openssl/ssl/statem, branch dependabot/github_actions/actions/setup-python-7

Reject unknown TLS 1.3 ServerHello extensions

2026-07-23T15:55:07Z

TLS 1.3 does not permit clients to ignore unknown extensions in ServerHello or HelloRetryRequest. Add a validation pass for these messages so fully unknown extension types fail early with unsupported_extension. Keep the existing ignore behavior for other extension contexts and leave TLS 1.2 ServerHello processing unchanged. Add TLSProxy coverage for the TLS 1.3 ServerHello case. Correct the unknown-extension path in tls_collect_extensions(). Collection still runs before the new TLS 1.3 validation, and verify_extension() returns success with thisex == NULL for fully unknown extension types. The previous idx calculation used invalid pointer arithmetic on NULL in that path. Map unknown extensions explicitly outside the built-in extension range instead, preserving the existing ignore semantics while avoiding undefined behavior. Update the truncated HRR ECH corruption vector to keep testing malformed ECH length after the new unknown-extension validation. The old 0xdddd bytes were only padding to preserve the replacement length, but they now trigger the unknown-extension check before the ECH parser. Use a known HRR cookie extension as padding so the test still reaches the intended SSL_R_LENGTH_MISMATCH path. Reviewed-by: Andrew Dinh Reviewed-by: Daniel Kubec Reviewed-by: Tomas Mraz MergeDate: Thu Jul 23 15:55:09 2026 (Merged from https://github.com/openssl/openssl/pull/31086)

PSK: Handle non-empty client sid_ctx

2026-07-21T14:11:36Z

- Do not reject external PSKs when client-side sid_ctx is set, fixed by copying the sid_ctx into the pending session. Tests added for this and also the server side sid_ctx issues. Reviewed-by: Bob Beck Reviewed-by: Norbert Pocs MergeDate: Tue Jul 21 14:12:06 2026 (Merged from https://github.com/openssl/openssl/pull/31964)

Fix TLS 1.3 PSKs with SSL_VERIFY_PEER and no sid_ctx.

2026-07-21T14:11:36Z

A server with client certificate verification requested, but no session ID context configured, wrongly rejected every TLS 1.3 PSK-based connection, whether a resumption ticket, or an external PSK. After a full non-PSK handshake the same server issued a poison resumption PSK (session ticket) that led to handshake failure if/when used. The session ID context check exists to stop SSL acceptors with distinct authentication policies that share a session cache from resuming each other's sessions and trusting their authentication results; it doesn't apply to a just-validated external PSK, so the corresponding sessions are now exempted. Ticket issuance is also suppressed when it's already known that the ticket would lead to a handshake failure with the same server's configuration. Reviewed-by: Bob Beck Reviewed-by: Norbert Pocs MergeDate: Tue Jul 21 14:12:04 2026 (Merged from https://github.com/openssl/openssl/pull/31964)

Convert internal use of ASN1_STRING_set and ASN1_STRING_length

2026-07-18T13:01:13Z

to use their non-deprecated replacements. For "pretty-printing" applications and test code that use a length and require an int, size_t lengths are simply cast to an int. For writes and protocol level things size_t lengths are checked against INT_MAX and take the error path if the returned value is too large to be used for a funciton that takes an integer length. Reviewed-by: Milan Broz Reviewed-by: Norbert Pocs MergeDate: Sat Jul 18 13:01:19 2026 (Merged from https://github.com/openssl/openssl/pull/31194)

NULL-pointer subtraction UB in tls_collect_extensions()

2026-07-10T15:40:09Z

Fixed invalid-pointer-pair in the existing branch by ensuring thisex != NULL before subtraction. Fixes #31689 Reviewed-by: Tom Cosgrove Reviewed-by: Tomas Mraz MergeDate: Fri Jul 10 15:40:21 2026 (Merged from https://github.com/openssl/openssl/pull/31875)

Improve TLS handling of EC point formats

2026-07-10T09:21:28Z

Decouple the ec_point_formats extension from TLS 1.2 X.509 selection and acceptance. Remove tls1_check_pkey_comp() and its callers in tls1_check_cert_param() and tls1_check_chain(): TLS 1.3 disregards the extension already, and we can decode any point form a peer might send, so refusing a compressed peer cert in TLS 1.2 because we didn't advertise compressed buys nothing. The RFC 4492/8422 section 5.1.2 requirement that the peer's list contain "uncompressed" used to be enforced in a final hook on the client side only. Move it to the two points where the negotiated ciphersuite is known: the client's ServerHello parse hook, and the server's ServerHello construct hook. Both sites fire the alert only when an ECC TLS 1.2 ciphersuite has been negotiated, so a missing "uncompressed" is ignored under TLS 1.3 or a non-ECC cipher. The client- and server-side parse hooks now share one function. Drop the always-NULL ext.ecpointformats fields on SSL_CTX and SSL; our own list is built directly inside the constructors. The peer's list continues to be stored verbatim, and is also exposed through the SSL_get0_ec_point_formats() accessor (now documented). New tests verify the four corners (ECC vs non-ECC ciphersuite, TLS 1.2 vs 1.3) plus that a compressed point form EC cert is usable on both sides without any opt-in. Reviewed-by: Neil Horman Reviewed-by: Matt Caswell MergeDate: Fri Jul 10 09:21:30 2026 (Merged from https://github.com/openssl/openssl/pull/30940)

Removes some stale SSLv3 support around the code and updated documentation to reflect removal.

2026-06-30T11:04:17Z

Reviewed-by: Matt Caswell Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs MergeDate: Tue Jun 30 11:04:18 2026 (Merged from https://github.com/openssl/openssl/pull/30824)

SSL_OP_SECOP is dead code

2026-06-30T10:47:03Z

Nothing set the "vfy" parameters in any of these functions to anything but 0. Remove the parameter and stage things related to SSL_OP_SECOP to go away in the future. Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs MergeDate: Tue Jun 30 10:47:07 2026 (Merged from https://github.com/openssl/openssl/pull/31271)

statem: fail handshake if there is memory failure in negotiate_dhe

2026-06-30T08:54:38Z

Previously this just resulted in the skip of the group but such failure should result in a proper error. This is not a big issue but it impacts mfail tests so it would be good to fail. Reviewed-by: Tomas Mraz Reviewed-by: Daniel Kubec MergeDate: Tue Jun 30 08:54:47 2026 (Merged from https://github.com/openssl/openssl/pull/31618)

Reject HelloRequest in TLS 1.3

2026-06-24T13:01:06Z

TLS 1.3 reserves handshake message type 0 and must not silently ignore HelloRequest records. The legacy client-side HelloRequest skip path in tls_get_message_header() could run before the TLS 1.3 state machine had a chance to reject the message, so a zero-length HelloRequest injected after ClientHello was discarded instead of triggering unexpected_message. Restrict the skip to cases where TLS 1.3 is no longer possible. Before ServerHello selects a version, s->version is the configured maximum; after ServerHello or during renegotiation, it is the negotiated version. Skip only when that value is below TLS 1.3, preserving the existing TLS 1.2-and-below behavior. Add TLSProxy regression tests covering rejection while TLS 1.3 is possible and the preserved TLS 1.2 skip after ServerHello. Fixes #31531 Reviewed-by: Bob Beck Reviewed-by: Norbert Pocs Reviewed-by: Eugene Syromiatnikov Reviewed-by: Tomas Mraz MergeDate: Wed Jun 24 13:01:12 2026 (Merged from https://github.com/openssl/openssl/pull/31577)