Skip to content
CHANGES 116 KiB
Newer Older
 OpenSSL CHANGES
 Changes between 0.9.5 and 0.9.6  [XX XXX 2000]
  *) Added configuration support for Linux/IA64
     [Rolf Haberrecker <rolf@suse.de>]

  *) Assembler module support for Mingw32.
     [Ulf Möller]

  *) Shared library support for HPUX (in shlib/).
     [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE> and Anonymous]

  *) Shared library support for Solaris gcc.
     [Lutz Behnke <behnke@trustcenter.de>]
Richard Levitte's avatar
Richard Levitte committed
 Changes between 0.9.4 and 0.9.5  [28 Feb 2000]
Ulf Möller's avatar
Ulf Möller committed

  *) PKCS7_encrypt() was adding text MIME headers twice because they
     were added manually and by SMIME_crlf_copy().
     [Steve Henson]

  *) In bntest.c don't call BN_rand with zero bits argument.
     [Steve Henson, pointed out by Andrew W. Gray <agray@iconsinc.com>]

Ulf Möller's avatar
Ulf Möller committed
  *) BN_mul bugfix: In bn_mul_part_recursion() only the a>a[n] && b>b[n]
     case was implemented. This caused BN_div_recp() to fail occasionally.
Ulf Möller's avatar
Ulf Möller committed
     [Ulf Möller]

  *) Add an optional second argument to the set_label() in the perl
     assembly language builder. If this argument exists and is set
     to 1 it signals that the assembler should use a symbol whose 
     scope is the entire file, not just the current function. This
     is needed with MASM which uses the format label:: for this scope.
     [Steve Henson, pointed out by Peter Runestig <peter@runestig.com>]

  *) Change the ASN1 types so they are typedefs by default. Before
     almost all types were #define'd to ASN1_STRING which was causing
     STACK_OF() problems: you couldn't declare STACK_OF(ASN1_UTF8STRING)
     for example.
     [Steve Henson]

  *) Change names of new functions to the new get1/get0 naming
     convention: After 'get1', the caller owns a reference count
     and has to call ..._free; 'get0' returns a pointer to some
     data structure without incrementing reference counters.
     (Some of the existing 'get' functions increment a reference
     counter, some don't.)
     Similarly, 'set1' and 'add1' functions increase reference
     counters or duplicate objects.
  *) Allow for the possibility of temp RSA key generation failure:
     the code used to assume it always worked and crashed on failure.
     [Steve Henson]

Ulf Möller's avatar
Ulf Möller committed
  *) Fix potential buffer overrun problem in BIO_printf().
     [Ulf Möller, using public domain code by Patrick Powell; problem
      pointed out by David Sacerdote <das33@cornell.edu>]

Ulf Möller's avatar
Ulf Möller committed
  *) Support EGD <http://www.lothar.com/tech/crypto/>.  New functions
     RAND_egd() and RAND_status().  In the command line application,
     the EGD socket can be specified like a seed file using RANDFILE
     or -rand.
     [Ulf Möller]

Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
  *) Allow the string CERTIFICATE to be tolerated in PKCS#7 structures.
     Some CAs (e.g. Verisign) distribute certificates in this form.
     [Steve Henson]

  *) Remove the SSL_ALLOW_ADH compile option and set the default cipher
     list to exclude them. This means that no special compilation option
     is needed to use anonymous DH: it just needs to be included in the
     cipher list.
     [Steve Henson]

  *) Change the EVP_MD_CTX_type macro so its meaning consistent with
     EVP_MD_type. The old functionality is available in a new macro called
     EVP_MD_md(). Change code that uses it and update docs.
     [Steve Henson]

  *) ..._ctrl functions now have corresponding ..._callback_ctrl functions
     where the 'void *' argument is replaced by a function pointer argument.
     Previously 'void *' was abused to point to functions, which works on
     many platforms, but is not correct.  As these functions are usually
     called by macros defined in OpenSSL header files, most source code
     should work without changes.
Ulf Möller's avatar
Ulf Möller committed
     [Richard Levitte]

  *) <openssl/opensslconf.h> (which is created by Configure) now contains
     sections with information on -D... compiler switches used for
     compiling the library so that applications can see them.  To enable
     one of these sections, a pre-processor symbol OPENSSL_..._DEFINES
     must be defined.  E.g.,
        #define OPENSSL_ALGORITHM_DEFINES
        #include <openssl/opensslconf.h>
     defines all pertinent NO_<algo> symbols, such as NO_IDEA, NO_RSA, etc.
Ulf Möller's avatar
Ulf Möller committed
     [Richard Levitte, Ulf and Bodo Möller]
  *) Bugfix: Tolerate fragmentation and interleaving in the SSL 3/TLS
     record layer.
     [Bodo Moeller]

  *) Change the 'other' type in certificate aux info to a STACK_OF
     X509_ALGOR. Although not an AlgorithmIdentifier as such it has
     the required ASN1 format: arbitrary types determined by an OID.
     [Steve Henson]

  *) Add some PEM_write_X509_REQ_NEW() functions and a command line
     argument to 'req'. This is not because the function is newer or
     better than others it just uses the work 'NEW' in the certificate
     request header lines. Some software needs this.
     [Steve Henson]

  *) Reorganise password command line arguments: now passwords can be
     obtained from various sources. Delete the PEM_cb function and make
     it the default behaviour: i.e. if the callback is NULL and the
     usrdata argument is not NULL interpret it as a null terminated pass
     phrase. If usrdata and the callback are NULL then the pass phrase
     is prompted for as usual.
     [Steve Henson]

  *) Add support for the Compaq Atalla crypto accelerator. If it is installed,
     the support is automatically enabled. The resulting binaries will
     autodetect the card and use it if present.
     [Ben Laurie and Compaq Inc.]

  *) Work around for Netscape hang bug. This sends certificate request
     and server done in one record. Since this is perfectly legal in the
     SSL/TLS protocol it isn't a "bug" option and is on by default. See
     the bugs/SSLv3 entry for more info.
     [Steve Henson]

  *) HP-UX tune-up: new unified configs, HP C compiler bug workaround.
     [Andy Polyakov]

  *) Add -rand argument to smime and pkcs12 applications and read/write
     of seed file.
     [Steve Henson]

Bodo Möller's avatar
Bodo Möller committed
  *) New 'passwd' tool for crypt(3) and apr1 password hashes.
Bodo Möller's avatar
Bodo Möller committed
     [Bodo Moeller]

  *) Add command line password options to the remaining applications.
     [Steve Henson]

  *) Bug fix for BN_div_recp() for numerators with an even number of
     bits.
     [Ulf Möller]

  *) More tests in bntest.c, and changed test_bn output.
     [Ulf Möller]

  *) ./config recognizes MacOS X now.
     [Andy Polyakov]

  *) Bug fix for BN_div() when the first words of num and divsor are
     equal (it gave wrong results if (rem=(n1-q*d0)&BN_MASK2) < d0).
     [Ulf Möller]

  *) Add support for various broken PKCS#8 formats, and command line
     options to produce them.
     [Steve Henson]

  *) New functions BN_CTX_start(), BN_CTX_get() and BT_CTX_end() to
     get temporary BIGNUMs from a BN_CTX.
     [Ulf Möller]

  *) Correct return values in BN_mod_exp_mont() and BN_mod_exp2_mont()
     for p == 0.
     [Ulf Möller]

  *) Change the SSLeay_add_all_*() functions to OpenSSL_add_all_*() and
     include a #define from the old name to the new. The original intent
     was that statically linked binaries could for example just call
     SSLeay_add_all_ciphers() to just add ciphers to the table and not
     link with digests. This never worked becayse SSLeay_add_all_digests()
     and SSLeay_add_all_ciphers() were in the same source file so calling
     one would link with the other. They are now in separate source files.
     [Steve Henson]

Dr. Stephen Henson's avatar
 
Dr. Stephen Henson committed
  *) Add a new -notext option to 'ca' and a -pubkey option to 'spkac'.
     [Steve Henson]

  *) Use a less unusual form of the Miller-Rabin primality test (it used
     a binary algorithm for exponentiation integrated into the Miller-Rabin
     loop, our standard modexp algorithms are faster).
     [Bodo Moeller]

  *) Support for the EBCDIC character set completed.
Ulf Möller's avatar
Ulf Möller committed
     [Martin Kraemer <Martin.Kraemer@Mch.SNI.De>]

Ulf Möller's avatar
Ulf Möller committed
  *) Source code cleanups: use const where appropriate, eliminate casts,
     use void * instead of char * in lhash.
     [Ulf Möller] 

  *) Bugfix: ssl3_send_server_key_exchange was not restartable
     (the state was not changed to SSL3_ST_SW_KEY_EXCH_B, and because of
Loading full blame...