Hi there
On Thu, 5 Oct 2000, Joseph J. Tardo wrote:
> I've been playing with the ENGINE release on freebsd 3.2 attempting to add
> support for new hardware.
cool, is it stuff you are able to contribute back in by any chance? :-)
[snip]
> I'm about ready to integrate with SSL & Apache and make the hardware
> acceleration actually do soemthing. But I am wondering, will ENGINE
> "automagically" work if it finds the .so and hardware and "method search"
> the ENGINE chain, or do I need additional tweaks someplace, analogous to
> the "-engine" switch in speed, to enable particular hardware?
This isn't yet built-in to mod_ssl, and I don't think it's in Apache-SSL
either (though either author could correct me, they're both on this list
;-). It's very straightforward to do this though, and you can see how by
looking in any of the "engine" enabled openssl apps ... eg. apps/speed.c
(a "diff -u" between the non-engine and engine versions in 0.9.6(-engine)
would be instructive). If you're using mod_ssl, someone has even noted
down the line numbers for you (in another thread on openssl-users) ...
I'll include the mail verbatim here for your benefit.
NB: This is to hardware the support into your compiled apache/mod_ssl ...
if you want it controllable via config-file directives, you'll need to add
the relevant declarations and handler functions ... exercise for the
reader :-)
Cheers,
Geoff
>From [EMAIL PROTECTED] Thu Oct 5 22:04:04 2000
Date: Mon, 02 Oct 2000 15:08:49 +0100
From: Adrian Peck <[EMAIL PROTECTED]>
Reply-To: [EMAIL PROTECTED]
To: Sylvain Bolduc <[EMAIL PROTECTED]>
Cc: [EMAIL PROTECTED], [EMAIL PROTECTED]
Subject: mod-ssl.2.6.6 with openssl-engine-0.9.6 and nCipher nFast support
[ The following text is in the "iso-8859-1" character set. ]
[ Your display is set for the "US-ASCII" character set. ]
[ Some characters may be displayed incorrectly. ]
I thought I'd cc modssl-users and openssl-users mailing lists as I guess
others might be having the same problem.
The problem is that the engine code in openssl-engine-0.9.6 is pretty recent
and mod-ssl has yet to add support for it. Ideally there would be a line in
the httpd.conf file to specify what openssl-engine should be used by default,
I'm sure this will be there in future releases :-)
For now you could try the following hack which sets the chil engine as the
default engine to use in mod-ssl.
I'm assuming that
openssl speed -engine chil
works and that you've configured apache to link with the ld library, eg,
edit apache-1.3.12/src/Makefile
by setting
EXTRA_LIBS=-ldl
To get mod-ssl to use chil as the default engine:
Edit apache_1.3.12/src/modules/ssl/mod_ssl.h, just after the line
(line 118) #include <openssl/rand.h>
add
#include <openssl/engine.h>
Edit apache_1.3.12/src/modules/ssl/ssl_engine_init.c, just after the line
(line 329) X509V3_add_standard_extensions();
add
{
/* Lookup the chil engine */
ENGINE *e = ENGINE_by_id("chil");
if( e == NULL )
{
/* Report the error eg.
* fprintf ( stderr, "Couldn't find chil engine" );
*/
return;
}
/* This is vital for the CHIL pluggin to cope with Apache's forking behaviour. */
ENGINE_ctrl(e, ENGINE_CTRL_CHIL_SET_FORKCHECK, 1, 0, 0);
/* Set the chil engine to be the default. */
if( !ENGINE_set_default(e, ENGINE_METHOD_ALL) )
{
/* Report the error eg.
* fprintf ( stderr, "Can't use the chil engine" );
*/
}
ENGINE_free(e);
}
make apache with these changes by typing
make
make install
start apache as usual by typing
bin/apachectl startssl
Let me know how you get on,
Bertie
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
