openssl/ssl/t1_lib.c, branch dependabot/github_actions/actions/setup-python-7

Fix removal of sole key exchange group in tuple

2026-07-20T07:12:19Z

- Don't attempt to float its keyshare if any - Include active tuple in memmove() that excises a newly empty closed tuple. Add comments to clarify the logic. Reviewed-by: Nikola Pajkovsky Reviewed-by: Milan Broz Reviewed-by: Norbert Pocs MergeDate: Mon Jul 20 07:12:30 2026 (Merged from https://github.com/openssl/openssl/pull/31926)

Improve TLS handling of EC point formats

2026-07-10T09:21:28Z

Decouple the ec_point_formats extension from TLS 1.2 X.509 selection and acceptance. Remove tls1_check_pkey_comp() and its callers in tls1_check_cert_param() and tls1_check_chain(): TLS 1.3 disregards the extension already, and we can decode any point form a peer might send, so refusing a compressed peer cert in TLS 1.2 because we didn't advertise compressed buys nothing. The RFC 4492/8422 section 5.1.2 requirement that the peer's list contain "uncompressed" used to be enforced in a final hook on the client side only. Move it to the two points where the negotiated ciphersuite is known: the client's ServerHello parse hook, and the server's ServerHello construct hook. Both sites fire the alert only when an ECC TLS 1.2 ciphersuite has been negotiated, so a missing "uncompressed" is ignored under TLS 1.3 or a non-ECC cipher. The client- and server-side parse hooks now share one function. Drop the always-NULL ext.ecpointformats fields on SSL_CTX and SSL; our own list is built directly inside the constructors. The peer's list continues to be stored verbatim, and is also exposed through the SSL_get0_ec_point_formats() accessor (now documented). New tests verify the four corners (ECC vs non-ECC ciphersuite, TLS 1.2 vs 1.3) plus that a compressed point form EC cert is usable on both sides without any opt-in. Reviewed-by: Neil Horman Reviewed-by: Matt Caswell MergeDate: Fri Jul 10 09:21:30 2026 (Merged from https://github.com/openssl/openssl/pull/30940)

Removes some stale SSLv3 support around the code and updated documentation to reflect removal.

2026-06-30T11:04:17Z

Reviewed-by: Matt Caswell Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs MergeDate: Tue Jun 30 11:04:18 2026 (Merged from https://github.com/openssl/openssl/pull/30824)

Don't attempt to check the security level on what signed our own certificate.

2026-06-30T10:47:06Z

What matters to us is that the key *we* are using matches our desired security level, as we may sign things with that key. As far as who signed us, this could be signed by something we don't recognize at all, and it is up to the peer to decide if the thing signing us matters to it (i.e. if it recognizes the algorithm, decides it's strong enough, or it even verifies the signature, as it might already trusts our key due to pinning, TOFU, Prayer and Clean Living, or whatever.) Obviously, we still check the security level on any signatures *we* recieve to verify *from* a peer. Fixes: https://github.com/openssl/openssl/issues/31195 Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs MergeDate: Tue Jun 30 10:47:09 2026 (Merged from https://github.com/openssl/openssl/pull/31271)

SSL_OP_SECOP is dead code

2026-06-30T10:47:03Z

Nothing set the "vfy" parameters in any of these functions to anything but 0. Remove the parameter and stage things related to SSL_OP_SECOP to go away in the future. Reviewed-by: Neil Horman Reviewed-by: Norbert Pocs MergeDate: Tue Jun 30 10:47:07 2026 (Merged from https://github.com/openssl/openssl/pull/31271)

Remove aliases for IANA-GOST2012-GOST8912-GOST8912

2026-06-24T15:06:49Z

"gost2012_256/512" sigalgs aliases of IANA-GOST2012-GOST8912-GOST8912 equals to sigalgs of LEAGACY-GOST2012-GOST8912-GOST8912 so we can't distinguish between them for the legacy algorithm Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Dale Reviewed-by: Bob Beck Reviewed-by: Tomas Mraz MergeDate: Wed Jun 24 15:07:04 2026 (Merged from https://github.com/openssl/openssl/pull/31562)

Fix typo of 512 gost sigalg name from bcff020

2026-06-24T15:06:49Z

Reviewed-by: Eugene Syromiatnikov Reviewed-by: Paul Dale Reviewed-by: Bob Beck Reviewed-by: Tomas Mraz MergeDate: Wed Jun 24 15:07:02 2026 (Merged from https://github.com/openssl/openssl/pull/31562)

Fix off-by-one in "groups list" parser

2026-04-16T17:17:30Z

When parsing the configured TLS supported groups list reallocating of the list of "tuples" happened one element too late. The current tuple count is the number of "closed" (completed) tuples, the currently active tuple occupies one more slot, so we need space for `tuple count + 1` elements. This is only an issue while parsing configurations (not attacker controlled), and only if the group list somehow manages to contain 32 or distinct elements (each in its own tuple, and even though OpenSSL does not implement that many groups in typical builds). Reviewed-by: Nikola Pajkovsky Reviewed-by: Tomas Mraz MergeDate: Thu Apr 16 17:17:38 2026 (Merged from https://github.com/openssl/openssl/pull/30838)

Precompute some helper objects in each SSL_CTX

2026-04-13T09:03:43Z

Instead of repeated fetching, precompute the below per the library context and properties of the SSL_CTX and use them for the lifetime of the SSL_CTX. - HMAC algorithm handle (session ticket HMAC) - SHA2-256 algorithm handle (session ticket HMAC) - AES_256-CBC algorithm handle (session ticket en/decryption) - TLS1 PRF (when TLS <= 1.2 is supported) The "sha1" and "md5" handles are no longer used, and those fields are removed. The `SSL_HMAC` objects used internally are now stack allocated, and the associated "new" and "free" functions are now called "construct" and "destruct" respectively. Reviewed-by: Matt Caswell Reviewed-by: Nikola Pajkovsky MergeDate: Mon Apr 13 09:03:45 2026 (Merged from https://github.com/openssl/openssl/pull/30696)

Copyright year updates

2026-03-10T14:37:52Z

Reviewed-by: Tomas Mraz Reviewed-by: Eugene Syromiatnikov MergeDate: Tue Mar 10 14:37:54 2026 Release: yes