Change ssl_sigalgs_build() to perform sigalg list selection.

Rather that doing sigalg list selection at every call site, pass in the
appropriate TLS version and have ssl_sigalgs_build() perform the sigalg
list selection itself. This reduces code duplication, simplifies the
calling code and is the first step towards internalising the sigalg lists.

ok tb@

1 files changed, 3 insertions, 21 deletions

diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index 035d6b4564..22932f969d 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.c,v 1.95 2021/06/11 17:29:48 jsing Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.96 2021/06/27 17:59:17 jsing Exp $ */
 /*
  * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -558,21 +558,12 @@ tlsext_sigalgs_client_needs(SSL *s, uint16_t msg_type)
 int
 tlsext_sigalgs_client_build(SSL *s, uint16_t msg_type, CBB *cbb)
 {
-        const uint16_t *tls_sigalgs = tls12_sigalgs;
-        size_t tls_sigalgs_len = tls12_sigalgs_len;
         CBB sigalgs;
 
-        if (S3I(s)->hs.our_min_tls_version >= TLS1_3_VERSION) {
-                tls_sigalgs = tls13_sigalgs;
-                tls_sigalgs_len = tls13_sigalgs_len;
-        }
-
         if (!CBB_add_u16_length_prefixed(cbb, &sigalgs))
                 return 0;
-
-        if (!ssl_sigalgs_build(&sigalgs, tls_sigalgs, tls_sigalgs_len))
+        if (!ssl_sigalgs_build(S3I(s)->hs.our_min_tls_version, &sigalgs))
                 return 0;
-
         if (!CBB_flush(cbb))
                 return 0;
 
@@ -603,21 +594,12 @@ tlsext_sigalgs_server_needs(SSL *s, uint16_t msg_type)
 int
 tlsext_sigalgs_server_build(SSL *s, uint16_t msg_type, CBB *cbb)
 {
-        const uint16_t *tls_sigalgs = tls12_sigalgs;
-        size_t tls_sigalgs_len = tls12_sigalgs_len;
         CBB sigalgs;
 
-        if (S3I(s)->hs.negotiated_tls_version >= TLS1_3_VERSION) {
-                tls_sigalgs = tls13_sigalgs;
-                tls_sigalgs_len = tls13_sigalgs_len;
-        }
-
         if (!CBB_add_u16_length_prefixed(cbb, &sigalgs))
                 return 0;
-
-        if (!ssl_sigalgs_build(&sigalgs, tls_sigalgs, tls_sigalgs_len))
+        if (!ssl_sigalgs_build(S3I(s)->hs.negotiated_tls_version, &sigalgs))
                 return 0;
-
         if (!CBB_flush(cbb))
                 return 0;