commit ebad508ef111ef13106019f6e9b22bdae7bf57ef
author David Benjamin <davidben@google.com> Mon Feb 03 19:32:19 2020 -0500
committer Adam Langley <agl@google.com> Wed Feb 05 23:21:08 2020 +0000
tree 920c62e26ff69ed2a5a34946f19e4fa0e1b07929
parent 10165d82c16a9cab4a61569eaea9f0fadb36346c

Switch verify sigalg pref functions to SSL_HANDSHAKE.

Functions that take SSL* do not necessarily have an ssl->config
available because it is released post-handshake, whereas hs->config can
be accessed without a null check.

Change-Id: I3d9f3838c1f2d79f92beac363a90fb6046671053
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/39844
Reviewed-by: Adam Langley <agl@google.com>

ssl/handshake_server.cc

diff --git a/ssl/handshake_server.cc b/ssl/handshake_server.cc
index dfe14bf..ec9e6ea 100644
--- a/ssl/handshake_server.cc
+++ b/ssl/handshake_server.cc
@@ -1094,7 +1094,7 @@
         !CBB_add_u8(&cert_types, TLS_CT_ECDSA_SIGN) ||
         (ssl_protocol_version(ssl) >= TLS1_2_VERSION &&
          (!CBB_add_u16_length_prefixed(&body, &sigalgs_cbb) ||
-          !tls12_add_verify_sigalgs(ssl, &sigalgs_cbb))) ||
+          !tls12_add_verify_sigalgs(hs, &sigalgs_cbb))) ||
         !ssl_add_client_CA_list(hs, &body) ||
         !ssl_add_message_cbb(ssl, cbb.get())) {
       OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
@@ -1439,7 +1439,7 @@
       return ssl_hs_error;
     }
     uint8_t alert = SSL_AD_DECODE_ERROR;
-    if (!tls12_check_peer_sigalg(ssl, &alert, signature_algorithm)) {
+    if (!tls12_check_peer_sigalg(hs, &alert, signature_algorithm)) {
       ssl_send_alert(ssl, SSL3_AL_FATAL, alert);
       return ssl_hs_error;
     }