X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=CHANGES;h=06477ac42bef6c9da9d4dae8362274bce832ea6e;hp=649de47179cb3d458fc89640329d295dcb88a032;hb=96c2201bef2160baac29dda5e1c295469f346e2f;hpb=8ce97163a2a3dea3d47e20f956032b50940422a2

diff --git a/CHANGES b/CHANGES
index 649de47179..06477ac42b 100644
--- a/CHANGES
+++ b/CHANGES
@@ -4,6 +4,67 @@
 
  Changes between 0.9.4 and 0.9.5  [xx XXX 1999]
 
+  *) Ugly workaround to get s_client and s_server working under Windows. The
+     old code wouldn't work because it needed to select() on sockets and the
+     tty (for keypresses and to see if data could be written). Win32 only
+     supports select() on sockets so we select() with a 1s timeout on the
+     sockets and then see if any characters are waiting to be read, if none
+     are present then we retry, we also assume we can always write data to
+     the tty. This isn't nice because the code then blocks until we've
+     received a complete line of data and it is effectively polling the
+     keyboard at 1s intervals: however it's quite a bit better than not
+     working at all :-) A dedicated Windows application might handle this
+     with an event loop for example.
+     [Steve Henson]
+
+  *) Enhance RSA_METHOD structure. Now there are two extra methods, rsa_sign
+     and rsa_verify. When the RSA_FLAGS_SIGN_VER option is set these functions
+     will be called when RSA_sign() and RSA_verify() are used. This is useful
+     if rsa_pub_dec() and rsa_priv_enc() equivalents are not available.
+     For this to work properly RSA_public_decrypt() and RSA_private_encrypt()
+     should *not* be used: RSA_sign() and RSA_verify() must be used instead.
+     This necessitated the support of an extra signature type NID_md5_sha1
+     for SSL signatures and modifications to the SSL library to use it instead
+     of calling RSA_public_decrypt() and RSA_private_encrypt().
+     [Steve Henson]
+
+  *) Add new -verify -CAfile and -CApath options to the crl program, these
+     will lookup a CRL issuers certificate and verify the signature in a
+     similar way to the verify program. Tidy up the crl program so it
+     no longer acesses structures directly. Make the ASN1 CRL parsing a bit
+     less strict. It will now permit CRL extensions even if it is not
+     a V2 CRL: this will allow it to tolerate some broken CRLs.
+     [Steve Henson]
+
+  *) Initialize all non-automatic variables each time one of the openssl
+     sub-programs is started (this is necessary as they may be started
+     multiple times from the "OpenSSL>" prompt).
+     [Lennart Bang, Bodo Moeller]
+
+  *) Preliminary compilation option RSA_NULL which disables RSA crypto without
+     removing all other RSA functionality (this is what NO_RSA does). This
+     is so (for example) those in the US can disable those operations covered
+     by the RSA patent while allowing storage and parsing of RSA keys and RSA
+     key generation.
+     [Steve Henson]
+
+  *) Non-copying interface to BIO pairs.
+     (still largely untested)
+     [Bodo Moeller]
+
+  *) New function ANS1_tag2str() to convert an ASN1 tag to a descriptive
+     ASCII string. This was handled independently in various places before.
+     [Steve Henson]
+
+  *) New functions UTF8_getc() and UTF8_putc() that parse and generate
+     UTF8 strings a character at a time.
+     [Steve Henson]
+
+  *) Use client_version from client hello to select the protocol
+     (s23_srvr.c) and for RSA client key exchange verification
+     (s3_srvr.c), as required by the SSL 3.0/TLS 1.0 specifications.
+     [Bodo Moeller]
+
   *) Add various utility functions to handle SPKACs, these were previously
      handled by poking round in the structure internals. Added new function
      NETSCAPE_SPKI_print() to print out SPKAC and a new utility 'spkac' to
@@ -35,8 +96,8 @@
      are otherwise ignored at present.
      [Steve Henson]
 
-  *) Fix a horrible bug in enc_read() in crypto/evp/bio_enc.c: if the first data
-     read consists of only the final block it would not decrypted because
+  *) Fix a horrible bug in enc_read() in crypto/evp/bio_enc.c: if the first
+     dataread consists of only the final block it would not decrypted because
      EVP_CipherUpdate() would correctly report zero bytes had been decrypted.
      A misplaced 'break' also meant the decrypted final block might not be
      copied until the next read.
@@ -142,9 +203,9 @@
      method only got called if p,q,dmp1,dmq1,iqmp components were present,
      otherwise bn_mod_exp was called. In the case of hardware keys for example
      no private key components need be present and it might store extra data
-     in the RSA structure, which cannot be accessed from bn_mod_exp. By setting
-     RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for private key
-     operations.
+     in the RSA structure, which cannot be accessed from bn_mod_exp.
+     By setting RSA_FLAG_EXT_PKEY rsa_mod_exp will always be called for
+     private key operations.
      [Steve Henson]
 
   *) Added support for SPARC Linux.
@@ -158,7 +219,7 @@
      The PEM[_ASN1]_{read,write}... functions and macros now take an
      additional void * argument, which is just handed through whenever
      the password callback is called.
-     [Damien Miller <dmiller@ilogic.com.au>, with tiny changes by Bodo Moeller]
+     [Damien Miller <dmiller@ilogic.com.au>; tiny changes by Bodo Moeller]
 
      New function SSL_CTX_set_default_passwd_cb_userdata.