183 lines
6.1 KiB
Plaintext
183 lines
6.1 KiB
Plaintext
Because this project is maintained both in the OpenBSD tree using CVS and in
|
|
Git, it can be confusing following all of the changes.
|
|
|
|
Most of the libssl and libcrypto source code is is here in OpenBSD CVS:
|
|
|
|
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libssl/
|
|
|
|
Some of the libcrypto and OS-compatibility files for entropy and random number
|
|
generation are here:
|
|
|
|
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libcrypto/
|
|
|
|
A new simplified SSL wrapper library is here:
|
|
|
|
http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/lib/libtls/
|
|
|
|
The LibreSSL Portable project copies these portions of the OpenBSD tree, along
|
|
with relevant portions of the C library, to a Git repository. This makes it
|
|
easier to follow all of the relevant changes to the upstream project in a
|
|
single place:
|
|
|
|
https://github.com/libressl-portable/openbsd/commits/master
|
|
|
|
The portable bits of the project are largely maintained out-of-tree, and their
|
|
history is also available from Git.
|
|
|
|
https://github.com/libressl-portable/portable/commits/master
|
|
|
|
LibreSSL Portable Release Notes:
|
|
|
|
2.1.4 - Security and feature updates
|
|
* Improvements to libtls:
|
|
|
|
* a new API for loading CA chains directly from memory instead of a
|
|
file, allowing verification with privilege separation in a chroot
|
|
without direct access to CA certificate files.
|
|
|
|
* Ciphers default to TLSv1.2 with AEAD and PFS.
|
|
|
|
* Improved error handling and message generation
|
|
|
|
* New APIs and improved documentation
|
|
|
|
* Added X509_STORE_load_mem API for loading certificates from memory.
|
|
This facilitates accessing certificates from a chrooted environment.
|
|
|
|
* New AEAD "MAC alias" allows configuring TLSv1.2 AEAD ciphers by
|
|
using 'TLSv1.2+AEAD' as the cipher selection string.
|
|
|
|
* Dead and disabled code removal including MD5, Netscape workarounds,
|
|
non-POSIX IO, SCTP, RFC 3779 support, many #if 0 sections, and more.
|
|
|
|
* ASN1 macro maze expanded to aid reading and searching the code.
|
|
|
|
* NULL pointer asserts removed in favor of letting the OS/signal
|
|
handler catch them.
|
|
|
|
* Refactored argument handling in openssl(1) for consistency and
|
|
maintainability.
|
|
|
|
* New openssl(1) command 'certhash' replaces the c_rehash script.
|
|
|
|
* Support for building with OPENSSL_NO_DEPRECATED
|
|
|
|
* Dozens of issues found with the Coverity scanner fixed.
|
|
|
|
* Server-side support for TLS_FALLBACK_SCSV for compatibility with
|
|
various auditor and vulnerability scanners.
|
|
|
|
2.1.3 - Security update and OS support improvements
|
|
* Fixed various memory leaks in DTLS, including fixes for
|
|
CVE-2015-0206.
|
|
|
|
* Added Application-Layer Protocol Negotiation (ALPN) support.
|
|
|
|
* Removed GOST R 34.10-94 signature authentication.
|
|
|
|
* Removed nonfunctional Netscape browser-hang workaround code.
|
|
|
|
* Simplfied and refactored SSL/DTLS handshake code.
|
|
|
|
* Added SHA256 Camellia cipher suites for TLS 1.2 from RFC 5932.
|
|
|
|
* Hide timing info about padding errors during handshakes.
|
|
|
|
* Improved libtls support for non-blocking sockets, added randomized
|
|
session ID contexts. Work is ongoing with this library - feedback
|
|
and potential use-cases are welcome.
|
|
|
|
* Support building Windows DLLs.
|
|
Thanks to Jan Engelhard.
|
|
|
|
* Packaged config wrapper for better compatibility with OpenSSL-based
|
|
build systems.
|
|
Thanks to @technion from github
|
|
|
|
* Ensure the stack is marked non-executable for assembly sections.
|
|
Thanks to Anthony G. Bastile.
|
|
|
|
* Enable extra compiler hardening flags by default, where applicable.
|
|
The default set of hardening features can vary by OS to OS, so
|
|
feedback is welcome on this. To disable the default hardening flags,
|
|
specify '--disable-hardening' during configure.
|
|
Thanks to Jim Barlow
|
|
|
|
* Initial HP-UX support, tested with HP-UX 11.31 ia64
|
|
Thanks to Kinichiro Inoguchi
|
|
|
|
* Initial NetBSD support, tested with NetBSD 6.1.5 x86_64
|
|
Imported from OpenNTPD, thanks to @gitisihara from github
|
|
|
|
2.1.2 - Many new features and improvements
|
|
* Added reworked GOST cipher suite support
|
|
thanks to Dmitry Eremin-Solenikov
|
|
|
|
* Enabled Camellia ciphers due to improved patent situation
|
|
|
|
* Use builtin arc4random implementation on OS X and FreeBSD
|
|
this addresses some deficiencies in the native implementations of
|
|
these operating systems, see commit logs for more information
|
|
|
|
* Added initial Windows mingw-w64 support (32 and 64-bit)
|
|
thanks to Song Dongsheng and others for code and feedback
|
|
|
|
* Enabled assembly optimizations on x86_64 CPUs
|
|
supports Linux, *BSD, Solaris and OS X operating systems
|
|
thanks to Wouter Clarie for the initial implementation
|
|
|
|
* Added no_ssl3/no_tls1_1/no_tls1_2 options to openssl(1)
|
|
|
|
* Improved build infrastructure, 'make distcheck' now passes
|
|
this simplifies and speeds developer efficiency
|
|
thanks to Dmitry Eremin-Solenikov and Wouter Clarie
|
|
|
|
* Allow conditional building of the libtls library
|
|
expect the API and ABI of the library to change
|
|
feedback is welcome
|
|
|
|
* Fixes for more memory leaks, cleanups, etc.
|
|
|
|
2.1.1 - Security update
|
|
* Address POODLE attack by disabling SSLv3 by default
|
|
|
|
* Fix Eliptical Curve cipher selection bug
|
|
(https://github.com/libressl-portable/portable/issues/35)
|
|
|
|
2.1.0 - First release from the OpenBSD 5.7 tree
|
|
* Added support for automatic ephemeral EC keys
|
|
|
|
* Fixes for many memory leaks and overflows in error handlers
|
|
|
|
* The TLS padding extension (that works around bugs in F5 terminators) is
|
|
off by default
|
|
|
|
* support for getrandom(2) on Linux 3.17
|
|
|
|
* the NO_ASM macro is no longer being set, providing the first bits toward
|
|
enabling other assembly offloads.
|
|
|
|
2.0.5 - Fixes for CVEs from OpenSSL 1.0.1i
|
|
* CVE-2014-3506
|
|
* CVE-2014-3507
|
|
* CVE-2014-3508 (partially vulnerable)he
|
|
* CVE-2014-3509
|
|
* CVE-2014-3510
|
|
* CVE-2014-3511
|
|
* Synced LibreSSL Portable with the release version of OpenBSD 5.6
|
|
|
|
2.0.4 - Portability fixes, deleted unused SRP code
|
|
|
|
2.0.3 - Portability fixes, improvements to fork detection
|
|
|
|
2.0.2 - Address arc4random fork PID wraparound issues with pthread_atfork
|
|
|
|
2.0.1 - Portability fixes:
|
|
* Removed -Werror and and other non-portable compiler flags
|
|
|
|
* Allow setting OPENSSLDIR and ENGINSDIR
|
|
|
|
2.0.0 - First release from the OpenBSD 5.6 tree
|
|
* Removal of many obsolete features and coding conventions from the OpenSSL
|
|
1.0.1h source
|