From 7b255e3a12a93fc87e3170ee2230a95550ba3df6 Mon Sep 17 00:00:00 2001 From: Janos Follath Date: Wed, 11 Mar 2026 17:02:56 +0000 Subject: [PATCH] ssl_parse_signature_algorithm: match error codes The caller is returning MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER if ssl_parse_signature_algorithm() fails, but ssl_parse_signature_algorithm() returns MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE upon failure. There is no good reason for this mismatch and better to be aligned. Signed-off-by: Janos Follath --- library/ssl_tls12_client.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/library/ssl_tls12_client.c b/library/ssl_tls12_client.c index 0bcbc7a5e1..841f911e66 100644 --- a/library/ssl_tls12_client.c +++ b/library/ssl_tls12_client.c @@ -1749,7 +1749,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (*md_alg == MBEDTLS_MD_NONE) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported HashAlgorithm %d", sig_alg >> 8)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* @@ -1758,14 +1758,14 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, if (*pk_alg == MBEDTLS_PK_SIGALG_NONE) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported SignatureAlgorithm %d", sig_alg & 0x00FF)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* * This shouldn't happen, but be robust. */ MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* @@ -1774,7 +1774,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (!mbedtls_ssl_sig_alg_is_supported(ssl, sig_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used unsupported value in SigAlg extension %d", sig_alg)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } /* @@ -1782,7 +1782,7 @@ static int ssl_parse_signature_algorithm(mbedtls_ssl_context *ssl, */ if (!mbedtls_ssl_sig_alg_is_offered(ssl, sig_alg)) { MBEDTLS_SSL_DEBUG_MSG(1, ("Server used SigAlg value %d that was not offered", sig_alg)); - return MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE; + return MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER; } MBEDTLS_SSL_DEBUG_MSG(2, ("Server used SignatureAlgorithm %d", sig_alg & 0x00FF));