@@ -19,21 +19,129 @@ with relevant portions of the C library, to a Git repository. This makes it
1919easier to follow all of the relevant changes to the upstream project in a
2020single place:
2121
22- https://github.com/libressl-portable /openbsd
22+ https://github.com/libressl/openbsd
2323
2424The portable bits of the project are largely maintained out-of-tree, and their
2525history is also available from Git.
2626
27- https://github.com/libressl-portable /portable
27+ https://github.com/libressl/portable
2828
2929LibreSSL Portable Release Notes:
3030
31- 3.6 .2 - Stable release
31+ 3.7 .2 - Stable release
3232
33- * Security fix
33+ * Portable changes
34+ - Moved official Github project to https://github.com/libressl/.
35+ - Build support for Apple Silicon.
36+ - Installed opensslconf.h is now architecture-specific.
37+ - Removed internal defines from opensslconf.h.
38+ - Support reproducible builds on tagged commits in main branch.
39+
40+ 3.7.1 - Development release
41+
42+ * Internal improvements
43+ - Initial overhaul of the BIGNUM code:
44+ - Added a new framework that allows architecture-dependent
45+ replacement implementations for bignum primitives.
46+ - Imported various s2n-bignum's constant time assembly primitives
47+ and switched amd64 to them.
48+ - Lots of cleanup, simplification and bug fixes.
49+ - Changed Perl assembly generators to move constants into .rodata,
50+ allowing code to run with execute-only permissions.
51+ - Capped the number of iterations in DSA and ECDSA signing (avoiding
52+ infinite loops), added additional sanity checks to DSA.
53+ - ASN.1 parsing improvements.
54+ - Made UI_destroy_method() NULL safe.
55+ - Various improvements to nc(1).
56+ - Always clear EC groups and points on free.
57+ - Cleanup and improvements in EC code.
58+ - Various openssl(1) improvements.
59+ * Bug fixes
60+ - Fixed a memory leak, a double free and various other issues in
61+ BIO_new_NDEF().
62+ - Fixed various crashes in the openssl(1) testing utility.
63+ - Do not check policies by default in the new X.509 verifier.
64+ - Added missing error checking in PKCS7.
65+ - Call CRYPTO_cleanup_all_ex_data() from OPENSSL_cleanup().
66+ * New features
67+ - Added UI_null()
68+ - Added X509_STORE_*check_issued()
69+ - Added X509_CRL_get0_tbs_sigalg() and X509_get0_uids() accessors.
70+ - Added EVP_CIPHER_meth_*() setter API.
71+ * Documentation improvements
72+ - Marked BIO_s_log(3) BIO_nread0(3), BIO_nread(3), BIO_nwrite0(3), BIO_nwrite(3),
73+ BIO_dump_cb(3) and BIO_dump_indent_cb(3) as intentionally undocumented.
74+ - Document BIO_number_read(3), BIO_number_written(3),
75+ BIO_set_retry_read(3), BIO_set_retry_write(3),
76+ BIO_set_retry_special(3), BIO_clear_retry_flags(3),
77+ BIO_get_retry_flags(3), BIO_dup_chain(3), BIO_set_flags(3),
78+ BIO_clear_flags(3), BIO_test_flags(3), BIO_get_flags(3).
79+ BIO_callback_fn_ex(3), BIO_set_callback_ex(3), BIO_get_callback_ex(3),
80+ BIO_callback_fn(3), and the BIO_FLAGS_* constants
81+ - Correct the prototypes of BIO_get_conn_ip(3) and BIO_get_conn_int_port(3).
82+ - Document ED25519_keypair(3), ED25519_sign(3), and ED25519_verify(3).
83+ - Document EVP_PKEY_new_raw_private_key(3),
84+ EVP_PKEY_new_raw_public_key(3), EVP_PKEY_get_raw_private_key(3), and
85+ EVP_PKEY_get_raw_public_key(3).
86+ - Document ASN1_buf_print(3).
87+ - Document DH_get0_*, DSA_get0_*, ECDSA_SIG_get0_{r,s}() and RSA_get0_*.
88+ - Merged documentation of UI_null() from OpenSSL 1.1
89+ - Various spelling and other documentation improvements.
90+ * Testing and Proactive Security
91+ - As always, new test coverage is added as bugs are fixed and subsystems
92+ are cleaned up.
93+ - New Wycheproof tests added.
94+ - OpenSSL 3.0 Interop tests added.
95+ - Many old tests rewritten, cleaned up and extended.
96+ * Security fixes
3497 - A malicious certificate revocation list or timestamp response token
3598 would allow an attacker to read arbitrary memory.
3699
100+ 3.7.0 - Development release
101+
102+ * Internal improvements
103+ - Remove dependency on system timegm() and gmtime() by replacing
104+ traditional Julian date conversion with POSIX epoch-seconds date
105+ conversion from BoringSSL.
106+ - Clean old and unused BN code dealing with primes.
107+ - Start rewriting name constraints code using CBS.
108+ - Remove support for the HMAC PRIVATE KEY.
109+ - Rework DSA signing and verifying internals.
110+ - First few passes on cleaning up the BN code.
111+ - Internal headers coming from OpenSSL are all called *_local.h now.
112+ - Rewrite TLSv1.2 key exporter.
113+ - Cleaned up and refactored various aspects of the legacy TLS stack.
114+ * Compatibility changes
115+ - BIO_read() and BIO_write() now behave more closely to OpenSSL 3 in
116+ various corner cases. More work is needed here.
117+ * Bug fixes
118+ - Add EVP_chacha20_poly1305() to the list of all ciphers.
119+ - Fix potential leaks of EVP_PKEY in various printing functions
120+ - Fix potential leak in OBJ_NAME_add().
121+ - Avoid signed overflow in i2c_ASN1_BIT_STRING().
122+ - Clean up EVP_PKEY_ASN1_METHOD related tables and code.
123+ - Fix long standing bugs BN_GF2m_poly2arr() and BN_GF2m_mod().
124+ - Fix segfaults in BN_{dec,hex}2bn().
125+ - Fix NULL dereference in x509_constraints_uri_host() reachable only
126+ in the process of generating certificates.
127+ - Fixed a variety of memory corruption issues in BIO chains coming
128+ from poor old and new API: BIO_push(), BIO_pop(), BIO_set_next().
129+ - Avoid potential divide by zero in BIO_dump_indent_cb()
130+ * Documentation improvements
131+ - Numerous improvements and additions for ASN.1, BIO, BN, and X.509.
132+ - The BN documentation is now considered to be complete.
133+ * Testing and Proactive Security
134+ - As always, new test coverage is added as bugs are fixed and
135+ subsystems are cleaned up.
136+ - Many old tests rewritten, cleaned up and extended.
137+ * New features
138+ - Added Ed25519 support both as a primitive and via OpenSSL's EVP
139+ interfaces.
140+ - X25519 is now also supported via EVP.
141+ - The OpenSSL 1.1 raw public and private key API is available with
142+ support for EVP_PKEY_ED25519, EVP_PKEY_HMAC and EVP_PKEY_X25519.
143+ Poly1305 is not currently supported via this interface.
144+
371453.6.1 - Stable release
38146
39147 * Bug fixes
@@ -2563,7 +2671,7 @@ LibreSSL Portable Release Notes:
25632671 * Address POODLE attack by disabling SSLv3 by default
25642672
25652673 * Fix Eliptical Curve cipher selection bug
2566- (https://github.com/libressl-portable /portable/issues/35)
2674+ (https://github.com/libressl/portable/issues/35)
25672675
256826762.1.0 - First release from the OpenBSD 5.7 tree
25692677 * Added support for automatic ephemeral EC keys
0 commit comments