crypto: Remove internal ENGINE usage from the subdir

Engines can be removed safely from static and internal functions
clearing out our codebase.

Resolves: https://github.com/openssl/project/issues/1625

Signed-off-by: Norbert Pocs <norbertp@openssl.org>

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Reviewed-by: Saša Nedvědický <sashan@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/28629)

.github/workflows/ci.yml

@@ -588,7 +588,7 @@ jobs:
     - name: checkout fuzz/corpora submodule
       run: git submodule update --init --depth 1 fuzz/corpora
     - name: config
-      run: ./config --strict-warnings --banner=Configured --debug no-afalgeng enable-demos enable-h3demo no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump
+      run: ./config --strict-warnings --banner=Configured --debug enable-demos enable-h3demo no-shared enable-crypto-mdebug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 no-fips && perl configdata.pm --dump
     - name: make
       run: make -s -j4
     - name: get cpu info
@@ -711,7 +711,7 @@ jobs:
     - name: setup hostname workaround
       run: sudo hostname localhost
     - name: config
-      run: ./config --strict-warnings --banner=Configured --debug no-afalgeng enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump
+      run: ./config --strict-warnings --banner=Configured --debug enable-rc5 enable-md2 enable-ssl3 enable-ssl3-method enable-weak-ssl-ciphers enable-zlib enable-ec_nistp_64_gcc_128 enable-external-tests no-fips && perl configdata.pm --dump
     - name: make
       run: make -s -j4
     - uses: dtolnay/rust-toolchain@0f44b27771c32bda9f458f75a1e241b09791b331

.github/workflows/coveralls.yml

@@ -68,7 +68,7 @@ jobs:
               "extra_config": "no-afalgeng enable-fips"
             }, {
               "branch": "master",
-              "extra_config": "no-afalgeng enable-fips enable-tfo enable-lms enable-crypto-mdebug enable-allocfail-tests"
+              "extra_config": "enable-fips enable-tfo enable-lms enable-crypto-mdebug enable-allocfail-tests"
           }]
           EOF
           )

.github/workflows/run-checker-daily.yml

@@ -24,7 +24,6 @@ jobs:
       matrix:
         opt: [
           386,
-          no-afalgeng,
           no-apps,
           no-argon2,
           no-aria,
@@ -41,7 +40,6 @@ jobs:
           no-bulk,
           no-cached-fetch,
           no-camellia,
-          no-capieng,
           no-cast,
           no-chacha,
           no-cmac,
@@ -52,7 +50,6 @@ jobs:
           enable-demos,
           no-deprecated,
           no-des,
-#          enable-devcryptoeng,  # Cannot work on Linux
           no-docs,
           no-dsa,
           no-dtls1,
@@ -63,7 +60,6 @@ jobs:
           no-ecdsa,
           enable-ec_nistp_64_gcc_128,
           enable-egd,
-          no-engine,
 #          enable-external-tests,  # Requires extra setup
           enable-fips,
           enable-fips enable-acvp-tests,
@@ -76,7 +72,6 @@ jobs:
           enable-heartbeats,
           enable-hqinterop,
           no-hw,
-          no-hw-padlock,
           no-idea,
           enable-lms,
           no-makedepend,
@@ -87,7 +82,6 @@ jobs:
           no-multiblock,
           no-nextprotoneg,
           no-ocb,
-          no-padlockeng,
           no-pic,
           no-poly1305,
           no-posix-io,
@@ -114,7 +108,7 @@ jobs:
           enable-ssl3,
           enable-ssl3-method,
           enable-sslkeylog,
-          no-static-engine no-shared,
+          no-shared,
           no-tests,
           enable-tfo,
           no-tls1,

.github/workflows/run-checker-merge.yml

@@ -20,9 +20,8 @@ jobs:
         opt: [
           enable-asan enable-ubsan no-shared no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function,
           no-dso,
-          no-dynamic-engine,
           no-ec2m enable-fips,
-          no-engine no-shared,
+          no-shared,
           no-err,
           no-filenames,
           enable-ubsan no-asm -DOPENSSL_SMALL_FOOTPRINT -fno-sanitize=function,

.github/workflows/windows.yml

@@ -72,7 +72,6 @@ jobs:
       run: |
         echo ${Env:OSSL_VERSION}
         reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
-        reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v ENGINESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
         reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
         reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32
     - name: get cpu info

.github/workflows/windows_comp.yml

@@ -63,7 +63,6 @@ jobs:
       run: |
         echo ${Env:OSSL_VERSION}
         reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
-        reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v ENGINESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
         reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
         reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32
     - name: download coreinfo
@@ -130,7 +129,6 @@ jobs:
       run: |
         echo ${Env:OSSL_VERSION}
         reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
-        reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v ENGINESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
         reg.exe add HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v MODULESDIR /t REG_EXPAND_SZ /d TESTOPENSSLDIR /reg:32
         reg.exe query HKLM\SOFTWARE\OpenSSL-${Env:OSSL_VERSION}-openssl /v OPENSSLDIR /reg:32
     - name: download coreinfo

CHANGES.md

@@ -81,6 +81,15 @@ OpenSSL 4.0
 
    *Daniel Kubec*
 
+ * ENGINE support was removed. The `no-engine` build option and the
+   `OPENSSL_NO_ENGINE` macro is always present.
+   Applications using `ENGINE_` functions unguarded with `OPENSSL_NO_ENGINE`
+   can be built by defining a macro `OPENSSL_ENGINE_STUBS`, however all these
+   functions will return error when called. Provider API should be used to
+   replace ENGINEs functionality.
+
+   *Milan Broz*, *Neil Horman*, *Norbert Pocs*
+
 OpenSSL 3.6
 -----------
 

Configurations/10-main.conf

@@ -694,7 +694,6 @@ my %targets = (
         shared_target    => "linux-shared",
         shared_cflag     => "-fPIC",
         shared_ldflag    => sub { $disabled{pinshared} ? () : "-Wl,-znodelete" },
-        enable           => [ "afalgeng" ],
     },
     "linux-latomic" => {
         inherit_from     => [ "linux-generic32" ],
@@ -1027,7 +1026,6 @@ my %targets = (
         cflags           => threads("-pthread"),
         cppflags         => threads("-D_THREAD_SAFE -D_REENTRANT"),
         ex_libs          => add(threads("-pthread")),
-        enable           => add("devcryptoeng"),
         bn_ops           => "BN_LLONG",
         thread_scheme    => "pthreads",
         dso_scheme       => "dlfcn",
@@ -1201,7 +1199,6 @@ my %targets = (
         cflags           => threads("-pthread"),
         cppflags         => threads("-D_THREAD_SAFE -D_REENTRANT"),
         ex_libs          => add(threads("-pthread")),
-        enable           => add("devcryptoeng"),
         bn_ops           => "BN_LLONG",
         thread_scheme    => "pthreads",
         dso_scheme       => "dlfcn",
@@ -2049,7 +2046,7 @@ my %targets = (
         asflags          => sub { vms_info()->{asflags} },
         perlasm_scheme   => sub { vms_info()->{perlasm_scheme} },
 
-        disable          => add('pinshared', 'loadereng'),
+        disable          => add('pinshared'),
 
     },
 

Configurations/descrip.mms.tmpl

@@ -56,13 +56,8 @@
       map { platform->sharedname($_) // () }
       grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
       @{$unified_info{libraries}};
-  our @install_engines =
-      grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
-             && $unified_info{attributes}->{modules}->{$_}->{engine} }
-      @{$unified_info{modules}};
   our @install_modules =
       grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
-             && !$unified_info{attributes}->{modules}->{$_}->{engine}
              && !$unified_info{attributes}->{modules}->{$_}->{fips} }
       @{$unified_info{modules}};
   our @install_fipsmodules =
@@ -109,7 +104,6 @@
                 @{$config{lib_defines}}, @{$config{shared_defines}},
                 @cnf_defines,
                 'OPENSSLDIR="""$(OPENSSLDIR_C)"""',
-                'ENGINESDIR="""$(ENGINESDIR_C)"""',
                 'MODULESDIR="""$(MODULESDIR_C)"""'
                 )
       . '$(DEFINES)'
@@ -353,7 +347,6 @@ GENERATED={- # common0.tmpl provides @generated
 
 INSTALL_LIBS={- join(", ", map { "-\n\t".$_.".OLB" } @install_libs) -}
 INSTALL_SHLIBS={- join(", ", map { "-\n\t".$_.".EXE" } @install_shlibs) -}
-INSTALL_ENGINES={- join(", ", map { "-\n\t".$_.".EXE" } @install_engines) -}
 INSTALL_MODULES={- join(", ", map { "-\n\t".$_.".EXE" } @install_modules) -}
 INSTALL_FIPSMODULE={- join(", ", map { "-\n\t".$_.".EXE" } @install_fipsmodules) -}
 INSTALL_FIPSMODULECONF=[.providers]fipsmodule.cnf
@@ -387,8 +380,6 @@ OPENSSLDIR={- catdir($config{openssldir}) or
                               : "SYS\$COMMON:[OPENSSL-COMMON]" -}
 # The same, but for C
 OPENSSLDIR_C={- platform->osslprefix() -}DATAROOT:[000000]
-# Where installed ENGINE modules reside, for C
-ENGINESDIR_C={- platform->osslprefix() -}ENGINES{- $sover_dirname.$target{pointer_size} -}:
 # Where modules reside, for C
 MODULESDIR_C={- platform->osslprefix() -}MODULES{- $target{pointer_size} -}:
 
@@ -598,10 +589,10 @@ depend : descrip.mms
 
 # Install helper targets #############################################
 
-install_sw : install_dev install_engines install_modules -
+install_sw : install_dev install_modules -
              install_runtime install_startup install_ivp
 
-uninstall_sw : uninstall_dev uninstall_modules uninstall_engines -
+uninstall_sw : uninstall_dev uninstall_modules -
                uninstall_runtime uninstall_startup uninstall_ivp
 
 install_docs : install_html_docs
@@ -660,15 +651,6 @@ install_dev : check_INSTALLTOP install_runtime_libs
                 map { "COPY/PROT=W:R $_.OLB ossl_installroot:[LIB.'arch']" }
                 @install_libs) -}
 
-install_engines : check_INSTALLTOP install_runtime_libs build_modules
-        @ {- output_off() unless scalar @install_engines; "" -} !
-        @ WRITE SYS$OUTPUT "*** Installing engines"
-        - CREATE/DIR ossl_installroot:[ENGINES{- $sover_dirname.$target{pointer_size} -}.'arch']
-        {- join("\n        ",
-                map { "COPY/PROT=W:RE $_.EXE ossl_installroot:[ENGINES$sover_dirname$target{pointer_size}.'arch']" }
-                @install_engines) -}
-        @ {- output_on() unless scalar @install_engines; "" -} !
-
 install_modules : check_INSTALLTOP install_runtime_libs build_modules
         @ {- output_off() unless scalar @install_modules; "" -} !
         @ WRITE SYS$OUTPUT "*** Installing modules"

Configurations/unix-Makefile.tmpl

@@ -183,20 +183,11 @@ INSTALL_SHLIB_INFO={-
                         grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
                         @{$unified_info{libraries}}))
 -}
-INSTALL_ENGINES={-
-        join(" \\\n" . ' ' x 16,
-             fill_lines(" ", $COLUMNS - 16,
-                        map { platform->dso($_) }
-                        grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
-                               && $unified_info{attributes}->{modules}->{$_}->{engine} }
-                        @{$unified_info{modules}}))
--}
 INSTALL_MODULES={-
         join(" \\\n" . ' ' x 16,
              fill_lines(" ", $COLUMNS - 16,
                         map { platform->dso($_) }
                         grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
-                               && !$unified_info{attributes}->{modules}->{$_}->{engine}
                                && !$unified_info{attributes}->{modules}->{$_}->{fips} }
                         @{$unified_info{modules}}))
 -}
@@ -333,7 +324,6 @@ LIBDIR={- our $libdir = $config{libdir};
 # $(libdir) is chosen to be compatible with the GNU coding standards
 libdir={- file_name_is_absolute($libdir)
           ? $libdir : '$(INSTALLTOP)/$(LIBDIR)' -}
-ENGINESDIR=$(libdir)/engines-{- $sover_dirname -}
 MODULESDIR=$(libdir)/ossl-modules
 
 # Convenience variable for those who want to set the rpath in shared
@@ -450,7 +440,6 @@ LIB_CPPFLAGS={- our $lib_cppflags =
                 join(' ', $lib_cppflags,
                           (map { '-D'.$_ }
                                'OPENSSLDIR="\"$(OPENSSLDIR)\""',
-                               'ENGINESDIR="\"$(ENGINESDIR)\""',
                                'MODULESDIR="\"$(MODULESDIR)\""'),
                           '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
 LIB_CFLAGS={- join(' ', $target{lib_cflags} || (),
@@ -541,7 +530,7 @@ LANG=C
 
 {- dependmagic('build_sw', 'Build all the software (default target)'); -}: build_libs_nodep build_modules_nodep build_programs_nodep link-utils
 {- dependmagic('build_libs', 'Build the libraries libssl and libcrypto'); -}: build_libs_nodep
-{- dependmagic('build_modules', 'Build the modules (i.e. providers and engines)'); -}: build_modules_nodep
+{- dependmagic('build_modules', 'Build the modules (i.e. providers)'); -}: build_modules_nodep
 {- dependmagic('build_programs', 'Build the openssl executables, scripts and all other programs as configured (e.g. tests or demos)'); -}: build_programs_nodep
 {- dependmagic('build_inst_sw', 'Build all the software to be installed'); -}: build_libs_nodep build_modules_nodep build_inst_programs_nodep link-utils
 {- dependmagic('build_inst_programs', 'Build only the installable openssl executables and scripts'); -}: build_inst_programs_nodep
@@ -675,9 +664,9 @@ install: Makefile ## Install software and documentation, create OpenSSL director
 
 uninstall: {- "uninstall_docs" if !$disabled{docs}; -} uninstall_sw {- $disabled{fips} ? "" : "uninstall_fips" -} ## Uninstall software and documentation
 
-install_sw: install_dev install_engines install_modules install_runtime ## Install just the software and libraries
+install_sw: install_dev install_modules install_runtime ## Install just the software and libraries
 
-uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev ## Uninstall the software and libraries
+uninstall_sw: uninstall_runtime uninstall_modules uninstall_dev ## Uninstall the software and libraries
 
 install_docs: install_man_docs install_html_docs ## Install manpages and HTML documentation
 
@@ -894,30 +883,6 @@ uninstall_dev: uninstall_runtime_libs
 
 _install_modules_deps: install_runtime_libs build_modules
 
-install_engines: _install_modules_deps
-	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
-	@$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(ENGINESDIR)/"
-	@$(ECHO) "*** Installing engines"
-	@set -e; for e in dummy $(INSTALL_ENGINES); do \
-		if [ "$$e" = "dummy" ]; then continue; fi; \
-		fn=`basename $$e`; \
-		$(ECHO) "install $$e -> $(DESTDIR)$(ENGINESDIR)/$$fn"; \
-		cp $$e "$(DESTDIR)$(ENGINESDIR)/$$fn.new"; \
-		chmod 755 "$(DESTDIR)$(ENGINESDIR)/$$fn.new"; \
-		mv -f "$(DESTDIR)$(ENGINESDIR)/$$fn.new" \
-		      "$(DESTDIR)$(ENGINESDIR)/$$fn"; \
-	done
-
-uninstall_engines:
-	@$(ECHO) "*** Uninstalling engines"
-	@set -e; for e in dummy $(INSTALL_ENGINES); do \
-		if [ "$$e" = "dummy" ]; then continue; fi; \
-		fn=`basename $$e`; \
-		$(ECHO) "$(RM) $(DESTDIR)$(ENGINESDIR)/$$fn"; \
-		$(RM) "$(DESTDIR)$(ENGINESDIR)/$$fn"; \
-	done
-	-$(RMDIR) "$(DESTDIR)$(ENGINESDIR)"
-
 install_modules: _install_modules_deps
 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
 	@$(PERL) $(SRCDIR)/util/mkdir-p.pl "$(DESTDIR)$(MODULESDIR)/"
@@ -1330,13 +1295,6 @@ errors:
 	( b=`pwd`; set -e; cd $(SRCDIR); \
           $(PERL) util/ck_errf.pl -strict -internal; \
           $(PERL) -I$$b util/mkerr.pl $(ERROR_REBUILD) -internal )
-	( b=`pwd`; set -e; cd $(SRCDIR)/engines; \
-          for E in *.ec ; do \
-              $(PERL) ../util/ck_errf.pl -strict \
-                -conf $$E `basename $$E .ec`.c; \
-              $(PERL) -I$$b ../util/mkerr.pl $(ERROR_REBUILD) -static \
-                -conf $$E `basename $$E .ec`.c ; \
-          done )
 
 {- use File::Basename;
 
@@ -1361,6 +1319,7 @@ errors:
    my @cryptoskipheaders = ( @sslheaders_tmpl,
        qw( include/openssl/conf_api.h
            include/openssl/ebcdic.h
+           include/openssl/engine.h
            include/openssl/opensslconf.h
            include/openssl/symhacks.h ) );
    our %cryptoheaders = ();

Configurations/windows-makefile.tmpl

@@ -101,29 +101,15 @@ INSTALL_SHLIBPDBS={-
                   grep { !$unified_info{attributes}->{libraries}->{$_}->{noinst} }
                   @{$unified_info{libraries}})
 -}
-INSTALL_ENGINES={-
-        join(" ", map { quotify1(platform->dso($_)) }
-                  grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
-                         && $unified_info{attributes}->{modules}->{$_}->{engine} }
-                  @{$unified_info{modules}})
--}
-INSTALL_ENGINEPDBS={-
-        join(" ", map { quotify1(platform->dsopdb($_)) }
-                  grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
-                         && $unified_info{attributes}->{modules}->{$_}->{engine} }
-                  @{$unified_info{modules}})
--}
 INSTALL_MODULES={-
         join(" ", map { quotify1(platform->dso($_)) }
                   grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
-                          && !$unified_info{attributes}->{modules}->{$_}->{engine}
                           && !$unified_info{attributes}->{modules}->{$_}->{fips} }
                   @{$unified_info{modules}})
 -}
 INSTALL_MODULEPDBS={-
         join(" ", map { quotify1(platform->dsopdb($_)) }
-                  grep { !$unified_info{attributes}->{modules}->{$_}->{noinst}
-                         && !$unified_info{attributes}->{modules}->{$_}->{engine} }
+                  grep { !$unified_info{attributes}->{modules}->{$_}->{noinst} }
                   @{$unified_info{modules}})
 -}
 INSTALL_FIPSMODULE={-
@@ -230,23 +216,15 @@ MODULESDIR_dev={- use File::Spec::Functions qw(:DEFAULT splitpath catpath);
                   our $modulesdir_dir =
                       catdir($modulesprefix_dir, "ossl-modules");
                   our $modulesdir = catpath($modulesdir_dev, $modulesdir_dir);
-                  our $enginesdir_dev = $modulesprefix_dev;
-                  our $enginesdir_dir =
-                      catdir($modulesprefix_dir, "engines-$sover_dirname");
-                  our $enginesdir = catpath($enginesdir_dev, $enginesdir_dir);
                   $modulesdir_dev -}
 MODULESDIR_dir={- canonpath($modulesdir_dir) -}
-ENGINESDIR_dev={- $enginesdir_dev -}
-ENGINESDIR_dir={- canonpath($enginesdir_dir) -}
 !IF "$(DESTDIR)" != ""
 INSTALLTOP=$(DESTDIR)$(INSTALLTOP_dir)
 OPENSSLDIR=$(DESTDIR)$(OPENSSLDIR_dir)
-ENGINESDIR=$(DESTDIR)$(ENGINESDIR_dir)
 MODULESDIR=$(DESTDIR)$(MODULESDIR_dir)
 !ELSE
 INSTALLTOP=$(INSTALLTOP_dev)$(INSTALLTOP_dir)
 OPENSSLDIR=$(OPENSSLDIR_dev)$(OPENSSLDIR_dir)
-ENGINESDIR=$(ENGINESDIR_dev)$(ENGINESDIR_dir)
 MODULESDIR=$(MODULESDIR_dev)$(MODULESDIR_dir)
 !ENDIF
 
@@ -344,7 +322,6 @@ LIB_CPPFLAGS={- our $lib_cppflags =
                 join(' ', $lib_cppflags,
                           (map { '-D'.quotify1($_) }
                                "OPENSSLDIR=\"$openssldir\"",
-                               "ENGINESDIR=\"$enginesdir\"",
                                "MODULESDIR=\"$modulesdir\""),
                           '$(CNF_CPPFLAGS)', '$(CPPFLAGS)') -}
 LIB_CFLAGS={- join(' ', $target{lib_cflags} || (),
@@ -485,7 +462,6 @@ clean: libclean
 	{- join("\n\t", map { "-del /Q /F $_" } @GENERATED_MANDATORY) || "\@rem" -}
 	{- join("\n\t", map { "-del /Q /F $_" } @GENERATED) || "\@rem" -}
 	-del /Q /S /F *.d *.obj *.pdb *.ilk *.manifest
-	-del /Q /S /F engines\*.lib engines\*.exp
 	-del /Q /S /F apps\*.lib apps\*.rc apps\*.res apps\*.exp
 	-del /Q /S /F test\*.exp
 	-rd /Q /S test\test-runs
@@ -502,9 +478,9 @@ depend: makefile
 
 # Install helper targets #############################################
 
-install_sw: install_dev install_engines install_modules install_runtime
+install_sw: install_dev install_modules install_runtime
 
-uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev
+uninstall_sw: uninstall_runtime uninstall_modules uninstall_dev
 
 install_docs: install_html_docs
 
@@ -577,17 +553,6 @@ uninstall_dev:
 
 _install_modules_deps: install_runtime_libs build_modules
 
-install_engines: _install_modules_deps
-	@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
-	@$(ECHO) "*** Installing engines"
-	@"$(PERL)" "$(SRCDIR)\util\mkdir-p.pl" "$(ENGINESDIR)"
-	@if not "$(INSTALL_ENGINES)"=="" \
-	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_ENGINES) "$(ENGINESDIR)"
-	@if not "$(INSTALL_ENGINES)"=="" \
-	 "$(PERL)" "$(SRCDIR)\util\copy.pl" $(INSTALL_ENGINEPDBS) "$(ENGINESDIR)"
-
-uninstall_engines:
-
 install_modules: _install_modules_deps
 	@if "$(INSTALLTOP)"=="" ( $(ECHO) "INSTALLTOP should not be empty" & exit 1 )
 	@$(ECHO) "*** Installing modules"

Configure

@@ -96,7 +96,7 @@ EOF
 #               [don't] allow default thread pool functionality
 # [no-]shared   [don't] try to create shared libraries when supported.
 # [no-]pic      [don't] try to build position independent code when supported.
-#               If disabled, it also disables shared and dynamic-engine.
+#               If disabled, it also disables shared.
 # no-asm        do not use assembler
 # no-egd        do not compile support for the entropy-gathering daemon APIs
 # [no-]zlib     [don't] compile support for zlib compression.
@@ -422,7 +422,6 @@ my @dtls = qw(dtls1 dtls1_2);
 
 my @disablables = (
     "acvp-tests",
-    "afalgeng",
     "apps",
     "argon2",
     "aria",
@@ -441,7 +440,6 @@ my @disablables = (
     "bulk",
     "cached-fetch",
     "camellia",
-    "capieng",
     "winstore",
     "cast",
     "chacha",
@@ -458,14 +456,12 @@ my @disablables = (
     "hqinterop",
     "deprecated",
     "des",
-    "devcryptoeng",
     "dgram",
     "dh",
     "docs",
     "dsa",
     "dso",
     "dtls",
-    "dynamic-engine",
     "ec",
     "ec2m",
     "ec_nistp_64_gcc_128",
@@ -473,7 +469,6 @@ my @disablables = (
     "ecdsa",
     "ecx",
     "egd",
-    "engine",
     "err",
     "external-tests",
     "filenames",
@@ -491,7 +486,6 @@ my @disablables = (
     "ktls",
     "legacy",
     "lms",
-    "loadereng",
     "makedepend",
     "md2",
     "md4",
@@ -504,7 +498,6 @@ my @disablables = (
     "nextprotoneg",
     "ocb",
     "ocsp",
-    "padlockeng",
     "pic",
     "pie",
     "pinshared",
@@ -537,7 +530,6 @@ my @disablables = (
     "sse2",
     "ssl",
     "ssl-trace",
-    "static-engine",
     "stdio",
     "sslkeylog",
     "tests",
@@ -574,11 +566,19 @@ my @disablables_int = qw(
     );
 
 my %deprecated_disablables = (
+    "engine" => undef,
+    "static-engine" => undef,
+    "dynamic-engine" => undef,
+    "afalgeng" => undef,
+    "capieng" => undef,
+    "devcryptoeng" => undef,
+    "loadereng" => undef,
+    "padlockeng" => undef,
     "ssl2" => undef,
     "buf-freelists" => undef,
     "crypto-mdebug-backtrace" => undef,
-    "hw" => "hw",               # causes cascade, but no macro
-    "hw-padlock" => "padlockeng",
+    "hw" => undef,
+    "hw-padlock" => undef,
     "ripemd" => "rmd160",
     "ui" => "ui-console",
     "heartbeats" => undef,
@@ -599,9 +599,9 @@ our %disabled = ( # "what"         => "comment"
                   "demos"               => "default",
                   "h3demo"              => "default",
                   "hqinterop"           => "default",
-                  "devcryptoeng"        => "default",
                   "ec_nistp_64_gcc_128" => "default",
                   "egd"                 => "default",
+                  "engine"              => "default",
                   "external-tests"      => "default",
                   "fuzz-afl"            => "default",
                   "fuzz-libfuzzer"      => "default",
@@ -635,7 +635,7 @@ my @disable_cascades = (
                              "blake2", "bf", "camellia", "cast", "chacha",
                              "cmac", "cms", "cmp", "comp", "ct",
                              "des", "dgram", "dh", "dsa",
-                             "ec", "engine",
+                             "ec",
                              "filenames",
                              "idea", "ktls", "lms",
                              "md4", "ml-dsa", "ml-kem", "multiblock",
@@ -671,17 +671,10 @@ my @disable_cascades = (
 
     "crypto-mdebug"     => [ "crypto-mdebug-backtrace", "allocfail-tests" ],
 
-    "module"            => [ "dynamic-engine", "fips" ],
+    "module"            => [ "fips" ],
 
-    # Without shared libraries, dynamic engines aren't possible.
-    # This is due to them having to link with libcrypto and register features
-    # using the ENGINE functionality, and since that relies on global tables,
-    # those *have* to be exactly the same as the ones accessed from the app,
-    # which cannot be guaranteed if shared libraries aren't present.
-    # (note that even with shared libraries, both the app and dynamic engines
-    # must be linked with the same library)
-    "shared"            => [ "dynamic-engine", "uplink" ],
-    "dso"               => [ "dynamic-engine", "module" ],
+    "shared"            => [ "uplink" ],
+    "dso"               => [ "module" ],
     # Other modules don't necessarily have to link with libcrypto, so shared
     # libraries do not have to be a condition to produce those.
 
@@ -689,14 +682,12 @@ my @disable_cascades = (
     # or modules.
     "pic"               => [ "shared", "module" ],
 
-    "engine"            => [ "dynamic-engine", grep(/eng$/, @disablables) ],
-    "dynamic-engine"    => [ "loadereng" ],
-    "hw"                => [ "padlockeng" ],
+    "engine"            => [ "static-engine", "dynamic-engine" ],
 
     # no-autoalginit is only useful when building non-shared
     "autoalginit"       => [ "shared", "apps", "fips" ],
 
-    "stdio"             => [ "apps", "capieng", "egd" ],
+    "stdio"             => [ "apps", "egd" ],
     "apps"              => [ "tests" ],
     "tests"             => [ "external-tests" ],
     "comp"              => [ "zlib", "brotli", "zstd" ],
@@ -718,7 +709,7 @@ my @disable_cascades = (
 
     "blake2"            => [ "argon2" ],
 
-    "deprecated-3.0"    => [ "engine", "srp" ],
+    "deprecated-3.0"    => [ "srp" ],
 
     "http"              => [ "ocsp" ]
     );
@@ -926,14 +917,6 @@ while (@argvcopy)
                                 $disabled{$proto} = "option(tls)";
                                 }
                         }
-                elsif ($1 eq "static-engine")
-                        {
-                        delete $disabled{"dynamic-engine"};
-                        }
-                elsif ($1 eq "dynamic-engine")
-                        {
-                        $disabled{"dynamic-engine"} = "option";
-                        }
                 elsif (exists $deprecated_disablables{$1})
                         {
                         $deprecated_options{$_} = 1;
@@ -955,15 +938,7 @@ while (@argvcopy)
                 }
         elsif (/^enable-(.+)$/)
                 {
-                if ($1 eq "static-engine")
-                        {
-                        $disabled{"dynamic-engine"} = "option";
-                        }
-                elsif ($1 eq "dynamic-engine")
-                        {
-                        delete $disabled{"dynamic-engine"};
-                        }
-                elsif ($1 eq "zlib-dynamic")
+                if ($1 eq "zlib-dynamic")
                         {
                         delete $disabled{"zlib"};
                         }
@@ -1646,16 +1621,10 @@ my $no_shared_warn=0;
 if (($target{shared_target} // '') eq "")
         {
         $no_shared_warn = 1
-            if (!$disabled{shared} || !$disabled{"dynamic-engine"});
+            if (!$disabled{shared});
         disable('no-shared-target', 'pic');
         }
 
-if ($disabled{"dynamic-engine"}) {
-        $config{dynamic_engines} = 0;
-} else {
-        $config{dynamic_engines} = 1;
-}
-
 unless ($disabled{asan} || defined $detected_sanitizers{asan}) {
     push @{$config{cflags}}, "-fsanitize=address";
 }
@@ -1834,30 +1803,6 @@ $config{CFLAGS} = [ map { $_ eq '--ossl-strict-warnings'
                               : ( $_ ) }
                     @{$config{CFLAGS}} ];
 
-unless ($disabled{afalgeng}) {
-    $config{afalgeng}="";
-    if (grep { $_ eq 'afalgeng' } @{$target{enable}}) {
-        push @{$config{engdirs}}, "afalg";
-    } else {
-        disable('not-linux', 'afalgeng');
-    }
-}
-
-unless ($disabled{devcryptoeng}) {
-    if ($target =~ m/^BSD/) {
-        my $maxver = 5*100 + 7;
-        my $sysstr = `uname -s`;
-        my $verstr = `uname -r`;
-        $sysstr =~ s|\R$||;
-        $verstr =~ s|\R$||;
-        my ($ma, $mi, @rest) = split m|\.|, $verstr;
-        my $ver = $ma*100 + $mi;
-        if ($sysstr eq 'OpenBSD' && $ver >= $maxver) {
-            disable('too-new-kernel', 'devcryptoeng');
-        }
-    }
-}
-
 unless ($disabled{ktls}) {
     $config{ktls}="";
     my $cc = $config{CROSS_COMPILE}.$config{CC};
@@ -1952,7 +1897,7 @@ foreach my $what (sort keys %disabled) {
     $config{options} .= " no-$what";
 
     if (!grep { $what eq $_ } ( 'buildtest-c++', 'fips', 'threads', 'shared',
-                                'module', 'pic', 'dynamic-engine', 'makedepend',
+                                'module', 'pic', 'makedepend',
                                 'sse2', 'legacy' )) {
         (my $WHAT = uc $what) =~ s|-|_|g;
         my $skipdir = $what;
@@ -1964,18 +1909,11 @@ foreach my $what (sort keys %disabled) {
         my $macro = $disabled_info{$what}->{macro} = "OPENSSL_NO_$WHAT";
         push @{$config{openssl_feature_defines}}, $macro;
 
-        $skipdir{engines} = $what if $what eq 'engine';
         $skipdir{"crypto/$skipdir"} = $what
             unless $what eq 'async' || $what eq 'err' || $what eq 'dso' || $what eq 'http';
     }
 }
 
-if ($disabled{"dynamic-engine"}) {
-    push @{$config{openssl_feature_defines}}, "OPENSSL_NO_DYNAMIC_ENGINE";
-} else {
-    push @{$config{openssl_feature_defines}}, "OPENSSL_NO_STATIC_ENGINE";
-}
-
 # If we use the unified build, collect information from build.info files
 my %unified_info = ();
 
@@ -2377,14 +2315,6 @@ if ($builder eq "unified") {
             );
         die "runaway IF?" if (@skip);
 
-        if (grep { defined $attributes{modules}->{$_}->{engine} } keys %attributes
-                and !$config{dynamic_engines}) {
-            die <<"EOF"
-ENGINES can only be used if configured with 'dynamic-engine'.
-This is usually a fault in a build.info file.
-EOF
-        }
-
         {
             my %infos = ( programs  => [ @programs  ],
                           libraries => [ @libraries ],
@@ -3051,9 +2981,9 @@ EOF
 
 print <<"EOF" if ($no_shared_warn);
 
-The options 'shared', 'pic' and 'dynamic-engine' aren't supported on this
+The options 'shared' and 'pic' aren't supported on this
 platform, so we will pretend you gave the option 'no-pic', which also disables
-'shared' and 'dynamic-engine'.  If you know how to implement shared libraries
+'shared'.  If you know how to implement shared libraries
 or position independent code, please let us know (but please first make sure
 you have tried with a current version of OpenSSL).
 EOF

INSTALL.md

@@ -584,12 +584,6 @@ In the following list, always the non-default variant is documented: if
 feature `xxxx` is disabled by default then `enable-xxxx` is documented and
 if feature `xxxx` is enabled by default then `no-xxxx` is documented.
 
-### no-afalgeng
-
-Don't build the AFALG engine.
-
-This option will be forced on a platform that does not support AFALG.
-
 ### enable-ktls
 
 Build with Kernel TLS support.
@@ -715,12 +709,6 @@ this option will reduce run-time memory usage but it also introduces a
 significant performance penalty.  This option is primarily designed to help
 with detecting incorrect reference counting.
 
-### no-capieng
-
-Don't build the CAPI engine.
-
-This option will be forced if on a platform that does not support CAPI.
-
 ### no-cmp
 
 Don't build support for Certificate Management Protocol (CMP)
@@ -773,19 +761,6 @@ Don't build and install documentation, i.e. manual pages in various forms.
 
 Don't build support for loading Dynamic Shared Objects (DSO)
 
-### enable-devcryptoeng
-
-Build the `/dev/crypto` engine.
-
-This option is automatically selected on the BSD platform, in which case it can
-be disabled with `no-devcryptoeng`.
-
-### no-dynamic-engine
-
-Don't build the dynamically loaded engines.
-
-This only has an effect in a shared build.
-
 ### no-ec
 
 Don't build support for Elliptic Curves.
@@ -817,10 +792,6 @@ This option is only supported on platforms:
 
 Build support for gathering entropy from the Entropy Gathering Daemon (EGD).
 
-### no-engine
-
-Don't build support for loading engines.
-
 ### no-err
 
 Don't compile in any error strings.
@@ -922,9 +893,7 @@ support.  ML-KEM is based on CRYSTALS-KYBER. See [FIPS 203].
 
 ### no-module
 
-Don't build any dynamically loadable engines.
-
-This also implies `no-dynamic-engine`.
+Don't build any dynamically loadable modules.
 
 ### no-multiblock
 
@@ -940,14 +909,6 @@ Don't build support for the Next Protocol Negotiation (NPN) TLS extension.
 
 Don't build support for Online Certificate Status Protocol (OCSP).
 
-### no-padlockeng
-
-Don't build the padlock engine.
-
-### no-hw-padlock
-
-As synonym for `no-padlockeng`.  Deprecated and should not be used.
-
 ### no-pic
 
 Don't build with support for Position Independent Code.
@@ -1054,12 +1015,6 @@ This removes the `-trace` option from `s_client` and `s_server`, and omits the
 
 Disabling `ssl-trace` may provide a small reduction in libssl binary size.
 
-### no-static-engine
-
-Don't build the statically linked engines.
-
-This only has an impact when not built "shared".
-
 ### no-stdio
 
 Don't use anything from the C header file `stdio.h` that makes use of the `FILE`
@@ -1548,7 +1503,6 @@ its default):
                    to build your own programs that use libcrypto
                    or libssl.
     lib            Contains the OpenSSL library files.
-    lib/engines    Contains the OpenSSL dynamically loadable engines.
 
     share/man/man1 Contains the OpenSSL command line man-pages.
     share/man/man3 Contains the OpenSSL library calls man-pages.
@@ -1574,8 +1528,6 @@ its default):
                    to build your own programs that use libcrypto
                    or libssl.
     [.LIB.'arch']  Contains the OpenSSL library files.
-    [.ENGINES'sover''pz'.'arch']
-                   Contains the OpenSSL dynamically loadable engines.
     [.SYS$STARTUP] Contains startup, login and shutdown scripts.
                    These define appropriate logical names and
                    command symbols.
@@ -1596,7 +1548,7 @@ for you convenience:
 
 The installation directory should be appropriately protected to ensure
 unprivileged users cannot make changes to OpenSSL binaries or files, or
-install engines.  If you already have a pre-installed version of OpenSSL as
+install providers.  If you already have a pre-installed version of OpenSSL as
 part of your Operating System it is recommended that you do not overwrite
 the system version and instead install to somewhere else.
 

NEWS.md

@@ -27,7 +27,8 @@ OpenSSL 4.0
 
 ### Major changes between OpenSSL 3.6 and OpenSSL 4.0 [under development]
 
-  * none
+  * ENGINE support was removed. The `no-engine` build option and the
+   `OPENSSL_NO_ENGINE` macro is always present.
 
 OpenSSL 3.6
 -----------

NOTES-WINDOWS.md

@@ -112,11 +112,10 @@ install it to a variety of locations.
 The following keys:
 
     `\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenSSL-<version>-<ctx>\OPENSSLDIR`
-    `\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenSSL-<version>-<ctx>\ENGINESDIR`
     `\\HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\OpenSSL-<version>-<ctx>\MODULESDIR`
 
 Can be administratively set, and openssl will take the paths found there as the
-values for OPENSSLDIR, ENGINESDIR and MODULESDIR respectively.
+values for OPENSSLDIR and MODULESDIR respectively.
 
 To enable the reading of registry keys from windows builds, add
 `-DOSSL_WINCTX=<string>`to the Configure command line.  This define is used

README-ENGINES.md

@@ -1,317 +0,0 @@
-Engines
-=======
-
-Deprecation Note
-----------------
-
-The ENGINE API was introduced in OpenSSL version 0.9.6 as a low level
-interface for adding alternative implementations of cryptographic
-primitives, most notably for integrating hardware crypto devices.
-
-The ENGINE interface has its limitations and it has been superseded
-by the [PROVIDER API](README-PROVIDERS.md), it is deprecated in OpenSSL
-version 3.0. The following documentation is retained as an aid for
-users who need to maintain or support existing ENGINE implementations.
-Support for new hardware devices or new algorithms should be added
-via providers, and existing engines should be converted to providers
-as soon as possible.
-
-Built-in ENGINE implementations
--------------------------------
-
-There are currently built-in ENGINE implementations for the following
-crypto devices:
-
-- Microsoft CryptoAPI
-- VIA Padlock
-- nCipher CHIL
-
-In addition, dynamic binding to external ENGINE implementations is now
-provided by a special ENGINE called "dynamic". See the "DYNAMIC ENGINE"
-section below for details.
-
-At this stage, a number of things are still needed and are being worked on:
-
-1. Integration of EVP support.
-2. Configuration support.
-3. Documentation!
-
-Integration of EVP support
---------------------------
-
-With respect to EVP, this relates to support for ciphers and digests in
-the ENGINE model so that alternative implementations of existing
-algorithms/modes (or previously unimplemented ones) can be provided by
-ENGINE implementations.
-
-Configuration support
----------------------
-
-Configuration support currently exists in the ENGINE API itself, in the
-form of "control commands". These allow an application to expose to the
-user/admin the set of commands and parameter types a given ENGINE
-implementation supports, and for an application to directly feed string
-based input to those ENGINEs, in the form of name-value pairs. This is an
-extensible way for ENGINEs to define their own "configuration" mechanisms
-that are specific to a given ENGINE (eg. for a particular hardware
-device) but that should be consistent across *all* OpenSSL-based
-applications when they use that ENGINE. Work is in progress (or at least
-in planning) for supporting these control commands from the CONF (or
-NCONF) code so that applications using OpenSSL's existing configuration
-file format can have ENGINE settings specified in much the same way.
-Presently however, applications must use the ENGINE API itself to provide
-such functionality. To see first hand the types of commands available
-with the various compiled-in ENGINEs (see further down for dynamic
-ENGINEs), use the "engine" openssl utility with full verbosity, i.e.:
-
-    openssl engine -vvvv
-
-Documentation
--------------
-
-Documentation? Volunteers welcome! The source code is reasonably well
-self-documenting, but some summaries and usage instructions are needed -
-moreover, they are needed in the same POD format the existing OpenSSL
-documentation is provided in. Any complete or incomplete contributions
-would help make this happen.
-
-STABILITY & BUG-REPORTS
-=======================
-
-What already exists is fairly stable as far as it has been tested, but
-the test base has been a bit small most of the time. For the most part,
-the vendors of the devices these ENGINEs support have contributed to the
-development and/or testing of the implementations, and *usually* (with no
-guarantees) have experience in using the ENGINE support to drive their
-devices from common OpenSSL-based applications. Bugs and/or inexplicable
-behaviour in using a specific ENGINE implementation should be sent to the
-author of that implementation (if it is mentioned in the corresponding C
-file), and in the case of implementations for commercial hardware
-devices, also through whatever vendor support channels are available. If
-none of this is possible, or the problem seems to be something about the
-ENGINE API itself (ie. not necessarily specific to a particular ENGINE
-implementation) then you should mail complete details to the relevant
-OpenSSL mailing list. For a definition of "complete details", refer to
-the OpenSSL "README" file. As for which list to send it to:
-
-- openssl-users: if you are *using* the ENGINE abstraction, either in an
-  pre-compiled application or in your own application code.
-
-- openssl-dev: if you are discussing problems with OpenSSL source code.
-
-USAGE
-=====
-
-The default "openssl" ENGINE is always chosen when performing crypto
-operations unless you specify otherwise. You must actively tell the
-openssl utility commands to use anything else through a new command line
-switch called "-engine". Also, if you want to use the ENGINE support in
-your own code to do something similar, you must likewise explicitly
-select the ENGINE implementation you want.
-
-Depending on the type of hardware, system, and configuration, "settings"
-may need to be applied to an ENGINE for it to function as expected/hoped.
-The recommended way of doing this is for the application to support
-ENGINE "control commands" so that each ENGINE implementation can provide
-whatever configuration primitives it might require and the application
-can allow the user/admin (and thus the hardware vendor's support desk
-also) to provide any such input directly to the ENGINE implementation.
-This way, applications do not need to know anything specific to any
-device, they only need to provide the means to carry such user/admin
-input through to the ENGINE in question. Ie. this connects *you* (and
-your helpdesk) to the specific ENGINE implementation (and device), and
-allows application authors to not get buried in hassle supporting
-arbitrary devices they know (and care) nothing about.
-
-A new "openssl" utility, "openssl engine", has been added in that allows
-for testing and examination of ENGINE implementations. Basic usage
-instructions are available by specifying the "-?" command line switch.
-
-DYNAMIC ENGINES
-===============
-
-The new "dynamic" ENGINE provides a low-overhead way to support ENGINE
-implementations that aren't pre-compiled and linked into OpenSSL-based
-applications. This could be because existing compiled-in implementations
-have known problems and you wish to use a newer version with an existing
-application. It could equally be because the application (or OpenSSL
-library) you are using simply doesn't have support for the ENGINE you
-wish to use, and the ENGINE provider (eg. hardware vendor) is providing
-you with a self-contained implementation in the form of a shared-library.
-The other use-case for "dynamic" is with applications that wish to
-maintain the smallest foot-print possible and so do not link in various
-ENGINE implementations from OpenSSL, but instead leaves you to provide
-them, if you want them, in the form of "dynamic"-loadable
-shared-libraries. It should be possible for hardware vendors to provide
-their own shared-libraries to support arbitrary hardware to work with
-applications based on OpenSSL 0.9.7 or later. If you're using an
-application based on 0.9.7 (or later) and the support you desire is only
-announced for versions later than the one you need, ask the vendor to
-backport their ENGINE to the version you need.
-
-How does "dynamic" work?
-------------------------
-
-The dynamic ENGINE has a special flag in its implementation such that
-every time application code asks for the 'dynamic' ENGINE, it in fact
-gets its own copy of it. As such, multi-threaded code (or code that
-multiplexes multiple uses of 'dynamic' in a single application in any
-way at all) does not get confused by 'dynamic' being used to do many
-independent things. Other ENGINEs typically don't do this so there is
-only ever 1 ENGINE structure of its type (and reference counts are used
-to keep order). The dynamic ENGINE itself provides absolutely no
-cryptographic functionality, and any attempt to "initialise" the ENGINE
-automatically fails. All it does provide are a few "control commands"
-that can be used to control how it will load an external ENGINE
-implementation from a shared-library. To see these control commands,
-use the command-line;
-
-    openssl engine -vvvv dynamic
-
-The "SO_PATH" control command should be used to identify the
-shared-library that contains the ENGINE implementation, and "NO_VCHECK"
-might possibly be useful if there is a minor version conflict and you
-(or a vendor helpdesk) is convinced you can safely ignore it.
-"ID" is probably only needed if a shared-library implements
-multiple ENGINEs, but if you know the engine id you expect to be using,
-it doesn't hurt to specify it (and this provides a sanity check if
-nothing else). "LIST_ADD" is only required if you actually wish the
-loaded ENGINE to be discoverable by application code later on using the
-ENGINE's "id". For most applications, this isn't necessary - but some
-application authors may have nifty reasons for using it. The "LOAD"
-command is the only one that takes no parameters and is the command
-that uses the settings from any previous commands to actually *load*
-the shared-library ENGINE implementation. If this command succeeds, the
-(copy of the) 'dynamic' ENGINE will magically morph into the ENGINE
-that has been loaded from the shared-library. As such, any control
-commands supported by the loaded ENGINE could then be executed as per
-normal. For instance, if ENGINE "foo" is implemented in the shared-library
-"libfoo.so" and it supports some special control command "CMD_FOO", the
-following code would load and use it (NB: obviously this code has no
-error checking);
-
-    ENGINE *e = ENGINE_by_id("dynamic");
-    ENGINE_ctrl_cmd_string(e, "SO_PATH", "/lib/libfoo.so", 0);
-    ENGINE_ctrl_cmd_string(e, "ID", "foo", 0);
-    ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0);
-    ENGINE_ctrl_cmd_string(e, "CMD_FOO", "some input data", 0);
-
-For testing, the "openssl engine" utility can be useful for this sort
-of thing. For example the above code excerpt would achieve much the
-same result as;
-
-    openssl engine dynamic \
-              -pre SO_PATH:/lib/libfoo.so \
-              -pre ID:foo \
-              -pre LOAD \
-              -pre "CMD_FOO:some input data"
-
-Or to simply see the list of commands supported by the "foo" ENGINE;
-
-    openssl engine -vvvv dynamic \
-              -pre SO_PATH:/lib/libfoo.so \
-              -pre ID:foo \
-              -pre LOAD
-
-Applications that support the ENGINE API and more specifically, the
-"control commands" mechanism, will provide some way for you to pass
-such commands through to ENGINEs. As such, you would select "dynamic"
-as the ENGINE to use, and the parameters/commands you pass would
-control the *actual* ENGINE used. Each command is actually a name-value
-pair and the value can sometimes be omitted (eg. the "LOAD" command).
-Whilst the syntax demonstrated in "openssl engine" uses a colon to
-separate the command name from the value, applications may provide
-their own syntax for making that separation (eg. a win32 registry
-key-value pair may be used by some applications). The reason for the
-"-pre" syntax in the "openssl engine" utility is that some commands
-might be issued to an ENGINE *after* it has been initialised for use.
-Eg. if an ENGINE implementation requires a smart-card to be inserted
-during initialisation (or a PIN to be typed, or whatever), there may be
-a control command you can issue afterwards to "forget" the smart-card
-so that additional initialisation is no longer possible. In
-applications such as web-servers, where potentially volatile code may
-run on the same host system, this may provide some arguable security
-value. In such a case, the command would be passed to the ENGINE after
-it has been initialised for use, and so the "-post" switch would be
-used instead. Applications may provide a different syntax for
-supporting this distinction, and some may simply not provide it at all
-("-pre" is almost always what you're after, in reality).
-
-How do I build a "dynamic" ENGINE?
-----------------------------------
-
-This question is trickier - currently OpenSSL bundles various ENGINE
-implementations that are statically built in, and any application that
-calls the "ENGINE_load_builtin_engines()" function will automatically
-have all such ENGINEs available (and occupying memory). Applications
-that don't call that function have no ENGINEs available like that and
-would have to use "dynamic" to load any such ENGINE - but on the other
-hand such applications would only have the memory footprint of any
-ENGINEs explicitly loaded using user/admin provided control commands.
-The main advantage of not statically linking ENGINEs and only using
-"dynamic" for hardware support is that any installation using no
-"external" ENGINE suffers no unnecessary memory footprint from unused
-ENGINEs. Likewise, installations that do require an ENGINE incur the
-overheads from only *that* ENGINE once it has been loaded.
-
-Sounds good? Maybe, but currently building an ENGINE implementation as
-a shared-library that can be loaded by "dynamic" isn't automated in
-OpenSSL's build process. It can be done manually quite easily however.
-Such a shared-library can either be built with any OpenSSL code it
-needs statically linked in, or it can link dynamically against OpenSSL
-if OpenSSL itself is built as a shared library. The instructions are
-the same in each case, but in the former (statically linked any
-dependencies on OpenSSL) you must ensure OpenSSL is built with
-position-independent code ("PIC"). The default OpenSSL compilation may
-already specify the relevant flags to do this, but you should consult
-with your compiler documentation if you are in any doubt.
-
-This example will show building the "atalla" ENGINE in the
-crypto/engine/ directory as a shared-library for use via the "dynamic"
-ENGINE.
-
-1.  "cd" to the crypto/engine/ directory of a pre-compiled OpenSSL
-    source tree.
-
-2.  Recompile at least one source file so you can see all the compiler
-    flags (and syntax) being used to build normally. Eg;
-
-        touch hw_atalla.c ; make
-
-    will rebuild "hw_atalla.o" using all such flags.
-
-3.  Manually enter the same compilation line to compile the
-    "hw_atalla.c" file but with the following two changes;
-
-    - add "-DENGINE_DYNAMIC_SUPPORT" to the command line switches,
-    - change the output file from "hw_atalla.o" to something new,
-      eg. "tmp_atalla.o"
-
-4.  Link "tmp_atalla.o" into a shared-library using the top-level
-    OpenSSL libraries to resolve any dependencies. The syntax for doing
-    this depends heavily on your system/compiler and is a nightmare
-    known well to anyone who has worked with shared-library portability
-    before. 'gcc' on Linux, for example, would use the following syntax;
-
-        gcc -shared -o dyn_atalla.so tmp_atalla.o -L../.. -lcrypto
-
-5.  Test your shared library using "openssl engine" as explained in the
-    previous section. Eg. from the top-level directory, you might try
-
-        apps/openssl engine -vvvv dynamic \
-              -pre SO_PATH:./crypto/engine/dyn_atalla.so -pre LOAD
-
-If the shared-library loads successfully, you will see both "-pre"
-commands marked as "SUCCESS" and the list of control commands
-displayed (because of "-vvvv") will be the control commands for the
-*atalla* ENGINE (ie. *not* the 'dynamic' ENGINE). You can also add
-the "-t" switch to the utility if you want it to try and initialise
-the atalla ENGINE for use to test any possible hardware/driver issues.
-
-PROBLEMS
-========
-
-It seems like the ENGINE part doesn't work too well with CryptoSwift on Win32.
-A quick test done right before the release showed that trying "openssl speed
--engine cswift" generated errors. If the DSO gets enabled, an attempt is made
-to write at memory address 0x00000002.

README.md

@@ -136,7 +136,6 @@ containing additional information on specific topics.
  * [Information about the OpenSSL QUIC protocol implementation](README-QUIC.md)
  * [Information about the OpenSSL Provider architecture](README-PROVIDERS.md)
  * [Information about using the OpenSSL FIPS validated module](README-FIPS.md)
- * [Information about the legacy OpenSSL Engine architecture](README-ENGINES.md)
 
 The OpenSSL Guide
 -----------------

apps/build.info

@@ -37,9 +37,6 @@ ENDIF
 IF[{- !$disabled{'dsa'} -}]
 $OPENSSLSRC=$OPENSSLSRC dsa.c dsaparam.c gendsa.c
 ENDIF
-IF[{- !$disabled{'engine'} -}]
-$OPENSSLSRC=$OPENSSLSRC engine.c
-ENDIF
 IF[{- !$disabled{'rsa'} -}]
 $OPENSSLSRC=$OPENSSLSRC rsa.c genrsa.c
 ENDIF

apps/ca.c

@@ -145,7 +145,7 @@ static int msie_hack = 0;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SUBJ, OPT_UTF8,
+    OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SUBJ, OPT_UTF8,
     OPT_CREATE_SERIAL, OPT_MULTIVALUE_RDN, OPT_STARTDATE, OPT_ENDDATE,
     OPT_DAYS, OPT_MD, OPT_POLICY, OPT_KEYFILE, OPT_KEYFORM, OPT_PASSIN,
     OPT_KEY, OPT_CERT, OPT_CERTFORM, OPT_SELFSIGN,
@@ -182,9 +182,6 @@ const OPTIONS ca_options[] = {
     {"ss_cert", OPT_SS_CERT, '<', "File contains a self signed cert to sign"},
     {"spkac", OPT_SPKAC, '<',
      "File contains DN and signed public key and challenge"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Configuration"),
     {"config", OPT_CONFIG, 's', "A config file"},
@@ -218,8 +215,7 @@ const OPTIONS ca_options[] = {
     OPT_SECTION("Signing"),
     {"md", OPT_MD, 's', "Digest to use, such as sha256"},
     {"keyfile", OPT_KEYFILE, 's', "The CA private key"},
-    {"keyform", OPT_KEYFORM, 'f',
-     "Private key file format (ENGINE, other values ignored)"},
+    {"keyform", OPT_KEYFORM, 'f', "Private key file format (DER/PEM)"},
     {"passin", OPT_PASSIN, 's', "Key and cert input file pass phrase source"},
     {"key", OPT_KEY, 's',
      "Key to decrypt the private key or cert files if encrypted. Better use -passin"},
@@ -266,7 +262,6 @@ const OPTIONS ca_options[] = {
 int ca_main(int argc, char **argv)
 {
     CONF *conf = NULL;
-    ENGINE *e = NULL;
     BIGNUM *crlnumber = NULL, *serial = NULL;
     EVP_PKEY *pkey = NULL;
     BIO *in = NULL, *out = NULL, *Sout = NULL;
@@ -500,9 +495,6 @@ opthelp:
             rev_arg = opt_arg();
             rev_type = (o - OPT_CRL_REASON) + REV_CRL_REASON;
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         }
     }
 
@@ -591,7 +583,7 @@ end_of_options:
             goto end;
         }
     }
-    pkey = load_key(keyfile, keyformat, 0, passin, e, "CA private key");
+    pkey = load_key(keyfile, keyformat, 0, passin, "CA private key");
     cleanse(passin);
     if (pkey == NULL)
         /* load_key() has already printed an appropriate message */
@@ -1319,7 +1311,6 @@ end_of_options:
     X509_CRL_free(crl);
     NCONF_free(conf);
     NCONF_free(extfile_conf);
-    release_engine(e);
     return ret;
 }
 

apps/cmp.c

@@ -160,7 +160,6 @@ static int opt_crlform = FORMAT_ASN1;
 static char *opt_keyform_s = NULL;
 static int opt_keyform = FORMAT_UNDEF;
 static char *opt_otherpass = NULL;
-static char *opt_engine = NULL;
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
 /* TLS connection */
@@ -264,9 +263,6 @@ typedef enum OPTION_choice {
 
     OPT_CERTFORM, OPT_CRLFORM, OPT_KEYFORM,
     OPT_OTHERPASS,
-#ifndef OPENSSL_NO_ENGINE
-    OPT_ENGINE,
-#endif
     OPT_PROV_ENUM,
     OPT_R_ENUM,
 
@@ -496,16 +492,9 @@ const OPTIONS cmp_options[] = {
      "Format (PEM or DER) to use when saving a certificate to a file. Default PEM"},
     {"crlform", OPT_CRLFORM, 's',
      "Format (PEM or DER) to use when saving a CRL to a file. Default DER"},
-    {"keyform", OPT_KEYFORM, 's',
-     "Format of the key input (ENGINE, other values ignored)"},
+    {"keyform", OPT_KEYFORM, 's', "Format of the key input (DER/PEM/P12)"},
     {"otherpass", OPT_OTHERPASS, 's',
      "Pass phrase source potentially needed for loading certificates of others"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's',
-     "Use crypto engine with given identifier, possibly a hardware device."},
-    {OPT_MORE_STR, 0, 0,
-     "Engines may also be defined in OpenSSL config file engine section."},
-#endif
     OPT_PROV_OPTIONS,
     OPT_R_OPTIONS,
 
@@ -678,9 +667,6 @@ static varref cmp_vars[] = { /* must be in same order as enumerated above! */
 
     {&opt_certform_s}, {&opt_crlform_s}, {&opt_keyform_s},
     {&opt_otherpass},
-#ifndef OPENSSL_NO_ENGINE
-    {&opt_engine},
-#endif
 
 #if !defined(OPENSSL_NO_SOCK) && !defined(OPENSSL_NO_HTTP)
     {(char **)&opt_tls_used}, {&opt_tls_cert}, {&opt_tls_key},
@@ -768,10 +754,10 @@ static int set_verbosity(int level)
 }
 
 static EVP_PKEY *load_key_pwd(const char *uri, int format,
-                              const char *pass, ENGINE *eng, const char *desc)
+                              const char *pass, const char *desc)
 {
     char *pass_string = get_passwd(pass, desc);
-    EVP_PKEY *pkey = load_key(uri, format, 0, pass_string, eng, desc);
+    EVP_PKEY *pkey = load_key(uri, format, 0, pass_string, desc);
 
     clear_free(pass_string);
     return pkey;
@@ -1099,11 +1085,7 @@ static int transform_opts(void)
         return 0;
     }
 
-#ifndef OPENSSL_NO_ENGINE
-# define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12 | OPT_FMT_ENGINE)
-#else
-# define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12)
-#endif
+#define FORMAT_OPTIONS (OPT_FMT_PEMDER | OPT_FMT_PKCS12)
 
     if (opt_keyform_s != NULL
             && !opt_format(opt_keyform_s, FORMAT_OPTIONS, &opt_keyform)) {
@@ -1127,7 +1109,7 @@ static int transform_opts(void)
     return 1;
 }
 
-static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
+static OSSL_CMP_SRV_CTX *setup_srv_ctx(void)
 {
     OSSL_CMP_CTX *ctx; /* extra CMP (client) ctx partly used by server */
     OSSL_CMP_SRV_CTX *srv_ctx = ossl_cmp_mock_srv_new(app_get0_libctx(),
@@ -1180,7 +1162,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
     if (opt_srv_key != NULL) {
         EVP_PKEY *pkey = load_key_pwd(opt_srv_key, opt_keyform,
                                       opt_srv_keypass,
-                                      engine, "private key for mock server cert");
+                                      "private key for mock server cert");
 
         if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {
             EVP_PKEY_free(pkey);
@@ -1220,7 +1202,7 @@ static OSSL_CMP_SRV_CTX *setup_srv_ctx(ENGINE *engine)
     }
     if (opt_rsp_key != NULL) {
         EVP_PKEY *pkey = load_key_pwd(opt_rsp_key, opt_keyform,
-                                      opt_rsp_keypass, engine,
+                                      opt_rsp_keypass,
                                       "private key for enrollment cert");
 
         if (pkey == NULL
@@ -1370,8 +1352,7 @@ static int setup_verification_ctx(OSSL_CMP_CTX *ctx)
  * set up ssl_ctx for the OSSL_CMP_CTX based on options from config file/CLI.
  * Returns pointer on success, NULL on error
  */
-static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
-                              ENGINE *engine)
+static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host)
 {
     STACK_OF(X509) *untrusted = OSSL_CMP_CTX_get0_untrusted(ctx);
     EVP_PKEY *pkey = NULL;
@@ -1477,7 +1458,7 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
         }
 
         pkey = load_key_pwd(opt_tls_key, opt_keyform, opt_tls_keypass,
-                            engine, "TLS client private key");
+                            "TLS client private key");
         cleanse(opt_tls_keypass);
         if (pkey == NULL)
             goto err;
@@ -1526,7 +1507,7 @@ static SSL_CTX *setup_ssl_ctx(OSSL_CMP_CTX *ctx, const char *host,
  * file/CLI while parsing options and checking their consistency.
  * Returns 1 on success, 0 on error
  */
-static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
+static int setup_protection_ctx(OSSL_CMP_CTX *ctx)
 {
     if (!opt_unprotected_requests && opt_secret == NULL && opt_key == NULL) {
         CMP_err("must give -key or -secret unless -unprotected_requests is used");
@@ -1564,7 +1545,7 @@ static int setup_protection_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         return 0;
 
     if (opt_key != NULL) {
-        EVP_PKEY *pkey = load_key_pwd(opt_key, opt_keyform, opt_keypass, engine,
+        EVP_PKEY *pkey = load_key_pwd(opt_key, opt_keyform, opt_keypass,
                                       "private key for CMP client certificate");
 
         if (pkey == NULL || !OSSL_CMP_CTX_set1_pkey(ctx, pkey)) {
@@ -1688,7 +1669,7 @@ static int set_fallback_pubkey(OSSL_CMP_CTX *ctx)
  * based on options from CLI and/or config file.
  * Returns 1 on success, 0 on error
  */
-static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
+static int setup_request_ctx(OSSL_CMP_CTX *ctx)
 {
     X509_REQ *csr = NULL;
     X509_EXTENSIONS *exts = NULL;
@@ -1870,14 +1851,14 @@ static int setup_request_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
         BIO *bio_bak = bio_err;
 
         bio_err = NULL; /* suppress diagnostics on first try loading key */
-        pkey = load_key_pwd(file, format, pass, engine, desc);
+        pkey = load_key_pwd(file, format, pass, desc);
         bio_err = bio_bak;
         if (pkey == NULL) {
             ERR_clear_error();
             desc = opt_csr == NULL
                 ? "fallback public key for cert to be enrolled"
                 : "public key for checking cert resulting from p10cr";
-            pkey = load_pubkey(file, format, 0, pass, engine, desc);
+            pkey = load_pubkey(file, format, 0, pass, desc);
             priv = 0;
         }
 
@@ -2140,7 +2121,7 @@ static int handle_opt_geninfo(OSSL_CMP_CTX *ctx)
  * Prints reason for error to bio_err.
  * Returns 1 on success, 0 on error
  */
-static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
+static int setup_client_ctx(OSSL_CMP_CTX *ctx)
 {
     int ret = 0;
     char *host = NULL, *port = NULL, *path = NULL, *used_path = opt_path;
@@ -2299,7 +2280,7 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
             goto err;
         APP_HTTP_TLS_INFO_free(OSSL_CMP_CTX_get_http_cb_arg(ctx));
         (void)OSSL_CMP_CTX_set_http_cb_arg(ctx, info);
-        info->ssl_ctx = setup_ssl_ctx(ctx, host, engine);
+        info->ssl_ctx = setup_ssl_ctx(ctx, host);
         info->server = host;
         host = NULL; /* prevent deallocation */
         if ((info->port = OPENSSL_strdup(server_port)) == NULL)
@@ -2314,10 +2295,10 @@ static int setup_client_ctx(OSSL_CMP_CTX *ctx, ENGINE *engine)
     }
 #endif
 
-    if (!setup_protection_ctx(ctx, engine))
+    if (!setup_protection_ctx(ctx))
         goto err;
 
-    if (!setup_request_ctx(ctx, engine))
+    if (!setup_request_ctx(ctx))
         goto err;
 
     if (!set_name(opt_recipient, OSSL_CMP_CTX_set1_recipient, ctx, "recipient")
@@ -3069,11 +3050,6 @@ static int get_opts(int argc, char **argv)
         case OPT_OTHERPASS:
             opt_otherpass = opt_str();
             break;
-#ifndef OPENSSL_NO_ENGINE
-        case OPT_ENGINE:
-            opt_engine = opt_str();
-            break;
-#endif
         case OPT_PROV_CASES:
             if (!opt_provider(o))
                 goto opthelp;
@@ -3606,7 +3582,6 @@ int cmp_main(int argc, char **argv)
     char *configfile = NULL;
     int i;
     X509 *newcert = NULL;
-    ENGINE *engine = NULL;
     int ret = 0; /* default: failure */
 
     if (!handle_opts_upfront(argc, argv))
@@ -3672,15 +3647,6 @@ int cmp_main(int argc, char **argv)
     if (opt_batch)
         set_base_ui_method(UI_null());
 
-    if (opt_engine != NULL) {
-        engine = setup_engine_methods(opt_engine,
-                                      0 /* not: ENGINE_METHOD_ALL */, 0);
-        if (engine == NULL) {
-            CMP_err1("cannot load engine %s", opt_engine);
-            goto err;
-        }
-    }
-
     OSSL_CMP_CTX_set_log_verbosity(cmp_ctx, opt_verbosity);
     if (!OSSL_CMP_CTX_set_log_cb(cmp_ctx, print_to_bio_out)) {
         CMP_err1("cannot set up error reporting and logging for %s", prog);
@@ -3740,7 +3706,7 @@ int cmp_main(int argc, char **argv)
         OSSL_CMP_SRV_CTX *srv_ctx;
         OSSL_CMP_CTX *srv_cmp_ctx;
 
-        if ((srv_ctx = setup_srv_ctx(engine)) == NULL)
+        if ((srv_ctx = setup_srv_ctx()) == NULL)
             goto err;
         OSSL_CMP_CTX_set_transfer_cb_arg(cmp_ctx /* of client */, srv_ctx);
 
@@ -3791,7 +3757,7 @@ int cmp_main(int argc, char **argv)
             CMP_warn("-use_mock_srv option is not used if enough filenames given for -rspin");
     }
 
-    if (!setup_client_ctx(cmp_ctx, engine)) {
+    if (!setup_client_ctx(cmp_ctx)) {
         CMP_err("cannot set up CMP context");
         goto err;
     }
@@ -3935,7 +3901,6 @@ int cmp_main(int argc, char **argv)
 #endif
     }
     X509_VERIFY_PARAM_free(vpm);
-    release_engine(engine);
 
     NCONF_free(conf); /* must not do as long as opt_... variables are used */
     OSSL_CMP_log_close();

apps/cms.c

@@ -89,7 +89,7 @@ typedef enum OPTION_choice {
     OPT_PASSIN, OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP,
     OPT_CERTSOUT, OPT_MD, OPT_INKEY, OPT_KEYFORM, OPT_KEYOPT, OPT_RR_FROM,
     OPT_RR_TO, OPT_AES128_WRAP, OPT_AES192_WRAP, OPT_AES256_WRAP,
-    OPT_3DES_WRAP, OPT_WRAP, OPT_ENGINE,
+    OPT_3DES_WRAP, OPT_WRAP,
     OPT_R_ENUM,
     OPT_PROV_ENUM, OPT_CONFIG,
     OPT_V_ENUM,
@@ -159,11 +159,7 @@ const OPTIONS cms_options[] = {
      "Input private key (if not signer or recipient)"},
     {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
     {"keyopt", OPT_KEYOPT, 's', "Set public key parameters as n:v pairs"},
-    {"keyform", OPT_KEYFORM, 'f',
-     "Input private key format (ENGINE, other values ignored)"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-#endif
+    {"keyform", OPT_KEYFORM, 'f', "Input private key format (DER/PEM)"},
     OPT_PROV_OPTIONS,
     OPT_R_OPTIONS,
 
@@ -313,7 +309,6 @@ int cms_main(int argc, char **argv)
     BIO *in = NULL, *out = NULL, *indata = NULL, *rctin = NULL;
     CMS_ContentInfo *cms = NULL, *rcms = NULL;
     CMS_ReceiptRequest *rr = NULL;
-    ENGINE *e = NULL;
     EVP_PKEY *key = NULL;
     EVP_CIPHER *cipher = NULL, *wrap_cipher = NULL, *kekcipher = NULL;
     EVP_MD *sign_md = NULL;
@@ -599,9 +594,6 @@ int cms_main(int argc, char **argv)
                 goto opthelp;
             }
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_PASSIN:
             passinarg = opt_arg();
             break;
@@ -962,7 +954,7 @@ int cms_main(int argc, char **argv)
     }
 
     if (keyfile != NULL) {
-        key = load_key(keyfile, keyform, 0, passin, e, "signing key");
+        key = load_key(keyfile, keyform, 0, passin, "signing key");
         if (key == NULL)
             goto end;
     }
@@ -1220,7 +1212,7 @@ int cms_main(int argc, char **argv)
                 ret = 2;
                 goto end;
             }
-            key = load_key(keyfile, keyform, 0, passin, e, "signing key");
+            key = load_key(keyfile, keyform, 0, passin, "signing key");
             if (key == NULL) {
                 ret = 2;
                 goto end;
@@ -1439,7 +1431,6 @@ int cms_main(int argc, char **argv)
     EVP_MD_free(sign_md);
     CMS_ContentInfo_free(cms);
     CMS_ContentInfo_free(rcms);
-    release_engine(e);
     BIO_free(rctin);
     BIO_free(in);
     BIO_free(indata);

apps/crl.c

@@ -265,7 +265,7 @@ int crl_main(int argc, char **argv)
         newcrl = load_crl(crldiff, informat, 0, "other CRL");
         if (!newcrl)
             goto end;
-        pkey = load_key(keyfile, keyformat, 0, NULL, NULL, "CRL signing key");
+        pkey = load_key(keyfile, keyformat, 0, NULL, "CRL signing key");
         if (pkey == NULL) {
             X509_CRL_free(newcrl);
             goto end;

apps/dgst.c

@@ -42,7 +42,7 @@ typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_LIST,
     OPT_C, OPT_R, OPT_OUT, OPT_SIGN, OPT_PASSIN, OPT_VERIFY,
-    OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM, OPT_ENGINE, OPT_ENGINE_IMPL,
+    OPT_PRVERIFY, OPT_SIGNATURE, OPT_KEYFORM,
     OPT_HEX, OPT_BINARY, OPT_DEBUG, OPT_FIPS_FINGERPRINT,
     OPT_HMAC, OPT_HMAC_ENV, OPT_HMAC_STDIN, OPT_MAC, OPT_SIGOPT, OPT_MACOPT, OPT_XOFLEN,
     OPT_DIGEST,
@@ -55,18 +55,13 @@ const OPTIONS dgst_options[] = {
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
     {"list", OPT_LIST, '-', "List digests"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-    {"engine_impl", OPT_ENGINE_IMPL, '-',
-     "Also use engine given by -engine for digest operations"},
-#endif
     {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
 
     OPT_SECTION("Output"),
     {"c", OPT_C, '-', "Print the digest with separating colons"},
     {"r", OPT_R, '-', "Print the digest in coreutils format"},
     {"out", OPT_OUT, '>', "Output to filename rather than stdout"},
-    {"keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)"},
+    {"keyform", OPT_KEYFORM, 'f', "Key file format (DER/PEM)"},
     {"hex", OPT_HEX, '-', "Print as hex dump"},
     {"binary", OPT_BINARY, '-', "Print in binary form"},
     {"xoflen", OPT_XOFLEN, 'p', "Output length for XOF algorithms. To obtain the maximum security strength set this to 32 (or greater) for SHAKE128, and 64 (or greater) for SHAKE256"},
@@ -99,7 +94,6 @@ const OPTIONS dgst_options[] = {
 int dgst_main(int argc, char **argv)
 {
     BIO *in = NULL, *inp = NULL, *bmd = NULL, *out = NULL;
-    ENGINE *e = NULL, *impl = NULL;
     EVP_PKEY *sigkey = NULL;
     STACK_OF(OPENSSL_STRING) *sigopts = NULL, *macopts = NULL;
     char *hmac_key = NULL;
@@ -117,7 +111,6 @@ int dgst_main(int argc, char **argv)
     int i, ret = EXIT_FAILURE, out_bin = -1, want_pub = 0, do_verify = 0;
     int xoflen = 0;
     unsigned char *buf = NULL, *sigbuf = NULL;
-    int engine_impl = 0;
     struct doall_dgst_digests dec;
     EVP_MD_CTX *signctx = NULL;
     int oneshot_sign = 0;
@@ -183,12 +176,6 @@ int dgst_main(int argc, char **argv)
             if (!opt_format(opt_arg(), OPT_FMT_ANY, &keyform))
                 goto opthelp;
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
-        case OPT_ENGINE_IMPL:
-            engine_impl = 1;
-            break;
         case OPT_HEX:
             out_bin = 0;
             break;
@@ -282,8 +269,6 @@ int dgst_main(int argc, char **argv)
                    "No signature to verify: use the -signature option\n");
         goto end;
     }
-    if (engine_impl)
-        impl = e;
 
     in = BIO_new(BIO_s_file());
     bmd = BIO_new(BIO_f_md());
@@ -319,9 +304,9 @@ int dgst_main(int argc, char **argv)
 
     if (keyfile != NULL) {
         if (want_pub)
-            sigkey = load_pubkey(keyfile, keyform, 0, NULL, e, "public key");
+            sigkey = load_pubkey(keyfile, keyform, 0, NULL, "public key");
         else
-            sigkey = load_key(keyfile, keyform, 0, passin, e, "private key");
+            sigkey = load_key(keyfile, keyform, 0, passin, "private key");
         if (sigkey == NULL) {
             /*
              * load_[pub]key() has already printed an appropriate message
@@ -344,7 +329,7 @@ int dgst_main(int argc, char **argv)
     if (mac_name != NULL) {
         EVP_PKEY_CTX *mac_ctx = NULL;
 
-        if (!init_gen_str(&mac_ctx, mac_name, impl, 0, NULL, NULL))
+        if (!init_gen_str(&mac_ctx, mac_name, 0, NULL, NULL))
             goto end;
         if (macopts != NULL) {
             for (i = 0; i < sk_OPENSSL_STRING_num(macopts); i++) {
@@ -359,7 +344,6 @@ int dgst_main(int argc, char **argv)
         }
 
         sigkey = app_keygen(mac_ctx, mac_name, 0, 0 /* not verbose */);
-        /* Verbose output would make external-tests gost-engine fail */
         EVP_PKEY_CTX_free(mac_ctx);
         if (sigkey == NULL)
             goto end;
@@ -370,7 +354,7 @@ int dgst_main(int argc, char **argv)
             md = (EVP_MD *)EVP_sha256();
             digestname = SN_sha256;
         }
-        sigkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, impl,
+        sigkey = EVP_PKEY_new_raw_private_key(EVP_PKEY_HMAC, NULL,
                                               (unsigned char *)hmac_key,
                                               strlen(hmac_key));
         if (sigkey == NULL)
@@ -389,19 +373,13 @@ int dgst_main(int argc, char **argv)
             goto end;
         }
         if (do_verify)
-            if (impl == NULL)
-                res = EVP_DigestVerifyInit_ex(mctx, &pctx, digestname,
-                                              app_get0_libctx(),
-                                              app_get0_propq(), sigkey, NULL);
-            else
-                res = EVP_DigestVerifyInit(mctx, &pctx, md, impl, sigkey);
+            res = EVP_DigestVerifyInit_ex(mctx, &pctx, digestname,
+                                          app_get0_libctx(),
+                                          app_get0_propq(), sigkey, NULL);
         else
-            if (impl == NULL)
-                res = EVP_DigestSignInit_ex(mctx, &pctx, digestname,
-                                            app_get0_libctx(),
-                                            app_get0_propq(), sigkey, NULL);
-            else
-                res = EVP_DigestSignInit(mctx, &pctx, md, impl, sigkey);
+            res = EVP_DigestSignInit_ex(mctx, &pctx, digestname,
+                                        app_get0_libctx(),
+                                        app_get0_propq(), sigkey, NULL);
         if (res == 0) {
             BIO_printf(bio_err, "Error setting context\n");
             goto end;
@@ -432,7 +410,7 @@ int dgst_main(int argc, char **argv)
         }
         if (md == NULL)
             md = (EVP_MD *)EVP_sha256();
-        if (!EVP_DigestInit_ex(mctx, md, impl)) {
+        if (!EVP_DigestInit_ex(mctx, md, NULL)) {
             BIO_printf(bio_err, "Error setting digest\n");
             goto end;
         }
@@ -534,7 +512,6 @@ int dgst_main(int argc, char **argv)
     sk_OPENSSL_STRING_pop_free(macopts, clear_free);
     OPENSSL_free(sigbuf);
     BIO_free(bmd);
-    release_engine(e);
     return ret;
 }
 

apps/dhparam.c

@@ -37,7 +37,7 @@ static int verbose = 1;
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
-    OPT_ENGINE, OPT_CHECK, OPT_TEXT, OPT_NOOUT,
+    OPT_CHECK, OPT_TEXT, OPT_NOOUT,
     OPT_DSAPARAM, OPT_2, OPT_3, OPT_5, OPT_VERBOSE, OPT_QUIET,
     OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
@@ -52,9 +52,6 @@ const OPTIONS dhparam_options[] = {
     {"dsaparam", OPT_DSAPARAM, '-',
      "Read or generate DSA parameters, convert to DH"},
 #endif
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Input"),
     {"in", OPT_IN, '<', "Input file"},
@@ -85,7 +82,6 @@ int dhparam_main(int argc, char **argv)
     EVP_PKEY *pkey = NULL, *tmppkey = NULL;
     EVP_PKEY_CTX *ctx = NULL;
     char *infile = NULL, *outfile = NULL, *prog;
-    ENGINE *e = NULL;
     int dsaparam = 0;
     int text = 0, ret = 1, num = 0, g = 0;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM, check = 0, noout = 0;
@@ -117,9 +113,6 @@ int dhparam_main(int argc, char **argv)
         case OPT_OUT:
             outfile = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_CHECK:
             check = 1;
             break;
@@ -362,7 +355,6 @@ int dhparam_main(int argc, char **argv)
     EVP_PKEY_free(pkey);
     EVP_PKEY_free(tmppkey);
     EVP_PKEY_CTX_free(ctx);
-    release_engine(e);
     return ret;
 }
 

apps/dsa.c

@@ -34,7 +34,7 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_ENGINE,
+    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
     /* Do not change the order here; see case statements below */
     OPT_PVK_NONE, OPT_PVK_WEAK, OPT_PVK_STRONG,
     OPT_NOOUT, OPT_TEXT, OPT_MODULUS, OPT_PUBIN,
@@ -51,9 +51,6 @@ const OPTIONS dsa_options[] = {
     {"pvk-weak", OPT_PVK_WEAK, '-', "Enable 'Weak' PVK encoding level"},
     {"pvk-none", OPT_PVK_NONE, '-', "Don't enforce PVK encoding"},
 #endif
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Input"),
     {"in", OPT_IN, 's', "Input key"},
@@ -77,7 +74,6 @@ const OPTIONS dsa_options[] = {
 int dsa_main(int argc, char **argv)
 {
     BIO *out = NULL;
-    ENGINE *e = NULL;
     EVP_PKEY *pkey = NULL;
     EVP_CIPHER *enc = NULL;
     char *infile = NULL, *outfile = NULL, *prog;
@@ -120,9 +116,6 @@ int dsa_main(int argc, char **argv)
         case OPT_OUT:
             outfile = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_PASSIN:
             passinarg = opt_arg();
             break;
@@ -176,9 +169,9 @@ int dsa_main(int argc, char **argv)
 
     BIO_printf(bio_err, "read DSA key\n");
     if (pubin)
-        pkey = load_pubkey(infile, informat, 1, passin, e, "public key");
+        pkey = load_pubkey(infile, informat, 1, passin, "public key");
     else
-        pkey = load_key(infile, informat, 1, passin, e, "private key");
+        pkey = load_key(infile, informat, 1, passin, "private key");
 
     if (pkey == NULL) {
         BIO_printf(bio_err, "unable to load Key\n");
@@ -300,7 +293,6 @@ int dsa_main(int argc, char **argv)
     BIO_free_all(out);
     EVP_PKEY_free(pkey);
     EVP_CIPHER_free(enc);
-    release_engine(e);
     OPENSSL_free(passin);
     OPENSSL_free(passout);
     return ret;

apps/dsaparam.c

@@ -27,7 +27,7 @@ static int verbose = 0;
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT,
-    OPT_NOOUT, OPT_GENKEY, OPT_ENGINE, OPT_VERBOSE, OPT_QUIET,
+    OPT_NOOUT, OPT_GENKEY, OPT_VERBOSE, OPT_QUIET,
     OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
@@ -36,9 +36,6 @@ const OPTIONS dsaparam_options[] = {
 
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine e, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Input"),
     {"in", OPT_IN, '<', "Input file"},
@@ -64,7 +61,6 @@ const OPTIONS dsaparam_options[] = {
 
 int dsaparam_main(int argc, char **argv)
 {
-    ENGINE *e = NULL;
     BIO *out = NULL;
     EVP_PKEY *params = NULL, *pkey = NULL;
     EVP_PKEY_CTX *ctx = NULL;
@@ -100,9 +96,6 @@ int dsaparam_main(int argc, char **argv)
         case OPT_OUT:
             outfile = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_TEXT:
             text = 1;
             break;
@@ -253,6 +246,5 @@ int dsaparam_main(int argc, char **argv)
     EVP_PKEY_CTX_free(ctx);
     EVP_PKEY_free(pkey);
     EVP_PKEY_free(params);
-    release_engine(e);
     return ret;
 }

apps/ec.c

@@ -23,7 +23,7 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
+    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
     OPT_NOOUT, OPT_TEXT, OPT_PARAM_OUT, OPT_PUBIN, OPT_PUBOUT,
     OPT_PASSIN, OPT_PASSOUT, OPT_PARAM_ENC, OPT_CONV_FORM, OPT_CIPHER,
     OPT_NO_PUBLIC, OPT_CHECK, OPT_PROV_ENUM
@@ -32,13 +32,10 @@ typedef enum OPTION_choice {
 const OPTIONS ec_options[] = {
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Input"),
     {"in", OPT_IN, 's', "Input file"},
-    {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)"},
+    {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12)"},
     {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
     {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
     {"check", OPT_CHECK, '-', "check key consistency"},
@@ -68,7 +65,6 @@ int ec_main(int argc, char **argv)
     EVP_PKEY_CTX *pctx = NULL;
     EVP_PKEY *eckey = NULL;
     BIO *out = NULL;
-    ENGINE *e = NULL;
     EVP_CIPHER *enc = NULL;
     char *infile = NULL, *outfile = NULL, *ciphername = NULL, *prog;
     char *passin = NULL, *passout = NULL, *passinarg = NULL, *passoutarg = NULL;
@@ -128,9 +124,6 @@ int ec_main(int argc, char **argv)
         case OPT_PASSOUT:
             passoutarg = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_CIPHER:
             ciphername = opt_unknown();
             break;
@@ -171,9 +164,9 @@ int ec_main(int argc, char **argv)
     }
 
     if (pubin)
-        eckey = load_pubkey(infile, informat, 1, passin, e, "public key");
+        eckey = load_pubkey(infile, informat, 1, passin, "public key");
     else
-        eckey = load_key(infile, informat, 1, passin, e, "private key");
+        eckey = load_key(infile, informat, 1, passin, "private key");
 
     if (eckey == NULL) {
         BIO_printf(bio_err, "unable to load Key\n");
@@ -278,7 +271,6 @@ end:
     OSSL_ENCODER_CTX_free(ectx);
     OSSL_DECODER_CTX_free(dctx);
     EVP_PKEY_CTX_free(pctx);
-    release_engine(e);
     if (passin != NULL)
         OPENSSL_clear_free(passin, strlen(passin));
     if (passout != NULL)

apps/ecparam.c

@@ -25,7 +25,7 @@ typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_TEXT,
     OPT_CHECK, OPT_LIST_CURVES, OPT_NO_SEED, OPT_NOOUT, OPT_NAME,
-    OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_ENGINE, OPT_CHECK_NAMED,
+    OPT_CONV_FORM, OPT_PARAM_ENC, OPT_GENKEY, OPT_CHECK_NAMED,
     OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
@@ -34,9 +34,6 @@ const OPTIONS ecparam_options[] = {
     {"help", OPT_HELP, '-', "Display this summary"},
     {"list_curves", OPT_LIST_CURVES, '-',
      "Prints a list of all curve 'short names'"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     {"genkey", OPT_GENKEY, '-', "Generate ec key"},
     {"in", OPT_IN, '<', "Input file  - default stdin"},
@@ -95,7 +92,6 @@ int ecparam_main(int argc, char **argv)
     EVP_PKEY *params_key = NULL, *key = NULL;
     OSSL_ENCODER_CTX *ectx_key = NULL, *ectx_params = NULL;
     OSSL_DECODER_CTX *dctx_params = NULL;
-    ENGINE *e = NULL;
     BIO *out = NULL;
     char *curve_name = NULL;
     char *asn1_encoding = NULL;
@@ -175,9 +171,6 @@ int ecparam_main(int argc, char **argv)
             if (!opt_provider(o))
                 goto end;
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         }
     }
 
@@ -345,7 +338,6 @@ int ecparam_main(int argc, char **argv)
 end:
     if (ret != 0)
         ERR_print_errors(bio_err);
-    release_engine(e);
     EVP_PKEY_free(params_key);
     EVP_PKEY_free(key);
     EVP_PKEY_CTX_free(pctx);

apps/enc.c

@@ -45,7 +45,7 @@ struct doall_enc_ciphers {
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_LIST,
-    OPT_E, OPT_IN, OPT_OUT, OPT_PASS, OPT_ENGINE, OPT_D, OPT_P, OPT_V,
+    OPT_E, OPT_IN, OPT_OUT, OPT_PASS, OPT_D, OPT_P, OPT_V,
     OPT_NOPAD, OPT_SALT, OPT_NOSALT, OPT_DEBUG, OPT_UPPER_P, OPT_UPPER_A,
     OPT_A, OPT_Z, OPT_BUFSIZE, OPT_K, OPT_KFILE, OPT_UPPER_K, OPT_NONE,
     OPT_UPPER_S, OPT_IV, OPT_MD, OPT_ITER, OPT_PBKDF2, OPT_CIPHER,
@@ -64,9 +64,6 @@ const OPTIONS enc_options[] = {
     {"d", OPT_D, '-', "Decrypt"},
     {"p", OPT_P, '-', "Print the iv/key"},
     {"P", OPT_UPPER_P, '-', "Print the iv/key and exit"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Input"),
     {"in", OPT_IN, '<', "Input file"},
@@ -119,7 +116,6 @@ int enc_main(int argc, char **argv)
 {
     static char buf[128];
     static const char magic[] = "Salted__";
-    ENGINE *e = NULL;
     BIO *in = NULL, *out = NULL, *b64 = NULL, *benc = NULL, *rbio =
         NULL, *wbio = NULL;
     EVP_CIPHER_CTX *ctx = NULL;
@@ -211,9 +207,6 @@ int enc_main(int argc, char **argv)
         case OPT_PASS:
             passarg = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_D:
             enc = 0;
             break;
@@ -667,7 +660,7 @@ int enc_main(int argc, char **argv)
             EVP_CIPHER_CTX_set_flags(ctx, EVP_CIPHER_CTX_FLAG_WRAP_ALLOW);
 
         if (rawkey_set) {
-            if (!EVP_CipherInit_ex(ctx, cipher, e, key,
+            if (!EVP_CipherInit_ex(ctx, cipher, NULL, key,
                                    (hiv == NULL && wrap == 1 ? NULL : iv), enc)) {
                 BIO_printf(bio_err, "Error setting cipher %s\n",
                            EVP_CIPHER_get0_name(cipher));
@@ -792,7 +785,6 @@ int enc_main(int argc, char **argv)
 #endif
     BIO_free(bbrot);
     BIO_free(bzstd);
-    release_engine(e);
     OPENSSL_free(pass);
     return ret;
 }

apps/engine.c

@@ -1,501 +0,0 @@
-/*
- * Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
-#include <openssl/opensslconf.h>
-
-#include "apps.h"
-#include "progs.h"
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <openssl/err.h>
-#include <openssl/engine.h>
-#include <openssl/ssl.h>
-#include <openssl/store.h>
-
-typedef enum OPTION_choice {
-    OPT_COMMON,
-    OPT_C, OPT_T, OPT_TT, OPT_PRE, OPT_POST,
-    OPT_V = 100, OPT_VV, OPT_VVV, OPT_VVVV
-} OPTION_CHOICE;
-
-const OPTIONS engine_options[] = {
-    {OPT_HELP_STR, 1, '-', "Usage: %s [options] engine...\n"},
-
-    OPT_SECTION("General"),
-    {"help", OPT_HELP, '-', "Display this summary"},
-    {"t", OPT_T, '-', "Check that specified engine is available"},
-    {"pre", OPT_PRE, 's', "Run command against the ENGINE before loading it"},
-    {"post", OPT_POST, 's', "Run command against the ENGINE after loading it"},
-
-    OPT_SECTION("Output"),
-    {"v", OPT_V, '-', "List 'control commands' For each specified engine"},
-    {"vv", OPT_VV, '-', "Also display each command's description"},
-    {"vvv", OPT_VVV, '-', "Also add the input flags for each command"},
-    {"vvvv", OPT_VVVV, '-', "Also show internal input flags"},
-    {"c", OPT_C, '-', "List the capabilities of specified engine"},
-    {"tt", OPT_TT, '-', "Display error trace for unavailable engines"},
-    {OPT_MORE_STR, OPT_EOF, 1,
-     "Commands are like \"SO_PATH:/lib/libdriver.so\""},
-
-    OPT_PARAMETERS(),
-    {"engine", 0, 0, "ID of engine(s) to load"},
-    {NULL}
-};
-
-static int append_buf(char **buf, int *size, const char *s)
-{
-    const int expand = 256;
-    int len = (int)(strlen(s) + 1);
-    char *p = *buf;
-
-    if (p == NULL) {
-        *size = ((len + expand - 1) / expand) * expand;
-        p = *buf = app_malloc(*size, "engine buffer");
-    } else {
-        const int blen = (int)strlen(p);
-
-        if (blen > 0)
-            len += 2 + blen;
-
-        if (len > *size) {
-            *size = ((len + expand - 1) / expand) * expand;
-            p = OPENSSL_realloc(p, *size);
-            if (p == NULL) {
-                OPENSSL_free(*buf);
-                *buf = NULL;
-                return 0;
-            }
-            *buf = p;
-        }
-
-        if (blen > 0) {
-            p += blen;
-            *p++ = ',';
-            *p++ = ' ';
-        }
-    }
-
-    strcpy(p, s);
-    return 1;
-}
-
-static int util_flags(BIO *out, unsigned int flags, const char *indent)
-{
-    int started = 0, err = 0;
-    /* Indent before displaying input flags */
-    BIO_printf(out, "%s%s(input flags): ", indent, indent);
-    if (flags == 0) {
-        BIO_printf(out, "<no flags>\n");
-        return 1;
-    }
-    /*
-     * If the object is internal, mark it in a way that shows instead of
-     * having it part of all the other flags, even if it really is.
-     */
-    if (flags & ENGINE_CMD_FLAG_INTERNAL) {
-        BIO_printf(out, "[Internal] ");
-    }
-
-    if (flags & ENGINE_CMD_FLAG_NUMERIC) {
-        BIO_printf(out, "NUMERIC");
-        started = 1;
-    }
-    /*
-     * Now we check that no combinations of the mutually exclusive NUMERIC,
-     * STRING, and NO_INPUT flags have been used. Future flags that can be
-     * OR'd together with these would need to added after these to preserve
-     * the testing logic.
-     */
-    if (flags & ENGINE_CMD_FLAG_STRING) {
-        if (started) {
-            BIO_printf(out, "|");
-            err = 1;
-        }
-        BIO_printf(out, "STRING");
-        started = 1;
-    }
-    if (flags & ENGINE_CMD_FLAG_NO_INPUT) {
-        if (started) {
-            BIO_printf(out, "|");
-            err = 1;
-        }
-        BIO_printf(out, "NO_INPUT");
-        started = 1;
-    }
-    /* Check for unknown flags */
-    flags = flags & ~ENGINE_CMD_FLAG_NUMERIC &
-        ~ENGINE_CMD_FLAG_STRING &
-        ~ENGINE_CMD_FLAG_NO_INPUT & ~ENGINE_CMD_FLAG_INTERNAL;
-    if (flags) {
-        if (started)
-            BIO_printf(out, "|");
-        BIO_printf(out, "<0x%04X>", flags);
-    }
-    if (err)
-        BIO_printf(out, "  <illegal flags!>");
-    BIO_printf(out, "\n");
-    return 1;
-}
-
-static int util_verbose(ENGINE *e, int verbose, BIO *out, const char *indent)
-{
-    static const int line_wrap = 78;
-    int num;
-    int ret = 0;
-    char *name = NULL;
-    char *desc = NULL;
-    int flags;
-    int xpos = 0;
-    STACK_OF(OPENSSL_STRING) *cmds = NULL;
-    if (!ENGINE_ctrl(e, ENGINE_CTRL_HAS_CTRL_FUNCTION, 0, NULL, NULL) ||
-        ((num = ENGINE_ctrl(e, ENGINE_CTRL_GET_FIRST_CMD_TYPE,
-                            0, NULL, NULL)) <= 0)) {
-        return 1;
-    }
-
-    cmds = sk_OPENSSL_STRING_new_null();
-    if (cmds == NULL)
-        goto err;
-
-    do {
-        int len;
-        /* Get the command input flags */
-        if ((flags = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FLAGS, num,
-                                 NULL, NULL)) < 0)
-            goto err;
-        if (!(flags & ENGINE_CMD_FLAG_INTERNAL) || verbose >= 4) {
-            /* Get the command name */
-            if ((len = ENGINE_ctrl(e, ENGINE_CTRL_GET_NAME_LEN_FROM_CMD, num,
-                                   NULL, NULL)) <= 0)
-                goto err;
-            name = app_malloc(len + 1, "name buffer");
-            if (ENGINE_ctrl(e, ENGINE_CTRL_GET_NAME_FROM_CMD, num, name,
-                            NULL) <= 0)
-                goto err;
-            /* Get the command description */
-            if ((len = ENGINE_ctrl(e, ENGINE_CTRL_GET_DESC_LEN_FROM_CMD, num,
-                                   NULL, NULL)) < 0)
-                goto err;
-            if (len > 0) {
-                desc = app_malloc(len + 1, "description buffer");
-                if (ENGINE_ctrl(e, ENGINE_CTRL_GET_DESC_FROM_CMD, num, desc,
-                                NULL) <= 0)
-                    goto err;
-            }
-            /* Now decide on the output */
-            if (xpos == 0)
-                /* Do an indent */
-                xpos = BIO_puts(out, indent);
-            else
-                /* Otherwise prepend a ", " */
-                xpos += BIO_printf(out, ", ");
-            if (verbose == 1) {
-                /*
-                 * We're just listing names, comma-delimited
-                 */
-                if ((xpos > (int)strlen(indent)) &&
-                    (xpos + (int)strlen(name) > line_wrap)) {
-                    BIO_printf(out, "\n");
-                    xpos = BIO_puts(out, indent);
-                }
-                xpos += BIO_printf(out, "%s", name);
-            } else {
-                /* We're listing names plus descriptions */
-                BIO_printf(out, "%s: %s\n", name,
-                           (desc == NULL) ? "<no description>" : desc);
-                /* ... and sometimes input flags */
-                if ((verbose >= 3) && !util_flags(out, flags, indent))
-                    goto err;
-                xpos = 0;
-            }
-        }
-        OPENSSL_free(name);
-        name = NULL;
-        OPENSSL_free(desc);
-        desc = NULL;
-        /* Move to the next command */
-        num = ENGINE_ctrl(e, ENGINE_CTRL_GET_NEXT_CMD_TYPE, num, NULL, NULL);
-    } while (num > 0);
-    if (xpos > 0)
-        BIO_printf(out, "\n");
-    ret = 1;
- err:
-    sk_OPENSSL_STRING_free(cmds);
-    OPENSSL_free(name);
-    OPENSSL_free(desc);
-    return ret;
-}
-
-static void util_do_cmds(ENGINE *e, STACK_OF(OPENSSL_STRING) *cmds,
-                         BIO *out, const char *indent)
-{
-    int loop, res, num = sk_OPENSSL_STRING_num(cmds);
-
-    if (num < 0) {
-        BIO_printf(out, "[Error]: internal stack error\n");
-        return;
-    }
-    for (loop = 0; loop < num; loop++) {
-        char buf[256];
-        const char *cmd, *arg;
-        cmd = sk_OPENSSL_STRING_value(cmds, loop);
-        res = 1;                /* assume success */
-        /* Check if this command has no ":arg" */
-        if ((arg = strchr(cmd, ':')) == NULL) {
-            if (!ENGINE_ctrl_cmd_string(e, cmd, NULL, 0))
-                res = 0;
-        } else {
-            if ((int)(arg - cmd) > 254) {
-                BIO_printf(out, "[Error]: command name too long\n");
-                return;
-            }
-            memcpy(buf, cmd, (int)(arg - cmd));
-            buf[arg - cmd] = '\0';
-            arg++;              /* Move past the ":" */
-            /* Call the command with the argument */
-            if (!ENGINE_ctrl_cmd_string(e, buf, arg, 0))
-                res = 0;
-        }
-        if (res) {
-            BIO_printf(out, "[Success]: %s\n", cmd);
-        } else {
-            BIO_printf(out, "[Failure]: %s\n", cmd);
-            ERR_print_errors(out);
-        }
-    }
-}
-
-struct util_store_cap_data {
-    ENGINE *engine;
-    char **cap_buf;
-    int *cap_size;
-    int ok;
-};
-static void util_store_cap(const OSSL_STORE_LOADER *loader, void *arg)
-{
-    struct util_store_cap_data *ctx = arg;
-
-    if (OSSL_STORE_LOADER_get0_engine(loader) == ctx->engine) {
-        char buf[256];
-        BIO_snprintf(buf, sizeof(buf), "STORE(%s)",
-                     OSSL_STORE_LOADER_get0_scheme(loader));
-        if (!append_buf(ctx->cap_buf, ctx->cap_size, buf))
-            ctx->ok = 0;
-    }
-}
-
-int engine_main(int argc, char **argv)
-{
-    int ret = 1, i;
-    int verbose = 0, list_cap = 0, test_avail = 0, test_avail_noise = 0;
-    ENGINE *e;
-    STACK_OF(OPENSSL_CSTRING) *engines = sk_OPENSSL_CSTRING_new_null();
-    STACK_OF(OPENSSL_STRING) *pre_cmds = sk_OPENSSL_STRING_new_null();
-    STACK_OF(OPENSSL_STRING) *post_cmds = sk_OPENSSL_STRING_new_null();
-    BIO *out;
-    const char *indent = "     ";
-    OPTION_CHOICE o;
-    char *prog;
-    char *argv1;
-
-    out = dup_bio_out(FORMAT_TEXT);
-    if (engines == NULL || pre_cmds == NULL || post_cmds == NULL)
-        goto end;
-
-    /* Remember the original command name, parse/skip any leading engine
-     * names, and then setup to parse the rest of the line as flags. */
-    prog = argv[0];
-    while ((argv1 = argv[1]) != NULL && *argv1 != '-') {
-        if (!sk_OPENSSL_CSTRING_push(engines, argv1))
-            goto end;
-        argc--;
-        argv++;
-    }
-    argv[0] = prog;
-    opt_init(argc, argv, engine_options);
-
-    while ((o = opt_next()) != OPT_EOF) {
-        switch (o) {
-        case OPT_EOF:
-        case OPT_ERR:
-            BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
-            goto end;
-        case OPT_HELP:
-            opt_help(engine_options);
-            ret = 0;
-            goto end;
-        case OPT_VVVV:
-        case OPT_VVV:
-        case OPT_VV:
-        case OPT_V:
-            /* Convert to an integer from one to four. */
-            i = (int)(o - OPT_V) + 1;
-            if (verbose < i)
-                verbose = i;
-            break;
-        case OPT_C:
-            list_cap = 1;
-            break;
-        case OPT_TT:
-            test_avail_noise++;
-            /* fall through */
-        case OPT_T:
-            test_avail++;
-            break;
-        case OPT_PRE:
-            if (sk_OPENSSL_STRING_push(pre_cmds, opt_arg()) <= 0)
-                goto end;
-            break;
-        case OPT_POST:
-            if (sk_OPENSSL_STRING_push(post_cmds, opt_arg()) <= 0)
-                goto end;
-            break;
-        }
-    }
-
-    /* Any remaining arguments are engine names. */
-    argc = opt_num_rest();
-    argv = opt_rest();
-    for ( ; *argv; argv++) {
-        if (**argv == '-') {
-            BIO_printf(bio_err, "%s: Cannot mix flags and engine names.\n",
-                       prog);
-            BIO_printf(bio_err, "%s: Use -help for summary.\n", prog);
-            goto end;
-        }
-        if (!sk_OPENSSL_CSTRING_push(engines, *argv))
-            goto end;
-    }
-
-    if (sk_OPENSSL_CSTRING_num(engines) == 0) {
-        for (e = ENGINE_get_first(); e != NULL; e = ENGINE_get_next(e)) {
-            if (!sk_OPENSSL_CSTRING_push(engines, ENGINE_get_id(e)))
-                goto end;
-        }
-    }
-
-    ret = 0;
-    for (i = 0; i < sk_OPENSSL_CSTRING_num(engines); i++) {
-        const char *id = sk_OPENSSL_CSTRING_value(engines, i);
-        if ((e = ENGINE_by_id(id)) != NULL) {
-            const char *name = ENGINE_get_name(e);
-            /*
-             * Do "id" first, then "name". Easier to auto-parse.
-             */
-            BIO_printf(out, "(%s) %s\n", id, name);
-            util_do_cmds(e, pre_cmds, out, indent);
-            if (strcmp(ENGINE_get_id(e), id) != 0) {
-                BIO_printf(out, "Loaded: (%s) %s\n",
-                           ENGINE_get_id(e), ENGINE_get_name(e));
-            }
-            if (list_cap) {
-                int cap_size = 256;
-                char *cap_buf = NULL;
-                int k, n;
-                const int *nids;
-                ENGINE_CIPHERS_PTR fn_c;
-                ENGINE_DIGESTS_PTR fn_d;
-                ENGINE_PKEY_METHS_PTR fn_pk;
-
-                if (ENGINE_get_RSA(e) != NULL
-                    && !append_buf(&cap_buf, &cap_size, "RSA"))
-                    goto end;
-                if (ENGINE_get_EC(e) != NULL
-                    && !append_buf(&cap_buf, &cap_size, "EC"))
-                    goto end;
-                if (ENGINE_get_DSA(e) != NULL
-                    && !append_buf(&cap_buf, &cap_size, "DSA"))
-                    goto end;
-                if (ENGINE_get_DH(e) != NULL
-                    && !append_buf(&cap_buf, &cap_size, "DH"))
-                    goto end;
-                if (ENGINE_get_RAND(e) != NULL
-                    && !append_buf(&cap_buf, &cap_size, "RAND"))
-                    goto end;
-
-                fn_c = ENGINE_get_ciphers(e);
-                if (fn_c == NULL)
-                    goto skip_ciphers;
-                n = fn_c(e, NULL, &nids, 0);
-                for (k = 0; k < n; ++k)
-                    if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k])))
-                        goto end;
-
- skip_ciphers:
-                fn_d = ENGINE_get_digests(e);
-                if (fn_d == NULL)
-                    goto skip_digests;
-                n = fn_d(e, NULL, &nids, 0);
-                for (k = 0; k < n; ++k)
-                    if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k])))
-                        goto end;
-
- skip_digests:
-                fn_pk = ENGINE_get_pkey_meths(e);
-                if (fn_pk == NULL)
-                    goto skip_pmeths;
-                n = fn_pk(e, NULL, &nids, 0);
-                for (k = 0; k < n; ++k)
-                    if (!append_buf(&cap_buf, &cap_size, OBJ_nid2sn(nids[k])))
-                        goto end;
- skip_pmeths:
-                {
-                    struct util_store_cap_data store_ctx;
-
-                    store_ctx.engine = e;
-                    store_ctx.cap_buf = &cap_buf;
-                    store_ctx.cap_size = &cap_size;
-                    store_ctx.ok = 1;
-
-                    OSSL_STORE_do_all_loaders(util_store_cap, &store_ctx);
-                    if (!store_ctx.ok)
-                        goto end;
-                }
-                if (cap_buf != NULL && (*cap_buf != '\0'))
-                    BIO_printf(out, " [%s]\n", cap_buf);
-
-                OPENSSL_free(cap_buf);
-            }
-            if (test_avail) {
-                BIO_printf(out, "%s", indent);
-                if (ENGINE_init(e)) {
-                    BIO_printf(out, "[ available ]\n");
-                    util_do_cmds(e, post_cmds, out, indent);
-                    ENGINE_finish(e);
-                } else {
-                    BIO_printf(out, "[ unavailable ]\n");
-                    if (test_avail_noise)
-                        ERR_print_errors_fp(stdout);
-                    ERR_clear_error();
-                }
-            }
-            if ((verbose > 0) && !util_verbose(e, verbose, out, indent))
-                goto end;
-            ENGINE_free(e);
-        } else {
-            ERR_print_errors(bio_err);
-            /* because exit codes above 127 have special meaning on Unix */
-            if (++ret > 127)
-                ret = 127;
-        }
-    }
-
- end:
-
-    ERR_print_errors(bio_err);
-    sk_OPENSSL_CSTRING_free(engines);
-    sk_OPENSSL_STRING_free(pre_cmds);
-    sk_OPENSSL_STRING_free(post_cmds);
-    BIO_free_all(out);
-    return ret;
-}

apps/gendsa.c

@@ -24,7 +24,7 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_OUT, OPT_PASSOUT, OPT_ENGINE, OPT_CIPHER, OPT_VERBOSE, OPT_QUIET,
+    OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_VERBOSE, OPT_QUIET,
     OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
@@ -33,9 +33,6 @@ const OPTIONS gendsa_options[] = {
 
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Output"),
     {"out", OPT_OUT, '>', "Output the key to the specified file"},
@@ -53,7 +50,6 @@ const OPTIONS gendsa_options[] = {
 
 int gendsa_main(int argc, char **argv)
 {
-    ENGINE *e = NULL;
     BIO *out = NULL, *in = NULL;
     EVP_PKEY *pkey = NULL;
     EVP_PKEY_CTX *ctx = NULL;
@@ -82,9 +78,6 @@ int gendsa_main(int argc, char **argv)
         case OPT_PASSOUT:
             passoutarg = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_R_CASES:
             if (!opt_rand(o))
                 goto end;
@@ -166,7 +159,6 @@ int gendsa_main(int argc, char **argv)
     EVP_PKEY_free(pkey);
     EVP_PKEY_CTX_free(ctx);
     EVP_CIPHER_free(enc);
-    release_engine(e);
     OPENSSL_free(passout);
     return ret;
 }

apps/genpkey.c

@@ -17,11 +17,11 @@
 
 static int verbose = 0;
 
-static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e,
+static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file,
                             OSSL_LIB_CTX *libctx, const char *propq);
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_OUTFORM, OPT_OUT, OPT_PASS, OPT_PARAMFILE,
+    OPT_OUTFORM, OPT_OUT, OPT_PASS, OPT_PARAMFILE,
     OPT_ALGORITHM, OPT_PKEYOPT, OPT_GENPARAM, OPT_TEXT, OPT_CIPHER,
     OPT_VERBOSE, OPT_QUIET, OPT_CONFIG, OPT_OUTPUBKEY,
     OPT_PROV_ENUM, OPT_R_ENUM
@@ -30,9 +30,6 @@ typedef enum OPTION_choice {
 const OPTIONS genpkey_options[] = {
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
     {"paramfile", OPT_PARAMFILE, '<', "Parameters file"},
     {"algorithm", OPT_ALGORITHM, 's', "The public key algorithm"},
     {"verbose", OPT_VERBOSE, '-', "Output status while generating keys"},
@@ -107,7 +104,6 @@ int genpkey_main(int argc, char **argv)
 {
     CONF *conf = NULL;
     BIO *mem_out = NULL, *mem_outpubkey = NULL;
-    ENGINE *e = NULL;
     EVP_PKEY *pkey = NULL;
     EVP_PKEY_CTX *ctx = NULL;
     char *outfile = NULL, *passarg = NULL, *pass = NULL, *prog, *p;
@@ -150,9 +146,6 @@ int genpkey_main(int argc, char **argv)
         case OPT_PASS:
             passarg = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_PARAMFILE:
             if (do_param == 1)
                 goto opthelp;
@@ -205,11 +198,11 @@ int genpkey_main(int argc, char **argv)
 
     /* Fetch cipher, etc. */
     if (paramfile != NULL) {
-        if (!init_keygen_file(&ctx, paramfile, e, libctx, app_get0_propq()))
+        if (!init_keygen_file(&ctx, paramfile, libctx, app_get0_propq()))
             goto end;
     }
     if (algname != NULL) {
-        if (!init_gen_str(&ctx, algname, e, do_param, libctx, app_get0_propq()))
+        if (!init_gen_str(&ctx, algname, do_param, libctx, app_get0_propq()))
             goto end;
     }
     if (ctx == NULL)
@@ -317,13 +310,12 @@ int genpkey_main(int argc, char **argv)
     EVP_CIPHER_free(cipher);
     BIO_free_all(mem_out);
     BIO_free_all(mem_outpubkey);
-    release_engine(e);
     OPENSSL_free(pass);
     NCONF_free(conf);
     return ret;
 }
 
-static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e,
+static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file,
                             OSSL_LIB_CTX *libctx, const char *propq)
 {
     BIO *pbio;
@@ -348,10 +340,7 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e,
         return 0;
     }
 
-    if (e != NULL)
-        ctx = EVP_PKEY_CTX_new(pkey, e);
-    else
-        ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq);
+    ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq);
     if (ctx == NULL)
         goto err;
     if (EVP_PKEY_keygen_init(ctx) <= 0)
@@ -370,26 +359,17 @@ static int init_keygen_file(EVP_PKEY_CTX **pctx, const char *file, ENGINE *e,
 }
 
 int init_gen_str(EVP_PKEY_CTX **pctx,
-                 const char *algname, ENGINE *e, int do_param,
+                 const char *algname, int do_param,
                  OSSL_LIB_CTX *libctx, const char *propq)
 {
     EVP_PKEY_CTX *ctx = NULL;
-#ifndef OPENSSL_NO_DEPRECATED_3_6
-    int pkey_id;
-#endif
 
     if (*pctx) {
         BIO_puts(bio_err, "Algorithm already set!\n");
         return 0;
     }
 
-#ifndef OPENSSL_NO_DEPRECATED_3_6
-    pkey_id = get_legacy_pkey_id(libctx, algname, e);
-    if (pkey_id != NID_undef)
-        ctx = EVP_PKEY_CTX_new_id(pkey_id, e);
-    else
-#endif
-        ctx = EVP_PKEY_CTX_new_from_name(libctx, algname, propq);
+    ctx = EVP_PKEY_CTX_new_from_name(libctx, algname, propq);
 
     if (ctx == NULL)
         goto err;

apps/genrsa.c

@@ -34,7 +34,7 @@ typedef enum OPTION_choice {
 #ifndef OPENSSL_NO_DEPRECATED_3_0
     OPT_3,
 #endif
-    OPT_F4, OPT_ENGINE,
+    OPT_F4,
     OPT_OUT, OPT_PASSOUT, OPT_CIPHER, OPT_PRIMES, OPT_VERBOSE, OPT_QUIET,
     OPT_R_ENUM, OPT_PROV_ENUM, OPT_TRADITIONAL
 } OPTION_CHOICE;
@@ -44,9 +44,6 @@ const OPTIONS genrsa_options[] = {
 
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Input"),
 #ifndef OPENSSL_NO_DEPRECATED_3_0
@@ -76,7 +73,6 @@ const OPTIONS genrsa_options[] = {
 int genrsa_main(int argc, char **argv)
 {
     BN_GENCB *cb = BN_GENCB_new();
-    ENGINE *eng = NULL;
     BIGNUM *bn = BN_new();
     BIO *out = NULL;
     EVP_PKEY *pkey = NULL;
@@ -116,9 +112,6 @@ opthelp:
         case OPT_OUT:
             outfile = opt_arg();
             break;
-        case OPT_ENGINE:
-            eng = setup_engine(opt_arg(), 0);
-            break;
         case OPT_R_CASES:
             if (!opt_rand(o))
                 goto end;
@@ -179,7 +172,7 @@ opthelp:
     if (out == NULL)
         goto end;
 
-    if (!init_gen_str(&ctx, "RSA", eng, 0, app_get0_libctx(),
+    if (!init_gen_str(&ctx, "RSA", 0, app_get0_libctx(),
                       app_get0_propq()))
         goto end;
 
@@ -242,7 +235,6 @@ opthelp:
     EVP_PKEY_free(pkey);
     EVP_CIPHER_free(enc);
     BIO_free_all(out);
-    release_engine(eng);
     OPENSSL_free(passout);
     if (ret != 0)
         ERR_print_errors(bio_err);

apps/include/apps.h

@@ -27,7 +27,6 @@
 # include <openssl/x509.h>
 # include <openssl/conf.h>
 # include <openssl/txt_db.h>
-# include <openssl/engine.h>
 # include <openssl/ocsp.h>
 # include <openssl/http.h>
 # include <signal.h>
@@ -35,7 +34,6 @@
 # include "opt.h"
 # include "fmt.h"
 # include "platform.h"
-# include "engine_loader.h"
 # include "app_libctx.h"
 
 /*
@@ -129,10 +127,10 @@ X509_CRL *load_crl(const char *uri, int format, int maybe_stdin,
 void cleanse(char *str);
 void clear_free(char *str);
 EVP_PKEY *load_key(const char *uri, int format, int maybe_stdin,
-                   const char *pass, ENGINE *e, const char *desc);
+                   const char *pass, const char *desc);
 /* first try reading public key, on failure resort to loading private key */
 EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin,
-                      const char *pass, ENGINE *e, const char *desc);
+                      const char *pass, const char *desc);
 EVP_PKEY *load_keyparams(const char *uri, int format, int maybe_stdin,
                          const char *keytype, const char *desc);
 EVP_PKEY *load_keyparams_suppress(const char *uri, int format, int maybe_stdin,
@@ -178,19 +176,6 @@ __owur int ctx_set_ctlog_list_file(SSL_CTX *ctx, const char *path);
 
 # endif
 
-ENGINE *setup_engine_methods(const char *id, unsigned int methods, int debug);
-# define setup_engine(e, debug) setup_engine_methods(e, (unsigned int)-1, debug)
-void release_engine(ENGINE *e);
-int init_engine(ENGINE *e);
-int finish_engine(ENGINE *e);
-char *make_engine_uri(ENGINE *e, const char *key_id, const char *desc);
-
-# ifndef OPENSSL_NO_DEPRECATED_3_6
-int get_legacy_pkey_id(OSSL_LIB_CTX *libctx, const char *algname, ENGINE *e);
-# endif
-const EVP_MD *get_digest_from_engine(const char *name);
-const EVP_CIPHER *get_cipher_from_engine(const char *name);
-
 # ifndef OPENSSL_NO_OCSP
 OCSP_RESPONSE *process_responder(OCSP_REQUEST *req, const char *host,
                                  const char *port, const char *path,
@@ -281,7 +266,7 @@ int pkey_ctrl_string(EVP_PKEY_CTX *ctx, const char *value);
 int x509_ctrl_string(X509 *x, const char *value);
 int x509_req_ctrl_string(X509_REQ *x, const char *value);
 int init_gen_str(EVP_PKEY_CTX **pctx,
-                 const char *algname, ENGINE *e, int do_param,
+                 const char *algname, int do_param,
                  OSSL_LIB_CTX *libctx, const char *propq);
 int cert_matches_key(const X509 *cert, const EVP_PKEY *pkey);
 int do_X509_sign(X509 *x, int force_v1, EVP_PKEY *pkey, const char *md,

apps/include/engine_loader.h

@@ -1,21 +0,0 @@
-/*
- * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-#ifndef HEADER_ENGINE_LOADER_H
-# define HEADER_ENGINE_LOADER_H
-
-# include <openssl/store.h>
-
-/* this is a private URI scheme */
-# define ENGINE_SCHEME          "org.openssl.engine"
-# define ENGINE_SCHEME_COLON    ENGINE_SCHEME ":"
-
-int setup_engine_loader(void);
-void destroy_engine_loader(void);
-
-#endif

apps/include/fmt.h

@@ -32,7 +32,6 @@
 # define FORMAT_PEM     (5 | B_FORMAT_TEXT)
 # define FORMAT_PKCS12   6
 # define FORMAT_SMIME   (7 | B_FORMAT_TEXT)
-# define FORMAT_ENGINE   8                      /* Not really a file format */
 # define FORMAT_PEMRSA  (9 | B_FORMAT_TEXT)     /* PEM RSAPublicKey format */
 # define FORMAT_ASN1RSA  10                     /* DER RSAPublicKey format */
 # define FORMAT_MSBLOB   11                     /* MS Key blob format */

apps/include/opt.h

@@ -343,7 +343,6 @@ typedef struct options_st {
      *   'f' any format                    [OPT_FMT_ANY]
      *   'F' der/pem format                [OPT_FMT_PEMDER]
      *   'A' any ASN1, der/pem/b64 format  [OPT_FMT_ASN1]
-     *   'E' der/pem/engine format         [OPT_FMT_PDE]
      *   'c' pem/der/smime format          [OPT_FMT_PDS]
      *
      * The 'l', 'n' and 'u' value types include the values zero,
@@ -372,7 +371,6 @@ typedef struct string_int_pair_st {
 # define OPT_FMT_B64             (1L <<  3)
 # define OPT_FMT_PKCS12          (1L <<  4)
 # define OPT_FMT_SMIME           (1L <<  5)
-# define OPT_FMT_ENGINE          (1L <<  6)
 # define OPT_FMT_MSBLOB          (1L <<  7)
 # define OPT_FMT_NSS             (1L <<  8)
 # define OPT_FMT_TEXT            (1L <<  9)
@@ -381,13 +379,11 @@ typedef struct string_int_pair_st {
 
 # define OPT_FMT_PEMDER  (OPT_FMT_PEM | OPT_FMT_DER)
 # define OPT_FMT_ASN1    (OPT_FMT_PEM | OPT_FMT_DER | OPT_FMT_B64)
-# define OPT_FMT_PDE     (OPT_FMT_PEMDER | OPT_FMT_ENGINE)
 # define OPT_FMT_PDS     (OPT_FMT_PEMDER | OPT_FMT_SMIME)
-# define OPT_FMT_ANY     ( \
-        OPT_FMT_PEM | OPT_FMT_DER | OPT_FMT_B64 | \
-        OPT_FMT_PKCS12 | OPT_FMT_SMIME |                     \
-        OPT_FMT_ENGINE | OPT_FMT_MSBLOB | OPT_FMT_NSS | \
-        OPT_FMT_TEXT | OPT_FMT_HTTP | OPT_FMT_PVK)
+# define OPT_FMT_ANY     (OPT_FMT_PEM | OPT_FMT_DER | OPT_FMT_B64 | \
+                          OPT_FMT_PKCS12 | OPT_FMT_SMIME | \
+                          OPT_FMT_MSBLOB | OPT_FMT_NSS | \
+                          OPT_FMT_TEXT | OPT_FMT_HTTP | OPT_FMT_PVK)
 
 /* Divide options into sections when displaying usage */
 #define OPT_SECTION(sec) { OPT_SECTION_STR, 1, '-', sec " options:\n" }
@@ -437,8 +433,5 @@ char **opt_rest(void);
 int opt_num_rest(void);
 int opt_check_rest_arg(const char *expected);
 
-/* Returns non-zero if legacy paths are still available */
-int opt_legacy_okay(void);
-
 
 #endif /* OSSL_APPS_OPT_H */

apps/info.c

@@ -13,7 +13,7 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_CONFIGDIR, OPT_ENGINESDIR, OPT_MODULESDIR, OPT_DSOEXT, OPT_DIRNAMESEP,
+    OPT_CONFIGDIR, OPT_MODULESDIR, OPT_DSOEXT, OPT_DIRNAMESEP,
     OPT_LISTSEP, OPT_SEEDS, OPT_CPUSETTINGS, OPT_WINDOWSCONTEXT
 } OPTION_CHOICE;
 
@@ -24,7 +24,6 @@ const OPTIONS info_options[] = {
 
     OPT_SECTION("Output"),
     {"configdir", OPT_CONFIGDIR, '-', "Default configuration file directory"},
-    {"enginesdir", OPT_ENGINESDIR, '-', "Default engine module directory"},
     {"modulesdir", OPT_MODULESDIR, '-',
      "Default module directory (other than engine modules)"},
     {"dsoext", OPT_DSOEXT, '-', "Configured extension for modules"},
@@ -58,10 +57,6 @@ opthelp:
             type = OPENSSL_INFO_CONFIG_DIR;
             dirty++;
             break;
-        case OPT_ENGINESDIR:
-            type = OPENSSL_INFO_ENGINES_DIR;
-            dirty++;
-            break;
         case OPT_MODULESDIR:
             type = OPENSSL_INFO_MODULES_DIR;
             dirty++;

apps/lib/apps.c

@@ -15,12 +15,6 @@
 # define _POSIX_C_SOURCE 2
 #endif
 
-#ifndef OPENSSL_NO_ENGINE
-/* We need to use some deprecated APIs */
-# define OPENSSL_SUPPRESS_DEPRECATED
-# include <openssl/engine.h>
-#endif
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -558,41 +552,33 @@ void clear_free(char *str)
 }
 
 EVP_PKEY *load_key(const char *uri, int format, int may_stdin,
-                   const char *pass, ENGINE *e, const char *desc)
+                   const char *pass, const char *desc)
 {
     EVP_PKEY *pkey = NULL;
-    char *allocated_uri = NULL;
 
     if (desc == NULL)
         desc = "private key";
 
-    if (format == FORMAT_ENGINE)
-        uri = allocated_uri = make_engine_uri(e, uri, desc);
     (void)load_key_certs_crls(uri, format, may_stdin, pass, desc, 0,
                               &pkey, NULL, NULL, NULL, NULL, NULL, NULL);
 
-    OPENSSL_free(allocated_uri);
     return pkey;
 }
 
 /* first try reading public key, on failure resort to loading private key */
 EVP_PKEY *load_pubkey(const char *uri, int format, int maybe_stdin,
-                      const char *pass, ENGINE *e, const char *desc)
+                      const char *pass, const char *desc)
 {
     EVP_PKEY *pkey = NULL;
-    char *allocated_uri = NULL;
 
     if (desc == NULL)
         desc = "public key";
 
-    if (format == FORMAT_ENGINE)
-        uri = allocated_uri = make_engine_uri(e, uri, desc);
     (void)load_key_certs_crls(uri, format, maybe_stdin, pass, desc, 1,
                               NULL, &pkey, NULL, NULL, NULL, NULL, NULL);
     if (pkey == NULL)
         (void)load_key_certs_crls(uri, format, maybe_stdin, pass, desc, 0,
                                   &pkey, NULL, NULL, NULL, NULL, NULL, NULL);
-    OPENSSL_free(allocated_uri);
     return pkey;
 }
 
@@ -3509,25 +3495,6 @@ EVP_PKEY *app_paramgen(EVP_PKEY_CTX *ctx, const char *alg)
     return res;
 }
 
-/*
- * Return non-zero if the legacy path is still an option.
- * This decision is based on the global command line operations and the
- * behaviour thus far.
- */
-int opt_legacy_okay(void)
-{
-    int provider_options = opt_provider_option_given();
-    int libctx = app_get0_libctx() != NULL || app_get0_propq() != NULL;
-
-    /*
-     * Having a provider option specified or a custom library context or
-     * property query, is a sure sign we're not using legacy.
-     */
-    if (provider_options || libctx)
-        return 0;
-    return 1;
-}
-
 #define MAX_KEY_SIZE 2048 /* Hope nobody needs mac key longer than 2048 bytes */
 
 /*

apps/lib/build.info

@@ -10,7 +10,7 @@ ENDIF
 # Source for libapps
 $LIBAPPSSRC=apps.c apps_ui.c log.c opt.c fmt.c s_cb.c s_socket.c app_rand.c \
         columns.c app_params.c names.c app_provider.c app_x509.c http_server.c \
-        engine.c engine_loader.c app_libctx.c apps_opt_printf.c
+        app_libctx.c apps_opt_printf.c
 
 IF[{- !$disabled{apps} -}]
   LIBS{noinst}=../libapps.a

apps/lib/engine.c

@@ -1,195 +0,0 @@
-/*
- * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/*
- * Here is a set of wrappers for the ENGINE API, which are no-ops when the
- * ENGINE API is disabled / removed.
- * We need to suppress deprecation warnings to make this work.
- */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
-#include <string.h> /* strcmp */
-
-#include <openssl/types.h> /* Ensure we have the ENGINE type, regardless */
-#include <openssl/err.h>
-#ifndef OPENSSL_NO_ENGINE
-# include <openssl/engine.h>
-#endif
-#include "apps.h"
-
-#ifndef OPENSSL_NO_ENGINE
-/* Try to load an engine in a shareable library */
-static ENGINE *try_load_engine(const char *engine)
-{
-    ENGINE *e = NULL;
-
-    if ((e = ENGINE_by_id("dynamic")) != NULL) {
-        if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", engine, 0)
-            || !ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0)) {
-            ENGINE_free(e);
-            e = NULL;
-        }
-    }
-    return e;
-}
-#endif
-
-ENGINE *setup_engine_methods(const char *id, unsigned int methods, int debug)
-{
-    ENGINE *e = NULL;
-
-#ifndef OPENSSL_NO_ENGINE
-    if (id != NULL) {
-        if (strcmp(id, "auto") == 0) {
-            BIO_printf(bio_err, "Enabling auto ENGINE support\n");
-            ENGINE_register_all_complete();
-            return NULL;
-        }
-        if ((e = ENGINE_by_id(id)) == NULL
-            && (e = try_load_engine(id)) == NULL) {
-            BIO_printf(bio_err, "Invalid engine \"%s\"\n", id);
-            ERR_print_errors(bio_err);
-            return NULL;
-        }
-        if (debug)
-            (void)ENGINE_ctrl(e, ENGINE_CTRL_SET_LOGSTREAM, 0, bio_err, 0);
-        if (!ENGINE_ctrl_cmd(e, "SET_USER_INTERFACE", 0,
-                             (void *)get_ui_method(), 0, 1)
-                || !ENGINE_set_default(e, methods)) {
-            BIO_printf(bio_err, "Cannot use engine \"%s\"\n", ENGINE_get_id(e));
-            ERR_print_errors(bio_err);
-            ENGINE_free(e);
-            return NULL;
-        }
-
-        BIO_printf(bio_err, "Engine \"%s\" set.\n", ENGINE_get_id(e));
-    }
-#endif
-    return e;
-}
-
-void release_engine(ENGINE *e)
-{
-#ifndef OPENSSL_NO_ENGINE
-    /* Free our "structural" reference. */
-    ENGINE_free(e);
-#endif
-}
-
-int init_engine(ENGINE *e)
-{
-    int rv = 1;
-
-#ifndef OPENSSL_NO_ENGINE
-    rv = ENGINE_init(e);
-#endif
-    return rv;
-}
-
-int finish_engine(ENGINE *e)
-{
-    int rv = 1;
-
-#ifndef OPENSSL_NO_ENGINE
-    rv = ENGINE_finish(e);
-#endif
-    return rv;
-}
-
-char *make_engine_uri(ENGINE *e, const char *key_id, const char *desc)
-{
-    char *new_uri = NULL;
-
-#ifndef OPENSSL_NO_ENGINE
-    if (e == NULL) {
-        BIO_printf(bio_err, "No engine specified for loading %s\n", desc);
-    } else if (key_id == NULL) {
-        BIO_printf(bio_err, "No engine key id specified for loading %s\n", desc);
-    } else {
-        const char *engineid = ENGINE_get_id(e);
-        size_t uri_sz =
-            sizeof(ENGINE_SCHEME_COLON) - 1
-            + strlen(engineid)
-            + 1 /* : */
-            + strlen(key_id)
-            + 1 /* \0 */
-            ;
-
-        new_uri = OPENSSL_malloc(uri_sz);
-        if (new_uri != NULL) {
-            OPENSSL_strlcpy(new_uri, ENGINE_SCHEME_COLON, uri_sz);
-            OPENSSL_strlcat(new_uri, engineid, uri_sz);
-            OPENSSL_strlcat(new_uri, ":", uri_sz);
-            OPENSSL_strlcat(new_uri, key_id, uri_sz);
-        }
-    }
-#else
-    BIO_printf(bio_err, "Engines not supported for loading %s\n", desc);
-#endif
-    return new_uri;
-}
-
-#ifndef OPENSSL_NO_DEPRECATED_3_6
-int get_legacy_pkey_id(OSSL_LIB_CTX *libctx, const char *algname, ENGINE *e)
-{
-    const EVP_PKEY_ASN1_METHOD *ameth;
-    ENGINE *tmpeng = NULL;
-    int pkey_id = NID_undef;
-
-    ERR_set_mark();
-    ameth = EVP_PKEY_asn1_find_str(&tmpeng, algname, -1);
-
-#if !defined(OPENSSL_NO_ENGINE)
-    ENGINE_finish(tmpeng);
-
-    if (ameth == NULL && e != NULL)
-        ameth = ENGINE_get_pkey_asn1_meth_str(e, algname, -1);
-    else
-#endif
-    /* We're only interested if it comes from an ENGINE */
-    if (tmpeng == NULL)
-        ameth = NULL;
-
-    ERR_pop_to_mark();
-    if (ameth == NULL)
-        return NID_undef;
-
-    EVP_PKEY_asn1_get0_info(&pkey_id, NULL, NULL, NULL, NULL, ameth);
-
-    return pkey_id;
-}
-#endif
-
-const EVP_MD *get_digest_from_engine(const char *name)
-{
-#ifndef OPENSSL_NO_ENGINE
-    ENGINE *eng;
-
-    eng = ENGINE_get_digest_engine(OBJ_sn2nid(name));
-    if (eng != NULL) {
-        ENGINE_finish(eng);
-        return EVP_get_digestbyname(name);
-    }
-#endif
-    return NULL;
-}
-
-const EVP_CIPHER *get_cipher_from_engine(const char *name)
-{
-#ifndef OPENSSL_NO_ENGINE
-    ENGINE *eng;
-
-    eng = ENGINE_get_cipher_engine(OBJ_sn2nid(name));
-    if (eng != NULL) {
-        ENGINE_finish(eng);
-        return EVP_get_cipherbyname(name);
-    }
-#endif
-    return NULL;
-}

apps/lib/engine_loader.c

@@ -1,202 +0,0 @@
-/*
- * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/*
- * Here is an STORE loader for ENGINE backed keys.  It relies on deprecated
- * functions, and therefore need to have deprecation warnings suppressed.
- * This file is not compiled at all in a '--api=3 no-deprecated' configuration.
- */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
-#include "internal/e_os.h"
-#include "apps.h"
-
-#ifndef OPENSSL_NO_ENGINE
-
-# include <stdarg.h>
-# include <string.h>
-# include <openssl/engine.h>
-# include <openssl/store.h>
-
-/*
- * Support for legacy private engine keys via the 'org.openssl.engine:' scheme
- *
- * org.openssl.engine:{engineid}:{keyid}
- *
- * Note: we ONLY support ENGINE_load_private_key() and ENGINE_load_public_key()
- * Note 2: This scheme has a precedent in code in PKIX-SSH. for exactly
- * this sort of purpose.
- */
-
-/* Local definition of OSSL_STORE_LOADER_CTX */
-struct ossl_store_loader_ctx_st {
-    ENGINE *e;                   /* Structural reference */
-    char *keyid;
-    int expected;
-    int loaded;                  /* 0 = key not loaded yet, 1 = key loaded */
-};
-
-static OSSL_STORE_LOADER_CTX *OSSL_STORE_LOADER_CTX_new(ENGINE *e, char *keyid)
-{
-    OSSL_STORE_LOADER_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
-
-    if (ctx != NULL) {
-        ctx->e = e;
-        ctx->keyid = keyid;
-    }
-    return ctx;
-}
-
-static void OSSL_STORE_LOADER_CTX_free(OSSL_STORE_LOADER_CTX *ctx)
-{
-    if (ctx != NULL) {
-        ENGINE_free(ctx->e);
-        OPENSSL_free(ctx->keyid);
-        OPENSSL_free(ctx);
-    }
-}
-
-static OSSL_STORE_LOADER_CTX *engine_open(const OSSL_STORE_LOADER *loader,
-                                          const char *uri,
-                                          const UI_METHOD *ui_method,
-                                          void *ui_data)
-{
-    const char *p = uri, *q;
-    ENGINE *e = NULL;
-    char *keyid = NULL;
-    OSSL_STORE_LOADER_CTX *ctx = NULL;
-
-    if (!CHECK_AND_SKIP_CASE_PREFIX(p, ENGINE_SCHEME_COLON))
-        return NULL;
-
-    /* Look for engine ID */
-    q = strchr(p, ':');
-    if (q != NULL                /* There is both an engine ID and a key ID */
-        && p[0] != ':'           /* The engine ID is at least one character */
-        && q[1] != '\0') {       /* The key ID is at least one character */
-        char engineid[256];
-        size_t engineid_l = q - p;
-
-        strncpy(engineid, p, engineid_l);
-        engineid[engineid_l] = '\0';
-        e = ENGINE_by_id(engineid);
-
-        keyid = OPENSSL_strdup(q + 1);
-    }
-
-    if (e != NULL && keyid != NULL)
-        ctx = OSSL_STORE_LOADER_CTX_new(e, keyid);
-
-    if (ctx == NULL) {
-        OPENSSL_free(keyid);
-        ENGINE_free(e);
-    }
-
-    return ctx;
-}
-
-static int engine_expect(OSSL_STORE_LOADER_CTX *ctx, int expected)
-{
-    if (expected == 0
-        || expected == OSSL_STORE_INFO_PUBKEY
-        || expected == OSSL_STORE_INFO_PKEY) {
-        ctx->expected = expected;
-        return 1;
-    }
-    return 0;
-}
-
-static OSSL_STORE_INFO *engine_load(OSSL_STORE_LOADER_CTX *ctx,
-                                    const UI_METHOD *ui_method, void *ui_data)
-{
-    EVP_PKEY *pkey = NULL, *pubkey = NULL;
-    OSSL_STORE_INFO *info = NULL;
-
-    if (ctx->loaded == 0) {
-        if (ENGINE_init(ctx->e)) {
-            if (ctx->expected == 0
-                || ctx->expected == OSSL_STORE_INFO_PKEY)
-                pkey =
-                    ENGINE_load_private_key(ctx->e, ctx->keyid,
-                                            (UI_METHOD *)ui_method, ui_data);
-            if ((pkey == NULL && ctx->expected == 0)
-                || ctx->expected == OSSL_STORE_INFO_PUBKEY)
-                pubkey =
-                    ENGINE_load_public_key(ctx->e, ctx->keyid,
-                                           (UI_METHOD *)ui_method, ui_data);
-            ENGINE_finish(ctx->e);
-        }
-    }
-
-    ctx->loaded = 1;
-
-    if (pubkey != NULL)
-        info = OSSL_STORE_INFO_new_PUBKEY(pubkey);
-    else if (pkey != NULL)
-        info = OSSL_STORE_INFO_new_PKEY(pkey);
-    if (info == NULL) {
-        EVP_PKEY_free(pkey);
-        EVP_PKEY_free(pubkey);
-    }
-    return info;
-}
-
-static int engine_eof(OSSL_STORE_LOADER_CTX *ctx)
-{
-    return ctx->loaded != 0;
-}
-
-static int engine_error(OSSL_STORE_LOADER_CTX *ctx)
-{
-    return 0;
-}
-
-static int engine_close(OSSL_STORE_LOADER_CTX *ctx)
-{
-    OSSL_STORE_LOADER_CTX_free(ctx);
-    return 1;
-}
-
-int setup_engine_loader(void)
-{
-    OSSL_STORE_LOADER *loader = NULL;
-
-    if ((loader = OSSL_STORE_LOADER_new(NULL, ENGINE_SCHEME)) == NULL
-        || !OSSL_STORE_LOADER_set_open(loader, engine_open)
-        || !OSSL_STORE_LOADER_set_expect(loader, engine_expect)
-        || !OSSL_STORE_LOADER_set_load(loader, engine_load)
-        || !OSSL_STORE_LOADER_set_eof(loader, engine_eof)
-        || !OSSL_STORE_LOADER_set_error(loader, engine_error)
-        || !OSSL_STORE_LOADER_set_close(loader, engine_close)
-        || !OSSL_STORE_register_loader(loader)) {
-        OSSL_STORE_LOADER_free(loader);
-        loader = NULL;
-    }
-
-    return loader != NULL;
-}
-
-void destroy_engine_loader(void)
-{
-    OSSL_STORE_LOADER *loader = OSSL_STORE_unregister_loader(ENGINE_SCHEME);
-    OSSL_STORE_LOADER_free(loader);
-}
-
-#else  /* !OPENSSL_NO_ENGINE */
-
-int setup_engine_loader(void)
-{
-    return 0;
-}
-
-void destroy_engine_loader(void)
-{
-}
-
-#endif

apps/lib/opt.c

@@ -192,7 +192,7 @@ char *opt_init(int ac, char **av, const OPTIONS *o)
             OPENSSL_assert(o->retval == OPT_DUP || o->retval > OPT_PARAM);
         switch (i) {
         case   0: case '-': case '.':
-        case '/': case '<': case '>': case 'E': case 'F':
+        case '/': case '<': case '>': case 'F':
         case 'M': case 'U': case 'f': case 'l': case 'n': case 'p': case 's':
         case 'u': case 'c': case ':': case 'N': case 'A':
             break;
@@ -230,7 +230,6 @@ static OPT_PAIR formats[] = {
     {"b64", OPT_FMT_B64},
     {"pkcs12", OPT_FMT_PKCS12},
     {"smime", OPT_FMT_SMIME},
-    {"engine", OPT_FMT_ENGINE},
     {"msblob", OPT_FMT_MSBLOB},
     {"nss", OPT_FMT_NSS},
     {"text", OPT_FMT_TEXT},
@@ -309,12 +308,6 @@ int opt_format(const char *s, unsigned long flags, int *result)
             return opt_format_error(s, flags);
         *result = FORMAT_MSBLOB;
         break;
-    case 'E':
-    case 'e':
-        if ((flags & OPT_FMT_ENGINE) == 0)
-            return opt_format_error(s, flags);
-        *result = FORMAT_ENGINE;
-        break;
     case 'H':
     case 'h':
         if ((flags & OPT_FMT_HTTP) == 0)
@@ -368,8 +361,6 @@ static const char *format2str(int format)
         return "SMIME";
     case FORMAT_MSBLOB:
         return "MSBLOB";
-    case FORMAT_ENGINE:
-        return "ENGINE";
     case FORMAT_HTTP:
         return "HTTP";
     case FORMAT_PKCS12:
@@ -395,9 +386,7 @@ int opt_cipher_silent(const char *name, EVP_CIPHER **cipherp)
 
     ERR_set_mark();
     if ((c = EVP_CIPHER_fetch(app_get0_libctx(), name,
-                              app_get0_propq())) != NULL
-        || (opt_legacy_okay()
-            && (c = (EVP_CIPHER *)EVP_get_cipherbyname(name)) != NULL)) {
+                              app_get0_propq())) != NULL) {
         ERR_pop_to_mark();
         if (cipherp != NULL) {
             EVP_CIPHER_free(*cipherp);
@@ -456,9 +445,7 @@ int opt_md_silent(const char *name, EVP_MD **mdp)
     EVP_MD *md;
 
     ERR_set_mark();
-    if ((md = EVP_MD_fetch(app_get0_libctx(), name, app_get0_propq())) != NULL
-        || (opt_legacy_okay()
-            && (md = (EVP_MD *)EVP_get_digestbyname(name)) != NULL)) {
+    if ((md = EVP_MD_fetch(app_get0_libctx(), name, app_get0_propq())) != NULL) {
         ERR_pop_to_mark();
         if (mdp != NULL) {
             EVP_MD_free(*mdp);
@@ -990,14 +977,12 @@ int opt_next(void)
                 return -1;
             break;
         case 'c':
-        case 'E':
         case 'F':
         case 'f':
         case 'A':
         case 'a':
             if (opt_format(arg,
                            o->valtype == 'c' ? OPT_FMT_PDS :
-                           o->valtype == 'E' ? OPT_FMT_PDE :
                            o->valtype == 'F' ? OPT_FMT_PEMDER :
                            o->valtype == 'A' ? OPT_FMT_ASN1 :
                            OPT_FMT_ANY, &ival))
@@ -1114,8 +1099,6 @@ static const char *valtype2param(const OPTIONS *o)
         return "long";
     case 'u':
         return "ulong";
-    case 'E':
-        return "PEM|DER|ENGINE";
     case 'F':
         return "PEM|DER";
     case 'f':

apps/lib/s_cb.c

@@ -1126,10 +1126,10 @@ int load_excert(SSL_EXCERT **pexc)
             return 0;
         if (exc->keyfile != NULL) {
             exc->key = load_key(exc->keyfile, exc->keyform,
-                                0, NULL, NULL, "server key");
+                                0, NULL, "server key");
         } else {
             exc->key = load_key(exc->certfile, exc->certform,
-                                0, NULL, NULL, "server key");
+                                0, NULL, "server key");
         }
         if (exc->key == NULL)
             return 0;

apps/list.c

@@ -1181,7 +1181,7 @@ static int is_md_available(const char *name)
         return 1;
     }
 
-    return propq != NULL || get_digest_from_engine(name) == NULL ? 0 : 1;
+    return 0;
 }
 
 static int is_cipher_available(const char *name)
@@ -1198,7 +1198,7 @@ static int is_cipher_available(const char *name)
         return 1;
     }
 
-    return propq != NULL || get_cipher_from_engine(name) == NULL ? 0 : 1;
+    return 0;
 }
 
 static void list_type(FUNC_TYPE ft, int one)
@@ -1443,24 +1443,6 @@ static void list_provider_info(void)
     sk_OSSL_PROVIDER_free(providers);
 }
 
-#ifndef OPENSSL_NO_DEPRECATED_3_0
-static void list_engines(void)
-{
-# ifndef OPENSSL_NO_ENGINE
-    ENGINE *e;
-
-    BIO_puts(bio_out, "Engines:\n");
-    e = ENGINE_get_first();
-    while (e) {
-        BIO_printf(bio_out, "%s\n", ENGINE_get_id(e));
-        e = ENGINE_get_next(e);
-    }
-# else
-    BIO_puts(bio_out, "Engine support is disabled.\n");
-# endif
-}
-#endif
-
 static void list_disabled(void)
 {
     BIO_puts(bio_out, "Disabled algorithms:\n");
@@ -1521,9 +1503,6 @@ static void list_disabled(void)
 #ifdef OPENSSL_NO_EC2M
     BIO_puts(bio_out, "EC2M\n");
 #endif
-#if defined(OPENSSL_NO_ENGINE) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-    BIO_puts(bio_out, "ENGINE\n");
-#endif
 #ifdef OPENSSL_NO_GOST
     BIO_puts(bio_out, "GOST\n");
 #endif
@@ -1639,9 +1618,6 @@ typedef enum HELPLIST_CHOICE {
 # if !defined(OPENSSL_NO_TLS1_3)
     OPT_TLS1_3,
 # endif
-#endif
-#ifndef OPENSSL_NO_DEPRECATED_3_0
-    OPT_ENGINES,
 #endif
     OPT_PROV_ENUM
 } HELPLIST_CHOICE;
@@ -1714,10 +1690,6 @@ const OPTIONS list_options[] = {
 #endif
     {"providers", OPT_PROVIDER_INFO, '-',
      "List of provider information"},
-#ifndef OPENSSL_NO_DEPRECATED_3_0
-    {"engines", OPT_ENGINES, '-',
-     "List of loaded engines"},
-#endif
     {"disabled", OPT_DISABLED, '-', "List of disabled features"},
     {"options", OPT_OPTIONS, 's',
      "List options for specified command"},
@@ -1767,9 +1739,6 @@ int list_main(int argc, char **argv)
         unsigned int pk_method:1;
         unsigned int store_loaders:1;
         unsigned int provider_info:1;
-#ifndef OPENSSL_NO_DEPRECATED_3_0
-        unsigned int engines:1;
-#endif
         unsigned int disabled:1;
         unsigned int objects:1;
         unsigned int options:1;
@@ -1879,11 +1848,6 @@ opthelp:
         case OPT_PROVIDER_INFO:
             todo.provider_info = 1;
             break;
-#ifndef OPENSSL_NO_DEPRECATED_3_0
-        case OPT_ENGINES:
-            todo.engines = 1;
-            break;
-#endif
         case OPT_DISABLED:
             todo.disabled = 1;
             break;
@@ -1997,10 +1961,6 @@ opthelp:
         MAYBE_ADD_NL(list_store_loaders());
     if (todo.provider_info)
         MAYBE_ADD_NL(list_provider_info());
-#ifndef OPENSSL_NO_DEPRECATED_3_0
-    if (todo.engines)
-        MAYBE_ADD_NL(list_engines());
-#endif
     if (todo.disabled)
         MAYBE_ADD_NL(list_disabled());
     if (todo.objects)

apps/ocsp.c

@@ -598,7 +598,7 @@ int ocsp_main(int argc, char **argv)
             BIO_printf(bio_err, "Error getting password\n");
             goto end;
         }
-        rkey = load_key(rkeyfile, FORMAT_UNDEF, 0, passin, NULL,
+        rkey = load_key(rkeyfile, FORMAT_UNDEF, 0, passin,
                         "responder private key");
         if (rkey == NULL)
             goto end;
@@ -694,7 +694,7 @@ redo_accept:
                             "signer certificates"))
                 goto end;
         }
-        key = load_key(keyfile, FORMAT_UNDEF, 0, NULL, NULL,
+        key = load_key(keyfile, FORMAT_UNDEF, 0, NULL,
                        "signer private key");
         if (key == NULL)
             goto end;

apps/openssl-vms.cnf

@@ -311,7 +311,6 @@ default_tsa = tsa_config1	# the default TSA section
 # These are used by the TSA reply generation only.
 dir		= sys\$disk:[.demoCA		# TSA root directory
 serial		= $dir]tsaserial.	# The current serial number (mandatory)
-crypto_device	= builtin		# OpenSSL engine to use for signing
 signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
 					# (optional)
 certs		= $dir.cacert.pem]	# Certificate chain to include in reply

apps/openssl.c

@@ -20,9 +20,6 @@
 #include <openssl/x509.h>
 #include <openssl/pem.h>
 #include <openssl/ssl.h>
-#ifndef OPENSSL_NO_ENGINE
-# include <openssl/engine.h>
-#endif
 #include <openssl/err.h>
 /* Needed to get the other O_xxx flags. */
 #ifdef OPENSSL_SYS_VMS
@@ -65,12 +62,10 @@ static int apps_startup(void)
 #endif
 
     /* Set non-default library initialisation settings */
-    if (!OPENSSL_init_ssl(OPENSSL_INIT_ENGINE_ALL_BUILTIN
-                          | OPENSSL_INIT_LOAD_CONFIG, NULL))
+    if (!OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL))
         return 0;
 
     (void)setup_ui_method();
-    (void)setup_engine_loader();
 
     /*
      * NOTE: This is an undocumented feature required for testing only.
@@ -92,7 +87,6 @@ static void apps_shutdown(void)
 {
     app_providers_cleanup();
     OSSL_LIB_CTX_free(app_get0_libctx());
-    destroy_engine_loader();
     destroy_ui_method();
 }
 

apps/openssl.cnf

@@ -311,7 +311,6 @@ default_tsa = tsa_config1	# the default TSA section
 # These are used by the TSA reply generation only.
 dir		= ./demoCA		# TSA root directory
 serial		= $dir/tsaserial	# The current serial number (mandatory)
-crypto_device	= builtin		# OpenSSL engine to use for signing
 signer_cert	= $dir/tsacert.pem 	# The TSA signing certificate
 					# (optional)
 certs		= $dir/cacert.pem	# Certificate chain to include in reply

apps/pkcs12.c

@@ -69,7 +69,7 @@ typedef enum OPTION_choice {
     OPT_INKEY, OPT_CERTFILE, OPT_UNTRUSTED, OPT_PASSCERTS,
     OPT_NAME, OPT_CSP, OPT_CANAME,
     OPT_IN, OPT_OUT, OPT_PASSIN, OPT_PASSOUT, OPT_PASSWORD, OPT_CAPATH,
-    OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE, OPT_ENGINE,
+    OPT_CAFILE, OPT_CASTORE, OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE,
     OPT_R_ENUM, OPT_PROV_ENUM, OPT_JDKTRUST, OPT_PBMAC1_PBKDF2, OPT_PBMAC1_PBKDF2_MD,
 #ifndef OPENSSL_NO_DES
     OPT_LEGACY_ALG
@@ -96,9 +96,6 @@ const OPTIONS pkcs12_options[] = {
      "Use legacy encryption: 3DES_CBC for keys, RC2_CBC for certs"
 # endif
     },
-#endif
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
 #endif
     OPT_PROV_OPTIONS,
     OPT_R_OPTIONS,
@@ -183,7 +180,6 @@ int pkcs12_main(int argc, char **argv)
     char *cpass = NULL, *mpass = NULL, *badpass = NULL;
     const char *CApath = NULL, *CAfile = NULL, *CAstore = NULL, *prog;
     int noCApath = 0, noCAfile = 0, noCAstore = 0;
-    ENGINE *e = NULL;
     BIO *in = NULL, *out = NULL;
     PKCS12 *p12 = NULL;
     STACK_OF(OPENSSL_STRING) *canames = NULL;
@@ -364,9 +360,6 @@ int pkcs12_main(int argc, char **argv)
         case OPT_NOCAFILE:
             noCAfile = 1;
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
 #ifndef OPENSSL_NO_DES
         case OPT_LEGACY_ALG:
             use_legacy = 1;
@@ -557,7 +550,7 @@ int pkcs12_main(int argc, char **argv)
 
         if (!(options & NOKEYS)) {
             key = load_key(keyname ? keyname : infile,
-                           FORMAT_PEM, 1, passin, e,
+                           FORMAT_PEM, 1, passin,
                            keyname ?
                            "private key from -inkey file" :
                            "private key from -in file");
@@ -904,7 +897,6 @@ int pkcs12_main(int argc, char **argv)
     ret = 0;
  end:
     PKCS12_free(p12);
-    release_engine(e);
     BIO_free(in);
     BIO_free_all(out);
     sk_OPENSSL_STRING_free(canames);

apps/pkcs7.c

@@ -24,15 +24,12 @@ typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT, OPT_NOOUT,
     OPT_TEXT, OPT_PRINT, OPT_PRINT_CERTS, OPT_QUIET,
-    OPT_ENGINE, OPT_PROV_ENUM
+    OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS pkcs7_options[] = {
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Input"),
     {"in", OPT_IN, '<', "Input file"},
@@ -55,7 +52,6 @@ const OPTIONS pkcs7_options[] = {
 
 int pkcs7_main(int argc, char **argv)
 {
-    ENGINE *e = NULL;
     PKCS7 *p7 = NULL, *p7i;
     BIO *in = NULL, *out = NULL;
     int informat = FORMAT_PEM, outformat = FORMAT_PEM;
@@ -105,9 +101,6 @@ int pkcs7_main(int argc, char **argv)
         case OPT_QUIET:
             quiet = 1;
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_PROV_CASES:
             if (!opt_provider(o))
                 goto end;
@@ -217,7 +210,6 @@ int pkcs7_main(int argc, char **argv)
     ret = 0;
  end:
     PKCS7_free(p7);
-    release_engine(e);
     BIO_free(in);
     BIO_free_all(out);
     return ret;

apps/pkcs8.c

@@ -22,7 +22,7 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
+    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
     OPT_TOPK8, OPT_NOITER, OPT_NOCRYPT,
 #ifndef OPENSSL_NO_SCRYPT
     OPT_SCRYPT, OPT_SCRYPT_N, OPT_SCRYPT_R, OPT_SCRYPT_P,
@@ -36,9 +36,6 @@ typedef enum OPTION_choice {
 const OPTIONS pkcs8_options[] = {
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
     {"v1", OPT_V1, 's', "Use PKCS#5 v1.5 and cipher"},
     {"v2", OPT_V2, 's', "Use PKCS#5 v2.0 and cipher"},
     {"v2prf", OPT_V2PRF, 's', "Set the PRF algorithm to use with PKCS#5 v2.0"},
@@ -75,7 +72,6 @@ const OPTIONS pkcs8_options[] = {
 int pkcs8_main(int argc, char **argv)
 {
     BIO *in = NULL, *out = NULL;
-    ENGINE *e = NULL;
     EVP_PKEY *pkey = NULL;
     PKCS8_PRIV_KEY_INFO *p8inf = NULL;
     X509_SIG *p8 = NULL;
@@ -171,9 +167,6 @@ int pkcs8_main(int argc, char **argv)
         case OPT_PASSOUT:
             passoutarg = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
 #ifndef OPENSSL_NO_SCRYPT
         case OPT_SCRYPT:
             scrypt_N = 16384;
@@ -229,7 +222,7 @@ int pkcs8_main(int argc, char **argv)
         goto end;
 
     if (topk8) {
-        pkey = load_key(infile, informat, 1, passin, e, "key");
+        pkey = load_key(infile, informat, 1, passin, "key");
         if (pkey == NULL)
             goto end;
         if ((p8inf = EVP_PKEY2PKCS8(pkey)) == NULL) {
@@ -382,7 +375,6 @@ int pkcs8_main(int argc, char **argv)
     PKCS8_PRIV_KEY_INFO_free(p8inf);
     EVP_PKEY_free(pkey);
     EVP_CIPHER_free(cipher);
-    release_engine(e);
     BIO_free_all(out);
     BIO_free(in);
     OPENSSL_free(passin);

apps/pkey.c

@@ -19,7 +19,7 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE,
+    OPT_INFORM, OPT_OUTFORM, OPT_PASSIN, OPT_PASSOUT,
     OPT_IN, OPT_OUT, OPT_PUBIN, OPT_PUBOUT, OPT_TEXT_PUB,
     OPT_TEXT, OPT_NOOUT, OPT_CIPHER, OPT_TRADITIONAL, OPT_CHECK, OPT_PUB_CHECK,
     OPT_EC_PARAM_ENC, OPT_EC_CONV_FORM,
@@ -29,9 +29,6 @@ typedef enum OPTION_choice {
 const OPTIONS pkey_options[] = {
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
     OPT_PROV_OPTIONS,
 
     {"check", OPT_CHECK, '-', "Check key consistency"},
@@ -39,8 +36,7 @@ const OPTIONS pkey_options[] = {
 
     OPT_SECTION("Input"),
     {"in", OPT_IN, 's', "Input key"},
-    {"inform", OPT_INFORM, 'f',
-     "Key input format (ENGINE, other values ignored)"},
+    {"inform", OPT_INFORM, 'f', "Key input format (DER/PEM)"},
     {"passin", OPT_PASSIN, 's', "Key input pass phrase source"},
     {"pubin", OPT_PUBIN, '-',
      "Read only public components from key input"},
@@ -68,7 +64,6 @@ const OPTIONS pkey_options[] = {
 int pkey_main(int argc, char **argv)
 {
     BIO *out = NULL;
-    ENGINE *e = NULL;
     EVP_PKEY *pkey = NULL;
     EVP_PKEY_CTX *ctx = NULL;
     EVP_CIPHER *cipher = NULL;
@@ -110,9 +105,6 @@ int pkey_main(int argc, char **argv)
         case OPT_PASSOUT:
             passoutarg = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_IN:
             infile = opt_arg();
             break;
@@ -209,9 +201,9 @@ int pkey_main(int argc, char **argv)
     }
 
     if (pubin)
-        pkey = load_pubkey(infile, informat, 1, passin, e, "Public Key");
+        pkey = load_pubkey(infile, informat, 1, passin, "Public Key");
     else
-        pkey = load_key(infile, informat, 1, passin, e, "key");
+        pkey = load_key(infile, informat, 1, passin, "key");
     if (pkey == NULL)
         goto end;
 
@@ -242,7 +234,7 @@ int pkey_main(int argc, char **argv)
     if (check || pub_check) {
         int r;
 
-        ctx = EVP_PKEY_CTX_new(pkey, e);
+        ctx = EVP_PKEY_CTX_new(pkey, NULL);
         if (ctx == NULL) {
             ERR_print_errors(bio_err);
             goto end;
@@ -327,7 +319,6 @@ int pkey_main(int argc, char **argv)
     EVP_PKEY_CTX_free(ctx);
     EVP_PKEY_free(pkey);
     EVP_CIPHER_free(cipher);
-    release_engine(e);
     BIO_free_all(out);
     OPENSSL_free(passin);
     OPENSSL_free(passout);

apps/pkeyparam.c

@@ -19,16 +19,13 @@
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_IN, OPT_OUT, OPT_TEXT, OPT_NOOUT,
-    OPT_ENGINE, OPT_CHECK,
+    OPT_CHECK,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS pkeyparam_options[] = {
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
     {"check", OPT_CHECK, '-', "Check key param consistency"},
 
     OPT_SECTION("Input"),
@@ -45,7 +42,6 @@ const OPTIONS pkeyparam_options[] = {
 
 int pkeyparam_main(int argc, char **argv)
 {
-    ENGINE *e = NULL;
     BIO *in = NULL, *out = NULL;
     EVP_PKEY *pkey = NULL;
     EVP_PKEY_CTX *ctx = NULL;
@@ -71,9 +67,6 @@ int pkeyparam_main(int argc, char **argv)
         case OPT_OUT:
             outfile = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_TEXT:
             text = 1;
             break;
@@ -109,11 +102,8 @@ int pkeyparam_main(int argc, char **argv)
         goto end;
 
     if (check) {
-        if (e == NULL)
-            ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), pkey,
-                                             app_get0_propq());
-        else
-            ctx = EVP_PKEY_CTX_new(pkey, e);
+        ctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(), pkey,
+                                         app_get0_propq());
         if (ctx == NULL) {
             ERR_print_errors(bio_err);
             goto end;
@@ -145,7 +135,6 @@ int pkeyparam_main(int argc, char **argv)
  end:
     EVP_PKEY_CTX_free(ctx);
     EVP_PKEY_free(pkey);
-    release_engine(e);
     BIO_free_all(out);
     BIO_free(in);
 

apps/pkeyutl.c

@@ -22,16 +22,14 @@
 
 static EVP_PKEY *get_pkey(const char *kdfalg,
                           const char *keyfile, int keyform, int key_type,
-                          char *passinarg, int pkey_op, ENGINE *e);
+                          char *passinarg, int pkey_op);
 static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
-                              int pkey_op, ENGINE *e,
-                              const int engine_impl, int rawin,
+                              int pkey_op, int rawin,
                               EVP_PKEY *pkey /* ownership is passed to ctx */,
                               EVP_MD_CTX *mctx, const char *digestname,
                               const char *kemop, OSSL_LIB_CTX *libctx, const char *propq);
 
-static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
-                      ENGINE *e);
+static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file);
 
 static int do_keyop(EVP_PKEY_CTX *ctx, int pkey_op,
                     unsigned char *out, size_t *poutlen,
@@ -56,7 +54,7 @@ static int only_nomd(EVP_PKEY *pkey)
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_ENGINE_IMPL, OPT_IN, OPT_OUT,
+    OPT_IN, OPT_OUT,
     OPT_PUBIN, OPT_CERTIN, OPT_ASN1PARSE, OPT_HEXDUMP, OPT_SIGN,
     OPT_VERIFY, OPT_VERIFYRECOVER, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT,
     OPT_DERIVE, OPT_SIGFILE, OPT_INKEY, OPT_PEERKEY, OPT_PASSIN,
@@ -70,11 +68,6 @@ typedef enum OPTION_choice {
 const OPTIONS pkeyutl_options[] = {
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-    {"engine_impl", OPT_ENGINE_IMPL, '-',
-     "Also use engine given by -engine for crypto operations"},
-#endif
     {"sign", OPT_SIGN, '-', "Sign input data with private key"},
     {"verify", OPT_VERIFY, '-', "Verify with public key"},
     {"encrypt", OPT_ENCRYPT, '-', "Encrypt input data with public key"},
@@ -90,11 +83,11 @@ const OPTIONS pkeyutl_options[] = {
     {"pubin", OPT_PUBIN, '-', "Input key is a public key"},
     {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
     {"peerkey", OPT_PEERKEY, 's', "Peer key file used in key derivation"},
-    {"peerform", OPT_PEERFORM, 'E', "Peer key format (DER/PEM/P12/ENGINE)"},
+    {"peerform", OPT_PEERFORM, 'f', "Peer key format (DER/PEM/P12)"},
     {"certin", OPT_CERTIN, '-', "Input is a cert with a public key"},
     {"rev", OPT_REV, '-', "Reverse the order of the input buffer"},
     {"sigfile", OPT_SIGFILE, '<', "Signature file (verify operation only)"},
-    {"keyform", OPT_KEYFORM, 'E', "Private key format (ENGINE, other values ignored)"},
+    {"keyform", OPT_KEYFORM, 'f', "Private key format (DER/PEM)"},
 
     OPT_SECTION("Output"),
     {"out", OPT_OUT, '>', "Output file - default stdout"},
@@ -126,7 +119,6 @@ int pkeyutl_main(int argc, char **argv)
 {
     CONF *conf = NULL;
     BIO *in = NULL, *out = NULL, *secout = NULL;
-    ENGINE *e = NULL;
     EVP_PKEY_CTX *ctx = NULL;
     EVP_PKEY *pkey = NULL;
     char *infile = NULL, *outfile = NULL, *secoutfile = NULL, *sigfile = NULL, *passinarg = NULL;
@@ -136,7 +128,6 @@ int pkeyutl_main(int argc, char **argv)
     int buf_inlen = 0, siglen = -1;
     int keyform = FORMAT_UNDEF, peerform = FORMAT_UNDEF;
     int keysize = -1, pkey_op = EVP_PKEY_OP_SIGN, key_type = KEY_PRIVKEY;
-    int engine_impl = 0;
     int ret = 1, rv = -1;
     size_t buf_outlen = 0, secretlen = 0;
     const char *inkey = NULL;
@@ -175,9 +166,6 @@ int pkeyutl_main(int argc, char **argv)
         case OPT_SIGFILE:
             sigfile = opt_arg();
             break;
-        case OPT_ENGINE_IMPL:
-            engine_impl = 1;
-            break;
         case OPT_INKEY:
             inkey = opt_arg();
             break;
@@ -208,9 +196,6 @@ int pkeyutl_main(int argc, char **argv)
             if (!opt_provider(o))
                 goto end;
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_PUBIN:
             key_type = KEY_PUBKEY;
             break;
@@ -317,7 +302,7 @@ int pkeyutl_main(int argc, char **argv)
         goto opthelp;
     }
 
-    pkey = get_pkey(kdfalg, inkey, keyform, key_type, passinarg, pkey_op, e);
+    pkey = get_pkey(kdfalg, inkey, keyform, key_type, passinarg, pkey_op);
     if (key_type != KEY_NONE && pkey == NULL) {
         BIO_printf(bio_err, "%s: Error loading key\n", prog);
         goto end;
@@ -357,13 +342,13 @@ int pkeyutl_main(int argc, char **argv)
             goto end;
         }
     }
-    ctx = init_ctx(kdfalg, &keysize, pkey_op, e, engine_impl, rawin, pkey,
+    ctx = init_ctx(kdfalg, &keysize, pkey_op, rawin, pkey,
                    mctx, digestname, kemop, libctx, app_get0_propq());
     if (ctx == NULL) {
         BIO_printf(bio_err, "%s: Error initializing context\n", prog);
         goto end;
     }
-    if (peerkey != NULL && !setup_peer(ctx, peerform, peerkey, e)) {
+    if (peerkey != NULL && !setup_peer(ctx, peerform, peerkey)) {
         BIO_printf(bio_err, "%s: Error setting up peer key\n", prog);
         goto end;
     }
@@ -601,7 +586,6 @@ int pkeyutl_main(int argc, char **argv)
     EVP_PKEY_CTX_free(ctx);
     EVP_PKEY_free(pkey);
     EVP_MD_free(md);
-    release_engine(e);
     BIO_free(in);
     BIO_free_all(out);
     BIO_free_all(secout);
@@ -617,7 +601,7 @@ int pkeyutl_main(int argc, char **argv)
 
 static EVP_PKEY *get_pkey(const char *kdfalg,
                           const char *keyfile, int keyform, int key_type,
-                          char *passinarg, int pkey_op, ENGINE *e)
+                          char *passinarg, int pkey_op)
 {
     EVP_PKEY *pkey = NULL;
     char *passin = NULL;
@@ -635,11 +619,11 @@ static EVP_PKEY *get_pkey(const char *kdfalg,
     }
     switch (key_type) {
     case KEY_PRIVKEY:
-        pkey = load_key(keyfile, keyform, 0, passin, e, "private key");
+        pkey = load_key(keyfile, keyform, 0, passin, "private key");
         break;
 
     case KEY_PUBKEY:
-        pkey = load_pubkey(keyfile, keyform, 0, NULL, e, "public key");
+        pkey = load_pubkey(keyfile, keyform, 0, NULL, "public key");
         break;
 
     case KEY_CERT:
@@ -659,21 +643,14 @@ static EVP_PKEY *get_pkey(const char *kdfalg,
 }
 
 static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
-                              int pkey_op, ENGINE *e,
-                              const int engine_impl, int rawin,
+                              int pkey_op, int rawin,
                               EVP_PKEY *pkey /* ownership is passed to ctx */,
                               EVP_MD_CTX *mctx, const char *digestname,
                               const char *kemop, OSSL_LIB_CTX *libctx, const char *propq)
 {
     EVP_PKEY_CTX *ctx = NULL;
-    ENGINE *impl = NULL;
     int rv = -1;
 
-#ifndef OPENSSL_NO_ENGINE
-    if (engine_impl)
-        impl = e;
-#endif
-
     if (kdfalg != NULL) {
         int kdfnid = OBJ_sn2nid(kdfalg);
 
@@ -685,19 +662,13 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
                 return NULL;
             }
         }
-        if (impl != NULL)
-            ctx = EVP_PKEY_CTX_new_id(kdfnid, impl);
-        else
-            ctx = EVP_PKEY_CTX_new_from_name(libctx, kdfalg, propq);
+        ctx = EVP_PKEY_CTX_new_from_name(libctx, kdfalg, propq);
     } else {
         if (pkey == NULL)
             return NULL;
 
         *pkeysize = EVP_PKEY_get_size(pkey);
-        if (impl != NULL)
-            ctx = EVP_PKEY_CTX_new(pkey, impl);
-        else
-            ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq);
+        ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, propq);
     }
 
     if (ctx == NULL)
@@ -766,17 +737,13 @@ static EVP_PKEY_CTX *init_ctx(const char *kdfalg, int *pkeysize,
     return ctx;
 }
 
-static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file,
-                      ENGINE *e)
+static int setup_peer(EVP_PKEY_CTX *ctx, int peerform, const char *file)
 {
     EVP_PKEY *pkey = EVP_PKEY_CTX_get0_pkey(ctx);
     EVP_PKEY *peer = NULL;
-    ENGINE *engine = NULL;
     int ret = 1;
 
-    if (peerform == FORMAT_ENGINE)
-        engine = e;
-    peer = load_pubkey(file, peerform, 0, NULL, engine, "peer key");
+    peer = load_pubkey(file, peerform, 0, NULL, "peer key");
     if (peer == NULL) {
         BIO_printf(bio_err, "Error reading peer key %s\n", file);
         return 0;

apps/rand.c

@@ -20,7 +20,7 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_OUT, OPT_ENGINE, OPT_BASE64, OPT_HEX,
+    OPT_OUT, OPT_BASE64, OPT_HEX,
     OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
@@ -29,9 +29,6 @@ const OPTIONS rand_options[] = {
 
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Output"),
     {"out", OPT_OUT, '>', "Output file"},
@@ -48,7 +45,6 @@ const OPTIONS rand_options[] = {
 
 int rand_main(int argc, char **argv)
 {
-    ENGINE *e = NULL;
     BIO *out = NULL;
     char *outfile = NULL, *prog;
     OPTION_CHOICE o;
@@ -73,9 +69,6 @@ int rand_main(int argc, char **argv)
         case OPT_OUT:
             outfile = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_R_CASES:
             if (!opt_rand(o))
                 goto end;
@@ -223,7 +216,6 @@ int rand_main(int argc, char **argv)
     if (ret != 0)
         ERR_print_errors(bio_err);
     OPENSSL_free(buf);
-    release_engine(e);
     BIO_free_all(out);
     return ret;
 }

apps/req.c

@@ -71,8 +71,7 @@ static int check_end(const char *str, const char *end);
 static int join(char buf[], size_t buf_size, const char *name,
                 const char *tail, const char *desc);
 static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
-                                    char **pkeytype, long *pkeylen,
-                                    ENGINE *keygen_engine);
+                                    char **pkeytype, long *pkeylen);
 
 static const char *section = "req";
 static CONF *req_conf = NULL;
@@ -82,7 +81,7 @@ static int batch = 0;
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_CIPHER,
-    OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_KEYGEN_ENGINE, OPT_KEY,
+    OPT_INFORM, OPT_OUTFORM, OPT_KEY,
     OPT_PUBKEY, OPT_NEW, OPT_CONFIG, OPT_KEYFORM, OPT_IN, OPT_OUT,
     OPT_KEYOUT, OPT_PASSIN, OPT_PASSOUT, OPT_NEWKEY,
     OPT_PKEYOPT, OPT_SIGOPT, OPT_VFYOPT, OPT_BATCH, OPT_NEWHDR, OPT_MODULUS,
@@ -100,11 +99,6 @@ const OPTIONS req_options[] = {
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
     {"cipher", OPT_CIPHER, 's', "Specify the cipher for private key encryption"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-    {"keygen_engine", OPT_KEYGEN_ENGINE, 's',
-     "Specify engine to be used for key generation operations"},
-#endif
     {"in", OPT_IN, '<', "X.509 request input file (default stdin)"},
     {"inform", OPT_INFORM, 'F',
      "CSR input format to use (PEM or DER; by default try PEM first)"},
@@ -147,7 +141,7 @@ const OPTIONS req_options[] = {
 
     OPT_SECTION("Keys and Signing"),
     {"key", OPT_KEY, 's', "Key for signing, and to include unless -in given"},
-    {"keyform", OPT_KEYFORM, 'f', "Key file format (ENGINE, other values ignored)"},
+    {"keyform", OPT_KEYFORM, 'f', "Key file format (DER/PEM)"},
     {"pubkey", OPT_PUBKEY, '-', "Output public key"},
     {"keyout", OPT_KEYOUT, '>', "File to write private key to"},
     {"passin", OPT_PASSIN, 's', "Private key and certificate password source"},
@@ -245,7 +239,6 @@ int req_main(int argc, char **argv)
 {
     ASN1_INTEGER *serial = NULL;
     BIO *out = NULL;
-    ENGINE *e = NULL, *gen_eng = NULL;
     EVP_PKEY *pkey = NULL, *CAkey = NULL;
     EVP_PKEY_CTX *genctx = NULL;
     STACK_OF(OPENSSL_STRING) *pkeyopts = NULL, *sigopts = NULL, *vfyopts = NULL;
@@ -298,18 +291,6 @@ int req_main(int argc, char **argv)
             if (!opt_format(opt_arg(), OPT_FMT_PEMDER, &outformat))
                 goto opthelp;
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
-        case OPT_KEYGEN_ENGINE:
-#ifndef OPENSSL_NO_ENGINE
-            gen_eng = setup_engine(opt_arg(), 0);
-            if (gen_eng == NULL) {
-                BIO_printf(bio_err, "Can't find keygen engine %s\n", *argv);
-                goto opthelp;
-            }
-#endif
-            break;
         case OPT_KEY:
             keyfile = opt_arg();
             break;
@@ -624,7 +605,7 @@ int req_main(int argc, char **argv)
     }
 
     if (keyfile != NULL) {
-        pkey = load_key(keyfile, keyform, 0, passin, e, "private key");
+        pkey = load_key(keyfile, keyform, 0, passin, "private key");
         if (pkey == NULL)
             goto end;
         app_RAND_load_conf(req_conf, section);
@@ -640,7 +621,7 @@ int req_main(int argc, char **argv)
         if (!app_conf_try_number(req_conf, section, BITS, &newkey_len))
             newkey_len = DEFAULT_KEY_LENGTH;
 
-        genctx = set_keygen_ctx(keyalg, &keyalgstr, &newkey_len, gen_eng);
+        genctx = set_keygen_ctx(keyalg, &keyalgstr, &newkey_len);
         if (genctx == NULL)
             goto end;
 
@@ -762,7 +743,7 @@ int req_main(int argc, char **argv)
                        "Warning: Ignoring -CAkey option since no -CA option is given\n");
         } else {
             if ((CAkey = load_key(CAkeyfile, FORMAT_UNDEF,
-                                  0, passin, e,
+                                  0, passin,
                                   CAkeyfile != CAfile
                                   ? "issuer private key from -CAkey arg"
                                   : "issuer private key from -CA arg")) == NULL)
@@ -1056,9 +1037,6 @@ int req_main(int argc, char **argv)
     sk_OPENSSL_STRING_free(vfyopts);
     lh_OPENSSL_STRING_doall(addexts, exts_cleanup);
     lh_OPENSSL_STRING_free(addexts);
-#ifndef OPENSSL_NO_ENGINE
-    release_engine(gen_eng);
-#endif
     OPENSSL_free(keyalgstr);
     X509_REQ_free(req);
     X509_NAME_free(fsubj);
@@ -1066,7 +1044,6 @@ int req_main(int argc, char **argv)
     X509_free(CAcert);
     EVP_PKEY_free(CAkey);
     ASN1_INTEGER_free(serial);
-    release_engine(e);
     if (passin != nofree_passin)
         OPENSSL_free(passin);
     if (passout != nofree_passout)
@@ -1484,8 +1461,7 @@ static int join(char buf[], size_t buf_size, const char *name,
 }
 
 static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
-                                    char **pkeytype, long *pkeylen,
-                                    ENGINE *keygen_engine)
+                                    char **pkeytype, long *pkeylen)
 {
     EVP_PKEY_CTX *gctx = NULL;
     EVP_PKEY *param = NULL;
@@ -1601,28 +1577,13 @@ static EVP_PKEY_CTX *set_keygen_ctx(const char *gstr,
             return NULL;
         }
 
-        if (keygen_engine != NULL)
-            gctx = EVP_PKEY_CTX_new(param, keygen_engine);
-        else
-            gctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(),
-                                              param, app_get0_propq());
+        gctx = EVP_PKEY_CTX_new_from_pkey(app_get0_libctx(),
+                                          param, app_get0_propq());
         *pkeylen = EVP_PKEY_get_bits(param);
         EVP_PKEY_free(param);
     } else {
-#ifndef OPENSSL_NO_DEPRECATED_3_6
-        if (keygen_engine != NULL) {
-            int pkey_id = get_legacy_pkey_id(app_get0_libctx(), *pkeytype,
-                                             keygen_engine);
-
-            if (pkey_id != NID_undef)
-                gctx = EVP_PKEY_CTX_new_id(pkey_id, keygen_engine);
-        } else {
-#endif
-            gctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(),
-                                              *pkeytype, app_get0_propq());
-#ifndef OPENSSL_NO_DEPRECATED_3_6
-        }
-#endif
+        gctx = EVP_PKEY_CTX_new_from_name(app_get0_libctx(),
+                                          *pkeytype, app_get0_propq());
     }
 
     if (gctx == NULL) {

apps/rsa.c

@@ -41,7 +41,7 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_INFORM, OPT_OUTFORM, OPT_ENGINE, OPT_IN, OPT_OUT,
+    OPT_INFORM, OPT_OUTFORM, OPT_IN, OPT_OUT,
     OPT_PUBIN, OPT_PUBOUT, OPT_PASSOUT, OPT_PASSIN,
     OPT_RSAPUBKEY_IN, OPT_RSAPUBKEY_OUT,
     /* Do not change the order here; see case statements below */
@@ -55,13 +55,10 @@ const OPTIONS rsa_options[] = {
     {"help", OPT_HELP, '-', "Display this summary"},
     {"check", OPT_CHECK, '-', "Verify key consistency"},
     {"", OPT_CIPHER, '-', "Any supported cipher"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Input"),
     {"in", OPT_IN, 's', "Input file"},
-    {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12/ENGINE)"},
+    {"inform", OPT_INFORM, 'f', "Input format (DER/PEM/P12)"},
     {"pubin", OPT_PUBIN, '-', "Expect a public key in input file"},
     {"RSAPublicKey_in", OPT_RSAPUBKEY_IN, '-', "Input is an RSAPublicKey"},
     {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
@@ -121,7 +118,6 @@ static int try_legacy_encoding(EVP_PKEY *pkey, int outformat, int pubout,
 
 int rsa_main(int argc, char **argv)
 {
-    ENGINE *e = NULL;
     BIO *out = NULL;
     EVP_PKEY *pkey = NULL;
     EVP_PKEY_CTX *pctx;
@@ -172,9 +168,6 @@ int rsa_main(int argc, char **argv)
         case OPT_PASSOUT:
             passoutarg = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_PUBIN:
             pubin = 1;
             break;
@@ -246,9 +239,9 @@ int rsa_main(int argc, char **argv)
             tmpformat = informat;
         }
 
-        pkey = load_pubkey(infile, tmpformat, 1, passin, e, "public key");
+        pkey = load_pubkey(infile, tmpformat, 1, passin, "public key");
     } else {
-        pkey = load_key(infile, informat, 1, passin, e, "private key");
+        pkey = load_key(infile, informat, 1, passin, "private key");
     }
 
     if (pkey == NULL) {
@@ -403,7 +396,6 @@ int rsa_main(int argc, char **argv)
     ret = 0;
  end:
     OSSL_ENCODER_CTX_free(ectx);
-    release_engine(e);
     BIO_free_all(out);
     EVP_PKEY_free(pkey);
     EVP_CIPHER_free(enc);

apps/rsautl.c

@@ -27,7 +27,7 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_IN, OPT_OUT, OPT_ASN1PARSE, OPT_HEXDUMP,
+    OPT_IN, OPT_OUT, OPT_ASN1PARSE, OPT_HEXDUMP,
     OPT_RSA_RAW, OPT_OAEP, OPT_PKCS, OPT_X931,
     OPT_SIGN, OPT_VERIFY, OPT_REV, OPT_ENCRYPT, OPT_DECRYPT,
     OPT_PUBIN, OPT_CERTIN, OPT_INKEY, OPT_PASSIN, OPT_KEYFORM,
@@ -41,14 +41,11 @@ const OPTIONS rsautl_options[] = {
     {"verify", OPT_VERIFY, '-', "Verify with public key"},
     {"encrypt", OPT_ENCRYPT, '-', "Encrypt with public key"},
     {"decrypt", OPT_DECRYPT, '-', "Decrypt with private key"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Input"),
     {"in", OPT_IN, '<', "Input file"},
     {"inkey", OPT_INKEY, 's', "Input key, by default an RSA private key"},
-    {"keyform", OPT_KEYFORM, 'E', "Private key format (ENGINE, other values ignored)"},
+    {"keyform", OPT_KEYFORM, 'f', "Private key format (DER/PEM)"},
     {"pubin", OPT_PUBIN, '-', "Input key is an RSA public pkey"},
     {"certin", OPT_CERTIN, '-', "Input is a cert carrying an RSA public key"},
     {"rev", OPT_REV, '-', "Reverse the order of the input buffer"},
@@ -72,7 +69,6 @@ const OPTIONS rsautl_options[] = {
 int rsautl_main(int argc, char **argv)
 {
     BIO *in = NULL, *out = NULL;
-    ENGINE *e = NULL;
     EVP_PKEY *pkey = NULL;
     EVP_PKEY_CTX *ctx = NULL;
     X509 *x;
@@ -107,9 +103,6 @@ int rsautl_main(int argc, char **argv)
         case OPT_OUT:
             outfile = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_ASN1PARSE:
             asn1parse = 1;
             break;
@@ -187,11 +180,11 @@ int rsautl_main(int argc, char **argv)
 
     switch (key_type) {
     case KEY_PRIVKEY:
-        pkey = load_key(keyfile, keyformat, 0, passin, e, "private key");
+        pkey = load_key(keyfile, keyformat, 0, passin, "private key");
         break;
 
     case KEY_PUBKEY:
-        pkey = load_pubkey(keyfile, keyformat, 0, NULL, e, "public key");
+        pkey = load_pubkey(keyfile, keyformat, 0, NULL, "public key");
         break;
 
     case KEY_CERT:
@@ -282,7 +275,6 @@ int rsautl_main(int argc, char **argv)
  end:
     EVP_PKEY_CTX_free(ctx);
     EVP_PKEY_free(pkey);
-    release_engine(e);
     BIO_free(in);
     BIO_free_all(out);
     OPENSSL_free(rsa_in);

apps/s_client.c

@@ -483,12 +483,11 @@ typedef enum OPTION_choice {
     OPT_CERT, OPT_CRL, OPT_CRL_DOWNLOAD, OPT_SESS_OUT, OPT_SESS_IN,
     OPT_CERTFORM, OPT_CRLFORM, OPT_VERIFY_RET_ERROR, OPT_VERIFY_QUIET,
     OPT_BRIEF, OPT_PREXIT, OPT_NO_INTERACTIVE, OPT_CRLF, OPT_QUIET, OPT_NBIO,
-    OPT_SSL_CLIENT_ENGINE, OPT_IGN_EOF, OPT_NO_IGN_EOF,
-    OPT_DEBUG, OPT_TLSEXTDEBUG, OPT_WDEBUG,
+    OPT_IGN_EOF, OPT_NO_IGN_EOF, OPT_DEBUG, OPT_TLSEXTDEBUG, OPT_WDEBUG,
 # ifndef OPENSSL_NO_OCSP
     OPT_STATUS, OPT_STATUS_OCSP_CHECK_LEAF, OPT_STATUS_OCSP_CHECK_ALL,
 # endif
-    OPT_MSG, OPT_MSGFILE, OPT_ENGINE, OPT_TRACE, OPT_SECURITY_DEBUG,
+    OPT_MSG, OPT_MSGFILE, OPT_TRACE, OPT_SECURITY_DEBUG,
     OPT_SECURITY_DEBUG_VERBOSE, OPT_SHOWCERTS, OPT_NBIO_TEST, OPT_STATE,
     OPT_PSK_IDENTITY, OPT_PSK, OPT_PSK_SESS,
 #ifndef OPENSSL_NO_SRP
@@ -530,11 +529,6 @@ const OPTIONS s_client_options[] = {
 
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-    {"ssl_client_engine", OPT_SSL_CLIENT_ENGINE, 's',
-     "Specify engine to be used for client certificate operations"},
-#endif
     {"ssl_config", OPT_SSL_CONFIG, 's', "Use specified section for SSL_CTX configuration"},
 #ifndef OPENSSL_NO_CT
     {"ct", OPT_CT, '-', "Request and parse SCTs (also enables OCSP stapling)"},
@@ -578,7 +572,7 @@ const OPTIONS s_client_options[] = {
      "Client certificate chain file (in PEM format)"},
     {"build_chain", OPT_BUILD_CHAIN, '-', "Build client certificate chain"},
     {"key", OPT_KEY, 's', "Private key file to use; default: -cert file"},
-    {"keyform", OPT_KEYFORM, 'E', "Key format (ENGINE, other values ignored)"},
+    {"keyform", OPT_KEYFORM, 'f', "Key format (DER/PEM)"},
     {"pass", OPT_PASS, 's', "Private key and cert file pass phrase source"},
     {"verify", OPT_VERIFY, 'p', "Turn on peer certificate verification"},
     {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
@@ -913,10 +907,6 @@ int s_client_main(int argc, char **argv)
     int enable_timeouts = 0;
     long socket_mtu = 0;
 #endif
-#ifndef OPENSSL_NO_ENGINE
-    ENGINE *ssl_client_engine = NULL;
-#endif
-    ENGINE *e = NULL;
 #if defined(OPENSSL_SYS_WINDOWS) || defined(OPENSSL_SYS_MSDOS)
     struct timeval tv;
 #endif
@@ -1175,18 +1165,6 @@ int s_client_main(int argc, char **argv)
         case OPT_ADV:
             cmdmode = USER_DATA_MODE_ADVANCED;
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 1);
-            break;
-        case OPT_SSL_CLIENT_ENGINE:
-#ifndef OPENSSL_NO_ENGINE
-            ssl_client_engine = setup_engine(opt_arg(), 0);
-            if (ssl_client_engine == NULL) {
-                BIO_printf(bio_err, "Error getting client auth engine\n");
-                goto opthelp;
-            }
-#endif
-            break;
         case OPT_R_CASES:
             if (!opt_rand(o))
                 goto end;
@@ -1771,7 +1749,7 @@ int s_client_main(int argc, char **argv)
         key_file = cert_file;
 
     if (key_file != NULL) {
-        key = load_key(key_file, key_format, 0, pass, e,
+        key = load_key(key_file, key_format, 0, pass,
                        "client certificate private key");
         if (key == NULL)
             goto end;
@@ -1929,16 +1907,6 @@ int s_client_main(int argc, char **argv)
         }
         SSL_CTX_set0_CA_list(ctx, nm);
     }
-#ifndef OPENSSL_NO_ENGINE
-    if (ssl_client_engine) {
-        if (!SSL_CTX_set_client_cert_engine(ctx, ssl_client_engine)) {
-            BIO_puts(bio_err, "Error setting client auth engine\n");
-            release_engine(ssl_client_engine);
-            goto end;
-        }
-        release_engine(ssl_client_engine);
-    }
-#endif
 
 #ifndef OPENSSL_NO_PSK
     if (psk_key != NULL) {
@@ -3344,7 +3312,6 @@ int s_client_main(int argc, char **argv)
     OPENSSL_clear_free(sbuf, BUFSIZZ);
     OPENSSL_clear_free(mbuf, BUFSIZZ);
     clear_free(proxypass);
-    release_engine(e);
     BIO_free(bio_c_out);
     bio_c_out = NULL;
     BIO_free(bio_c_msg);

apps/s_server.c

@@ -939,7 +939,6 @@ static int not_resumable_sess_cb(SSL *s, int is_forward_secure)
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE,
     OPT_4, OPT_6, OPT_ACCEPT, OPT_PORT, OPT_UNIX, OPT_UNLINK, OPT_NACCEPT,
     OPT_VERIFY, OPT_NAMEOPT, OPT_UPPER_V_VERIFY, OPT_CONTEXT, OPT_CERT, OPT_CRL,
     OPT_CRL_DOWNLOAD, OPT_SERVERINFO, OPT_CERTFORM, OPT_KEY, OPT_KEYFORM,
@@ -987,9 +986,6 @@ const OPTIONS s_server_options[] = {
 #ifndef OPENSSL_NO_SSL_TRACE
     {"trace", OPT_TRACE, '-', "trace protocol messages"},
 #endif
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Network"),
     {"port", OPT_PORT, 'p',
@@ -1036,7 +1032,7 @@ const OPTIONS s_server_options[] = {
      "Private key file to use; default is -cert file or else" TEST_CERT},
     {"key2", OPT_KEY2, '<',
      "-Private Key file to use for servername if not in -cert2"},
-    {"keyform", OPT_KEYFORM, 'f', "Key format (ENGINE, other values ignored)"},
+    {"keyform", OPT_KEYFORM, 'f', "Key format (DER/PEM)"},
     {"pass", OPT_PASS, 's', "Private key and cert file pass phrase source"},
     {"dcert", OPT_DCERT, '<',
      "Second server certificate file to use (usually for DSA)"},
@@ -1046,8 +1042,7 @@ const OPTIONS s_server_options[] = {
      "second server certificate chain file in PEM format"},
     {"dkey", OPT_DKEY, '<',
      "Second private key file to use (usually for DSA)"},
-    {"dkeyform", OPT_DKEYFORM, 'f',
-     "Second key file format (ENGINE, other values ignored)"},
+    {"dkeyform", OPT_DKEYFORM, 'f', "Second key file format (DER/PEM)"},
     {"dpass", OPT_DPASS, 's',
      "Second private key and cert file pass phrase source"},
     {"dhparam", OPT_DHPARAM, '<', "DH parameters file to use"},
@@ -1242,7 +1237,6 @@ const OPTIONS s_server_options[] = {
 
 int s_server_main(int argc, char *argv[])
 {
-    ENGINE *engine = NULL;
     EVP_PKEY *s_key = NULL, *s_dkey = NULL;
     SSL_CONF_CTX *cctx = NULL;
     const SSL_METHOD *meth = TLS_server_method();
@@ -1832,11 +1826,6 @@ int s_server_main(int argc, char *argv[])
         case OPT_ID_PREFIX:
             session_id_prefix = opt_arg();
             break;
-        case OPT_ENGINE:
-#ifndef OPENSSL_NO_ENGINE
-            engine = setup_engine(opt_arg(), s_debug);
-#endif
-            break;
         case OPT_R_CASES:
             if (!opt_rand(o))
                 goto end;
@@ -2048,7 +2037,7 @@ int s_server_main(int argc, char *argv[])
         goto end;
 
     if (nocert == 0) {
-        s_key = load_key(s_key_file, s_key_format, 0, pass, engine,
+        s_key = load_key(s_key_file, s_key_format, 0, pass,
                          "server certificate private key");
         if (s_key == NULL)
             goto end;
@@ -2065,7 +2054,7 @@ int s_server_main(int argc, char *argv[])
         }
 
         if (tlsextcbp.servername != NULL) {
-            s_key2 = load_key(s_key_file2, s_key_format, 0, pass, engine,
+            s_key2 = load_key(s_key_file2, s_key_format, 0, pass,
                               "second server certificate private key");
             if (s_key2 == NULL)
                 goto end;
@@ -2111,7 +2100,7 @@ int s_server_main(int argc, char *argv[])
             s_dkey_file = s_dcert_file;
 
         s_dkey = load_key(s_dkey_file, s_dkey_format,
-                          0, dpass, engine, "second certificate private key");
+                          0, dpass, "second certificate private key");
         if (s_dkey == NULL)
             goto end;
 
@@ -2612,7 +2601,6 @@ int s_server_main(int argc, char *argv[])
     ssl_excert_free(exc);
     sk_OPENSSL_STRING_free(ssl_args);
     SSL_CONF_CTX_free(cctx);
-    release_engine(engine);
     BIO_free(bio_s_out);
     bio_s_out = NULL;
     BIO_free(bio_s_msg);

apps/smime.c

@@ -38,7 +38,7 @@ typedef enum OPTION_choice {
     OPT_PK7OUT, OPT_TEXT, OPT_NOINTERN, OPT_NOVERIFY, OPT_NOCHAIN,
     OPT_NOCERTS, OPT_NOATTR, OPT_NODETACH, OPT_NOSMIMECAP,
     OPT_BINARY, OPT_NOSIGS, OPT_STREAM, OPT_INDEF, OPT_NOINDEF,
-    OPT_CRLFEOL, OPT_ENGINE, OPT_PASSIN,
+    OPT_CRLFEOL, OPT_PASSIN,
     OPT_TO, OPT_FROM, OPT_SUBJECT, OPT_SIGNER, OPT_RECIP, OPT_MD,
     OPT_CIPHER, OPT_INKEY, OPT_KEYFORM, OPT_CERTFILE, OPT_CAFILE,
     OPT_CAPATH, OPT_CASTORE, OPT_NOCAFILE, OPT_NOCAPATH, OPT_NOCASTORE,
@@ -60,10 +60,7 @@ const OPTIONS smime_options[] = {
      "Output format SMIME (default), PEM or DER"},
     {"inkey", OPT_INKEY, 's',
      "Input private key (if not signer or recipient)"},
-    {"keyform", OPT_KEYFORM, 'f', "Input private key format (ENGINE, other values ignored)"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
+    {"keyform", OPT_KEYFORM, 'f', "Input private key format (DER/PEM)"},
     {"stream", OPT_STREAM, '-', "Enable CMS streaming" },
     {"indef", OPT_INDEF, '-', "Same as -stream" },
     {"noindef", OPT_NOINDEF, '-', "Disable CMS streaming"},
@@ -182,7 +179,6 @@ int smime_main(int argc, char **argv)
     int informat = FORMAT_SMIME, outformat = FORMAT_SMIME, keyform =
         FORMAT_UNDEF;
     int vpmtouched = 0, rv = 0;
-    ENGINE *e = NULL;
     const char *mime_eol = "\n";
     OSSL_LIB_CTX *libctx = app_get0_libctx();
 
@@ -294,9 +290,6 @@ int smime_main(int argc, char **argv)
             if (conf == NULL)
                 goto end;
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_PASSIN:
             passinarg = opt_arg();
             break;
@@ -520,7 +513,7 @@ int smime_main(int argc, char **argv)
     }
 
     if (keyfile != NULL) {
-        key = load_key(keyfile, keyform, 0, passin, e, "signing key");
+        key = load_key(keyfile, keyform, 0, passin, "signing key");
         if (key == NULL)
             goto end;
     }
@@ -612,7 +605,7 @@ int smime_main(int argc, char **argv)
             signer = load_cert(signerfile, FORMAT_UNDEF, "signer certificate");
             if (signer == NULL)
                 goto end;
-            key = load_key(keyfile, keyform, 0, passin, e, "signing key");
+            key = load_key(keyfile, keyform, 0, passin, "signing key");
             if (key == NULL)
                 goto end;
 
@@ -701,7 +694,6 @@ int smime_main(int argc, char **argv)
     EVP_MD_free(sign_md);
     EVP_CIPHER_free(cipher);
     PKCS7_free(p7);
-    release_engine(e);
     BIO_free(in);
     BIO_free(indata);
     BIO_free_all(out);

apps/speed.c

@@ -233,7 +233,7 @@ static int opt_found(const char *name, unsigned int *result,
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ELAPSED, OPT_EVP, OPT_HMAC, OPT_DECRYPT, OPT_ENGINE, OPT_MULTI,
+    OPT_ELAPSED, OPT_EVP, OPT_HMAC, OPT_DECRYPT, OPT_MULTI,
     OPT_MR, OPT_MB, OPT_MISALIGN, OPT_ASYNCJOBS, OPT_R_ENUM, OPT_PROV_ENUM,
     OPT_CONFIG, OPT_PRIMES, OPT_SECONDS, OPT_BYTES, OPT_AEAD, OPT_CMAC,
     OPT_MLOCK, OPT_TESTMODE, OPT_KEM, OPT_SIG
@@ -257,9 +257,6 @@ const OPTIONS speed_options[] = {
 #ifndef OPENSSL_NO_ASYNC
     {"async_jobs", OPT_ASYNCJOBS, 'p',
      "Enable async mode and start specified number of jobs"},
-#endif
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
 #endif
     {"primes", OPT_PRIMES, 'p', "Specify number of primes (for RSA only)"},
     {"mlock", OPT_MLOCK, '-', "Lock memory for better result determinism"},
@@ -1879,10 +1876,8 @@ static int get_max(const uint8_t doit[], size_t algs_len) {
 int speed_main(int argc, char **argv)
 {
     CONF *conf = NULL;
-    ENGINE *e = NULL;
     loopargs_t *loopargs = NULL;
     const char *prog;
-    const char *engine_id = NULL;
     EVP_CIPHER *evp_cipher = NULL;
     EVP_MAC *mac = NULL;
     double d = 0.0;
@@ -2096,14 +2091,6 @@ int speed_main(int argc, char **argv)
         case OPT_DECRYPT:
             decrypt = 1;
             break;
-        case OPT_ENGINE:
-            /*
-             * In a forked execution, an engine might need to be
-             * initialised by each child process, not by the parent.
-             * So store the name here and run setup_engine() later on.
-             */
-            engine_id = opt_arg();
-            break;
         case OPT_MULTI:
 #ifndef NO_FORK
             multi = opt_int_arg();
@@ -2554,9 +2541,6 @@ int speed_main(int argc, char **argv)
         memset(loopargs[i].buf2_malloc, 0, buflen);
     }
 
-    /* Initialize the engine after the fork */
-    e = setup_engine(engine_id, 0);
-
     /* No parameters; turn on everything. */
     if (argc == 0 && !doit[D_EVP] && !doit[D_HMAC]
         && !doit[D_EVP_CMAC] && !do_kems && !do_sigs) {
@@ -3231,7 +3215,7 @@ int speed_main(int argc, char **argv)
             bn = BN_new();
             st = bn != NULL
                 && BN_set_word(bn, RSA_F4)
-                && init_gen_str(&genctx, "RSA", NULL, 0, NULL, NULL)
+                && init_gen_str(&genctx, "RSA", 0, NULL, NULL)
                 && EVP_PKEY_CTX_set_rsa_keygen_bits(genctx, rsa_keys[testnum].bits) > 0
                 && EVP_PKEY_CTX_set1_rsa_keygen_pubexp(genctx, bn) > 0
                 && EVP_PKEY_CTX_set_rsa_keygen_primes(genctx, primes) > 0
@@ -4784,7 +4768,6 @@ int speed_main(int argc, char **argv)
         ASYNC_cleanup_thread();
     }
     OPENSSL_free(loopargs);
-    release_engine(e);
     EVP_CIPHER_free(evp_cipher);
     EVP_MAC_free(mac);
     NCONF_free(conf);

apps/spkac.c

@@ -23,7 +23,7 @@
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_NOOUT, OPT_PUBKEY, OPT_VERIFY, OPT_IN, OPT_OUT,
-    OPT_ENGINE, OPT_KEY, OPT_CHALLENGE, OPT_PASSIN, OPT_SPKAC,
+    OPT_KEY, OPT_CHALLENGE, OPT_PASSIN, OPT_SPKAC,
     OPT_SPKSECT, OPT_KEYFORM, OPT_DIGEST,
     OPT_PROV_ENUM
 } OPTION_CHOICE;
@@ -33,14 +33,11 @@ const OPTIONS spkac_options[] = {
     {"help", OPT_HELP, '-', "Display this summary"},
     {"spksect", OPT_SPKSECT, 's',
      "Specify the name of an SPKAC-dedicated section of configuration"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Input"),
     {"in", OPT_IN, '<', "Input file"},
     {"key", OPT_KEY, '<', "Create SPKAC using private key"},
-    {"keyform", OPT_KEYFORM, 'f', "Private key file format (ENGINE, other values ignored)"},
+    {"keyform", OPT_KEYFORM, 'f', "Private key file format (DER/PEM)"},
     {"passin", OPT_PASSIN, 's', "Input file pass phrase source"},
     {"challenge", OPT_CHALLENGE, 's', "Challenge string"},
     {"spkac", OPT_SPKAC, 's', "Alternative SPKAC name"},
@@ -60,7 +57,6 @@ int spkac_main(int argc, char **argv)
 {
     BIO *out = NULL;
     CONF *conf = NULL;
-    ENGINE *e = NULL;
     EVP_PKEY *pkey = NULL;
     NETSCAPE_SPKI *spki = NULL;
     char *challenge = NULL, *keyfile = NULL;
@@ -122,9 +118,6 @@ int spkac_main(int argc, char **argv)
         case OPT_DIGEST:
             digest = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_PROV_CASES:
             if (!opt_provider(o))
                 goto end;
@@ -146,7 +139,7 @@ int spkac_main(int argc, char **argv)
             goto end;
 
         pkey = load_key(strcmp(keyfile, "-") ? keyfile : NULL,
-                        keyformat, 1, passin, e, "private key");
+                        keyformat, 1, passin, "private key");
         if (pkey == NULL)
             goto end;
         spki = NETSCAPE_SPKI_new();
@@ -227,7 +220,6 @@ int spkac_main(int argc, char **argv)
     NETSCAPE_SPKI_free(spki);
     BIO_free_all(out);
     EVP_PKEY_free(pkey);
-    release_engine(e);
     OPENSSL_free(passin);
     return ret;
 }

apps/srp.c

@@ -193,7 +193,7 @@ typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_VERBOSE, OPT_CONFIG, OPT_NAME, OPT_SRPVFILE, OPT_ADD,
     OPT_DELETE, OPT_MODIFY, OPT_LIST, OPT_GN, OPT_USERINFO,
-    OPT_PASSIN, OPT_PASSOUT, OPT_ENGINE, OPT_R_ENUM, OPT_PROV_ENUM
+    OPT_PASSIN, OPT_PASSOUT, OPT_R_ENUM, OPT_PROV_ENUM
 } OPTION_CHOICE;
 
 const OPTIONS srp_options[] = {
@@ -204,9 +204,6 @@ const OPTIONS srp_options[] = {
     {"verbose", OPT_VERBOSE, '-', "Talk a lot while doing things"},
     {"config", OPT_CONFIG, '<', "A config file"},
     {"name", OPT_NAME, 's', "The particular srp definition to use"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Action"),
     {"add", OPT_ADD, '-', "Add a user and SRP verifier"},
@@ -231,7 +228,6 @@ const OPTIONS srp_options[] = {
 
 int srp_main(int argc, char **argv)
 {
-    ENGINE *e = NULL;
     CA_DB *db = NULL;
     CONF *conf = NULL;
     int gNindex = -1, maxgN = -1, ret = 1, errors = 0, verbose = 0, i;
@@ -291,9 +287,6 @@ int srp_main(int argc, char **argv)
         case OPT_PASSOUT:
             passoutarg = opt_arg();
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_R_CASES:
             if (!opt_rand(o))
                 goto end;
@@ -626,6 +619,5 @@ int srp_main(int argc, char **argv)
         ERR_print_errors(bio_err);
     NCONF_free(conf);
     free_index(db);
-    release_engine(e);
     return ret;
 }

apps/storeutl.c

@@ -25,7 +25,7 @@ static BIO *out = NULL;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_OUT, OPT_PASSIN,
+    OPT_OUT, OPT_PASSIN,
     OPT_NOOUT, OPT_TEXT, OPT_RECURSIVE,
     OPT_SEARCHFOR_CERTS, OPT_SEARCHFOR_KEYS, OPT_SEARCHFOR_CRLS,
     OPT_CRITERION_SUBJECT, OPT_CRITERION_ISSUER, OPT_CRITERION_SERIAL,
@@ -39,9 +39,6 @@ const OPTIONS storeutl_options[] = {
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
     {"", OPT_MD, '-', "Any supported digest"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
 
     OPT_SECTION("Search"),
     {"certs", OPT_SEARCHFOR_CERTS, '-', "Search for certificates only"},
@@ -73,7 +70,6 @@ int storeutl_main(int argc, char *argv[])
 {
     int ret = 1, noout = 0, text = 0, recursive = 0;
     char *outfile = NULL, *passin = NULL, *passinarg = NULL;
-    ENGINE *e = NULL;
     OPTION_CHOICE o;
     char *prog;
     PW_CB_DATA pw_cb_data;
@@ -243,9 +239,6 @@ int storeutl_main(int argc, char *argv[])
                 goto end;
             }
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_MD:
             digestname = opt_unknown();
             break;
@@ -324,7 +317,6 @@ int storeutl_main(int argc, char *argv[])
     OSSL_STORE_SEARCH_free(search);
     BIO_free_all(out);
     OPENSSL_free(passin);
-    release_engine(e);
     return ret;
 }
 

apps/ts.c

@@ -46,13 +46,13 @@ static int create_digest(BIO *input, const char *digest,
 static ASN1_INTEGER *create_nonce(int bits);
 
 /* Reply related functions. */
-static int reply_command(CONF *conf, const char *section, const char *engine,
+static int reply_command(CONF *conf, const char *section,
                          const char *queryfile, const char *passin, const char *inkey,
                          const EVP_MD *md, const char *signer, const char *chain,
                          const char *policy, const char *in, int token_in,
                          const char *out, int token_out, int text);
 static TS_RESP *read_PKCS7(BIO *in_bio);
-static TS_RESP *create_response(CONF *conf, const char *section, const char *engine,
+static TS_RESP *create_response(CONF *conf, const char *section,
                                 const char *queryfile, const char *passin,
                                 const char *inkey, const EVP_MD *md, const char *signer,
                                 const char *chain, const char *policy);
@@ -78,7 +78,7 @@ static int verify_cb(int ok, X509_STORE_CTX *ctx);
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_CONFIG, OPT_SECTION, OPT_QUERY, OPT_DATA,
+    OPT_CONFIG, OPT_SECTION, OPT_QUERY, OPT_DATA,
     OPT_DIGEST, OPT_TSPOLICY, OPT_NO_NONCE, OPT_CERT,
     OPT_IN, OPT_TOKEN_IN, OPT_OUT, OPT_TOKEN_OUT, OPT_TEXT,
     OPT_REPLY, OPT_QUERYFILE, OPT_PASSIN, OPT_INKEY, OPT_SIGNER,
@@ -91,9 +91,6 @@ const OPTIONS ts_options[] = {
     {"help", OPT_HELP, '-', "Display this summary"},
     {"config", OPT_CONFIG, '<', "Configuration file"},
     {"section", OPT_SECTION, 's', "Section to use within config file"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
     {"inkey", OPT_INKEY, 's', "File with private key for reply"},
     {"signer", OPT_SIGNER, 's', "Signer certificate file"},
     {"chain", OPT_CHAIN, '<', "File with signer CA chain"},
@@ -143,11 +140,7 @@ static char* opt_helplist[] = {
     "    [-signer tsa_cert.pem] [-inkey private_key.pem]",
     "    [-chain certs_file.pem] [-tspolicy oid]",
     "    [-in file] [-token_in] [-out file] [-token_out]",
-#ifndef OPENSSL_NO_ENGINE
-    "    [-text] [-engine id]",
-#else
     "    [-text]",
-#endif
     "",
     " openssl ts -verify -CApath dir -CAfile root-cert.pem -CAstore uri",
     "   -untrusted extra-certs.pem [-data file] [-digest hexstring]",
@@ -160,7 +153,7 @@ int ts_main(int argc, char **argv)
     CONF *conf = NULL;
     const char *CAfile = NULL, *prog;
     char *untrusted = NULL;
-    const char *configfile = default_config_file, *engine = NULL;
+    const char *configfile = default_config_file;
     const char *section = NULL, *digestname = NULL;
     char **helpp;
     char *password = NULL;
@@ -276,9 +269,6 @@ int ts_main(int argc, char **argv)
         case OPT_UNTRUSTED:
             untrusted = opt_arg();
             break;
-        case OPT_ENGINE:
-            engine = opt_arg();
-            break;
         case OPT_MD:
             digestname = opt_unknown();
             break;
@@ -331,7 +321,7 @@ int ts_main(int argc, char **argv)
             if ((conf == NULL) || (token_in != 0))
                 goto opthelp;
         }
-        ret = !reply_command(conf, section, engine, queryfile,
+        ret = !reply_command(conf, section, queryfile,
                              password, inkey, md, signer, chain, policy,
                              in, token_in, out, token_out, text);
 
@@ -587,7 +577,7 @@ static ASN1_INTEGER *create_nonce(int bits)
  * Reply-related method definitions.
  */
 
-static int reply_command(CONF *conf, const char *section, const char *engine,
+static int reply_command(CONF *conf, const char *section,
                          const char *queryfile, const char *passin, const char *inkey,
                          const EVP_MD *md, const char *signer, const char *chain,
                          const char *policy, const char *in, int token_in,
@@ -610,7 +600,7 @@ static int reply_command(CONF *conf, const char *section, const char *engine,
             response = d2i_TS_RESP_bio(in_bio, NULL);
         }
     } else {
-        response = create_response(conf, section, engine, queryfile,
+        response = create_response(conf, section, queryfile,
                                    passin, inkey, md, signer, chain, policy);
         if (response != NULL)
             BIO_printf(bio_err, "Response has been generated.\n");
@@ -695,7 +685,7 @@ static TS_RESP *read_PKCS7(BIO *in_bio)
     return resp;
 }
 
-static TS_RESP *create_response(CONF *conf, const char *section, const char *engine,
+static TS_RESP *create_response(CONF *conf, const char *section,
                                 const char *queryfile, const char *passin,
                                 const char *inkey, const EVP_MD *md, const char *signer,
                                 const char *chain, const char *policy)
@@ -713,10 +703,6 @@ static TS_RESP *create_response(CONF *conf, const char *section, const char *eng
         goto end;
     if (!TS_CONF_set_serial(conf, section, serial_cb, resp_ctx))
         goto end;
-#ifndef OPENSSL_NO_ENGINE
-    if (!TS_CONF_set_crypto_device(conf, section, engine))
-        goto end;
-#endif
     if (!TS_CONF_set_signer_cert(conf, section, signer, resp_ctx))
         goto end;
     if (!TS_CONF_set_certs(conf, section, chain, resp_ctx))

apps/verify.c

@@ -27,7 +27,7 @@ static int v_verbose = 0, vflags = 0;
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_ENGINE, OPT_CAPATH, OPT_CAFILE, OPT_CASTORE,
+    OPT_CAPATH, OPT_CAFILE, OPT_CASTORE,
     OPT_NOCAPATH, OPT_NOCAFILE, OPT_NOCASTORE,
     OPT_UNTRUSTED, OPT_TRUSTED, OPT_CRLFILE, OPT_CRL_DOWNLOAD, OPT_SHOW_CHAIN,
     OPT_V_ENUM, OPT_NAMEOPT, OPT_VFYOPT,
@@ -40,9 +40,6 @@ const OPTIONS verify_options[] = {
 
     OPT_SECTION("General"),
     {"help", OPT_HELP, '-', "Display this summary"},
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
     {"verbose", OPT_VERBOSE, '-',
         "Print extra information about the operations being performed."},
     {"nameopt", OPT_NAMEOPT, 's', "Certificate subject/issuer name printing options"},
@@ -78,7 +75,6 @@ const OPTIONS verify_options[] = {
 
 int verify_main(int argc, char **argv)
 {
-    ENGINE *e = NULL;
     STACK_OF(X509) *untrusted = NULL, *trusted = NULL;
     STACK_OF(X509_CRL) *crls = NULL;
     STACK_OF(OPENSSL_STRING) *vfyopts = NULL;
@@ -165,12 +161,6 @@ int verify_main(int argc, char **argv)
         case OPT_CRL_DOWNLOAD:
             crl_download = 1;
             break;
-        case OPT_ENGINE:
-            if ((e = setup_engine(opt_arg(), 0)) == NULL) {
-                /* Failure message already displayed */
-                goto end;
-            }
-            break;
         case OPT_SHOW_CHAIN:
             show_chain = 1;
             break;
@@ -238,7 +228,6 @@ int verify_main(int argc, char **argv)
     OSSL_STACK_OF_X509_free(trusted);
     sk_X509_CRL_pop_free(crls, X509_CRL_free);
     sk_OPENSSL_STRING_free(vfyopts);
-    release_engine(e);
     return (ret < 0 ? 2 : ret);
 }
 

apps/version.c

@@ -18,7 +18,7 @@
 
 typedef enum OPTION_choice {
     OPT_COMMON,
-    OPT_B, OPT_D, OPT_E, OPT_M, OPT_F, OPT_O, OPT_P, OPT_V, OPT_A, OPT_R, OPT_C
+    OPT_B, OPT_D, OPT_M, OPT_F, OPT_O, OPT_P, OPT_V, OPT_A, OPT_R, OPT_C
 #if defined(_WIN32)
     ,OPT_W
 #endif
@@ -32,7 +32,6 @@ const OPTIONS version_options[] = {
     {"a", OPT_A, '-', "Show all data"},
     {"b", OPT_B, '-', "Show build date"},
     {"d", OPT_D, '-', "Show configuration directory"},
-    {"e", OPT_E, '-', "Show engines directory"},
     {"m", OPT_M, '-', "Show modules directory"},
     {"f", OPT_F, '-', "Show compiler flags used"},
     {"o", OPT_O, '-', "Show some internal datatype options"},
@@ -50,7 +49,7 @@ int version_main(int argc, char **argv)
 {
     int ret = 1, dirty = 0, seed = 0;
     int cflags = 0, version = 0, date = 0, options = 0, platform = 0, dir = 0;
-    int engdir = 0, moddir = 0, cpuinfo = 0;
+    int moddir = 0, cpuinfo = 0;
 #if defined(_WIN32)
     int windows = 0;
 #endif
@@ -75,9 +74,6 @@ opthelp:
         case OPT_D:
             dirty = dir = 1;
             break;
-        case OPT_E:
-            dirty = engdir = 1;
-            break;
         case OPT_M:
             dirty = moddir = 1;
             break;
@@ -106,7 +102,7 @@ opthelp:
 #endif
         case OPT_A:
             seed = options = cflags = version = date = platform
-                = dir = engdir = moddir = cpuinfo
+                = dir = moddir = cpuinfo
                 = 1;
             break;
         }
@@ -135,8 +131,6 @@ opthelp:
         printf("%s\n", OpenSSL_version(OPENSSL_CFLAGS));
     if (dir)
         printf("%s\n", OpenSSL_version(OPENSSL_DIR));
-    if (engdir)
-        printf("%s\n", OpenSSL_version(OPENSSL_ENGINES_DIR));
     if (moddir)
         printf("%s\n", OpenSSL_version(OPENSSL_MODULES_DIR));
     if (seed) {

apps/x509.c

@@ -53,7 +53,7 @@ typedef enum OPTION_choice {
     OPT_CHECKEMAIL, OPT_CHECKIP, OPT_NOOUT, OPT_TRUSTOUT, OPT_CLRTRUST,
     OPT_CLRREJECT, OPT_ALIAS, OPT_CACREATESERIAL, OPT_CLREXT, OPT_OCSPID,
     OPT_SUBJECT_HASH_OLD, OPT_ISSUER_HASH_OLD, OPT_COPY_EXTENSIONS,
-    OPT_BADSIG, OPT_MD, OPT_ENGINE, OPT_NOCERT, OPT_PRESERVE_DATES,
+    OPT_BADSIG, OPT_MD, OPT_NOCERT, OPT_PRESERVE_DATES,
     OPT_NOT_BEFORE, OPT_NOT_AFTER,
     OPT_R_ENUM, OPT_PROV_ENUM, OPT_EXT
 } OPTION_CHOICE;
@@ -78,8 +78,7 @@ const OPTIONS x509_options[] = {
      "Key for signing, and to include unless using -force_pubkey"},
     {"signkey", OPT_SIGNKEY, 's',
      "Same as -key"},
-    {"keyform", OPT_KEYFORM, 'E',
-     "Key input format (ENGINE, other values ignored)"},
+    {"keyform", OPT_KEYFORM, 'f', "Key input format (DER/PEM)"},
     {"out", OPT_OUT, '>', "Output file - default stdout"},
     {"outform", OPT_OUTFORM, 'f',
      "Output format (DER or PEM) - default PEM"},
@@ -165,8 +164,7 @@ const OPTIONS x509_options[] = {
      "Use the given CA certificate, conflicts with -key"},
     {"CAform", OPT_CAFORM, 'F', "CA cert format (PEM/DER/P12); has no effect"},
     {"CAkey", OPT_CAKEY, 's', "The corresponding CA key; default is -CA arg"},
-    {"CAkeyform", OPT_CAKEYFORM, 'E',
-     "CA key format (ENGINE, other values ignored)"},
+    {"CAkeyform", OPT_CAKEYFORM, 'f', "CA key format (DER/PEM)"},
     {"CAserial", OPT_CASERIAL, 's',
      "File that keeps track of CA-generated serial number"},
     {"CAcreateserial", OPT_CACREATESERIAL, '-',
@@ -183,9 +181,6 @@ const OPTIONS x509_options[] = {
      "Reject certificate for a given purpose"},
 
     OPT_R_OPTIONS,
-#ifndef OPENSSL_NO_ENGINE
-    {"engine", OPT_ENGINE, 's', "Use engine, possibly a hardware device"},
-#endif
     OPT_PROV_OPTIONS,
     {NULL}
 };
@@ -303,7 +298,6 @@ int x509_main(int argc, char **argv)
     unsigned long certflag = 0;
     int preserve_dates = 0;
     OPTION_CHOICE o;
-    ENGINE *e = NULL;
 #ifndef OPENSSL_NO_MD5
     int subject_hash_old = 0, issuer_hash_old = 0;
 #endif
@@ -483,9 +477,6 @@ int x509_main(int argc, char **argv)
             if (!set_nameopt(opt_arg()))
                 goto opthelp;
             break;
-        case OPT_ENGINE:
-            e = setup_engine(opt_arg(), 0);
-            break;
         case OPT_EMAIL:
             email = ++num;
             break;
@@ -663,12 +654,12 @@ int x509_main(int argc, char **argv)
         goto err;
     }
     if (privkeyfile != NULL) {
-        privkey = load_key(privkeyfile, keyformat, 0, passin, e, "private key");
+        privkey = load_key(privkeyfile, keyformat, 0, passin, "private key");
         if (privkey == NULL)
             goto err;
     }
     if (pubkeyfile != NULL) {
-        if ((pubkey = load_pubkey(pubkeyfile, keyformat, 0, NULL, e,
+        if ((pubkey = load_pubkey(pubkeyfile, keyformat, 0, NULL,
                                   "explicitly set public key")) == NULL)
             goto err;
     }
@@ -956,7 +947,7 @@ int x509_main(int argc, char **argv)
         noout = 1;
     } else if (CAfile != NULL) {
         if ((CAkey = load_key(CAkeyfile, CAkeyformat,
-                              0, passin, e, "CA private key")) == NULL)
+                              0, passin, "CA private key")) == NULL)
             goto err;
         if (!X509_check_private_key(xca, CAkey)) {
             BIO_printf(bio_err,
@@ -1172,7 +1163,6 @@ int x509_main(int argc, char **argv)
     ASN1_INTEGER_free(sno);
     sk_ASN1_OBJECT_pop_free(trust, ASN1_OBJECT_free);
     sk_ASN1_OBJECT_pop_free(reject, ASN1_OBJECT_free);
-    release_engine(e);
     clear_free(passin);
     return ret;
 }

build.info

@@ -8,9 +8,6 @@ ENDIF
 IF[{- !$disabled{demos} -}]
   SUBDIRS=demos
 ENDIF
-IF[{- !$disabled{'deprecated-3.0'} -}]
-  SUBDIRS=engines
-ENDIF
 SUBDIRS=exporters
 
 LIBS=libcrypto libssl
@@ -463,7 +460,7 @@ DEPEND[openssl.pc]=libcrypto.pc libssl.pc
 GENERATE[builddata.pm]=util/mkinstallvars.pl \
     PREFIX=. BINDIR=apps APPLINKDIR=ms \
     LIBDIR= INCLUDEDIR=include "INCLUDEDIR=$(SRCDIR)/include" \
-    ENGINESDIR=engines MODULESDIR=providers \
+    MODULESDIR=providers \
     libdir= CMAKECONFIGDIR= PKGCONFIGDIR= \
     "VERSION=$(VERSION)" "LDLIBS=$(LIB_EX_LIBS)"
 

crypto/asn1/a_digest.c

@@ -7,16 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
 #include <stdio.h>
 #include <time.h>
 #include <sys/types.h>
 
 #include "internal/cryptlib.h"
 
-#include <openssl/engine.h>
 #include <openssl/err.h>
 #include <openssl/evp.h>
 #include <openssl/buffer.h>
@@ -63,16 +59,8 @@ int ossl_asn1_item_digest_ex(const ASN1_ITEM *it, const EVP_MD *md, void *asn,
     if (i < 0 || str == NULL)
         return 0;
 
-    if (EVP_MD_get0_provider(md) == NULL) {
-#if !defined(OPENSSL_NO_ENGINE)
-        ENGINE *tmpeng = ENGINE_get_digest_engine(EVP_MD_get_type(md));
-
-        if (tmpeng != NULL)
-            ENGINE_finish(tmpeng);
-        else
-#endif
-            fetched_md = EVP_MD_fetch(libctx, EVP_MD_get0_name(md), propq);
-    }
+    if (EVP_MD_get0_provider(md) == NULL)
+        fetched_md = EVP_MD_fetch(libctx, EVP_MD_get0_name(md), propq);
     if (fetched_md == NULL)
         goto err;
 

crypto/asn1/ameth_lib.c

@@ -8,7 +8,7 @@
  */
 
 /*
- * We need to use some engine deprecated APIs
+ * We need to use some EVP_PKEY_asn1 deprecated APIs
  */
 #include "internal/deprecated.h"
 
@@ -16,7 +16,6 @@
 #include <stdio.h>
 #include <openssl/asn1t.h>
 #include <openssl/x509.h>
-#include <openssl/engine.h>
 #include "crypto/asn1.h"
 #include "crypto/evp.h"
 
@@ -75,11 +74,10 @@ static const EVP_PKEY_ASN1_METHOD *pkey_asn1_find(int type)
 }
 
 /*
- * Find an implementation of an ASN1 algorithm. If 'pe' is not NULL also
- * search through engines and set *pe to a functional reference to the engine
- * implementing 'type' or NULL if no engine implements it.
+ * Return ASN1 method for desired `type`, returns NULL if no method is found for
+ * `type`. If pe is not NULL, the function will set *pe to NULL to indicate no
+ * engine is used.
  */
-
 const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find(ENGINE **pe, int type)
 {
     const EVP_PKEY_ASN1_METHOD *t;
@@ -91,15 +89,6 @@ const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find(ENGINE **pe, int type)
         type = t->pkey_base_id;
     }
     if (pe) {
-#ifndef OPENSSL_NO_ENGINE
-        ENGINE *e;
-        /* type will contain the final unaliased type */
-        e = ENGINE_get_pkey_asn1_meth_engine(type);
-        if (e) {
-            *pe = e;
-            return ENGINE_get_pkey_asn1_meth(e, type);
-        }
-#endif
         *pe = NULL;
     }
     return t;
@@ -114,20 +103,6 @@ const EVP_PKEY_ASN1_METHOD *EVP_PKEY_asn1_find_str(ENGINE **pe,
     if (len == -1)
         len = (int)strlen(str);
     if (pe) {
-#ifndef OPENSSL_NO_ENGINE
-        ENGINE *e;
-        ameth = ENGINE_pkey_asn1_find_str(&e, str, len);
-        if (ameth) {
-            /*
-             * Convert structural into functional reference
-             */
-            if (!ENGINE_init(e))
-                ameth = NULL;
-            ENGINE_free(e);
-            *pe = e;
-            return ameth;
-        }
-#endif
         *pe = NULL;
     }
     for (i = EVP_PKEY_asn1_get_count(); i-- > 0; ) {

crypto/asn1/d2i_pr.c

@@ -7,16 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
 #include <stdio.h>
 #include "internal/cryptlib.h"
 #include <openssl/bn.h>
 #include <openssl/evp.h>
 #include <openssl/objects.h>
 #include <openssl/decoder.h>
-#include <openssl/engine.h>
 #include <openssl/x509.h>
 #include <openssl/asn1.h>
 #include "crypto/asn1.h"
@@ -112,10 +108,6 @@ ossl_d2i_PrivateKey_legacy(int keytype, EVP_PKEY **a, const unsigned char **pp,
         }
     } else {
         ret = *a;
-#ifndef OPENSSL_NO_ENGINE
-        ENGINE_finish(ret->engine);
-        ret->engine = NULL;
-#endif
     }
 
     if (!EVP_PKEY_set_type(ret, keytype)) {

crypto/build.info

@@ -4,7 +4,7 @@ SUBDIRS=objects buffer bio stack lhash hashtable rand evp asn1 pem x509 conf \
         txt_db pkcs7 pkcs12 ui kdf store property \
         md2 md4 md5 sha mdc2 ml_kem hmac ripemd whrlpool poly1305 \
         siphash sm3 des aes rc2 rc4 rc5 idea aria bf cast camellia \
-        seed sm4 chacha modes bn ec rsa dsa dh sm2 dso engine \
+        seed sm4 chacha modes bn ec rsa dsa dh sm2 dso \
         err comp http ocsp cms ts srp cmac ct async ess crmf cmp encode_decode \
         ffc hpke thread lms ml_dsa slh_dsa
 

crypto/cmac/cmac.c

@@ -20,6 +20,7 @@
 #include <openssl/cmac.h>
 #include <openssl/err.h>
 #include "crypto/cmac.h"
+#include "internal/common.h"
 
 #define LOCAL_BUF_SIZE 2048
 struct CMAC_CTX_st {
@@ -109,14 +110,13 @@ int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in)
 }
 
 int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen,
-                   const EVP_CIPHER *cipher, ENGINE *impl,
-                   const OSSL_PARAM param[])
+                   const EVP_CIPHER *cipher, const OSSL_PARAM param[])
 {
     static const unsigned char zero_iv[EVP_MAX_BLOCK_LENGTH] = { 0 };
     int block_len;
 
     /* All zeros means restart */
-    if (!key && !cipher && !impl && keylen == 0) {
+    if (key == NULL && cipher == NULL && keylen == 0) {
         /* Not initialised */
         if (ctx->nlast_block == -1)
             return 0;
@@ -133,13 +133,8 @@ int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen,
     if (cipher != NULL) {
         /* Ensure we can't use this ctx until we also have a key */
         ctx->nlast_block = -1;
-        if (impl != NULL) {
-            if (!EVP_EncryptInit_ex(ctx->cctx, cipher, impl, NULL, NULL))
-                return 0;
-        } else {
-            if (!EVP_EncryptInit_ex2(ctx->cctx, cipher, NULL, NULL, param))
-                return 0;
-        }
+        if (!EVP_EncryptInit_ex2(ctx->cctx, cipher, NULL, NULL, param))
+            return 0;
     }
     /* Non-NULL key means initialisation complete */
     if (key != NULL) {
@@ -174,7 +169,9 @@ int ossl_cmac_init(CMAC_CTX *ctx, const void *key, size_t keylen,
 int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
               const EVP_CIPHER *cipher, ENGINE *impl)
 {
-    return ossl_cmac_init(ctx, key, keylen, cipher, impl, NULL);
+    if (!ossl_assert(impl == NULL))
+        return 0;
+    return ossl_cmac_init(ctx, key, keylen, cipher, NULL);
 }
 
 int CMAC_Update(CMAC_CTX *ctx, const void *in, size_t dlen)

crypto/conf/conf_mall.c

@@ -7,16 +7,12 @@
  * https://www.openssl.org/source/license.html
  */
 
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
 #include <stdio.h>
 #include <openssl/crypto.h>
 #include "internal/cryptlib.h"
 #include <openssl/conf.h>
 #include <openssl/x509.h>
 #include <openssl/asn1.h>
-#include <openssl/engine.h>
 #include "internal/provider.h"
 #include "crypto/rand.h"
 #include "conf_local.h"
@@ -28,9 +24,6 @@ void OPENSSL_load_builtin_modules(void)
     /* Add builtin modules here */
     ASN1_add_oid_module();
     ASN1_add_stable_module();
-#ifndef OPENSSL_NO_ENGINE
-    ENGINE_add_conf_module();
-#endif
     EVP_add_alg_module();
     ossl_config_add_ssl_module();
     ossl_provider_add_conf_module();

crypto/conf/conf_mod.c

@@ -7,9 +7,6 @@
  * https://www.openssl.org/source/license.html
  */
 
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
 #include "internal/cryptlib.h"
 #include "internal/rcu.h"
 #include <stdio.h>
@@ -22,7 +19,6 @@
 #include "internal/thread_once.h"
 #include <openssl/x509.h>
 #include <openssl/trace.h>
-#include <openssl/engine.h>
 #include "conf_local.h"
 
 DEFINE_STACK_OF(CONF_MODULE)
@@ -219,10 +215,6 @@ int CONF_modules_load_file(const char *filename,
 DEFINE_RUN_ONCE_STATIC(do_load_builtin_modules)
 {
     OPENSSL_load_builtin_modules();
-#ifndef OPENSSL_NO_ENGINE
-    /* Need to load ENGINEs */
-    ENGINE_load_builtin_engines();
-#endif
     return 1;
 }
 

crypto/conf/conf_sap.c

@@ -14,7 +14,6 @@
 #include "conf_local.h"
 #include <openssl/x509.h>
 #include <openssl/asn1.h>
-#include <openssl/engine.h>
 
 #if defined(_WIN32) && !defined(__BORLANDC__)
 # define strdup _strdup

crypto/cversion.c

@@ -52,9 +52,6 @@ extern char ossl_cpu_info_str[];
 /* size: MAX_PATH + sizeof("OPENSSLDIR: \"\"") */
 static char openssldir[MAX_PATH + 15];
 
-/* size: MAX_PATH + sizeof("ENGINESDIR: \"\"") */
-static char enginesdir[MAX_PATH + 15];
-
 /* size: MAX_PATH + sizeof("MODULESDIR: \"\"") */
 static char modulesdir[MAX_PATH + 15];
 
@@ -64,8 +61,6 @@ DEFINE_RUN_ONCE_STATIC(version_strings_setup)
 {
     BIO_snprintf(openssldir, sizeof(openssldir), "OPENSSLDIR: \"%s\"",
                  ossl_get_openssldir());
-    BIO_snprintf(enginesdir, sizeof(enginesdir), "ENGINESDIR: \"%s\"",
-                 ossl_get_enginesdir());
     BIO_snprintf(modulesdir, sizeof(modulesdir), "MODULESDIR: \"%s\"",
                  ossl_get_modulesdir());
     return 1;
@@ -99,8 +94,6 @@ const char *OpenSSL_version(int t)
 #if defined(_WIN32) && defined(OSSL_WINCTX)
     case OPENSSL_DIR:
         return openssldir;
-    case OPENSSL_ENGINES_DIR:
-        return enginesdir;
     case OPENSSL_MODULES_DIR:
         return modulesdir;
 #else
@@ -109,12 +102,6 @@ const char *OpenSSL_version(int t)
         return "OPENSSLDIR: \"" OPENSSLDIR "\"";
 # else
         return "OPENSSLDIR: N/A";
-# endif
-    case OPENSSL_ENGINES_DIR:
-# ifdef ENGINESDIR
-        return "ENGINESDIR: \"" ENGINESDIR "\"";
-# else
-        return "ENGINESDIR: N/A";
 # endif
     case OPENSSL_MODULES_DIR:
 # ifdef MODULESDIR
@@ -134,6 +121,8 @@ const char *OpenSSL_version(int t)
 #else
         return "OSSL_WINCTX: Undefined";
 #endif
+    case OPENSSL_ENGINES_DIR:
+        return "ENGINESDIR: N/A";
     }
     return "not available";
 }

crypto/defaults.c

@@ -32,17 +32,6 @@ static char openssldir[MAX_PATH + 1];
  */
 static char *openssldirptr = NULL;
 
-/**
- * @brief The directory where OpenSSL engines are located.
- */
-
-static char enginesdir[MAX_PATH + 1];
-
-/**
- * @brief The pointer to the enginesdir buffer
- */
-static char *enginesdirptr = NULL;
-
 /**
  * @brief The directory where OpenSSL modules are located.
  */
@@ -122,7 +111,6 @@ static CRYPTO_ONCE defaults_setup_init = CRYPTO_ONCE_STATIC_INIT;
 DEFINE_RUN_ONCE_STATIC(do_defaults_setup)
 {
     get_windows_regdirs(openssldir, sizeof(openssldir), L"OPENSSLDIR");
-    get_windows_regdirs(enginesdir, sizeof(enginesdir), L"ENGINESDIR");
     get_windows_regdirs(modulesdir, sizeof(modulesdir), L"MODULESDIR");
 
     /*
@@ -131,9 +119,6 @@ DEFINE_RUN_ONCE_STATIC(do_defaults_setup)
     if (strlen(openssldir) > 0)
         openssldirptr = openssldir;
 
-    if (strlen(enginesdir) > 0)
-        enginesdirptr = enginesdir;
-
     if (strlen(modulesdir) > 0)
         modulesdirptr = modulesdir;
 
@@ -157,22 +142,6 @@ const char *ossl_get_openssldir(void)
 #endif
 }
 
-/**
- * @brief Get the directory where OpenSSL engines are located.
- *
- * @return A pointer to a string containing the engines directory path.
- */
-const char *ossl_get_enginesdir(void)
-{
-#if defined(_WIN32) && defined (OSSL_WINCTX)
-    if (!RUN_ONCE(&defaults_setup_init, do_defaults_setup))
-        return NULL;
-    return (const char *)enginesdirptr;
-#else
-    return ENGINESDIR;
-#endif
-}
-
 /**
  * @brief Get the directory where OpenSSL modules are located.
  *

crypto/dh/dh_backend.c

@@ -124,7 +124,7 @@ int ossl_dh_key_todata(DH *dh, OSSL_PARAM_BLD *bld, OSSL_PARAM *pubkey,
 int ossl_dh_is_foreign(const DH *dh)
 {
 #ifndef FIPS_MODULE
-    if (dh->engine != NULL || ossl_dh_get_method(dh) != DH_OpenSSL())
+    if (ossl_dh_get_method(dh) != DH_OpenSSL())
         return 1;
 #endif
     return 0;

crypto/dh/dh_lib.c

@@ -15,18 +15,16 @@
 
 #include <stdio.h>
 #include <openssl/bn.h>
-#ifndef FIPS_MODULE
-# include <openssl/engine.h>
-#endif
 #include <openssl/obj_mac.h>
 #include <openssl/core_names.h>
 #include "internal/cryptlib.h"
 #include "internal/refcount.h"
+#include "internal/common.h"
 #include "crypto/evp.h"
 #include "crypto/dh.h"
 #include "dh_local.h"
 
-static DH *dh_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx);
+static DH *dh_new_intern(OSSL_LIB_CTX *libctx);
 
 #ifndef FIPS_MODULE
 int DH_set_method(DH *dh, const DH_METHOD *meth)
@@ -39,10 +37,6 @@ int DH_set_method(DH *dh, const DH_METHOD *meth)
     mtmp = dh->meth;
     if (mtmp->finish)
         mtmp->finish(dh);
-#ifndef OPENSSL_NO_ENGINE
-    ENGINE_finish(dh->engine);
-    dh->engine = NULL;
-#endif
     dh->meth = meth;
     if (meth->init)
         meth->init(dh);
@@ -56,22 +50,24 @@ const DH_METHOD *ossl_dh_get_method(const DH *dh)
 # ifndef OPENSSL_NO_DEPRECATED_3_0
 DH *DH_new(void)
 {
-    return dh_new_intern(NULL, NULL);
+    return dh_new_intern(NULL);
 }
 # endif
 
 DH *DH_new_method(ENGINE *engine)
 {
-    return dh_new_intern(engine, NULL);
+    if (!ossl_assert(engine == NULL))
+        return NULL;
+    return dh_new_intern(NULL);
 }
 #endif /* !FIPS_MODULE */
 
 DH *ossl_dh_new_ex(OSSL_LIB_CTX *libctx)
 {
-    return dh_new_intern(NULL, libctx);
+    return dh_new_intern(libctx);
 }
 
-static DH *dh_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx)
+static DH *dh_new_intern(OSSL_LIB_CTX *libctx)
 {
     DH *ret = OPENSSL_zalloc(sizeof(*ret));
 
@@ -93,25 +89,6 @@ static DH *dh_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx)
 
     ret->libctx = libctx;
     ret->meth = DH_get_default_method();
-#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
-    ret->flags = ret->meth->flags;  /* early default init */
-    if (engine) {
-        if (!ENGINE_init(engine)) {
-            ERR_raise(ERR_LIB_DH, ERR_R_ENGINE_LIB);
-            goto err;
-        }
-        ret->engine = engine;
-    } else
-        ret->engine = ENGINE_get_default_DH();
-    if (ret->engine) {
-        ret->meth = ENGINE_get_DH(ret->engine);
-        if (ret->meth == NULL) {
-            ERR_raise(ERR_LIB_DH, ERR_R_ENGINE_LIB);
-            goto err;
-        }
-    }
-#endif
-
     ret->flags = ret->meth->flags;
 
 #ifndef FIPS_MODULE
@@ -149,9 +126,6 @@ void DH_free(DH *r)
     if (r->meth != NULL && r->meth->finish != NULL)
         r->meth->finish(r);
 #if !defined(FIPS_MODULE)
-# if !defined(OPENSSL_NO_ENGINE)
-    ENGINE_finish(r->engine);
-# endif
     CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DH, r, &r->ex_data);
 #endif
 
@@ -319,13 +293,6 @@ void DH_set_flags(DH *dh, int flags)
     dh->flags |= flags;
 }
 
-#ifndef FIPS_MODULE
-ENGINE *DH_get0_engine(DH *dh)
-{
-    return dh->engine;
-}
-#endif /*FIPS_MODULE */
-
 FFC_PARAMS *ossl_dh_get0_params(DH *dh)
 {
     return &dh->params;

crypto/dh/dh_local.h

@@ -30,7 +30,6 @@ struct dh_st {
     CRYPTO_REF_COUNT references;
 #ifndef FIPS_MODULE
     CRYPTO_EX_DATA ex_data;
-    ENGINE *engine;
 #endif
     OSSL_LIB_CTX *libctx;
     const DH_METHOD *meth;

crypto/dsa/dsa_backend.c

@@ -66,7 +66,7 @@ int ossl_dsa_key_fromdata(DSA *dsa, const OSSL_PARAM params[],
 int ossl_dsa_is_foreign(const DSA *dsa)
 {
 #ifndef FIPS_MODULE
-    if (dsa->engine != NULL || DSA_get_method((DSA *)dsa) != DSA_OpenSSL())
+    if (DSA_get_method((DSA *)dsa) != DSA_OpenSSL())
         return 1;
 #endif
     return 0;

crypto/dsa/dsa_lib.c

@@ -14,16 +14,14 @@
 #include "internal/deprecated.h"
 
 #include <openssl/bn.h>
-#ifndef FIPS_MODULE
-# include <openssl/engine.h>
-#endif
 #include "internal/cryptlib.h"
 #include "internal/refcount.h"
+#include "internal/common.h"
 #include "crypto/dsa.h"
 #include "crypto/dh.h" /* required by DSA_dup_DH() */
 #include "dsa_local.h"
 
-static DSA *dsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx);
+static DSA *dsa_new_intern(OSSL_LIB_CTX *libctx);
 
 #ifndef FIPS_MODULE
 
@@ -98,11 +96,6 @@ void DSA_set_flags(DSA *d, int flags)
     d->flags |= flags;
 }
 
-ENGINE *DSA_get0_engine(DSA *d)
-{
-    return d->engine;
-}
-
 int DSA_set_method(DSA *dsa, const DSA_METHOD *meth)
 {
     /*
@@ -113,10 +106,6 @@ int DSA_set_method(DSA *dsa, const DSA_METHOD *meth)
     mtmp = dsa->meth;
     if (mtmp->finish)
         mtmp->finish(dsa);
-#ifndef OPENSSL_NO_ENGINE
-    ENGINE_finish(dsa->engine);
-    dsa->engine = NULL;
-#endif
     dsa->meth = meth;
     if (meth->init)
         meth->init(dsa);
@@ -130,7 +119,7 @@ const DSA_METHOD *DSA_get_method(DSA *d)
     return d->meth;
 }
 
-static DSA *dsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx)
+static DSA *dsa_new_intern(OSSL_LIB_CTX *libctx)
 {
     DSA *ret = OPENSSL_zalloc(sizeof(*ret));
 
@@ -152,24 +141,6 @@ static DSA *dsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx)
 
     ret->libctx = libctx;
     ret->meth = DSA_get_default_method();
-#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
-    ret->flags = ret->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW; /* early default init */
-    if (engine) {
-        if (!ENGINE_init(engine)) {
-            ERR_raise(ERR_LIB_DSA, ERR_R_ENGINE_LIB);
-            goto err;
-        }
-        ret->engine = engine;
-    } else
-        ret->engine = ENGINE_get_default_DSA();
-    if (ret->engine) {
-        ret->meth = ENGINE_get_DSA(ret->engine);
-        if (ret->meth == NULL) {
-            ERR_raise(ERR_LIB_DSA, ERR_R_ENGINE_LIB);
-            goto err;
-        }
-    }
-#endif
 
     ret->flags = ret->meth->flags & ~DSA_FLAG_NON_FIPS_ALLOW;
 
@@ -195,18 +166,20 @@ static DSA *dsa_new_intern(ENGINE *engine, OSSL_LIB_CTX *libctx)
 
 DSA *DSA_new_method(ENGINE *engine)
 {
-    return dsa_new_intern(engine, NULL);
+    if (!ossl_assert(engine == NULL))
+        return NULL;
+    return dsa_new_intern(NULL);
 }
 
 DSA *ossl_dsa_new(OSSL_LIB_CTX *libctx)
 {
-    return dsa_new_intern(NULL, libctx);
+    return dsa_new_intern(libctx);
 }
 
 #ifndef FIPS_MODULE
 DSA *DSA_new(void)
 {
-    return dsa_new_intern(NULL, NULL);
+    return dsa_new_intern(NULL);
 }
 #endif
 
@@ -225,9 +198,6 @@ void DSA_free(DSA *r)
 
     if (r->meth != NULL && r->meth->finish != NULL)
         r->meth->finish(r);
-#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_ENGINE)
-    ENGINE_finish(r->engine);
-#endif
 
 #ifndef FIPS_MODULE
     CRYPTO_free_ex_data(CRYPTO_EX_INDEX_DSA, r, &r->ex_data);

crypto/dsa/dsa_local.h

@@ -29,8 +29,6 @@ struct dsa_st {
     CRYPTO_EX_DATA ex_data;
 #endif
     const DSA_METHOD *meth;
-    /* functional reference if 'meth' is ENGINE-provided */
-    ENGINE *engine;
     CRYPTO_RWLOCK *lock;
     OSSL_LIB_CTX *libctx;
 

crypto/ec/ec_backend.c

@@ -18,7 +18,6 @@
 #include <openssl/params.h>
 #include <openssl/err.h>
 #ifndef FIPS_MODULE
-# include <openssl/engine.h>
 # include <openssl/x509.h>
 #endif
 #include "crypto/bn.h"
@@ -587,7 +586,7 @@ int ossl_ec_key_otherparams_fromdata(EC_KEY *ec, const OSSL_PARAM params[])
 int ossl_ec_key_is_foreign(const EC_KEY *ec)
 {
 #ifndef FIPS_MODULE
-    if (ec->engine != NULL || EC_KEY_get_method(ec) != EC_KEY_OpenSSL())
+    if (EC_KEY_get_method(ec) != EC_KEY_OpenSSL())
         return 1;
 #endif
     return 0;
@@ -603,8 +602,7 @@ EC_KEY *ossl_ec_key_dup(const EC_KEY *src, int selection)
         return NULL;
     }
 
-    if ((ret = ossl_ec_key_new_method_int(src->libctx, src->propq,
-                                          src->engine)) == NULL)
+    if ((ret = ossl_ec_key_new_method_int(src->libctx, src->propq)) == NULL)
         return NULL;
 
     /* copy the parameters */

crypto/ec/ec_key.c

@@ -19,9 +19,6 @@
 #include "ec_local.h"
 #include "internal/refcount.h"
 #include <openssl/err.h>
-#ifndef FIPS_MODULE
-# include <openssl/engine.h>
-#endif
 #include <openssl/self_test.h>
 #include "prov/providercommon.h"
 #include "prov/ecx.h"
@@ -33,13 +30,13 @@ static int ecdsa_keygen_pairwise_test(EC_KEY *eckey, OSSL_CALLBACK *cb,
 #ifndef FIPS_MODULE
 EC_KEY *EC_KEY_new(void)
 {
-    return ossl_ec_key_new_method_int(NULL, NULL, NULL);
+    return ossl_ec_key_new_method_int(NULL, NULL);
 }
 #endif
 
 EC_KEY *EC_KEY_new_ex(OSSL_LIB_CTX *ctx, const char *propq)
 {
-    return ossl_ec_key_new_method_int(ctx, propq, NULL);
+    return ossl_ec_key_new_method_int(ctx, propq);
 }
 
 EC_KEY *EC_KEY_new_by_curve_name_ex(OSSL_LIB_CTX *ctx, const char *propq,
@@ -84,10 +81,6 @@ void EC_KEY_free(EC_KEY *r)
     if (r->meth != NULL && r->meth->finish != NULL)
         r->meth->finish(r);
 
-#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
-    ENGINE_finish(r->engine);
-#endif
-
     if (r->group && r->group->meth->keyfinish)
         r->group->meth->keyfinish(r);
 
@@ -114,11 +107,6 @@ EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
             dest->meth->finish(dest);
         if (dest->group && dest->group->meth->keyfinish)
             dest->group->meth->keyfinish(dest);
-#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
-        if (ENGINE_finish(dest->engine) == 0)
-            return 0;
-        dest->engine = NULL;
-#endif
     }
     dest->libctx = src->libctx;
     /* copy the parameters */
@@ -169,11 +157,6 @@ EC_KEY *EC_KEY_copy(EC_KEY *dest, const EC_KEY *src)
 #endif
 
     if (src->meth != dest->meth) {
-#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
-        if (src->engine != NULL && ENGINE_init(src->engine) == 0)
-            return NULL;
-        dest->engine = src->engine;
-#endif
         dest->meth = src->meth;
     }
 
@@ -202,11 +185,6 @@ int EC_KEY_up_ref(EC_KEY *r)
     return ((i > 1) ? 1 : 0);
 }
 
-ENGINE *EC_KEY_get0_engine(const EC_KEY *eckey)
-{
-    return eckey->engine;
-}
-
 int EC_KEY_generate_key(EC_KEY *eckey)
 {
     if (eckey == NULL || eckey->group == NULL) {

crypto/ec/ec_kmeth.c

@@ -15,13 +15,9 @@
 
 #include <string.h>
 #include <openssl/ec.h>
-#ifndef FIPS_MODULE
-# include <openssl/engine.h>
-#endif
 #include <openssl/err.h>
 #include "ec_local.h"
 
-
 static const EC_KEY_METHOD openssl_ec_key_method = {
     "OpenSSL EC_KEY method",
     0,
@@ -67,19 +63,13 @@ int EC_KEY_set_method(EC_KEY *key, const EC_KEY_METHOD *meth)
     if (finish != NULL)
         finish(key);
 
-#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
-    ENGINE_finish(key->engine);
-    key->engine = NULL;
-#endif
-
     key->meth = meth;
     if (meth->init != NULL)
         return meth->init(key);
     return 1;
 }
 
-EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq,
-                                   ENGINE *engine)
+EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq)
 {
     EC_KEY *ret = OPENSSL_zalloc(sizeof(*ret));
 
@@ -99,24 +89,6 @@ EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq,
     }
 
     ret->meth = EC_KEY_get_default_method();
-#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
-    if (engine != NULL) {
-        if (!ENGINE_init(engine)) {
-            ERR_raise(ERR_LIB_EC, ERR_R_ENGINE_LIB);
-            goto err;
-        }
-        ret->engine = engine;
-    } else
-        ret->engine = ENGINE_get_default_EC();
-    if (ret->engine != NULL) {
-        ret->meth = ENGINE_get_EC(ret->engine);
-        if (ret->meth == NULL) {
-            ERR_raise(ERR_LIB_EC, ERR_R_ENGINE_LIB);
-            goto err;
-        }
-    }
-#endif
-
     ret->version = 1;
     ret->conv_form = POINT_CONVERSION_UNCOMPRESSED;
 
@@ -140,9 +112,11 @@ EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq,
 }
 
 #ifndef FIPS_MODULE
-EC_KEY *EC_KEY_new_method(ENGINE *engine)
+EC_KEY *EC_KEY_new_method(ossl_unused ENGINE *engine)
 {
-    return ossl_ec_key_new_method_int(NULL, NULL, engine);
+    if (engine != NULL)
+        return NULL;
+    return ossl_ec_key_new_method_int(NULL, NULL);
 }
 #endif
 

crypto/ec/ec_local.h

@@ -289,7 +289,6 @@ struct ec_group_st {
 
 struct ec_key_st {
     const EC_KEY_METHOD *meth;
-    ENGINE *engine;
     int version;
     EC_GROUP *group;
     EC_POINT *pub_key;
@@ -692,8 +691,7 @@ struct ec_key_method_st {
 
 #define EC_KEY_METHOD_DYNAMIC   1
 
-EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq,
-                                   ENGINE *engine);
+EC_KEY *ossl_ec_key_new_method_int(OSSL_LIB_CTX *libctx, const char *propq);
 
 int ossl_ec_key_gen(EC_KEY *eckey);
 int ossl_ecdh_compute_key(unsigned char **pout, size_t *poutlen,

crypto/engine/README.md

@@ -1,210 +0,0 @@
-Notes on engines of 2001-09-24
-==============================
-
-This "description" (if one chooses to call it that) needed some major updating
-so here goes. This update addresses a change being made at the same time to
-OpenSSL, and it pretty much completely restructures the underlying mechanics of
-the "ENGINE" code. So it serves a double purpose of being a "ENGINE internals
-for masochists" document *and* a rather extensive commit log message. (I'd get
-lynched for sticking all this in CHANGES.md or the commit mails :-).
-
-ENGINE_TABLE underlies this restructuring, as described in the internal header
-"eng_local.h", implemented in eng_table.c, and used in each of the "class" files;
-tb_rsa.c, tb_dsa.c, etc.
-
-However, "EVP_CIPHER" underlies the motivation and design of ENGINE_TABLE so
-I'll mention a bit about that first. EVP_CIPHER (and most of this applies
-equally to EVP_MD for digests) is both a "method" and a algorithm/mode
-identifier that, in the current API, "lingers". These cipher description +
-implementation structures can be defined or obtained directly by applications,
-or can be loaded "en masse" into EVP storage so that they can be catalogued and
-searched in various ways, ie. two ways of encrypting with the "des_cbc"
-algorithm/mode pair are;
-
-    (i) directly;
-         const EVP_CIPHER *cipher = EVP_des_cbc();
-         EVP_EncryptInit(&ctx, cipher, key, iv);
-         [ ... use EVP_EncryptUpdate() and EVP_EncryptFinal() ...]
-
-    (ii) indirectly;
-         OpenSSL_add_all_ciphers();
-         cipher = EVP_get_cipherbyname("des_cbc");
-         EVP_EncryptInit(&ctx, cipher, key, iv);
-         [ ... etc ... ]
-
-The latter is more generally used because it also allows ciphers/digests to be
-looked up based on other identifiers which can be useful for automatic cipher
-selection, eg. in SSL/TLS, or by user-controllable configuration.
-
-The important point about this is that EVP_CIPHER definitions and structures are
-passed around with impunity and there is no safe way, without requiring massive
-rewrites of many applications, to assume that EVP_CIPHERs can be reference
-counted. One an EVP_CIPHER is exposed to the caller, neither it nor anything it
-comes from can "safely" be destroyed. Unless of course the way of getting to
-such ciphers is via entirely distinct API calls that didn't exist before.
-However existing API usage cannot be made to understand when an EVP_CIPHER
-pointer, that has been passed to the caller, is no longer being used.
-
-The other problem with the existing API w.r.t. to hooking EVP_CIPHER support
-into ENGINE is storage - the OBJ_NAME-based storage used by EVP to register
-ciphers simultaneously registers cipher *types* and cipher *implementations* -
-they are effectively the same thing, an "EVP_CIPHER" pointer. The problem with
-hooking in ENGINEs is that multiple ENGINEs may implement the same ciphers. The
-solution is necessarily that ENGINE-provided ciphers simply are not registered,
-stored, or exposed to the caller in the same manner as existing ciphers. This is
-especially necessary considering the fact ENGINE uses reference counts to allow
-for cleanup, modularity, and DSO support - yet EVP_CIPHERs, as exposed to
-callers in the current API, support no such controls.
-
-Another sticking point for integrating cipher support into ENGINE is linkage.
-Already there is a problem with the way ENGINE supports RSA, DSA, etc whereby
-they are available *because* they're part of a giant ENGINE called "openssl".
-Ie. all implementations *have* to come from an ENGINE, but we get round that by
-having a giant ENGINE with all the software support encapsulated. This creates
-linker hassles if nothing else - linking a 1-line application that calls 2 basic
-RSA functions (eg. "RSA_free(RSA_new());") will result in large quantities of
-ENGINE code being linked in *and* because of that DSA, DH, and RAND also. If we
-continue with this approach for EVP_CIPHER support (even if it *was* possible)
-we would lose our ability to link selectively by selectively loading certain
-implementations of certain functionality. Touching any part of any kind of
-crypto would result in massive static linkage of everything else. So the
-solution is to change the way ENGINE feeds existing "classes", ie. how the
-hooking to ENGINE works from RSA, DSA, DH, RAND, as well as adding new hooking
-for EVP_CIPHER, and EVP_MD.
-
-The way this is now being done is by mostly reverting back to how things used to
-work prior to ENGINE :-). Ie. RSA now has a "RSA_METHOD" pointer again - this
-was previously replaced by an "ENGINE" pointer and all RSA code that required
-the RSA_METHOD would call ENGINE_get_RSA() each time on its ENGINE handle to
-temporarily get and use the ENGINE's RSA implementation. Apart from being more
-efficient, switching back to each RSA having an RSA_METHOD pointer also allows
-us to conceivably operate with *no* ENGINE. As we'll see, this removes any need
-for a fallback ENGINE that encapsulates default implementations - we can simply
-have our RSA structure pointing its RSA_METHOD pointer to the software
-implementation and have its ENGINE pointer set to NULL.
-
-A look at the EVP_CIPHER hooking is most explanatory, the RSA, DSA (etc) cases
-turn out to be degenerate forms of the same thing. The EVP storage of ciphers,
-and the existing EVP API functions that return "software" implementations and
-descriptions remain untouched. However, the storage takes more meaning in terms
-of "cipher description" and less meaning in terms of "implementation". When an
-EVP_CIPHER_CTX is actually initialised with an EVP_CIPHER method and is about to
-begin en/decryption, the hooking to ENGINE comes into play. What happens is that
-cipher-specific ENGINE code is asked for an ENGINE pointer (a functional
-reference) for any ENGINE that is registered to perform the algo/mode that the
-provided EVP_CIPHER structure represents. Under normal circumstances, that
-ENGINE code will return NULL because no ENGINEs will have had any cipher
-implementations *registered*. As such, a NULL ENGINE pointer is stored in the
-EVP_CIPHER_CTX context, and the EVP_CIPHER structure is left hooked into the
-context and so is used as the implementation. Pretty much how things work now
-except we'd have a redundant ENGINE pointer set to NULL and doing nothing.
-
-Conversely, if an ENGINE *has* been registered to perform the algorithm/mode
-combination represented by the provided EVP_CIPHER, then a functional reference
-to that ENGINE will be returned to the EVP_CIPHER_CTX during initialisation.
-That functional reference will be stored in the context (and released on
-cleanup) - and having that reference provides a *safe* way to use an EVP_CIPHER
-definition that is private to the ENGINE. Ie. the EVP_CIPHER provided by the
-application will actually be replaced by an EVP_CIPHER from the registered
-ENGINE - it will support the same algorithm/mode as the original but will be a
-completely different implementation. Because this EVP_CIPHER isn't stored in the
-EVP storage, nor is it returned to applications from traditional API functions,
-there is no associated problem with it not having reference counts. And of
-course, when one of these "private" cipher implementations is hooked into
-EVP_CIPHER_CTX, it is done whilst the EVP_CIPHER_CTX holds a functional
-reference to the ENGINE that owns it, thus the use of the ENGINE's EVP_CIPHER is
-safe.
-
-The "cipher-specific ENGINE code" I mentioned is implemented in tb_cipher.c but
-in essence it is simply an instantiation of "ENGINE_TABLE" code for use by
-EVP_CIPHER code. tb_digest.c is virtually identical but, of course, it is for
-use by EVP_MD code. Ditto for tb_rsa.c, tb_dsa.c, etc. These instantiations of
-ENGINE_TABLE essentially provide linker-separation of the classes so that even
-if ENGINEs implement *all* possible algorithms, an application using only
-EVP_CIPHER code will link at most code relating to EVP_CIPHER, tb_cipher.c, core
-ENGINE code that is independent of class, and of course the ENGINE
-implementation that the application loaded. It will *not* however link any
-class-specific ENGINE code for digests, RSA, etc nor will it bleed over into
-other APIs, such as the RSA/DSA/etc library code.
-
-ENGINE_TABLE is a little more complicated than may seem necessary but this is
-mostly to avoid a lot of "init()"-thrashing on ENGINEs (that may have to load
-DSOs, and other expensive setup that shouldn't be thrashed unnecessarily) *and*
-to duplicate "default" behaviour. Basically an ENGINE_TABLE instantiation, for
-example tb_cipher.c, implements a hash-table keyed by integer "nid" values.
-These nids provide the uniquenness of an algorithm/mode - and each nid will hash
-to a potentially NULL "ENGINE_PILE". An ENGINE_PILE is essentially a list of
-pointers to ENGINEs that implement that particular 'nid'. Each "pile" uses some
-caching tricks such that requests on that 'nid' will be cached and all future
-requests will return immediately (well, at least with minimal operation) unless
-a change is made to the pile, eg. perhaps an ENGINE was unloaded. The reason is
-that an application could have support for 10 ENGINEs statically linked
-in, and the machine in question may not have any of the hardware those 10
-ENGINEs support. If each of those ENGINEs has a "des_cbc" implementation, we
-want to avoid every EVP_CIPHER_CTX setup from trying (and failing) to initialise
-each of those 10 ENGINEs. Instead, the first such request will try to do that
-and will either return (and cache) a NULL ENGINE pointer or will return a
-functional reference to the first that successfully initialised. In the latter
-case it will also cache an extra functional reference to the ENGINE as a
-"default" for that 'nid'. The caching is acknowledged by a 'uptodate' variable
-that is unset only if un/registration takes place on that pile. Ie. if
-implementations of "des_cbc" are added or removed. This behaviour can be
-tweaked; the ENGINE_TABLE_FLAG_NOINIT value can be passed to
-ENGINE_set_table_flags(), in which case the only ENGINEs that tb_cipher.c will
-try to initialise from the "pile" will be those that are already initialised
-(ie. it's simply an increment of the functional reference count, and no real
-"initialisation" will take place).
-
-RSA, DSA, DH, and RAND all have their own ENGINE_TABLE code as well, and the
-difference is that they all use an implicit 'nid' of 1. Whereas EVP_CIPHERs are
-actually qualitatively different depending on 'nid' (the "des_cbc" EVP_CIPHER is
-not an interoperable implementation of "aes_256_cbc"), RSA_METHODs are
-necessarily interoperable and don't have different flavours, only different
-implementations. In other words, the ENGINE_TABLE for RSA will either be empty,
-or will have a single ENGINE_PILE hashed to by the 'nid' 1 and that pile
-represents ENGINEs that implement the single "type" of RSA there is.
-
-Cleanup - the registration and unregistration may pose questions about how
-cleanup works with the ENGINE_PILE doing all this caching nonsense (ie. when the
-application or EVP_CIPHER code releases its last reference to an ENGINE, the
-ENGINE_PILE code may still have references and thus those ENGINEs will stay
-hooked in forever). The way this is handled is via "unregistration". With these
-new ENGINE changes, an abstract ENGINE can be loaded and initialised, but that
-is an algorithm-agnostic process. Even if initialised, it will not have
-registered any of its implementations (to do so would link all class "table"
-code despite the fact the application may use only ciphers, for example). This
-is deliberately a distinct step. Moreover, registration and unregistration has
-nothing to do with whether an ENGINE is *functional* or not (ie. you can even
-register an ENGINE and its implementations without it being operational, you may
-not even have the drivers to make it operate). What actually happens with
-respect to cleanup is managed inside eng_lib.c with the `engine_cleanup_***`
-functions. These functions are internal-only and each part of ENGINE code that
-could require cleanup will, upon performing its first allocation, register a
-callback with the "engine_cleanup" code. The other part of this that makes it
-tick is that the ENGINE_TABLE instantiations (tb_***.c) use NULL as their
-initialised state. So if RSA code asks for an ENGINE and no ENGINE has
-registered an implementation, the code will simply return NULL and the tb_rsa.c
-state will be unchanged. Thus, no cleanup is required unless registration takes
-place. ENGINE_cleanup() will simply iterate across a list of registered cleanup
-callbacks calling each in turn, and will then internally delete its own storage
-(a STACK). When a cleanup callback is next registered (eg. if the cleanup() is
-part of a graceful restart and the application wants to cleanup all state then
-start again), the internal STACK storage will be freshly allocated. This is much
-the same as the situation in the ENGINE_TABLE instantiations ... NULL is the
-initialised state, so only modification operations (not queries) will cause that
-code to have to register a cleanup.
-
-What else? The bignum callbacks and associated ENGINE functions have been
-removed for two obvious reasons; (i) there was no way to generalise them to the
-mechanism now used by RSA/DSA/..., because there's no such thing as a BIGNUM
-method, and (ii) because of (i), there was no meaningful way for library or
-application code to automatically hook and use ENGINE supplied bignum functions
-anyway. Also, ENGINE_cpy() has been removed (although an internal-only version
-exists) - the idea of providing an ENGINE_cpy() function probably wasn't a good
-one and now certainly doesn't make sense in any generalised way. Some of the
-RSA, DSA, DH, and RAND functions that were fiddled during the original ENGINE
-changes have now, as a consequence, been reverted back. This is because the
-hooking of ENGINE is now automatic (and passive, it can internally use a NULL
-ENGINE pointer to simply ignore ENGINE from then on).
-
-Hell, that should be enough for now ... comments welcome.

crypto/engine/build.info

@@ -1,8 +0,0 @@
-LIBS=../../libcrypto
-SOURCE[../../libcrypto]=\
-        eng_err.c eng_lib.c eng_list.c eng_init.c eng_ctrl.c \
-        eng_table.c eng_pkey.c eng_fat.c eng_all.c \
-        tb_rsa.c tb_dsa.c tb_dh.c tb_rand.c \
-        tb_cipher.c tb_digest.c tb_pkmeth.c tb_asnmth.c tb_eckey.c \
-        eng_openssl.c eng_cnf.c eng_dyn.c \
-        eng_rdrand.c

crypto/engine/eng_all.c

@@ -1,24 +0,0 @@
-/*
- * Copyright 2001-2018 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#include "internal/cryptlib.h"
-#include "eng_local.h"
-
-void ENGINE_load_builtin_engines(void)
-{
-    OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL);
-}
-
-#ifndef OPENSSL_NO_DEPRECATED_1_1_0
-# if (defined(__OpenBSD__) || defined(__FreeBSD__) || defined(__DragonFly__))
-void ENGINE_setup_bsd_cryptodev(void)
-{
-}
-# endif
-#endif

crypto/engine/eng_cnf.c

@@ -1,185 +0,0 @@
-/*
- * Copyright 2002-2020 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
-#include "eng_local.h"
-#include <openssl/conf.h>
-#include <openssl/trace.h>
-
-/* ENGINE config module */
-
-static const char *skip_dot(const char *name)
-{
-    const char *p = strchr(name, '.');
-
-    if (p != NULL)
-        return p + 1;
-    return name;
-}
-
-static STACK_OF(ENGINE) *initialized_engines = NULL;
-
-static int int_engine_init(ENGINE *e)
-{
-    if (!ENGINE_init(e))
-        return 0;
-    if (!initialized_engines)
-        initialized_engines = sk_ENGINE_new_null();
-    if (!initialized_engines || !sk_ENGINE_push(initialized_engines, e)) {
-        ENGINE_finish(e);
-        return 0;
-    }
-    return 1;
-}
-
-static int int_engine_configure(const char *name, const char *value, const CONF *cnf)
-{
-    int i;
-    int ret = 0;
-    long do_init = -1;
-    STACK_OF(CONF_VALUE) *ecmds;
-    CONF_VALUE *ecmd = NULL;
-    const char *ctrlname, *ctrlvalue;
-    ENGINE *e = NULL;
-    int soft = 0;
-
-    name = skip_dot(name);
-    OSSL_TRACE1(CONF, "Configuring engine %s\n", name);
-    /* Value is a section containing ENGINE commands */
-    ecmds = NCONF_get_section(cnf, value);
-
-    if (!ecmds) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ENGINE_SECTION_ERROR);
-        return 0;
-    }
-
-    for (i = 0; i < sk_CONF_VALUE_num(ecmds); i++) {
-        ecmd = sk_CONF_VALUE_value(ecmds, i);
-        ctrlname = skip_dot(ecmd->name);
-        ctrlvalue = ecmd->value;
-        OSSL_TRACE2(CONF, "ENGINE: doing ctrl(%s,%s)\n",
-                    ctrlname, ctrlvalue);
-
-        /* First handle some special pseudo ctrls */
-
-        /* Override engine name to use */
-        if (strcmp(ctrlname, "engine_id") == 0)
-            name = ctrlvalue;
-        else if (strcmp(ctrlname, "soft_load") == 0)
-            soft = 1;
-        /* Load a dynamic ENGINE */
-        else if (strcmp(ctrlname, "dynamic_path") == 0) {
-            e = ENGINE_by_id("dynamic");
-            if (!e)
-                goto err;
-            if (!ENGINE_ctrl_cmd_string(e, "SO_PATH", ctrlvalue, 0))
-                goto err;
-            if (!ENGINE_ctrl_cmd_string(e, "LIST_ADD", "2", 0))
-                goto err;
-            if (!ENGINE_ctrl_cmd_string(e, "LOAD", NULL, 0))
-                goto err;
-        }
-        /* ... add other pseudos here ... */
-        else {
-            /*
-             * At this point we need an ENGINE structural reference if we
-             * don't already have one.
-             */
-            if (!e) {
-                e = ENGINE_by_id(name);
-                if (!e && soft) {
-                    ERR_clear_error();
-                    return 1;
-                }
-                if (!e)
-                    goto err;
-            }
-            /*
-             * Allow "EMPTY" to mean no value: this allows a valid "value" to
-             * be passed to ctrls of type NO_INPUT
-             */
-            if (strcmp(ctrlvalue, "EMPTY") == 0)
-                ctrlvalue = NULL;
-            if (strcmp(ctrlname, "init") == 0) {
-                if (!NCONF_get_number_e(cnf, value, "init", &do_init))
-                    goto err;
-                if (do_init == 1) {
-                    if (!int_engine_init(e))
-                        goto err;
-                } else if (do_init != 0) {
-                    ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_INIT_VALUE);
-                    goto err;
-                }
-            } else if (strcmp(ctrlname, "default_algorithms") == 0) {
-                if (!ENGINE_set_default_string(e, ctrlvalue))
-                    goto err;
-            } else if (!ENGINE_ctrl_cmd_string(e, ctrlname, ctrlvalue, 0))
-                goto err;
-        }
-
-    }
-    if (e && (do_init == -1) && !int_engine_init(e)) {
-        ecmd = NULL;
-        goto err;
-    }
-    ret = 1;
- err:
-    if (ret != 1) {
-        if (ecmd == NULL)
-            ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ENGINE_CONFIGURATION_ERROR);
-        else
-            ERR_raise_data(ERR_LIB_ENGINE, ENGINE_R_ENGINE_CONFIGURATION_ERROR,
-                           "section=%s, name=%s, value=%s",
-                           ecmd->section, ecmd->name, ecmd->value);
-    }
-    ENGINE_free(e);
-    return ret;
-}
-
-static int int_engine_module_init(CONF_IMODULE *md, const CONF *cnf)
-{
-    STACK_OF(CONF_VALUE) *elist;
-    CONF_VALUE *cval;
-    int i;
-    OSSL_TRACE2(CONF, "Called engine module: name %s, value %s\n",
-                CONF_imodule_get_name(md), CONF_imodule_get_value(md));
-    /* Value is a section containing ENGINEs to configure */
-    elist = NCONF_get_section(cnf, CONF_imodule_get_value(md));
-
-    if (!elist) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ENGINES_SECTION_ERROR);
-        return 0;
-    }
-
-    for (i = 0; i < sk_CONF_VALUE_num(elist); i++) {
-        cval = sk_CONF_VALUE_value(elist, i);
-        if (!int_engine_configure(cval->name, cval->value, cnf))
-            return 0;
-    }
-
-    return 1;
-}
-
-static void int_engine_module_finish(CONF_IMODULE *md)
-{
-    ENGINE *e;
-
-    while ((e = sk_ENGINE_pop(initialized_engines)))
-        ENGINE_finish(e);
-    sk_ENGINE_free(initialized_engines);
-    initialized_engines = NULL;
-}
-
-void ENGINE_add_conf_module(void)
-{
-    CONF_module_add("engines",
-                    int_engine_module_init, int_engine_module_finish);
-}

crypto/engine/eng_ctrl.c

@@ -1,322 +0,0 @@
-/*
- * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
-#include "eng_local.h"
-
-/*
- * When querying a ENGINE-specific control command's 'description', this
- * string is used if the ENGINE_CMD_DEFN has cmd_desc set to NULL.
- */
-static const char *int_no_description = "";
-
-/*
- * These internal functions handle 'CMD'-related control commands when the
- * ENGINE in question has asked us to take care of it (ie. the ENGINE did not
- * set the ENGINE_FLAGS_MANUAL_CMD_CTRL flag.
- */
-
-static int int_ctrl_cmd_is_null(const ENGINE_CMD_DEFN *defn)
-{
-    if ((defn->cmd_num == 0) || (defn->cmd_name == NULL))
-        return 1;
-    return 0;
-}
-
-static int int_ctrl_cmd_by_name(const ENGINE_CMD_DEFN *defn, const char *s)
-{
-    int idx = 0;
-    while (!int_ctrl_cmd_is_null(defn) && (strcmp(defn->cmd_name, s) != 0)) {
-        idx++;
-        defn++;
-    }
-    if (int_ctrl_cmd_is_null(defn))
-        /* The given name wasn't found */
-        return -1;
-    return idx;
-}
-
-static int int_ctrl_cmd_by_num(const ENGINE_CMD_DEFN *defn, unsigned int num)
-{
-    int idx = 0;
-    /*
-     * NB: It is stipulated that 'cmd_defn' lists are ordered by cmd_num. So
-     * our searches don't need to take any longer than necessary.
-     */
-    while (!int_ctrl_cmd_is_null(defn) && (defn->cmd_num < num)) {
-        idx++;
-        defn++;
-    }
-    if (defn->cmd_num == num)
-        return idx;
-    /* The given cmd_num wasn't found */
-    return -1;
-}
-
-static int int_ctrl_helper(ENGINE *e, int cmd, long i, void *p,
-                           void (*f) (void))
-{
-    int idx;
-    char *s = (char *)p;
-    const ENGINE_CMD_DEFN *cdp;
-
-    /* Take care of the easy one first (eg. it requires no searches) */
-    if (cmd == ENGINE_CTRL_GET_FIRST_CMD_TYPE) {
-        if ((e->cmd_defns == NULL) || int_ctrl_cmd_is_null(e->cmd_defns))
-            return 0;
-        return e->cmd_defns->cmd_num;
-    }
-    /* One or two commands require that "p" be a valid string buffer */
-    if ((cmd == ENGINE_CTRL_GET_CMD_FROM_NAME) ||
-        (cmd == ENGINE_CTRL_GET_NAME_FROM_CMD) ||
-        (cmd == ENGINE_CTRL_GET_DESC_FROM_CMD)) {
-        if (s == NULL) {
-            ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER);
-            return -1;
-        }
-    }
-    /* Now handle cmd_name -> cmd_num conversion */
-    if (cmd == ENGINE_CTRL_GET_CMD_FROM_NAME) {
-        if ((e->cmd_defns == NULL)
-            || ((idx = int_ctrl_cmd_by_name(e->cmd_defns, s)) < 0)) {
-            ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NAME);
-            return -1;
-        }
-        return e->cmd_defns[idx].cmd_num;
-    }
-    /*
-     * For the rest of the commands, the 'long' argument must specify a valid
-     * command number - so we need to conduct a search.
-     */
-    if ((e->cmd_defns == NULL)
-        || ((idx = int_ctrl_cmd_by_num(e->cmd_defns, (unsigned int)i)) < 0)) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NUMBER);
-        return -1;
-    }
-    /* Now the logic splits depending on command type */
-    cdp = &e->cmd_defns[idx];
-    switch (cmd) {
-    case ENGINE_CTRL_GET_NEXT_CMD_TYPE:
-        cdp++;
-        return int_ctrl_cmd_is_null(cdp) ? 0 : cdp->cmd_num;
-    case ENGINE_CTRL_GET_NAME_LEN_FROM_CMD:
-        return (int)strlen(cdp->cmd_name);
-    case ENGINE_CTRL_GET_NAME_FROM_CMD:
-        return (int)strlen(strcpy(s, cdp->cmd_name));
-    case ENGINE_CTRL_GET_DESC_LEN_FROM_CMD:
-        return (int)strlen(cdp->cmd_desc == NULL ? int_no_description
-                                                 : cdp->cmd_desc);
-    case ENGINE_CTRL_GET_DESC_FROM_CMD:
-        return (int)strlen(strcpy(s, cdp->cmd_desc == NULL ? int_no_description
-                                                           : cdp->cmd_desc));
-    case ENGINE_CTRL_GET_CMD_FLAGS:
-        return cdp->cmd_flags;
-    }
-    /* Shouldn't really be here ... */
-    ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR);
-    return -1;
-}
-
-int ENGINE_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void))
-{
-    int ctrl_exists;
-
-    if (e == NULL) {
-        ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER);
-        return 0;
-    }
-
-    ctrl_exists = ((e->ctrl == NULL) ? 0 : 1);
-
-    /*
-     * Intercept any "root-level" commands before trying to hand them on to
-     * ctrl() handlers.
-     */
-    switch (cmd) {
-    case ENGINE_CTRL_HAS_CTRL_FUNCTION:
-        return ctrl_exists;
-    case ENGINE_CTRL_GET_FIRST_CMD_TYPE:
-    case ENGINE_CTRL_GET_NEXT_CMD_TYPE:
-    case ENGINE_CTRL_GET_CMD_FROM_NAME:
-    case ENGINE_CTRL_GET_NAME_LEN_FROM_CMD:
-    case ENGINE_CTRL_GET_NAME_FROM_CMD:
-    case ENGINE_CTRL_GET_DESC_LEN_FROM_CMD:
-    case ENGINE_CTRL_GET_DESC_FROM_CMD:
-    case ENGINE_CTRL_GET_CMD_FLAGS:
-        if (ctrl_exists && !(e->flags & ENGINE_FLAGS_MANUAL_CMD_CTRL))
-            return int_ctrl_helper(e, cmd, i, p, f);
-        if (!ctrl_exists) {
-            ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NO_CONTROL_FUNCTION);
-            /*
-             * For these cmd-related functions, failure is indicated by a -1
-             * return value (because 0 is used as a valid return in some
-             * places).
-             */
-            return -1;
-        }
-    default:
-        break;
-    }
-    /* Anything else requires a ctrl() handler to exist. */
-    if (!ctrl_exists) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NO_CONTROL_FUNCTION);
-        return 0;
-    }
-    return e->ctrl(e, cmd, i, p, f);
-}
-
-int ENGINE_cmd_is_executable(ENGINE *e, int cmd)
-{
-    int flags;
-    if ((flags =
-         ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FLAGS, cmd, NULL, NULL)) < 0) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NUMBER);
-        return 0;
-    }
-    if (!(flags & ENGINE_CMD_FLAG_NO_INPUT) &&
-        !(flags & ENGINE_CMD_FLAG_NUMERIC) &&
-        !(flags & ENGINE_CMD_FLAG_STRING))
-        return 0;
-    return 1;
-}
-
-int ENGINE_ctrl_cmd(ENGINE *e, const char *cmd_name,
-                    long i, void *p, void (*f) (void), int cmd_optional)
-{
-    int num;
-
-    if (e == NULL || cmd_name == NULL) {
-        ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER);
-        return 0;
-    }
-    if (e->ctrl == NULL
-        || (num = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FROM_NAME,
-                              0, (void *)cmd_name, NULL)) <= 0) {
-        /*
-         * If the command didn't *have* to be supported, we fake success.
-         * This allows certain settings to be specified for multiple ENGINEs
-         * and only require a change of ENGINE id (without having to
-         * selectively apply settings). Eg. changing from a hardware device
-         * back to the regular software ENGINE without editing the config
-         * file, etc.
-         */
-        if (cmd_optional) {
-            ERR_clear_error();
-            return 1;
-        }
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NAME);
-        return 0;
-    }
-    /*
-     * Force the result of the control command to 0 or 1, for the reasons
-     * mentioned before.
-     */
-    if (ENGINE_ctrl(e, num, i, p, f) > 0)
-        return 1;
-    return 0;
-}
-
-int ENGINE_ctrl_cmd_string(ENGINE *e, const char *cmd_name, const char *arg,
-                           int cmd_optional)
-{
-    int num, flags;
-    long l;
-    char *ptr;
-
-    if (e == NULL || cmd_name == NULL) {
-        ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER);
-        return 0;
-    }
-    if (e->ctrl == NULL
-        || (num = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FROM_NAME,
-                              0, (void *)cmd_name, NULL)) <= 0) {
-        /*
-         * If the command didn't *have* to be supported, we fake success.
-         * This allows certain settings to be specified for multiple ENGINEs
-         * and only require a change of ENGINE id (without having to
-         * selectively apply settings). Eg. changing from a hardware device
-         * back to the regular software ENGINE without editing the config
-         * file, etc.
-         */
-        if (cmd_optional) {
-            ERR_clear_error();
-            return 1;
-        }
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NAME);
-        return 0;
-    }
-    if (!ENGINE_cmd_is_executable(e, num)) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_CMD_NOT_EXECUTABLE);
-        return 0;
-    }
-
-    flags = ENGINE_ctrl(e, ENGINE_CTRL_GET_CMD_FLAGS, num, NULL, NULL);
-    if (flags < 0) {
-        /*
-         * Shouldn't happen, given that ENGINE_cmd_is_executable() returned
-         * success.
-         */
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR);
-        return 0;
-    }
-    /*
-     * If the command takes no input, there must be no input. And vice versa.
-     */
-    if (flags & ENGINE_CMD_FLAG_NO_INPUT) {
-        if (arg != NULL) {
-            ERR_raise(ERR_LIB_ENGINE, ENGINE_R_COMMAND_TAKES_NO_INPUT);
-            return 0;
-        }
-        /*
-         * We deliberately force the result of ENGINE_ctrl() to 0 or 1 rather
-         * than returning it as "return data". This is to ensure usage of
-         * these commands is consistent across applications and that certain
-         * applications don't understand it one way, and others another.
-         */
-        if (ENGINE_ctrl(e, num, 0, (void *)arg, NULL) > 0)
-            return 1;
-        return 0;
-    }
-    /* So, we require input */
-    if (arg == NULL) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_COMMAND_TAKES_INPUT);
-        return 0;
-    }
-    /* If it takes string input, that's easy */
-    if (flags & ENGINE_CMD_FLAG_STRING) {
-        /* Same explanation as above */
-        if (ENGINE_ctrl(e, num, 0, (void *)arg, NULL) > 0)
-            return 1;
-        return 0;
-    }
-    /*
-     * If it doesn't take numeric either, then it is unsupported for use in a
-     * config-setting situation, which is what this function is for. This
-     * should never happen though, because ENGINE_cmd_is_executable() was
-     * used.
-     */
-    if (!(flags & ENGINE_CMD_FLAG_NUMERIC)) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR);
-        return 0;
-    }
-    l = strtol(arg, &ptr, 10);
-    if ((arg == ptr) || (*ptr != '\0')) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER);
-        return 0;
-    }
-    /*
-     * Force the result of the control command to 0 or 1, for the reasons
-     * mentioned before.
-     */
-    if (ENGINE_ctrl(e, num, l, NULL, NULL) > 0)
-        return 1;
-    return 0;
-}

crypto/engine/eng_dyn.c

@@ -1,534 +0,0 @@
-/*
- * Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
-#include "eng_local.h"
-#include "internal/dso.h"
-#include <openssl/crypto.h>
-
-/*
- * Shared libraries implementing ENGINEs for use by the "dynamic" ENGINE
- * loader should implement the hook-up functions with the following
- * prototypes.
- */
-
-/* Our ENGINE handlers */
-static int dynamic_init(ENGINE *e);
-static int dynamic_finish(ENGINE *e);
-static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p,
-                        void (*f) (void));
-/* Predeclare our context type */
-typedef struct st_dynamic_data_ctx dynamic_data_ctx;
-/* The implementation for the important control command */
-static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx);
-
-#define DYNAMIC_CMD_SO_PATH             ENGINE_CMD_BASE
-#define DYNAMIC_CMD_NO_VCHECK           (ENGINE_CMD_BASE + 1)
-#define DYNAMIC_CMD_ID                  (ENGINE_CMD_BASE + 2)
-#define DYNAMIC_CMD_LIST_ADD            (ENGINE_CMD_BASE + 3)
-#define DYNAMIC_CMD_DIR_LOAD            (ENGINE_CMD_BASE + 4)
-#define DYNAMIC_CMD_DIR_ADD             (ENGINE_CMD_BASE + 5)
-#define DYNAMIC_CMD_LOAD                (ENGINE_CMD_BASE + 6)
-
-/* The constants used when creating the ENGINE */
-static const char *engine_dynamic_id = "dynamic";
-static const char *engine_dynamic_name = "Dynamic engine loading support";
-static const ENGINE_CMD_DEFN dynamic_cmd_defns[] = {
-    {DYNAMIC_CMD_SO_PATH,
-     "SO_PATH",
-     "Specifies the path to the new ENGINE shared library",
-     ENGINE_CMD_FLAG_STRING},
-    {DYNAMIC_CMD_NO_VCHECK,
-     "NO_VCHECK",
-     "Specifies to continue even if version checking fails (boolean)",
-     ENGINE_CMD_FLAG_NUMERIC},
-    {DYNAMIC_CMD_ID,
-     "ID",
-     "Specifies an ENGINE id name for loading",
-     ENGINE_CMD_FLAG_STRING},
-    {DYNAMIC_CMD_LIST_ADD,
-     "LIST_ADD",
-     "Whether to add a loaded ENGINE to the internal list (0=no,1=yes,2=mandatory)",
-     ENGINE_CMD_FLAG_NUMERIC},
-    {DYNAMIC_CMD_DIR_LOAD,
-     "DIR_LOAD",
-     "Specifies whether to load from 'DIR_ADD' directories (0=no,1=yes,2=mandatory)",
-     ENGINE_CMD_FLAG_NUMERIC},
-    {DYNAMIC_CMD_DIR_ADD,
-     "DIR_ADD",
-     "Adds a directory from which ENGINEs can be loaded",
-     ENGINE_CMD_FLAG_STRING},
-    {DYNAMIC_CMD_LOAD,
-     "LOAD",
-     "Load up the ENGINE specified by other settings",
-     ENGINE_CMD_FLAG_NO_INPUT},
-    {0, NULL, NULL, 0}
-};
-
-/*
- * Loading code stores state inside the ENGINE structure via the "ex_data"
- * element. We load all our state into a single structure and use that as a
- * single context in the "ex_data" stack.
- */
-struct st_dynamic_data_ctx {
-    /* The DSO object we load that supplies the ENGINE code */
-    DSO *dynamic_dso;
-    /*
-     * The function pointer to the version checking shared library function
-     */
-    dynamic_v_check_fn v_check;
-    /*
-     * The function pointer to the engine-binding shared library function
-     */
-    dynamic_bind_engine bind_engine;
-    /* The default name/path for loading the shared library */
-    char *DYNAMIC_LIBNAME;
-    /* Whether to continue loading on a version check failure */
-    int no_vcheck;
-    /* If non-NULL, stipulates the 'id' of the ENGINE to be loaded */
-    char *engine_id;
-    /*
-     * If non-zero, a successfully loaded ENGINE should be added to the
-     * internal ENGINE list. If 2, the add must succeed or the entire load
-     * should fail.
-     */
-    int list_add_value;
-    /* The symbol name for the version checking function */
-    const char *DYNAMIC_F1;
-    /* The symbol name for the "initialise ENGINE structure" function */
-    const char *DYNAMIC_F2;
-    /*
-     * Whether to never use 'dirs', use 'dirs' as a fallback, or only use
-     * 'dirs' for loading. Default is to use 'dirs' as a fallback.
-     */
-    int dir_load;
-    /* A stack of directories from which ENGINEs could be loaded */
-    STACK_OF(OPENSSL_STRING) *dirs;
-};
-
-/*
- * This is the "ex_data" index we obtain and reserve for use with our context
- * structure.
- */
-static int dynamic_ex_data_idx = -1;
-
-static void int_free_str(char *s)
-{
-    OPENSSL_free(s);
-}
-
-/*
- * Because our ex_data element may or may not get allocated depending on
- * whether a "first-use" occurs before the ENGINE is freed, we have a memory
- * leak problem to solve. We can't declare a "new" handler for the ex_data as
- * we don't want a dynamic_data_ctx in *all* ENGINE structures of all types
- * (this is a bug in the design of CRYPTO_EX_DATA). As such, we just declare
- * a "free" handler and that will get called if an ENGINE is being destroyed
- * and there was an ex_data element corresponding to our context type.
- */
-static void dynamic_data_ctx_free_func(void *parent, void *ptr,
-                                       CRYPTO_EX_DATA *ad, int idx, long argl,
-                                       void *argp)
-{
-    if (ptr) {
-        dynamic_data_ctx *ctx = (dynamic_data_ctx *)ptr;
-        DSO_free(ctx->dynamic_dso);
-        OPENSSL_free(ctx->DYNAMIC_LIBNAME);
-        OPENSSL_free(ctx->engine_id);
-        sk_OPENSSL_STRING_pop_free(ctx->dirs, int_free_str);
-        OPENSSL_free(ctx);
-    }
-}
-
-/*
- * Construct the per-ENGINE context. We create it blindly and then use a lock
- * to check for a race - if so, all but one of the threads "racing" will have
- * wasted their time. The alternative involves creating everything inside the
- * lock which is far worse.
- */
-static int dynamic_set_data_ctx(ENGINE *e, dynamic_data_ctx **ctx)
-{
-    dynamic_data_ctx *c = OPENSSL_zalloc(sizeof(*c));
-    int ret = 0;
-
-    if (c == NULL)
-        return 0;
-    c->dirs = sk_OPENSSL_STRING_new_null();
-    if (c->dirs == NULL) {
-        ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB);
-        goto end;
-    }
-    c->DYNAMIC_F1 = "v_check";
-    c->DYNAMIC_F2 = "bind_engine";
-    c->dir_load = 1;
-    if (!CRYPTO_THREAD_write_lock(global_engine_lock))
-        goto end;
-    if ((*ctx = (dynamic_data_ctx *)ENGINE_get_ex_data(e,
-                                                       dynamic_ex_data_idx))
-        == NULL) {
-        /* Good, we're the first */
-        ret = ENGINE_set_ex_data(e, dynamic_ex_data_idx, c);
-        if (ret) {
-            *ctx = c;
-            c = NULL;
-        }
-    }
-    CRYPTO_THREAD_unlock(global_engine_lock);
-    ret = 1;
-    /*
-     * If we lost the race to set the context, c is non-NULL and *ctx is the
-     * context of the thread that won.
-     */
-end:
-    if (c != NULL)
-        sk_OPENSSL_STRING_free(c->dirs);
-    OPENSSL_free(c);
-    return ret;
-}
-
-/*
- * This function retrieves the context structure from an ENGINE's "ex_data",
- * or if it doesn't exist yet, sets it up.
- */
-static dynamic_data_ctx *dynamic_get_data_ctx(ENGINE *e)
-{
-    dynamic_data_ctx *ctx;
-    if (dynamic_ex_data_idx < 0) {
-        /*
-         * Create and register the ENGINE ex_data, and associate our "free"
-         * function with it to ensure any allocated contexts get freed when
-         * an ENGINE goes underground.
-         */
-        int new_idx = ENGINE_get_ex_new_index(0, NULL, NULL, NULL,
-                                              dynamic_data_ctx_free_func);
-        if (new_idx == -1) {
-            ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NO_INDEX);
-            return NULL;
-        }
-        if (!CRYPTO_THREAD_write_lock(global_engine_lock))
-            return NULL;
-        /* Avoid a race by checking again inside this lock */
-        if (dynamic_ex_data_idx < 0) {
-            /* Good, someone didn't beat us to it */
-            dynamic_ex_data_idx = new_idx;
-            new_idx = -1;
-        }
-        CRYPTO_THREAD_unlock(global_engine_lock);
-        /*
-         * In theory we could "give back" the index here if (new_idx>-1), but
-         * it's not possible and wouldn't gain us much if it were.
-         */
-    }
-    ctx = (dynamic_data_ctx *)ENGINE_get_ex_data(e, dynamic_ex_data_idx);
-    /* Check if the context needs to be created */
-    if ((ctx == NULL) && !dynamic_set_data_ctx(e, &ctx))
-        /* "set_data" will set errors if necessary */
-        return NULL;
-    return ctx;
-}
-
-static ENGINE *engine_dynamic(void)
-{
-    ENGINE *ret = ENGINE_new();
-    if (ret == NULL)
-        return NULL;
-    if (!ENGINE_set_id(ret, engine_dynamic_id) ||
-        !ENGINE_set_name(ret, engine_dynamic_name) ||
-        !ENGINE_set_init_function(ret, dynamic_init) ||
-        !ENGINE_set_finish_function(ret, dynamic_finish) ||
-        !ENGINE_set_ctrl_function(ret, dynamic_ctrl) ||
-        !ENGINE_set_flags(ret, ENGINE_FLAGS_BY_ID_COPY) ||
-        !ENGINE_set_cmd_defns(ret, dynamic_cmd_defns)) {
-        ENGINE_free(ret);
-        return NULL;
-    }
-    return ret;
-}
-
-void engine_load_dynamic_int(void)
-{
-    ENGINE *toadd = engine_dynamic();
-    if (!toadd)
-        return;
-
-    ERR_set_mark();
-    ENGINE_add(toadd);
-    /*
-     * If the "add" worked, it gets a structural reference. So either way, we
-     * release our just-created reference.
-     */
-    ENGINE_free(toadd);
-    /*
-     * If the "add" didn't work, it was probably a conflict because it was
-     * already added (eg. someone calling ENGINE_load_blah then calling
-     * ENGINE_load_builtin_engines() perhaps).
-     */
-    ERR_pop_to_mark();
-}
-
-static int dynamic_init(ENGINE *e)
-{
-    /*
-     * We always return failure - the "dynamic" engine itself can't be used
-     * for anything.
-     */
-    return 0;
-}
-
-static int dynamic_finish(ENGINE *e)
-{
-    /*
-     * This should never be called on account of "dynamic_init" always
-     * failing.
-     */
-    return 0;
-}
-
-static int dynamic_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f) (void))
-{
-    dynamic_data_ctx *ctx = dynamic_get_data_ctx(e);
-    int initialised;
-
-    if (!ctx) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_NOT_LOADED);
-        return 0;
-    }
-    initialised = ((ctx->dynamic_dso == NULL) ? 0 : 1);
-    /* All our control commands require the ENGINE to be uninitialised */
-    if (initialised) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_ALREADY_LOADED);
-        return 0;
-    }
-    switch (cmd) {
-    case DYNAMIC_CMD_SO_PATH:
-        /* a NULL 'p' or a string of zero-length is the same thing */
-        if (p && (strlen((const char *)p) < 1))
-            p = NULL;
-        OPENSSL_free(ctx->DYNAMIC_LIBNAME);
-        if (p)
-            ctx->DYNAMIC_LIBNAME = OPENSSL_strdup(p);
-        else
-            ctx->DYNAMIC_LIBNAME = NULL;
-        return (ctx->DYNAMIC_LIBNAME ? 1 : 0);
-    case DYNAMIC_CMD_NO_VCHECK:
-        ctx->no_vcheck = ((i == 0) ? 0 : 1);
-        return 1;
-    case DYNAMIC_CMD_ID:
-        /* a NULL 'p' or a string of zero-length is the same thing */
-        if (p && (strlen((const char *)p) < 1))
-            p = NULL;
-        OPENSSL_free(ctx->engine_id);
-        if (p)
-            ctx->engine_id = OPENSSL_strdup(p);
-        else
-            ctx->engine_id = NULL;
-        return (ctx->engine_id ? 1 : 0);
-    case DYNAMIC_CMD_LIST_ADD:
-        if ((i < 0) || (i > 2)) {
-            ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_ARGUMENT);
-            return 0;
-        }
-        ctx->list_add_value = (int)i;
-        return 1;
-    case DYNAMIC_CMD_LOAD:
-        return dynamic_load(e, ctx);
-    case DYNAMIC_CMD_DIR_LOAD:
-        if ((i < 0) || (i > 2)) {
-            ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_ARGUMENT);
-            return 0;
-        }
-        ctx->dir_load = (int)i;
-        return 1;
-    case DYNAMIC_CMD_DIR_ADD:
-        /* a NULL 'p' or a string of zero-length is the same thing */
-        if (p == NULL || (strlen((const char *)p) < 1)) {
-            ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INVALID_ARGUMENT);
-            return 0;
-        }
-        {
-            char *tmp_str = OPENSSL_strdup(p);
-            if (tmp_str == NULL)
-                return 0;
-            if (!sk_OPENSSL_STRING_push(ctx->dirs, tmp_str)) {
-                OPENSSL_free(tmp_str);
-                ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB);
-                return 0;
-            }
-        }
-        return 1;
-    default:
-        break;
-    }
-    ERR_raise(ERR_LIB_ENGINE, ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED);
-    return 0;
-}
-
-static int int_load(dynamic_data_ctx *ctx)
-{
-    int num, loop;
-    /* Unless told not to, try a direct load */
-    if ((ctx->dir_load != 2) && (DSO_load(ctx->dynamic_dso,
-                                          ctx->DYNAMIC_LIBNAME, NULL,
-                                          0)) != NULL)
-        return 1;
-    /* If we're not allowed to use 'dirs' or we have none, fail */
-    if (!ctx->dir_load || (num = sk_OPENSSL_STRING_num(ctx->dirs)) < 1)
-        return 0;
-    for (loop = 0; loop < num; loop++) {
-        const char *s = sk_OPENSSL_STRING_value(ctx->dirs, loop);
-        char *merge = DSO_merge(ctx->dynamic_dso, ctx->DYNAMIC_LIBNAME, s);
-        if (!merge)
-            return 0;
-        if (DSO_load(ctx->dynamic_dso, merge, NULL, 0)) {
-            /* Found what we're looking for */
-            OPENSSL_free(merge);
-            return 1;
-        }
-        OPENSSL_free(merge);
-    }
-    return 0;
-}
-
-/*
- * Unfortunately the version checker does not distinguish between
- * engines built for openssl 1.1.x and openssl 3.x, but loading
- * an engine that is built for openssl 1.1.x will cause a fatal
- * error.  Detect such engines, since EVP_PKEY_base_id is exported
- * as a function in openssl 1.1.x, while it is named EVP_PKEY_get_base_id
- * in openssl 3.x.  Therefore we take the presence of that symbol
- * as an indication that the engine will be incompatible.
- */
-static int using_libcrypto_11(dynamic_data_ctx *ctx)
-{
-    int ret;
-
-    ERR_set_mark();
-    ret = DSO_bind_func(ctx->dynamic_dso, "EVP_PKEY_base_id") != NULL;
-    ERR_pop_to_mark();
-
-    return ret;
-}
-
-static int dynamic_load(ENGINE *e, dynamic_data_ctx *ctx)
-{
-    ENGINE cpy;
-    dynamic_fns fns;
-
-    if (ctx->dynamic_dso == NULL)
-        ctx->dynamic_dso = DSO_new();
-    if (ctx->dynamic_dso == NULL)
-        return 0;
-    if (!ctx->DYNAMIC_LIBNAME) {
-        if (!ctx->engine_id)
-            return 0;
-        DSO_ctrl(ctx->dynamic_dso, DSO_CTRL_SET_FLAGS,
-                 DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL);
-        ctx->DYNAMIC_LIBNAME =
-            DSO_convert_filename(ctx->dynamic_dso, ctx->engine_id);
-    }
-    if (!int_load(ctx)) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_DSO_NOT_FOUND);
-        DSO_free(ctx->dynamic_dso);
-        ctx->dynamic_dso = NULL;
-        return 0;
-    }
-    /* We have to find a bind function otherwise it'll always end badly */
-    if (!
-        (ctx->bind_engine =
-         (dynamic_bind_engine) DSO_bind_func(ctx->dynamic_dso,
-                                             ctx->DYNAMIC_F2))) {
-        ctx->bind_engine = NULL;
-        DSO_free(ctx->dynamic_dso);
-        ctx->dynamic_dso = NULL;
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_DSO_FAILURE);
-        return 0;
-    }
-    /* Do we perform version checking? */
-    if (!ctx->no_vcheck) {
-        unsigned long vcheck_res = 0;
-        /*
-         * Now we try to find a version checking function and decide how to
-         * cope with failure if/when it fails.
-         */
-        ctx->v_check =
-            (dynamic_v_check_fn) DSO_bind_func(ctx->dynamic_dso,
-                                               ctx->DYNAMIC_F1);
-        if (ctx->v_check)
-            vcheck_res = ctx->v_check(OSSL_DYNAMIC_VERSION);
-        /*
-         * We fail if the version checker veto'd the load *or* if it is
-         * deferring to us (by returning its version) and we think it is too
-         * old. Also fail if this is engine for openssl 1.1.x.
-         */
-        if (vcheck_res < OSSL_DYNAMIC_OLDEST || using_libcrypto_11(ctx)) {
-            /* Fail */
-            ctx->bind_engine = NULL;
-            ctx->v_check = NULL;
-            DSO_free(ctx->dynamic_dso);
-            ctx->dynamic_dso = NULL;
-            ERR_raise(ERR_LIB_ENGINE, ENGINE_R_VERSION_INCOMPATIBILITY);
-            return 0;
-        }
-    }
-    /*
-     * First binary copy the ENGINE structure so that we can roll back if the
-     * hand-over fails
-     */
-    memcpy(&cpy, e, sizeof(ENGINE));
-    /*
-     * Provide the ERR, "ex_data", memory, and locking callbacks so the
-     * loaded library uses our state rather than its own. FIXME: As noted in
-     * engine.h, much of this would be simplified if each area of code
-     * provided its own "summary" structure of all related callbacks. It
-     * would also increase opaqueness.
-     */
-    fns.static_state = ENGINE_get_static_state();
-    CRYPTO_get_mem_functions(&fns.mem_fns.malloc_fn, &fns.mem_fns.realloc_fn,
-                             &fns.mem_fns.free_fn);
-    /*
-     * Now that we've loaded the dynamic engine, make sure no "dynamic"
-     * ENGINE elements will show through.
-     */
-    engine_set_all_null(e);
-
-    /* Try to bind the ENGINE onto our own ENGINE structure */
-    if (!engine_add_dynamic_id(e, (ENGINE_DYNAMIC_ID)ctx->bind_engine, 1)
-            || !ctx->bind_engine(e, ctx->engine_id, &fns)) {
-        engine_remove_dynamic_id(e, 1);
-        ctx->bind_engine = NULL;
-        ctx->v_check = NULL;
-        DSO_free(ctx->dynamic_dso);
-        ctx->dynamic_dso = NULL;
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_INIT_FAILED);
-        /* Copy the original ENGINE structure back */
-        memcpy(e, &cpy, sizeof(ENGINE));
-        return 0;
-    }
-    /* Do we try to add this ENGINE to the internal list too? */
-    if (ctx->list_add_value > 0) {
-        if (!ENGINE_add(e)) {
-            /* Do we tolerate this or fail? */
-            if (ctx->list_add_value > 1) {
-                /*
-                 * Fail - NB: By this time, it's too late to rollback, and
-                 * trying to do so allows the bind_engine() code to have
-                 * created leaks. We just have to fail where we are, after
-                 * the ENGINE has changed.
-                 */
-                ERR_raise(ERR_LIB_ENGINE, ENGINE_R_CONFLICTING_ENGINE_ID);
-                return 0;
-            }
-            /* Tolerate */
-            ERR_clear_error();
-        }
-    }
-    return 1;
-}

crypto/engine/eng_err.c

@@ -1,94 +0,0 @@
-/*
- * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#include <openssl/err.h>
-#include <openssl/engineerr.h>
-#include "crypto/engineerr.h"
-
-#ifndef OPENSSL_NO_ENGINE
-
-# ifndef OPENSSL_NO_ERR
-
-static const ERR_STRING_DATA ENGINE_str_reasons[] = {
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ALREADY_LOADED), "already loaded"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER),
-    "argument is not a number"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_CMD_NOT_EXECUTABLE),
-    "cmd not executable"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_COMMAND_TAKES_INPUT),
-    "command takes input"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_COMMAND_TAKES_NO_INPUT),
-    "command takes no input"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_CONFLICTING_ENGINE_ID),
-    "conflicting engine id"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED),
-    "ctrl command not implemented"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_DSO_FAILURE), "DSO failure"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_DSO_NOT_FOUND), "dso not found"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ENGINES_SECTION_ERROR),
-    "engines section error"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ENGINE_CONFIGURATION_ERROR),
-    "engine configuration error"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ENGINE_IS_NOT_IN_LIST),
-    "engine is not in the list"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ENGINE_SECTION_ERROR),
-    "engine section error"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_FAILED_LOADING_PRIVATE_KEY),
-    "failed loading private key"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_FAILED_LOADING_PUBLIC_KEY),
-    "failed loading public key"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_FINISH_FAILED), "finish failed"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_ID_OR_NAME_MISSING),
-    "'id' or 'name' missing"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INIT_FAILED), "init failed"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INTERNAL_LIST_ERROR),
-    "internal list error"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INVALID_ARGUMENT),
-    "invalid argument"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INVALID_CMD_NAME),
-    "invalid cmd name"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INVALID_CMD_NUMBER),
-    "invalid cmd number"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INVALID_INIT_VALUE),
-    "invalid init value"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_INVALID_STRING), "invalid string"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NOT_INITIALISED), "not initialised"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NOT_LOADED), "not loaded"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NO_CONTROL_FUNCTION),
-    "no control function"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NO_INDEX), "no index"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NO_LOAD_FUNCTION),
-    "no load function"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NO_REFERENCE), "no reference"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_NO_SUCH_ENGINE), "no such engine"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_UNIMPLEMENTED_CIPHER),
-    "unimplemented cipher"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_UNIMPLEMENTED_DIGEST),
-    "unimplemented digest"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD),
-    "unimplemented public key method"},
-    {ERR_PACK(ERR_LIB_ENGINE, 0, ENGINE_R_VERSION_INCOMPATIBILITY),
-    "version incompatibility"},
-    {0, NULL}
-};
-
-# endif
-
-int ossl_err_load_ENGINE_strings(void)
-{
-# ifndef OPENSSL_NO_ERR
-    if (ERR_reason_error_string(ENGINE_str_reasons[0].error) == NULL)
-        ERR_load_strings_const(ENGINE_str_reasons);
-# endif
-    return 1;
-}
-#else
-NON_EMPTY_TRANSLATION_UNIT
-#endif

crypto/engine/eng_fat.c

@@ -1,121 +0,0 @@
-/*
- * Copyright 2001-2020 The OpenSSL Project Authors. All Rights Reserved.
- * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
-#include "eng_local.h"
-#include <openssl/conf.h>
-
-int ENGINE_set_default(ENGINE *e, unsigned int flags)
-{
-    if ((flags & ENGINE_METHOD_CIPHERS) && !ENGINE_set_default_ciphers(e))
-        return 0;
-    if ((flags & ENGINE_METHOD_DIGESTS) && !ENGINE_set_default_digests(e))
-        return 0;
-    if ((flags & ENGINE_METHOD_RSA) && !ENGINE_set_default_RSA(e))
-        return 0;
-#ifndef OPENSSL_NO_DSA
-    if ((flags & ENGINE_METHOD_DSA) && !ENGINE_set_default_DSA(e))
-        return 0;
-#endif
-#ifndef OPENSSL_NO_DH
-    if ((flags & ENGINE_METHOD_DH) && !ENGINE_set_default_DH(e))
-        return 0;
-#endif
-#ifndef OPENSSL_NO_EC
-    if ((flags & ENGINE_METHOD_EC) && !ENGINE_set_default_EC(e))
-        return 0;
-#endif
-    if ((flags & ENGINE_METHOD_RAND) && !ENGINE_set_default_RAND(e))
-        return 0;
-    if ((flags & ENGINE_METHOD_PKEY_METHS)
-        && !ENGINE_set_default_pkey_meths(e))
-        return 0;
-    if ((flags & ENGINE_METHOD_PKEY_ASN1_METHS)
-        && !ENGINE_set_default_pkey_asn1_meths(e))
-        return 0;
-    return 1;
-}
-
-/* Set default algorithms using a string */
-
-static int int_def_cb(const char *alg, int len, void *arg)
-{
-    unsigned int *pflags = arg;
-    if (alg == NULL)
-        return 0;
-    if (strncmp(alg, "ALL", len) == 0)
-        *pflags |= ENGINE_METHOD_ALL;
-    else if (strncmp(alg, "RSA", len) == 0)
-        *pflags |= ENGINE_METHOD_RSA;
-    else if (strncmp(alg, "DSA", len) == 0)
-        *pflags |= ENGINE_METHOD_DSA;
-    else if (strncmp(alg, "DH", len) == 0)
-        *pflags |= ENGINE_METHOD_DH;
-    else if (strncmp(alg, "EC", len) == 0)
-        *pflags |= ENGINE_METHOD_EC;
-    else if (strncmp(alg, "RAND", len) == 0)
-        *pflags |= ENGINE_METHOD_RAND;
-    else if (strncmp(alg, "CIPHERS", len) == 0)
-        *pflags |= ENGINE_METHOD_CIPHERS;
-    else if (strncmp(alg, "DIGESTS", len) == 0)
-        *pflags |= ENGINE_METHOD_DIGESTS;
-    else if (strncmp(alg, "PKEY", len) == 0)
-        *pflags |= ENGINE_METHOD_PKEY_METHS | ENGINE_METHOD_PKEY_ASN1_METHS;
-    else if (strncmp(alg, "PKEY_CRYPTO", len) == 0)
-        *pflags |= ENGINE_METHOD_PKEY_METHS;
-    else if (strncmp(alg, "PKEY_ASN1", len) == 0)
-        *pflags |= ENGINE_METHOD_PKEY_ASN1_METHS;
-    else
-        return 0;
-    return 1;
-}
-
-int ENGINE_set_default_string(ENGINE *e, const char *def_list)
-{
-    unsigned int flags = 0;
-    if (!CONF_parse_list(def_list, ',', 1, int_def_cb, &flags)) {
-        ERR_raise_data(ERR_LIB_ENGINE, ENGINE_R_INVALID_STRING,
-                       "str=%s", def_list);
-        return 0;
-    }
-    return ENGINE_set_default(e, flags);
-}
-
-int ENGINE_register_complete(ENGINE *e)
-{
-    ENGINE_register_ciphers(e);
-    ENGINE_register_digests(e);
-    ENGINE_register_RSA(e);
-#ifndef OPENSSL_NO_DSA
-    ENGINE_register_DSA(e);
-#endif
-#ifndef OPENSSL_NO_DH
-    ENGINE_register_DH(e);
-#endif
-#ifndef OPENSSL_NO_EC
-    ENGINE_register_EC(e);
-#endif
-    ENGINE_register_RAND(e);
-    ENGINE_register_pkey_meths(e);
-    ENGINE_register_pkey_asn1_meths(e);
-    return 1;
-}
-
-int ENGINE_register_all_complete(void)
-{
-    ENGINE *e;
-
-    for (e = ENGINE_get_first(); e; e = ENGINE_get_next(e))
-        if (!(e->flags & ENGINE_FLAGS_NO_REGISTER_ALL))
-            ENGINE_register_complete(e);
-    return 1;
-}

crypto/engine/eng_init.c

@@ -1,121 +0,0 @@
-/*
- * Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-/* We need to use some engine deprecated APIs */
-#define OPENSSL_SUPPRESS_DEPRECATED
-
-#include "internal/e_os.h"
-#include "eng_local.h"
-
-/*
- * Initialise an engine type for use (or up its functional reference count if
- * it's already in use). This version is only used internally.
- */
-int engine_unlocked_init(ENGINE *e)
-{
-    int to_return = 1;
-
-    if ((e->funct_ref == 0) && e->init)
-        /*
-         * This is the first functional reference and the engine requires
-         * initialisation so we do it now.
-         */
-        to_return = e->init(e);
-    if (to_return) {
-        int ref;
-
-        /*
-         * OK, we return a functional reference which is also a structural
-         * reference.
-         */
-        if (!CRYPTO_UP_REF(&e->struct_ref, &ref)) {
-            e->finish(e);
-            return 0;
-        }
-        e->funct_ref++;
-        ENGINE_REF_PRINT(e, 0, 1);
-        ENGINE_REF_PRINT(e, 1, 1);
-    }
-    return to_return;
-}
-
-/*
- * Free a functional reference to an engine type. This version is only used
- * internally.
- */
-int engine_unlocked_finish(ENGINE *e, int unlock_for_handlers)
-{
-    int to_return = 1;
-
-    /*
-     * Reduce the functional reference count here so if it's the terminating
-     * case, we can release the lock safely and call the finish() handler
-     * without risk of a race. We get a race if we leave the count until
-     * after and something else is calling "finish" at the same time -
-     * there's a chance that both threads will together take the count from 2
-     * to 0 without either calling finish().
-     */
-    e->funct_ref--;
-    ENGINE_REF_PRINT(e, 1, -1);
-    if ((e->funct_ref == 0) && e->finish) {
-        if (unlock_for_handlers)
-            CRYPTO_THREAD_unlock(global_engine_lock);
-        to_return = e->finish(e);
-        if (unlock_for_handlers)
-            if (!CRYPTO_THREAD_write_lock(global_engine_lock))
-                return 0;
-        if (!to_return)
-            return 0;
-    }
-    REF_ASSERT_ISNT(e->funct_ref < 0);
-    /* Release the structural reference too */
-    if (!engine_free_util(e, 0)) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_FINISH_FAILED);
-        return 0;
-    }
-    return to_return;
-}
-
-/* The API (locked) version of "init" */
-int ENGINE_init(ENGINE *e)
-{
-    int ret;
-    if (e == NULL) {
-        ERR_raise(ERR_LIB_ENGINE, ERR_R_PASSED_NULL_PARAMETER);
-        return 0;
-    }
-    if (!RUN_ONCE(&engine_lock_init, do_engine_lock_init)) {
-        /* Maybe this should be raised in do_engine_lock_init() */
-        ERR_raise(ERR_LIB_ENGINE, ERR_R_CRYPTO_LIB);
-        return 0;
-    }
-    if (!CRYPTO_THREAD_write_lock(global_engine_lock))
-        return 0;
-    ret = engine_unlocked_init(e);
-    CRYPTO_THREAD_unlock(global_engine_lock);
-    return ret;
-}
-
-/* The API (locked) version of "finish" */
-int ENGINE_finish(ENGINE *e)
-{
-    int to_return = 1;
-
-    if (e == NULL)
-        return 1;
-    if (!CRYPTO_THREAD_write_lock(global_engine_lock))
-        return 0;
-    to_return = engine_unlocked_finish(e, 1);
-    CRYPTO_THREAD_unlock(global_engine_lock);
-    if (!to_return) {
-        ERR_raise(ERR_LIB_ENGINE, ENGINE_R_FINISH_FAILED);
-        return 0;
-    }
-    return to_return;
-}