From: Matt Caswell <matt@openssl.org>
Date: Thu, 19 Apr 2018 09:38:57 +0000 (+0100)
Subject: Fix the alert sent if no shared sig algs
X-Git-Tag: OpenSSL_1_0_2p~78
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=279bf3e0a07d6c84043a316ca8494cbc3b51f731;p=thirdparty%2Fopenssl.git

Fix the alert sent if no shared sig algs

We were sending illegal parameter. This isn't correct. The parameters are
legal, we just don't have an overlap. A more appropriate alert is
handshake failure.

Fixes #2919

Reviewed-by: Richard Levitte <levitte@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/6011)
---

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 179802ca598..8cb8816f9b1 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -3165,7 +3165,7 @@ int tls1_set_server_sigalgs(SSL *s)
         if (!s->cert->shared_sigalgs) {
             SSLerr(SSL_F_TLS1_SET_SERVER_SIGALGS,
                    SSL_R_NO_SHARED_SIGATURE_ALGORITHMS);
-            al = SSL_AD_ILLEGAL_PARAMETER;
+            al = SSL_AD_HANDSHAKE_FAILURE;
             goto err;
         }
     } else