imported>InternetArchiveBot：补救0个来源，并将1个来源标记为失效。) #IABot (v2.0.8.7

2022-05-14T21:34:10Z

补救0个来源，并将1个来源标记为失效。) #IABot (v2.0.8.7

新页面

{{noteTA
|G1=IT
|G2=FL
}}
{{Infobox software
| name = LibreSSL
| logo = LibreSSL logo as of 2014-04-22.png
| logo_size = 170px
| alt = 白色背景上的黑色Comic Sans字体LibreSSL单词
| screenshot =
| caption =
| developer = [[OpenBSD]]项目组
| released = 2.0.0 / {{Start date and age|2014|07|11|df=yes}}
| repo = {{URL|https://github.com/libressl-portable/portable}}
| operating_system = [[OpenBSD]]、[[FreeBSD]]、[[NetBSD]]、[[Linux]]、[[HP-UX]]、[[Solaris]]、[[OS X]]、[[Windows]] and others<ref>{{cite web|title=LibreSSL Releases|url=http://www.libressl.org/releases.html|accessdate=2018-02-14|archive-date=2021-01-28|archive-url=https://web.archive.org/web/20210128013712/https://www.libressl.org/releases.html|dead-url=no}}</ref>
| status = 進行中
| programming_language = [[C语言]]、[[汇编语言|汇编]]
| genre = [[函式庫|安全性加密函式庫]]
| license = [[Apache许可证]]1.0<br>原版[[BSD许可证]]<br>[[ISC許可證]]<br>部份為[[公有领域]]
}}

'''LibreSSL'''是[[OpenSSL]][[密码学|加密]][[函式庫|软件库]]的一个[[复刻 (软件工程)|分支]]，是一个[[安全套接层]]（SSL）和[[传输层安全]]（TLS）协议的[[开放源代码|开源]]实现。在OpenSSL爆出[[心脏出血漏洞|心脏出血]][[计算机安全隐患|安全漏洞]]之后，一些[[OpenBSD]]开发者于2014年4月创立了LibreSSL，<ref>{{cite web |url=http://www.tedunangst.com/flak/post/origins-of-libressl |title=Origins of libressl |first=Ted |last=Unangst |work=flak |date=2014-04-22 |accessdate=2014-04-24 |archive-date=2014-04-24 |archive-url=https://web.archive.org/web/20140424125844/http://www.tedunangst.com/flak/post/origins-of-libressl |dead-url=no }}</ref><ref>{{Cite web |url=http://www.eweek.com/security/after-heartbleed-openssl-is-forked-into-libressl.html |title=After Heartbleed, OpenSSL Is Forked Into LibreSSL |first=Sean Michael |last=Kemer |work={{link-en|eWeek|eWeek}} |date=2014-04-22 |accessdate=2014-04-24 }}{{Dead link}}</ref><ref>{{cite web|title=Not Just a Cleanup Any More: LibreSSL Project Announced|url=http://it.slashdot.org/story/14/04/22/1240247/not-just-a-cleanup-any-more-libressl-project-announced|publisher=[[Slashdot]]|accessdate=2014-04-24|date=2014-04-22|archive-date=2014-04-24|archive-url=https://web.archive.org/web/20140424142257/http://it.slashdot.org/story/14/04/22/1240247/not-just-a-cleanup-any-more-libressl-project-announced|dead-url=no}}</ref>目标是[[代码重构|重构]]OpenSSL的代码，以提供一个更安全的替代品。<ref>{{cite web |url=http://www.osnews.com/story/27689/OpenBSD_forks_prunes_fixes_OpenSSL |title=OpenBSD forks, prunes, fixes OpenSSL |first=Thom |last=Holwerda |work={{link-en|OSNews|OSNews}} |date=2014-04-23 |accessdate=2014-04-24 |archive-date=2018-03-04 |archive-url=https://web.archive.org/web/20180304054754/http://www.osnews.com/story/27689/OpenBSD_forks_prunes_fixes_OpenSSL |dead-url=no }}</ref>LibreSSL复刻自OpenSSL库的1.0.1g分支，它将遵循OpenBSD基金会在其他项目所使用的安全指导原则。<ref name="fork">{{cite web |url=http://www.undeadly.org/cgi?action=article&sid=20140415093252 |title=OpenBSD has started a massive strip-down and cleanup of OpenSSL |first=Peter |last=Hessler |work={{link-en|OpenBSD Journal|OpenBSD Journal}} |date=2014-04-15 |accessdate=2014-04-24 |archive-date=2020-12-03 |archive-url=https://web.archive.org/web/20201203152737/https://undeadly.org/cgi?action=article&sid=20140415093252 |dead-url=no }}</ref>

== 历史 ==

在OpenSSL爆出心脏出血漏洞后的一周之内，OpenBSD开发团队便决定自行维护一个OpenSSL分支。开发团队于2014年4月11日注册libressl.org域名，该项目于2014年4月22日公布。

OpenBSD开发团队随即开始清理OpenSSL的代码，在第一周，LibreSSL开发团队删去了90000多行的代码。<ref>{{cite web |url=http://www.zdnet.com/openbsd-forks-prunes-fixes-openssl-7000028613/ |title=OpenBSD forks, prunes, fixes OpenSSL |first=Larry |last=Seltzer |work=Zero Day |publisher=[[ZDNet]] |date=2014-04-21 |accessdate=2014-04-21 |archive-date=2014-04-21 |archive-url=https://web.archive.org/web/20140421235922/http://www.zdnet.com/openbsd-forks-prunes-fixes-openssl-7000028613/ |dead-url=no }}</ref><ref name=brodkin20140422>{{cite web |url=http://arstechnica.com/information-technology/2014/04/openssl-code-beyond-repair-claims-creator-of-libressl-fork/ |title=OpenSSL code beyond repair, claims creator of "LibreSSL" fork |first=Jon |last=Brodkin |work=[[Ars Technica]] |date=2014-04-22 |accessdate=2014-04-24 |archive-date=2014-08-19 |archive-url=https://web.archive.org/web/20140819033404/http://arstechnica.com/information-technology/2014/04/openssl-code-beyond-repair-claims-creator-of-libressl-fork/ |dead-url=no }}</ref>一些陈旧或无用代码被移除，同时对一些比较罕见的操作系统的支持也被移除。LibreSSL最初的目标平台是OpenBSD 5.6，但当代码稳定之后，还移植至其他平台。<ref name=pcpro>{{cite web |url=http://www.pcpro.co.uk/news/security/388309/heartbleed-libressl-scrubs-irresponsible-openssl-code |title=Heartbleed: LibreSSL scrubs "irresponsible" OpenSSL code |first=Jane |last=McCallion |work={{link-en|PC Pro|PC Pro}} |date=2014-04-22 |accessdate=2014-04-23 |archive-url=https://web.archive.org/web/20140626092314/http://www.pcpro.co.uk/news/security/388309/heartbleed-libressl-scrubs-irresponsible-openssl-code |archive-date=2014-06-26 |dead-url=yes }}</ref>{{As of|2014|04}}，该项目仍在寻求“稳定的”外部资金支持。<ref name=brodkin20140422/>

== 变化详情 ==

=== 内存相关 ===

一些较显着和重要的变化包括更换自定义的内存存取调用为标准函数（例如[[strlcpy]]、calloc、asprintf、reallocarray等）。<ref name="valhalla1wk">{{cite web|url=http://opensslrampage.org/post/83631316689/a-quick-recap-over-the-last-week|work=OpenSSL Valhalla Rampage|title=A quick recap over the last week|date=2014-04-23|accessdate=2014-04-30|last=Orr|first=William|archive-date=2014-04-29|archive-url=https://web.archive.org/web/20140429135152/http://opensslrampage.org/post/83631316689/a-quick-recap-over-the-last-week|dead-url=no}}{{self-published inline|date=May 2014}}</ref><ref name="libsslcallc">{{cite web|url=http://freshbsd.org/search?project=openbsd&q=libssl+calloc|title=OpenBSD LibreSSL CVS Calloc Commits|accessdate=2014-05-02|archive-date=2019-02-17|archive-url=https://web.archive.org/web/20190217011929/http://freshbsd.org/search?project=openbsd&q=libssl+calloc|dead-url=no}}</ref>这有助于在将来用更先进的{{link-en|内存调试器|Memory_debugger}}，或通过观察程序的崩溃情况来发现[[缓存溢出]]等错误。[[协作版本系统|CVS]]提交日志中也记录了对潜在[[C语言的动态内存分配#常见错误|双重释放内存]]的修复（包括[[空指针]]值的显式分配）。<ref name="libssldouble">{{cite web|url=http://freshbsd.org/search?project=openbsd&q=libssl+double+free|title=OpenBSD LibreSSL CVS Double Free Commits|accessdate=2014-05-02|archive-date=2019-02-17|archive-url=https://web.archive.org/web/20190217011930/http://freshbsd.org/search?project=openbsd&q=libssl+double+free|dead-url=no}}</ref>

=== 加密算法 ===

原本不安全的种子生成方法（由内核原生提供）被移除，以确保随机数种子是通过安全的[[随机数生成器]]产生的。又新加入了一系列算法，包括[[ChaCha20]]-[[Poly1305]]等。

=== 其他改动 ===

加入了的{{link-en|完整性检查|Sanity_check#Software development}}，以检查长度参数、无符号到有符号变量的赋值、指针值/方法返回值等数据的有效性。启用了一些使之更加安全的编译器选项和标志（-Wuninitialized，-Werror等），这有助于发现潜在问题。为遵循良好的编程风格，项目也提高了代码可读性并清理空白字符，使之符合BSD的代码风格（{{link-en|KNF|Kernel Normal Form}}）。移除了不必要或不安全的宏和变量；移除了未使用的或旧的程序集、应用程序、演示及文档文件/代码（[[Perl]]脚本、[[C语言]]文件等）。移除了对{{link-en|FIPS 140-2|FIPS_140-2}}的支持、不安全的算法[[Dual EC DRBG]]及旧的协议/加密器（[[安全套接层|SSLv2]]）。{{Portal|自由软件}}

== 参见 ==
* {{link-en|TLS实现比较|Comparison of TLS implementations}}
* [[OpenSSH]]，OpenBSD社区所创的另一个安全软件的分支

== 参考 ==
{{Reflist|30em}}

== 外部链接 ==
* {{official website|http://www.libressl.org/}}
* [https://web.archive.org/web/20140424095911/http://bxr.su/OpenBSD/lib/libssl/src/ssl/ LibreSSL源代码（OpenGrok）]

{{OpenBSD}}
{{加密软件}}
{{TLS和SSL}}

[[Category:加密软件]]
[[Category:C函式庫]]
[[Category:2014年软件]]
[[Category:自由安全软件]]
[[Category:傳輸層安全協議]]

LibreSSL - 版本历史

imported>InternetArchiveBot：​补救0个来源，并将1个来源标记为失效。) #IABot (v2.0.8.7

imported>InternetArchiveBot：补救0个来源，并将1个来源标记为失效。) #IABot (v2.0.8.7