aboutsummaryrefslogtreecommitdiffstats
path: root/CHANGES
Commit message (Collapse)AuthorAgeFilesLines
...
* Missing credit in CHANGESRich Salz2016-05-091-0/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move 3DES from HIGH to MEDIUMRich Salz2016-05-051-0/+2
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Fix spellingFdaSilvaYY2016-05-051-7/+7
| | | | | | | Signed-off-by: Kurt Roeckx <kurt@roeckx.be> Reviewed-by: Matt Caswell <matt@openssl.org> GH: #1021
* Update CHANGES and NEWS for the new releaseMatt Caswell2016-05-031-0/+97
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Document the addition of OPENSSL_LOCAL_CONFIG_DIRRichard Levitte2016-05-021-0/+7
| | | | Reviewed-by: Stephen Henson <steve@openssl.org>
* Make many X509_xxx types opaque.Rich Salz2016-04-151-0/+5
| | | | | | | | | Make X509_OBJECT, X509_STORE_CTX, X509_STORE, X509_LOOKUP, and X509_LOOKUP_METHOD opaque. Remove unused X509_CERT_FILE_CTX Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Make "shared" builds the defaultMatt Caswell2016-04-141-0/+4
| | | | | | | In most cases we expect that people will be using shared libraries not static ones, therefore we make that the default. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add a CHANGES entry for removal of Configure optionsMatt Caswell2016-04-131-1/+6
| | | | | | Document removal of no-aes, no-hmac, no-rsa, no-sha and no-md5. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add a CHANGES entry for the deprecated cleanup functionsMatt Caswell2016-04-131-0/+11
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org>
* Adjust --strict-warnings builds in TravisEmilia Kasper2016-04-101-0/+5
| | | | | | | | In Travis, do --strict-warnings on BUILDONLY configurations. This ensures that the tests run even if --strict-warnings fail, and avoids hiding unrelated test failures. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add CHANGES entry for DH and DH_METHOD opacityMatt Caswell2016-04-091-0/+5
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Update CHANGES with the new about RSA and RSA_METHODRichard Levitte2016-04-061-0/+5
| | | | Reviewed-by: Matt Caswell <matt@openssl.org>
* Added DSA opacity to CHANGESMatt Caswell2016-04-031-0/+5
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Stephen Henson <steve@openssl.org>
* Add a CHANGES entry for opaque BIOsMatt Caswell2016-03-291-1/+6
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove the no-rijndael optionMatt Caswell2016-03-211-0/+3
| | | | | | | Rijndael is an old name for AES. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Remove the remainder of util/mk1mf.pl and companion scriptsRichard Levitte2016-03-211-0/+3
| | | | | | | This removes all scripts that deal with MINFO as well, since that's only used by mk1mf. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Remove #error from include files.Rich Salz2016-03-201-0/+4
| | | | | | | | Don't have #error statements in header files, but instead wrap the contents of that file in #ifndef OPENSSL_NO_xxx This means it is now always safe to include the header file. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove Netware and OS/2Rich Salz2016-03-171-1/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove ultrix/mips support.Rich Salz2016-03-171-0/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Remove support for Borland C++Richard Levitte2016-03-171-0/+3
| | | | | | | Borland C++ 4.5 is very old and our "support" for it is already non-existent, we might as well remove it. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix up CHANGESEmilia Kasper2016-03-161-3/+3
| | | | | | | | | | - Remove duplicate entry - Add author for SSL_CIPHER query functions - Note HKDF support in CHANGES and NEWS [ci skip] Reviewed-by: Richard Levitte <levitte@openssl.org>
* Review commentsKurt Roeckx2016-03-111-0/+3
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update CHANGES and NEWSMatt Caswell2016-03-091-0/+14
| | | | | | | Update the CHANGES and NEWS files with information about the recently added AFALG engine and pipelining. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Update CHANGES for the new threading APIMatt Caswell2016-03-091-0/+8
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH787: Fix ALPNTodd Short2016-03-081-0/+3
| | | | | | | | | | | | | * Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * clean up ssl3_free() no need to explicitly clear when doing memset * document ALPN functions Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add cipher query functionsTodd Short2016-03-081-0/+3
| | | | | | | Add functions to determine authentication, key-exchange, FIPS and AEAD. Reviewed-by: Emilia Käsper <emilia@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH787: Fix ALPNTodd Short2016-03-081-0/+4
| | | | | | | | | | | | * Perform ALPN after the SNI callback; the SSL_CTX may change due to that processing * Add flags to indicate that we actually sent ALPN, to properly error out if unexpectedly received. * clean up ssl3_free() no need to explicitly clear when doing memset * document ALPN functions Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Rework the default cipherlist.Emilia Kasper2016-03-071-0/+9
| | | | | | | | | | | | - Always prefer forward-secure handshakes. - Consistently order ECDSA above RSA. - Next, always prefer AEADs to non-AEADs, irrespective of strength. - Within AEADs, prefer GCM > CHACHA > CCM for a given strength. - Prefer TLS v1.2 ciphers to legacy ciphers. - Remove rarely used DSS, IDEA, SEED, CAMELLIA, CCM from the default list to reduce ClientHello bloat. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Documentation for new CT s_client flagsRob Percival2016-03-041-0/+5
| | | | | Reviewed-by: Ben Laurie <ben@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Changes to DEFAULT curvesRich Salz2016-03-041-0/+4
| | | | | | | Change the ECC default curve list to be this, in order: x25519, secp256r1, secp521r1, secp384r1, brainpoolP256r1, brainpoolP384r1, and brainpool512r1. Reviewed-by: Emilia Käsper <emilia@openssl.org>
* Don't build RC4 ciphersuites into libssl by defaultMatt Caswell2016-03-041-0/+5
| | | | | | | | RC4 based ciphersuites in libssl have been disabled by default. They can be added back by building OpenSSL with the "enable-weak-ssl-ciphers" Configure option at compile time. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Refactor ClientHello extension parsingEmilia Kasper2016-03-031-0/+6
| | | | | | | | | | | | | | | | | 1) Simplify code with better PACKET methods. 2) Make broken SNI parsing explicit. SNI was intended to be extensible to new name types but RFC 4366 defined the syntax inextensibly, and OpenSSL has never parsed SNI in a way that would allow adding a new name type. RFC 6066 fixed the definition but due to broken implementations being widespread, it appears impossible to ever extend SNI. 3) Annotate resumption behaviour. OpenSSL doesn't currently handle all extensions correctly upon resumption. Annotate for further clean-up. 4) Send an alert on ALPN protocol mismatch. Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Updates to CHANGES and NEWS for 1.0.2 and 1.0.1 releaseMatt Caswell2016-03-011-1/+133
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add CHANGES entry for X25519Dr. Stephen Henson2016-02-281-0/+16
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* GH753: More spelling fixFdaSilvaYY2016-02-271-1/+1
| | | | | Signed-off-by: Rich Salz <rsalz@akamai.com> Reviewed-by: Kurt Roeckx <kurt@openssl.org>
* Remove Ubsec engineMatt Caswell2016-02-261-1/+1
| | | | | | | The ubsec engine is now considered obsolete and therefore has been removed. Reviewed-by: Rich Salz <rsalz@openssl.org>
* CVE-2016-0798: avoid memory leak in SRPEmilia Kasper2016-02-251-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | The SRP user database lookup method SRP_VBASE_get_by_user had confusing memory management semantics; the returned pointer was sometimes newly allocated, and sometimes owned by the callee. The calling code has no way of distinguishing these two cases. Specifically, SRP servers that configure a secret seed to hide valid login information are vulnerable to a memory leak: an attacker connecting with an invalid username can cause a memory leak of around 300 bytes per connection. Servers that do not configure SRP, or configure SRP but do not configure a seed are not vulnerable. In Apache, the seed directive is known as SSLSRPUnknownUserSeed. To mitigate the memory leak, the seed handling in SRP_VBASE_get_by_user is now disabled even if the user has configured a seed. Applications are advised to migrate to SRP_VBASE_get1_by_user. However, note that OpenSSL makes no strong guarantees about the indistinguishability of valid and invalid logins. In particular, computations are currently not carried out in constant time. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Fix a few typosRichard Levitte2016-02-221-2/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Rewrite CHANGES to add some commentary about the "pic" optionRichard Levitte2016-02-221-7/+15
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Use $disabled{"dynamic-engine"} internallyRichard Levitte2016-02-221-1/+1
| | | | | | | | We were kinda sorta using a mix of $disabled{"static-engine" and $disabled{"dynamic-engine"} in Configure. Let's avoid confusion, choose one of them and stick to it. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Document the last configuration changesRichard Levitte2016-02-211-0/+22
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove JPAKERich Salz2016-02-171-0/+3
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* Rename INSTALL_PREFIX to DESTDIR, remove option --install_prefixRichard Levitte2016-02-121-0/+6
| | | | | | | | | | | | | INSTALL_PREFIX is a confusing name, as there's also --prefix. Instead, tag along with the rest of the open source world and adopt the Makefile variable DESTDIR to designate the desired staging directory. The Configure option --install_prefix is removed, the only way to designate a staging directory is with the Makefile variable (this is also implemented for VMS' descrip.mms et al). Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove TLS heartbeat, disable DTLS heartbeatRich Salz2016-02-111-0/+5
| | | | | | | | | To enable heartbeats for DTLS, configure with enable-heartbeats. Heartbeats for TLS have been completely removed. This addresses RT 3647 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Move to REF_DEBUG, for consistency.Rich Salz2016-02-111-0/+3
| | | | | | | Add utility macros REF_ASSERT_NOT and REF_PRINT_COUNT This is also RT 4181 Reviewed-by: Richard Levitte <levitte@openssl.org>
* Update CHANGES following init function renamingMatt Caswell2016-02-101-3/+2
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* unified build system: add CHANGES & NEWSRichard Levitte2016-02-101-0/+19
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add a CHANGES entry for auto-init and de-initMatt Caswell2016-02-091-0/+6
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* GH601: Various spelling fixes.FdaSilvaYY2016-02-051-6/+6
| | | | | Signed-off-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Make DTLSv1_listen a first class function and change its typeMatt Caswell2016-02-051-0/+3
| | | | | | | | | The DTLSv1_listen function exposed details of the underlying BIO abstraction and did not properly allow for IPv6. This commit changes the "peer" argument to be a BIO_ADDR and makes it a first class function (rather than a ctrl) to ensure proper type checking. Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-12 03:49:45 +0000