aboutsummaryrefslogtreecommitdiffstats
path: root/CHANGES
Commit message (Collapse)AuthorAgeFilesLines
* Ensure s_client sends an SNI extension by defaultMatt Caswell2017-04-271-0/+6
| | | | | | | | | Enforcement of an SNI extension in the initial ClientHello is becoming increasingly common (e.g. see GitHub issue #2580). This commit changes s_client so that it adds SNI be default, unless explicitly told not to via the new "-noservername" option. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2614)
* Ignore dups in X509_STORE_add_*Rich Salz2017-04-201-0/+6
| | | | | | | | | | | | | | | | | | | | | | X509_STORE_add_cert and X509_STORE_add_crl are changed to return success if the object to be added was already found in the store, rather than returning an error. Raise errors if empty or malformed files are read when loading certificates and CRLs. Remove NULL checks and allow a segv to occur. Add error handing for all calls to X509_STORE_add_c{ert|tl} Refactor these two routines into one. Bring the unit test for duplicate certificates up to date using the test framework. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2830)
* Add a note in CHANGESRichard Levitte2017-04-101-0/+6
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3126)
* Make default_method mostly compile-timeRich Salz2017-04-071-0/+4
| | | | | | | | Document thread-safety issues Have RSA_null return NULL (always fails) Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2244)
* bio/b_print.c: recognize even 'j' format modifier.Andy Polyakov2017-03-301-3/+3
| | | | | | | | | | 'j' is specified as modifier for "greatest-width integer type", which in practice means 64 bits on both 32- and 64-bit platforms. Since we rely on __attribute__((__format__(__printf__,...))) to sanitize BIO_print format, we can use it to denote [u]int64_t-s in platform-neutral manner. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3083)
* Add z modifier parsing to the BIO_printf et all format stringRichard Levitte2017-03-291-0/+4
| | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3064)
* More typo fixesFdaSilvaYY2017-03-291-1/+1
| | | | | | | | Fix some comments too [skip ci] Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3069)
* Spelling fixesFdaSilvaYY2017-03-281-2/+2
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3066)
* Add EC_KEY_get0_engine()Richard Levitte2017-03-151-0/+4
| | | | | | | Just as for DH, DSA and RSA, this gives the engine associated with the key. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2960)
* Add the presence of ARIA to the change log.Pauli2017-03-141-0/+3
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2926)
* Document in CHANGES that config now recognises 64-bit mingwRichard Levitte2017-03-131-0/+4
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2917)
* CHANGES: mention CFI annotations.Andy Polyakov2017-03-021-0/+4
| | | | | | | [skip ci] Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Code health: Quick note in changes and the OPENSSL_GLOBAL et al changesRichard Levitte2017-02-281-0/+4
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2785)
* Code cleanup: remove the VMS specific reimplementation of gmtimeRichard Levitte2017-02-281-0/+5
| | | | | | | | This reimplementation was necessary before VMS C V7.1. Since that's the minimum version we support in this OpenSSL version, the reimplementation is no longer needed. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2762)
* X509 time: tighten validation per RFC 5280Emilia Kasper2017-02-241-0/+5
| | | | | | | | | | | | - Reject fractional seconds - Reject offsets - Check that the date/time digits are in valid range. - Add documentation for X509_cmp_time GH issue 2620 Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org>
* Update CHANGES and NEWS for new releaseMatt Caswell2017-02-161-1/+14
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add support for parameterized SipHashTodd Short2017-02-011-0/+3
| | | | | | | | | | | The core SipHash supports either 8 or 16-byte output and a configurable number of rounds. The default behavior, as added to EVP, is to use 16-byte output and 2,4 rounds, which matches the behavior of most implementations. There is an EVP_PKEY_CTRL that can control the output size. Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2216)
* Update CHANGES and NEWS for new releaseMatt Caswell2017-01-261-1/+44
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Test mac-then-encryptEmilia Kasper2016-11-281-0/+3
| | | | | | | | | | | Verify that the encrypt-then-mac negotiation is handled correctly. Additionally, when compiled with no-asm, this test ensures coverage for the constant-time MAC copying code in ssl3_cbc_copy_mac. The proxy-based CBC padding test covers that as well but it's nevertheless better to have an explicit handshake test for mac-then-encrypt. Reviewed-by: Andy Polyakov <appro@openssl.org>
* Remove heartbeat supportRichard Levitte2016-11-131-0/+3
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1669)
* Update CHANGES and NEWSMatt Caswell2016-11-101-0/+46
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Add a CHANGES entry for the unrecognised record type changeMatt Caswell2016-11-021-1/+5
| | | | Reviewed-by: Tim Hudson <tjh@openssl.org>
* Revert "Disable MDC2 by default."Rich Salz2016-11-011-2/+1
| | | | | | | This reverts commit ca1574cec20589885000d039eed3a9375fb29a0d. Not suitabled for a minor release as it breaks the ABI. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Disable MDC2 by default.Rich Salz2016-10-311-1/+2
| | | | | Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Backdated note in CHANGES about shared library namesRichard Levitte2016-10-251-0/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1767)
* Remove automatic RPATH - Add a CHANGES entryRichard Levitte2016-10-131-0/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Updates CHANGES and NEWS for new releaseMatt Caswell2016-09-261-0/+17
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Updates CHANGES and NEWS for new releaseMatt Caswell2016-09-221-1/+76
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Document the new SHA256 and SHA512 password generation optionsRichard Levitte2016-09-141-0/+5
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove note from CHANGES about EC DRBGMatt Caswell2016-08-251-4/+0
| | | | | | | | EC DRBG support was added in 7fdcb457 in 2011 and then later removed. However the CHANGES entry for its original addition was left behind. This just removes the spurious CHANGES entry. Reviewed-by: Stephen Henson <steve@openssl.org>
* Update CHANGES, NEWS, README and opensslv.h on masterRichard Levitte2016-08-251-1/+5
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* CHANGES: mention Windows UTF-8 opt-in option.Andy Polyakov2016-08-251-0/+8
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Put DES into "not default" category.Rich Salz2016-08-241-2/+3
| | | | | | Add CVE to CHANGES Reviewed-by: Emilia Käsper <emilia@openssl.org>
* To avoid SWEET32 attack, move 3DES to weakRich Salz2016-08-241-0/+4
| | | | Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* update CHANGESDr. Stephen Henson2016-08-131-12/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* fixing too optimistic typo-fixklemens2016-08-051-1/+1
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1413)
* spelling fixes, just comments and readme.klemens2016-08-051-20/+20
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1413)
* Fix date in CHANGESMatt Caswell2016-08-041-1/+1
| | | | | | | The release scripts expect to see the date "xx XXX xxxx" in CHANGES. At some point the year got changed from xxxx to 2016. This changes it back. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Change default directory for the .rnd file on Windows and VMSRichard Levitte2016-06-201-2/+2
| | | | | | | | | | The previous change for Windows wasn't quite right. Corrected to use %HOME%, %USERPROFILE% and %SYSTEMPROFILE%, in that order. Also adding the default home for VMS, SYS$LOGIN: Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org>
* Change default directory for storing the .rnd file on WindowsMatt Caswell2016-06-171-0/+6
| | | | | | | | | | | | Previously we would try %RANDFILE%, then %HOME% and finally "C:". Unfortunately this often ends up being "C:" which the user may not have write permission for. Now we try %RANDFILE% first, and then the same set of environment vars as GetTempFile() uses, i.e. %TMP%, then %TEMP%, %USERPROFILE% and %SYSTEMROOT%. If all else fails we fall back to %HOME% and only then "C:". Reviewed-by: Rich Salz <rsalz@openssl.org>
* Change the return type of EVP_EncodeUpdateMatt Caswell2016-06-161-0/+5
| | | | | | | | Previously EVP_EncodeUpdate returned a void. However there are a couple of error conditions that can occur. Therefore the return type has been changed to an int, with 0 indicating error and 1 indicating success. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Deprecate the flags that switch off constant timeMatt Caswell2016-06-061-0/+6
| | | | | | | | | The flags RSA_FLAG_NO_CONSTTIME, DSA_FLAG_NO_EXP_CONSTTIME and DH_FLAG_NO_EXP_CONSTTIME which previously provided the ability to switch off the constant time implementation for RSA, DSA and DH have been made no-ops and deprecated. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Fix some RAND bugsRich Salz2016-06-011-0/+5
| | | | | | | | RT2630 -- segfault for int overlow RT2877 -- check return values in apps/rand Update CHANGES file for previous "windows rand" changes. Reviewed-by: Richard Levitte <levitte@openssl.org>
* Rename lh_xxx,sk_xxx tp OPENSSL_{LH,SK}_xxxRich Salz2016-05-201-0/+5
| | | | | | | | | | | | Rename sk_xxx to OPENSSL_sk_xxx and _STACK to OPENSSL_STACK Rename lh_xxx API to OPENSSL_LH_xxx and LHASH_NODE to OPENSSL_LH_NODE Make lhash stuff opaque. Use typedefs for function pointers; makes the code simpler. Remove CHECKED_xxx macros. Add documentation; remove old X509-oriented doc. Add API-compat names for entire old API Reviewed-by: Dr. Stephen Henson <steve@openssl.org>
* Unify <TYPE>_up_ref methods signature and behaviour.FdaSilvaYY2016-05-161-1/+9
| | | | | | | | | Add a status return value instead of void. Add some sanity checks on reference counter value. Update the docs. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org>
* Windows: When installing libraries and executables, install .pdb files as wellRichard Levitte2016-05-121-0/+6
| | | | Reviewed-by: Rich Salz <rsalz@openssl.org>
* Remove openssl.specRichard Levitte2016-05-121-0/+3
| | | | | | | | While it seemed like a good idea to have this file once upon a time, this kind of file belongs with the package maintainer rather than in our source. Reviewed-by: Rich Salz <rsalz@openssl.org>
* Add a case for 64-bit OS X in configRichard Levitte2016-05-121-0/+9
| | | | | | | | | This makes it possible to just run ./config on a x86_64 machine with no extra fuss. RT#4356 Reviewed-by: Tim Hudson <tjh@openssl.org>
* Update pkcs8 defaults.Dr. Stephen Henson2016-05-111-0/+4
| | | | | | | | Update pkcs8 utility to use 256 bit AES using SHA256 by default. Update documentation. Reviewed-by: Viktor Dukhovni <viktor@openssl.org>
* IRIX fixes.Andy Polyakov2016-05-101-0/+3
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2024-08-19 10:59:13 +0000