libssl: use correct alert for key_share without supported_groups

Processing the key_share extension requires a supported_groups extension.
RFC 9846, section 9.2 explicitly mandates a missing_extension alert in
this situation, so use that instead of illegal_parameter.

We do have code in tls13_client_hello_required_extensions() implementing
the requirements on extensions of the relevant paragraph of that section
with the corrrect alerts.  The error in the extension processing happens
before hitting these checks in this particular case.

Reported by Tom Gouville of the tlspuffin team as part of
https://github.com/libressl/portable/issues/1279

ok jsing kenjiro

1 files changed, 2 insertions, 2 deletions

diff --git a/src/lib/libssl/ssl_tlsext.c b/src/lib/libssl/ssl_tlsext.c
index 467784da2b..039218e1ef 100644
--- a/src/lib/libssl/ssl_tlsext.c
+++ b/src/lib/libssl/ssl_tlsext.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssl_tlsext.c,v 1.164 2026/07/31 03:59:50 kenjiro Exp $ */
+/* $OpenBSD: ssl_tlsext.c,v 1.165 2026/08/18 04:40:17 tb Exp $ */
 /*
  * Copyright (c) 2016, 2017, 2019 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2017 Doug Hogan <doug@openbsd.org>
@@ -1517,7 +1517,7 @@ tlsext_keyshare_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
          */
 
         if (!tlsext_extension_seen(s, TLSEXT_TYPE_supported_groups)) {
-                *alert = SSL_AD_ILLEGAL_PARAMETER;
+                *alert = SSL_AD_MISSING_EXTENSION;
                 return 0;
         }
         if (!tlsext_extension_processed(s, TLSEXT_TYPE_supported_groups)) {