aboutsummaryrefslogtreecommitdiff
path: root/ChangeLog
diff options
context:
space:
mode:
authorTheo Buehler <tb@openbsd.org>2020-10-03 12:28:51 +0200
committerTheo Buehler <tb@openbsd.org>2020-10-03 13:15:06 +0200
commit2dc9f8e3733edf19f2826a9aa34f9645f79aec82 (patch)
tree5b3e2f797ed208bf2f2be1a81edbc3e205ba3557 /ChangeLog
parent17c88164016df821df2dff4b2b1291291ec4f28a (diff)
downloadportable-2dc9f8e3733edf19f2826a9aa34f9645f79aec82.tar.gz
portable-2dc9f8e3733edf19f2826a9aa34f9645f79aec82.tar.bz2
portable-2dc9f8e3733edf19f2826a9aa34f9645f79aec82.zip
Initial cut of the 3.2.2 ChangeLog
Diffstat (limited to 'ChangeLog')
-rw-r--r--ChangeLog188
1 files changed, 188 insertions, 0 deletions
diff --git a/ChangeLog b/ChangeLog
index 8a70b14..76dadd3 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -28,6 +28,194 @@ history is also available from Git.
28 28
29LibreSSL Portable Release Notes: 29LibreSSL Portable Release Notes:
30 30
313.2.2 - Stable release
32
33 * Simplify handling of allocation handling in SSL_new().
34
35 * Use SSL3_SEQUENCE_SIZE for last_write_sequence[].
36
37 * Use 0 instead of 0x00 in memset() calls in DTLS code.
38
39 * Increment the epoch in the same place for both read and write.
40
41 * Send an unexpected message alert if no valid content type is found.
42
43 * Define OPENSSL_NO_SSL_TRACE in opensslfeatures.h.
44
45 * Start replacing the existing TLSv1.2 record layer.
46
47 * Send alert on ssl_get_prev_session() failure.
48
49 * Simplify return codes for tls1_process_ticket() and
50 tls_decrypt_ticket().
51
52 * Simplify tls_decrypt_ticket() exit path.
53
54 * Copy the session ide directly in ssl_get_prev_session() instead of
55 handing it through several functions for copying.
56
57 * Split session retrieval out of ssl_get_prev_session().
58
59 * Zero out variable on the stack to avoid leaving garbage in the tail
60 of short session ids.
61
62 * Remove unnecessary zeroing after recallocarray() in
63 ASN1_BIT_STRING_set_bit().
64
65 * Rewrite X509_INFO_{new,free}() more idiomatically.
66
67 * Import commented versions of the latest OPENSSL_NO_* flags from
68 OpenSSL 1.1.1g.
69
70 * Document return value from EC_KEY_get0_public_key(3).
71
72 * Set alpn_selected_len = 0 whenever alpn_selected is NULL.
73
74 * Add option type OPTION_UL_VALUE_OR to openssl(1) option parser.
75
76 * Convert openssl(1) ocsp option handling.
77
78 * Major style cleanup in ocsp.c.
79
80 * Assorted ciphers related cleanup in ssl_lib.c.
81
82 * Add issuer cache in preparation for changes to the validation code.
83
84 * Replace some SSL_AD_* with TLS13_ALERT_* defines in the new TLSv1.3
85 code.
86
87 * Rename ssl_cipher_is_permitted() to the more accurate and specific
88 ssl_cipher_allowed_in_version_range().
89
90 * Simplify SSL_get_ciphers().
91
92 * Remove cipher_list_by_id.
93
94 * Add a new implementation of X509 name constraints with regrssion
95 tests.
96
97 * Fix and re-enable cert and cipher interop tests.
98
99 * Include machine/endian.h gost2814789.c in order to pick up the
100 __STRICT_ALIGNMENT define.
101
102 * Enable the new X509 name constraints verification.
103
104 * Avoid an out-of-bounds write in BN_rand().
105
106 * Simplify tls1_set_ec_id().
107
108 * Use uint16_t for curve_id.
109
110 * Improve the handling of BIO_read()/BIO_write() failures in the
111 TLSv1.3 stack.
112
113 * Add a new certificate chain validator.
114
115 The new validator finds multiple validated chains to handle the
116 modern PKI cases which may frequently have multiple paths via
117 different intermediates to different roots. It is loosely based on
118 golang's x509 validator.
119
120 This includes integration so that the new validator can be used via
121 X509_verify_cert() as well as a new API x509_verify() which will
122 return multiple chains (similar to go).
123
124 The new public API is not yet exposed, and will be finalized and
125 exposed with a man page and a library minor bump later.
126
127 * Implement SSL_{CTX_,}set_ciphersuites() and add regress. This is not
128 yet public API and will be enabled in a future release.
129
130 * Enable the use of the new X509 chain validator by default.
131
132 * Fix double frees and a NULL dereference introduced on review of the
133 new validator.
134
135 * Remove various unused variables in the X509 code.
136
137 * Fix memory leaks in x509_constraints_chain() and
138 X509V3_ext_add_alias().
139
140 * Add initial manual page for the x509_verify() chain validator which
141 will be installed once the new API is publically exposed.
142
143 * Avoid NULL deref in SSL_{,CTX_}set_ciphersuites().
144
145 * Clean up and simplify SSL_set_session().
146
147 * Move state initialization from SSL_clear() to ssl3_clear() to ensure
148 that it gets correctly reinitialized accross a SSL_set_ssl_method()
149 call.
150
151 * Test the botan TLS client with LibreSSL, OpenSSL 1.0.2 and 1.1.1
152 servers.
153
154 * Mop up the get_ssl_method function pointer.
155
156 * Clean up and simplify SSL_set_ssl_method().
157
158 * Deduplicate the time validation code between the legacy and the new
159 verifcation code.
160
161 * Set error_depth and current_cert to avoid problems in legacy
162 callbacks that don't do proper error checking.
163
164 * Correct a failure case in tls12_record_layer_esal_record_protected().
165
166 * Do not destroy an existing cipher list when ssl_parse_ciphersuites()
167 fails to match the behavior of ssl_create_cipher_list() and
168 SSL_set_ciphersuites() of OpenSSL.
169
170 * Split the tls12_record_layer_write_mac() for future reuse on the
171 read side.
172
173 * Dedup code in X509_verify_ctx_new_from_xsc().
174
175 * Make check in x509_verify_ctx_set_max_signatures() consistent with
176 others.
177
178 * Avoid memset() before memcpy() for CBS_add_bytes().
179
180 * Make SSL_CTX_get_ciphers(NULL) return NULL rather than crash.
181
182 * Simplify SSL method lookups.
183
184 * Prepare to provide most of the TLSv1.3-related OpenSSL 1.1.1 API.
185 This will be finished in an upcoming release.
186
187 * Fix an overflow in the CN subject line parsing.
188
189 * Correctly handle ssl_cert_dup() failure in SSL_set_SSL_CTX().
190
191 * Fix memory leaks in x509_constraints_extract_names().
192
193 * Correct a 1 byte read overflow in x509_constraints_uri().
194
195 * Ensure the chain is set on the X509_STORE_CTX before triggering
196 callback.
197
198 * Release read and write buffers using freezero()
199
200 * Simplify the cleanup of init_buf via an ssl3_release_init_buffer()
201 function.
202
203 * Fix numerous leaks in the UI_dup_* functions.
204
205 * Simplify and tidy up hte code in ui_lib.c.
206
207 * Refactor dtls1_clear_queues() to make it NULL safe.
208
209 * Have dtls1_hm_fragment_new() call dtls1_hm_fragment_free() on
210 failure.
211
212 * Have dtls1_new() call dtls1_free() on failure.
213
214 * Call dtls1_hm_fragment_free() from dtls1_drain_fragments() to fix
215 potential memory leaks.
216
217 * Ensure that leaf is set up on X509_STORE_CTX before verification.
218
313.2.1 - Development release 2193.2.1 - Development release
32 220
33 * Propagate alerts from the read half of the TLSv1.3 record layer to I/O 221 * Propagate alerts from the read half of the TLSv1.3 record layer to I/O
generated by cgit v1.2.3-55-g6feb (git 2.39.1) at 2025-03-18 17:49:51 +0000