mention des_old.h

[openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index 94605d7ffdd45be314ff773f8234f2d52ed28f0a..5c6a9fdcddf678fefe2a42fd0ab472ef9b625ebc 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -12,6 +12,39 @@
          *) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7
          +) applies to 0.9.7 only
 
+  +) Add '-noemailDN' option to 'openssl ca'.  This prevents inclusion
+     of the e-mail address in the DN (i.e., it will go into a certificate
+     extension only).  The new configuration file option 'email_in_dn = no'
+     has the same effect.
+     [Massimiliano Pala madwolf@openca.org]
+
+  *) Change ssl23_get_client_hello (ssl/s23_srvr.c) behaviour when
+     faced with a pathologically small ClientHello fragment that does
+     not contain client_version: Instead of aborting with an error,
+     simply choose the highest available protocol version (i.e.,
+     TLS 1.0 unless it is disabled).  In practice, ClientHello
+     messages are never sent like this, but this change gives us
+     strictly correct behaviour at least for TLS.
+     [Bodo Moeller]
+
+  +) Change all functions with names starting with des_ to be starting
+     with DES_ instead.  This because there are increasing clashes with
+     libdes and other des libraries that are currently used by other
+     projects.  The old libdes interface is provided, as well as crypt(),
+     if openssl/des_old.h is included.  Note that crypt() is no longer
+     declared in openssl/des.h.
+
+     NOTE: This is a major break of an old API into a new one.  Software
+     authors are encouraged to switch to the DES_ style functions.  Some
+     time in the future, des_old.h and the libdes compatibility functions
+     will be completely removed.
+     [Richard Levitte]
+
+  *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()
+     never resets s->method to s->ctx->method when called from within
+     one of the SSL handshake functions.
+     [Bodo Moeller; problem pointed out by Niko Baric]
+
   +) Test for certificates which contain unsupported critical extensions.
      If such a certificate is found during a verify operation it is 
      rejected by default: this behaviour can be overridden by either
@@ -63,13 +96,16 @@
      [Steve Henson]
 
   +) Modify the behaviour of EVP_DigestInit() and EVP_DigestFinal() to retain
-     compatibility with existing code. In particular the 'ctx' parameter is
-     not assumed to be valid before the call to EVP_DigestInit() and it is tidied
-     up after a call to EVP_DigestFinal(). A new function EVP_DigestFinal_ex()
-     but does not free up the ctx. Also change function EVP_MD_CTX_copy() to
-     assume the destination is uninitialized: EVP_MD_CTX_copy_ex() do assumes
-     the destiation is valid. Also modify all the OpenSSL digest calls to call 
-     EVP_DigestInit_ex(), EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
+     compatibility with existing code. In particular the 'ctx' parameter does
+     not have to be to be initialized before the call to EVP_DigestInit() and
+     it is tidied up after a call to EVP_DigestFinal(). New function
+     EVP_DigestFinal_ex() which does not tidy up the ctx. Similarly function
+     EVP_MD_CTX_copy() changed to not require the destination to be
+     initialized valid and new function EVP_MD_CTX_copy_ex() added which
+     requires the destination to be valid.
+
+     Modify all the OpenSSL digest calls to use EVP_DigestInit_ex(),
+     EVP_DigestFinal_ex() and EVP_MD_CTX_copy_ex().
      [Steve Henson]
 
   +) Change ssl3_get_message (ssl/s3_both.c) and the functions using it