-
Notifications
You must be signed in to change notification settings - Fork 65
Expand file tree
/
Copy pathchangelog.xml
More file actions
409 lines (403 loc) · 13.4 KB
/
Copy pathchangelog.xml
File metadata and controls
409 lines (403 loc) · 13.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!DOCTYPE document [
<!ENTITY project SYSTEM "project.xml">
]>
<?xml-stylesheet type="application/xslt+xml" href="../style.xsl"?>
<document url="changelog.html">
&project;
<body>
<section name="Preface">
<p>
This is the Changelog for Apache Tomcat Native 2.0.x. The Tomcat Native 2.0.x
branch started from the 1.2.33 tag.
</p>
</section>
<section name="2.0.16" rtext="developement in progress">
<changelog>
<scode>
Remove call to ERR_remove_thread_state() from Windows specific code to
allow building with OpenSSL 4.0.x. ERR_remove_thread_state() is a no-op
in OpenSSL 1.1+ and got removed in OpenSSL 4. (rjung)
</scode>
<update>
Remove support for Windows build on IA64 architecture (Itanium). (rjung)
</update>
<update>
Make x64 the default architecture for Windows build. (rjung)
</update>
<update>
Make Windows 10 / 11 the default target version for Windows builds. (rjung)
</update>
</changelog>
</section>
<section name="2.0.15" rtext="2026-06-15">
<changelog>
<fix>
Fix a memory leak when parsing certificates. Pull request <pr>44</pr>
provided by chenjp. (markt)
</fix>
<fix>
Fix two potential memory leaks on error paths identified by Copilot.
(markt)
</fix>
<fix>
<bug>69988</bug>: Fix post handshake authentication Tomcat is configured
with a trust store using JSSE style configuration. (markt)
</fix>
<fix>
<bug>70102</bug>: Correct expected size of tickets when calling
<code>SSLContext.setSessionTicketKeys</code>. (markt)
</fix>
</changelog>
</section>
<section name="2.0.14" rtext="2026-03-10">
<changelog>
<scode>
Refactor access to ASN1_OCTET_STRING to use setters to fix errors when
building against the latest OpenSSL 4.0.x code. (markt)
</scode>
<fix>
Fix the handling of OCSP requests with multiple responder URIs. (jfclere)
</fix>
<fix>
Fix the handling of <code>TRY_AGAIN</code> responses to OCSP requests when
soft fail is disabled. (jfclere)
</fix>
</changelog>
</section>
<section name="2.0.13" rtext="2026-02-11">
<changelog>
<scode>
Due to various refactorings, the 2.0.x code no longer compiles with
LibreSSL. Without a volunteer to maintain LibreSSL support, the LibreSSL
code will be removed no earlier than 30 September 2026. (markt)</scode>
<fix>
Remove group write permissions from the files in the tar.gz source
archive. (markt)
</fix>
<scode>
Refactor the SSL_CONF_CTX clean-up to align it with SSL and SSL_CTX
clean-up. (markt)
</scode>
<fix>
Fix unnecessarily large buffer allocation when filtering out NULL and
export ciphers. Pull requests <pr>35</pr> and <pr>37</pr> provided by
chenjp. (markt)
</fix>
<fix>
Fix a potential memory leak if an invalid <code>OpenSSLConf</code> is
provided. Pull request <pr>36</pr> provided by chenjp. (markt)
</fix>
<fix>
Refactor setting of OCSP configuration defaults as they were only applied
if the SSL_CONF_CTX was used. While one was always used with Tomcat
versions aware of the OCSP configuration options, one was not always used
with Tomcat versions unaware of the OCSP configuration options leading to
OCSP verification being enabled by default when the expected behaviour was
disabled by default. (markt)
</fix>
<scode>
Improve performance for the rare case of handling large OCSP responses.
(markt)
</scode>
<fix>
<bug>69939</bug>: Fix the cause of a crash with OpenSSL 3.0.x when a
certificate PEM file does not contain explicit DH parameters. (markt)
</fix>
<fix>
Refactor extraction of ECDH curve name from the Certificate to avoid
deprecated OpenSSL methods.
</fix>
<fix>
Refactor the native implementation of <code>SSL.getTime()</code> to avoid
the Y2038 problem in <code>SSL_SESSION_get_time()</code> when running on a
version of OpenSSL that includes the new
<code>SSL_SESSION_get_time_ex()</code> method. (markt)
</fix>
</changelog>
</section>
<section name="2.0.12" rtext="2026-01-12">
<changelog>
<fix>
Refactor the addition of TLS 1.3 cipher suite configuration to avoid a
regression when running a version of Tomcat that pre-dates this change.
(markt)
</fix>
</changelog>
</section>
<section name="2.0.11" rtext="not released">
<changelog>
<fix>
Fix a reference to an uninitialized variable. (schultz)
</fix>
<fix>
Correct file names and update versions in native build instructions.
(markt)
</fix>
<update>
Remove references to deprecated engine configuration. (markt)
</update>
</changelog>
</section>
<section name="2.0.10" rtext="not released">
<changelog>
<update>
The Windows binaries are now built with OCSP support enabled by default.
(markt)
</update>
<add>
Include a nonce with OCSP requests and check the nonce, if any, in the
OCSP response. (markt)
</add>
<add>
Expand verification of OCSP responses. (markt)
</add>
<add>
Add the ability to configure the OCSP checks to soft-fail - i.e. if the
responder cannot be contacted or fails to respond in a timely manner the
OCSP check will not fail. (markt)
</add>
<add>
Add a configurable timeout to the writing of OCSP requests and reading of
OCSP responses. (markt)
</add>
<add>
Add the ability to control the OCSP verification flags. (markt)
</add>
<add>
Configure TLS 1.3 connections from the provided ciphers list as well as
connections using TLS 1.2 and earlier. Pull request provided by gastush.
(markt)
</add>
<update>
Remove out of date options from make file. (markt)
</update>
<update>
Use automated configuration of DH parameters rather than deprecated
callback. (markt)
</update>
</changelog>
</section>
<section name="2.0.9" rtext="2025-05-29">
<changelog>
<update>
Update the Windows build environment to use Visual Studio 2022. (markt)
</update>
<update>
Update the recommended minimum version of OpenSSL to 3.5.0. (markt)
</update>
<update>
Update the recommended minimum version of APR to 1.7.6. (markt)
</update>
</changelog>
</section>
<section name="2.0.8" rtext="2024-07-24">
<changelog>
<fix>
Fix a crash on Windows when <code>SSLContext.setCACertificate()</code>
is invoked with a <code>null</code> value for <code>caCertificateFile</code>
and a non-<code>null</code> value for <code>caCertificatePath</code>
until properly addressed with
https://github.com/openssl/openssl/issues/24416. (michaelo)
</fix>
<add>
Use ERR_error_string_n with a definite buffer length as a named constant.
(schultz)
</add>
<add>
Ensure local reference capacity is available when creating new arrays
and Strings. (schultz)
</add>
<update>
Update the recommended minimum version of OpenSSL to 3.0.14. (markt)
</update>
</changelog>
</section>
<section name="2.0.7" rtext="2024-02-08">
<changelog>
<add>
<bug>67538</bug>: Make use of Ant's <code><javaversion /></code>
task to enforce the mininum Java build version. (michaelo)
</add>
<fix>
<bug>67615</bug>: Windows binary for version 2 has incorrect version
suffix compared to the GNU autoconf version. (michaelo)
</fix>
<update>
Align default pass phrase prompt with HTTPd on Windows as well. (michaelo)
</update>
<fix>
<bug>67616</bug>: o.a.tomcat.jni.SSL contains useless check for old
OpenSSL version. (michaelo)
</fix>
<update>
Drop useless <code>compile.optimize</code> option. (michaelo)
</update>
<update>
Align Java source compile configuration with Tomcat. (michaelo)
</update>
<add>
Add Ant version (1.10.2) requirement identical to Tomcat. (michaelo)
</add>
<update>
Remove an unreachable if condition around CRLs in sslcontext.c. (michaelo)
</update>
<fix>
<bug>67818</bug>: When calling <code>SSL.setVerify()</code> or
<code>SSLContext.setVerify()</code>, the default verify paths are no
longer set. Only the explicitly configured trust store, if any, will be
used. (michaelo)
</fix>
<update>
Update the recommended minimum version of OpenSSL to 3.0.13. (markt)
</update>
</changelog>
</section>
<section name="2.0.6" rtext="2023-10-02">
<changelog>
<fix>
<bug>67061</bug>: If the insecure optionalNoCA certificate verification
mode is used, disable OCSP if enabled else client certificates from
unknown certificate authorities will be rejected. (markt)
</fix>
<update>
Update the recommended minimum version of OpenSSL to 3.0.11. (markt)
</update>
</changelog>
</section>
<section name="2.0.5" rtext="2023-08-07">
<changelog>
<update>
<bug>66666</bug>: Remove non-reachable functions from ssl.c. (michaelo)
</update>
<update>
Align default pass phrase prompt with HTTPd. (michaelo)
</update>
<update>
Rename configure.in to modern autotools style configure.ac. (rjung)
</update>
<update>
Fix incomplete updates for autotools generated files during "buildconf" execution. (rjung)
</update>
<update>
Improve quoting in tcnative.m4. (rjung)
</update>
<update>
Update the minimum version of autoconf for releasing to 2.68. (rjung)
</update>
<fix>
<bug>66669</bug>: Fix memory leak in SNI processing. (markt)
</fix>
<update>
Update the recommended minimum version of OpenSSL to 3.0.10. (markt)
</update>
</changelog>
</section>
<section name="2.0.4" rtext="not released">
<changelog>
<update>
Update the recommended minimum version of APR to 1.7.4. (markt)
</update>
<update>
Update the recommended minimum version of OpenSSL to 3.0.9. (markt)
</update>
</changelog>
</section>
<section name="2.0.3" rtext="2023-02-13">
<changelog>
<update>
Update the recommended minimum version of APR to 1.7.2. (markt)
</update>
<update>
Update the recommended minimum version of OpenSSL to 3.0.8. (markt)
</update>
</changelog>
</section>
<section name="2.0.2" rtext="2022-11-08">
<changelog>
<update>
Update the minimum supported version of LibreSSL to 3.5.2. Based on pull
request <pr>13</pr> provided by orbea. (markt)
</update>
<fix>
Fix build when building with rlibtool. Pull request <pr>14</pr> provided
by orbea. (markt)
</fix>
</changelog>
</section>
<section name="2.0.1" rtext="2022-07-12">
<changelog>
<update>
Update recommended OpenSSL version to 3.0.5 or later. (markt)
</update>
</changelog>
</section>
<section name="2.0.0" rtext="not released">
<changelog>
<update>
Update the minimum required version of OpenSSL to 3.0.0 and make it a
madatory dependency. (markt)
</update>
<update>
Update the minimum required version of APR to 1.7.0. (markt)
</update>
<design>
Remove NPN support as NPN was never standardised and browser support was
removed in 2019. (markt)
</design>
<add>
Add support for using OpenSSL when the FIPS provider is configured as the
default provider. (markt)
</add>
<design>
Remove all API methods (and supporting code) that are not used by Tomcat
10.1.x to support the use of OpenSSL as a replacement for JSSE to provide
TLS functionality. (markt)
</design>
<docs>
Document the TLS rengotiation behaviour. (markt)
</docs>
<update>
Update the minimum required Java version to Java 11. (markt)
</update>
<update>
Remove support for Windows 2000, Windows XP, Windows Server 2003, Windows
Vista and Windows Server 2008. The minimum Windows version is now Windows
7 / Windows Server 2008 R2. (markt)
</update>
<docs>
Add HOWTO-RELEASE.txt that describes the release process. (markt)
</docs>
<fix>
Fix the autoconf warnings when creating a release. (markt)
</fix>
</changelog>
</section>
<section name="Changes in 1.3.x">
<p>Please see the <a href="../../native-1.3-doc/miscellaneous/changelog.html">1.3.x
changelog</a>.</p>
</section>
<section name="Changes in 1.2.x">
<p>Please see the <a href="../../native-1.2-doc/miscellaneous/changelog.html">1.2.x
changelog</a>.</p>
</section>
<section name="Changes in 1.1.x">
<p>Please see the <a href="../../native-1.1-doc/miscellaneous/changelog.html">1.1.x
changelog</a>.</p>
</section>
</body>
</document>