Merge from 0.9.7-stable.

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 070cbbe213847d71f719947f07599cb8ac1e1122..404f76bd082b9ebb703047738ac49484838e22c6 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,7 +2,7 @@
  OpenSSL CHANGES
  _______________
 
- Changes between 0.9.7 and 0.9.8  [xx XXX 2002]
+ Changes between 0.9.7 and 0.9.8  [xx XXX xxxx]
 
   *) Change the "progress" mechanism used in key-generation and
      primality testing to functions that take a new BN_GENCB pointer in
@@ -14,6 +14,23 @@
      functions operate on a caller-supplied key-structure and return
      success/failure rather than returning a key or NULL - this is to
      help make "keygen" another member function of RSA_METHOD etc.
+
+     Example for using the new callback interface:
+
+          int (*my_callback)(int a, int b, BN_GENCB *cb) = ...;
+          void *my_arg = ...;
+          BN_GENCB my_cb;
+
+          BN_GENCB_set(&my_cb, my_callback, my_arg);
+
+          return BN_is_prime_ex(some_bignum, BN_prime_checks, NULL, &cb);
+          /* For the meaning of a, b in calls to my_callback(), see the
+           * documentation of the function that calls the callback.
+           * cb will point to my_cb; my_arg can be retrieved as cb->arg.
+           * my_callback should return 1 if it wants BN_is_prime_ex()
+           * to continue, or 0 to stop.
+           */
+
      [Geoff Thorpe]
 
   *) Change the ZLIB compression method to be stateful, and make it
@@ -25,9 +42,9 @@
      is defined as follows (according to X.509_4thEditionDraftV6.pdf):
 
      CertificatePair ::= SEQUENCE {
-       forward         [0]     Certificate OPTIONAL,
-       reverse         [1]     Certificate OPTIONAL,
-       -- at least one of the pair shall be present -- }
+        forward                [0]     Certificate OPTIONAL,
+        reverse                [1]     Certificate OPTIONAL,
+        -- at least one of the pair shall be present -- }
 
      Also implement the PEM functions to read and write certificate
      pairs, and defined the PEM tag as "CERTIFICATE PAIR".
@@ -350,11 +367,36 @@ TODO: bug: pad  x  with leading zeros if necessary
          EC_GROUP_get_nid()
      [Nils Larsch <nla@trustcenter.de, Bodo Moeller]
  
- Changes between 0.9.6h and 0.9.7  [XX xxx 2002]
+ Changes between 0.9.7 and 0.9.7a  [XX xxx 2003]
+
+  *) IA-32 assembler support enhancements: unified ELF targets, support
+     for SCO/Caldera platforms, fix for Cygwin shared build.
+     [Andy Polyakov]
+
+  *) Add support for FreeBSD on sparc64.  As a consequence, support for
+     FreeBSD on non-x86 processors is separate from x86 processors on
+     the config script, much like the NetBSD support.
+     [Richard Levitte & Kris Kennaway <kris@obsecurity.org>]
+
+ Changes between 0.9.6h and 0.9.7  [31 Dec 2002]
+
+  *) Fix session ID handling in SSLv2 client code: the SERVER FINISHED
+     code (06) was taken as the first octet of the session ID and the last
+     octet was ignored consequently. As a result SSLv2 client side session
+     caching could not have worked due to the session ID mismatch between
+     client and server.
+     Behaviour observed by Crispin Flowerday <crispin@flowerday.cx> as
+     PR #377.
+     [Lutz Jaenicke]
+
+  *) Change the declaration of needed Kerberos libraries to use EX_LIBS
+     instead of the special (and badly supported) LIBKRB5.  LIBKRB5 is
+     removed entirely.
+     [Richard Levitte]
 
   *) The hw_ncipher.c engine requires dynamic locks.  Unfortunately, it
-     seems that in spite of existing for more than a year, no application
-     author has done anything to provide the necessary callbacks, which
+     seems that in spite of existing for more than a year, many application
+     author have done nothing to provide the necessary callbacks, which
      means that this particular engine will not work properly anywhere.
      This is a very unfortunate situation which forces us, in the name
      of usability, to give the hw_ncipher.c a static lock, which is part
@@ -511,7 +553,7 @@ TODO: bug: pad  x  with leading zeros if necessary
        # is assumed to contain the absolute OpenSSL source directory.
        mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
        cd objtree/"`uname -s`-`uname -r`-`uname -m`"
-       (cd $OPENSSL_SOURCE; find . -type f -o -type l) | while read F; do
+       (cd $OPENSSL_SOURCE; find . -type f) | while read F; do
                mkdir -p `dirname $F`
                ln -s $OPENSSL_SOURCE/$F $F
        done