LibreSSL July 2017: LibreSSL 2.5.5 Stable Release

eva2000 · Jul 16, 2017

Centmin Mod + LibreSSL 2.5.5

LibreSSL 2.5.5 is now latest stable release https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.5-relnotes.txt:

We have released LibreSSL 2.5.5, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon. It includes the following
changes:

* Distinguish between self-issued certificates and self-signed
certificates. The certificate verification code has special cases
for self-signed certificates and without this change, self-issued
certificates (which it seems are common place with
openvpn/easyrsa) were also being included in this category.

* Added getpagesize fallback, needed for Android bionic libc.

The LibreSSL project continues improvement of the codebase to reflect modern,
safe programming practices. We welcome feedback and improvements from the
broader community. Thanks to all of the contributors who helped make this
release possible.
Click to expand...

Centmin Mod 123.08stable and 123.09beta01 Github branches corresponding to Centmin Mod 1.2.3-eva2000.08 stable and Centmin Mod 1.2.3-eva2000.09 beta01 have been updated to default to LibreSSL 2.5.5 for new fresh installs. For existing folks, follow below update instructions.

Centmin Mod Nginx Update LibreSSL

For Centmin Mod 1.2.3-eva2000.08 beta03, .08 stable and higher you can update to LibreSSL 2.5.5 via 2 steps.

Step 1. Updating centmin.sh LIBRESSL_VERSION variable to 2.5.5. Best way is to use centmin.sh menu option 23 submenu option 2 for auto updating Centmin Mod code as outlined at centminmod.com/upgrade.html and at https://community.centminmod.com/threads/new-08-beta-menu-option-updating-centmin-mod-via-git.3084/. That will auto update centmin.sh to latest version which already has LIBRESSL_VERSION='2.5.5' set.

Check your updated Centmin Mod centmin.sh to see if LIBRESSL_VERSION='2.5.5' is set. If not set and you do not have centmin.sh menu option 23 submenu option 1 for git environment setup, then you need to manually update and edit in your persistent config file (create it if it doesn't exist) at /etc/centminmod/custom_config.inc and add to it:
Code (Text):
# LibreSSL
LIBRESSL_SWITCH='y'        # if set to 'y' it overrides OpenSSL as the default static compiled option for Nginx server
LIBRESSL_VERSION='2.5.5'   # Use this version of LibreSSL http://www.libressl.org/
Step 2. Then select centmin.sh menu option #4 to upgrade/downgrade Nginx recompile Nginx and specify latest Nginx version i.e. 1.13.0+ or newer.

For example after recompile Nginx version output will show built with LibreSSL 2.5.5

For 123.09 beta01

nginx -V
nginx version: nginx/1.13.3
built by gcc 6.2.1 20160916 (Red Hat 6.2.1-3) (GCC)
built with LibreSSL 2.5.5
TLS SNI support enabled
configure arguments: --with-ld-opt='-lrt -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -Wno-error=strict-aliasing -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.0 --add-module=../ngx_cache_purge-2.3 --add-module=../ngx_devel_kit-0.3.0 --add-module=../set-misc-nginx-module-0.31 --add-module=../echo-nginx-module-0.60 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-module=../headers-more-nginx-module-0.32 --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-http_v2_hpack_enc --with-openssl=../libressl-2.5.5
Click to expand...

LibreSSL 2.5.5

You'll find latest LibreSSL 2.5.5 on official site.

eva2000 · Jul 16, 2017

Looks like development branch has started for LibreSSL 2.6.x too with LibreSSL 2.6.0 https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.6.0-relnotes.txt

set in persistent config file /etc/centminmod/custom_config.inc to override centmin.sh set default LIBRESSL_VERSION='2.5.5'
Code (Text):
LIBRESSL_VERSION='2.6.0' 
then run centmin.sh menu option 4 to recompile nginx.

nginx -V
nginx version: nginx/1.13.3
built by gcc 6.2.1 20160916 (Red Hat 6.2.1-3) (GCC)
built with LibreSSL 2.6.0
TLS SNI support enabled
configure arguments: --with-ld-opt='-lrt -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -Wno-error=strict-aliasing -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.0 --add-module=../ngx_cache_purge-2.3 --add-module=../ngx_devel_kit-0.3.0 --add-module=../set-misc-nginx-module-0.31 --add-module=../echo-nginx-module-0.60 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-module=../headers-more-nginx-module-0.32 --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-http_v2_hpack_enc --with-openssl=../libressl-2.6.0
Click to expand...

We have released LibreSSL 2.6.0, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon. This is the first
development release from the 2.6 series, which will eventually be part of
OpenBSD 6.2. It includes the following changes:

* Added support for providing CRLs to libtls. Once a CRL is provided we
enable CRL checking for the full certificate chain. Based on a diff
from Jack Burton

* Allow non-compliant clients using IP literal addresses with SNI
to connect to a server using libtls.

* Avoid a potential NULL pointer dereference in d2i_ECPrivateKey().
Reported by Robert Swiecki, who found the issue using honggfuzz.

* Added definitions for three OIDs used in EV certificates.
From Kyle J. McKay

* Plugged a memory leak in tls_ocsp_free.

* Added tls_peer_cert_chain_pem, tls_cert_hash, and tls_hex_string to
libtls, useful in private certificate validation callbacks such as
those in relayd.

* Converted explicit lear/free sequences to use freezero(3).

* Reworked TLS certificate name verification code to more strictly
follow RFC 6125.

* Cleaned up and simplified server key exchange EC point handling.

* Added tls_keypair_clear_key for clearing key material.

* Removed inconsistent IPv6 handling from BIO_get_accept_socket,
simplified BIO_get_host_ip and BIO_accept.

* Fixed the openssl(1) ca command so that is generates certificates
with RFC 5280-conformant time. Problem noticed by Harald Dunkel.

* Added ASN1_TIME_set_tm to set an asn1 from a struct tm *

* Added SSL{,_CTX}_set_{min,max}_proto_version() functions.

* Added HKDF (HMAC Key Derivation Function) from BoringSSL

* Providea a tls_unload_file() function that frees the memory returned
from a tls_load_file() call, ensuring that it the contents become
inaccessible. This is specifically needed on platforms where the
library allocators may be different from the application allocator.

* Perform reference counting for tls_config. This allows
tls_config_free() to be called as soon as it has been passed to the
final tls_configure() call, simplifying lifetime tracking for the
application.

* Moved internal state of SSL and other structures to be opaque.

* Dropped cipher suites with DSS authentication.

* nc(1) improvements, including:
nc -W to terminate nc after receiving a number of packets
nc -Z for saving the peer certificate and chain in a pem file

* Distinguish between self-issued certificates and self-signed
certificates. The certificate verification code has special cases
for self-signed certificates and without this change, self-issued
certificates (which it seems are common place with
openvpn/easyrsa) were also being included in this category.

* Added getpagesize fallback, needed for Android bionic libc.

* Improvements to cmake supporting embedding in other projects, and GNU
multi-lib directory layouts.

* Solaris builds now default to 64-bit only.
Click to expand...

Sunka · Jul 16, 2017

Nice

# nginx -V
nginx version: nginx/1.13.3
built by gcc 6.2.1 20160916 (Red Hat 6.2.1-3) (GCC)
built with LibreSSL 2.5.5
TLS SNI support enabled
configure arguments: --with-ld-opt='-lrt -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -Wno-error=strict-aliasing -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.0 --add-module=../ngx_cache_purge-2.3 --add-module=../ngx_devel_kit-0.3.0 --add-module=../set-misc-nginx-module-0.31 --add-module=../echo-nginx-module-0.60 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-module=../headers-more-nginx-module-0.32 --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-http_v2_hpack_enc --with-openssl=../libressl-2.5.5
Click to expand...

Log in / Register

Forums

Learn about Centmin Mod LEMP Stack today

LibreSSL July 2017: LibreSSL 2.5.5 Stable Release

eva2000 Administrator Staff Member

Centmin Mod + LibreSSL 2.5.5

Centmin Mod Nginx Update LibreSSL

LibreSSL 2.5.5

eva2000 Administrator Staff Member

Sunka Well-Known Member

.

Log in / Register

Useful Searches

Learn about Centmin Mod LEMP Stack today

LibreSSL July 2017: LibreSSL 2.5.5 Stable Release

eva2000 Administrator Staff Member

Centmin Mod + LibreSSL 2.5.5

Centmin Mod Nginx Update LibreSSL

LibreSSL 2.5.5

eva2000 Administrator Staff Member

Sunka Well-Known Member

.