Revision history for Perl extension Net::SSLeay.

1.88 2019-05-10

	- New stable release incorporating all changes from developer

	  releases 1.86_01 to 1.86_11.

	- From this release, Net-SSLeay is switching to an "odd/even"

	  developer/stable release version numbering system, like that of

	  many core modules (e.g. ExtUtils::MakeMaker): developer releases

	  will have an odd minor version number (and the usual "_xx" suffix),

	  and stable releases will have an even minor version number. This

	  means there is no Net-SSLeay 1.87.

	- Summary of major changes since version 1.85:

	  - Mike McCauley has stepped down as maintainer. The new maintainers

	    are Chris Novakovic, Heikki Vatiainen and Tuure Vartiainen.

	  - The source code has moved from the now-defunct Debian Subversion

	    server (alioth.debian.org) to GitHub

	    (https://github.com/radiator-software/p5-net-ssleay).

	  - Net-SSLeay is provided under the terms of the Artistic License

	    2.0 - this has been the case since version 1.66, but references

	    to other licenses remained in the source code, causing ambiguity.

	  - Perl 5.8.1 or newer is now required to use Net-SSLeay. This has

	    already been the case for some time in practice, as the test

	    suite hasn't fully passed on Perl 5.6 for several years.

	  - Much-improved compatibility with OpenSSL 1.1.1, and improved

	    support for TLS 1.3.

	  - Fixed a long-standing bug in cb_data_advanced_put() that caused

	    memory leaks when callbacks were frequently added and removed.

	  - Support in the test suite for "hardened" OpenSSL configurations

	    that set a default security level of 2 or higher (e.g., in the

	    OpenSSL packages that ship with recent versions of Debian, Fedora

	    and Ubuntu).

1.86_11 2019-05-08

	- Clarified Net-SSLeay's licensing terms: the module distribution has

	  been released under the terms of the Artistic License 2.0 since

	  version 1.66; references to other licenses have been removed. Fixes

	  RT#106314. Thanks to Kent Fredric for pointing out the ambiguity.

	- Replace the HTTPS hosts in the external tests (some of which were

	  no longer online) with more resilient ones. Closes issue #26.

1.86_10 2019-05-04

	- Use locally-generated certificate chain in local tests rather

	  than the Twitter one, which changes regularly and breaks the

	  test suite unnecessarily. Fixes RT#129201. Thanks to Petr Písař

	  for the report and patch, and Steffen Ullrich for an alternative

	  patch suggestion.

	- In t/local/09_ctx_new.t, rather than checking that the functions

	  (CTX_)get_min_proto_version and (CTX_)get_max_proto_version return

	  0x0000 (indicating the lowest and highest versions supported by

	  libssl respectively, which is not the case if a run-time

	  configuration is enforcing a different minimum or maximum), just

	  check whether the returned value is one of those mentioned on the

	  SSL_CTX_set_min_proto_version(3) man page. Partially fixes

	  RT#128025. Thanks to Slaven Rezić and Dmytro Zagashev for the

	  downstream reports.

	- Move from 1024-bit keys/certificates to 2048-bit keys/certificates

	  across the entire test suite. This removes the need to manually

	  set the security level to 1 in tests that used the old keys, and

	  fixes large numbers of test failures on modern Linux distributions

	  that set the minimum OpenSSL security level to 2. Fixes RT#126270

	  and the remainder of RT#128025. Thanks to Petr Písař and Slaven

	  Rezić for the downstream reports.

	- In t/local/06_tcpecho.t and t/local/07_sslecho.t, connect to

	  127.0.0.1 instead of localhost. This fixes these tests when

	  executed inside a network sandbox that disrupts the behaviour of

	  gethostbyname(). Fixes RT#128207. Thanks to Kent Fredric for the

	  downstream report.

1.86_09 2019-03-12

	- Add missing files to MANIFEST that prevented tests from passing

	  when installing from the 1.86_08 release tarball.

1.86_08 2019-03-12

	- Add and fix functions needed to properly implement client

	  side session reuse for TLS 1.3 with using

	  CTX_sess_set_new_cb. Newly exposed functions:

	  SSL_SESSION_dup and SSL_SESSION_up_ref.

	  Fixed functions: i2d_SSL_SESSION and d2i_SSL_SESSION.

	  Thanks to Steffen Ullrich.

	- Add functions functions to allow reading multiple pems from

	  file and creating untrusted chain: These functions allow you

	  to:

	  - Read in a PEM file with multiple certificates as a

	    STACK_OF(X509_INFO)

	  - Determine the size of the STACK_OF(X509_INFO) and value at

	    an index, which allows you to loop over the stack.

	  - Retrieve the X509 structure from each X509_INFO structure

	    in the stack.

	  Then you can create a new STACK_OF(X509) and push the X509

	  structures onto the new stack. You can then pass this

	  STACK_OF(X509) to X509_STORE_CTX_init which will allow you

	  to add additional untrusted certificates to the chain for

	  verification. Exposed functions are:

	  PEM_X509_INFO_read_bio

	  sk_X509_INFO_num

	  sk_X509_INFO_value

	  sk_X509_INFO_free

	  sk_X509_new_null

	  sk_X509_free

	  sk_X509_push

	  New function implemented by Net::SSLeay:

	  P_X509_INFO_get_x509

	  Thanks to Marc Reisner.

	- Add functions and constants that are necessary to verify a

	  certificate using a hash directory outside of an SSL/TLS

	  connection. Newly exposed functions:

	  X509_STORE_CTX_init

	  X509_STORE_CTX_free

	  X509_STORE_new

	  X509_STORE_free

	  X509_STORE_add_lookup

	  X509_LOOKUP_hash_dir

	  X509_LOOKUP_add_dir

	  Newly exposed constants:

	  X509_FILETYPE_ASN1

	  X509_FILETYPE_DEFAULT

	  X509_FILETYPE_PEM

	  Thanks to Marc Reisner.

	- Declare n_a in ssleay_set_psk_client_callback_invoke and

	  ssleay_ctx_set_psk_client_callback_invoke to avoid a compilation

	  error with Perl versions below 5.8.8. Fixes RT#128030. Thanks to

	  Graham Ollis for the report.

	- Add X509_get0_serialNumber. Thanks to Marc Reisner.

	- Enable Travis CI for LibreSSL 2.2.1, 2.7.5, 2.8.3 and 2.9.0

	  on Perl 5.20 and more recent.

	- Expose the following functions for curve and group selection:

	  - CTX_set_ecdh_auto, set_ecdh_auto

	  - CTX_set1_curves_list, set1_curves_list

	  - CTX_set1_groups_list, set1_groups_list

	  Thanks to Steffen Ullrich.

1.86_07 2018-12-13

        - Net::SSLeay::RSA_generate_key() now prefers using

          RSA_generate_key_ex. This avois deprecated RSA_generate_key

          and allows removing the only Android specific code in

          SSLeay.xs. Fixes RT#127593. Thanks to Rouven Weiler.

	- SSL_CTX_get0_param, SSL_CTX_get0_param,

	  X509_VERIFY_PARAM_set1_host, X509_VERIFY_PARAM_add1_host,

	  X509_VERIFY_PARAM_set_hostflags,

	  X509_VERIFY_PARAM_get0_peername,

	  X509_VERIFY_PARAM_set1_email, X509_VERIFY_PARAM_set1_ip and

	  X509_VERIFY_PARAM_set1_ip_asc added in 1.83 for OpenSSL

	  1.0.2 and later are now available with LibreSSL 2.7.0 and

	  later.

	- get_keyblock_size() now gets the MAC secret size from the

	  cipher on LibreSSL 2.7.0 and later, rather than reaching

	  into libssl internals. This effectively takes the OpenSSL

	  1.1 code path for LibreSSL 2.7.0 instead of the OpenSSL 1.0

	  code path.  Thanks to Alexander Bluhm.

	- get_client_random and get_server_random now use API

	  functions supported by LibreSSL 2.7.0 and later. Thanks to

	  Alexander Bluhm.

	- Add X509_check_host(), X509_check_email(), X509_check_ip(),

	  and X509_check_ip_asc() for LibreSSL 2.5.0 and later. Thanks

	  to Alexander Bluhm.

        - OpenSSL_version() and OpenSSL_version_num() are available

          with LibreSSL 2.7.0 and later. Thanks to Alexander Bluhm.

        - Use OPENSSL_cleanse() instead of memset(). Fixes

          RT#116599. Thanks to A. Sinan Unur.

1.86_06 2018-09-29

	- Net::SSLeay::read() and SSL_peek() now check SSL_get_error()

	  for SSL_ERROR_ZERO_RETURN for return values <= 0 to make

	  Net::SSLeay::read() behave more like underlying OpenSSL

	  function SSL_read().

	  Convenience function ssl_read_all() now does an automatic

	  retry when ERROR_WANT_READ or ERROR_WANT_WRITE is returned

	  with Net::SSLeay::read().

	  Convenience function ssl_read_until() now uses

	  Net::SSLeay::ssl_read_all() instead of

	  Net::SSLeay::read(). Tests 07_sslecho.t and 36_verify.t were

	  also updated to use ssl_read_all() and ssl_write_all(). The

	  tests now also disable TLSv1.3 session tickets and ignore

	  SIGPIPE to avoid this signal when the client has finished

	  before server has sent session tickets and called

	  Net::SSLeay::accept().

	  Thanks to Petr Pisar and Sebastian Andrzej Siewior for the

	  patches (in #RT125218).

	- Fix a memory leak in cb_data_advanced_put. Fixes

	  RT#127131. Noticed, investigated and patched by Paul

	  Evans. Thanks!

	- Enable OpenSSL 1.1.1-pre9 with Travis CI.

	- Add SSL_CTX_set_num_tickets, SSL_CTX_get_num_tickets,

	  SSL_set_num_ticket and SSL_get_num_tickets for controlling

	  the number of TLSv1.3 session tickets that are issued.  Add

	  tests in 44_sess.t. Parts taken from a larger patch by Petr

	  Pisar of RedHat.

	- Add SSL_CTX_set_ciphersuites and SSL_set_ciphersuites for

	  configuring the available TLSv1.3 ciphersuites. Add tests in

	  43_misc_functions.t and clarify SSL_client_version tests.

	- Add SSL_CTX_set_security_level, SSL_CTX_get_security_level,

	  SSL_set_security_level and SSL_get_security_level.

	  Add new test file 65_security_level.t.

	  All courtesy of Damyan Ivanov of Debian project.

	- Fix export_keying_material return value check and context

	  handling. SSL_export_keying_material use_context is now

	  correctly set to non-zero value when context is an empty

	  string. This affects values exported with TLSv1.2 and earlier.

	  Update documentation in NetSSLeay.pod and add tests

	  in t/local/45_export.t.

	- Add RAND_priv_bytes. Add new test file t/local/10_rand.t for

	  RAND_bytes, RAND_pseudo_bytes, RAND_priv_bytes, RAND_status,

	  RAND_poll, RAND_file_name and RAND_load_file.

	- Update documentation for RAND_*bytes return values and

	  RAND_file_name behaviour with LibreSSL.

	- Add SSL_SESSION_is_resumable. Add and update tests in 44_sess.t.

	- Set OpenSSL security level to 1 in tests that use the test suite's

	  (1024-bit) RSA keys, which allows the test suite to pass when

	  Net-SSLeay is built against an OpenSSL with a higher default

	  security level. Fixes RT#126987. Thanks to Petr Pisar (in

	  RT#126270) and Damyan Ivanov (in RT#126987) for the reports and

	  patches, and to Damyan Ivanov for the preferred patch.

	- Add SSL_CTX_sess_set_new_cb and SSL_CTX_sess_set_remove_cb.

	  Add new test file 44_sess.t for these and future session

	  related tests for which no specific test file is needed.

	- Add SSL_get_version, SSL_client_version and SSL_is_dtls.

	- Add SSL_peek_ex, SSL_read_ex, SSL_write_ex and SSL_has_pending.

	  Add tests in t/local/11_read.t

	- Add SSL_CTX_set_post_handshake_auth contributed by Paul

	  Howarth. Add SSL_set_post_handshake_auth,

	  SSL_verify_client_post_handshake and constant

	  SSL_VERIFY_POST_HANDSHAKE.

	- Applied a patch to set_cert_and_key() from Damyan Ivanov,

	  Debian Perl Group. This function now returns errors from

	  library's error stack only when an underlying routine

	  fails. Unrelated errors are now skipped. Fixes RT#126988.

	- Add support for TLSv1.3 via $Net::SSLeay::ssl_version.

	- Enhance t/local/43_misc_functions.t get_keyblock_size test

	  to work better with AEAD ciphers.

	- Add constants SSL_OP_ENABLE_MIDDLEBOX_COMPAT and

	  SSL_OP_NO_ANTI_REPLAY for TLSv1.3

	- Fix compile time DEFINE=-DSHOW_XS_DEBUG to work with

	  non-threaded Perls. Fixes RT#127027. Thanks to SREZIC for

	  the report. Also fix other minor compile warnings.

1.86_05 2018-08-22

	- Net-SSLeay now requires at least Perl 5.8.1. This is a

	  formalisation of what has been the de facto case for some time,

	  as the distribution hasn't compiled and passed its tests on Perl

	  5.005 for several years.

	- Increment Net::SSLeay::Handle's version number to keep it in sync

	  with Net::SSLeay's, thus satisfying Kwalitee's consistent_version

	  metric.

	- Re-enable the d2i_X509_bio() test in t/local/33_x509_create_cert.t

	  for LibreSSL. Thanks to Alexander Bluhm.

	- Automatically detect new library names on Windows for OpenSSL

	  1.1.0 onwards (libcrypto, libssl). Fixes part of RT#121084. Thanks

	  to Jean-Damien Durand.

	- Fix a typo preventing OpenSSL libraries built with the VC compiler

	  (i.e. ones with a ".lib" suffix) from being automatically detected

	  on Windows. Fixes part of RT#121084. Thanks to Jean-Damien Durand.

	- Add missing call to va_end() following va_start() in TRACE().

	  Fixes RT#126028. Thanks to Jitka Plesnikova.

	- Added SSL_in_init() and the related functions for all

	  libraries and their versions. All return 0 or 1 as

	  documented by OpenSSL 1.1.1. Use of these functions is

	  recommended over using constants returned by get_state() and

	  state(). New constants TLS_ST_*, used by OpenSSL 1.1.0 and

	  later, will not be made available by Net::SSLeay.

1.86_04 2018-07-30

	- Re-add SSLv3_method() for OpenSSL 1.0.2 and above. Fixes

	  RT#101484.

	- Don't expose ENGINE-related functions when building against

	  OpenSSL builds without ENGINE support. Fixes RT#121538. Thanks to

	  Paul Green.

	- Automatically detect OpenSSL 1.0.x on VMS, and update VMS

	  installation instructions to reflect removal of Module::Install

	  from the build system. Fixes RT#124388. Thanks to Craig A. Berry.

	- Prevent memory leak in OCSP_cert2ids() and OCSP_response_verify().

	  Fixes RT#125273. Thanks to Steffen Ullrich.

1.86_03 2018-07-19

	- Convert packaging to ExtUtils::MakeMaker. Thanks to mohawk2.

	- Module::Install is no longer a prerequisite when building

	  from the reposistory.

	- Re-apply patch from ETJ permitting configure and build in

	  places with a space in the name.

1.86_02 2018-07-06

	- Removed inc/ from repository. Module::Install is now a

	  prerequisite when building from the repository. This allowed

	  also removing "." from Makefile.PL lib path which was added

	  in version 1.81. These updates require no changes when

	  building from release packages. They also help AppVeyor

	  builds to work better with old Perls.

	- Added CONTRIBUTING.md, reformatted the previous Changes

          entry to use CPAN::Changes::Spec guidelines and removed

          unused version control tags from comments.

1.86_01 2018-07-04

	- Net::SSLeay functionality was not changed in this release.

	- Maintainer changes:

	  - Mike McCauley, maintainer of Net-SSLeay since November 2005,

	    has stepped down. Thanks to Mike for his 13 years of

	    stewardship.

	  - Net-SSLeay is now maintained by Chris Novakovic, Heikki

	    Vatiainen and Tuure Vartiainen.

	- Version control system changes:

	  - The previous Debian-hosted SVN repository has been imported

	    into Git. The source code is now maintained on GitHub, at

	    https://github.com/radiator-software/p5-net-ssleay.

	  - Fixes to commit metadata, branches and tags that git-svn

	    couldn't handle or had no way of handling, were done

	    manually or semi-automatically afterwards. For instance, the

	    "git-svn-id:" lines that git-svn appends to commit messages

	    were kept because Mike used SVN revision numbers in RT

	    replies to indicate when bugs had been fixed/patches applied

	    (which may be useful for future reference).

	  - All commits were replayed onto a single master branch rather

	    than having separate dead-end branches for the old SVN

	    version tags (as this seems more "git-like").

	  - New lightweight tags were created for each public release

	    going back as far as the start of the SVN repository using

	    data from MetaCPAN (cross-referencing with the changelog

	    when it wasn't clear when a release was cut from the SVN

	    repo).

	  - Florian's and Mike's email addresses were mapped to git

	    author/committer IDs

	- Continuous integration:

	  - Travis CI configuration was added for automated testing on

	    Linux using 64 bit Ubuntu Trusty. Build matrix dimensions

	    are: Perl 5.8 - 5.26 x OpenSSL 0.9.8zh - 1.1.0h. Only the

	    currently latest version for each major Perl and OpenSSL

	    release is chosen.

	  - AppVeyor configuration was added for automated testing on

	    Windows. Build matrix dimensions are: Perl 5.8 - 5.26 x

	    32bit and 64bit Perl environment x Windows Server 2012R2 and

	    Windows Server 2016. The Perl environment is Strawberry Perl

	    and its OpenSSL is used with builds. Only the latest major

	    versions are used, similarly to Travis CI. Net-SSLeay PPM

	    and PPD files are made available as artifacts.

	  - Added README.md with link to master branch build and test

	    status. Did minor updates to README and other misc files.

	- Release packaging:

	  - Files t/local/43_misc_functions.t and

	    t/local/65_ticket_sharing_2.t were missing from MANIFEST.

	  - Updated inc/ directory with Module::Install 1.19. Updated

	    Makefile.PL author and resource information. Synced

	    SSLeay.pm under ext/ with the latest changes under

	    inc/. Reordered use imports so that META.yml gets correctly

	    regenerated. More Module::Install related changes will

	    follow.

1.85 2018-03-14

	Preparations for transferring maintenace to a new maintainer

	Fixed test failure in t/local/33_x509_create_cert.t for some version of OpenSSL.

	Fixed free() error that causes "Free to wrong pool ..." merssage on Windows.

	Reported and patched by Steffen Ullrich.

1.84 2018-01-17

	Fixed an error in t/local/04_basic.t causing a test failure if

	Test::Exception not installed. Reported by Joel Berger.

1.83 2018-01-16

	Fixed a problem with exporting OPENSSL_NO_NEXTPROTONEG even though they are not availble on LibreSSL.

	Patch patch-SSLeay_xs-NO_NPN from Alexander Bluhm.

	Patch from Heikki Vatiainen adds support for SSL_set_default_passwd_cb* for 

	OpenSSL 1.1.0f and later. LibreSSL does not support these functions, at 

	least yet.

	Patch from Heikki Vatiainen adds new functions related to SSL_CTX_new.

	Patch from Heikki Vatiainen adds two new functions introduced in OpenSSL 1.1.0, a number 

	of constants and a couple of const qualifiers to SSLeay.xs. Tests and 

	documentation .pod were also updated.

	Patch from Heikki Vatiainen adds one new OpenSSL 1.1.0 function and has a minor fix for 

	LibreSSL version detection:	    

	*   Added support for SSL_use_certificate_chain_file

     	function introduced in OpenSSL 1.1.0.

	*   Fixed LibreSSL version detection to correctly parse

     	LibreSSL minor version.

	Patch from Steffen Ulrich to fix memory leaks in OCSP handling. Thanks.

	Patch from Heikki Vatiainen adds new functions for certificate verification introduced in 

	OpenSSL 1.02, a number of constants, new test data files, new tests and 

	updates to .pod documentation.

	The new functions provide access to the built-in wildcard check 

	functionality available in OpenSSL 1.0.2 and later.

	The patch also adds new tests for the new functions and updates some of 

	the current tests for CTX_set_default_passwd_cb* functions.

	Added X509_STORE_CTX_new and X509_verify_cert.

	SSL_OCSP_response_verify now clears the error queue if OCSP_basic_verify fails but the

	intermediate certificate succeeds. Patch from Stefan Ullrich.

1.82 2017-10-31

	Added support for building under Linuxbrew (a linuxbrew version of MacOS Homebrew)

	Patch from Matthew Altus, that implements SSL_CTX_set_psk_client_callback() and SSL_set_psk_client_callback().

	Patch to build with LibreSSL has no support for NPN

	Also skip the NPN test if the SSL library is LibreSSL.

	Fixed a problem with a variable declaration in ssleay_session_secret_cb_invoke reported by Graham Ollis.

	Significant patch set from Open System Consultants:

	- Bugfix: tlsext_status_cb_invoke(...): free ocsp_response only when allocated.

 	- The same callback is used on a server side for OCSP stapling and in that 

  	 case ocsp_response is NULL and not used.

	 - New feature: Added a binding SSL_set_session_ticket_ext_cb(ssl,callback,data)

	 - A callback used by EAP-FAST/EAP-TEAT to parse and process TLS session ticket.

	 - Tests are in t/local/65_ticket_sharing_2.t

	 - New feature: Added a binding SSL_set_session_ticket_ext(ssl,ticket)

	 - Used by EAP-FAST/EAP-TEAP to define TLS session ticket value.

	 - Tests are in t/local/65_ticket_sharing_2.t

	 - Bugfix: tlsext_ticket_key_cb_invoke(...): allow SHA256 HMAC key to be 32 bytes 

	 instead of 16 bytes (which OpenSSL will pad with zeros up to 32 bytes).

	 - New feature: Added following bindings:

	 - X509_get_ex_data(cert,idx)

	 - X509_get_ex_new_index(argl,argp,new_func,dup_funL,free_func)

	 - X509_get_app_data(cert)

	 - X509_set_ex_data(cert,idx,data)

	 - X509_set_app_data(cert,arg)

	 - X509_STORE_CTX_get_ex_new_index(argl,argp,new_func,dup_func,free_func)

	 - X509_STORE_CTX_get_app_data(x509_store_ctx)

	 - X509_STORE_CTX_set_app_data(x509_store_ctx,arg)

	 - New feature: Added an implementation for SSL_get_finished(ssl,buf,count=2*EVP_MAX_MD_SIZE)

	 - Tests are in t/local/43_misc_functions.t

	 - New feature: Added an implementation for SSL_get_peer_finished(ssl,buf,count=2*EVP_MAX_MD_SIZE)

	 - Tests are in t/local/43_misc_functions.t

	 - Bugfix: SSL_get_keyblock_size(s): Calculate key block size correctly also with AEAD ciphers

	 which don’t use digest functions.

	 - New feature: Added a binding SSL_set_tlsext_status_ocsp_resp(ssl,staple)

	 - Used by a server side to include OCSP staple in ServerHello.

	 - Bugfix: SSL_OCSP_response_verify(ssl,rsp,svreq,flags): check that chain and last are not NULL 

	 before trying to use them.

	 - Bugfix: inc/Module/Install/PRIVATE/Net/SSLeay.pm: Don’t quote include and lib paths.

1.81	 2017-03-28

	Patch from Alexander Bluhm to enable RSA_get_key_parameters with

	LibreSSL. Again.

	Fixed memory leak in X509_get_subjectAltNames. Reported and patched by Jim Westfall.

	Added . to lib path in Makefile.PL and t/local/32_x509_get_cert_info.t

	to accommodate people who are using a perl with -Ddefault_inc_excludes_dot

	or perl 25 or later.

	Fixed build failure if engine support not present. Patch from Paul Green.

	Improvements to  get_my_thread_id to work around possibility of ERRSV not being defined eg on OpenWRT.

	Patch from ETJ permitting configure and build in places with a space in the name.

1.80	 2017-01-05

	 Patch from Steffen Ulrich that fixed unexpected changes in the

	 control flow of the Perl program which seemed to be triggered by the

	 ticket key callback. Thanks Steffen.

1.79	 2017-01-03

	Patch to fix a few inline variable declarations that cause errors for

	older compilers. From Andy Grundman. Thanks.

	Patch: Generated C code is not compatible with MSVC, AIX cc,

	probably others. Added some PREINIT blocks and replaced 2 cases of INIT with

	PREINIT. From Andy Grundman. Thanks.

	Patch to fix: Fails to compile if the OpenSSL library it's built

	against has compression support compiled out. From Stephan

	Wall. Thanks.

	Added RSA_get_key_parameters() to return a list of pointers to RSA key

	internals.

	Patch to fix some documentation typos courtesy gregor herrmann.

	RSA_get_key_parameters() is now only available prior OpenSSL 1.1.

	Testing with openssl-1.1.0b.

1.78	 2016-08-13

	 Fixed broken OCSP code and tests. Broken since 1.75. Patched by

	 Steffen Ullrich. Thanks.

1.77	 2016-08-01

	 Fixed incorrect size to memset in tlsext_ticket_key_cb_invoke.

1.76	 2016-07-31

	 Replaced bzero with memset. Bzero not present on windows.

1.75  2016-07-31

     Compatibility with OpenSSL 1.1, tested with openssl-1.1.0-pre5:

     - Conditionally remove threading locking code, not needed in 1.1

     - Rewrite code that accesses inside X509_ATTRIBUTE struct.

     - SSL_CTX_need_tmp_RSA, SSL_CTX_set_tmp_rsa,

       SSL_CTX_set_tmp_rsa_callback, SSL_set_tmp_rsa_callback support

       not available in 1.1.

     - SSL_session_reused is now native

     - SSL_get_keyblock_size modifed to use new API

     - OCSP functions modified to use new API under 1.1

     - SSL_set_state removed with 1.1

     - SSL_get_state and SSL_state are now equivalent and available in all

       versions

     - SSL_CTX_v2_new removed

     - SESSION_set_master_key removed with 1.1. Code that previously used

       SESSION_set_master_key must now set $secret in the session_secret

       callback set with SSL_set_session_secret_cb

     - With 1.1, $secret in the session_secret

       callback set with SSL_set_session_secret_cb can be changed to alter

       the master key (required by EAP-FAST).

     Added a function EC_KEY_generate_key similar to RSA_generate_key and a

     function EVP_PKEY_assign_EC_KEY similar to EVP_PKEY_assign_RSA. Using

     these functions it is easy to create and use EC keys in the same way as

     RSA keys. Patch provided by Steffen Ullrich. Thanks Steffen.

     Testing with LibreSSL 2.4.1, with compatibility patch from Steffen

     Ullrich. Thanks Steffen.

     Patch from Steffen Ulrich provides  support for cross context (and cross process)

     session sharing using the stateless TLS session tickets. It uses the

     SSL_CTX_set_tlsext_ticket_key_cb function to manage the encryption and

     decryption of the tickets but provides a more simplified

     interface. Includes new function CTX_set_tlsext_ticket_getkey_cb.

     To not conflict with the OpenSSL name in case the more complex interface

     will be implemented ever the current simplified interface is called

     slightly different: CTX_set_tlsext_ticket_*get*key_cb. 

     Added documentation about downloading latest version from SVN.

     Added missing Module/install files to SVN.

1.74 2016-04-12

     README.OSX was missing from the distribution

1.73 2016-04-11

     Added X509_get_X509_PUBKEY. Patch supplied by GUILHEM. Thanks.

     Added README.OSX with instructions on how to build for recent OS X.

     Added info about using OPENSSL_PREFIX to README.Win32.

     Added comments in POD about installation documentation.

     Added '/usr/local/opt/openssl/bin/openssl' to Openssl search path for

     latest version of  OSX homebrew openssl. Patch from Shoichi Kaji.

1.72 2015-09-22

     Fixed a problem where SvPVx_nolen was undefined in some versions of

     perl. Reported by Karen Etheridge. Replaced with SvPV_nolen.

     Fixed a cast warning on Darwin reported by Karen Etheridge. 

1.71 2015-09-18

     Patch from Ben Kaduk: Conditionalise support for MD4, MD5.

     Added support for linking libraries in /usr/local/lib64 for some flavours

     of Linux like RH Tikanga. 

     Fixes to X509_check_host, X509_check_ip, SSL_CTX_set_alpn_protos, and

     SSL_set_alpn_protos so they will compile on MSVC and AIX cc. Thanks to

     AGRUNDMA.

     Fixed typos in documentation for X509_NAME_new and X509_NAME_hash

     incorrect version 1.45 instead of 1.55 given.

     Version number in META.yml is now quoted per request from Satoshi Yagi.

1.70 2015-06-26

     Patch from Alexander Bluhm: The new OpenSSL 1.0.2 X509_check_* functions are not available in

     current LibreSSL.  So disable them in SSLeay.xs.

     Fixed a problem with building against OSX homebrew's openssl. Patch from

     Shoichi Kaji.

     Removed a test in t/local/33_x509_create_cert.t which fails due to

     changes in 1.0.1n and later

1.69 2015-06-04

     Testing with OpenSSL 1.0.2, 1.0.2a. OK.

     Completed LibreSSL compatibility with the kind assistance of Alexander

     Bluhm.

     Improved compatibility with OpenSSL 1.0.2a as suggested by Petr Pisar.

     Added the X509_check_* functions introduced in OpenSSL 1.0.2, contributed

     by Carsten Gaebler.

     Added support for X509_V_FLAG_TRUSTED_FIRST constant, patch from Gisle Aas.

     Patch allows get_keyblock_size to work correctly with 

     OpenSSL 1.0.1 and later versions. Contributed by Heikki Vatiainen.

1.68 2015-01-24

     Fixed a problem on OSX when macports openssl 1.x is installed: headers from

     macport were found but older OSX openssl libraries were linked, resulting

     in "Symbol not found: _EVP_MD_do_all_sorted".

     Added notes about runtime error "no OPENSSL_Applink", when calling

     Net::SSLeay::P_PKCS12_load_file.

1.67 2015-01-17

     Improvements to inc/Module/Install/PRIVATE/Net/SSLeay.pm to handle the

     case whe there are muliple OPENSSLs installed. Patch from HBRAND

     Fixed a documentation error in get_peer_cert_chain, reported by tejas.

     Fixed a problem with building on Windows that prevented correct OpenSSL

     directory detection with version 1.0.1j as delivered with Shining Light OpenSSL.

     Fixed a problem with building on Windows that prevented finding MT or MD

     versions of SSL libraries.

     Updated doc in README.Win32 to build with Microsoft Visual Studio 2010 Express.

     Added Windows crypt32 library to Windows linking as some compilers/platforms seem to

     require it and it is innocuous otherwise. For Steve Hay.

     Fixed a failure in t/external/20_cert_chain.t where some platforms do not

     have HTTPS in /etc/services. Reported and patched by Gisle Aas.

     Recent 1.0.2 betas have dropped the SSLv3_method function. 

     This patch leaves out the function on newer versions, much the same as

     the SSLv2 deprecation is handled. Patch from Tom Molesworth.

     Fix the ALPN test, which was incorrectly failing on OpenSSL due to the

     LibreSSL check (earlier versions bailed out before that line).Patch from

     Tom Molesworth. 

1.66 2014-08-21

     Fixed compile problem with perl prior to 5.8.8, similar to

     RT#76267. Reported by Graham Knop.

     Fixed a problem with Socket::IPPROTO_TCP on early perls.

     After discussions with the community and the original author Sampo

     Kellomaki, the license conditions have been changed to "Perl Artisitic

     License 2.0".

1.65  2014-07-14

     Added note to doc to make it clear that X509_get_subjectAltNames returns a

     packed binary IP address for type 7 - GEN_IPADD.

     Improvements to SSL_OCSP_response_verify to compile under non c99

     compilers. Requested by MERIJNB.

     Port to Android, contributed by Brian Fraser. Includes Android specific

     version of RSA_generate_key.

     Added LibreSSL support, patch provided by Alexander Bluhm. Thanks!

     Patch that fixes the support for SSL_set_info_callback and adds

     SSL_CTX_set_info_callback and SSL_set_state. Support for these functions is

     necessary to either detect renegotiation or to enforce

     renegotiation. Contributed by Steffen Ullrich. Thanks!

     Fixed a problem with SSL_set_state not available on some early OpenSSLs,

     patched by Steffen Ullrich. Thanks!

     Removed arbitrary size limits from calls to tcp_read_all in tcpcat() and

     http_cat().

     Removed unnecessary Debian_SPANTS.txt from MANIFEST. Again.

1.64 2014-06-11

     Fixes for test ocsp.t. Test now does not fail if HTTP::Tiny is not

     installed.

     Fixed repository in META.yml.

     Fixed a problem with SSL_get_peer_cert_chain: if the SSL handshake

     results in an anonymous authentication, like ADH-DES-CBC3-SHA,

     get_peer_cert_chain will not return an empty list, but instead return the

     SSL object. Reported and fixed by Steffen

     Ullrich. Thanks.

     Fixed a problem where patch

     https://git.openssl.org/gitweb/?p=openssl.git;a=commit;h=3009244da47b989c4cc59ba02cf81a4e9d8f8431

     caused a failed test in t/local/33_x509_create_cert.t.

1.63 2014-05-19

     Fixed error in version number in META.yml

1.62 2014-05-19

     Improvements to OCSP support: It turns out that some CA (like Verisign)

     sign the OCSP response with the CA we have in the trust store and don't

     attach this certifcate in the response.  But OpenSSL by itself only

     considers the certificates included in the response and

     SSL_OCSP_response_verify added the certificates in the chain too.

     Now, we also add the trusted CA from the store which

     signed the lowest chain certificate, at least if we could not verify the

     OCSP response without doing it. Patch from Steffen

     Ullrich. Thanks.

     Fixed some compiler warnings.

1.61 2014-05-12

     Changes calloc to Newx and free to Safefree, otherwise there might be

     problems because calloc is done from a different memory pool than free (depends

     on the build options for perl, but seen on Windows). Patch from Steffen

     Ullrich. Thanks.

1.60 2014-05-10

     Fixed a typo in an error message. Patch from gregor herrmann. Thanks.

     Fixed a problem with building with openssl that does not support

     OCSP. Also fixed some newly introduced warnings

     if compiled with -Wall. Patch from Steffen Ullrich. Thanks.

     fix build-failure on most Debian architectures:

     SSLeay.xs: In function 'XS_Net__SSLeay_OCSP_response_results':

     SSLeay.xs:5602:3: error: format not a string literal and no format

     arguments. Patch from  gregor herrmann.

1.59 2014-05-10

     Fixed local/30_error.t, so that tests do not fail if diagnostics are

     enabled.

     Fixed error messages about undefined strings used with length or

     split. Reported and patched by Peter Heuchert.

     Improvements to configuration of OPTIMIZE flags, to prevent overriding

     of perls expected optimization flags. Caution: HPUX aCC optimize options are special.

     SSL_peek() now returns openssl error code as second item when called in

     array context, same as SSL_read. Patch from Andreas Mohr.

     Fixed some warnings.

     Added support for tlsv1.1 tlsv1.2 via $Net::SSLeay::ssl_version. Patch

     from Andreas Mohr.

     Improve examples in 'Using other perl modules based on

     Net::SSLeay'. Patched by Andreas Mohr.

     Added support for OCSP. Patched by Steffen Ullrich. Thanks!

     Added missing t/external/ocsp.t

1.58 2014-01-15

     Always use size_t for strlen() return value, requested by Alexander Bluhm.

     t/external/20_cert_chain.t was missing from dist.

     Version number in META.yml was incorrect

     Improvements to test t/external/20_cert_chain.t to provoke following bug:

     Fixed crash due to SSL_get_peer_cert_chain incorrectly free'ing the chain

     after use.

     Fixed a problem when compiling against openssl where OPENSSL_NO_EC is set.

1.57 2014-01-09

     Fixed remaining problems with test suite: pod coverage and kwalitee tests

     are only enabled with RELEASE_TESTING=1

1.56 2014-01-08

     Fixed a typo in documentation of BEAST Attack, patched by gregor

     herrmann.

     Added LICENSE file copied form OpenSSL distribution to prevent complaints

     from various versions of kwalitee.

     Adjusted license: in META.yml to be 'openssl'

     Adds support for the basic operations necessary to support ECDH for PFS,

     e.g. EC_KEY_new_by_curve_name, EC_KEY_free and SSL_CTX_set_tmp_ecdh.

     Improvements to t/handle/external/50_external.t to handle the case when a

     test connection was not possible. Patched by Alexandr Ciornii.

     Added support for ALPN TLS extension. Patch from Lubomir Rintel. Tested

     with openssl-1.0.2-stable-SNAP-20131205.

     Fix an use-after-free error. Patch from Lubomir Rintel.

     Fixed a problem with  Invalid comparison on OBJ_cmp result in

     t/local/36_verify.t. Contributed by paul.

     Added support for get_peer_cert_chain(). Patch by Markus Benning.

     Fixed a bug that could cause stack faults: mixed up PUTBACK with SPAGAIN in ssleay_RSA_generate_key_cb_invoke()

     a final PUTBACK is needed here. A second issue is also fixed:

     cb->data defaults to &PL_sv_undef but throught the code you do not check

     against &PL_sv_undef, just NULL. 

     To avoid passing the 3rd optional arg at all, do not create it. This fixes all the 

     cb->data checks and wrong refcounts on &PL_sv_undef. Patched by Reini Urban.

     Deleted support for SSL_get_tlsa_record_byname: it is not included in

     OpenSSL git master. 

1.55 2013-06-08

     Added support for TLSV1_1 and TLSV1_2 methods with SSL_CTX_tlsv1_1_new(),

     SSL_CTX_tlsv1_2_new(), TLSv1_1_method() and TLSv1_2_method(), where

     available in the underlying openssl.

     Added CRL support functions X509_CRL_get_ext(), X509_CRL_get_ext_by_NID(),

     X509_CRL_get_ext_count(). Patch from Franck Youssef.

     Fixed a problem which could cause content with a value of '0' to not be

     correctly encoded by do_httpx3 and friends. Reported by Victor Efimov via

     RT.

     Added support for SSL_get_tlsa_record_byname() required for DANE support in

     openssl-1.0.2 and later. SSL_get_tlsa_record_byname() was added to

     OpenSSL with the financial assistance of .SE.

     Testing with openssl-1.0.2-stable-SNAP-20130521.

     Added X509_NAME_new and X509_NAME_hash, patched by Franck Youssef.

     Fixed a number of typos in pod file thanks to dsteinbrunner.

1.54 2013-03-23

     t/data/testcert_cdp.crt.pem_dump and t/data/testcert_cdp.crt.pem were

     missing from MANIFEST.

     Added MANIFEST to svn

     Improvement to test 07_sslecho.t so that if set_cert_and_key fails we

     can tell why.

1.53 2013-03-22

     Added support for SSL_export_keying_material where present (ie in OpenSSL

     1.0.1 and later).

     Changed t/handle/external/50_external.t to use www.airspayce.com instead of

     perldition.org, who no longer have an https server.

     Patch to fix a crash: P_X509_get_crl_distribution_points on an

     X509 certificate with values in the CDP extension which do not have an

     ia5 string will cause a segmentation fault when accessed. Patch from

     Robert Duncan.

     Change in t/local/32_x509_get_cert_info.t to not use

     Net::SSLeay::ASN1_INTEGER_get, since it works differntly on 32 and 64 bit platforms.

     Updated author and distribution location details to airspayce.com

1.52 2013-01-09

     Rebuild package with gnu format tar, to prevent problems with unpacking

     on other systems such as old Solaris,

1.51 2012-12-14

     Fixed a problem where SSL_set_SSL_CTX is not available with

     OpenSSL < 0.9.8f. Reported by Paul.

1.50 2012-12-13 

     Fixed a problem where t/handle/external/50_external.t would crash if any

     of the test sites were not contactable.

     Now builds on VMS. Patch kindly supplied by Craig A. Berry.

     Fixed a few compiler warnings in SSLeay.xs.  Most of them

     are just signed/unsigned pointer mismatches but there is one that actually

     fixes returning what would be an arbitrary value off the stack from

     get_my_thread_id if it happened to be called in a non-threaded build.

     Patch kindly supplied by Craig A. Berry.

     Added README.VMS, contributed by Craig A. Berry.

     Added SSL_set_tlsext_host_name, SSL_get_servername,

     SSL_get_servername_type, SSL_CTX_set_tlsext_servername_callback for

     server side Server Name Indication (SNI) support. Patched by kmx.

     Further mods for VMS building supplied by Craig A. Berry.

     Fixed a problem with C++ comments preventing builds on AIX and

     HPUX. Patched by Gisle Aas.

     perdition.org not available for tests, changed to www.airspayce.com

     Added SSL_FIPS_mode_set

     Improvements to test suite so it succeeds with and without FIPS mode

     enabled. Patch supplied by Petr Pisar.

     Added documentation, warning not to pass UTF-8 data in the content

     argument to post_https. Reported by Jason Terry.

1.49 2012-09-25

     Fixed problem where on some platforms test t/local/07_tcpecho.t would

     bail out if it could not bind port 1212. Now now tries a number of ports to bind to until

     successful.

     Improvements to  unsigned casting contributed by Reini Urban.

     Improvements to Net::SSLeay::read to make it easier to use with non-blocking IO:

      contributed by James Marshall:  It modifies

      Net::SSLeay::read() to return the result from SSL_read() as the second

      return value, if Net::SSLeay::read() is called in list context.  Its

      behavior should be unchanged if called in scalar or void context.  This

      result code seems to be required for full support of non-blocking I/O,

      since users need to handle SSL_ERR_WANT_READ, SSL_ERROR_WANT_WRITE, etc.

      Fixed a problem where t/local/kwalitee.t fails with

       Module::CPANTS::Analyse 0.86. Patch from Paul.

      Fixed a number of typos patched by Giles.

      Fixed a compiler warning from Compiling with gcc-4.4 and -Wall, patched by Giles.	

      Fixed problems with get_https4: documentation was wrong, $header_ref was

       not correctly set and $server_cert was not returned.

      Fixed a problem that could cause a Perl exception about no blength

      method on undef. Reported by "Stephen J. Smith via RT". https://rt.cpan.org/Ticket/Display.html?id=79309 

      Added documentation about how to mitigatxe various SSL/TLS

     vulnerabilities.

     Fixed problem reported by Mike Doherty: SSL_MODE_* are defined in ssl.h, 

     and should be available as constants, but I do not see them listed in constants.h

1.48 2012-04-25

     Removed unneeded Debian_CPANTS.txt from MANIFEST.

     Fixed incorrect documentation about the best way to call CTX_set_options.

     Fixed problem that caused Undefined subroutine utf8::encode @

     t/local/33_x509_create_cert.t (on perl 5.6.2). Thanks to kmx.

     In examples and pod documentations, changed #!/usr/local/bin/perl to #!/usr/bin/perl.

     t/local/06_tcpecho.t now tries a number of ports to bind to until

     successful.

1.47 2012-04-04

     Fixed overlong lines in pod, patch from Salvatore Bonaccorso, Debian Perl

     Group

     Fixed spelling errors in pod, patch from Salvatore Bonaccorso, Debian Perl

     Group

     Fixed extra "garbage" files in 1.46 tarball. Patch from kmx.

     Fixed incorrect fail reports on some 64 bit platforms. Patch from paul.

     Fix to avoid FAIL reports from cpantesters with missing openssl

     Use my_snprintf from ppport.h to prevent link failures with perl 5.8 and

     earlier when compiled with MSVC.

1.46 2012-04-03

     Fixed a problem reported by Atoomic: 

      When bootstrapping Net::SSleay ( with DynaLoader ) if you override the SIG{DIE} signal, using 

      Net::SSLeay will result in an error.

      Recreated META.yml, added META.yml to dist

      Fixed typo: the word "corresponding" was mis-spelled as "coresponding"

       throughout the POD. Patched by kmx.

      Updated META.yml to include repository and bugtracker

     Constants cleanup - removing non existing constants (perhaps from pre-0.9.6 era) - kmx

     Automatic constants.c generation via helper_script/regen_openssl_constants.pl - kmx

     Future changes in constants now under better control via

     t/local/21_constants.t - kmx

     Added missing new files

     Reordering @EXPORT_OK (constants first, functions next) - kmx

     Adding missing 51 constants to @EXPORT_OK + test to keep it in sync - kmx

     Instructions "howto add new constant" added to helper_script/regen_openssl_constants.pl - kmx

     NEWLY INTRODUCED CONSTANTS:

     - Net::SSLeay::ASN1_STRFLGS_ESC_CTRL

     - Net::SSLeay::ASN1_STRFLGS_ESC_MSB

     - Net::SSLeay::ASN1_STRFLGS_ESC_QUOTE

     - Net::SSLeay::ASN1_STRFLGS_RFC2253

     - Net::SSLeay::ERROR_WANT_ACCEPT

     - Net::SSLeay::EVP_PKS_DSA

     - Net::SSLeay::EVP_PKS_EC

     - Net::SSLeay::EVP_PKS_RSA

     - Net::SSLeay::EVP_PKT_ENC

     - Net::SSLeay::EVP_PKT_EXCH

     - Net::SSLeay::EVP_PKT_EXP

     - Net::SSLeay::EVP_PKT_SIGN

     - Net::SSLeay::EVP_PK_DH

     - Net::SSLeay::EVP_PK_DSA

     - Net::SSLeay::EVP_PK_EC

     - Net::SSLeay::EVP_PK_RSA

     - Net::SSLeay::MBSTRING_ASC

     - Net::SSLeay::MBSTRING_BMP

     - Net::SSLeay::MBSTRING_FLAG

     - Net::SSLeay::MBSTRING_UNIV

     - Net::SSLeay::MBSTRING_UTF8

     - Net::SSLeay::OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION

     - Net::SSLeay::OP_CISCO_ANYCONNECT

     - Net::SSLeay::OP_CRYPTOPRO_TLSEXT_BUG

     - Net::SSLeay::OP_LEGACY_SERVER_CONNECT

     - Net::SSLeay::OP_NO_TLSv1_1

     - Net::SSLeay::OP_NO_TLSv1_2

     - Net::SSLeay::OP_SINGLE_ECDH_USE

     - Net::SSLeay::OP_TLS_BLOCK_PADDING_BUG

     - Net::SSLeay::X509_V_FLAG_CHECK_SS_SIGNATURE

     - Net::SSLeay::X509_V_FLAG_EXTENDED_CRL_SUPPORT

     - Net::SSLeay::X509_V_FLAG_POLICY_MASK

     - Net::SSLeay::X509_V_FLAG_USE_DELTAS

     - Net::SSLeay::X509_V_OK

     - Net::SSLeay::XN_FLAG_COMPAT