Check that TLS signature type is accepted by the policy.

Previously the signature hashes and algos info was used to set the v1.2
signature_algorithms extension, but if the counterparty ignored the
extension and sent something else, we wouldn't notice.

1 files changed, 1 insertions, 1 deletions

diff --git a/src/lib/tls/tls_server.cpp b/src/lib/tls/tls_server.cpp
index 5ababe621..41b14ae08 100644
--- a/src/lib/tls/tls_server.cpp
+++ b/src/lib/tls/tls_server.cpp
@@ -618,7 +618,7 @@ void Server::process_handshake_msg(const Handshake_State* active_state,
          state.client_certs()->cert_chain();
 
       const bool sig_valid =
-         state.client_verify()->verify(client_certs[0], state);
+         state.client_verify()->verify(client_certs[0], state, policy());
 
       state.hash().update(state.handshake_io().format(contents, type));