Skip to content
CHANGES 245 KiB
Newer Older
 OpenSSL CHANGES
 Changes between 0.9.7 and 0.9.8  [xx XXX 2001]

  *)

 Changes between 0.9.6 and 0.9.7  [xx XXX 2001]
     OpenSSL 0.9.6a/0.9.6b/0.9.6c (bugfix releases, 5 Apr 2001, 9 July 2001
     and 21 Dec 2001) and OpenSSL 0.9.7 were developed in parallel, based
     on OpenSSL 0.9.6.  
Bodo Möller's avatar
Bodo Möller committed

     Change log entries are tagged as follows:
Bodo Möller's avatar
Bodo Möller committed
         -) applies to 0.9.6a/0.9.6b/0.9.6c only
         *) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7
  *) Add information about CygWin32 1.3 and on, and preserve proper
     configuration for the versions before that.
     [Corinna Vinschen <vinschen@redhat.com> and Richard Levitte]

  *) Make removal from session cache (SSL_CTX_remove_session()) more robust:
     check whether we deal with a copy of a session and do not delete from
     the cache in this case. Problem reported by "Izhar Shoshani Levi"
     <izhar@checkpoint.com>.
     [Lutz Jaenicke]

  *) Do not store session data into the internal session cache, if it
     is never intended to be looked up (SSL_SESS_CACHE_NO_INTERNAL_LOOKUP
     flag is set). Proposed by Aslam <aslam@funk.com>.
     [Lutz Jaenicke]

  +) Support for crypto accelerator cards from Accelerated Encryption
     Processing, www.aep.ie.  (Use engine 'aep')
     The support was copied from 0.9.6c [engine] and adapted/corrected
     to work with the new engine framework.
     [AEP Inc. and Richard Levitte]

  +) Support for SureWare crypto accelerator cards from Baltimore
     Technologies.  (Use engine 'sureware')
     The support was copied from 0.9.6c [engine] and adapted
     to work with the new engine framework.
     [Richard Levitte]

  *) Have ASN1_BIT_STRING_set_bit() really clear a bit when the requested
     value is 0.
     [Richard Levitte]

  +) Have the CHIL engine fork-safe (as defined by nCipher) and actually
     make the newer ENGINE framework commands for the CHIL engine work.
     [Toomas Kiisk <vix@cyber.ee> and Richard Levitte]

  +) Make it possible to produce shared libraries on ReliantUNIX.
     [Robert Dahlem <Robert.Dahlem@ffm2.siemens.de> via Richard Levitte]

  *) Add the configuration target linux-s390x.
     [Neale Ferguson <Neale.Ferguson@SoftwareAG-USA.com> via Richard Levitte]

  +) Add the configuration target debug-linux-ppro.
     Make 'openssl rsa' use the general key loading routines
     implemented in apps.c, and make those routines able to
     handle the key format FORMAT_NETSCAPE and the variant
     FORMAT_IISSGC.
     [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]

  *) Fix a crashbug and a logic bug in hwcrhk_load_pubkey().
     [Toomas Kiisk <vix@cyber.ee> via Richard Levitte]

  +) Add -keyform to rsautl, and document -engine.
     [Richard Levitte, inspired by Toomas Kiisk <vix@cyber.ee>]

Bodo Möller's avatar
Bodo Möller committed
  +) Change BIO_new_file (crypto/bio/bss_file.c) to use new
     BIO_R_NO_SUCH_FILE error code rather than the generic
     ERR_R_SYS_LIB error code if fopen() fails with ENOENT.
     [Ben Laurie]

  +) Add new functions
          ERR_peek_last_error
          ERR_peek_last_error_line
          ERR_peek_last_error_line_data.
     These are similar to
          ERR_peek_error
          ERR_peek_error_line
          ERR_peek_error_line_data,
     but report on the latest error recorded rather than the first one
     still in the error queue.
     [Ben Laurie, Bodo Moeller]
        
Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
  +) default_algorithms option in ENGINE config module. This allows things
     like:
     default_algorithms = ALL
     default_algorithms = RSA, DSA, RAND, CIPHERS, DIGESTS
     [Steve Henson]

Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
  +) Prelminary ENGINE config module.
     [Steve Henson]

  *) The earlier bugfix for the SSL3_ST_SW_HELLO_REQ_C case of
     ssl3_accept (ssl/s3_srvr.c) incorrectly used a local flag
     variable as an indication that a ClientHello message has been
     received.  As the flag value will be lost between multiple
     invocations of ssl3_accept when using non-blocking I/O, the
     function may not be aware that a handshake has actually taken
     place, thus preventing a new session from being added to the
     session cache.

     To avoid this problem, we now set s->new_session to 2 instead of
     using a local variable.
     [Lutz Jaenicke, Bodo Moeller]

  *) Bugfix: Return -1 from ssl3_get_server_done (ssl3/s3_clnt.c)
     if the SSL_R_LENGTH_MISMATCH error is detected.
     [Geoff Thorpe, Bodo Moeller]

Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
  +) New experimental application configuration code.
     [Steve Henson]

  *) New 'shared_ldflag' column in Configure platform table.
     [Richard Levitte]

Bodo Möller's avatar
Bodo Möller committed
  *) Fix EVP_CIPHER_mode macro.
     ["Dan S. Camper" <dan@bti.net>]

  +) Change the AES code to follow the same name structure as all other
     symmetric ciphers, and behave the same way.  Move everything to
     the directory crypto/aes, thereby obsoleting crypto/rijndael.
     [Stephen Sprunk <stephen@sprunk.org> and Richard Levitte]

Ulf Möller's avatar
Ulf Möller committed
  *) Fix ssl3_read_bytes (ssl/s3_pkt.c): To ignore messages of unknown
     type, we must throw them away by setting rr->length to 0.
     [D P Chang <dpc@qualys.com>]

  -) OpenSSL 0.9.6c released [21 dec 2001]

Ben Laurie's avatar
Ben Laurie committed
  +) SECURITY: remove unsafe setjmp/signal interaction from ui_openssl.c.
     [Ben Laurie and Theo de Raadt]

Bodo Möller's avatar
Bodo Möller committed
  *) Fix BN_rand_range bug pointed out by Dominikus Scherkl
     <Dominikus.Scherkl@biodata.com>.  (The previous implementation
     worked incorrectly for those cases where  range = 10..._2  and
     3*range  is two bits longer than  range.)
     [Bodo Moeller]

  *) Only add signing time to PKCS7 structures if it is not already
     present.
Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
     [Steve Henson]

Bodo Möller's avatar
Bodo Möller committed
  *) Fix crypto/objects/objects.h: "ld-ce" should be "id-ce",
     OBJ_ld_ce should be OBJ_id_ce.
     Also some ip-pda OIDs in crypto/objects/objects.txt were
     incorrect (cf. RFC 3039).
     [Matt Cooper, Frederic Giudicelli, Bodo Moeller]

  +) Add option to output public keys in req command.
     [Massimiliano Pala madwolf@openca.org]

  *) Release CRYPTO_LOCK_DYNLOCK when CRYPTO_destroy_dynlockid()
     returns early because it has nothing to do.
     [Andy Schneider <andy.schneider@bjss.co.uk>]

  *) [In 0.9.6c-engine and 0.9.7 release:]
     Fix mutex callback return values in crypto/engine/hw_ncipher.c.
     [Andy Schneider <andy.schneider@bjss.co.uk>]

  -) [In 0.9.6c-engine release:]
     Add support for Cryptographic Appliance's keyserver technology.
     (Use engine 'keyclient')
     [Cryptographic Appliances and Geoff Thorpe]

Bodo Möller's avatar
Bodo Möller committed
  *) Add a configuration entry for OS/390 Unix.  The C compiler 'c89'
     is called via tools/c89.sh because arguments have to be
     rearranged (all '-L' options must appear before the first object
     modules).
     [Richard Shapiro <rshapiro@abinitio.com>]

  +) Use wNAFs in EC_POINTs_mul() for improved efficiency
     (up to about 10% better than before for P-192 and P-224).
Bodo Möller's avatar
Bodo Möller committed
     [Bodo Moeller]

  -) [In 0.9.6c-engine release:]
     Add support for Broadcom crypto accelerator cards, backported
     from 0.9.7.
     [Broadcom, Nalin Dahyabhai <nalin@redhat.com>, Mark Cox]

  -) [In 0.9.6c-engine release:]
     Add support for SureWare crypto accelerator cards from 
     Baltimore Technologies.  (Use engine 'sureware')
     [Baltimore Technologies and Mark Cox]

  -) [In 0.9.6c-engine release:]
     Add support for crypto accelerator cards from Accelerated
     Encryption Processing, www.aep.ie.  (Use engine 'aep')
     [AEP Inc. and Mark Cox]

  *) Add a configuration entry for gcc on UnixWare.
     [Gary Benson <gbenson@redhat.com>]

Loading full blame...