CLEANUP: quic: remove the unused key parameter from quic_tls_decrypt()

The key parameter of quic_tls_decrypt() and quic_tls_decrypt2() is never
read: the key is installed in the cipher context by
quic_tls_rx_ctx_init(), only the IV differs per packet. Dead since the
cipher contexts became reusable (commit f4605748f).

diff --git a/include/haproxy/quic_tls.h b/include/haproxy/quic_tls.h
index 5cef804d0b0b2616e4dc0243ba153697859d15ce..a4d223722f218384a887b605c9e69861c3573caf 100644 (file)
--- a/include/haproxy/quic_tls.h
+++ b/include/haproxy/quic_tls.h
@@ -66,12 +66,12 @@ int quic_tls_decrypt2(unsigned char *out,
                       unsigned char *in, size_t ilen,
                       unsigned char *aad, size_t aad_len,
                       QUIC_AEAD_CTX *ctx, const QUIC_AEAD *aead,
-                      const unsigned char *key, const unsigned char *iv);
+                      const unsigned char *iv);
 
 int quic_tls_decrypt(unsigned char *buf, size_t len,
                      unsigned char *aad, size_t aad_len,
                      QUIC_AEAD_CTX *tls_ctx, const QUIC_AEAD *aead,
-                     const unsigned char *key, const unsigned char *iv);
+                     const unsigned char *iv);
 
 int quic_tls_generate_retry_integrity_tag(unsigned char *odcid, unsigned char odcid_len,
                                           const unsigned char *buf, size_t len,

diff --git a/src/quic_retry.c b/src/quic_retry.c
index 23b74d8fca51ef4894581d95c9c33d58312ff812..6580646605c700044c5cae8728a3838fa186d38a 100644 (file)
--- a/src/quic_retry.c
+++ b/src/quic_retry.c
@@ -299,7 +299,7 @@ int quic_retry_token_check(struct quic_rx_packet *pkt,
 
        /* The token is prefixed by a one-byte length format which is not ciphered. */
        if (!quic_tls_decrypt2(buf, token + 1, tokenlen - QUIC_RETRY_TOKEN_SALTLEN - 1, aad, aadlen,
-                              ctx, aead, key, iv)) {
+                              ctx, aead, iv)) {
                TRACE_ERROR("Could not decrypt retry token", QUIC_EV_CONN_LPKT, qc);
                goto err;
        }

diff --git a/src/quic_rx.c b/src/quic_rx.c
index e90c76e094a113e1c98ba7912664bbadab2d0e7d..5dff2f3987dcf7a6104f71b81984f7de702339db 100644 (file)
--- a/src/quic_rx.c
+++ b/src/quic_rx.c
@@ -133,7 +133,6 @@ static int qc_pkt_decrypt(struct quic_conn *qc, struct quic_enc_level *qel,
        QUIC_AEAD_CTX *rx_ctx = tls_ctx->rx.ctx;
        unsigned char *rx_iv = tls_ctx->rx.iv;
        size_t rx_iv_sz = tls_ctx->rx.ivlen;
-       unsigned char *rx_key = tls_ctx->rx.key;
 
        TRACE_ENTER(QUIC_EV_CONN_RXPKT, qc);
 
@@ -158,7 +157,6 @@ static int qc_pkt_decrypt(struct quic_conn *qc, struct quic_enc_level *qel,
 
                                rx_ctx = qc->ku.prv_rx.ctx;
                                rx_iv  = qc->ku.prv_rx.iv;
-                               rx_key = qc->ku.prv_rx.key;
                                kp_prv = 1;
                        }
                        else if (pkt->pn > qel->pktns->rx.largest_pn) {
@@ -177,7 +175,6 @@ static int qc_pkt_decrypt(struct quic_conn *qc, struct quic_enc_level *qel,
                                kp_changed = 1;
                                rx_ctx = qc->ku.nxt_rx.ctx;
                                rx_iv  = qc->ku.nxt_rx.iv;
-                               rx_key = qc->ku.nxt_rx.key;
                        }
                }
        }
@@ -186,7 +183,7 @@ static int qc_pkt_decrypt(struct quic_conn *qc, struct quic_enc_level *qel,
 
        ret = quic_tls_decrypt(pkt->data + pkt->aad_len, pkt->len - pkt->aad_len,
                               pkt->data, pkt->aad_len,
-                              rx_ctx, tls_ctx->rx.aead, rx_key, iv);
+                              rx_ctx, tls_ctx->rx.aead, iv);
        if (!ret) {
                TRACE_ERROR("quic_tls_decrypt() failed", QUIC_EV_CONN_RXPKT, qc);
 

diff --git a/src/quic_tls.c b/src/quic_tls.c
index 2ef40c13dd197b5f3c9b81e87c53fe6a9afea579..00264b084cde505823deabca4a20bb8d09ed52b2 100644 (file)
--- a/src/quic_tls.c
+++ b/src/quic_tls.c
@@ -867,7 +867,7 @@ int quic_tls_encrypt(unsigned char *buf, size_t len,
 int quic_tls_decrypt(unsigned char *buf, size_t len,
                      unsigned char *aad, size_t aad_len,
                      QUIC_AEAD_CTX *ctx, const QUIC_AEAD *aead,
-                     const unsigned char *key, const unsigned char *iv)
+                     const unsigned char *iv)
 {
 #ifdef QUIC_AEAD_API
        size_t outlen;
@@ -916,7 +916,7 @@ int quic_tls_decrypt2(unsigned char *out,
                       unsigned char *in, size_t len,
                       unsigned char *aad, size_t aad_len,
                       QUIC_AEAD_CTX *ctx, const QUIC_AEAD *aead,
-                      const unsigned char *key, const unsigned char *iv)
+                      const unsigned char *iv)
 {
 #ifdef QUIC_AEAD_API
        size_t outlen;

diff --git a/src/quic_token.c b/src/quic_token.c
index 2ac5458af4c4cbe198cc29e23bcaf35c7adde7f3..8a8eced13919defba4e8e6df9666a3ca9a9a211e 100644 (file)
--- a/src/quic_token.c
+++ b/src/quic_token.c
@@ -149,7 +149,7 @@ int quic_token_check(struct quic_rx_packet *pkt,
 
        /* The token is prefixed by a one-byte length format which is not ciphered. */
        if (!quic_tls_decrypt2(buf, token + 1, tokenlen - QUIC_TOKEN_RAND_DLEN - 1, aad, aadlen,
-                              ctx, aead, key, iv)) {
+                              ctx, aead, iv)) {
                TRACE_ERROR("Could not decrypt token", QUIC_EV_CONN_LPKT, qc);
                goto err;
        }