Fix SSL handshake functions and SSL_clear() such that SSL_clear()

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 79ee3c82e429d6565d84715b1aa4cc93189bb797..4ff8e00b4475ef9b576c61f4c8d99ca823c676ff 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -12,6 +12,20 @@
          *) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7
          +) applies to 0.9.7 only
 
+  *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()
+     never resets s->method to s->ctx->method when called from within
+     one of the SSL handshake functions.
+     [Bodo Moeller; problem pointed out by Niko Baric]
+
+  +) Test for certificates which contain unsupported critical extensions.
+     If such a certificate is found during a verify operation it is 
+     rejected by default: this behaviour can be overridden by either
+     handling the new error X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION or
+     by setting the verify flag X509_V_FLAG_IGNORE_CRITICAL. A new function
+     X509_supported_extension() has also been added which returns 1 if a
+     particular extension is supported.
+     [Steve Henson]
+
   +) New functions/macros
 
           SSL_CTX_set_msg_callback(ctx, cb)
@@ -54,13 +68,16 @@
      [Steve Henson]
 
   +) Modify the behaviour of EVP_DigestInit() and EVP_DigestFinal() to retain
-     compatibility with existing code. In particular the 'ctx' parameter is
-     not assumed to be valid before the call to EVP_DigestInit() and it is tidied
-     up after a call to EVP_DigestFinal(). A new function EVP_DigestFinal_ex()
-     but does not free up the ctx. Also change function EVP_MD_CTX_copy() to
-     assume the destination is uninitialized: EVP_MD_CTX_copy_ex() do assumes
-     the destiation is valid. Also modify all the OpenSSL digest calls to call 
-     EVP_DigestInit_ex(), EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
+     compatibility with existing code. In particular the 'ctx' parameter does
+     not have to be to be initialized before the call to EVP_DigestInit() and
+     it is tidied up after a call to EVP_DigestFinal(). New function
+     EVP_DigestFinal_ex() which does not tidy up the ctx. Similarly function
+     EVP_MD_CTX_copy() changed to not require the destination to be
+     initialized valid and new function EVP_MD_CTX_copy_ex() added which
+     requires the destination to be valid.
+
+     Modify all the OpenSSL digest calls to use EVP_DigestInit_ex(),
+     EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
      [Steve Henson]
 
   +) Change ssl3_get_message (ssl/s3_both.c) and the functions using it