commit ebad508ef111ef13106019f6e9b22bdae7bf57ef
author David Benjamin <davidben@google.com> Mon Feb 03 19:32:19 2020 -0500
committer Adam Langley <agl@google.com> Wed Feb 05 23:21:08 2020 +0000
tree 920c62e26ff69ed2a5a34946f19e4fa0e1b07929
parent 10165d82c16a9cab4a61569eaea9f0fadb36346c

Switch verify sigalg pref functions to SSL_HANDSHAKE.

Functions that take SSL* do not necessarily have an ssl->config
available because it is released post-handshake, whereas hs->config can
be accessed without a null check.

Change-Id: I3d9f3838c1f2d79f92beac363a90fb6046671053
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39844
Reviewed-by: Adam Langley <agl@google.com>

ssl/handshake_client.cc

diff --git a/ssl/handshake_client.cc b/ssl/handshake_client.cc
index 4041fe9..25f96d0 100644
--- a/ssl/handshake_client.cc
+++ b/ssl/handshake_client.cc
@@ -1050,7 +1050,7 @@
         return ssl_hs_error;
       }
       uint8_t alert = SSL_AD_DECODE_ERROR;
-      if (!tls12_check_peer_sigalg(ssl, &alert, signature_algorithm)) {
+      if (!tls12_check_peer_sigalg(hs, &alert, signature_algorithm)) {
         ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
         return ssl_hs_error;
       }
@@ -1273,7 +1273,7 @@
     ssl_key_usage_t intended_use = (alg_k & SSL_kRSA)
                                        ? key_usage_encipherment
                                        : key_usage_digital_signature;
-    if (ssl->config->enforce_rsa_key_usage ||
+    if (hs->config->enforce_rsa_key_usage ||
         EVP_PKEY_id(hs->peer_pubkey.get()) != EVP_PKEY_RSA) {
       if (!ssl_cert_check_key_usage(&leaf_cbs, intended_use)) {
         return ssl_hs_error;