search for: engine_load_builtin_engin

...versions: > > @@ -70,12 +70,19 @@ ssh_compatible_openssl(long headerver, long libver) > void > ssh_OpenSSL_add_all_algorithms(void) > { > +#if OPENSSL_VERSION_NUMBER < 0x10100000L > OpenSSL_add_all_algorithms(); > > /* Enable use of crypto hardware */ > ENGINE_load_builtin_engines(); > +#if OPENSSL_VERSION_NUMBER < 0x10001000L > ENGINE_register_all_complete(); > +#endif > OPENSSL_config(NULL); > +#else > + OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_DIGESTS | > + OPENSSL_INIT_ADD_ALL_DIGESTS | OPENSSL_INIT_LOAD_CONFIG, > NULL); > +#endif...

Hi all, attached is a patch that enables using hardware crypto accelerators available through OpenSSL library for SSH operations. Especially in ssh/sshd it can bring a significant speed improvement. OTOH if no crypto engine is available, nothing bad happens and default software crypto routines are used. This patch is used in SUSE Linux OpenSSH package and proved to work (at least it didn't

...erations that are to be offloaded, it is necessary to restrict use to subset > of OpenSSL functions (the EVP_ functions) and explicitly indicate the use of the PKCS11 > engine; something like the following works for bulk ciphers (the process for RSA is similar): > > ENGINE *e; > ENGINE_load_builtin_engines(); > e = ENGINE_by_id("pkcs11"); > ENGINE_set_default_ciphers(e); > EVP_CIPHER_CTX_init (&ctx); > EVP_EncryptInit (&ctx, EVP_des_cbc (), key, iv); > EVP_EncryptUpdate (.....); Since I'm not familiar with SSL programming, I wonder if it's possible to modif...

...gine' gives an error: checking for OpenSSL ENGINE support... configure: error: OpenSSL ENGINE support not found Cause: configure.ac lines 1916 onward state: AC_TRY_COMPILE( [ #include <openssl/engine.h>], [ int main(void){ENGINE_load_builtin_engines();ENGINE_register_all_complete();} ], [ AC_MSG_RESULT(yes) AC_DEFINE(USE_OPENSSL_ENGINE, 1, [Enable OpenSSL engine support]) ], [ AC_MSG_ERROR(Ope...

...de ] ) +AC_ARG_WITH(ssl-engine, + [ --with-ssl-engine Enable OpenSSL (hardware) ENGINE support ], + [ if test "x$withval" != "xno" ; then + AC_MSG_CHECKING(for OpenSSL ENGINE support) + AC_TRY_COMPILE( + [ #include <openssl/engine.h>], + [ +int main(void){ENGINE_load_builtin_engines();ENGINE_register_all_complete();} + ], + [ AC_MSG_RESULT(yes) + AC_DEFINE(USE_OPENSSL_ENGINE, 1, + [Enable OpenSSL engine support]) + ], + [ AC_MSG_ERROR(OpenSSL ENGINE support not found)] + ) + fi ] +) + # Some systems want crypt() from libcrypt, *not* the version in Open...

...stream_openssl.so: undefined reference to `ENGINE_set_default at OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_init at OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_load_builtin_engines at OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_free at OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so: undefined reference to `ENGINE_finish at OPENSSL_1_1_0' /opt/bin/ld: ../lib-ssl...

...ompat/openssl-compat.c +++ b/openbsd-compat/openssl-compat.c @@ -70,7 +70,9 @@ ssh_compatible_openssl(long headerver, long libver) void ssh_OpenSSL_add_all_algorithms(void) { +#ifdef HAVE_OPENSSL_ADD_ALL_ALGORITHMS OpenSSL_add_all_algorithms(); +#endif /* Enable use of crypto hardware */ ENGINE_load_builtin_engines(); diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h index b87ce59e..3ebdcca1 100644 --- a/openbsd-compat/openssl-compat.h +++ b/openbsd-compat/openssl-compat.h @@ -113,6 +113,10 @@ void ssh_OpenSSL_add_all_algorithms(void); #endif /* SSH_DONT_OVERLOAD_OPENSSL_FUNC...

Hi, OpenSSH 7.9p1 is almost ready for release, so we would appreciate testing on as many platforms and systems as possible. This is a bugfix release. Snapshot releases for portable OpenSSH are available from http://www.mindrot.org/openssh_snap/ The OpenBSD version is available in CVS HEAD: http://www.openbsd.org/anoncvs.html Portable OpenSSH is also available via git using the instructions at

...itrary external engine to establish a secure RSA-based tunnel. OpenSSH would need no information built into it to accomodate any particular engine. One approach to this would be that taken by Stunnel (http://www.stunnel.org/). Stunnel first loads the internal engine 'dynamic'. It then uses ENGINE_load_builtin_engines(), but I think ENGINE_load_dynamic() would be more efficient. Next a series of ENGINE_ctrl_cmd_string() and other engine(1) calls are used to locate, name, load and initialize an external engine. IMHO, they did a very nice job of achieving a highly versatile implementation. It was easy to config...

...ted fun:MD5*=uninstrumented fun:MD4*=uninstrumented fun:*X509*=uninstrumented fun:OPENSSL*=uninstrumented fun:CRYPTO*=uninstrumented fun:TLS*=uninstrumented fun:BIO_*=uninstrumented fun:gzdopen=uninstrumented fun:gzclose=uninstrumented fun:gzwrite=uninstrumented fun:a2i_IPADDRESS=uninstrumented fun:ENGINE_load_builtin_engines=uninstrumented fun:inflateInit2_=uninstrumented fun:inflate=uninstrumented fun:inflateEnd=uninstrumented fun:inflateInit2_=uninstrumented fun:ASN1_*=uninstrumented fun:GENERAL_NAME_free=uninstrumented fun:CONF_modules_load_file=uninstrumented

...SL_1.0.0' /usr/local/lib/dovecot/libdovecot-storage.so: undefined reference to `SSL_set_bio at OPENSSL_1.0.0' /usr/local/lib/dovecot/libdovecot-storage.so: undefined reference to `ASN1_STRING_data at OPENSSL_1.0.0' /usr/local/lib/dovecot/libdovecot-storage.so: undefined reference to `ENGINE_load_builtin_engines at OPENSSL_1.0.0' /usr/local/lib/dovecot/libdovecot-storage.so: undefined reference to `PEM_read_bio_X509 at OPENSSL_1.0.0' /usr/local/lib/dovecot/libdovecot-storage.so: undefined reference to `EVP_cleanup at OPENSSL_1.0.0' /usr/local/lib/dovecot/libdovecot-storage.so: undefined ref...

...nssl.so OBJ_cleanup ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_verify_cert_error_string ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ASN1_STRING_length ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so X509_STORE_add_crl ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so ENGINE_load_builtin_engines ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_set_client_CA_list ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so OBJ_txt2nid ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_use_certificate ../lib-ssl-iostream/.libs/libssl_iostream_openssl.so SSL_CTX_use_certificate .....