test was never triggered due to an off-by-one error.

In s23_clnt.c, don't use special rollback-attack detection padding
(RSA_SSLV23_PADDING) if SSL 2.0 is the only protocol enabled in the
client; similarly, in s23_srvr.c, don't do the rollback check if
SSL 2.0 is the only protocol enabled in the server.

New ASN1_STRING_print_ex() and X509_NAME_print_ex()
functions. These are intended to be replacements
for the ancient ASN1_STRING_print() and X509_NAME_print()
functions.

The new functions support RFC2253 and various pretty
printing options. It is also possible to display
international characters if the terminal properly handles
UTF8 encoding (Linux seems to tolerate this if the
"unicode_start" script is run).

Still needs to be documented, integrated into other
utilities and extensively tested.

therefore have unallocated parts.  Therefore, a check for the 0 case
is needed, resulting with the same thing as when a is negative.

BN_add_word becomes wrongly negative...
This was discovered by Darrel Hankerson <dhankers@cacr.math.uwaterloo.ca>

supporting threads, which means that th assertion is supperbly
dangerous, so make sure it's not compiled under Win32, period.

'openssl asn1parse'.  As a side effect, the functions ASN1_parse_dump
and BIO_dump_indent are added.

didn't recognise NULL to mean 'don't output anything'

size) through the base64 filter, b64_write() messes up it's parameters
in such a way that instead of writing correct base64 output, the first
4 characters of that output is repeated over and over.  This fix
corrects that problem.

it wants to stir the pool using ssleay_rand_add.  This fix provides the
possibility to call ssleay_rand_add inside a locked state by simply telling
it not to do any locking through a static variable.  This isn't the most
elegant way one could do this, but it does retain thread safety during the
stirring process.

In crypto/err/err.c need to initialise p to
NULL in case thread_hash is NULL. Otherwise
p will be uninitialized.

ASN1_TIME fixes.

New function c2i_ASN1_OBJECT().

that of the result pointer to bn_mul was the same as one of the two arguments,
That argument might have it's sign destroyed.  He provided this fix.

state at the same time.

(there's no way to get it through configuration yet).

libraries even if the "shared" configuration option wasn't chosen.

start, but can save you some trouble.  Just ignore "shared" if it
comes up among the given options, at least for now...

has helped me a bit when I ran into trouble.

there's support for building under Linux and True64 (using examples
from the programming manuals), including versioning that is currently
the same as OpenSSL versions but should really be a different series.

With this change, it's up to the users to decide if they want shared
libraries as well as the static ones.  This decision now has to be
done at configuration time (well, not really, those who know what they
do can still do it the same way as before).

The OpenSSL programs (openssl and the test programs) are currently
always linked statically, but this may change in the future in a
configurable manner.  The necessary makefile variables to enable this
are in place.

Also note that I have done absolutely nothing about the Windows target
to get something similar.  On the other hand, DLLs are already the
default there, but without versioning, and I've no idea what the
possibilities for such a thing are there...

rand_lcl.h

Make req seed the PRNG if signing with
an already existing DSA key.

Document the new smime options.

is easier to grasp.

call the i2c/c2i (they were not using the
content length for the headers).

Fix ASN1 long form tag encoding. This never
worked but it was never tested since it is
only used for tags > 30.

New options to smime program to allow the
PKCS#7 format to be specified and the content
supplied externally.

New ASN1 functions that just deal with
content octets, not tag+length.

limit higher and thereby get through compilation of sha_dgst.c.

could be done automagically, much like the numbering in libeay.num and
ssleay.num.  The solution works as follows:

  - New object identifiers are inserted in objects.txt, following the
    syntax given in objects.README.
  - objects.pl is used to process obj_mac.num and create a new
    obj_mac.h.
  - obj_dat.pl is used to create a new obj_dat.h, using the data in
    obj_mac.h.

This is currently kind of a hack, and the perl code in objects.pl
isn't very elegant, but it works as I intended.  The simplest way to
check that it worked correctly is to look in obj_dat.h and check the
array nid_objs and make sure the objects haven't moved around (this is
important!).  Additions are OK, as well as consistent name changes.