changes

mediastreamer2是开源的网络传输媒体流的库

     followup to PR #377.
     [Lutz Jaenicke]

  *) IA-32 assembler support enhancements: unified ELF targets, support
     for SCO/Caldera platforms, fix for Cygwin shared build.
     [Andy Polyakov]

  *) Add support for FreeBSD on sparc64.  As a consequence, support for
     FreeBSD on non-x86 processors is separate from x86 processors on
     the config script, much like the NetBSD support.
     [Richard Levitte & Kris Kennaway <[e-mail]>]

 Changes between 0.9.6h and 0.9.7  [31 Dec 2002]

  [NB: OpenSSL 0.9.6i and later 0.9.6 patch levels were released after
  OpenSSL 0.9.7.]

  *) Fix session ID handling in SSLv2 client code: the SERVER FINISHED
     code (06) was taken as the first octet of the session ID and the last
     octet was ignored consequently. As a result SSLv2 client side session
     caching could not have worked due to the session ID mismatch between
     client and server.
     Behaviour observed by Crispin Flowerday <[e-mail]> as
     PR #377.
     [Lutz Jaenicke]

  *) Change the declaration of needed Kerberos libraries to use EX_LIBS
     instead of the special (and badly supported) LIBKRB5.  LIBKRB5 is
     removed entirely.
     [Richard Levitte]

  *) The hw_ncipher.c engine requires dynamic locks.  Unfortunately, it
     seems that in spite of existing for more than a year, many application
     author have done nothing to provide the necessary callbacks, which
     means that this particular engine will not work properly anywhere.
     This is a very unfortunate situation which forces us, in the name
     of usability, to give the hw_ncipher.c a static lock, which is part
     of libcrypto.
     NOTE: This is for the 0.9.7 series ONLY.  This hack will never
     appear in 0.9.8 or later.  We EXPECT application authors to have
     dealt properly with this when 0.9.8 is released (unless we actually
     make such changes in the libcrypto locking code that changes will
     have to be made anyway).
     [Richard Levitte]

  *) In asn1_d2i_read_bio() repeatedly call BIO_read() until all content
     octets have been read, EOF or an error occurs. Without this change
     some truncated ASN1 structures will not produce an error.
     [Steve Henson]

  *) Disable Heimdal support, since it hasn't been fully implemented.
     Still give the possibility to force the use of Heimdal, but with
     warnings and a request that patches get sent to openssl-dev.
     [Richard Levitte]

  *) Add the VC-CE target, introduce the WINCE sysname, and add
     INSTALL.WCE and appropriate conditionals to make it build.
     [Steven Reddie <[e-mail]> via Richard Levitte]

  *) Change the DLL names for Cygwin to cygcrypto-x.y.z.dll and
     cygssl-x.y.z.dll, where x, y and z are the major, minor and
     edit numbers of the version.
     [Corinna Vinschen <[e-mail]> and Richard Levitte]

  *) Introduce safe string copy and catenation functions
     (BUF_strlcpy() and BUF_strlcat()).
     [Ben Laurie (CHATS) and Richard Levitte]

  *) Avoid using fixed-size buffers for one-line DNs.
     [Ben Laurie (CHATS)]

  *) Add BUF_MEM_grow_clean() to avoid information leakage when
     resizing buffers containing secrets, and use where appropriate.
     [Ben Laurie (CHATS)]

  *) Avoid using fixed size buffers for configuration file location.
     [Ben Laurie (CHATS)]

  *) Avoid filename truncation for various CA files.
     [Ben Laurie (CHATS)]

  *) Use sizeof in preference to magic numbers.
     [Ben Laurie (CHATS)]

  *) Avoid filename truncation in cert requests.
     [Ben Laurie (CHATS)]

  *) Add assertions to check for (supposedly impossible) buffer
     overflows.
     [Ben Laurie (CHATS)]

  *) Don't cache truncated DNS entries in the local cache (this could
     potentially lead to a spoofing attack).
     [Ben Laurie (CHATS)]

  *) Fix various buffers to be large enough for hex/decimal
     representations in a platform independent manner.
     [Ben Laurie (CHATS)]

  *) Add CRYPTO_realloc_clean() to avoid information leakage when
     resizing buffers containing secrets, and use where appropriate.
     [Ben Laurie (CHATS)]

  *) Add BIO_indent() to avoid much slightly worrying code to do
     indents.
     [Ben Laurie (CHATS)]

  *) Convert sprintf()/BIO_puts() to BIO_printf().
     [Ben Laurie (CHATS)]

  *) buffer_gets() could terminate with the buffer only half
     full. Fixed.
     [Ben Laurie (CHATS)]

  *) Add assertions to prevent user-supplied crypto functions from
     overflowing internal buffers by having large block sizes, etc.
     [Ben Laurie (CHATS)]

  *) New OPENSSL_assert() macro (similar to assert(), but enabled
     unconditionally).
     [Ben Laurie (CHATS)]

  *) Eliminate unused copy of key in RC4.
     [Ben Laurie (CHATS)]

  *) Eliminate unused and incorrectly sized buffers for IV in pem.h.
     [Ben Laurie (CHATS)]

  *) Fix off-by-one error in EGD path.
     [Ben Laurie (CHATS)]

  *) If RANDFILE path is too long, ignore instead of truncating.
     [Ben Laurie (CHATS)]

  *) Eliminate unused and incorrectly sized X.509 structure
     CBCParameter.
     [Ben Laurie (CHATS)]

  *) Eliminate unused and dangerous function knumber().
     [Ben Laurie (CHATS)]

  *) Eliminate unused and dangerous structure, KSSL_ERR.
     [Ben Laurie (CHATS)]

  *) Protect against overlong session ID context length in an encoded
     session object. Since these are local, this does not appear to be
     exploitable.
     [Ben Laurie (CHATS)]

  *) Change from security patch (see 0.9.6e below) that did not affect
     the 0.9.6 release series:

     Remote buffer overflow in SSL3 protocol - an attacker could
     supply an oversized master key in Kerberos-enabled versions.
     (CAN-2002-0657)
     [Ben Laurie (CHATS)]

  *) Change the SSL kerb5 codes to match RFC 2712.
     [Richard Levitte]

  *) Make -nameopt work fully for req and add -reqopt switch.
     [Michael Bell <[e-mail]>, Steve Henson]

  *) The "block size" for block ciphers in CFB and OFB mode should be 1.
     [Steve Henson, reported by Yngve Nysaeter Pettersen <[e-mail]>]

  *) Make sure tests can be performed even if the corresponding algorithms
     have been removed entirely.  This was also the last step to make
     OpenSSL compilable with DJGPP under all reasonable conditions.
     [Richard Levitte, Doug Kaufman <[e-mail]>]

  *) Add cipher selection rules COMPLEMENTOFALL and COMPLEMENTOFDEFAULT
     to allow version independent disabling of normally unselected ciphers,
     which may be activated as a side-effect of selecting a single cipher.

     (E.g., cipher list string "RSA" enables ciphersuites that are left
     out of "ALL" because they do not provide symmetric encryption.
     "RSA:!COMPLEMEMENTOFALL" avoids these unsafe ciphersuites.)
     [Lutz Jaenicke, Bodo Moeller]

  *) Add appropriate support for separate platform-dependent build
     directories.  The recommended way to make a platform-dependent
     build directory is the following (tested on Linux), maybe with
     some local tweaks:

	# Place yourself outside of the OpenSSL source tree.  In
	# this example, the environment variable OPENSSL_SOURCE
	# is assumed to contain the absolute OpenSSL source directory.
	mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
	cd objtree/"`uname -s`-`uname -r`-`uname -m`"
	(cd $OPENSSL_SOURCE; find . -type f) | while read F; do
		mkdir -p `dirname $F`
		ln -s $OPENSSL_SOURCE/$F $F
	done

     To be absolutely sure not to disturb the source tree, a "make clean"
     is a good thing.  If it isn't successfull, don't worry about it,
     it probably means the source directory is very clean.
     [Richard Levitte]

  *) Make sure any ENGINE control commands make local copies of string
     pointers passed to them whenever necessary. Otherwise it is possible
     the caller may have overwritten (or deallocated) the original string
     data when a later ENGINE operation tries to use the stored values.
     [G鰐z Babin-Ebell <[e-mail]>]

  *) Improve diagnostics in file reading and command-line digests.
     [Ben Laurie aided and abetted by Solar Designer <[e-mail]>]

  *) Add AES modes CFB and OFB to the object database.  Correct an
     error in AES-CFB decryption.
     [Richard Levitte]

  *) Remove most calls to EVP_CIPHER_CTX_cleanup() in evp_enc.c, this 
     allows existing EVP_CIPHER_CTX structures to be reused after
     calling EVP_*Final(). This behaviour is used by encryption
     BIOs and some applications. This has the side effect that
     applications must explicitly clean up cipher contexts with
     EVP_CIPHER_CTX_cleanup() or they will leak memory.
     [Steve Henson]

  *) Check the values of dna and dnb in bn_mul_recursive before calling
     bn_mul_comba (a non zero value means the a or b arrays do not contain
     n2 elements) and fallback to bn_mul_normal if either is not zero.
     [Steve Henson]

  *) Fix escaping of non-ASCII characters when using the -subj option
     of the "openssl req" command line tool. (Robert Joop <[e-mail]>)
     [Lutz Jaenicke]

  *) Make object definitions compliant to LDAP (RFC2256): SN is the short
     form for "surname", serialNumber has no short form.
     Use "mail" as the short name for "rfc822Mailbox" according to RFC2798;
     therefore remove "mail" short name for "internet 7".
     The OID for unique identifiers in X509 certificates is
     x500UniqueIdentifier, not uniqueIdentifier.
     Some more OID additions. (Michael Bell <[e-mail]>)
     [Lutz Jaenicke]

  *) Add an "init" command to the ENGINE config module and auto initialize
     ENGINEs. Without any "init" command the ENGINE will be initialized 
     after all ctrl commands have been executed on it. If init=1 the 
     ENGINE is initailized at that point (ctrls before that point are run
     on the uninitialized ENGINE and after on the initialized one). If
     init=0 then the ENGINE will not be iniatialized at all.
     [Steve Henson]

  *) Fix the 'app_verify_callback' interface so that the user-defined
     argument is actually passed to the callback: In the
     SSL_CTX_set_cert_verify_callback() prototype, the callback
     declaration has been changed from
          int (*cb)()
     into
          int (*cb)(X509_STORE_CTX *,void *);
     in ssl_verify_cert_chain (ssl/ssl_cert.c), the call
          i=s->ctx->app_verify_callback(&ctx)
     has been changed into
          i=s->ctx->app_verify_callback(&ctx, s->ctx->app_verify_arg).

     To update applications using SSL_CTX_set_cert_verify_callback(),
     a dummy argument can be added to their callback functions.
     [D. K. Smetters <[e-mail]>]

  *) Added the '4758cca' ENGINE to support IBM 4758 cards.
     [Maurice Gittens <[e-mail]>, touchups by Geoff Thorpe]

  *) Add and OPENSSL_LOAD_CONF define which will cause
     OpenSSL_add_all_algorithms() to load the openssl.cnf config file.
     This allows older applications to transparently support certain
     OpenSSL features: such as crypto acceleration and dynamic ENGINE loading.
     Two new functions OPENSSL_add_all_algorithms_noconf() which will never
     load the config file and OPENSSL_add_all_algorithms_conf() which will
     always load it have also been added.
     [Steve Henson]

  *) Add the OFB, CFB and CTR (all with 128 bit feedback) to AES.
     Adjust NIDs and EVP layer.
     [Stephen Sprunk <[e-mail]> and Richard Levitte]

  *) Config modules support in openssl utility.

     Most commands now load modules from the config file,
     though in a few (such as version) this isn't done 
     because it couldn't be used for anything.

     In the case of ca and req the config file used is
     the same as the utility itself: that is the -config
     command line option can be used to specify an
     alternative file.
     [Steve Henson]

  *) Move default behaviour from OPENSSL_config(). If appname is NULL
     use "openssl_conf" if filename is NULL use default openssl config file.
     [Steve Henson]

  *) Add an argument to OPENSSL_config() to allow the use of an alternative
     config section name. Add a new flag to tolerate a missing config file
     and move code to CONF_modules_load_file().
     [Steve Henson]

  *) Support for crypto accelerator cards from Accelerated Encryption
     Processing, www.aep.ie.  (Use engine 'aep')