pkcs11: do not shortcut checks when GNUTLS_PKCS11_OBJ_FLAG_COMPARE_KEY is specified

diff --git a/lib/pkcs11.c b/lib/pkcs11.c
index 13dee0aae0b513ac1c4b9f3f812a72ceb092c0ac..e86314c68d14e64d3c9f7b50a3030575b28304ac 100644 (file)
--- a/lib/pkcs11.c
+++ b/lib/pkcs11.c
@@ -3225,7 +3225,8 @@ find_cert_cb(struct pkcs11_session_info *sinfo,
                       (sinfo->module, sinfo->pks, &obj, 1,
                        &count) == CKR_OK && count == 1) {
 
-                       if (priv->need_import == 0 && !(priv->flags & GNUTLS_PKCS11_OBJ_FLAG_COMPARE)) {
+                       if (priv->need_import == 0 && !(priv->flags & GNUTLS_PKCS11_OBJ_FLAG_COMPARE)
+                           && !(priv->flags & GNUTLS_PKCS11_OBJ_FLAG_COMPARE_KEY)) {
                                found = 1;
                                break;
                        }