Removes fixed version TLS methods.

Fixes #28343

Reviewed-by: Kurt Roeckx <kurt@roeckx.be>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Paul Dale <paul.dale@oracle.com>
Reviewed-by: Neil Horman <nhorman@openssl.org>
MergeDate: Tue Feb 24 21:19:39 2026
(Merged from https://github.com/openssl/openssl/pull/30128)

diff --git a/doc/man3/SSL_CTX_new.pod b/doc/man3/SSL_CTX_new.pod
index ba24120f771151c83db5b1cb51248f6c0db29570..2e2282d6957d15e6081f21c856bc962fedfdf982 100644 (file)
--- a/doc/man3/SSL_CTX_new.pod
+++ b/doc/man3/SSL_CTX_new.pod
@@ -2,15 +2,9 @@
 
 =head1 NAME
 
-TLSv1_2_method, TLSv1_2_server_method, TLSv1_2_client_method,
-SSL_CTX_new, SSL_CTX_new_ex, SSL_CTX_up_ref, SSLv3_method,
-SSLv3_server_method, SSLv3_client_method, TLSv1_method, TLSv1_server_method,
-TLSv1_client_method, TLSv1_1_method, TLSv1_1_server_method,
-TLSv1_1_client_method, TLS_method, TLS_server_method, TLS_client_method,
-SSLv23_method, SSLv23_server_method, SSLv23_client_method, DTLS_method,
-DTLS_server_method, DTLS_client_method, DTLSv1_method, DTLSv1_server_method,
-DTLSv1_client_method, DTLSv1_2_method, DTLSv1_2_server_method,
-DTLSv1_2_client_method
+SSL_CTX_new, SSL_CTX_new_ex, SSL_CTX_up_ref, TLS_method, TLS_server_method,
+TLS_client_method, SSLv23_method, SSLv23_server_method, SSLv23_client_method,
+DTLS_method, DTLS_server_method, DTLS_client_method
 - create a new SSL_CTX object as framework for TLS/SSL or DTLS enabled
 functions
 
@@ -31,46 +25,10 @@ functions
  const SSL_METHOD *SSLv23_server_method(void);
  const SSL_METHOD *SSLv23_client_method(void);
 
- #ifndef OPENSSL_NO_SSL3_METHOD
- const SSL_METHOD *SSLv3_method(void);
- const SSL_METHOD *SSLv3_server_method(void);
- const SSL_METHOD *SSLv3_client_method(void);
- #endif
-
- #ifndef OPENSSL_NO_TLS1_METHOD
- const SSL_METHOD *TLSv1_method(void);
- const SSL_METHOD *TLSv1_server_method(void);
- const SSL_METHOD *TLSv1_client_method(void);
- #endif
-
- #ifndef OPENSSL_NO_TLS1_1_METHOD
- const SSL_METHOD *TLSv1_1_method(void);
- const SSL_METHOD *TLSv1_1_server_method(void);
- const SSL_METHOD *TLSv1_1_client_method(void);
- #endif
-
- #ifndef OPENSSL_NO_TLS1_2_METHOD
- const SSL_METHOD *TLSv1_2_method(void);
- const SSL_METHOD *TLSv1_2_server_method(void);
- const SSL_METHOD *TLSv1_2_client_method(void);
- #endif
-
  const SSL_METHOD *DTLS_method(void);
  const SSL_METHOD *DTLS_server_method(void);
  const SSL_METHOD *DTLS_client_method(void);
 
- #ifndef OPENSSL_NO_DTLS1_METHOD
- const SSL_METHOD *DTLSv1_method(void);
- const SSL_METHOD *DTLSv1_server_method(void);
- const SSL_METHOD *DTLSv1_client_method(void);
- #endif
-
- #ifndef OPENSSL_NO_DTLS1_2_METHOD
- const SSL_METHOD *DTLSv1_2_method(void);
- const SSL_METHOD *DTLSv1_2_server_method(void);
- const SSL_METHOD *DTLSv1_2_client_method(void);
- #endif
-
 =head1 DESCRIPTION
 
 SSL_CTX_new_ex() creates a new B<SSL_CTX> object, which holds various
@@ -120,15 +78,6 @@ can be one of the following:
 
 =over 4
 
-=item TLS_method(), TLS_server_method(), TLS_client_method()
-
-These are the general-purpose I<version-flexible> SSL/TLS methods.
-The actual protocol version used will be negotiated to the highest version
-mutually supported by the client and the server.
-The supported protocols are TLSv1, TLSv1.1, TLSv1.2 and TLSv1.3.
-Applications should use these methods, and avoid the version-specific
-methods described below, which are deprecated.
-
 =item SSLv23_method(), SSLv23_server_method(), SSLv23_client_method()
 
 These functions do not exist anymore, they have been renamed to
@@ -138,39 +87,17 @@ ones by preprocessor macros, to ensure that existing code which uses the
 old function names still compiles. However, using the old function names
 is deprecated and new code should call the new functions instead.
 
-=item TLSv1_2_method(), TLSv1_2_server_method(), TLSv1_2_client_method()
-
-A TLS/SSL connection established with these methods will only understand the
-TLSv1.2 protocol. These methods are deprecated.
-
-=item TLSv1_1_method(), TLSv1_1_server_method(), TLSv1_1_client_method()
-
-A TLS/SSL connection established with these methods will only understand the
-TLSv1.1 protocol.  These methods are deprecated.
-
-=item TLSv1_method(), TLSv1_server_method(), TLSv1_client_method()
-
-A TLS/SSL connection established with these methods will only understand the
-TLSv1 protocol. These methods are deprecated.
-
-=item SSLv3_method(), SSLv3_server_method(), SSLv3_client_method()
+=item TLS_method(), TLS_server_method(), TLS_client_method()
 
-Starting in version 3.6 those functions always return NULL.
+These are the general-purpose I<version-flexible> SSL/TLS methods.
+The actual protocol version used will be negotiated to the highest version
+mutually supported by the client and the server.
+The supported protocols are TLSv1, TLSv1.1, TLSv1.2 and TLSv1.3.
 
 =item DTLS_method(), DTLS_server_method(), DTLS_client_method()
 
 These are the version-flexible DTLS methods.
-Currently supported protocols are DTLS 1.0 and DTLS 1.2.
-
-=item DTLSv1_2_method(), DTLSv1_2_server_method(), DTLSv1_2_client_method()
-
-These are the version-specific methods for DTLSv1.2.
-These methods are deprecated.
-
-=item DTLSv1_method(), DTLSv1_server_method(), DTLSv1_client_method()
-
-These are the version-specific methods for DTLSv1.
-These methods are deprecated.
+The supported protocols are DTLS 1.0 and DTLS 1.2.
 
 =back
 
@@ -180,8 +107,6 @@ callbacks, the keys and certificates and the options to their default values.
 TLS_method(), TLS_server_method(), TLS_client_method(), DTLS_method(),
 DTLS_server_method() and DTLS_client_method() are the I<version-flexible>
 methods.
-All other methods only support one specific protocol version.
-Use the I<version-flexible> methods instead of the version specific methods.
 
 If you want to limit the supported protocols for the version flexible
 methods you can use L<SSL_CTX_set_min_proto_version(3)>,
@@ -247,6 +172,8 @@ All version-specific methods were deprecated in OpenSSL 1.1.0.
 
 SSL_CTX_new_ex() was added in OpenSSL 3.0.
 
+All version-specific methods were removed in OpenSSL 4.0.
+
 =head1 COPYRIGHT
 
 Copyright 2000-2023 The OpenSSL Project Authors. All Rights Reserved.

diff --git a/doc/man7/ossl-guide-migration.pod b/doc/man7/ossl-guide-migration.pod
index 3fc59c3bb1fc06cac755a97c9b82352a97784c2b..ffaf31abee33fcd386e48c25605a676fea5f8f69 100644 (file)
--- a/doc/man7/ossl-guide-migration.pod
+++ b/doc/man7/ossl-guide-migration.pod
@@ -46,6 +46,22 @@ Memory leak detectors may report there is allocated, but still reachable,
 allocated memory at application exit. If clean report is desired, then
 application must call OPENSSL_cleanup() explicitly before main() returns.
 
+=head3 Removal of fixed (D)TLS version method functions
+
+SSLv3_method(), SSLv3_server_method(), SSLv3_client_method(),
+TLSv1_method(), TLSv1_server_method(), TLSv1_client_method(),
+TLSv1_1_method(), TLSv1_1_server_method(), TLSv1_1_client_method(),
+TLSv1_2_method(), TLSv1_2_server_method(), TLSv1_2_client_method(),
+DTLSv1_method(), DTLSv1_server_method(), DTLSv1_client_method(),
+DTLSv1_2_method(), DTLSv1_2_server_method() and DTLSv1_2_client_method()
+were deprecated in the OpenSSL 1.1.0 release.
+
+Migrating applications should use
+TLS_method(), TLS_server_method(), TLS_client_method(),
+TLS_method(), TLS_server_method(), TLS_client_method(),
+instead and set the version with the SSL_CTX_set_min_proto_version() and/or
+SSL_CTX_set_max_proto_version() api's.
+
 =head3 Deprecation of EVP_MD_CTX_get0_md_data()
 
 The function EVP_MD_CTX_get0_md_data() has been deprecated in 4.0. This function

diff --git a/fuzz/client.c b/fuzz/client.c
index d916218c27a1bbbf6213aa3e82182c0588a6b0d4..7753aa134c039bb60b2f6e8e5670a517c4f89c5c 100644 (file)
--- a/fuzz/client.c
+++ b/fuzz/client.c
@@ -69,7 +69,7 @@ int FuzzerTestOneInput(const uint8_t *buf, size_t len)
         return 0;
 
     /* This only fuzzes the initial flow from the client so far. */
-    ctx = SSL_CTX_new(SSLv23_method());
+    ctx = SSL_CTX_new(TLS_method());
     if (ctx == NULL)
         goto end;
 

diff --git a/fuzz/server.c b/fuzz/server.c
index a9ff6c5e1c242eb278442f36faec448f6454e332..70302ed73c68c0d77535c17ba6f0068fd28a8086 100644 (file)
--- a/fuzz/server.c
+++ b/fuzz/server.c
@@ -2343,7 +2343,7 @@ int FuzzerTestOneInput(const uint8_t *buf, size_t len)
         return 0;
 
     /* This only fuzzes the initial flow from the client so far. */
-    ctx = SSL_CTX_new(SSLv23_method());
+    ctx = SSL_CTX_new(TLS_method());
     OPENSSL_assert(ctx != NULL);
     ret = SSL_CTX_set_min_proto_version(ctx, 0);
     OPENSSL_assert(ret == 1);

diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
index ca2701a0ad42717c001b95f3cb921d58d86c647f..abb6db8c1decb463df31a7bbda0eaca9ceef35a0 100644 (file)
--- a/include/openssl/ssl.h.in
+++ b/include/openssl/ssl.h.in
@@ -2039,14 +2039,6 @@ OSSL_DEPRECATEDIN_3_0
 __owur int SSL_CTX_set_ssl_version(SSL_CTX *ctx, const SSL_METHOD *meth);
 #endif
 
-#ifndef OPENSSL_NO_SSL3_METHOD
-#ifndef OPENSSL_NO_DEPRECATED_1_1_0
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *SSLv3_method(void); /* SSLv3 */
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *SSLv3_server_method(void);
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *SSLv3_client_method(void);
-#endif
-#endif
-
 #define SSLv23_method TLS_method
 #define SSLv23_server_method TLS_server_method
 #define SSLv23_client_method TLS_client_method
@@ -2056,47 +2048,6 @@ __owur const SSL_METHOD *TLS_method(void);
 __owur const SSL_METHOD *TLS_server_method(void);
 __owur const SSL_METHOD *TLS_client_method(void);
 
-#ifndef OPENSSL_NO_TLS1_METHOD
-#ifndef OPENSSL_NO_DEPRECATED_1_1_0
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *TLSv1_method(void); /* TLSv1.0 */
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *TLSv1_server_method(void);
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *TLSv1_client_method(void);
-#endif
-#endif
-
-#ifndef OPENSSL_NO_TLS1_1_METHOD
-#ifndef OPENSSL_NO_DEPRECATED_1_1_0
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *TLSv1_1_method(void); /* TLSv1.1 */
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *TLSv1_1_server_method(void);
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *TLSv1_1_client_method(void);
-#endif
-#endif
-
-#ifndef OPENSSL_NO_TLS1_2_METHOD
-#ifndef OPENSSL_NO_DEPRECATED_1_1_0
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *TLSv1_2_method(void); /* TLSv1.2 */
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *TLSv1_2_server_method(void);
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *TLSv1_2_client_method(void);
-#endif
-#endif
-
-#ifndef OPENSSL_NO_DTLS1_METHOD
-#ifndef OPENSSL_NO_DEPRECATED_1_1_0
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *DTLSv1_method(void); /* DTLSv1.0 */
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *DTLSv1_server_method(void);
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *DTLSv1_client_method(void);
-#endif
-#endif
-
-#ifndef OPENSSL_NO_DTLS1_2_METHOD
-/* DTLSv1.2 */
-#ifndef OPENSSL_NO_DEPRECATED_1_1_0
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *DTLSv1_2_method(void);
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *DTLSv1_2_server_method(void);
-OSSL_DEPRECATEDIN_1_1_0 __owur const SSL_METHOD *DTLSv1_2_client_method(void);
-#endif
-#endif
-
 __owur const SSL_METHOD *DTLS_method(void); /* DTLS 1.0 and 1.2 */
 __owur const SSL_METHOD *DTLS_server_method(void); /* DTLS 1.0 and 1.2 */
 __owur const SSL_METHOD *DTLS_client_method(void); /* DTLS 1.0 and 1.2 */

diff --git a/ssl/methods.c b/ssl/methods.c
index 35d84444f1a704c9b817d44eb6ac4a6070ba9dc9..e7e122798b06869e39a851e830f53795956415b0 100644 (file)
--- a/ssl/methods.c
+++ b/ssl/methods.c
@@ -162,107 +162,3 @@ IMPLEMENT_dtls1_meth_func(DTLS_ANY_VERSION, 0, 0,
     DTLS_client_method,
     ssl_undefined_function,
     ossl_statem_connect, DTLSv1_2_enc_data)
-#ifndef OPENSSL_NO_DEPRECATED_1_1_0
-#ifndef OPENSSL_NO_TLS1_2_METHOD
-const SSL_METHOD *TLSv1_2_method(void)
-{
-    return tlsv1_2_method();
-}
-
-const SSL_METHOD *TLSv1_2_server_method(void)
-{
-    return tlsv1_2_server_method();
-}
-
-const SSL_METHOD *TLSv1_2_client_method(void)
-{
-    return tlsv1_2_client_method();
-}
-#endif
-
-#ifndef OPENSSL_NO_TLS1_1_METHOD
-const SSL_METHOD *TLSv1_1_method(void)
-{
-    return tlsv1_1_method();
-}
-
-const SSL_METHOD *TLSv1_1_server_method(void)
-{
-    return tlsv1_1_server_method();
-}
-
-const SSL_METHOD *TLSv1_1_client_method(void)
-{
-    return tlsv1_1_client_method();
-}
-#endif
-
-#ifndef OPENSSL_NO_TLS1_METHOD
-const SSL_METHOD *TLSv1_method(void)
-{
-    return tlsv1_method();
-}
-
-const SSL_METHOD *TLSv1_server_method(void)
-{
-    return tlsv1_server_method();
-}
-
-const SSL_METHOD *TLSv1_client_method(void)
-{
-    return tlsv1_client_method();
-}
-#endif
-
-#ifndef OPENSSL_NO_SSL3_METHOD
-const SSL_METHOD *SSLv3_method(void)
-{
-    return NULL;
-}
-
-const SSL_METHOD *SSLv3_server_method(void)
-{
-    return NULL;
-}
-
-const SSL_METHOD *SSLv3_client_method(void)
-{
-    return NULL;
-}
-#endif
-
-#ifndef OPENSSL_NO_DTLS1_2_METHOD
-const SSL_METHOD *DTLSv1_2_method(void)
-{
-    return dtlsv1_2_method();
-}
-
-const SSL_METHOD *DTLSv1_2_server_method(void)
-{
-    return dtlsv1_2_server_method();
-}
-
-const SSL_METHOD *DTLSv1_2_client_method(void)
-{
-    return dtlsv1_2_client_method();
-}
-#endif
-
-#ifndef OPENSSL_NO_DTLS1_METHOD
-const SSL_METHOD *DTLSv1_method(void)
-{
-    return dtlsv1_method();
-}
-
-const SSL_METHOD *DTLSv1_server_method(void)
-{
-    return dtlsv1_server_method();
-}
-
-const SSL_METHOD *DTLSv1_client_method(void)
-{
-    return dtlsv1_client_method();
-}
-#endif
-
-#endif

diff --git a/util/libssl.num b/util/libssl.num
index dca18a55c625f9e8d1b89ea8422d6c0aa5a0bf17..2c50b8aba70cf74db0b9107386f83f96b6f2560b 100644 (file)
--- a/util/libssl.num
+++ b/util/libssl.num
@@ -345,27 +345,9 @@ SSL_get_error                           ?  4_0_0   EXIST::FUNCTION:
 SSL_get_version                         ?      4_0_0   EXIST::FUNCTION:
 SSL_get_handshake_rtt                   ?      4_0_0   EXIST::FUNCTION:
 SSL_CTX_set_ssl_version                 ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_3_0
-SSLv3_method                            ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
-SSLv3_server_method                     ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
-SSLv3_client_method                     ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,SSL3_METHOD
 TLS_method                              ?      4_0_0   EXIST::FUNCTION:
 TLS_server_method                       ?      4_0_0   EXIST::FUNCTION:
 TLS_client_method                       ?      4_0_0   EXIST::FUNCTION:
-TLSv1_method                            ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_METHOD
-TLSv1_server_method                     ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_METHOD
-TLSv1_client_method                     ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_METHOD
-TLSv1_1_method                          ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_1_METHOD
-TLSv1_1_server_method                   ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_1_METHOD
-TLSv1_1_client_method                   ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_1_METHOD
-TLSv1_2_method                          ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_2_METHOD
-TLSv1_2_server_method                   ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_2_METHOD
-TLSv1_2_client_method                   ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,TLS1_2_METHOD
-DTLSv1_method                           ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_METHOD
-DTLSv1_server_method                    ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_METHOD
-DTLSv1_client_method                    ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_METHOD
-DTLSv1_2_method                         ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_2_METHOD
-DTLSv1_2_server_method                  ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_2_METHOD
-DTLSv1_2_client_method                  ?      4_0_0   EXIST::FUNCTION:DEPRECATEDIN_1_1_0,DTLS1_2_METHOD
 DTLS_method                             ?      4_0_0   EXIST::FUNCTION:
 DTLS_server_method                      ?      4_0_0   EXIST::FUNCTION:
 DTLS_client_method                      ?      4_0_0   EXIST::FUNCTION: