1 files changed, 20 insertions, 14 deletions

diff --git a/src/lib/libssl/s3_srvr.c b/src/lib/libssl/s3_srvr.c
index 398ce469d6..80b45eb86f 100644
--- a/src/lib/libssl/s3_srvr.c
+++ b/src/lib/libssl/s3_srvr.c
@@ -902,22 +902,28 @@ int ssl3_get_client_hello(SSL *s)
                                 break;
                                 }
                         }
-                if (j == 0)
-                        {
-                        if ((s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
-                                {
-                                /* Very bad for multi-threading.... */
-                                s->session->cipher=sk_SSL_CIPHER_value(ciphers, 0);
-                                }
-                        else
+                if (j == 0 && (s->options & SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG) && (sk_SSL_CIPHER_num(ciphers) == 1))
+                        {
+                        /* Special case as client bug workaround: the previously used cipher may
+                         * not be in the current list, the client instead might be trying to
+                         * continue using a cipher that before wasn't chosen due to server
+                         * preferences.  We'll have to reject the connection if the cipher is not
+                         * enabled, though. */
+                        c = sk_SSL_CIPHER_value(ciphers, 0);
+                        if (sk_SSL_CIPHER_find(SSL_get_ciphers(s), c) >= 0)
                                 {
-                                /* we need to have the cipher in the cipher
-                                 * list if we are asked to reuse it */
-                                al=SSL_AD_ILLEGAL_PARAMETER;
-                                SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
-                                goto f_err;
+                                s->session->cipher = c;
+                                j = 1;
                                 }
                         }
+                if (j == 0)
+                        {
+                        /* we need to have the cipher in the cipher
+                         * list if we are asked to reuse it */
+                        al=SSL_AD_ILLEGAL_PARAMETER;
+                        SSLerr(SSL_F_SSL3_GET_CLIENT_HELLO,SSL_R_REQUIRED_CIPHER_MISSING);
+                        goto f_err;
+                        }
                 }
 
         /* compression */
@@ -2560,7 +2566,7 @@ int ssl3_get_client_certificate(SSL *s)
         else
                 {
                 i=ssl_verify_cert_chain(s,sk);
-                if (!i)
+                if (i <= 0)
                         {
                         al=ssl_verify_alarm_type(s->verify_result);
                         SSLerr(SSL_F_SSL3_GET_CLIENT_CERTIFICATE,SSL_R_NO_CERTIFICATE_RETURNED);