Enhancement: support openssl engines

[nagiosenterprises]

Enhancement: support openssl engines

[skrueger8]

Quick win, call at least ENGINE_load_builtin_engines() to get hardware crypto out of the box...

A call to ENGINE_load_builtin_engines loads all built-in engines, including those for AES_NI instructions and RDRAND. After the call, OpenSSL will use the engines for AES encryption and random number generation, if available. In this case, RDRAND will be the only source of random numbers.

https://wiki.openssl.org/index.php/Library_Initialization

[skrueger8]

I did some testing (Solaris 11 and FreeBSD 11, OpenSSL 1.0.1) and it seems hardware crypto such as AESNI is already used without calling ENGINE_load_builtin_engines():

root@x86:~# dtrace -n 'pid$target::*crypt*:entry { @[probemod, probefunc] = count(); }' -c ".../check_nrpe -H 127.0.0.1"
dtrace: description 'pid$target::*crypt*:entry ' matched 9 probes
NRPE v3.0.1
dtrace: pid 12461 has exited

  libcrypto.so.1.0.0                                  ERR_load_crypto_strings                                           1
  libcrypto.so.1.0.0                                  _aesni_encrypt4                                                   1
  libcrypto.so.1.0.0                                  CRYPTO_gcm128_decrypt_ctr32                                       2
  libcrypto.so.1.0.0                                  aesni_set_encrypt_key                                             2
  libcrypto.so.1.0.0                                  CRYPTO_gcm128_encrypt_ctr32                                       3
  libcrypto.so.1.0.0                                  aesni_ctr32_encrypt_blocks                                        4
  libcrypto.so.1.0.0                                  aesni_encrypt                                                    10

SPARC T7 with builtin T4 engine:

root@t7:/~ # dtrace -n 'pid$target::*crypt*:entry { @[probemod, probefunc] = count(); }' -c ".../check_nrpe -H 127.0.0.1"
dtrace: description 'pid$target::*crypt*:entry ' matched 9 probes
NRPE v2.12
dtrace: pid 21481 has exited

  libcrypto.so.1.0.0                                  ERR_load_crypto_strings                                           2
  libcrypto.so.1.0.0                                  aes_t4_set_encrypt_key                                            4
  libcrypto.so.1.0.0                                  CRYPTO_gcm128_decrypt_ctr32                                       5
  libcrypto.so.1.0.0                                  CRYPTO_gcm128_encrypt_ctr32                                       6
  libcrypto.so.1.0.0                                  aes256_t4_ctr32_encrypt                                           7
  libcrypto.so.1.0.0                                  aes_t4_encrypt                                                   22

But it would still be nice to use a non-builtin engine such as pkcs11 on older SPARC (M10/T1000/T5xx0/T3/etc.) servers to use hardware crypto there, too.

[hedenface]

I think this is a good idea. We'll talk about it at our next internal open source development meeting.

[hedenface]

I went with the quick implementation, which should be fine. We may discuss allowing engines in the future, but this seems like something more for NCPA to be honest. What's your opinion @jomann09 ?

Anyway, added in 50cbea7.