changes.ssleay

mediastreamer2是开源的网络传输媒体流的库

    only the SSLv3 version would be picked up.  Now this will pick
    up both SSLv2 and SSLv3 versions. This required changing the
    SSL_CIPHER->mask values so that they only mask the ciphers,
    digests, authentication, export type and key-exchange algorithms.

    I found that when a SSLv23 session is established, a reused
    session, of type SSLv3 was attempting to write the SSLv2 
    ciphers, which were invalid. The SSL_METHOD->put_cipher_by_char 
    method has been modified so it will only write out cipher which
    that method knows about.  


 Changes between 0.8.0 and 0.8.1

  *) Mostly bug fixes. 
     There is an Ephemeral DH cipher problem which is fixed.

 SSLeay 0.8.0

This version of SSLeay has quite a lot of things different from the
previous version.

Basically check all callback parameters, I will be producing documentation
about how to use things in th future.  Currently I'm just getting 080 out
the door.  Please not that there are several ways to do everything, and
most of the applications in the apps directory are hybrids, some using old
methods and some using new methods.

Have a look in demos/bio for some very simple programs and
apps/s_client.c and apps/s_server.c for some more advanced versions.
Notes are definitly needed but they are a week or so away.

Anyway, some quick nots from Tim Hudson ([e-mail])
---
Quick porting notes for moving from SSLeay-0.6.x to SSLeay-0.8.x to
get those people that want to move to using the new code base off to
a quick start.

Note that Eric has tidied up a lot of the areas of the API that were
less than desirable and renamed quite a few things (as he had to break
the API in lots of places anyrate). There are a whole pile of additional
functions for making dealing with (and creating) certificates a lot
cleaner.

01-Jul-97
Tim Hudson
[e-mail]

---8<---

To maintain code that uses both SSLeay-0.6.x and SSLeay-0.8.x you could
use something like the following (assuming you #include "crypto.h" which
is something that you really should be doing).

#if SSLEAY_VERSION_NUMBER >= 0x0800
#define SSLEAY8
#endif

buffer.h -> splits into buffer.h and bio.h so you need to include bio.h
            too if you are working with BIO internal stuff (as distinct
        from simply using the interface in an opaque manner)

#include "bio.h"    - required along with "buffer.h" if you write
              your own BIO routines as the buffer and bio
              stuff that was intermixed has been separated
              out 
            
envelope.h -> evp.h  (which should have been done ages ago)

Initialisation ... don't forget these or you end up with code that
is missing the bits required to do useful things (like ciphers):

SSLeay_add_ssl_algorithms()
(probably also want SSL_load_error_strings() too but you should have
 already had that call in place)

SSL_CTX_new()   - requires an extra method parameter
              SSL_CTX_new(SSLv23_method()) 
              SSL_CTX_new(SSLv2_method()) 
              SSL_CTX_new(SSLv3_method()) 

          OR to only have the server or the client code
              SSL_CTX_new(SSLv23_server_method()) 
              SSL_CTX_new(SSLv2_server_method()) 
              SSL_CTX_new(SSLv3_server_method()) 
          or  
              SSL_CTX_new(SSLv23_client_method()) 
              SSL_CTX_new(SSLv2_client_method()) 
              SSL_CTX_new(SSLv3_client_method()) 

SSL_set_default_verify_paths() ... renamed to the more appropriate
SSL_CTX_set_default_verify_paths()

If you want to use client certificates then you have to add in a bit
of extra stuff in that a SSLv3 server sends a list of those CAs that
it will accept certificates from ... so you have to provide a list to
SSLeay otherwise certain browsers will not send client certs.

SSL_CTX_set_client_CA_list(ctx,SSL_load_client_CA_file(s_cert_file));


X509_NAME_oneline(X)    -> X509_NAME_oneline(X,NULL,0)  
               or provide a buffer and size to copy the
               result into

X509_add_cert ->  X509_STORE_add_cert (and you might want to read the
          notes on X509_NAME structure changes too)


VERIFICATION CODE
=================

The codes have all be renamed from VERIFY_ERR_* to X509_V_ERR_* to
more accurately reflect things.

The verification callback args are now packaged differently so that
extra fields for verification can be added easily in future without
having to break things by adding extra parameters each release :-)

X509_cert_verify_error_string -> X509_verify_cert_error_string


BIO INTERNALS
=============

Eric has fixed things so that extra flags can be introduced in
the BIO layer in future without having to play with all the BIO
modules by adding in some macros.

The ugly stuff using 
    b->flags ~= (BIO_FLAGS_RW|BIO_FLAGS_SHOULD_RETRY)
becomes
    BIO_clear_retry_flags(b)

    b->flags |= (BIO_FLAGS_READ|BIO_FLAGS_SHOULD_RETRY)
becomes
    BIO_set_retry_read(b)

Also ... BIO_get_retry_flags(b), BIO_set_flags(b)



OTHER THINGS
============

X509_NAME has been altered so that it isn't just a STACK ... the STACK
is now in the "entries" field ... and there are a pile of nice functions
for getting at the details in a much cleaner manner.

SSL_CTX has been altered ... "cert" is no longer a direct member of this
structure ... things are now down under "cert_store" (see x509_vfy.h) and
things are no longer in a CERTIFICATE_CTX but instead in a X509_STORE.
If your code "knows" about this level of detail then it will need some 
surgery.

If you depending on the incorrect spelling of a number of the error codes
then you will have to change your code as these have been fixed.

ENV_CIPHER "type" got renamed to "nid" and as that is what it actually
has been all along so this makes things clearer.
ify_cert_error_string(ctx->error));

SSL_R_NO_CIPHER_WE_TRUST -> SSL_R_NO_CIPHER_LIST
            and SSL_R_REUSE_CIPHER_LIST_NOT_ZERO



 Changes between 0.7.x and 0.8.0
  
  *) There have been lots of changes, mostly the addition of SSLv3.
     There have been many additions from people and amongst
     others, C2Net has assisted greatly.
 
 Changes between 0.7.x and 0.7.x

  *) Internal development version only

SSLeay 0.6.6 13-Jan-1997

The main additions are

- assember for x86 DES improvments.
  From 191,000 per second on a pentium 100, I now get 281,000.  The inner
  loop and the IP/FP modifications are from
  Svend Olaf Mikkelsen <[e-mail]>.  Many thanks for his
  contribution.
- The 'DES macros' introduced in 0.6.5 now have 3 types.
  DES_PTR1, DES_PTR2 and 'normal'.  As per before, des_opts reports which
  is best and there is a summery of mine in crypto/des/options.txt
- A few bug fixes.
- Added blowfish.  It is not used by SSL but all the other stuff that
  deals with ciphers can use it in either ecb, cbc, cfb64 or ofb64 modes.
  There are 3 options for optimising Blowfish.  BF_PTR, BF_PTR2 and 'normal'.
  BF_PTR2 is pentium/x86 specific.  The correct option is setup in
  the 'Configure' script.
- There is now a 'get client certificate' callback which can be
  'non-blocking'.  If more details are required, let me know.  It will
  documented more in SSLv3 when I finish it.
- Bug fixes from 0.6.5 including the infamous 'ca' bug.  The 'make test'
  now tests the ca program.
- Lots of little things modified and tweaked.

 SSLeay 0.6.5

After quite some time (3 months), the new release.  I have been very busy
for the last few months and so this is mostly bug fixes and improvments.

The main additions are

- assember for x86 DES.  For all those gcc based systems, this is a big
  improvement.  From 117,000 DES operation a second on a pentium 100,
  I now get 191,000.  I have also reworked the C version so it
  now gives 148,000 DESs per second.  
- As mentioned above, the inner DES macros now have some more variant that
  sometimes help, sometimes hinder performance.  There are now 3 options
  DES_PTR (ptr vs array lookup), DES_UNROLL (full vs partial loop unrolling)
  and DES_RISC (a more register intensive version of the inner macro).
  The crypto/des/des_opts.c program, when compiled and run, will give
  an indication of the correct options to use.
- The BIO stuff has been improved.  Read doc/bio.doc.  There are now
  modules for encryption and base64 encoding and a BIO_printf() function.
- The CA program will accept simple one line X509v3 extensions in the
  ssleay.cnf file.  Have a look at the example.  Currently this just
  puts the text into the certificate as an OCTET_STRING so currently
  the more advanced X509v3 data types are not handled but this is enough
  for the netscape extensions.
- There is the start of a nicer higher level interface to the X509
  strucutre.
- Quite a lot of bug fixes.
- CRYPTO_malloc_init()  (or CRYPTO_set_mem_functions()) can be used
  to define the malloc(), free() and realloc() routines to use
  (look in crypto/crypto.h).  This is mostly needed for Windows NT/95 when
  using DLLs and mixing CRT libraries.

In general, read the 'VERSION' file for changes and be aware that some of
the new stuff may not have been tested quite enough yet, so don't just plonk
in SSLeay 0.6.5 when 0.6.4 used to work and expect nothing to break.

SSLeay 0.6.4 30/08/96 eay

I've just finished some test builds on Windows NT, Windows 3.1, Solaris 2.3,
Solaris 2.5, Linux, IRIX, HPUX 10 and everthing seems to work :-).

The main changes in this release

- Thread safe.  have a read of doc/threads.doc and play in the mt directory.
  For anyone using 0.6.3 with threads, I found 2 major errors so consider
  moving to 0.6.4.  I have a test program that builds under NT and
  solaris.
- The get session-id callback has changed.  Have a read of doc/callback.doc.
- The X509_cert_verify callback (the SSL_verify callback) now
  has another argument.  Have a read of doc/callback.doc
- 'ca -preserve', sign without re-ordering the DN.  Not tested much.
- VMS support.
- Compile time memory leak detection can now be built into SSLeay.
  Read doc/memory.doc
- CONF routines now understand '\', '\n', '\r' etc.  What this means is that
  the  SPKAC object mentioned in doc/ns-ca.doc can be on multiple lines.
- 'ssleay ciphers' added, lists the default cipher list for SSLeay.
- RC2 key setup is now compatable with Netscape.
- Modifed server side of SSL implementation, big performance difference when
      using session-id reuse.

0.6.3

Bug fixes and the addition of some nice stuff to the 'ca' program.
Have a read of doc/ns-ca.doc for how hit has been modified so
it can be driven from a CGI script.  The CGI script is not provided,
but that is just being left as an excersize for the reader :-).

0.6.2

This is most bug fixes and functionality improvements.

Additions are
- More thread debugging patches, the thread stuff is still being
  tested, but for those keep to play with stuff, have a look in
  crypto/cryptlib.c.  The application needs to define 1 (or optionaly
  a second) callback that is used to implement locking.  Compiling
  with LOCK_DEBUG spits out lots of locking crud :-).
  This is what I'm currently working on.
- SSL_CTX_set_default_passwd_cb() can be used to define the callback
  function used in the SSL*_file() functions used to load keys.  I was
  always of the opinion that people should call
  PEM_read_RSAPrivateKey() and pass the callback they want to use, but
  it appears they just want to use the SSL_*_file() function() :-(.
- 'enc' now has a -kfile so a key can be read from a file.  This is
  mostly used so that the passwd does not appear when using 'ps',
  which appears imposible to stop under solaris.
- X509v3 certificates now work correctly.  I even have more examples
  in my tests :-).  There is now a X509_EXTENSION type that is used in
  X509v3 certificates and CRLv2.
- Fixed that signature type error :-(
- Fixed quite a few potential memory leaks and problems when reusing
  X509, CRL and REQ structures.
- EVP_set_pw_prompt() now sets the library wide default password
  prompt.
- The 'pkcs7' command will now, given the -print_certs flag, output in
  pem format, all certificates and CRL contained within.  This is more
  of a pre-emtive thing for the new verisign distribution method.  I
  should also note, that this also gives and example in code, of how
  to do this :-), or for that matter, what is involved in going the
  other way (list of certs and crl -> pkcs7).
- Added RSA's DESX to the DES library.  It is also available via the
  EVP_desx_cbc() method and via 'enc desx'. 

SSLeay 0.6.1

The main functional changes since 0.6.0 are as follows
- Bad news, the Microsoft 060 DLL's are not compatable, but the good news is
  that from now on, I'll keep the .def numbers the same so they will be.
- RSA private key operations are about 2 times faster that 0.6.0
- The SSL_CTX now has more fields so default values can be put against
  it.  When an SSL structure is created, these default values are used
  but can be overwritten.  There are defaults for cipher, certificate,
  private key, verify mode and callback.  This means SSL session
  creation can now be
  ssl=SSL_new()
  SSL_set_fd(ssl,sock);
  SSL_accept(ssl)
  ....
  All the other uglyness with having to keep a global copy of the
  private key and certificate/verify mode in the server is now gone.