aboutsummaryrefslogtreecommitdiffstats
path: root/CHANGES
Commit message (Collapse)AuthorAgeFilesLines
* GH601: Various spelling fixes.FdaSilvaYY2016-02-051-6/+6
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Make DTLSv1_listen a first class function and change its typeMatt Caswell2016-02-051-0/+3
| | | | | | | | | The DTLSv1_listen function exposed details of the underlying BIO abstraction and did not properly allow for IPv6. This commit changes the "peer" argument to be a BIO_ADDR and makes it a first class function (rather than a ctrl) to ensure proper type checking. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Refactoring BIO: Add a few lines in CHANGES & NEWSRichard Levitte2016-02-031-0/+10
| | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* RT4148Emilia Kasper2016-02-031-0/+4
| | | | | | | Accept leading 0-byte in PKCS1 type 1 padding. Internally, the byte is stripped by BN_bn2bin but external callers may have other expectations. Reviewed-by: Kurt Roeckx<kurt@openssl.org>
* RT3234: disable compressionEmilia Kasper2016-02-031-0/+6
| | | | | | | | | | | | | | | | | CRIME protection: disable compression by default, even if OpenSSL is compiled with zlib enabled. Applications can still enable compression by calling SSL_CTX_clear_options(ctx, SSL_OP_NO_COMPRESSION), or by using the SSL_CONF library to configure compression. SSL_CONF continues to work as before: SSL_CONF_cmd(ctx, "Options", "Compression") enables compression. SSL_CONF_cmd(ctx, "Options", "-Compression") disables compression (now no-op by default). The command-line switch has changed from -no_comp to -comp. Reviewed-by: Rich Salz <rsalz@openssl.org>
* constify PACKETEmilia Kasper2016-02-011-0/+6
| | | | | | | | PACKET contents should be read-only. To achieve this, also - constify two user callbacks - constify BUF_reverse. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Move more BN internals to bn_lcl.hRich Salz2016-01-301-0/+3
| | | | | | | | There was an unused macro in ssl_locl.h that used an internal type, so I removed it. Move bio_st from bio.h to ossl_type.h Reviewed-by: Andy Polyakov <appro@openssl.org>
* Always DPURIFYEmilia Kasper2016-01-291-0/+4
| | | | | | | | The use of the uninitialized buffer in the RNG has no real security benefits and is only a nuisance when using memory sanitizers. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* CHANGES and NEWS updates for releaseMatt Caswell2016-01-281-1/+45
| | | | | | Add details about the latest issues fixed in the forthcoming release. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove outdated legacy crypto optionsRich Salz2016-01-271-0/+8
| | | | | | | | | | | | | | | | | | | | | | Many options for supporting optimizations for legacy crypto on legacy platforms have been removed. This simplifies the source code and does not really penalize anyone. DES_PTR (always on) DES_RISC1, DES_RISC2 (always off) DES_INT (always 'unsigned int') DES_UNROLL (always on) BF_PTR (always on) BF_PTR2 (removed) MD2_CHAR, MD2_LONG (always 'unsigned char') IDEA_SHORT, IDEA_LONG (always 'unsigned int') RC2_SHORT, RC2_LONG (always 'unsigned int') RC4_LONG (only int and char (for assembler) are supported) RC4_CHUNK (always long), RC_CHUNK_LL (removed) RC4_INDEX (always on) And also make D_ENCRYPT macro more clear (@appro) This is done in consultation with Andy. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Add some info in CHANGES about what's happening so far with Configure et alRichard Levitte2016-01-251-0/+14
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Refresh the thinking of --prefix and --openssldirRichard Levitte2016-01-221-0/+21
| | | | | | | | | | | | | | | --prefix is now exclusively used for software and manual installation. --openssldir is not exclusively used as a default location for certs, keys and the default openssl.cnf. This change is made to bring clarity, to have the two less intertwined, and to be more compatible with the usual ways of software installation. Please change your habits and scripts to use --prefix rather than --openssldir for installation location now. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Remove the GOST engineMatt Caswell2016-01-191-0/+7
| | | | | | | | | | The GOST engine is now out of date and is removed by this commit. An up to date GOST engine is now being maintained in an external repository. See: https://wiki.openssl.org/index.php/Binaries Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix typoRich Salz2016-01-151-1/+1
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Add a no-egd option to disable EGD-related codeBenjamin Kaduk2016-01-141-0/+4
| | | | | | | | The entropy-gathering daemon is used only on a small number of machines. Provide a configure knob so that EGD support can be disabled by default but re-enabled on those systems that do need it. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Move Makefiles to Makefile.inRich Salz2016-01-121-0/+5
| | | | | | | | | | Create Makefile's from Makefile.in Rename Makefile.org to Makefile.in Rename Makefiles to Makefile.in Address review feedback from Viktor and Richard Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Correct a small typo in CHANGESRichard Levitte2016-01-121-1/+1
| | | | Reviewed-by: Stephen Henson <steve@openssl.org>
* Add notes in CHANGES and NEWSRichard Levitte2016-01-121-10/+10
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH528: "cipher -v" output is confusing.Rich Salz2016-01-111-0/+4
| | | | | | Fix the docs, and refactor some common code. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* DANE CHANGESViktor Dukhovni2016-01-071-0/+14
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Backwards-compatibility subject to OPENSSL_API_COMPATViktor Dukhovni2016-01-071-0/+29
| | | | | | | | | Provide backwards-compatiblity for functions, macros and include files if OPENSSL_API_COMPAT is either not defined or defined less than the version number of the release in which the feature was deprecated. Reviewed-by: Richard Levitte <levitte@openssl.org>
* mem functions cleanupRich Salz2016-01-071-0/+6
| | | | | | | | | | | | | | | | | Only two macros CRYPTO_MDEBUG and CRYPTO_MDEBUG_ABORT to control this. If CRYPTO_MDEBUG is not set, #ifdef out the whole debug machinery. (Thanks to Jakob Bohm for the suggestion!) Make the "change wrapper functions" be the only paradigm. Wrote documentation! Format the 'set func' functions so their paramlists are legible. Format some multi-line comments. Remove ability to get/set the "memory debug" functions at runtme. Remove MemCheck_* and CRYPTO_malloc_debug_init macros. Add CRYPTO_mem_debug(int flag) function. Add test/memleaktest. Rename CRYPTO_malloc_init to OPENSSL_malloc_init; remove needless calls. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Protocol version selection and negotiation rewriteViktor Dukhovni2016-01-021-1/+3
| | | | | | | | | | | | | | | | | | | The protocol selection code is now consolidated in a few consecutive short functions in a single file and is table driven. Protocol-specific constraints that influence negotiation are moved into the flags field of the method structure. The same protocol version constraints are now applied in all code paths. It is now much easier to add new protocol versions without reworking the protocol selection logic. In the presence of "holes" in the list of enabled client protocols we no longer select client protocols below the hole based on a subset of the constraints and then fail shortly after when it is found that these don't meet the remaining constraints (suiteb, FIPS, security level, ...). Ideally, with the new min/max controls users will be less likely to create "holes" in the first place. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Add support for minimum and maximum protocol versionKurt Roeckx2016-01-021-0/+8
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Remove GMP engine.Rich Salz2015-12-151-2/+3
| | | | Reviewed-by: Ben Laurie <ben@openssl.org>
* Fix s_server problem with no-ecMatt Caswell2015-12-151-1/+2
| | | | | | | | | | s_server was trying to set the ECDH curve when no-ec was defined. This also highlighted the fact that the -no_ecdhe option to s_server is broken, and doesn't make any sense any more (ECDHE is on by default and the only way it can be disabled is through the cipherstring). Therefore this commit removes the option. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Use SHA256 not MD5 as default digest.Rich Salz2015-12-121-0/+4
| | | | | (Documentation update was in the MR but not the commit. Oops.) Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix OCB linkMatt Caswell2015-12-111-1/+1
| | | | | | | The link to the OCB patent pdf changed, so the link in CHANGES needs to be updated. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update CHANGES and NEWS for alpha releaseMatt Caswell2015-12-101-1/+3
| | | | | | Misc updates to the CHANGES and NEWS files ready for the alpha release. Reviewed-by: Richard Levitte <levitte@openssl.org>
* add CHANGES and NEWS entryDr. Stephen Henson2015-12-091-0/+10
| | | | | | Todo: update documentation. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add an entry in CHANGESRichard Levitte2015-12-071-0/+22
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix and update versions in CHANGES and NEWSDr. Stephen Henson2015-12-071-1/+59
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Remove support for all 40 and 56 bit ciphers.Kurt Roeckx2015-12-051-0/+5
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> MR: #364
* Remove SSL_{CTX_}set_ecdh_auto() and always enable ECDHKurt Roeckx2015-12-041-0/+5
| | | | Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Make SSL_{CTX}_set_tmp_ecdh() call SSL_{CTX_}set1_curves()Kurt Roeckx2015-12-041-0/+4
| | | | | | | | SSL_{CTX}_set_tmp_ecdh() allows to set 1 EC curve and then tries to use it. On the other hand SSL_{CTX_}set1_curves() allows you to set a list of curves, but only when SSL_{CTX_}set_ecdh_auto() was called to turn it on. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Remove support for SSL_{CTX_}set_tmp_ecdh_callback().Kurt Roeckx2015-12-041-0/+4
| | | | | | | | This only gets used to set a specific curve without actually checking that the peer supports it or not and can therefor result in handshake failures that can be avoided by selecting a different cipher. Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* ex_data part 2: doc fixes and CRYPTO_free_ex_index.Rich Salz2015-12-011-0/+4
| | | | | | | | | | Add CRYPTO_free_ex_index (for shared libraries) Unify and complete the documentation for all "ex_data" API's and objects. Replace xxx_get_ex_new_index functions with a macro. Added an exdata test. Renamed the ex_data internal datatypes. Reviewed-by: Matt Caswell <matt@openssl.org>
* Tweak async documentation based on feedbackMatt Caswell2015-11-201-1/+1
| | | | | | | | | | Add some clarifications to the async documentation. Also changed ASYNC_pause_job() so that it returns success if you are not within the context of a job. This is so that engines can be used either asynchronously or synchronously and can treat an error from ASYNC_pause_job() as a real error. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update CHANGESMatt Caswell2015-11-201-0/+10
| | | | | | Add a CHANGES entry for the new async code. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Rename RSA_eay_xxx to rsa_ossl_xxxRich Salz2015-11-171-0/+1
| | | | | | Final part of flushing out SSLEay API's. Reviewed-by: Tim Hudson <tjh@openssl.org>
* Replace "SSLeay" in API with OpenSSLRich Salz2015-10-301-0/+4
| | | | | | | All instances of SSLeay (any combination of case) were replaced with the case-equivalent OpenSSL. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove the old state definesMatt Caswell2015-10-301-4/+1
| | | | | | | | | Remove all the defines for the old state machines states. Mapping old to new is probably going to cause more problems than it solves so it is probably better to just remove them. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove SSL_state and SSL_set_stateMatt Caswell2015-10-301-6/+8
| | | | | | | | SSL_state has been replaced by SSL_get_state and SSL_set_state is no longer supported. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Change HANDSHAKE_STATE to OSSL_HANDSHAKE_STATEMatt Caswell2015-10-301-4/+4
| | | | | | | | Rename the enum HANDSHAKE_STATE to OSSL_HANDSHAKE_STATE to ensure there are no namespace clashes, and convert it into a typedef. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Update CHANGESMatt Caswell2015-10-301-0/+12
| | | | | | | Update the CHANGES file for the state machine rewrite Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move crypto/threads to demo/threadsRich Salz2015-10-261-0/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove Obsolete enginesMatt Caswell2015-10-151-0/+3
| | | | | | | | There are a number of engines in the OpenSSL source code which are now obsolete. The following engines have been removed: 4758cca, aep, atalla, cswift, nuron, sureware. Reviewed-by: Rich Salz <rsalz@openssl.org>
* add CHANGES entry for embedDr. Stephen Henson2015-10-151-0/+21
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove EVP_CHECK_DES_KEYEmilia Kasper2015-10-141-0/+2
| | | | | | Thanks to the OpenBSD community for bringing this to our attention. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Change the DEFAULT ciphersuites to exclude DES, RC4 and RC2Matt Caswell2015-09-301-0/+6
| | | | | | | | | | | | | This patch updates the "DEFAULT" cipherstring to be "ALL:!COMPLEMENTOFDEFAULT:!eNULL". COMPLEMENTOFDEFAULT is now defined internally by a flag on each ciphersuite indicating whether it should be excluded from DEFAULT or not. This gives us control at an individual ciphersuite level as to exactly what is in DEFAULT and what is not. Finally all DES, RC4 and RC2 ciphersuites are added to COMPLEMENTOFDEFAULT and hence removed from DEFAULT. Reviewed-by: Tim Hudson <tjh@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-01 22:50:58 +0000