www/59.html - diff

Return to 59.html CVS log

Up to [local] / www

Diff for /www/59.html between version 1.27 and 1.28

version 1.27, 2016/02/18 01:55:02

version 1.28, 2016/02/18 11:39:14

Line 76

<li>Generic network stack improvements:

<ul>

<li>Remove support for obsolete IPv6 socket options

<li>Remove support for obsolete IPv6 socket options.

<li>...

</ul>

<p>

Line 120

<li>Assorted improvements:

<ul>

<li>doas is a little friendlier to use

<li>doas is a little friendlier to use.

<li>Updated flex

<li>Updated

<li>Updated and improved less

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=flex&sektion=1">flex(1)</a>.

<li>Updated and improved

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=less&sektion=1">less(1)</a>.

<li><a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/macppc/pdisk.8?query=pdisk">pdisk(8)</a> was largely rewritten and pledged.

<li>Renaming files in the root directory of a MSDOS filesystem was fixed.

<li>Many obsolete <a href="http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man5/disktab.5?query=disktab">disktab(5)</a> attributes and entries were removed.

Line 225

Line 227

<li>Added <tt>Certplus CA</tt> root certificate to the default

<tt>cert.pem</tt> file.

<li>Fixed a leak in

in the error path.

<li>Fixed a memory leak and out-of-bounds access in <tt>OBJ_obj2txt</tt>.

<li>Fixed a memory leak and out-of-bounds access in

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=OBJ_nid2obj&sektion=3">OBJ_obj2txt(3)</a>.

<li>Fixed an up-to 7 byte overflow in RC4 when len is not a multiple of

<tt>sizeof(RC4_CHUNK)</tt>.

<li>Added

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=EVP_AEAD_CTX_init&sektion=3">EVP_aead_chacha20_poly1305(3)</a>

which matches the

<tt>AEAD</tt> construction introduced in RFC 7539, which is different

than that already used in TLS with

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=EVP_AEAD_CTX_init&sektion=3">EVP_aead_chacha20_poly1305(3)</a>.

<li>More man pages converted from pod to

format.

<li>Added <tt>COMODO RSA Certification Authority</tt> and

<tt>QuoVadis</tt> root certificates to <tt>cert.pem</tt>.

Line 246

Line 249

(serial 3c:91:31:cb:1f:f6:d0:1b:0e:9a:b8:d0:44:bf:12:be)

root certificate from <tt>cert.pem</tt>.

<li>Fixed incorrect TLS certificate loading by

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=nc&sektion=1">nc(1)</a>.

<li>The following CVEs had been fixed:

<ul>

<li><tt>CVE-2015-3194</tt>—NULL pointer dereference in client

side certificate validation.

<li><tt>CVE-2015-3195</tt>—memory leak in PKCS7, not reachable

from TLS/SSL.

</ul>

<li>Note: The following OpenSSL CVEs did not apply to LibreSSL:

<ul>

<li><tt>CVE-2015-3193</tt>—carry propagating bug in the x86_64

Montgomery squaring procedure.

<li><tt>CVE-2015-3196</tt>—double free race condition of the

identify hint data.

</ul>

<li>Code improvements:

Line 270

Line 273

<li>SSLv3 is now permanently removed from the tree.

<li>The <tt>libtls</tt> API is changed from the 2.2.x series:

<ul>

<li>The

and

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tls_init&sektion=3">tls_write(3)</a>

functions now work better with external event libraries.

<li>Client-side verification is now supported, with the client

supplying the certificate to the server.

<li>Also, when using

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tls_init&sektion=3">tls_connect_fds(3)</a>,

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tls_init&sektion=3">tls_connect_socket(3)</a>

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tls_init&sektion=3">tls_accept_fds(3)</a>,

<tt>libtls</tt> no longer implicitly closes the passed in sockets.

The caller is responsible for closing them in this case.

</ul>

<li>New interface <tt>OPENSSL_cpu_caps</tt> is provided that does not

allow software to inadvertently modify cpu capability flags.

Line 292

Line 295

<tt>ssize_t</tt> to <tt>size_t</tt>.

<li>Deduplicated DTLS code, sharing bugfixes and improvements with TLS.

<li>Converted

to use <tt>libtls</tt> for client and server operations; it is

included in the libressl-portable distribution as an example of how

to use the <tt>libtls</tt> library. This is intended to be a simpler

Line 306

Line 309

<tt>libtls</tt>.

<li>Added ability to check certificate validity times with

<tt>libtls</tt>,

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tls_init&sektion=3">tls_peer_cert_notbefore(3)</a>

and

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tls_init&sektion=3">tls_peer_cert_notafter(3)</a>.

<li>Changed

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=tls_init&sektion=3">tls_connect_servername(3)</a>

to use the first address that resolves with

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=getaddrinfo&sektion=3">getaddrinfo(3)</a>.

<li>Remove broken conditional <tt>EVP_CHECK_DES_KEY</tt> code

(non-functional since initial commit in 2004).

<li>Reject too small bits value in

<a href="http://www.openbsd.org/cgi-bin/man.cgi?query=BN_generate_prime&sektion=3">BN_generate_prime_ex(3)</a>,

so that it does not risk becoming negative in

<tt>probable_prime_dh_safe()</tt>.

<li>Changed format of <tt>LIBRESSL_VERSION_NUMBER</tt> to match that of