Commit 7508d1ca18 for openssl.org
commit 7508d1ca18968ea1b6e400bd74d9435806ee315d
Author: Frederik Wedel-Heinen <frederik.wedel-heinen@dencrypt.dk>
Date: Mon Sep 21 21:16:01 2026 +0200
ssl/record/methods: remove the SSL_MAC_BUF struct
This follows the suggestions in [1]: the struct type is no longer
needed, as it wraps a single field now. Remove the type declaration
and switch its users to using plain unsigned char *.
[1] https://github.com/openssl/openssl/pull/31721#pullrequestreview-5265705269
Complements: eba80400a25e "Removes unused member variable 'alloced' from SSL_MAC_BUF struct."
Suggested-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
Merge-date: Tue Nov 10 07:12:45 2026
Merged-from: https://github.com/openssl/openssl/pull/32944
diff --git a/.clang-format b/.clang-format
index 0c39b721a4..3cdf7345d9 100644
--- a/.clang-format
+++ b/.clang-format
@@ -989,7 +989,6 @@ TypeNames:
- "SSL_EARLY_DATA_STATE"
- "SSL_EXCERT"
- "SSL_HMAC"
- - "SSL_MAC_BUF"
- "SSL_METHOD"
- "SSL_new_pending_conn_cb_fn"
- "SSL_PHA_STATE"
diff --git a/ssl/record/methods/dtls_meth.c b/ssl/record/methods/dtls_meth.c
index 809e94e58b..8b22a5ffe5 100644
--- a/ssl/record/methods/dtls_meth.c
+++ b/ssl/record/methods/dtls_meth.c
@@ -140,7 +140,7 @@ static int dtls_process_record(OSSL_RECORD_LAYER *rl, DTLS_BITMAP *bitmap)
size_t mac_size = 0;
size_t rechdrsize = dtls_get_rec_header_size(rl->packet[0]);
unsigned char md[EVP_MAX_MD_SIZE];
- SSL_MAC_BUF macbuf = { NULL };
+ unsigned char *macbuf = NULL;
int ret = 0;
rr = &rl->rrec[0];
@@ -248,8 +248,8 @@ static int dtls_process_record(OSSL_RECORD_LAYER *rl, DTLS_BITMAP *bitmap)
/* rl->md_ctx != NULL => mac_size != -1 */
i = rl->funcs->mac(rl, rr, md, 0 /* not send */);
- if (i == 0 || macbuf.mac == NULL
- || CRYPTO_memcmp(md, macbuf.mac, mac_size) != 0)
+ if (i == 0 || macbuf == NULL
+ || CRYPTO_memcmp(md, macbuf, mac_size) != 0)
enc_err = 0;
if (rr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_size)
enc_err = 0;
diff --git a/ssl/record/methods/ktls_meth.c b/ssl/record/methods/ktls_meth.c
index 8e39c17c34..6a8eb5d16f 100644
--- a/ssl/record/methods/ktls_meth.c
+++ b/ssl/record/methods/ktls_meth.c
@@ -376,7 +376,7 @@ static int ktls_read_n(OSSL_RECORD_LAYER *rl, size_t n, size_t max, int extend,
}
static int ktls_cipher(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *inrecs,
- size_t n_recs, int sending, SSL_MAC_BUF *mac,
+ size_t n_recs, int sending, unsigned char **mac,
size_t macsize)
{
return 1;
diff --git a/ssl/record/methods/recmethod_local.h b/ssl/record/methods/recmethod_local.h
index b324ff762d..ad01692f8d 100644
--- a/ssl/record/methods/recmethod_local.h
+++ b/ssl/record/methods/recmethod_local.h
@@ -23,10 +23,6 @@ typedef struct dtls_bitmap_st {
uint64_t max_seq_num;
} DTLS_BITMAP;
-typedef struct ssl_mac_buf_st {
- unsigned char *mac;
-} SSL_MAC_BUF;
-
typedef struct tls_buffer_st {
/* at least SSL3_RT_MAX_PACKET_SIZE bytes */
unsigned char *buf;
@@ -117,7 +113,7 @@ struct record_functions_st {
* 1: Success or MtE decryption failed (MAC will be randomised)
*/
int (*cipher)(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *recs, size_t n_recs,
- int sending, SSL_MAC_BUF *macs, size_t macsize);
+ int sending, unsigned char **macs, size_t macsize);
/* Returns 1 for success or 0 for error */
int (*mac)(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec, unsigned char *md,
int sending);
diff --git a/ssl/record/methods/tls13_meth.c b/ssl/record/methods/tls13_meth.c
index 8fea9f7292..ac1f75de54 100644
--- a/ssl/record/methods/tls13_meth.c
+++ b/ssl/record/methods/tls13_meth.c
@@ -107,7 +107,7 @@ end:
}
static int tls13_cipher(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *recs,
- size_t n_recs, int sending, SSL_MAC_BUF *mac,
+ size_t n_recs, int sending, unsigned char **mac,
size_t macsize)
{
EVP_CIPHER_CTX *enc_ctx;
diff --git a/ssl/record/methods/tls1_meth.c b/ssl/record/methods/tls1_meth.c
index 06c80e2c3d..6bacbbc956 100644
--- a/ssl/record/methods/tls1_meth.c
+++ b/ssl/record/methods/tls1_meth.c
@@ -206,7 +206,7 @@ static int setup_record_header(const OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *rec,
* 1: Success or Mac-then-encrypt decryption failed (MAC will be randomised)
*/
static int tls1_cipher(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *recs,
- size_t n_recs, int sending, SSL_MAC_BUF *macs,
+ size_t n_recs, int sending, unsigned char **mac,
size_t macsize)
{
EVP_CIPHER_CTX *ds;
@@ -407,13 +407,12 @@ static int tls1_cipher(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *recs,
}
/* Now get a pointer to the MAC (if applicable) */
- if (macs != NULL) {
+ if (mac != NULL) {
OSSL_PARAM params[2], *p = params;
/* Get the MAC */
*p++ = OSSL_PARAM_construct_octet_ptr(OSSL_CIPHER_PARAM_TLS_MAC,
- (void **)&macs[0].mac,
- macsize);
+ (void **)mac, macsize);
*p = OSSL_PARAM_construct_end();
if (!EVP_CIPHER_CTX_get_params(ds, params)) {
diff --git a/ssl/record/methods/tls_common.c b/ssl/record/methods/tls_common.c
index fcbf585277..57b9d95a80 100644
--- a/ssl/record/methods/tls_common.c
+++ b/ssl/record/methods/tls_common.c
@@ -582,7 +582,7 @@ int tls_get_more_records(OSSL_RECORD_LAYER *rl)
int imac_size;
size_t num_recs = 0, max_recs, j;
PACKET pkt;
- SSL_MAC_BUF *macbufs = NULL;
+ unsigned char **macbufs = NULL;
int ret = OSSL_RECORD_RETURN_FATAL;
rr = rl->rrec;
@@ -853,18 +853,18 @@ int tls_get_more_records(OSSL_RECORD_LAYER *rl)
&& !rl->use_etm
&& EVP_MD_CTX_get0_md(rl->md_ctx) != NULL) {
for (j = 0; j < num_recs; j++) {
- SSL_MAC_BUF *thismb = &macbufs[j];
+ unsigned char *thismb = macbufs[j];
thisrr = &rr[j];
i = rl->funcs->mac(rl, thisrr, md, 0 /* not send */);
- if (i == 0 || thismb == NULL || thismb->mac == NULL
- || CRYPTO_memcmp(md, thismb->mac, (size_t)mac_size) != 0)
+ if (i == 0 || thismb == NULL
+ || CRYPTO_memcmp(md, thismb, (size_t)mac_size) != 0)
enc_err = 0;
if (thisrr->length > SSL3_RT_MAX_COMPRESSED_LENGTH + mac_size)
enc_err = 0;
#ifdef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
- if (enc_err == 0 && mac_size > 0 && thismb != NULL && thismb->mac != NULL && (md[0] ^ thismb->mac[0]) != 0xFF) {
+ if (enc_err == 0 && mac_size > 0 && thismb != NULL && (md[0] ^ thismb[0]) != 0xFF) {
enc_err = 1;
}
#endif
diff --git a/ssl/record/methods/tlsany_meth.c b/ssl/record/methods/tlsany_meth.c
index 55d5f77c4b..21afa4af50 100644
--- a/ssl/record/methods/tlsany_meth.c
+++ b/ssl/record/methods/tlsany_meth.c
@@ -37,7 +37,7 @@ static int tls_any_set_crypto_state(OSSL_RECORD_LAYER *rl, int level,
}
static int tls_any_cipher(OSSL_RECORD_LAYER *rl, TLS_RL_RECORD *recs,
- size_t n_recs, int sending, SSL_MAC_BUF *macs,
+ size_t n_recs, int sending, unsigned char **macs,
size_t macsize)
{
return 1;