From: Frederic Lecaille <flecaille@haproxy.com>
Date: Thu, 29 Oct 2026 14:08:28 +0000 (+0100)
Subject: CLEANUP: quic: remove the unused key parameter from quic_tls_decrypt()
X-Git-Tag: v3.5-dev11~70
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=2902a959f9d135d0004603eb39691978af683185;p=haproxy.git

CLEANUP: quic: remove the unused key parameter from quic_tls_decrypt()

The key parameter of quic_tls_decrypt() and quic_tls_decrypt2() is never
read: the key is installed in the cipher context by
quic_tls_rx_ctx_init(), only the IV differs per packet. Dead since the
cipher contexts became reusable (commit f4605748f).
---

diff --git a/include/haproxy/quic_tls.h b/include/haproxy/quic_tls.h
index 5cef804d0..a4d223722 100644
--- a/include/haproxy/quic_tls.h
+++ b/include/haproxy/quic_tls.h
@@ -66,12 +66,12 @@ int quic_tls_decrypt2(unsigned char *out,
                       unsigned char *in, size_t ilen,
                       unsigned char *aad, size_t aad_len,
                       QUIC_AEAD_CTX *ctx, const QUIC_AEAD *aead,
-                      const unsigned char *key, const unsigned char *iv);
+                      const unsigned char *iv);
 
 int quic_tls_decrypt(unsigned char *buf, size_t len,
                      unsigned char *aad, size_t aad_len,
                      QUIC_AEAD_CTX *tls_ctx, const QUIC_AEAD *aead,
-                     const unsigned char *key, const unsigned char *iv);
+                     const unsigned char *iv);
 
 int quic_tls_generate_retry_integrity_tag(unsigned char *odcid, unsigned char odcid_len,
                                           const unsigned char *buf, size_t len,
diff --git a/src/quic_retry.c b/src/quic_retry.c
index 23b74d8fc..658064660 100644
--- a/src/quic_retry.c
+++ b/src/quic_retry.c
@@ -299,7 +299,7 @@ int quic_retry_token_check(struct quic_rx_packet *pkt,
 
 	/* The token is prefixed by a one-byte length format which is not ciphered. */
 	if (!quic_tls_decrypt2(buf, token + 1, tokenlen - QUIC_RETRY_TOKEN_SALTLEN - 1, aad, aadlen,
-	                       ctx, aead, key, iv)) {
+	                       ctx, aead, iv)) {
 		TRACE_ERROR("Could not decrypt retry token", QUIC_EV_CONN_LPKT, qc);
 		goto err;
 	}
diff --git a/src/quic_rx.c b/src/quic_rx.c
index e90c76e09..5dff2f398 100644
--- a/src/quic_rx.c
+++ b/src/quic_rx.c
@@ -133,7 +133,6 @@ static int qc_pkt_decrypt(struct quic_conn *qc, struct quic_enc_level *qel,
 	QUIC_AEAD_CTX *rx_ctx = tls_ctx->rx.ctx;
 	unsigned char *rx_iv = tls_ctx->rx.iv;
 	size_t rx_iv_sz = tls_ctx->rx.ivlen;
-	unsigned char *rx_key = tls_ctx->rx.key;
 
 	TRACE_ENTER(QUIC_EV_CONN_RXPKT, qc);
 
@@ -158,7 +157,6 @@ static int qc_pkt_decrypt(struct quic_conn *qc, struct quic_enc_level *qel,
 
 				rx_ctx = qc->ku.prv_rx.ctx;
 				rx_iv  = qc->ku.prv_rx.iv;
-				rx_key = qc->ku.prv_rx.key;
 				kp_prv = 1;
 			}
 			else if (pkt->pn > qel->pktns->rx.largest_pn) {
@@ -177,7 +175,6 @@ static int qc_pkt_decrypt(struct quic_conn *qc, struct quic_enc_level *qel,
 				kp_changed = 1;
 				rx_ctx = qc->ku.nxt_rx.ctx;
 				rx_iv  = qc->ku.nxt_rx.iv;
-				rx_key = qc->ku.nxt_rx.key;
 			}
 		}
 	}
@@ -186,7 +183,7 @@ static int qc_pkt_decrypt(struct quic_conn *qc, struct quic_enc_level *qel,
 
 	ret = quic_tls_decrypt(pkt->data + pkt->aad_len, pkt->len - pkt->aad_len,
 	                       pkt->data, pkt->aad_len,
-	                       rx_ctx, tls_ctx->rx.aead, rx_key, iv);
+	                       rx_ctx, tls_ctx->rx.aead, iv);
 	if (!ret) {
 		TRACE_ERROR("quic_tls_decrypt() failed", QUIC_EV_CONN_RXPKT, qc);
 
diff --git a/src/quic_tls.c b/src/quic_tls.c
index 2ef40c13d..00264b084 100644
--- a/src/quic_tls.c
+++ b/src/quic_tls.c
@@ -867,7 +867,7 @@ int quic_tls_encrypt(unsigned char *buf, size_t len,
 int quic_tls_decrypt(unsigned char *buf, size_t len,
                      unsigned char *aad, size_t aad_len,
                      QUIC_AEAD_CTX *ctx, const QUIC_AEAD *aead,
-                     const unsigned char *key, const unsigned char *iv)
+                     const unsigned char *iv)
 {
 #ifdef QUIC_AEAD_API
 	size_t outlen;
@@ -916,7 +916,7 @@ int quic_tls_decrypt2(unsigned char *out,
                       unsigned char *in, size_t len,
                       unsigned char *aad, size_t aad_len,
                       QUIC_AEAD_CTX *ctx, const QUIC_AEAD *aead,
-                      const unsigned char *key, const unsigned char *iv)
+                      const unsigned char *iv)
 {
 #ifdef QUIC_AEAD_API
 	size_t outlen;
diff --git a/src/quic_token.c b/src/quic_token.c
index 2ac5458af..8a8eced13 100644
--- a/src/quic_token.c
+++ b/src/quic_token.c
@@ -149,7 +149,7 @@ int quic_token_check(struct quic_rx_packet *pkt,
 
 	/* The token is prefixed by a one-byte length format which is not ciphered. */
 	if (!quic_tls_decrypt2(buf, token + 1, tokenlen - QUIC_TOKEN_RAND_DLEN - 1, aad, aadlen,
-	                       ctx, aead, key, iv)) {
+	                       ctx, aead, iv)) {
 		TRACE_ERROR("Could not decrypt token", QUIC_EV_CONN_LPKT, qc);
 		goto err;
 	}