Make short names of objects RFC2256-compliant.

[oweals/openssl.git] / CHANGES

diff --git a/CHANGES b/CHANGES
index cd745b4ddbb0b880d3b14837db5472573b2d1485..4fd48d07a9657feb38f8e7b408883dfb96d9f849 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -13,6 +13,34 @@
          *) applies to 0.9.6a/0.9.6b/0.9.6c and 0.9.7
          +) applies to 0.9.7 only
 
+  +) Make object definitions compliant to LDAP (RFC2256): SN is the short
+     form for "surname", serialNumber has no short form (Michael Bell
+     <michael.bell@rz.hu-berlin.de>).
+     [Lutu Jaenicke]
+
+  *) Fix DH_generate_parameters() so that it works for 'non-standard'
+     generators, i.e. generators other than 2 and 5.  (Previously, the
+     code did not properly initialise the 'add' and 'rem' values to
+     BN_generate_prime().)
+
+     In the new general case, we do not insist that 'generator' is
+     actually a primitive root: This requirement is rather pointless;
+     a generator of the order-q subgroup is just as good, if not
+     better.
+     [Bodo Moeller]
+
+  *) Map new X509 verification errors to alerts. Discovered and submitted by
+     Tom Wu <tom@arcot.com>.
+     [Lutz Jaenicke]
+
+  *) Fix ssl3_pending() (ssl/s3_lib.c) to prevent SSL_pending() from
+     returning non-zero before the data has been completely received
+     when using non-blocking I/O.
+     [Bodo Moeller; problem pointed out by John Hughes]
+
+  *) Some of the ciphers missed the strength entry (SSL_LOW etc).
+     [Ben Laurie, Lutz Jaenicke]
+
   +) Add an "init" command to the ENGINE config module and auto initialize
      ENGINEs. Without any "init" command the ENGINE will be initialized 
      after all ctrl commands have been executed on it. If init=1 the 
@@ -340,19 +368,30 @@
   +) Change all functions with names starting with des_ to be starting
      with DES_ instead.  Add wrappers that are compatible with libdes,
      but are named _ossl_old_des_*.  Finally, add macros that map the
-     des_* symbols to the corresponding _ossl_old_des_*.
+     des_* symbols to the corresponding _ossl_old_des_* if libdes
+     compatibility is desired.  If OpenSSL 0.9.6c compatibility is
+     desired, the des_* symbols will be mapped to DES_*, with one
+     exception.
+
+     Since we provide two compatibility mappings, the user needs to
+     define the macro OPENSSL_DES_LIBDES_COMPATIBILITY if libdes
+     compatibility is desired.  The default (i.e., when that macro
+     isn't defined) is OpenSSL 0.9.6c compatibility.
+
+     There are also macros that enable and disable the support of old
+     des functions altogether.  Those are OPENSSL_ENABLE_OLD_DES_SUPPORT
+     and OPENSSL_DISABLE_OLD_DES_SUPPORT.  If none or both of those
+     are defined, the default will apply: to support the old des routines.
 
-     All this is done because there are increasing clashes with libdes
-     and other DES libraries that are currently used by other projects.
-     The old libdes interface (including crypt()) is provided if
-     <openssl/des_old.h> is included.  For now, this automatically
-     happens in <openssl/des.h> unless OPENSSL_DISABLE_OLD_DES_SUPPORT is
-     defined.  Note that crypt() is no longer declared in <openssl/des.h>.
+     In either case, one must include openssl/des.h to get the correct
+     definitions.  Do not try to just include openssl/des_old.h, that
+     won't work.
 
      NOTE: This is a major break of an old API into a new one.  Software
      authors are encouraged to switch to the DES_ style functions.  Some
      time in the future, des_old.h and the libdes compatibility functions
-     will be completely removed.
+     will be disable (i.e. OPENSSL_DISABLE_OLD_DES_SUPPORT will be the
+     default), and then completely removed.
      [Richard Levitte]
 
   *) Fix SSL handshake functions and SSL_clear() such that SSL_clear()