Update STATUS, modify ssl.h so mkdef.pl will pick up prototypes and

[thirdparty/openssl.git] / CHANGES

 OpenSSL CHANGES
 _______________


 Changes between 0.9.1c and 0.9.2

  *) Add CygWin32 platform information to Configure script.
     [Alan Batie <batie@aahz.jf.intel.com>]

  *) Fixed ms/32all.bat script: `no_asm' -> `no-asm'
     [Rainer W. Gerling <gerling@mpg-gv.mpg.de>]
  
  *) New program nseq to manipulate netscape certificate sequences
     [Steve Henson]

  *) Modify crl2pkcs7 so it supports multiple -certfile arguments. Fix a
     few typos.
     [Steve Henson]

  *) Fixes to BN code.  Previously the default was to define BN_RECURSION
     but the BN code had some problems that would cause failures when
     doing certificate verification and some other functions.
     [Eric A. Young, (from changes to C2Net SSLeay, integrated by Mark Cox)]

  *) Add ASN1 and PEM code to support netscape certificate sequences.
     [Steve Henson]

  *) Add ASN1 and PEM code to support netscape certificate sequences.
     [Steve Henson]

  *) Add several PKIX and private extended key usage OIDs.
     [Steve Henson]

  *) Modify the 'ca' program to handle the new extension code. Modify
     openssl.cnf for new extension format, add comments.
     [Steve Henson]

  *) More X509 V3 changes. Fix typo in v3_bitstr.c. Add support to 'req'
     and add a sample to openssl.cnf so req -x509 now adds appropriate
     CA extensions.
     [Steve Henson]

  *) Continued X509 V3 changes. Add to other makefiles, integrate with the
     error code, add initial support to X509_print() and x509 application.
     [Steve Henson]

  *) Takes a deep breath and start addding X509 V3 extension support code. Add
     files in crypto/x509v3. Move original stuff to crypto/x509v3/old. All this
     stuff is currently isolated and isn't even compiled yet.
     [Steve Henson]

  *) Continuing patches for GeneralizedTime. Fix up certificate and CRL
     ASN1 to use ASN1_TIME and modify print routines to use ASN1_TIME_print.
     Removed the versions check from X509 routines when loading extensions:
     this allows certain broken certificates that don't set the version
     properly to be processed.
     [Steve Henson]

  *) Deal with irritating shit to do with dependencies, in YAAHW (Yet Another
     Ad Hoc Way) - Makefile.ssls now all contain local dependencies, which
     can still be regenerated with "make depend".
     [Ben Laurie]

  *) Spelling mistake in C version of CAST-128.
     [Ben Laurie, reported by Jeremy Hylton <jeremy@cnri.reston.va.us>]

  *) Changes to the error generation code. The perl script err-code.pl 
     now reads in the old error codes and retains the old numbers, only
     adding new ones if necessary. It also only changes the .err files if new
     codes are added. The makefiles have been modified to only insert errors
     when needed (to avoid needlessly modifying header files). This is done
     by only inserting errors if the .err file is newer than the auto generated
     C file. To rebuild all the error codes from scratch (the old behaviour)
     either modify crypto/Makefile.ssl to pass the -regen flag to err_code.pl
     or delete all the .err files.
     [Steve Henson]

  *) CAST-128 was incorrectly implemented for short keys. The C version has
     been fixed, but is untested. The assembler versions are also fixed, but
     new assembler HAS NOT BEEN GENERATED FOR WIN32 - the Makefile needs fixing
     to regenerate it if needed.
     [Ben Laurie, reported (with fix for C version) by Jun-ichiro itojun
      Hagino <itojun@kame.net>]

  *) File was opened incorrectly in randfile.c.