Relax some over-zealous constification that gave some lhash-based code no

[thirdparty/openssl.git] / CHANGES

 OpenSSL CHANGES
 _______________

 Changes between 0.9.7c and 0.9.8  [xx XXX xxxx]

  *) Because of the callback-based approach for implementing LHASH as a
     template type, lh_insert() adds opaque objects to hash-tables and
     lh_doall() or lh_doall_arg() are typically used with a destructor callback
     to clean up those corresponding objects before destroying the hash table
     (and losing the object pointers). So some over-zealous constifications in
     LHASH have been relaxed so that lh_insert() does not take (nor store) the
     objects as "const" and the lh_doall[_arg] callback wrappers are not
     prototyped to have "const" restrictions on the object pointers they are
     given (and so aren't required to cast them away any more).
     [Geoff Thorpe]

  *) The tmdiff.h API was so ugly and minimal that our own timing utility
     (speed) prefers to use its own implementation. The two implementations
     haven't been consolidated as yet (volunteers?) but the tmdiff API has had
     its object type properly exposed (MS_TM) instead of casting to/from "char
     *". This may still change yet if someone realises MS_TM and "ms_time_***"
     aren't necessarily the greatest nomenclatures - but this is what was used
     internally to the implementation so I've used that for now.
     [Geoff Thorpe]

  *) Ensure that deprecated functions do not get compiled when
     OPENSSL_NO_DEPRECATED is defined. Some "openssl" subcommands and a few of
     the self-tests were still using deprecated key-generation functions so
     these have been updated also.
     [Geoff Thorpe]

  *) Reorganise PKCS#7 code to separate the digest location functionality
     into PKCS7_find_digest(), digest addtion into PKCS7_bio_add_digest().
     New function PKCS7_set_digest() to set the digest type for PKCS#7
     digestedData type. Add additional code to correctly generate the
     digestedData type and add support for this type in PKCS7 initialization
     functions.
     [Steve Henson]

  *) New function PKCS7_set0_type_other() this initializes a PKCS7 
     structure of type "other".
     [Steve Henson]

  *) Fix prime generation loop in crypto/bn/bn_prime.pl by making
     sure the loop does correctly stop and breaking ("division by zero")
     modulus operations are not performed. The (pre-generated) prime
     table crypto/bn/bn_prime.h was already correct, but it could not be
     re-generated on some platforms because of the "division by zero"
     situation in the script.
     [Ralf S. Engelschall]

  *) Update support for ECC-based TLS ciphersuites according to
     draft-ietf-tls-ecc-03.txt: the KDF1 key derivation function with
     SHA-1 now is only used for "small" curves (where the
     representation of a field element takes up to 24 bytes); for
     larger curves, the field element resulting from ECDH is directly
     used as premaster secret.
     [Douglas Stebila (Sun Microsystems Laboratories)]

  *) Add code for kP+lQ timings to crypto/ec/ectest.c, and add SEC2
     curve secp160r1 to the tests.
     [Douglas Stebila (Sun Microsystems Laboratories)]

  *) Add the possibility to load symbols globally with DSO.