Updates from 1.0.0-stable

diff --git a/apps/apps.c b/apps/apps.c
index 957939599fae36d8060cd614b01e6bc4627dccb9..7294c26f317aef6019cd0e037c0c62ec641ef623 100644 (file)
--- a/apps/apps.c
+++ b/apps/apps.c
@@ -259,13 +259,6 @@ int str2fmt(char *s)
                return(FORMAT_ASN1);
        else if ((*s == 'T') || (*s == 't'))
                return(FORMAT_TEXT);
-       else if ((*s == 'P') || (*s == 'p'))
-               {
-               if (s[1] == 'V' || s[1] == 'v')
-                       return FORMAT_PVK;
-               else
-                       return(FORMAT_PEM);
-               }
        else if ((*s == 'N') || (*s == 'n'))
                return(FORMAT_NETSCAPE);
        else if ((*s == 'S') || (*s == 's'))
@@ -278,6 +271,13 @@ int str2fmt(char *s)
                return(FORMAT_PKCS12);
        else if ((*s == 'E') || (*s == 'e'))
                return(FORMAT_ENGINE);
+       else if ((*s == 'P') || (*s == 'p'))
+               {
+               if (s[1] == 'V' || s[1] == 'v')
+                       return FORMAT_PVK;
+               else
+                       return(FORMAT_PEM);
+               }
        else
                return(FORMAT_UNDEF);
        }

diff --git a/apps/openssl.cnf b/apps/openssl.cnf
index 7bcaa53ede5faa99fe77d2a0e737ce4ac51616a4..9d2cd5bfa52f3121b08b494a0ea4bbfbba32ea31 100644 (file)
--- a/apps/openssl.cnf
+++ b/apps/openssl.cnf
@@ -231,7 +231,7 @@ keyUsage = nonRepudiation, digitalSignature, keyEncipherment
 
 subjectKeyIdentifier=hash
 
-authorityKeyIdentifier=keyid:always,issuer:always
+authorityKeyIdentifier=keyid:always,issuer
 
 # This is what PKIX recommends but some broken software chokes on critical
 # extensions.
@@ -264,7 +264,7 @@ basicConstraints = CA:true
 # Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.
 
 # issuerAltName=issuer:copy
-authorityKeyIdentifier=keyid:always,issuer:always
+authorityKeyIdentifier=keyid:always
 
 [ proxy_cert_ext ]
 # These extensions should be added when creating a proxy certificate
@@ -297,7 +297,7 @@ nsComment                   = "OpenSSL Generated Certificate"
 
 # PKIX recommendations harmless if included in all certificates.
 subjectKeyIdentifier=hash
-authorityKeyIdentifier=keyid,issuer:always
+authorityKeyIdentifier=keyid,issuer
 
 # This stuff is for subjectAltName and issuerAltname.
 # Import the email address.

diff --git a/crypto/bio/b_sock.c b/crypto/bio/b_sock.c
index 0eee25a0bc9b44742ff1fb12ccaf8879ab47065f..da0f126f12e5c2d1194ab12140560d83fad00f18 100644 (file)
--- a/crypto/bio/b_sock.c
+++ b/crypto/bio/b_sock.c
@@ -810,7 +810,7 @@ int BIO_accept(int sock, char **addr)
 #ifdef EAI_FAMILY
 # if defined(OPENSSL_SYS_VMS) || defined(OPENSSL_SYS_BEOS_BONE) || defined(OPENSSL_SYS_MSDOS)
 #  define SOCKLEN_T size_t
-# else
+# elif !defined(SOCKLEN_T)
 #  define SOCKLEN_T socklen_t
 #endif
        do {

diff --git a/crypto/objects/objects.h b/crypto/objects/objects.h
index 65b6f013588cddf53b2453a1fdcfd9b52d0ca9b2..bd0ee52feb22b74fc1e1243d892cf411e3b6a0b3 100644 (file)
--- a/crypto/objects/objects.h
+++ b/crypto/objects/objects.h
@@ -1054,24 +1054,34 @@ const void *    OBJ_bsearch_ex_(const void *key,const void *base,int num,
  * the non-constness means a lot of complication, and in practice
  * comparison routines do always not touch their arguments.
  */
-#define _IMPLEMENT_OBJ_BSEARCH_CMP_FN(scope, type1, type2, nm) \
+
+#define IMPLEMENT_OBJ_BSEARCH_CMP_FN(type1, type2, nm) \
   static int nm##_cmp_BSEARCH_CMP_FN(const void *a_, const void *b_)   \
       { \
       type1 const *a = a_; \
       type2 const *b = b_; \
       return nm##_cmp(a,b); \
       } \
-  scope type2 *OBJ_bsearch_##nm(type1 *key, type2 const *base, int num) \
+  static type2 *OBJ_bsearch_##nm(type1 *key, type2 const *base, int num) \
       { \
       return (type2 *)OBJ_bsearch_(key, base, num, sizeof(type2), \
                                        nm##_cmp_BSEARCH_CMP_FN); \
       } \
       extern void dummy_prototype(void)
 
-#define IMPLEMENT_OBJ_BSEARCH_CMP_FN(type1, type2, cmp) \
-  _IMPLEMENT_OBJ_BSEARCH_CMP_FN(static, type1, type2, cmp)
-#define IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(type1, type2, cmp) \
-  _IMPLEMENT_OBJ_BSEARCH_CMP_FN(, type1, type2, cmp)
+#define IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(type1, type2, nm)  \
+  static int nm##_cmp_BSEARCH_CMP_FN(const void *a_, const void *b_)   \
+      { \
+      type1 const *a = a_; \
+      type2 const *b = b_; \
+      return nm##_cmp(a,b); \
+      } \
+  type2 *OBJ_bsearch_##nm(type1 *key, type2 const *base, int num) \
+      { \
+      return (type2 *)OBJ_bsearch_(key, base, num, sizeof(type2), \
+                                       nm##_cmp_BSEARCH_CMP_FN); \
+      } \
+      extern void dummy_prototype(void)
 
 #define OBJ_bsearch(type1,key,type2,base,num,cmp)                             \
   ((type2 *)OBJ_bsearch_(CHECKED_PTR_OF(type1,key),CHECKED_PTR_OF(type2,base), \

diff --git a/crypto/pkcs12/p12_kiss.c b/crypto/pkcs12/p12_kiss.c
index 10ee5e7b945bf5341a0fb58a656d334237ee97d8..292cc3ed4a27f2e076923a84279d4355669aac43 100644 (file)
--- a/crypto/pkcs12/p12_kiss.c
+++ b/crypto/pkcs12/p12_kiss.c
@@ -81,7 +81,7 @@ int PKCS12_parse(PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
             STACK_OF(X509) **ca)
 {
        STACK_OF(X509) *ocerts = NULL;
-       X509 *x;
+       X509 *x = NULL;
        /* Check for NULL PKCS12 structure */
 
        if(!p12)

diff --git a/crypto/x509/x509.h b/crypto/x509/x509.h
index e779c334e5bf07a95528f271de4f02814f513724..3beb69965b4647ef7995bbd2bb0ec54d6784cd4f 100644 (file)
--- a/crypto/x509/x509.h
+++ b/crypto/x509/x509.h
@@ -116,6 +116,7 @@ extern "C" {
 /* Under Win32 these are defined in wincrypt.h */
 #undef X509_NAME
 #undef X509_CERT_PAIR
+#undef X509_EXTENSIONS
 #endif
 
 #define X509_FILETYPE_PEM      1

diff --git a/crypto/x509v3/v3_alt.c b/crypto/x509v3/v3_alt.c
index 19b3a8b628e68849f7e30cc1702501cc6e31d780..b13c5674a1345c76196cd07e5a981c6d2641e1d1 100644 (file)
--- a/crypto/x509v3/v3_alt.c
+++ b/crypto/x509v3/v3_alt.c
@@ -605,6 +605,7 @@ static int do_dirname(GENERAL_NAME *gen, char *value, X509V3_CTX *ctx)
        if (!ret)
                X509_NAME_free(nm);
        gen->d.dirn = nm;
+       X509V3_section_free(ctx, sk);
                
        return ret;
        }

diff --git a/ssl/s2_lib.c b/ssl/s2_lib.c
index 907e305259ae352b8e34576ebb360201e713a692..99146041091087eb2757c316b773be8fc3725c88 100644 (file)
--- a/ssl/s2_lib.c
+++ b/ssl/s2_lib.c
@@ -412,9 +412,6 @@ long ssl2_ctx_callback_ctrl(SSL_CTX *ctx, int cmd, void (*fp)(void))
        return(0);
        }
 
-IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER,
-                                   ssl_cipher_id);
-
 /* This function needs to check if the ciphers required are actually
  * available */
 const SSL_CIPHER *ssl2_get_cipher_by_char(const unsigned char *p)

diff --git a/ssl/ssl.h b/ssl/ssl.h
index 893eb6ece39d23a1f0747010fc7e8e1bb7b7811c..e8d03bf914972b2e59f836ecd060bed45a6fe6fa 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -1595,9 +1595,11 @@ const char *SSL_get_version(const SSL *s);
 /* This sets the 'default' SSL version that SSL_new() will create */
 int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth);
 
+#ifndef OPENSSL_NO_SSL2
 const SSL_METHOD *SSLv2_method(void);          /* SSLv2 */
 const SSL_METHOD *SSLv2_server_method(void);   /* SSLv2 */
 const SSL_METHOD *SSLv2_client_method(void);   /* SSLv2 */
+#endif
 
 const SSL_METHOD *SSLv3_method(void);          /* SSLv3 */
 const SSL_METHOD *SSLv3_server_method(void);   /* SSLv3 */

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 17fc536636715b85d0e4d879211786ac416f577a..24cd4268e4033989900e7de140937ede528097ed 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -2986,3 +2986,6 @@ void ssl_clear_hash_ctx(EVP_MD_CTX **hash)
 
 IMPLEMENT_STACK_OF(SSL_CIPHER)
 IMPLEMENT_STACK_OF(SSL_COMP)
+IMPLEMENT_OBJ_BSEARCH_GLOBAL_CMP_FN(SSL_CIPHER, SSL_CIPHER,
+                                   ssl_cipher_id);
+

diff --git a/util/mk1mf.pl b/util/mk1mf.pl
index 0ed7cb4ac8cbadd0158ed62219f198a5226c456e..6b052fa31ca85d68e495f7434475c85093cdb09f 100755 (executable)
--- a/util/mk1mf.pl
+++ b/util/mk1mf.pl
@@ -736,8 +736,8 @@ sub var_add
        @a=grep(!/^e_camellia$/,@a) if $no_camellia;
        @a=grep(!/^e_seed$/,@a) if $no_seed;
 
-       @a=grep(!/(^s2_)|(^s23_)/,@a) if $no_ssl2;
-       @a=grep(!/(^s3_)|(^s23_)/,@a) if $no_ssl3;
+       #@a=grep(!/(^s2_)|(^s23_)/,@a) if $no_ssl2;
+       #@a=grep(!/(^s3_)|(^s23_)/,@a) if $no_ssl3;
 
        @a=grep(!/(_sock$)|(_acpt$)|(_conn$)|(^pxy_)/,@a) if $no_sock;
 

diff --git a/util/mkdef.pl b/util/mkdef.pl
index 96aa51af2effe10669c6c52e56697460162c79aa..29a5b9657159401c1098c639a51aa95ec848ef3b 100755 (executable)
--- a/util/mkdef.pl
+++ b/util/mkdef.pl
@@ -103,6 +103,8 @@ my @known_algorithms = ( "RC2", "RC4", "RC5", "IDEA", "DES", "BF",
                         "CMS",
                         # CryptoAPI Engine
                         "CAPIENG",
+                        # SSL v2
+                        "SSL2",
                         # JPAKE
                         "JPAKE",
                         # Deprecated functions
@@ -125,7 +127,7 @@ my $no_rsa; my $no_dsa; my $no_dh; my $no_hmac=0; my $no_aes; my $no_krb5;
 my $no_ec; my $no_ecdsa; my $no_ecdh; my $no_engine; my $no_hw;
 my $no_fp_api; my $no_static_engine=1; my $no_gmp; my $no_deprecated;
 my $no_rfc3779; my $no_psk; my $no_tlsext; my $no_cms; my $no_capieng;
-my $no_jpake;
+my $no_jpake; my $no_ssl2;
 
 my $zlib;
 
@@ -213,6 +215,7 @@ foreach (@ARGV, split(/ /, $options))
        elsif (/^no-rfc3779$/)  { $no_rfc3779=1; }
        elsif (/^no-tlsext$/)   { $no_tlsext=1; }
        elsif (/^no-cms$/)      { $no_cms=1; }
+       elsif (/^no-ssl2$/)     { $no_ssl2=1; }
        elsif (/^no-capieng$/)  { $no_capieng=1; }
        elsif (/^no-jpake$/)    { $no_jpake=1; }
        }
@@ -1145,6 +1148,7 @@ sub is_valid
                        if ($keyword eq "TLSEXT" && $no_tlsext) { return 0; }
                        if ($keyword eq "PSK" && $no_psk) { return 0; }
                        if ($keyword eq "CMS" && $no_cms) { return 0; }
+                       if ($keyword eq "SSL2" && $no_ssl2) { return 0; }
                        if ($keyword eq "CAPIENG" && $no_capieng) { return 0; }
                        if ($keyword eq "JPAKE" && $no_jpake) { return 0; }
                        if ($keyword eq "DEPRECATED" && $no_deprecated) { return 0; }