Continue check next psk key when binder mismatch
with matched identity and mismatch binder, should check next psk key.
Exit with error will break multi-psk cases.
@@ -298,7 +298,7 @@ static int ssl_tls13_parse_pre_shared_key_ext( mbedtls_ssl_context *ssl,
ret = ssl_tls13_offered_psks_check_binder_match(
ssl, binder, binder_len, &alg );
- if( ret != SSL_TLS1_3_OFFERED_PSK_MATCH )
+ if( ret < 0 )
{
MBEDTLS_SSL_DEBUG_RET( 1,
"ssl_tls13_offered_psks_check_binder_match" , ret );
@@ -308,6 +308,9 @@ static int ssl_tls13_parse_pre_shared_key_ext( mbedtls_ssl_context *ssl,
return( ret );
}
+ if( ret != SSL_TLS1_3_OFFERED_PSK_MATCH )
+ continue;
+
matched_identity = identity_id;
*psk_alg = alg;
}
