Deprecate the low level CMAC functions

Use of the low level CMAC functions has been informally discouraged for a
long time.  We now formally deprecate them.

Applications should instead use EVP_MAC_CTX_new(3), EVP_MAC_CTX_free(3),
EVP_MAC_init(3), EVP_MAC_update(3) and EVP_MAC_final(3).

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/10836)

1 files changed, 14 insertions, 11 deletions

diff --git a/include/openssl/cmac.h b/include/openssl/cmac.h
index ef0ab3a36a..2f43eced3c 100644
--- a/include/openssl/cmac.h
+++ b/include/openssl/cmac.h
@@ -24,20 +24,23 @@ extern "C" {
 
 #  include <openssl/evp.h>
 
+#  ifndef OPENSSL_NO_DEPRECATED_3_0
 /* Opaque */
 typedef struct CMAC_CTX_st CMAC_CTX;
+#  endif
 
-CMAC_CTX *CMAC_CTX_new(void);
-void CMAC_CTX_cleanup(CMAC_CTX *ctx);
-void CMAC_CTX_free(CMAC_CTX *ctx);
-EVP_CIPHER_CTX *CMAC_CTX_get0_cipher_ctx(CMAC_CTX *ctx);
-int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in);
-
-int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
-              const EVP_CIPHER *cipher, ENGINE *impl);
-int CMAC_Update(CMAC_CTX *ctx, const void *data, size_t dlen);
-int CMAC_Final(CMAC_CTX *ctx, unsigned char *out, size_t *poutlen);
-int CMAC_resume(CMAC_CTX *ctx);
+DEPRECATEDIN_3_0(CMAC_CTX *CMAC_CTX_new(void))
+DEPRECATEDIN_3_0(void CMAC_CTX_cleanup(CMAC_CTX *ctx))
+DEPRECATEDIN_3_0(void CMAC_CTX_free(CMAC_CTX *ctx))
+DEPRECATEDIN_3_0(EVP_CIPHER_CTX *CMAC_CTX_get0_cipher_ctx(CMAC_CTX *ctx))
+DEPRECATEDIN_3_0(int CMAC_CTX_copy(CMAC_CTX *out, const CMAC_CTX *in))
+
+DEPRECATEDIN_3_0(int CMAC_Init(CMAC_CTX *ctx, const void *key, size_t keylen,
+              const EVP_CIPHER *cipher, ENGINE *impl))
+DEPRECATEDIN_3_0(int CMAC_Update(CMAC_CTX *ctx, const void *data, size_t dlen))
+DEPRECATEDIN_3_0(int CMAC_Final(CMAC_CTX *ctx, unsigned char *out,
+                                size_t *poutlen))
+DEPRECATEDIN_3_0(int CMAC_resume(CMAC_CTX *ctx))
 
 #  ifdef  __cplusplus
 }