Commit bced994b4a for openssl.org

commit bced994b4a924e369b57273c0d2a06b2f9b92776
Author: Eugene Syromiatnikov <esyr@openssl.org>
Date:   Mon Sep 14 16:35:40 2026 +0200

    CHANGES.md: move IPAddrBlocks change log entry to a proper section

    It is not going to be present in 4.1, move it to 4.2 change log.
    Also, add a link to RFC 3779 and clean up the formatting.

    Complements: f08174e91476 "Add public API for IPAddrBlocks (RFC 3779)"
    Signed-off-by: Eugene Syromiatnikov <esyr@openssl.org>
    Reviewed-by: Milan Broz <mbroz@openssl.org>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Merge-date: Wed Sep 23 12:57:50 2026
    Merged-from: https://github.com/openssl/openssl/pull/32827

diff --git a/CHANGES.md b/CHANGES.md
index e02c618f09..48d45332d9 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -34,6 +34,15 @@ OpenSSL 4.2

 ### Changes between 4.1 and 4.2 [xx XXX xxxx]

+ * Added public API for `IPAddrBlocks` ([RFC 3779]), mirroring the existing
+   `ASIdentifiers` API: `IPAddrBlocks_new()`, `IPAddrBlocks_free()`,
+   `d2i_IPAddrBlocks()`, `i2d_IPAddrBlocks()`, and the exported
+   `IPAddrBlocks_it` ASN.1 item for use in custom ASN.1 templates
+   (e.g. RPKI Signed Checklist).
+   <!-- https://github.com/openssl/openssl/pull/30430 -->
+
+   *John Claus*
+
  * Added AVX-512 and VAES optimizations for AES-CTR mode. Performance for
    large inputs (1024 bytes or more) improved by 2.9x to 3.9x.
    <!-- https://github.com/openssl/openssl/pull/30755 -->
@@ -495,14 +504,6 @@ OpenSSL 4.1

    *Adam Tabak*

- * Added public API for IPAddrBlocks (RFC 3779), mirroring the existing
-   ASIdentifiers API: `IPAddrBlocks_new()`, `IPAddrBlocks_free()`,
-   `d2i_IPAddrBlocks()`, `i2d_IPAddrBlocks()`, and the exported
-   `IPAddrBlocks_it` ASN.1 item for use in custom ASN.1 templates
-   (e.g. RPKI Signed Checklist).  Fixes issue #18528.
-
-   *John Claus*
-
  * Fixed X.509 verification of certificate chains that use DSA signatures
    with SHA-384 or SHA-512 by registering `dsa_with_SHA384` and
    `dsa_with_SHA512` in the signature-algorithm cross-reference table.
@@ -24194,6 +24195,7 @@ ndif
 [ESV]: https://csrc.nist.gov/Projects/cryptographic-module-validation-program/entropy-validations
 [RFC 2578 (STD 58), section 3.5]: https://datatracker.ietf.org/doc/html/rfc2578#section-3.5
 [RFC 3211]: https://datatracker.ietf.org/doc/html/rfc3211
+[RFC 3779]: https://datatracker.ietf.org/doc/html/rfc3779
 [RFC 4492 Section 5.1.2]: https://datatracker.ietf.org/doc/html/rfc4492#section-5.1.2
 [RFC 5280]: https://datatracker.ietf.org/doc/html/rfc5280
 [RFC 5280 Section 6.3.3]: https://datatracker.ietf.org/doc/html/rfc5280#section-6.3.3