Date: Thu, 3 Dec 2015 21:18:49 +0000 (UTC) From: Jung-uk Kim <jkim@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-10@freebsd.org Subject: svn commit: r291721 - in stable/10: crypto/openssl crypto/openssl/apps crypto/openssl/crypto crypto/openssl/crypto/aes/asm crypto/openssl/crypto/asn1 crypto/openssl/crypto/bio crypto/openssl/crypto... Message-ID: <201512032118.tB3LIns1043566@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: jkim Date: Thu Dec 3 21:18:48 2015 New Revision: 291721 URL: https://svnweb.freebsd.org/changeset/base/291721 Log: Merge OpenSSL 1.0.1q. Added: stable/10/crypto/openssl/CONTRIBUTING - copied unchanged from r291709, vendor-crypto/openssl/dist-1.0.1/CONTRIBUTING stable/10/crypto/openssl/appveyor.yml - copied unchanged from r291709, vendor-crypto/openssl/dist-1.0.1/appveyor.yml stable/10/crypto/openssl/doc/dir-locals.example.el - copied unchanged from r291709, vendor-crypto/openssl/dist-1.0.1/doc/dir-locals.example.el stable/10/crypto/openssl/doc/openssl-c-indent.el - copied unchanged from r291709, vendor-crypto/openssl/dist-1.0.1/doc/openssl-c-indent.el stable/10/crypto/openssl/ssl/clienthellotest.c - copied unchanged from r291709, vendor-crypto/openssl/dist-1.0.1/ssl/clienthellotest.c stable/10/crypto/openssl/util/toutf8.sh - copied unchanged from r291709, vendor-crypto/openssl/dist-1.0.1/util/toutf8.sh Deleted: stable/10/crypto/openssl/util/pod2mantest Modified: stable/10/crypto/openssl/CHANGES stable/10/crypto/openssl/Configure stable/10/crypto/openssl/FAQ stable/10/crypto/openssl/Makefile stable/10/crypto/openssl/Makefile.org stable/10/crypto/openssl/NEWS stable/10/crypto/openssl/README stable/10/crypto/openssl/apps/Makefile stable/10/crypto/openssl/apps/apps.c stable/10/crypto/openssl/apps/asn1pars.c stable/10/crypto/openssl/apps/ca.c stable/10/crypto/openssl/apps/ecparam.c stable/10/crypto/openssl/apps/engine.c stable/10/crypto/openssl/apps/ocsp.c stable/10/crypto/openssl/apps/pkcs12.c stable/10/crypto/openssl/apps/s_client.c stable/10/crypto/openssl/apps/s_server.c stable/10/crypto/openssl/crypto/aes/asm/aes-586.pl stable/10/crypto/openssl/crypto/aes/asm/aesni-x86.pl stable/10/crypto/openssl/crypto/asn1/asn1_par.c stable/10/crypto/openssl/crypto/asn1/d2i_pr.c stable/10/crypto/openssl/crypto/asn1/tasn_dec.c stable/10/crypto/openssl/crypto/asn1/x_bignum.c stable/10/crypto/openssl/crypto/asn1/x_pubkey.c stable/10/crypto/openssl/crypto/asn1/x_x509.c stable/10/crypto/openssl/crypto/bio/b_dump.c stable/10/crypto/openssl/crypto/bio/bss_file.c stable/10/crypto/openssl/crypto/bn/asm/armv4-gf2m.pl stable/10/crypto/openssl/crypto/bn/asm/ia64.S stable/10/crypto/openssl/crypto/bn/asm/s390x-gf2m.pl stable/10/crypto/openssl/crypto/bn/asm/x86-gf2m.pl stable/10/crypto/openssl/crypto/bn/asm/x86_64-gcc.c stable/10/crypto/openssl/crypto/bn/asm/x86_64-gf2m.pl stable/10/crypto/openssl/crypto/bn/bn_exp.c stable/10/crypto/openssl/crypto/bn/bn_gcd.c stable/10/crypto/openssl/crypto/bn/bn_gf2m.c stable/10/crypto/openssl/crypto/bn/bn_mont.c stable/10/crypto/openssl/crypto/bn/bn_recp.c stable/10/crypto/openssl/crypto/bn/bn_x931p.c stable/10/crypto/openssl/crypto/bn/bntest.c stable/10/crypto/openssl/crypto/buffer/buf_str.c stable/10/crypto/openssl/crypto/buffer/buffer.h stable/10/crypto/openssl/crypto/cms/cms_enc.c stable/10/crypto/openssl/crypto/cms/cms_pwri.c stable/10/crypto/openssl/crypto/cms/cms_smime.c stable/10/crypto/openssl/crypto/comp/c_zlib.c stable/10/crypto/openssl/crypto/conf/conf_def.c stable/10/crypto/openssl/crypto/conf/conf_sap.c stable/10/crypto/openssl/crypto/cryptlib.c stable/10/crypto/openssl/crypto/dsa/dsa_ameth.c stable/10/crypto/openssl/crypto/dsa/dsa_gen.c stable/10/crypto/openssl/crypto/ec/ec.h stable/10/crypto/openssl/crypto/ec/ec_asn1.c stable/10/crypto/openssl/crypto/ec/ec_key.c stable/10/crypto/openssl/crypto/engine/eng_cryptodev.c stable/10/crypto/openssl/crypto/engine/eng_list.c stable/10/crypto/openssl/crypto/evp/e_des3.c stable/10/crypto/openssl/crypto/evp/encode.c stable/10/crypto/openssl/crypto/evp/evp_key.c stable/10/crypto/openssl/crypto/evp/evp_lib.c stable/10/crypto/openssl/crypto/evp/evp_pbe.c stable/10/crypto/openssl/crypto/evp/p_lib.c stable/10/crypto/openssl/crypto/evp/pmeth_gn.c stable/10/crypto/openssl/crypto/hmac/hm_ameth.c stable/10/crypto/openssl/crypto/jpake/jpake.c stable/10/crypto/openssl/crypto/mem_clr.c stable/10/crypto/openssl/crypto/modes/asm/ghash-armv4.pl stable/10/crypto/openssl/crypto/modes/asm/ghash-x86.pl stable/10/crypto/openssl/crypto/ocsp/ocsp_lib.c stable/10/crypto/openssl/crypto/ocsp/ocsp_prn.c stable/10/crypto/openssl/crypto/opensslconf.h stable/10/crypto/openssl/crypto/opensslconf.h.in stable/10/crypto/openssl/crypto/opensslv.h stable/10/crypto/openssl/crypto/pem/pem_info.c stable/10/crypto/openssl/crypto/pem/pvkfmt.c stable/10/crypto/openssl/crypto/pkcs12/p12_add.c stable/10/crypto/openssl/crypto/pkcs12/p12_crpt.c stable/10/crypto/openssl/crypto/pkcs12/p12_mutl.c stable/10/crypto/openssl/crypto/pkcs7/pk7_doit.c stable/10/crypto/openssl/crypto/rc4/asm/rc4-x86_64.pl stable/10/crypto/openssl/crypto/rsa/rsa_ameth.c stable/10/crypto/openssl/crypto/rsa/rsa_gen.c stable/10/crypto/openssl/crypto/rsa/rsa_sign.c stable/10/crypto/openssl/crypto/rsa/rsa_test.c stable/10/crypto/openssl/crypto/sha/asm/sha1-586.pl stable/10/crypto/openssl/crypto/sha/asm/sha256-586.pl stable/10/crypto/openssl/crypto/sha/asm/sha512-586.pl stable/10/crypto/openssl/crypto/sha/asm/sha512-parisc.pl stable/10/crypto/openssl/crypto/sparccpuid.S stable/10/crypto/openssl/crypto/srp/srp_vfy.c stable/10/crypto/openssl/crypto/ts/ts_rsp_verify.c stable/10/crypto/openssl/crypto/whrlpool/asm/wp-mmx.pl stable/10/crypto/openssl/crypto/x509/x509_cmp.c stable/10/crypto/openssl/crypto/x509/x509_lu.c stable/10/crypto/openssl/crypto/x509v3/v3_cpols.c stable/10/crypto/openssl/crypto/x509v3/v3_ncons.c stable/10/crypto/openssl/crypto/x509v3/v3_pci.c stable/10/crypto/openssl/crypto/x509v3/v3_pcia.c stable/10/crypto/openssl/doc/apps/ciphers.pod stable/10/crypto/openssl/doc/apps/dgst.pod stable/10/crypto/openssl/doc/apps/genrsa.pod stable/10/crypto/openssl/doc/apps/req.pod stable/10/crypto/openssl/doc/apps/x509.pod stable/10/crypto/openssl/doc/crypto/BIO_read.pod stable/10/crypto/openssl/doc/crypto/BN_rand.pod stable/10/crypto/openssl/doc/crypto/DSA_generate_parameters.pod stable/10/crypto/openssl/doc/crypto/EVP_DigestVerifyInit.pod stable/10/crypto/openssl/doc/crypto/EVP_SignInit.pod stable/10/crypto/openssl/doc/crypto/buffer.pod stable/10/crypto/openssl/doc/crypto/d2i_X509_NAME.pod stable/10/crypto/openssl/doc/ssl/SSL_CTX_add_extra_chain_cert.pod stable/10/crypto/openssl/e_os.h stable/10/crypto/openssl/engines/e_chil.c stable/10/crypto/openssl/ssl/Makefile stable/10/crypto/openssl/ssl/bio_ssl.c stable/10/crypto/openssl/ssl/d1_both.c stable/10/crypto/openssl/ssl/d1_clnt.c stable/10/crypto/openssl/ssl/d1_srvr.c stable/10/crypto/openssl/ssl/s23_clnt.c stable/10/crypto/openssl/ssl/s3_cbc.c stable/10/crypto/openssl/ssl/s3_clnt.c stable/10/crypto/openssl/ssl/s3_enc.c stable/10/crypto/openssl/ssl/s3_lib.c stable/10/crypto/openssl/ssl/s3_srvr.c stable/10/crypto/openssl/ssl/ssl.h stable/10/crypto/openssl/ssl/ssl3.h stable/10/crypto/openssl/ssl/ssl_asn1.c stable/10/crypto/openssl/ssl/ssl_cert.c stable/10/crypto/openssl/ssl/ssl_ciph.c stable/10/crypto/openssl/ssl/ssl_err.c stable/10/crypto/openssl/ssl/ssl_lib.c stable/10/crypto/openssl/ssl/ssl_locl.h stable/10/crypto/openssl/ssl/ssl_rsa.c stable/10/crypto/openssl/ssl/ssl_sess.c stable/10/crypto/openssl/ssl/ssltest.c stable/10/crypto/openssl/ssl/t1_enc.c stable/10/crypto/openssl/ssl/t1_lib.c stable/10/crypto/openssl/ssl/tls1.h stable/10/crypto/openssl/util/indent.pro stable/10/crypto/openssl/util/mk1mf.pl stable/10/crypto/openssl/util/mkrc.pl stable/10/crypto/openssl/util/mkstack.pl stable/10/crypto/openssl/util/pl/VC-32.pl stable/10/crypto/openssl/util/selftest.pl stable/10/secure/lib/libcrypto/Makefile.inc stable/10/secure/lib/libcrypto/Makefile.man stable/10/secure/lib/libcrypto/man/ASN1_OBJECT_new.3 stable/10/secure/lib/libcrypto/man/ASN1_STRING_length.3 stable/10/secure/lib/libcrypto/man/ASN1_STRING_new.3 stable/10/secure/lib/libcrypto/man/ASN1_STRING_print_ex.3 stable/10/secure/lib/libcrypto/man/ASN1_generate_nconf.3 stable/10/secure/lib/libcrypto/man/BIO_ctrl.3 stable/10/secure/lib/libcrypto/man/BIO_f_base64.3 stable/10/secure/lib/libcrypto/man/BIO_f_buffer.3 stable/10/secure/lib/libcrypto/man/BIO_f_cipher.3 stable/10/secure/lib/libcrypto/man/BIO_f_md.3 stable/10/secure/lib/libcrypto/man/BIO_f_null.3 stable/10/secure/lib/libcrypto/man/BIO_f_ssl.3 stable/10/secure/lib/libcrypto/man/BIO_find_type.3 stable/10/secure/lib/libcrypto/man/BIO_new.3 stable/10/secure/lib/libcrypto/man/BIO_new_CMS.3 stable/10/secure/lib/libcrypto/man/BIO_push.3 stable/10/secure/lib/libcrypto/man/BIO_read.3 stable/10/secure/lib/libcrypto/man/BIO_s_accept.3 stable/10/secure/lib/libcrypto/man/BIO_s_bio.3 stable/10/secure/lib/libcrypto/man/BIO_s_connect.3 stable/10/secure/lib/libcrypto/man/BIO_s_fd.3 stable/10/secure/lib/libcrypto/man/BIO_s_file.3 stable/10/secure/lib/libcrypto/man/BIO_s_mem.3 stable/10/secure/lib/libcrypto/man/BIO_s_null.3 stable/10/secure/lib/libcrypto/man/BIO_s_socket.3 stable/10/secure/lib/libcrypto/man/BIO_set_callback.3 stable/10/secure/lib/libcrypto/man/BIO_should_retry.3 stable/10/secure/lib/libcrypto/man/BN_BLINDING_new.3 stable/10/secure/lib/libcrypto/man/BN_CTX_new.3 stable/10/secure/lib/libcrypto/man/BN_CTX_start.3 stable/10/secure/lib/libcrypto/man/BN_add.3 stable/10/secure/lib/libcrypto/man/BN_add_word.3 stable/10/secure/lib/libcrypto/man/BN_bn2bin.3 stable/10/secure/lib/libcrypto/man/BN_cmp.3 stable/10/secure/lib/libcrypto/man/BN_copy.3 stable/10/secure/lib/libcrypto/man/BN_generate_prime.3 stable/10/secure/lib/libcrypto/man/BN_mod_inverse.3 stable/10/secure/lib/libcrypto/man/BN_mod_mul_montgomery.3 stable/10/secure/lib/libcrypto/man/BN_mod_mul_reciprocal.3 stable/10/secure/lib/libcrypto/man/BN_new.3 stable/10/secure/lib/libcrypto/man/BN_num_bytes.3 stable/10/secure/lib/libcrypto/man/BN_rand.3 stable/10/secure/lib/libcrypto/man/BN_set_bit.3 stable/10/secure/lib/libcrypto/man/BN_swap.3 stable/10/secure/lib/libcrypto/man/BN_zero.3 stable/10/secure/lib/libcrypto/man/CMS_add0_cert.3 stable/10/secure/lib/libcrypto/man/CMS_add1_recipient_cert.3 stable/10/secure/lib/libcrypto/man/CMS_add1_signer.3 stable/10/secure/lib/libcrypto/man/CMS_compress.3 stable/10/secure/lib/libcrypto/man/CMS_decrypt.3 stable/10/secure/lib/libcrypto/man/CMS_encrypt.3 stable/10/secure/lib/libcrypto/man/CMS_final.3 stable/10/secure/lib/libcrypto/man/CMS_get0_RecipientInfos.3 stable/10/secure/lib/libcrypto/man/CMS_get0_SignerInfos.3 stable/10/secure/lib/libcrypto/man/CMS_get0_type.3 stable/10/secure/lib/libcrypto/man/CMS_get1_ReceiptRequest.3 stable/10/secure/lib/libcrypto/man/CMS_sign.3 stable/10/secure/lib/libcrypto/man/CMS_sign_receipt.3 stable/10/secure/lib/libcrypto/man/CMS_uncompress.3 stable/10/secure/lib/libcrypto/man/CMS_verify.3 stable/10/secure/lib/libcrypto/man/CMS_verify_receipt.3 stable/10/secure/lib/libcrypto/man/CONF_modules_free.3 stable/10/secure/lib/libcrypto/man/CONF_modules_load_file.3 stable/10/secure/lib/libcrypto/man/CRYPTO_set_ex_data.3 stable/10/secure/lib/libcrypto/man/DH_generate_key.3 stable/10/secure/lib/libcrypto/man/DH_generate_parameters.3 stable/10/secure/lib/libcrypto/man/DH_get_ex_new_index.3 stable/10/secure/lib/libcrypto/man/DH_new.3 stable/10/secure/lib/libcrypto/man/DH_set_method.3 stable/10/secure/lib/libcrypto/man/DH_size.3 stable/10/secure/lib/libcrypto/man/DSA_SIG_new.3 stable/10/secure/lib/libcrypto/man/DSA_do_sign.3 stable/10/secure/lib/libcrypto/man/DSA_dup_DH.3 stable/10/secure/lib/libcrypto/man/DSA_generate_key.3 stable/10/secure/lib/libcrypto/man/DSA_generate_parameters.3 stable/10/secure/lib/libcrypto/man/DSA_get_ex_new_index.3 stable/10/secure/lib/libcrypto/man/DSA_new.3 stable/10/secure/lib/libcrypto/man/DSA_set_method.3 stable/10/secure/lib/libcrypto/man/DSA_sign.3 stable/10/secure/lib/libcrypto/man/DSA_size.3 stable/10/secure/lib/libcrypto/man/ERR_GET_LIB.3 stable/10/secure/lib/libcrypto/man/ERR_clear_error.3 stable/10/secure/lib/libcrypto/man/ERR_error_string.3 stable/10/secure/lib/libcrypto/man/ERR_get_error.3 stable/10/secure/lib/libcrypto/man/ERR_load_crypto_strings.3 stable/10/secure/lib/libcrypto/man/ERR_load_strings.3 stable/10/secure/lib/libcrypto/man/ERR_print_errors.3 stable/10/secure/lib/libcrypto/man/ERR_put_error.3 stable/10/secure/lib/libcrypto/man/ERR_remove_state.3 stable/10/secure/lib/libcrypto/man/ERR_set_mark.3 stable/10/secure/lib/libcrypto/man/EVP_BytesToKey.3 stable/10/secure/lib/libcrypto/man/EVP_DigestInit.3 stable/10/secure/lib/libcrypto/man/EVP_DigestSignInit.3 stable/10/secure/lib/libcrypto/man/EVP_DigestVerifyInit.3 stable/10/secure/lib/libcrypto/man/EVP_EncryptInit.3 stable/10/secure/lib/libcrypto/man/EVP_OpenInit.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_CTX_ctrl.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_CTX_new.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_cmp.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_decrypt.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_derive.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_encrypt.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_get_default_digest.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_keygen.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_new.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_print_private.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_set1_RSA.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_sign.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_verify.3 stable/10/secure/lib/libcrypto/man/EVP_PKEY_verify_recover.3 stable/10/secure/lib/libcrypto/man/EVP_SealInit.3 stable/10/secure/lib/libcrypto/man/EVP_SignInit.3 stable/10/secure/lib/libcrypto/man/EVP_VerifyInit.3 stable/10/secure/lib/libcrypto/man/OBJ_nid2obj.3 stable/10/secure/lib/libcrypto/man/OPENSSL_Applink.3 stable/10/secure/lib/libcrypto/man/OPENSSL_VERSION_NUMBER.3 stable/10/secure/lib/libcrypto/man/OPENSSL_config.3 stable/10/secure/lib/libcrypto/man/OPENSSL_ia32cap.3 stable/10/secure/lib/libcrypto/man/OPENSSL_load_builtin_modules.3 stable/10/secure/lib/libcrypto/man/OpenSSL_add_all_algorithms.3 stable/10/secure/lib/libcrypto/man/PEM_write_bio_CMS_stream.3 stable/10/secure/lib/libcrypto/man/PEM_write_bio_PKCS7_stream.3 stable/10/secure/lib/libcrypto/man/PKCS12_create.3 stable/10/secure/lib/libcrypto/man/PKCS12_parse.3 stable/10/secure/lib/libcrypto/man/PKCS7_decrypt.3 stable/10/secure/lib/libcrypto/man/PKCS7_encrypt.3 stable/10/secure/lib/libcrypto/man/PKCS7_sign.3 stable/10/secure/lib/libcrypto/man/PKCS7_sign_add_signer.3 stable/10/secure/lib/libcrypto/man/PKCS7_verify.3 stable/10/secure/lib/libcrypto/man/RAND_add.3 stable/10/secure/lib/libcrypto/man/RAND_bytes.3 stable/10/secure/lib/libcrypto/man/RAND_cleanup.3 stable/10/secure/lib/libcrypto/man/RAND_egd.3 stable/10/secure/lib/libcrypto/man/RAND_load_file.3 stable/10/secure/lib/libcrypto/man/RAND_set_rand_method.3 stable/10/secure/lib/libcrypto/man/RSA_blinding_on.3 stable/10/secure/lib/libcrypto/man/RSA_check_key.3 stable/10/secure/lib/libcrypto/man/RSA_generate_key.3 stable/10/secure/lib/libcrypto/man/RSA_get_ex_new_index.3 stable/10/secure/lib/libcrypto/man/RSA_new.3 stable/10/secure/lib/libcrypto/man/RSA_padding_add_PKCS1_type_1.3 stable/10/secure/lib/libcrypto/man/RSA_print.3 stable/10/secure/lib/libcrypto/man/RSA_private_encrypt.3 stable/10/secure/lib/libcrypto/man/RSA_public_encrypt.3 stable/10/secure/lib/libcrypto/man/RSA_set_method.3 stable/10/secure/lib/libcrypto/man/RSA_sign.3 stable/10/secure/lib/libcrypto/man/RSA_sign_ASN1_OCTET_STRING.3 stable/10/secure/lib/libcrypto/man/RSA_size.3 stable/10/secure/lib/libcrypto/man/SMIME_read_CMS.3 stable/10/secure/lib/libcrypto/man/SMIME_read_PKCS7.3 stable/10/secure/lib/libcrypto/man/SMIME_write_CMS.3 stable/10/secure/lib/libcrypto/man/SMIME_write_PKCS7.3 stable/10/secure/lib/libcrypto/man/X509_NAME_ENTRY_get_object.3 stable/10/secure/lib/libcrypto/man/X509_NAME_add_entry_by_txt.3 stable/10/secure/lib/libcrypto/man/X509_NAME_get_index_by_NID.3 stable/10/secure/lib/libcrypto/man/X509_NAME_print_ex.3 stable/10/secure/lib/libcrypto/man/X509_STORE_CTX_get_error.3 stable/10/secure/lib/libcrypto/man/X509_STORE_CTX_get_ex_new_index.3 stable/10/secure/lib/libcrypto/man/X509_STORE_CTX_new.3 stable/10/secure/lib/libcrypto/man/X509_STORE_CTX_set_verify_cb.3 stable/10/secure/lib/libcrypto/man/X509_STORE_set_verify_cb_func.3 stable/10/secure/lib/libcrypto/man/X509_VERIFY_PARAM_set_flags.3 stable/10/secure/lib/libcrypto/man/X509_new.3 stable/10/secure/lib/libcrypto/man/X509_verify_cert.3 stable/10/secure/lib/libcrypto/man/bio.3 stable/10/secure/lib/libcrypto/man/blowfish.3 stable/10/secure/lib/libcrypto/man/bn.3 stable/10/secure/lib/libcrypto/man/bn_internal.3 stable/10/secure/lib/libcrypto/man/buffer.3 stable/10/secure/lib/libcrypto/man/crypto.3 stable/10/secure/lib/libcrypto/man/d2i_ASN1_OBJECT.3 stable/10/secure/lib/libcrypto/man/d2i_CMS_ContentInfo.3 stable/10/secure/lib/libcrypto/man/d2i_DHparams.3 stable/10/secure/lib/libcrypto/man/d2i_DSAPublicKey.3 stable/10/secure/lib/libcrypto/man/d2i_ECPrivateKey.3 stable/10/secure/lib/libcrypto/man/d2i_PKCS8PrivateKey.3 stable/10/secure/lib/libcrypto/man/d2i_RSAPublicKey.3 stable/10/secure/lib/libcrypto/man/d2i_X509.3 stable/10/secure/lib/libcrypto/man/d2i_X509_ALGOR.3 stable/10/secure/lib/libcrypto/man/d2i_X509_CRL.3 stable/10/secure/lib/libcrypto/man/d2i_X509_NAME.3 stable/10/secure/lib/libcrypto/man/d2i_X509_REQ.3 stable/10/secure/lib/libcrypto/man/d2i_X509_SIG.3 stable/10/secure/lib/libcrypto/man/des.3 stable/10/secure/lib/libcrypto/man/dh.3 stable/10/secure/lib/libcrypto/man/dsa.3 stable/10/secure/lib/libcrypto/man/ecdsa.3 stable/10/secure/lib/libcrypto/man/engine.3 stable/10/secure/lib/libcrypto/man/err.3 stable/10/secure/lib/libcrypto/man/evp.3 stable/10/secure/lib/libcrypto/man/hmac.3 stable/10/secure/lib/libcrypto/man/i2d_CMS_bio_stream.3 stable/10/secure/lib/libcrypto/man/i2d_PKCS7_bio_stream.3 stable/10/secure/lib/libcrypto/man/lh_stats.3 stable/10/secure/lib/libcrypto/man/lhash.3 stable/10/secure/lib/libcrypto/man/md5.3 stable/10/secure/lib/libcrypto/man/mdc2.3 stable/10/secure/lib/libcrypto/man/pem.3 stable/10/secure/lib/libcrypto/man/rand.3 stable/10/secure/lib/libcrypto/man/rc4.3 stable/10/secure/lib/libcrypto/man/ripemd.3 stable/10/secure/lib/libcrypto/man/rsa.3 stable/10/secure/lib/libcrypto/man/sha.3 stable/10/secure/lib/libcrypto/man/threads.3 stable/10/secure/lib/libcrypto/man/ui.3 stable/10/secure/lib/libcrypto/man/ui_compat.3 stable/10/secure/lib/libcrypto/man/x509.3 stable/10/secure/lib/libssl/Makefile.man stable/10/secure/lib/libssl/man/SSL_CIPHER_get_name.3 stable/10/secure/lib/libssl/man/SSL_COMP_add_compression_method.3 stable/10/secure/lib/libssl/man/SSL_CTX_add_extra_chain_cert.3 stable/10/secure/lib/libssl/man/SSL_CTX_add_session.3 stable/10/secure/lib/libssl/man/SSL_CTX_ctrl.3 stable/10/secure/lib/libssl/man/SSL_CTX_flush_sessions.3 stable/10/secure/lib/libssl/man/SSL_CTX_free.3 stable/10/secure/lib/libssl/man/SSL_CTX_get_ex_new_index.3 stable/10/secure/lib/libssl/man/SSL_CTX_get_verify_mode.3 stable/10/secure/lib/libssl/man/SSL_CTX_load_verify_locations.3 stable/10/secure/lib/libssl/man/SSL_CTX_new.3 stable/10/secure/lib/libssl/man/SSL_CTX_sess_number.3 stable/10/secure/lib/libssl/man/SSL_CTX_sess_set_cache_size.3 stable/10/secure/lib/libssl/man/SSL_CTX_sess_set_get_cb.3 stable/10/secure/lib/libssl/man/SSL_CTX_sessions.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_cert_store.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_cert_verify_callback.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_cipher_list.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_client_CA_list.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_client_cert_cb.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_default_passwd_cb.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_generate_session_id.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_info_callback.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_max_cert_list.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_mode.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_msg_callback.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_options.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_psk_client_callback.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_quiet_shutdown.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_read_ahead.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_session_cache_mode.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_session_id_context.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_ssl_version.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_timeout.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_tlsext_ticket_key_cb.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_tmp_dh_callback.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_tmp_rsa_callback.3 stable/10/secure/lib/libssl/man/SSL_CTX_set_verify.3 stable/10/secure/lib/libssl/man/SSL_CTX_use_certificate.3 stable/10/secure/lib/libssl/man/SSL_CTX_use_psk_identity_hint.3 stable/10/secure/lib/libssl/man/SSL_SESSION_free.3 stable/10/secure/lib/libssl/man/SSL_SESSION_get_ex_new_index.3 stable/10/secure/lib/libssl/man/SSL_SESSION_get_time.3 stable/10/secure/lib/libssl/man/SSL_accept.3 stable/10/secure/lib/libssl/man/SSL_alert_type_string.3 stable/10/secure/lib/libssl/man/SSL_clear.3 stable/10/secure/lib/libssl/man/SSL_connect.3 stable/10/secure/lib/libssl/man/SSL_do_handshake.3 stable/10/secure/lib/libssl/man/SSL_free.3 stable/10/secure/lib/libssl/man/SSL_get_SSL_CTX.3 stable/10/secure/lib/libssl/man/SSL_get_ciphers.3 stable/10/secure/lib/libssl/man/SSL_get_client_CA_list.3 stable/10/secure/lib/libssl/man/SSL_get_current_cipher.3 stable/10/secure/lib/libssl/man/SSL_get_default_timeout.3 stable/10/secure/lib/libssl/man/SSL_get_error.3 stable/10/secure/lib/libssl/man/SSL_get_ex_data_X509_STORE_CTX_idx.3 stable/10/secure/lib/libssl/man/SSL_get_ex_new_index.3 stable/10/secure/lib/libssl/man/SSL_get_fd.3 stable/10/secure/lib/libssl/man/SSL_get_peer_cert_chain.3 stable/10/secure/lib/libssl/man/SSL_get_peer_certificate.3 stable/10/secure/lib/libssl/man/SSL_get_psk_identity.3 stable/10/secure/lib/libssl/man/SSL_get_rbio.3 stable/10/secure/lib/libssl/man/SSL_get_session.3 stable/10/secure/lib/libssl/man/SSL_get_verify_result.3 stable/10/secure/lib/libssl/man/SSL_get_version.3 stable/10/secure/lib/libssl/man/SSL_library_init.3 stable/10/secure/lib/libssl/man/SSL_load_client_CA_file.3 stable/10/secure/lib/libssl/man/SSL_new.3 stable/10/secure/lib/libssl/man/SSL_pending.3 stable/10/secure/lib/libssl/man/SSL_read.3 stable/10/secure/lib/libssl/man/SSL_rstate_string.3 stable/10/secure/lib/libssl/man/SSL_session_reused.3 stable/10/secure/lib/libssl/man/SSL_set_bio.3 stable/10/secure/lib/libssl/man/SSL_set_connect_state.3 stable/10/secure/lib/libssl/man/SSL_set_fd.3 stable/10/secure/lib/libssl/man/SSL_set_session.3 stable/10/secure/lib/libssl/man/SSL_set_shutdown.3 stable/10/secure/lib/libssl/man/SSL_set_verify_result.3 stable/10/secure/lib/libssl/man/SSL_shutdown.3 stable/10/secure/lib/libssl/man/SSL_state_string.3 stable/10/secure/lib/libssl/man/SSL_want.3 stable/10/secure/lib/libssl/man/SSL_write.3 stable/10/secure/lib/libssl/man/d2i_SSL_SESSION.3 stable/10/secure/lib/libssl/man/ssl.3 stable/10/secure/usr.bin/openssl/man/CA.pl.1 stable/10/secure/usr.bin/openssl/man/asn1parse.1 stable/10/secure/usr.bin/openssl/man/c_rehash.1 stable/10/secure/usr.bin/openssl/man/ca.1 stable/10/secure/usr.bin/openssl/man/ciphers.1 stable/10/secure/usr.bin/openssl/man/cms.1 stable/10/secure/usr.bin/openssl/man/crl.1 stable/10/secure/usr.bin/openssl/man/crl2pkcs7.1 stable/10/secure/usr.bin/openssl/man/dgst.1 stable/10/secure/usr.bin/openssl/man/dhparam.1 stable/10/secure/usr.bin/openssl/man/dsa.1 stable/10/secure/usr.bin/openssl/man/dsaparam.1 stable/10/secure/usr.bin/openssl/man/ec.1 stable/10/secure/usr.bin/openssl/man/ecparam.1 stable/10/secure/usr.bin/openssl/man/enc.1 stable/10/secure/usr.bin/openssl/man/errstr.1 stable/10/secure/usr.bin/openssl/man/gendsa.1 stable/10/secure/usr.bin/openssl/man/genpkey.1 stable/10/secure/usr.bin/openssl/man/genrsa.1 stable/10/secure/usr.bin/openssl/man/nseq.1 stable/10/secure/usr.bin/openssl/man/ocsp.1 stable/10/secure/usr.bin/openssl/man/openssl.1 stable/10/secure/usr.bin/openssl/man/passwd.1 stable/10/secure/usr.bin/openssl/man/pkcs12.1 stable/10/secure/usr.bin/openssl/man/pkcs7.1 stable/10/secure/usr.bin/openssl/man/pkcs8.1 stable/10/secure/usr.bin/openssl/man/pkey.1 stable/10/secure/usr.bin/openssl/man/pkeyparam.1 stable/10/secure/usr.bin/openssl/man/pkeyutl.1 stable/10/secure/usr.bin/openssl/man/rand.1 stable/10/secure/usr.bin/openssl/man/req.1 stable/10/secure/usr.bin/openssl/man/rsa.1 stable/10/secure/usr.bin/openssl/man/rsautl.1 stable/10/secure/usr.bin/openssl/man/s_client.1 stable/10/secure/usr.bin/openssl/man/s_server.1 stable/10/secure/usr.bin/openssl/man/s_time.1 stable/10/secure/usr.bin/openssl/man/sess_id.1 stable/10/secure/usr.bin/openssl/man/smime.1 stable/10/secure/usr.bin/openssl/man/speed.1 stable/10/secure/usr.bin/openssl/man/spkac.1 stable/10/secure/usr.bin/openssl/man/ts.1 stable/10/secure/usr.bin/openssl/man/tsget.1 stable/10/secure/usr.bin/openssl/man/verify.1 stable/10/secure/usr.bin/openssl/man/version.1 stable/10/secure/usr.bin/openssl/man/x509.1 stable/10/secure/usr.bin/openssl/man/x509v3_config.1 Modified: stable/10/crypto/openssl/CHANGES ============================================================================== --- stable/10/crypto/openssl/CHANGES Thu Dec 3 21:16:52 2015 (r291720) +++ stable/10/crypto/openssl/CHANGES Thu Dec 3 21:18:48 2015 (r291721) @@ -2,6 +2,45 @@ OpenSSL CHANGES _______________ + Changes between 1.0.1p and 1.0.1q [3 Dec 2015] + + *) Certificate verify crash with missing PSS parameter + + The signature verification routines will crash with a NULL pointer + dereference if presented with an ASN.1 signature using the RSA PSS + algorithm and absent mask generation function parameter. Since these + routines are used to verify certificate signature algorithms this can be + used to crash any certificate verification operation and exploited in a + DoS attack. Any application which performs certificate verification is + vulnerable including OpenSSL clients and servers which enable client + authentication. + + This issue was reported to OpenSSL by Loïc Jonas Etienne (Qnective AG). + (CVE-2015-3194) + [Stephen Henson] + + *) X509_ATTRIBUTE memory leak + + When presented with a malformed X509_ATTRIBUTE structure OpenSSL will leak + memory. This structure is used by the PKCS#7 and CMS routines so any + application which reads PKCS#7 or CMS data from untrusted sources is + affected. SSL/TLS is not affected. + + This issue was reported to OpenSSL by Adam Langley (Google/BoringSSL) using + libFuzzer. + (CVE-2015-3195) + [Stephen Henson] + + *) Rewrite EVP_DecodeUpdate (base64 decoding) to fix several bugs. + This changes the decoding behaviour for some invalid messages, + though the change is mostly in the more lenient direction, and + legacy behaviour is preserved as much as possible. + [Emilia Käsper] + + *) In DSA_generate_parameters_ex, if the provided seed is too short, + return an error + [Rich Salz and Ismo Puustinen <ismo.puustinen@intel.com>] + Changes between 1.0.1o and 1.0.1p [9 Jul 2015] *) Alternate chains certificate forgery @@ -15,10 +54,19 @@ This issue was reported to OpenSSL by Adam Langley/David Benjamin (Google/BoringSSL). + (CVE-2015-1793) [Matt Caswell] - Changes between 1.0.1n and 1.0.1o [12 Jun 2015] + *) Race condition handling PSK identify hint + + If PSK identity hints are received by a multi-threaded client then + the values are wrongly updated in the parent SSL_CTX structure. This can + result in a race condition potentially leading to a double free of the + identify hint data. + (CVE-2015-3196) + [Stephen Henson] + Changes between 1.0.1n and 1.0.1o [12 Jun 2015] *) Fix HMAC ABI incompatibility. The previous version introduced an ABI incompatibility in the handling of HMAC. The previous ABI has now been restored. @@ -55,9 +103,9 @@ callbacks. This issue was reported to OpenSSL by Robert Swiecki (Google), and - independently by Hanno Böck. + independently by Hanno Böck. (CVE-2015-1789) - [Emilia Käsper] + [Emilia Käsper] *) PKCS7 crash with missing EnvelopedContent @@ -71,7 +119,7 @@ This issue was reported to OpenSSL by Michal Zalewski (Google). (CVE-2015-1790) - [Emilia Käsper] + [Emilia Käsper] *) CMS verify infinite loop with unknown hash function @@ -94,6 +142,9 @@ *) Reject DH handshakes with parameters shorter than 768 bits. [Kurt Roeckx and Emilia Kasper] + *) dhparam: generate 2048-bit parameters by default. + [Kurt Roeckx and Emilia Kasper] + Changes between 1.0.1l and 1.0.1m [19 Mar 2015] *) Segmentation fault in ASN1_TYPE_cmp fix @@ -132,7 +183,7 @@ This issue was reported to OpenSSL by Michal Zalewski (Google). (CVE-2015-0289) - [Emilia Käsper] + [Emilia Käsper] *) DoS via reachable assert in SSLv2 servers fix @@ -140,10 +191,10 @@ servers that both support SSLv2 and enable export cipher suites by sending a specially crafted SSLv2 CLIENT-MASTER-KEY message. - This issue was discovered by Sean Burford (Google) and Emilia Käsper + This issue was discovered by Sean Burford (Google) and Emilia Käsper (OpenSSL development team). (CVE-2015-0293) - [Emilia Käsper] + [Emilia Käsper] *) Use After Free following d2i_ECPrivatekey error fix @@ -288,12 +339,12 @@ version does not match the session's version. Resuming with a different version, while not strictly forbidden by the RFC, is of questionable sanity and breaks all known clients. - [David Benjamin, Emilia Käsper] + [David Benjamin, Emilia Käsper] *) Tighten handling of the ChangeCipherSpec (CCS) message: reject early CCS messages during renegotiation. (Note that because renegotiation is encrypted, this early CCS was not exploitable.) - [Emilia Käsper] + [Emilia Käsper] *) Tighten client-side session ticket handling during renegotiation: ensure that the client only accepts a session ticket if the server sends @@ -304,7 +355,7 @@ Similarly, ensure that the client requires a session ticket if one was advertised in the ServerHello. Previously, a TLS client would ignore a missing NewSessionTicket message. - [Emilia Käsper] + [Emilia Käsper] Changes between 1.0.1i and 1.0.1j [15 Oct 2014] @@ -384,10 +435,10 @@ with a null pointer dereference (read) by specifying an anonymous (EC)DH ciphersuite and sending carefully crafted handshake messages. - Thanks to Felix Gröbert (Google) for discovering and researching this + Thanks to Felix Gröbert (Google) for discovering and researching this issue. (CVE-2014-3510) - [Emilia Käsper] + [Emilia Käsper] *) By sending carefully crafted DTLS packets an attacker could cause openssl to leak memory. This can be exploited through a Denial of Service attack. @@ -424,7 +475,7 @@ properly negotiated with the client. This can be exploited through a Denial of Service attack. - Thanks to Joonas Kuorilehto and Riku Hietamäki (Codenomicon) for + Thanks to Joonas Kuorilehto and Riku Hietamäki (Codenomicon) for discovering and researching this issue. (CVE-2014-5139) [Steve Henson] @@ -436,7 +487,7 @@ Thanks to Ivan Fratric (Google) for discovering this issue. (CVE-2014-3508) - [Emilia Käsper, and Steve Henson] + [Emilia Käsper, and Steve Henson] *) Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.) for corner cases. (Certain input points at infinity could lead to @@ -466,15 +517,15 @@ client or server. This is potentially exploitable to run arbitrary code on a vulnerable client or server. - Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195) - [Jüri Aedla, Steve Henson] + Thanks to Jüri Aedla for reporting this issue. (CVE-2014-0195) + [Jüri Aedla, Steve Henson] *) Fix bug in TLS code where clients enable anonymous ECDH ciphersuites are subject to a denial of service attack. - Thanks to Felix Gröbert and Ivan Fratric at Google for discovering + Thanks to Felix Gröbert and Ivan Fratric at Google for discovering this issue. (CVE-2014-3470) - [Felix Gröbert, Ivan Fratric, Steve Henson] + [Felix Gröbert, Ivan Fratric, Steve Henson] *) Harmonize version and its documentation. -f flag is used to display compilation flags. @@ -553,9 +604,9 @@ Thanks go to Nadhem Alfardan and Kenny Paterson of the Information Security Group at Royal Holloway, University of London (www.isg.rhul.ac.uk) for discovering this flaw and Adam Langley and - Emilia Käsper for the initial patch. + Emilia Käsper for the initial patch. (CVE-2013-0169) - [Emilia Käsper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson] + [Emilia Käsper, Adam Langley, Ben Laurie, Andy Polyakov, Steve Henson] *) Fix flaw in AESNI handling of TLS 1.2 and 1.1 records for CBC mode ciphersuites which can be exploited in a denial of service attack. @@ -730,7 +781,7 @@ EC_GROUP_new_by_curve_name() will automatically use these (while EC_GROUP_new_curve_GFp() currently prefers the more flexible implementations). - [Emilia Käsper, Adam Langley, Bodo Moeller (Google)] + [Emilia Käsper, Adam Langley, Bodo Moeller (Google)] *) Use type ossl_ssize_t instad of ssize_t which isn't available on all platforms. Move ssize_t definition from e_os.h to the public @@ -1006,7 +1057,7 @@ [Adam Langley (Google)] *) Fix spurious failures in ecdsatest.c. - [Emilia Käsper (Google)] + [Emilia Käsper (Google)] *) Fix the BIO_f_buffer() implementation (which was mixing different interpretations of the '..._len' fields). @@ -1020,7 +1071,7 @@ lock to call BN_BLINDING_invert_ex, and avoids one use of BN_BLINDING_update for each BN_BLINDING structure (previously, the last update always remained unused). - [Emilia Käsper (Google)] + [Emilia Käsper (Google)] *) In ssl3_clear, preserve s3->init_extra along with s3->rbuf. [Bob Buckholz (Google)] @@ -1829,7 +1880,7 @@ *) Add RFC 3161 compliant time stamp request creation, response generation and response verification functionality. - [Zoltán Glózik <zglozik@opentsa.org>, The OpenTSA Project] + [Zoltán Glózik <zglozik@opentsa.org>, The OpenTSA Project] *) Add initial support for TLS extensions, specifically for the server_name extension so far. The SSL_SESSION, SSL_CTX, and SSL data structures now @@ -2997,7 +3048,7 @@ *) BN_CTX_get() should return zero-valued bignums, providing the same initialised value as BN_new(). - [Geoff Thorpe, suggested by Ulf Möller] + [Geoff Thorpe, suggested by Ulf Möller] *) Support for inhibitAnyPolicy certificate extension. [Steve Henson] @@ -3016,7 +3067,7 @@ some point, these tighter rules will become openssl's default to improve maintainability, though the assert()s and other overheads will remain only in debugging configurations. See bn.h for more details. - [Geoff Thorpe, Nils Larsch, Ulf Möller] + [Geoff Thorpe, Nils Larsch, Ulf Möller] *) BN_CTX_init() has been deprecated, as BN_CTX is an opaque structure that can only be obtained through BN_CTX_new() (which implicitly @@ -3083,7 +3134,7 @@ [Douglas Stebila (Sun Microsystems Laboratories)] *) Add the possibility to load symbols globally with DSO. - [Götz Babin-Ebell <babin-ebell@trustcenter.de> via Richard Levitte] + [Götz Babin-Ebell <babin-ebell@trustcenter.de> via Richard Levitte] *) Add the functions ERR_set_mark() and ERR_pop_to_mark() for better control of the error stack. @@ -3798,7 +3849,7 @@ [Steve Henson] *) Undo Cygwin change. - [Ulf Möller] + [Ulf Möller] *) Added support for proxy certificates according to RFC 3820. Because they may be a security thread to unaware applications, @@ -3831,11 +3882,11 @@ [Stephen Henson, reported by UK NISCC] *) Use Windows randomness collection on Cygwin. - [Ulf Möller] + [Ulf Möller] *) Fix hang in EGD/PRNGD query when communication socket is closed prematurely by EGD/PRNGD. - [Darren Tucker <dtucker@zip.com.au> via Lutz Jänicke, resolves #1014] + [Darren Tucker <dtucker@zip.com.au> via Lutz Jänicke, resolves #1014] *) Prompt for pass phrases when appropriate for PKCS12 input format. [Steve Henson] @@ -4297,7 +4348,7 @@ pointers passed to them whenever necessary. Otherwise it is possible the caller may have overwritten (or deallocated) the original string data when a later ENGINE operation tries to use the stored values. - [Götz Babin-Ebell <babinebell@trustcenter.de>] + [Götz Babin-Ebell <babinebell@trustcenter.de>] *) Improve diagnostics in file reading and command-line digests. [Ben Laurie aided and abetted by Solar Designer <solar@openwall.com>] @@ -6402,7 +6453,7 @@ des-cbc 3624.96k 5258.21k [Bodo Moeller] *) BN_sqr() bug fix. - [Ulf Möller, reported by Jim Ellis <jim.ellis@cavium.com>] + [Ulf Möller, reported by Jim Ellis <jim.ellis@cavium.com>] *) Rabin-Miller test analyses assume uniformly distributed witnesses, so use BN_pseudo_rand_range() instead of using BN_pseudo_rand() @@ -6562,7 +6613,7 @@ des-cbc 3624.96k 5258.21k [Bodo Moeller] *) Fix OAEP check. - [Ulf Möller, Bodo Möller] + [Ulf Möller, Bodo Möller] *) The countermeasure against Bleichbacher's attack on PKCS #1 v1.5 RSA encryption was accidentally removed in s3_srvr.c in OpenSSL 0.9.5 @@ -6824,10 +6875,10 @@ des-cbc 3624.96k 5258.21k [Bodo Moeller] *) Use better test patterns in bntest. - [Ulf Möller] + [Ulf Möller] *) rand_win.c fix for Borland C. - [Ulf Möller] + [Ulf Möller] *) BN_rshift bugfix for n == 0. [Bodo Moeller] @@ -6972,14 +7023,14 @@ des-cbc 3624.96k 5258.21k *) New BIO_shutdown_wr macro, which invokes the BIO_C_SHUTDOWN_WR BIO_ctrl (for BIO pairs). - [Bodo Möller] + [Bodo Möller] *) Add DSO method for VMS. [Richard Levitte] *) Bug fix: Montgomery multiplication could produce results with the wrong sign. - [Ulf Möller] + [Ulf Möller] *) Add RPM specification openssl.spec and modify it to build three packages. The default package contains applications, application @@ -6997,7 +7048,7 @@ des-cbc 3624.96k 5258.21k *) Don't set the two most significant bits to one when generating a random number < q in the DSA library. - [Ulf Möller] + [Ulf Möller] *) New SSL API mode 'SSL_MODE_AUTO_RETRY'. This disables the default behaviour that SSL_read may result in SSL_ERROR_WANT_READ (even if @@ -7263,7 +7314,7 @@ des-cbc 3624.96k 5258.21k *) Randomness polling function for Win9x, as described in: Peter Gutmann, Software Generation of Practically Strong Random Numbers. - [Ulf Möller] + [Ulf Möller] *) Fix so PRNG is seeded in req if using an already existing DSA key. @@ -7483,7 +7534,7 @@ des-cbc 3624.96k 5258.21k [Steve Henson] *) Eliminate non-ANSI declarations in crypto.h and stack.h. - [Ulf Möller] + [Ulf Möller] *) Fix for SSL server purpose checking. Server checking was rejecting certificates which had extended key usage present @@ -7515,7 +7566,7 @@ des-cbc 3624.96k 5258.21k [Bodo Moeller] *) Bugfix for linux-elf makefile.one. - [Ulf Möller] + [Ulf Möller] *) RSA_get_default_method() will now cause a default RSA_METHOD to be chosen if one doesn't exist already. @@ -7604,7 +7655,7 @@ des-cbc 3624.96k 5258.21k [Steve Henson] *) des_quad_cksum() byte order bug fix. - [Ulf Möller, using the problem description in krb4-0.9.7, where + [Ulf Möller, using the problem description in krb4-0.9.7, where the solution is attributed to Derrick J Brashear <shadow@DEMENTIA.ORG>] *) Fix so V_ASN1_APP_CHOOSE works again: however its use is strongly @@ -7705,7 +7756,7 @@ des-cbc 3624.96k 5258.21k [Rolf Haberrecker <rolf@suse.de>] *) Assembler module support for Mingw32. - [Ulf Möller] + [Ulf Möller] *) Shared library support for HPUX (in shlib/). [Lutz Jaenicke <Lutz.Jaenicke@aet.TU-Cottbus.DE> and Anonymous] @@ -7724,7 +7775,7 @@ des-cbc 3624.96k 5258.21k *) BN_mul bugfix: In bn_mul_part_recursion() only the a>a[n] && b>b[n] case was implemented. This caused BN_div_recp() to fail occasionally. - [Ulf Möller] + [Ulf Möller] *) Add an optional second argument to the set_label() in the perl assembly language builder. If this argument exists and is set @@ -7754,14 +7805,14 @@ des-cbc 3624.96k 5258.21k [Steve Henson] *) Fix potential buffer overrun problem in BIO_printf(). - [Ulf Möller, using public domain code by Patrick Powell; problem + [Ulf Möller, using public domain code by Patrick Powell; problem pointed out by David Sacerdote <das33@cornell.edu>] *) Support EGD <http://www.lothar.com/tech/crypto/>. New functions RAND_egd() and RAND_status(). In the command line application, the EGD socket can be specified like a seed file using RANDFILE or -rand. - [Ulf Möller] + [Ulf Möller] *) Allow the string CERTIFICATE to be tolerated in PKCS#7 structures. Some CAs (e.g. Verisign) distribute certificates in this form. @@ -7794,7 +7845,7 @@ des-cbc 3624.96k 5258.21k #define OPENSSL_ALGORITHM_DEFINES #include <openssl/opensslconf.h> defines all pertinent NO_<algo> symbols, such as NO_IDEA, NO_RSA, etc. - [Richard Levitte, Ulf and Bodo Möller] + [Richard Levitte, Ulf and Bodo Möller] *) Bugfix: Tolerate fragmentation and interleaving in the SSL 3/TLS record layer. @@ -7845,17 +7896,17 @@ des-cbc 3624.96k 5258.21k *) Bug fix for BN_div_recp() for numerators with an even number of bits. - [Ulf Möller] + [Ulf Möller] *) More tests in bntest.c, and changed test_bn output. - [Ulf Möller] + [Ulf Möller] *) ./config recognizes MacOS X now. [Andy Polyakov] *) Bug fix for BN_div() when the first words of num and divsor are equal (it gave wrong results if (rem=(n1-q*d0)&BN_MASK2) < d0). - [Ulf Möller] + [Ulf Möller] *) Add support for various broken PKCS#8 formats, and command line options to produce them. @@ -7863,11 +7914,11 @@ des-cbc 3624.96k 5258.21k *) New functions BN_CTX_start(), BN_CTX_get() and BT_CTX_end() to get temporary BIGNUMs from a BN_CTX. - [Ulf Möller] + [Ulf Möller] *) Correct return values in BN_mod_exp_mont() and BN_mod_exp2_mont() for p == 0. - [Ulf Möller] + [Ulf Möller] *) Change the SSLeay_add_all_*() functions to OpenSSL_add_all_*() and include a #define from the old name to the new. The original intent @@ -7891,7 +7942,7 @@ des-cbc 3624.96k 5258.21k *) Source code cleanups: use const where appropriate, eliminate casts, use void * instead of char * in lhash. - [Ulf Möller] + [Ulf Möller] *) Bugfix: ssl3_send_server_key_exchange was not restartable (the state was not changed to SSL3_ST_SW_KEY_EXCH_B, and because of @@ -7936,13 +7987,13 @@ des-cbc 3624.96k 5258.21k [Steve Henson] *) New function BN_pseudo_rand(). - [Ulf Möller] + [Ulf Möller] *) Clean up BN_mod_mul_montgomery(): replace the broken (and unreadable) bignum version of BN_from_montgomery() with the working code from SSLeay 0.9.0 (the word based version is faster anyway), and clean up the comments. - [Ulf Möller] + [Ulf Möller] *) Avoid a race condition in s2_clnt.c (function get_server_hello) that made it impossible to use the same SSL_SESSION data structure in @@ -7952,25 +8003,25 @@ des-cbc 3624.96k 5258.21k *) The return value of RAND_load_file() no longer counts bytes obtained by stat(). RAND_load_file(..., -1) is new and uses the complete file to seed the PRNG (previously an explicit byte count was required). - [Ulf Möller, Bodo Möller] + [Ulf Möller, Bodo Möller] *) Clean up CRYPTO_EX_DATA functions, some of these didn't have prototypes used (char *) instead of (void *) and had casts all over the place. [Steve Henson] *) Make BN_generate_prime() return NULL on error if ret!=NULL. - [Ulf Möller] + [Ulf Möller] *) Retain source code compatibility for BN_prime_checks macro: BN_is_prime(..., BN_prime_checks, ...) now uses BN_prime_checks_for_size to determine the appropriate number of Rabin-Miller iterations. - [Ulf Möller] + [Ulf Möller] *) Diffie-Hellman uses "safe" primes: DH_check() return code renamed to DH_CHECK_P_NOT_SAFE_PRIME. (Check if this is true? OpenPGP calls them "strong".) - [Ulf Möller] + [Ulf Möller] *) Merge the functionality of "dh" and "gendh" programs into a new program "dhparam". The old programs are retained for now but will handle DH keys @@ -8026,7 +8077,7 @@ des-cbc 3624.96k 5258.21k *) Add missing #ifndefs that caused missing symbols when building libssl as a shared library without RSA. Use #ifndef NO_SSL2 instead of NO_RSA in ssl/s2*.c. - [Kris Kennaway <kris@hub.freebsd.org>, modified by Ulf Möller] + [Kris Kennaway <kris@hub.freebsd.org>, modified by Ulf Möller] *) Precautions against using the PRNG uninitialized: RAND_bytes() now has a return value which indicates the quality of the random data @@ -8035,7 +8086,7 @@ des-cbc 3624.96k 5258.21k guaranteed to be unique but not unpredictable. RAND_add is like RAND_seed, but takes an extra argument for an entropy estimate (RAND_seed always assumes full entropy). - [Ulf Möller] + [Ulf Möller] *) Do more iterations of Rabin-Miller probable prime test (specifically, 3 for 1024-bit primes, 6 for 512-bit primes, 12 for 256-bit primes @@ -8065,7 +8116,7 @@ des-cbc 3624.96k 5258.21k [Steve Henson] *) Honor the no-xxx Configure options when creating .DEF files. - [Ulf Möller] + [Ulf Möller] *) Add PKCS#10 attributes to field table: challengePassword, unstructuredName and unstructuredAddress. These are taken from @@ -8899,7 +8950,7 @@ des-cbc 3624.96k 5258.21k *) More DES library cleanups: remove references to srand/rand and delete an unused file. - [Ulf Möller] + [Ulf Möller] *) Add support for the the free Netwide assembler (NASM) under Win32, since not many people have MASM (ml) and it can be hard to obtain. @@ -8988,7 +9039,7 @@ des-cbc 3624.96k 5258.21k worked. *) Fix problems with no-hmac etc. - [Ulf Möller, pointed out by Brian Wellington <bwelling@tislabs.com>] + [Ulf Möller, pointed out by Brian Wellington <bwelling@tislabs.com>] *) New functions RSA_get_default_method(), RSA_set_method() and RSA_get_method(). These allows replacement of RSA_METHODs without having @@ -9105,7 +9156,7 @@ des-cbc 3624.96k 5258.21k [Ben Laurie] *) DES library cleanups. - [Ulf Möller] + [Ulf Möller] *) Add support for PKCS#5 v2.0 PBE algorithms. This will permit PKCS#8 to be used with any cipher unlike PKCS#5 v1.5 which can at most handle 64 bit @@ -9148,7 +9199,7 @@ des-cbc 3624.96k 5258.21k [Christian Forster <fo@hawo.stw.uni-erlangen.de>] *) config now generates no-xxx options for missing ciphers. - [Ulf Möller] + [Ulf Möller] *) Support the EBCDIC character set (work in progress). File ebcdic.c not yet included because it has a different license. @@ -9261,7 +9312,7 @@ des-cbc 3624.96k 5258.21k [Bodo Moeller] *) Move openssl.cnf out of lib/. - [Ulf Möller] + [Ulf Möller] *) Fix various things to let OpenSSL even pass ``egcc -pipe -O2 -Wall -Wshadow -Wpointer-arith -Wcast-align -Wmissing-prototypes @@ -9318,10 +9369,10 @@ des-cbc 3624.96k 5258.21k [Ben Laurie] *) Support Borland C++ builder. - [Janez Jere <jj@void.si>, modified by Ulf Möller] + [Janez Jere <jj@void.si>, modified by Ulf Möller] *) Support Mingw32. - [Ulf Möller] + [Ulf Möller] *) SHA-1 cleanups and performance enhancements. [Andy Polyakov <appro@fy.chalmers.se>] @@ -9330,7 +9381,7 @@ des-cbc 3624.96k 5258.21k [Andy Polyakov <appro@fy.chalmers.se>] *) Accept any -xxx and +xxx compiler options in Configure. - [Ulf Möller] + [Ulf Möller] *) Update HPUX configuration. [Anonymous] @@ -9363,7 +9414,7 @@ des-cbc 3624.96k 5258.21k [Bodo Moeller] *) OAEP decoding bug fix. - [Ulf Möller] + [Ulf Möller] *) Support INSTALL_PREFIX for package builders, as proposed by David Harris. @@ -9386,21 +9437,21 @@ des-cbc 3624.96k 5258.21k [Niels Poppe <niels@netbox.org>] *) New Configure option no-<cipher> (rsa, idea, rc5, ...). - [Ulf Möller] + [Ulf Möller] *) Add the PKCS#12 API documentation to openssl.txt. Preliminary support for extension adding in x509 utility. [Steve Henson] *) Remove NOPROTO sections and error code comments. - [Ulf Möller] + [Ulf Möller] *) Partial rewrite of the DEF file generator to now parse the ANSI prototypes. [Steve Henson] *) New Configure options --prefix=DIR and --openssldir=DIR. - [Ulf Möller] + [Ulf Möller] *) Complete rewrite of the error code script(s). It is all now handled by one script at the top level which handles error code gathering, @@ -9429,7 +9480,7 @@ des-cbc 3624.96k 5258.21k [Steve Henson] *) Move the autogenerated header file parts to crypto/opensslconf.h. - [Ulf Möller] + [Ulf Möller] *) Fix new 56-bit DES export ciphersuites: they were using 7 bytes instead of 8 of keying material. Merlin has also confirmed interop with this fix @@ -9447,13 +9498,13 @@ des-cbc 3624.96k 5258.21k [Andy Polyakov <appro@fy.chalmers.se>] *) Change functions to ANSI C. - [Ulf Möller] + [Ulf Möller] *) Fix typos in error codes. - [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>, Ulf Möller] + [Martin Kraemer <Martin.Kraemer@MchP.Siemens.De>, Ulf Möller] *) Remove defunct assembler files from Configure. - [Ulf Möller] + [Ulf Möller] *) SPARC v8 assembler BIGNUM implementation. [Andy Polyakov <appro@fy.chalmers.se>] @@ -9490,7 +9541,7 @@ des-cbc 3624.96k 5258.21k [Steve Henson] *) New Configure option "rsaref". - [Ulf Möller] + [Ulf Möller] *) Don't auto-generate pem.h. [Bodo Moeller] @@ -9538,7 +9589,7 @@ des-cbc 3624.96k 5258.21k *) New functions DSA_do_sign and DSA_do_verify to provide access to the raw DSA values prior to ASN.1 encoding. - [Ulf Möller] + [Ulf Möller] *) Tweaks to Configure [Niels Poppe <niels@netbox.org>] @@ -9548,11 +9599,11 @@ des-cbc 3624.96k 5258.21k [Steve Henson] *) New variables $(RANLIB) and $(PERL) in the Makefiles. - [Ulf Möller] + [Ulf Möller] *) New config option to avoid instructions that are illegal on the 80386. The default code is faster, but requires at least a 486. - [Ulf Möller] + [Ulf Möller] *) Got rid of old SSL2_CLIENT_VERSION (inconsistently used) and SSL2_SERVER_VERSION (not used at all) macros, which are now the @@ -10091,7 +10142,7 @@ des-cbc 3624.96k 5258.21k Hagino <itojun@kame.net>] *) File was opened incorrectly in randfile.c. - [Ulf Möller <ulf@fitug.de>] + [Ulf Möller <ulf@fitug.de>] *) Beginning of support for GeneralizedTime. d2i, i2d, check and print functions. Also ASN1_TIME suite which is a CHOICE of UTCTime or @@ -10101,7 +10152,7 @@ des-cbc 3624.96k 5258.21k [Steve Henson] *) Correct Linux 1 recognition in config. - [Ulf Möller <ulf@fitug.de>] + [Ulf Möller <ulf@fitug.de>] *) Remove pointless MD5 hash when using DSA keys in ca. [Anonymous <nobody@replay.com>] @@ -10248,7 +10299,7 @@ des-cbc 3624.96k 5258.21k *) Fix the RSA header declarations that hid a bug I fixed in 0.9.0b but was already fixed by Eric for 0.9.1 it seems. - [Ben Laurie - pointed out by Ulf Möller <ulf@fitug.de>] + [Ben Laurie - pointed out by Ulf Möller <ulf@fitug.de>] *) Autodetect FreeBSD3. [Ben Laurie] Copied: stable/10/crypto/openssl/CONTRIBUTING (from r291709, vendor-crypto/openssl/dist-1.0.1/CONTRIBUTING) ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ stable/10/crypto/openssl/CONTRIBUTING Thu Dec 3 21:18:48 2015 (r291721, copy of r291709, vendor-crypto/openssl/dist-1.0.1/CONTRIBUTING) @@ -0,0 +1,38 @@ +HOW TO CONTRIBUTE TO OpenSSL +---------------------------- + +Development is coordinated on the openssl-dev mailing list (see +http://www.openssl.org for information on subscribing). If you +would like to submit a patch, send it to rt@openssl.org with +the string "[PATCH]" in the subject. Please be sure to include a +textual explanation of what your patch does. + +You can also make GitHub pull requests. If you do this, please also send +mail to rt@openssl.org with a brief description and a link to the PR so +that we can more easily keep track of it. + +If you are unsure as to whether a feature will be useful for the general +OpenSSL community please discuss it on the openssl-dev mailing list first. +Someone may be already working on the same thing or there may be a good +reason as to why that feature isn't implemented. + +Patches should be as up to date as possible, preferably relative to the +current Git or the last snapshot. They should follow our coding style +(see https://www.openssl.org/policies/codingstyle.html) and compile without +warnings using the --strict-warnings flag. OpenSSL compiles on many varied +platforms: try to ensure you only use portable features. + +Our preferred format for patch files is "git format-patch" output. For example +to provide a patch file containing the last commit in your local git repository +use the following command: + +# git format-patch --stdout HEAD^ >mydiffs.patch + +Another method of creating an acceptable patch file without using git is as +follows: + +# cd openssl-work +# [your changes] +# ./Configure dist; make clean +# cd .. +# diff -ur openssl-orig openssl-work > mydiffs.patch Modified: stable/10/crypto/openssl/Configure ============================================================================== --- stable/10/crypto/openssl/Configure Thu Dec 3 21:16:52 2015 (r291720) +++ stable/10/crypto/openssl/Configure Thu Dec 3 21:18:48 2015 (r291721) @@ -105,6 +105,8 @@ my $usage="Usage: Configure [no-<cipher> my $gcc_devteam_warn = "-Wall -pedantic -DPEDANTIC -Wno-long-long -Wsign-compare -Wmissing-prototypes -Wshadow -Wformat -Werror -DCRYPTO_MDEBUG_ALL -DCRYPTO_MDEBUG_ABORT -DREF_CHECK -DOPENSSL_NO_DEPRECATED"; +my $clang_devteam_warn = "-Wno-unused-parameter -Wno-missing-field-initializers -Wno-language-extension-token -Wno-extended-offsetof -Qunused-arguments"; + my $strict_warnings = 0; my $x86_gcc_des="DES_PTR DES_RISC1 DES_UNROLL"; @@ -197,6 +199,7 @@ my %table=( "debug-linux-generic32","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -g -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", "debug-linux-generic64","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", "debug-linux-x86_64","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -m64 -DL_ENDIAN -g -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64", +"debug-linux-x86_64-clang","clang: -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -m64 -DL_ENDIAN -g -Wall -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64", "dist", "cc:-O::(unknown)::::::", # Basic configs that should work on any (32 and less bit) box @@ -361,6 +364,7 @@ my %table=( "linux-ia64-ecc","ecc:-DL_ENDIAN -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", "linux-ia64-icc","icc:-DL_ENDIAN -O2 -Wall -no_cpprt::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)", "linux-x86_64", "gcc:-m64 -DL_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64", +"linux-x86_64-clang","clang: -m64 -DL_ENDIAN -O3 -Wall -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64", "linux64-s390x", "gcc:-m64 -DB_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64", #### So called "highgprs" target for z/Architecture CPUs # "Highgprs" is kernel feature first implemented in Linux 2.6.32, see @@ -1574,11 +1578,20 @@ if ($shlib_version_number =~ /(^[0-9]*)\ if ($strict_warnings) { + my $ecc = $cc; + $ecc = "clang" if `$cc --version 2>&1` =~ /clang/; my $wopt; - die "ERROR --strict-warnings requires gcc" unless ($cc =~ /gcc$/); + die "ERROR --strict-warnings requires gcc or clang" unless ($ecc =~ /gcc$/ or $ecc =~ /clang$/); foreach $wopt (split /\s+/, $gcc_devteam_warn) { - $cflags .= " $wopt" unless ($cflags =~ /$wopt/) + $cflags .= " $wopt" unless ($cflags =~ /(^|\s)$wopt(\s|$)/) + } + if ($ecc eq "clang") + { + foreach $wopt (split /\s+/, $clang_devteam_warn) + { + $cflags .= " $wopt" unless ($cflags =~ /(^|\s)$wopt(\s|$)/) + } } } Modified: stable/10/crypto/openssl/FAQ ============================================================================== --- stable/10/crypto/openssl/FAQ Thu Dec 3 21:16:52 2015 (r291720) +++ stable/10/crypto/openssl/FAQ Thu Dec 3 21:18:48 2015 (r291721) @@ -1,1039 +1,2 @@ -OpenSSL - Frequently Asked Questions --------------------------------------- - -[MISC] Miscellaneous questions - -* Which is the current version of OpenSSL? -* Where is the documentation? -* How can I contact the OpenSSL developers? -* Where can I get a compiled version of OpenSSL? -* Why aren't tools like 'autoconf' and 'libtool' used? -* What is an 'engine' version? -* How do I check the authenticity of the OpenSSL distribution? -* How does the versioning scheme work? - -[LEGAL] Legal questions - -* Do I need patent licenses to use OpenSSL? -* Can I use OpenSSL with GPL software? - -[USER] Questions on using the OpenSSL applications - -* Why do I get a "PRNG not seeded" error message? -* Why do I get an "unable to write 'random state'" error message? -* How do I create certificates or certificate requests? -* Why can't I create certificate requests? -* Why does <SSL program> fail with a certificate verify error? -* Why can I only use weak ciphers when I connect to a server using OpenSSL? -* How can I create DSA certificates? -* Why can't I make an SSL connection using a DSA certificate? -* How can I remove the passphrase on a private key? -* Why can't I use OpenSSL certificates with SSL client authentication? -* Why does my browser give a warning about a mismatched hostname? -* How do I install a CA certificate into a browser? -* Why is OpenSSL x509 DN output not conformant to RFC2253? -* What is a "128 bit certificate"? Can I create one with OpenSSL? -* Why does OpenSSL set the authority key identifier extension incorrectly? -* How can I set up a bundle of commercial root CA certificates? - -[BUILD] Questions about building and testing OpenSSL - -* Why does the linker complain about undefined symbols? -* Why does the OpenSSL test fail with "bc: command not found"? -* Why does the OpenSSL test fail with "bc: 1 no implemented"? -* Why does the OpenSSL test fail with "bc: stack empty"? -* Why does the OpenSSL compilation fail on Alpha Tru64 Unix? -* Why does the OpenSSL compilation fail with "ar: command not found"? -* Why does the OpenSSL compilation fail on Win32 with VC++? -* What is special about OpenSSL on Redhat? -* Why does the OpenSSL compilation fail on MacOS X? -* Why does the OpenSSL test suite fail on MacOS X? -* Why does the OpenSSL test suite fail in BN_sqr test [on a 64-bit platform]? -* Why does OpenBSD-i386 build fail on des-586.s with "Unimplemented segment type"? -* Why does the OpenSSL test suite fail in sha512t on x86 CPU? -* Why does compiler fail to compile sha512.c? -* Test suite still fails, what to do? -* I think I've found a bug, what should I do? -* I'm SURE I've found a bug, how do I report it? -* I've found a security issue, how do I report it? - -[PROG] Questions about programming with OpenSSL - -* Is OpenSSL thread-safe? -* I've compiled a program under Windows and it crashes: why? -* How do I read or write a DER encoded buffer using the ASN1 functions? -* OpenSSL uses DER but I need BER format: does OpenSSL support BER? -* I've tried using <M_some_evil_pkcs12_macro> and I get errors why? -* I've called <some function> and it fails, why? -* I just get a load of numbers for the error output, what do they mean? -* Why do I get errors about unknown algorithms? -* Why can't the OpenSSH configure script detect OpenSSL? -* Can I use OpenSSL's SSL library with non-blocking I/O? -* Why doesn't my server application receive a client certificate? -* Why does compilation fail due to an undefined symbol NID_uniqueIdentifier? -* I think I've detected a memory leak, is this a bug? -* Why does Valgrind complain about the use of uninitialized data? -* Why doesn't a memory BIO work when a file does? -* Where are the declarations and implementations of d2i_X509() etc? - -=============================================================================== - -[MISC] ======================================================================== - -* Which is the current version of OpenSSL? - -The current version is available from <URL: http://www.openssl.org>. -OpenSSL 1.0.1e was released on Feb 11th, 2013. - -In addition to the current stable release, you can also access daily -snapshots of the OpenSSL development version at <URL: -ftp://ftp.openssl.org/snapshot/>, or get it by anonymous Git access. - - -* Where is the documentation? - -OpenSSL is a library that provides cryptographic functionality to -applications such as secure web servers. Be sure to read the -documentation of the application you want to use. The INSTALL file -explains how to install this library. - -OpenSSL includes a command line utility that can be used to perform a -variety of cryptographic functions. It is described in the openssl(1) -manpage. Documentation for developers is currently being written. Many -manual pages are available; overviews over libcrypto and -libssl are given in the crypto(3) and ssl(3) manpages. - -The OpenSSL manpages are installed in /usr/local/ssl/man/ (or a -different directory if you specified one as described in INSTALL). -In addition, you can read the most current versions at -<URL: http://www.openssl.org/docs/>. Note that the online documents refer -to the very latest development versions of OpenSSL and may include features -not present in released versions. If in doubt refer to the documentation -that came with the version of OpenSSL you are using. The pod format -documentation is included in each OpenSSL distribution under the docs -directory. - -There is some documentation about certificate extensions and PKCS#12 -in doc/openssl.txt - -The original SSLeay documentation is included in OpenSSL as -doc/ssleay.txt. It may be useful when none of the other resources -help, but please note that it reflects the obsolete version SSLeay -0.6.6. - - -* How can I contact the OpenSSL developers? - -The README file describes how to submit bug reports and patches to -OpenSSL. Information on the OpenSSL mailing lists is available from -<URL: http://www.openssl.org>. - - -* Where can I get a compiled version of OpenSSL? - -You can finder pointers to binary distributions in -<URL: http://www.openssl.org/related/binaries.html>; . - -Some applications that use OpenSSL are distributed in binary form. -When using such an application, you don't need to install OpenSSL -yourself; the application will include the required parts (e.g. DLLs). - -If you want to build OpenSSL on a Windows system and you don't have -a C compiler, read the "Mingw32" section of INSTALL.W32 for information -on how to obtain and install the free GNU C compiler. - -A number of Linux and *BSD distributions include OpenSSL. - - -* Why aren't tools like 'autoconf' and 'libtool' used? - -autoconf will probably be used in future OpenSSL versions. If it was -less Unix-centric, it might have been used much earlier. - -* What is an 'engine' version? - -With version 0.9.6 OpenSSL was extended to interface to external crypto -hardware. This was realized in a special release '0.9.6-engine'. With -version 0.9.7 the changes were merged into the main development line, -so that the special release is no longer necessary. - -* How do I check the authenticity of the OpenSSL distribution? - -We provide MD5 digests and ASC signatures of each tarball. *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201512032118.tB3LIns1043566>