From 9d98df23f38afa21e159d910335b49fb196206e8 Mon Sep 17 00:00:00 2001 From: cvs2svn Date: Tue, 7 Nov 2000 13:49:47 +0000 Subject: [PATCH] This commit was manufactured by cvs2svn to create tag 'rsaref'. --- .cvsignore | 15 - CHANGES | 3691 ---------- CHANGES.SSLeay | 968 --- Configure | 1175 ---- FAQ | 460 -- INSTALL | 278 - INSTALL.MacOS | 72 - INSTALL.VMS | 289 - INSTALL.W32 | 260 - LICENSE | 127 - MacOS/GUSI_Init.cpp | 62 - MacOS/GetHTTPS.src/CPStringUtils.cpp | 2753 -------- MacOS/GetHTTPS.src/CPStringUtils.hpp | 104 - MacOS/GetHTTPS.src/ErrorHandling.cpp | 170 - MacOS/GetHTTPS.src/ErrorHandling.hpp | 147 - MacOS/GetHTTPS.src/GetHTTPS.cpp | 209 - MacOS/GetHTTPS.src/MacSocket.cpp | 1607 ----- MacOS/GetHTTPS.src/MacSocket.h | 103 - MacOS/OpenSSL.mcp.hqx | 4940 ------------- MacOS/Randomizer.cpp | 476 -- MacOS/Randomizer.h | 43 - MacOS/TODO | 18 - MacOS/_MWERKS_GUSI_prefix.h | 9 - MacOS/_MWERKS_prefix.h | 9 - MacOS/buildinf.h | 5 - MacOS/mklinks.as.hqx | 820 --- MacOS/opensslconf.h | 116 - Makefile.org | 521 -- NEWS | 125 - README | 176 - README.ENGINE | 44 - STATUS | 90 - TABLE | 2437 ------- VMS/TODO | 18 - VMS/WISHLIST.TXT | 4 - VMS/install.com | 72 - VMS/multinet_shr.opt | 1 - VMS/openssl_utils.com | 38 - VMS/socketshr_shr.opt | 1 - VMS/test-includes.com | 28 - VMS/ucx_shr_decc.opt | 1 - VMS/ucx_shr_decc_log.opt | 1 - VMS/ucx_shr_vaxc.opt | 1 - apps/.cvsignore | 5 - apps/CA.com | 220 - apps/CA.pl.in | 168 - apps/CA.sh | 132 - apps/Makefile.ssl | 1041 --- apps/app_rand.c | 216 - apps/apps.c | 835 --- apps/apps.h | 175 - apps/asn1pars.c | 334 - apps/ca-cert.srl | 1 - apps/ca-key.pem | 15 - apps/ca-req.pem | 11 - apps/ca.c | 2287 ------ apps/cert.pem | 11 - apps/ciphers.c | 207 - apps/client.pem | 24 - apps/crl.c | 411 -- apps/crl2p7.c | 343 - apps/demoCA/cacert.pem | 14 - apps/demoCA/index.txt | 39 - apps/demoCA/private/cakey.pem | 24 - apps/demoCA/serial | 1 - apps/der_chop.in | 305 - apps/dgst.c | 453 -- apps/dh.c | 351 - apps/dh1024.pem | 10 - apps/dh2048.pem | 12 - apps/dh4096.pem | 18 - apps/dh512.pem | 9 - apps/dhparam.c | 554 -- apps/dsa-ca.pem | 40 - apps/dsa-pca.pem | 46 - apps/dsa.c | 325 - apps/dsa1024.pem | 9 - apps/dsa512.pem | 6 - apps/dsap.pem | 6 - apps/dsaparam.c | 404 -- apps/enc.c | 668 -- apps/engine.c | 243 - apps/errstr.c | 125 - apps/gendh.c | 231 - apps/gendsa.c | 252 - apps/genrsa.c | 278 - apps/install.com | 69 - apps/makeapps.com | 1160 --- apps/nseq.c | 167 - apps/oid.cnf | 6 - apps/openssl-vms.cnf | 236 - apps/openssl.c | 369 - apps/openssl.cnf | 244 - apps/passwd.c | 502 -- apps/pca-cert.srl | 1 - apps/pca-key.pem | 15 - apps/pca-req.pem | 11 - apps/pkcs12.c | 939 --- apps/pkcs7.c | 320 - apps/pkcs8.c | 382 - apps/privkey.pem | 18 - apps/progs.h | 258 - apps/progs.pl | 77 - apps/rand.c | 177 - apps/req.c | 1351 ---- apps/req.pem | 11 - apps/rsa.c | 427 -- apps/rsa8192.pem | 101 - apps/rsautl.c | 318 - apps/s1024key.pem | 15 - apps/s1024req.pem | 11 - apps/s512-key.pem | 9 - apps/s512-req.pem | 8 - apps/s_apps.h | 111 - apps/s_cb.c | 238 - apps/s_client.c | 918 --- apps/s_server.c | 1540 ---- apps/s_socket.c | 542 -- apps/s_time.c | 689 -- apps/server.pem | 369 - apps/server.srl | 1 - apps/server2.pem | 376 - apps/sess_id.c | 319 - apps/set/set-g-ca.pem | 21 - apps/set/set-m-ca.pem | 21 - apps/set/set_b_ca.pem | 23 - apps/set/set_c_ca.pem | 21 - apps/set/set_d_ct.pem | 21 - apps/set/set_root.pem | 21 - apps/smime.c | 575 -- apps/speed.c | 1462 ---- apps/spkac.c | 319 - apps/testCA.pem | 8 - apps/testdsa.h | 151 - apps/testrsa.h | 518 -- apps/verify.c | 383 - apps/version.c | 132 - apps/winrand.c | 149 - apps/x509.c | 1248 ---- bugs/MS | 7 - bugs/SSLv3 | 49 - bugs/VC16.bug | 18 - bugs/alpha.c | 91 - bugs/dggccbug.c | 45 - bugs/sgiccbug.c | 57 - bugs/sslref.dif | 26 - bugs/stream.c | 131 - bugs/ultrixcc.c | 45 - certs/ICE-CA.pem | 59 - certs/ICE-root.pem | 48 - certs/ICE-user.pem | 63 - certs/ICE.crl | 9 - certs/ca-cert.pem | 33 - certs/dsa-ca.pem | 43 - certs/dsa-pca.pem | 49 - certs/expired/ICE-CA.pem | 59 - certs/expired/ICE-root.pem | 48 - certs/expired/ICE-user.pem | 63 - certs/expired/ICE.crl | 9 - certs/expired/rsa-ssca.pem | 19 - certs/factory.pem | 15 - certs/nortelCA.pem | 16 - certs/pca-cert.pem | 33 - certs/rsa-cca.pem | 19 - certs/thawteCb.pem | 19 - certs/thawteCp.pem | 19 - certs/timCA.pem | 16 - certs/tjhCA.pem | 15 - certs/vsign1.pem | 17 - certs/vsign2.pem | 18 - certs/vsign3.pem | 18 - certs/vsignss.pem | 17 - certs/vsigntca.pem | 18 - config | 591 -- crypto/.cvsignore | 4 - crypto/Makefile.ssl | 200 - crypto/asn1/.cvsignore | 2 - crypto/asn1/Makefile.ssl | 1403 ---- crypto/asn1/a_bitstr.c | 259 - crypto/asn1/a_bmp.c | 89 - crypto/asn1/a_bool.c | 112 - crypto/asn1/a_bytes.c | 323 - crypto/asn1/a_d2i_fp.c | 195 - crypto/asn1/a_digest.c | 90 - crypto/asn1/a_dup.c | 83 - crypto/asn1/a_enum.c | 224 - crypto/asn1/a_gentm.c | 230 - crypto/asn1/a_hdr.c | 119 - crypto/asn1/a_i2d_fp.c | 113 - crypto/asn1/a_int.c | 473 -- crypto/asn1/a_mbstr.c | 400 -- crypto/asn1/a_meth.c | 84 - crypto/asn1/a_null.c | 119 - crypto/asn1/a_object.c | 320 - crypto/asn1/a_octet.c | 95 - crypto/asn1/a_print.c | 197 - crypto/asn1/a_set.c | 217 - crypto/asn1/a_sign.c | 148 - crypto/asn1/a_strex.c | 545 -- crypto/asn1/a_strnid.c | 250 - crypto/asn1/a_time.c | 127 - crypto/asn1/a_type.c | 352 - crypto/asn1/a_utctm.c | 348 - crypto/asn1/a_utf8.c | 238 - crypto/asn1/a_verify.c | 119 - crypto/asn1/a_vis.c | 89 - crypto/asn1/asn1.h | 1181 ---- crypto/asn1/asn1_err.c | 382 - crypto/asn1/asn1_lib.c | 427 -- crypto/asn1/asn1_mac.h | 560 -- crypto/asn1/asn1_par.c | 423 -- crypto/asn1/asn_pack.c | 145 - crypto/asn1/charmap.h | 15 - crypto/asn1/charmap.pl | 80 - crypto/asn1/d2i_dhp.c | 101 - crypto/asn1/d2i_dsap.c | 98 - crypto/asn1/d2i_pr.c | 138 - crypto/asn1/d2i_pu.c | 115 - crypto/asn1/d2i_r_pr.c | 128 - crypto/asn1/d2i_r_pu.c | 103 - crypto/asn1/d2i_s_pr.c | 106 - crypto/asn1/d2i_s_pu.c | 121 - crypto/asn1/evp_asn1.c | 185 - crypto/asn1/f.c | 80 - crypto/asn1/f_enum.c | 207 - crypto/asn1/f_int.c | 214 - crypto/asn1/f_string.c | 212 - crypto/asn1/i2d_dhp.c | 128 - crypto/asn1/i2d_dsap.c | 117 - crypto/asn1/i2d_pr.c | 84 - crypto/asn1/i2d_pu.c | 82 - crypto/asn1/i2d_r_pr.c | 133 - crypto/asn1/i2d_r_pu.c | 118 - crypto/asn1/i2d_s_pr.c | 123 - crypto/asn1/i2d_s_pu.c | 129 - crypto/asn1/n_pkey.c | 390 -- crypto/asn1/nsseq.c | 118 - crypto/asn1/p5_pbe.c | 157 - crypto/asn1/p5_pbev2.c | 282 - crypto/asn1/p7_dgst.c | 121 - crypto/asn1/p7_enc.c | 111 - crypto/asn1/p7_enc_c.c | 120 - crypto/asn1/p7_evp.c | 119 - crypto/asn1/p7_i_s.c | 111 - crypto/asn1/p7_lib.c | 391 -- crypto/asn1/p7_recip.c | 125 - crypto/asn1/p7_s_e.c | 145 - crypto/asn1/p7_signd.c | 135 - crypto/asn1/p7_signi.c | 150 - crypto/asn1/p8_key.c | 131 - crypto/asn1/p8_pkey.c | 127 - crypto/asn1/t_bitst.c | 99 - crypto/asn1/t_crl.c | 166 - crypto/asn1/t_pkey.c | 361 - crypto/asn1/t_req.c | 254 - crypto/asn1/t_spki.c | 116 - crypto/asn1/t_x509.c | 514 -- crypto/asn1/t_x509a.c | 110 - crypto/asn1/x_algor.c | 118 - crypto/asn1/x_attrib.c | 165 - crypto/asn1/x_cinf.c | 201 - crypto/asn1/x_crl.c | 348 - crypto/asn1/x_exten.c | 139 - crypto/asn1/x_info.c | 114 - crypto/asn1/x_name.c | 279 - crypto/asn1/x_pkey.c | 151 - crypto/asn1/x_pubkey.c | 366 - crypto/asn1/x_req.c | 257 - crypto/asn1/x_sig.c | 110 - crypto/asn1/x_spki.c | 166 - crypto/asn1/x_val.c | 109 - crypto/asn1/x_x509.c | 216 - crypto/asn1/x_x509a.c | 208 - crypto/bf/.cvsignore | 2 - crypto/bf/COPYRIGHT | 46 - crypto/bf/INSTALL | 14 - crypto/bf/Makefile.ssl | 119 - crypto/bf/README | 8 - crypto/bf/VERSION | 6 - crypto/bf/asm/.cvsignore | 1 - crypto/bf/asm/bf-586.pl | 136 - crypto/bf/asm/bf-686.pl | 127 - crypto/bf/asm/readme | 10 - crypto/bf/bf_cbc.c | 143 - crypto/bf/bf_cfb64.c | 121 - crypto/bf/bf_ecb.c | 96 - crypto/bf/bf_enc.c | 306 - crypto/bf/bf_locl.h | 219 - crypto/bf/bf_ofb64.c | 110 - crypto/bf/bf_opts.c | 328 - crypto/bf/bf_pi.h | 325 - crypto/bf/bf_skey.c | 116 - crypto/bf/bfs.cpp | 67 - crypto/bf/bfspeed.c | 274 - crypto/bf/bftest.c | 534 -- crypto/bf/blowfish.h | 125 - crypto/bio/.cvsignore | 2 - crypto/bio/Makefile.ssl | 247 - crypto/bio/b_dump.c | 152 - crypto/bio/b_print.c | 814 --- crypto/bio/b_sock.c | 723 -- crypto/bio/bf_buff.c | 511 -- crypto/bio/bf_lbuf.c | 397 -- crypto/bio/bf_nbio.c | 256 - crypto/bio/bf_null.c | 184 - crypto/bio/bio.h | 689 -- crypto/bio/bio_cb.c | 133 - crypto/bio/bio_err.c | 150 - crypto/bio/bio_lib.c | 542 -- crypto/bio/bss_acpt.c | 479 -- crypto/bio/bss_bio.c | 857 --- crypto/bio/bss_conn.c | 651 -- crypto/bio/bss_fd.c | 62 - crypto/bio/bss_file.c | 310 - crypto/bio/bss_log.c | 394 -- crypto/bio/bss_mem.c | 317 - crypto/bio/bss_null.c | 150 - crypto/bio/bss_rtcp.c | 294 - crypto/bio/bss_sock.c | 424 -- crypto/bn/.cvsignore | 2 - crypto/bn/Makefile.ssl | 313 - crypto/bn/asm/.cvsignore | 2 - crypto/bn/asm/README | 23 - crypto/bn/asm/alpha.s | 3199 --------- crypto/bn/asm/alpha.s.works | 533 -- crypto/bn/asm/alpha.works/add.pl | 119 - crypto/bn/asm/alpha.works/div.pl | 144 - crypto/bn/asm/alpha.works/mul.pl | 116 - crypto/bn/asm/alpha.works/mul_add.pl | 120 - crypto/bn/asm/alpha.works/mul_c4.pl | 213 - crypto/bn/asm/alpha.works/mul_c4.works.pl | 98 - crypto/bn/asm/alpha.works/mul_c8.pl | 177 - crypto/bn/asm/alpha.works/sqr.pl | 113 - crypto/bn/asm/alpha.works/sqr_c4.pl | 109 - crypto/bn/asm/alpha.works/sqr_c8.pl | 132 - crypto/bn/asm/alpha.works/sub.pl | 108 - crypto/bn/asm/alpha/add.pl | 118 - crypto/bn/asm/alpha/div.pl | 144 - crypto/bn/asm/alpha/mul.pl | 104 - crypto/bn/asm/alpha/mul_add.pl | 123 - crypto/bn/asm/alpha/mul_c4.pl | 215 - crypto/bn/asm/alpha/mul_c4.works.pl | 98 - crypto/bn/asm/alpha/mul_c8.pl | 177 - crypto/bn/asm/alpha/sqr.pl | 113 - crypto/bn/asm/alpha/sqr_c4.pl | 109 - crypto/bn/asm/alpha/sqr_c8.pl | 132 - crypto/bn/asm/alpha/sub.pl | 108 - crypto/bn/asm/bn-586.pl | 384 - crypto/bn/asm/bn-alpha.pl | 571 -- crypto/bn/asm/ca.pl | 33 - crypto/bn/asm/co-586.pl | 286 - crypto/bn/asm/co-alpha.pl | 116 - crypto/bn/asm/mips1.s | 539 -- crypto/bn/asm/mips3.s | 2141 ------ crypto/bn/asm/pa-risc.s | 710 -- crypto/bn/asm/pa-risc2.s | 1618 ----- crypto/bn/asm/pa-risc2.s.old | 416 -- crypto/bn/asm/pa-risc2W.s | 1605 ----- crypto/bn/asm/r3000.s | 646 -- crypto/bn/asm/sparcv8.S | 1458 ---- crypto/bn/asm/sparcv8plus.S | 1535 ---- crypto/bn/asm/vms.mar | 6695 ------------------ crypto/bn/asm/x86.pl | 28 - crypto/bn/asm/x86/add.pl | 76 - crypto/bn/asm/x86/comba.pl | 277 - crypto/bn/asm/x86/div.pl | 15 - crypto/bn/asm/x86/f | 3 - crypto/bn/asm/x86/mul.pl | 77 - crypto/bn/asm/x86/mul_add.pl | 87 - crypto/bn/asm/x86/sqr.pl | 60 - crypto/bn/asm/x86/sub.pl | 76 - crypto/bn/bn.h | 519 -- crypto/bn/bn.mul | 19 - crypto/bn/bn_add.c | 307 - crypto/bn/bn_asm.c | 832 --- crypto/bn/bn_blind.c | 144 - crypto/bn/bn_ctx.c | 144 - crypto/bn/bn_div.c | 380 - crypto/bn/bn_err.c | 121 - crypto/bn/bn_exp.c | 698 -- crypto/bn/bn_exp2.c | 301 - crypto/bn/bn_gcd.c | 211 - crypto/bn/bn_lcl.h | 419 -- crypto/bn/bn_lib.c | 811 --- crypto/bn/bn_mont.c | 346 - crypto/bn/bn_mpi.c | 129 - crypto/bn/bn_mul.c | 804 --- crypto/bn/bn_prime.c | 466 -- crypto/bn/bn_prime.h | 325 - crypto/bn/bn_prime.pl | 117 - crypto/bn/bn_print.c | 332 - crypto/bn/bn_rand.c | 142 - crypto/bn/bn_recp.c | 222 - crypto/bn/bn_shift.c | 200 - crypto/bn/bn_sqr.c | 291 - crypto/bn/bn_word.c | 199 - crypto/bn/bnspeed.c | 233 - crypto/bn/bntest.c | 1079 --- crypto/bn/divtest.c | 41 - crypto/bn/exp.c | 62 - crypto/bn/expspeed.c | 215 - crypto/bn/exptest.c | 187 - crypto/bn/todo | 3 - crypto/bn/vms-helper.c | 68 - crypto/buffer/.cvsignore | 2 - crypto/buffer/Makefile.ssl | 93 - crypto/buffer/buf_err.c | 95 - crypto/buffer/buffer.c | 144 - crypto/buffer/buffer.h | 98 - crypto/cast/.cvsignore | 2 - crypto/cast/Makefile.ssl | 125 - crypto/cast/asm/.cvsignore | 1 - crypto/cast/asm/cast-586.pl | 176 - crypto/cast/asm/readme | 7 - crypto/cast/c_cfb64.c | 122 - crypto/cast/c_ecb.c | 80 - crypto/cast/c_enc.c | 207 - crypto/cast/c_ofb64.c | 111 - crypto/cast/c_skey.c | 166 - crypto/cast/cast.h | 103 - crypto/cast/cast_lcl.h | 226 - crypto/cast/cast_s.h | 585 -- crypto/cast/cast_spd.c | 275 - crypto/cast/castopts.c | 339 - crypto/cast/casts.cpp | 70 - crypto/cast/casttest.c | 230 - crypto/comp/.cvsignore | 2 - crypto/comp/Makefile.ssl | 102 - crypto/comp/c_rle.c | 61 - crypto/comp/c_zlib.c | 133 - crypto/comp/comp.h | 61 - crypto/comp/comp_err.c | 92 - crypto/comp/comp_lib.c | 78 - crypto/conf/.cvsignore | 2 - crypto/conf/Makefile.ssl | 109 - crypto/conf/cnf_save.c | 105 - crypto/conf/conf.h | 191 - crypto/conf/conf_api.c | 293 - crypto/conf/conf_api.h | 87 - crypto/conf/conf_def.c | 728 -- crypto/conf/conf_def.h | 145 - crypto/conf/conf_err.c | 116 - crypto/conf/conf_lib.c | 392 -- crypto/conf/keysets.pl | 179 - crypto/conf/ssleay.cnf | 78 - crypto/conf/test.c | 98 - crypto/cpt_err.c | 97 - crypto/cryptlib.c | 491 -- crypto/cryptlib.h | 96 - crypto/crypto-lib.com | 1490 ---- crypto/crypto.h | 401 -- crypto/cversion.c | 110 - crypto/des/.cvsignore | 3 - crypto/des/COPYRIGHT | 50 - crypto/des/DES.pm | 19 - crypto/des/DES.xs | 268 - crypto/des/FILES | 96 - crypto/des/INSTALL | 69 - crypto/des/Imakefile | 35 - crypto/des/KERBEROS | 41 - crypto/des/Makefile.ssl | 212 - crypto/des/README | 54 - crypto/des/VERSION | 412 -- crypto/des/asm/.cvsignore | 2 - crypto/des/asm/crypt586.pl | 204 - crypto/des/asm/des-586.pl | 253 - crypto/des/asm/des686.pl | 230 - crypto/des/asm/desboth.pl | 79 - crypto/des/asm/readme | 131 - crypto/des/cbc3_enc.c | 99 - crypto/des/cbc_cksm.c | 97 - crypto/des/cbc_enc.c | 61 - crypto/des/cfb64ede.c | 141 - crypto/des/cfb64enc.c | 121 - crypto/des/cfb_enc.c | 165 - crypto/des/des-lib.com | 1003 --- crypto/des/des.c | 928 --- crypto/des/des.h | 266 - crypto/des/des.pod | 217 - crypto/des/des3s.cpp | 67 - crypto/des/des_enc.c | 406 -- crypto/des/des_locl.h | 412 -- crypto/des/des_opts.c | 604 -- crypto/des/des_ver.h | 61 - crypto/des/dess.cpp | 67 - crypto/des/destest.c | 927 --- crypto/des/ecb3_enc.c | 82 - crypto/des/ecb_enc.c | 122 - crypto/des/ede_cbcm_enc.c | 197 - crypto/des/enc_read.c | 228 - crypto/des/enc_writ.c | 171 - crypto/des/fcrypt.c | 180 - crypto/des/fcrypt_b.c | 145 - crypto/des/makefile.bc | 50 - crypto/des/ncbc_enc.c | 148 - crypto/des/ofb64ede.c | 124 - crypto/des/ofb64enc.c | 110 - crypto/des/ofb_enc.c | 134 - crypto/des/options.txt | 39 - crypto/des/pcbc_enc.c | 122 - crypto/des/qud_cksm.c | 139 - crypto/des/rand_key.c | 73 - crypto/des/read2pwd.c | 84 - crypto/des/read_pwd.c | 505 -- crypto/des/rpc_des.h | 131 - crypto/des/rpc_enc.c | 98 - crypto/des/rpw.c | 99 - crypto/des/set_key.c | 402 -- crypto/des/speed.c | 310 - crypto/des/spr.h | 204 - crypto/des/str2key.c | 155 - crypto/des/t/test | 27 - crypto/des/times/486-50.sol | 16 - crypto/des/times/586-100.lnx | 20 - crypto/des/times/686-200.fre | 18 - crypto/des/times/aix.cc | 26 - crypto/des/times/alpha.cc | 18 - crypto/des/times/hpux.cc | 17 - crypto/des/times/sparc.gcc | 17 - crypto/des/times/usparc.cc | 31 - crypto/des/typemap | 34 - crypto/des/xcbc_enc.c | 194 - crypto/dh/.cvsignore | 2 - crypto/dh/Makefile.ssl | 141 - crypto/dh/dh.h | 213 - crypto/dh/dh1024.pem | 5 - crypto/dh/dh192.pem | 3 - crypto/dh/dh2048.pem | 16 - crypto/dh/dh4096.pem | 14 - crypto/dh/dh512.pem | 4 - crypto/dh/dh_check.c | 120 - crypto/dh/dh_err.c | 99 - crypto/dh/dh_gen.c | 153 - crypto/dh/dh_key.c | 221 - crypto/dh/dh_lib.c | 237 - crypto/dh/dhtest.c | 196 - crypto/dh/example | 50 - crypto/dh/generate | 65 - crypto/dh/p1024.c | 92 - crypto/dh/p192.c | 80 - crypto/dh/p512.c | 85 - crypto/dsa/.cvsignore | 2 - crypto/dsa/Makefile.ssl | 196 - crypto/dsa/README | 4 - crypto/dsa/dsa.h | 256 - crypto/dsa/dsa_asn1.c | 96 - crypto/dsa/dsa_err.c | 106 - crypto/dsa/dsa_gen.c | 294 - crypto/dsa/dsa_key.c | 113 - crypto/dsa/dsa_lib.c | 296 - crypto/dsa/dsa_ossl.c | 322 - crypto/dsa/dsa_sign.c | 93 - crypto/dsa/dsa_vrf.c | 95 - crypto/dsa/dsagen.c | 111 - crypto/dsa/dsatest.c | 232 - crypto/dsa/fips186a.txt | 122 - crypto/dso/.cvsignore | 2 - crypto/dso/Makefile.ssl | 141 - crypto/dso/README | 22 - crypto/dso/dso.h | 325 - crypto/dso/dso_dl.c | 278 - crypto/dso/dso_dlfcn.c | 286 - crypto/dso/dso_err.c | 135 - crypto/dso/dso_lib.c | 440 -- crypto/dso/dso_null.c | 86 - crypto/dso/dso_openssl.c | 81 - crypto/dso/dso_vms.c | 378 - crypto/dso/dso_win32.c | 276 - crypto/ebcdic.c | 217 - crypto/ebcdic.h | 19 - crypto/engine/.cvsignore | 2 - crypto/engine/Makefile.ssl | 256 - crypto/engine/README | 278 - crypto/engine/engine.h | 409 -- crypto/engine/engine_all.c | 118 - crypto/engine/engine_err.c | 188 - crypto/engine/engine_int.h | 144 - crypto/engine/engine_lib.c | 488 -- crypto/engine/engine_list.c | 661 -- crypto/engine/engine_openssl.c | 174 - crypto/engine/enginetest.c | 251 - crypto/engine/hw_atalla.c | 443 -- crypto/engine/hw_cswift.c | 806 --- crypto/engine/hw_ncipher.c | 1018 --- crypto/engine/hw_nuron.c | 285 - crypto/engine/vendor_defns/atalla.h | 61 - crypto/engine/vendor_defns/cswift.h | 213 - crypto/engine/vendor_defns/hwcryptohook.h | 476 -- crypto/err/.cvsignore | 2 - crypto/err/Makefile.ssl | 118 - crypto/err/err.c | 795 --- crypto/err/err.h | 280 - crypto/err/err_all.c | 126 - crypto/err/err_prn.c | 107 - crypto/err/openssl.ec | 75 - crypto/evp/.cvsignore | 2 - crypto/evp/Makefile.ssl | 982 --- crypto/evp/bio_b64.c | 547 -- crypto/evp/bio_enc.c | 425 -- crypto/evp/bio_md.c | 261 - crypto/evp/bio_ok.c | 569 -- crypto/evp/c_all.c | 67 - crypto/evp/c_allc.c | 157 - crypto/evp/c_alld.c | 103 - crypto/evp/digest.c | 92 - crypto/evp/e_bf.c | 80 - crypto/evp/e_cast.c | 82 - crypto/evp/e_des.c | 118 - crypto/evp/e_des3.c | 165 - crypto/evp/e_dsa.c | 71 - crypto/evp/e_idea.c | 112 - crypto/evp/e_null.c | 101 - crypto/evp/e_rc2.c | 222 - crypto/evp/e_rc4.c | 125 - crypto/evp/e_rc5.c | 118 - crypto/evp/e_rd.c | 131 - crypto/evp/e_xcbc_d.c | 111 - crypto/evp/encode.c | 437 -- crypto/evp/evp.h | 868 --- crypto/evp/evp_enc.c | 341 - crypto/evp/evp_err.c | 156 - crypto/evp/evp_key.c | 159 - crypto/evp/evp_lib.c | 142 - crypto/evp/evp_locl.h | 168 - crypto/evp/evp_pbe.c | 136 - crypto/evp/evp_pkey.c | 410 -- crypto/evp/m_dss.c | 83 - crypto/evp/m_dss1.c | 83 - crypto/evp/m_md2.c | 83 - crypto/evp/m_md4.c | 83 - crypto/evp/m_md5.c | 83 - crypto/evp/m_mdc2.c | 83 - crypto/evp/m_null.c | 88 - crypto/evp/m_ripemd.c | 84 - crypto/evp/m_sha.c | 83 - crypto/evp/m_sha1.c | 83 - crypto/evp/names.c | 123 - crypto/evp/p5_crpt.c | 149 - crypto/evp/p5_crpt2.c | 248 - crypto/evp/p_dec.c | 87 - crypto/evp/p_enc.c | 86 - crypto/evp/p_lib.c | 333 - crypto/evp/p_open.c | 123 - crypto/evp/p_seal.c | 112 - crypto/evp/p_sign.c | 112 - crypto/evp/p_verify.c | 99 - crypto/ex_data.c | 223 - crypto/hmac/.cvsignore | 2 - crypto/hmac/Makefile.ssl | 98 - crypto/hmac/hmac.c | 152 - crypto/hmac/hmac.h | 100 - crypto/hmac/hmactest.c | 159 - crypto/idea/.cvsignore | 2 - crypto/idea/Makefile.ssl | 91 - crypto/idea/i_cbc.c | 168 - crypto/idea/i_cfb64.c | 122 - crypto/idea/i_ecb.c | 85 - crypto/idea/i_ofb64.c | 111 - crypto/idea/i_skey.c | 156 - crypto/idea/idea.h | 99 - crypto/idea/idea_lcl.h | 215 - crypto/idea/idea_spd.c | 296 - crypto/idea/ideatest.c | 230 - crypto/idea/version | 12 - crypto/install.com | 132 - crypto/lhash/.cvsignore | 2 - crypto/lhash/Makefile.ssl | 92 - crypto/lhash/lh_stats.c | 274 - crypto/lhash/lh_test.c | 89 - crypto/lhash/lhash.c | 461 -- crypto/lhash/lhash.h | 149 - crypto/lhash/num.pl | 17 - crypto/md2/.cvsignore | 2 - crypto/md2/Makefile.ssl | 90 - crypto/md2/md2.c | 124 - crypto/md2/md2.h | 91 - crypto/md2/md2_dgst.c | 223 - crypto/md2/md2_one.c | 93 - crypto/md2/md2test.c | 135 - crypto/md32_common.h | 607 -- crypto/md4/.cvsignore | 2 - crypto/md4/Makefile.ssl | 85 - crypto/md4/md4.c | 127 - crypto/md4/md4.h | 114 - crypto/md4/md4_dgst.c | 285 - crypto/md4/md4_locl.h | 154 - crypto/md4/md4_one.c | 95 - crypto/md4/md4s.cpp | 78 - crypto/md4/md4test.c | 131 - crypto/md5/.cvsignore | 2 - crypto/md5/Makefile.ssl | 134 - crypto/md5/asm/.cvsignore | 1 - crypto/md5/asm/md5-586.pl | 306 - crypto/md5/asm/md5-sparcv9.S | 1029 --- crypto/md5/md5.c | 127 - crypto/md5/md5.h | 114 - crypto/md5/md5_dgst.c | 319 - crypto/md5/md5_locl.h | 172 - crypto/md5/md5_one.c | 95 - crypto/md5/md5s.cpp | 78 - crypto/md5/md5test.c | 131 - crypto/mdc2/.cvsignore | 2 - crypto/mdc2/Makefile.ssl | 91 - crypto/mdc2/mdc2.h | 95 - crypto/mdc2/mdc2_one.c | 75 - crypto/mdc2/mdc2dgst.c | 195 - crypto/mdc2/mdc2test.c | 140 - crypto/mem.c | 272 - crypto/mem_dbg.c | 730 -- crypto/objects/.cvsignore | 2 - crypto/objects/Makefile.ssl | 118 - crypto/objects/o_names.c | 266 - crypto/objects/obj_dat.c | 657 -- crypto/objects/obj_dat.h | 2247 ------ crypto/objects/obj_dat.pl | 302 - crypto/objects/obj_err.c | 99 - crypto/objects/obj_lib.c | 126 - crypto/objects/obj_mac.h | 1834 ----- crypto/objects/obj_mac.num | 404 -- crypto/objects/objects.README | 44 - crypto/objects/objects.h | 1038 --- crypto/objects/objects.pl | 224 - crypto/objects/objects.txt | 603 -- crypto/ocsp/Makefile.ssl | 243 - crypto/ocsp/ocsp.h | 591 -- crypto/ocsp/ocsp_cid.c | 157 - crypto/ocsp/ocsp_err.c | 116 - crypto/ocsp/ocsp_ext.c | 348 - crypto/ocsp/ocsp_lib.c | 791 --- crypto/ocsp/ocsp_req.c | 316 - crypto/ocsp/ocsp_res.c | 896 --- crypto/ocsp/ocsp_sig.c | 157 - crypto/opensslconf.h.in | 155 - crypto/opensslv.h | 85 - crypto/pem/.cvsignore | 3 - crypto/pem/Makefile.ssl | 211 - crypto/pem/message | 16 - crypto/pem/pem.h | 667 -- crypto/pem/pem2.h | 68 - crypto/pem/pem_all.c | 203 - crypto/pem/pem_err.c | 131 - crypto/pem/pem_info.c | 364 - crypto/pem/pem_lib.c | 963 --- crypto/pem/pem_seal.c | 184 - crypto/pem/pem_sign.c | 102 - crypto/pem/pkcs7.lis | 22 - crypto/perlasm/alpha.pl | 434 -- crypto/perlasm/cbc.pl | 342 - crypto/perlasm/readme | 124 - crypto/perlasm/x86asm.pl | 118 - crypto/perlasm/x86ms.pl | 365 - crypto/perlasm/x86nasm.pl | 342 - crypto/perlasm/x86unix.pl | 461 -- crypto/pkcs12/.cvsignore | 2 - crypto/pkcs12/Makefile.ssl | 419 -- crypto/pkcs12/p12_add.c | 218 - crypto/pkcs12/p12_attr.c | 238 - crypto/pkcs12/p12_bags.c | 192 - crypto/pkcs12/p12_crpt.c | 124 - crypto/pkcs12/p12_crt.c | 164 - crypto/pkcs12/p12_decr.c | 187 - crypto/pkcs12/p12_init.c | 98 - crypto/pkcs12/p12_key.c | 197 - crypto/pkcs12/p12_kiss.c | 284 - crypto/pkcs12/p12_lib.c | 111 - crypto/pkcs12/p12_mac.c | 110 - crypto/pkcs12/p12_mutl.c | 170 - crypto/pkcs12/p12_npas.c | 217 - crypto/pkcs12/p12_sbag.c | 234 - crypto/pkcs12/p12_utl.c | 118 - crypto/pkcs12/pk12err.c | 139 - crypto/pkcs12/pkcs12.h | 345 - crypto/pkcs7/.cvsignore | 6 - crypto/pkcs7/Makefile.ssl | 228 - crypto/pkcs7/bio_ber.c | 466 -- crypto/pkcs7/dec.c | 248 - crypto/pkcs7/des.pem | 15 - crypto/pkcs7/doc | 24 - crypto/pkcs7/enc.c | 174 - crypto/pkcs7/es1.pem | 66 - crypto/pkcs7/example.c | 328 - crypto/pkcs7/example.h | 57 - crypto/pkcs7/info.pem | 57 - crypto/pkcs7/infokey.pem | 9 - crypto/pkcs7/p7/a1 | 2 - crypto/pkcs7/p7/a2 | 1 - crypto/pkcs7/p7/cert.p7c | Bin 1728 -> 0 bytes crypto/pkcs7/p7/smime.p7m | Bin 4894 -> 0 bytes crypto/pkcs7/p7/smime.p7s | Bin 2625 -> 0 bytes crypto/pkcs7/pk7_attr.c | 89 - crypto/pkcs7/pk7_dgst.c | 66 - crypto/pkcs7/pk7_doit.c | 937 --- crypto/pkcs7/pk7_enc.c | 76 - crypto/pkcs7/pk7_lib.c | 469 -- crypto/pkcs7/pk7_mime.c | 685 -- crypto/pkcs7/pk7_smime.c | 435 -- crypto/pkcs7/pkcs7.h | 505 -- crypto/pkcs7/pkcs7err.c | 161 - crypto/pkcs7/server.pem | 24 - crypto/pkcs7/sign.c | 154 - crypto/pkcs7/t/3des.pem | 16 - crypto/pkcs7/t/3dess.pem | 32 - crypto/pkcs7/t/c.pem | 48 - crypto/pkcs7/t/ff | 32 - crypto/pkcs7/t/msie-e | 20 - crypto/pkcs7/t/msie-e.pem | 22 - crypto/pkcs7/t/msie-enc-01 | 62 - crypto/pkcs7/t/msie-enc-01.pem | 66 - crypto/pkcs7/t/msie-enc-02 | 90 - crypto/pkcs7/t/msie-enc-02.pem | 106 - crypto/pkcs7/t/msie-s-a-e | 91 - crypto/pkcs7/t/msie-s-a-e.pem | 106 - crypto/pkcs7/t/nav-smime | 157 - crypto/pkcs7/t/s.pem | 57 - crypto/pkcs7/t/server.pem | 57 - crypto/pkcs7/verify.c | 262 - crypto/rand/.cvsignore | 2 - crypto/rand/Makefile.ssl | 125 - crypto/rand/md_rand.c | 511 -- crypto/rand/rand.h | 132 - crypto/rand/rand_egd.c | 167 - crypto/rand/rand_err.c | 94 - crypto/rand/rand_lcl.h | 184 - crypto/rand/rand_lib.c | 136 - crypto/rand/rand_win.c | 732 -- crypto/rand/randfile.c | 220 - crypto/rand/randtest.c | 214 - crypto/rc2/.cvsignore | 2 - crypto/rc2/Makefile.ssl | 91 - crypto/rc2/rc2.h | 101 - crypto/rc2/rc2_cbc.c | 226 - crypto/rc2/rc2_ecb.c | 88 - crypto/rc2/rc2_locl.h | 156 - crypto/rc2/rc2_skey.c | 138 - crypto/rc2/rc2cfb64.c | 122 - crypto/rc2/rc2ofb64.c | 111 - crypto/rc2/rc2speed.c | 274 - crypto/rc2/rc2test.c | 269 - crypto/rc2/rrc2.doc | 219 - crypto/rc2/tab.c | 86 - crypto/rc2/version | 22 - crypto/rc4/.cvsignore | 2 - crypto/rc4/Makefile.ssl | 115 - crypto/rc4/asm/.cvsignore | 1 - crypto/rc4/asm/rc4-586.pl | 173 - crypto/rc4/rc4.c | 192 - crypto/rc4/rc4.h | 88 - crypto/rc4/rc4_enc.c | 315 - crypto/rc4/rc4_locl.h | 4 - crypto/rc4/rc4_skey.c | 117 - crypto/rc4/rc4s.cpp | 73 - crypto/rc4/rc4speed.c | 250 - crypto/rc4/rc4test.c | 201 - crypto/rc4/rrc4.doc | 278 - crypto/rc5/.cvsignore | 2 - crypto/rc5/Makefile.ssl | 113 - crypto/rc5/asm/.cvsignore | 1 - crypto/rc5/asm/rc5-586.pl | 109 - crypto/rc5/rc5.h | 116 - crypto/rc5/rc5_ecb.c | 80 - crypto/rc5/rc5_enc.c | 215 - crypto/rc5/rc5_locl.h | 187 - crypto/rc5/rc5_skey.c | 113 - crypto/rc5/rc5cfb64.c | 122 - crypto/rc5/rc5ofb64.c | 111 - crypto/rc5/rc5s.cpp | 70 - crypto/rc5/rc5speed.c | 274 - crypto/rc5/rc5test.c | 384 - crypto/rijndael/Makefile.ssl | 86 - crypto/rijndael/README | 84 - crypto/rijndael/boxes-fst-corrected.dat | 3986 ----------- crypto/rijndael/rijndael-alg-fst.c | 476 -- crypto/rijndael/rijndael-alg-fst.h | 46 - crypto/rijndael/rijndael.h | 11 - crypto/ripemd/.cvsignore | 2 - crypto/ripemd/Makefile.ssl | 109 - crypto/ripemd/README | 15 - crypto/ripemd/asm/.cvsignore | 1 - crypto/ripemd/asm/rips.cpp | 82 - crypto/ripemd/asm/rmd-586.pl | 590 -- crypto/ripemd/ripemd.h | 101 - crypto/ripemd/rmd160.c | 127 - crypto/ripemd/rmd_dgst.c | 493 -- crypto/ripemd/rmd_locl.h | 160 - crypto/ripemd/rmd_one.c | 76 - crypto/ripemd/rmdconst.h | 399 -- crypto/ripemd/rmdtest.c | 140 - crypto/rsa/.cvsignore | 2 - crypto/rsa/Makefile.ssl | 226 - crypto/rsa/rsa.h | 365 - crypto/rsa/rsa_chk.c | 184 - crypto/rsa/rsa_eay.c | 502 -- crypto/rsa/rsa_err.c | 148 - crypto/rsa/rsa_gen.c | 197 - crypto/rsa/rsa_lib.c | 388 - crypto/rsa/rsa_none.c | 98 - crypto/rsa/rsa_null.c | 150 - crypto/rsa/rsa_oaep.c | 166 - crypto/rsa/rsa_pk1.c | 224 - crypto/rsa/rsa_saos.c | 146 - crypto/rsa/rsa_sign.c | 226 - crypto/rsa/rsa_ssl.c | 154 - crypto/rsa/rsa_test.c | 314 - crypto/sha/.cvsignore | 2 - crypto/sha/Makefile.ssl | 113 - crypto/sha/asm/.cvsignore | 1 - crypto/sha/asm/README | 1 - crypto/sha/asm/sha1-586.pl | 540 -- crypto/sha/sha.c | 124 - crypto/sha/sha.h | 119 - crypto/sha/sha1.c | 127 - crypto/sha/sha1_one.c | 76 - crypto/sha/sha1dgst.c | 73 - crypto/sha/sha1s.cpp | 82 - crypto/sha/sha1test.c | 168 - crypto/sha/sha_dgst.c | 73 - crypto/sha/sha_locl.h | 471 -- crypto/sha/sha_one.c | 76 - crypto/sha/shatest.c | 168 - crypto/stack/.cvsignore | 2 - crypto/stack/Makefile.ssl | 88 - crypto/stack/safestack.h | 1192 ---- crypto/stack/stack.c | 332 - crypto/stack/stack.h | 107 - crypto/symhacks.h | 154 - crypto/threads/README | 14 - crypto/threads/mttest.c | 1100 --- crypto/threads/profile.sh | 4 - crypto/threads/ptest.bat | 4 - crypto/threads/pthread.sh | 9 - crypto/threads/pthread2.sh | 7 - crypto/threads/pthreads-vms.com | 9 - crypto/threads/purify.sh | 4 - crypto/threads/solaris.sh | 4 - crypto/threads/th-lock.c | 387 - crypto/threads/win32.bat | 4 - crypto/tmdiff.c | 229 - crypto/tmdiff.h | 81 - crypto/txt_db/.cvsignore | 2 - crypto/txt_db/Makefile.ssl | 88 - crypto/txt_db/txt_db.c | 383 - crypto/txt_db/txt_db.h | 108 - crypto/x509/.cvsignore | 2 - crypto/x509/Makefile.ssl | 560 -- crypto/x509/by_dir.c | 351 - crypto/x509/by_file.c | 298 - crypto/x509/x509.h | 1312 ---- crypto/x509/x509_att.c | 326 - crypto/x509/x509_cmp.c | 314 - crypto/x509/x509_d2.c | 107 - crypto/x509/x509_def.c | 81 - crypto/x509/x509_err.c | 152 - crypto/x509/x509_ext.c | 191 - crypto/x509/x509_lu.c | 529 -- crypto/x509/x509_obj.c | 223 - crypto/x509/x509_r2x.c | 110 - crypto/x509/x509_req.c | 278 - crypto/x509/x509_set.c | 150 - crypto/x509/x509_trs.c | 266 - crypto/x509/x509_txt.c | 150 - crypto/x509/x509_v3.c | 267 - crypto/x509/x509_vfy.c | 920 --- crypto/x509/x509_vfy.h | 390 -- crypto/x509/x509name.c | 383 - crypto/x509/x509rset.c | 83 - crypto/x509/x509spki.c | 121 - crypto/x509/x509type.c | 114 - crypto/x509/x_all.c | 565 -- crypto/x509v3/.cvsignore | 2 - crypto/x509v3/Makefile.ssl | 550 -- crypto/x509v3/ext_dat.h | 97 - crypto/x509v3/tabtest.c | 88 - crypto/x509v3/v3_akey.c | 249 - crypto/x509v3/v3_alt.c | 401 -- crypto/x509v3/v3_bcons.c | 164 - crypto/x509v3/v3_bitst.c | 141 - crypto/x509v3/v3_conf.c | 390 -- crypto/x509v3/v3_cpols.c | 660 -- crypto/x509v3/v3_crld.c | 285 - crypto/x509v3/v3_enum.c | 96 - crypto/x509v3/v3_extku.c | 150 - crypto/x509v3/v3_genn.c | 291 - crypto/x509v3/v3_ia5.c | 113 - crypto/x509v3/v3_info.c | 245 - crypto/x509v3/v3_int.c | 72 - crypto/x509v3/v3_lib.c | 225 - crypto/x509v3/v3_pku.c | 151 - crypto/x509v3/v3_prn.c | 181 - crypto/x509v3/v3_purp.c | 533 -- crypto/x509v3/v3_skey.c | 149 - crypto/x509v3/v3_sxnet.c | 340 - crypto/x509v3/v3_utl.c | 516 -- crypto/x509v3/v3conf.c | 128 - crypto/x509v3/v3err.c | 176 - crypto/x509v3/v3prin.c | 101 - crypto/x509v3/x509v3.h | 666 -- demos/README | 9 - demos/b64.c | 270 - demos/b64.pl | 20 - demos/bio/Makefile | 16 - demos/bio/README | 3 - demos/bio/saccept.c | 107 - demos/bio/sconnect.c | 116 - demos/bio/server.pem | 30 - demos/eay/Makefile | 24 - demos/eay/base64.c | 49 - demos/eay/conn.c | 105 - demos/eay/loadrsa.c | 53 - demos/maurice/Makefile | 59 - demos/maurice/README | 34 - demos/maurice/cert.pem | 77 - demos/maurice/example1.c | 200 - demos/maurice/example2.c | 75 - demos/maurice/example3.c | 85 - demos/maurice/example4.c | 123 - demos/maurice/loadkeys.c | 77 - demos/maurice/loadkeys.h | 19 - demos/maurice/privkey.pem | 27 - demos/pkcs12/README | 3 - demos/pkcs12/pkread.c | 61 - demos/pkcs12/pkwrite.c | 46 - demos/prime/Makefile | 20 - demos/prime/prime.c | 101 - demos/privkey.pem | 9 - demos/selfsign.c | 180 - demos/sign/Makefile | 15 - demos/sign/cert.pem | 14 - demos/sign/key.pem | 9 - demos/sign/sig.txt | 158 - demos/sign/sign.c | 153 - demos/sign/sign.txt | 170 - demos/spkigen.c | 160 - demos/ssl/cli.cpp | 110 - demos/ssl/inetdsrv.cpp | 98 - demos/ssl/serv.cpp | 152 - demos/state_machine/.cvsignore | 1 - demos/state_machine/Makefile | 9 - demos/state_machine/state_machine.c | 395 -- demos/tunala/A-client.pem | 85 - demos/tunala/A-server.pem | 85 - demos/tunala/CA.pem | 24 - demos/tunala/Makefile | 40 - demos/tunala/README | 233 - demos/tunala/buffer.c | 146 - demos/tunala/ip.c | 147 - demos/tunala/sm.c | 149 - demos/tunala/tunala.c | 724 -- demos/tunala/tunala.h | 146 - doc/README | 12 - doc/apps/CA.pl.pod | 174 - doc/apps/asn1parse.pod | 129 - doc/apps/ca.pod | 488 -- doc/apps/ciphers.pod | 346 - doc/apps/config.pod | 138 - doc/apps/crl.pod | 117 - doc/apps/crl2pkcs7.pod | 90 - doc/apps/dgst.pod | 104 - doc/apps/dhparam.pod | 133 - doc/apps/dsa.pod | 150 - doc/apps/dsaparam.pod | 102 - doc/apps/enc.pod | 257 - doc/apps/gendsa.pod | 58 - doc/apps/genrsa.pod | 88 - doc/apps/nseq.pod | 70 - doc/apps/openssl.pod | 336 - doc/apps/passwd.pod | 76 - doc/apps/pkcs12.pod | 310 - doc/apps/pkcs7.pod | 97 - doc/apps/pkcs8.pod | 235 - doc/apps/rand.pod | 50 - doc/apps/req.pod | 538 -- doc/apps/rsa.pod | 181 - doc/apps/rsautl.pod | 183 - doc/apps/s_client.pod | 229 - doc/apps/s_server.pod | 273 - doc/apps/sess_id.pod | 151 - doc/apps/smime.pod | 376 - doc/apps/speed.pod | 57 - doc/apps/spkac.pod | 127 - doc/apps/verify.pod | 328 - doc/apps/version.pod | 56 - doc/apps/x509.pod | 706 -- doc/c-indentation.el | 46 - doc/crypto/BIO_ctrl.pod | 128 - doc/crypto/BIO_f_base64.pod | 82 - doc/crypto/BIO_f_buffer.pod | 69 - doc/crypto/BIO_f_cipher.pod | 76 - doc/crypto/BIO_f_md.pod | 138 - doc/crypto/BIO_f_null.pod | 32 - doc/crypto/BIO_f_ssl.pod | 313 - doc/crypto/BIO_find_type.pod | 98 - doc/crypto/BIO_new.pod | 65 - doc/crypto/BIO_new_bio_pair.pod | 102 - doc/crypto/BIO_push.pod | 69 - doc/crypto/BIO_read.pod | 66 - doc/crypto/BIO_s_accept.pod | 195 - doc/crypto/BIO_s_bio.pod | 130 - doc/crypto/BIO_s_connect.pod | 192 - doc/crypto/BIO_s_fd.pod | 89 - doc/crypto/BIO_s_file.pod | 144 - doc/crypto/BIO_s_mem.pod | 115 - doc/crypto/BIO_s_null.pod | 37 - doc/crypto/BIO_s_socket.pod | 63 - doc/crypto/BIO_set_callback.pod | 108 - doc/crypto/BIO_should_retry.pod | 114 - doc/crypto/BN_CTX_new.pod | 53 - doc/crypto/BN_CTX_start.pod | 52 - doc/crypto/BN_add.pod | 99 - doc/crypto/BN_add_word.pod | 57 - doc/crypto/BN_bn2bin.pod | 95 - doc/crypto/BN_cmp.pod | 48 - doc/crypto/BN_copy.pod | 34 - doc/crypto/BN_generate_prime.pod | 102 - doc/crypto/BN_mod_inverse.pod | 36 - doc/crypto/BN_mod_mul_montgomery.pod | 95 - doc/crypto/BN_mod_mul_reciprocal.pod | 81 - doc/crypto/BN_new.pod | 53 - doc/crypto/BN_num_bytes.pod | 37 - doc/crypto/BN_rand.pod | 45 - doc/crypto/BN_set_bit.pod | 66 - doc/crypto/BN_zero.pod | 56 - doc/crypto/CRYPTO_set_ex_data.pod | 51 - doc/crypto/DH_generate_key.pod | 50 - doc/crypto/DH_generate_parameters.pod | 72 - doc/crypto/DH_get_ex_new_index.pod | 36 - doc/crypto/DH_new.pod | 40 - doc/crypto/DH_set_method.pod | 111 - doc/crypto/DH_size.pod | 33 - doc/crypto/DSA_SIG_new.pod | 39 - doc/crypto/DSA_do_sign.pod | 47 - doc/crypto/DSA_dup_DH.pod | 36 - doc/crypto/DSA_generate_key.pod | 33 - doc/crypto/DSA_generate_parameters.pod | 105 - doc/crypto/DSA_get_ex_new_index.pod | 36 - doc/crypto/DSA_new.pod | 41 - doc/crypto/DSA_set_method.pod | 118 - doc/crypto/DSA_sign.pod | 66 - doc/crypto/DSA_size.pod | 33 - doc/crypto/ERR_GET_LIB.pod | 51 - doc/crypto/ERR_clear_error.pod | 29 - doc/crypto/ERR_error_string.pod | 73 - doc/crypto/ERR_get_error.pod | 63 - doc/crypto/ERR_load_crypto_strings.pod | 46 - doc/crypto/ERR_load_strings.pod | 54 - doc/crypto/ERR_print_errors.pod | 51 - doc/crypto/ERR_put_error.pod | 44 - doc/crypto/ERR_remove_state.pod | 34 - doc/crypto/EVP_DigestInit.pod | 202 - doc/crypto/EVP_EncryptInit.pod | 359 - doc/crypto/EVP_OpenInit.pod | 63 - doc/crypto/EVP_SealInit.pod | 76 - doc/crypto/EVP_SignInit.pod | 85 - doc/crypto/EVP_VerifyInit.pod | 72 - doc/crypto/OPENSSL_VERSION_NUMBER.pod | 88 - doc/crypto/OpenSSL_add_all_algorithms.pod | 66 - doc/crypto/RAND_add.pod | 77 - doc/crypto/RAND_bytes.pod | 46 - doc/crypto/RAND_cleanup.pod | 29 - doc/crypto/RAND_egd.pod | 42 - doc/crypto/RAND_load_file.pod | 53 - doc/crypto/RAND_set_rand_method.pod | 59 - doc/crypto/RSA_blinding_on.pod | 43 - doc/crypto/RSA_check_key.pod | 39 - doc/crypto/RSA_generate_key.pod | 68 - doc/crypto/RSA_get_ex_new_index.pod | 120 - doc/crypto/RSA_new.pod | 38 - doc/crypto/RSA_padding_add_PKCS1_type_1.pod | 124 - doc/crypto/RSA_print.pod | 49 - doc/crypto/RSA_private_encrypt.pod | 69 - doc/crypto/RSA_public_encrypt.pod | 86 - doc/crypto/RSA_set_method.pod | 168 - doc/crypto/RSA_sign.pod | 62 - doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod | 59 - doc/crypto/RSA_size.pod | 33 - doc/crypto/bio.pod | 54 - doc/crypto/blowfish.pod | 112 - doc/crypto/bn.pod | 148 - doc/crypto/bn_internal.pod | 225 - doc/crypto/buffer.pod | 73 - doc/crypto/crypto.pod | 68 - doc/crypto/d2i_DHparams.pod | 30 - doc/crypto/d2i_RSAPublicKey.pod | 39 - doc/crypto/des.pod | 376 - doc/crypto/des_modes.pod | 253 - doc/crypto/dh.pod | 69 - doc/crypto/dsa.pod | 105 - doc/crypto/err.pod | 187 - doc/crypto/evp.pod | 37 - doc/crypto/hmac.pod | 76 - doc/crypto/lh_stats.pod | 60 - doc/crypto/lhash.pod | 155 - doc/crypto/md5.pod | 101 - doc/crypto/mdc2.pod | 64 - doc/crypto/rand.pod | 158 - doc/crypto/rc4.pod | 62 - doc/crypto/ripemd.pod | 66 - doc/crypto/rsa.pod | 117 - doc/crypto/sha.pod | 70 - doc/crypto/threads.pod | 156 - doc/openssl.txt | 1235 ---- doc/openssl_button.gif | Bin 2063 -> 0 bytes doc/openssl_button.html | 7 - doc/ssl/SSL_CIPHER_get_name.pod | 57 - doc/ssl/SSL_CTX_free.pod | 29 - doc/ssl/SSL_CTX_get_verify_mode.pod | 50 - doc/ssl/SSL_CTX_load_verify_locations.pod | 115 - doc/ssl/SSL_CTX_new.pod | 94 - doc/ssl/SSL_CTX_set_cipher_list.pod | 52 - doc/ssl/SSL_CTX_set_client_CA_list.pod | 90 - doc/ssl/SSL_CTX_set_ssl_version.pod | 60 - doc/ssl/SSL_CTX_set_verify.pod | 251 - doc/ssl/SSL_SESSION_free.pod | 25 - doc/ssl/SSL_accept.pod | 72 - doc/ssl/SSL_clear.pod | 39 - doc/ssl/SSL_connect.pod | 69 - doc/ssl/SSL_free.pod | 33 - doc/ssl/SSL_get_ciphers.pod | 42 - doc/ssl/SSL_get_client_CA_list.pod | 52 - doc/ssl/SSL_get_current_cipher.pod | 43 - doc/ssl/SSL_get_error.pod | 93 - doc/ssl/SSL_get_fd.pod | 44 - doc/ssl/SSL_get_peer_cert_chain.pod | 52 - doc/ssl/SSL_get_peer_certificate.pod | 48 - doc/ssl/SSL_get_rbio.pod | 40 - doc/ssl/SSL_get_session.pod | 48 - doc/ssl/SSL_get_verify_result.pod | 57 - doc/ssl/SSL_library_init.pod | 52 - doc/ssl/SSL_load_client_CA_file.pod | 62 - doc/ssl/SSL_new.pod | 42 - doc/ssl/SSL_pending.pod | 43 - doc/ssl/SSL_read.pod | 77 - doc/ssl/SSL_set_bio.pod | 34 - doc/ssl/SSL_set_fd.pod | 54 - doc/ssl/SSL_set_session.pod | 45 - doc/ssl/SSL_set_verify_result.pod | 38 - doc/ssl/SSL_shutdown.pod | 62 - doc/ssl/SSL_write.pod | 76 - doc/ssl/ssl.pod | 680 -- doc/ssleay.txt | 7014 ------------------- doc/standards.txt | 130 - e_os.h | 458 -- e_os2.h | 38 - include/.cvsignore | 1 - install.com | 89 - makevms.com | 1058 --- ms/.cvsignore | 2 - ms/.rnd | Bin 1024 -> 0 bytes ms/16all.bat | 12 - ms/32all.bat | 12 - ms/README | 18 - ms/bcb4.bat | 6 - ms/certCA.srl | 1 - ms/certCA.ss | 10 - ms/certU.ss | 10 - ms/cipher.out | 93 - ms/clear.out | 93 - ms/cmp.pl | 47 - ms/do_masm.bat | 68 - ms/do_ms.bat | 12 - ms/do_nasm.bat | 69 - ms/do_nt.bat | 7 - ms/keyCA.ss | 9 - ms/keyU.ss | 9 - ms/mingw32.bat | 94 - ms/mw.bat | 31 - ms/req2CA.ss | 29 - ms/reqCA.ss | 8 - ms/reqU.ss | 8 - ms/speed16.bat | 38 - ms/speed32.bat | 37 - ms/tenc.bat | 14 - ms/test.bat | 193 - ms/testenc.bat | 94 - ms/testpem.bat | 32 - ms/testss.bat | 98 - ms/tlhelp32.h | 136 - ms/tpem.bat | 6 - ms/x86asm.bat | 57 - openssl.doxy | 7 - openssl.spec | 219 - perl/.cvsignore | 12 - perl/MANIFEST | 17 - perl/Makefile.PL | 45 - perl/OpenSSL.pm | 90 - perl/OpenSSL.xs | 82 - perl/README.1ST | 4 - perl/openssl.h | 96 - perl/openssl_bio.xs | 450 -- perl/openssl_bn.xs | 593 -- perl/openssl_cipher.xs | 154 - perl/openssl_digest.xs | 84 - perl/openssl_err.xs | 47 - perl/openssl_ssl.xs | 483 -- perl/openssl_x509.xs | 75 - perl/t/01-use.t | 13 - perl/t/02-version.t | 10 - perl/t/03-bio.t | 16 - perl/typemap | 96 - rsaref/.cvsignore | 2 - shlib/Makefile.hpux10-cc | 51 - shlib/README | 1 - shlib/hpux10-cc.sh | 90 - shlib/irix.sh | 7 - shlib/solaris-sc4.sh | 42 - shlib/solaris.sh | 36 - shlib/sun.sh | 8 - shlib/win32.bat | 18 - shlib/win32dll.bat | 13 - ssl/.cvsignore | 2 - ssl/Makefile.ssl | 919 --- ssl/bio_ssl.c | 590 -- ssl/install.com | 103 - ssl/s23_clnt.c | 475 -- ssl/s23_lib.c | 226 - ssl/s23_meth.c | 92 - ssl/s23_pkt.c | 117 - ssl/s23_srvr.c | 576 -- ssl/s2_clnt.c | 993 --- ssl/s2_enc.c | 187 - ssl/s2_lib.c | 482 -- ssl/s2_meth.c | 95 - ssl/s2_pkt.c | 648 -- ssl/s2_srvr.c | 975 --- ssl/s3_both.c | 588 -- ssl/s3_clnt.c | 1740 ----- ssl/s3_enc.c | 583 -- ssl/s3_lib.c | 1339 ---- ssl/s3_meth.c | 88 - ssl/s3_pkt.c | 1198 ---- ssl/s3_srvr.c | 1754 ----- ssl/ssl-lib.com | 1224 ---- ssl/ssl.h | 1563 ----- ssl/ssl2.h | 269 - ssl/ssl23.h | 83 - ssl/ssl3.h | 429 -- ssl/ssl_algs.c | 103 - ssl/ssl_asn1.c | 349 - ssl/ssl_cert.c | 755 -- ssl/ssl_ciph.c | 1071 --- ssl/ssl_err.c | 431 -- ssl/ssl_err2.c | 70 - ssl/ssl_lib.c | 2068 ------ ssl/ssl_locl.h | 556 -- ssl/ssl_rsa.c | 815 --- ssl/ssl_sess.c | 680 -- ssl/ssl_stat.c | 454 -- ssl/ssl_task.c | 369 - ssl/ssl_txt.c | 174 - ssl/ssltest.c | 1370 ---- ssl/t1_clnt.c | 90 - ssl/t1_enc.c | 633 -- ssl/t1_lib.c | 149 - ssl/t1_meth.c | 88 - ssl/t1_srvr.c | 91 - ssl/tls1.h | 164 - test/.cvsignore | 15 - test/CAss.cnf | 25 - test/CAssdh.cnf | 24 - test/CAssdsa.cnf | 23 - test/CAssrsa.cnf | 24 - test/Makefile.ssl | 459 -- test/Sssdsa.cnf | 27 - test/Sssrsa.cnf | 26 - test/Uss.cnf | 28 - test/VMSca-response.1 | 1 - test/VMSca-response.2 | 2 - test/maketests.com | 1077 --- test/methtest.c | 105 - test/pkcs7-1.pem | 15 - test/pkcs7.pem | 54 - test/r160test.c | 57 - test/tcrl | 81 - test/tcrl.com | 81 - test/test.cnf | 88 - test/testca | 44 - test/testca.com | 78 - test/testcrl.pem | 16 - test/testenc | 54 - test/testenc.com | 60 - test/testgen | 38 - test/testgen.com | 52 - test/testp7.pem | 46 - test/testreq2.pem | 7 - test/testrsa.pem | 9 - test/tests.com | 232 - test/testsid.pem | 12 - test/testss | 97 - test/testss.com | 118 - test/testssl | 128 - test/testssl.com | 190 - test/testx509.pem | 10 - test/times | 113 - test/tpkcs7 | 51 - test/tpkcs7.com | 52 - test/tpkcs7d | 44 - test/tpkcs7d.com | 45 - test/treq | 86 - test/treq.com | 81 - test/trsa | 86 - test/trsa.com | 92 - test/tsid | 81 - test/tsid.com | 81 - test/tverify.com | 26 - test/tx509 | 81 - test/tx509.com | 81 - test/v3-cert1.pem | 16 - test/v3-cert2.pem | 16 - times/090/586-100.nt | 32 - times/091/486-50.nt | 30 - times/091/586-100.lnx | 32 - times/091/68000.bsd | 32 - times/091/686-200.lnx | 32 - times/091/alpha064.osf | 32 - times/091/alpha164.lnx | 32 - times/091/alpha164.osf | 31 - times/091/mips-rel.pl | 21 - times/091/r10000.irx | 37 - times/091/r3000.ult | 32 - times/091/r4400.irx | 32 - times/100.lnx | 32 - times/100.nt | 29 - times/200.lnx | 30 - times/486-66.dos | 22 - times/486-66.nt | 22 - times/486-66.w31 | 23 - times/5.lnx | 29 - times/586-085i.nt | 29 - times/586-100.LN3 | 26 - times/586-100.NT2 | 26 - times/586-100.dos | 24 - times/586-100.ln4 | 26 - times/586-100.lnx | 23 - times/586-100.nt | 23 - times/586-100.ntx | 30 - times/586-100.w31 | 27 - times/586-1002.lnx | 26 - times/586p-100.lnx | 26 - times/686-200.bsd | 25 - times/686-200.lnx | 26 - times/686-200.nt | 24 - times/L1 | 27 - times/R10000.t | 24 - times/R4400.t | 26 - times/aix.t | 34 - times/aixold.t | 23 - times/alpha.t | 81 - times/alpha400.t | 25 - times/cyrix100.lnx | 22 - times/dgux-x86.t | 23 - times/dgux.t | 17 - times/hpux-acc.t | 25 - times/hpux-kr.t | 23 - times/hpux.t | 86 - times/p2.w95 | 22 - times/pent2.t | 24 - times/readme | 11 - times/s586-100.lnx | 25 - times/s586-100.nt | 23 - times/sgi.t | 29 - times/sparc.t | 26 - times/sparc2 | 21 - times/sparcLX.t | 22 - times/usparc.t | 25 - times/x86/bfs.cpp | 67 - times/x86/casts.cpp | 67 - times/x86/des3s.cpp | 67 - times/x86/dess.cpp | 67 - times/x86/md4s.cpp | 78 - times/x86/md5s.cpp | 78 - times/x86/rc4s.cpp | 73 - times/x86/sha1s.cpp | 79 - tools/.cvsignore | 2 - tools/Makefile.ssl | 61 - tools/c_hash | 9 - tools/c_info | 12 - tools/c_issuer | 10 - tools/c_name | 10 - tools/c_rehash.in | 148 - util/FreeBSD.sh | 6 - util/add_cr.pl | 123 - util/bat.sh | 132 - util/ck_errf.pl | 45 - util/clean-depend.pl | 38 - util/deleof.pl | 7 - util/do_ms.sh | 19 - util/domd | 11 - util/err-ins.pl | 33 - util/files.pl | 61 - util/fixNT.sh | 14 - util/install.sh | 108 - util/libeay.num | 2046 ------ util/mk1mf.pl | 901 --- util/mkcerts.sh | 220 - util/mkdef.pl | 925 --- util/mkdir-p.pl | 33 - util/mkerr.pl | 529 -- util/mkfiles.pl | 114 - util/mklink.pl | 55 - util/mkstack.pl | 124 - util/perlpath.pl | 35 - util/pl/BC-16.pl | 146 - util/pl/BC-32.pl | 136 - util/pl/Mingw32.pl | 102 - util/pl/Mingw32f.pl | 73 - util/pl/VC-16.pl | 173 - util/pl/VC-32.pl | 141 - util/pl/linux.pl | 104 - util/pl/ultrix.pl | 38 - util/pl/unix.pl | 96 - util/pod2man.pl | 1181 ---- util/point.sh | 6 - util/selftest.pl | 200 - util/sp-diff.pl | 80 - util/speed.sh | 39 - util/src-dep.pl | 147 - util/ssleay.num | 195 - util/tab_num.pl | 17 - util/x86asm.sh | 42 - 1518 files changed, 327546 deletions(-) delete mode 100644 .cvsignore delete mode 100644 CHANGES delete mode 100644 CHANGES.SSLeay delete mode 100755 Configure delete mode 100644 FAQ delete mode 100644 INSTALL delete mode 100644 INSTALL.MacOS delete mode 100644 INSTALL.VMS delete mode 100644 INSTALL.W32 delete mode 100644 LICENSE delete mode 100644 MacOS/GUSI_Init.cpp delete mode 100644 MacOS/GetHTTPS.src/CPStringUtils.cpp delete mode 100644 MacOS/GetHTTPS.src/CPStringUtils.hpp delete mode 100644 MacOS/GetHTTPS.src/ErrorHandling.cpp delete mode 100644 MacOS/GetHTTPS.src/ErrorHandling.hpp delete mode 100644 MacOS/GetHTTPS.src/GetHTTPS.cpp delete mode 100644 MacOS/GetHTTPS.src/MacSocket.cpp delete mode 100644 MacOS/GetHTTPS.src/MacSocket.h delete mode 100644 MacOS/OpenSSL.mcp.hqx delete mode 100644 MacOS/Randomizer.cpp delete mode 100644 MacOS/Randomizer.h delete mode 100644 MacOS/TODO delete mode 100644 MacOS/_MWERKS_GUSI_prefix.h delete mode 100644 MacOS/_MWERKS_prefix.h delete mode 100644 MacOS/buildinf.h delete mode 100644 MacOS/mklinks.as.hqx delete mode 100644 MacOS/opensslconf.h delete mode 100644 Makefile.org delete mode 100644 NEWS delete mode 100644 README delete mode 100644 README.ENGINE delete mode 100644 STATUS delete mode 100644 TABLE delete mode 100644 VMS/TODO delete mode 100644 VMS/WISHLIST.TXT delete mode 100644 VMS/install.com delete mode 100644 VMS/multinet_shr.opt delete mode 100644 VMS/openssl_utils.com delete mode 100644 VMS/socketshr_shr.opt delete mode 100644 VMS/test-includes.com delete mode 100644 VMS/ucx_shr_decc.opt delete mode 100644 VMS/ucx_shr_decc_log.opt delete mode 100644 VMS/ucx_shr_vaxc.opt delete mode 100644 apps/.cvsignore delete mode 100644 apps/CA.com delete mode 100644 apps/CA.pl.in delete mode 100644 apps/CA.sh delete mode 100644 apps/Makefile.ssl delete mode 100644 apps/app_rand.c delete mode 100644 apps/apps.c delete mode 100644 apps/apps.h delete mode 100644 apps/asn1pars.c delete mode 100644 apps/ca-cert.srl delete mode 100644 apps/ca-key.pem delete mode 100644 apps/ca-req.pem delete mode 100644 apps/ca.c delete mode 100644 apps/cert.pem delete mode 100644 apps/ciphers.c delete mode 100644 apps/client.pem delete mode 100644 apps/crl.c delete mode 100644 apps/crl2p7.c delete mode 100644 apps/demoCA/cacert.pem delete mode 100644 apps/demoCA/index.txt delete mode 100644 apps/demoCA/private/cakey.pem delete mode 100644 apps/demoCA/serial delete mode 100644 apps/der_chop.in delete mode 100644 apps/dgst.c delete mode 100644 apps/dh.c delete mode 100644 apps/dh1024.pem delete mode 100644 apps/dh2048.pem delete mode 100644 apps/dh4096.pem delete mode 100644 apps/dh512.pem delete mode 100644 apps/dhparam.c delete mode 100644 apps/dsa-ca.pem delete mode 100644 apps/dsa-pca.pem delete mode 100644 apps/dsa.c delete mode 100644 apps/dsa1024.pem delete mode 100644 apps/dsa512.pem delete mode 100644 apps/dsap.pem delete mode 100644 apps/dsaparam.c delete mode 100644 apps/enc.c delete mode 100644 apps/engine.c delete mode 100644 apps/errstr.c delete mode 100644 apps/gendh.c delete mode 100644 apps/gendsa.c delete mode 100644 apps/genrsa.c delete mode 100644 apps/install.com delete mode 100644 apps/makeapps.com delete mode 100644 apps/nseq.c delete mode 100644 apps/oid.cnf delete mode 100644 apps/openssl-vms.cnf delete mode 100644 apps/openssl.c delete mode 100644 apps/openssl.cnf delete mode 100644 apps/passwd.c delete mode 100644 apps/pca-cert.srl delete mode 100644 apps/pca-key.pem delete mode 100644 apps/pca-req.pem delete mode 100644 apps/pkcs12.c delete mode 100644 apps/pkcs7.c delete mode 100644 apps/pkcs8.c delete mode 100644 apps/privkey.pem delete mode 100644 apps/progs.h delete mode 100644 apps/progs.pl delete mode 100644 apps/rand.c delete mode 100644 apps/req.c delete mode 100644 apps/req.pem delete mode 100644 apps/rsa.c delete mode 100644 apps/rsa8192.pem delete mode 100644 apps/rsautl.c delete mode 100644 apps/s1024key.pem delete mode 100644 apps/s1024req.pem delete mode 100644 apps/s512-key.pem delete mode 100644 apps/s512-req.pem delete mode 100644 apps/s_apps.h delete mode 100644 apps/s_cb.c delete mode 100644 apps/s_client.c delete mode 100644 apps/s_server.c delete mode 100644 apps/s_socket.c delete mode 100644 apps/s_time.c delete mode 100644 apps/server.pem delete mode 100644 apps/server.srl delete mode 100644 apps/server2.pem delete mode 100644 apps/sess_id.c delete mode 100644 apps/set/set-g-ca.pem delete mode 100644 apps/set/set-m-ca.pem delete mode 100644 apps/set/set_b_ca.pem delete mode 100644 apps/set/set_c_ca.pem delete mode 100644 apps/set/set_d_ct.pem delete mode 100644 apps/set/set_root.pem delete mode 100644 apps/smime.c delete mode 100644 apps/speed.c delete mode 100644 apps/spkac.c delete mode 100644 apps/testCA.pem delete mode 100644 apps/testdsa.h delete mode 100644 apps/testrsa.h delete mode 100644 apps/verify.c delete mode 100644 apps/version.c delete mode 100644 apps/winrand.c delete mode 100644 apps/x509.c delete mode 100644 bugs/MS delete mode 100644 bugs/SSLv3 delete mode 100644 bugs/VC16.bug delete mode 100644 bugs/alpha.c delete mode 100644 bugs/dggccbug.c delete mode 100644 bugs/sgiccbug.c delete mode 100644 bugs/sslref.dif delete mode 100644 bugs/stream.c delete mode 100644 bugs/ultrixcc.c delete mode 100644 certs/ICE-CA.pem delete mode 100644 certs/ICE-root.pem delete mode 100644 certs/ICE-user.pem delete mode 100644 certs/ICE.crl delete mode 100644 certs/ca-cert.pem delete mode 100644 certs/dsa-ca.pem delete mode 100644 certs/dsa-pca.pem delete mode 100644 certs/expired/ICE-CA.pem delete mode 100644 certs/expired/ICE-root.pem delete mode 100644 certs/expired/ICE-user.pem delete mode 100644 certs/expired/ICE.crl delete mode 100644 certs/expired/rsa-ssca.pem delete mode 100644 certs/factory.pem delete mode 100644 certs/nortelCA.pem delete mode 100644 certs/pca-cert.pem delete mode 100644 certs/rsa-cca.pem delete mode 100644 certs/thawteCb.pem delete mode 100644 certs/thawteCp.pem delete mode 100644 certs/timCA.pem delete mode 100644 certs/tjhCA.pem delete mode 100644 certs/vsign1.pem delete mode 100644 certs/vsign2.pem delete mode 100644 certs/vsign3.pem delete mode 100644 certs/vsignss.pem delete mode 100644 certs/vsigntca.pem delete mode 100755 config delete mode 100644 crypto/.cvsignore delete mode 100644 crypto/Makefile.ssl delete mode 100644 crypto/asn1/.cvsignore delete mode 100644 crypto/asn1/Makefile.ssl delete mode 100644 crypto/asn1/a_bitstr.c delete mode 100644 crypto/asn1/a_bmp.c delete mode 100644 crypto/asn1/a_bool.c delete mode 100644 crypto/asn1/a_bytes.c delete mode 100644 crypto/asn1/a_d2i_fp.c delete mode 100644 crypto/asn1/a_digest.c delete mode 100644 crypto/asn1/a_dup.c delete mode 100644 crypto/asn1/a_enum.c delete mode 100644 crypto/asn1/a_gentm.c delete mode 100644 crypto/asn1/a_hdr.c delete mode 100644 crypto/asn1/a_i2d_fp.c delete mode 100644 crypto/asn1/a_int.c delete mode 100644 crypto/asn1/a_mbstr.c delete mode 100644 crypto/asn1/a_meth.c delete mode 100644 crypto/asn1/a_null.c delete mode 100644 crypto/asn1/a_object.c delete mode 100644 crypto/asn1/a_octet.c delete mode 100644 crypto/asn1/a_print.c delete mode 100644 crypto/asn1/a_set.c delete mode 100644 crypto/asn1/a_sign.c delete mode 100644 crypto/asn1/a_strex.c delete mode 100644 crypto/asn1/a_strnid.c delete mode 100644 crypto/asn1/a_time.c delete mode 100644 crypto/asn1/a_type.c delete mode 100644 crypto/asn1/a_utctm.c delete mode 100644 crypto/asn1/a_utf8.c delete mode 100644 crypto/asn1/a_verify.c delete mode 100644 crypto/asn1/a_vis.c delete mode 100644 crypto/asn1/asn1.h delete mode 100644 crypto/asn1/asn1_err.c delete mode 100644 crypto/asn1/asn1_lib.c delete mode 100644 crypto/asn1/asn1_mac.h delete mode 100644 crypto/asn1/asn1_par.c delete mode 100644 crypto/asn1/asn_pack.c delete mode 100644 crypto/asn1/charmap.h delete mode 100644 crypto/asn1/charmap.pl delete mode 100644 crypto/asn1/d2i_dhp.c delete mode 100644 crypto/asn1/d2i_dsap.c delete mode 100644 crypto/asn1/d2i_pr.c delete mode 100644 crypto/asn1/d2i_pu.c delete mode 100644 crypto/asn1/d2i_r_pr.c delete mode 100644 crypto/asn1/d2i_r_pu.c delete mode 100644 crypto/asn1/d2i_s_pr.c delete mode 100644 crypto/asn1/d2i_s_pu.c delete mode 100644 crypto/asn1/evp_asn1.c delete mode 100644 crypto/asn1/f.c delete mode 100644 crypto/asn1/f_enum.c delete mode 100644 crypto/asn1/f_int.c delete mode 100644 crypto/asn1/f_string.c delete mode 100644 crypto/asn1/i2d_dhp.c delete mode 100644 crypto/asn1/i2d_dsap.c delete mode 100644 crypto/asn1/i2d_pr.c delete mode 100644 crypto/asn1/i2d_pu.c delete mode 100644 crypto/asn1/i2d_r_pr.c delete mode 100644 crypto/asn1/i2d_r_pu.c delete mode 100644 crypto/asn1/i2d_s_pr.c delete mode 100644 crypto/asn1/i2d_s_pu.c delete mode 100644 crypto/asn1/n_pkey.c delete mode 100644 crypto/asn1/nsseq.c delete mode 100644 crypto/asn1/p5_pbe.c delete mode 100644 crypto/asn1/p5_pbev2.c delete mode 100644 crypto/asn1/p7_dgst.c delete mode 100644 crypto/asn1/p7_enc.c delete mode 100644 crypto/asn1/p7_enc_c.c delete mode 100644 crypto/asn1/p7_evp.c delete mode 100644 crypto/asn1/p7_i_s.c delete mode 100644 crypto/asn1/p7_lib.c delete mode 100644 crypto/asn1/p7_recip.c delete mode 100644 crypto/asn1/p7_s_e.c delete mode 100644 crypto/asn1/p7_signd.c delete mode 100644 crypto/asn1/p7_signi.c delete mode 100644 crypto/asn1/p8_key.c delete mode 100644 crypto/asn1/p8_pkey.c delete mode 100644 crypto/asn1/t_bitst.c delete mode 100644 crypto/asn1/t_crl.c delete mode 100644 crypto/asn1/t_pkey.c delete mode 100644 crypto/asn1/t_req.c delete mode 100644 crypto/asn1/t_spki.c delete mode 100644 crypto/asn1/t_x509.c delete mode 100644 crypto/asn1/t_x509a.c delete mode 100644 crypto/asn1/x_algor.c delete mode 100644 crypto/asn1/x_attrib.c delete mode 100644 crypto/asn1/x_cinf.c delete mode 100644 crypto/asn1/x_crl.c delete mode 100644 crypto/asn1/x_exten.c delete mode 100644 crypto/asn1/x_info.c delete mode 100644 crypto/asn1/x_name.c delete mode 100644 crypto/asn1/x_pkey.c delete mode 100644 crypto/asn1/x_pubkey.c delete mode 100644 crypto/asn1/x_req.c delete mode 100644 crypto/asn1/x_sig.c delete mode 100644 crypto/asn1/x_spki.c delete mode 100644 crypto/asn1/x_val.c delete mode 100644 crypto/asn1/x_x509.c delete mode 100644 crypto/asn1/x_x509a.c delete mode 100644 crypto/bf/.cvsignore delete mode 100644 crypto/bf/COPYRIGHT delete mode 100644 crypto/bf/INSTALL delete mode 100644 crypto/bf/Makefile.ssl delete mode 100644 crypto/bf/README delete mode 100644 crypto/bf/VERSION delete mode 100644 crypto/bf/asm/.cvsignore delete mode 100644 crypto/bf/asm/bf-586.pl delete mode 100644 crypto/bf/asm/bf-686.pl delete mode 100644 crypto/bf/asm/readme delete mode 100644 crypto/bf/bf_cbc.c delete mode 100644 crypto/bf/bf_cfb64.c delete mode 100644 crypto/bf/bf_ecb.c delete mode 100644 crypto/bf/bf_enc.c delete mode 100644 crypto/bf/bf_locl.h delete mode 100644 crypto/bf/bf_ofb64.c delete mode 100644 crypto/bf/bf_opts.c delete mode 100644 crypto/bf/bf_pi.h delete mode 100644 crypto/bf/bf_skey.c delete mode 100644 crypto/bf/bfs.cpp delete mode 100644 crypto/bf/bfspeed.c delete mode 100644 crypto/bf/bftest.c delete mode 100644 crypto/bf/blowfish.h delete mode 100644 crypto/bio/.cvsignore delete mode 100644 crypto/bio/Makefile.ssl delete mode 100644 crypto/bio/b_dump.c delete mode 100644 crypto/bio/b_print.c delete mode 100644 crypto/bio/b_sock.c delete mode 100644 crypto/bio/bf_buff.c delete mode 100644 crypto/bio/bf_lbuf.c delete mode 100644 crypto/bio/bf_nbio.c delete mode 100644 crypto/bio/bf_null.c delete mode 100644 crypto/bio/bio.h delete mode 100644 crypto/bio/bio_cb.c delete mode 100644 crypto/bio/bio_err.c delete mode 100644 crypto/bio/bio_lib.c delete mode 100644 crypto/bio/bss_acpt.c delete mode 100644 crypto/bio/bss_bio.c delete mode 100644 crypto/bio/bss_conn.c delete mode 100644 crypto/bio/bss_fd.c delete mode 100644 crypto/bio/bss_file.c delete mode 100644 crypto/bio/bss_log.c delete mode 100644 crypto/bio/bss_mem.c delete mode 100644 crypto/bio/bss_null.c delete mode 100644 crypto/bio/bss_rtcp.c delete mode 100644 crypto/bio/bss_sock.c delete mode 100644 crypto/bn/.cvsignore delete mode 100644 crypto/bn/Makefile.ssl delete mode 100644 crypto/bn/asm/.cvsignore delete mode 100644 crypto/bn/asm/README delete mode 100644 crypto/bn/asm/alpha.s delete mode 100644 crypto/bn/asm/alpha.s.works delete mode 100644 crypto/bn/asm/alpha.works/add.pl delete mode 100644 crypto/bn/asm/alpha.works/div.pl delete mode 100644 crypto/bn/asm/alpha.works/mul.pl delete mode 100644 crypto/bn/asm/alpha.works/mul_add.pl delete mode 100644 crypto/bn/asm/alpha.works/mul_c4.pl delete mode 100644 crypto/bn/asm/alpha.works/mul_c4.works.pl delete mode 100644 crypto/bn/asm/alpha.works/mul_c8.pl delete mode 100644 crypto/bn/asm/alpha.works/sqr.pl delete mode 100644 crypto/bn/asm/alpha.works/sqr_c4.pl delete mode 100644 crypto/bn/asm/alpha.works/sqr_c8.pl delete mode 100644 crypto/bn/asm/alpha.works/sub.pl delete mode 100644 crypto/bn/asm/alpha/add.pl delete mode 100644 crypto/bn/asm/alpha/div.pl delete mode 100644 crypto/bn/asm/alpha/mul.pl delete mode 100644 crypto/bn/asm/alpha/mul_add.pl delete mode 100644 crypto/bn/asm/alpha/mul_c4.pl delete mode 100644 crypto/bn/asm/alpha/mul_c4.works.pl delete mode 100644 crypto/bn/asm/alpha/mul_c8.pl delete mode 100644 crypto/bn/asm/alpha/sqr.pl delete mode 100644 crypto/bn/asm/alpha/sqr_c4.pl delete mode 100644 crypto/bn/asm/alpha/sqr_c8.pl delete mode 100644 crypto/bn/asm/alpha/sub.pl delete mode 100644 crypto/bn/asm/bn-586.pl delete mode 100644 crypto/bn/asm/bn-alpha.pl delete mode 100644 crypto/bn/asm/ca.pl delete mode 100644 crypto/bn/asm/co-586.pl delete mode 100644 crypto/bn/asm/co-alpha.pl delete mode 100644 crypto/bn/asm/mips1.s delete mode 100644 crypto/bn/asm/mips3.s delete mode 100644 crypto/bn/asm/pa-risc.s delete mode 100644 crypto/bn/asm/pa-risc2.s delete mode 100644 crypto/bn/asm/pa-risc2.s.old delete mode 100644 crypto/bn/asm/pa-risc2W.s delete mode 100644 crypto/bn/asm/r3000.s delete mode 100644 crypto/bn/asm/sparcv8.S delete mode 100644 crypto/bn/asm/sparcv8plus.S delete mode 100644 crypto/bn/asm/vms.mar delete mode 100644 crypto/bn/asm/x86.pl delete mode 100644 crypto/bn/asm/x86/add.pl delete mode 100644 crypto/bn/asm/x86/comba.pl delete mode 100644 crypto/bn/asm/x86/div.pl delete mode 100644 crypto/bn/asm/x86/f delete mode 100644 crypto/bn/asm/x86/mul.pl delete mode 100644 crypto/bn/asm/x86/mul_add.pl delete mode 100644 crypto/bn/asm/x86/sqr.pl delete mode 100644 crypto/bn/asm/x86/sub.pl delete mode 100644 crypto/bn/bn.h delete mode 100644 crypto/bn/bn.mul delete mode 100644 crypto/bn/bn_add.c delete mode 100644 crypto/bn/bn_asm.c delete mode 100644 crypto/bn/bn_blind.c delete mode 100644 crypto/bn/bn_ctx.c delete mode 100644 crypto/bn/bn_div.c delete mode 100644 crypto/bn/bn_err.c delete mode 100644 crypto/bn/bn_exp.c delete mode 100644 crypto/bn/bn_exp2.c delete mode 100644 crypto/bn/bn_gcd.c delete mode 100644 crypto/bn/bn_lcl.h delete mode 100644 crypto/bn/bn_lib.c delete mode 100644 crypto/bn/bn_mont.c delete mode 100644 crypto/bn/bn_mpi.c delete mode 100644 crypto/bn/bn_mul.c delete mode 100644 crypto/bn/bn_prime.c delete mode 100644 crypto/bn/bn_prime.h delete mode 100644 crypto/bn/bn_prime.pl delete mode 100644 crypto/bn/bn_print.c delete mode 100644 crypto/bn/bn_rand.c delete mode 100644 crypto/bn/bn_recp.c delete mode 100644 crypto/bn/bn_shift.c delete mode 100644 crypto/bn/bn_sqr.c delete mode 100644 crypto/bn/bn_word.c delete mode 100644 crypto/bn/bnspeed.c delete mode 100644 crypto/bn/bntest.c delete mode 100644 crypto/bn/divtest.c delete mode 100644 crypto/bn/exp.c delete mode 100644 crypto/bn/expspeed.c delete mode 100644 crypto/bn/exptest.c delete mode 100644 crypto/bn/todo delete mode 100644 crypto/bn/vms-helper.c delete mode 100644 crypto/buffer/.cvsignore delete mode 100644 crypto/buffer/Makefile.ssl delete mode 100644 crypto/buffer/buf_err.c delete mode 100644 crypto/buffer/buffer.c delete mode 100644 crypto/buffer/buffer.h delete mode 100644 crypto/cast/.cvsignore delete mode 100644 crypto/cast/Makefile.ssl delete mode 100644 crypto/cast/asm/.cvsignore delete mode 100644 crypto/cast/asm/cast-586.pl delete mode 100644 crypto/cast/asm/readme delete mode 100644 crypto/cast/c_cfb64.c delete mode 100644 crypto/cast/c_ecb.c delete mode 100644 crypto/cast/c_enc.c delete mode 100644 crypto/cast/c_ofb64.c delete mode 100644 crypto/cast/c_skey.c delete mode 100644 crypto/cast/cast.h delete mode 100644 crypto/cast/cast_lcl.h delete mode 100644 crypto/cast/cast_s.h delete mode 100644 crypto/cast/cast_spd.c delete mode 100644 crypto/cast/castopts.c delete mode 100644 crypto/cast/casts.cpp delete mode 100644 crypto/cast/casttest.c delete mode 100644 crypto/comp/.cvsignore delete mode 100644 crypto/comp/Makefile.ssl delete mode 100644 crypto/comp/c_rle.c delete mode 100644 crypto/comp/c_zlib.c delete mode 100644 crypto/comp/comp.h delete mode 100644 crypto/comp/comp_err.c delete mode 100644 crypto/comp/comp_lib.c delete mode 100644 crypto/conf/.cvsignore delete mode 100644 crypto/conf/Makefile.ssl delete mode 100644 crypto/conf/cnf_save.c delete mode 100644 crypto/conf/conf.h delete mode 100644 crypto/conf/conf_api.c delete mode 100644 crypto/conf/conf_api.h delete mode 100644 crypto/conf/conf_def.c delete mode 100644 crypto/conf/conf_def.h delete mode 100644 crypto/conf/conf_err.c delete mode 100644 crypto/conf/conf_lib.c delete mode 100644 crypto/conf/keysets.pl delete mode 100644 crypto/conf/ssleay.cnf delete mode 100644 crypto/conf/test.c delete mode 100644 crypto/cpt_err.c delete mode 100644 crypto/cryptlib.c delete mode 100644 crypto/cryptlib.h delete mode 100644 crypto/crypto-lib.com delete mode 100644 crypto/crypto.h delete mode 100644 crypto/cversion.c delete mode 100644 crypto/des/.cvsignore delete mode 100644 crypto/des/COPYRIGHT delete mode 100644 crypto/des/DES.pm delete mode 100644 crypto/des/DES.xs delete mode 100644 crypto/des/FILES delete mode 100644 crypto/des/INSTALL delete mode 100644 crypto/des/Imakefile delete mode 100644 crypto/des/KERBEROS delete mode 100644 crypto/des/Makefile.ssl delete mode 100644 crypto/des/README delete mode 100644 crypto/des/VERSION delete mode 100644 crypto/des/asm/.cvsignore delete mode 100644 crypto/des/asm/crypt586.pl delete mode 100644 crypto/des/asm/des-586.pl delete mode 100644 crypto/des/asm/des686.pl delete mode 100644 crypto/des/asm/desboth.pl delete mode 100644 crypto/des/asm/readme delete mode 100644 crypto/des/cbc3_enc.c delete mode 100644 crypto/des/cbc_cksm.c delete mode 100644 crypto/des/cbc_enc.c delete mode 100644 crypto/des/cfb64ede.c delete mode 100644 crypto/des/cfb64enc.c delete mode 100644 crypto/des/cfb_enc.c delete mode 100644 crypto/des/des-lib.com delete mode 100644 crypto/des/des.c delete mode 100644 crypto/des/des.h delete mode 100644 crypto/des/des.pod delete mode 100644 crypto/des/des3s.cpp delete mode 100644 crypto/des/des_enc.c delete mode 100644 crypto/des/des_locl.h delete mode 100644 crypto/des/des_opts.c delete mode 100644 crypto/des/des_ver.h delete mode 100644 crypto/des/dess.cpp delete mode 100644 crypto/des/destest.c delete mode 100644 crypto/des/ecb3_enc.c delete mode 100644 crypto/des/ecb_enc.c delete mode 100644 crypto/des/ede_cbcm_enc.c delete mode 100644 crypto/des/enc_read.c delete mode 100644 crypto/des/enc_writ.c delete mode 100644 crypto/des/fcrypt.c delete mode 100644 crypto/des/fcrypt_b.c delete mode 100644 crypto/des/makefile.bc delete mode 100644 crypto/des/ncbc_enc.c delete mode 100644 crypto/des/ofb64ede.c delete mode 100644 crypto/des/ofb64enc.c delete mode 100644 crypto/des/ofb_enc.c delete mode 100644 crypto/des/options.txt delete mode 100644 crypto/des/pcbc_enc.c delete mode 100644 crypto/des/qud_cksm.c delete mode 100644 crypto/des/rand_key.c delete mode 100644 crypto/des/read2pwd.c delete mode 100644 crypto/des/read_pwd.c delete mode 100644 crypto/des/rpc_des.h delete mode 100644 crypto/des/rpc_enc.c delete mode 100644 crypto/des/rpw.c delete mode 100644 crypto/des/set_key.c delete mode 100644 crypto/des/speed.c delete mode 100644 crypto/des/spr.h delete mode 100644 crypto/des/str2key.c delete mode 100644 crypto/des/t/test delete mode 100644 crypto/des/times/486-50.sol delete mode 100644 crypto/des/times/586-100.lnx delete mode 100644 crypto/des/times/686-200.fre delete mode 100644 crypto/des/times/aix.cc delete mode 100644 crypto/des/times/alpha.cc delete mode 100644 crypto/des/times/hpux.cc delete mode 100644 crypto/des/times/sparc.gcc delete mode 100644 crypto/des/times/usparc.cc delete mode 100644 crypto/des/typemap delete mode 100644 crypto/des/xcbc_enc.c delete mode 100644 crypto/dh/.cvsignore delete mode 100644 crypto/dh/Makefile.ssl delete mode 100644 crypto/dh/dh.h delete mode 100644 crypto/dh/dh1024.pem delete mode 100644 crypto/dh/dh192.pem delete mode 100644 crypto/dh/dh2048.pem delete mode 100644 crypto/dh/dh4096.pem delete mode 100644 crypto/dh/dh512.pem delete mode 100644 crypto/dh/dh_check.c delete mode 100644 crypto/dh/dh_err.c delete mode 100644 crypto/dh/dh_gen.c delete mode 100644 crypto/dh/dh_key.c delete mode 100644 crypto/dh/dh_lib.c delete mode 100644 crypto/dh/dhtest.c delete mode 100644 crypto/dh/example delete mode 100644 crypto/dh/generate delete mode 100644 crypto/dh/p1024.c delete mode 100644 crypto/dh/p192.c delete mode 100644 crypto/dh/p512.c delete mode 100644 crypto/dsa/.cvsignore delete mode 100644 crypto/dsa/Makefile.ssl delete mode 100644 crypto/dsa/README delete mode 100644 crypto/dsa/dsa.h delete mode 100644 crypto/dsa/dsa_asn1.c delete mode 100644 crypto/dsa/dsa_err.c delete mode 100644 crypto/dsa/dsa_gen.c delete mode 100644 crypto/dsa/dsa_key.c delete mode 100644 crypto/dsa/dsa_lib.c delete mode 100644 crypto/dsa/dsa_ossl.c delete mode 100644 crypto/dsa/dsa_sign.c delete mode 100644 crypto/dsa/dsa_vrf.c delete mode 100644 crypto/dsa/dsagen.c delete mode 100644 crypto/dsa/dsatest.c delete mode 100644 crypto/dsa/fips186a.txt delete mode 100644 crypto/dso/.cvsignore delete mode 100644 crypto/dso/Makefile.ssl delete mode 100644 crypto/dso/README delete mode 100644 crypto/dso/dso.h delete mode 100644 crypto/dso/dso_dl.c delete mode 100644 crypto/dso/dso_dlfcn.c delete mode 100644 crypto/dso/dso_err.c delete mode 100644 crypto/dso/dso_lib.c delete mode 100644 crypto/dso/dso_null.c delete mode 100644 crypto/dso/dso_openssl.c delete mode 100644 crypto/dso/dso_vms.c delete mode 100644 crypto/dso/dso_win32.c delete mode 100644 crypto/ebcdic.c delete mode 100644 crypto/ebcdic.h delete mode 100644 crypto/engine/.cvsignore delete mode 100644 crypto/engine/Makefile.ssl delete mode 100644 crypto/engine/README delete mode 100644 crypto/engine/engine.h delete mode 100644 crypto/engine/engine_all.c delete mode 100644 crypto/engine/engine_err.c delete mode 100644 crypto/engine/engine_int.h delete mode 100644 crypto/engine/engine_lib.c delete mode 100644 crypto/engine/engine_list.c delete mode 100644 crypto/engine/engine_openssl.c delete mode 100644 crypto/engine/enginetest.c delete mode 100644 crypto/engine/hw_atalla.c delete mode 100644 crypto/engine/hw_cswift.c delete mode 100644 crypto/engine/hw_ncipher.c delete mode 100644 crypto/engine/hw_nuron.c delete mode 100644 crypto/engine/vendor_defns/atalla.h delete mode 100644 crypto/engine/vendor_defns/cswift.h delete mode 100644 crypto/engine/vendor_defns/hwcryptohook.h delete mode 100644 crypto/err/.cvsignore delete mode 100644 crypto/err/Makefile.ssl delete mode 100644 crypto/err/err.c delete mode 100644 crypto/err/err.h delete mode 100644 crypto/err/err_all.c delete mode 100644 crypto/err/err_prn.c delete mode 100644 crypto/err/openssl.ec delete mode 100644 crypto/evp/.cvsignore delete mode 100644 crypto/evp/Makefile.ssl delete mode 100644 crypto/evp/bio_b64.c delete mode 100644 crypto/evp/bio_enc.c delete mode 100644 crypto/evp/bio_md.c delete mode 100644 crypto/evp/bio_ok.c delete mode 100644 crypto/evp/c_all.c delete mode 100644 crypto/evp/c_allc.c delete mode 100644 crypto/evp/c_alld.c delete mode 100644 crypto/evp/digest.c delete mode 100644 crypto/evp/e_bf.c delete mode 100644 crypto/evp/e_cast.c delete mode 100644 crypto/evp/e_des.c delete mode 100644 crypto/evp/e_des3.c delete mode 100644 crypto/evp/e_dsa.c delete mode 100644 crypto/evp/e_idea.c delete mode 100644 crypto/evp/e_null.c delete mode 100644 crypto/evp/e_rc2.c delete mode 100644 crypto/evp/e_rc4.c delete mode 100644 crypto/evp/e_rc5.c delete mode 100644 crypto/evp/e_rd.c delete mode 100644 crypto/evp/e_xcbc_d.c delete mode 100644 crypto/evp/encode.c delete mode 100644 crypto/evp/evp.h delete mode 100644 crypto/evp/evp_enc.c delete mode 100644 crypto/evp/evp_err.c delete mode 100644 crypto/evp/evp_key.c delete mode 100644 crypto/evp/evp_lib.c delete mode 100644 crypto/evp/evp_locl.h delete mode 100644 crypto/evp/evp_pbe.c delete mode 100644 crypto/evp/evp_pkey.c delete mode 100644 crypto/evp/m_dss.c delete mode 100644 crypto/evp/m_dss1.c delete mode 100644 crypto/evp/m_md2.c delete mode 100644 crypto/evp/m_md4.c delete mode 100644 crypto/evp/m_md5.c delete mode 100644 crypto/evp/m_mdc2.c delete mode 100644 crypto/evp/m_null.c delete mode 100644 crypto/evp/m_ripemd.c delete mode 100644 crypto/evp/m_sha.c delete mode 100644 crypto/evp/m_sha1.c delete mode 100644 crypto/evp/names.c delete mode 100644 crypto/evp/p5_crpt.c delete mode 100644 crypto/evp/p5_crpt2.c delete mode 100644 crypto/evp/p_dec.c delete mode 100644 crypto/evp/p_enc.c delete mode 100644 crypto/evp/p_lib.c delete mode 100644 crypto/evp/p_open.c delete mode 100644 crypto/evp/p_seal.c delete mode 100644 crypto/evp/p_sign.c delete mode 100644 crypto/evp/p_verify.c delete mode 100644 crypto/ex_data.c delete mode 100644 crypto/hmac/.cvsignore delete mode 100644 crypto/hmac/Makefile.ssl delete mode 100644 crypto/hmac/hmac.c delete mode 100644 crypto/hmac/hmac.h delete mode 100644 crypto/hmac/hmactest.c delete mode 100644 crypto/idea/.cvsignore delete mode 100644 crypto/idea/Makefile.ssl delete mode 100644 crypto/idea/i_cbc.c delete mode 100644 crypto/idea/i_cfb64.c delete mode 100644 crypto/idea/i_ecb.c delete mode 100644 crypto/idea/i_ofb64.c delete mode 100644 crypto/idea/i_skey.c delete mode 100644 crypto/idea/idea.h delete mode 100644 crypto/idea/idea_lcl.h delete mode 100644 crypto/idea/idea_spd.c delete mode 100644 crypto/idea/ideatest.c delete mode 100644 crypto/idea/version delete mode 100644 crypto/install.com delete mode 100644 crypto/lhash/.cvsignore delete mode 100644 crypto/lhash/Makefile.ssl delete mode 100644 crypto/lhash/lh_stats.c delete mode 100644 crypto/lhash/lh_test.c delete mode 100644 crypto/lhash/lhash.c delete mode 100644 crypto/lhash/lhash.h delete mode 100644 crypto/lhash/num.pl delete mode 100644 crypto/md2/.cvsignore delete mode 100644 crypto/md2/Makefile.ssl delete mode 100644 crypto/md2/md2.c delete mode 100644 crypto/md2/md2.h delete mode 100644 crypto/md2/md2_dgst.c delete mode 100644 crypto/md2/md2_one.c delete mode 100644 crypto/md2/md2test.c delete mode 100644 crypto/md32_common.h delete mode 100644 crypto/md4/.cvsignore delete mode 100644 crypto/md4/Makefile.ssl delete mode 100644 crypto/md4/md4.c delete mode 100644 crypto/md4/md4.h delete mode 100644 crypto/md4/md4_dgst.c delete mode 100644 crypto/md4/md4_locl.h delete mode 100644 crypto/md4/md4_one.c delete mode 100644 crypto/md4/md4s.cpp delete mode 100644 crypto/md4/md4test.c delete mode 100644 crypto/md5/.cvsignore delete mode 100644 crypto/md5/Makefile.ssl delete mode 100644 crypto/md5/asm/.cvsignore delete mode 100644 crypto/md5/asm/md5-586.pl delete mode 100644 crypto/md5/asm/md5-sparcv9.S delete mode 100644 crypto/md5/md5.c delete mode 100644 crypto/md5/md5.h delete mode 100644 crypto/md5/md5_dgst.c delete mode 100644 crypto/md5/md5_locl.h delete mode 100644 crypto/md5/md5_one.c delete mode 100644 crypto/md5/md5s.cpp delete mode 100644 crypto/md5/md5test.c delete mode 100644 crypto/mdc2/.cvsignore delete mode 100644 crypto/mdc2/Makefile.ssl delete mode 100644 crypto/mdc2/mdc2.h delete mode 100644 crypto/mdc2/mdc2_one.c delete mode 100644 crypto/mdc2/mdc2dgst.c delete mode 100644 crypto/mdc2/mdc2test.c delete mode 100644 crypto/mem.c delete mode 100644 crypto/mem_dbg.c delete mode 100644 crypto/objects/.cvsignore delete mode 100644 crypto/objects/Makefile.ssl delete mode 100644 crypto/objects/o_names.c delete mode 100644 crypto/objects/obj_dat.c delete mode 100644 crypto/objects/obj_dat.h delete mode 100644 crypto/objects/obj_dat.pl delete mode 100644 crypto/objects/obj_err.c delete mode 100644 crypto/objects/obj_lib.c delete mode 100644 crypto/objects/obj_mac.h delete mode 100644 crypto/objects/obj_mac.num delete mode 100644 crypto/objects/objects.README delete mode 100644 crypto/objects/objects.h delete mode 100644 crypto/objects/objects.pl delete mode 100644 crypto/objects/objects.txt delete mode 100644 crypto/ocsp/Makefile.ssl delete mode 100644 crypto/ocsp/ocsp.h delete mode 100644 crypto/ocsp/ocsp_cid.c delete mode 100644 crypto/ocsp/ocsp_err.c delete mode 100644 crypto/ocsp/ocsp_ext.c delete mode 100644 crypto/ocsp/ocsp_lib.c delete mode 100644 crypto/ocsp/ocsp_req.c delete mode 100644 crypto/ocsp/ocsp_res.c delete mode 100644 crypto/ocsp/ocsp_sig.c delete mode 100644 crypto/opensslconf.h.in delete mode 100644 crypto/opensslv.h delete mode 100644 crypto/pem/.cvsignore delete mode 100644 crypto/pem/Makefile.ssl delete mode 100644 crypto/pem/message delete mode 100644 crypto/pem/pem.h delete mode 100644 crypto/pem/pem2.h delete mode 100644 crypto/pem/pem_all.c delete mode 100644 crypto/pem/pem_err.c delete mode 100644 crypto/pem/pem_info.c delete mode 100644 crypto/pem/pem_lib.c delete mode 100644 crypto/pem/pem_seal.c delete mode 100644 crypto/pem/pem_sign.c delete mode 100644 crypto/pem/pkcs7.lis delete mode 100644 crypto/perlasm/alpha.pl delete mode 100644 crypto/perlasm/cbc.pl delete mode 100644 crypto/perlasm/readme delete mode 100644 crypto/perlasm/x86asm.pl delete mode 100644 crypto/perlasm/x86ms.pl delete mode 100644 crypto/perlasm/x86nasm.pl delete mode 100644 crypto/perlasm/x86unix.pl delete mode 100644 crypto/pkcs12/.cvsignore delete mode 100644 crypto/pkcs12/Makefile.ssl delete mode 100644 crypto/pkcs12/p12_add.c delete mode 100644 crypto/pkcs12/p12_attr.c delete mode 100644 crypto/pkcs12/p12_bags.c delete mode 100644 crypto/pkcs12/p12_crpt.c delete mode 100644 crypto/pkcs12/p12_crt.c delete mode 100644 crypto/pkcs12/p12_decr.c delete mode 100644 crypto/pkcs12/p12_init.c delete mode 100644 crypto/pkcs12/p12_key.c delete mode 100644 crypto/pkcs12/p12_kiss.c delete mode 100644 crypto/pkcs12/p12_lib.c delete mode 100644 crypto/pkcs12/p12_mac.c delete mode 100644 crypto/pkcs12/p12_mutl.c delete mode 100644 crypto/pkcs12/p12_npas.c delete mode 100644 crypto/pkcs12/p12_sbag.c delete mode 100644 crypto/pkcs12/p12_utl.c delete mode 100644 crypto/pkcs12/pk12err.c delete mode 100644 crypto/pkcs12/pkcs12.h delete mode 100644 crypto/pkcs7/.cvsignore delete mode 100644 crypto/pkcs7/Makefile.ssl delete mode 100644 crypto/pkcs7/bio_ber.c delete mode 100644 crypto/pkcs7/dec.c delete mode 100644 crypto/pkcs7/des.pem delete mode 100644 crypto/pkcs7/doc delete mode 100644 crypto/pkcs7/enc.c delete mode 100644 crypto/pkcs7/es1.pem delete mode 100644 crypto/pkcs7/example.c delete mode 100644 crypto/pkcs7/example.h delete mode 100644 crypto/pkcs7/info.pem delete mode 100644 crypto/pkcs7/infokey.pem delete mode 100644 crypto/pkcs7/p7/a1 delete mode 100644 crypto/pkcs7/p7/a2 delete mode 100644 crypto/pkcs7/p7/cert.p7c delete mode 100644 crypto/pkcs7/p7/smime.p7m delete mode 100644 crypto/pkcs7/p7/smime.p7s delete mode 100644 crypto/pkcs7/pk7_attr.c delete mode 100644 crypto/pkcs7/pk7_dgst.c delete mode 100644 crypto/pkcs7/pk7_doit.c delete mode 100644 crypto/pkcs7/pk7_enc.c delete mode 100644 crypto/pkcs7/pk7_lib.c delete mode 100644 crypto/pkcs7/pk7_mime.c delete mode 100644 crypto/pkcs7/pk7_smime.c delete mode 100644 crypto/pkcs7/pkcs7.h delete mode 100644 crypto/pkcs7/pkcs7err.c delete mode 100644 crypto/pkcs7/server.pem delete mode 100644 crypto/pkcs7/sign.c delete mode 100644 crypto/pkcs7/t/3des.pem delete mode 100644 crypto/pkcs7/t/3dess.pem delete mode 100644 crypto/pkcs7/t/c.pem delete mode 100644 crypto/pkcs7/t/ff delete mode 100644 crypto/pkcs7/t/msie-e delete mode 100644 crypto/pkcs7/t/msie-e.pem delete mode 100644 crypto/pkcs7/t/msie-enc-01 delete mode 100644 crypto/pkcs7/t/msie-enc-01.pem delete mode 100644 crypto/pkcs7/t/msie-enc-02 delete mode 100644 crypto/pkcs7/t/msie-enc-02.pem delete mode 100644 crypto/pkcs7/t/msie-s-a-e delete mode 100644 crypto/pkcs7/t/msie-s-a-e.pem delete mode 100644 crypto/pkcs7/t/nav-smime delete mode 100644 crypto/pkcs7/t/s.pem delete mode 100644 crypto/pkcs7/t/server.pem delete mode 100644 crypto/pkcs7/verify.c delete mode 100644 crypto/rand/.cvsignore delete mode 100644 crypto/rand/Makefile.ssl delete mode 100644 crypto/rand/md_rand.c delete mode 100644 crypto/rand/rand.h delete mode 100644 crypto/rand/rand_egd.c delete mode 100644 crypto/rand/rand_err.c delete mode 100644 crypto/rand/rand_lcl.h delete mode 100644 crypto/rand/rand_lib.c delete mode 100644 crypto/rand/rand_win.c delete mode 100644 crypto/rand/randfile.c delete mode 100644 crypto/rand/randtest.c delete mode 100644 crypto/rc2/.cvsignore delete mode 100644 crypto/rc2/Makefile.ssl delete mode 100644 crypto/rc2/rc2.h delete mode 100644 crypto/rc2/rc2_cbc.c delete mode 100644 crypto/rc2/rc2_ecb.c delete mode 100644 crypto/rc2/rc2_locl.h delete mode 100644 crypto/rc2/rc2_skey.c delete mode 100644 crypto/rc2/rc2cfb64.c delete mode 100644 crypto/rc2/rc2ofb64.c delete mode 100644 crypto/rc2/rc2speed.c delete mode 100644 crypto/rc2/rc2test.c delete mode 100644 crypto/rc2/rrc2.doc delete mode 100644 crypto/rc2/tab.c delete mode 100644 crypto/rc2/version delete mode 100644 crypto/rc4/.cvsignore delete mode 100644 crypto/rc4/Makefile.ssl delete mode 100644 crypto/rc4/asm/.cvsignore delete mode 100644 crypto/rc4/asm/rc4-586.pl delete mode 100644 crypto/rc4/rc4.c delete mode 100644 crypto/rc4/rc4.h delete mode 100644 crypto/rc4/rc4_enc.c delete mode 100644 crypto/rc4/rc4_locl.h delete mode 100644 crypto/rc4/rc4_skey.c delete mode 100644 crypto/rc4/rc4s.cpp delete mode 100644 crypto/rc4/rc4speed.c delete mode 100644 crypto/rc4/rc4test.c delete mode 100644 crypto/rc4/rrc4.doc delete mode 100644 crypto/rc5/.cvsignore delete mode 100644 crypto/rc5/Makefile.ssl delete mode 100644 crypto/rc5/asm/.cvsignore delete mode 100644 crypto/rc5/asm/rc5-586.pl delete mode 100644 crypto/rc5/rc5.h delete mode 100644 crypto/rc5/rc5_ecb.c delete mode 100644 crypto/rc5/rc5_enc.c delete mode 100644 crypto/rc5/rc5_locl.h delete mode 100644 crypto/rc5/rc5_skey.c delete mode 100644 crypto/rc5/rc5cfb64.c delete mode 100644 crypto/rc5/rc5ofb64.c delete mode 100644 crypto/rc5/rc5s.cpp delete mode 100644 crypto/rc5/rc5speed.c delete mode 100644 crypto/rc5/rc5test.c delete mode 100644 crypto/rijndael/Makefile.ssl delete mode 100755 crypto/rijndael/README delete mode 100644 crypto/rijndael/boxes-fst-corrected.dat delete mode 100755 crypto/rijndael/rijndael-alg-fst.c delete mode 100755 crypto/rijndael/rijndael-alg-fst.h delete mode 100644 crypto/rijndael/rijndael.h delete mode 100644 crypto/ripemd/.cvsignore delete mode 100644 crypto/ripemd/Makefile.ssl delete mode 100644 crypto/ripemd/README delete mode 100644 crypto/ripemd/asm/.cvsignore delete mode 100644 crypto/ripemd/asm/rips.cpp delete mode 100644 crypto/ripemd/asm/rmd-586.pl delete mode 100644 crypto/ripemd/ripemd.h delete mode 100644 crypto/ripemd/rmd160.c delete mode 100644 crypto/ripemd/rmd_dgst.c delete mode 100644 crypto/ripemd/rmd_locl.h delete mode 100644 crypto/ripemd/rmd_one.c delete mode 100644 crypto/ripemd/rmdconst.h delete mode 100644 crypto/ripemd/rmdtest.c delete mode 100644 crypto/rsa/.cvsignore delete mode 100644 crypto/rsa/Makefile.ssl delete mode 100644 crypto/rsa/rsa.h delete mode 100644 crypto/rsa/rsa_chk.c delete mode 100644 crypto/rsa/rsa_eay.c delete mode 100644 crypto/rsa/rsa_err.c delete mode 100644 crypto/rsa/rsa_gen.c delete mode 100644 crypto/rsa/rsa_lib.c delete mode 100644 crypto/rsa/rsa_none.c delete mode 100644 crypto/rsa/rsa_null.c delete mode 100644 crypto/rsa/rsa_oaep.c delete mode 100644 crypto/rsa/rsa_pk1.c delete mode 100644 crypto/rsa/rsa_saos.c delete mode 100644 crypto/rsa/rsa_sign.c delete mode 100644 crypto/rsa/rsa_ssl.c delete mode 100644 crypto/rsa/rsa_test.c delete mode 100644 crypto/sha/.cvsignore delete mode 100644 crypto/sha/Makefile.ssl delete mode 100644 crypto/sha/asm/.cvsignore delete mode 100644 crypto/sha/asm/README delete mode 100644 crypto/sha/asm/sha1-586.pl delete mode 100644 crypto/sha/sha.c delete mode 100644 crypto/sha/sha.h delete mode 100644 crypto/sha/sha1.c delete mode 100644 crypto/sha/sha1_one.c delete mode 100644 crypto/sha/sha1dgst.c delete mode 100644 crypto/sha/sha1s.cpp delete mode 100644 crypto/sha/sha1test.c delete mode 100644 crypto/sha/sha_dgst.c delete mode 100644 crypto/sha/sha_locl.h delete mode 100644 crypto/sha/sha_one.c delete mode 100644 crypto/sha/shatest.c delete mode 100644 crypto/stack/.cvsignore delete mode 100644 crypto/stack/Makefile.ssl delete mode 100644 crypto/stack/safestack.h delete mode 100644 crypto/stack/stack.c delete mode 100644 crypto/stack/stack.h delete mode 100644 crypto/symhacks.h delete mode 100644 crypto/threads/README delete mode 100644 crypto/threads/mttest.c delete mode 100644 crypto/threads/profile.sh delete mode 100755 crypto/threads/ptest.bat delete mode 100644 crypto/threads/pthread.sh delete mode 100755 crypto/threads/pthread2.sh delete mode 100644 crypto/threads/pthreads-vms.com delete mode 100644 crypto/threads/purify.sh delete mode 100644 crypto/threads/solaris.sh delete mode 100644 crypto/threads/th-lock.c delete mode 100755 crypto/threads/win32.bat delete mode 100644 crypto/tmdiff.c delete mode 100644 crypto/tmdiff.h delete mode 100644 crypto/txt_db/.cvsignore delete mode 100644 crypto/txt_db/Makefile.ssl delete mode 100644 crypto/txt_db/txt_db.c delete mode 100644 crypto/txt_db/txt_db.h delete mode 100644 crypto/x509/.cvsignore delete mode 100644 crypto/x509/Makefile.ssl delete mode 100644 crypto/x509/by_dir.c delete mode 100644 crypto/x509/by_file.c delete mode 100644 crypto/x509/x509.h delete mode 100644 crypto/x509/x509_att.c delete mode 100644 crypto/x509/x509_cmp.c delete mode 100644 crypto/x509/x509_d2.c delete mode 100644 crypto/x509/x509_def.c delete mode 100644 crypto/x509/x509_err.c delete mode 100644 crypto/x509/x509_ext.c delete mode 100644 crypto/x509/x509_lu.c delete mode 100644 crypto/x509/x509_obj.c delete mode 100644 crypto/x509/x509_r2x.c delete mode 100644 crypto/x509/x509_req.c delete mode 100644 crypto/x509/x509_set.c delete mode 100644 crypto/x509/x509_trs.c delete mode 100644 crypto/x509/x509_txt.c delete mode 100644 crypto/x509/x509_v3.c delete mode 100644 crypto/x509/x509_vfy.c delete mode 100644 crypto/x509/x509_vfy.h delete mode 100644 crypto/x509/x509name.c delete mode 100644 crypto/x509/x509rset.c delete mode 100644 crypto/x509/x509spki.c delete mode 100644 crypto/x509/x509type.c delete mode 100644 crypto/x509/x_all.c delete mode 100644 crypto/x509v3/.cvsignore delete mode 100644 crypto/x509v3/Makefile.ssl delete mode 100644 crypto/x509v3/ext_dat.h delete mode 100644 crypto/x509v3/tabtest.c delete mode 100644 crypto/x509v3/v3_akey.c delete mode 100644 crypto/x509v3/v3_alt.c delete mode 100644 crypto/x509v3/v3_bcons.c delete mode 100644 crypto/x509v3/v3_bitst.c delete mode 100644 crypto/x509v3/v3_conf.c delete mode 100644 crypto/x509v3/v3_cpols.c delete mode 100644 crypto/x509v3/v3_crld.c delete mode 100644 crypto/x509v3/v3_enum.c delete mode 100644 crypto/x509v3/v3_extku.c delete mode 100644 crypto/x509v3/v3_genn.c delete mode 100644 crypto/x509v3/v3_ia5.c delete mode 100644 crypto/x509v3/v3_info.c delete mode 100644 crypto/x509v3/v3_int.c delete mode 100644 crypto/x509v3/v3_lib.c delete mode 100644 crypto/x509v3/v3_pku.c delete mode 100644 crypto/x509v3/v3_prn.c delete mode 100644 crypto/x509v3/v3_purp.c delete mode 100644 crypto/x509v3/v3_skey.c delete mode 100644 crypto/x509v3/v3_sxnet.c delete mode 100644 crypto/x509v3/v3_utl.c delete mode 100644 crypto/x509v3/v3conf.c delete mode 100644 crypto/x509v3/v3err.c delete mode 100644 crypto/x509v3/v3prin.c delete mode 100644 crypto/x509v3/x509v3.h delete mode 100644 demos/README delete mode 100644 demos/b64.c delete mode 100644 demos/b64.pl delete mode 100644 demos/bio/Makefile delete mode 100644 demos/bio/README delete mode 100644 demos/bio/saccept.c delete mode 100644 demos/bio/sconnect.c delete mode 100644 demos/bio/server.pem delete mode 100644 demos/eay/Makefile delete mode 100644 demos/eay/base64.c delete mode 100644 demos/eay/conn.c delete mode 100644 demos/eay/loadrsa.c delete mode 100644 demos/maurice/Makefile delete mode 100644 demos/maurice/README delete mode 100644 demos/maurice/cert.pem delete mode 100644 demos/maurice/example1.c delete mode 100644 demos/maurice/example2.c delete mode 100644 demos/maurice/example3.c delete mode 100644 demos/maurice/example4.c delete mode 100644 demos/maurice/loadkeys.c delete mode 100644 demos/maurice/loadkeys.h delete mode 100644 demos/maurice/privkey.pem delete mode 100644 demos/pkcs12/README delete mode 100644 demos/pkcs12/pkread.c delete mode 100644 demos/pkcs12/pkwrite.c delete mode 100644 demos/prime/Makefile delete mode 100644 demos/prime/prime.c delete mode 100644 demos/privkey.pem delete mode 100644 demos/selfsign.c delete mode 100644 demos/sign/Makefile delete mode 100644 demos/sign/cert.pem delete mode 100644 demos/sign/key.pem delete mode 100644 demos/sign/sig.txt delete mode 100644 demos/sign/sign.c delete mode 100644 demos/sign/sign.txt delete mode 100644 demos/spkigen.c delete mode 100644 demos/ssl/cli.cpp delete mode 100644 demos/ssl/inetdsrv.cpp delete mode 100644 demos/ssl/serv.cpp delete mode 100644 demos/state_machine/.cvsignore delete mode 100644 demos/state_machine/Makefile delete mode 100644 demos/state_machine/state_machine.c delete mode 100644 demos/tunala/A-client.pem delete mode 100644 demos/tunala/A-server.pem delete mode 100644 demos/tunala/CA.pem delete mode 100644 demos/tunala/Makefile delete mode 100644 demos/tunala/README delete mode 100644 demos/tunala/buffer.c delete mode 100644 demos/tunala/ip.c delete mode 100644 demos/tunala/sm.c delete mode 100644 demos/tunala/tunala.c delete mode 100644 demos/tunala/tunala.h delete mode 100644 doc/README delete mode 100644 doc/apps/CA.pl.pod delete mode 100644 doc/apps/asn1parse.pod delete mode 100644 doc/apps/ca.pod delete mode 100644 doc/apps/ciphers.pod delete mode 100644 doc/apps/config.pod delete mode 100644 doc/apps/crl.pod delete mode 100644 doc/apps/crl2pkcs7.pod delete mode 100644 doc/apps/dgst.pod delete mode 100644 doc/apps/dhparam.pod delete mode 100644 doc/apps/dsa.pod delete mode 100644 doc/apps/dsaparam.pod delete mode 100644 doc/apps/enc.pod delete mode 100644 doc/apps/gendsa.pod delete mode 100644 doc/apps/genrsa.pod delete mode 100644 doc/apps/nseq.pod delete mode 100644 doc/apps/openssl.pod delete mode 100644 doc/apps/passwd.pod delete mode 100644 doc/apps/pkcs12.pod delete mode 100644 doc/apps/pkcs7.pod delete mode 100644 doc/apps/pkcs8.pod delete mode 100644 doc/apps/rand.pod delete mode 100644 doc/apps/req.pod delete mode 100644 doc/apps/rsa.pod delete mode 100644 doc/apps/rsautl.pod delete mode 100644 doc/apps/s_client.pod delete mode 100644 doc/apps/s_server.pod delete mode 100644 doc/apps/sess_id.pod delete mode 100644 doc/apps/smime.pod delete mode 100644 doc/apps/speed.pod delete mode 100644 doc/apps/spkac.pod delete mode 100644 doc/apps/verify.pod delete mode 100644 doc/apps/version.pod delete mode 100644 doc/apps/x509.pod delete mode 100644 doc/c-indentation.el delete mode 100644 doc/crypto/BIO_ctrl.pod delete mode 100644 doc/crypto/BIO_f_base64.pod delete mode 100644 doc/crypto/BIO_f_buffer.pod delete mode 100644 doc/crypto/BIO_f_cipher.pod delete mode 100644 doc/crypto/BIO_f_md.pod delete mode 100644 doc/crypto/BIO_f_null.pod delete mode 100644 doc/crypto/BIO_f_ssl.pod delete mode 100644 doc/crypto/BIO_find_type.pod delete mode 100644 doc/crypto/BIO_new.pod delete mode 100644 doc/crypto/BIO_new_bio_pair.pod delete mode 100644 doc/crypto/BIO_push.pod delete mode 100644 doc/crypto/BIO_read.pod delete mode 100644 doc/crypto/BIO_s_accept.pod delete mode 100644 doc/crypto/BIO_s_bio.pod delete mode 100644 doc/crypto/BIO_s_connect.pod delete mode 100644 doc/crypto/BIO_s_fd.pod delete mode 100644 doc/crypto/BIO_s_file.pod delete mode 100644 doc/crypto/BIO_s_mem.pod delete mode 100644 doc/crypto/BIO_s_null.pod delete mode 100644 doc/crypto/BIO_s_socket.pod delete mode 100644 doc/crypto/BIO_set_callback.pod delete mode 100644 doc/crypto/BIO_should_retry.pod delete mode 100644 doc/crypto/BN_CTX_new.pod delete mode 100644 doc/crypto/BN_CTX_start.pod delete mode 100644 doc/crypto/BN_add.pod delete mode 100644 doc/crypto/BN_add_word.pod delete mode 100644 doc/crypto/BN_bn2bin.pod delete mode 100644 doc/crypto/BN_cmp.pod delete mode 100644 doc/crypto/BN_copy.pod delete mode 100644 doc/crypto/BN_generate_prime.pod delete mode 100644 doc/crypto/BN_mod_inverse.pod delete mode 100644 doc/crypto/BN_mod_mul_montgomery.pod delete mode 100644 doc/crypto/BN_mod_mul_reciprocal.pod delete mode 100644 doc/crypto/BN_new.pod delete mode 100644 doc/crypto/BN_num_bytes.pod delete mode 100644 doc/crypto/BN_rand.pod delete mode 100644 doc/crypto/BN_set_bit.pod delete mode 100644 doc/crypto/BN_zero.pod delete mode 100644 doc/crypto/CRYPTO_set_ex_data.pod delete mode 100644 doc/crypto/DH_generate_key.pod delete mode 100644 doc/crypto/DH_generate_parameters.pod delete mode 100644 doc/crypto/DH_get_ex_new_index.pod delete mode 100644 doc/crypto/DH_new.pod delete mode 100644 doc/crypto/DH_set_method.pod delete mode 100644 doc/crypto/DH_size.pod delete mode 100644 doc/crypto/DSA_SIG_new.pod delete mode 100644 doc/crypto/DSA_do_sign.pod delete mode 100644 doc/crypto/DSA_dup_DH.pod delete mode 100644 doc/crypto/DSA_generate_key.pod delete mode 100644 doc/crypto/DSA_generate_parameters.pod delete mode 100644 doc/crypto/DSA_get_ex_new_index.pod delete mode 100644 doc/crypto/DSA_new.pod delete mode 100644 doc/crypto/DSA_set_method.pod delete mode 100644 doc/crypto/DSA_sign.pod delete mode 100644 doc/crypto/DSA_size.pod delete mode 100644 doc/crypto/ERR_GET_LIB.pod delete mode 100644 doc/crypto/ERR_clear_error.pod delete mode 100644 doc/crypto/ERR_error_string.pod delete mode 100644 doc/crypto/ERR_get_error.pod delete mode 100644 doc/crypto/ERR_load_crypto_strings.pod delete mode 100644 doc/crypto/ERR_load_strings.pod delete mode 100644 doc/crypto/ERR_print_errors.pod delete mode 100644 doc/crypto/ERR_put_error.pod delete mode 100644 doc/crypto/ERR_remove_state.pod delete mode 100644 doc/crypto/EVP_DigestInit.pod delete mode 100644 doc/crypto/EVP_EncryptInit.pod delete mode 100644 doc/crypto/EVP_OpenInit.pod delete mode 100644 doc/crypto/EVP_SealInit.pod delete mode 100644 doc/crypto/EVP_SignInit.pod delete mode 100644 doc/crypto/EVP_VerifyInit.pod delete mode 100644 doc/crypto/OPENSSL_VERSION_NUMBER.pod delete mode 100644 doc/crypto/OpenSSL_add_all_algorithms.pod delete mode 100644 doc/crypto/RAND_add.pod delete mode 100644 doc/crypto/RAND_bytes.pod delete mode 100644 doc/crypto/RAND_cleanup.pod delete mode 100644 doc/crypto/RAND_egd.pod delete mode 100644 doc/crypto/RAND_load_file.pod delete mode 100644 doc/crypto/RAND_set_rand_method.pod delete mode 100644 doc/crypto/RSA_blinding_on.pod delete mode 100644 doc/crypto/RSA_check_key.pod delete mode 100644 doc/crypto/RSA_generate_key.pod delete mode 100644 doc/crypto/RSA_get_ex_new_index.pod delete mode 100644 doc/crypto/RSA_new.pod delete mode 100644 doc/crypto/RSA_padding_add_PKCS1_type_1.pod delete mode 100644 doc/crypto/RSA_print.pod delete mode 100644 doc/crypto/RSA_private_encrypt.pod delete mode 100644 doc/crypto/RSA_public_encrypt.pod delete mode 100644 doc/crypto/RSA_set_method.pod delete mode 100644 doc/crypto/RSA_sign.pod delete mode 100644 doc/crypto/RSA_sign_ASN1_OCTET_STRING.pod delete mode 100644 doc/crypto/RSA_size.pod delete mode 100644 doc/crypto/bio.pod delete mode 100644 doc/crypto/blowfish.pod delete mode 100644 doc/crypto/bn.pod delete mode 100644 doc/crypto/bn_internal.pod delete mode 100644 doc/crypto/buffer.pod delete mode 100644 doc/crypto/crypto.pod delete mode 100644 doc/crypto/d2i_DHparams.pod delete mode 100644 doc/crypto/d2i_RSAPublicKey.pod delete mode 100644 doc/crypto/des.pod delete mode 100644 doc/crypto/des_modes.pod delete mode 100644 doc/crypto/dh.pod delete mode 100644 doc/crypto/dsa.pod delete mode 100644 doc/crypto/err.pod delete mode 100644 doc/crypto/evp.pod delete mode 100644 doc/crypto/hmac.pod delete mode 100644 doc/crypto/lh_stats.pod delete mode 100644 doc/crypto/lhash.pod delete mode 100644 doc/crypto/md5.pod delete mode 100644 doc/crypto/mdc2.pod delete mode 100644 doc/crypto/rand.pod delete mode 100644 doc/crypto/rc4.pod delete mode 100644 doc/crypto/ripemd.pod delete mode 100644 doc/crypto/rsa.pod delete mode 100644 doc/crypto/sha.pod delete mode 100644 doc/crypto/threads.pod delete mode 100644 doc/openssl.txt delete mode 100644 doc/openssl_button.gif delete mode 100644 doc/openssl_button.html delete mode 100644 doc/ssl/SSL_CIPHER_get_name.pod delete mode 100644 doc/ssl/SSL_CTX_free.pod delete mode 100644 doc/ssl/SSL_CTX_get_verify_mode.pod delete mode 100644 doc/ssl/SSL_CTX_load_verify_locations.pod delete mode 100644 doc/ssl/SSL_CTX_new.pod delete mode 100644 doc/ssl/SSL_CTX_set_cipher_list.pod delete mode 100644 doc/ssl/SSL_CTX_set_client_CA_list.pod delete mode 100644 doc/ssl/SSL_CTX_set_ssl_version.pod delete mode 100644 doc/ssl/SSL_CTX_set_verify.pod delete mode 100644 doc/ssl/SSL_SESSION_free.pod delete mode 100644 doc/ssl/SSL_accept.pod delete mode 100644 doc/ssl/SSL_clear.pod delete mode 100644 doc/ssl/SSL_connect.pod delete mode 100644 doc/ssl/SSL_free.pod delete mode 100644 doc/ssl/SSL_get_ciphers.pod delete mode 100644 doc/ssl/SSL_get_client_CA_list.pod delete mode 100644 doc/ssl/SSL_get_current_cipher.pod delete mode 100644 doc/ssl/SSL_get_error.pod delete mode 100644 doc/ssl/SSL_get_fd.pod delete mode 100644 doc/ssl/SSL_get_peer_cert_chain.pod delete mode 100644 doc/ssl/SSL_get_peer_certificate.pod delete mode 100644 doc/ssl/SSL_get_rbio.pod delete mode 100644 doc/ssl/SSL_get_session.pod delete mode 100644 doc/ssl/SSL_get_verify_result.pod delete mode 100644 doc/ssl/SSL_library_init.pod delete mode 100644 doc/ssl/SSL_load_client_CA_file.pod delete mode 100644 doc/ssl/SSL_new.pod delete mode 100644 doc/ssl/SSL_pending.pod delete mode 100644 doc/ssl/SSL_read.pod delete mode 100644 doc/ssl/SSL_set_bio.pod delete mode 100644 doc/ssl/SSL_set_fd.pod delete mode 100644 doc/ssl/SSL_set_session.pod delete mode 100644 doc/ssl/SSL_set_verify_result.pod delete mode 100644 doc/ssl/SSL_shutdown.pod delete mode 100644 doc/ssl/SSL_write.pod delete mode 100644 doc/ssl/ssl.pod delete mode 100644 doc/ssleay.txt delete mode 100644 doc/standards.txt delete mode 100644 e_os.h delete mode 100644 e_os2.h delete mode 100644 include/.cvsignore delete mode 100644 install.com delete mode 100755 makevms.com delete mode 100644 ms/.cvsignore delete mode 100644 ms/.rnd delete mode 100755 ms/16all.bat delete mode 100755 ms/32all.bat delete mode 100644 ms/README delete mode 100755 ms/bcb4.bat delete mode 100644 ms/certCA.srl delete mode 100644 ms/certCA.ss delete mode 100644 ms/certU.ss delete mode 100755 ms/cipher.out delete mode 100755 ms/clear.out delete mode 100644 ms/cmp.pl delete mode 100755 ms/do_masm.bat delete mode 100755 ms/do_ms.bat delete mode 100755 ms/do_nasm.bat delete mode 100755 ms/do_nt.bat delete mode 100644 ms/keyCA.ss delete mode 100644 ms/keyU.ss delete mode 100644 ms/mingw32.bat delete mode 100644 ms/mw.bat delete mode 100644 ms/req2CA.ss delete mode 100644 ms/reqCA.ss delete mode 100644 ms/reqU.ss delete mode 100755 ms/speed16.bat delete mode 100755 ms/speed32.bat delete mode 100755 ms/tenc.bat delete mode 100755 ms/test.bat delete mode 100755 ms/testenc.bat delete mode 100755 ms/testpem.bat delete mode 100755 ms/testss.bat delete mode 100644 ms/tlhelp32.h delete mode 100755 ms/tpem.bat delete mode 100755 ms/x86asm.bat delete mode 100644 openssl.doxy delete mode 100644 openssl.spec delete mode 100644 perl/.cvsignore delete mode 100644 perl/MANIFEST delete mode 100644 perl/Makefile.PL delete mode 100644 perl/OpenSSL.pm delete mode 100644 perl/OpenSSL.xs delete mode 100644 perl/README.1ST delete mode 100644 perl/openssl.h delete mode 100644 perl/openssl_bio.xs delete mode 100644 perl/openssl_bn.xs delete mode 100644 perl/openssl_cipher.xs delete mode 100644 perl/openssl_digest.xs delete mode 100644 perl/openssl_err.xs delete mode 100644 perl/openssl_ssl.xs delete mode 100644 perl/openssl_x509.xs delete mode 100644 perl/t/01-use.t delete mode 100644 perl/t/02-version.t delete mode 100644 perl/t/03-bio.t delete mode 100644 perl/typemap delete mode 100644 rsaref/.cvsignore delete mode 100644 shlib/Makefile.hpux10-cc delete mode 100644 shlib/README delete mode 100644 shlib/hpux10-cc.sh delete mode 100644 shlib/irix.sh delete mode 100755 shlib/solaris-sc4.sh delete mode 100644 shlib/solaris.sh delete mode 100644 shlib/sun.sh delete mode 100755 shlib/win32.bat delete mode 100755 shlib/win32dll.bat delete mode 100644 ssl/.cvsignore delete mode 100644 ssl/Makefile.ssl delete mode 100644 ssl/bio_ssl.c delete mode 100644 ssl/install.com delete mode 100644 ssl/s23_clnt.c delete mode 100644 ssl/s23_lib.c delete mode 100644 ssl/s23_meth.c delete mode 100644 ssl/s23_pkt.c delete mode 100644 ssl/s23_srvr.c delete mode 100644 ssl/s2_clnt.c delete mode 100644 ssl/s2_enc.c delete mode 100644 ssl/s2_lib.c delete mode 100644 ssl/s2_meth.c delete mode 100644 ssl/s2_pkt.c delete mode 100644 ssl/s2_srvr.c delete mode 100644 ssl/s3_both.c delete mode 100644 ssl/s3_clnt.c delete mode 100644 ssl/s3_enc.c delete mode 100644 ssl/s3_lib.c delete mode 100644 ssl/s3_meth.c delete mode 100644 ssl/s3_pkt.c delete mode 100644 ssl/s3_srvr.c delete mode 100644 ssl/ssl-lib.com delete mode 100644 ssl/ssl.h delete mode 100644 ssl/ssl2.h delete mode 100644 ssl/ssl23.h delete mode 100644 ssl/ssl3.h delete mode 100644 ssl/ssl_algs.c delete mode 100644 ssl/ssl_asn1.c delete mode 100644 ssl/ssl_cert.c delete mode 100644 ssl/ssl_ciph.c delete mode 100644 ssl/ssl_err.c delete mode 100644 ssl/ssl_err2.c delete mode 100644 ssl/ssl_lib.c delete mode 100644 ssl/ssl_locl.h delete mode 100644 ssl/ssl_rsa.c delete mode 100644 ssl/ssl_sess.c delete mode 100644 ssl/ssl_stat.c delete mode 100644 ssl/ssl_task.c delete mode 100644 ssl/ssl_txt.c delete mode 100644 ssl/ssltest.c delete mode 100644 ssl/t1_clnt.c delete mode 100644 ssl/t1_enc.c delete mode 100644 ssl/t1_lib.c delete mode 100644 ssl/t1_meth.c delete mode 100644 ssl/t1_srvr.c delete mode 100644 ssl/tls1.h delete mode 100644 test/.cvsignore delete mode 100644 test/CAss.cnf delete mode 100644 test/CAssdh.cnf delete mode 100644 test/CAssdsa.cnf delete mode 100644 test/CAssrsa.cnf delete mode 100644 test/Makefile.ssl delete mode 100644 test/Sssdsa.cnf delete mode 100644 test/Sssrsa.cnf delete mode 100644 test/Uss.cnf delete mode 100644 test/VMSca-response.1 delete mode 100644 test/VMSca-response.2 delete mode 100644 test/maketests.com delete mode 100644 test/methtest.c delete mode 100644 test/pkcs7-1.pem delete mode 100644 test/pkcs7.pem delete mode 100644 test/r160test.c delete mode 100644 test/tcrl delete mode 100644 test/tcrl.com delete mode 100644 test/test.cnf delete mode 100644 test/testca delete mode 100644 test/testca.com delete mode 100644 test/testcrl.pem delete mode 100644 test/testenc delete mode 100644 test/testenc.com delete mode 100644 test/testgen delete mode 100644 test/testgen.com delete mode 100644 test/testp7.pem delete mode 100644 test/testreq2.pem delete mode 100644 test/testrsa.pem delete mode 100644 test/tests.com delete mode 100644 test/testsid.pem delete mode 100644 test/testss delete mode 100644 test/testss.com delete mode 100644 test/testssl delete mode 100644 test/testssl.com delete mode 100644 test/testx509.pem delete mode 100644 test/times delete mode 100644 test/tpkcs7 delete mode 100644 test/tpkcs7.com delete mode 100644 test/tpkcs7d delete mode 100644 test/tpkcs7d.com delete mode 100644 test/treq delete mode 100644 test/treq.com delete mode 100644 test/trsa delete mode 100644 test/trsa.com delete mode 100644 test/tsid delete mode 100644 test/tsid.com delete mode 100644 test/tverify.com delete mode 100644 test/tx509 delete mode 100644 test/tx509.com delete mode 100644 test/v3-cert1.pem delete mode 100644 test/v3-cert2.pem delete mode 100644 times/090/586-100.nt delete mode 100644 times/091/486-50.nt delete mode 100644 times/091/586-100.lnx delete mode 100644 times/091/68000.bsd delete mode 100644 times/091/686-200.lnx delete mode 100644 times/091/alpha064.osf delete mode 100644 times/091/alpha164.lnx delete mode 100644 times/091/alpha164.osf delete mode 100644 times/091/mips-rel.pl delete mode 100644 times/091/r10000.irx delete mode 100644 times/091/r3000.ult delete mode 100644 times/091/r4400.irx delete mode 100644 times/100.lnx delete mode 100644 times/100.nt delete mode 100644 times/200.lnx delete mode 100644 times/486-66.dos delete mode 100644 times/486-66.nt delete mode 100644 times/486-66.w31 delete mode 100644 times/5.lnx delete mode 100644 times/586-085i.nt delete mode 100644 times/586-100.LN3 delete mode 100644 times/586-100.NT2 delete mode 100644 times/586-100.dos delete mode 100644 times/586-100.ln4 delete mode 100644 times/586-100.lnx delete mode 100644 times/586-100.nt delete mode 100644 times/586-100.ntx delete mode 100644 times/586-100.w31 delete mode 100644 times/586-1002.lnx delete mode 100644 times/586p-100.lnx delete mode 100644 times/686-200.bsd delete mode 100644 times/686-200.lnx delete mode 100644 times/686-200.nt delete mode 100644 times/L1 delete mode 100644 times/R10000.t delete mode 100644 times/R4400.t delete mode 100644 times/aix.t delete mode 100644 times/aixold.t delete mode 100644 times/alpha.t delete mode 100644 times/alpha400.t delete mode 100644 times/cyrix100.lnx delete mode 100644 times/dgux-x86.t delete mode 100644 times/dgux.t delete mode 100644 times/hpux-acc.t delete mode 100644 times/hpux-kr.t delete mode 100644 times/hpux.t delete mode 100644 times/p2.w95 delete mode 100644 times/pent2.t delete mode 100644 times/readme delete mode 100644 times/s586-100.lnx delete mode 100644 times/s586-100.nt delete mode 100644 times/sgi.t delete mode 100644 times/sparc.t delete mode 100644 times/sparc2 delete mode 100644 times/sparcLX.t delete mode 100644 times/usparc.t delete mode 100644 times/x86/bfs.cpp delete mode 100644 times/x86/casts.cpp delete mode 100644 times/x86/des3s.cpp delete mode 100644 times/x86/dess.cpp delete mode 100644 times/x86/md4s.cpp delete mode 100644 times/x86/md5s.cpp delete mode 100644 times/x86/rc4s.cpp delete mode 100644 times/x86/sha1s.cpp delete mode 100644 tools/.cvsignore delete mode 100644 tools/Makefile.ssl delete mode 100644 tools/c_hash delete mode 100644 tools/c_info delete mode 100644 tools/c_issuer delete mode 100644 tools/c_name delete mode 100644 tools/c_rehash.in delete mode 100755 util/FreeBSD.sh delete mode 100755 util/add_cr.pl delete mode 100755 util/bat.sh delete mode 100755 util/ck_errf.pl delete mode 100755 util/clean-depend.pl delete mode 100755 util/deleof.pl delete mode 100755 util/do_ms.sh delete mode 100755 util/domd delete mode 100755 util/err-ins.pl delete mode 100755 util/files.pl delete mode 100755 util/fixNT.sh delete mode 100755 util/install.sh delete mode 100755 util/libeay.num delete mode 100755 util/mk1mf.pl delete mode 100755 util/mkcerts.sh delete mode 100755 util/mkdef.pl delete mode 100755 util/mkdir-p.pl delete mode 100644 util/mkerr.pl delete mode 100755 util/mkfiles.pl delete mode 100755 util/mklink.pl delete mode 100755 util/mkstack.pl delete mode 100755 util/perlpath.pl delete mode 100644 util/pl/BC-16.pl delete mode 100644 util/pl/BC-32.pl delete mode 100644 util/pl/Mingw32.pl delete mode 100644 util/pl/Mingw32f.pl delete mode 100644 util/pl/VC-16.pl delete mode 100644 util/pl/VC-32.pl delete mode 100644 util/pl/linux.pl delete mode 100644 util/pl/ultrix.pl delete mode 100644 util/pl/unix.pl delete mode 100755 util/pod2man.pl delete mode 100755 util/point.sh delete mode 100644 util/selftest.pl delete mode 100755 util/sp-diff.pl delete mode 100755 util/speed.sh delete mode 100755 util/src-dep.pl delete mode 100755 util/ssleay.num delete mode 100755 util/tab_num.pl delete mode 100755 util/x86asm.sh diff --git a/.cvsignore b/.cvsignore deleted file mode 100644 index 8ff9fdc915..0000000000 --- a/.cvsignore +++ /dev/null @@ -1,15 +0,0 @@ -Makefile.ssl -MINFO -makefile.one -tmp -out -outinc -rehash.time -testlog -make.log -maketest.log -cctest -cctest.c -cctest.a -libcrypto.so.* -libssl.so.* diff --git a/CHANGES b/CHANGES deleted file mode 100644 index 8e53374d03..0000000000 --- a/CHANGES +++ /dev/null @@ -1,3691 +0,0 @@ - - OpenSSL CHANGES - _______________ - - Changes between 0.9.6 and 0.9.7 [xx XXX 2000] - - *) Make DSO load along a path given through an environment variable - (SHLIB_PATH) with shl_load(). - [Richard Levitte] - - *) Constify the ENGINE code as a result of BIGNUM constification. - Also constify the RSA code and most things related to it. In a - few places, most notable in the depth of the ASN.1 code, ugly - casts back to non-const were required (to be solved at a later - time) - [Richard Levitte] - - *) Make it so the openssl application has all engines loaded by default. - [Richard Levitte] - - *) Constify the BIGNUM routines a little more. - [Richard Levitte] - - *) Make sure that shared libraries get the internal name engine with - the full version number and not just 0. This should mark the - shared libraries as not backward compatible. Of course, this should - be changed again when we can guarantee backward binary compatibility. - [Richard Levitte] - - *) Add the following functions: - - ENGINE_load_cswift() - ENGINE_load_chil() - ENGINE_load_atalla() - ENGINE_load_nuron() - ENGINE_load_builtin_engines() - - That way, an application can itself choose if external engines that - are built-in in OpenSSL shall ever be used or not. The benefit is - that applications won't have to be linked with libdl or other dso - libraries unless it's really needed. - - Changed 'openssl engine' to load all engines on demand. - Changed the engine header files to avoid the duplication of some - declarations (they differed!). - [Richard Levitte] - - *) 'openssl engine' can now list capabilities. - [Richard Levitte] - - *) Better error reporting in 'openssl engine'. - [Richard Levitte] - - *) Never call load_dh_param(NULL) in s_server. - [Bodo Moeller] - - *) Add engine application. It can currently list engines by name and - identity, and test if they are actually available. - [Richard Levitte] - - *) Add support for shared libraries under Irix. - [Albert Chin-A-Young ] - - *) Improve RPM specification file by forcing symbolic linking and making - sure the installed documentation is also owned by root.root. - [Damien Miller ] - - *) Add configuration option to build on Linux on both big-endian and - little-endian MIPS. - [Ralf Baechle ] - - *) Give the OpenSSL applications more possibilities to make use of - keys (public as well as private) handled by engines. - [Richard Levitte] - - *) Add OCSP code that comes from CertCo. - [Richard Levitte] - - *) Add VMS support for the Rijndael code. - [Richard Levitte] - - *) Added untested support for Nuron crypto accelerator. - [Ben Laurie] - - *) Add support for external cryptographic devices. This code was - previously distributed separately as the "engine" branch. - [Geoff Thorpe, Richard Levitte] - - *) Rework the filename-translation in the DSO code. It is now possible to - have far greater control over how a "name" is turned into a filename - depending on the operating environment and any oddities about the - different shared library filenames on each system. - [Geoff Thorpe] - - *) Support threads on FreeBSD-elf in Configure. - [Richard Levitte] - - *) Add the possibility to create shared libraries on HP-UX - [Richard Levitte] - - *) Fix for SHA1 assembly problem with MASM: it produces - warnings about corrupt line number information when assembling - with debugging information. This is caused by the overlapping - of two sections. - [Bernd Matthes , Steve Henson] - - *) NCONF changes. - NCONF_get_number() has no error checking at all. As a replacement, - NCONF_get_number_e() is defined (_e for "error checking") and is - promoted strongly. The old NCONF_get_number is kept around for - binary backward compatibility. - Make it possible for methods to load from something other than a BIO, - by providing a function pointer that is given a name instead of a BIO. - For example, this could be used to load configuration data from an - LDAP server. - [Richard Levitte] - - *) Fix typo in get_cert_by_subject() in by_dir.c - [Jean-Marc Desperrier ] - - *) Rework the system to generate shared libraries: - - - Make note of the expected extension for the shared libraries and - if there is a need for symbolic links from for example libcrypto.so.0 - to libcrypto.so.0.9.7. There is extended info in Configure for - that. - - - Make as few rebuilds of the shared libraries as possible. - - - Still avoid linking the OpenSSL programs with the shared libraries. - - - When installing, install the shared libraries separately from the - static ones. - [Richard Levitte] - - *) Fix for non blocking accept BIOs. Added new I/O special reason - BIO_RR_ACCEPT to cover this case. Previously use of accept BIOs - with non blocking I/O was not possible because no retry code was - implemented. Also added new SSL code SSL_WANT_ACCEPT to cover - this case. - [Steve Henson] - - *) Added the beginnings of Rijndael support. - [Ben Laurie] - - *) Fix for bug in DirectoryString mask setting. Add support for - X509_NAME_print_ex() in 'req' and X509_print_ex() function - to allow certificate printing to more controllable, additional - 'certopt' option to 'x509' to allow new printing options to be - set. - [Steve Henson] - - *) Clean old EAY MD5 hack from e_os.h. - [Richard Levitte] - - *) Fix SSL_CTX_set_read_ahead macro to actually use its argument. - - Copy SSL_CTX's read_ahead flag to SSL object directly in SSL_new - and not in SSL_clear because the latter is also used by the - accept/connect functions; previously, the settings made by - SSL_set_read_ahead would be lost during the handshake. - [Bodo Moeller; problems reported by Anders Gertz ] - - *) Correct util/mkdef.pl to be selective about disabled algorithms. - Previously, it would create entries for disableed algorithms no - matter what. - [Richard Levitte] - - Changes between 0.9.5a and 0.9.6 [24 Sep 2000] - - *) In ssl23_get_client_hello, generate an error message when faced - with an initial SSL 3.0/TLS record that is too small to contain the - first two bytes of the ClientHello message, i.e. client_version. - (Note that this is a pathologic case that probably has never happened - in real life.) The previous approach was to use the version number - from the record header as a substitute; but our protocol choice - should not depend on that one because it is not authenticated - by the Finished messages. - [Bodo Moeller] - - *) More robust randomness gathering functions for Windows. - [Jeffrey Altman ] - - *) For compatibility reasons if the flag X509_V_FLAG_ISSUER_CHECK is - not set then we don't setup the error code for issuer check errors - to avoid possibly overwriting other errors which the callback does - handle. If an application does set the flag then we assume it knows - what it is doing and can handle the new informational codes - appropriately. - [Steve Henson] - - *) Fix for a nasty bug in ASN1_TYPE handling. ASN1_TYPE is used for - a general "ANY" type, as such it should be able to decode anything - including tagged types. However it didn't check the class so it would - wrongly interpret tagged types in the same way as their universal - counterpart and unknown types were just rejected. Changed so that the - tagged and unknown types are handled in the same way as a SEQUENCE: - that is the encoding is stored intact. There is also a new type - "V_ASN1_OTHER" which is used when the class is not universal, in this - case we have no idea what the actual type is so we just lump them all - together. - [Steve Henson] - - *) On VMS, stdout may very well lead to a file that is written to - in a record-oriented fashion. That means that every write() will - write a separate record, which will be read separately by the - programs trying to read from it. This can be very confusing. - - The solution is to put a BIO filter in the way that will buffer - text until a linefeed is reached, and then write everything a - line at a time, so every record written will be an actual line, - not chunks of lines and not (usually doesn't happen, but I've - seen it once) several lines in one record. BIO_f_linebuffer() is - the answer. - - Currently, it's a VMS-only method, because that's where it has - been tested well enough. - [Richard Levitte] - - *) Remove 'optimized' squaring variant in BN_mod_mul_montgomery, - it can return incorrect results. - (Note: The buggy variant was not enabled in OpenSSL 0.9.5a, - but it was in 0.9.6-beta[12].) - [Bodo Moeller] - - *) Disable the check for content being present when verifying detached - signatures in pk7_smime.c. Some versions of Netscape (wrongly) - include zero length content when signing messages. - [Steve Henson] - - *) New BIO_shutdown_wr macro, which invokes the BIO_C_SHUTDOWN_WR - BIO_ctrl (for BIO pairs). - [Bodo Möller] - - *) Add DSO method for VMS. - [Richard Levitte] - - *) Bug fix: Montgomery multiplication could produce results with the - wrong sign. - [Ulf Möller] - - *) Add RPM specification openssl.spec and modify it to build three - packages. The default package contains applications, application - documentation and run-time libraries. The devel package contains - include files, static libraries and function documentation. The - doc package contains the contents of the doc directory. The original - openssl.spec was provided by Damien Miller . - [Richard Levitte] - - *) Add a large number of documentation files for many SSL routines. - [Lutz Jaenicke ] - - *) Add a configuration entry for Sony News 4. - [NAKAJI Hiroyuki ] - - *) Don't set the two most significant bits to one when generating a - random number < q in the DSA library. - [Ulf Möller] - - *) New SSL API mode 'SSL_MODE_AUTO_RETRY'. This disables the default - behaviour that SSL_read may result in SSL_ERROR_WANT_READ (even if - the underlying transport is blocking) if a handshake took place. - (The default behaviour is needed by applications such as s_client - and s_server that use select() to determine when to use SSL_read; - but for applications that know in advance when to expect data, it - just makes things more complicated.) - [Bodo Moeller] - - *) Add RAND_egd_bytes(), which gives control over the number of bytes read - from EGD. - [Ben Laurie] - - *) Add a few more EBCDIC conditionals that make `req' and `x509' - work better on such systems. - [Martin Kraemer ] - - *) Add two demo programs for PKCS12_parse() and PKCS12_create(). - Update PKCS12_parse() so it copies the friendlyName and the - keyid to the certificates aux info. - [Steve Henson] - - *) Fix bug in PKCS7_verify() which caused an infinite loop - if there was more than one signature. - [Sven Uszpelkat ] - - *) Major change in util/mkdef.pl to include extra information - about each symbol, as well as presentig variables as well - as functions. This change means that there's n more need - to rebuild the .num files when some algorithms are excluded. - [Richard Levitte] - - *) Allow the verify time to be set by an application, - rather than always using the current time. - [Steve Henson] - - *) Phase 2 verify code reorganisation. The certificate - verify code now looks up an issuer certificate by a - number of criteria: subject name, authority key id - and key usage. It also verifies self signed certificates - by the same criteria. The main comparison function is - X509_check_issued() which performs these checks. - - Lot of changes were necessary in order to support this - without completely rewriting the lookup code. - - Authority and subject key identifier are now cached. - - The LHASH 'certs' is X509_STORE has now been replaced - by a STACK_OF(X509_OBJECT). This is mainly because an - LHASH can't store or retrieve multiple objects with - the same hash value. - - As a result various functions (which were all internal - use only) have changed to handle the new X509_STORE - structure. This will break anything that messed round - with X509_STORE internally. - - The functions X509_STORE_add_cert() now checks for an - exact match, rather than just subject name. - - The X509_STORE API doesn't directly support the retrieval - of multiple certificates matching a given criteria, however - this can be worked round by performing a lookup first - (which will fill the cache with candidate certificates) - and then examining the cache for matches. This is probably - the best we can do without throwing out X509_LOOKUP - entirely (maybe later...). - - The X509_VERIFY_CTX structure has been enhanced considerably. - - All certificate lookup operations now go via a get_issuer() - callback. Although this currently uses an X509_STORE it - can be replaced by custom lookups. This is a simple way - to bypass the X509_STORE hackery necessary to make this - work and makes it possible to use more efficient techniques - in future. A very simple version which uses a simple - STACK for its trusted certificate store is also provided - using X509_STORE_CTX_trusted_stack(). - - The verify_cb() and verify() callbacks now have equivalents - in the X509_STORE_CTX structure. - - X509_STORE_CTX also has a 'flags' field which can be used - to customise the verify behaviour. - [Steve Henson] - - *) Add new PKCS#7 signing option PKCS7_NOSMIMECAP which - excludes S/MIME capabilities. - [Steve Henson] - - *) When a certificate request is read in keep a copy of the - original encoding of the signed data and use it when outputing - again. Signatures then use the original encoding rather than - a decoded, encoded version which may cause problems if the - request is improperly encoded. - [Steve Henson] - - *) For consistency with other BIO_puts implementations, call - buffer_write(b, ...) directly in buffer_puts instead of calling - BIO_write(b, ...). - - In BIO_puts, increment b->num_write as in BIO_write. - [Peter.Sylvester@EdelWeb.fr] - - *) Fix BN_mul_word for the case where the word is 0. (We have to use - BN_zero, we may not return a BIGNUM with an array consisting of - words set to zero.) - [Bodo Moeller] - - *) Avoid calling abort() from within the library when problems are - detected, except if preprocessor symbols have been defined - (such as REF_CHECK, BN_DEBUG etc.). - [Bodo Moeller] - - *) New openssl application 'rsautl'. This utility can be - used for low level RSA operations. DER public key - BIO/fp routines also added. - [Steve Henson] - - *) New Configure entry and patches for compiling on QNX 4. - [Andreas Schneider ] - - *) A demo state-machine implementation was sponsored by - Nuron (http://www.nuron.com/) and is now available in - demos/state_machine. - [Ben Laurie] - - *) New options added to the 'dgst' utility for signature - generation and verification. - [Steve Henson] - - *) Unrecognized PKCS#7 content types are now handled via a - catch all ASN1_TYPE structure. This allows unsupported - types to be stored as a "blob" and an application can - encode and decode it manually. - [Steve Henson] - - *) Fix various signed/unsigned issues to make a_strex.c - compile under VC++. - [Oscar Jacobsson ] - - *) ASN1 fixes. i2d_ASN1_OBJECT was not returning the correct - length if passed a buffer. ASN1_INTEGER_to_BN failed - if passed a NULL BN and its argument was negative. - [Steve Henson, pointed out by Sven Heiberg ] - - *) Modification to PKCS#7 encoding routines to output definite - length encoding. Since currently the whole structures are in - memory there's not real point in using indefinite length - constructed encoding. However if OpenSSL is compiled with - the flag PKCS7_INDEFINITE_ENCODING the old form is used. - [Steve Henson] - - *) Added BIO_vprintf() and BIO_vsnprintf(). - [Richard Levitte] - - *) Added more prefixes to parse for in the the strings written - through a logging bio, to cover all the levels that are available - through syslog. The prefixes are now: - - PANIC, EMERG, EMR => LOG_EMERG - ALERT, ALR => LOG_ALERT - CRIT, CRI => LOG_CRIT - ERROR, ERR => LOG_ERR - WARNING, WARN, WAR => LOG_WARNING - NOTICE, NOTE, NOT => LOG_NOTICE - INFO, INF => LOG_INFO - DEBUG, DBG => LOG_DEBUG - - and as before, if none of those prefixes are present at the - beginning of the string, LOG_ERR is chosen. - - On Win32, the LOG_* levels are mapped according to this: - - LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_ERR => EVENTLOG_ERROR_TYPE - LOG_WARNING => EVENTLOG_WARNING_TYPE - LOG_NOTICE, LOG_INFO, LOG_DEBUG => EVENTLOG_INFORMATION_TYPE - - [Richard Levitte] - - *) Made it possible to reconfigure with just the configuration - argument "reconf" or "reconfigure". The command line arguments - are stored in Makefile.ssl in the variable CONFIGURE_ARGS, - and are retrieved from there when reconfiguring. - [Richard Levitte] - - *) MD4 implemented. - [Assar Westerlund , Richard Levitte] - - *) Add the arguments -CAfile and -CApath to the pkcs12 utility. - [Richard Levitte] - - *) The obj_dat.pl script was messing up the sorting of object - names. The reason was that it compared the quoted version - of strings as a result "OCSP" > "OCSP Signing" because - " > SPACE. Changed script to store unquoted versions of - names and add quotes on output. It was also omitting some - names from the lookup table if they were given a default - value (that is if SN is missing it is given the same - value as LN and vice versa), these are now added on the - grounds that if an object has a name we should be able to - look it up. Finally added warning output when duplicate - short or long names are found. - [Steve Henson] - - *) Changes needed for Tandem NSK. - [Scott Uroff ] - - *) Fix SSL 2.0 rollback checking: Due to an off-by-one error in - RSA_padding_check_SSLv23(), special padding was never detected - and thus the SSL 3.0/TLS 1.0 countermeasure against protocol - version rollback attacks was not effective. - - In s23_clnt.c, don't use special rollback-attack detection padding - (RSA_SSLV23_PADDING) if SSL 2.0 is the only protocol enabled in the - client; similarly, in s23_srvr.c, don't do the rollback check if - SSL 2.0 is the only protocol enabled in the server. - [Bodo Moeller] - - *) Make it possible to get hexdumps of unprintable data with 'openssl - asn1parse'. By implication, the functions ASN1_parse_dump() and - BIO_dump_indent() are added. - [Richard Levitte] - - *) New functions ASN1_STRING_print_ex() and X509_NAME_print_ex() - these print out strings and name structures based on various - flags including RFC2253 support and proper handling of - multibyte characters. Added options to the 'x509' utility - to allow the various flags to be set. - [Steve Henson] - - *) Various fixes to use ASN1_TIME instead of ASN1_UTCTIME. - Also change the functions X509_cmp_current_time() and - X509_gmtime_adj() work with an ASN1_TIME structure, - this will enable certificates using GeneralizedTime in validity - dates to be checked. - [Steve Henson] - - *) Make the NEG_PUBKEY_BUG code (which tolerates invalid - negative public key encodings) on by default, - NO_NEG_PUBKEY_BUG can be set to disable it. - [Steve Henson] - - *) New function c2i_ASN1_OBJECT() which acts on ASN1_OBJECT - content octets. An i2c_ASN1_OBJECT is unnecessary because - the encoding can be trivially obtained from the structure. - [Steve Henson] - - *) crypto/err.c locking bugfix: Use write locks (CRYPTO_w_[un]lock), - not read locks (CRYPTO_r_[un]lock). - [Bodo Moeller] - - *) A first attempt at creating official support for shared - libraries through configuration. I've kept it so the - default is static libraries only, and the OpenSSL programs - are always statically linked for now, but there are - preparations for dynamic linking in place. - This has been tested on Linux and True64. - [Richard Levitte] - - *) Randomness polling function for Win9x, as described in: - Peter Gutmann, Software Generation of Practically Strong - Random Numbers. - [Ulf Möller] - - *) Fix so PRNG is seeded in req if using an already existing - DSA key. - [Steve Henson] - - *) New options to smime application. -inform and -outform - allow alternative formats for the S/MIME message including - PEM and DER. The -content option allows the content to be - specified separately. This should allow things like Netscape - form signing output easier to verify. - [Steve Henson] - - *) Fix the ASN1 encoding of tags using the 'long form'. - [Steve Henson] - - *) New ASN1 functions, i2c_* and c2i_* for INTEGER and BIT - STRING types. These convert content octets to and from the - underlying type. The actual tag and length octets are - already assumed to have been read in and checked. These - are needed because all other string types have virtually - identical handling apart from the tag. By having versions - of the ASN1 functions that just operate on content octets - IMPLICIT tagging can be handled properly. It also allows - the ASN1_ENUMERATED code to be cut down because ASN1_ENUMERATED - and ASN1_INTEGER are identical apart from the tag. - [Steve Henson] - - *) Change the handling of OID objects as follows: - - - New object identifiers are inserted in objects.txt, following - the syntax given in objects.README. - - objects.pl is used to process obj_mac.num and create a new - obj_mac.h. - - obj_dat.pl is used to create a new obj_dat.h, using the data in - obj_mac.h. - - This is currently kind of a hack, and the perl code in objects.pl - isn't very elegant, but it works as I intended. The simplest way - to check that it worked correctly is to look in obj_dat.h and - check the array nid_objs and make sure the objects haven't moved - around (this is important!). Additions are OK, as well as - consistent name changes. - [Richard Levitte] - - *) Add BSD-style MD5-based passwords to 'openssl passwd' (option '-1'). - [Bodo Moeller] - - *) Addition of the command line parameter '-rand file' to 'openssl req'. - The given file adds to whatever has already been seeded into the - random pool through the RANDFILE configuration file option or - environment variable, or the default random state file. - [Richard Levitte] - - *) mkstack.pl now sorts each macro group into lexical order. - Previously the output order depended on the order the files - appeared in the directory, resulting in needless rewriting - of safestack.h . - [Steve Henson] - - *) Patches to make OpenSSL compile under Win32 again. Mostly - work arounds for the VC++ problem that it treats func() as - func(void). Also stripped out the parts of mkdef.pl that - added extra typesafe functions: these no longer exist. - [Steve Henson] - - *) Reorganisation of the stack code. The macros are now all - collected in safestack.h . Each macro is defined in terms of - a "stack macro" of the form SKM_(type, a, b). The - DEBUG_SAFESTACK is now handled in terms of function casts, - this has the advantage of retaining type safety without the - use of additional functions. If DEBUG_SAFESTACK is not defined - then the non typesafe macros are used instead. Also modified the - mkstack.pl script to handle the new form. Needs testing to see - if which (if any) compilers it chokes and maybe make DEBUG_SAFESTACK - the default if no major problems. Similar behaviour for ASN1_SET_OF - and PKCS12_STACK_OF. - [Steve Henson] - - *) When some versions of IIS use the 'NET' form of private key the - key derivation algorithm is different. Normally MD5(password) is - used as a 128 bit RC4 key. In the modified case - MD5(MD5(password) + "SGCKEYSALT") is used insted. Added some - new functions i2d_RSA_NET(), d2i_RSA_NET() etc which are the same - as the old Netscape_RSA functions except they have an additional - 'sgckey' parameter which uses the modified algorithm. Also added - an -sgckey command line option to the rsa utility. Thanks to - Adrian Peck for posting details of the modified - algorithm to openssl-dev. - [Steve Henson] - - *) The evp_local.h macros were using 'c.##kname' which resulted in - invalid expansion on some systems (SCO 5.0.5 for example). - Corrected to 'c.kname'. - [Phillip Porch ] - - *) New X509_get1_email() and X509_REQ_get1_email() functions that return - a STACK of email addresses from a certificate or request, these look - in the subject name and the subject alternative name extensions and - omit any duplicate addresses. - [Steve Henson] - - *) Re-implement BN_mod_exp2_mont using independent (and larger) windows. - This makes DSA verification about 2 % faster. - [Bodo Moeller] - - *) Increase maximum window size in BN_mod_exp_... to 6 bits instead of 5 - (meaning that now 2^5 values will be precomputed, which is only 4 KB - plus overhead for 1024 bit moduli). - This makes exponentiations about 0.5 % faster for 1024 bit - exponents (as measured by "openssl speed rsa2048"). - [Bodo Moeller] - - *) Rename memory handling macros to avoid conflicts with other - software: - Malloc => OPENSSL_malloc - Malloc_locked => OPENSSL_malloc_locked - Realloc => OPENSSL_realloc - Free => OPENSSL_free - [Richard Levitte] - - *) New function BN_mod_exp_mont_word for small bases (roughly 15% - faster than BN_mod_exp_mont, i.e. 7% for a full DH exchange). - [Bodo Moeller] - - *) CygWin32 support. - [John Jarvie ] - - *) The type-safe stack code has been rejigged. It is now only compiled - in when OpenSSL is configured with the DEBUG_SAFESTACK option and - by default all type-specific stack functions are "#define"d back to - standard stack functions. This results in more streamlined output - but retains the type-safety checking possibilities of the original - approach. - [Geoff Thorpe] - - *) The STACK code has been cleaned up, and certain type declarations - that didn't make a lot of sense have been brought in line. This has - also involved a cleanup of sorts in safestack.h to more correctly - map type-safe stack functions onto their plain stack counterparts. - This work has also resulted in a variety of "const"ifications of - lots of the code, especially "_cmp" operations which should normally - be prototyped with "const" parameters anyway. - [Geoff Thorpe] - - *) When generating bytes for the first time in md_rand.c, 'stir the pool' - by seeding with STATE_SIZE dummy bytes (with zero entropy count). - (The PRNG state consists of two parts, the large pool 'state' and 'md', - where all of 'md' is used each time the PRNG is used, but 'state' - is used only indexed by a cyclic counter. As entropy may not be - well distributed from the beginning, 'md' is important as a - chaining variable. However, the output function chains only half - of 'md', i.e. 80 bits. ssleay_rand_add, on the other hand, chains - all of 'md', and seeding with STATE_SIZE dummy bytes will result - in all of 'state' being rewritten, with the new values depending - on virtually all of 'md'. This overcomes the 80 bit limitation.) - [Bodo Moeller] - - *) In ssl/s2_clnt.c and ssl/s3_clnt.c, call ERR_clear_error() when - the handshake is continued after ssl_verify_cert_chain(); - otherwise, if SSL_VERIFY_NONE is set, remaining error codes - can lead to 'unexplainable' connection aborts later. - [Bodo Moeller; problem tracked down by Lutz Jaenicke] - - *) Major EVP API cipher revision. - Add hooks for extra EVP features. This allows various cipher - parameters to be set in the EVP interface. Support added for variable - key length ciphers via the EVP_CIPHER_CTX_set_key_length() function and - setting of RC2 and RC5 parameters. - - Modify EVP_OpenInit() and EVP_SealInit() to cope with variable key length - ciphers. - - Remove lots of duplicated code from the EVP library. For example *every* - cipher init() function handles the 'iv' in the same way according to the - cipher mode. They also all do nothing if the 'key' parameter is NULL and - for CFB and OFB modes they zero ctx->num. - - New functionality allows removal of S/MIME code RC2 hack. - - Most of the routines have the same form and so can be declared in terms - of macros. - - By shifting this to the top level EVP_CipherInit() it can be removed from - all individual ciphers. If the cipher wants to handle IVs or keys - differently it can set the EVP_CIPH_CUSTOM_IV or EVP_CIPH_ALWAYS_CALL_INIT - flags. - - Change lots of functions like EVP_EncryptUpdate() to now return a - value: although software versions of the algorithms cannot fail - any installed hardware versions can. - [Steve Henson] - - *) Implement SSL_OP_TLS_ROLLBACK_BUG: In ssl3_get_client_key_exchange, if - this option is set, tolerate broken clients that send the negotiated - protocol version number instead of the requested protocol version - number. - [Bodo Moeller] - - *) Call dh_tmp_cb (set by ..._TMP_DH_CB) with correct 'is_export' flag; - i.e. non-zero for export ciphersuites, zero otherwise. - Previous versions had this flag inverted, inconsistent with - rsa_tmp_cb (..._TMP_RSA_CB). - [Bodo Moeller; problem reported by Amit Chopra] - - *) Add missing DSA library text string. Work around for some IIS - key files with invalid SEQUENCE encoding. - [Steve Henson] - - *) Add a document (doc/standards.txt) that list all kinds of standards - and so on that are implemented in OpenSSL. - [Richard Levitte] - - *) Enhance c_rehash script. Old version would mishandle certificates - with the same subject name hash and wouldn't handle CRLs at all. - Added -fingerprint option to crl utility, to support new c_rehash - features. - [Steve Henson] - - *) Eliminate non-ANSI declarations in crypto.h and stack.h. - [Ulf Möller] - - *) Fix for SSL server purpose checking. Server checking was - rejecting certificates which had extended key usage present - but no ssl client purpose. - [Steve Henson, reported by Rene Grosser ] - - *) Make PKCS#12 code work with no password. The PKCS#12 spec - is a little unclear about how a blank password is handled. - Since the password in encoded as a BMPString with terminating - double NULL a zero length password would end up as just the - double NULL. However no password at all is different and is - handled differently in the PKCS#12 key generation code. NS - treats a blank password as zero length. MSIE treats it as no - password on export: but it will try both on import. We now do - the same: PKCS12_parse() tries zero length and no password if - the password is set to "" or NULL (NULL is now a valid password: - it wasn't before) as does the pkcs12 application. - [Steve Henson] - - *) Bugfixes in apps/x509.c: Avoid a memory leak; and don't use - perror when PEM_read_bio_X509_REQ fails, the error message must - be obtained from the error queue. - [Bodo Moeller] - - *) Avoid 'thread_hash' memory leak in crypto/err/err.c by freeing - it in ERR_remove_state if appropriate, and change ERR_get_state - accordingly to avoid race conditions (this is necessary because - thread_hash is no longer constant once set). - [Bodo Moeller] - - *) Bugfix for linux-elf makefile.one. - [Ulf Möller] - - *) RSA_get_default_method() will now cause a default - RSA_METHOD to be chosen if one doesn't exist already. - Previously this was only set during a call to RSA_new() - or RSA_new_method(NULL) meaning it was possible for - RSA_get_default_method() to return NULL. - [Geoff Thorpe] - - *) Added native name translation to the existing DSO code - that will convert (if the flag to do so is set) filenames - that are sufficiently small and have no path information - into a canonical native form. Eg. "blah" converted to - "libblah.so" or "blah.dll" etc. - [Geoff Thorpe] - - *) New function ERR_error_string_n(e, buf, len) which is like - ERR_error_string(e, buf), but writes at most 'len' bytes - including the 0 terminator. For ERR_error_string_n, 'buf' - may not be NULL. - [Damien Miller , Bodo Moeller] - - *) CONF library reworked to become more general. A new CONF - configuration file reader "class" is implemented as well as a - new functions (NCONF_*, for "New CONF") to handle it. The now - old CONF_* functions are still there, but are reimplemented to - work in terms of the new functions. Also, a set of functions - to handle the internal storage of the configuration data is - provided to make it easier to write new configuration file - reader "classes" (I can definitely see something reading a - configuration file in XML format, for example), called _CONF_*, - or "the configuration storage API"... - - The new configuration file reading functions are: - - NCONF_new, NCONF_free, NCONF_load, NCONF_load_fp, NCONF_load_bio, - NCONF_get_section, NCONF_get_string, NCONF_get_numbre - - NCONF_default, NCONF_WIN32 - - NCONF_dump_fp, NCONF_dump_bio - - NCONF_default and NCONF_WIN32 are method (or "class") choosers, - NCONF_new creates a new CONF object. This works in the same way - as other interfaces in OpenSSL, like the BIO interface. - NCONF_dump_* dump the internal storage of the configuration file, - which is useful for debugging. All other functions take the same - arguments as the old CONF_* functions wth the exception of the - first that must be a `CONF *' instead of a `LHASH *'. - - To make it easer to use the new classes with the old CONF_* functions, - the function CONF_set_default_method is provided. - [Richard Levitte] - - *) Add '-tls1' option to 'openssl ciphers', which was already - mentioned in the documentation but had not been implemented. - (This option is not yet really useful because even the additional - experimental TLS 1.0 ciphers are currently treated as SSL 3.0 ciphers.) - [Bodo Moeller] - - *) Initial DSO code added into libcrypto for letting OpenSSL (and - OpenSSL-based applications) load shared libraries and bind to - them in a portable way. - [Geoff Thorpe, with contributions from Richard Levitte] - - Changes between 0.9.5 and 0.9.5a [1 Apr 2000] - - *) Make sure _lrotl and _lrotr are only used with MSVC. - - *) Use lock CRYPTO_LOCK_RAND correctly in ssleay_rand_status - (the default implementation of RAND_status). - - *) Rename openssl x509 option '-crlext', which was added in 0.9.5, - to '-clrext' (= clear extensions), as intended and documented. - [Bodo Moeller; inconsistency pointed out by Michael Attili - ] - - *) Fix for HMAC. It wasn't zeroing the rest of the block if the key length - was larger than the MD block size. - [Steve Henson, pointed out by Yost William ] - - *) Modernise PKCS12_parse() so it uses STACK_OF(X509) for its ca argument - fix a leak when the ca argument was passed as NULL. Stop X509_PUBKEY_set() - using the passed key: if the passed key was a private key the result - of X509_print(), for example, would be to print out all the private key - components. - [Steve Henson] - - *) des_quad_cksum() byte order bug fix. - [Ulf Möller, using the problem description in krb4-0.9.7, where - the solution is attributed to Derrick J Brashear ] - - *) Fix so V_ASN1_APP_CHOOSE works again: however its use is strongly - discouraged. - [Steve Henson, pointed out by Brian Korver ] - - *) For easily testing in shell scripts whether some command - 'openssl XXX' exists, the new pseudo-command 'openssl no-XXX' - returns with exit code 0 iff no command of the given name is available. - 'no-XXX' is printed in this case, 'XXX' otherwise. In both cases, - the output goes to stdout and nothing is printed to stderr. - Additional arguments are always ignored. - - Since for each cipher there is a command of the same name, - the 'no-cipher' compilation switches can be tested this way. - - ('openssl no-XXX' is not able to detect pseudo-commands such - as 'quit', 'list-XXX-commands', or 'no-XXX' itself.) - [Bodo Moeller] - - *) Update test suite so that 'make test' succeeds in 'no-rsa' configuration. - [Bodo Moeller] - - *) For SSL_[CTX_]set_tmp_dh, don't create a DH key if SSL_OP_SINGLE_DH_USE - is set; it will be thrown away anyway because each handshake creates - its own key. - ssl_cert_dup, which is used by SSL_new, now copies DH keys in addition - to parameters -- in previous versions (since OpenSSL 0.9.3) the - 'default key' from SSL_CTX_set_tmp_dh would always be lost, meanining - you effectivly got SSL_OP_SINGLE_DH_USE when using this macro. - [Bodo Moeller] - - *) New s_client option -ign_eof: EOF at stdin is ignored, and - 'Q' and 'R' lose their special meanings (quit/renegotiate). - This is part of what -quiet does; unlike -quiet, -ign_eof - does not suppress any output. - [Richard Levitte] - - *) Add compatibility options to the purpose and trust code. The - purpose X509_PURPOSE_ANY is "any purpose" which automatically - accepts a certificate or CA, this was the previous behaviour, - with all the associated security issues. - - X509_TRUST_COMPAT is the old trust behaviour: only and - automatically trust self signed roots in certificate store. A - new trust setting X509_TRUST_DEFAULT is used to specify that - a purpose has no associated trust setting and it should instead - use the value in the default purpose. - [Steve Henson] - - *) Fix the PKCS#8 DSA private key code so it decodes keys again - and fix a memory leak. - [Steve Henson] - - *) In util/mkerr.pl (which implements 'make errors'), preserve - reason strings from the previous version of the .c file, as - the default to have only downcase letters (and digits) in - automatically generated reasons codes is not always appropriate. - [Bodo Moeller] - - *) In ERR_load_ERR_strings(), build an ERR_LIB_SYS error reason table - using strerror. Previously, ERR_reason_error_string() returned - library names as reason strings for SYSerr; but SYSerr is a special - case where small numbers are errno values, not library numbers. - [Bodo Moeller] - - *) Add '-dsaparam' option to 'openssl dhparam' application. This - converts DSA parameters into DH parameters. (When creating parameters, - DSA_generate_parameters is used.) - [Bodo Moeller] - - *) Include 'length' (recommended exponent length) in C code generated - by 'openssl dhparam -C'. - [Bodo Moeller] - - *) The second argument to set_label in perlasm was already being used - so couldn't be used as a "file scope" flag. Moved to third argument - which was free. - [Steve Henson] - - *) In PEM_ASN1_write_bio and some other functions, use RAND_pseudo_bytes - instead of RAND_bytes for encryption IVs and salts. - [Bodo Moeller] - - *) Include RAND_status() into RAND_METHOD instead of implementing - it only for md_rand.c Otherwise replacing the PRNG by calling - RAND_set_rand_method would be impossible. - [Bodo Moeller] - - *) Don't let DSA_generate_key() enter an infinite loop if the random - number generation fails. - [Bodo Moeller] - - *) New 'rand' application for creating pseudo-random output. - [Bodo Moeller] - - *) Added configuration support for Linux/IA64 - [Rolf Haberrecker ] - - *) Assembler module support for Mingw32. - [Ulf Möller] - - *) Shared library support for HPUX (in shlib/). - [Lutz Jaenicke and Anonymous] - - *) Shared library support for Solaris gcc. - [Lutz Behnke ] - - Changes between 0.9.4 and 0.9.5 [28 Feb 2000] - - *) PKCS7_encrypt() was adding text MIME headers twice because they - were added manually and by SMIME_crlf_copy(). - [Steve Henson] - - *) In bntest.c don't call BN_rand with zero bits argument. - [Steve Henson, pointed out by Andrew W. Gray ] - - *) BN_mul bugfix: In bn_mul_part_recursion() only the a>a[n] && b>b[n] - case was implemented. This caused BN_div_recp() to fail occasionally. - [Ulf Möller] - - *) Add an optional second argument to the set_label() in the perl - assembly language builder. If this argument exists and is set - to 1 it signals that the assembler should use a symbol whose - scope is the entire file, not just the current function. This - is needed with MASM which uses the format label:: for this scope. - [Steve Henson, pointed out by Peter Runestig ] - - *) Change the ASN1 types so they are typedefs by default. Before - almost all types were #define'd to ASN1_STRING which was causing - STACK_OF() problems: you couldn't declare STACK_OF(ASN1_UTF8STRING) - for example. - [Steve Henson] - - *) Change names of new functions to the new get1/get0 naming - convention: After 'get1', the caller owns a reference count - and has to call ..._free; 'get0' returns a pointer to some - data structure without incrementing reference counters. - (Some of the existing 'get' functions increment a reference - counter, some don't.) - Similarly, 'set1' and 'add1' functions increase reference - counters or duplicate objects. - [Steve Henson] - - *) Allow for the possibility of temp RSA key generation failure: - the code used to assume it always worked and crashed on failure. - [Steve Henson] - - *) Fix potential buffer overrun problem in BIO_printf(). - [Ulf Möller, using public domain code by Patrick Powell; problem - pointed out by David Sacerdote ] - - *) Support EGD . New functions - RAND_egd() and RAND_status(). In the command line application, - the EGD socket can be specified like a seed file using RANDFILE - or -rand. - [Ulf Möller] - - *) Allow the string CERTIFICATE to be tolerated in PKCS#7 structures. - Some CAs (e.g. Verisign) distribute certificates in this form. - [Steve Henson] - - *) Remove the SSL_ALLOW_ADH compile option and set the default cipher - list to exclude them. This means that no special compilation option - is needed to use anonymous DH: it just needs to be included in the - cipher list. - [Steve Henson] - - *) Change the EVP_MD_CTX_type macro so its meaning consistent with - EVP_MD_type. The old functionality is available in a new macro called - EVP_MD_md(). Change code that uses it and update docs. - [Steve Henson] - - *) ..._ctrl functions now have corresponding ..._callback_ctrl functions - where the 'void *' argument is replaced by a function pointer argument. - Previously 'void *' was abused to point to functions, which works on - many platforms, but is not correct. As these functions are usually - called by macros defined in OpenSSL header files, most source code - should work without changes. - [Richard Levitte] - - *) (which is created by Configure) now contains - sections with information on -D... compiler switches used for - compiling the library so that applications can see them. To enable - one of these sections, a pre-processor symbol OPENSSL_..._DEFINES - must be defined. E.g., - #define OPENSSL_ALGORITHM_DEFINES - #include - defines all pertinent NO_ symbols, such as NO_IDEA, NO_RSA, etc. - [Richard Levitte, Ulf and Bodo Möller] - - *) Bugfix: Tolerate fragmentation and interleaving in the SSL 3/TLS - record layer. - [Bodo Moeller] - - *) Change the 'other' type in certificate aux info to a STACK_OF - X509_ALGOR. Although not an AlgorithmIdentifier as such it has - the required ASN1 format: arbitrary types determined by an OID. - [Steve Henson] - - *) Add some PEM_write_X509_REQ_NEW() functions and a command line - argument to 'req'. This is not because the function is newer or - better than others it just uses the work 'NEW' in the certificate - request header lines. Some software needs this. - [Steve Henson] - - *) Reorganise password command line arguments: now passwords can be - obtained from various sources. Delete the PEM_cb function and make - it the default behaviour: i.e. if the callback is NULL and the - usrdata argument is not NULL interpret it as a null terminated pass - phrase. If usrdata and the callback are NULL then the pass phrase - is prompted for as usual. - [Steve Henson] - - *) Add support for the Compaq Atalla crypto accelerator. If it is installed, - the support is automatically enabled. The resulting binaries will - autodetect the card and use it if present. - [Ben Laurie and Compaq Inc.] - - *) Work around for Netscape hang bug. This sends certificate request - and server done in one record. Since this is perfectly legal in the - SSL/TLS protocol it isn't a "bug" option and is on by default. See - the bugs/SSLv3 entry for more info. - [Steve Henson] - - *) HP-UX tune-up: new unified configs, HP C compiler bug workaround. - [Andy Polyakov] - - *) Add -rand argument to smime and pkcs12 applications and read/write - of seed file. - [Steve Henson] - - *) New 'passwd' tool for crypt(3) and apr1 password hashes. - [Bodo Moeller] - - *) Add command line password options to the remaining applications. - [Steve Henson] - - *) Bug fix for BN_div_recp() for numerators with an even number of - bits. - [Ulf Möller] - - *) More tests in bntest.c, and changed test_bn output. - [Ulf Möller] - - *) ./config recognizes MacOS X now. - [Andy Polyakov] - - *) Bug fix for BN_div() when the first words of num and divsor are - equal (it gave wrong results if (rem=(n1-q*d0)&BN_MASK2) < d0). - [Ulf Möller] - - *) Add support for various broken PKCS#8 formats, and command line - options to produce them. - [Steve Henson] - - *) New functions BN_CTX_start(), BN_CTX_get() and BT_CTX_end() to - get temporary BIGNUMs from a BN_CTX. - [Ulf Möller] - - *) Correct return values in BN_mod_exp_mont() and BN_mod_exp2_mont() - for p == 0. - [Ulf Möller] - - *) Change the SSLeay_add_all_*() functions to OpenSSL_add_all_*() and - include a #define from the old name to the new. The original intent - was that statically linked binaries could for example just call - SSLeay_add_all_ciphers() to just add ciphers to the table and not - link with digests. This never worked becayse SSLeay_add_all_digests() - and SSLeay_add_all_ciphers() were in the same source file so calling - one would link with the other. They are now in separate source files. - [Steve Henson] - - *) Add a new -notext option to 'ca' and a -pubkey option to 'spkac'. - [Steve Henson] - - *) Use a less unusual form of the Miller-Rabin primality test (it used - a binary algorithm for exponentiation integrated into the Miller-Rabin - loop, our standard modexp algorithms are faster). - [Bodo Moeller] - - *) Support for the EBCDIC character set completed. - [Martin Kraemer ] - - *) Source code cleanups: use const where appropriate, eliminate casts, - use void * instead of char * in lhash. - [Ulf Möller] - - *) Bugfix: ssl3_send_server_key_exchange was not restartable - (the state was not changed to SSL3_ST_SW_KEY_EXCH_B, and because of - this the server could overwrite ephemeral keys that the client - has already seen). - [Bodo Moeller] - - *) Turn DSA_is_prime into a macro that calls BN_is_prime, - using 50 iterations of the Rabin-Miller test. - - DSA_generate_parameters now uses BN_is_prime_fasttest (with 50 - iterations of the Rabin-Miller test as required by the appendix - to FIPS PUB 186[-1]) instead of DSA_is_prime. - As BN_is_prime_fasttest includes trial division, DSA parameter - generation becomes much faster. - - This implies a change for the callback functions in DSA_is_prime - and DSA_generate_parameters: The callback function is called once - for each positive witness in the Rabin-Miller test, not just - occasionally in the inner loop; and the parameters to the - callback function now provide an iteration count for the outer - loop rather than for the current invocation of the inner loop. - DSA_generate_parameters additionally can call the callback - function with an 'iteration count' of -1, meaning that a - candidate has passed the trial division test (when q is generated - from an application-provided seed, trial division is skipped). - [Bodo Moeller] - - *) New function BN_is_prime_fasttest that optionally does trial - division before starting the Rabin-Miller test and has - an additional BN_CTX * argument (whereas BN_is_prime always - has to allocate at least one BN_CTX). - 'callback(1, -1, cb_arg)' is called when a number has passed the - trial division stage. - [Bodo Moeller] - - *) Fix for bug in CRL encoding. The validity dates weren't being handled - as ASN1_TIME. - [Steve Henson] - - *) New -pkcs12 option to CA.pl script to write out a PKCS#12 file. - [Steve Henson] - - *) New function BN_pseudo_rand(). - [Ulf Möller] - - *) Clean up BN_mod_mul_montgomery(): replace the broken (and unreadable) - bignum version of BN_from_montgomery() with the working code from - SSLeay 0.9.0 (the word based version is faster anyway), and clean up - the comments. - [Ulf Möller] - - *) Avoid a race condition in s2_clnt.c (function get_server_hello) that - made it impossible to use the same SSL_SESSION data structure in - SSL2 clients in multiple threads. - [Bodo Moeller] - - *) The return value of RAND_load_file() no longer counts bytes obtained - by stat(). RAND_load_file(..., -1) is new and uses the complete file - to seed the PRNG (previously an explicit byte count was required). - [Ulf Möller, Bodo Möller] - - *) Clean up CRYPTO_EX_DATA functions, some of these didn't have prototypes - used (char *) instead of (void *) and had casts all over the place. - [Steve Henson] - - *) Make BN_generate_prime() return NULL on error if ret!=NULL. - [Ulf Möller] - - *) Retain source code compatibility for BN_prime_checks macro: - BN_is_prime(..., BN_prime_checks, ...) now uses - BN_prime_checks_for_size to determine the appropriate number of - Rabin-Miller iterations. - [Ulf Möller] - - *) Diffie-Hellman uses "safe" primes: DH_check() return code renamed to - DH_CHECK_P_NOT_SAFE_PRIME. - (Check if this is true? OpenPGP calls them "strong".) - [Ulf Möller] - - *) Merge the functionality of "dh" and "gendh" programs into a new program - "dhparam". The old programs are retained for now but will handle DH keys - (instead of parameters) in future. - [Steve Henson] - - *) Make the ciphers, s_server and s_client programs check the return values - when a new cipher list is set. - [Steve Henson] - - *) Enhance the SSL/TLS cipher mechanism to correctly handle the TLS 56bit - ciphers. Before when the 56bit ciphers were enabled the sorting was - wrong. - - The syntax for the cipher sorting has been extended to support sorting by - cipher-strength (using the strength_bits hard coded in the tables). - The new command is "@STRENGTH" (see also doc/apps/ciphers.pod). - - Fix a bug in the cipher-command parser: when supplying a cipher command - string with an "undefined" symbol (neither command nor alphanumeric - [A-Za-z0-9], ssl_set_cipher_list used to hang in an endless loop. Now - an error is flagged. - - Due to the strength-sorting extension, the code of the - ssl_create_cipher_list() function was completely rearranged. I hope that - the readability was also increased :-) - [Lutz Jaenicke ] - - *) Minor change to 'x509' utility. The -CAcreateserial option now uses 1 - for the first serial number and places 2 in the serial number file. This - avoids problems when the root CA is created with serial number zero and - the first user certificate has the same issuer name and serial number - as the root CA. - [Steve Henson] - - *) Fixes to X509_ATTRIBUTE utilities, change the 'req' program so it uses - the new code. Add documentation for this stuff. - [Steve Henson] - - *) Changes to X509_ATTRIBUTE utilities. These have been renamed from - X509_*() to X509at_*() on the grounds that they don't handle X509 - structures and behave in an analagous way to the X509v3 functions: - they shouldn't be called directly but wrapper functions should be used - instead. - - So we also now have some wrapper functions that call the X509at functions - when passed certificate requests. (TO DO: similar things can be done with - PKCS#7 signed and unsigned attributes, PKCS#12 attributes and a few other - things. Some of these need some d2i or i2d and print functionality - because they handle more complex structures.) - [Steve Henson] - - *) Add missing #ifndefs that caused missing symbols when building libssl - as a shared library without RSA. Use #ifndef NO_SSL2 instead of - NO_RSA in ssl/s2*.c. - [Kris Kennaway , modified by Ulf Möller] - - *) Precautions against using the PRNG uninitialized: RAND_bytes() now - has a return value which indicates the quality of the random data - (1 = ok, 0 = not seeded). Also an error is recorded on the thread's - error queue. New function RAND_pseudo_bytes() generates output that is - guaranteed to be unique but not unpredictable. RAND_add is like - RAND_seed, but takes an extra argument for an entropy estimate - (RAND_seed always assumes full entropy). - [Ulf Möller] - - *) Do more iterations of Rabin-Miller probable prime test (specifically, - 3 for 1024-bit primes, 6 for 512-bit primes, 12 for 256-bit primes - instead of only 2 for all lengths; see BN_prime_checks_for_size definition - in crypto/bn/bn_prime.c for the complete table). This guarantees a - false-positive rate of at most 2^-80 for random input. - [Bodo Moeller] - - *) Rewrite ssl3_read_n (ssl/s3_pkt.c) avoiding a couple of bugs. - [Bodo Moeller] - - *) New function X509_CTX_rget_chain() (renamed to X509_CTX_get1_chain - in the 0.9.5 release), this returns the chain - from an X509_CTX structure with a dup of the stack and all - the X509 reference counts upped: so the stack will exist - after X509_CTX_cleanup() has been called. Modify pkcs12.c - to use this. - - Also make SSL_SESSION_print() print out the verify return - code. - [Steve Henson] - - *) Add manpage for the pkcs12 command. Also change the default - behaviour so MAC iteration counts are used unless the new - -nomaciter option is used. This improves file security and - only older versions of MSIE (4.0 for example) need it. - [Steve Henson] - - *) Honor the no-xxx Configure options when creating .DEF files. - [Ulf Möller] - - *) Add PKCS#10 attributes to field table: challengePassword, - unstructuredName and unstructuredAddress. These are taken from - draft PKCS#9 v2.0 but are compatible with v1.2 provided no - international characters are used. - - More changes to X509_ATTRIBUTE code: allow the setting of types - based on strings. Remove the 'loc' parameter when adding - attributes because these will be a SET OF encoding which is sorted - in ASN1 order. - [Steve Henson] - - *) Initial changes to the 'req' utility to allow request generation - automation. This will allow an application to just generate a template - file containing all the field values and have req construct the - request. - - Initial support for X509_ATTRIBUTE handling. Stacks of these are - used all over the place including certificate requests and PKCS#7 - structures. They are currently handled manually where necessary with - some primitive wrappers for PKCS#7. The new functions behave in a - manner analogous to the X509 extension functions: they allow - attributes to be looked up by NID and added. - - Later something similar to the X509V3 code would be desirable to - automatically handle the encoding, decoding and printing of the - more complex types. The string types like challengePassword can - be handled by the string table functions. - - Also modified the multi byte string table handling. Now there is - a 'global mask' which masks out certain types. The table itself - can use the flag STABLE_NO_MASK to ignore the mask setting: this - is useful when for example there is only one permissible type - (as in countryName) and using the mask might result in no valid - types at all. - [Steve Henson] - - *) Clean up 'Finished' handling, and add functions SSL_get_finished and - SSL_get_peer_finished to allow applications to obtain the latest - Finished messages sent to the peer or expected from the peer, - respectively. (SSL_get_peer_finished is usually the Finished message - actually received from the peer, otherwise the protocol will be aborted.) - - As the Finished message are message digests of the complete handshake - (with a total of 192 bits for TLS 1.0 and more for SSL 3.0), they can - be used for external authentication procedures when the authentication - provided by SSL/TLS is not desired or is not enough. - [Bodo Moeller] - - *) Enhanced support for Alpha Linux is added. Now ./config checks if - the host supports BWX extension and if Compaq C is present on the - $PATH. Just exploiting of the BWX extension results in 20-30% - performance kick for some algorithms, e.g. DES and RC4 to mention - a couple. Compaq C in turn generates ~20% faster code for MD5 and - SHA1. - [Andy Polyakov] - - *) Add support for MS "fast SGC". This is arguably a violation of the - SSL3/TLS protocol. Netscape SGC does two handshakes: the first with - weak crypto and after checking the certificate is SGC a second one - with strong crypto. MS SGC stops the first handshake after receiving - the server certificate message and sends a second client hello. Since - a server will typically do all the time consuming operations before - expecting any further messages from the client (server key exchange - is the most expensive) there is little difference between the two. - - To get OpenSSL to support MS SGC we have to permit a second client - hello message after we have sent server done. In addition we have to - reset the MAC if we do get this second client hello. - [Steve Henson] - - *) Add a function 'd2i_AutoPrivateKey()' this will automatically decide - if a DER encoded private key is RSA or DSA traditional format. Changed - d2i_PrivateKey_bio() to use it. This is only needed for the "traditional" - format DER encoded private key. Newer code should use PKCS#8 format which - has the key type encoded in the ASN1 structure. Added DER private key - support to pkcs8 application. - [Steve Henson] - - *) SSL 3/TLS 1 servers now don't request certificates when an anonymous - ciphersuites has been selected (as required by the SSL 3/TLS 1 - specifications). Exception: When SSL_VERIFY_FAIL_IF_NO_PEER_CERT - is set, we interpret this as a request to violate the specification - (the worst that can happen is a handshake failure, and 'correct' - behaviour would result in a handshake failure anyway). - [Bodo Moeller] - - *) In SSL_CTX_add_session, take into account that there might be multiple - SSL_SESSION structures with the same session ID (e.g. when two threads - concurrently obtain them from an external cache). - The internal cache can handle only one SSL_SESSION with a given ID, - so if there's a conflict, we now throw out the old one to achieve - consistency. - [Bodo Moeller] - - *) Add OIDs for idea and blowfish in CBC mode. This will allow both - to be used in PKCS#5 v2.0 and S/MIME. Also add checking to - some routines that use cipher OIDs: some ciphers do not have OIDs - defined and so they cannot be used for S/MIME and PKCS#5 v2.0 for - example. - [Steve Henson] - - *) Simplify the trust setting structure and code. Now we just have - two sequences of OIDs for trusted and rejected settings. These will - typically have values the same as the extended key usage extension - and any application specific purposes. - - The trust checking code now has a default behaviour: it will just - check for an object with the same NID as the passed id. Functions can - be provided to override either the default behaviour or the behaviour - for a given id. SSL client, server and email already have functions - in place for compatibility: they check the NID and also return "trusted" - if the certificate is self signed. - [Steve Henson] - - *) Add d2i,i2d bio/fp functions for PrivateKey: these convert the - traditional format into an EVP_PKEY structure. - [Steve Henson] - - *) Add a password callback function PEM_cb() which either prompts for - a password if usr_data is NULL or otherwise assumes it is a null - terminated password. Allow passwords to be passed on command line - environment or config files in a few more utilities. - [Steve Henson] - - *) Add a bunch of DER and PEM functions to handle PKCS#8 format private - keys. Add some short names for PKCS#8 PBE algorithms and allow them - to be specified on the command line for the pkcs8 and pkcs12 utilities. - Update documentation. - [Steve Henson] - - *) Support for ASN1 "NULL" type. This could be handled before by using - ASN1_TYPE but there wasn't any function that would try to read a NULL - and produce an error if it couldn't. For compatibility we also have - ASN1_NULL_new() and ASN1_NULL_free() functions but these are faked and - don't allocate anything because they don't need to. - [Steve Henson] - - *) Initial support for MacOS is now provided. Examine INSTALL.MacOS - for details. - [Andy Polyakov, Roy Woods ] - - *) Rebuild of the memory allocation routines used by OpenSSL code and - possibly others as well. The purpose is to make an interface that - provide hooks so anyone can build a separate set of allocation and - deallocation routines to be used by OpenSSL, for example memory - pool implementations, or something else, which was previously hard - since Malloc(), Realloc() and Free() were defined as macros having - the values malloc, realloc and free, respectively (except for Win32 - compilations). The same is provided for memory debugging code. - OpenSSL already comes with functionality to find memory leaks, but - this gives people a chance to debug other memory problems. - - With these changes, a new set of functions and macros have appeared: - - CRYPTO_set_mem_debug_functions() [F] - CRYPTO_get_mem_debug_functions() [F] - CRYPTO_dbg_set_options() [F] - CRYPTO_dbg_get_options() [F] - CRYPTO_malloc_debug_init() [M] - - The memory debug functions are NULL by default, unless the library - is compiled with CRYPTO_MDEBUG or friends is defined. If someone - wants to debug memory anyway, CRYPTO_malloc_debug_init() (which - gives the standard debugging functions that come with OpenSSL) or - CRYPTO_set_mem_debug_functions() (tells OpenSSL to use functions - provided by the library user) must be used. When the standard - debugging functions are used, CRYPTO_dbg_set_options can be used to - request additional information: - CRYPTO_dbg_set_options(V_CYRPTO_MDEBUG_xxx) corresponds to setting - the CRYPTO_MDEBUG_xxx macro when compiling the library. - - Also, things like CRYPTO_set_mem_functions will always give the - expected result (the new set of functions is used for allocation - and deallocation) at all times, regardless of platform and compiler - options. - - To finish it up, some functions that were never use in any other - way than through macros have a new API and new semantic: - - CRYPTO_dbg_malloc() - CRYPTO_dbg_realloc() - CRYPTO_dbg_free() - - All macros of value have retained their old syntax. - [Richard Levitte and Bodo Moeller] - - *) Some S/MIME fixes. The OID for SMIMECapabilities was wrong, the - ordering of SMIMECapabilities wasn't in "strength order" and there - was a missing NULL in the AlgorithmIdentifier for the SHA1 signature - algorithm. - [Steve Henson] - - *) Some ASN1 types with illegal zero length encoding (INTEGER, - ENUMERATED and OBJECT IDENTIFIER) choked the ASN1 routines. - [Frans Heymans , modified by Steve Henson] - - *) Merge in my S/MIME library for OpenSSL. This provides a simple - S/MIME API on top of the PKCS#7 code, a MIME parser (with enough - functionality to handle multipart/signed properly) and a utility - called 'smime' to call all this stuff. This is based on code I - originally wrote for Celo who have kindly allowed it to be - included in OpenSSL. - [Steve Henson] - - *) Add variants des_set_key_checked and des_set_key_unchecked of - des_set_key (aka des_key_sched). Global variable des_check_key - decides which of these is called by des_set_key; this way - des_check_key behaves as it always did, but applications and - the library itself, which was buggy for des_check_key == 1, - have a cleaner way to pick the version they need. - [Bodo Moeller] - - *) New function PKCS12_newpass() which changes the password of a - PKCS12 structure. - [Steve Henson] - - *) Modify X509_TRUST and X509_PURPOSE so it also uses a static and - dynamic mix. In both cases the ids can be used as an index into the - table. Also modified the X509_TRUST_add() and X509_PURPOSE_add() - functions so they accept a list of the field values and the - application doesn't need to directly manipulate the X509_TRUST - structure. - [Steve Henson] - - *) Modify the ASN1_STRING_TABLE stuff so it also uses bsearch and doesn't - need initialising. - [Steve Henson] - - *) Modify the way the V3 extension code looks up extensions. This now - works in a similar way to the object code: we have some "standard" - extensions in a static table which is searched with OBJ_bsearch() - and the application can add dynamic ones if needed. The file - crypto/x509v3/ext_dat.h now has the info: this file needs to be - updated whenever a new extension is added to the core code and kept - in ext_nid order. There is a simple program 'tabtest.c' which checks - this. New extensions are not added too often so this file can readily - be maintained manually. - - There are two big advantages in doing things this way. The extensions - can be looked up immediately and no longer need to be "added" using - X509V3_add_standard_extensions(): this function now does nothing. - [Side note: I get *lots* of email saying the extension code doesn't - work because people forget to call this function] - Also no dynamic allocation is done unless new extensions are added: - so if we don't add custom extensions there is no need to call - X509V3_EXT_cleanup(). - [Steve Henson] - - *) Modify enc utility's salting as follows: make salting the default. Add a - magic header, so unsalted files fail gracefully instead of just decrypting - to garbage. This is because not salting is a big security hole, so people - should be discouraged from doing it. - [Ben Laurie] - - *) Fixes and enhancements to the 'x509' utility. It allowed a message - digest to be passed on the command line but it only used this - parameter when signing a certificate. Modified so all relevant - operations are affected by the digest parameter including the - -fingerprint and -x509toreq options. Also -x509toreq choked if a - DSA key was used because it didn't fix the digest. - [Steve Henson] - - *) Initial certificate chain verify code. Currently tests the untrusted - certificates for consistency with the verify purpose (which is set - when the X509_STORE_CTX structure is set up) and checks the pathlength. - - There is a NO_CHAIN_VERIFY compilation option to keep the old behaviour: - this is because it will reject chains with invalid extensions whereas - every previous version of OpenSSL and SSLeay made no checks at all. - - Trust code: checks the root CA for the relevant trust settings. Trust - settings have an initial value consistent with the verify purpose: e.g. - if the verify purpose is for SSL client use it expects the CA to be - trusted for SSL client use. However the default value can be changed to - permit custom trust settings: one example of this would be to only trust - certificates from a specific "secure" set of CAs. - - Also added X509_STORE_CTX_new() and X509_STORE_CTX_free() functions - which should be used for version portability: especially since the - verify structure is likely to change more often now. - - SSL integration. Add purpose and trust to SSL_CTX and SSL and functions - to set them. If not set then assume SSL clients will verify SSL servers - and vice versa. - - Two new options to the verify program: -untrusted allows a set of - untrusted certificates to be passed in and -purpose which sets the - intended purpose of the certificate. If a purpose is set then the - new chain verify code is used to check extension consistency. - [Steve Henson] - - *) Support for the authority information access extension. - [Steve Henson] - - *) Modify RSA and DSA PEM read routines to transparently handle - PKCS#8 format private keys. New *_PUBKEY_* functions that handle - public keys in a format compatible with certificate - SubjectPublicKeyInfo structures. Unfortunately there were already - functions called *_PublicKey_* which used various odd formats so - these are retained for compatibility: however the DSA variants were - never in a public release so they have been deleted. Changed dsa/rsa - utilities to handle the new format: note no releases ever handled public - keys so we should be OK. - - The primary motivation for this change is to avoid the same fiasco - that dogs private keys: there are several incompatible private key - formats some of which are standard and some OpenSSL specific and - require various evil hacks to allow partial transparent handling and - even then it doesn't work with DER formats. Given the option anything - other than PKCS#8 should be dumped: but the other formats have to - stay in the name of compatibility. - - With public keys and the benefit of hindsight one standard format - is used which works with EVP_PKEY, RSA or DSA structures: though - it clearly returns an error if you try to read the wrong kind of key. - - Added a -pubkey option to the 'x509' utility to output the public key. - Also rename the EVP_PKEY_get_*() to EVP_PKEY_rget_*() - (renamed to EVP_PKEY_get1_*() in the OpenSSL 0.9.5 release) and add - EVP_PKEY_rset_*() functions (renamed to EVP_PKEY_set1_*()) - that do the same as the EVP_PKEY_assign_*() except they up the - reference count of the added key (they don't "swallow" the - supplied key). - [Steve Henson] - - *) Fixes to crypto/x509/by_file.c the code to read in certificates and - CRLs would fail if the file contained no certificates or no CRLs: - added a new function to read in both types and return the number - read: this means that if none are read it will be an error. The - DER versions of the certificate and CRL reader would always fail - because it isn't possible to mix certificates and CRLs in DER format - without choking one or the other routine. Changed this to just read - a certificate: this is the best we can do. Also modified the code - in apps/verify.c to take notice of return codes: it was previously - attempting to read in certificates from NULL pointers and ignoring - any errors: this is one reason why the cert and CRL reader seemed - to work. It doesn't check return codes from the default certificate - routines: these may well fail if the certificates aren't installed. - [Steve Henson] - - *) Code to support otherName option in GeneralName. - [Steve Henson] - - *) First update to verify code. Change the verify utility - so it warns if it is passed a self signed certificate: - for consistency with the normal behaviour. X509_verify - has been modified to it will now verify a self signed - certificate if *exactly* the same certificate appears - in the store: it was previously impossible to trust a - single self signed certificate. This means that: - openssl verify ss.pem - now gives a warning about a self signed certificate but - openssl verify -CAfile ss.pem ss.pem - is OK. - [Steve Henson] - - *) For servers, store verify_result in SSL_SESSION data structure - (and add it to external session representation). - This is needed when client certificate verifications fails, - but an application-provided verification callback (set by - SSL_CTX_set_cert_verify_callback) allows accepting the session - anyway (i.e. leaves x509_store_ctx->error != X509_V_OK - but returns 1): When the session is reused, we have to set - ssl->verify_result to the appropriate error code to avoid - security holes. - [Bodo Moeller, problem pointed out by Lutz Jaenicke] - - *) Fix a bug in the new PKCS#7 code: it didn't consider the - case in PKCS7_dataInit() where the signed PKCS7 structure - didn't contain any existing data because it was being created. - [Po-Cheng Chen , slightly modified by Steve Henson] - - *) Add a salt to the key derivation routines in enc.c. This - forms the first 8 bytes of the encrypted file. Also add a - -S option to allow a salt to be input on the command line. - [Steve Henson] - - *) New function X509_cmp(). Oddly enough there wasn't a function - to compare two certificates. We do this by working out the SHA1 - hash and comparing that. X509_cmp() will be needed by the trust - code. - [Steve Henson] - - *) SSL_get1_session() is like SSL_get_session(), but increments - the reference count in the SSL_SESSION returned. - [Geoff Thorpe ] - - *) Fix for 'req': it was adding a null to request attributes. - Also change the X509_LOOKUP and X509_INFO code to handle - certificate auxiliary information. - [Steve Henson] - - *) Add support for 40 and 64 bit RC2 and RC4 algorithms: document - the 'enc' command. - [Steve Henson] - - *) Add the possibility to add extra information to the memory leak - detecting output, to form tracebacks, showing from where each - allocation was originated: CRYPTO_push_info("constant string") adds - the string plus current file name and line number to a per-thread - stack, CRYPTO_pop_info() does the obvious, CRYPTO_remove_all_info() - is like calling CYRPTO_pop_info() until the stack is empty. - Also updated memory leak detection code to be multi-thread-safe. - [Richard Levitte] - - *) Add options -text and -noout to pkcs7 utility and delete the - encryption options which never did anything. Update docs. - [Steve Henson] - - *) Add options to some of the utilities to allow the pass phrase - to be included on either the command line (not recommended on - OSes like Unix) or read from the environment. Update the - manpages and fix a few bugs. - [Steve Henson] - - *) Add a few manpages for some of the openssl commands. - [Steve Henson] - - *) Fix the -revoke option in ca. It was freeing up memory twice, - leaking and not finding already revoked certificates. - [Steve Henson] - - *) Extensive changes to support certificate auxiliary information. - This involves the use of X509_CERT_AUX structure and X509_AUX - functions. An X509_AUX function such as PEM_read_X509_AUX() - can still read in a certificate file in the usual way but it - will also read in any additional "auxiliary information". By - doing things this way a fair degree of compatibility can be - retained: existing certificates can have this information added - using the new 'x509' options. - - Current auxiliary information includes an "alias" and some trust - settings. The trust settings will ultimately be used in enhanced - certificate chain verification routines: currently a certificate - can only be trusted if it is self signed and then it is trusted - for all purposes. - [Steve Henson] - - *) Fix assembler for Alpha (tested only on DEC OSF not Linux or *BSD). - The problem was that one of the replacement routines had not been working - since SSLeay releases. For now the offending routine has been replaced - with non-optimised assembler. Even so, this now gives around 95% - performance improvement for 1024 bit RSA signs. - [Mark Cox] - - *) Hack to fix PKCS#7 decryption when used with some unorthodox RC2 - handling. Most clients have the effective key size in bits equal to - the key length in bits: so a 40 bit RC2 key uses a 40 bit (5 byte) key. - A few however don't do this and instead use the size of the decrypted key - to determine the RC2 key length and the AlgorithmIdentifier to determine - the effective key length. In this case the effective key length can still - be 40 bits but the key length can be 168 bits for example. This is fixed - by manually forcing an RC2 key into the EVP_PKEY structure because the - EVP code can't currently handle unusual RC2 key sizes: it always assumes - the key length and effective key length are equal. - [Steve Henson] - - *) Add a bunch of functions that should simplify the creation of - X509_NAME structures. Now you should be able to do: - X509_NAME_add_entry_by_txt(nm, "CN", MBSTRING_ASC, "Steve", -1, -1, 0); - and have it automatically work out the correct field type and fill in - the structures. The more adventurous can try: - X509_NAME_add_entry_by_txt(nm, field, MBSTRING_UTF8, str, -1, -1, 0); - and it will (hopefully) work out the correct multibyte encoding. - [Steve Henson] - - *) Change the 'req' utility to use the new field handling and multibyte - copy routines. Before the DN field creation was handled in an ad hoc - way in req, ca, and x509 which was rather broken and didn't support - BMPStrings or UTF8Strings. Since some software doesn't implement - BMPStrings or UTF8Strings yet, they can be enabled using the config file - using the dirstring_type option. See the new comment in the default - openssl.cnf for more info. - [Steve Henson] - - *) Make crypto/rand/md_rand.c more robust: - - Assure unique random numbers after fork(). - - Make sure that concurrent threads access the global counter and - md serializably so that we never lose entropy in them - or use exactly the same state in multiple threads. - Access to the large state is not always serializable because - the additional locking could be a performance killer, and - md should be large enough anyway. - [Bodo Moeller] - - *) New file apps/app_rand.c with commonly needed functionality - for handling the random seed file. - - Use the random seed file in some applications that previously did not: - ca, - dsaparam -genkey (which also ignored its '-rand' option), - s_client, - s_server, - x509 (when signing). - Except on systems with /dev/urandom, it is crucial to have a random - seed file at least for key creation, DSA signing, and for DH exchanges; - for RSA signatures we could do without one. - - gendh and gendsa (unlike genrsa) used to read only the first byte - of each file listed in the '-rand' option. The function as previously - found in genrsa is now in app_rand.c and is used by all programs - that support '-rand'. - [Bodo Moeller] - - *) In RAND_write_file, use mode 0600 for creating files; - don't just chmod when it may be too late. - [Bodo Moeller] - - *) Report an error from X509_STORE_load_locations - when X509_LOOKUP_load_file or X509_LOOKUP_add_dir failed. - [Bill Perry] - - *) New function ASN1_mbstring_copy() this copies a string in either - ASCII, Unicode, Universal (4 bytes per character) or UTF8 format - into an ASN1_STRING type. A mask of permissible types is passed - and it chooses the "minimal" type to use or an error if not type - is suitable. - [Steve Henson] - - *) Add function equivalents to the various macros in asn1.h. The old - macros are retained with an M_ prefix. Code inside the library can - use the M_ macros. External code (including the openssl utility) - should *NOT* in order to be "shared library friendly". - [Steve Henson] - - *) Add various functions that can check a certificate's extensions - to see if it usable for various purposes such as SSL client, - server or S/MIME and CAs of these types. This is currently - VERY EXPERIMENTAL but will ultimately be used for certificate chain - verification. Also added a -purpose flag to x509 utility to - print out all the purposes. - [Steve Henson] - - *) Add a CRYPTO_EX_DATA to X509 certificate structure and associated - functions. - [Steve Henson] - - *) New X509V3_{X509,CRL,REVOKED}_get_d2i() functions. These will search - for, obtain and decode and extension and obtain its critical flag. - This allows all the necessary extension code to be handled in a - single function call. - [Steve Henson] - - *) RC4 tune-up featuring 30-40% performance improvement on most RISC - platforms. See crypto/rc4/rc4_enc.c for further details. - [Andy Polyakov] - - *) New -noout option to asn1parse. This causes no output to be produced - its main use is when combined with -strparse and -out to extract data - from a file (which may not be in ASN.1 format). - [Steve Henson] - - *) Fix for pkcs12 program. It was hashing an invalid certificate pointer - when producing the local key id. - [Richard Levitte ] - - *) New option -dhparam in s_server. This allows a DH parameter file to be - stated explicitly. If it is not stated then it tries the first server - certificate file. The previous behaviour hard coded the filename - "server.pem". - [Steve Henson] - - *) Add -pubin and -pubout options to the rsa and dsa commands. These allow - a public key to be input or output. For example: - openssl rsa -in key.pem -pubout -out pubkey.pem - Also added necessary DSA public key functions to handle this. - [Steve Henson] - - *) Fix so PKCS7_dataVerify() doesn't crash if no certificates are contained - in the message. This was handled by allowing - X509_find_by_issuer_and_serial() to tolerate a NULL passed to it. - [Steve Henson, reported by Sampo Kellomaki ] - - *) Fix for bug in d2i_ASN1_bytes(): other ASN1 functions add an extra null - to the end of the strings whereas this didn't. This would cause problems - if strings read with d2i_ASN1_bytes() were later modified. - [Steve Henson, reported by Arne Ansper ] - - *) Fix for base64 decode bug. When a base64 bio reads only one line of - data and it contains EOF it will end up returning an error. This is - caused by input 46 bytes long. The cause is due to the way base64 - BIOs find the start of base64 encoded data. They do this by trying a - trial decode on each line until they find one that works. When they - do a flag is set and it starts again knowing it can pass all the - data directly through the decoder. Unfortunately it doesn't reset - the context it uses. This means that if EOF is reached an attempt - is made to pass two EOFs through the context and this causes the - resulting error. This can also cause other problems as well. As is - usual with these problems it takes *ages* to find and the fix is - trivial: move one line. - [Steve Henson, reported by ian@uns.ns.ac.yu (Ivan Nejgebauer) ] - - *) Ugly workaround to get s_client and s_server working under Windows. The - old code wouldn't work because it needed to select() on sockets and the - tty (for keypresses and to see if data could be written). Win32 only - supports select() on sockets so we select() with a 1s timeout on the - sockets and then see if any characters are waiting to be read, if none - are present then we retry, we also assume we can always write data to - the tty. This isn't nice because the code then blocks until we've - received a complete line of data and it is effectively polling the - keyboard at 1s intervals: however it's quite a bit better than not - working at all :-) A dedicated Windows application might handle this - with an event loop for example. - [Steve Henson] - - *) Enhance RSA_METHOD structure. Now there are two extra methods, rsa_sign - and rsa_verify. When the RSA_FLAGS_SIGN_VER option is set these functions - will be called when RSA_sign() and RSA_verify() are used. This is useful - if rsa_pub_dec() and rsa_priv_enc() equivalents are not available. - For this to work properly RSA_public_decrypt() and RSA_private_encrypt() - should *not* be used: RSA_sign() and RSA_verify() must be used instead. - This necessitated the support of an extra signature type NID_md5_sha1 - for SSL signatures and modifications to the SSL library to use it instead - of calling RSA_public_decrypt() and RSA_private_encrypt(). - [Steve Henson] - - *) Add new -verify -CAfile and -CApath options to the crl program, these - will lookup a CRL issuers certificate and verify the signature in a - similar way to the verify program. Tidy up the crl program so it - no longer accesses structures directly. Make the ASN1 CRL parsing a bit - less strict. It will now permit CRL extensions even if it is not - a V2 CRL: this will allow it to tolerate some broken CRLs. - [Steve Henson] - - *) Initialize all non-automatic variables each time one of the openssl - sub-programs is started (this is necessary as they may be started - multiple times from the "OpenSSL>" prompt). - [Lennart Bang, Bodo Moeller] - - *) Preliminary compilation option RSA_NULL which disables RSA crypto without - removing all other RSA functionality (this is what NO_RSA does). This - is so (for example) those in the US can disable those operations covered - by the RSA patent while allowing storage and parsing of RSA keys and RSA - key generation. - [Steve Henson] - - *) Non-copying interface to BIO pairs. - (still largely untested) - [Bodo Moeller] - - *) New function ANS1_tag2str() to convert an ASN1 tag to a descriptive - ASCII string. This was handled independently in various places before. - [Steve Henson] - - *) New functions UTF8_getc() and UTF8_putc() that parse and generate - UTF8 strings a character at a time. - [Steve Henson] - - *) Use client_version from client hello to select the protocol - (s23_srvr.c) and for RSA client key exchange verification - (s3_srvr.c), as required by the SSL 3.0/TLS 1.0 specifications. - [Bodo Moeller] - - *) Add various utility functions to handle SPKACs, these were previously - handled by poking round in the structure internals. Added new function - NETSCAPE_SPKI_print() to print out SPKAC and a new utility 'spkac' to - print, verify and generate SPKACs. Based on an original idea from - Massimiliano Pala but extensively modified. - [Steve Henson] - - *) RIPEMD160 is operational on all platforms and is back in 'make test'. - [Andy Polyakov] - - *) Allow the config file extension section to be overwritten on the - command line. Based on an original idea from Massimiliano Pala - . The new option is called -extensions - and can be applied to ca, req and x509. Also -reqexts to override - the request extensions in req and -crlexts to override the crl extensions - in ca. - [Steve Henson] - - *) Add new feature to the SPKAC handling in ca. Now you can include - the same field multiple times by preceding it by "XXXX." for example: - 1.OU="Unit name 1" - 2.OU="Unit name 2" - this is the same syntax as used in the req config file. - [Steve Henson] - - *) Allow certificate extensions to be added to certificate requests. These - are specified in a 'req_extensions' option of the req section of the - config file. They can be printed out with the -text option to req but - are otherwise ignored at present. - [Steve Henson] - - *) Fix a horrible bug in enc_read() in crypto/evp/bio_enc.c: if the first - data read consists of only the final block it would not decrypted because - EVP_CipherUpdate() would correctly report zero bytes had been decrypted. - A misplaced 'break' also meant the decrypted final block might not be - copied until the next read. - [Steve Henson] - - *) Initial support for DH_METHOD. Again based on RSA_METHOD. Also added - a few extra parameters to the DH structure: these will be useful if - for example we want the value of 'q' or implement X9.42 DH. - [Steve Henson] - - *) Initial support for DSA_METHOD. This is based on the RSA_METHOD and - provides hooks that allow the default DSA functions or functions on a - "per key" basis to be replaced. This allows hardware acceleration and - hardware key storage to be handled without major modification to the - library. Also added low level modexp hooks and CRYPTO_EX structure and - associated functions. - [Steve Henson] - - *) Add a new flag to memory BIOs, BIO_FLAG_MEM_RDONLY. This marks the BIO - as "read only": it can't be written to and the buffer it points to will - not be freed. Reading from a read only BIO is much more efficient than - a normal memory BIO. This was added because there are several times when - an area of memory needs to be read from a BIO. The previous method was - to create a memory BIO and write the data to it, this results in two - copies of the data and an O(n^2) reading algorithm. There is a new - function BIO_new_mem_buf() which creates a read only memory BIO from - an area of memory. Also modified the PKCS#7 routines to use read only - memory BIOs. - [Steve Henson] - - *) Bugfix: ssl23_get_client_hello did not work properly when called in - state SSL23_ST_SR_CLNT_HELLO_B, i.e. when the first 7 bytes of - a SSLv2-compatible client hello for SSLv3 or TLSv1 could be read, - but a retry condition occured while trying to read the rest. - [Bodo Moeller] - - *) The PKCS7_ENC_CONTENT_new() function was setting the content type as - NID_pkcs7_encrypted by default: this was wrong since this should almost - always be NID_pkcs7_data. Also modified the PKCS7_set_type() to handle - the encrypted data type: this is a more sensible place to put it and it - allows the PKCS#12 code to be tidied up that duplicated this - functionality. - [Steve Henson] - - *) Changed obj_dat.pl script so it takes its input and output files on - the command line. This should avoid shell escape redirection problems - under Win32. - [Steve Henson] - - *) Initial support for certificate extension requests, these are included - in things like Xenroll certificate requests. Included functions to allow - extensions to be obtained and added. - [Steve Henson] - - *) -crlf option to s_client and s_server for sending newlines as - CRLF (as required by many protocols). - [Bodo Moeller] - - Changes between 0.9.3a and 0.9.4 [09 Aug 1999] - - *) Install libRSAglue.a when OpenSSL is built with RSAref. - [Ralf S. Engelschall] - - *) A few more ``#ifndef NO_FP_API / #endif'' pairs for consistency. - [Andrija Antonijevic ] - - *) Fix -startdate and -enddate (which was missing) arguments to 'ca' - program. - [Steve Henson] - - *) New function DSA_dup_DH, which duplicates DSA parameters/keys as - DH parameters/keys (q is lost during that conversion, but the resulting - DH parameters contain its length). - - For 1024-bit p, DSA_generate_parameters followed by DSA_dup_DH is - much faster than DH_generate_parameters (which creates parameters - where p = 2*q + 1), and also the smaller q makes DH computations - much more efficient (160-bit exponentiation instead of 1024-bit - exponentiation); so this provides a convenient way to support DHE - ciphersuites in SSL/TLS servers (see ssl/ssltest.c). It is of - utter importance to use - SSL_CTX_set_options(s_ctx, SSL_OP_SINGLE_DH_USE); - or - SSL_set_options(s_ctx, SSL_OP_SINGLE_DH_USE); - when such DH parameters are used, because otherwise small subgroup - attacks may become possible! - [Bodo Moeller] - - *) Avoid memory leak in i2d_DHparams. - [Bodo Moeller] - - *) Allow the -k option to be used more than once in the enc program: - this allows the same encrypted message to be read by multiple recipients. - [Steve Henson] - - *) New function OBJ_obj2txt(buf, buf_len, a, no_name), this converts - an ASN1_OBJECT to a text string. If the "no_name" parameter is set then - it will always use the numerical form of the OID, even if it has a short - or long name. - [Steve Henson] - - *) Added an extra RSA flag: RSA_FLAG_EXT_PKEY. Previously the rsa_mod_exp - method only got called if p,q,dmp1,dmq1,iqmp components were present, - otherwise bn_mod_exp was called. In the case of hardware keys for example - no private key components need be present and it might store extra data - in the RSA structure, which cannot be accessed from bn_mod_exp. - By setting RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for - private key operations. - [Steve Henson] - - *) Added support for SPARC Linux. - [Andy Polyakov] - - *) pem_password_cb function type incompatibly changed from - typedef int pem_password_cb(char *buf, int size, int rwflag); - to - ....(char *buf, int size, int rwflag, void *userdata); - so that applications can pass data to their callbacks: - The PEM[_ASN1]_{read,write}... functions and macros now take an - additional void * argument, which is just handed through whenever - the password callback is called. - [Damien Miller ; tiny changes by Bodo Moeller] - - New function SSL_CTX_set_default_passwd_cb_userdata. - - Compatibility note: As many C implementations push function arguments - onto the stack in reverse order, the new library version is likely to - interoperate with programs that have been compiled with the old - pem_password_cb definition (PEM_whatever takes some data that - happens to be on the stack as its last argument, and the callback - just ignores this garbage); but there is no guarantee whatsoever that - this will work. - - *) The -DPLATFORM="\"$(PLATFORM)\"" definition and the similar -DCFLAGS=... - (both in crypto/Makefile.ssl for use by crypto/cversion.c) caused - problems not only on Windows, but also on some Unix platforms. - To avoid problematic command lines, these definitions are now in an - auto-generated file crypto/buildinf.h (created by crypto/Makefile.ssl - for standard "make" builds, by util/mk1mf.pl for "mk1mf" builds). - [Bodo Moeller] - - *) MIPS III/IV assembler module is reimplemented. - [Andy Polyakov] - - *) More DES library cleanups: remove references to srand/rand and - delete an unused file. - [Ulf Möller] - - *) Add support for the the free Netwide assembler (NASM) under Win32, - since not many people have MASM (ml) and it can be hard to obtain. - This is currently experimental but it seems to work OK and pass all - the tests. Check out INSTALL.W32 for info. - [Steve Henson] - - *) Fix memory leaks in s3_clnt.c: All non-anonymous SSL3/TLS1 connections - without temporary keys kept an extra copy of the server key, - and connections with temporary keys did not free everything in case - of an error. - [Bodo Moeller] - - *) New function RSA_check_key and new openssl rsa option -check - for verifying the consistency of RSA keys. - [Ulf Moeller, Bodo Moeller] - - *) Various changes to make Win32 compile work: - 1. Casts to avoid "loss of data" warnings in p5_crpt2.c - 2. Change unsigned int to int in b_dump.c to avoid "signed/unsigned - comparison" warnings. - 3. Add sk__sort to DEF file generator and do make update. - [Steve Henson] - - *) Add a debugging option to PKCS#5 v2 key generation function: when - you #define DEBUG_PKCS5V2 passwords, salts, iteration counts and - derived keys are printed to stderr. - [Steve Henson] - - *) Copy the flags in ASN1_STRING_dup(). - [Roman E. Pavlov ] - - *) The x509 application mishandled signing requests containing DSA - keys when the signing key was also DSA and the parameters didn't match. - - It was supposed to omit the parameters when they matched the signing key: - the verifying software was then supposed to automatically use the CA's - parameters if they were absent from the end user certificate. - - Omitting parameters is no longer recommended. The test was also - the wrong way round! This was probably due to unusual behaviour in - EVP_cmp_parameters() which returns 1 if the parameters match. - This meant that parameters were omitted when they *didn't* match and - the certificate was useless. Certificates signed with 'ca' didn't have - this bug. - [Steve Henson, reported by Doug Erickson ] - - *) Memory leak checking (-DCRYPTO_MDEBUG) had some problems. - The interface is as follows: - Applications can use - CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ON) aka MemCheck_start(), - CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_OFF) aka MemCheck_stop(); - "off" is now the default. - The library internally uses - CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_DISABLE) aka MemCheck_off(), - CRYPTO_mem_ctrl(CRYPTO_MEM_CHECK_ENABLE) aka MemCheck_on() - to disable memory-checking temporarily. - - Some inconsistent states that previously were possible (and were - even the default) are now avoided. - - -DCRYPTO_MDEBUG_TIME is new and additionally stores the current time - with each memory chunk allocated; this is occasionally more helpful - than just having a counter. - - -DCRYPTO_MDEBUG_THREAD is also new and adds the thread ID. - - -DCRYPTO_MDEBUG_ALL enables all of the above, plus any future - extensions. - [Bodo Moeller] - - *) Introduce "mode" for SSL structures (with defaults in SSL_CTX), - which largely parallels "options", but is for changing API behaviour, - whereas "options" are about protocol behaviour. - Initial "mode" flags are: - - SSL_MODE_ENABLE_PARTIAL_WRITE Allow SSL_write to report success when - a single record has been written. - SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER Don't insist that SSL_write - retries use the same buffer location. - (But all of the contents must be - copied!) - [Bodo Moeller] - - *) Bugfix: SSL_set_mode ignored its parameter, only SSL_CTX_set_mode - worked. - - *) Fix problems with no-hmac etc. - [Ulf Möller, pointed out by Brian Wellington ] - - *) New functions RSA_get_default_method(), RSA_set_method() and - RSA_get_method(). These allows replacement of RSA_METHODs without having - to mess around with the internals of an RSA structure. - [Steve Henson] - - *) Fix memory leaks in DSA_do_sign and DSA_is_prime. - Also really enable memory leak checks in openssl.c and in some - test programs. - [Chad C. Mulligan, Bodo Moeller] - - *) Fix a bug in d2i_ASN1_INTEGER() and i2d_ASN1_INTEGER() which can mess - up the length of negative integers. This has now been simplified to just - store the length when it is first determined and use it later, rather - than trying to keep track of where data is copied and updating it to - point to the end. - [Steve Henson, reported by Brien Wheeler - ] - - *) Add a new function PKCS7_signatureVerify. This allows the verification - of a PKCS#7 signature but with the signing certificate passed to the - function itself. This contrasts with PKCS7_dataVerify which assumes the - certificate is present in the PKCS#7 structure. This isn't always the - case: certificates can be omitted from a PKCS#7 structure and be - distributed by "out of band" means (such as a certificate database). - [Steve Henson] - - *) Complete the PEM_* macros with DECLARE_PEM versions to replace the - function prototypes in pem.h, also change util/mkdef.pl to add the - necessary function names. - [Steve Henson] - - *) mk1mf.pl (used by Windows builds) did not properly read the - options set by Configure in the top level Makefile, and Configure - was not even able to write more than one option correctly. - Fixed, now "no-idea no-rc5 -DCRYPTO_MDEBUG" etc. works as intended. - [Bodo Moeller] - - *) New functions CONF_load_bio() and CONF_load_fp() to allow a config - file to be loaded from a BIO or FILE pointer. The BIO version will - for example allow memory BIOs to contain config info. - [Steve Henson] - - *) New function "CRYPTO_num_locks" that returns CRYPTO_NUM_LOCKS. - Whoever hopes to achieve shared-library compatibility across versions - must use this, not the compile-time macro. - (Exercise 0.9.4: Which is the minimum library version required by - such programs?) - Note: All this applies only to multi-threaded programs, others don't - need locks. - [Bodo Moeller] - - *) Add missing case to s3_clnt.c state machine -- one of the new SSL tests - through a BIO pair triggered the default case, i.e. - SSLerr(...,SSL_R_UNKNOWN_STATE). - [Bodo Moeller] - - *) New "BIO pair" concept (crypto/bio/bss_bio.c) so that applications - can use the SSL library even if none of the specific BIOs is - appropriate. - [Bodo Moeller] - - *) Fix a bug in i2d_DSAPublicKey() which meant it returned the wrong value - for the encoded length. - [Jeon KyoungHo ] - - *) Add initial documentation of the X509V3 functions. - [Steve Henson] - - *) Add a new pair of functions PEM_write_PKCS8PrivateKey() and - PEM_write_bio_PKCS8PrivateKey() that are equivalent to - PEM_write_PrivateKey() and PEM_write_bio_PrivateKey() but use the more - secure PKCS#8 private key format with a high iteration count. - [Steve Henson] - - *) Fix determination of Perl interpreter: A perl or perl5 - _directory_ in $PATH was also accepted as the interpreter. - [Ralf S. Engelschall] - - *) Fix demos/sign/sign.c: well there wasn't anything strictly speaking - wrong with it but it was very old and did things like calling - PEM_ASN1_read() directly and used MD5 for the hash not to mention some - unusual formatting. - [Steve Henson] - - *) Fix demos/selfsign.c: it used obsolete and deleted functions, changed - to use the new extension code. - [Steve Henson] - - *) Implement the PEM_read/PEM_write functions in crypto/pem/pem_all.c - with macros. This should make it easier to change their form, add extra - arguments etc. Fix a few PEM prototypes which didn't have cipher as a - constant. - [Steve Henson] - - *) Add to configuration table a new entry that can specify an alternative - name for unistd.h (for pre-POSIX systems); we need this for NeXTstep, - according to Mark Crispin . - [Bodo Moeller] - -#if 0 - *) DES CBC did not update the IV. Weird. - [Ben Laurie] -#else - des_cbc_encrypt does not update the IV, but des_ncbc_encrypt does. - Changing the behaviour of the former might break existing programs -- - where IV updating is needed, des_ncbc_encrypt can be used. -#endif - - *) When bntest is run from "make test" it drives bc to check its - calculations, as well as internally checking them. If an internal check - fails, it needs to cause bc to give a non-zero result or make test carries - on without noticing the failure. Fixed. - [Ben Laurie] - - *) DES library cleanups. - [Ulf Möller] - - *) Add support for PKCS#5 v2.0 PBE algorithms. This will permit PKCS#8 to be - used with any cipher unlike PKCS#5 v1.5 which can at most handle 64 bit - ciphers. NOTE: although the key derivation function has been verified - against some published test vectors it has not been extensively tested - yet. Added a -v2 "cipher" option to pkcs8 application to allow the use - of v2.0. - [Steve Henson] - - *) Instead of "mkdir -p", which is not fully portable, use new - Perl script "util/mkdir-p.pl". - [Bodo Moeller] - - *) Rewrite the way password based encryption (PBE) is handled. It used to - assume that the ASN1 AlgorithmIdentifier parameter was a PBEParameter - structure. This was true for the PKCS#5 v1.5 and PKCS#12 PBE algorithms - but doesn't apply to PKCS#5 v2.0 where it can be something else. Now - the 'parameter' field of the AlgorithmIdentifier is passed to the - underlying key generation function so it must do its own ASN1 parsing. - This has also changed the EVP_PBE_CipherInit() function which now has a - 'parameter' argument instead of literal salt and iteration count values - and the function EVP_PBE_ALGOR_CipherInit() has been deleted. - [Steve Henson] - - *) Support for PKCS#5 v1.5 compatible password based encryption algorithms - and PKCS#8 functionality. New 'pkcs8' application linked to openssl. - Needed to change the PEM_STRING_EVP_PKEY value which was just "PRIVATE - KEY" because this clashed with PKCS#8 unencrypted string. Since this - value was just used as a "magic string" and not used directly its - value doesn't matter. - [Steve Henson] - - *) Introduce some semblance of const correctness to BN. Shame C doesn't - support mutable. - [Ben Laurie] - - *) "linux-sparc64" configuration (ultrapenguin). - [Ray Miller ] - "linux-sparc" configuration. - [Christian Forster ] - - *) config now generates no-xxx options for missing ciphers. - [Ulf Möller] - - *) Support the EBCDIC character set (work in progress). - File ebcdic.c not yet included because it has a different license. - [Martin Kraemer ] - - *) Support BS2000/OSD-POSIX. - [Martin Kraemer ] - - *) Make callbacks for key generation use void * instead of char *. - [Ben Laurie] - - *) Make S/MIME samples compile (not yet tested). - [Ben Laurie] - - *) Additional typesafe stacks. - [Ben Laurie] - - *) New configuration variants "bsdi-elf-gcc" (BSD/OS 4.x). - [Bodo Moeller] - - - Changes between 0.9.3 and 0.9.3a [29 May 1999] - - *) New configuration variant "sco5-gcc". - - *) Updated some demos. - [Sean O Riordain, Wade Scholine] - - *) Add missing BIO_free at exit of pkcs12 application. - [Wu Zhigang] - - *) Fix memory leak in conf.c. - [Steve Henson] - - *) Updates for Win32 to assembler version of MD5. - [Steve Henson] - - *) Set #! path to perl in apps/der_chop to where we found it - instead of using a fixed path. - [Bodo Moeller] - - *) SHA library changes for irix64-mips4-cc. - [Andy Polyakov] - - *) Improvements for VMS support. - [Richard Levitte] - - - Changes between 0.9.2b and 0.9.3 [24 May 1999] - - *) Bignum library bug fix. IRIX 6 passes "make test" now! - This also avoids the problems with SC4.2 and unpatched SC5. - [Andy Polyakov ] - - *) New functions sk_num, sk_value and sk_set to replace the previous macros. - These are required because of the typesafe stack would otherwise break - existing code. If old code used a structure member which used to be STACK - and is now STACK_OF (for example cert in a PKCS7_SIGNED structure) with - sk_num or sk_value it would produce an error because the num, data members - are not present in STACK_OF. Now it just produces a warning. sk_set - replaces the old method of assigning a value to sk_value - (e.g. sk_value(x, i) = y) which the library used in a few cases. Any code - that does this will no longer work (and should use sk_set instead) but - this could be regarded as a "questionable" behaviour anyway. - [Steve Henson] - - *) Fix most of the other PKCS#7 bugs. The "experimental" code can now - correctly handle encrypted S/MIME data. - [Steve Henson] - - *) Change type of various DES function arguments from des_cblock - (which means, in function argument declarations, pointer to char) - to des_cblock * (meaning pointer to array with 8 char elements), - which allows the compiler to do more typechecking; it was like - that back in SSLeay, but with lots of ugly casts. - - Introduce new type const_des_cblock. - [Bodo Moeller] - - *) Reorganise the PKCS#7 library and get rid of some of the more obvious - problems: find RecipientInfo structure that matches recipient certificate - and initialise the ASN1 structures properly based on passed cipher. - [Steve Henson] - - *) Belatedly make the BN tests actually check the results. - [Ben Laurie] - - *) Fix the encoding and decoding of negative ASN1 INTEGERS and conversion - to and from BNs: it was completely broken. New compilation option - NEG_PUBKEY_BUG to allow for some broken certificates that encode public - key elements as negative integers. - [Steve Henson] - - *) Reorganize and speed up MD5. - [Andy Polyakov ] - - *) VMS support. - [Richard Levitte ] - - *) New option -out to asn1parse to allow the parsed structure to be - output to a file. This is most useful when combined with the -strparse - option to examine the output of things like OCTET STRINGS. - [Steve Henson] - - *) Make SSL library a little more fool-proof by not requiring any longer - that SSL_set_{accept,connect}_state be called before - SSL_{accept,connect} may be used (SSL_set_..._state is omitted - in many applications because usually everything *appeared* to work as - intended anyway -- now it really works as intended). - [Bodo Moeller] - - *) Move openssl.cnf out of lib/. - [Ulf Möller] - - *) Fix various things to let OpenSSL even pass ``egcc -pipe -O2 -Wall - -Wshadow -Wpointer-arith -Wcast-align -Wmissing-prototypes - -Wmissing-declarations -Wnested-externs -Winline'' with EGCS 1.1.2+ - [Ralf S. Engelschall] - - *) Various fixes to the EVP and PKCS#7 code. It may now be able to - handle PKCS#7 enveloped data properly. - [Sebastian Akerman , modified by Steve] - - *) Create a duplicate of the SSL_CTX's CERT in SSL_new instead of - copying pointers. The cert_st handling is changed by this in - various ways (and thus what used to be known as ctx->default_cert - is now called ctx->cert, since we don't resort to s->ctx->[default_]cert - any longer when s->cert does not give us what we need). - ssl_cert_instantiate becomes obsolete by this change. - As soon as we've got the new code right (possibly it already is?), - we have solved a couple of bugs of the earlier code where s->cert - was used as if it could not have been shared with other SSL structures. - - Note that using the SSL API in certain dirty ways now will result - in different behaviour than observed with earlier library versions: - Changing settings for an SSL_CTX *ctx after having done s = SSL_new(ctx) - does not influence s as it used to. - - In order to clean up things more thoroughly, inside SSL_SESSION - we don't use CERT any longer, but a new structure SESS_CERT - that holds per-session data (if available); currently, this is - the peer's certificate chain and, for clients, the server's certificate - and temporary key. CERT holds only those values that can have - meaningful defaults in an SSL_CTX. - [Bodo Moeller] - - *) New function X509V3_EXT_i2d() to create an X509_EXTENSION structure - from the internal representation. Various PKCS#7 fixes: remove some - evil casts and set the enc_dig_alg field properly based on the signing - key type. - [Steve Henson] - - *) Allow PKCS#12 password to be set from the command line or the - environment. Let 'ca' get its config file name from the environment - variables "OPENSSL_CONF" or "SSLEAY_CONF" (for consistency with 'req' - and 'x509'). - [Steve Henson] - - *) Allow certificate policies extension to use an IA5STRING for the - organization field. This is contrary to the PKIX definition but - VeriSign uses it and IE5 only recognises this form. Document 'x509' - extension option. - [Steve Henson] - - *) Add PEDANTIC compiler flag to allow compilation with gcc -pedantic, - without disallowing inline assembler and the like for non-pedantic builds. - [Ben Laurie] - - *) Support Borland C++ builder. - [Janez Jere , modified by Ulf Möller] - - *) Support Mingw32. - [Ulf Möller] - - *) SHA-1 cleanups and performance enhancements. - [Andy Polyakov ] - - *) Sparc v8plus assembler for the bignum library. - [Andy Polyakov ] - - *) Accept any -xxx and +xxx compiler options in Configure. - [Ulf Möller] - - *) Update HPUX configuration. - [Anonymous] - - *) Add missing sk__unshift() function to safestack.h - [Ralf S. Engelschall] - - *) New function SSL_CTX_use_certificate_chain_file that sets the - "extra_cert"s in addition to the certificate. (This makes sense - only for "PEM" format files, as chains as a whole are not - DER-encoded.) - [Bodo Moeller] - - *) Support verify_depth from the SSL API. - x509_vfy.c had what can be considered an off-by-one-error: - Its depth (which was not part of the external interface) - was actually counting the number of certificates in a chain; - now it really counts the depth. - [Bodo Moeller] - - *) Bugfix in crypto/x509/x509_cmp.c: The SSLerr macro was used - instead of X509err, which often resulted in confusing error - messages since the error codes are not globally unique - (e.g. an alleged error in ssl3_accept when a certificate - didn't match the private key). - - *) New function SSL_CTX_set_session_id_context that allows to set a default - value (so that you don't need SSL_set_session_id_context for each - connection using the SSL_CTX). - [Bodo Moeller] - - *) OAEP decoding bug fix. - [Ulf Möller] - - *) Support INSTALL_PREFIX for package builders, as proposed by - David Harris. - [Bodo Moeller] - - *) New Configure options "threads" and "no-threads". For systems - where the proper compiler options are known (currently Solaris - and Linux), "threads" is the default. - [Bodo Moeller] - - *) New script util/mklink.pl as a faster substitute for util/mklink.sh. - [Bodo Moeller] - - *) Install various scripts to $(OPENSSLDIR)/misc, not to - $(INSTALLTOP)/bin -- they shouldn't clutter directories - such as /usr/local/bin. - [Bodo Moeller] - - *) "make linux-shared" to build shared libraries. - [Niels Poppe ] - - *) New Configure option no- (rsa, idea, rc5, ...). - [Ulf Möller] - - *) Add the PKCS#12 API documentation to openssl.txt. Preliminary support for - extension adding in x509 utility. - [Steve Henson] - - *) Remove NOPROTO sections and error code comments. - [Ulf Möller] - - *) Partial rewrite of the DEF file generator to now parse the ANSI - prototypes. - [Steve Henson] - - *) New Configure options --prefix=DIR and --openssldir=DIR. - [Ulf Möller] - - *) Complete rewrite of the error code script(s). It is all now handled - by one script at the top level which handles error code gathering, - header rewriting and C source file generation. It should be much better - than the old method: it now uses a modified version of Ulf's parser to - read the ANSI prototypes in all header files (thus the old K&R definitions - aren't needed for error creation any more) and do a better job of - translating function codes into names. The old 'ASN1 error code imbedded - in a comment' is no longer necessary and it doesn't use .err files which - have now been deleted. Also the error code call doesn't have to appear all - on one line (which resulted in some large lines...). - [Steve Henson] - - *) Change #include filenames from to . - [Bodo Moeller] - - *) Change behaviour of ssl2_read when facing length-0 packets: Don't return - 0 (which usually indicates a closed connection), but continue reading. - [Bodo Moeller] - - *) Fix some race conditions. - [Bodo Moeller] - - *) Add support for CRL distribution points extension. Add Certificate - Policies and CRL distribution points documentation. - [Steve Henson] - - *) Move the autogenerated header file parts to crypto/opensslconf.h. - [Ulf Möller] - - *) Fix new 56-bit DES export ciphersuites: they were using 7 bytes instead of - 8 of keying material. Merlin has also confirmed interop with this fix - between OpenSSL and Baltimore C/SSL 2.0 and J/SSL 2.0. - [Merlin Hughes ] - - *) Fix lots of warnings. - [Richard Levitte ] - - *) In add_cert_dir() in crypto/x509/by_dir.c, break out of the loop if - the directory spec didn't end with a LIST_SEPARATOR_CHAR. - [Richard Levitte ] - - *) Fix problems with sizeof(long) == 8. - [Andy Polyakov ] - - *) Change functions to ANSI C. - [Ulf Möller] - - *) Fix typos in error codes. - [Martin Kraemer , Ulf Möller] - - *) Remove defunct assembler files from Configure. - [Ulf Möller] - - *) SPARC v8 assembler BIGNUM implementation. - [Andy Polyakov ] - - *) Support for Certificate Policies extension: both print and set. - Various additions to support the r2i method this uses. - [Steve Henson] - - *) A lot of constification, and fix a bug in X509_NAME_oneline() that could - return a const string when you are expecting an allocated buffer. - [Ben Laurie] - - *) Add support for ASN1 types UTF8String and VISIBLESTRING, also the CHOICE - types DirectoryString and DisplayText. - [Steve Henson] - - *) Add code to allow r2i extensions to access the configuration database, - add an LHASH database driver and add several ctx helper functions. - [Steve Henson] - - *) Fix an evil bug in bn_expand2() which caused various BN functions to - fail when they extended the size of a BIGNUM. - [Steve Henson] - - *) Various utility functions to handle SXNet extension. Modify mkdef.pl to - support typesafe stack. - [Steve Henson] - - *) Fix typo in SSL_[gs]et_options(). - [Nils Frostberg ] - - *) Delete various functions and files that belonged to the (now obsolete) - old X509V3 handling code. - [Steve Henson] - - *) New Configure option "rsaref". - [Ulf Möller] - - *) Don't auto-generate pem.h. - [Bodo Moeller] - - *) Introduce type-safe ASN.1 SETs. - [Ben Laurie] - - *) Convert various additional casted stacks to type-safe STACK_OF() variants. - [Ben Laurie, Ralf S. Engelschall, Steve Henson] - - *) Introduce type-safe STACKs. This will almost certainly break lots of code - that links with OpenSSL (well at least cause lots of warnings), but fear - not: the conversion is trivial, and it eliminates loads of evil casts. A - few STACKed things have been converted already. Feel free to convert more. - In the fullness of time, I'll do away with the STACK type altogether. - [Ben Laurie] - - *) Add `openssl ca -revoke ' facility which revokes a certificate - specified in by updating the entry in the index.txt file. - This way one no longer has to edit the index.txt file manually for - revoking a certificate. The -revoke option does the gory details now. - [Massimiliano Pala , Ralf S. Engelschall] - - *) Fix `openssl crl -noout -text' combination where `-noout' killed the - `-text' option at all and this way the `-noout -text' combination was - inconsistent in `openssl crl' with the friends in `openssl x509|rsa|dsa'. - [Ralf S. Engelschall] - - *) Make sure a corresponding plain text error message exists for the - X509_V_ERR_CERT_REVOKED/23 error number which can occur when a - verify callback function determined that a certificate was revoked. - [Ralf S. Engelschall] - - *) Bugfix: In test/testenc, don't test "openssl " for - ciphers that were excluded, e.g. by -DNO_IDEA. Also, test - all available cipers including rc5, which was forgotten until now. - In order to let the testing shell script know which algorithms - are available, a new (up to now undocumented) command - "openssl list-cipher-commands" is used. - [Bodo Moeller] - - *) Bugfix: s_client occasionally would sleep in select() when - it should have checked SSL_pending() first. - [Bodo Moeller] - - *) New functions DSA_do_sign and DSA_do_verify to provide access to - the raw DSA values prior to ASN.1 encoding. - [Ulf Möller] - - *) Tweaks to Configure - [Niels Poppe ] - - *) Add support for PKCS#5 v2.0 ASN1 PBES2 structures. No other support, - yet... - [Steve Henson] - - *) New variables $(RANLIB) and $(PERL) in the Makefiles. - [Ulf Möller] - - *) New config option to avoid instructions that are illegal on the 80386. - The default code is faster, but requires at least a 486. - [Ulf Möller] - - *) Got rid of old SSL2_CLIENT_VERSION (inconsistently used) and - SSL2_SERVER_VERSION (not used at all) macros, which are now the - same as SSL2_VERSION anyway. - [Bodo Moeller] - - *) New "-showcerts" option for s_client. - [Bodo Moeller] - - *) Still more PKCS#12 integration. Add pkcs12 application to openssl - application. Various cleanups and fixes. - [Steve Henson] - - *) More PKCS#12 integration. Add new pkcs12 directory with Makefile.ssl and - modify error routines to work internally. Add error codes and PBE init - to library startup routines. - [Steve Henson] - - *) Further PKCS#12 integration. Added password based encryption, PKCS#8 and - packing functions to asn1 and evp. Changed function names and error - codes along the way. - [Steve Henson] - - *) PKCS12 integration: and so it begins... First of several patches to - slowly integrate PKCS#12 functionality into OpenSSL. Add PKCS#12 - objects to objects.h - [Steve Henson] - - *) Add a new 'indent' option to some X509V3 extension code. Initial ASN1 - and display support for Thawte strong extranet extension. - [Steve Henson] - - *) Add LinuxPPC support. - [Jeff Dubrule ] - - *) Get rid of redundant BN file bn_mulw.c, and rename bn_div64 to - bn_div_words in alpha.s. - [Hannes Reinecke and Ben Laurie] - - *) Make sure the RSA OAEP test is skipped under -DRSAref because - OAEP isn't supported when OpenSSL is built with RSAref. - [Ulf Moeller ] - - *) Move definitions of IS_SET/IS_SEQUENCE inside crypto/asn1/asn1.h - so they no longer are missing under -DNOPROTO. - [Soren S. Jorvang ] - - - Changes between 0.9.1c and 0.9.2b [22 Mar 1999] - - *) Make SSL_get_peer_cert_chain() work in servers. Unfortunately, it still - doesn't work when the session is reused. Coming soon! - [Ben Laurie] - - *) Fix a security hole, that allows sessions to be reused in the wrong - context thus bypassing client cert protection! All software that uses - client certs and session caches in multiple contexts NEEDS PATCHING to - allow session reuse! A fuller solution is in the works. - [Ben Laurie, problem pointed out by Holger Reif, Bodo Moeller (and ???)] - - *) Some more source tree cleanups (removed obsolete files - crypto/bf/asm/bf586.pl, test/test.txt and crypto/sha/asm/f.s; changed - permission on "config" script to be executable) and a fix for the INSTALL - document. - [Ulf Moeller ] - - *) Remove some legacy and erroneous uses of malloc, free instead of - Malloc, Free. - [Lennart Bang , with minor changes by Steve] - - *) Make rsa_oaep_test return non-zero on error. - [Ulf Moeller ] - - *) Add support for native Solaris shared libraries. Configure - solaris-sparc-sc4-pic, make, then run shlib/solaris-sc4.sh. It'd be nice - if someone would make that last step automatic. - [Matthias Loepfe ] - - *) ctx_size was not built with the right compiler during "make links". Fixed. - [Ben Laurie] - - *) Change the meaning of 'ALL' in the cipher list. It now means "everything - except NULL ciphers". This means the default cipher list will no longer - enable NULL ciphers. They need to be specifically enabled e.g. with - the string "DEFAULT:eNULL". - [Steve Henson] - - *) Fix to RSA private encryption routines: if p < q then it would - occasionally produce an invalid result. This will only happen with - externally generated keys because OpenSSL (and SSLeay) ensure p > q. - [Steve Henson] - - *) Be less restrictive and allow also `perl util/perlpath.pl - /path/to/bin/perl' in addition to `perl util/perlpath.pl /path/to/bin', - because this way one can also use an interpreter named `perl5' (which is - usually the name of Perl 5.xxx on platforms where an Perl 4.x is still - installed as `perl'). - [Matthias Loepfe ] - - *) Let util/clean-depend.pl work also with older Perl 5.00x versions. - [Matthias Loepfe ] - - *) Fix Makefile.org so CC,CFLAG etc are passed to 'make links' add - advapi32.lib to Win32 build and change the pem test comparision - to fc.exe (thanks to Ulrich Kroener for the - suggestion). Fix misplaced ASNI prototypes and declarations in evp.h - and crypto/des/ede_cbcm_enc.c. - [Steve Henson] - - *) DES quad checksum was broken on big-endian architectures. Fixed. - [Ben Laurie] - - *) Comment out two functions in bio.h that aren't implemented. Fix up the - Win32 test batch file so it (might) work again. The Win32 test batch file - is horrible: I feel ill.... - [Steve Henson] - - *) Move various #ifdefs around so NO_SYSLOG, NO_DIRENT etc are now selected - in e_os.h. Audit of header files to check ANSI and non ANSI - sections: 10 functions were absent from non ANSI section and not exported - from Windows DLLs. Fixed up libeay.num for new functions. - [Steve Henson] - - *) Make `openssl version' output lines consistent. - [Ralf S. Engelschall] - - *) Fix Win32 symbol export lists for BIO functions: Added - BIO_get_ex_new_index, BIO_get_ex_num, BIO_get_ex_data and BIO_set_ex_data - to ms/libeay{16,32}.def. - [Ralf S. Engelschall] - - *) Second round of fixing the OpenSSL perl/ stuff. It now at least compiled - fine under Unix and passes some trivial tests I've now added. But the - whole stuff is horribly incomplete, so a README.1ST with a disclaimer was - added to make sure no one expects that this stuff really works in the - OpenSSL 0.9.2 release. Additionally I've started to clean the XS sources - up and fixed a few little bugs and inconsistencies in OpenSSL.{pm,xs} and - openssl_bio.xs. - [Ralf S. Engelschall] - - *) Fix the generation of two part addresses in perl. - [Kenji Miyake , integrated by Ben Laurie] - - *) Add config entry for Linux on MIPS. - [John Tobey ] - - *) Make links whenever Configure is run, unless we are on Windoze. - [Ben Laurie] - - *) Permit extensions to be added to CRLs using crl_section in openssl.cnf. - Currently only issuerAltName and AuthorityKeyIdentifier make any sense - in CRLs. - [Steve Henson] - - *) Add a useful kludge to allow package maintainers to specify compiler and - other platforms details on the command line without having to patch the - Configure script everytime: One now can use ``perl Configure - :
'', i.e. platform ids are allowed to have details appended - to them (seperated by colons). This is treated as there would be a static - pre-configured entry in Configure's %table under key with value -
and ``perl Configure '' is called. So, when you want to - perform a quick test-compile under FreeBSD 3.1 with pgcc and without - assembler stuff you can use ``perl Configure "FreeBSD-elf:pgcc:-O6:::"'' - now, which overrides the FreeBSD-elf entry on-the-fly. - [Ralf S. Engelschall] - - *) Disable new TLS1 ciphersuites by default: they aren't official yet. - [Ben Laurie] - - *) Allow DSO flags like -fpic, -fPIC, -KPIC etc. to be specified - on the `perl Configure ...' command line. This way one can compile - OpenSSL libraries with Position Independent Code (PIC) which is needed - for linking it into DSOs. - [Ralf S. Engelschall] - - *) Remarkably, export ciphers were totally broken and no-one had noticed! - Fixed. - [Ben Laurie] - - *) Cleaned up the LICENSE document: The official contact for any license - questions now is the OpenSSL core team under openssl-core@openssl.org. - And add a paragraph about the dual-license situation to make sure people - recognize that _BOTH_ the OpenSSL license _AND_ the SSLeay license apply - to the OpenSSL toolkit. - [Ralf S. Engelschall] - - *) General source tree makefile cleanups: Made `making xxx in yyy...' - display consistent in the source tree and replaced `/bin/rm' by `rm'. - Additonally cleaned up the `make links' target: Remove unnecessary - semicolons, subsequent redundant removes, inline point.sh into mklink.sh - to speed processing and no longer clutter the display with confusing - stuff. Instead only the actually done links are displayed. - [Ralf S. Engelschall] - - *) Permit null encryption ciphersuites, used for authentication only. It used - to be necessary to set the preprocessor define SSL_ALLOW_ENULL to do this. - It is now necessary to set SSL_FORBID_ENULL to prevent the use of null - encryption. - [Ben Laurie] - - *) Add a bunch of fixes to the PKCS#7 stuff. It used to sometimes reorder - signed attributes when verifying signatures (this would break them), - the detached data encoding was wrong and public keys obtained using - X509_get_pubkey() weren't freed. - [Steve Henson] - - *) Add text documentation for the BUFFER functions. Also added a work around - to a Win95 console bug. This was triggered by the password read stuff: the - last character typed gets carried over to the next fread(). If you were - generating a new cert request using 'req' for example then the last - character of the passphrase would be CR which would then enter the first - field as blank. - [Steve Henson] - - *) Added the new `Includes OpenSSL Cryptography Software' button as - doc/openssl_button.{gif,html} which is similar in style to the old SSLeay - button and can be used by applications based on OpenSSL to show the - relationship to the OpenSSL project. - [Ralf S. Engelschall] - - *) Remove confusing variables in function signatures in files - ssl/ssl_lib.c and ssl/ssl.h. - [Lennart Bong ] - - *) Don't install bss_file.c under PREFIX/include/ - [Lennart Bong ] - - *) Get the Win32 compile working again. Modify mkdef.pl so it can handle - functions that return function pointers and has support for NT specific - stuff. Fix mk1mf.pl and VC-32.pl to support NT differences also. Various - #ifdef WIN32 and WINNTs sprinkled about the place and some changes from - unsigned to signed types: this was killing the Win32 compile. - [Steve Henson] - - *) Add new certificate file to stack functions, - SSL_add_dir_cert_subjects_to_stack() and - SSL_add_file_cert_subjects_to_stack(). These largely supplant - SSL_load_client_CA_file(), and can be used to add multiple certs easily - to a stack (usually this is then handed to SSL_CTX_set_client_CA_list()). - This means that Apache-SSL and similar packages don't have to mess around - to add as many CAs as they want to the preferred list. - [Ben Laurie] - - *) Experiment with doxygen documentation. Currently only partially applied to - ssl/ssl_lib.c. - See http://www.stack.nl/~dimitri/doxygen/index.html, and run doxygen with - openssl.doxy as the configuration file. - [Ben Laurie] - - *) Get rid of remaining C++-style comments which strict C compilers hate. - [Ralf S. Engelschall, pointed out by Carlos Amengual] - - *) Changed BN_RECURSION in bn_mont.c to BN_RECURSION_MONT so it is not - compiled in by default: it has problems with large keys. - [Steve Henson] - - *) Add a bunch of SSL_xxx() functions for configuring the temporary RSA and - DH private keys and/or callback functions which directly correspond to - their SSL_CTX_xxx() counterparts but work on a per-connection basis. This - is needed for applications which have to configure certificates on a - per-connection basis (e.g. Apache+mod_ssl) instead of a per-context basis - (e.g. s_server). - For the RSA certificate situation is makes no difference, but - for the DSA certificate situation this fixes the "no shared cipher" - problem where the OpenSSL cipher selection procedure failed because the - temporary keys were not overtaken from the context and the API provided - no way to reconfigure them. - The new functions now let applications reconfigure the stuff and they - are in detail: SSL_need_tmp_RSA, SSL_set_tmp_rsa, SSL_set_tmp_dh, - SSL_set_tmp_rsa_callback and SSL_set_tmp_dh_callback. Additionally a new - non-public-API function ssl_cert_instantiate() is used as a helper - function and also to reduce code redundancy inside ssl_rsa.c. - [Ralf S. Engelschall] - - *) Move s_server -dcert and -dkey options out of the undocumented feature - area because they are useful for the DSA situation and should be - recognized by the users. - [Ralf S. Engelschall] - - *) Fix the cipher decision scheme for export ciphers: the export bits are - *not* within SSL_MKEY_MASK or SSL_AUTH_MASK, they are within - SSL_EXP_MASK. So, the original variable has to be used instead of the - already masked variable. - [Richard Levitte ] - - *) Fix 'port' variable from `int' to `unsigned int' in crypto/bio/b_sock.c - [Richard Levitte ] - - *) Change type of another md_len variable in pk7_doit.c:PKCS7_dataFinal() - from `int' to `unsigned int' because it's a length and initialized by - EVP_DigestFinal() which expects an `unsigned int *'. - [Richard Levitte ] - - *) Don't hard-code path to Perl interpreter on shebang line of Configure - script. Instead use the usual Shell->Perl transition trick. - [Ralf S. Engelschall] - - *) Make `openssl x509 -noout -modulus' functional also for DSA certificates - (in addition to RSA certificates) to match the behaviour of `openssl dsa - -noout -modulus' as it's already the case for `openssl rsa -noout - -modulus'. For RSA the -modulus is the real "modulus" while for DSA - currently the public key is printed (a decision which was already done by - `openssl dsa -modulus' in the past) which serves a similar purpose. - Additionally the NO_RSA no longer completely removes the whole -modulus - option; it now only avoids using the RSA stuff. Same applies to NO_DSA - now, too. - [Ralf S. Engelschall] - - *) Add Arne Ansper's reliable BIO - this is an encrypted, block-digested - BIO. See the source (crypto/evp/bio_ok.c) for more info. - [Arne Ansper ] - - *) Dump the old yucky req code that tried (and failed) to allow raw OIDs - to be added. Now both 'req' and 'ca' can use new objects defined in the - config file. - [Steve Henson] - - *) Add cool BIO that does syslog (or event log on NT). - [Arne Ansper , integrated by Ben Laurie] - - *) Add support for new TLS ciphersuites, TLS_RSA_EXPORT56_WITH_RC4_56_MD5, - TLS_RSA_EXPORT56_WITH_RC2_CBC_56_MD5 and - TLS_RSA_EXPORT56_WITH_DES_CBC_SHA, as specified in "56-bit Export Cipher - Suites For TLS", draft-ietf-tls-56-bit-ciphersuites-00.txt. - [Ben Laurie] - - *) Add preliminary config info for new extension code. - [Steve Henson] - - *) Make RSA_NO_PADDING really use no padding. - [Ulf Moeller ] - - *) Generate errors when private/public key check is done. - [Ben Laurie] - - *) Overhaul for 'crl' utility. New function X509_CRL_print. Partial support - for some CRL extensions and new objects added. - [Steve Henson] - - *) Really fix the ASN1 IMPLICIT bug this time... Partial support for private - key usage extension and fuller support for authority key id. - [Steve Henson] - - *) Add OAEP encryption for the OpenSSL crypto library. OAEP is the improved - padding method for RSA, which is recommended for new applications in PKCS - #1 v2.0 (RFC 2437, October 1998). - OAEP (Optimal Asymmetric Encryption Padding) has better theoretical - foundations than the ad-hoc padding used in PKCS #1 v1.5. It is secure - against Bleichbacher's attack on RSA. - [Ulf Moeller , reformatted, corrected and integrated by - Ben Laurie] - - *) Updates to the new SSL compression code - [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)] - - *) Fix so that the version number in the master secret, when passed - via RSA, checks that if TLS was proposed, but we roll back to SSLv3 - (because the server will not accept higher), that the version number - is 0x03,0x01, not 0x03,0x00 - [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)] - - *) Run extensive memory leak checks on SSL apps. Fixed *lots* of memory - leaks in ssl/ relating to new X509_get_pubkey() behaviour. Also fixes - in apps/ and an unrelated leak in crypto/dsa/dsa_vrf.c - [Steve Henson] - - *) Support for RAW extensions where an arbitrary extension can be - created by including its DER encoding. See apps/openssl.cnf for - an example. - [Steve Henson] - - *) Make sure latest Perl versions don't interpret some generated C array - code as Perl array code in the crypto/err/err_genc.pl script. - [Lars Weber <3weber@informatik.uni-hamburg.de>] - - *) Modify ms/do_ms.bat to not generate assembly language makefiles since - not many people have the assembler. Various Win32 compilation fixes and - update to the INSTALL.W32 file with (hopefully) more accurate Win32 - build instructions. - [Steve Henson] - - *) Modify configure script 'Configure' to automatically create crypto/date.h - file under Win32 and also build pem.h from pem.org. New script - util/mkfiles.pl to create the MINFO file on environments that can't do a - 'make files': perl util/mkfiles.pl >MINFO should work. - [Steve Henson] - - *) Major rework of DES function declarations, in the pursuit of correctness - and purity. As a result, many evil casts evaporated, and some weirdness, - too. You may find this causes warnings in your code. Zapping your evil - casts will probably fix them. Mostly. - [Ben Laurie] - - *) Fix for a typo in asn1.h. Bug fix to object creation script - obj_dat.pl. It considered a zero in an object definition to mean - "end of object": none of the objects in objects.h have any zeros - so it wasn't spotted. - [Steve Henson, reported by Erwann ABALEA ] - - *) Add support for Triple DES Cipher Block Chaining with Output Feedback - Masking (CBCM). In the absence of test vectors, the best I have been able - to do is check that the decrypt undoes the encrypt, so far. Send me test - vectors if you have them. - [Ben Laurie] - - *) Correct calculation of key length for export ciphers (too much space was - allocated for null ciphers). This has not been tested! - [Ben Laurie] - - *) Modifications to the mkdef.pl for Win32 DEF file creation. The usage - message is now correct (it understands "crypto" and "ssl" on its - command line). There is also now an "update" option. This will update - the util/ssleay.num and util/libeay.num files with any new functions. - If you do a: - perl util/mkdef.pl crypto ssl update - it will update them. - [Steve Henson] - - *) Overhauled the Perl interface (perl/*): - - ported BN stuff to OpenSSL's different BN library - - made the perl/ source tree CVS-aware - - renamed the package from SSLeay to OpenSSL (the files still contain - their history because I've copied them in the repository) - - removed obsolete files (the test scripts will be replaced - by better Test::Harness variants in the future) - [Ralf S. Engelschall] - - *) First cut for a very conservative source tree cleanup: - 1. merge various obsolete readme texts into doc/ssleay.txt - where we collect the old documents and readme texts. - 2. remove the first part of files where I'm already sure that we no - longer need them because of three reasons: either they are just temporary - files which were left by Eric or they are preserved original files where - I've verified that the diff is also available in the CVS via "cvs diff - -rSSLeay_0_8_1b" or they were renamed (as it was definitely the case for - the crypto/md/ stuff). - [Ralf S. Engelschall] - - *) More extension code. Incomplete support for subject and issuer alt - name, issuer and authority key id. Change the i2v function parameters - and add an extra 'crl' parameter in the X509V3_CTX structure: guess - what that's for :-) Fix to ASN1 macro which messed up - IMPLICIT tag and add f_enum.c which adds a2i, i2a for ENUMERATED. - [Steve Henson] - - *) Preliminary support for ENUMERATED type. This is largely copied from the - INTEGER code. - [Steve Henson] - - *) Add new function, EVP_MD_CTX_copy() to replace frequent use of memcpy. - [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)] - - *) Make sure `make rehash' target really finds the `openssl' program. - [Ralf S. Engelschall, Matthias Loepfe ] - - *) Squeeze another 7% of speed out of MD5 assembler, at least on a P2. I'd - like to hear about it if this slows down other processors. - [Ben Laurie] - - *) Add CygWin32 platform information to Configure script. - [Alan Batie ] - - *) Fixed ms/32all.bat script: `no_asm' -> `no-asm' - [Rainer W. Gerling ] - - *) New program nseq to manipulate netscape certificate sequences - [Steve Henson] - - *) Modify crl2pkcs7 so it supports multiple -certfile arguments. Fix a - few typos. - [Steve Henson] - - *) Fixes to BN code. Previously the default was to define BN_RECURSION - but the BN code had some problems that would cause failures when - doing certificate verification and some other functions. - [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)] - - *) Add ASN1 and PEM code to support netscape certificate sequences. - [Steve Henson] - - *) Add ASN1 and PEM code to support netscape certificate sequences. - [Steve Henson] - - *) Add several PKIX and private extended key usage OIDs. - [Steve Henson] - - *) Modify the 'ca' program to handle the new extension code. Modify - openssl.cnf for new extension format, add comments. - [Steve Henson] - - *) More X509 V3 changes. Fix typo in v3_bitstr.c. Add support to 'req' - and add a sample to openssl.cnf so req -x509 now adds appropriate - CA extensions. - [Steve Henson] - - *) Continued X509 V3 changes. Add to other makefiles, integrate with the - error code, add initial support to X509_print() and x509 application. - [Steve Henson] - - *) Takes a deep breath and start addding X509 V3 extension support code. Add - files in crypto/x509v3. Move original stuff to crypto/x509v3/old. All this - stuff is currently isolated and isn't even compiled yet. - [Steve Henson] - - *) Continuing patches for GeneralizedTime. Fix up certificate and CRL - ASN1 to use ASN1_TIME and modify print routines to use ASN1_TIME_print. - Removed the versions check from X509 routines when loading extensions: - this allows certain broken certificates that don't set the version - properly to be processed. - [Steve Henson] - - *) Deal with irritating shit to do with dependencies, in YAAHW (Yet Another - Ad Hoc Way) - Makefile.ssls now all contain local dependencies, which - can still be regenerated with "make depend". - [Ben Laurie] - - *) Spelling mistake in C version of CAST-128. - [Ben Laurie, reported by Jeremy Hylton ] - - *) Changes to the error generation code. The perl script err-code.pl - now reads in the old error codes and retains the old numbers, only - adding new ones if necessary. It also only changes the .err files if new - codes are added. The makefiles have been modified to only insert errors - when needed (to avoid needlessly modifying header files). This is done - by only inserting errors if the .err file is newer than the auto generated - C file. To rebuild all the error codes from scratch (the old behaviour) - either modify crypto/Makefile.ssl to pass the -regen flag to err_code.pl - or delete all the .err files. - [Steve Henson] - - *) CAST-128 was incorrectly implemented for short keys. The C version has - been fixed, but is untested. The assembler versions are also fixed, but - new assembler HAS NOT BEEN GENERATED FOR WIN32 - the Makefile needs fixing - to regenerate it if needed. - [Ben Laurie, reported (with fix for C version) by Jun-ichiro itojun - Hagino ] - - *) File was opened incorrectly in randfile.c. - [Ulf Möller ] - - *) Beginning of support for GeneralizedTime. d2i, i2d, check and print - functions. Also ASN1_TIME suite which is a CHOICE of UTCTime or - GeneralizedTime. ASN1_TIME is the proper type used in certificates et - al: it's just almost always a UTCTime. Note this patch adds new error - codes so do a "make errors" if there are problems. - [Steve Henson] - - *) Correct Linux 1 recognition in config. - [Ulf Möller ] - - *) Remove pointless MD5 hash when using DSA keys in ca. - [Anonymous ] - - *) Generate an error if given an empty string as a cert directory. Also - generate an error if handed NULL (previously returned 0 to indicate an - error, but didn't set one). - [Ben Laurie, reported by Anonymous ] - - *) Add prototypes to SSL methods. Make SSL_write's buffer const, at last. - [Ben Laurie] - - *) Fix the dummy function BN_ref_mod_exp() in rsaref.c to have the correct - parameters. This was causing a warning which killed off the Win32 compile. - [Steve Henson] - - *) Remove C++ style comments from crypto/bn/bn_local.h. - [Neil Costigan ] - - *) The function OBJ_txt2nid was broken. It was supposed to return a nid - based on a text string, looking up short and long names and finally - "dot" format. The "dot" format stuff didn't work. Added new function - OBJ_txt2obj to do the same but return an ASN1_OBJECT and rewrote - OBJ_txt2nid to use it. OBJ_txt2obj can also return objects even if the - OID is not part of the table. - [Steve Henson] - - *) Add prototypes to X509 lookup/verify methods, fixing a bug in - X509_LOOKUP_by_alias(). - [Ben Laurie] - - *) Sort openssl functions by name. - [Ben Laurie] - - *) Get the gendsa program working (hopefully) and add it to app list. Remove - encryption from sample DSA keys (in case anyone is interested the password - was "1234"). - [Steve Henson] - - *) Make _all_ *_free functions accept a NULL pointer. - [Frans Heymans ] - - *) If a DH key is generated in s3_srvr.c, don't blow it by trying to use - NULL pointers. - [Anonymous ] - - *) s_server should send the CAfile as acceptable CAs, not its own cert. - [Bodo Moeller <3moeller@informatik.uni-hamburg.de>] - - *) Don't blow it for numeric -newkey arguments to apps/req. - [Bodo Moeller <3moeller@informatik.uni-hamburg.de>] - - *) Temp key "for export" tests were wrong in s3_srvr.c. - [Anonymous ] - - *) Add prototype for temp key callback functions - SSL_CTX_set_tmp_{rsa,dh}_callback(). - [Ben Laurie] - - *) Make DH_free() tolerate being passed a NULL pointer (like RSA_free() and - DSA_free()). Make X509_PUBKEY_set() check for errors in d2i_PublicKey(). - [Steve Henson] - - *) X509_name_add_entry() freed the wrong thing after an error. - [Arne Ansper ] - - *) rsa_eay.c would attempt to free a NULL context. - [Arne Ansper ] - - *) BIO_s_socket() had a broken should_retry() on Windoze. - [Arne Ansper ] - - *) BIO_f_buffer() didn't pass on BIO_CTRL_FLUSH. - [Arne Ansper ] - - *) Make sure the already existing X509_STORE->depth variable is initialized - in X509_STORE_new(), but document the fact that this variable is still - unused in the certificate verification process. - [Ralf S. Engelschall] - - *) Fix the various library and apps files to free up pkeys obtained from - X509_PUBKEY_get() et al. Also allow x509.c to handle netscape extensions. - [Steve Henson] - - *) Fix reference counting in X509_PUBKEY_get(). This makes - demos/maurice/example2.c work, amongst others, probably. - [Steve Henson and Ben Laurie] - - *) First cut of a cleanup for apps/. First the `ssleay' program is now named - `openssl' and second, the shortcut symlinks for the `openssl ' - are no longer created. This way we have a single and consistent command - line interface `openssl ', similar to `cvs '. - [Ralf S. Engelschall, Paul Sutton and Ben Laurie] - - *) ca.c: move test for DSA keys inside #ifndef NO_DSA. Make pubkey - BIT STRING wrapper always have zero unused bits. - [Steve Henson] - - *) Add CA.pl, perl version of CA.sh, add extended key usage OID. - [Steve Henson] - - *) Make the top-level INSTALL documentation easier to understand. - [Paul Sutton] - - *) Makefiles updated to exit if an error occurs in a sub-directory - make (including if user presses ^C) [Paul Sutton] - - *) Make Montgomery context stuff explicit in RSA data structure. - [Ben Laurie] - - *) Fix build order of pem and err to allow for generated pem.h. - [Ben Laurie] - - *) Fix renumbering bug in X509_NAME_delete_entry(). - [Ben Laurie] - - *) Enhanced the err-ins.pl script so it makes the error library number - global and can add a library name. This is needed for external ASN1 and - other error libraries. - [Steve Henson] - - *) Fixed sk_insert which never worked properly. - [Steve Henson] - - *) Fix ASN1 macros so they can handle indefinite length construted - EXPLICIT tags. Some non standard certificates use these: they can now - be read in. - [Steve Henson] - - *) Merged the various old/obsolete SSLeay documentation files (doc/xxx.doc) - into a single doc/ssleay.txt bundle. This way the information is still - preserved but no longer messes up this directory. Now it's new room for - the new set of documenation files. - [Ralf S. Engelschall] - - *) SETs were incorrectly DER encoded. This was a major pain, because they - shared code with SEQUENCEs, which aren't coded the same. This means that - almost everything to do with SETs or SEQUENCEs has either changed name or - number of arguments. - [Ben Laurie, based on a partial fix by GP Jayan ] - - *) Fix test data to work with the above. - [Ben Laurie] - - *) Fix the RSA header declarations that hid a bug I fixed in 0.9.0b but - was already fixed by Eric for 0.9.1 it seems. - [Ben Laurie - pointed out by Ulf Möller ] - - *) Autodetect FreeBSD3. - [Ben Laurie] - - *) Fix various bugs in Configure. This affects the following platforms: - nextstep - ncr-scde - unixware-2.0 - unixware-2.0-pentium - sco5-cc. - [Ben Laurie] - - *) Eliminate generated files from CVS. Reorder tests to regenerate files - before they are needed. - [Ben Laurie] - - *) Generate Makefile.ssl from Makefile.org (to keep CVS happy). - [Ben Laurie] - - - Changes between 0.9.1b and 0.9.1c [23-Dec-1998] - - *) Added OPENSSL_VERSION_NUMBER to crypto/crypto.h and - changed SSLeay to OpenSSL in version strings. - [Ralf S. Engelschall] - - *) Some fixups to the top-level documents. - [Paul Sutton] - - *) Fixed the nasty bug where rsaref.h was not found under compile-time - because the symlink to include/ was missing. - [Ralf S. Engelschall] - - *) Incorporated the popular no-RSA/DSA-only patches - which allow to compile a RSA-free SSLeay. - [Andrew Cooke / Interrader Ldt., Ralf S. Engelschall] - - *) Fixed nasty rehash problem under `make -f Makefile.ssl links' - when "ssleay" is still not found. - [Ralf S. Engelschall] - - *) Added more platforms to Configure: Cray T3E, HPUX 11, - [Ralf S. Engelschall, Beckmann ] - - *) Updated the README file. - [Ralf S. Engelschall] - - *) Added various .cvsignore files in the CVS repository subdirs - to make a "cvs update" really silent. - [Ralf S. Engelschall] - - *) Recompiled the error-definition header files and added - missing symbols to the Win32 linker tables. - [Ralf S. Engelschall] - - *) Cleaned up the top-level documents; - o new files: CHANGES and LICENSE - o merged VERSION, HISTORY* and README* files a CHANGES.SSLeay - o merged COPYRIGHT into LICENSE - o removed obsolete TODO file - o renamed MICROSOFT to INSTALL.W32 - [Ralf S. Engelschall] - - *) Removed dummy files from the 0.9.1b source tree: - crypto/asn1/x crypto/bio/cd crypto/bio/fg crypto/bio/grep crypto/bio/vi - crypto/bn/asm/......add.c crypto/bn/asm/a.out crypto/dsa/f crypto/md5/f - crypto/pem/gmon.out crypto/perlasm/f crypto/pkcs7/build crypto/rsa/f - crypto/sha/asm/f crypto/threads/f ms/zzz ssl/f ssl/f.mak test/f - util/f.mak util/pl/f util/pl/f.mak crypto/bf/bf_locl.old apps/f - [Ralf S. Engelschall] - - *) Added various platform portability fixes. - [Mark J. Cox] - - *) The Genesis of the OpenSSL rpject: - We start with the latest (unreleased) SSLeay version 0.9.1b which Eric A. - Young and Tim J. Hudson created while they were working for C2Net until - summer 1998. - [The OpenSSL Project] - - - Changes between 0.9.0b and 0.9.1b [not released] - - *) Updated a few CA certificates under certs/ - [Eric A. Young] - - *) Changed some BIGNUM api stuff. - [Eric A. Young] - - *) Various platform ports: OpenBSD, Ultrix, IRIX 64bit, NetBSD, - DGUX x86, Linux Alpha, etc. - [Eric A. Young] - - *) New COMP library [crypto/comp/] for SSL Record Layer Compression: - RLE (dummy implemented) and ZLIB (really implemented when ZLIB is - available). - [Eric A. Young] - - *) Add -strparse option to asn1pars program which parses nested - binary structures - [Dr Stephen Henson ] - - *) Added "oid_file" to ssleay.cnf for "ca" and "req" programs. - [Eric A. Young] - - *) DSA fix for "ca" program. - [Eric A. Young] - - *) Added "-genkey" option to "dsaparam" program. - [Eric A. Young] - - *) Added RIPE MD160 (rmd160) message digest. - [Eric A. Young] - - *) Added -a (all) option to "ssleay version" command. - [Eric A. Young] - - *) Added PLATFORM define which is the id given to Configure. - [Eric A. Young] - - *) Added MemCheck_XXXX functions to crypto/mem.c for memory checking. - [Eric A. Young] - - *) Extended the ASN.1 parser routines. - [Eric A. Young] - - *) Extended BIO routines to support REUSEADDR, seek, tell, etc. - [Eric A. Young] - - *) Added a BN_CTX to the BN library. - [Eric A. Young] - - *) Fixed the weak key values in DES library - [Eric A. Young] - - *) Changed API in EVP library for cipher aliases. - [Eric A. Young] - - *) Added support for RC2/64bit cipher. - [Eric A. Young] - - *) Converted the lhash library to the crypto/mem.c functions. - [Eric A. Young] - - *) Added more recognized ASN.1 object ids. - [Eric A. Young] - - *) Added more RSA padding checks for SSL/TLS. - [Eric A. Young] - - *) Added BIO proxy/filter functionality. - [Eric A. Young] - - *) Added extra_certs to SSL_CTX which can be used - send extra CA certificates to the client in the CA cert chain sending - process. It can be configured with SSL_CTX_add_extra_chain_cert(). - [Eric A. Young] - - *) Now Fortezza is denied in the authentication phase because - this is key exchange mechanism is not supported by SSLeay at all. - [Eric A. Young] - - *) Additional PKCS1 checks. - [Eric A. Young] - - *) Support the string "TLSv1" for all TLS v1 ciphers. - [Eric A. Young] - - *) Added function SSL_get_ex_data_X509_STORE_CTX_idx() which gives the - ex_data index of the SSL context in the X509_STORE_CTX ex_data. - [Eric A. Young] - - *) Fixed a few memory leaks. - [Eric A. Young] - - *) Fixed various code and comment typos. - [Eric A. Young] - - *) A minor bug in ssl/s3_clnt.c where there would always be 4 0 - bytes sent in the client random. - [Edward Bishop ] - diff --git a/CHANGES.SSLeay b/CHANGES.SSLeay deleted file mode 100644 index dbb80b003d..0000000000 --- a/CHANGES.SSLeay +++ /dev/null @@ -1,968 +0,0 @@ -This file contains the changes for the SSLeay library up to version -0.9.0b. For later changes, see the file "CHANGES". - - SSLeay CHANGES - ______________ - -Changes between 0.8.x and 0.9.0b - -10-Apr-1998 - -I said the next version would go out at easter, and so it shall. -I expect a 0.9.1 will follow with portability fixes in the next few weeks. - -This is a quick, meet the deadline. Look to ssl-users for comments on what -is new etc. - -eric (about to go bushwalking for the 4 day easter break :-) - -16-Mar-98 - - Patch for Cray T90 from Wayne Schroeder - - Lots and lots of changes - -29-Jan-98 - - ASN1_BIT_STRING_set_bit()/ASN1_BIT_STRING_get_bit() from - Goetz Babin-Ebell . - - SSL_version() now returns SSL2_VERSION, SSL3_VERSION or - TLS1_VERSION. - -7-Jan-98 - - Finally reworked the cipher string to ciphers again, so it - works correctly - - All the app_data stuff is now ex_data with funcion calls to access. - The index is supplied by a function and 'methods' can be setup - for the types that are called on XXX_new/XXX_free. This lets - applications get notified on creation and destruction. Some of - the RSA methods could be implemented this way and I may do so. - - Oh yes, SSL under perl5 is working at the basic level. - -15-Dec-97 - - Warning - the gethostbyname cache is not fully thread safe, - but it should work well enough. - - Major internal reworking of the app_data stuff. More functions - but if you were accessing ->app_data directly, things will - stop working. - - The perlv5 stuff is working. Currently on message digests, - ciphers and the bignum library. - -9-Dec-97 - - Modified re-negotiation so that server initated re-neg - will cause a SSL_read() to return -1 should retry. - The danger otherwise was that the server and the - client could end up both trying to read when using non-blocking - sockets. - -4-Dec-97 - - Lots of small changes - - Fix for binaray mode in Windows for the FILE BIO, thanks to - Bob Denny - -17-Nov-97 - - Quite a few internal cleanups, (removal of errno, and using macros - defined in e_os.h). - - A bug in ca.c, pointed out by yasuyuki-ito@d-cruise.co.jp, where - the automactic naming out output files was being stuffed up. - -29-Oct-97 - - The Cast5 cipher has been added. MD5 and SHA-1 are now in assember - for x86. - -21-Oct-97 - - Fixed a bug in the BIO_gethostbyname() cache. - -15-Oct-97 - - cbc mode for blowfish/des/3des is now in assember. Blowfish asm - has also been improved. At this point in time, on the pentium, - md5 is %80 faster, the unoptimesed sha-1 is %79 faster, - des-cbc is %28 faster, des-ede3-cbc is %9 faster and blowfish-cbc - is %62 faster. - -12-Oct-97 - - MEM_BUF_grow() has been fixed so that it always sets the buf->length - to the value we are 'growing' to. Think of MEM_BUF_grow() as the - way to set the length value correctly. - -10-Oct-97 - - I now hash for certificate lookup on the raw DER encoded RDN (md5). - This breaks things again :-(. This is efficent since I cache - the DER encoding of the RDN. - - The text DN now puts in the numeric OID instead of UNKNOWN. - - req can now process arbitary OIDs in the config file. - - I've been implementing md5 in x86 asm, much faster :-). - - Started sha1 in x86 asm, needs more work. - - Quite a few speedups in the BN stuff. RSA public operation - has been made faster by caching the BN_MONT_CTX structure. - The calulating of the Ai where A*Ai === 1 mod m was rather - expensive. Basically a 40-50% speedup on public operations. - The RSA speedup is now 15% on pentiums and %20 on pentium - pro. - -30-Sep-97 - - After doing some profiling, I added x86 adm for bn_add_words(), - which just adds 2 arrays of longs together. A %10 speedup - for 512 and 1024 bit RSA on the pentium pro. - -29-Sep-97 - - Converted the x86 bignum assembler to us the perl scripts - for generation. - -23-Sep-97 - - If SSL_set_session() is passed a NULL session, it now clears the - current session-id. - -22-Sep-97 - - Added a '-ss_cert file' to apps/ca.c. This will sign selfsigned - certificates. - - Bug in crypto/evp/encode.c where by decoding of 65 base64 - encoded lines, one line at a time (via a memory BIO) would report - EOF after the first line was decoded. - - Fix in X509_find_by_issuer_and_serial() from - Dr Stephen Henson - -19-Sep-97 - - NO_FP_API and NO_STDIO added. - - Put in sh config command. It auto runs Configure with the correct - parameters. - -18-Sep-97 - - Fix x509.c so if a DSA cert has different parameters to its parent, - they are left in place. Not tested yet. - -16-Sep-97 - - ssl_create_cipher_list() had some bugs, fixes from - Patrick Eisenacher - - Fixed a bug in the Base64 BIO, where it would return 1 instead - of -1 when end of input was encountered but should retry. - Basically a Base64/Memory BIO interaction problem. - - Added a HMAC set of functions in preporarion for TLS work. - -15-Sep-97 - - Top level makefile tweak - Cameron Simpson - - Prime generation spead up %25 (512 bit prime, pentium pro linux) - by using montgomery multiplication in the prime number test. - -11-Sep-97 - - Ugly bug in ssl3_write_bytes(). Basically if application land - does a SSL_write(ssl,buf,len) where len > 16k, the SSLv3 write code - did not check the size and tried to copy the entire buffer. - This would tend to cause memory overwrites since SSLv3 has - a maximum packet size of 16k. If your program uses - buffers <= 16k, you would probably never see this problem. - - Fixed a new errors that were cause by malloc() not returning - 0 initialised memory.. - - SSL_OP_NETSCAPE_CA_DN_BUG was being switched on when using - SSL_CTX_set_options(ssl_ctx,SSL_OP_ALL); which was a bad thing - since this flags stops SSLeay being able to handle client - cert requests correctly. - -08-Sep-97 - - SSL_SESS_CACHE_NO_INTERNAL_LOOKUP option added. When switched - on, the SSL server routines will not use a SSL_SESSION that is - held in it's cache. This in intended to be used with the session-id - callbacks so that while the session-ids are still stored in the - cache, the decision to use them and how to look them up can be - done by the callbacks. The are the 'new', 'get' and 'remove' - callbacks. This can be used to determine the session-id - to use depending on information like which port/host the connection - is coming from. Since the are also SSL_SESSION_set_app_data() and - SSL_SESSION_get_app_data() functions, the application can hold - information against the session-id as well. - -03-Sep-97 - - Added lookup of CRLs to the by_dir method, - X509_load_crl_file() also added. Basically it means you can - lookup CRLs via the same system used to lookup certificates. - - Changed things so that the X509_NAME structure can contain - ASN.1 BIT_STRINGS which is required for the unique - identifier OID. - - Fixed some problems with the auto flushing of the session-id - cache. It was not occuring on the server side. - -02-Sep-97 - - Added SSL_CTX_sess_cache_size(SSL_CTX *ctx,unsigned long size) - which is the maximum number of entries allowed in the - session-id cache. This is enforced with a simple FIFO list. - The default size is 20*1024 entries which is rather large :-). - The Timeout code is still always operating. - -01-Sep-97 - - Added an argument to all the 'generate private key/prime` - callbacks. It is the last parameter so this should not - break existing code but it is needed for C++. - - Added the BIO_FLAGS_BASE64_NO_NL flag for the BIO_f_base64() - BIO. This lets the BIO read and write base64 encoded data - without inserting or looking for '\n' characters. The '-A' - flag turns this on when using apps/enc.c. - - RSA_NO_PADDING added to help BSAFE functionality. This is a - very dangerous thing to use, since RSA private key - operations without random padding bytes (as PKCS#1 adds) can - be attacked such that the private key can be revealed. - - ASN.1 bug and rc2-40-cbc and rc4-40 added by - Dr Stephen Henson - -31-Aug-97 (stuff added while I was away) - - Linux pthreads by Tim Hudson (tjh@cryptsoft.com). - - RSA_flags() added allowing bypass of pub/priv match check - in ssl/ssl_rsa.c - Tim Hudson. - - A few minor bugs. - -SSLeay 0.8.1 released. - -19-Jul-97 - - Server side initated dynamic renegotiation is broken. I will fix - it when I get back from holidays. - -15-Jul-97 - - Quite a few small changes. - - INVALID_SOCKET usage cleanups from Alex Kiernan - -09-Jul-97 - - Added 2 new values to the SSL info callback. - SSL_CB_START which is passed when the SSL protocol is started - and SSL_CB_DONE when it has finished sucsessfully. - -08-Jul-97 - - Fixed a few bugs problems in apps/req.c and crypto/asn1/x_pkey.c - that related to DSA public/private keys. - - Added all the relevent PEM and normal IO functions to support - reading and writing RSAPublic keys. - - Changed makefiles to use ${AR} instead of 'ar r' - -07-Jul-97 - - Error in ERR_remove_state() that would leave a dangling reference - to a free()ed location - thanks to Alex Kiernan - - s_client now prints the X509_NAMEs passed from the server - when requesting a client cert. - - Added a ssl->type, which is one of SSL_ST_CONNECT or - SSL_ST_ACCEPT. I had to add it so I could tell if I was - a connect or an accept after the handshake had finished. - - SSL_get_client_CA_list(SSL *s) now returns the CA names - passed by the server if called by a client side SSL. - -05-Jul-97 - - Bug in X509_NAME_get_text_by_OBJ(), looking starting at index - 0, not -1 :-( Fix from Tim Hudson (tjh@cryptsoft.com). - -04-Jul-97 - - Fixed some things in X509_NAME_add_entry(), thanks to - Matthew Donald . - - I had a look at the cipher section and though that it was a - bit confused, so I've changed it. - - I was not setting up the RC4-64-MD5 cipher correctly. It is - a MS special that appears in exported MS Money. - - Error in all my DH ciphers. Section 7.6.7.3 of the SSLv3 - spec. I was missing the two byte length header for the - ClientDiffieHellmanPublic value. This is a packet sent from - the client to the server. The SSL_OP_SSLEAY_080_CLIENT_DH_BUG - option will enable SSLeay server side SSLv3 accept either - the correct or my 080 packet format. - - Fixed a few typos in crypto/pem.org. - -02-Jul-97 - - Alias mapping for EVP_get_(digest|cipher)byname is now - performed before a lookup for actual cipher. This means - that an alias can be used to 're-direct' a cipher or a - digest. - - ASN1_read_bio() had a bug that only showed up when using a - memory BIO. When EOF is reached in the memory BIO, it is - reported as a -1 with BIO_should_retry() set to true. - -01-Jul-97 - - Fixed an error in X509_verify_cert() caused by my - miss-understanding how 'do { contine } while(0);' works. - Thanks to Emil Sit for educating me :-) - -30-Jun-97 - - Base64 decoding error. If the last data line did not end with - a '=', sometimes extra data would be returned. - - Another 'cut and paste' bug in x509.c related to setting up the - STDout BIO. - -27-Jun-97 - - apps/ciphers.c was not printing due to an editing error. - - Alex Kiernan send in a nice fix for - a library build error in util/mk1mf.pl - -26-Jun-97 - - Still did not have the auto 'experimental' code removal - script correct. - - A few header tweaks for Watcom 11.0 under Win32 from - Rolf Lindemann - - 0 length OCTET_STRING bug in asn1_parse - - A minor fix with an non-existent function in the MS .def files. - - A few changes to the PKCS7 stuff. - -25-Jun-97 - SSLeay 0.8.0 finally it gets released. - -24-Jun-97 - Added a SSL_OP_EPHEMERAL_RSA option which causes all SSLv3 RSA keys to - use a temporary RSA key. This is experimental and needs some more work. - Fixed a few Win16 build problems. - -23-Jun-97 - SSLv3 bug. I was not doing the 'lookup' of the CERT structure - correctly. I was taking the SSL->ctx->default_cert when I should - have been using SSL->cert. The bug was in ssl/s3_srvr.c - -20-Jun-97 - X509_ATTRIBUTES were being encoded wrongly by apps/reg.c and the - rest of the library. Even though I had the code required to do - it correctly, apps/req.c was doing the wrong thing. I have fixed - and tested everything. - - Missing a few #ifdef FIONBIO sections in crypto/bio/bss_acpt.c. - -19-Jun-97 - Fixed a bug in the SSLv2 server side first packet handling. When - using the non-blocking test BIO, the ssl->s2->first_packet flag - was being reset when a would-block failure occurred when reading - the first 5 bytes of the first packet. This caused the checking - logic to run at the wrong time and cause an error. - - Fixed a problem with specifying cipher. If RC4-MD5 were used, - only the SSLv3 version would be picked up. Now this will pick - up both SSLv2 and SSLv3 versions. This required changing the - SSL_CIPHER->mask values so that they only mask the ciphers, - digests, authentication, export type and key-exchange algorithms. - - I found that when a SSLv23 session is established, a reused - session, of type SSLv3 was attempting to write the SSLv2 - ciphers, which were invalid. The SSL_METHOD->put_cipher_by_char - method has been modified so it will only write out cipher which - that method knows about. - - - Changes between 0.8.0 and 0.8.1 - - *) Mostly bug fixes. - There is an Ephemeral DH cipher problem which is fixed. - - SSLeay 0.8.0 - -This version of SSLeay has quite a lot of things different from the -previous version. - -Basically check all callback parameters, I will be producing documentation -about how to use things in th future. Currently I'm just getting 080 out -the door. Please not that there are several ways to do everything, and -most of the applications in the apps directory are hybrids, some using old -methods and some using new methods. - -Have a look in demos/bio for some very simple programs and -apps/s_client.c and apps/s_server.c for some more advanced versions. -Notes are definitly needed but they are a week or so away. - -Anyway, some quick nots from Tim Hudson (tjh@cryptsoft.com) ---- -Quick porting notes for moving from SSLeay-0.6.x to SSLeay-0.8.x to -get those people that want to move to using the new code base off to -a quick start. - -Note that Eric has tidied up a lot of the areas of the API that were -less than desirable and renamed quite a few things (as he had to break -the API in lots of places anyrate). There are a whole pile of additional -functions for making dealing with (and creating) certificates a lot -cleaner. - -01-Jul-97 -Tim Hudson -tjh@cryptsoft.com - ----8<--- - -To maintain code that uses both SSLeay-0.6.x and SSLeay-0.8.x you could -use something like the following (assuming you #include "crypto.h" which -is something that you really should be doing). - -#if SSLEAY_VERSION_NUMBER >= 0x0800 -#define SSLEAY8 -#endif - -buffer.h -> splits into buffer.h and bio.h so you need to include bio.h - too if you are working with BIO internal stuff (as distinct - from simply using the interface in an opaque manner) - -#include "bio.h" - required along with "buffer.h" if you write - your own BIO routines as the buffer and bio - stuff that was intermixed has been separated - out - -envelope.h -> evp.h (which should have been done ages ago) - -Initialisation ... don't forget these or you end up with code that -is missing the bits required to do useful things (like ciphers): - -SSLeay_add_ssl_algorithms() -(probably also want SSL_load_error_strings() too but you should have - already had that call in place) - -SSL_CTX_new() - requires an extra method parameter - SSL_CTX_new(SSLv23_method()) - SSL_CTX_new(SSLv2_method()) - SSL_CTX_new(SSLv3_method()) - - OR to only have the server or the client code - SSL_CTX_new(SSLv23_server_method()) - SSL_CTX_new(SSLv2_server_method()) - SSL_CTX_new(SSLv3_server_method()) - or - SSL_CTX_new(SSLv23_client_method()) - SSL_CTX_new(SSLv2_client_method()) - SSL_CTX_new(SSLv3_client_method()) - -SSL_set_default_verify_paths() ... renamed to the more appropriate -SSL_CTX_set_default_verify_paths() - -If you want to use client certificates then you have to add in a bit -of extra stuff in that a SSLv3 server sends a list of those CAs that -it will accept certificates from ... so you have to provide a list to -SSLeay otherwise certain browsers will not send client certs. - -SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(s_cert_file)); - - -X509_NAME_oneline(X) -> X509_NAME_oneline(X,NULL,0) - or provide a buffer and size to copy the - result into - -X509_add_cert -> X509_STORE_add_cert (and you might want to read the - notes on X509_NAME structure changes too) - - -VERIFICATION CODE -================= - -The codes have all be renamed from VERIFY_ERR_* to X509_V_ERR_* to -more accurately reflect things. - -The verification callback args are now packaged differently so that -extra fields for verification can be added easily in future without -having to break things by adding extra parameters each release :-) - -X509_cert_verify_error_string -> X509_verify_cert_error_string - - -BIO INTERNALS -============= - -Eric has fixed things so that extra flags can be introduced in -the BIO layer in future without having to play with all the BIO -modules by adding in some macros. - -The ugly stuff using - b->flags ~= (BIO_FLAGS_RW|BIO_FLAGS_SHOULD_RETRY) -becomes - BIO_clear_retry_flags(b) - - b->flags |= (BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY) -becomes - BIO_set_retry_read(b) - -Also ... BIO_get_retry_flags(b), BIO_set_flags(b) - - - -OTHER THINGS -============ - -X509_NAME has been altered so that it isn't just a STACK ... the STACK -is now in the "entries" field ... and there are a pile of nice functions -for getting at the details in a much cleaner manner. - -SSL_CTX has been altered ... "cert" is no longer a direct member of this -structure ... things are now down under "cert_store" (see x509_vfy.h) and -things are no longer in a CERTIFICATE_CTX but instead in a X509_STORE. -If your code "knows" about this level of detail then it will need some -surgery. - -If you depending on the incorrect spelling of a number of the error codes -then you will have to change your code as these have been fixed. - -ENV_CIPHER "type" got renamed to "nid" and as that is what it actually -has been all along so this makes things clearer. -ify_cert_error_string(ctx->error)); - -SSL_R_NO_CIPHER_WE_TRUST -> SSL_R_NO_CIPHER_LIST - and SSL_R_REUSE_CIPHER_LIST_NOT_ZERO - - - - Changes between 0.7.x and 0.8.0 - - *) There have been lots of changes, mostly the addition of SSLv3. - There have been many additions from people and amongst - others, C2Net has assisted greatly. - - Changes between 0.7.x and 0.7.x - - *) Internal development version only - -SSLeay 0.6.6 13-Jan-1997 - -The main additions are - -- assember for x86 DES improvments. - From 191,000 per second on a pentium 100, I now get 281,000. The inner - loop and the IP/FP modifications are from - Svend Olaf Mikkelsen . Many thanks for his - contribution. -- The 'DES macros' introduced in 0.6.5 now have 3 types. - DES_PTR1, DES_PTR2 and 'normal'. As per before, des_opts reports which - is best and there is a summery of mine in crypto/des/options.txt -- A few bug fixes. -- Added blowfish. It is not used by SSL but all the other stuff that - deals with ciphers can use it in either ecb, cbc, cfb64 or ofb64 modes. - There are 3 options for optimising Blowfish. BF_PTR, BF_PTR2 and 'normal'. - BF_PTR2 is pentium/x86 specific. The correct option is setup in - the 'Configure' script. -- There is now a 'get client certificate' callback which can be - 'non-blocking'. If more details are required, let me know. It will - documented more in SSLv3 when I finish it. -- Bug fixes from 0.6.5 including the infamous 'ca' bug. The 'make test' - now tests the ca program. -- Lots of little things modified and tweaked. - - SSLeay 0.6.5 - -After quite some time (3 months), the new release. I have been very busy -for the last few months and so this is mostly bug fixes and improvments. - -The main additions are - -- assember for x86 DES. For all those gcc based systems, this is a big - improvement. From 117,000 DES operation a second on a pentium 100, - I now get 191,000. I have also reworked the C version so it - now gives 148,000 DESs per second. -- As mentioned above, the inner DES macros now have some more variant that - sometimes help, sometimes hinder performance. There are now 3 options - DES_PTR (ptr vs array lookup), DES_UNROLL (full vs partial loop unrolling) - and DES_RISC (a more register intensive version of the inner macro). - The crypto/des/des_opts.c program, when compiled and run, will give - an indication of the correct options to use. -- The BIO stuff has been improved. Read doc/bio.doc. There are now - modules for encryption and base64 encoding and a BIO_printf() function. -- The CA program will accept simple one line X509v3 extensions in the - ssleay.cnf file. Have a look at the example. Currently this just - puts the text into the certificate as an OCTET_STRING so currently - the more advanced X509v3 data types are not handled but this is enough - for the netscape extensions. -- There is the start of a nicer higher level interface to the X509 - strucutre. -- Quite a lot of bug fixes. -- CRYPTO_malloc_init() (or CRYPTO_set_mem_functions()) can be used - to define the malloc(), free() and realloc() routines to use - (look in crypto/crypto.h). This is mostly needed for Windows NT/95 when - using DLLs and mixing CRT libraries. - -In general, read the 'VERSION' file for changes and be aware that some of -the new stuff may not have been tested quite enough yet, so don't just plonk -in SSLeay 0.6.5 when 0.6.4 used to work and expect nothing to break. - -SSLeay 0.6.4 30/08/96 eay - -I've just finished some test builds on Windows NT, Windows 3.1, Solaris 2.3, -Solaris 2.5, Linux, IRIX, HPUX 10 and everthing seems to work :-). - -The main changes in this release - -- Thread safe. have a read of doc/threads.doc and play in the mt directory. - For anyone using 0.6.3 with threads, I found 2 major errors so consider - moving to 0.6.4. I have a test program that builds under NT and - solaris. -- The get session-id callback has changed. Have a read of doc/callback.doc. -- The X509_cert_verify callback (the SSL_verify callback) now - has another argument. Have a read of doc/callback.doc -- 'ca -preserve', sign without re-ordering the DN. Not tested much. -- VMS support. -- Compile time memory leak detection can now be built into SSLeay. - Read doc/memory.doc -- CONF routines now understand '\', '\n', '\r' etc. What this means is that - the SPKAC object mentioned in doc/ns-ca.doc can be on multiple lines. -- 'ssleay ciphers' added, lists the default cipher list for SSLeay. -- RC2 key setup is now compatable with Netscape. -- Modifed server side of SSL implementation, big performance difference when - using session-id reuse. - -0.6.3 - -Bug fixes and the addition of some nice stuff to the 'ca' program. -Have a read of doc/ns-ca.doc for how hit has been modified so -it can be driven from a CGI script. The CGI script is not provided, -but that is just being left as an excersize for the reader :-). - -0.6.2 - -This is most bug fixes and functionality improvements. - -Additions are -- More thread debugging patches, the thread stuff is still being - tested, but for those keep to play with stuff, have a look in - crypto/cryptlib.c. The application needs to define 1 (or optionaly - a second) callback that is used to implement locking. Compiling - with LOCK_DEBUG spits out lots of locking crud :-). - This is what I'm currently working on. -- SSL_CTX_set_default_passwd_cb() can be used to define the callback - function used in the SSL*_file() functions used to load keys. I was - always of the opinion that people should call - PEM_read_RSAPrivateKey() and pass the callback they want to use, but - it appears they just want to use the SSL_*_file() function() :-(. -- 'enc' now has a -kfile so a key can be read from a file. This is - mostly used so that the passwd does not appear when using 'ps', - which appears imposible to stop under solaris. -- X509v3 certificates now work correctly. I even have more examples - in my tests :-). There is now a X509_EXTENSION type that is used in - X509v3 certificates and CRLv2. -- Fixed that signature type error :-( -- Fixed quite a few potential memory leaks and problems when reusing - X509, CRL and REQ structures. -- EVP_set_pw_prompt() now sets the library wide default password - prompt. -- The 'pkcs7' command will now, given the -print_certs flag, output in - pem format, all certificates and CRL contained within. This is more - of a pre-emtive thing for the new verisign distribution method. I - should also note, that this also gives and example in code, of how - to do this :-), or for that matter, what is involved in going the - other way (list of certs and crl -> pkcs7). -- Added RSA's DESX to the DES library. It is also available via the - EVP_desx_cbc() method and via 'enc desx'. - -SSLeay 0.6.1 - -The main functional changes since 0.6.0 are as follows -- Bad news, the Microsoft 060 DLL's are not compatable, but the good news is - that from now on, I'll keep the .def numbers the same so they will be. -- RSA private key operations are about 2 times faster that 0.6.0 -- The SSL_CTX now has more fields so default values can be put against - it. When an SSL structure is created, these default values are used - but can be overwritten. There are defaults for cipher, certificate, - private key, verify mode and callback. This means SSL session - creation can now be - ssl=SSL_new() - SSL_set_fd(ssl,sock); - SSL_accept(ssl) - .... - All the other uglyness with having to keep a global copy of the - private key and certificate/verify mode in the server is now gone. -- ssl/ssltest.c - one process talking SSL to its self for testing. -- Storage of Session-id's can be controled via a session_cache_mode - flag. There is also now an automatic default flushing of - old session-id's. -- The X509_cert_verify() function now has another parameter, this - should not effect most people but it now means that the reason for - the failure to verify is now available via SSL_get_verify_result(ssl). - You don't have to use a global variable. -- SSL_get_app_data() and SSL_set_app_data() can be used to keep some - application data against the SSL structure. It is upto the application - to free the data. I don't use it, but it is available. -- SSL_CTX_set_cert_verify_callback() can be used to specify a - verify callback function that completly replaces my certificate - verification code. Xcert should be able to use this :-). - The callback is of the form int app_verify_callback(arg,ssl,cert). - This needs to be documented more. -- I have started playing with shared library builds, have a look in - the shlib directory. It is very simple. If you need a numbered - list of functions, have a look at misc/crypto.num and misc/ssl.num. -- There is some stuff to do locking to make the library thread safe. - I have only started this stuff and have not finished. If anyone is - keen to do so, please send me the patches when finished. - -So I have finally made most of the additions to the SSL interface that -I thought were needed. - -There will probably be a pause before I make any non-bug/documentation -related changes to SSLeay since I'm feeling like a bit of a break. - -eric - 12 Jul 1996 -I saw recently a comment by some-one that we now seem to be entering -the age of perpetual Beta software. -Pioneered by packages like linux but refined to an art form by -netscape. - -I too wish to join this trend with the anouncement of SSLeay 0.6.0 :-). - -There are quite a large number of sections that are 'works in -progress' in this package. I will also list the major changes and -what files you should read. - -BIO - this is the new IO structure being used everywhere in SSLeay. I -started out developing this because of microsoft, I wanted a mechanism -to callback to the application for all IO, so Windows 3.1 DLL -perversion could be hidden from me and the 15 different ways to write -to a file under NT would also not be dictated by me at library build -time. What the 'package' is is an API for a data structure containing -functions. IO interfaces can be written to conform to the -specification. This in not intended to hide the underlying data type -from the application, but to hide it from SSLeay :-). -I have only really finished testing the FILE * and socket/fd modules. -There are also 'filter' BIO's. Currently I have only implemented -message digests, and it is in use in the dgst application. This -functionality will allow base64/encrypto/buffering modules to be -'push' into a BIO without it affecting the semantics. I'm also -working on an SSL BIO which will hide the SSL_accept()/SLL_connet() -from an event loop which uses the interface. -It is also possible to 'attach' callbacks to a BIO so they get called -before and after each operation, alowing extensive debug output -to be generated (try running dgst with -d). - -Unfortunaly in the conversion from 0.5.x to 0.6.0, quite a few -functions that used to take FILE *, now take BIO *. -The wrappers are easy to write - -function_fp(fp,x) -FILE *fp; - { - BIO *b; - int ret; - - if ((b=BIO_new(BIO_s_file())) == NULL) error..... - BIO_set_fp(b,fp,BIO_NOCLOSE); - ret=function_bio(b,x); - BIO_free(b); - return(ret); - } -Remember, there are no functions that take FILE * in SSLeay when -compiled for Windows 3.1 DLL's. - --- -I have added a general EVP_PKEY type that can hold a public/private -key. This is now what is used by the EVP_ functions and is passed -around internally. I still have not done the PKCS#8 stuff, but -X509_PKEY is defined and waiting :-) - --- -For a full function name listings, have a look at ms/crypt32.def and -ms/ssl32.def. These are auto-generated but are complete. -Things like ASN1_INTEGER_get() have been added and are in here if you -look. I have renamed a few things, again, have a look through the -function list and you will probably find what you are after. I intend -to at least put a one line descrition for each one..... - --- -Microsoft - thats what this release is about, read the MICROSOFT file. - --- -Multi-threading support. I have started hunting through the code and -flaging where things need to be done. In a state of work but high on -the list. - --- -For random numbers, edit e_os.h and set DEVRANDOM (it's near the top) -be be you random data device, otherwise 'RFILE' in e_os.h -will be used, in your home directory. It will be updated -periodically. The environment variable RANDFILE will override this -choice and read/write to that file instead. DEVRANDOM is used in -conjunction to the RFILE/RANDFILE. If you wish to 'seed' the random -number generator, pick on one of these files. - --- - -The list of things to read and do - -dgst -d -s_client -state (this uses a callback placed in the SSL state loop and - will be used else-where to help debug/monitor what - is happening.) - -doc/why.doc -doc/bio.doc <- hmmm, needs lots of work. -doc/bss_file.doc <- one that is working :-) -doc/session.doc <- it has changed -doc/speed.doc - also play with ssleay version -a. I have now added a SSLeay() - function that returns a version number, eg 0600 for this release - which is primarily to be used to check DLL version against the - application. -util/* Quite a few will not interest people, but some may, like - mk1mf.pl, mkdef.pl, -util/do_ms.sh - -try -cc -Iinclude -Icrypto -c crypto/crypto.c -cc -Iinclude -Issl -c ssl/ssl.c -You have just built the SSLeay libraries as 2 object files :-) - -Have a general rummage around in the bin stall directory and look at -what is in there, like CA.sh and c_rehash - -There are lots more things but it is 12:30am on a Friday night and I'm -heading home :-). - -eric 22-Jun-1996 -This version has quite a few major bug fixes and improvements. It DOES NOT -do SSLv3 yet. - -The main things changed -- A Few days ago I added the s_mult application to ssleay which is - a demo of an SSL server running in an event loop type thing. - It supports non-blocking IO, I have finally gotten it right, SSL_accept() - can operate in non-blocking IO mode, look at the code to see how :-). - Have a read of doc/s_mult as well. This program leaks memory and - file descriptors everywhere but I have not cleaned it up yet. - This is a demo of how to do non-blocking IO. -- The SSL session management has been 'worked over' and there is now - quite an expansive set of functions to manipulate them. Have a read of - doc/session.doc for some-things I quickly whipped up about how it now works. - This assume you know the SSLv2 protocol :-) -- I can now read/write the netscape certificate format, use the - -inform/-outform 'net' options to the x509 command. I have not put support - for this type in the other demo programs, but it would be easy to add. -- asn1parse and 'enc' have been modified so that when reading base64 - encoded files (pem format), they do not require '-----BEGIN' header lines. - The 'enc' program had a buffering bug fixed, it can be used as a general - base64 -> binary -> base64 filter by doing 'enc -a -e' and 'enc -a -d' - respecivly. Leaving out the '-a' flag in this case makes the 'enc' command - into a form of 'cat'. -- The 'x509' and 'req' programs have been fixed and modified a little so - that they generate self-signed certificates correctly. The test - script actually generates a 'CA' certificate and then 'signs' a - 'user' certificate. Have a look at this shell script (test/sstest) - to see how things work, it tests most possible combinations of what can - be done. -- The 'SSL_set_pref_cipher()' function has been 'fixed' and the prefered name - of SSL_set_cipher_list() is now the correct API (stops confusion :-). - If this function is used in the client, only the specified ciphers can - be used, with preference given to the order the ciphers were listed. - For the server, if this is used, only the specified ciphers will be used - to accept connections. If this 'option' is not used, a default set of - ciphers will be used. The SSL_CTX_set_cipher_list(SSL_CTX *ctx) sets this - list for all ciphers started against the SSL_CTX. So the order is - SSL cipher_list, if not present, SSL_CTX cipher list, if not - present, then the library default. - What this means is that normally ciphers like - NULL-MD5 will never be used. The only way this cipher can be used - for both ends to specify to use it. - To enable or disable ciphers in the library at build time, modify the - first field for the cipher in the ssl_ciphers array in ssl/ssl_lib.c. - This file also contains the 'pref_cipher' list which is the default - cipher preference order. -- I'm not currently sure if the 'rsa -inform net' and the 'rsa -outform net' - options work. They should, and they enable loading and writing the - netscape rsa private key format. I will be re-working this section of - SSLeay for the next version. What is currently in place is a quick and - dirty hack. -- I've re-written parts of the bignum library. This gives speedups - for all platforms. I now provide assembler for use under Windows NT. - I have not tested the Windows 3.1 assembler but it is quite simple code. - This gives RSAprivate_key operation encryption times of 0.047s (512bit key) - and 0.230s (1024bit key) on a pentium 100 which I consider reasonable. - Basically the times available under linux/solaris x86 can be achieve under - Windows NT. I still don't know how these times compare to RSA's BSAFE - library but I have been emailing with people and with their help, I should - be able to get my library's quite a bit faster still (more algorithm changes). - The object file crypto/bn/asm/x86-32.obj should be used when linking - under NT. -- 'make makefile.one' in the top directory will generate a single makefile - called 'makefile.one' This makefile contains no perl references and - will build the SSLeay library into the 'tmp' and 'out' directories. - util/mk1mf.pl >makefile.one is how this makefile is - generated. The mk1mf.pl command take several option to generate the - makefile for use with cc, gcc, Visual C++ and Borland C++. This is - still under development. I have only build .lib's for NT and MSDOS - I will be working on this more. I still need to play with the - correct compiler setups for these compilers and add some more stuff but - basically if you just want to compile the library - on a 'non-unix' platform, this is a very very good file to start with :-). - Have a look in the 'microsoft' directory for my current makefiles. - I have not yet modified things to link with sockets under Windows NT. - You guys should be able to do this since this is actually outside of the - SSLeay scope :-). I will be doing it for myself soon. - util/mk1mf.pl takes quite a few options including no-rc, rsaref and no-sock - to build without RC2/RC4, to require RSAref for linking, and to - build with no socket code. - -- Oh yes, the cipher that was reported to be compatible with RSA's RC2 cipher - that was posted to sci.crypt has been added to the library and SSL. - I take the view that if RC2 is going to be included in a standard, - I'll include the cipher to make my package complete. - There are NO_RC2, NO_RC4 and NO_IDEA macros to remove these ciphers - at compile time. I have not tested this recently but it should all work - and if you are in the USA and don't want RSA threatening to sue you, - you could probably remove the RC4/RC2 code inside these sections. - I may in the future include a perl script that does this code - removal automatically for those in the USA :-). -- I have removed all references to sed in the makefiles. So basically, - the development environment requires perl and sh. The build environment - does not (use the makefile.one makefile). - The Configure script still requires perl, this will probably stay that way - since I have perl for Windows NT :-). - -eric (03-May-1996) - -PS Have a look in the VERSION file for more details on the changes and - bug fixes. -I have fixed a few bugs, added alpha and x86 assembler and generally cleaned -things up. This version will be quite stable, mostly because I'm on -holidays until 10-March-1996. For any problems in the interum, send email -to Tim Hudson . - -SSLeay 0.5.0 - -12-12-95 -This is going out before it should really be released. - -I leave for 11 weeks holidays on the 22-12-95 and so I either sit on -this for 11 weeks or get things out. It is still going to change a -lot in the next week so if you do grab this version, please test and -give me feed back ASAP, inculuding questions on how to do things with -the library. This will prompt me to write documentation so I don't -have to answer the same question again :-). - -This 'pre' release version is for people who are interested in the -library. The applications will have to be changed to use -the new version of the SSL interface. I intend to finish more -documentation before I leave but until then, look at the programs in -the apps directory. As far as code goes, it is much much nicer than -the old version. - -The current library works, has no memory leaks (as far as I can tell) -and is far more bug free that 0.4.5d. There are no global variable of -consequence (I believe) and I will produce some documentation that -tell where to look for those people that do want to do multi-threaded -stuff. - -There should be more documentation. Have a look in the -doc directory. I'll be adding more before I leave, it is a start -by mostly documents the crypto library. Tim Hudson will update -the web page ASAP. The spelling and grammar are crap but -it is better than nothing :-) - -Reasons to start playing with version 0.5.0 -- All the programs in the apps directory build into one ssleay binary. -- There is a new version of the 'req' program that generates certificate - requests, there is even documentation for this one :-) -- There is a demo certification authorithy program. Currently it will - look at the simple database and update it. It will generate CRL from - the data base. You need to edit the database by hand to revoke a - certificate, it is my aim to use perl5/Tk but I don't have time to do - this right now. It will generate the certificates but the management - scripts still need to be written. This is not a hard task. -- Things have been cleaned up alot. -- Have a look at the enc and dgst programs in the apps directory. -- It supports v3 of x509 certiticates. - - -Major things missing. -- I have been working on (and thinging about) the distributed x509 - hierachy problem. I have not had time to put my solution in place. - It will have to wait until I come back. -- I have not put in CRL checking in the certificate verification but - it would not be hard to do. I was waiting until I could generate my - own CRL (which has only been in the last week) and I don't have time - to put it in correctly. -- Montgomery multiplication need to be implemented. I know the - algorithm, just ran out of time. -- PKCS#7. I can load and write the DER version. I need to re-work - things to support BER (if that means nothing, read the ASN1 spec :-). -- Testing of the higher level digital envelope routines. I have not - played with the *_seal() and *_open() type functions. They are - written but need testing. The *_sign() and *_verify() functions are - rock solid. -- PEM. Doing this and PKCS#7 have been dependant on the distributed - x509 heirachy problem. I started implementing my ideas, got - distracted writing a CA program and then ran out of time. I provide - the functionality of RSAref at least. -- Re work the asm. code for the x86. I've changed by low level bignum - interface again, so I really need to tweak the x86 stuff. gcc is - good enough for the other boxes. - diff --git a/Configure b/Configure deleted file mode 100755 index 2215a3120a..0000000000 --- a/Configure +++ /dev/null @@ -1,1175 +0,0 @@ -: -eval 'exec perl -S $0 ${1+"$@"}' - if $running_under_some_shell; -## -## Configure -- OpenSSL source tree configuration script -## - -require 5.000; -use strict; - -# see INSTALL for instructions. - -my $usage="Usage: Configure [no- ...] [-Dxxx] [-lxxx] [-Lxxx] [-fxxx] [-Kxxx] [no-hw-xxx|no-hw] [rsaref] [no-threads] [no-asm] [no-dso] [386] [--prefix=DIR] [--openssldir=OPENSSLDIR] os/compiler[:flags]\n"; - -# Options: -# -# --openssldir install OpenSSL in OPENSSLDIR (Default: DIR/ssl if the -# --prefix option is given; /usr/local/ssl otherwise) -# --prefix prefix for the OpenSSL include, lib and bin directories -# (Default: the OPENSSLDIR directory) -# -# --install_prefix Additional prefix for package builders (empty by -# default). This needn't be set in advance, you can -# just as well use "make INSTALL_PREFIX=/whatever install". -# -# no-hw-xxx do not compile support for specific crypto hardware. -# Generic OpenSSL-style methods relating to this support -# are always compiled but return NULL if the hardware -# support isn't compiled. -# no-hw do not compile support for any crypto hardware. -# rsaref use RSAref -# [no-]threads [don't] try to create a library that is suitable for -# multithreaded applications (default is "threads" if we -# know how to do it) -# [no-]shared [don't] try to create shared libraries when supported. -# no-asm do not use assembler -# no-dso do not compile in any native shared-library methods. This -# will ensure that all methods just return NULL. -# 386 generate 80386 code -# no- build without specified algorithm (rsa, idea, rc5, ...) -# - + compiler options are passed through -# -# DEBUG_SAFESTACK use type-safe stacks to enforce type-safety on stack items -# provided to stack calls. Generates unique stack functions for -# each possible stack type. -# DES_PTR use pointer lookup vs arrays in the DES in crypto/des/des_locl.h -# DES_RISC1 use different DES_ENCRYPT macro that helps reduce register -# dependancies but needs to more registers, good for RISC CPU's -# DES_RISC2 A different RISC variant. -# DES_UNROLL unroll the inner DES loop, sometimes helps, somtimes hinders. -# DES_INT use 'int' instead of 'long' for DES_LONG in crypto/des/des.h -# This is used on the DEC Alpha where long is 8 bytes -# and int is 4 -# BN_LLONG use the type 'long long' in crypto/bn/bn.h -# MD2_CHAR use 'char' instead of 'int' for MD2_INT in crypto/md2/md2.h -# MD2_LONG use 'long' instead of 'int' for MD2_INT in crypto/md2/md2.h -# IDEA_SHORT use 'short' instead of 'int' for IDEA_INT in crypto/idea/idea.h -# IDEA_LONG use 'long' instead of 'int' for IDEA_INT in crypto/idea/idea.h -# RC2_SHORT use 'short' instead of 'int' for RC2_INT in crypto/rc2/rc2.h -# RC2_LONG use 'long' instead of 'int' for RC2_INT in crypto/rc2/rc2.h -# RC4_CHAR use 'char' instead of 'int' for RC4_INT in crypto/rc4/rc4.h -# RC4_LONG use 'long' instead of 'int' for RC4_INT in crypto/rc4/rc4.h -# RC4_INDEX define RC4_INDEX in crypto/rc4/rc4_locl.h. This turns on -# array lookups instead of pointer use. -# RC4_CHUNK enables code that handles data aligned at long (natural CPU -# word) boundary. -# RC4_CHUNK_LL enables code that handles data aligned at long long boundary -# (intended for 64-bit CPUs running 32-bit OS). -# BF_PTR use 'pointer arithmatic' for Blowfish (unsafe on Alpha). -# BF_PTR2 intel specific version (generic version is more efficient). -# MD5_ASM use some extra md5 assember, -# SHA1_ASM use some extra sha1 assember, must define L_ENDIAN for x86 -# RMD160_ASM use some extra ripemd160 assember, - -my $x86_gcc_des="DES_PTR DES_RISC1 DES_UNROLL"; - -# MD2_CHAR slags pentium pros -my $x86_gcc_opts="RC4_INDEX MD2_INT"; - -# MODIFY THESE PARAMETERS IF YOU ARE GOING TO USE THE 'util/speed.sh SCRIPT -# Don't worry about these normally - -my $tcc="cc"; -my $tflags="-fast -Xa"; -my $tbn_mul=""; -my $tlib="-lnsl -lsocket"; -#$bits1="SIXTEEN_BIT "; -#$bits2="THIRTY_TWO_BIT "; -my $bits1="THIRTY_TWO_BIT "; -my $bits2="SIXTY_FOUR_BIT "; - -my $x86_sol_asm="asm/bn86-sol.o asm/co86-sol.o:asm/dx86-sol.o asm/yx86-sol.o:asm/bx86-sol.o:asm/mx86-sol.o:asm/sx86-sol.o:asm/cx86-sol.o:asm/rx86-sol.o:asm/rm86-sol.o:asm/r586-sol.o"; -my $x86_elf_asm="asm/bn86-elf.o asm/co86-elf.o:asm/dx86-elf.o asm/yx86-elf.o:asm/bx86-elf.o:asm/mx86-elf.o:asm/sx86-elf.o:asm/cx86-elf.o:asm/rx86-elf.o:asm/rm86-elf.o:asm/r586-elf.o"; -my $x86_out_asm="asm/bn86-out.o asm/co86-out.o:asm/dx86-out.o asm/yx86-out.o:asm/bx86-out.o:asm/mx86-out.o:asm/sx86-out.o:asm/cx86-out.o:asm/rx86-out.o:asm/rm86-out.o:asm/r586-out.o"; -my $x86_bsdi_asm="asm/bn86bsdi.o asm/co86bsdi.o:asm/dx86bsdi.o asm/yx86bsdi.o:asm/bx86bsdi.o:asm/mx86bsdi.o:asm/sx86bsdi.o:asm/cx86bsdi.o:asm/rx86bsdi.o:asm/rm86bsdi.o:asm/r586bsdi.o"; - -# -DB_ENDIAN slows things down on a sparc for md5, but helps sha1. -# So the md5_locl.h file has an undef B_ENDIAN if sun is defined - -#config-string $cc : $cflags : $unistd : $thread_cflag : $lflags : $bn_ops : $bn_obj : $des_obj : $bf_obj : $md5_obj : $sha1_obj : $cast_obj : $rc4_obj : $rmd160_obj : $rc5_obj : $dso_scheme : $shared_target : $shared_cflag - -my %table=( -# File 'TABLE' (created by 'make TABLE') contains the data from this list, -# formatted for better readability. - - -#"b", "${tcc}:${tflags}::${tlib}:${bits1}:${tbn_mul}::", -#"bl-4c-2c", "${tcc}:${tflags}::${tlib}:${bits1}BN_LLONG RC4_CHAR MD2_CHAR:${tbn_mul}::", -#"bl-4c-ri", "${tcc}:${tflags}::${tlib}:${bits1}BN_LLONG RC4_CHAR RC4_INDEX:${tbn_mul}::", -#"b2-is-ri-dp", "${tcc}:${tflags}::${tlib}:${bits2}IDEA_SHORT RC4_INDEX DES_PTR:${tbn_mul}::", - -# Our development configs -"purify", "purify gcc:-g -DPURIFY -Wall::(unknown):-lsocket -lnsl::::", -"debug", "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -ggdb -g2 -Wformat -Wshadow -Wmissing-prototypes -Wmissing-declarations -Werror::(unknown):-lefence::::", -"debug-ben", "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown):::::", -"debug-ben-debug", "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown):::::", -"debug-ben-strict", "gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DCONST_STRICT -O2 -Wall -Wshadow -Werror -Wpointer-arith -Wcast-qual -Wwrite-strings -pipe::(unknown):::::", -"debug-rse","cc:-DTERMIOS -DL_ENDIAN -pipe -O -g -ggdb3 -Wall::(unknown)::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}", -"debug-bodo", "gcc:-DL_ENDIAN -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -DBIO_PAIR_DEBUG -g -m486 -pedantic -Wshadow -Wall::-D_REENTRANT::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}", -"debug-ulf", "gcc:-DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DBN_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -g -O2 -m486 -Wall -Werror -Wshadow -pipe::-D_REENTRANT::${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}", -"debug-steve", "gcc:-DL_ENDIAN -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DDEBUG_SAFESTACK -DCRYPTO_MDEBUG_ALL -DPEDANTIC -g -O2 -m486 -pedantic -Wall -Werror -Wshadow -pipe::-D_REENTRANT::${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}", -"debug-levitte-linux-elf","gcc:-DUSE_ALLOCATING_PRINT -DRL_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DNO_ASM -DL_ENDIAN -DTERMIO -D_POSIX_SOURCE -ggdb -g3 -m486 -pedantic -ansi -Wall -Wshadow -Wid-clash-31 -pipe::-D_REENTRANT:-ldl:::::::::::dlfcn", -"dist", "cc:-O::(unknown):::::", - -# Basic configs that should work on any (32 and less bit) box -"gcc", "gcc:-O3::(unknown)::BN_LLONG:::", -"cc", "cc:-O::(unknown):::::", - -#### Solaris x86 setups -# -DNO_INLINE_ASM switches off inline assembler. We have to do it -# here because whenever GNU C instantiates an assembler template it -# surrounds it with #APP #NO_APP comment pair which (at least Solaris -# 7_x86) /usr/ccs/bin/as fails to assemble with "Illegal mnemonic" -# error message. -"solaris-x86-gcc","gcc:-O3 -fomit-frame-pointer -m486 -Wall -DL_ENDIAN -DNO_INLINE_ASM::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_sol_asm}:dlfcn:solaris-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -#### SPARC Solaris with GNU C setups -"solaris-sparcv7-gcc","gcc:-O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::::::::::dlfcn:solaris-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"solaris-sparcv8-gcc","gcc:-mv8 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8.o:::::::::dlfcn:solaris-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"solaris-sparcv9-gcc","gcc:-mcpu=ultrasparc -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o::::::dlfcn:solaris-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -# gcc pre-2.8 doesn't understand -mcpu=ultrasparc, so fall down to -mv8 -# but keep the assembler modules. -"solaris-sparcv9-gcc27","gcc:-mv8 -O3 -fomit-frame-pointer -Wall -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus-gcc27.o:::asm/md5-sparcv8plus-gcc27.o::::::dlfcn:solaris-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -#### -"debug-solaris-sparcv8-gcc","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -O -g -mv8 -Wall -DB_ENDIAN::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8.o:::::::::dlfcn:solaris-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"debug-solaris-sparcv9-gcc","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -O -g -mcpu=ultrasparc -Wall -DB_ENDIAN::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus.o:::::::::dlfcn:solaris-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -#### SPARC Solaris with Sun C setups -# DO NOT use /xO[34] on sparc with SC3.0. It is broken, and will not pass the tests -"solaris-sparc-sc3","cc:-fast -O -Xa -DB_ENDIAN::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_UNROLL BF_PTR::::::::::dlfcn:solaris-shared:-KPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -# SC4.0 doesn't pass 'make test', upgrade to SC5.0 or SC4.2. -# SC4.2 is ok, better than gcc even on bn as long as you tell it -xarch=v8 -# SC5.0 note: Compiler common patch 107357-01 or later is required! -"solaris-sparcv7-cc","cc:-xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::::::::dlfcn:solaris-shared:-KPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"solaris-sparcv8-cc","cc:-xarch=v8 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8.o:::::::::dlfcn:solaris-shared:-KPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"solaris-sparcv9-cc","cc:-xtarget=ultra -xarch=v8plus -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o::::::dlfcn:solaris-shared:-KPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"solaris64-sparcv9-cc","cc:-xtarget=ultra -xarch=v9 -xO5 -xstrconst -xdepend -Xa -DB_ENDIAN -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl -ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::asm/md5-sparcv9.o::::::dlfcn:solaris-shared:-KPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -#### -"debug-solaris-sparcv8-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -xarch=v8 -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8.o:::::::::dlfcn:solaris-shared:-KPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"debug-solaris-sparcv9-cc","cc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG_ALL -xtarget=ultra -xarch=v8plus -g -O -xstrconst -Xa -DB_ENDIAN -DBN_DIV2W -DULTRASPARC::-D_REENTRANT:-lsocket -lnsl -ldl:BN_LLONG RC4_CHAR RC4_CHUNK_LL DES_PTR DES_RISC1 DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o::::::dlfcn:solaris-shared:-KPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -#### SPARC Linux setups -"linux-sparcv7","gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::", -# Ray Miller has patiently -# assisted with debugging of following two configs. -"linux-sparcv8","gcc:-mv8 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8.o::::", -# it's a real mess with -mcpu=ultrasparc option under Linux, but -# -Wa,-Av8plus should do the trick no matter what. -"linux-sparcv9","gcc:-mcpu=ultrasparc -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DULTRASPARC -DBN_DIV2W::-D_REENTRANT::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:asm/sparcv8plus.o:::asm/md5-sparcv8plus.o:", -# !!!Folowing can't be even tested yet!!! -# We have to wait till 64-bit glibc for SPARC is operational!!! -#"linux64-sparcv9","sparc64-linux-gcc:-m64 -mcpu=v9 -DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall -DULTRASPARC -DBN_DIV2W::-D_REENTRANT::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR::::asm/md5-sparcv9.o:", - -# Sunos configs, assuming sparc for the gcc one. -##"sunos-cc", "cc:-O4 -DNOPROTO -DNOCONST::(unknown)::DES_UNROLL:::", -"sunos-gcc","gcc:-O3 -mv8 -Dssize_t=int::(unknown)::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL DES_PTR DES_RISC1:::", - -#### IRIX 5.x configs -# -mips2 flag is added by ./config when appropriate. -"irix-gcc","gcc:-O3 -DTERMIOS -DB_ENDIAN::(unknown)::BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK DES_UNROLL DES_RISC2 DES_PTR BF_PTR::::::::::dlfcn:irix-shared::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"irix-cc", "cc:-O2 -use_readonly_const -DTERMIOS -DB_ENDIAN::(unknown)::BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC2 DES_UNROLL BF_PTR::::::::::dlfcn:irix-shared::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -#### IRIX 6.x configs -# Only N32 and N64 ABIs are supported. If you need O32 ABI build, invoke -# './Configure irix-[g]cc' manually. -# -mips4 flag is added by ./config when appropriate. -"irix-mips3-gcc","gcc:-mabi=n32 -mmips-as -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE::MD2_CHAR RC4_INDEX RC4_CHAR RC4_CHUNK_LL DES_UNROLL DES_RISC2 DES_PTR BF_PTR SIXTY_FOUR_BIT:asm/mips3.o:::::::::dlfcn:irix-shared::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"irix-mips3-cc", "cc:-n32 -O2 -use_readonly_const -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE::DES_PTR RC4_CHAR RC4_CHUNK_LL DES_RISC2 DES_UNROLL BF_PTR SIXTY_FOUR_BIT:asm/mips3.o:::::::::dlfcn:irix-shared::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -# N64 ABI builds. -"irix64-mips4-gcc","gcc:-mabi=64 -mips4 -mmips-as -O3 -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:asm/mips3.o:::::::::dlfcn:irix-shared::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"irix64-mips4-cc", "cc:-64 -mips4 -O2 -use_readonly_const -DTERMIOS -DB_ENDIAN -DBN_DIV3W::-D_SGI_MP_SOURCE::RC4_CHAR RC4_CHUNK DES_RISC2 DES_UNROLL SIXTY_FOUR_BIT_LONG:asm/mips3.o:::::::::dlfcn:irix-shared::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -#### Unified HP-UX ANSI C configs. -# Special notes: -# - Originally we were optimizing at +O4 level. It should be noted -# that the only difference between +O3 and +O4 is global inter- -# procedural analysis. As it has to be performed during the link -# stage the compiler leaves behind certain pseudo-code in lib*.a -# which might be release or even patch level specific. Generating -# the machine code for and analyzing the *whole* program appears -# to be *extremely* memory demanding while the performance gain is -# actually questionable. The situation is intensified by the default -# HP-UX data set size limit (infamous 'maxdsiz' tunable) of 64MB -# which is way too low for +O4. In other words, doesn't +O3 make -# more sense? -# - Keep in mind that the HP compiler by default generates code -# suitable for execution on the host you're currently compiling at. -# If the toolkit is ment to be used on various PA-RISC processors -# consider './config +Dportable'. -# - +DD64 is chosen in favour of +DA2.0W because it's ment to be -# compatible with *future* releases. -# - If you run ./Configure hpux-parisc-[g]cc manually don't forget to -# pass -D_REENTRANT on HP-UX 10 and later. -# - -DMD32_XARRAY triggers workaround for compiler bug we ran into in -# 32-bit message digests. (For the moment of this writing) HP C -# doesn't seem to "digest" too many local variables (they make "him" -# chew forever:-). For more details look-up MD32_XARRAY comment in -# crypto/sha/sha_lcl.h. -# -# -#!#"hpux-parisc-cc","cc:-Ae +O3 +ESlit -z -DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY:::-ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl", -# Since there is mention of this in shlib/hpux10-cc.sh -"hpux-parisc-cc-o4","cc:-Ae +O4 +ESlit -z -DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY:::-ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:+Z:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"hpux-parisc-gcc","gcc:-O3 -DB_ENDIAN -DBN_DIV2W:::-Wl,+s -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:-fPIC:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"hpux64-parisc-cc","cc:-Ae +DD64 +O3 +ESlit -z -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT:-ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT::::::::::dlfcn:hpux64-shared:+Z:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -# More attempts at unified 10.X and 11.X targets for HP C compiler. -# -# Chris Ruemmler -# Kevin Steves -"hpux-parisc-cc","cc:+O3 +Optrs_strongly_typed +Olibcalls -Ae +ESlit -DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY::-D_REENTRANT:-Wl,+s -ldld:MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT::::::::::dl:hpux-shared:+Z:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"hpux-parisc2-cc","cc:+DA2.0 +DS2.0 +O3 +Optrs_strongly_typed +Olibcalls -Ae +ESlit -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT:-Wl,+s -ldld:SIXTY_FOUR_BIT MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT:asm/pa-risc2.o:::::::::dl:hpux-shared:+Z:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"hpux64-parisc2-cc","cc:+DD64 +O3 +Optrs_strongly_typed +Olibcalls -Ae +ESlit -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT:-ldl:SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT:asm/pa-risc2W.o:::::::::dlfcn:hpux64-shared:+Z:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"hpux-parisc1_1-cc","cc:+DA1.1 +DS1.1 +O3 +Optrs_strongly_typed +Olibcalls -Ae +ESlit -DB_ENDIAN -DMD32_XARRAY::-D_REENTRANT:-Wl,+s -ldld:MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT::::::::::dl:hpux-shared:+Z:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -# HPUX 9.X config. -# Don't use the bundled cc. It is broken. Use HP ANSI C if possible, or -# egcs. gcc 2.8.1 is also broken. - -"hpux-cc", "cc:-DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY -Ae +ESlit +O3 -z::(unknown):-Wl,+s -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:+Z:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -# If hpux-cc fails (e.g. during "make test"), try the next one; otherwise, -# please report your OS and compiler version to the openssl-bugs@openssl.org -# mailing list. -"hpux-brokencc", "cc:-DB_ENDIAN -DBN_DIV2W -Ae +ESlit +O2 -z::(unknown):-Wl,+s -ldld:DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:+Z:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -"hpux-gcc", "gcc:-DB_ENDIAN -DBN_DIV2W -O3::(unknown):-Wl,+s -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:-fPIC:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -# If hpux-gcc fails, try this one: -"hpux-brokengcc", "gcc:-DB_ENDIAN -DBN_DIV2W -O3::(unknown):-Wl,+s -ldld:DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:-fPIC:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -# HPUX 10.X config. Supports threads. -"hpux10-cc", "cc:-DB_ENDIAN -DBN_DIV2W -DMD32_XARRAY -Ae +ESlit +O3 -z::-D_REENTRANT:-Wl,+s -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:+Z:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -# If hpux10-cc fails, try this one (if still fails, try deleting BN_LLONG): -"hpux10-brokencc", "cc:-DB_ENDIAN -DBN_DIV2W -Ae +ESlit +O2 -z::-D_REENTRANT:-Wl,+s -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:+Z:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -"hpux10-gcc", "gcc:-DB_ENDIAN -DBN_DIV2W -O3::-D_REENTRANT:-Wl,+s -ldld:BN_LLONG DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:-fPIC:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -# If hpux10-gcc fails, try this one: -"hpux10-brokengcc", "gcc:-DB_ENDIAN -DBN_DIV2W -O3::-D_REENTRANT:-Wl,+s -ldld:DES_PTR DES_UNROLL DES_RISC1::::::::::dl:hpux-shared:-fPIC:.sl.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -# HPUX 11.X from www.globus.org. -# Only works on PA-RISC 2.0 cpus, and not optimized. Why? -#"hpux11-32bit-cc","cc:+DA2.0 -DB_ENDIAN -D_HPUX_SOURCE -Aa -Ae +ESlit::-D_REENTRANT::DES_PTR DES_UNROLL DES_RISC1:::", -#"hpux11-64bit-cc","cc:+DA2.0W -g -D_HPUX_SOURCE -Aa -Ae +ESlit::-D_REENTRANT::SIXTY_FOUR_BIT_LONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC1 DES_INT :::", -# Use unified settings above instead. - -#### HP MPE/iX http://jazz.external.hp.com/src/openssl/ -"MPE/iX-gcc", "gcc:-D_ENDIAN -DBN_DIV2W -O3 -DMPE -D_POSIX_SOURCE -D_SOCKET_SOURCE -I/SYSLOG/PUB::(unknown):-L/SYSLOG/PUB -lsyslog -lsocket -lcurses:BN_LLONG DES_PTR DES_UNROLL DES_RISC1:::", - -# Dec Alpha, OSF/1 - the alpha164-cc is the flags for a 21164A with -# the new compiler -# For gcc, the following gave a %50 speedup on a 164 over the 'DES_INT' version -"alpha-gcc","gcc:-O3::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_RISC1:asm/alpha.o:::::::::dlfcn:tru64-shared::.so", -"alpha-cc", "cc:-std1 -tune host -O4 -readonly_strings::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK:asm/alpha.o:::::::::dlfcn:tru64-shared::.so", -"alpha164-cc", "cc:-std1 -tune host -fast -readonly_strings::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK:asm/alpha.o:::::::::dlfcn:tru64-shared::.so", -"FreeBSD-alpha","gcc:-DTERMIOS -O -fomit-frame-pointer::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC2::::::::::dlfcn:bsd-gcc-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -#### Alpha Linux with GNU C and Compaq C setups -# Special notes: -# - linux-alpha+bwx-gcc is ment to be used from ./config only. If you -# ought to run './Configure linux-alpha+bwx-gcc' manually, do -# complement the command line with -mcpu=ev56, -mcpu=ev6 or whatever -# which is appropriate. -# - If you use ccc keep in mind that -fast implies -arch host and the -# compiler is free to issue instructions which gonna make elder CPU -# choke. If you wish to build "blended" toolkit, add -arch generic -# *after* -fast and invoke './Configure linux-alpha-ccc' manually. -# -# -# -"linux-alpha-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT:-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_UNROLL:asm/alpha.o:::::::::dlfcn:linux-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"linux-alpha+bwx-gcc","gcc:-O3 -DL_ENDIAN -DTERMIO::-D_REENTRANT:-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:asm/alpha.o:::::::::dlfcn:linux-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"linux-alpha-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:asm/alpha.o::", -"linux-alpha+bwx-ccc","ccc:-fast -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:asm/alpha.o::", - -# assembler versions -- currently defunct: -##"OpenBSD-alpha","gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown):SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2:asm/alpha.o::", - -# The intel boxes :-), It would be worth seeing if bsdi-gcc can use the -# bn86-elf.o file file since it is hand tweaked assembler. -"linux-elf", "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall::-D_REENTRANT:-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"debug-linux-elf","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -m486 -Wall::-D_REENTRANT:-lefence -ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn", -"debug-linux-elf-noefence","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DL_ENDIAN -DTERMIO -g -m486 -Wall::-D_REENTRANT:-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn", -"linux-aout", "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -m486 -Wall::(unknown)::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}", -"linux-mipsel", "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::(unknown)::BN_LLONG:::", -"linux-mips", "gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::(unknown)::BN_LLONG:::", -"linux-ppc", "gcc:-DB_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::BN_LLONG::", -"linux-m68k", "gcc:-DB_ENDIAN -DTERMIO -O2 -fomit-frame-pointer -Wall::-D_REENTRANT::BN_LLONG::", -"linux-ia64", "gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::(unknown)::SIXTY_FOUR_BIT_LONG::", -"NetBSD-sparc", "gcc:-DTERMIOS -O3 -fomit-frame-pointer -mv8 -Wall -DB_ENDIAN::(unknown)::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"NetBSD-m68", "gcc:-DTERMIOS -O3 -fomit-frame-pointer -Wall -DB_ENDIAN::(unknown)::BN_LLONG MD2_CHAR RC4_INDEX DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"NetBSD-x86", "gcc:-DTERMIOS -O3 -fomit-frame-pointer -m486 -Wall::(unknown)::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::dlfcn:bsd-gcc-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"FreeBSD-elf", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::-pthread -D_REENTRANT -D_THREAD_SAFE -D_THREADSAFE::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"FreeBSD", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::(unknown)::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}", -"bsdi-gcc", "gcc:-O3 -ffast-math -DL_ENDIAN -DPERL5 -m486::(unknown)::RSA_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_bsdi_asm}", -"bsdi-elf-gcc", "gcc:-DPERL5 -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::(unknown)::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:bsd-gcc-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"nextstep", "cc:-O -Wall::(unknown)::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::", -"nextstep3.3", "cc:-O3 -Wall::(unknown)::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::", -# NCR MP-RAS UNIX ver 02.03.01 -"ncr-scde","cc:-O6 -Xa -Hoff=BEHAVED -686 -Hwide -Hiw::(unknown):-lsocket -lnsl:${x86_gcc_des} ${x86_gcc_opts}:::", - -# QNX 4 -"qnx4", "cc:-DL_ENDIAN -DTERMIO::(unknown)::${x86_gcc_des} ${x86_gcc_opts}:", - -# Linux on ARM -"linux-elf-arm","gcc:-DL_ENDIAN -DTERMIO -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::BN_LLONG::::::::::dlfcn:linux-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -# UnixWare 2.0 -"unixware-2.0","cc:-O -DFILIO_H::(unknown):-lsocket -lnsl:${x86_gcc_des} ${x86_gcc_opts}:::", -"unixware-2.0-pentium","cc:-O -DFILIO_H -Kpentium -Kthread::(unknown):-lsocket -lnsl:MD2_CHAR RC4_INDEX ${x86_gcc_des}::", - -# UnixWare 7 -"unixware-7","cc:-O -DFILIO_H -Kalloca::-Kthread:-lsocket -lnsl:MD2_CHAR RC4_INDEX ${x86_gcc_des}::", - -# IBM's AIX. -"aix-cc", "cc:-O -DAIX -DB_ENDIAN -qmaxmem=16384::(unknown)::BN_LLONG RC4_CHAR:::", -"aix-gcc", "gcc:-O3 -DAIX -DB_ENDIAN::(unknown)::BN_LLONG RC4_CHAR:::", - -# -# Cray T90 (SDSC) -# It's Big-endian, but the algorithms work properly when B_ENDIAN is NOT -# defined. The T90 ints and longs are 8 bytes long, and apparently the -# B_ENDIAN code assumes 4 byte ints. Fortunately, the non-B_ENDIAN and -# non L_ENDIAN code aligns the bytes in each word correctly. -# -# The BIT_FIELD_LIMITS define is to avoid two fatal compiler errors: -#'Taking the address of a bit field is not allowed. ' -#'An expression with bit field exists as the operand of "sizeof" ' -# (written by Wayne Schroeder ) -"cray-t90-cc", "cc: -DBIT_FIELD_LIMITS -DTERMIOS::(unknown)::SIXTY_FOUR_BIT_LONG DES_INT:::", - -# -# Cray T3E (Research Center Juelich, beckman@acl.lanl.gov) -# -# The BIT_FIELD_LIMITS define was written for the C90 (it seems). I added -# another use. Basically, the problem is that the T3E uses some bit fields -# for some st_addr stuff, and then sizeof and address-of fails -# I could not use the ams/alpha.o option because the Cray assembler, 'cam' -# did not like it. -"cray-t3e", "cc: -DBIT_FIELD_LIMITS -DTERMIOS::(unknown)::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT:::", - -# DGUX, 88100. -"dgux-R3-gcc", "gcc:-O3 -fomit-frame-pointer::(unknown)::RC4_INDEX DES_UNROLL:::", -"dgux-R4-gcc", "gcc:-O3 -fomit-frame-pointer::(unknown):-lnsl -lsocket:RC4_INDEX:RC4_INDEX DES_UNROLL:::", -"dgux-R4-x86-gcc", "gcc:-O3 -fomit-frame-pointer -DL_ENDIAN::(unknown):-lnsl -lsocket:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}", - -# SCO 5 - Ben Laurie says the -O breaks the -# SCO cc. -"sco5-cc", "cc:::(unknown):-lsocket:${x86_gcc_des} ${x86_gcc_opts}:::", # des options? -"sco5-gcc", "gcc:-O3 -fomit-frame-pointer::(unknown):-lsocket:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:::", # the SCO assembler doesn't seem to like our assembler files ... - -# Sinix/ReliantUNIX RM400 -# NOTE: The CDS++ Compiler up to V2.0Bsomething has the IRIX_CC_BUG optimizer problem. Better use -g */ -"ReliantUNIX","cc:-KPIC -g -DSNI -DTERMIOS -DB_ENDIAN::-Kthread:-lsocket -lnsl -lc -L/usr/ucblib -lucb:BN_LLONG DES_PTR DES_RISC2 DES_UNROLL BF_PTR:::", -"SINIX","cc:-O -DSNI::(unknown):-lsocket -lnsl -lc -L/usr/ucblib -lucb:RC4_INDEX RC4_CHAR:::", -"SINIX-N","/usr/ucb/cc:-O2 -misaligned::(unknown):-lucb:RC4_INDEX RC4_CHAR:::", - -# SIEMENS BS2000/OSD: an EBCDIC-based mainframe -"BS2000-OSD","c89:-O -XLLML -XLLMK -XL -DB_ENDIAN -DTERMIOS -DCHARSET_EBCDIC::(unknown):-lsocket -lnsl:THIRTY_TWO_BIT DES_PTR DES_UNROLL MD2_CHAR RC4_INDEX RC4_CHAR BF_PTR:::", - -# Windows NT, Microsoft Visual C++ 4.0 - -"VC-NT","cl:::::BN_LLONG RC4_INDEX ${x86_gcc_opts}::::::::::win32", -"VC-WIN32","cl:::::BN_LLONG RC4_INDEX ${x86_gcc_opts}::::::::::win32", -"VC-WIN16","cl:::(unknown)::MD2_CHAR DES_UNROLL DES_PTR RC4_INDEX THIRTY_TWO_BIT:::", -"VC-W31-16","cl:::(unknown)::BN_LLONG MD2_CHAR DES_UNROLL DES_PTR RC4_INDEX SIXTEEN_BIT:::", -"VC-W31-32","cl:::::BN_LLONG MD2_CHAR DES_UNROLL DES_PTR RC4_INDEX THIRTY_TWO_BIT:::", -"VC-MSDOS","cl:::(unknown)::BN_LLONG MD2_CHAR DES_UNROLL DES_PTR RC4_INDEX SIXTEEN_BIT:::", - -# Borland C++ 4.5 -"BC-32","bcc32:::::BN_LLONG DES_PTR RC4_INDEX::::::::::win32", -"BC-16","bcc:::(unknown)::BN_LLONG DES_PTR RC4_INDEX SIXTEEN_BIT:::", - -# Mingw32 -# (Note: the real CFLAGS for Windows builds are defined by util/mk1mf.pl -# and its library files in util/pl/*) -"Mingw32", "gcc:-DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::win32", - -# CygWin32 -"CygWin32", "gcc:-DTERMIOS -DL_ENDIAN -fomit-frame-pointer -O3 -m486 -Wall::::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}::::::::::win32", - -# Ultrix from Bernhard Simon -"ultrix-cc","cc:-std1 -O -Olimit 1000 -DL_ENDIAN::(unknown)::::::", -"ultrix-gcc","gcc:-O3 -DL_ENDIAN::(unknown)::::::", -# K&R C is no longer supported; you need gcc on old Ultrix installations -##"ultrix","cc:-O2 -DNOPROTO -DNOCONST -DL_ENDIAN::(unknown)::::::", - -# Some OpenBSD from Bob Beck -"OpenBSD-alpha","gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown)::SIXTY_FOUR_BIT_LONG DES_INT DES_PTR DES_RISC2::::::::::dlfcn:bsd-gcc-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"OpenBSD-x86", "gcc:-DL_ENDIAN -DTERMIOS -O3 -fomit-frame-pointer -m486::(unknown)::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_out_asm}:dlfcn:bsd-gcc-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"OpenBSD", "gcc:-DTERMIOS -O3 -fomit-frame-pointer::(unknown)::BN_LLONG RC2_CHAR RC4_INDEX DES_UNROLL::::::::::dlfcn:bsd-gcc-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", -"OpenBSD-mips","gcc:-O2 -DL_ENDIAN::(unknown):BN_LLONG MD2_CHAR RC4_INDEX RC4_CHAR DES_UNROLL DES_RISC2 DES_PTR BF_PTR:::::::::::dlfcn:bsd-gcc-shared:-fPIC:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", - -##### MacOS X (a.k.a. Rhapsody) setup -"rhapsody-ppc-cc","cc:-O3 -DB_ENDIAN::(unknown)::BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:::", - -##### Sony NEWS-OS 4.x -"newsos4-gcc","gcc:-O -DB_ENDIAN -DNEWS4::(unknown):-lmld -liberty:BN_LLONG RC4_CHAR RC4_CHUNK DES_PTR DES_RISC1 DES_UNROLL BF_PTR::::", - -); - -my @WinTargets=qw(VC-NT VC-WIN32 VC-WIN16 VC-W31-16 VC-W31-32 VC-MSDOS BC-32 - BC-16 Mingw32); - -my $prefix=""; -my $openssldir=""; -my $install_prefix=""; -my $no_threads=0; -my $no_shared=1; -my $threads=0; -my $no_asm=0; -my $no_dso=0; -my @skip=(); -my $Makefile="Makefile.ssl"; -my $des_locl="crypto/des/des_locl.h"; -my $des ="crypto/des/des.h"; -my $bn ="crypto/bn/bn.h"; -my $md2 ="crypto/md2/md2.h"; -my $rc4 ="crypto/rc4/rc4.h"; -my $rc4_locl="crypto/rc4/rc4_locl.h"; -my $idea ="crypto/idea/idea.h"; -my $rc2 ="crypto/rc2/rc2.h"; -my $bf ="crypto/bf/bf_locl.h"; -my $bn_asm ="bn_asm.o"; -my $des_enc="des_enc.o fcrypt_b.o"; -my $bf_enc ="bf_enc.o"; -my $cast_enc="c_enc.o"; -my $rc4_enc="rc4_enc.o"; -my $rc5_enc="rc5_enc.o"; -my $md5_obj=""; -my $sha1_obj=""; -my $rmd160_obj=""; -my $processor=""; -my $ranlib; -my $perl; - -$ranlib=&which("ranlib") or $ranlib="true"; -$perl=$ENV{'PERL'} or $perl=&which("perl5") or $perl=&which("perl") - or $perl="perl"; - -&usage if ($#ARGV < 0); - -my $flags; -my $depflags; -my $openssl_algorithm_defines; -my $openssl_thread_defines; -my $openssl_other_defines; -my $libs; -my $target; -my $options; -my $symlink; - -my @argvcopy=@ARGV; -my $argvstring=""; -my $argv_unprocessed=1; - -while($argv_unprocessed) - { - $flags=""; - $depflags=""; - $openssl_algorithm_defines=""; - $openssl_thread_defines=""; - $openssl_other_defines=""; - $libs=""; - $target=""; - $options=""; - $symlink=1; - - $argv_unprocessed=0; - $argvstring=join(' ',@argvcopy); - -PROCESS_ARGS: - foreach (@argvcopy) - { - s /^-no-/no-/; # some people just can't read the instructions - if (/^no-asm$/) - { - $no_asm=1; - $flags .= "-DNO_ASM "; - $openssl_other_defines .= "#define NO_ASM\n"; - } - elsif (/^no-hw-(.+)$/) - { - my $hw=$1; - $hw =~ tr/[a-z]/[A-Z]/; - $flags .= "-DNO_HW_$hw "; - $openssl_other_defines .= "#define NO_HW_$hw\n"; - } - elsif (/^no-hw$/) - { - $flags .= "-DNO_HW "; - $openssl_other_defines .= "#define NO_HW\n"; - } - elsif (/^no-dso$/) - { $no_dso=1; } - elsif (/^no-threads$/) - { $no_threads=1; } - elsif (/^threads$/) - { $threads=1; } - elsif (/^no-shared$/) - { $no_shared=1; } - elsif (/^shared$/) - { $no_shared=0; } - elsif (/^no-symlinks$/) - { $symlink=0; } - elsif (/^no-(.+)$/) - { - my $algo=$1; - push @skip,$algo; - $algo =~ tr/[a-z]/[A-Z]/; - $flags .= "-DNO_$algo "; - $depflags .= "-DNO_$algo "; - $openssl_algorithm_defines .= "#define NO_$algo\n"; - if ($algo eq "DES") - { - push @skip, "mdc2"; - $options .= " no-mdc2"; - $flags .= "-DNO_MDC2 "; - $depflags .= "-DNO_MDC2 "; - $openssl_algorithm_defines .= "#define NO_MDC2\n"; - } - } - elsif (/^reconfigure/ || /^reconf/) - { - if (open(IN,"<$Makefile")) - { - while () - { - chop; - if (/^CONFIGURE_ARGS=(.*)/) - { - $argvstring=$1; - @argvcopy=split(' ',$argvstring); - die "Incorrect data to reconfigure, please do a normal configuration\n" - if (grep(/^reconf/,@argvcopy)); - print "Reconfiguring with: $argvstring\n"; - $argv_unprocessed=1; - close(IN); - last PROCESS_ARGS; - } - } - close(IN); - } - die "Insufficient data to reconfigure, please do a normal configuration\n"; - } - elsif (/^386$/) - { $processor=386; } - elsif (/^rsaref$/) - { - $libs.= "-lRSAglue -lrsaref "; - $flags.= "-DRSAref "; - $openssl_other_defines .= "#define RSAref\n"; - } - elsif (/^[-+]/) - { - if (/^-[lL](.*)$/) - { - $libs.=$_." "; - } - elsif (/^-[^-]/ or /^\+/) - { - $flags.=$_." "; - } - elsif (/^--prefix=(.*)$/) - { - $prefix=$1; - } - elsif (/^--openssldir=(.*)$/) - { - $openssldir=$1; - } - elsif (/^--install.prefix=(.*)$/) - { - $install_prefix=$1; - } - else - { - print STDERR $usage; - exit(1); - } - } - elsif ($_ =~ /^([^:]+):(.+)$/) - { - eval "\$table{\$1} = \"$2\""; # allow $xxx constructs in the string - $target=$1; - } - else - { - die "target already defined - $target\n" if ($target ne ""); - $target=$_; - } - unless ($_ eq $target) { - if ($options eq "") { - $options = $_; - } else { - $options .= " ".$_; - } - } - } -} - -if ($target eq "TABLE") { - foreach $target (sort keys %table) { - print_table_entry($target); - } - exit 0; -} - -if ($target eq "LIST") { - foreach (sort keys %table) { - print; - print "\n"; - } - exit 0; -} - -print "Configuring for $target\n"; - -&usage if (!defined($table{$target})); - -my $IsWindows=scalar grep /^$target$/,@WinTargets; - -$openssldir="/usr/local/ssl" if ($openssldir eq "" and $prefix eq ""); -$prefix=$openssldir if $prefix eq ""; - -chop $openssldir if $openssldir =~ /\/$/; -chop $prefix if $prefix =~ /\/$/; - -$openssldir=$prefix . "/ssl" if $openssldir eq ""; -$openssldir=$prefix . "/" . $openssldir if $openssldir !~ /^\//; - - -print "IsWindows=$IsWindows\n"; - -(my $cc,my $cflags,my $unistd,my $thread_cflag,my $lflags,my $bn_ops,my $bn_obj,my $des_obj,my $bf_obj, - $md5_obj,$sha1_obj,my $cast_obj,my $rc4_obj,$rmd160_obj,my $rc5_obj,my $dso_scheme,my $shared_target,my $shared_cflag,my $shared_extension)= - split(/\s*:\s*/,$table{$target} . ":" x 30 , -1); -$cflags="$flags$cflags" if ($flags ne ""); - -# The DSO code currently always implements all functions so that no -# applications will have to worry about that from a compilation point -# of view. However, the "method"s may return zero unless that platform -# has support compiled in for them. Currently each method is enabled -# by a define "DSO_" ... we translate the "dso_scheme" config -# string entry into using the following logic; -my $dso_cflags; -if (!$no_dso && $dso_scheme ne "") - { - $dso_scheme =~ tr/[a-z]/[A-Z]/; - if ($dso_scheme eq "DLFCN") - { - $dso_cflags = "-DDSO_DLFCN -DHAVE_DLFCN_H"; - $openssl_other_defines .= "#define DSO_DLFCN\n"; - $openssl_other_defines .= "#define HAVE_DLFCN_H\n"; - } - elsif ($dso_scheme eq "DLFCN_NO_H") - { - $dso_cflags = "-DDSO_DLFCN"; - $openssl_other_defines .= "#define DSO_DLFCN\n"; - } - else - { - $dso_cflags = "-DDSO_$dso_scheme"; - $openssl_other_defines .= "#define DSO_$dso_scheme\n"; - } - $cflags = "$dso_cflags $cflags"; - } - -my $thread_cflags; -my $thread_defines; -if ($thread_cflag ne "(unknown)" && !$no_threads) - { - # If we know how to do it, support threads by default. - $threads = 1; - } -if ($thread_cflag eq "(unknown)") - { - # If the user asked for "threads", hopefully they also provided - # any system-dependent compiler options that are necessary. - $thread_cflags="-DTHREADS $cflags" ; - $thread_defines .= "#define THREADS\n"; - } -else - { - $thread_cflags="-DTHREADS $thread_cflag $cflags"; - $thread_defines .= "#define THREADS\n"; -# my $def; -# foreach $def (split ' ',$thread_cflag) -# { -# if ($def =~ s/^-D// && $def !~ /^_/) -# { -# $thread_defines .= "#define $def\n"; -# } -# } - } - -$lflags="$libs$lflags"if ($libs ne ""); - -if ($no_asm) - { - $bn_obj=$des_obj=$bf_obj=$cast_obj=$rc4_obj=$rc5_obj=""; - $sha1_obj=$md5_obj=$rmd160_obj=""; - } - -if ($threads) - { - $cflags=$thread_cflags; - $openssl_thread_defines .= $thread_defines; - } - -# You will find shlib_mark1 and shlib_mark2 explained in Makefile.org -my $shared_mark = ""; -if ($shared_target ne "") - { - if ($shared_cflag ne "") - { - $cflags = "$shared_cflag $cflags"; - } - if (!$no_shared) - { - #$shared_mark = "\$(SHARED_LIBS)"; - } - } -else - { - $no_shared = 1; - } - -#my ($bn1)=split(/\s+/,$bn_obj); -#$bn1 = "" unless defined $bn1; -#$bn1=$bn_asm unless ($bn1 =~ /\.o$/); -#$bn_obj="$bn1"; - -$bn_obj = $bn_asm unless $bn_obj ne ""; - -$des_obj=$des_enc unless ($des_obj =~ /\.o$/); -$bf_obj=$bf_enc unless ($bf_obj =~ /\.o$/); -$cast_obj=$cast_enc unless ($cast_obj =~ /\.o$/); -$rc4_obj=$rc4_enc unless ($rc4_obj =~ /\.o$/); -$rc5_obj=$rc5_enc unless ($rc5_obj =~ /\.o$/); -if ($sha1_obj =~ /\.o$/) - { -# $sha1_obj=$sha1_enc; - $cflags.=" -DSHA1_ASM"; - } -if ($md5_obj =~ /\.o$/) - { -# $md5_obj=$md5_enc; - $cflags.=" -DMD5_ASM"; - } -if ($rmd160_obj =~ /\.o$/) - { -# $rmd160_obj=$rmd160_enc; - $cflags.=" -DRMD160_ASM"; - } - -my $version = "unknown"; -my $major = "unknown"; -my $minor = "unknown"; -my $shlib_version_number = "unknown"; -my $shlib_version_history = "unknown"; -my $shlib_major = "unknown"; -my $shlib_minor = "unknown"; - -open(IN,') - { - $version=$1 if /OPENSSL.VERSION.TEXT.*OpenSSL (\S+) /; - $shlib_version_number=$1 if /SHLIB_VERSION_NUMBER *"([^"]+)"/; - $shlib_version_history=$1 if /SHLIB_VERSION_HISTORY *"([^"]*)"/; - } -close(IN); -if ($shlib_version_history ne "") { $shlib_version_history .= ":"; } - -if ($version =~ /(^[0-9]*)\.([0-9\.]*)/) - { - $major=$1; - $minor=$2; - } - -if ($shlib_version_number =~ /(^[0-9]*)\.([0-9\.]*)/) - { - $shlib_major=$1; - $shlib_minor=$2; - } - -open(IN,'$Makefile") || die "unable to create $Makefile:$!\n"; -print OUT "### Generated automatically from Makefile.org by Configure.\n\n"; -my $sdirs=0; -while () - { - chop; - $sdirs = 1 if /^SDIRS=/; - if ($sdirs) { - my $dir; - foreach $dir (@skip) { - s/$dir//; - } - } - $sdirs = 0 unless /\\$/; - s/^VERSION=.*/VERSION=$version/; - s/^MAJOR=.*/MAJOR=$major/; - s/^MINOR=.*/MINOR=$minor/; - s/^SHLIB_VERSION_NUMBER=.*/SHLIB_VERSION_NUMBER=$shlib_version_number/; - s/^SHLIB_VERSION_HISTORY=.*/SHLIB_VERSION_HISTORY=$shlib_version_history/; - s/^SHLIB_MAJOR=.*/SHLIB_MAJOR=$shlib_major/; - s/^SHLIB_MINOR=.*/SHLIB_MINOR=$shlib_minor/; - s/^SHLIB_EXT=.*/SHLIB_EXT=$shared_extension/; - s/^INSTALLTOP=.*$/INSTALLTOP=$prefix/; - s/^OPENSSLDIR=.*$/OPENSSLDIR=$openssldir/; - s/^INSTALL_PREFIX=.*$/INSTALL_PREFIX=$install_prefix/; - s/^PLATFORM=.*$/PLATFORM=$target/; - s/^OPTIONS=.*$/OPTIONS=$options/; - s/^CONFIGURE_ARGS=.*$/CONFIGURE_ARGS=$argvstring/; - s/^CC=.*$/CC= $cc/; - s/^CFLAG=.*$/CFLAG= $cflags/; - s/^DEPFLAG=.*$/DEPFLAG= $depflags/; - s/^EX_LIBS=.*$/EX_LIBS= $lflags/; - s/^BN_ASM=.*$/BN_ASM= $bn_obj/; - s/^DES_ENC=.*$/DES_ENC= $des_obj/; - s/^BF_ENC=.*$/BF_ENC= $bf_obj/; - s/^CAST_ENC=.*$/CAST_ENC= $cast_obj/; - s/^RC4_ENC=.*$/RC4_ENC= $rc4_obj/; - s/^RC5_ENC=.*$/RC5_ENC= $rc5_obj/; - s/^MD5_ASM_OBJ=.*$/MD5_ASM_OBJ= $md5_obj/; - s/^SHA1_ASM_OBJ=.*$/SHA1_ASM_OBJ= $sha1_obj/; - s/^RMD160_ASM_OBJ=.*$/RMD160_ASM_OBJ= $rmd160_obj/; - s/^PROCESSOR=.*/PROCESSOR= $processor/; - s/^RANLIB=.*/RANLIB= $ranlib/; - s/^PERL=.*/PERL= $perl/; - s/^SHLIB_TARGET=.*/SHLIB_TARGET=$shared_target/; - s/^SHLIB_MARK=.*/SHLIB_MARK=$shared_mark/; - s/^SHARED_LIBS=.*/SHARED_LIBS=\$(SHARED_CRYPTO) \$(SHARED_SSL)/ if (!$no_shared); - if ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*$/) - { - my $sotmp = $1; - s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp/ - } - elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/) - { - my $sotmp = $1; - s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_MAJOR) .s$sotmp/; - } - print OUT $_."\n"; - } -close(IN); -close(OUT); - -print "CC =$cc\n"; -print "CFLAG =$cflags\n"; -print "EX_LIBS =$lflags\n"; -print "BN_ASM =$bn_obj\n"; -print "DES_ENC =$des_obj\n"; -print "BF_ENC =$bf_obj\n"; -print "CAST_ENC =$cast_obj\n"; -print "RC4_ENC =$rc4_obj\n"; -print "RC5_ENC =$rc5_obj\n"; -print "MD5_OBJ_ASM =$md5_obj\n"; -print "SHA1_OBJ_ASM =$sha1_obj\n"; -print "RMD160_OBJ_ASM=$rmd160_obj\n"; -print "PROCESSOR =$processor\n"; -print "RANLIB =$ranlib\n"; -print "PERL =$perl\n"; - -my $des_ptr=0; -my $des_risc1=0; -my $des_risc2=0; -my $des_unroll=0; -my $bn_ll=0; -my $def_int=2; -my $rc4_int=$def_int; -my $md2_int=$def_int; -my $idea_int=$def_int; -my $rc2_int=$def_int; -my $rc4_idx=0; -my $rc4_chunk=0; -my $bf_ptr=0; -my @type=("char","short","int","long"); -my ($b64l,$b64,$b32,$b16,$b8)=(0,0,1,0,0); - -my $des_int; - -foreach (sort split(/\s+/,$bn_ops)) - { - $des_ptr=1 if /DES_PTR/; - $des_risc1=1 if /DES_RISC1/; - $des_risc2=1 if /DES_RISC2/; - $des_unroll=1 if /DES_UNROLL/; - $des_int=1 if /DES_INT/; - $bn_ll=1 if /BN_LLONG/; - $rc4_int=0 if /RC4_CHAR/; - $rc4_int=3 if /RC4_LONG/; - $rc4_idx=1 if /RC4_INDEX/; - $rc4_chunk=1 if /RC4_CHUNK/; - $rc4_chunk=2 if /RC4_CHUNK_LL/; - $md2_int=0 if /MD2_CHAR/; - $md2_int=3 if /MD2_LONG/; - $idea_int=1 if /IDEA_SHORT/; - $idea_int=3 if /IDEA_LONG/; - $rc2_int=1 if /RC2_SHORT/; - $rc2_int=3 if /RC2_LONG/; - $bf_ptr=1 if $_ eq "BF_PTR"; - $bf_ptr=2 if $_ eq "BF_PTR2"; - ($b64l,$b64,$b32,$b16,$b8)=(0,1,0,0,0) if /SIXTY_FOUR_BIT/; - ($b64l,$b64,$b32,$b16,$b8)=(1,0,0,0,0) if /SIXTY_FOUR_BIT_LONG/; - ($b64l,$b64,$b32,$b16,$b8)=(0,0,1,0,0) if /THIRTY_TWO_BIT/; - ($b64l,$b64,$b32,$b16,$b8)=(0,0,0,1,0) if /SIXTEEN_BIT/; - ($b64l,$b64,$b32,$b16,$b8)=(0,0,0,0,1) if /EIGHT_BIT/; - } - -open(IN,'crypto/opensslconf.h') || die "unable to create crypto/opensslconf.h:$!\n"; -print OUT "/* opensslconf.h */\n"; -print OUT "/* WARNING: Generated automatically from opensslconf.h.in by Configure. */\n\n"; - -print OUT "/* OpenSSL was configured with the following options: */\n"; -$openssl_algorithm_defines =~ s/^\s*#\s*define\s+(.*)/# ifndef $1\n# define $1\n# endif/mg; -$openssl_algorithm_defines = " /* no ciphers excluded */\n" if $openssl_algorithm_defines eq ""; -$openssl_thread_defines =~ s/^\s*#\s*define\s+(.*)/# ifndef $1\n# define $1\n# endif/mg; -$openssl_other_defines =~ s/^\s*#\s*define\s+(.*)/# ifndef $1\n# define $1\n# endif/mg; -print OUT "#ifdef OPENSSL_ALGORITHM_DEFINES\n$openssl_algorithm_defines#endif\n"; -print OUT "#ifdef OPENSSL_THREAD_DEFINES\n$openssl_thread_defines#endif\n"; -print OUT "#ifdef OPENSSL_OTHER_DEFINES\n$openssl_other_defines#endif\n\n"; - -while () - { - if (/^#define\s+OPENSSLDIR/) - { print OUT "#define OPENSSLDIR \"$openssldir\"\n"; } - elsif (/^#define\s+OPENSSL_UNISTD/) - { - $unistd = "" if $unistd eq ""; - print OUT "#define OPENSSL_UNISTD $unistd\n"; - } - elsif (/^#((define)|(undef))\s+SIXTY_FOUR_BIT_LONG/) - { printf OUT "#%s SIXTY_FOUR_BIT_LONG\n",($b64l)?"define":"undef"; } - elsif (/^#((define)|(undef))\s+SIXTY_FOUR_BIT/) - { printf OUT "#%s SIXTY_FOUR_BIT\n",($b64)?"define":"undef"; } - elsif (/^#((define)|(undef))\s+THIRTY_TWO_BIT/) - { printf OUT "#%s THIRTY_TWO_BIT\n",($b32)?"define":"undef"; } - elsif (/^#((define)|(undef))\s+SIXTEEN_BIT/) - { printf OUT "#%s SIXTEEN_BIT\n",($b16)?"define":"undef"; } - elsif (/^#((define)|(undef))\s+EIGHT_BIT/) - { printf OUT "#%s EIGHT_BIT\n",($b8)?"define":"undef"; } - elsif (/^#((define)|(undef))\s+BN_LLONG\s*$/) - { printf OUT "#%s BN_LLONG\n",($bn_ll)?"define":"undef"; } - elsif (/^\#define\s+DES_LONG\s+.*/) - { printf OUT "#define DES_LONG unsigned %s\n", - ($des_int)?'int':'long'; } - elsif (/^\#(define|undef)\s+DES_PTR/) - { printf OUT "#%s DES_PTR\n",($des_ptr)?'define':'undef'; } - elsif (/^\#(define|undef)\s+DES_RISC1/) - { printf OUT "#%s DES_RISC1\n",($des_risc1)?'define':'undef'; } - elsif (/^\#(define|undef)\s+DES_RISC2/) - { printf OUT "#%s DES_RISC2\n",($des_risc2)?'define':'undef'; } - elsif (/^\#(define|undef)\s+DES_UNROLL/) - { printf OUT "#%s DES_UNROLL\n",($des_unroll)?'define':'undef'; } - elsif (/^#define\s+RC4_INT\s/) - { printf OUT "#define RC4_INT unsigned %s\n",$type[$rc4_int]; } - elsif (/^#undef\s+RC4_CHUNK/) - { - printf OUT "#undef RC4_CHUNK\n" if $rc4_chunk==0; - printf OUT "#define RC4_CHUNK unsigned long\n" if $rc4_chunk==1; - printf OUT "#define RC4_CHUNK unsigned long long\n" if $rc4_chunk==2; - } - elsif (/^#((define)|(undef))\s+RC4_INDEX/) - { printf OUT "#%s RC4_INDEX\n",($rc4_idx)?"define":"undef"; } - elsif (/^#(define|undef)\s+I386_ONLY/) - { printf OUT "#%s I386_ONLY\n", ($processor == 386)? - "define":"undef"; } - elsif (/^#define\s+MD2_INT\s/) - { printf OUT "#define MD2_INT unsigned %s\n",$type[$md2_int]; } - elsif (/^#define\s+IDEA_INT\s/) - {printf OUT "#define IDEA_INT unsigned %s\n",$type[$idea_int];} - elsif (/^#define\s+RC2_INT\s/) - {printf OUT "#define RC2_INT unsigned %s\n",$type[$rc2_int];} - elsif (/^#(define|undef)\s+BF_PTR/) - { - printf OUT "#undef BF_PTR\n" if $bf_ptr == 0; - printf OUT "#define BF_PTR\n" if $bf_ptr == 1; - printf OUT "#define BF_PTR2\n" if $bf_ptr == 2; - } - else - { print OUT $_; } - } -close(IN); -close(OUT); - - -# Fix the date - -print "SIXTY_FOUR_BIT_LONG mode\n" if $b64l; -print "SIXTY_FOUR_BIT mode\n" if $b64; -print "THIRTY_TWO_BIT mode\n" if $b32; -print "SIXTEEN_BIT mode\n" if $b16; -print "EIGHT_BIT mode\n" if $b8; -print "DES_PTR used\n" if $des_ptr; -print "DES_RISC1 used\n" if $des_risc1; -print "DES_RISC2 used\n" if $des_risc2; -print "DES_UNROLL used\n" if $des_unroll; -print "DES_INT used\n" if $des_int; -print "BN_LLONG mode\n" if $bn_ll; -print "RC4 uses u$type[$rc4_int]\n" if $rc4_int != $def_int; -print "RC4_INDEX mode\n" if $rc4_idx; -print "RC4_CHUNK is undefined\n" if $rc4_chunk==0; -print "RC4_CHUNK is unsigned long\n" if $rc4_chunk==1; -print "RC4_CHUNK is unsigned long long\n" if $rc4_chunk==2; -print "MD2 uses u$type[$md2_int]\n" if $md2_int != $def_int; -print "IDEA uses u$type[$idea_int]\n" if $idea_int != $def_int; -print "RC2 uses u$type[$rc2_int]\n" if $rc2_int != $def_int; -print "BF_PTR used\n" if $bf_ptr == 1; -print "BF_PTR2 used\n" if $bf_ptr == 2; - -if($IsWindows) { - open (OUT,">crypto/buildinf.h") || die "Can't open buildinf.h"; - printf OUT < 78) - { - print STDERR "\n"; - $k=length($i); - } - print STDERR $i . " "; - } - foreach $i (sort keys %table) - { - next if $i !~ /^debug/; - $k += length($i) + 1; - if ($k > 78) - { - print STDERR "\n"; - $k=length($i); - } - print STDERR $i . " "; - } - print STDERR "\n\nNOTE: If in doubt, on Unix-ish systems use './config'.\n"; - exit(1); - } - -sub which - { - my($name)=@_; - my $path; - foreach $path (split /:/, $ENV{PATH}) - { - if (-f "$path/$name" and -x _) - { - return "$path/$name" unless ($name eq "perl" and - system("$path/$name -e " . '\'exit($]<5.0);\'')); - } - } - } - -sub dofile - { - my $f; my $p; my %m; my @a; my $k; my $ff; - ($f,$p,%m)=@_; - - open(IN,"<$f.in") || open(IN,"<$f") || die "unable to open $f:$!\n"; - @a=; - close(IN); - foreach $k (keys %m) - { - grep(/$k/ && ($_=sprintf($m{$k}."\n",$p)),@a); - } - open(OUT,">$f.new") || die "unable to open $f.new:$!\n"; - print OUT @a; - close(OUT); - rename($f,"$f.bak") || die "unable to rename $f\n" if -e $f; - rename("$f.new",$f) || die "unable to rename $f.new\n"; - } - -sub print_table_entry - { - my $target = shift; - - (my $cc,my $cflags,my $unistd,my $thread_cflag,my $lflags,my $bn_ops, - my $bn_obj,my $des_obj,my $bf_obj, - my $md5_obj,my $sha1_obj,my $cast_obj,my $rc4_obj,my $rmd160_obj, - my $rc5_obj,my $dso_scheme,my $shared_target,my $shared_cflag, - my $shared_extension)= - split(/\s*:\s*/,$table{$target} . ":" x 30 , -1); - - print < and I get errors why? -* I've called and it fails, why? -* I just get a load of numbers for the error output, what do they mean? -* Why do I get errors about unknown algorithms? -* How do I create certificates or certificate requests? -* Why can't I create certificate requests? -* Why does fail with a certificate verify error? -* Why can I only use weak ciphers when I connect to a server using OpenSSL? -* How can I create DSA certificates? -* Why can't I make an SSL connection using a DSA certificate? -* How can I remove the passphrase on a private key? -* Why can't the OpenSSH configure script detect OpenSSL? -* Why does the OpenSSL test fail with "bc: command not found"? -* Why does the OpenSSL test fail with "bc: 1 no implemented"? -* Why does the OpenSSL compilation fail on Alpha True64 Unix? -* Why does the OpenSSL compilation fail with "ar: command not found"? -* Why does the OpenSSL compilation fail on Win32 with VC++? -* Why aren't tools like 'autoconf' and 'libtool' used? - - -* Which is the current version of OpenSSL? - -The current version is available from . -OpenSSL 0.9.6 was released on September 24th, 2000. - -In addition to the current stable release, you can also access daily -snapshots of the OpenSSL development version at , or get it by anonymous CVS access. - - -* Where is the documentation? - -OpenSSL is a library that provides cryptographic functionality to -applications such as secure web servers. Be sure to read the -documentation of the application you want to use. The INSTALL file -explains how to install this library. - -OpenSSL includes a command line utility that can be used to perform a -variety of cryptographic functions. It is described in the openssl(1) -manpage. Documentation for developers is currently being written. A -few manual pages already are available; overviews over libcrypto and -libssl are given in the crypto(3) and ssl(3) manpages. - -The OpenSSL manpages are installed in /usr/local/ssl/man/ (or a -different directory if you specified one as described in INSTALL). -In addition, you can read the most current versions at -. - -For information on parts of libcrypto that are not yet documented, you -might want to read Ariel Glenn's documentation on SSLeay 0.9, OpenSSL's -predecessor, at . Much -of this still applies to OpenSSL. - -There is some documentation about certificate extensions and PKCS#12 -in doc/openssl.txt - -The original SSLeay documentation is included in OpenSSL as -doc/ssleay.txt. It may be useful when none of the other resources -help, but please note that it reflects the obsolete version SSLeay -0.6.6. - - -* How can I contact the OpenSSL developers? - -The README file describes how to submit bug reports and patches to -OpenSSL. Information on the OpenSSL mailing lists is available from -. - - -* Do I need patent licenses to use OpenSSL? - -The patents section of the README file lists patents that may apply to -you if you want to use OpenSSL. For information on intellectual -property rights, please consult a lawyer. The OpenSSL team does not -offer legal advice. - -You can configure OpenSSL so as not to use RC5 and IDEA by using - ./config no-rc5 no-idea - - -* Is OpenSSL thread-safe? - -Yes (with limitations: an SSL connection may not concurrently be used -by multiple threads). On Windows and many Unix systems, OpenSSL -automatically uses the multi-threaded versions of the standard -libraries. If your platform is not one of these, consult the INSTALL -file. - -Multi-threaded applications must provide two callback functions to -OpenSSL. This is described in the threads(3) manpage. - - -* Why do I get a "PRNG not seeded" error message? - -Cryptographic software needs a source of unpredictable data to work -correctly. Many open source operating systems provide a "randomness -device" that serves this purpose. On other systems, applications have -to call the RAND_add() or RAND_seed() function with appropriate data -before generating keys or performing public key encryption. - -Some broken applications do not do this. As of version 0.9.5, the -OpenSSL functions that need randomness report an error if the random -number generator has not been seeded with at least 128 bits of -randomness. If this error occurs, please contact the author of the -application you are using. It is likely that it never worked -correctly. OpenSSL 0.9.5 and later make the error visible by refusing -to perform potentially insecure encryption. - -On systems without /dev/urandom, it is a good idea to use the Entropy -Gathering Demon; see the RAND_egd() manpage for details. - -Most components of the openssl command line tool try to use the -file $HOME/.rnd (or $RANDFILE, if this environment variable is set) -for seeding the PRNG. If this file does not exist or is too short, -the "PRNG not seeded" error message may occur. - -[Note to OpenSSL 0.9.5 users: The command "openssl rsa" in version -0.9.5 does not do this and will fail on systems without /dev/urandom -when trying to password-encrypt an RSA key! This is a bug in the -library; try a later version instead.] - -For Solaris 2.6, Tim Nibbe and others have suggested -installing the SUNski package from Sun patch 105710-01 (Sparc) which -adds a /dev/random device and make sure it gets used, usually through -$RANDFILE. There are probably similar patches for the other Solaris -versions. However, be warned that /dev/random is usually a blocking -device, which may have some effects on OpenSSL. - - -* Why does the linker complain about undefined symbols? - -Maybe the compilation was interrupted, and make doesn't notice that -something is missing. Run "make clean; make". - -If you used ./Configure instead of ./config, make sure that you -selected the right target. File formats may differ slightly between -OS versions (for example sparcv8/sparcv9, or a.out/elf). - -In case you get errors about the following symbols, use the config -option "no-asm", as described in INSTALL: - - BF_cbc_encrypt, BF_decrypt, BF_encrypt, CAST_cbc_encrypt, - CAST_decrypt, CAST_encrypt, RC4, RC5_32_cbc_encrypt, RC5_32_decrypt, - RC5_32_encrypt, bn_add_words, bn_div_words, bn_mul_add_words, - bn_mul_comba4, bn_mul_comba8, bn_mul_words, bn_sqr_comba4, - bn_sqr_comba8, bn_sqr_words, bn_sub_words, des_decrypt3, - des_ede3_cbc_encrypt, des_encrypt, des_encrypt2, des_encrypt3, - des_ncbc_encrypt, md5_block_asm_host_order, sha1_block_asm_data_order - -If none of these helps, you may want to try using the current snapshot. -If the problem persists, please submit a bug report. - - -* Where can I get a compiled version of OpenSSL? - -Some applications that use OpenSSL are distributed in binary form. -When using such an application, you don't need to install OpenSSL -yourself; the application will include the required parts (e.g. DLLs). - -If you want to install OpenSSL on a Windows system and you don't have -a C compiler, read the "Mingw32" section of INSTALL.W32 for information -on how to obtain and install the free GNU C compiler. - -A number of Linux and *BSD distributions include OpenSSL. - - -* I've compiled a program under Windows and it crashes: why? - -This is usually because you've missed the comment in INSTALL.W32. You -must link with the multithreaded DLL version of the VC++ runtime library -otherwise the conflict will cause a program to crash: typically on the -first BIO related read or write operation. - - -* How do I read or write a DER encoded buffer using the ASN1 functions? - -You have two options. You can either use a memory BIO in conjunction -with the i2d_XXX_bio() or d2i_XXX_bio() functions or you can use the -i2d_XXX(), d2i_XXX() functions directly. Since these are often the -cause of grief here are some code fragments using PKCS7 as an example: - -unsigned char *buf, *p; -int len; - -len = i2d_PKCS7(p7, NULL); -buf = OPENSSL_malloc(len); /* or Malloc, error checking omitted */ -p = buf; -i2d_PKCS7(p7, &p); - -At this point buf contains the len bytes of the DER encoding of -p7. - -The opposite assumes we already have len bytes in buf: - -unsigned char *p; -p = buf; -p7 = d2i_PKCS7(NULL, &p, len); - -At this point p7 contains a valid PKCS7 structure of NULL if an error -occurred. If an error occurred ERR_print_errors(bio) should give more -information. - -The reason for the temporary variable 'p' is that the ASN1 functions -increment the passed pointer so it is ready to read or write the next -structure. This is often a cause of problems: without the temporary -variable the buffer pointer is changed to point just after the data -that has been read or written. This may well be uninitialized data -and attempts to free the buffer will have unpredictable results -because it no longer points to the same address. - - -* I've tried using and I get errors why? - -This usually happens when you try compiling something using the PKCS#12 -macros with a C++ compiler. There is hardly ever any need to use the -PKCS#12 macros in a program, it is much easier to parse and create -PKCS#12 files using the PKCS12_parse() and PKCS12_create() functions -documented in doc/openssl.txt and with examples in demos/pkcs12. The -'pkcs12' application has to use the macros because it prints out -debugging information. - - -* I've called and it fails, why? - -Before submitting a report or asking in one of the mailing lists, you -should try to determine the cause. In particular, you should call -ERR_print_errors() or ERR_print_errors_fp() after the failed call -and see if the message helps. Note that the problem may occur earlier -than you think -- you should check for errors after every call where -it is possible, otherwise the actual problem may be hidden because -some OpenSSL functions clear the error state. - - -* I just get a load of numbers for the error output, what do they mean? - -The actual format is described in the ERR_print_errors() manual page. -You should call the function ERR_load_crypto_strings() before hand and -the message will be output in text form. If you can't do this (for example -it is a pre-compiled binary) you can use the errstr utility on the error -code itself (the hex digits after the second colon). - - -* Why do I get errors about unknown algorithms? - -This can happen under several circumstances such as reading in an -encrypted private key or attempting to decrypt a PKCS#12 file. The cause -is forgetting to load OpenSSL's table of algorithms with -OpenSSL_add_all_algorithms(). See the manual page for more information. - - -* How do I create certificates or certificate requests? - -Check out the CA.pl(1) manual page. This provides a simple wrapper round -the 'req', 'verify', 'ca' and 'pkcs12' utilities. For finer control check -out the manual pages for the individual utilities and the certificate -extensions documentation (currently in doc/openssl.txt). - - -* Why can't I create certificate requests? - -You typically get the error: - - unable to find 'distinguished_name' in config - problems making Certificate Request - -This is because it can't find the configuration file. Check out the -DIAGNOSTICS section of req(1) for more information. - - -* Why does fail with a certificate verify error? - -This problem is usually indicated by log messages saying something like -"unable to get local issuer certificate" or "self signed certificate". -When a certificate is verified its root CA must be "trusted" by OpenSSL -this typically means that the CA certificate must be placed in a directory -or file and the relevant program configured to read it. The OpenSSL program -'verify' behaves in a similar way and issues similar error messages: check -the verify(1) program manual page for more information. - - -* Why can I only use weak ciphers when I connect to a server using OpenSSL? - -This is almost certainly because you are using an old "export grade" browser -which only supports weak encryption. Upgrade your browser to support 128 bit -ciphers. - - -* How can I create DSA certificates? - -Check the CA.pl(1) manual page for a DSA certificate example. - - -* Why can't I make an SSL connection to a server using a DSA certificate? - -Typically you'll see a message saying there are no shared ciphers when -the same setup works fine with an RSA certificate. There are two possible -causes. The client may not support connections to DSA servers most web -browsers (including Netscape and MSIE) only support connections to servers -supporting RSA cipher suites. The other cause is that a set of DH parameters -has not been supplied to the server. DH parameters can be created with the -dhparam(1) command and loaded using the SSL_CTX_set_tmp_dh() for example: -check the source to s_server in apps/s_server.c for an example. - - -* How can I remove the passphrase on a private key? - -Firstly you should be really *really* sure you want to do this. Leaving -a private key unencrypted is a major security risk. If you decide that -you do have to do this check the EXAMPLES sections of the rsa(1) and -dsa(1) manual pages. - - -* Why can't the OpenSSH configure script detect OpenSSL? - -There is a problem with OpenSSH 1.2.2p1, in that the configure script -can't find the installed OpenSSL libraries. The problem is actually -a small glitch that is easily solved with the following patch to be -applied to the OpenSSH distribution: - ------ snip:start ----- ---- openssh-1.2.2p1/configure.in.orig Thu Mar 23 18:56:58 2000 -+++ openssh-1.2.2p1/configure.in Thu Mar 23 18:55:05 2000 -@@ -152,10 +152,10 @@ - AC_MSG_CHECKING([for OpenSSL/SSLeay directory]) - for ssldir in "" $tryssldir /usr /usr/local/openssl /usr/lib/openssl /usr/local/ssl /usr/lib/ssl /usr/local /usr/pkg /opt /opt/openssl ; do - if test ! -z "$ssldir" ; then -- LIBS="$saved_LIBS -L$ssldir" -+ LIBS="$saved_LIBS -L$ssldir/lib" - CFLAGS="$CFLAGS -I$ssldir/include" - if test "x$need_dash_r" = "x1" ; then -- LIBS="$LIBS -R$ssldir" -+ LIBS="$LIBS -R$ssldir/lib" - fi - fi - LIBS="$LIBS -lcrypto" ---- openssh-1.2.2p1/configure.orig Thu Mar 23 18:55:02 2000 -+++ openssh-1.2.2p1/configure Thu Mar 23 18:57:08 2000 -@@ -1890,10 +1890,10 @@ - echo "configure:1891: checking for OpenSSL/SSLeay directory" >&5 - for ssldir in "" $tryssldir /usr /usr/local/openssl /usr/lib/openssl /usr/local/ssl /usr/lib/ssl /usr/local /usr/pkg /opt /opt/openssl ; do - if test ! -z "$ssldir" ; then -- LIBS="$saved_LIBS -L$ssldir" -+ LIBS="$saved_LIBS -L$ssldir/lib" - CFLAGS="$CFLAGS -I$ssldir/include" - if test "x$need_dash_r" = "x1" ; then -- LIBS="$LIBS -R$ssldir" -+ LIBS="$LIBS -R$ssldir/lib" - fi - fi - LIBS="$LIBS -lcrypto" ------ snip:end ----- - - -* Why does the OpenSSL test fail with "bc: command not found"? - -You didn't install "bc", the Unix calculator. If you want to run the -tests, get GNU bc from ftp://ftp.gnu.org or from your OS distributor. - - -* Why does the OpenSSL test fail with "bc: 1 no implemented"? - -On some SCO installations or versions, bc has a bug that gets triggered when -you run the test suite (using "make test"). The message returned is "bc: -1 not implemented". The best way to deal with this is to find another -implementation of bc and compile/install it. For example, GNU bc (see -http://www.gnu.org/software/software.html for download instructions) can -be safely used. - - -* Why does the OpenSSL compilation fail on Alpha True64 Unix? - -On some Alpha installations running True64 Unix and Compaq C, the compilation -of crypto/sha/sha_dgst.c fails with the message 'Fatal: Insufficient virtual -memory to continue compilation.' As far as the tests have shown, this may be -a compiler bug. What happens is that it eats up a lot of resident memory -to build something, probably a table. The problem is clearly in the -optimization code, because if one eliminates optimization completely (-O0), -the compilation goes through (and the compiler consumes about 2MB of resident -memory instead of 240MB or whatever one's limit is currently). - -There are three options to solve this problem: - -1. set your current data segment size soft limit higher. Experience shows -that about 241000 kbytes seems to be enough on an AlphaServer DS10. You do -this with the command 'ulimit -Sd nnnnnn', where 'nnnnnn' is the number of -kbytes to set the limit to. - -2. If you have a hard limit that is lower than what you need and you can't -get it changed, you can compile all of OpenSSL with -O0 as optimization -level. This is however not a very nice thing to do for those who expect to -get the best result from OpenSSL. A bit more complicated solution is the -following: - ------ snip:start ----- - make DIRS=crypto SDIRS=sha "`grep '^CFLAG=' Makefile.ssl | \ - sed -e 's/ -O[0-9] / -O0 /'`" - rm `ls crypto/*.o crypto/sha/*.o | grep -v 'sha_dgst\.o'` - make ------ snip:end ----- - -This will only compile sha_dgst.c with -O0, the rest with the optimization -level chosen by the configuration process. When the above is done, do the -test and installation and you're set. - - -* Why does the OpenSSL compilation fail with "ar: command not found"? - -Getting this message is quite usual on Solaris 2, because Sun has hidden -away 'ar' and other development commands in directories that aren't in -$PATH by default. One of those directories is '/usr/ccs/bin'. The -quickest way to fix this is to do the following (it assumes you use sh -or any sh-compatible shell): - ------ snip:start ----- - PATH=${PATH}:/usr/ccs/bin; export PATH ------ snip:end ----- - -and then redo the compilation. What you should really do is make sure -'/usr/ccs/bin' is permanently in your $PATH, for example through your -'.profile' (again, assuming you use a sh-compatible shell). - - -* Why does the OpenSSL compilation fail on Win32 with VC++? - -Sometimes, you may get reports from VC++ command line (cl) that it -can't find standard include files like stdio.h and other weirdnesses. -One possible cause is that the environment isn't correctly set up. -To solve that problem, one should run VCVARS32.BAT which is found in -the 'bin' subdirectory of the VC++ installation directory (somewhere -under 'Program Files'). This needs to be done prior to running NMAKE, -and the changes are only valid for the current DOS session. - - -* Why aren't tools like 'autoconf' and 'libtool' used? - -autoconf is a nice tool, but is unfortunately very Unix-centric. -Although one can come up with solution to have ports keep in track, -there's also some work needed for that, and can be quite painful at -times. If there was a 'autoconf'-like tool that generated perl -scripts or something similarly general, it would probably be used -in OpenSSL much earlier. - -libtool has repeatadly been reported by some members of the OpenSSL -development and others to be a pain to use. So far, those in the -development team who have said anything about this have expressed -a wish to avoid libtool for that reason. - diff --git a/INSTALL b/INSTALL deleted file mode 100644 index ea9b8a3844..0000000000 --- a/INSTALL +++ /dev/null @@ -1,278 +0,0 @@ - - INSTALLATION ON THE UNIX PLATFORM - --------------------------------- - - [Installation on Windows, OpenVMS and MacOS (before MacOS X) is described - in INSTALL.W32, INSTALL.VMS and INSTALL.MacOS.] - - To install OpenSSL, you will need: - - * Perl 5 - * an ANSI C compiler - * a supported Unix operating system - - Quick Start - ----------- - - If you want to just get on with it, do: - - $ ./config - $ make - $ make test - $ make install - - [If any of these steps fails, see section Installation in Detail below.] - - This will build and install OpenSSL in the default location, which is (for - historical reasons) /usr/local/ssl. If you want to install it anywhere else, - run config like this: - - $ ./config --prefix=/usr/local --openssldir=/usr/local/openssl - - - Configuration Options - --------------------- - - There are several options to ./config (or ./Configure) to customize - the build: - - --prefix=DIR Install in DIR/bin, DIR/lib, DIR/include/openssl. - Configuration files used by OpenSSL will be in DIR/ssl - or the directory specified by --openssldir. - - --openssldir=DIR Directory for OpenSSL files. If no prefix is specified, - the library files and binaries are also installed there. - - rsaref Build with RSADSI's RSAREF toolkit (this assumes that - librsaref.a is in the library search path). - - no-threads Don't try to build with support for multi-threaded - applications. - - threads Build with support for multi-threaded applications. - This will usually require additional system-dependent options! - See "Note on multi-threading" below. - - no-shared Don't try to create shared libraries. - - shared In addition to the usual static libraries, create shared - libraries on platforms where it's supported. See "Note on - shared libraries" below. - - no-asm Do not use assembler code. - - 386 Use the 80386 instruction set only (the default x86 code is - more efficient, but requires at least a 486). - - no- Build without the specified cipher (bf, cast, des, dh, dsa, - hmac, md2, md5, mdc2, rc2, rc4, rc5, rsa, sha). - The crypto/ directory can be removed after running - "make depend". - - -Dxxx, -lxxx, -Lxxx, -fxxx, -Kxxx These system specific options will - be passed through to the compiler to allow you to - define preprocessor symbols, specify additional libraries, - library directories or other compiler options. - - - Installation in Detail - ---------------------- - - 1a. Configure OpenSSL for your operation system automatically: - - $ ./config [options] - - This guesses at your operating system (and compiler, if necessary) and - configures OpenSSL based on this guess. Run ./config -t to see - if it guessed correctly. If you want to use a different compiler, you - are cross-compiling for another platform, or the ./config guess was - wrong for other reasons, go to step 1b. Otherwise go to step 2. - - On some systems, you can include debugging information as follows: - - $ ./config -d [options] - - 1b. Configure OpenSSL for your operating system manually - - OpenSSL knows about a range of different operating system, hardware and - compiler combinations. To see the ones it knows about, run - - $ ./Configure - - Pick a suitable name from the list that matches your system. For most - operating systems there is a choice between using "cc" or "gcc". When - you have identified your system (and if necessary compiler) use this name - as the argument to ./Configure. For example, a "linux-elf" user would - run: - - $ ./Configure linux-elf [options] - - If your system is not available, you will have to edit the Configure - program and add the correct configuration for your system. The - generic configurations "cc" or "gcc" should usually work on 32 bit - systems. - - Configure creates the file Makefile.ssl from Makefile.org and - defines various macros in crypto/opensslconf.h (generated from - crypto/opensslconf.h.in). - - 2. Build OpenSSL by running: - - $ make - - This will build the OpenSSL libraries (libcrypto.a and libssl.a) and the - OpenSSL binary ("openssl"). The libraries will be built in the top-level - directory, and the binary will be in the "apps" directory. - - If "make" fails, look at the output. There may be reasons for - the failure that isn't a problem in OpenSSL itself (like missing - standard headers). If it is a problem with OpenSSL itself, please - report the problem to (note that your - message will be forwarded to a public mailing list). Include the - output of "make report" in your message. - - [If you encounter assembler error messages, try the "no-asm" - configuration option as an immediate fix.] - - Compiling parts of OpenSSL with gcc and others with the system - compiler will result in unresolved symbols on some systems. - - 3. After a successful build, the libraries should be tested. Run: - - $ make test - - If a test fails, look at the output. There may be reasons for - the failure that isn't a problem in OpenSSL itself (like a missing - or malfunctioning bc). If it is a problem with OpenSSL itself, - try removing any compiler optimization flags from the CFLAGS line - in Makefile.ssl and run "make clean; make". Please send a bug - report to , including the output of - "make report". - - 4. If everything tests ok, install OpenSSL with - - $ make install - - This will create the installation directory (if it does not exist) and - then the following subdirectories: - - certs Initially empty, this is the default location - for certificate files. - man/man1 Manual pages for the 'openssl' command line tool - man/man3 Manual pages for the libraries (very incomplete) - misc Various scripts. - private Initially empty, this is the default location - for private key files. - - If you didn't choose a different installation prefix, the - following additional subdirectories will be created: - - bin Contains the openssl binary and a few other - utility programs. - include/openssl Contains the header files needed if you want to - compile programs with libcrypto or libssl. - lib Contains the OpenSSL library files themselves. - - Package builders who want to configure the library for standard - locations, but have the package installed somewhere else so that - it can easily be packaged, can use - - $ make INSTALL_PREFIX=/tmp/package-root install - - (or specify "--install_prefix=/tmp/package-root" as a configure - option). The specified prefix will be prepended to all - installation target filenames. - - - NOTE: The header files used to reside directly in the include - directory, but have now been moved to include/openssl so that - OpenSSL can co-exist with other libraries which use some of the - same filenames. This means that applications that use OpenSSL - should now use C preprocessor directives of the form - - #include - - instead of "#include ", which was used with library versions - up to OpenSSL 0.9.2b. - - If you install a new version of OpenSSL over an old library version, - you should delete the old header files in the include directory. - - Compatibility issues: - - * COMPILING existing applications - - To compile an application that uses old filenames -- e.g. - "#include " --, it will usually be enough to find - the CFLAGS definition in the application's Makefile and - add a C option such as - - -I/usr/local/ssl/include/openssl - - to it. - - But don't delete the existing -I option that points to - the ..../include directory! Otherwise, OpenSSL header files - could not #include each other. - - * WRITING applications - - To write an application that is able to handle both the new - and the old directory layout, so that it can still be compiled - with library versions up to OpenSSL 0.9.2b without bothering - the user, you can proceed as follows: - - - Always use the new filename of OpenSSL header files, - e.g. #include . - - - Create a directory "incl" that contains only a symbolic - link named "openssl", which points to the "include" directory - of OpenSSL. - For example, your application's Makefile might contain the - following rule, if OPENSSLDIR is a pathname (absolute or - relative) of the directory where OpenSSL resides: - - incl/openssl: - -mkdir incl - cd $(OPENSSLDIR) # Check whether the directory really exists - -ln -s `cd $(OPENSSLDIR); pwd`/include incl/openssl - - You will have to add "incl/openssl" to the dependencies - of those C files that include some OpenSSL header file. - - - Add "-Iincl" to your CFLAGS. - - With these additions, the OpenSSL header files will be available - under both name variants if an old library version is used: - Your application can reach them under names like , - while the header files still are able to #include each other - with names of the form . - - - Note on multi-threading - ----------------------- - - For some systems, the OpenSSL Configure script knows what compiler options - are needed to generate a library that is suitable for multi-threaded - applications. On these systems, support for multi-threading is enabled - by default; use the "no-threads" option to disable (this should never be - necessary). - - On other systems, to enable support for multi-threading, you will have - to specify at least two options: "threads", and a system-dependent option. - (The latter is "-D_REENTRANT" on various systems.) The default in this - case, obviously, is not to include support for multi-threading (but - you can still use "no-threads" to suppress an annoying warning message - from the Configure script.) - - - Note on shared libraries - ------------------------ - - For some systems, the OpenSSL Configure script knows what is needed to - build shared libraries for libcrypto and libssl. On these systems, - the shared libraries are currently not created by default, but giving - the option "shared" will get them created. This method supports Makefile - targets for shared library creation, like linux-shared. Those targets - can currently be used on their own just as well, but this is expected - to change in future versions of OpenSSL. diff --git a/INSTALL.MacOS b/INSTALL.MacOS deleted file mode 100644 index a8c4f7f1da..0000000000 --- a/INSTALL.MacOS +++ /dev/null @@ -1,72 +0,0 @@ -OpenSSL - Port To The Macintosh -=============================== - -Thanks to Roy Wood initial support for MacOS (pre -X) is now provided. "Initial" means that unlike other platforms where you -get an SDK and a "swiss army" openssl application, on Macintosh you only -get one sample application which fetches a page over HTTPS(*) and dumps it -in a window. We don't even build the test applications so that we can't -guarantee that all algorithms are operational. - -Required software: - -- StuffIt Expander 5.5 or later, alternatively MacGzip and SUNtar; -- Scriptable Finder; -- CodeWarrior Pro 5; - -Installation procedure: - -- fetch the source at ftp://ftp.openssl.org/ (well, you probably already - did, huh?) -- unpack the .tar.gz file: - - if you have StuffIt Expander then just drag it over it; - - otherwise uncompress it with MacGzip and then unpack with SUNtar; -- locate MacOS folder in OpenSSL source tree and open it; -- unbinhex mklinks.as.hqx and OpenSSL.mcp.hqx if present (**), do it - "in-place", i.e. unpacked files should end-up in the very same folder; -- execute mklinks.as; -- open OpenSSL.mcp(***) and build 'GetHTTPS PPC' target(****); -- that's it for now; - -(*) URL is hardcoded into ./MacOS/GetHTTPS.src/GetHTTPS.cpp, lines 40 - to 42, change appropriately. -(**) If you use SUNtar, then it might have already unbinhexed the files - in question. -(***) The project file was saved with CW Pro 5.3. If you have earlier - version and it refuses to open it, then download - http://www.openssl.org/~appro/OpenSSL.mcp.xml and import it - overwriting the original OpenSSL.mcp. -(****) Other targets are work in progress. If you feel like giving 'em a - shot, then you should know that OpenSSL* and Lib* targets are - supposed to be built with the GUSI, MacOS library which mimics - BSD sockets and some other POSIX APIs. The GUSI distribution is - expected to be found in the same directory as openssl source tree, - i.e. in the parent directory to the one where this very file, - namely INSTALL.MacOS. For more informations about GUSI, see - http://www.iis.ee.ethz.ch/~neeri/macintosh/gusi-qa.html - -Finally some essential comments from our generous contributor:-) - -"I've gotten OpenSSL working on the Macintosh. It's probably a bit of a -hack, but it works for what I'm doing. If you don't like the way I've done -it, then feel free to change what I've done. I freely admit that I've done -some less-than-ideal things in my port, and if you don't like the way I've -done something, then feel free to change it-- I won't be offended! - -... I've tweaked "bss_sock.c" a little to call routines in a "MacSocket" -library I wrote. My MacSocket library is a wrapper around OpenTransport, -handling stuff like endpoint creation, reading, writing, etc. It is not -designed as a high-performance package such as you'd use in a webserver, -but is fine for lots of other applications. MacSocket also uses some other -code libraries I've written to deal with string manipulations and error -handling. Feel free to use these things in your own code, but give me -credit and/or send me free stuff in appreciation! :-) - -... - -If you have any questions, feel free to email me as the following: - -roy@centricsystems.ca - --Roy Wood" - diff --git a/INSTALL.VMS b/INSTALL.VMS deleted file mode 100644 index 1fe78a41bb..0000000000 --- a/INSTALL.VMS +++ /dev/null @@ -1,289 +0,0 @@ - VMS Installation instructions - written by Richard Levitte - - - -Intro: -====== - -This file is divided in the following parts: - - Checking the distribution - Mandatory reading. - Compilation - Mandatory reading. - Logical names - Mandatory reading. - Test - Mandatory reading. - Installation - Mandatory reading. - Backward portability - Read if it's an issue. - Possible bugs or quirks - A few warnings on things that - may go wrong or may surprise you. - TODO - Things that are to come. - - -Checking the distribution: -========================== - -There have been reports of places where the distribution didn't quite get -through, for example if you've copied the tree from a NFS-mounted unix -mount point. - -The easiest way to check if everything got through as it should is to check -for oen of the following files: - - [.CRYPTO]OPENSSLCONF.H_IN - [.CRYPTO]OPENSSLCONF_H.IN - -They should never exist both at once, but one of them should (preferably -the first variant). If you can't find any of those two, something went -wrong. - -The best way to get a correct distribution is to download the gzipped tar -file from ftp://ftp.openssl.org/source/, use GUNZIP to uncompress it and -use VMSTAR to unpack the resulting tar file. - -GUNZIP is available in many places on the net. One of the distribution -points is the WKU software archive, ftp://ftp.wku.edu/vms/fileserv/ . - -VMSTAR is also available in many places on the net. The recommended place -to find information about it is http://www.free.lp.se/vmstar/ . - - -Compilation: -============ - -I've used the very good command procedures written by Robert Byer -, and just slightly modified them, making -them slightly more general and easier to maintain. - -You can actually compile in almost any directory separately. Look -for a command procedure name xxx-LIB.COM (in the library directories) -or MAKExxx.COM (in the program directories) and read the comments at -the top to understand how to use them. However, if you want to -compile all you can get, the simplest is to use MAKEVMS.COM in the top -directory. The syntax is trhe following: - - @MAKEVMS