2000-10-22 00:05  levitte

	* Configure (1.232): FreeBSD-elf can do threads.  However, there
	seems to be confusion if you should defined _THREAD_SAFE (I found
	that in an include file, and that's what everybody tells me) or
	_THREADSAFE (that's what the gcc manual says in the
	FreeBSD-specific section), so I defined both, just to be safe.

2000-10-21 23:24  levitte

	* CHANGES (1.631), Configure (1.231), Makefile.org (1.104):
	Add what's needed to get shared libraries on HP-UX.

Make sure ranlib is only used on .a libraries.

remove redundant name OpenUNIX for OpenUNIX-8 configuration

applied since the initial patch was created)

Submitted by:
Reviewed by:
PR:

Submitted by: Gary Benson
Reviewed by: Mark Cox
PR:

Submitted by: Andy Polyakov
Reviewed by: Mark Cox
PR:

Submitted by: "Stefan Marxen" <stefan.marxen@gmx.net>

_REENTRANT if threads support is enabled, the ./Configure entry must
define it so that it ends up in CFLAG.

Addapt VMS scripts to the newer disk layout system ODS-5, which allows more than one period and mixed size characters in file names

change)

never resets s->method to s->ctx->method when called from within one
of the SSL handshake functions.

client_version is smaller than the protocol version in use.
Also change ssl23_get_client_hello (ssl/s23_srvr.c) to select TLS 1.0
if the client demanded SSL 3.0 but only TLS 1.0 is enabled; then the
client will at least see that alert.

case of ssl3_accept

Submitted by: Toomas Kiisk <vix@cyber.ee>

  From: "Chris D. Peterson" <cpeterson@aventail.com>
  Subject: Implementation Issues with OpenSSL
  To: openssl-users@openssl.org
  Date: Wed, 22 Aug 2001 16:13:17 -0700
The patch included in the original post may improve the internal session
list handling (and is therefore worth a seperate investigation).
No change to the list handling will however solve the problems of incorrect
SSL_SESSION_free() calls. The session list is only one possible point of
failure, dangling pointers would also occur for SSL object currently
using the session. The correct solution is to only use SSL_SESSION_free()
when applicable!