Fold SSL_SESSION_INTERNAL back into SSL_SESSION.

ok beck@ tb@

10 files changed, 110 insertions, 121 deletions

diff --git a/src/lib/libssl/s3_lib.c b/src/lib/libssl/s3_lib.c
index 8a96a2cdef..71b86770ca 100644
--- a/src/lib/libssl/s3_lib.c
+++ b/src/lib/libssl/s3_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: s3_lib.c,v 1.216 2021/10/24 09:15:00 beck Exp $ */
+/* $OpenBSD: s3_lib.c,v 1.217 2021/10/25 10:01:46 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -1668,10 +1668,10 @@ _SSL_get_peer_tmp_key(SSL *s, EVP_PKEY **key)
 
         *key = NULL;
 
-        if (s->session == NULL || SSI(s)->sess_cert == NULL)
+        if (s->session == NULL || s->session->sess_cert == NULL)
                 return 0;
 
-        sc = SSI(s)->sess_cert;
+        sc = s->session->sess_cert;
 
         if ((pkey = EVP_PKEY_new()) == NULL)
                 return 0;
diff --git a/src/lib/libssl/ssl_clnt.c b/src/lib/libssl/ssl_clnt.c
index ea502e6a33..fe864d1cdc 100644
--- a/src/lib/libssl/ssl_clnt.c
+++ b/src/lib/libssl/ssl_clnt.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_clnt.c,v 1.116 2021/10/23 16:11:30 tb Exp $ */
+/* $OpenBSD: ssl_clnt.c,v 1.117 2021/10/25 10:01:46 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -655,7 +655,7 @@ ssl3_send_client_hello(SSL *s)
                 if (sess == NULL ||
                     sess->ssl_version != s->version ||
                     (!sess->session_id_length && !sess->tlsext_tick) ||
-                    sess->internal->not_resumable) {
+                    sess->not_resumable) {
                         if (!ssl_get_new_session(s, 0))
                                 goto err;
                 }
@@ -1157,8 +1157,8 @@ ssl3_get_server_certificate(SSL *s)
         sc = ssl_sess_cert_new();
         if (sc == NULL)
                 goto err;
-        ssl_sess_cert_free(SSI(s)->sess_cert);
-        SSI(s)->sess_cert = sc;
+        ssl_sess_cert_free(s->session->sess_cert);
+        s->session->sess_cert = sc;
 
         sc->cert_chain = sk;
         /*
@@ -1231,7 +1231,7 @@ ssl3_get_server_kex_dhe(SSL *s, EVP_PKEY **pkey, CBS *cbs)
         int al;
 
         alg_a = S3I(s)->hs.cipher->algorithm_auth;
-        sc = SSI(s)->sess_cert;
+        sc = s->session->sess_cert;
 
         if ((dh = DH_new()) == NULL) {
                 SSLerror(s, ERR_R_DH_LIB);
@@ -1359,7 +1359,7 @@ ssl3_get_server_kex_ecdhe(SSL *s, EVP_PKEY **pkey, CBS *cbs)
         int al;
 
         alg_a = S3I(s)->hs.cipher->algorithm_auth;
-        sc = SSI(s)->sess_cert;
+        sc = s->session->sess_cert;
 
         /* Only named curves are supported. */
         if (!CBS_get_u8(cbs, &curve_type) ||
@@ -1468,18 +1468,18 @@ ssl3_get_server_key_exchange(SSL *s)
                 return (1);
         }
 
-        if (SSI(s)->sess_cert != NULL) {
-                DH_free(SSI(s)->sess_cert->peer_dh_tmp);
-                SSI(s)->sess_cert->peer_dh_tmp = NULL;
+        if (s->session->sess_cert != NULL) {
+                DH_free(s->session->sess_cert->peer_dh_tmp);
+                s->session->sess_cert->peer_dh_tmp = NULL;
 
-                EC_KEY_free(SSI(s)->sess_cert->peer_ecdh_tmp);
-                SSI(s)->sess_cert->peer_ecdh_tmp = NULL;
+                EC_KEY_free(s->session->sess_cert->peer_ecdh_tmp);
+                s->session->sess_cert->peer_ecdh_tmp = NULL;
 
-                free(SSI(s)->sess_cert->peer_x25519_tmp);
-                SSI(s)->sess_cert->peer_x25519_tmp = NULL;
+                free(s->session->sess_cert->peer_x25519_tmp);
+                s->session->sess_cert->peer_x25519_tmp = NULL;
         } else {
-                SSI(s)->sess_cert = ssl_sess_cert_new();
-                if (SSI(s)->sess_cert == NULL)
+                s->session->sess_cert = ssl_sess_cert_new();
+                if (s->session->sess_cert == NULL)
                         goto err;
         }
 
@@ -2267,7 +2267,7 @@ ssl3_send_client_key_exchange(SSL *s)
         if (S3I(s)->hs.state == SSL3_ST_CW_KEY_EXCH_A) {
                 alg_k = S3I(s)->hs.cipher->algorithm_mkey;
 
-                if ((sess_cert = SSI(s)->sess_cert) == NULL) {
+                if ((sess_cert = s->session->sess_cert) == NULL) {
                         ssl3_send_alert(s, SSL3_AL_FATAL,
                             SSL_AD_UNEXPECTED_MESSAGE);
                         SSLerror(s, ERR_R_INTERNAL_ERROR);
@@ -2670,12 +2670,12 @@ ssl3_check_cert_and_algorithm(SSL *s)
         if (alg_a & SSL_aNULL)
                 return (1);
 
-        sc = SSI(s)->sess_cert;
+        sc = s->session->sess_cert;
         if (sc == NULL) {
                 SSLerror(s, ERR_R_INTERNAL_ERROR);
                 goto err;
         }
-        dh = SSI(s)->sess_cert->peer_dh_tmp;
+        dh = s->session->sess_cert->peer_dh_tmp;
 
         /* This is the passed certificate. */
 
diff --git a/src/lib/libssl/ssl_lib.c b/src/lib/libssl/ssl_lib.c
index cfd5c9bfb8..f64b89352e 100644
--- a/src/lib/libssl/ssl_lib.c
+++ b/src/lib/libssl/ssl_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_lib.c,v 1.275 2021/10/23 20:42:50 beck Exp $ */
+/* $OpenBSD: ssl_lib.c,v 1.276 2021/10/25 10:01:46 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -887,10 +887,10 @@ SSL_get_peer_cert_chain(const SSL *s)
         STACK_OF(X509)  *r;
 
         if ((s == NULL) || (s->session == NULL) ||
-            (SSI(s)->sess_cert == NULL))
+            (s->session->sess_cert == NULL))
                 r = NULL;
         else
-                r = SSI(s)->sess_cert->cert_chain;
+                r = s->session->sess_cert->cert_chain;
 
         /*
          * If we are a client, cert_chain includes the peer's own
@@ -2245,8 +2245,8 @@ ssl_using_ecc_cipher(SSL *s)
         alg_a = S3I(s)->hs.cipher->algorithm_auth;
         alg_k = S3I(s)->hs.cipher->algorithm_mkey;
 
-        return SSI(s)->tlsext_ecpointformatlist != NULL &&
-            SSI(s)->tlsext_ecpointformatlist_length > 0 &&
+        return s->session->tlsext_ecpointformatlist != NULL &&
+            s->session->tlsext_ecpointformatlist_length > 0 &&
             ((alg_k & SSL_kECDHE) || (alg_a & SSL_aECDSA));
 }
 
diff --git a/src/lib/libssl/ssl_locl.h b/src/lib/libssl/ssl_locl.h
index aa6233e617..01c22762ef 100644
--- a/src/lib/libssl/ssl_locl.h
+++ b/src/lib/libssl/ssl_locl.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_locl.h,v 1.366 2021/10/23 20:42:50 beck Exp $ */
+/* $OpenBSD: ssl_locl.h,v 1.367 2021/10/25 10:01:46 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -412,28 +412,6 @@ struct ssl_method_st {
         unsigned int enc_flags;         /* SSL_ENC_FLAG_* */
 };
 
-typedef struct ssl_session_internal_st {
-        CRYPTO_EX_DATA ex_data; /* application specific data */
-
-        /* These are used to make removal of session-ids more
-         * efficient and to implement a maximum cache size. */
-        struct ssl_session_st *prev, *next;
-
-        /* Used to indicate that session resumption is not allowed.
-         * Applications can also set this bit for a new session via
-         * not_resumable_session_cb to disable session caching and tickets. */
-        int not_resumable;
-
-        /* The cert is the certificate used to establish this connection */
-        struct sess_cert_st /* SESS_CERT */ *sess_cert;
-
-        size_t tlsext_ecpointformatlist_length;
-        uint8_t *tlsext_ecpointformatlist; /* peer's list */
-        size_t tlsext_supportedgroups_length;
-        uint16_t *tlsext_supportedgroups; /* peer's list */
-} SSL_SESSION_INTERNAL;
-#define SSI(s) (s->session->internal)
-
 /* Lets make this into an ASN.1 type structure as follows
  * SSL_SESSION_ID ::= SEQUENCE {
  *      version                 INTEGER,        -- structure version number
@@ -500,7 +478,24 @@ struct ssl_session_st {
         size_t tlsext_ticklen;                  /* Session ticket length */
         uint32_t tlsext_tick_lifetime_hint;     /* Session lifetime hint in seconds */
 
-        struct ssl_session_internal_st *internal;
+        CRYPTO_EX_DATA ex_data; /* application specific data */
+
+        /* These are used to make removal of session-ids more
+         * efficient and to implement a maximum cache size. */
+        struct ssl_session_st *prev, *next;
+
+        /* Used to indicate that session resumption is not allowed.
+         * Applications can also set this bit for a new session via
+         * not_resumable_session_cb to disable session caching and tickets. */
+        int not_resumable;
+
+        /* The cert is the certificate used to establish this connection */
+        struct sess_cert_st /* SESS_CERT */ *sess_cert;
+
+        size_t tlsext_ecpointformatlist_length;
+        uint8_t *tlsext_ecpointformatlist; /* peer's list */
+        size_t tlsext_supportedgroups_length;
+        uint16_t *tlsext_supportedgroups; /* peer's list */
 };
 
 typedef struct cert_pkey_st {
diff --git a/src/lib/libssl/ssl_sess.c b/src/lib/libssl/ssl_sess.c
index 4e798e08f0..2fa6af4564 100644
--- a/src/lib/libssl/ssl_sess.c
+++ b/src/lib/libssl/ssl_sess.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_sess.c,v 1.105 2021/09/08 17:27:33 tb Exp $ */
+/* $OpenBSD: ssl_sess.c,v 1.106 2021/10/25 10:01:46 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -186,13 +186,13 @@ SSL_SESSION_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
 int
 SSL_SESSION_set_ex_data(SSL_SESSION *s, int idx, void *arg)
 {
-        return (CRYPTO_set_ex_data(&s->internal->ex_data, idx, arg));
+        return (CRYPTO_set_ex_data(&s->ex_data, idx, arg));
 }
 
 void *
 SSL_SESSION_get_ex_data(const SSL_SESSION *s, int idx)
 {
-        return (CRYPTO_get_ex_data(&s->internal->ex_data, idx));
+        return (CRYPTO_get_ex_data(&s->ex_data, idx));
 }
 
 uint32_t
@@ -221,26 +221,21 @@ SSL_SESSION_new(void)
                 SSLerrorx(ERR_R_MALLOC_FAILURE);
                 return (NULL);
         }
-        if ((ss->internal = calloc(1, sizeof(*ss->internal))) == NULL) {
-                free(ss);
-                SSLerrorx(ERR_R_MALLOC_FAILURE);
-                return (NULL);
-        }
 
         ss->verify_result = 1; /* avoid 0 (= X509_V_OK) just in case */
         ss->references = 1;
         ss->timeout=60*5+4; /* 5 minute timeout by default */
         ss->time = time(NULL);
-        ss->internal->prev = NULL;
-        ss->internal->next = NULL;
+        ss->prev = NULL;
+        ss->next = NULL;
         ss->tlsext_hostname = NULL;
 
-        ss->internal->tlsext_ecpointformatlist_length = 0;
-        ss->internal->tlsext_ecpointformatlist = NULL;
-        ss->internal->tlsext_supportedgroups_length = 0;
-        ss->internal->tlsext_supportedgroups = NULL;
+        ss->tlsext_ecpointformatlist_length = 0;
+        ss->tlsext_ecpointformatlist = NULL;
+        ss->tlsext_supportedgroups_length = 0;
+        ss->tlsext_supportedgroups = NULL;
 
-        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->internal->ex_data);
+        CRYPTO_new_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
 
         return (ss);
 }
@@ -738,7 +733,7 @@ remove_session_lock(SSL_CTX *ctx, SSL_SESSION *c, int lck)
                         CRYPTO_w_unlock(CRYPTO_LOCK_SSL_CTX);
 
                 if (ret) {
-                        r->internal->not_resumable = 1;
+                        r->not_resumable = 1;
                         if (ctx->internal->remove_session_cb != NULL)
                                 ctx->internal->remove_session_cb(ctx, r);
                         SSL_SESSION_free(r);
@@ -760,12 +755,12 @@ SSL_SESSION_free(SSL_SESSION *ss)
         if (i > 0)
                 return;
 
-        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->internal->ex_data);
+        CRYPTO_free_ex_data(CRYPTO_EX_INDEX_SSL_SESSION, ss, &ss->ex_data);
 
         explicit_bzero(ss->master_key, sizeof ss->master_key);
         explicit_bzero(ss->session_id, sizeof ss->session_id);
 
-        ssl_sess_cert_free(ss->internal->sess_cert);
+        ssl_sess_cert_free(ss->sess_cert);
 
         X509_free(ss->peer);
 
@@ -773,10 +768,9 @@ SSL_SESSION_free(SSL_SESSION *ss)
 
         free(ss->tlsext_hostname);
         free(ss->tlsext_tick);
-        free(ss->internal->tlsext_ecpointformatlist);
-        free(ss->internal->tlsext_supportedgroups);
+        free(ss->tlsext_ecpointformatlist);
+        free(ss->tlsext_supportedgroups);
 
-        freezero(ss->internal, sizeof(*ss->internal));
         freezero(ss, sizeof(*ss));
 }
 
@@ -1007,7 +1001,7 @@ timeout_doall_arg(SSL_SESSION *s, TIMEOUT_PARAM *p)
                  * save on locking overhead */
                 (void)lh_SSL_SESSION_delete(p->cache, s);
                 SSL_SESSION_list_remove(p->ctx, s);
-                s->internal->not_resumable = 1;
+                s->not_resumable = 1;
                 if (p->ctx->internal->remove_session_cb != NULL)
                         p->ctx->internal->remove_session_cb(p->ctx, s);
                 SSL_SESSION_free(s);
@@ -1059,50 +1053,50 @@ ssl_clear_bad_session(SSL *s)
 static void
 SSL_SESSION_list_remove(SSL_CTX *ctx, SSL_SESSION *s)
 {
-        if ((s->internal->next == NULL) || (s->internal->prev == NULL))
+        if (s->next == NULL || s->prev == NULL)
                 return;
 
-        if (s->internal->next == (SSL_SESSION *)&(ctx->internal->session_cache_tail)) {
+        if (s->next == (SSL_SESSION *)&(ctx->internal->session_cache_tail)) {
                 /* last element in list */
-                if (s->internal->prev == (SSL_SESSION *)&(ctx->internal->session_cache_head)) {
+                if (s->prev == (SSL_SESSION *)&(ctx->internal->session_cache_head)) {
                         /* only one element in list */
                         ctx->internal->session_cache_head = NULL;
                         ctx->internal->session_cache_tail = NULL;
                 } else {
-                        ctx->internal->session_cache_tail = s->internal->prev;
-                        s->internal->prev->internal->next =
+                        ctx->internal->session_cache_tail = s->prev;
+                        s->prev->next =
                             (SSL_SESSION *)&(ctx->internal->session_cache_tail);
                 }
         } else {
-                if (s->internal->prev == (SSL_SESSION *)&(ctx->internal->session_cache_head)) {
+                if (s->prev == (SSL_SESSION *)&(ctx->internal->session_cache_head)) {
                         /* first element in list */
-                        ctx->internal->session_cache_head = s->internal->next;
-                        s->internal->next->internal->prev =
+                        ctx->internal->session_cache_head = s->next;
+                        s->next->prev =
                             (SSL_SESSION *)&(ctx->internal->session_cache_head);
                 } else {
                         /* middle of list */
-                        s->internal->next->internal->prev = s->internal->prev;
-                        s->internal->prev->internal->next = s->internal->next;
+                        s->next->prev = s->prev;
+                        s->prev->next = s->next;
                 }
         }
-        s->internal->prev = s->internal->next = NULL;
+        s->prev = s->next = NULL;
 }
 
 static void
 SSL_SESSION_list_add(SSL_CTX *ctx, SSL_SESSION *s)
 {
-        if ((s->internal->next != NULL) && (s->internal->prev != NULL))
+        if (s->next != NULL && s->prev != NULL)
                 SSL_SESSION_list_remove(ctx, s);
 
         if (ctx->internal->session_cache_head == NULL) {
                 ctx->internal->session_cache_head = s;
                 ctx->internal->session_cache_tail = s;
-                s->internal->prev = (SSL_SESSION *)&(ctx->internal->session_cache_head);
-                s->internal->next = (SSL_SESSION *)&(ctx->internal->session_cache_tail);
+                s->prev = (SSL_SESSION *)&(ctx->internal->session_cache_head);
+                s->next = (SSL_SESSION *)&(ctx->internal->session_cache_tail);
         } else {
-                s->internal->next = ctx->internal->session_cache_head;
-                s->internal->next->internal->prev = s;
-                s->internal->prev = (SSL_SESSION *)&(ctx->internal->session_cache_head);
+                s->next = ctx->internal->session_cache_head;
+                s->next->prev = s;
+                s->prev = (SSL_SESSION *)&(ctx->internal->session_cache_head);
                 ctx->internal->session_cache_head = s;
         }
 }
diff --git a/src/lib/libssl/ssl_srvr.c b/src/lib/libssl/ssl_srvr.c
index ec1e69a8bb..42f64bf86d 100644
--- a/src/lib/libssl/ssl_srvr.c
+++ b/src/lib/libssl/ssl_srvr.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_srvr.c,v 1.122 2021/10/23 14:40:54 jsing Exp $ */
+/* $OpenBSD: ssl_srvr.c,v 1.123 2021/10/25 10:01:46 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -2433,15 +2433,15 @@ ssl3_get_client_certificate(SSL *s)
          * With the current implementation, sess_cert will always be NULL
          * when we arrive here
          */
-        if (SSI(s)->sess_cert == NULL) {
-                SSI(s)->sess_cert = ssl_sess_cert_new();
-                if (SSI(s)->sess_cert == NULL) {
+        if (s->session->sess_cert == NULL) {
+                s->session->sess_cert = ssl_sess_cert_new();
+                if (s->session->sess_cert == NULL) {
                         SSLerror(s, ERR_R_MALLOC_FAILURE);
                         goto err;
                 }
         }
-        sk_X509_pop_free(SSI(s)->sess_cert->cert_chain, X509_free);
-        SSI(s)->sess_cert->cert_chain = sk;
+        sk_X509_pop_free(s->session->sess_cert->cert_chain, X509_free);
+        s->session->sess_cert->cert_chain = sk;
 
         /*
          * Inconsistency alert: cert_chain does *not* include the
diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index 3ad564964d..d8143ce1be 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.c,v 1.99 2021/09/10 09:25:29 tb Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.100 2021/10/25 10:01:46 jsing Exp $ */
 /*
  * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -243,7 +243,7 @@ tlsext_supportedgroups_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
                 int i;
 
                 if (S3I(s)->hs.tls13.hrr) {
-                        if (SSI(s)->tlsext_supportedgroups == NULL) {
+                        if (s->session->tlsext_supportedgroups == NULL) {
                                 *alert = SSL_AD_HANDSHAKE_FAILURE;
                                 return 0;
                         }
@@ -251,7 +251,7 @@ tlsext_supportedgroups_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
                          * In the case of TLSv1.3 the client cannot change
                          * the supported groups.
                          */
-                        if (groups_len != SSI(s)->tlsext_supportedgroups_length) {
+                        if (groups_len != s->session->tlsext_supportedgroups_length) {
                                 *alert = SSL_AD_ILLEGAL_PARAMETER;
                                 return 0;
                         }
@@ -260,7 +260,7 @@ tlsext_supportedgroups_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
 
                                 if (!CBS_get_u16(&grouplist, &group))
                                         goto err;
-                                if (SSI(s)->tlsext_supportedgroups[i] != group) {
+                                if (s->session->tlsext_supportedgroups[i] != group) {
                                         *alert = SSL_AD_ILLEGAL_PARAMETER;
                                         return 0;
                                 }
@@ -269,7 +269,7 @@ tlsext_supportedgroups_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
                         return 1;
                 }
 
-                if (SSI(s)->tlsext_supportedgroups != NULL)
+                if (s->session->tlsext_supportedgroups != NULL)
                         goto err;
 
                 if ((groups = reallocarray(NULL, groups_len,
@@ -290,8 +290,8 @@ tlsext_supportedgroups_server_parse(SSL *s, uint16_t msg_type, CBS *cbs,
                         goto err;
                 }
 
-                SSI(s)->tlsext_supportedgroups = groups;
-                SSI(s)->tlsext_supportedgroups_length = groups_len;
+                s->session->tlsext_supportedgroups = groups;
+                s->session->tlsext_supportedgroups_length = groups_len;
         }
 
         return 1;
@@ -383,8 +383,8 @@ tlsext_ecpf_parse(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
         }
 
         if (!s->internal->hit) {
-                if (!CBS_stow(&ecpf, &(SSI(s)->tlsext_ecpointformatlist),
-                    &(SSI(s)->tlsext_ecpointformatlist_length))) {
+                if (!CBS_stow(&ecpf, &(s->session->tlsext_ecpointformatlist),
+                    &(s->session->tlsext_ecpointformatlist_length))) {
                         *alert = SSL_AD_INTERNAL_ERROR;
                         return 0;
                 }
diff --git a/src/lib/libssl/t1_lib.c b/src/lib/libssl/t1_lib.c
index 3cb2d8a113..092331aae1 100644
--- a/src/lib/libssl/t1_lib.c
+++ b/src/lib/libssl/t1_lib.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: t1_lib.c,v 1.182 2021/07/01 17:53:39 jsing Exp $ */
+/* $OpenBSD: t1_lib.c,v 1.183 2021/10/25 10:01:46 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -329,8 +329,8 @@ tls1_get_formatlist(SSL *s, int client_formats, const uint8_t **pformats,
     size_t *pformatslen)
 {
         if (client_formats != 0) {
-                *pformats = SSI(s)->tlsext_ecpointformatlist;
-                *pformatslen = SSI(s)->tlsext_ecpointformatlist_length;
+                *pformats = s->session->tlsext_ecpointformatlist;
+                *pformatslen = s->session->tlsext_ecpointformatlist_length;
                 return;
         }
 
@@ -352,8 +352,8 @@ tls1_get_group_list(SSL *s, int client_groups, const uint16_t **pgroups,
     size_t *pgroupslen)
 {
         if (client_groups != 0) {
-                *pgroups = SSI(s)->tlsext_supportedgroups;
-                *pgroupslen = SSI(s)->tlsext_supportedgroups_length;
+                *pgroups = s->session->tlsext_supportedgroups;
+                *pgroupslen = s->session->tlsext_supportedgroups_length;
                 return;
         }
 
diff --git a/src/lib/libssl/tls13_client.c b/src/lib/libssl/tls13_client.c
index 00a1c6baa4..4dfb02581a 100644
--- a/src/lib/libssl/tls13_client.c
+++ b/src/lib/libssl/tls13_client.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_client.c,v 1.87 2021/10/23 14:40:54 jsing Exp $ */
+/* $OpenBSD: tls13_client.c,v 1.88 2021/10/25 10:01:46 jsing Exp $ */
 /*
  * Copyright (c) 2018, 2019 Joel Sing <jsing@openbsd.org>
  *
@@ -628,16 +628,16 @@ tls13_server_certificate_recv(struct tls13_ctx *ctx, CBS *cbs)
         if ((cert_idx = ssl_cert_type(cert, pkey)) < 0)
                 goto err;
 
-        ssl_sess_cert_free(SSI(s)->sess_cert);
-        if ((SSI(s)->sess_cert = ssl_sess_cert_new()) == NULL)
+        ssl_sess_cert_free(s->session->sess_cert);
+        if ((s->session->sess_cert = ssl_sess_cert_new()) == NULL)
                 goto err;
 
-        SSI(s)->sess_cert->cert_chain = certs;
+        s->session->sess_cert->cert_chain = certs;
         certs = NULL;
 
         X509_up_ref(cert);
-        SSI(s)->sess_cert->peer_pkeys[cert_idx].x509 = cert;
-        SSI(s)->sess_cert->peer_key = &(SSI(s)->sess_cert->peer_pkeys[cert_idx]);
+        s->session->sess_cert->peer_pkeys[cert_idx].x509 = cert;
+        s->session->sess_cert->peer_key = &(s->session->sess_cert->peer_pkeys[cert_idx]);
 
         X509_free(s->session->peer);
 
diff --git a/src/lib/libssl/tls13_server.c b/src/lib/libssl/tls13_server.c
index a19b3825fe..733a71f7d1 100644
--- a/src/lib/libssl/tls13_server.c
+++ b/src/lib/libssl/tls13_server.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: tls13_server.c,v 1.86 2021/10/23 14:40:54 jsing Exp $ */
+/* $OpenBSD: tls13_server.c,v 1.87 2021/10/25 10:01:46 jsing Exp $ */
 /*
  * Copyright (c) 2019, 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020 Bob Beck <beck@openbsd.org>
@@ -922,16 +922,16 @@ tls13_client_certificate_recv(struct tls13_ctx *ctx, CBS *cbs)
         if ((cert_idx = ssl_cert_type(cert, pkey)) < 0)
                 goto err;
 
-        ssl_sess_cert_free(SSI(s)->sess_cert);
-        if ((SSI(s)->sess_cert = ssl_sess_cert_new()) == NULL)
+        ssl_sess_cert_free(s->session->sess_cert);
+        if ((s->session->sess_cert = ssl_sess_cert_new()) == NULL)
                 goto err;
 
-        SSI(s)->sess_cert->cert_chain = certs;
+        s->session->sess_cert->cert_chain = certs;
         certs = NULL;
 
         X509_up_ref(cert);
-        SSI(s)->sess_cert->peer_pkeys[cert_idx].x509 = cert;
-        SSI(s)->sess_cert->peer_key = &(SSI(s)->sess_cert->peer_pkeys[cert_idx]);
+        s->session->sess_cert->peer_pkeys[cert_idx].x509 = cert;
+        s->session->sess_cert->peer_key = &(s->session->sess_cert->peer_pkeys[cert_idx]);
 
         X509_free(s->session->peer);