openssl/util/missingmacro.txt, branch dependabot/github_actions/actions/setup-python-7

Improve TLS handling of EC point formats

2026-07-10T09:21:28Z

Decouple the ec_point_formats extension from TLS 1.2 X.509 selection and acceptance. Remove tls1_check_pkey_comp() and its callers in tls1_check_cert_param() and tls1_check_chain(): TLS 1.3 disregards the extension already, and we can decode any point form a peer might send, so refusing a compressed peer cert in TLS 1.2 because we didn't advertise compressed buys nothing. The RFC 4492/8422 section 5.1.2 requirement that the peer's list contain "uncompressed" used to be enforced in a final hook on the client side only. Move it to the two points where the negotiated ciphersuite is known: the client's ServerHello parse hook, and the server's ServerHello construct hook. Both sites fire the alert only when an ECC TLS 1.2 ciphersuite has been negotiated, so a missing "uncompressed" is ignored under TLS 1.3 or a non-ECC cipher. The client- and server-side parse hooks now share one function. Drop the always-NULL ext.ecpointformats fields on SSL_CTX and SSL; our own list is built directly inside the constructors. The peer's list continues to be stored verbatim, and is also exposed through the SSL_get0_ec_point_formats() accessor (now documented). New tests verify the four corners (ECC vs non-ECC ciphersuite, TLS 1.2 vs 1.3) plus that a compressed point form EC cert is usable on both sides without any opt-in. Reviewed-by: Neil Horman Reviewed-by: Matt Caswell MergeDate: Fri Jul 10 09:21:30 2026 (Merged from https://github.com/openssl/openssl/pull/30940)

BIO_s_dgram: add documentation and hazard warnings

2022-12-15T06:32:45Z

Reviewed-by: Tomas Mraz Reviewed-by: Paul Dale (Merged from https://github.com/openssl/openssl/pull/19795)

Add deprecation macro for 3.1 and deprecate OPENSSL_LH_stats

2022-06-22T07:36:14Z

Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/17937)

Add TFO support to socket BIO and s_client/s_server

2022-03-10T15:42:43Z

Supports Linux, MacOS and FreeBSD Disabled by default, enabled via `enabled-tfo` Some tests Reviewed-by: Matt Caswell Reviewed-by: Tomas Mraz Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/8692)

Cleanup the missing*.txt files

2021-05-21T09:03:37Z

One macro existed that was added since 1.1.1 and was undocumented. This had been added to missingmacro.txt. This is the wrong approach and so has been removed from there. There were some entries in missingcrypto.txt that don't exist as functions at all. There were also some which were in fact documented. Additionally 2 entries from missingcrypto.txt have been moved to missingmacro.txt. These entries existed in 1.1.1 and were undocumented. In master they have been deprecated and compatibility macros for them implemented. The replacement functions have been documented. An entry in missingcrypto111.txt was not in alphabetical order (and was also) duplicated, but the equivalent entry in missingcrypto.txt was in the correct place. This has been corrected to make comparisons between the files easier. Finally a function has been added to missingcrypto111.txt. This function did exist in 1.1.1 and was undocumented. Its unclear why this wasn't in missingcrypto111.txt to start with. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/15333)

Document the OSSL_PARAM_DEFN macro

2021-02-22T12:15:34Z

This macro was added since 1.1.1 and was undocumented. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/14232)

Add documentation for the macro OPENSSL_VERSION_PREREQ

2021-02-22T12:15:34Z

This macro was added since 1.1.1 but had no associated documentation. Reviewed-by: Paul Dale Reviewed-by: Tomas Mraz Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/14232)

Add X509V3_set_issuer_pkey, needed for AKID of self-issued not self-signed cert

2021-01-13T10:53:15Z

Also clean up some related auxiliary functions and documentation Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/13658)

Document some SSL DH related functions/macros

2020-11-18T14:14:53Z

Reviewed-by: Richard Levitte (Merged from https://github.com/openssl/openssl/pull/13368)

util/find-doc-nits: ignore OSSL_DEPRECATED*, alongside other reserved symbols

2020-11-01T04:57:42Z

Reviewed-by: Tomas Mraz (Merged from https://github.com/openssl/openssl/pull/13240)