From eb68ad162b6e51e3ee8b938863ca0802521fee10 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Fri, 16 Aug 2019 10:20:25 -0700
Subject: [PATCH] Enable strict cipher suite checking by default. Changed to
 enable by default and can be disabled using `WOLFSSL_NO_STRICT_CIPHER_SUITE`.

---
 src/internal.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/internal.c b/src/internal.c
index 51c555892..9a885cd7a 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -18172,14 +18172,15 @@ exit_dpk:
         ssl->options.cipherSuite  = cs1;
         compression = input[i++];
 
-#ifdef WOLFSSL_STRICT_CIPHER_SUITE
+#ifndef WOLFSSL_NO_STRICT_CIPHER_SUITE
         {
             word32 idx, found = 0;
             /* confirm server_hello cipher suite is one sent in client_hello */
             for (idx = 0; idx < ssl->suites->suiteSz; idx += 2) {
                 if (ssl->suites->suites[idx]   == cs0 &&
                     ssl->suites->suites[idx+1] == cs1) {
-                    found = idx;
+                    found = 1;
+                    break;
                 }
             }
             if (!found) {
@@ -18187,7 +18188,7 @@ exit_dpk:
                 return MATCH_SUITE_ERROR;
             }
         }
-#endif
+#endif /* !WOLFSSL_NO_STRICT_CIPHER_SUITE */
 
         if (compression != NO_COMPRESSION && !ssl->options.usingCompression) {
             WOLFSSL_MSG("Server forcing compression w/o support");