openssl/ssl/s3_lib.c, branch dependabot/github_actions/actions/setup-python-7

SSL_CTX_set_tlsext_servername_callback.pod: improve doc of SSL_set_tlsext_host_name(); update format

2026-06-10T06:26:46Z

Add recommendation to use it for TLS clients, together with X509_VERIFY_PARAM_{set1,add1}_host() Reviewed-by: Neil Horman Reviewed-by: Eugene Syromiatnikov MergeDate: Wed Jun 10 06:26:57 2026 (Merged from https://github.com/openssl/openssl/pull/27357)

Copyright year updates

2026-03-10T14:37:52Z

Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 10 14:37:54 2026 Release: yes

Remove remnant SSL_FIPS flag

2026-02-28T10:47:39Z

This flag was used to support the old FIPS canister and isn't used or needed anymore. It's only set in the data structures and never queried so it's removal is low impact. Fixes #30156 Reviewed-by: Matt Caswell Reviewed-by: Simo Sorce Reviewed-by: Dmitry Belyavskiy (Merged from https://github.com/openssl/openssl/pull/30200)

Ensure TLS 1.3 ciphersuites are actually for TLS 1.3

2026-02-28T09:09:29Z

- Also suppress duplicate ciphersuites - Also ignore case in both TLS 1.3 and TLS 1.2 ciphers Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz MergeDate: Sat Feb 28 09:11:33 2026 (Merged from https://github.com/openssl/openssl/pull/30140)

Add TLS1.3 ciphersuites from RFC8998

2026-02-19T15:11:05Z

This adds TLS_SM4_GCM_SM3 and TLS_SM4_CCM_SM3 as defined in RFC 8998. Fixes openssl/project#1871 Signed-off-by: Milan Broz Reviewed-by: Viktor Dukhovni Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Reviewed-by: Neil Horman MergeDate: Thu Feb 19 15:11:15 2026 (Merged from https://github.com/openssl/openssl/pull/30028)

Implement first step of RFC7919 in TLS 1.2 server

2026-02-05T09:09:18Z

RFC 7919 states: If a compatible TLS server receives a Supported Groups extension from a client that includes any FFDHE group (i.e., any codepoint between 256 and 511, inclusive, even if unknown to the server), and if none of the client-proposed FFDHE groups are known and acceptable to the server, then the server MUST NOT select an FFDHE cipher suite. We implement this behavior by adding a new function that checks this condition as its inverse: only select FFDHE cipher suites if at least one of the client-proposed FFDHE groups is known and acceptable, or if the client did _not_ send any FFDHE groups. Also add a test to verify two possible outcomes: 1) The client proposes FFDHE and non-FFDHE ciphersuites -> the server will select a non-FFDHE ciphersuite. 2) The client only proposes FFDHE ciphersuites -> the server will end the connection. Reviewed-by: Viktor Dukhovni Reviewed-by: Matt Caswell Reviewed-by: Saša Nedvědický MergeDate: Thu Feb 5 09:09:40 2026 (Merged from https://github.com/openssl/openssl/pull/24551)

Support FFDHE groups in tls1_shared_group

2026-02-05T09:09:18Z

Update tls1_shared_group to allow filtering for FFDHE and/or ECDHE groups. This will be used for implementing RFC 7919 groups support in the TLS 1.2 server. As defined in RFC 7919: Codepoints in the "Supported Groups Registry" with a high byte of 0x01 (that is, between 256 and 511, inclusive) are set aside for FFDHE groups Reviewed-by: Viktor Dukhovni Reviewed-by: Matt Caswell Reviewed-by: Saša Nedvědický MergeDate: Thu Feb 5 09:09:38 2026 (Merged from https://github.com/openssl/openssl/pull/24551)

Rename SSL3 error codes to TLS equivalents

2025-12-23T15:54:08Z

Updated error code names and references from SSL3 to TLS in error definitions and error strings. Legacy error codes are preserved in sslerr_legacy.h for backward compatibility Reviewed-by: Neil Horman Reviewed-by: Matt Caswell Reviewed-by: Saša Nedvědický Reviewed-by: Viktor Dukhovni (Merged from https://github.com/openssl/openssl/pull/29338)

Remove support for SSLv3

2025-12-23T15:54:06Z

Reviewed-by: Saša Nedvědický Reviewed-by: Neil Horman Reviewed-by: Saša Nedvědický Reviewed-by: Viktor Dukhovni (Merged from https://github.com/openssl/openssl/pull/29338)

Redo source reformatting with the TypeNames added

2025-12-17T15:19:43Z

This resulted in some source reformatting becoming a bit less trippy This is the script I used to run clang-format appropriately enough: #! /bin/bash include_re=$(yq -r '.repos.[].hooks.[] | select(.id == "clang-format") | .files' < .pre-commit-config.yaml) known_generated=( crypto/bn/bn_prime.h crypto/objects/obj_dat.h crypto/objects/obj_xref.h include/openssl/obj_mac.h crypto/conf/conf_def.h crypto/asn1/charmap.h '*_err.c' '*err.h' ) exclusions=() for g in "${known_generated[@]}"; do # Convert pattern to a regex g=${g//\./\\.} g=${g//\*/.\*} exclusions+=( "^${g}\$" ) done # Join all exclusions into one regex exclude_re=$(IFS='|'; echo "${exclusions[*]}") (set -x; git ls-files | grep -E $include_re | grep -Ev $exclude_re | xargs clang-format -i) Reviewed-by: Paul Yang Reviewed-by: Tomas Mraz Reviewed-by: Matt Caswell Reviewed-by: Neil Horman (Merged from https://github.com/openssl/openssl/pull/29383)