OK, I've amused myself with making sure the engines that have been

contributed TO WORK WITH 0.9.7 can be built as dynamically loadable
libraries.

For now, they're not included in crypto/engine/ since 0.9.7 is in
feature freeze.  Further discussion might change that, but don't hold
your breath.

18 files changed, 4865 insertions, 0 deletions

diff --git a/demos/engines/cluster_labs/Makefile b/demos/engines/cluster_labs/Makefile
new file mode 100644
index 0000000000..956193f093
--- /dev/null
+++ b/demos/engines/cluster_labs/Makefile
@@ -0,0 +1,114 @@
+LIBNAME=	libclabs
+SRC=		hw_cluster_labs.c
+OBJ=		hw_cluster_labs.o
+HEADER=		hw_cluster_labs.h
+
+CC=		gcc
+PIC=		-fPIC
+CFLAGS=		-g -I../../../include $(PIC) -DENGINE_DYNAMIC_SUPPORT -DFLAT_INC
+AR=		ar r
+RANLIB=		ranlib
+
+LIB=		$(LIBNAME).a
+SHLIB=		$(LIBNAME).so
+
+all:
+		@echo 'Please choose a system to build on:'
+		@echo ''
+		@echo 'tru64:    Tru64 Unix, Digital Unix, Digital OSF/1'
+		@echo 'solaris:  Solaris'
+		@echo 'irix:     IRIX'
+		@echo 'hpux32:   32-bit HP/UX'
+		@echo 'hpux64:   64-bit HP/UX'
+		@echo 'aix:      AIX'
+		@echo 'gnu:      Generic GNU-based system (gcc and GNU ld)'
+		@echo ''
+
+FORCE.update:
+update:		FORCE.update
+		perl ../../../util/mkerr.pl -conf hw_cluster_labs.ec \
+			-nostatic -staticloader -write hw_cluster_labs.c
+
+gnu:		$(SHLIB).gnu
+tru64:		$(SHLIB).tru64
+solaris:	$(SHLIB).solaris
+irix:		$(SHLIB).irix
+hpux32:		$(SHLIB).hpux32
+hpux64:		$(SHLIB).hpux64
+aix:		$(SHLIB).aix
+
+$(LIB):		$(OBJ)
+		$(AR) $(LIB) $(OBJ)
+		- $(RANLIB) $(LIB)
+
+LINK_SO=	\
+  ld -r -o $(LIBNAME).o $$ALLSYMSFLAGS $(LIB) && \
+  (nm -Pg $(LIBNAME).o | grep ' [BDT] ' | cut -f1 -d' ' > $(LIBNAME).exp; \
+   $$SHAREDCMD $$SHAREDFLAGS -o $(SHLIB) $(LIBNAME).o -L ../../.. -lcrypto -lc)
+
+$(SHLIB).gnu:	$(LIB)
+		ALLSYMSFLAGS='--whole-archive' \
+		SHAREDFLAGS='-shared -Wl,-soname=$(SHLIB)' \
+		SHAREDCMD='$(CC)'; \
+		$(LINK_SO)
+		touch $(SHLIB).gnu
+$(SHLIB).tru64:	$(LIB)
+		ALLSYMSFLAGS='-all' \
+		SHAREDFLAGS='-shared' \
+		SHAREDCMD='$(CC)'; \
+		$(LINK_SO)
+		touch $(SHLIB).tru64
+$(SHLIB).solaris:	$(LIB)
+		ALLSYMSFLAGS='-z allextract' \
+		SHAREDFLAGS='-G -h $(SHLIB)' \
+		SHAREDCMD='$(CC)'; \
+		$(LINK_SO)
+		touch $(SHLIB).solaris
+$(SHLIB).irix:	$(LIB)
+		ALLSYMSFLAGS='-all' \
+		SHAREDFLAGS='-shared -Wl,-soname,$(SHLIB)' \
+		SHAREDCMD='$(CC)'; \
+		$(LINK_SO)
+		touch $(SHLIB).irix
+$(SHLIB).hpux32:	$(LIB)
+		ALLSYMSFLAGS='-Fl' \
+		SHAREDFLAGS='+vnocompatwarnings -b -z +s +h $(SHLIB)' \
+		SHAREDCMD='/usr/ccs/bin/ld'; \
+		$(LINK_SO)
+		touch $(SHLIB).hpux32
+$(SHLIB).hpux64:	$(LIB)
+		ALLSYMSFLAGS='+forceload' \
+		SHAREDFLAGS='-b -z +h $(SHLIB)' \
+		SHAREDCMD='/usr/ccs/bin/ld'; \
+		$(LINK_SO)
+		touch $(SHLIB).hpux64
+$(SHLIB).aix:	$(LIB)
+		ALLSYMSFLAGS='-bnogc' \
+		SHAREDFLAGS='-G -bE:$(LIBNAME).exp -bM:SRE' \
+		SHAREDCMD='$(CC)'; \
+		$(LINK_SO)
+		touch $(SHLIB).aix
+
+depend:
+		sed -e '/^# DO NOT DELETE.*/,$$d' < Makefile > Makefile.tmp
+		echo '# DO NOT DELETE THIS LINE -- make depend depends on it.' >> Makefile.tmp
+		gcc -M $(CFLAGS) $(SRC) >> Makefile.tmp
+		perl ../../../util/clean-depend.pl < Makefile.tmp > Makefile.new
+		rm -f Makefile.tmp Makefile
+		mv Makefile.new Makefile
+
+# DO NOT DELETE THIS LINE -- make depend depends on it.
+
+rsaref.o: ../../../include/openssl/asn1.h ../../../include/openssl/bio.h
+rsaref.o: ../../../include/openssl/bn.h ../../../include/openssl/crypto.h
+rsaref.o: ../../../include/openssl/dh.h ../../../include/openssl/dsa.h
+rsaref.o: ../../../include/openssl/e_os2.h ../../../include/openssl/engine.h
+rsaref.o: ../../../include/openssl/err.h ../../../include/openssl/lhash.h
+rsaref.o: ../../../include/openssl/opensslconf.h
+rsaref.o: ../../../include/openssl/opensslv.h
+rsaref.o: ../../../include/openssl/ossl_typ.h ../../../include/openssl/rand.h
+rsaref.o: ../../../include/openssl/rsa.h ../../../include/openssl/safestack.h
+rsaref.o: ../../../include/openssl/stack.h ../../../include/openssl/symhacks.h
+rsaref.o: ../../../include/openssl/ui.h rsaref.c rsaref_err.c rsaref_err.h
+rsaref.o: source/des.h source/global.h source/md2.h source/md5.h source/rsa.h
+rsaref.o: source/rsaref.h
diff --git a/demos/engines/cluster_labs/cluster_labs.h b/demos/engines/cluster_labs/cluster_labs.h
new file mode 100644
index 0000000000..d0926796f0
--- /dev/null
+++ b/demos/engines/cluster_labs/cluster_labs.h
@@ -0,0 +1,35 @@
+typedef int cl_engine_init(void);
+typedef int cl_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+			const BIGNUM *m, BN_CTX *cgx);
+typedef int cl_mod_exp_crt(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+		const BIGNUM *q, const BIGNUM *dmp1, const BIGNUM *dmq1,
+		const BIGNUM *iqmp, BN_CTX *ctx);
+typedef int cl_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
+typedef int cl_rsa_pub_enc(int flen, const unsigned char *from,
+	     unsigned char *to, RSA *rsa, int padding);
+typedef int cl_rsa_pub_dec(int flen, const unsigned char *from,
+	     unsigned char *to, RSA *rsa, int padding);
+typedef int cl_rsa_priv_enc(int flen, const unsigned char *from, 
+		unsigned char *to, RSA *rsa, int padding);
+typedef int cl_rsa_priv_dec(int flen, const unsigned char *from, 
+		unsigned char *to, RSA *rsa, int padding);		
+typedef int cl_rand_bytes(unsigned char *buf, int num);
+typedef DSA_SIG *cl_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+typedef int cl_dsa_verify(const unsigned char *dgst, int dgst_len,
+				DSA_SIG *sig, DSA *dsa);
+
+
+static const char *CLUSTER_LABS_LIB_NAME = "cluster_labs";
+static const char *CLUSTER_LABS_F1	 = "hw_engine_init";
+static const char *CLUSTER_LABS_F2	 = "hw_mod_exp";
+static const char *CLUSTER_LABS_F3	 = "hw_mod_exp_crt";
+static const char *CLUSTER_LABS_F4	 = "hw_rsa_mod_exp";
+static const char *CLUSTER_LABS_F5	 = "hw_rsa_priv_enc";
+static const char *CLUSTER_LABS_F6	 = "hw_rsa_priv_dec";
+static const char *CLUSTER_LABS_F7	 = "hw_rsa_pub_enc";
+static const char *CLUSTER_LABS_F8	 = "hw_rsa_pub_dec";
+static const char *CLUSTER_LABS_F20	 = "hw_rand_bytes";
+static const char *CLUSTER_LABS_F30	 = "hw_dsa_sign";
+static const char *CLUSTER_LABS_F31	 = "hw_dsa_verify";
+
+
diff --git a/demos/engines/cluster_labs/hw_cluster_labs.c b/demos/engines/cluster_labs/hw_cluster_labs.c
new file mode 100644
index 0000000000..00c14f2755
--- /dev/null
+++ b/demos/engines/cluster_labs/hw_cluster_labs.c
@@ -0,0 +1,718 @@
+/* crypto/engine/hw_cluster_labs.c */
+/* Written by Jan Tschirschwitz (jan.tschirschwitz@cluster-labs.com
+ * for the OpenSSL project 2000.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+
+#define MSC_VER   /* only used cryptic.h */
+
+#include <stdio.h>
+#include <openssl/crypto.h>
+#include <openssl/dso.h>
+#include <openssl/des.h>
+#include <openssl/engine.h>
+
+#ifndef NO_HW
+#ifndef NO_HW_CLUSTER_LABS
+
+#ifdef FLAT_INC
+#include "cluster_labs.h"
+#else
+#include "vendor_defns/cluster_labs.h"
+#endif
+
+#define CL_LIB_NAME "cluster_labs engine"
+#include "hw_cluster_labs_err.c"
+
+
+static int cluster_labs_destroy(ENGINE *e);
+static int cluster_labs_init(ENGINE *e);
+static int cluster_labs_finish(ENGINE *e);
+static int cluster_labs_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)());
+
+
+/* BIGNUM stuff */
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int cluster_labs_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+		const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+		
+/* RSA stuff */
+#ifndef OPENSSL_NO_RSA
+static int cluster_labs_rsa_pub_enc(int flen, const unsigned char *from,
+	     unsigned char *to, RSA *rsa, int padding);
+static int cluster_labs_rsa_pub_dec(int flen, const unsigned char *from,
+	     unsigned char *to, RSA *rsa, int padding);
+static int cluster_labs_rsa_priv_enc(int flen, const unsigned char *from, 
+		unsigned char *to, RSA *rsa, int padding);
+static int cluster_labs_rsa_priv_dec(int flen, const unsigned char *from, 
+		unsigned char *to, RSA *rsa, int padding);
+static int cluster_labs_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa);
+#endif
+
+/* DSA stuff */
+#ifndef OPENSSL_NO_DSA
+DSA_SIG *cluster_labs_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa);
+static int cluster_labs_dsa_verify(const unsigned char *dgst, int dgst_len,
+				DSA_SIG *sig, DSA *dsa);
+static int cluster_labs_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+		BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+		BN_CTX *ctx, BN_MONT_CTX *in_mont);
+static int cluster_labs_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+		const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+		BN_MONT_CTX *m_ctx);
+#endif
+								
+/* DH stuff */
+#ifndef OPENSSL_NO_DH
+/* This function is alised to mod_exp (with the DH and mont dropped). */
+static int cluster_labs_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a, const BIGNUM *p, 
+		const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx);
+#endif
+		
+/* RANDOM stuff */						
+static int cluster_labs_rand_bytes(unsigned char *buf, int num);
+
+/* The definitions for control commands specific to this engine */
+#define CLUSTER_LABS_CMD_SO_PATH		ENGINE_CMD_BASE
+static const ENGINE_CMD_DEFN cluster_labs_cmd_defns[] =
+	{
+	{ CLUSTER_LABS_CMD_SO_PATH,
+	  "SO_PATH",
+	  "Specifies the path to the 'cluster labs' shared library",
+	  ENGINE_CMD_FLAG_STRING
+	},
+	{0, NULL, NULL, 0}
+	};
+
+/* Our internal RSA_METHOD that we provide pointers to */
+#ifndef OPENSSL_NO_RSA
+static RSA_METHOD cluster_labs_rsa =
+	{
+	"Cluster Labs RSA method",
+	cluster_labs_rsa_pub_enc,	/* rsa_pub_enc */
+	cluster_labs_rsa_pub_dec,	/* rsa_pub_dec */
+	cluster_labs_rsa_priv_enc,	/* rsa_priv_enc */
+	cluster_labs_rsa_priv_dec,	/* rsa_priv_dec */
+	cluster_labs_rsa_mod_exp,	/* rsa_mod_exp */
+	cluster_labs_mod_exp_mont,	/* bn_mod_exp */
+	NULL,				/* init */
+	NULL,				/* finish */
+	0, 				/* flags */
+	NULL,				/* apps_data */
+	NULL,				/* rsa_sign */
+	NULL				/* rsa_verify */
+	};
+#endif
+
+/* Our internal DSA_METHOD that we provide pointers to */
+#ifndef OPENSSL_NO_DSA
+static DSA_METHOD cluster_labs_dsa =
+	{
+	"Cluster Labs DSA method",
+	cluster_labs_dsa_sign,  	/* dsa_do_sign */
+	NULL, 				/* dsa_sign_setup */
+	cluster_labs_dsa_verify,	/* dsa_do_verify */
+	cluster_labs_dsa_mod_exp, 	/* dsa_mod_exp */
+	cluster_labs_mod_exp_dsa, 	/* bn_mod_exp */
+	NULL, 				/* init */
+	NULL, 				/* finish */
+	0, 				/* flags */
+	NULL 				/* app_data */
+	};
+#endif	
+
+/* Our internal DH_METHOD that we provide pointers to */
+#ifndef OPENSSL_NO_DH
+static DH_METHOD cluster_labs_dh =
+	{
+	"Cluster Labs DH method",
+	NULL,				/* generate key */
+	NULL,				/* compute key */
+	cluster_labs_mod_exp_dh,	/* bn_mod_exp */
+	NULL,				/* init */
+	NULL,				/* finish */
+	0,				/* flags */
+	NULL				/* app_data */
+	};
+#endif	
+	
+static RAND_METHOD cluster_labs_rand =
+	{
+	/* "Cluster Labs RAND method", */
+	NULL,				/* seed */
+	cluster_labs_rand_bytes,	/* bytes */
+	NULL,				/* cleanup */
+	NULL,				/* add */
+	cluster_labs_rand_bytes,	/* pseudorand */
+	NULL,				/* status */
+	};	
+
+static const char *engine_cluster_labs_id = "cluster_labs";
+static const char *engine_cluster_labs_name = "Cluster Labs hardware engine support";
+
+/* engine implementation */
+/*-----------------------*/
+static int bind_helper(ENGINE *e)
+	{
+	
+	if(!ENGINE_set_id(e, engine_cluster_labs_id) ||
+			!ENGINE_set_name(e, engine_cluster_labs_name) ||
+#ifndef OPENSSL_NO_RSA
+			!ENGINE_set_RSA(e, &cluster_labs_rsa) ||
+#endif
+#ifndef OPENSSL_NO_DSA
+			!ENGINE_set_DSA(e, &cluster_labs_dsa) ||
+#endif
+#ifndef OPENSSL_NO_DH
+			!ENGINE_set_DH(e, &cluster_labs_dh) ||
+#endif
+			!ENGINE_set_RAND(e, &cluster_labs_rand) ||
+			!ENGINE_set_destroy_function(e, cluster_labs_destroy) ||
+			!ENGINE_set_init_function(e, cluster_labs_init) ||
+			!ENGINE_set_finish_function(e, cluster_labs_finish) ||
+			!ENGINE_set_ctrl_function(e, cluster_labs_ctrl) ||
+			!ENGINE_set_cmd_defns(e, cluster_labs_cmd_defns))
+		return 0;
+	/* Ensure the error handling is set up */
+	ERR_load_CL_strings();
+	return 1;
+	}
+	
+#ifndef ENGINE_DYNAMIC_SUPPORT
+static ENGINE *engine_cluster_labs(void)
+	{
+	ENGINE *ret = ENGINE_new();
+
+	if(!ret)
+		return NULL;
+	if(!bind_helper(ret))
+		{
+		ENGINE_free(ret);
+		return NULL;
+		}
+	return ret;
+	}
+
+void ENGINE_load_cluster_labs(void)
+	{
+
+	ENGINE *cluster_labs = engine_cluster_labs();
+	
+	if(!cluster_labs) return;
+	ENGINE_add(cluster_labs);
+	ENGINE_free(cluster_labs);
+	ERR_clear_error();
+	}
+#endif /* !ENGINE_DYNAMIC_SUPPORT */
+
+static int cluster_labs_destroy(ENGINE *e)
+	{
+	
+	ERR_unload_CL_strings();
+	return 1;
+	}
+
+
+
+/* This is a process-global DSO handle used for loading and unloading
+ * the Cluster Labs library. NB: This is only set (or unset) during an
+ * init() or finish() call (reference counts permitting) and they're
+ * operating with global locks, so this should be thread-safe
+ * implicitly. */
+static DSO *cluster_labs_dso = NULL;
+
+/* These are the function pointers that are (un)set when the library has
+ * successfully (un)loaded. */
+static cl_engine_init	  	*p_cl_engine_init 		 = NULL;
+static cl_mod_exp	 	*p_cl_mod_exp 			 = NULL;
+static cl_mod_exp_crt		*p_cl_mod_exp_crt 		 = NULL;
+static cl_rsa_mod_exp		*p_cl_rsa_mod_exp 		 = NULL;
+static cl_rsa_priv_enc		*p_cl_rsa_priv_enc 		 = NULL;
+static cl_rsa_priv_dec		*p_cl_rsa_priv_dec 		 = NULL;
+static cl_rsa_pub_enc		*p_cl_rsa_pub_enc 		 = NULL;
+static cl_rsa_pub_dec		*p_cl_rsa_pub_dec 		 = NULL;
+static cl_rand_bytes		*p_cl_rand_bytes	 	 = NULL;
+static cl_dsa_sign		*p_cl_dsa_sign		 	 = NULL;
+static cl_dsa_verify		*p_cl_dsa_verify	 	 = NULL;
+
+
+int cluster_labs_init(ENGINE *e)
+	{
+
+	cl_engine_init			*p1;
+	cl_mod_exp			*p2;
+	cl_mod_exp_crt			*p3;
+	cl_rsa_mod_exp			*p4;
+	cl_rsa_priv_enc			*p5;
+	cl_rsa_priv_dec			*p6;	
+	cl_rsa_pub_enc			*p7;
+	cl_rsa_pub_dec			*p8;
+	cl_rand_bytes			*p20;
+	cl_dsa_sign			*p30;	
+	cl_dsa_verify			*p31;		
+	
+	/* engine already loaded */
+	if(cluster_labs_dso != NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_INIT,CL_R_ALREADY_LOADED);
+		goto err;
+		}
+	/* try to load engine	 */	
+	cluster_labs_dso = DSO_load(NULL, CLUSTER_LABS_LIB_NAME, NULL,0);
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_INIT,CL_R_DSO_FAILURE);
+		goto err;
+		}
+	/* bind functions */
+	if(	!(p1 = (cl_engine_init *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F1)) ||
+		!(p2 = (cl_mod_exp *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F2)) ||			
+		!(p3 = (cl_mod_exp_crt *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F3)) ||				
+		!(p4 = (cl_rsa_mod_exp *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F4)) ||				
+		!(p5 = (cl_rsa_priv_enc *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F5)) ||
+		!(p6 = (cl_rsa_priv_dec *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F6)) ||
+		!(p7 = (cl_rsa_pub_enc *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F7)) ||
+		!(p8 = (cl_rsa_pub_dec *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F8)) ||
+		!(p20= (cl_rand_bytes *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F20)) ||
+		!(p30= (cl_dsa_sign *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F30)) ||
+		!(p31= (cl_dsa_verify *)DSO_bind_func(
+				cluster_labs_dso, CLUSTER_LABS_F31)))
+		{
+		CLerr(CL_F_CLUSTER_LABS_INIT,CL_R_DSO_FAILURE);
+		goto err;
+		}
+		
+	/* copy function pointers */
+	p_cl_engine_init		= p1;
+	p_cl_mod_exp			= p2;
+	p_cl_mod_exp_crt		= p3;	
+	p_cl_rsa_mod_exp 		= p4;
+	p_cl_rsa_priv_enc	 	= p5;
+	p_cl_rsa_priv_dec	 	= p6;
+	p_cl_rsa_pub_enc	 	= p7;
+	p_cl_rsa_pub_dec	 	= p8;
+	p_cl_rand_bytes			= p20;	
+	p_cl_dsa_sign			= p30;
+	p_cl_dsa_verify			= p31;	
+	
+	
+	
+	/* cluster labs engine init */
+	if(p_cl_engine_init()== 0){
+		CLerr(CL_F_CLUSTER_LABS_INIT,CL_R_INIT_FAILED);		
+		goto err;
+	}
+
+	return(1);
+
+err:	
+	/* reset all pointers */
+	if(cluster_labs_dso)
+		DSO_free(cluster_labs_dso);
+
+	cluster_labs_dso		= NULL;
+	p_cl_engine_init		= NULL;	
+	p_cl_mod_exp			= NULL;
+	p_cl_mod_exp_crt		= NULL;
+	p_cl_rsa_mod_exp		= NULL;
+	p_cl_rsa_priv_enc		= NULL;
+	p_cl_rsa_priv_dec		= NULL;	
+	p_cl_rsa_pub_enc		= NULL;
+	p_cl_rsa_pub_dec		= NULL;	
+	p_cl_rand_bytes			= NULL;	
+	p_cl_dsa_sign			= NULL;
+	p_cl_dsa_verify			= NULL;	
+	
+	return(0);
+	}
+	
+
+static int cluster_labs_finish(ENGINE *e)
+	{
+
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_FINISH,CL_R_NOT_LOADED);
+		return 0;
+		}
+	if(!DSO_free(cluster_labs_dso))
+		{
+		CLerr(CL_F_CLUSTER_LABS_FINISH,CL_R_DSO_FAILURE);
+		return 0;
+		}
+		
+	cluster_labs_dso 		= NULL;
+	p_cl_engine_init		= NULL;		
+	p_cl_mod_exp			= NULL;
+	p_cl_rsa_mod_exp		= NULL;	
+	p_cl_mod_exp_crt		= NULL;	
+	p_cl_rsa_priv_enc		= NULL;	
+	p_cl_rsa_priv_dec		= NULL;	
+	p_cl_rsa_pub_enc		= NULL;
+	p_cl_rsa_pub_dec		= NULL;	
+	p_cl_rand_bytes			= NULL;		
+	p_cl_dsa_sign			= NULL;
+	p_cl_dsa_verify			= NULL;	
+	
+	return(1);	
+	
+	}
+	
+static int cluster_labs_ctrl(ENGINE *e, int cmd, long i, void *p, void (*f)())
+	{
+	int initialised = ((cluster_labs_dso == NULL) ? 0 : 1);
+
+	switch(cmd)
+		{
+	case CLUSTER_LABS_CMD_SO_PATH:
+		if(p == NULL)
+			{
+			CLerr(CL_F_CLUSTER_LABS_CTRL,ERR_R_PASSED_NULL_PARAMETER);
+			return 0;
+			}
+		if(initialised)
+			{
+			CLerr(CL_F_CLUSTER_LABS_CTRL,CL_R_ALREADY_LOADED);
+			return 0;
+			}
+		CLUSTER_LABS_LIB_NAME = (const char *)p;
+		return 1;
+	default:
+		break;
+		}
+	CLerr(CL_F_CLUSTER_LABS_CTRL,CL_R_COMMAND_NOT_IMPLEMENTED);
+	return 0;
+	}
+	
+
+static int cluster_labs_mod_exp(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+		const BIGNUM *m, BN_CTX *ctx)
+	{
+
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_MOD_EXP,CL_R_NOT_LOADED);
+		return 0;
+		}	
+	if(p_cl_mod_exp == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_MOD_EXP,CL_R_FUNCTION_NOT_BINDED);
+		return 0;
+		}
+
+	return	p_cl_mod_exp(r, a, p, m, ctx);
+
+	}
+	
+static int cluster_labs_mod_exp_crt(BIGNUM *r, BIGNUM *a, const BIGNUM *p,
+		const BIGNUM *q, const BIGNUM *dmp1, const BIGNUM *dmq1,
+		const BIGNUM *iqmp, BN_CTX *ctx)
+	{
+
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_MOD_EXP_CRT,CL_R_NOT_LOADED);		
+		return 0;
+		}
+	if(p_cl_mod_exp_crt == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_MOD_EXP_CRT,CL_R_FUNCTION_NOT_BINDED);		
+		return 0;
+		}
+	
+	return	p_cl_mod_exp_crt(r, a, p, q,dmp1, dmq1, iqmp, ctx);
+	
+	}
+	
+static int cluster_labs_rsa_mod_exp(BIGNUM *r0, const BIGNUM *I, RSA *rsa)
+	{
+
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RSA_MOD_EXP,CL_R_NOT_LOADED);		
+		return 0;
+		}
+	if(p_cl_rsa_mod_exp == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RSA_MOD_EXP,CL_R_FUNCTION_NOT_BINDED);				
+		return 0;
+		}
+
+	return p_cl_rsa_mod_exp(r0, I, rsa);
+
+	}
+	
+DSA_SIG *cluster_labs_dsa_sign(const unsigned char *dgst, int dlen, DSA *dsa)
+	{
+
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_DSA_SIGN,CL_R_NOT_LOADED);		
+		return 0;
+		}
+	if(p_cl_dsa_sign == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_DSA_SIGN,CL_R_FUNCTION_NOT_BINDED);				
+		return 0;
+		}
+
+	return p_cl_dsa_sign(dgst, dlen, dsa);
+	
+	}
+	
+static int cluster_labs_dsa_verify(const unsigned char *dgst, int dgst_len,
+				DSA_SIG *sig, DSA *dsa)
+	{
+
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_DSA_VERIFY,CL_R_NOT_LOADED);		
+		return 0;
+		}
+	
+	if(p_cl_dsa_verify == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_DSA_VERIFY,CL_R_FUNCTION_NOT_BINDED);				
+		return 0;
+		}
+
+	return p_cl_dsa_verify(dgst, dgst_len, sig, dsa);
+	
+	}			
+
+static int cluster_labs_dsa_mod_exp(DSA *dsa, BIGNUM *rr, BIGNUM *a1,
+		BIGNUM *p1, BIGNUM *a2, BIGNUM *p2, BIGNUM *m,
+		BN_CTX *ctx, BN_MONT_CTX *in_mont)
+	{
+	BIGNUM t;
+	int status = 0;
+		
+	BN_init(&t);
+	/* let rr = a1 ^ p1 mod m */
+	if (!cluster_labs_mod_exp(rr,a1,p1,m,ctx)) goto end;
+	/* let t = a2 ^ p2 mod m */
+	if (!cluster_labs_mod_exp(&t,a2,p2,m,ctx)) goto end;
+	/* let rr = rr * t mod m */
+	if (!BN_mod_mul(rr,rr,&t,m,ctx)) goto end;
+	status = 1;
+end:
+	BN_free(&t);
+	
+	return(1);
+
+	}
+
+static int cluster_labs_mod_exp_dsa(DSA *dsa, BIGNUM *r, BIGNUM *a,
+		const BIGNUM *p, const BIGNUM *m, BN_CTX *ctx,
+		BN_MONT_CTX *m_ctx)
+	{
+	return 	cluster_labs_mod_exp(r, a, p, m, ctx);
+	}
+	
+/* This function is aliased to mod_exp (with the mont stuff dropped). */
+static int cluster_labs_mod_exp_mont(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+		const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+	{
+	return	cluster_labs_mod_exp(r, a, p, m, ctx);
+	}
+	
+
+/* This function is aliased to mod_exp (with the dh and mont dropped). */
+static int cluster_labs_mod_exp_dh(const DH *dh, BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
+		const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *m_ctx)
+	{
+	return 	cluster_labs_mod_exp(r, a, p, m, ctx);
+	}
+
+
+static int cluster_labs_rsa_pub_enc(int flen, const unsigned char *from,
+	     unsigned char *to, RSA *rsa, int padding)
+	{
+
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RSA_PUB_ENC,CL_R_NOT_LOADED);		
+		return 0;
+		}
+	if(p_cl_rsa_priv_enc == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RSA_PUB_ENC,CL_R_FUNCTION_NOT_BINDED);				
+		return 0;
+		}
+		
+	return 	p_cl_rsa_pub_enc(flen, from, to, rsa, padding);
+	
+	}  
+	     
+static int cluster_labs_rsa_pub_dec(int flen, const unsigned char *from,
+	     unsigned char *to, RSA *rsa, int padding)
+	{
+
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RSA_PUB_DEC,CL_R_NOT_LOADED);		
+		return 0;
+		}
+	if(p_cl_rsa_priv_enc == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RSA_PUB_DEC,CL_R_FUNCTION_NOT_BINDED);				
+		return 0;
+		}
+		
+	return 	p_cl_rsa_pub_dec(flen, from, to, rsa, padding);
+	
+	}  
+
+
+static int cluster_labs_rsa_priv_enc(int flen, const unsigned char *from, 
+		unsigned char *to, RSA *rsa, int padding)
+	{
+
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RSA_PRIV_ENC,CL_R_NOT_LOADED);		
+		return 0;
+		}
+
+	if(p_cl_rsa_priv_enc == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RSA_PRIV_ENC,CL_R_FUNCTION_NOT_BINDED);				
+		return 0;
+		}
+		
+	return 	p_cl_rsa_priv_enc(flen, from, to, rsa, padding);
+	
+	}  
+
+static int cluster_labs_rsa_priv_dec(int flen, const unsigned char *from, 
+		unsigned char *to, RSA *rsa, int padding)
+	{
+	
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RSA_PRIV_DEC,CL_R_NOT_LOADED);		
+		return 0;
+		}
+	if(p_cl_rsa_priv_dec == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RSA_PRIV_DEC,CL_R_FUNCTION_NOT_BINDED);				
+		return 0;
+		}
+
+	return 	p_cl_rsa_priv_dec(flen, from, to, rsa, padding);
+		
+	}  
+
+/************************************************************************************
+* Symmetric algorithms
+************************************************************************************/
+/* this will be come soon! */
+
+/************************************************************************************
+* Random generator
+************************************************************************************/
+
+static int cluster_labs_rand_bytes(unsigned char *buf, int num){
+
+	if(cluster_labs_dso == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RAND_BYTES,CL_R_NOT_LOADED);		
+		return 0;
+		}
+	if(p_cl_mod_exp_crt == NULL)
+		{
+		CLerr(CL_F_CLUSTER_LABS_RAND_BYTES,CL_R_FUNCTION_NOT_BINDED);				
+		return 0;
+		}
+
+	return 	p_cl_rand_bytes(buf, num);
+
+}
+
+
+/* This stuff is needed if this ENGINE is being compiled into a self-contained
+ * shared-library. */
+#ifdef ENGINE_DYNAMIC_SUPPORT
+static int bind_fn(ENGINE *e, const char *id)
+	{
+	fprintf(stderr, "bind_fn CLUSTER_LABS\n");
+	if(id && (strcmp(id, engine_cluster_labs_id) != 0)) {
+		fprintf(stderr, "bind_fn return(0) first\n");
+		return 0;
+		}
+	if(!bind_helper(e)) {
+		fprintf(stderr, "bind_fn return(1) first\n");
+		return 0;
+		}
+	fprintf(stderr, "bind_fn return(1)\n");		
+	return 1;
+	}
+IMPLEMENT_DYNAMIC_CHECK_FN()
+IMPLEMENT_DYNAMIC_BIND_FN(bind_fn)
+#endif /* ENGINE_DYNAMIC_SUPPORT */
+						
+#endif /* !NO_HW_CLUSTER_LABS */
+#endif /* !NO_HW */
+
diff --git a/demos/engines/cluster_labs/hw_cluster_labs.ec b/demos/engines/cluster_labs/hw_cluster_labs.ec
new file mode 100644
index 0000000000..1f64786542
--- /dev/null
+++ b/demos/engines/cluster_labs/hw_cluster_labs.ec
@@ -0,0 +1,8 @@
+# configuration file for util/mkerr.pl
+#
+# use like this:
+#
+#	perl ../../../util/mkerr.pl -conf hw_cluster_labs.ec \
+#		-nostatic -staticloader -write *.c
+
+L CL		hw_cluster_labs_err.h		hw_cluster_labs_err.c
diff --git a/demos/engines/cluster_labs/hw_cluster_labs_err.c b/demos/engines/cluster_labs/hw_cluster_labs_err.c
new file mode 100644
index 0000000000..a7fa4083b1
--- /dev/null
+++ b/demos/engines/cluster_labs/hw_cluster_labs_err.c
@@ -0,0 +1,151 @@
+/* hw_cluster_labs_err.c */
+/* ====================================================================
+ * Copyright (c) 1999-2002 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    openssl-core@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR