diff options
| author | Dr. Stephen Henson <steve@openssl.org> | 2009-12-16 20:28:30 +0000 |
|---|---|---|
| committer | Dr. Stephen Henson <steve@openssl.org> | 2009-12-16 20:28:30 +0000 |
| commit | 675564835cb1105289ee85e32844d38af5efef4c (patch) | |
| tree | a2475af596d14c5f1cc39a1dde69b9f4b79ad61b /ssl/t1_lib.c | |
| parent | 2456cd58c4a685f9303b9d9235dcc13c6d0a962e (diff) | |
New option to enable/disable connection to unpatched servers
Diffstat (limited to 'ssl/t1_lib.c')
| -rw-r--r-- | ssl/t1_lib.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c index 8f1a6b2f6d..26b8bf98cc 100644 --- a/ssl/t1_lib.c +++ b/ssl/t1_lib.c @@ -1157,8 +1157,9 @@ int ssl_parse_serverhello_tlsext(SSL *s, unsigned char **p, unsigned char *d, in * which doesn't support RI so for the immediate future tolerate RI * absence on initial connect only. */ - if (!renegotiate_seen && s->new_session && - !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) + if (!renegotiate_seen && + (s->new_session || !(s->options & SSL_OP_LEGACY_SERVER_CONNECT)) + && !(s->options & SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION)) { /* FIXME: Spec currently doesn't give alert to use */ *al = SSL_AD_ILLEGAL_PARAMETER; |