commit ef51b4b9b469fc93a91de47b63a143a3c60c5530
author Dr. Stephen Henson <steve@openssl.org> Wed Dec 16 20:25:59 2009 +0000
committer Dr. Stephen Henson <steve@openssl.org> Wed Dec 16 20:25:59 2009 +0000
tree 41aa22b18fc09720e33516ba30082b786d08ce51
parent c27c9cb4f7ab74d772521fd927918f354724c2fc

New option to enable/disable connection to unpatched servers

ssl/t1_lib.c

diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index bdbb806..6678926 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -1157,8 +1157,9 @@
 	 * which doesn't support RI so for the immediate future tolerate RI
 	 * absence on initial connect only.
 	 */
-	if (!renegotiate_seen && s->new_session &&
-		!(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
+	if (!renegotiate_seen && 
+		(s->new_session || !(s->options & SSL_OP_LEGACY_SERVER_CONNECT))
+		&& !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION))
 		{
 		/* FIXME: Spec currently doesn't give alert to use */
 		*al = SSL_AD_ILLEGAL_PARAMETER;