tree 8ce8df212f3146cfc1b004f1d7a7a500ceeb0585
parent 9bb8f779a7287dd11d02e25fe1a91e1d902d917e
author David Benjamin <davidben@google.com> 1739834827 -0500
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1739901390 -0800

Avoid running the X.509 auto-chaining logic twice in TLS clients

The ssl_get_credential_list helper implicitly assumed we only need to
read the credential list immediately after cert_cb finishes. The SPAKE
CL broke this assumption, by needing to look at credentials during
ClientHello. But since that doesn't need the legacy credential, we can
just say that other uses look at the list directly. As a bonus, we avoid
a copy.

Change-Id: I878cba59903889a648c89bf8a781d9f99c8bfd03
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/76427
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>