summaryrefslogtreecommitdiffstats
path: root/CHANGES.md
AgeCommit message (Collapse)Author
2021-01-13apps/req.c: Add -copy_extensions option for use with -x509; default: noneDr. David von Oheimb
Fixes #13708 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13658)
2021-01-13apps/{req,x509,ca}.c Make sure certs have SKID and AKID X.509 extensions by ↵Dr. David von Oheimb
default Fixes #13603 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13658)
2021-01-08Add SM2 private key range validationNicola Tuveri
According to the relevant standards, the valid range for SM2 private keys is [1, n-1), where n is the order of the curve generator. For this reason we cannot reuse the EC validation function as it is, and we introduce a new internal function `sm2_key_private_check()`. Partially fixes https://github.com/openssl/openssl/issues/8435 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13359)
2021-01-08[apps/pkey] Return error on failed `-[pub]check`Nicola Tuveri
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13359)
2021-01-07Add a CHANGES entry for ignore unknown ciphers in set_ciphersuites.Otto Hollmann
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12100)
2021-01-07Prepare for 3.0 alpha 11Matt Caswell
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
2021-01-07Prepare for release of 3.0 alpha 10openssl-3.0.0-alpha10Matt Caswell
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
2020-12-17dsa: add additional deprecated functions to CHANGES entry.Pauli
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13638)
2020-12-15Documenting the options deprecating in CHANGES.mdDmitry Belyavskiy
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13669)
2020-12-08Update CHANGES and NEWS for new releaseMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org>
2020-11-28ERR: Drop or deprecate dangerous or overly confusing functionsRichard Levitte
ERR_get_error_line() is deprecated, and ERR_get_error_func() and ERR_get_error_data() are removed in favor of ERR_get_error_all(), since they pop the error record, leaving the caller with only partial error record data and no way to get the rest if the wish. If it's desirable to retrieve data piecemeal, the caller should consider using the diverse ERR_peek functions and finish off with ERR_get_error(). Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13466)
2020-11-27Updates the CHANGES.md entry regarding DH deprecationMatt Caswell
Extend the existing CHANGES.md entry with information about the additional functions that have also been deprecated. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13138)
2020-11-26Prepare for 3.0 alpha 10Matt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
2020-11-26Prepare for release of 3.0 alpha 9openssl-3.0.0-alpha9Matt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
2020-11-24Modify the ERR init functions to use the internal ERR string loadersRichard Levitte
This deprecates all the ERR_load_ functions, and moves their definition to separate C source files that can easily be removed when those functions are finally removed. This also reduces include/openssl/kdferr.h to include cryptoerr_legacy.h, moves the declaration of ERR_load_ERR_strings() from include/openssl/err.h to include/openssl/cryptoerr_legacy.h, and finally removes the declaration of ERR_load_DSO_strings(), which was entirely internal anyway. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13390)
2020-11-18Add a CHANGES.md entry for the "tmp_dh" functions/macrosMatt Caswell
Describe the tmp_dh deprecations, and what applications should do instead. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13368)
2020-11-13Remove -C option from x509 commandRich Salz
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13384)
2020-11-13Remove -C from dhparam,dsaparam,ecparamRich Salz
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13384)
2020-11-12apps/passwd: remove the -crypt option.Pauli
Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13313)
2020-11-06CHANGES.md: Mention (strict) checks recently added to X509_verify_cert()David von Oheimb
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13312)
2020-11-05Prepare for 3.0 alpha 9Matt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
2020-11-05Prepare for release of 3.0 alpha 8openssl-3.0.0-alpha8Matt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
2020-11-04Moved OPENSSL_fork_prepare,_parent,_child from init.c to threads_pthread.c.Randall S. Becker
These methods should ultimately be deprecated. The move is to insulate non-UNIX platforms from these undefined symbols. CLA: Permission is granted by the author to the OpenSSL team to use these modifications. Fixes #13273 Signed-off-by: Randall S. Becker <rsbecker@nexbridge.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13276)
2020-11-02Add AES KW inverse ciphers to the EVP layerShane Lontis
Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13272)
2020-10-20Deprecate EVP_PKEY_set1_tls_encodedpoint()Matt Caswell
Also deprecate EVP_PKEY_get1_tls_encodedpoint(). The preferred alternative is EVP_PKEY_set1_encoded_public_key() and EVP_PKEY_get1_encoded_public_key(). Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13105)
2020-10-16Add a CHANGES entry for the SSL_SECOP_TMP_DH changeMatt Caswell
Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Ben Kaduk <kaduk@mit.edu> (Merged from https://github.com/openssl/openssl/pull/13136)
2020-10-16list: add a -provider-info option.Pauli
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13084)
2020-10-15Prepare for 3.0 alpha 8Matt Caswell
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
2020-10-15Prepare for release of 3.0 alpha 7openssl-3.0.0-alpha7Matt Caswell
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
2020-10-15Rename OPENSSL_CTX prefix to OSSL_LIB_CTXDr. Matthias St. Pierre
Many of the new types introduced by OpenSSL 3.0 have an OSSL_ prefix, e.g., OSSL_CALLBACK, OSSL_PARAM, OSSL_ALGORITHM, OSSL_SERIALIZER. The OPENSSL_CTX type stands out a little by using a different prefix. For consistency reasons, this type is renamed to OSSL_LIB_CTX. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12621)
2020-10-08Expose PKCS7_get_octet_string and PKCS7_type_is_otherJordan Montgomery
Add PKCS7_get_octet_string() and PKCS7_type_is_other() to the public interface. Fixes #11139 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/13059)
2020-10-06Change CVE link style in CHANGES and NEWSDr. Matthias St. Pierre
Replace [collapsed reference links][] for the CVEs by [shortcut reference links], in order to to improve the readability of the raw markdown text. Consistently add parentheses around the CVE links at the end of the CVE descriptions. (The NEWS file already had the parentheses, in the CHANGES file they where missing.) [collapsed reference links]: https://github.github.com/gfm/#collapsed-reference-link [shortcut reference links]: https://github.github.com/gfm/#shortcut-reference-link Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12967)
2020-10-06Update CHANGES and NEWS for 1.1.1h releaseDr. Matthias St. Pierre
Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12967)
2020-09-26en EVP_PKEY_CTX_set_rsa_keygen_pubexp() BIGNUM managementjwalch
Fixes #12635 As discussed in the issue, supporting the set0-like semantics long-term is not necessarily desirable, although necessary for short-term compatibility concerns. So I've deprecated the original method and added an equivalent that is explicitly labelled as set1. I tried to audit existing usages of the (now-deprecated) API and update them to use set1 if that appeared to align with their expectations. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12917)
2020-09-25EVP: Enforce that EVP_PKEY_set_alias_type() only works with legacy keysRichard Levitte
This also deprecates the function, as it is not necessary any more, and should fall out of use. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12920)
2020-09-13Add a CHANGES entry for the safestack updatesMatt Caswell
Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12781)
2020-09-11apps/ca: allow CRL lastUpdate/nextUpdate fields to be specifiedChris Novakovic
When generating a CRL using the "ca" utility, allow values for the lastUpdate and nextUpdate fields to be specified using the command line options -crl_lastupdate and -crl_nextupdate respectively. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Dmitry Belyavskiy <beldmit@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12784)
2020-09-09Support writing RSA keys using the traditional format againKurt Roeckx
Fixes: #6855 Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #8743
2020-08-21Rename OSSL_SERIALIZER / OSSL_DESERIALIZER to OSSL_ENCODE / OSSL_DECODERichard Levitte
Fixes #12455 Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12660)
2020-08-19PKCS12_parse(): Fix reversed order of certs parsed and output via *caDr. David von Oheimb
Fixes #6698 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12641)
2020-08-07rand_drbg: remove RAND_DRBG.Pauli
The RAND_DRBG API did not fit well into the new provider concept as implemented by EVP_RAND and EVP_RAND_CTX. The main reason is that the RAND_DRBG API is a mixture of 'front end' and 'back end' API calls and some of its API calls are rather low-level. This holds in particular for the callback mechanism (RAND_DRBG_set_callbacks()) and the RAND_DRBG type changing mechanism (RAND_DRBG_set()). Adding a compatibility layer to continue supporting the RAND_DRBG API as a legacy API for a regular deprecation period turned out to come at the price of complicating the new provider API unnecessarily. Since the RAND_DRBG API exists only since version 1.1.1, it was decided by the OMC to drop it entirely. Other related changes: Use RNG instead of DRBG in EVP_RAND documentation. The documentation was using DRBG in places where it should have been RNG or CSRNG. Move the RAND_DRBG(7) documentation to EVP_RAND(7). Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/12509)
2020-08-06Prepare for 3.0 alpha 7Matt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
2020-08-06Prepare for release of 3.0 alpha 6openssl-3.0.0-alpha6Matt Caswell
Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org>
2020-08-03Add CHANGES.md entry for SSL_set1_host()/SSL_add1_host() taking IP literalsDavid Woodhouse
Reviewed-by: Viktor Dukhovni <viktor@openssl.org> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9201)
2020-07-21Avoid errors with a priori inapplicable protocol boundsViktor Dukhovni
The 'MinProtocol' and 'MaxProtocol' configuration commands now silently ignore TLS protocol version bounds when configurign DTLS-based contexts, and conversely, silently ignore DTLS protocol version bounds when configuring TLS-based contexts. The commands can be repeated to set bounds of both types. The same applies with the corresponding "min_protocol" and "max_protocol" command-line switches, in case some application uses both TLS and DTLS. SSL_CTX instances that are created for a fixed protocol version (e.g. TLSv1_server_method()) also silently ignore version bounds. Previously attempts to apply bounds to these protocol versions would result in an error. Now only the "version-flexible" SSL_CTX instances are subject to limits in configuration files in command-line options. Expected to resolve #12394 Reviewed-by: Paul Dale <paul.dale@oracle.com> GH: #12472
2020-07-20check-format.pl: Add an entry about it to NEWS.md and to CHANGES.mdDr. David von Oheimb
Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12270)
2020-07-16Prepare for 3.0 alpha 6Richard Levitte
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
2020-07-16Prepare for release of 3.0 alpha 5openssl-3.0.0-alpha5Richard Levitte
Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com>
2020-07-16Revert "The EVP_MAC functions have been renamed for consistency. The ↵Matt Caswell
EVP_MAC_CTX_*" The commit claimed to make things more consistent. In fact it makes it less so. Revert back to the previous namig convention. This reverts commit d9c2fd51e2e278bc3f7793a104ff7b4879f6d63a. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12186)
2020-07-16Add latest changes and news in CHANGES.md and NEWS.mdRichard Levitte
- Reworked test perl framwork for parallel tests - Reworked ERR codes to make better space for system errors - Deprecation of the ENGINE API Reviewed-by: Nicola Tuveri <nic.tuv@gmail.com> (Merged from https://github.com/openssl/openssl/pull/12461)
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-31 17:02:43 +0000