From 5672327522b1a364b9a2010603f1aa0ff58f5718 Mon Sep 17 00:00:00 2001 From: "Dr. Stephen Henson" Date: Tue, 31 Jan 2017 18:00:55 +0000 Subject: [PATCH] Set signature algorithm when choosing cipher Reviewed-by: Rich Salz Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/2339) --- ssl/statem/statem_srvr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ssl/statem/statem_srvr.c b/ssl/statem/statem_srvr.c index f965ae1873..20ea684906 100644 --- a/ssl/statem/statem_srvr.c +++ b/ssl/statem/statem_srvr.c @@ -1797,6 +1797,12 @@ WORK_STATE tls_post_process_client_hello(SSL *s, WORK_STATE wst) goto f_err; } s->s3->tmp.new_cipher = cipher; + if (!tls_choose_sigalg(s)) { + al = SSL_AD_HANDSHAKE_FAILURE; + SSLerr(SSL_F_TLS_POST_PROCESS_CLIENT_HELLO, + SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM); + goto f_err; + } /* check whether we should disable session resumption */ if (s->not_resumable_session_cb != NULL) s->session->not_resumable = -- 2.25.1