[julek-wolfssl]

Several wolfSSL setters could leave a CTX or SSL half-modified when they failed. This change makes them apply their result only on success, and fixes related cipher suite and option handling.

Protocol versions

• The CTX and SSL min/max protocol version setters work on a copy of the version limits and store it only on success. Before, a failing call could disable every version or re-enable versions the application had disabled with options.
• The CTX setters record the NO_* options they set and drop only those, so application options are kept and a later call can lower the min or raise the max. The max setter no longer re-applies the min. wolfSSL_CTX_set_options(), wolfSSL_CTX_clear_options() and wolfSSL_CTX_SetMinVersion() update the records.
• A call fails when no version is left from the min up, counting a min held only in minDowngrade (the default, one set with wolfSSL_CTX_SetMinVersion() or wolfSSL_SetMinVersion(), or the crypto policy's). In old TLS builds without TLS 1.0, a TLS 1.0 min is TLS 1.1.
• A DTLS min on a TLS CTX fails, as does an SSL max of the other major version.
• The CTX max setter rebuilds ctx->suites when it changes the method version.
• wolfSSL_CTX_SetMinVersion() clears the automatic min flag.
• WOLFSSL_MIN_DOWNGRADE is TLS 1.1 in old TLS builds without WOLFSSL_ALLOW_TLSV10.
• With WOLFSSL_SYS_CRYPTO_POLICY at level 0, including when no policy is loaded, a new TLS CTX keeps the default min instead of an SSLv3 min.

Cipher suites

• The CTX PSK callback setters and wolfSSL_CTX_allow_anon_cipher() rebuild ctx->suites when it was already derived. The max setter no longer leaves the min's options in ctx->mask. Previously, SSLs created after a late PSK callback shared stale CTX suites without PSK. A cipher list set by the application is kept.

Groups

• wolfSSL_CTX_set_groups() and wolfSSL_set_groups() build the Supported Groups extension in a local list and replace the old one only on success. They move from tls.c to ssl_api_ext.c.
• set_curves_list() sets the groups once, after parsing.
• wolfSSL_UseSupportedCurve() and wolfSSL_CTX_UseSupportedCurve() set userCurves only when the group was added.

Signature algorithms

• SetSuitesHashSigAlgo() parses into a local buffer and copies it only when the whole list parses.
• wolfSSL_CTX_set1_sigalgs_list() on a CTX without suites frees the suites it allocated when the list is rejected, and adds the default cipher suites when it is accepted.

ZD22696

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m3

• FLASH: .text +100 B (+0.1%, 131,437 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

• FLASH: .text +128 B (+0.1%, 208,432 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 195,032 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .rodata +24 B, .text +128 B (+0.0%, 796,276 B / 1,048,576 B, total: 76% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +64 B (+0.0%, 311,760 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 342,472 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.0%, 132,177 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 248,738 B / 262,144 B, total: 95% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 208,432 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 312,656 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +128 B (+0.1%, 248,802 B / 262,144 B, total: 95% used)

zephyr-frdm_rw612

• FLASH: rodata +100 B, text +1,680 B (+0.6%, 284,048 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟢 Approval recommended

No active review issues are reported for the setter-state preservation and derived cipher-suite consistency changes.

No open issues 🎉

What changed in this PR

This PR makes wolfSSL protocol-version, group, and signature-algorithm setters preserve existing state when a call fails. It also keeps derived cipher suites consistent with later configuration changes.

Changes:

• Apply protocol limits only on success while preserving application-set options and default minimum versions.
• Validate group and signature-algorithm lists before replacing existing settings.
• Refresh derived cipher suites after relevant configuration changes and add regression tests for state preservation and handshake behavior.

File	Description
wolfssl/​internal.h	Track setter-owned protocol options and adjust the default minimum version.
tests/​api.c	Add regression coverage for failed setters, option preservation, and cipher-suite updates.
src/​tls13.c	Refresh derived CTX suites when TLS 1.3 PSK callbacks change.
src/​tls.c	Remove group setters relocated to ssl_api_ext.c.
src/​ssl.c	Stage protocol-limit changes, track option ownership, refresh suites, and defer group updates until parsing completes.
src/​ssl_api_ext.c	Replace groups only on success and handle fresh signature-algorithm suite allocation.
src/​internal.c	Preserve signature algorithms on parse failure and correct the crypto-policy default minimum.

_{Review effort: Balanced}