Skip to content
CHANGES 227 KiB
Newer Older
 OpenSSL CHANGES
 Changes between 0.9.6 and 0.9.7  [xx XXX 2001]
Bodo Möller's avatar
Bodo Möller committed
     OpenSSL 0.9.6a/0.9.6b (bugfix releases, 5 Apr 2001 and 9 July 2001)
     and OpenSSL 0.9.7 were developped in parallel, based on OpenSSL 0.9.6.  

     Change log entries are tagged as follows:
Bodo Möller's avatar
Bodo Möller committed
         -) applies to 0.9.6a/0.9.6b/0.9.6c only
         *) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7
Bodo Möller's avatar
Bodo Möller committed
  *) Improve RSA_padding_check_PKCS1_OAEP() check again to avoid
     'wristwatch attack' using huge encoding parameters (cf.
     James H. Manger's CRYPTO 2001 paper).  Note that the
     RSA_PKCS1_OAEP_PADDING case of RSA_private_decrypt() does not use
     encoding paramters and hence was not vulnerable.
     [Bodo Moeller]

  +) Add a "destroy" handler to ENGINEs that allows structural cleanup to
     be done prior to destruction. Use this to unload error strings from
     ENGINEs that load their own error strings. NB: This adds two new API
     functions to "get" and "set" this destroy handler in an ENGINE.
Bodo Möller's avatar
Bodo Möller committed
     [Geoff Thorpe]
  +) Alter all existing ENGINE implementations (except "openssl" and
     "openbsd") to dynamically instantiate their own error strings. This
     makes them more flexible to be built both as statically-linked ENGINEs
     and self-contained shared-libraries loadable via the "dynamic" ENGINE.
     Also, add stub code to each that makes building them as self-contained
     shared-libraries easier (see README.ENGINE).
     [Geoff Thorpe]

  +) Add a "dynamic" ENGINE that provides a mechanism for binding ENGINE
     implementations into applications that are completely implemented in
     self-contained shared-libraries. The "dynamic" ENGINE exposes control
     commands that can be used to configure what shared-library to load and
     to control aspects of the way it is handled. Also, made an update to
     the README.ENGINE file that brings its information up-to-date and
     provides some information and instructions on the "dynamic" ENGINE
     (ie. how to use it, how to build "dynamic"-loadable ENGINEs, etc).
     [Geoff Thorpe]

  *) BN_sqr() bug fix.
     [Ulf Möller, reported by Jim Ellis <jim.ellis@cavium.com>]

  *) Make it possible to unload ranges of ERR strings with a new
     "ERR_unload_strings" function.
     [Geoff Thorpe]

  *) Rabin-Miller test analyses assume uniformly distributed witnesses,
     so use BN_pseudo_rand_range() instead of using BN_pseudo_rand()
     followed by modular reduction.
     [Bodo Moeller; pointed out by Adam Young <AYoung1@NCSUS.JNJ.COM>]

  *) Add BN_pseudo_rand_range() with obvious functionality: BN_rand_range()
     requivalent based on BN_pseudo_rand() instead of BN_rand().
     [Bodo Moeller]

  +) Add a copy() function to EVP_MD.
     [Ben Laurie]

  +) Make EVP_MD routines take a context pointer instead of just the
     md_data voud pointer.
     [Ben Laurie]

  +) Add flags to EVP_MD and EVP_MD_CTX. EVP_MD_FLAG_ONESHOT indicates
     that the digest can only process a single chunk of data
     (typically because it is provided by a piece of
     hardware). EVP_MD_CTX_FLAG_ONESHOT indicates that the application
     is only going to provide a single chunk of data, and hence the
     framework needn't accumulate the data for oneshot drivers.
     [Ben Laurie]

  +) As with "ERR", make it possible to replace the underlying "ex_data"
     functions. This change also alters the storage and management of global
     ex_data state - it's now all inside ex_data.c and all "class" code (eg.
     RSA, BIO, SSL_CTX, etc) no longer stores its own STACKS and per-class
     index counters. The API functions that use this state have been changed
     to take a "class_index" rather than pointers to the class's local STACK
     and counter, and there is now an API function to dynamically create new
     classes. This centralisation allows us to (a) plug a lot of the
     thread-safety problems that existed, and (b) makes it possible to clean
     up all allocated state using "CRYPTO_cleanup_all_ex_data()". W.r.t. (b)
     such data would previously have always leaked in application code and
     workarounds were in place to make the memory debugging turn a blind eye
     to it. Application code that doesn't use this new function will still
     leak as before, but their memory debugging output will announce it now
     rather than letting it slide.

     Besides the addition of CRYPTO_cleanup_all_ex_data(), another API change
     induced by the "ex_data" overhaul is that X509_STORE_CTX_init() now
     has a return value to indicate success or failure.
     [Geoff Thorpe]

Geoff Thorpe's avatar
Geoff Thorpe committed
  +) Make it possible to replace the underlying "ERR" functions such that the
     global state (2 LHASH tables and 2 locks) is only used by the "default"
     implementation. This change also adds two functions to "get" and "set"
     the implementation prior to it being automatically set the first time
     any other ERR function takes place. Ie. an application can call "get",
     pass the return value to a module it has just loaded, and that module
     can call its own "set" function using that value. This means the
     module's "ERR" operations will use (and modify) the error state in the
     application and not in its own statically linked copy of OpenSSL code.
     [Geoff Thorpe]

  +) Give DH, DSA, and RSA types their own "**_up_ref()" function to increment
     reference counts. This performs normal REF_PRINT/REF_CHECK macros on
     the operation, and provides a more encapsulated way for external code
     (crypto/evp/ and ssl/) to do this. Also changed the evp and ssl code
     to use these functions rather than manually incrementing the counts.

     Also rename "DSO_up()" function to more descriptive "DSO_up_ref()".
     [Geoff Thorpe]

  *) s3_srvr.c: allow sending of large client certificate lists (> 16 kB).
     This function was broken, as the check for a new client hello message
     to handle SGC did not allow these large messages.
     (Tracked down by "Douglas E. Engert" <deengert@anl.gov>.)
     [Lutz Jaenicke]

  *) Add alert descriptions for TLSv1 to SSL_alert_desc_string[_long]().
     [Lutz Jaenicke]

Ben Laurie's avatar
Ben Laurie committed
  +) Add EVP test program.
     [Ben Laurie]

  +) Add symmetric cipher support to ENGINE. Expect the API to change!
     [Ben Laurie]

Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
  +) New CRL functions: X509_CRL_set_version(), X509_CRL_set_issuer_name()
     X509_CRL_set_lastUpdate(), X509_CRL_set_nextUpdate(), X509_CRL_sort(),
     X509_REVOKED_set_serialNumber(), and X509_REVOKED_set_revocationDate().
     These allow a CRL to be built without having to access X509_CRL fields
     directly. Modify 'ca' application to use new functions.
     [Steve Henson]

  *) Fix buggy behaviour of BIO_get_num_renegotiates() and BIO_ctrl()
     for BIO_C_GET_WRITE_BUF_SIZE ("Stephen Hinton" <shinton@netopia.com>).
     [Lutz Jaenicke]

  *) Rework the configuration and shared library support for Tru64 Unix.
     The configuration part makes use of modern compiler features and
     still retains old compiler behavior for those that run older versions
     of the OS.  The shared library support part includes a variant that
     uses the RPATH feature, and is available through the speciel
     configuration target "alpha-cc-rpath", which will never be selected
     automatically.
     [Tim Mooney <mooney@dogbert.cc.ndsu.NoDak.edu> via Richard Levitte]

  *) In ssl3_get_key_exchange (ssl/s3_clnt.c), call ssl3_get_message()
     with the same message size as in ssl3_get_certificate_request().
     Otherwise, if no ServerKeyExchange message occurs, CertificateRequest
     messages might inadvertently be reject as too long.
     [Petr Lampa <lampa@fee.vutbr.cz>]

  +) Move SSL_OP_TLS_ROLLBACK_BUG out of the SSL_OP_ALL list of recommended
     bug workarounds. Rollback attack detection is a security feature.
Bodo Möller's avatar
Bodo Möller committed
     The problem will only arise on OpenSSL servers when TLSv1 is not
     available (sslv3_server_method() or SSL_OP_NO_TLSv1).
     Software authors not wanting to support TLSv1 will have special reasons
     for their choice and can explicitly enable this option.
     [Bodo Moeller, Lutz Jaenicke]

  +) Rationalise EVP so it can be extended: don't include a union of
     cipher/digest structures, add init/cleanup functions. This also reduces
     the number of header dependencies.
     [Ben Laurie]

Ben Laurie's avatar
Ben Laurie committed
  +) Make DES key schedule conform to the usual scheme, as well as
     correcting its structure. This means that calls to DES functions
     now have to pass a pointer to a des_key_schedule instead of a
     plain des_key_schedule (which was actually always a pointer
     anyway).
  +) Enhanced support for IA-64 Unix platforms (well, Linux and HP-UX).
     [Andy Polyakov]

  *) Modified SSL library such that the verify_callback that has been set
     specificly for an SSL object with SSL_set_verify() is actually being
     used. Before the change, a verify_callback set with this function was
     ignored and the verify_callback() set in the SSL_CTX at the time of
     the call was used. New function X509_STORE_CTX_set_verify_cb() introduced
     to allow the necessary settings.
     [Lutz Jaenicke]

Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
  +) Initial reduction of linker bloat: the use of some functions, such as
     PEM causes large amounts of unused functions to be linked in due to
     poor organisation. For example pem_all.c contains every PEM function
     which has a knock on effect of linking in large amounts of (unused)
     ASN1 code. Grouping together similar functions and splitting unrelated
     functions prevents this.
     [Steve Henson]

  *) Initialize static variable in crypto/dsa/dsa_lib.c and crypto/dh/dh_lib.c
     explicitely to NULL, as at least on Solaris 8 this seems not always to be
     done automatically (in contradiction to the requirements of the C
Loading full blame...