4 files changed, 32 insertions, 2 deletions

diff --git a/crypto/openssh/rsa.c b/crypto/openssh/rsa.c
index 5cab80489121..7a2bed69505c 100644
--- a/crypto/openssh/rsa.c
+++ b/crypto/openssh/rsa.c
@@ -32,6 +32,8 @@
  * 
  *     [gone - had to be deleted - what a pity]
  * 
+ * $FreeBSD$
+ *
 */
 
 #include "includes.h"
@@ -125,7 +127,10 @@ rsa_public_encrypt(BIGNUM *out, BIGNUM *in, RSA *key)
 
 	if ((len = RSA_public_encrypt(ilen, inbuf, outbuf, key,
 	    RSA_PKCS1_PADDING)) <= 0)
-		fatal("rsa_public_encrypt() failed");
+	    if (BN_num_bits(key->n) > 1024 && RSA_libversion() == RSALIB_RSAREF)
+		fatal("rsa_private_encrypt() failed: RSAREF cannot handle keys larger than 1024 bits.");
+	    else
+		fatal("rsa_private_encrypt() failed.");
 
 	BN_bin2bn(outbuf, len, out);
 
@@ -150,7 +155,10 @@ rsa_private_decrypt(BIGNUM *out, BIGNUM *in, RSA *key)
 
 	if ((len = RSA_private_decrypt(ilen, inbuf, outbuf, key,
 	    RSA_PKCS1_PADDING)) <= 0)
-		fatal("rsa_private_decrypt() failed");
+	    if (BN_num_bits(key->n) > 1024 && RSA_libversion() == RSALIB_RSAREF)
+		fatal("rsa_private_decrypt() failed: RSAREF cannot handle keys larger than 1024 bits.");
+	    else
+		fatal("rsa_private_decrypt() failed.");
 
 	BN_bin2bn(outbuf, len, out);
 
diff --git a/crypto/openssl/crypto/rsa/rsa.h b/crypto/openssl/crypto/rsa/rsa.h
index 6c17cccdef6b..3040d03233db 100644
--- a/crypto/openssl/crypto/rsa/rsa.h
+++ b/crypto/openssl/crypto/rsa/rsa.h
@@ -244,6 +244,8 @@ int RSA_get_ex_new_index(long argl, char *argp, int (*new_func)(),
 int RSA_set_ex_data(RSA *r,int idx,char *arg);
 char *RSA_get_ex_data(RSA *r, int idx);
 
+int RSA_libversion();
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -308,6 +310,9 @@ char *RSA_get_ex_data(RSA *r, int idx);
 #define RSA_R_UNKNOWN_PADDING_TYPE			 118
 #define RSA_R_WRONG_SIGNATURE_LENGTH			 119
 
+#define RSALIB_OPENSSL	1
+#define RSALIB_RSAREF	2
+
 #ifdef  __cplusplus
 }
 #endif
diff --git a/crypto/openssl/crypto/rsa/rsa_stubs.c b/crypto/openssl/crypto/rsa/rsa_stubs.c
index 2da9e4268360..f164ce0133ac 100644
--- a/crypto/openssl/crypto/rsa/rsa_stubs.c
+++ b/crypto/openssl/crypto/rsa/rsa_stubs.c
@@ -87,6 +87,16 @@ ERR_load_RSA_strings_stub(void)
 }
 __weak_reference(ERR_load_RSA_strings_stub, ERR_load_RSA_strings);
 
+int
+RSA_libversion_stub(void)
+{
+    static void (*sym)(void);
+
+    if (sym || (sym = getsym("RSA_libversion")))
+	sym();
+}
+__weak_reference(RSA_libversion_stub, RSA_libversion);
+
 #else	/* !PIC */
 
 /* Sigh, just get your own libs, ld(1) doesn't deal with weaks here */
diff --git a/crypto/openssl/rsaref/rsaref_stubs.c b/crypto/openssl/rsaref/rsaref_stubs.c
index 6296ebb93ec9..f1f7063cdec7 100644
--- a/crypto/openssl/rsaref/rsaref_stubs.c
+++ b/crypto/openssl/rsaref/rsaref_stubs.c
@@ -40,6 +40,7 @@
 #ifndef NO_RSA
 
 #include <stdio.h>
+#include <openssl/rsa.h>
 
 #define VERBOSE_STUBS	/* undef if you don't want missing rsaref reported */
 
@@ -165,6 +166,12 @@ R_RandomUpdate_stub(void *randomStruct,
 }
 __weak_reference(R_RandomUpdate_stub, R_RandomUpdate);
 
+int
+RSA_libversion()
+{
+	return RSALIB_RSAREF;
+}
+
 #else	/* !PIC */
 
 /* Failsafe glue for static linking.  Link but complain like hell. */