Fix whitespace issues in CHANGES and NEWS

Removed mixed tabs (converted tabs to eight spaces)

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/5344)
This commit is contained in:
Dr. Matthias St. Pierre 2018-02-13 02:04:50 +01:00 committed by Matt Caswell
parent 53010ea150
commit 87411f0595
2 changed files with 70 additions and 71 deletions

128
CHANGES
View file

@ -2984,12 +2984,12 @@
1. Do not use record version number > TLS 1.0 in initial client 1. Do not use record version number > TLS 1.0 in initial client
hello: some (but not all) hanging servers will now work. hello: some (but not all) hanging servers will now work.
2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate 2. If we set OPENSSL_MAX_TLS1_2_CIPHER_LENGTH this will truncate
the number of ciphers sent in the client hello. This should be the number of ciphers sent in the client hello. This should be
set to an even number, such as 50, for example by passing: set to an even number, such as 50, for example by passing:
-DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure. -DOPENSSL_MAX_TLS1_2_CIPHER_LENGTH=50 to config or Configure.
Most broken servers should now work. Most broken servers should now work.
3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable 3. If all else fails setting OPENSSL_NO_TLS1_2_CLIENT will disable
TLS 1.2 client support entirely. TLS 1.2 client support entirely.
[Steve Henson] [Steve Henson]
*) Fix SEGV in Vector Permutation AES module observed in OpenSSH. *) Fix SEGV in Vector Permutation AES module observed in OpenSSH.
@ -3026,12 +3026,12 @@
*) Extensive assembler packs updates, most notably: *) Extensive assembler packs updates, most notably:
- x86[_64]: AES-NI, PCLMULQDQ, RDRAND support; - x86[_64]: AES-NI, PCLMULQDQ, RDRAND support;
- x86[_64]: SSSE3 support (SHA1, vector-permutation AES); - x86[_64]: SSSE3 support (SHA1, vector-permutation AES);
- x86_64: bit-sliced AES implementation; - x86_64: bit-sliced AES implementation;
- ARM: NEON support, contemporary platforms optimizations; - ARM: NEON support, contemporary platforms optimizations;
- s390x: z196 support; - s390x: z196 support;
- *: GHASH and GF(2^m) multiplication implementations; - *: GHASH and GF(2^m) multiplication implementations;
[Andy Polyakov] [Andy Polyakov]
@ -3384,7 +3384,7 @@
*) Add protection against ECDSA timing attacks as mentioned in the paper *) Add protection against ECDSA timing attacks as mentioned in the paper
by Billy Bob Brumley and Nicola Tuveri, see: by Billy Bob Brumley and Nicola Tuveri, see:
http://eprint.iacr.org/2011/232.pdf http://eprint.iacr.org/2011/232.pdf
[Billy Bob Brumley and Nicola Tuveri] [Billy Bob Brumley and Nicola Tuveri]
@ -5457,16 +5457,16 @@
takes an extra flags argument for optional functionality. Currently, takes an extra flags argument for optional functionality. Currently,
the following flags are defined: the following flags are defined:
OBJ_BSEARCH_VALUE_ON_NOMATCH OBJ_BSEARCH_VALUE_ON_NOMATCH
This one gets OBJ_bsearch_ex() to return a pointer to the first This one gets OBJ_bsearch_ex() to return a pointer to the first
element where the comparing function returns a negative or zero element where the comparing function returns a negative or zero
number. number.
OBJ_BSEARCH_FIRST_VALUE_ON_MATCH OBJ_BSEARCH_FIRST_VALUE_ON_MATCH
This one gets OBJ_bsearch_ex() to return a pointer to the first This one gets OBJ_bsearch_ex() to return a pointer to the first
element where the comparing function returns zero. This is useful element where the comparing function returns zero. This is useful
if there are more than one element where the comparing function if there are more than one element where the comparing function
returns zero. returns zero.
[Richard Levitte] [Richard Levitte]
*) Make it possible to create self-signed certificates with 'openssl ca' *) Make it possible to create self-signed certificates with 'openssl ca'
@ -5613,8 +5613,8 @@
is defined as follows (according to X.509_4thEditionDraftV6.pdf): is defined as follows (according to X.509_4thEditionDraftV6.pdf):
CertificatePair ::= SEQUENCE { CertificatePair ::= SEQUENCE {
forward [0] Certificate OPTIONAL, forward [0] Certificate OPTIONAL,
reverse [1] Certificate OPTIONAL, reverse [1] Certificate OPTIONAL,
-- at least one of the pair shall be present -- } -- at least one of the pair shall be present -- }
Also implement the PEM functions to read and write certificate Also implement the PEM functions to read and write certificate
@ -6616,15 +6616,15 @@
build directory is the following (tested on Linux), maybe with build directory is the following (tested on Linux), maybe with
some local tweaks: some local tweaks:
# Place yourself outside of the OpenSSL source tree. In # Place yourself outside of the OpenSSL source tree. In
# this example, the environment variable OPENSSL_SOURCE # this example, the environment variable OPENSSL_SOURCE
# is assumed to contain the absolute OpenSSL source directory. # is assumed to contain the absolute OpenSSL source directory.
mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`" mkdir -p objtree/"`uname -s`-`uname -r`-`uname -m`"
cd objtree/"`uname -s`-`uname -r`-`uname -m`" cd objtree/"`uname -s`-`uname -r`-`uname -m`"
(cd $OPENSSL_SOURCE; find . -type f) | while read F; do (cd $OPENSSL_SOURCE; find . -type f) | while read F; do
mkdir -p `dirname $F` mkdir -p `dirname $F`
ln -s $OPENSSL_SOURCE/$F $F ln -s $OPENSSL_SOURCE/$F $F
done done
To be absolutely sure not to disturb the source tree, a "make clean" To be absolutely sure not to disturb the source tree, a "make clean"
is a good thing. If it isn't successful, don't worry about it, is a good thing. If it isn't successful, don't worry about it,
@ -7119,8 +7119,8 @@
des_key_schedule ks; des_key_schedule ks;
des_set_key_checked(..., &ks); des_set_key_checked(..., &ks);
des_ncbc_encrypt(..., &ks, ...); des_ncbc_encrypt(..., &ks, ...);
(Note that a later change renames 'des_...' into 'DES_...'.) (Note that a later change renames 'des_...' into 'DES_...'.)
[Ben Laurie] [Ben Laurie]
@ -7326,7 +7326,7 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
'-pre' and '-post' switches. '-post' is only used if '-t' is '-pre' and '-post' switches. '-post' is only used if '-t' is
specified and the ENGINE is successfully initialised. The syntax for specified and the ENGINE is successfully initialised. The syntax for
the individual commands are colon-separated, for example; the individual commands are colon-separated, for example;
openssl engine chil -pre FORK_CHECK:0 -pre SO_PATH:/lib/test.so openssl engine chil -pre FORK_CHECK:0 -pre SO_PATH:/lib/test.so
[Geoff] [Geoff]
*) New dynamic control command support for ENGINEs. ENGINEs can now *) New dynamic control command support for ENGINEs. ENGINEs can now
@ -7514,16 +7514,16 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
To implement a global variable, use the macro OPENSSL_IMPLEMENT_GLOBAL To implement a global variable, use the macro OPENSSL_IMPLEMENT_GLOBAL
in the source file (foo.c) like this: in the source file (foo.c) like this:
OPENSSL_IMPLEMENT_GLOBAL(int,foo)=1; OPENSSL_IMPLEMENT_GLOBAL(int,foo)=1;
OPENSSL_IMPLEMENT_GLOBAL(double,bar); OPENSSL_IMPLEMENT_GLOBAL(double,bar);
To declare a global variable, use the macros OPENSSL_DECLARE_GLOBAL To declare a global variable, use the macros OPENSSL_DECLARE_GLOBAL
and OPENSSL_GLOBAL_REF in the header file (foo.h) like this: and OPENSSL_GLOBAL_REF in the header file (foo.h) like this:
OPENSSL_DECLARE_GLOBAL(int,foo); OPENSSL_DECLARE_GLOBAL(int,foo);
#define foo OPENSSL_GLOBAL_REF(foo) #define foo OPENSSL_GLOBAL_REF(foo)
OPENSSL_DECLARE_GLOBAL(double,bar); OPENSSL_DECLARE_GLOBAL(double,bar);
#define bar OPENSSL_GLOBAL_REF(bar) #define bar OPENSSL_GLOBAL_REF(bar)
The #defines are very important, and therefore so is including the The #defines are very important, and therefore so is including the
header file everywhere where the defined globals are used. header file everywhere where the defined globals are used.
@ -7727,7 +7727,7 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
to data. This was previously part of the PKCS7 ASN1 code. This to data. This was previously part of the PKCS7 ASN1 code. This
was causing problems with OpenSSL created PKCS#12 and PKCS#7 structures. was causing problems with OpenSSL created PKCS#12 and PKCS#7 structures.
[Steve Henson, reported by Kenneth R. Robinette [Steve Henson, reported by Kenneth R. Robinette
<support@securenetterm.com>] <support@securenetterm.com>]
*) Add CRYPTO_push_info() and CRYPTO_pop_info() calls to new ASN1 *) Add CRYPTO_push_info() and CRYPTO_pop_info() calls to new ASN1
routines: without these tracing memory leaks is very painful. routines: without these tracing memory leaks is very painful.
@ -7741,7 +7741,7 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
and use ASN1_TIME_set() if the value is not V_ASN1_UTCTIME or and use ASN1_TIME_set() if the value is not V_ASN1_UTCTIME or
V_ASN1_GENERALIZEDTIME, without this it always uses GeneralizedTime. V_ASN1_GENERALIZEDTIME, without this it always uses GeneralizedTime.
[Steve Henson, reported by Kenneth R. Robinette [Steve Henson, reported by Kenneth R. Robinette
<support@securenetterm.com>] <support@securenetterm.com>]
*) Fixes to BN_to_ASN1_INTEGER when bn is zero. This would previously *) Fixes to BN_to_ASN1_INTEGER when bn is zero. This would previously
result in a zero length in the ASN1_INTEGER structure which was result in a zero length in the ASN1_INTEGER structure which was
@ -7826,10 +7826,10 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
settings for extended allocation functions, the following settings for extended allocation functions, the following
functions are provided: functions are provided:
CRYPTO_set_mem_ex_functions CRYPTO_set_mem_ex_functions
CRYPTO_set_locked_mem_ex_functions CRYPTO_set_locked_mem_ex_functions
CRYPTO_get_mem_ex_functions CRYPTO_get_mem_ex_functions
CRYPTO_get_locked_mem_ex_functions CRYPTO_get_locked_mem_ex_functions
These work the same way as CRYPTO_set_mem_functions and friends. These work the same way as CRYPTO_set_mem_functions and friends.
CRYPTO_get_[locked_]mem_functions now writes 0 where such an CRYPTO_get_[locked_]mem_functions now writes 0 where such an
@ -8170,11 +8170,11 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
*) Add the following functions: *) Add the following functions:
ENGINE_load_cswift() ENGINE_load_cswift()
ENGINE_load_chil() ENGINE_load_chil()
ENGINE_load_atalla() ENGINE_load_atalla()
ENGINE_load_nuron() ENGINE_load_nuron()
ENGINE_load_builtin_engines() ENGINE_load_builtin_engines()
That way, an application can itself choose if external engines that That way, an application can itself choose if external engines that
are built-in in OpenSSL shall ever be used or not. The benefit is are built-in in OpenSSL shall ever be used or not. The benefit is
@ -8423,8 +8423,8 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
*) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX *) Fix ASN1 checks. Check for overflow by comparing with LONG_MAX
and get fix the header length calculation. and get fix the header length calculation.
[Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>, [Florian Weimer <Weimer@CERT.Uni-Stuttgart.DE>,
Alon Kantor <alonk@checkpoint.com> (and others), Alon Kantor <alonk@checkpoint.com> (and others),
Steve Henson] Steve Henson]
*) Use proper error handling instead of 'assertions' in buffer *) Use proper error handling instead of 'assertions' in buffer
overflow checks added in 0.9.6e. This prevents DoS (the overflow checks added in 0.9.6e. This prevents DoS (the
@ -9498,23 +9498,23 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
through a logging bio, to cover all the levels that are available through a logging bio, to cover all the levels that are available
through syslog. The prefixes are now: through syslog. The prefixes are now:
PANIC, EMERG, EMR => LOG_EMERG PANIC, EMERG, EMR => LOG_EMERG
ALERT, ALR => LOG_ALERT ALERT, ALR => LOG_ALERT
CRIT, CRI => LOG_CRIT CRIT, CRI => LOG_CRIT
ERROR, ERR => LOG_ERR ERROR, ERR => LOG_ERR
WARNING, WARN, WAR => LOG_WARNING WARNING, WARN, WAR => LOG_WARNING
NOTICE, NOTE, NOT => LOG_NOTICE NOTICE, NOTE, NOT => LOG_NOTICE
INFO, INF => LOG_INFO INFO, INF => LOG_INFO
DEBUG, DBG => LOG_DEBUG DEBUG, DBG => LOG_DEBUG
and as before, if none of those prefixes are present at the and as before, if none of those prefixes are present at the
beginning of the string, LOG_ERR is chosen. beginning of the string, LOG_ERR is chosen.
On Win32, the LOG_* levels are mapped according to this: On Win32, the LOG_* levels are mapped according to this:
LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_ERR => EVENTLOG_ERROR_TYPE LOG_EMERG, LOG_ALERT, LOG_CRIT, LOG_ERR => EVENTLOG_ERROR_TYPE
LOG_WARNING => EVENTLOG_WARNING_TYPE LOG_WARNING => EVENTLOG_WARNING_TYPE
LOG_NOTICE, LOG_INFO, LOG_DEBUG => EVENTLOG_INFORMATION_TYPE LOG_NOTICE, LOG_INFO, LOG_DEBUG => EVENTLOG_INFORMATION_TYPE
[Richard Levitte] [Richard Levitte]
@ -10559,9 +10559,9 @@ des-cbc 3624.96k 5258.21k 5530.91k 5624.30k 5628.26k
With these changes, a new set of functions and macros have appeared: With these changes, a new set of functions and macros have appeared:
CRYPTO_set_mem_debug_functions() [F] CRYPTO_set_mem_debug_functions() [F]
CRYPTO_get_mem_debug_functions() [F] CRYPTO_get_mem_debug_functions() [F]
CRYPTO_dbg_set_options() [F] CRYPTO_dbg_set_options() [F]
CRYPTO_dbg_get_options() [F] CRYPTO_dbg_get_options() [F]
CRYPTO_malloc_debug_init() [M] CRYPTO_malloc_debug_init() [M]

13
NEWS
View file

@ -381,7 +381,7 @@
o Compression memory leak fixed. o Compression memory leak fixed.
o Compression session resumption fixed. o Compression session resumption fixed.
o Ticket and SNI coexistence fixes. o Ticket and SNI coexistence fixes.
o Many fixes to DTLS handling. o Many fixes to DTLS handling.
Major changes between OpenSSL 0.9.8k and OpenSSL 0.9.8l [5 Nov 2009]: Major changes between OpenSSL 0.9.8k and OpenSSL 0.9.8l [5 Nov 2009]:
@ -414,7 +414,7 @@
o Add gcc 4.2 support. o Add gcc 4.2 support.
o Add support for AES and SSE2 assembly language optimization o Add support for AES and SSE2 assembly language optimization
for VC++ build. for VC++ build.
o Support for RFC4507bis and server name extensions if explicitly o Support for RFC4507bis and server name extensions if explicitly
selected at compile time. selected at compile time.
o DTLS improvements. o DTLS improvements.
o RFC4507bis support. o RFC4507bis support.
@ -594,7 +594,7 @@
Major changes between OpenSSL 0.9.7a and OpenSSL 0.9.7b [10 Apr 2003]: Major changes between OpenSSL 0.9.7a and OpenSSL 0.9.7b [10 Apr 2003]:
o Security: counter the Klima-Pokorny-Rosa extension of o Security: counter the Klima-Pokorny-Rosa extension of
Bleichbacher's attack Bleichbacher's attack
o Security: make RSA blinding default. o Security: make RSA blinding default.
o Configuration: Irix fixes, AIX fixes, better mingw support. o Configuration: Irix fixes, AIX fixes, better mingw support.
o Support for new platforms: linux-ia64-ecc. o Support for new platforms: linux-ia64-ecc.
@ -654,7 +654,7 @@
o SSL/TLS: allow optional cipher choice according to server's preference. o SSL/TLS: allow optional cipher choice according to server's preference.
o SSL/TLS: allow server to explicitly set new session ids. o SSL/TLS: allow server to explicitly set new session ids.
o SSL/TLS: support Kerberos cipher suites (RFC2712). o SSL/TLS: support Kerberos cipher suites (RFC2712).
Only supports MIT Kerberos for now. Only supports MIT Kerberos for now.
o SSL/TLS: allow more precise control of renegotiations and sessions. o SSL/TLS: allow more precise control of renegotiations and sessions.
o SSL/TLS: add callback to retrieve SSL/TLS messages. o SSL/TLS: add callback to retrieve SSL/TLS messages.
o SSL/TLS: support AES cipher suites (RFC3268). o SSL/TLS: support AES cipher suites (RFC3268).
@ -667,7 +667,7 @@
Major changes between OpenSSL 0.9.6i and OpenSSL 0.9.6j [10 Apr 2003]: Major changes between OpenSSL 0.9.6i and OpenSSL 0.9.6j [10 Apr 2003]:
o Security: counter the Klima-Pokorny-Rosa extension of o Security: counter the Klima-Pokorny-Rosa extension of
Bleichbacher's attack Bleichbacher's attack
o Security: make RSA blinding default. o Security: make RSA blinding default.
o Build: shared library support fixes. o Build: shared library support fixes.
@ -779,7 +779,7 @@
Major changes between OpenSSL 0.9.5 and OpenSSL 0.9.5a [1 Apr 2000]: Major changes between OpenSSL 0.9.5 and OpenSSL 0.9.5a [1 Apr 2000]:
o Bug fixes for Win32, SuSE Linux, NeXTSTEP and FreeBSD 2.2.8 o Bug fixes for Win32, SuSE Linux, NeXTSTEP and FreeBSD 2.2.8
o Shared library support for HPUX and Solaris-gcc o Shared library support for HPUX and Solaris-gcc
o Support of Linux/IA64 o Support of Linux/IA64
o Assembler support for Mingw32 o Assembler support for Mingw32
@ -879,4 +879,3 @@
o Extended ASN.1 parser routines o Extended ASN.1 parser routines
o Adjustments of the source tree for CVS o Adjustments of the source tree for CVS
o Support for various new platforms o Support for various new platforms