I just noticed this on the Solaris 10 beta box that is lying around here:
fix compilation on Sun's cripples SUNWopenssl package.

Is this worth having before 4.1?

-d


Index: acconfig.h
===================================================================
RCS file: /var/cvs/openssh/acconfig.h,v
retrieving revision 1.181
diff -u -r1.181 acconfig.h
--- acconfig.h	25 Feb 2005 23:07:38 -0000	1.181
+++ acconfig.h	6 May 2005 00:55:41 -0000
@@ -457,6 +457,9 @@
 /* Define if you have /proc/$pid/fd */
 #undef HAVE_PROC_PID
 
+/* Define if OpenSSL is lacking > 128 bit AES EVP support */
+#undef OPENSSL_LOBOTOMISED_AES
+
 @BOTTOM@
 
 /* ******************* Shouldn't need to edit below this line ************** */
Index: cipher.c
===================================================================
RCS file: /var/cvs/openssh/cipher.c,v
retrieving revision 1.75
diff -u -r1.75 cipher.c
--- cipher.c	24 Jan 2005 10:57:11 -0000	1.75
+++ cipher.c	6 May 2005 00:55:41 -0000
@@ -93,15 +93,19 @@
 				SSH_CIPHER_SSH2, 16, 32, evp_rijndael },
 #else
 	{ "aes128-cbc",		SSH_CIPHER_SSH2, 16, 16, EVP_aes_128_cbc },
+#ifndef OPENSSL_LOBOTOMISED_AES
 	{ "aes192-cbc",		SSH_CIPHER_SSH2, 16, 24, EVP_aes_192_cbc },
 	{ "aes256-cbc",		SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc },
 	{ "rijndael-cbc@lysator.liu.se",
 				SSH_CIPHER_SSH2, 16, 32, EVP_aes_256_cbc },
 #endif
+#endif
 #if OPENSSL_VERSION_NUMBER >= 0x00905000L
 	{ "aes128-ctr",		SSH_CIPHER_SSH2, 16, 16, evp_aes_128_ctr },
+#ifndef OPENSSL_LOBOTOMISED_AES
 	{ "aes192-ctr",		SSH_CIPHER_SSH2, 16, 24, evp_aes_128_ctr },
 	{ "aes256-ctr",		SSH_CIPHER_SSH2, 16, 32, evp_aes_128_ctr },
+#endif
 #endif
 #if defined(EVP_CTRL_SET_ACSS_MODE)
 	{ "acss@openssh.org",	SSH_CIPHER_SSH2, 16, 5, EVP_acss },
Index: configure.ac
===================================================================
RCS file: /var/cvs/openssh/configure.ac,v
retrieving revision 1.260
diff -u -r1.260 configure.ac
--- configure.ac	24 Apr 2005 07:52:23 -0000	1.260
+++ configure.ac	6 May 2005 00:55:42 -0000
@@ -1457,6 +1457,26 @@
 	]
 )
 
+# Check for OpenSSL without EVP_aes_{192,256}_cbc
+AC_MSG_CHECKING([whether OpenSSL has crippled AES support])
+AC_RUN_IFELSE(
+	[AC_LANG_SOURCE([[
+#include <string.h>
+#include <openssl/evp.h>
+int main(void) { exit(EVP_aes_192_cbc() == NULL || EVP_aes_256_cbc() == NULL)}
+	]])],
+	[
+		AC_MSG_RESULT(no)
+	],
+	[
+		AC_MSG_RESULT(yes)
+		AC_DEFINE(OPENSSL_LOBOTOMISED_AES)
+	],
+	[
+		AC_MSG_WARN([cross compiling: not checking])
+	]
+)
+
 # Some systems want crypt() from libcrypt, *not* the version in OpenSSL,
 # because the system crypt() is more featureful.
 if test "x$check_for_libcrypt_before" = "x1"; then
