===================================================================
RCS file: /cvsrepo/anoncvs/cvs/www/68.html,v
retrieving revision 1.53
retrieving revision 1.54
diff -c -r1.53 -r1.54
*** www/68.html 2020/10/08 10:26:26 1.53
--- www/68.html 2020/10/08 10:29:49 1.54
***************
*** 453,510 ****
Removed mail.local(8) support for world-writable mail spools.
! LibreSSL 3.1.1 XXX Temporary List, replace with LibreSSL ChangeLog:
- - Enabled the TLSv1.3 server in openssl(1).
-
- Added -rls1_3 and -no_tls1_3 options to openssl(1) s_server.
-
- Enabled TLSv1.3 support in relayd(8).
-
- Added a decode error alert when a TLS server provides an empty certificate list.
-
- Added support for TLS 1.3 server to send certificate status messages with OCSP staples.
-
- Began looking for non-expired certificates first when building a chain, making certificate validation possible for various sites that are serving expired AddTrust certificates.
-
- Improved TLSv1.3 client certificate selection to allow use of EC certificates.
-
- Added ssl(8) support for additional GOST curves and aliases for 256-bit GOST curves.
-
- Enabled TLSv1.3 for the generic TLS_method().
-
- Fixed potential use-after-free and double-free issues in PEM_X509_INFO_read_bio(3).
-
- Corrected ssl(8) handling of server requests for an OCSP response.
-
- Added P-521 to the list of curves supported by default for TLS.
-
- Released LibreSSL 3.1.4.
-
- Released LibreSSL 3.2.1.
-
- Fixed a memory leak in x509_constraints_extract_names.
-
-
- New Features
- API and Documentation Enhancements
- Compatibility Changes
- Testing and Proactive Security
- Internal Improvements
- Portable Improvements
- Bug Fixes
--- 453,553 ----
Removed mail.local(8) support for world-writable mail spools.
! LibreSSL 3.2.2
- New Features
! - This is the first stable release with the new TLSv1.3 implementation
! enabled for both server and client.
! The OpenSSL TLSv1.3 API is not yet available and will be provided
! in an upcoming release.
!
!
- New X509 certificate chain validator loosely based on Go's X509 validator.
- API and Documentation Enhancements
! - New CMAC_Init(3) and ChaCha(3) manual pages.
!
- Document SSL_set1_host(3), SSL_set_SSL_CTX(3).
!
- Document PKCS7 attribute functions.
!
- Document PKCS7_final(3), PKCS7_add_attribute(3).
!
- Document PKCS7_get_signer_info(3).
!
- Document PEM_ASN1_read(3) and PEM_ASN1_read_bio(3).
!
- Document PEM_X509_INFO_read(3) and PEM_X509_INFO_read_bio(3).
!
- Document PEM_def_callback(3).
!
- Document EVP_read_pw_string_min(3).
!
- Merge documentation of X509_get0_serialNumber from OpenSSL 1.1.1.
!
- Document error handling of X509_PUBKEY_get0(3) and X509_PUBKEY_get(3)
!
- Document X509_get0_pubkey_bitstr(3).
!
- Document openssl(1) certhash.
- Compatibility Changes
! - Modify I/O behavior so that SSL_MODE_AUTO_RETRY is the default similar to new OpenSSL releases.
!
- Add the P-521 curve to the list of curves supported by default in the client.
!
- Define OPENSSL_NO_SSL_TRACE in opensslfeatures.h.
!
- Make SSL_CTX_get_ciphers(NULL) return NULL rather than crash.
!
- Improve TLSv1.3 client certificate selection to allow EC certificates instead of only RSA certificates.
!
- Add minimal info callback support for TLSv1.3.
!
- Support TLS 1.3 options in the openssl(1) command.
!
- Add support for additional GOST curves from RFC 7836 and draft-deremin-rfc4491-bis.
!
- Add OIDs for HMAC using the Streebog hash function.
!
- Allow GOST R 34.11-2012 in PBE/PBKDF2/PKCS#5.
!
- Enable GOST_SIG_FORMAT_RS_LE when verifying certificate signatures.
!
- Handle GOST in ssl_cert_dup().
!
- Stop sending GOST R 34.10-94 as a CertificateType.
!
- Use IANA allocated GOST ClientCertificateTypes.
- Testing and Proactive Security
! - Greatly expanded test coverage via the tlsfuzzer test scripts.
!
- Test interoperability with the Botan TLS client.
- Internal Improvements
! - Collapse x509v3 directory into x509.
!
- Add initial support for openbsd/powerpc64.
!
- Improve length checks in the TLS 1.3 record layer and provide appropriate alerts for violations of record layer limits.
!
- Enforce that SNI hostnames received by the TLS server are correctly formed as per RFC 5890 and RFC 6066, responding with illegal parameter for a nonconformant host name.
!
- Support SSL_MODE_AUTO_RETRY in TLS 1.3 to allow the automatic retry of handshake messages.
!
- Improve the handling of BIO_read()/BIO_write() failures in the TLSv1.3 stack.
!
- Start replacing the existing TLSv1.2 record layer.
!
- Simplify SSL method lookups.
!
- Clean up and simplify SSL_get_ciphers(), SSL_set_session(), SSL_set_ssl_method() and several internal functions.
!
- Refactor dtls1_new(), dtls1_hm_fragment_new(), dtls1_drain_fragments(), dtls1_clear_queues().
!
- Make the message type available in the internal TLS extensions API functions.
!
- Numerous openssl(1) subcommands were converted to the new option handling.
!
- Copy the session ID directly in ssl_get_prev_session() instead of handing it through several functions for copying.
- Portable Improvements
! - Make pthread_mutex static initialisation work on Windows.
!
- Get __STRICT_ALIGNMENT from machine/endian.h with portable build.
- Bug Fixes
! - Fix an off-by-one in the CBC padding removal.
!
- Enforce in the TLSv1.3 server that that ClientHello messages after a HelloRetryRequest match the original ClientHello as per RFC 8446 section 4.1.2
!
- Avoid calling freezero with a negative size if a server sends a malformed plaintext of all zeroes.
!
- Correct use of sockaddr_storage instead of sockaddr in openssl(1) s_client, which could lead to using 14 bytes of stack garbage instead of an IPv6 address in DTLS mode.
!
- Fix a longstanding bug in PEM_X509_INFO_read_bio(3) that could cause use-after-free and double-free issues in calling programs.
!
- Zero out variable on the stack to avoid leaving garbage in the tail of short session IDs.
!
- Ensure that appropriate alerts are sent on various error conditions.
!
- Move state initialization from SSL_clear() to ssl3_clear() to ensure that it gets correctly reinitialized across a SSL_set_ssl_method() call.
!
- Add a custom copy handler for AES keywrap to fix a use-after-free.
!
- Avoid an out-of-bounds write in BN_rand().
!
- Fix numerous leaks in the UI_dup_* functions. Simplify and tidy up the code in ui_lib.c.
!
- Correctly track selected ALPN length to avoid a potential segmentation fault with SSL_get0_alpn_selected() when alpn_selected is NULL.
!
- Include machine/endian.h gost2814789.c in order to pick up the __STRICT_ALIGNMENT define.
!
- Correctly handle ssl_cert_dup() failure in SSL_set_SSL_CTX().
!
- Fail on receiving an invalid NID in X509_ATTRIBUTE_create() instead of constructing a broken objects that may cause NULL pointer accesses.
!
- Fix SSL_shutdown behavior in TLSv1.3 to match the legacy stack. The previous behavior could cause a hang.
!
- Modify "openssl x509" to display invalid certificate times as invalid, and correctly deal with the failing return case from X509_cmp_time so that a certificate with an invalid NotAfter does not appear valid.