[BACK]Return to 68.html CVS log [TXT][DIR] Up to [local] / www

Diff for /www/68.html between version 1.53 and 1.54

version 1.53, 2020/10/08 10:26:26 version 1.54, 2020/10/08 10:29:49
Line 453 
Line 453 
         <li>Removed <a href="https://man.openbsd.org/mail.local">mail.local(8)</a> support for world-writable mail spools.          <li>Removed <a href="https://man.openbsd.org/mail.local">mail.local(8)</a> support for world-writable mail spools.
   </ul>    </ul>
   
 <li>LibreSSL 3.1.1 XXX <span style="color:red;">Temporary List, replace with LibreSSL ChangeLog:</span>  <li>LibreSSL 3.2.2
   <ul>    <ul>
 <li>Enabled the TLSv1.3 server in <a href="https://man.openbsd.org/openssl">openssl(1)</a>.  
 <li>Added -rls1_3 and -no_tls1_3 options to <a href="https://man.openbsd.org/openssl">openssl(1)</a> s_server.  
 <li>Enabled TLSv1.3 support in <a href="https://man.openbsd.org/relayd">relayd(8)</a>.  
 <li>Added a decode error alert when a TLS server provides an empty certificate list.  
 <li>Added support for TLS 1.3 server to send certificate status messages with OCSP staples.  
 <li>Began looking for non-expired certificates first when building a chain, making certificate validation possible for various sites that are serving expired AddTrust certificates.  
 <li>Improved TLSv1.3 client certificate selection to allow use of EC certificates.  
 <li>Added <a href="https://man.openbsd.org/ssl">ssl(8)</a> support for additional GOST curves and aliases for 256-bit GOST curves.  
 <li>Enabled TLSv1.3 for the generic TLS_method().  
 <li>Fixed potential use-after-free and double-free issues in <a href="https://man.openbsd.org/PEM_X509_INFO_read_bio">PEM_X509_INFO_read_bio(3)</a>.  
 <li>Corrected <a href="https://man.openbsd.org/ssl">ssl(8)</a> handling of server requests for an OCSP response.  
 <li>Added P-521 to the list of curves supported by default for TLS.  
 <li>Released <a href="https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.1.4-relnotes.txt">LibreSSL 3.1.4</a>.  
 <li>Released <a href="https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.1-relnotes.txt">LibreSSL 3.2.1</a>.  
 <li>Fixed a memory leak in x509_constraints_extract_names.  
   </ul>  
   <ul>  
     <li>New Features      <li>New Features
     <ul>      <ul>
         <li>...          <li>This is the first stable release with the new TLSv1.3 implementation
               enabled for both server and client.
               The OpenSSL TLSv1.3 API is not yet available and will be provided
               in an upcoming release.
   
           <li>New X509 certificate chain validator loosely based on Go's X509 validator.
     </ul>      </ul>
   
     <li>API and Documentation Enhancements      <li>API and Documentation Enhancements
     <ul>      <ul>
         <li>...          <li>New CMAC_Init(3) and ChaCha(3) manual pages.
           <li>Document SSL_set1_host(3), SSL_set_SSL_CTX(3).
           <li>Document PKCS7 attribute functions.
           <li>Document PKCS7_final(3), PKCS7_add_attribute(3).
           <li>Document PKCS7_get_signer_info(3).
           <li>Document PEM_ASN1_read(3) and PEM_ASN1_read_bio(3).
           <li>Document PEM_X509_INFO_read(3) and PEM_X509_INFO_read_bio(3).
           <li>Document PEM_def_callback(3).
           <li>Document EVP_read_pw_string_min(3).
           <li>Merge documentation of X509_get0_serialNumber from OpenSSL 1.1.1.
           <li>Document error handling of X509_PUBKEY_get0(3) and X509_PUBKEY_get(3)
           <li>Document X509_get0_pubkey_bitstr(3).
           <li>Document openssl(1) certhash.
     </ul>      </ul>
   
     <li>Compatibility Changes      <li>Compatibility Changes
     <ul>      <ul>
         <li>...          <li>Modify I/O behavior so that SSL_MODE_AUTO_RETRY is the default similar to new OpenSSL releases.
           <li>Add the P-521 curve to the list of curves supported by default in the client.
           <li>Define OPENSSL_NO_SSL_TRACE in opensslfeatures.h.
           <li>Make SSL_CTX_get_ciphers(NULL) return NULL rather than crash.
           <li>Improve TLSv1.3 client certificate selection to allow EC certificates instead of only RSA certificates.
           <li>Add minimal info callback support for TLSv1.3.
           <li>Support TLS 1.3 options in the openssl(1) command.
           <li>Add support for additional GOST curves from RFC 7836 and draft-deremin-rfc4491-bis.
           <li>Add OIDs for HMAC using the Streebog hash function.
           <li>Allow GOST R 34.11-2012 in PBE/PBKDF2/PKCS#5.
           <li>Enable GOST_SIG_FORMAT_RS_LE when verifying certificate signatures.
           <li>Handle GOST in ssl_cert_dup().
           <li>Stop sending GOST R 34.10-94 as a CertificateType.
           <li>Use IANA allocated GOST ClientCertificateTypes.
     </ul>      </ul>
   
     <li>Testing and Proactive Security      <li>Testing and Proactive Security
     <ul>      <ul>
         <li>...          <li>Greatly expanded test coverage via the tlsfuzzer test scripts.
           <li>Test interoperability with the Botan TLS client.
     </ul>      </ul>
   
     <li>Internal Improvements      <li>Internal Improvements
       <ul>        <ul>
         <li>...          <li>Collapse x509v3 directory into x509.
           <li>Add initial support for openbsd/powerpc64.
           <li>Improve length checks in the TLS 1.3 record layer and provide appropriate alerts for violations of record layer limits.
           <li>Enforce that SNI hostnames received by the TLS server are correctly formed as per RFC 5890 and RFC 6066, responding with illegal parameter for a nonconformant host name.
           <li>Support SSL_MODE_AUTO_RETRY in TLS 1.3 to allow the automatic retry of handshake messages.
           <li>Improve the handling of BIO_read()/BIO_write() failures in the TLSv1.3 stack.
           <li>Start replacing the existing TLSv1.2 record layer.
           <li>Simplify SSL method lookups.
           <li>Clean up and simplify SSL_get_ciphers(), SSL_set_session(), SSL_set_ssl_method() and several internal functions.
           <li>Refactor dtls1_new(), dtls1_hm_fragment_new(), dtls1_drain_fragments(), dtls1_clear_queues().
           <li>Make the message type available in the internal TLS extensions API functions.
           <li>Numerous openssl(1) subcommands were converted to the new option handling.
           <li>Copy the session ID directly in ssl_get_prev_session() instead of handing it through several functions for copying.
       </ul>        </ul>
   
     <li>Portable Improvements      <li>Portable Improvements
     <ul>      <ul>
         <li>...          <li>Make pthread_mutex static initialisation work on Windows.
           <li>Get __STRICT_ALIGNMENT from machine/endian.h with portable build.
     </ul>      </ul>
   
     <li>Bug Fixes      <li>Bug Fixes
     <ul>      <ul>
         <li>...          <li>Fix an off-by-one in the CBC padding removal.
           <li>Enforce in the TLSv1.3 server that that ClientHello messages after a HelloRetryRequest match the original ClientHello as per RFC 8446 section 4.1.2
           <li>Avoid calling freezero with a negative size if a server sends a malformed plaintext of all zeroes.
           <li>Correct use of sockaddr_storage instead of sockaddr in openssl(1) s_client, which could lead to using 14 bytes of stack garbage instead of an IPv6 address in DTLS mode.
           <li>Fix a longstanding bug in PEM_X509_INFO_read_bio(3) that could cause use-after-free and double-free issues in calling programs.
           <li>Zero out variable on the stack to avoid leaving garbage in the tail of short session IDs.
           <li>Ensure that appropriate alerts are sent on various error conditions.
           <li>Move state initialization from SSL_clear() to ssl3_clear() to ensure that it gets correctly reinitialized across a SSL_set_ssl_method() call.
           <li>Add a custom copy handler for AES keywrap to fix a use-after-free.
           <li>Avoid an out-of-bounds write in BN_rand().
           <li>Fix numerous leaks in the UI_dup_* functions. Simplify and tidy up the code in ui_lib.c.
           <li>Correctly track selected ALPN length to avoid a potential segmentation fault with SSL_get0_alpn_selected() when alpn_selected is NULL.
           <li>Include machine/endian.h gost2814789.c in order to pick up the __STRICT_ALIGNMENT define.
           <li>Correctly handle ssl_cert_dup() failure in SSL_set_SSL_CTX().
           <li>Fail on receiving an invalid NID in X509_ATTRIBUTE_create() instead of constructing a broken objects that may cause NULL pointer accesses.
           <li>Fix SSL_shutdown behavior in TLSv1.3 to match the legacy stack.  The previous behavior could cause a hang.
           <li>Modify "openssl x509" to display invalid certificate times as invalid, and correctly deal with the failing return case from X509_cmp_time so that a certificate with an invalid NotAfter does not appear valid.
     </ul>      </ul>
   </ul>    </ul>
   
Legend:
Removed from v.1.53  
changed lines
  Added in v.1.54