package/libs/openssl/patches/410-eng_devcrypto-add-configuration-options.patch

   1 From 1c2fabcdb34e436286b4a8760cfbfbff11ea551a Mon Sep 17 00:00:00 2001
   2 From: Eneas U de Queiroz <cote2004-github@yahoo.com>
   3 Date: Sat, 3 Nov 2018 15:41:10 -0300
   4 Subject: eng_devcrypto: add configuration options
   5
   6 USE_SOFTDRIVERS: whether to use software (not accelerated) drivers
   7 CIPHERS: list of ciphers to enable
   8 DIGESTS: list of digests to enable
   9
  10 Signed-off-by: Eneas U de Queiroz <cote2004-github@yahoo.com>
  11
  12 Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
  13 Reviewed-by: Richard Levitte <levitte@openssl.org>
  14 (Merged from https://github.com/openssl/openssl/pull/7585)
  15
  16 diff --git a/crypto/engine/eng_devcrypto.c b/crypto/engine/eng_devcrypto.c
  17 index a2c9a966f7..5ec38ca8f3 100644
  18 --- a/crypto/engine/eng_devcrypto.c
  19 +++ b/crypto/engine/eng_devcrypto.c
  20 @@ -16,6 +16,7 @@
  21  #include <unistd.h>
  22  #include <assert.h>
  23
  24 +#include <openssl/conf.h>
  25  #include <openssl/evp.h>
  26  #include <openssl/err.h>
  27  #include <openssl/engine.h>
  28 @@ -36,6 +37,30 @@
  29   * saner...  why re-open /dev/crypto for every session?
  30   */
  31  static int cfd;
  32 +#define DEVCRYPTO_REQUIRE_ACCELERATED 0 /* require confirmation of acceleration */
  33 +#define DEVCRYPTO_USE_SOFTWARE        1 /* allow software drivers */
  34 +#define DEVCRYPTO_REJECT_SOFTWARE     2 /* only disallow confirmed software drivers */
  35 +
  36 +#define DEVCRYPTO_DEFAULT_USE_SOFDTRIVERS DEVCRYPTO_REJECT_SOFTWARE
  37 +static int use_softdrivers = DEVCRYPTO_DEFAULT_USE_SOFDTRIVERS;
  38 +
  39 +/*
  40 + * cipher/digest status & acceleration definitions
  41 + * Make sure the defaults are set to 0
  42 + */
  43 +struct driver_info_st {
  44 +    enum devcrypto_status_t {
  45 +        DEVCRYPTO_STATUS_UNUSABLE       = -1, /* session open failed */
  46 +        DEVCRYPTO_STATUS_UNKNOWN        =  0, /* not tested yet */
  47 +        DEVCRYPTO_STATUS_USABLE         =  1  /* algo can be used */
  48 +    } status;
  49 +
  50 +    enum devcrypto_accelerated_t {
  51 +        DEVCRYPTO_NOT_ACCELERATED       = -1, /* software implemented */
  52 +        DEVCRYPTO_ACCELERATION_UNKNOWN  =  0, /* acceleration support unkown */
  53 +        DEVCRYPTO_ACCELERATED           =  1  /* hardware accelerated */
  54 +    } accelerated;
  55 +};
  56
  57  static int clean_devcrypto_session(struct session_op *sess) {
  58      if (ioctl(cfd, CIOCFSESSION, &sess->ses) < 0) {
  59 @@ -119,13 +144,22 @@ static const struct cipher_data_st {
  60  #endif
  61  };
  62
  63 -static size_t get_cipher_data_index(int nid)
  64 +static size_t find_cipher_data_index(int nid)
  65  {
  66      size_t i;
  67
  68      for (i = 0; i < OSSL_NELEM(cipher_data); i++)
  69          if (nid == cipher_data[i].nid)
  70              return i;
  71 +    return (size_t)-1;
  72 +}
  73 +
  74 +static size_t get_cipher_data_index(int nid)
  75 +{
  76 +    size_t i = find_cipher_data_index(nid);
  77 +
  78 +    if (i != (size_t)-1)
  79 +        return i;
  80
  81      /*
  82       * Code further down must make sure that only NIDs in the table above
  83 @@ -333,19 +367,40 @@ static int cipher_cleanup(EVP_CIPHER_CTX *ctx)
  84  }
  85
  86  /*
  87 - * Keep a table of known nids and associated methods.
  88 + * Keep tables of known nids, associated methods, selected ciphers, and driver
  89 + * info.
  90   * Note that known_cipher_nids[] isn't necessarily indexed the same way as
  91 - * cipher_data[] above, which known_cipher_methods[] is.
  92 + * cipher_data[] above, which the other tables are.
  93   */
  94  static int known_cipher_nids[OSSL_NELEM(cipher_data)];
  95  static int known_cipher_nids_amount = -1; /* -1 indicates not yet initialised */
  96  static EVP_CIPHER *known_cipher_methods[OSSL_NELEM(cipher_data)] = { NULL, };
  97 +static int selected_ciphers[OSSL_NELEM(cipher_data)];
  98 +static struct driver_info_st cipher_driver_info[OSSL_NELEM(cipher_data)];
  99 +
 100 +
 101 +static int devcrypto_test_cipher(size_t cipher_data_index)
 102 +{
 103 +    return (cipher_driver_info[cipher_data_index].status == DEVCRYPTO_STATUS_USABLE
 104 +            && selected_ciphers[cipher_data_index] == 1
 105 +            && (cipher_driver_info[cipher_data_index].accelerated
 106 +                    == DEVCRYPTO_ACCELERATED
 107 +                || use_softdrivers == DEVCRYPTO_USE_SOFTWARE
 108 +                || (cipher_driver_info[cipher_data_index].accelerated
 109 +                        != DEVCRYPTO_NOT_ACCELERATED
 110 +                    && use_softdrivers == DEVCRYPTO_REJECT_SOFTWARE)));
 111 +}
 112
 113  static void prepare_cipher_methods(void)
 114  {
 115      size_t i;
 116      struct session_op sess;
 117      unsigned long cipher_mode;
 118 +#ifdef CIOCGSESSINFO
 119 +    struct session_info_op siop;
 120 +#endif
 121 +
 122 +    memset(&cipher_driver_info, 0, sizeof(cipher_driver_info));
 123
 124      memset(&sess, 0, sizeof(sess));
 125      sess.key = (void *)"01234567890123456789012345678901234567890123456789";
 126 @@ -353,15 +408,16 @@ static void prepare_cipher_methods(void)
 127      for (i = 0, known_cipher_nids_amount = 0;
 128           i < OSSL_NELEM(cipher_data); i++) {
 129
 130 +        selected_ciphers[i] = 1;
 131          /*
 132 -         * Check that the algo is really availably by trying to open and close
 133 -         * a session.
 134 +         * Check that the cipher is usable
 135           */
 136          sess.cipher = cipher_data[i].devcryptoid;
 137          sess.keylen = cipher_data[i].keylen;
 138 -        if (ioctl(cfd, CIOCGSESSION, &sess) < 0
 139 -            || ioctl(cfd, CIOCFSESSION, &sess.ses) < 0)
 140 +        if (ioctl(cfd, CIOCGSESSION, &sess) < 0) {
 141 +            cipher_driver_info[i].status = DEVCRYPTO_STATUS_UNUSABLE;
 142              continue;
 143 +        }
 144
 145          cipher_mode = cipher_data[i].flags & EVP_CIPH_MODE;
 146
 147 @@ -387,15 +443,41 @@ static void prepare_cipher_methods(void)
 148                                              cipher_cleanup)
 149              || !EVP_CIPHER_meth_set_impl_ctx_size(known_cipher_methods[i],
 150                                                    sizeof(struct cipher_ctx))) {
 151 +            cipher_driver_info[i].status = DEVCRYPTO_STATUS_UNUSABLE;
 152              EVP_CIPHER_meth_free(known_cipher_methods[i]);
 153              known_cipher_methods[i] = NULL;
 154          } else {
 155 +            cipher_driver_info[i].status = DEVCRYPTO_STATUS_USABLE;
 156 +#ifdef CIOCGSESSINFO
 157 +            siop.ses = sess.ses;
 158 +            if (ioctl(cfd, CIOCGSESSINFO, &siop) < 0)
 159 +                cipher_driver_info[i].accelerated = DEVCRYPTO_ACCELERATION_UNKNOWN;
 160 +            else if (!(siop.flags & SIOP_FLAG_KERNEL_DRIVER_ONLY))
 161 +                cipher_driver_info[i].accelerated = DEVCRYPTO_NOT_ACCELERATED;
 162 +            else
 163 +                cipher_driver_info[i].accelerated = DEVCRYPTO_ACCELERATED;
 164 +#endif /* CIOCGSESSINFO */
 165 +        }
 166 +        ioctl(cfd, CIOCFSESSION, &sess.ses);
 167 +        if (devcrypto_test_cipher(i)) {
 168              known_cipher_nids[known_cipher_nids_amount++] =
 169                  cipher_data[i].nid;
 170          }
 171      }
 172  }
 173
 174 +static void rebuild_known_cipher_nids(ENGINE *e)
 175 +{
 176 +    size_t i;
 177 +
 178 +    for (i = 0, known_cipher_nids_amount = 0; i < OSSL_NELEM(cipher_data); i++) {
 179 +        if (devcrypto_test_cipher(i))
 180 +            known_cipher_nids[known_cipher_nids_amount++] = cipher_data[i].nid;
 181 +    }
 182 +    ENGINE_unregister_ciphers(e);
 183 +    ENGINE_register_ciphers(e);
 184 +}
 185 +
 186  static const EVP_CIPHER *get_cipher_method(int nid)
 187  {
 188      size_t i = get_cipher_data_index(nid);
 189 @@ -438,6 +520,36 @@ static int devcrypto_ciphers(ENGINE *e, const EVP_CIPHER **cipher,
 190      return *cipher != NULL;
 191  }
 192
 193 +static void devcrypto_select_all_ciphers(int *cipher_list)
 194 +{
 195 +    size_t i;
 196 +
 197 +    for (i = 0; i < OSSL_NELEM(cipher_data); i++)
 198 +        cipher_list[i] = 1;
 199 +}
 200 +
 201 +static int cryptodev_select_cipher_cb(const char *str, int len, void *usr)
 202 +{
 203 +    int *cipher_list = (int *)usr;
 204 +    char *name;
 205 +    const EVP_CIPHER *EVP;
 206 +    size_t i;
 207 +
 208 +    if (len == 0)
 209 +        return 1;
 210 +    if (usr == NULL || (name = OPENSSL_strndup(str, len)) == NULL)
 211 +        return 0;
 212 +    EVP = EVP_get_cipherbyname(name);
 213 +    if (EVP == NULL)
 214 +        fprintf(stderr, "devcrypto: unknown cipher %s\n", name);
 215 +    else if ((i = find_cipher_data_index(EVP_CIPHER_nid(EVP))) != (size_t)-1)
 216 +        cipher_list[i] = 1;
 217 +    else
 218 +        fprintf(stderr, "devcrypto: cipher %s not available\n", name);
 219 +    OPENSSL_free(name);
 220 +    return 1;
 221 +}
 222 +
 223  /*
 224   * We only support digests if the cryptodev implementation supports multiple
 225   * data updates and session copying.  Otherwise, we would be forced to maintain
 226 @@ -493,13 +605,22 @@ static const struct digest_data_st {
 227  #endif
 228  };
 229
 230 -static size_t get_digest_data_index(int nid)
 231 +static size_t find_digest_data_index(int nid)
 232  {
 233      size_t i;
 234
 235      for (i = 0; i < OSSL_NELEM(digest_data); i++)
 236          if (nid == digest_data[i].nid)
 237              return i;
 238 +    return (size_t)-1;
 239 +}
 240 +
 241 +static size_t get_digest_data_index(int nid)
 242 +{
 243 +    size_t i = find_digest_data_index(nid);
 244 +
 245 +    if (i != (size_t)-1)
 246 +        return i;
 247
 248      /*
 249       * Code further down must make sure that only NIDs in the table above
 250 @@ -516,8 +637,8 @@ static const struct digest_data_st *get_digest_data(int nid)
 251  }
 252
 253  /*
 254 - * Following are the four necessary functions to map OpenSSL functionality
 255 - * with cryptodev.
 256 + * Following are the five necessary functions to map OpenSSL functionality
 257 + * with cryptodev: init, update, final, cleanup, and copy.
 258   */
 259
 260  static int digest_init(EVP_MD_CTX *ctx)
 261 @@ -630,52 +751,94 @@ static int digest_cleanup(EVP_MD_CTX *ctx)
 262      return clean_devcrypto_session(&digest_ctx->sess);
 263  }
 264
 265 -static int devcrypto_test_digest(size_t digest_data_index)
 266 -{
 267 -    struct session_op sess1, sess2;
 268 -    struct cphash_op cphash;
 269 -    int ret=0;
 270 -
 271 -    memset(&sess1, 0, sizeof(sess1));
 272 -    memset(&sess2, 0, sizeof(sess2));
 273 -    sess1.mac = digest_data[digest_data_index].devcryptoid;
 274 -    if (ioctl(cfd, CIOCGSESSION, &sess1) < 0)
 275 -        return 0;
 276 -    /* Make sure the driver is capable of hash state copy */
 277 -    sess2.mac = sess1.mac;
 278 -    if (ioctl(cfd, CIOCGSESSION, &sess2) >= 0) {
 279 -        cphash.src_ses = sess1.ses;
 280 -        cphash.dst_ses = sess2.ses;
 281 -        if (ioctl(cfd, CIOCCPHASH, &cphash) >= 0)
 282 -            ret = 1;
 283 -        ioctl(cfd, CIOCFSESSION, &sess2.ses);
 284 -    }
 285 -    ioctl(cfd, CIOCFSESSION, &sess1.ses);
 286 -    return ret;
 287 -}
 288 -
 289  /*
 290 - * Keep a table of known nids and associated methods.
 291 + * Keep tables of known nids, associated methods, selected digests, and
 292 + * driver info.
 293   * Note that known_digest_nids[] isn't necessarily indexed the same way as
 294 - * digest_data[] above, which known_digest_methods[] is.
 295 + * digest_data[] above, which the other tables are.
 296   */
 297  static int known_digest_nids[OSSL_NELEM(digest_data)];
 298  static int known_digest_nids_amount = -1; /* -1 indicates not yet initialised */
 299  static EVP_MD *known_digest_methods[OSSL_NELEM(digest_data)] = { NULL, };
 300 +static int selected_digests[OSSL_NELEM(digest_data)];
 301 +static struct driver_info_st digest_driver_info[OSSL_NELEM(digest_data)];
 302 +
 303 +static int devcrypto_test_digest(size_t digest_data_index)
 304 +{
 305 +    return (digest_driver_info[digest_data_index].status == DEVCRYPTO_STATUS_USABLE
 306 +            && selected_digests[digest_data_index] == 1
 307 +            && (digest_driver_info[digest_data_index].accelerated
 308 +                    == DEVCRYPTO_ACCELERATED
 309 +                || use_softdrivers == DEVCRYPTO_USE_SOFTWARE
 310 +                || (digest_driver_info[digest_data_index].accelerated
 311 +                        != DEVCRYPTO_NOT_ACCELERATED
 312 +                    && use_softdrivers == DEVCRYPTO_REJECT_SOFTWARE)));
 313 +}
 314 +
 315 +static void rebuild_known_digest_nids(ENGINE *e)
 316 +{
 317 +    size_t i;
 318 +
 319 +    for (i = 0, known_digest_nids_amount = 0; i < OSSL_NELEM(digest_data); i++) {
 320 +        if (devcrypto_test_digest(i))
 321 +            known_digest_nids[known_digest_nids_amount++] = digest_data[i].nid;
 322 +    }
 323 +    ENGINE_unregister_digests(e);
 324 +    ENGINE_register_digests(e);
 325 +}
 326
 327  static void prepare_digest_methods(void)
 328  {
 329      size_t i;
 330 +    struct session_op sess1, sess2;
 331 +#ifdef CIOCGSESSINFO
 332 +    struct session_info_op siop;
 333 +#endif
 334 +    struct cphash_op cphash;
 335 +
 336 +    memset(&digest_driver_info, 0, sizeof(digest_driver_info));
 337 +
 338 +    memset(&sess1, 0, sizeof(sess1));
 339 +    memset(&sess2, 0, sizeof(sess2));
 340
 341      for (i = 0, known_digest_nids_amount = 0; i < OSSL_NELEM(digest_data);
 342           i++) {
 343
 344 +        selected_digests[i] = 1;
 345 +
 346          /*
 347 -         * Check that the algo is usable
 348 +         * Check that the digest is usable
 349           */
 350 -        if (!devcrypto_test_digest(i))
 351 -            continue;
 352 +        sess1.mac = digest_data[i].devcryptoid;
 353 +        sess2.ses = 0;
 354 +        if (ioctl(cfd, CIOCGSESSION, &sess1) < 0) {
 355 +            digest_driver_info[i].status = DEVCRYPTO_STATUS_UNUSABLE;
 356 +            goto finish;
 357 +        }
 358
 359 +#ifdef CIOCGSESSINFO
 360 +        /* gather hardware acceleration info from the driver */
 361 +        siop.ses = sess1.ses;
 362 +        if (ioctl(cfd, CIOCGSESSINFO, &siop) < 0)
 363 +            digest_driver_info[i].accelerated = DEVCRYPTO_ACCELERATION_UNKNOWN;
 364 +        else if (siop.flags & SIOP_FLAG_KERNEL_DRIVER_ONLY)
 365 +            digest_driver_info[i].accelerated = DEVCRYPTO_ACCELERATED;
 366 +        else
 367 +            digest_driver_info[i].accelerated = DEVCRYPTO_NOT_ACCELERATED;
 368 +#endif
 369 +
 370 +        /* digest must be capable of hash state copy */
 371 +        sess2.mac = sess1.mac;
 372 +        if (ioctl(cfd, CIOCGSESSION, &sess2) < 0) {
 373 +            digest_driver_info[i].status = DEVCRYPTO_STATUS_UNUSABLE;
 374 +            goto finish;
 375 +        }
 376 +        cphash.src_ses = sess1.ses;
 377 +        cphash.dst_ses = sess2.ses;
 378 +        if (ioctl(cfd, CIOCCPHASH, &cphash) < 0) {
 379 +            digest_driver_info[i].status = DEVCRYPTO_STATUS_UNUSABLE;
 380 +            goto finish;
 381 +        }
 382          if ((known_digest_methods[i] = EVP_MD_meth_new(digest_data[i].nid,
 383                                                         NID_undef)) == NULL
 384              || !EVP_MD_meth_set_input_blocksize(known_digest_methods[i],
 385 @@ -689,11 +852,18 @@ static void prepare_digest_methods(void)
 386              || !EVP_MD_meth_set_cleanup(known_digest_methods[i], digest_cleanup)
 387              || !EVP_MD_meth_set_app_datasize(known_digest_methods[i],
 388                                               sizeof(struct digest_ctx))) {
 389 +            digest_driver_info[i].status = DEVCRYPTO_STATUS_UNUSABLE;
 390              EVP_MD_meth_free(known_digest_methods[i]);
 391              known_digest_methods[i] = NULL;
 392 -        } else {
 393 -            known_digest_nids[known_digest_nids_amount++] = digest_data[i].nid;
 394 +            goto finish;
 395          }
 396 +        digest_driver_info[i].status = DEVCRYPTO_STATUS_USABLE;
 397 +finish:
 398 +        ioctl(cfd, CIOCFSESSION, &sess1.ses);
 399 +        if (sess2.ses != 0)
 400 +            ioctl(cfd, CIOCFSESSION, &sess2.ses);
 401 +        if (devcrypto_test_digest(i))
 402 +            known_digest_nids[known_digest_nids_amount++] = digest_data[i].nid;
 403      }
 404  }
 405
 406 @@ -739,8 +909,154 @@ static int devcrypto_digests(ENGINE *e, const EVP_MD **digest,
 407      return *digest != NULL;
 408  }
 409
 410 +static void devcrypto_select_all_digests(int *digest_list)
 411 +{
 412 +    size_t i;
 413 +
 414 +    for (i = 0; i < OSSL_NELEM(digest_data); i++)
 415 +        digest_list[i] = 1;
 416 +}
 417 +
 418 +static int cryptodev_select_digest_cb(const char *str, int len, void *usr)
 419 +{
 420 +    int *digest_list = (int *)usr;
 421 +    char *name;
 422 +    const EVP_MD *EVP;
 423 +    size_t i;
 424 +
 425 +    if (len == 0)
 426 +        return 1;
 427 +    if (usr == NULL || (name = OPENSSL_strndup(str, len)) == NULL)
 428 +        return 0;
 429 +    EVP = EVP_get_digestbyname(name);
 430 +    if (EVP == NULL)
 431 +        fprintf(stderr, "devcrypto: unknown digest %s\n", name);
 432 +    else if ((i = find_digest_data_index(EVP_MD_type(EVP))) != (size_t)-1)
 433 +        digest_list[i] = 1;
 434 +    else
 435 +        fprintf(stderr, "devcrypto: digest %s not available\n", name);
 436 +    OPENSSL_free(name);
 437 +    return 1;
 438 +}
 439 +
 440 +#endif
 441 +
 442 +/******************************************************************************
 443 + *
 444 + * CONTROL COMMANDS
 445 + *
 446 + *****/
 447 +
 448 +#define DEVCRYPTO_CMD_USE_SOFTDRIVERS ENGINE_CMD_BASE
 449 +#define DEVCRYPTO_CMD_CIPHERS (ENGINE_CMD_BASE + 1)
 450 +#define DEVCRYPTO_CMD_DIGESTS (ENGINE_CMD_BASE + 2)
 451 +#define DEVCRYPTO_CMD_DUMP_INFO (ENGINE_CMD_BASE + 3)
 452 +
 453 +/* Helper macros for CPP string composition */
 454 +#ifndef OPENSSL_MSTR
 455 +# define OPENSSL_MSTR_HELPER(x) #x
 456 +# define OPENSSL_MSTR(x) OPENSSL_MSTR_HELPER(x)
 457 +#endif
 458 +
 459 +static const ENGINE_CMD_DEFN devcrypto_cmds[] = {
 460 +#ifdef CIOCGSESSINFO
 461 +   {DEVCRYPTO_CMD_USE_SOFTDRIVERS,
 462 +    "USE_SOFTDRIVERS",
 463 +    "specifies whether to use software (not accelerated) drivers ("
 464 +        OPENSSL_MSTR(DEVCRYPTO_REQUIRE_ACCELERATED) "=use only accelerated drivers, "
 465 +        OPENSSL_MSTR(DEVCRYPTO_USE_SOFTWARE) "=allow all drivers, "
 466 +        OPENSSL_MSTR(DEVCRYPTO_REJECT_SOFTWARE)
 467 +        "=use if acceleration can't be determined) [default="
 468 +        OPENSSL_MSTR(DEVCRYPTO_DEFAULT_USE_SOFDTRIVERS) "]",
 469 +    ENGINE_CMD_FLAG_NUMERIC},
 470 +#endif
 471 +
 472 +   {DEVCRYPTO_CMD_CIPHERS,
 473 +    "CIPHERS",
 474 +    "either ALL, NONE, or a comma-separated list of ciphers to enable [default=ALL]",
 475 +    ENGINE_CMD_FLAG_STRING},
 476 +
 477 +#ifdef IMPLEMENT_DIGEST
 478 +   {DEVCRYPTO_CMD_DIGESTS,
 479 +    "DIGESTS",
 480 +    "either ALL, NONE, or a comma-separated list of digests to enable [default=ALL]",
 481 +    ENGINE_CMD_FLAG_STRING},
 482  #endif
 483
 484 +   {0, NULL, NULL, 0}
 485 +};
 486 +
 487 +static int devcrypto_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void))
 488 +{
 489 +    int *new_list;
 490 +    switch (cmd) {
 491 +#ifdef CIOCGSESSINFO
 492 +    case DEVCRYPTO_CMD_USE_SOFTDRIVERS:
 493 +        switch (i) {
 494 +        case DEVCRYPTO_REQUIRE_ACCELERATED:
 495 +        case DEVCRYPTO_USE_SOFTWARE:
 496 +        case DEVCRYPTO_REJECT_SOFTWARE:
 497 +            break;
 498 +        default:
 499 +            fprintf(stderr, "devcrypto: invalid value (%ld) for USE_SOFTDRIVERS\n", i);
 500 +            return 0;
 501 +        }
 502 +        if (use_softdrivers == i)
 503 +            return 1;
 504 +        use_softdrivers = i;
 505 +#ifdef IMPLEMENT_DIGEST
 506 +        rebuild_known_digest_nids(e);
 507 +#endif
 508 +        rebuild_known_cipher_nids(e);
 509 +        return 1;
 510 +#endif /* CIOCGSESSINFO */
 511 +
 512 +    case DEVCRYPTO_CMD_CIPHERS:
 513 +        if (p == NULL)
 514 +            return 1;
 515 +        if (strcasecmp((const char *)p, "ALL") == 0) {
 516 +            devcrypto_select_all_ciphers(selected_ciphers);
 517 +        } else if (strcasecmp((const char*)p, "NONE") == 0) {
 518 +            memset(selected_ciphers, 0, sizeof(selected_ciphers));
 519 +        } else {
 520 +            new_list=OPENSSL_zalloc(sizeof(selected_ciphers));
 521 +            if (!CONF_parse_list(p, ',', 1, cryptodev_select_cipher_cb, new_list)) {
 522 +                OPENSSL_free(new_list);
 523 +                return 0;
 524 +            }
 525 +            memcpy(selected_ciphers, new_list, sizeof(selected_ciphers));
 526 +            OPENSSL_free(new_list);
 527 +        }
 528 +        rebuild_known_cipher_nids(e);
 529 +        return 1;
 530 +
 531 +#ifdef IMPLEMENT_DIGEST
 532 +    case DEVCRYPTO_CMD_DIGESTS:
 533 +        if (p == NULL)
 534 +            return 1;
 535 +        if (strcasecmp((const char *)p, "ALL") == 0) {
 536 +            devcrypto_select_all_digests(selected_digests);
 537 +        } else if (strcasecmp((const char*)p, "NONE") == 0) {
 538 +            memset(selected_digests, 0, sizeof(selected_digests));
 539 +        } else {
 540 +            new_list=OPENSSL_zalloc(sizeof(selected_digests));
 541 +            if (!CONF_parse_list(p, ',', 1, cryptodev_select_digest_cb, new_list)) {
 542 +                OPENSSL_free(new_list);
 543 +                return 0;
 544 +            }
 545 +            memcpy(selected_digests, new_list, sizeof(selected_digests));
 546 +            OPENSSL_free(new_list);
 547 +        }
 548 +        rebuild_known_digest_nids(e);
 549 +        return 1;
 550 +#endif /* IMPLEMENT_DIGEST */
 551 +
 552 +    default:
 553 +        break;
 554 +    }
 555 +    return 0;
 556 +}
 557 +
 558  /******************************************************************************
 559   *
 560   * LOAD / UNLOAD
 561 @@ -793,6 +1109,8 @@ void engine_load_devcrypto_int()
 562
 563      if (!ENGINE_set_id(e, "devcrypto")
 564          || !ENGINE_set_name(e, "/dev/crypto engine")
 565 +        || !ENGINE_set_cmd_defns(e, devcrypto_cmds)
 566 +        || !ENGINE_set_ctrl_function(e, devcrypto_ctrl)
 567
 568  /*
 569   * Asymmetric ciphers aren't well supported with /dev/crypto.  Among the BSD