[dev.boringcrypto] all: merge master (nearly Go 1.10 beta 1) into dev.boringcrypto

[gostls13.git] / src / crypto / tls / handshake_server.go

diff --git a/src/crypto/tls/handshake_server.go b/src/crypto/tls/handshake_server.go
index 93e664079f4bb8d7a68c4c581d06b8e535edf835..07e388a35ebf977eaff5df7a95f5595d2254aac5 100644 (file)
--- a/src/crypto/tls/handshake_server.go
+++ b/src/crypto/tls/handshake_server.go
@@ -418,7 +418,7 @@ func (hs *serverHandshakeState) doFullHandshake() error {
                }
                if c.vers >= VersionTLS12 {
                        certReq.hasSignatureAndHash = true
-                       certReq.signatureAndHashes = supportedSignatureAlgorithms()
+                       certReq.supportedSignatureAlgorithms = supportedSignatureAlgorithms()
                }
 
                // An empty list of certificateAuthorities signals to
@@ -519,27 +519,30 @@ func (hs *serverHandshakeState) doFullHandshake() error {
                }
 
                // Determine the signature type.
-               var signatureAndHash signatureAndHash
+               var signatureAlgorithm SignatureScheme
+               var sigType uint8
                if certVerify.hasSignatureAndHash {
-                       signatureAndHash = certVerify.signatureAndHash
-                       if !isSupportedSignatureAndHash(signatureAndHash, supportedSignatureAlgorithms()) {
+                       signatureAlgorithm = certVerify.signatureAlgorithm
+                       if !isSupportedSignatureAlgorithm(signatureAlgorithm, supportedSignatureAlgorithms()) {
                                return errors.New("tls: unsupported hash function for client certificate")
                        }
+                       sigType = signatureFromSignatureScheme(signatureAlgorithm)
                } else {
                        // Before TLS 1.2 the signature algorithm was implicit
                        // from the key type, and only one hash per signature
-                       // algorithm was possible. Leave the hash as zero.
+                       // algorithm was possible. Leave signatureAlgorithm
+                       // unset.
                        switch pub.(type) {
                        case *ecdsa.PublicKey:
-                               signatureAndHash.signature = signatureECDSA
+                               sigType = signatureECDSA
                        case *rsa.PublicKey:
-                               signatureAndHash.signature = signatureRSA
+                               sigType = signatureRSA
                        }
                }
 
                switch key := pub.(type) {
                case *ecdsa.PublicKey:
-                       if signatureAndHash.signature != signatureECDSA {
+                       if sigType != signatureECDSA {
                                err = errors.New("tls: bad signature type for client's ECDSA certificate")
                                break
                        }
@@ -552,20 +555,20 @@ func (hs *serverHandshakeState) doFullHandshake() error {
                                break
                        }
                        var digest []byte
-                       if digest, _, err = hs.finishedHash.hashForClientCertificate(signatureAndHash, hs.masterSecret); err != nil {
+                       if digest, _, err = hs.finishedHash.hashForClientCertificate(sigType, signatureAlgorithm, hs.masterSecret); err != nil {
                                break
                        }
                        if !ecdsa.Verify(key, digest, ecdsaSig.R, ecdsaSig.S) {
                                err = errors.New("tls: ECDSA verification failure")
                        }
                case *rsa.PublicKey:
-                       if signatureAndHash.signature != signatureRSA {
+                       if sigType != signatureRSA {
                                err = errors.New("tls: bad signature type for client's RSA certificate")
                                break
                        }
                        var digest []byte
                        var hashFunc crypto.Hash
-                       if digest, hashFunc, err = hs.finishedHash.hashForClientCertificate(signatureAndHash, hs.masterSecret); err != nil {
+                       if digest, hashFunc, err = hs.finishedHash.hashForClientCertificate(sigType, signatureAlgorithm, hs.masterSecret); err != nil {
                                break
                        }
                        err = rsa.VerifyPKCS1v15(key, hashFunc, digest, certVerify.signature)
@@ -820,17 +823,12 @@ func (hs *serverHandshakeState) clientHelloInfo() *ClientHelloInfo {
                supportedVersions = suppVersArray[VersionTLS12-hs.clientHello.vers:]
        }
 
-       signatureSchemes := make([]SignatureScheme, 0, len(hs.clientHello.signatureAndHashes))
-       for _, sah := range hs.clientHello.signatureAndHashes {
-               signatureSchemes = append(signatureSchemes, SignatureScheme(sah.hash)<<8+SignatureScheme(sah.signature))
-       }
-
        hs.cachedClientHelloInfo = &ClientHelloInfo{
                CipherSuites:      hs.clientHello.cipherSuites,
                ServerName:        hs.clientHello.serverName,
                SupportedCurves:   hs.clientHello.supportedCurves,
                SupportedPoints:   hs.clientHello.supportedPoints,
-               SignatureSchemes:  signatureSchemes,
+               SignatureSchemes:  hs.clientHello.supportedSignatureAlgorithms,
                SupportedProtos:   hs.clientHello.alpnProtocols,
                SupportedVersions: supportedVersions,
                Conn:              hs.c.conn,