LibreSSL March 2018: LibreSSL 2.7.1 Released

eva2000 · Mar 31, 2018

Centmin Mod + LibreSSL 2.7.1

LibreSSL 2.7.1 is now latest stable release https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.7.1-relnotes.txt:

We have released LibreSSL 2.7.1, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon. This is the second
release from the 2.7 series, which will be part of OpenBSD 6.3.

It includes the following changes from 2.7.0

* Fixed a bug in int_x509_param_set_hosts, calling strlen() if name
length provided is 0 to match the OpenSSL behaviour. Issue noticed
by Christian Heimes <christian@python.org>

* Fixed builds macOS 10.11 and older.

LibreSSL 2.7.1 also includes:

* Added support for many OpenSSL 1.0.2 and 1.1 APIs, based on
observations of real-world usage in applications. These are
implemented in parallel with existing OpenSSL 1.0.1 APIs - visibility
changes have not been made to existing structs, allowing code written
for older OpenSSL APIs to continue working.

* Extensive corrections, improvements, and additions to the
API documentation, including new public APIs from OpenSSL that had
no pre-existing documentation.

* Added support for automatic library initialization in libcrypto,
libssl, and libtls. Support for pthread_once or a compatible
equivalent is now required of the target operating system. As a
side-effect, minimum Windows support is Vista or higher.

* Converted more packet handling methods to CBB, which improves
resiliency when generating TLS messages.

* Completed TLS extension handling rewrite, improving consistency of
checks for malformed and duplicate extensions.

* Rewrote ASN1_TYPE_{get,set}_octetstring() using templated ASN.1.
This removes the last remaining use of the old M_ASN1_* macros
(asn1_mac.h) from API that needs to continue to exist.

* Added support for client-side session resumption in libtls.
A libtls client can specify a session file descriptor (a regular
file with appropriate ownership and permissions) and libtls will
manage reading and writing of session data across TLS handshakes.

* Improved support for strict alignment on ARMv7 architectures,
conditionally enabling assembly in those cases.

* Fixed a memory leak in libtls when reusing a tls_config.

* Merged more DTLS support into the regular TLS code path, removing
duplicated code.

* Many improvements to Windows Cmake-based builds and tests,
especially when targeting Visual Studio.

The LibreSSL project continues improvement of the codebase to reflect modern,
safe programming practices. We welcome feedback and improvements from the
broader community. Thanks to all of the contributors who helped make this
release possible.
Click to expand...

Centmin Mod 123.08stable and 123.09beta01 Github branches corresponding to Centmin Mod 1.2.3-eva2000.08 stable and Centmin Mod 1.2.3-eva2000.09 beta01 have been updated to LibreSSL 2.7.1. Centmin Mod 123.09beta01 uses OpenSSL 1.1.0* branch by default for Nginx compiles now though. For existing folks, follow below update instructions.

Centmin Mod Nginx Update LibreSSL

For Centmin Mod 1.2.3-eva2000.08 beta03, .08 stable and higher you can update to LibreSSL 2.7.1 via 2 steps.

Step 1. Updating centmin.sh LIBRESSL_VERSION variable to 2.7.1. Best way is to use centmin.sh menu option 23 submenu option 2 for auto updating Centmin Mod code as outlined at centminmod.com/upgrade.html and at https://community.centminmod.com/threads/new-08-beta-menu-option-updating-centmin-mod-via-git.3084/. That will auto update centmin.sh to latest version which already has LIBRESSL_VERSION='2.7.1' set.

Check your updated Centmin Mod centmin.sh to see if LIBRESSL_VERSION='2.7.1' is set. If not set and you do not have centmin.sh menu option 23 submenu option 1 for git environment setup, then you need to manually update and edit in your persistent config file (create it if it doesn't exist) at /etc/centminmod/custom_config.inc and add to it. Note Centmin Mod 123.09beta01 defaults to Nginx compiles with OpenSSL now for better performance so is set to LIBRESSL_SWITCH='n'. Enabling below LIBRESSL_SWITCH='y' will switch you to Nginx with LibreSSL:
Code (Text):
# LibreSSL
LIBRESSL_SWITCH='y'        # if set to 'y' it overrides OpenSSL as the default static compiled option for Nginx server
LIBRESSL_VERSION='2.7.1'   # Use this version of LibreSSL http://www.libressl.org/
Step 2. Then select centmin.sh menu option #4 to upgrade/downgrade Nginx recompile Nginx and specify latest Nginx version i.e. 1.13.10+ or newer.

For example after recompile Nginx version output will show built with LibreSSL 2.7.1

For 123.09 beta01

nginx -V
nginx version: nginx/1.13.10
built by gcc 7.2.1 20170829 (Red Hat 7.2.1-1) (GCC)
built with LibreSSL 2.7.1
TLS SNI support enabled
configure arguments: --with-ld-opt='-lrt -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wp,-D_FORTIFY_SOURCE=2 -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --add-dynamic-module=../nginx-module-vts --with-libatomic --with-http_gzip_static_module --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.4.2 --add-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.31 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre=../pcre-8.42 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-openssl=../libressl-2.7.1
Click to expand...

LibreSSL 2.7.1

You'll find latest LibreSSL 2.7.1 on official site.

rdan · Mar 31, 2018

Maybe it's time to remove LibreSSL on Centminmod? .

pamamolf · Mar 31, 2018

If something goes wrong with the default compile we can use that

So it will be good to have as an alternative

eva2000 · Mar 31, 2018

Yeah you never know what LibreSSL developments happen in future so having support for it as an alternative is good

Log in / Register

Forums

Get the most out of your Centmin Mod LEMP stack

LibreSSL March 2018: LibreSSL 2.7.1 Released

eva2000 Administrator Staff Member

Centmin Mod + LibreSSL 2.7.1

Centmin Mod Nginx Update LibreSSL

LibreSSL 2.7.1

rdan Well-Known Member

pamamolf Well-Known Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Get the most out of your Centmin Mod LEMP stack

LibreSSL March 2018: LibreSSL 2.7.1 Released

eva2000 Administrator Staff Member

Centmin Mod + LibreSSL 2.7.1

Centmin Mod Nginx Update LibreSSL

LibreSSL 2.7.1

rdan Well-Known Member

pamamolf Well-Known Member

eva2000 Administrator Staff Member

.