libssl: Move SSL object unwrapping macros to separate header

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23334)

48 files changed, 207 insertions, 109 deletions

diff --git a/include/internal/quic_predef.h b/include/internal/quic_predef.h
index a4cde59385..f4fe0f606e 100644
--- a/include/internal/quic_predef.h
+++ b/include/internal/quic_predef.h
@@ -38,6 +38,7 @@ typedef struct quic_lcidm_st QUIC_LCIDM;
 typedef struct quic_urxe_st QUIC_URXE;
 typedef struct quic_engine_st QUIC_ENGINE;
 typedef struct quic_obj_st QUIC_OBJ;
+typedef struct quic_conn_st QUIC_CONNECTION;
 
 # endif
 
diff --git a/include/internal/quic_trace.h b/include/internal/quic_trace.h
new file mode 100644
index 0000000000..35d6996490
--- /dev/null
+++ b/include/internal/quic_trace.h
@@ -0,0 +1,20 @@
+/*
+ * Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef OSSL_QUIC_TRACE_H
+# define OSSL_QUIC_TRACE_H
+
+# ifndef OPENSSL_NO_QUIC
+
+int ossl_quic_trace(int write_p, int version, int content_type,
+                    const void *buf, size_t msglen, SSL *ssl, void *arg);
+
+# endif
+
+#endif
diff --git a/include/internal/ssl_unwrap.h b/include/internal/ssl_unwrap.h
new file mode 100644
index 0000000000..c9a131f1d7
--- /dev/null
+++ b/include/internal/ssl_unwrap.h
@@ -0,0 +1,121 @@
+/*
+ * Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#ifndef OSSL_SSL_UNWRAP_H
+# define OSSL_SSL_UNWRAP_H
+
+# include <openssl/ssl.h>
+# include "internal/quic_predef.h"
+
+# define SSL_CONNECTION_FROM_SSL_ONLY_int(ssl, c) \
+    ((ssl) == NULL ? NULL                         \
+     : ((ssl)->type == SSL_TYPE_SSL_CONNECTION    \
+       ? (c SSL_CONNECTION *)(ssl)                \
+       : NULL))
+# define SSL_CONNECTION_NO_CONST
+# define SSL_CONNECTION_FROM_SSL_ONLY(ssl) \
+    SSL_CONNECTION_FROM_SSL_ONLY_int(ssl, SSL_CONNECTION_NO_CONST)
+# define SSL_CONNECTION_FROM_CONST_SSL_ONLY(ssl) \
+    SSL_CONNECTION_FROM_SSL_ONLY_int(ssl, const)
+# define SSL_CONNECTION_GET_CTX(sc) ((sc)->ssl.ctx)
+# define SSL_CONNECTION_GET_SSL(sc) (&(sc)->ssl)
+# ifndef OPENSSL_NO_QUIC
+struct ssl_connection_st *ossl_quic_obj_get0_handshake_layer(QUIC_OBJ *obj);
+#  define SSL_CONNECTION_FROM_SSL_int(ssl, c)                                           \
+    ((ssl) == NULL ? NULL                                                               \
+     : ((ssl)->type == SSL_TYPE_SSL_CONNECTION                                          \
+        ? (c SSL_CONNECTION *)(ssl)                                                     \
+        : (SSL_TYPE_IS_QUIC((ssl)->type)                                                \
+          ? (c SSL_CONNECTION *)ossl_quic_obj_get0_handshake_layer((QUIC_OBJ *)(ssl))   \
+          : NULL)))
+#  define SSL_CONNECTION_FROM_SSL(ssl) \
+    SSL_CONNECTION_FROM_SSL_int(ssl, SSL_CONNECTION_NO_CONST)
+#  define SSL_CONNECTION_FROM_CONST_SSL(ssl) \
+    SSL_CONNECTION_FROM_SSL_int(ssl, const)
+# else
+#  define SSL_CONNECTION_FROM_SSL(ssl) \
+    SSL_CONNECTION_FROM_SSL_ONLY_int(ssl, SSL_CONNECTION_NO_CONST)
+#  define SSL_CONNECTION_FROM_CONST_SSL(ssl) \
+    SSL_CONNECTION_FROM_SSL_ONLY_int(ssl, const)
+# endif
+
+# ifndef OPENSSL_NO_QUIC
+
+#  define IS_QUIC_METHOD(m) \
+    ((m) == OSSL_QUIC_client_method() || \
+     (m) == OSSL_QUIC_client_thread_method())
+
+#  define IS_QUIC_CTX(ctx)          IS_QUIC_METHOD((ctx)->method)
+
+#  define QUIC_CONNECTION_FROM_SSL_int(ssl, c)   \
+     ((ssl) == NULL ? NULL                       \
+      : ((ssl)->type == SSL_TYPE_QUIC_CONNECTION \
+         ? (c QUIC_CONNECTION *)(ssl)            \
+         : NULL))
+
+#  define QUIC_XSO_FROM_SSL_int(ssl, c)                             \
+    ((ssl) == NULL                                                  \
+     ? NULL                                                         \
+     : (((ssl)->type == SSL_TYPE_QUIC_XSO                           \
+        ? (c QUIC_XSO *)(ssl)                                       \
+        : ((ssl)->type == SSL_TYPE_QUIC_CONNECTION                  \
+           ? (c QUIC_XSO *)((QUIC_CONNECTION *)(ssl))->default_xso  \
+           : NULL))))
+
+#  define SSL_CONNECTION_FROM_QUIC_SSL_int(ssl, c)               \
+     ((ssl) == NULL ? NULL                                       \
+      : ((ssl)->type == SSL_TYPE_QUIC_CONNECTION                 \
+         ? (c SSL_CONNECTION *)((c QUIC_CONNECTION *)(ssl))->tls \
+         : NULL))
+
+#  define QUIC_LISTENER_FROM_SSL_int(ssl, c)                            \
+    ((ssl) == NULL                                                      \
+     ? NULL                                                             \
+     : ((ssl)->type == SSL_TYPE_QUIC_LISTENER                           \
+        ? (c QUIC_LISTENER *)(ssl)                                      \
+        : NULL))
+
+#  define IS_QUIC_CS(ssl) ((ssl) != NULL                                \
+                           && ((ssl)->type == SSL_TYPE_QUIC_CONNECTION  \
+                               || (ssl)->type == SSL_TYPE_QUIC_XSO))
+
+#  define IS_QUIC(ssl)                                                  \
+    ((ssl) != NULL && SSL_TYPE_IS_QUIC((ssl)->type))
+
+# else
+
+#  define QUIC_CONNECTION_FROM_SSL_int(ssl, c) NULL
+#  define QUIC_XSO_FROM_SSL_int(ssl, c) NULL
+#  define QUIC_LISTENER_FROM_SSL_int(ssl, c) NULL
+#  define SSL_CONNECTION_FROM_QUIC_SSL_int(ssl, c) NULL
+#  define IS_QUIC(ssl) 0
+#  define IS_QUIC_CS(ssl) 0
+#  define IS_QUIC_CTX(ctx) 0
+#  define IS_QUIC_METHOD(m) 0
+
+# endif
+
+# define QUIC_CONNECTION_FROM_SSL(ssl) \
+    QUIC_CONNECTION_FROM_SSL_int(ssl, SSL_CONNECTION_NO_CONST)
+# define QUIC_CONNECTION_FROM_CONST_SSL(ssl) \
+    QUIC_CONNECTION_FROM_SSL_int(ssl, const)
+# define QUIC_XSO_FROM_SSL(ssl) \
+    QUIC_XSO_FROM_SSL_int(ssl, SSL_CONNECTION_NO_CONST)
+# define QUIC_XSO_FROM_CONST_SSL(ssl) \
+    QUIC_XSO_FROM_SSL_int(ssl, const)
+# define QUIC_LISTENER_FROM_SSL(ssl) \
+    QUIC_LISTENER_FROM_SSL_int(ssl, SSL_CONNECTION_NO_CONST)
+# define QUIC_LISTENER_FROM_CONST_SSL(ssl) \
+    QUIC_LISTENER_FROM_SSL_int(ssl, const)
+# define SSL_CONNECTION_FROM_QUIC_SSL(ssl) \
+    SSL_CONNECTION_FROM_QUIC_SSL_int(ssl, SSL_CONNECTION_NO_CONST)
+# define SSL_CONNECTION_FROM_CONST_QUIC_SSL(ssl) \
+    SSL_CONNECTION_FROM_CONST_QUIC_SSL_int(ssl, const)
+
+#endif
diff --git a/ssl/bio_ssl.c b/ssl/bio_ssl.c
index aabd047fe5..ccd8ce058e 100644
--- a/ssl/bio_ssl.c
+++ b/ssl/bio_ssl.c
@@ -15,6 +15,8 @@
 #include "internal/bio.h"
 #include <openssl/err.h>
 #include "ssl_local.h"
+#include "internal/ssl_unwrap.h"
+#include "internal/sockets.h"
 
 static int ssl_write(BIO *h, const char *buf, size_t size, size_t *written);
 static int ssl_read(BIO *b, char *buf, size_t size, size_t *readbytes);
diff --git a/ssl/d1_lib.c b/ssl/d1_lib.c
index 1ac0975d0a..27668c946f 100644
--- a/ssl/d1_lib.c
+++ b/ssl/d1_lib.c
@@ -13,6 +13,7 @@
 #include <openssl/rand.h>
 #include "ssl_local.h"
 #include "internal/time.h"
+#include "internal/ssl_unwrap.h"
 
 static int dtls1_handshake_write(SSL_CONNECTION *s);
 static size_t dtls1_link_min_mtu(void);
diff --git a/ssl/d1_msg.c b/ssl/d1_msg.c
index b1e1fad16d..48902c97f3 100644
--- a/ssl/d1_msg.c
+++ b/ssl/d1_msg.c
@@ -8,6 +8,7 @@
  */
 
 #include "ssl_local.h"
+#include "internal/ssl_unwrap.h"
 
 int dtls1_write_app_data_bytes(SSL *s, uint8_t type, const void *buf_,
                                size_t len, size_t *written)
diff --git a/ssl/d1_srtp.c b/ssl/d1_srtp.c
index 155021ff58..0cccc37c29 100644
--- a/ssl/d1_srtp.c
+++ b/ssl/d1_srtp.c
@@ -16,7 +16,7 @@
 #include <stdio.h>
 #include <openssl/objects.h>
 #include "ssl_local.h"
-#include "quic/quic_local.h"
+#include "internal/ssl_unwrap.h"
 
 #ifndef OPENSSL_NO_SRTP
 
diff --git a/ssl/quic/quic_channel.c b/ssl/quic/quic_channel.c
index 396cbe8461..7c9fa2f81a 100644
--- a/ssl/quic/quic_channel.c
+++ b/ssl/quic/quic_channel.c
@@ -9,12 +9,15 @@
 
 #include <openssl/rand.h>
 #include <openssl/err.h>
+#include "internal/ssl_unwrap.h"
 #include "internal/quic_channel.h"
 #include "internal/quic_error.h"
 #include "internal/quic_rx_depack.h"
 #include "internal/quic_lcidm.h"
 #include "internal/quic_srtm.h"
 #include "internal/qlog_event_helpers.h"
+#include "internal/quic_txp.h"
+#include "internal/quic_tls.h"
 #include "../ssl_local.h"
 #include "quic_channel_local.h"
 #include "quic_port_local.h"
diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c
index c77230a19f..2043af1e95 100644
--- a/ssl/quic/quic_impl.c
+++ b/ssl/quic/quic_impl.c
@@ -12,6 +12,7 @@
 #include <openssl/sslerr.h>
 #include <crypto/rand.h>
 #include "quic_local.h"
+#include "internal/ssl_unwrap.h"
 #include "internal/quic_tls.h"
 #include "internal/quic_rx_depack.h"
 #include "internal/quic_error.h"
diff --git a/ssl/quic/quic_local.h b/ssl/quic/quic_local.h
index cada184482..0fcaf8a142 100644
--- a/ssl/quic/quic_local.h
+++ b/ssl/quic/quic_local.h
@@ -33,8 +33,8 @@
  * state required by the libssl API personality.
  */
 struct quic_xso_st {
-    /* SSL object common header. */
-    struct ssl_st                   ssl;
+    /* QUIC_OBJ common header, including SSL object common header. */
+    QUIC_OBJ                        obj;
 
     /* The connection this stream is associated with. Always non-NULL. */
     QUIC_CONNECTION                 *conn;
@@ -126,13 +126,13 @@ struct quic_xso_st {
  */
 struct quic_conn_st {
     /*
-     * ssl_st is a common header for ordinary SSL objects, QUIC connection
-     * objects and QUIC stream objects, allowing objects of these different
-     * types to be disambiguated at runtime and providing some common fields.
+     * QUIC_OBJ is a common header for QUIC APL objects, allowing objects of
+     * these different types to be disambiguated at runtime and providing some
+     * common fields.
      *
      * Note: This must come first in the QUIC_CONNECTION structure.
      */
-    struct ssl_st                   ssl;
+    QUIC_OBJ                        obj;
 
     SSL                             *tls;
 
@@ -255,8 +255,8 @@ struct quic_conn_st {
  * layer for QLSO objects, wrapping the QUIC-native QUIC_PORT object.
  */
 struct quic_listener_st {
-    /* Common header for SSL objects. */
-    struct ssl_st                   ssl;
+    /* QUIC_OBJ common header, including SSL object common header. */
+    QUIC_OBJ                        obj;
 };
 
 /* Internal calls to the QUIC CSM which come from various places. */
@@ -276,77 +276,9 @@ void ossl_quic_conn_raise_protocol_error(QUIC_CONNECTION *qc,
 void ossl_quic_conn_on_remote_conn_close(QUIC_CONNECTION *qc,
                                          OSSL_QUIC_FRAME_CONN_CLOSE *f);
 
-int ossl_quic_trace(int write_p, int version, int content_type,
-                    const void *buf, size_t msglen, SSL *ssl, void *arg);
-
 #  define OSSL_QUIC_ANY_VERSION 0xFFFFF
-#  define IS_QUIC_METHOD(m) \
-    ((m) == OSSL_QUIC_client_method() || \
-     (m) == OSSL_QUIC_client_thread_method())
-#  define IS_QUIC_CTX(ctx)          IS_QUIC_METHOD((ctx)->method)
-
-#  define QUIC_CONNECTION_FROM_SSL_int(ssl, c)   \
-     ((ssl) == NULL ? NULL                       \
-      : ((ssl)->type == SSL_TYPE_QUIC_CONNECTION \
-         ? (c QUIC_CONNECTION *)(ssl)            \
-         : NULL))
-
-#  define QUIC_XSO_FROM_SSL_int(ssl, c)                             \
-    ((ssl) == NULL                                                  \
-     ? NULL                                                         \
-     : (((ssl)->type == SSL_TYPE_QUIC_XSO                           \
-        ? (c QUIC_XSO *)(ssl)                                       \
-        : ((ssl)->type == SSL_TYPE_QUIC_CONNECTION                  \
-           ? (c QUIC_XSO *)((QUIC_CONNECTION *)(ssl))->default_xso  \
-           : NULL))))
-
-#  define SSL_CONNECTION_FROM_QUIC_SSL_int(ssl, c)               \
-     ((ssl) == NULL ? NULL                                       \
-      : ((ssl)->type == SSL_TYPE_QUIC_CONNECTION                 \
-         ? (c SSL_CONNECTION *)((c QUIC_CONNECTION *)(ssl))->tls \
-         : NULL))
-
-#  define QUIC_LISTENER_FROM_SSL_int(ssl, c)                            \
-    ((ssl) == NULL                                                      \
-     ? NULL                                                             \
-     : ((ssl)->type == SSL_TYPE_QUIC_LISTENER                           \
-        ? (c QUIC_LISTENER *)(ssl)                                      \
-        : NULL))
-
-#  define IS_QUIC_CS(ssl) ((ssl) != NULL                                \
-                           && ((ssl)->type == SSL_TYPE_QUIC_CONNECTION  \
-                               || (ssl)->type == SSL_TYPE_QUIC_XSO))
-
-#  define IS_QUIC(ssl)                                                  \
-    ((ssl) != NULL && SSL_TYPE_IS_QUIC((ssl)->type))
-# else
-#  define QUIC_CONNECTION_FROM_SSL_int(ssl, c) NULL
-#  define QUIC_XSO_FROM_SSL_int(ssl, c) NULL
-#  define QUIC_LISTENER_FROM_SSL_int(ssl, c) NULL
-#  define SSL_CONNECTION_FROM_QUIC_SSL_int(ssl, c) NULL
-#  define IS_QUIC(ssl) 0
-#  define IS_QUIC_CS(ssl) 0
-#  define IS_QUIC_CTX(ctx) 0
-#  define IS_QUIC_METHOD(m) 0
 # endif
 
-# define QUIC_CONNECTION_FROM_SSL(ssl) \
-    QUIC_CONNECTION_FROM_SSL_int(ssl, SSL_CONNECTION_NO_CONST)
-# define QUIC_CONNECTION_FROM_CONST_SSL(ssl) \
-    QUIC_CONNECTION_FROM_SSL_int(ssl, const)
-# define QUIC_XSO_FROM_SSL(ssl) \
-    QUIC_XSO_FROM_SSL_int(ssl, SSL_CONNECTION_NO_CONST)
-# define QUIC_XSO_FROM_CONST_SSL(ssl) \
-    QUIC_XSO_FROM_SSL_int(ssl, const)
-# define QUIC_LISTENER_FROM_SSL(ssl) \
-    QUIC_LISTENER_FROM_SSL_int(ssl, SSL_CONNECTION_NO_CONST)
-# define QUIC_LISTENER_FROM_CONST_SSL(ssl) \
-    QUIC_LISTENER_FROM_SSL_int(ssl, const)
-# define SSL_CONNECTION_FROM_QUIC_SSL(ssl) \
-    SSL_CONNECTION_FROM_QUIC_SSL_int(ssl, SSL_CONNECTION_NO_CONST)
-# define SSL_CONNECTION_FROM_CONST_QUIC_SSL(ssl) \
-    SSL_CONNECTION_FROM_CONST_QUIC_SSL_int(ssl, const)
-
 # define IMPLEMENT_quic_meth_func(version, func_name, q_accept, \
                                  q_connect, enc_data) \
 const SSL_METHOD *func_name(void)  \
diff --git a/ssl/quic/quic_obj.c b/ssl/quic/quic_obj.c
index 63261073d5..2981fd4fe8 100644
--- a/ssl/quic/quic_obj.c
+++ b/ssl/quic/quic_obj.c
@@ -9,6 +9,7 @@
 
 #include "quic_obj_local.h"
 #include "quic_local.h"
+#include "internal/ssl_unwrap.h"
 
 static int obj_update_cache(QUIC_OBJ *obj);
 
diff --git a/ssl/quic/quic_port.c b/ssl/quic/quic_port.c
index c8cdc66898..c26164c9c2 100644
--- a/ssl/quic/quic_port.c
+++ b/ssl/quic/quic_port.c
@@ -11,6 +11,7 @@
 #include "internal/quic_channel.h"
 #include "internal/quic_lcidm.h"
 #include "internal/quic_srtm.h"
+#include "internal/ssl_unwrap.h"
 #include "quic_port_local.h"
 #include "quic_channel_local.h"
 #include "quic_engine_local.h"
diff --git a/ssl/quic/quic_tls.c b/ssl/quic/quic_tls.c
index bd560c9a91..b2ad28e5d1 100644
--- a/ssl/quic/quic_tls.c
+++ b/ssl/quic/quic_tls.c
@@ -11,6 +11,7 @@
 #include "internal/quic_tls.h"
 #include "../ssl_local.h"
 #include "internal/quic_error.h"
+#include "internal/ssl_unwrap.h"
 
 #define QUIC_TLS_FATAL(rl, ad, err) \
     do { \
diff --git a/ssl/quic/quic_trace.c b/ssl/quic/quic_trace.c
index 5a6d79bf4b..34f9c001c6 100644
--- a/ssl/quic/quic_trace.c
+++ b/ssl/quic/quic_trace.c
@@ -9,7 +9,10 @@
 
 #include <openssl/bio.h>
 #include "../ssl_local.h"
+#include "internal/quic_trace.h"
 #include "internal/quic_wire_pkt.h"
+#include "internal/quic_wire.h"
+#include "internal/ssl_unwrap.h"
 
 static const char *packet_type(int type)
 {
diff --git a/ssl/record/rec_layer_d1.c b/ssl/record/rec_layer_d1.c
index ee45f8117d..6fb762bbd6 100644
--- a/ssl/record/rec_layer_d1.c
+++ b/ssl/record/rec_layer_d1.c
@@ -15,6 +15,7 @@
 #include "record_local.h"
 #include "internal/packet.h"
 #include "internal/cryptlib.h"
+#include "internal/ssl_unwrap.h"
 
 int DTLS_RECORD_LAYER_new(RECORD_LAYER *rl)
 {
diff --git a/ssl/record/rec_layer_s3.c b/ssl/record/rec_layer_s3.c
index 6a31efe1c0..711c6c49df 100644
--- a/ssl/record/rec_layer_s3.c
+++ b/ssl/record/rec_layer_s3.c
@@ -19,6 +19,7 @@
 #include <openssl/core_names.h>
 #include "record_local.h"
 #include "internal/packet.h"
+#include "internal/ssl_unwrap.h"
 
 void RECORD_LAYER_init(RECORD_LAYER *rl, SSL_CONNECTION *s)
 {
diff --git a/ssl/s3_enc.c b/ssl/s3_enc.c
index 878556b069..b67ec03900 100644
--- a/ssl/s3_enc.c
+++ b/ssl/s3_enc.c
@@ -14,6 +14,7 @@
 #include <openssl/md5.h>
 #include <openssl/core_names.h>
 #include "internal/cryptlib.h"
+#include "internal/ssl_unwrap.h"
 
 static int ssl3_generate_key_block(SSL_CONNECTION *s, unsigned char *km, int num)
 {
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 2bc5e79fd1..2b0245f084 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -20,6 +20,7 @@
 #include <openssl/x509v3.h>
 #include <openssl/core_names.h>
 #include "internal/cryptlib.h"
+#include "internal/ssl_unwrap.h"
 
 #define TLS13_NUM_CIPHERS       OSSL_NELEM(tls13_ciphers)
 #define SSL3_NUM_CIPHERS        OSSL_NELEM(ssl3_ciphers)
diff --git a/ssl/s3_msg.c b/ssl/s3_msg.c
index 3fcea15e27..398f746a90 100644
--- a/ssl/s3_msg.c
+++ b/ssl/s3_msg.c
@@ -8,6 +8,7 @@
  */
 
 #include "ssl_local.h"
+#include "internal/ssl_unwrap.h"
 
 int ssl3_do_change_cipher_spec(SSL_CONNECTION *s)
 {
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index f11eb75827..2e439684f2 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -24,6 +24,7 @@
 #include "ssl_local.h"
 #include "ssl_cert_table.h"
 #include "internal/thread_once.h"
+#include "internal/ssl_unwrap.h"
 #ifndef OPENSSL_NO_POSIX_IO
 # include <sys/stat.h>
 # ifdef _WIN32
diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
index ddde21b968..9da1dc407b 100644
--- a/ssl/ssl_ciph.c
+++ b/ssl/ssl_ciph.c
@@ -21,6 +21,7 @@
 #include "ssl_local.h"
 #include "internal/thread_once.h"
 #include "internal/cryptlib.h"
+#include "internal/ssl_unwrap.h"
 
 /* NB: make sure indices in these tables match values above */
 
diff --git a/ssl/ssl_conf.c b/ssl/ssl_conf.c
index 77de00542b..4b3723e1fc 100644
--- a/ssl/ssl_conf.c
+++ b/ssl/ssl_conf.c
@@ -14,6 +14,7 @@
 #include <openssl/decoder.h>
 #include <openssl/core_dispatch.h>
 #include "internal/nelem.h"
+#include "internal/ssl_unwrap.h"
 
 /*
  * structure holding name tables. This is used for permitted elements in lists
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index fee2656a6d..a08fc013a3 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -26,6 +26,7 @@
 #include "internal/nelem.h"
 #include "internal/refcount.h"
 #include "internal/ktls.h"
+#include "internal/ssl_unwrap.h"
 #include "quic/quic_local.h"
 
 static int ssl_undefined_function_3(SSL_CONNECTION *sc, unsigned char *r,
diff --git a/ssl/ssl_local.h b/ssl/ssl_local.h
index b033ea0999..beea83e028 100644
--- a/ssl/ssl_local.h
+++ b/ssl/ssl_local.h
@@ -37,6 +37,7 @@
 # include "internal/ktls.h"
 # include "internal/time.h"
 # include "internal/ssl.h"
+# include "internal/quic_predef.h"
 # include "record/record.h"
 
 # ifdef OPENSSL_BUILD_SHLIBSSL
@@ -1813,38 +1814,6 @@ struct ssl_connection_st {
     size_t server_cert_type_len;
 };
 
-# define SSL_CONNECTION_FROM_SSL_ONLY_int(ssl, c) \
-    ((ssl) == NULL ? NULL                         \
-     : ((ssl)->type == SSL_TYPE_SSL_CONNECTION    \
-       ? (c SSL_CONNECTION *)(ssl)                \
-       : NULL))
-# define SSL_CONNECTION_NO_CONST
-# define SSL_CONNECTION_FROM_SSL_ONLY(ssl) \
-    SSL_CONNECTION_FROM_SSL_ONLY_int(ssl, SSL_CONNECTION_NO_CONST)
-# define SSL_CONNECTION_FROM_CONST_SSL_ONLY(ssl) \
-    SSL_CONNECTION_FROM_SSL_ONLY_int(ssl, const)
-# define SSL_CONNECTION_GET_CTX(sc) ((sc)->ssl.ctx)
-# define SSL_CONNECTION_GET_SSL(sc) (&(sc)->ssl)
-# ifndef OPENSSL_NO_QUIC
-#  include "quic/quic_local.h"
-#  define SSL_CONNECTION_FROM_SSL_int(ssl, c)                      \
-    ((ssl) == NULL ? NULL                                          \
-     : ((ssl)->type == SSL_TYPE_SSL_CONNECTION                     \
-        ? (c SSL_CONNECTION *)(ssl)                                \
-        : ((ssl)->type == SSL_TYPE_QUIC_CONNECTION                 \
-           ? (c SSL_CONNECTION *)((c QUIC_CONNECTION *)(ssl))->tls \
-           : NULL)))
-#  define SSL_CONNECTION_FROM_SSL(ssl) \
-    SSL_CONNECTION_FROM_SSL_int(ssl, SSL_CONNECTION_NO_CONST)
-#  define SSL_CONNECTION_FROM_CONST_SSL(ssl) \
-    SSL_CONNECTION_FROM_SSL_int(ssl, const)
-# else
-#  define SSL_CONNECTION_FROM_SSL(ssl) \
-    SSL_CONNECTION_FROM_SSL_ONLY_int(ssl, SSL_CONNECTION_NO_CONST)
-#  define SSL_CONNECTION_FROM_CONST_SSL(ssl) \
-    SSL_CONNECTION_FROM_SSL_ONLY_int(ssl, const)
-# endif
-
 /*
  * Structure containing table entry of values associated with the signature
  * algorithms (signature scheme) extension
diff --git a/ssl/ssl_rsa.c b/ssl/ssl_rsa.c
index c245c24080..50a8ba75ac 100644
--- a/ssl/ssl_rsa.c
+++ b/ssl/ssl_rsa.c
@@ -10,6 +10,7 @@
 #include <stdio.h>
 #include "ssl_local.h"
 #include "internal/packet.h"
+#include "internal/ssl_unwrap.h"
 #include <openssl/bio.h>
 #include <openssl/objects.h>
 #include <openssl/evp.h>
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index eaa9595f8c..fe75b6ee91 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -17,6 +17,7 @@
 #include <openssl/engine.h>
 #include "internal/refcount.h"
 #include "internal/cryptlib.h"
+#include "internal/ssl_unwrap.h"
 #include "ssl_local.h"
 #include "statem/statem_local.h"
 
diff --git a/ssl/ssl_stat.c b/ssl/ssl_stat.c
index c7fbd4ed02..201173d0fe 100644
--- a/ssl/ssl_stat.c
+++ b/ssl/ssl_stat.c
@@ -10,6 +10,7 @@
 
 #include <stdio.h>
 #include "ssl_local.h"
+#include "internal/ssl_unwrap.h"
 
 const char *SSL_state_string_long(const SSL *s)
 {
diff --git a/ssl/statem/extensions.c b/ssl/statem/extensions.c
index 0a64ca2246..94a53d3c89 100644
--- a/