void CRYPTO_gcm128_tag(GCM128_CONTEXT *ctx, unsigned char *tag, size_t len)
{
    CRYPTO_gcm128_finish(ctx, NULL, 0);
    memcpy(tag, ctx->Xi.c,
           len <= sizeof(ctx->Xi.c) ? len : sizeof(ctx->Xi.c));
}
['static int aes_gcm_tls_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out,\n                              const unsigned char *in, size_t len)\n{\n    EVP_AES_GCM_CTX *gctx = ctx->cipher_data;\n    int rv = -1;\n    if (out != in\n        || len < (EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN))\n        return -1;\n    if (EVP_CIPHER_CTX_ctrl(ctx, ctx->encrypt ?\n                            EVP_CTRL_GCM_IV_GEN : EVP_CTRL_GCM_SET_IV_INV,\n                            EVP_GCM_TLS_EXPLICIT_IV_LEN, out) <= 0)\n        goto err;\n    if (CRYPTO_gcm128_aad(&gctx->gcm, ctx->buf, gctx->tls_aad_len))\n        goto err;\n    in += EVP_GCM_TLS_EXPLICIT_IV_LEN;\n    out += EVP_GCM_TLS_EXPLICIT_IV_LEN;\n    len -= EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;\n    if (ctx->encrypt) {\n        if (gctx->ctr) {\n            size_t bulk = 0;\n# if defined(AES_GCM_ASM)\n            if (len >= 32 && AES_GCM_ASM(gctx)) {\n                if (CRYPTO_gcm128_encrypt(&gctx->gcm, NULL, NULL, 0))\n                    return -1;\n                bulk = AES_gcm_encrypt(in, out, len,\n                                       gctx->gcm.key,\n                                       gctx->gcm.Yi.c, gctx->gcm.Xi.u);\n                gctx->gcm.len.u[1] += bulk;\n            }\n# endif\n            if (CRYPTO_gcm128_encrypt_ctr32(&gctx->gcm,\n                                            in + bulk,\n                                            out + bulk,\n                                            len - bulk, gctx->ctr))\n                goto err;\n        } else {\n            size_t bulk = 0;\n# if defined(AES_GCM_ASM2)\n            if (len >= 32 && AES_GCM_ASM2(gctx)) {\n                if (CRYPTO_gcm128_encrypt(&gctx->gcm, NULL, NULL, 0))\n                    return -1;\n                bulk = AES_gcm_encrypt(in, out, len,\n                                       gctx->gcm.key,\n                                       gctx->gcm.Yi.c, gctx->gcm.Xi.u);\n                gctx->gcm.len.u[1] += bulk;\n            }\n# endif\n            if (CRYPTO_gcm128_encrypt(&gctx->gcm,\n                                      in + bulk, out + bulk, len - bulk))\n                goto err;\n        }\n        out += len;\n        CRYPTO_gcm128_tag(&gctx->gcm, out, EVP_GCM_TLS_TAG_LEN);\n        rv = len + EVP_GCM_TLS_EXPLICIT_IV_LEN + EVP_GCM_TLS_TAG_LEN;\n    } else {\n        if (gctx->ctr) {\n            size_t bulk = 0;\n# if defined(AES_GCM_ASM)\n            if (len >= 16 && AES_GCM_ASM(gctx)) {\n                if (CRYPTO_gcm128_decrypt(&gctx->gcm, NULL, NULL, 0))\n                    return -1;\n                bulk = AES_gcm_decrypt(in, out, len,\n                                       gctx->gcm.key,\n                                       gctx->gcm.Yi.c, gctx->gcm.Xi.u);\n                gctx->gcm.len.u[1] += bulk;\n            }\n# endif\n            if (CRYPTO_gcm128_decrypt_ctr32(&gctx->gcm,\n                                            in + bulk,\n                                            out + bulk,\n                                            len - bulk, gctx->ctr))\n                goto err;\n        } else {\n            size_t bulk = 0;\n# if defined(AES_GCM_ASM2)\n            if (len >= 16 && AES_GCM_ASM2(gctx)) {\n                if (CRYPTO_gcm128_decrypt(&gctx->gcm, NULL, NULL, 0))\n                    return -1;\n                bulk = AES_gcm_decrypt(in, out, len,\n                                       gctx->gcm.key,\n                                       gctx->gcm.Yi.c, gctx->gcm.Xi.u);\n                gctx->gcm.len.u[1] += bulk;\n            }\n# endif\n            if (CRYPTO_gcm128_decrypt(&gctx->gcm,\n                                      in + bulk, out + bulk, len - bulk))\n                goto err;\n        }\n        CRYPTO_gcm128_tag(&gctx->gcm, ctx->buf, EVP_GCM_TLS_TAG_LEN);\n        if (memcmp(ctx->buf, in + len, EVP_GCM_TLS_TAG_LEN)) {\n            OPENSSL_cleanse(out, len);\n            goto err;\n        }\n        rv = len;\n    }\n err:\n    gctx->iv_set = 0;\n    gctx->tls_aad_len = -1;\n    return rv;\n}', 'void CRYPTO_gcm128_tag(GCM128_CONTEXT *ctx, unsigned char *tag, size_t len)\n{\n    CRYPTO_gcm128_finish(ctx, NULL, 0);\n    memcpy(tag, ctx->Xi.c,\n           len <= sizeof(ctx->Xi.c) ? len : sizeof(ctx->Xi.c));\n}']