Switch sig schemes from copies to references (#4237)

tests/cbmc/sources/make_common_datastructures.c

@@ -518,6 +518,13 @@ void cbmc_populate_s2n_signature_scheme(struct s2n_signature_scheme *s2n_signatu
     s2n_signature_scheme->signature_curve = cbmc_allocate_s2n_ecc_named_curve();
 }
 
+struct s2n_signature_scheme *cbmc_allocate_s2n_signature_scheme()
+{
+    struct s2n_signature_scheme *s2n_signature_scheme = malloc(sizeof(*s2n_signature_scheme));
+    cbmc_populate_s2n_signature_scheme(s2n_signature_scheme);
+    return s2n_signature_scheme;
+}
+
 struct s2n_kex *cbmc_allocate_s2n_kex()
 {
     struct s2n_kex *s2n_kex = malloc(sizeof(*s2n_kex));
@@ -660,10 +667,10 @@ void cbmc_populate_s2n_handshake_parameters(struct s2n_handshake_parameters *s2n
     CBMC_ENSURE_REF(s2n_handshake_parameters);
     cbmc_populate_s2n_pkey(&(s2n_handshake_parameters->server_public_key));
     cbmc_populate_s2n_pkey(&(s2n_handshake_parameters->client_public_key));
-    cbmc_populate_s2n_signature_scheme(&(s2n_handshake_parameters->conn_sig_scheme));
     cbmc_populate_s2n_blob(&(s2n_handshake_parameters->client_cert_chain));
-    cbmc_populate_s2n_signature_scheme(&(s2n_handshake_parameters->client_cert_sig_scheme));
     cbmc_populate_s2n_cert_chain_and_key(s2n_handshake_parameters->our_chain_and_key);
+    s2n_handshake_parameters->server_cert_sig_scheme = cbmc_allocate_s2n_signature_scheme();
+    s2n_handshake_parameters->client_cert_sig_scheme = cbmc_allocate_s2n_signature_scheme();
     /* `s2n_handshake_parameters->exact_sni_matches`
      * `s2n_handshake_parameters->wc_sni_matches` are never allocated.
      * If required, these initializations should be done in the proof harness.

tests/fuzz/s2n_hybrid_ecdhe_kyber_r3_fuzz_test.c

@@ -55,7 +55,7 @@ static int setup_connection(struct s2n_connection *server_conn, struct s2n_kem_p
     server_conn->kex_params.server_ecc_evp_params.evp_pkey = NULL;
     server_conn->kex_params.kem_params.kem = &s2n_kyber_512_r3;
     server_conn->secure->cipher_suite = &s2n_ecdhe_kyber_rsa_with_aes_256_gcm_sha384;
-    server_conn->handshake_params.conn_sig_scheme = s2n_rsa_pkcs1_sha384;
+    server_conn->handshake_params.server_cert_sig_scheme = &s2n_rsa_pkcs1_sha384;
 
     POSIX_GUARD(s2n_dup(&params->private_key, &server_conn->kex_params.kem_params.private_key));
     POSIX_GUARD(s2n_ecc_evp_generate_ephemeral_key(&server_conn->kex_params.server_ecc_evp_params));

tests/unit/s2n_auth_selection_test.c

@@ -53,7 +53,7 @@ static int s2n_test_auth_combo(struct s2n_connection *conn,
     conn->secure->cipher_suite = cipher_suite;
 
     POSIX_GUARD(s2n_is_sig_scheme_valid_for_auth(conn, sig_scheme));
-    conn->handshake_params.conn_sig_scheme.sig_alg = sig_scheme->sig_alg;
+    conn->handshake_params.server_cert_sig_scheme = sig_scheme;
 
     POSIX_GUARD(s2n_select_certs_for_server_auth(conn, &actual_cert_chain));
     POSIX_ENSURE_EQ(actual_cert_chain, expected_cert_chain);
@@ -303,38 +303,48 @@ int main(int argc, char **argv)
         /* Requested cert chain exists */
         s2n_connection_set_config(conn, all_certs_config);
 
-        conn->handshake_params.conn_sig_scheme.sig_alg = S2N_SIGNATURE_RSA;
+        struct s2n_signature_scheme test_sig_scheme = { 0 };
+        conn->handshake_params.server_cert_sig_scheme = &test_sig_scheme;
+
+        test_sig_scheme.sig_alg = S2N_SIGNATURE_RSA;
         EXPECT_SUCCESS(s2n_select_certs_for_server_auth(conn, &chosen_certs));
         EXPECT_EQUAL(chosen_certs, rsa_cert_chain);
 
-        conn->handshake_params.conn_sig_scheme.sig_alg = S2N_SIGNATURE_RSA_PSS_PSS;
+        /* cppcheck-suppress redundantAssignment */
+        test_sig_scheme.sig_alg = S2N_SIGNATURE_RSA_PSS_PSS;
         EXPECT_SUCCESS_IF_RSA_PSS_CERTS_SUPPORTED(s2n_select_certs_for_server_auth(conn, &chosen_certs));
         EXPECT_EQUAL(chosen_certs, rsa_pss_cert_chain);
 
-        conn->handshake_params.conn_sig_scheme.sig_alg = S2N_SIGNATURE_RSA_PSS_RSAE;
+        /* cppcheck-suppress redundantAssignment */
+        test_sig_scheme.sig_alg = S2N_SIGNATURE_RSA_PSS_RSAE;
         EXPECT_SUCCESS(s2n_select_certs_for_server_auth(conn, &chosen_certs));
         EXPECT_EQUAL(chosen_certs, rsa_cert_chain);
 
-        conn->handshake_params.conn_sig_scheme.sig_alg = S2N_SIGNATURE_ECDSA;
+        /* cppcheck-suppress redundantAssignment */
+        test_sig_scheme.sig_alg = S2N_SIGNATURE_ECDSA;
         EXPECT_SUCCESS(s2n_select_certs_for_server_auth(conn, &chosen_certs));
         EXPECT_EQUAL(chosen_certs, ecdsa_cert_chain);
 
         /* Requested cert chain does NOT exist */
         s2n_connection_set_config(conn, no_certs_config);
 
-        conn->handshake_params.conn_sig_scheme.sig_alg = S2N_SIGNATURE_RSA;
+        /* cppcheck-suppress redundantAssignment */
+        test_sig_scheme.sig_alg = S2N_SIGNATURE_RSA;
         EXPECT_FAILURE(s2n_select_certs_for_server_auth(conn, &chosen_certs));
         EXPECT_NULL(chosen_certs);
 
-        conn->handshake_params.conn_sig_scheme.sig_alg = S2N_SIGNATURE_RSA_PSS_PSS;
+        /* cppcheck-suppress redundantAssignment */
+        test_sig_scheme.sig_alg = S2N_SIGNATURE_RSA_PSS_PSS;
         EXPECT_FAILURE(s2n_select_certs_for_server_auth(conn, &chosen_certs));
         EXPECT_NULL(chosen_certs);
 
-        conn->handshake_params.conn_sig_scheme.sig_alg = S2N_SIGNATURE_RSA_PSS_RSAE;
+        /* cppcheck-suppress redundantAssignment */
+        test_sig_scheme.sig_alg = S2N_SIGNATURE_RSA_PSS_RSAE;
         EXPECT_FAILURE(s2n_select_certs_for_server_auth(conn, &chosen_certs));
         EXPECT_NULL(chosen_certs);
 
-        conn->handshake_params.conn_sig_scheme.sig_alg = S2N_SIGNATURE_ECDSA;
+        /* cppcheck-suppress redundantAssignment */
+        test_sig_scheme.sig_alg = S2N_SIGNATURE_ECDSA;
         EXPECT_FAILURE(s2n_select_certs_for_server_auth(conn, &chosen_certs));
         EXPECT_NULL(chosen_certs);
 

tests/unit/s2n_client_auth_handshake_test.c

@@ -47,8 +47,8 @@ int s2n_test_client_auth_negotiation(struct s2n_config *server_config, struct s2
     client_conn->server_protocol_version = S2N_TLS13;
     client_conn->client_protocol_version = S2N_TLS13;
     client_conn->actual_protocol_version = S2N_TLS13;
-    client_conn->handshake_params.conn_sig_scheme = s2n_ecdsa_secp256r1_sha256;
-    client_conn->handshake_params.client_cert_sig_scheme = s2n_ecdsa_secp256r1_sha256;
+    client_conn->handshake_params.server_cert_sig_scheme = &s2n_ecdsa_secp256r1_sha256;
+    client_conn->handshake_params.client_cert_sig_scheme = &s2n_ecdsa_secp256r1_sha256;
     client_conn->secure->cipher_suite = &s2n_tls13_aes_128_gcm_sha256;
     if (!no_cert) {
         client_conn->handshake_params.our_chain_and_key = ecdsa_cert;
@@ -58,7 +58,7 @@ int s2n_test_client_auth_negotiation(struct s2n_config *server_config, struct s2
     server_conn->server_protocol_version = S2N_TLS13;
     server_conn->client_protocol_version = S2N_TLS13;
     server_conn->actual_protocol_version = S2N_TLS13;
-    server_conn->handshake_params.conn_sig_scheme = s2n_ecdsa_secp256r1_sha256;
+    server_conn->handshake_params.server_cert_sig_scheme = &s2n_ecdsa_secp256r1_sha256;
     server_conn->secure->cipher_suite = &s2n_tls13_aes_128_gcm_sha256;
 
     if (no_cert) {

tests/unit/s2n_client_cert_verify_test.c

@@ -169,7 +169,7 @@ int main(int argc, char **argv)
         EXPECT_NOT_NULL(conn);
 
         /* Set any signature scheme. Our test pkey methods ignore it. */
-        conn->handshake_params.client_cert_sig_scheme = s2n_rsa_pkcs1_md5_sha1;
+        conn->handshake_params.client_cert_sig_scheme = &s2n_rsa_pkcs1_md5_sha1;
 
         struct s2n_cert_chain_and_key *chain_and_key;
         EXPECT_SUCCESS(s2n_test_cert_chain_and_key_new(&chain_and_key,

tests/unit/s2n_client_hello_recv_test.c

@@ -453,7 +453,7 @@ int main(int argc, char **argv)
         server_conn->psk_params.chosen_psk = &chosen_psk;
         EXPECT_SUCCESS(s2n_client_hello_recv(server_conn));
 
-        EXPECT_EQUAL(server_conn->handshake_params.conn_sig_scheme.iana_value, 0);
+        EXPECT_EQUAL(server_conn->handshake_params.server_cert_sig_scheme->iana_value, 0);
         EXPECT_NULL(server_conn->handshake_params.our_chain_and_key);
 
         EXPECT_SUCCESS(s2n_connection_free(client_conn));

tests/unit/s2n_client_hello_test.c

@@ -1480,10 +1480,10 @@ int main(int argc, char **argv)
 
         EXPECT_EQUAL(server_conn->secure->cipher_suite, &s2n_ecdhe_ecdsa_with_aes_128_cbc_sha);
         EXPECT_EQUAL(client_conn->secure->cipher_suite, &s2n_ecdhe_ecdsa_with_aes_128_cbc_sha);
-        EXPECT_EQUAL(server_conn->handshake_params.conn_sig_scheme.sig_alg, S2N_SIGNATURE_ECDSA);
-        EXPECT_EQUAL(server_conn->handshake_params.conn_sig_scheme.hash_alg, S2N_HASH_SHA1);
-        EXPECT_EQUAL(client_conn->handshake_params.conn_sig_scheme.sig_alg, S2N_SIGNATURE_ECDSA);
-        EXPECT_EQUAL(client_conn->handshake_params.conn_sig_scheme.hash_alg, S2N_HASH_SHA1);
+        EXPECT_EQUAL(server_conn->handshake_params.server_cert_sig_scheme->sig_alg, S2N_SIGNATURE_ECDSA);
+        EXPECT_EQUAL(server_conn->handshake_params.server_cert_sig_scheme->hash_alg, S2N_HASH_SHA1);
+        EXPECT_EQUAL(client_conn->handshake_params.server_cert_sig_scheme->sig_alg, S2N_SIGNATURE_ECDSA);
+        EXPECT_EQUAL(client_conn->handshake_params.server_cert_sig_scheme->hash_alg, S2N_HASH_SHA1);
 
         /* Free the data */
         EXPECT_SUCCESS(s2n_connection_free(server_conn));

tests/unit/s2n_client_signature_algorithms_extension_test.c

@@ -93,7 +93,7 @@ int main(int argc, char **argv)
         EXPECT_SUCCESS(s2n_client_signature_algorithms_extension.recv(conn, &signature_algorithms_extension));
         EXPECT_EQUAL(conn->handshake_params.client_sig_hash_algs.len, sig_hash_algs.len);
         EXPECT_FAILURE(s2n_choose_sig_scheme_from_peer_preference_list(conn, &conn->handshake_params.client_sig_hash_algs,
-                &conn->handshake_params.conn_sig_scheme));
+                &conn->handshake_params.server_cert_sig_scheme));
 
         EXPECT_SUCCESS(s2n_stuffer_free(&signature_algorithms_extension));
         EXPECT_SUCCESS(s2n_connection_free(conn));
@@ -121,8 +121,8 @@ int main(int argc, char **argv)
         EXPECT_SUCCESS(s2n_client_signature_algorithms_extension.recv(conn, &signature_algorithms_extension));
         EXPECT_EQUAL(conn->handshake_params.client_sig_hash_algs.len, sig_hash_algs.len);
         EXPECT_SUCCESS(s2n_choose_sig_scheme_from_peer_preference_list(conn, &conn->handshake_params.client_sig_hash_algs,
-                &conn->handshake_params.conn_sig_scheme));
-        EXPECT_EQUAL(conn->handshake_params.conn_sig_scheme.iana_value, TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA384);
+                &conn->handshake_params.server_cert_sig_scheme));
+        EXPECT_EQUAL(conn->handshake_params.server_cert_sig_scheme->iana_value, TLS_SIGNATURE_SCHEME_RSA_PKCS1_SHA384);
 
         EXPECT_SUCCESS(s2n_stuffer_free(&signature_algorithms_extension));
         EXPECT_SUCCESS(s2n_connection_free(conn));

tests/unit/s2n_connection_test.c

@@ -253,8 +253,10 @@ int main(int argc, char **argv)
         };
 
         for (size_t i = S2N_TLS_HASH_NONE; i <= UINT16_MAX; i++) {
-            conn->handshake_params.client_cert_sig_scheme.hash_alg = i;
-            conn->handshake_params.conn_sig_scheme.hash_alg = i;
+            struct s2n_signature_scheme test_scheme = *conn->handshake_params.client_cert_sig_scheme;
+            test_scheme.hash_alg = i;
+            conn->handshake_params.client_cert_sig_scheme = &test_scheme;
+            conn->handshake_params.server_cert_sig_scheme = &test_scheme;
             if (i <= S2N_HASH_SENTINEL) {
                 EXPECT_SUCCESS(s2n_connection_get_selected_client_cert_digest_algorithm(conn, &output));
                 EXPECT_EQUAL(expected_output[i], output);
@@ -300,8 +302,10 @@ int main(int argc, char **argv)
         };
 
         for (size_t i = 0; i <= UINT16_MAX; i++) {
-            conn->handshake_params.client_cert_sig_scheme.sig_alg = i;
-            conn->handshake_params.conn_sig_scheme.sig_alg = i;
+            struct s2n_signature_scheme test_scheme = *conn->handshake_params.client_cert_sig_scheme;
+            test_scheme.sig_alg = i;
+            conn->handshake_params.client_cert_sig_scheme = &test_scheme;
+            conn->handshake_params.server_cert_sig_scheme = &test_scheme;
 
             if (i < s2n_array_len(expected_output)) {
                 EXPECT_SUCCESS(s2n_connection_get_selected_client_cert_signature_algorithm(conn, &output));

tests/unit/s2n_handshake_test.c

@@ -187,7 +187,8 @@ int test_cipher_preferences(struct s2n_config *server_config, struct s2n_config
             EXPECT_STRING_EQUAL(s2n_connection_get_cipher(server_conn), expected_cipher->name);
 
             EXPECT_EQUAL(server_conn->handshake_params.our_chain_and_key, expected_cert_chain);
-            EXPECT_EQUAL(server_conn->handshake_params.conn_sig_scheme.sig_alg, expected_sig_alg);
+            EXPECT_NOT_NULL(server_conn->handshake_params.server_cert_sig_scheme);
+            EXPECT_EQUAL(server_conn->handshake_params.server_cert_sig_scheme->sig_alg, expected_sig_alg);
 
             EXPECT_TRUE(IS_NEGOTIATED(server_conn));
             EXPECT_TRUE(IS_NEGOTIATED(client_conn));

tests/unit/s2n_security_policies_test.c

@@ -151,7 +151,7 @@ int main(int argc, char **argv)
                     client_conn->secure->cipher_suite = &tls_13_ciphers[i];
                     server_conn->secure->cipher_suite = &tls_13_ciphers[i];
 
-                    struct s2n_signature_scheme chosen_scheme = { 0 };
+                    const struct s2n_signature_scheme *chosen_scheme = NULL;
 
                     if (s2n_is_rsa_pss_signing_supported()) {
                         /* If RSA PSS signing is supported, then we should always be able to select a default Signature
@@ -214,7 +214,7 @@ int main(int argc, char **argv)
                     client_conn->secure->cipher_suite = &tls_13_ciphers[i];
                     server_conn->secure->cipher_suite = &tls_13_ciphers[i];
 
-                    struct s2n_signature_scheme chosen_scheme = { 0 };
+                    const struct s2n_signature_scheme *chosen_scheme = NULL;
 
                     /* If an ECDSA Certificate is configured, then we should always be able to pick a default Signature
                      * Scheme (even if RSA PSS is not supported by the libcrypto) */

tests/unit/s2n_self_talk_offload_signing_test.c

@@ -55,13 +55,13 @@ static S2N_RESULT s2n_async_pkey_sign(struct s2n_cert_chain_and_key *complete_ch
 
     /* Get signature algorithm */
     s2n_tls_signature_algorithm sig_alg = 0;
-    struct s2n_signature_scheme *sig_scheme = NULL;
+    const struct s2n_signature_scheme *sig_scheme = NULL;
     if (pkey_op_conn->mode == S2N_CLIENT) {
         RESULT_GUARD_POSIX(s2n_connection_get_selected_client_cert_signature_algorithm(pkey_op_conn, &sig_alg));
-        sig_scheme = &pkey_op_conn->handshake_params.client_cert_sig_scheme;
+        sig_scheme = pkey_op_conn->handshake_params.client_cert_sig_scheme;
     } else {
         RESULT_GUARD_POSIX(s2n_connection_get_selected_signature_algorithm(pkey_op_conn, &sig_alg));
-        sig_scheme = &pkey_op_conn->handshake_params.conn_sig_scheme;
+        sig_scheme = pkey_op_conn->handshake_params.server_cert_sig_scheme;
     }
 
     /* These are our "external" / "offloaded" operations.