files going into
+$! the current engine.
+$!
+$! Here's the start of the engine loop.
+$!
+$ ENGINE_COUNTER = 0
+$ ENGINE_NEXT:
+$!
+$! Extract the current engine name, and if we've reached the end, stop
+$!
+$ ENGINE_NAME = F$ELEMENT(ENGINE_COUNTER,",",ENGINES)
+$ IF (ENGINE_NAME.EQS.",") THEN GOTO ENGINE_DONE
+$!
+$ ENGINE_COUNTER = ENGINE_COUNTER + 1
+$!
+$! Set up the engine library names.
+$!
+$ LIB_ENGINE = "ENGINE_" + ENGINE_NAME
+$!
+$! Check if the library module name actually is defined
+$!
+$ IF F$TYPE('LIB_ENGINE') .EQS. ""
+$ THEN
+$   WRITE SYS$ERROR ""
+$   WRITE SYS$ERROR "The module ",ENGINE_NAME," does not exist.  Continuing..."
+$   WRITE SYS$ERROR ""
+$   GOTO ENGINE_NEXT
+$ ENDIF
+$!
+$! Talk to the user
+$!
+$ IF ENGINE_NAME .NES. ""
+$ THEN
+$   WRITE SYS$OUTPUT "Compiling The ",ENGINE_NAME," Library Files. (",BUILDALL,")"
+$ ELSE
+$   WRITE SYS$OUTPUT "Compiling Support Files. (",BUILDALL,")"
+$ ENDIF
+$!
+$! Create a .OPT file for the object files (for a real engine name).
+$!
+$ IF ENGINE_NAME .NES. ""
+$ THEN
+$   OPEN/WRITE OBJECTS 'EXE_DIR''ENGINE_NAME'.OPT
+$ ENDIF
+$!
+$! Here's the start of per-engine module loop.
+$!
+$ FILE_COUNTER = 0
+$ FILE_NEXT:
+$!
+$! Extract the file name from the file list, and if we've reached the end, stop
+$!
+$ FILE_NAME = F$ELEMENT(FILE_COUNTER,",",'LIB_ENGINE')
+$ IF (FILE_NAME.EQS.",") THEN GOTO FILE_DONE
+$!
+$ FILE_COUNTER = FILE_COUNTER + 1
+$!
+$ IF FILE_NAME .EQS. "" THEN GOTO FILE_NEXT
+$!
+$! Set up the source and object reference
+$!
+$ IF F$TYPE('LIB_ENGINE'_SUBDIR) .EQS. ""
+$ THEN
+$     SOURCE_FILE = F$PARSE(FILE_NAME,"SYS$DISK:[].C",,,"SYNTAX_ONLY")
+$ ELSE
+$     SOURCE_FILE = F$PARSE(FILE_NAME,"SYS$DISK:[."+'LIB_ENGINE'_SUBDIR+"].C",,,"SYNTAX_ONLY")
+$ ENDIF
+$ OBJECT_FILE = OBJ_DIR + F$PARSE(FILE_NAME,,,"NAME","SYNTAX_ONLY") + ".OBJ"
+$!
+$! If we get some problem, we just go on trying to build the next module.
+$ ON WARNING THEN GOTO FILE_NEXT
+$!
+$! Check if the module we want to compile is actually there.
+$!
+$ IF F$SEARCH(SOURCE_FILE) .EQS. ""
+$ THEN
+$   WRITE SYS$OUTPUT ""
+$   WRITE SYS$OUTPUT "The File ",SOURCE_FILE," Doesn't Exist."
+$   WRITE SYS$OUTPUT ""
+$   GOTO EXIT
+$ ENDIF
+$!
+$! Talk to the user.
+$!
+$ WRITE SYS$OUTPUT "	",FILE_NAME,""
+$!
+$! Do the dirty work.
+$!
+$ ON ERROR THEN GOTO FILE_NEXT
+$ IF F$EDIT(F$PARSE(SOURCE_FILE,,,"TYPE","SYNTAX_ONLY"),"UPCASE") .EQS. ".MAR"
+$ THEN
+$   MACRO/OBJECT='OBJECT_FILE' 'SOURCE_FILE'
+$ ELSE
+$   CC/OBJECT='OBJECT_FILE' 'SOURCE_FILE'
+$ ENDIF
+$!
+$! Write the entry to the .OPT file (for a real engine name).
+$!
+$ IF ENGINE_NAME .NES. ""
+$ THEN
+$   WRITE OBJECTS OBJECT_FILE
+$ ENDIF
+$!
+$! Next file
+$!
+$ GOTO FILE_NEXT
+$!
+$ FILE_DONE:
+$!
+$! Do not link the support files.
+$!
+$ IF ENGINE_NAME .EQS. "" THEN GOTO ENGINE_NEXT
+$!
+$! Close the linker options file (for a real engine name).
+$!
+$ CLOSE OBJECTS
+$!
+$! Now, there are two ways to handle this.  We can either build 
+$! shareable images or stick the engine object file into libcrypto.
+$! For now, the latter is NOT supported.
+$!
+$!!!!! LIBRARY/REPLACE 'CRYPTO_LIB' 'OBJECT_FILE'
+$!
+$! For shareable libraries, we need to do things a little differently
+$! depending on if we link with a TCP/IP library or not.
+$!
+$ ENGINE_OPT := SYS$DISK:[]'ARCH'.OPT
+$ IF TCPIP_LIB .NES. ""
+$ THEN
+$   LINK/'DEBUGGER'/'TRACEBACK' /SHARE='EXE_DIR''ENGINE_NAME'.EXE -
+	'EXE_DIR''ENGINE_NAME'.OPT/OPTION'TV_OBJ', -
+	'CRYPTO_LIB'/LIBRARY, -
+	'ENGINE_OPT'/OPTION,'TCPIP_LIB','OPT_FILE'/OPTION
+$ ELSE
+$   LINK/'DEBUGGER'/'TRACEBACK' /SHARE='EXE_DIR''ENGINE_NAME'.EXE -
+	'EXE_DIR''ENGINE_NAME'.OPT/OPTION'TV_OBJ', -
+        'CRYPTO_LIB'/LIBRARY, -
+	'ENGINE_OPT'/OPTION,'OPT_FILE'/OPTION
+$ ENDIF
+$!
+$! Next engine
+$!
+$ GOTO ENGINE_NEXT
+$!
+$ ENGINE_DONE:
+$!
+$! Talk to the user
+$!
+$ WRITE SYS$OUTPUT "All Done..."
+$ EXIT:
+$ GOSUB CLEANUP
+$ EXIT
+$!
+$! Check For The Link Option FIle.
+$!
+$ CHECK_OPT_FILE:
+$!
+$! Check To See If We Need To Make A VAX C Option File.
+$!
+$ IF (COMPILER.EQS."VAXC")
+$ THEN
+$!
+$!  Check To See If We Already Have A VAX C Linker Option File.
+$!
+$   IF (F$SEARCH(OPT_FILE).EQS."")
+$   THEN
+$!
+$!    We Need A VAX C Linker Option File.
+$!
+$     CREATE 'OPT_FILE'
+$DECK
+!
+! Default System Options File To Link Agianst 
+! The Sharable VAX C Runtime Library.
+!
+SYS$SHARE:VAXCRTL.EXE/SHARE
+$EOD
+$!
+$!  End The Option File Check.
+$!
+$   ENDIF
+$!
+$! End The VAXC Check.
+$!
+$ ENDIF
+$!
+$! Check To See If We Need A GNU C Option File.
+$!
+$ IF (COMPILER.EQS."GNUC")
+$ THEN
+$!
+$!  Check To See If We Already Have A GNU C Linker Option File.
+$!
+$   IF (F$SEARCH(OPT_FILE).EQS."")
+$   THEN
+$!
+$!    We Need A GNU C Linker Option File.
+$!
+$     CREATE 'OPT_FILE'
+$DECK
+!
+! Default System Options File To Link Agianst 
+! The Sharable C Runtime Library.
+!
+GNU_CC:[000000]GCCLIB/LIBRARY
+SYS$SHARE:VAXCRTL/SHARE
+$EOD
+$!
+$!  End The Option File Check.
+$!
+$   ENDIF
+$!
+$! End The GNU C Check.
+$!
+$ ENDIF
+$!
+$! Check To See If We Need A DEC C Option File.
+$!
+$ IF (COMPILER.EQS."DECC")
+$ THEN
+$!
+$!  Check To See If We Already Have A DEC C Linker Option File.
+$!
+$   IF (F$SEARCH(OPT_FILE).EQS."")
+$   THEN
+$!
+$!    Figure Out If We Need A non-VAX Or A VAX Linker Option File.
+$!
+$     IF ARCH .EQS. "VAX"
+$     THEN
+$!
+$!      We Need A DEC C Linker Option File For VAX.
+$!
+$       CREATE 'OPT_FILE'
+$DECK
+!
+! Default System Options File To Link Agianst 
+! The Sharable DEC C Runtime Library.
+!
+SYS$SHARE:DECC$SHR.EXE/SHARE
+$EOD
+$!
+$!    Else...
+$!
+$     ELSE
+$!
+$!      Create The non-VAX Linker Option File.
+$!
+$       CREATE 'OPT_FILE'
+$DECK
+!
+! Default System Options File For non-VAX To Link Agianst 
+! The Sharable C Runtime Library.
+!
+SYS$SHARE:CMA$OPEN_LIB_SHR/SHARE
+SYS$SHARE:CMA$OPEN_RTL/SHARE
+$EOD
+$!
+$!    End The DEC C Option File Check.
+$!
+$     ENDIF
+$!
+$!  End The Option File Search.
+$!
+$   ENDIF
+$!
+$! End The DEC C Check.
+$!
+$ ENDIF
+$!
+$!  Tell The User What Linker Option File We Are Using.
+$!
+$ WRITE SYS$OUTPUT "Using Linker Option File ",OPT_FILE,"."	
+$!
+$! Time To RETURN.
+$!
+$ RETURN
+$!
+$! Check The User's Options.
+$!
+$ CHECK_OPTIONS:
+$!
+$! Check To See If OPT_PHASE Is Blank.
+$!
+$ IF (OPT_PHASE.EQS."ALL")
+$ THEN
+$!
+$!   OPT_PHASE Is Blank, So Build Everything.
+$!
+$    BUILDALL = "ALL"
+$!
+$! Else...
+$!
+$ ELSE
+$!
+$!  Else, Check To See If OPT_PHASE Has A Valid Argument.
+$!
+$   IF ("," + ACCEPT_PHASE + ",") - ("," + OPT_PHASE + ",") -
+       .NES. ("," + ACCEPT_PHASE + ",")
+$   THEN
+$!
+$!    A Valid Argument.
+$!
+$     BUILDALL = OPT_PHASE
+$!
+$!  Else...
+$!
+$   ELSE
+$!
+$!    Tell The User We Don't Know What They Want.
+$!
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT "The option ",OPT_PHASE," is invalid.  The valid options are:"
+$     WRITE SYS$OUTPUT ""
+$     IF ("," + ACCEPT_PHASE + ",") - ",ALL," -
+	.NES. ("," + ACCEPT_PHASE + ",") THEN -
+	WRITE SYS$OUTPUT "    ALL      :  just build everything."
+$     IF ("," + ACCEPT_PHASE + ",") - ",ENGINES," -
+	.NES. ("," + ACCEPT_PHASE + ",") THEN -
+	WRITE SYS$OUTPUT "    ENGINES  :  to compile just the [.xxx.EXE.ENGINES]*.EXE hareable images."
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT " where 'xxx' stands for:"
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT "    ALPHA    :  Alpha architecture."
+$     WRITE SYS$OUTPUT "    IA64     :  IA64 architecture."
+$     WRITE SYS$OUTPUT "    VAX      :  VAX architecture."
+$     WRITE SYS$OUTPUT ""
+$!
+$!    Time To EXIT.
+$!
+$     EXIT
+$!
+$!  End The Valid Argument Check.
+$!
+$   ENDIF
+$!
+$! End The OPT_PHASE Check.
+$!
+$ ENDIF
+$!
+$! Check To See If OPT_DEBUG Is Blank.
+$!
+$ IF (OPT_DEBUG.EQS."NODEBUG")
+$ THEN
+$!
+$!   OPT_DEBUG Is NODEBUG, So Compile Without The Debugger Information.
+$!
+$    DEBUGGER = "NODEBUG"
+$    TRACEBACK = "NOTRACEBACK" 
+$    GCC_OPTIMIZE = "OPTIMIZE"
+$    CC_OPTIMIZE = "OPTIMIZE"
+$    MACRO_OPTIMIZE = "OPTIMIZE"
+$    WRITE SYS$OUTPUT "No Debugger Information Will Be Produced During Compile."
+$    WRITE SYS$OUTPUT "Compiling With Compiler Optimization."
+$ ELSE
+$!
+$!  Check To See If We Are To Compile With Debugger Information.
+$!
+$   IF (OPT_DEBUG.EQS."DEBUG")
+$   THEN
+$!
+$!    Compile With Debugger Information.
+$!
+$     DEBUGGER = "DEBUG"
+$     TRACEBACK = "TRACEBACK"
+$     GCC_OPTIMIZE = "NOOPTIMIZE"
+$     CC_OPTIMIZE = "NOOPTIMIZE"
+$     MACRO_OPTIMIZE = "NOOPTIMIZE"
+$     WRITE SYS$OUTPUT "Debugger Information Will Be Produced During Compile."
+$     WRITE SYS$OUTPUT "Compiling Without Compiler Optimization."
+$   ELSE 
+$!
+$!    They Entered An Invalid Option..
+$!
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT "The Option ",OPT_DEBUG," Is Invalid.  The Valid Options Are:"
+$     WRITE SYS$OUTPUT ""
+$     WRITE SYS$OUTPUT "     DEBUG   :  Compile With The Debugger Information."
+$     WRITE SYS$OUTPUT "     NODEBUG :  Compile Without The Debugger Information."
+$     WRITE SYS$OUTPUT ""
+$!
+$!    Time To EXIT.
+$!
+$     EXIT
+$!
+$!  End The Valid Argument Check.
+$!
+$   ENDIF
+$!
+$! End The OPT_DEBUG Check.
+$!
+$ ENDIF
+$!
+$! Special Threads For OpenVMS v7.1 Or Later
+$!
+$! Written By:  Richard Levitte
+$!              richard@levitte.org
+$!
+$!
+$! Check To See If We Have A Option For OPT_SPECIAL_THREADS.
+$!
+$ IF (OPT_SPECIAL_THREADS.EQS."")
+$ THEN
+$!
+$!  Get The Version Of VMS We Are Using.
+$!
+$   ISSEVEN :=
+$   TMP = F$ELEMENT(0,"-",F$EXTRACT(1,4,F$GETSYI("VERSION")))
+$   TMP = F$INTEGER(F$ELEMENT(0,".",TMP)+F$ELEMENT(1,".",TMP))
+$!
+$!  Check To See If The VMS Version Is v7.1 Or Later.
+$!
+$   IF (TMP.GE.71)
+$   THEN
+$!
+$!    We Have OpenVMS v7.1 Or Later, So Use The Special Threads.
+$!
+$     ISSEVEN := ,PTHREAD_USE_D4
+$!
+$!  End The VMS Version Check.
+$!
+$   ENDIF
+$!
+$! End The OPT_SPECIAL_THREADS Check.
+$!
+$ ENDIF
+$!
+$! Check To See If OPT_POINTER_SIZE Is Blank.
+$!
+$ IF (OPT_POINTER_SIZE.EQS."")
+$ THEN
+$   POINTER_SIZE = ""
+$ ELSE
+$!
+$!  Check is OPT_POINTER_SIZE Is Valid
+$!
+$   IF (OPT_POINTER_SIZE.EQS."32")
+$   THEN
+$     POINTER_SIZE = "/POINTER_SIZE=32"
+$     IF ARCH .EQS. "VAX"
+$     THEN
+$       LIB32 = ""
+$     ELSE
+$       LIB32 = "32"
+$     ENDIF
+$   ELSE
+$     IF (OPT_POINTER_SIZE.EQS."64")
+$     THEN
+$       LIB32 = ""
+$       IF ARCH .EQS. "VAX"
+$       THEN
+$         POINTER_SIZE = "/POINTER_SIZE=32"
+$       ELSE
+$         POINTER_SIZE = "/POINTER_SIZE=64"
+$       ENDIF
+$     ELSE
+$!
+$!      Tell The User Entered An Invalid Option..
+$!
+$       WRITE SYS$OUTPUT ""
+$       WRITE SYS$OUTPUT "The Option ",OPT_POINTER_SIZE," Is Invalid.  The Valid Options Are:"
+$       WRITE SYS$OUTPUT ""
+$       WRITE SYS$OUTPUT "    32  :  Compile with 32 bit pointer size"
+$       WRITE SYS$OUTPUT "    64  :  Compile with 64 bit pointer size"
+$       WRITE SYS$OUTPUT ""
+$!
+$!      Time To EXIT.
+$!
+$       GOTO TIDY
+$!
+$!      End The Valid Arguement Check.
+$!
+$     ENDIF
+$   ENDIF
+$!
+$! End The OPT_POINTER_SIZE Check.
+$!
+$ ENDIF
+$!
+$! Check To See If OPT_COMPILER Is Blank.
+$!
+$ IF (OPT_COMPILER.EQS."")
+$ THEN
+$!
+$!  O.K., The User Didn't Specify A Compiler, Let's Try To
+$!  Find Out Which One To Use.
+$!
+$!  Check To See If We Have GNU C.
+$!
+$   IF (F$TRNLNM("GNU_CC").NES."")
+$   THEN
+$!
+$!    Looks Like GNUC, Set To Use GNUC.
+$!
+$     OPT_COMPILER = "GNUC"
+$!
+$!  Else...
+$!
+$   ELSE
+$!
+$!    Check To See If We Have VAXC Or DECC.
+$!
+$     IF (ARCH.NES."VAX").OR.(F$TRNLNM("DECC$CC_DEFAULT").NES."")
+$     THEN 
+$!
+$!      Looks Like DECC, Set To Use DECC.
+$!
+$       OPT_COMPILER = "DECC"
+$!
+$!    Else...
+$!
+$     ELSE
+$!
+$!      Looks Like VAXC, Set To Use VAXC.
+$!
+$       OPT_COMPILER = "VAXC"
+$!
+$!    End The VAXC Compiler Check.
+$!
+$     ENDIF
+$!
+$!  End The DECC & VAXC Compiler Check.
+$!
+$   ENDIF
+$!
+$!  End The Compiler Check.
+$!
+$ ENDIF
+$!
+$! Check To See If We Have A Option For OPT_TCPIP_LIB.
+$!
+$ IF (OPT_TCPIP_LIB.EQS."")
+$ THEN
+$!
+$!  Find out what socket library we have available
+$!
+$   IF F$PARSE("SOCKETSHR:") .NES. ""
+$   THEN
+$!
+$!    We have SOCKETSHR, and it is my opinion that it's the best to use.
+$!
+$     OPT_TCPIP_LIB = "SOCKETSHR"
+$!
+$!    Tell the user
+$!
+$     WRITE SYS$OUTPUT "Using SOCKETSHR for TCP/IP"
+$!
+$!    Else, let's look for something else
+$!
+$   ELSE
+$!
+$!    Like UCX (the reason to do this before Multinet is that the UCX
+$!    emulation is easier to use...)
+$!
+$     IF F$TRNLNM("UCX$IPC_SHR") .NES. "" -
+	 .OR. F$PARSE("SYS$SHARE:UCX$IPC_SHR.EXE") .NES. "" -
+	 .OR. F$PARSE("SYS$LIBRARY:UCX$IPC.OLB") .NES. ""
+$     THEN
+$!
+$!	Last resort: a UCX or UCX-compatible library
+$!
+$	OPT_TCPIP_LIB = "UCX"
+$!
+$!      Tell the user
+$!
+$       WRITE SYS$OUTPUT "Using UCX or an emulation thereof for TCP/IP"
+$!
+$!	That was all...
+$!
+$     ENDIF
+$   ENDIF
+$ ENDIF
+$!
+$! Set Up Initial CC Definitions, Possibly With User Ones
+$!
+$ CCDEFS = "TCPIP_TYPE_''OPT_TCPIP_LIB',DSO_VMS"
+$ IF F$TYPE(USER_CCDEFS) .NES. "" THEN CCDEFS = CCDEFS + "," + USER_CCDEFS
+$ CCEXTRAFLAGS = ""
+$ IF F$TYPE(USER_CCFLAGS) .NES. "" THEN CCEXTRAFLAGS = USER_CCFLAGS
+$ CCDISABLEWARNINGS = "LONGLONGTYPE,LONGLONGSUFX"
+$ IF F$TYPE(USER_CCDISABLEWARNINGS) .NES. "" THEN -
+	CCDISABLEWARNINGS = CCDISABLEWARNINGS + "," + USER_CCDISABLEWARNINGS
+$!
+$!  Check To See If The User Entered A Valid Paramter.
+$!
+$ IF (OPT_COMPILER.EQS."VAXC").OR.(OPT_COMPILER.EQS."DECC").OR.(OPT_COMPILER.EQS."GNUC")
+$ THEN
+$!
+$!    Check To See If The User Wanted DECC.
+$!
+$   IF (OPT_COMPILER.EQS."DECC")
+$   THEN
+$!
+$!    Looks Like DECC, Set To Use DECC.
+$!
+$     COMPILER = "DECC"
+$!
+$!    Tell The User We Are Using DECC.
+$!
+$     WRITE SYS$OUTPUT "Using DECC 'C' Compiler."
+$!
+$!    Use DECC...
+$!
+$     CC = "CC"
+$     IF ARCH.EQS."VAX" .AND. F$TRNLNM("DECC$CC_DEFAULT").NES."/DECC" -
+	 THEN CC = "CC/DECC"
+$     CC = CC + "/''CC_OPTIMIZE'/''DEBUGGER'/STANDARD=ANSI89''POINTER_SIZE'" + -
+           "/NOLIST/PREFIX=ALL" + -
+	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[.VENDOR_DEFNS])" + -
+	   CCEXTRAFLAGS
+$!
+$!    Define The Linker Options File Name.
+$!
+$     OPT_FILE = "''EXE_DIR'VAX_DECC_OPTIONS.OPT"
+$!
+$!  End DECC Check.
+$!
+$   ENDIF
+$!
+$!  Check To See If We Are To Use VAXC.
+$!
+$   IF (OPT_COMPILER.EQS."VAXC")
+$   THEN
+$!
+$!    Looks Like VAXC, Set To Use VAXC.
+$!
+$     COMPILER = "VAXC"
+$!
+$!    Tell The User We Are Using VAX C.
+$!
+$     WRITE SYS$OUTPUT "Using VAXC 'C' Compiler."
+$!
+$!    Compile Using VAXC.
+$!
+$     CC = "CC"
+$     IF ARCH.NES."VAX"
+$     THEN
+$	WRITE SYS$OUTPUT "There is no VAX C on Alpha!"
+$	EXIT
+$     ENDIF
+$     IF F$TRNLNM("DECC$CC_DEFAULT").EQS."/DECC" THEN CC = "CC/VAXC"
+$     CC = CC + "/''CC_OPTIMIZE'/''DEBUGGER'/NOLIST" + -
+	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[-],SYS$DISK:[.VENDOR_DEFNS])" + -
+	   CCEXTRAFLAGS
+$     CCDEFS = """VAXC""," + CCDEFS
+$!
+$!    Define <sys> As SYS$COMMON:[SYSLIB]
+$!
+$     DEFINE/NOLOG SYS SYS$COMMON:[SYSLIB]
+$!
+$!    Define The Linker Options File Name.
+$!
+$     OPT_FILE = "''EXE_DIR'VAX_VAXC_OPTIONS.OPT"
+$!
+$!  End VAXC Check
+$!
+$   ENDIF
+$!
+$!  Check To See If We Are To Use GNU C.
+$!
+$   IF (OPT_COMPILER.EQS."GNUC")
+$   THEN
+$!
+$!    Looks Like GNUC, Set To Use GNUC.
+$!
+$     COMPILER = "GNUC"
+$!
+$!    Tell The User We Are Using GNUC.
+$!
+$     WRITE SYS$OUTPUT "Using GNU 'C' Compiler."
+$!
+$!    Use GNU C...
+$!
+$     CC = "GCC/NOCASE_HACK/''GCC_OPTIMIZE'/''DEBUGGER'/NOLIST" + -
+	   "/INCLUDE=(SYS$DISK:[],SYS$DISK:[-],SYS$DISK:[.VENDOR_DEFNS])" + -
+	   CCEXTRAFLAGS
+$!
+$!    Define The Linker Options File Name.
+$!
+$     OPT_FILE = "''EXE_DIR'VAX_GNUC_OPTIONS.OPT"
+$!
+$!  End The GNU C Check.
+$!
+$   ENDIF
+$!
+$!  Set up default defines
+$!
+$   CCDEFS = """FLAT_INC=1""," + CCDEFS
+$!
+$!  Finish up the definition of CC.
+$!
+$   IF COMPILER .EQS. "DECC"
+$   THEN
+$     IF CCDISABLEWARNINGS .NES. ""
+$     THEN
+$       CCDISABLEWARNINGS = "/WARNING=(DISABLE=(" + CCDISABLEWARNINGS + "))"
+$     ENDIF
+$   ELSE
+$     CCDISABLEWARNINGS = ""
+$   ENDIF
+$   CC = CC + "/DEFINE=(" + CCDEFS + ")" + CCDISABLEWARNINGS
+$!
+$!  Show user the result
+$!
+$   WRITE/SYMBOL SYS$OUTPUT "Main C Compiling Command: ",CC
+$!
+$!  Else The User Entered An Invalid Argument.
+$!
+$ ELSE
+$!
+$!  Tell The User We Don't Know What They Want.
+$!
+$   WRITE SYS$OUTPUT ""
+$   WRITE SYS$OUTPUT "The Option ",OPT_COMPILER," Is Invalid.  The Valid Options Are:"
+$   WRITE SYS$OUTPUT ""
+$   WRITE SYS$OUTPUT "    VAXC  :  To Compile With VAX C."
+$   WRITE SYS$OUTPUT "    DECC  :  To Compile With DEC C."
+$   WRITE SYS$OUTPUT "    GNUC  :  To Compile With GNU C."
+$   WRITE SYS$OUTPUT ""
+$!
+$!  Time To EXIT.
+$!
+$   EXIT
+$!
+$! End The Valid Argument Check.
+$!
+$ ENDIF
+$!
+$! Build a MACRO command for the architecture at hand
+$!
+$ IF ARCH .EQS. "VAX" THEN MACRO = "MACRO/''DEBUGGER'"
+$ IF ARCH .NES. "VAX" THEN MACRO = "MACRO/MIGRATION/''DEBUGGER'/''MACRO_OPTIMIZE'"
+$!
+$!  Show user the result
+$!
+$ WRITE/SYMBOL SYS$OUTPUT "Main MACRO Compiling Command: ",MACRO
+$!
+$! Time to check the contents, and to make sure we get the correct library.
+$!
+$ IF OPT_TCPIP_LIB.EQS."SOCKETSHR" .OR. OPT_TCPIP_LIB.EQS."MULTINET" -
+     .OR. OPT_TCPIP_LIB.EQS."UCX" .OR. OPT_TCPIP_LIB.EQS."TCPIP" -
+     .OR. OPT_TCPIP_LIB.EQS."NONE"
+$ THEN
+$!
+$!  Check to see if SOCKETSHR was chosen
+$!
+$   IF OPT_TCPIP_LIB.EQS."SOCKETSHR"
+$   THEN
+$!
+$!    Set the library to use SOCKETSHR
+$!
+$     TCPIP_LIB = "SYS$DISK:[-.VMS]SOCKETSHR_SHR.OPT/OPT"
+$!
+$!    Done with SOCKETSHR
+$!
+$   ENDIF
+$!
+$!  Check to see if MULTINET was chosen
+$!
+$   IF OPT_TCPIP_LIB.EQS."MULTINET"
+$   THEN
+$!
+$!    Set the library to use UCX emulation.
+$!
+$     OPT_TCPIP_LIB = "UCX"
+$!
+$!    Done with MULTINET
+$!
+$   ENDIF
+$!
+$!  Check to see if UCX was chosen
+$!
+$   IF OPT_TCPIP_LIB.EQS."UCX"
+$   THEN
+$!
+$!    Set the library to use UCX.
+$!
+$     TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_DECC.OPT/OPT"
+$     IF F$TRNLNM("UCX$IPC_SHR") .NES. ""
+$     THEN
+$       TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_DECC_LOG.OPT/OPT"
+$     ELSE
+$       IF COMPILER .NES. "DECC" .AND. ARCH .EQS. "VAX" THEN -
+	  TCPIP_LIB = "SYS$DISK:[-.VMS]UCX_SHR_VAXC.OPT/OPT"
+$     ENDIF
+$!
+$!    Done with UCX
+$!
+$   ENDIF
+$!
+$!  Check to see if TCPIP was chosen
+$!
+$   IF OPT_TCPIP_LIB.EQS."TCPIP"
+$   THEN
+$!
+$!    Set the library to use TCPIP (post UCX).
+$!
+$     TCPIP_LIB = "SYS$DISK:[-.VMS]TCPIP_SHR_DECC.OPT/OPT"
+$!
+$!    Done with TCPIP
+$!
+$   ENDIF
+$!
+$!  Check to see if NONE was chosen
+$!
+$   IF OPT_TCPIP_LIB.EQS."NONE"
+$   THEN
+$!
+$!    Do not use a TCPIP library.
+$!
+$     TCPIP_LIB = ""
+$!
+$!    Done with TCPIP
+$!
+$   ENDIF
+$!
+$!  Print info
+$!
+$   WRITE SYS$OUTPUT "TCP/IP library spec: ", TCPIP_LIB
+$!
+$!  Else The User Entered An Invalid Argument.
+$!
+$ ELSE
+$!
+$!  Tell The User We Don't Know What They Want.
+$!
+$   WRITE SYS$OUTPUT ""
+$   WRITE SYS$OUTPUT "The Option ",OPT_TCPIP_LIB," Is Invalid.  The Valid Options Are:"
+$   WRITE SYS$OUTPUT ""
+$   WRITE SYS$OUTPUT "    SOCKETSHR  :  To link with SOCKETSHR TCP/IP library."
+$   WRITE SYS$OUTPUT "    UCX        :  To link with UCX TCP/IP library."
+$   WRITE SYS$OUTPUT "    TCPIP      :  To link with TCPIP (post UCX) TCP/IP library."
+$   WRITE SYS$OUTPUT ""
+$!
+$!  Time To EXIT.
+$!
+$   EXIT
+$!
+$!  Done with TCP/IP libraries
+$!
+$ ENDIF
+$!
+$!  Time To RETURN...
+$!
+$ RETURN
+$!
+$ INITIALISE:
+$!
+$! Save old value of the logical name OPENSSL
+$!
+$ __SAVE_OPENSSL = F$TRNLNM("OPENSSL","LNM$PROCESS_TABLE")
+$!
+$! Save directory information
+$!
+$ __HERE = F$PARSE(F$PARSE("A.;",F$ENVIRONMENT("PROCEDURE"))-"A.;","[]A.;") - "A.;"
+$ __HERE = F$EDIT(__HERE,"UPCASE")
+$ __TOP = __HERE - "ENGINES]"
+$ __INCLUDE = __TOP + "INCLUDE.OPENSSL]"
+$!
+$! Set up the logical name OPENSSL to point at the include directory
+$!
+$ DEFINE OPENSSL/NOLOG '__INCLUDE'
+$!
+$! Done
+$!
+$ RETURN
+$!
+$ CLEANUP:
+$!
+$! Restore the logical name OPENSSL if it had a value
+$!
+$ IF __SAVE_OPENSSL .EQS. ""
+$ THEN
+$   DEASSIGN OPENSSL
+$ ELSE
+$   DEFINE/NOLOG OPENSSL '__SAVE_OPENSSL'
+$ ENDIF
+$!
+$! Done
+$!
+$ RETURN