From f0bad2554af6a08d76369236a79e22e97ba9b7c7 Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Sat, 30 Jul 2022 13:45:24 +0800 Subject: [PATCH] Continue check next psk key when binder mismatch with matched identity and mismatch binder, should check next psk key. Exit with error will break multi-psk cases. Signed-off-by: Jerry Yu --- library/ssl_tls13_server.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c index 5ae9f7cb21..6013079231 100644 --- a/library/ssl_tls13_server.c +++ b/library/ssl_tls13_server.c @@ -298,7 +298,7 @@ static int ssl_tls13_parse_pre_shared_key_ext( mbedtls_ssl_context *ssl, ret = ssl_tls13_offered_psks_check_binder_match( ssl, binder, binder_len, &alg ); - if( ret != SSL_TLS1_3_OFFERED_PSK_MATCH ) + if( ret < 0 ) { MBEDTLS_SSL_DEBUG_RET( 1, "ssl_tls13_offered_psks_check_binder_match" , ret ); @@ -308,6 +308,9 @@ static int ssl_tls13_parse_pre_shared_key_ext( mbedtls_ssl_context *ssl, return( ret ); } + if( ret != SSL_TLS1_3_OFFERED_PSK_MATCH ) + continue; + matched_identity = identity_id; *psk_alg = alg; }