Fix irix-cc build.

[openssl.git] / ssl / ssl.h

diff --git a/ssl/ssl.h b/ssl/ssl.h
index a9b15d46cd6e419e0c1213edfeb32092b7cf14cc..2ba5923204d2982938b57feed8e608796eae42b6 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -596,9 +596,8 @@ struct ssl_session_st
 #define SSL_OP_SINGLE_ECDH_USE                         0x00080000L
 /* If set, always create a new key when using tmp_dh parameters */
 #define SSL_OP_SINGLE_DH_USE                           0x00100000L
-/* Set to always use the tmp_rsa key when doing RSA operations,
- * even when this violates protocol specs */
-#define SSL_OP_EPHEMERAL_RSA                           0x00200000L
+/* Does nothing: retained for compatibiity */
+#define SSL_OP_EPHEMERAL_RSA                           0x0
 /* Set on servers to choose the cipher according to the server's
  * preferences */
 #define SSL_OP_CIPHER_SERVER_PREFERENCE                        0x00400000L
@@ -653,6 +652,15 @@ struct ssl_session_st
  */
 #define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L
 #define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L
+/* Send TLS_FALLBACK_SCSV in the ClientHello.
+ * To be set only by applications that reconnect with a downgraded protocol
+ * version; see draft-ietf-tls-downgrade-scsv-00 for details.
+ *
+ * DO NOT ENABLE THIS if your application attempts a normal handshake.
+ * Only use this in explicit fallback retries, following the guidance
+ * in draft-ietf-tls-downgrade-scsv-00.
+ */
+#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L
 
 /* Note: SSL[_CTX]_set_{options,mode} use |= op on the previous value,
  * they cannot be used to clear bits. */
@@ -684,6 +692,10 @@ struct ssl_session_st
         SSL_ctrl((ssl),SSL_CTRL_MODE,0,NULL)
 #define SSL_set_mtu(ssl, mtu) \
         SSL_ctrl((ssl),SSL_CTRL_SET_MTU,(mtu),NULL)
+#define DTLS_set_link_mtu(ssl, mtu) \
+        SSL_ctrl((ssl),DTLS_CTRL_SET_LINK_MTU,(mtu),NULL)
+#define DTLS_get_link_min_mtu(ssl) \
+        SSL_ctrl((ssl),DTLS_CTRL_GET_LINK_MIN_MTU,0,NULL)
 
 #define SSL_get_secure_renegotiation_support(ssl) \
        SSL_ctrl((ssl), SSL_CTRL_GET_RI_SUPPORT, 0, NULL)
@@ -1511,6 +1523,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 #define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
 #define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE
 #define SSL_AD_UNKNOWN_PSK_IDENTITY     TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */
+#define SSL_AD_INAPPROPRIATE_FALLBACK  TLS1_AD_INAPPROPRIATE_FALLBACK /* fatal */
 
 #define SSL_ERROR_NONE                 0
 #define SSL_ERROR_SSL                  1
@@ -1621,6 +1634,10 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 #define SSL_CTRL_GET_EXTRA_CHAIN_CERTS         82
 #define SSL_CTRL_CLEAR_EXTRA_CHAIN_CERTS       83
 
+#define SSL_CTRL_CHECK_PROTO_VERSION           119
+#define DTLS_CTRL_SET_LINK_MTU                 120
+#define DTLS_CTRL_GET_LINK_MIN_MTU             121
+
 #define DTLSv1_get_timeout(ssl, arg) \
        SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg)
 #define DTLSv1_handle_timeout(ssl) \
@@ -1871,13 +1888,15 @@ const SSL_METHOD *SSLv2_server_method(void);    /* SSLv2 */
 const SSL_METHOD *SSLv2_client_method(void);   /* SSLv2 */
 #endif
 
+#ifndef OPENSSL_NO_SSL3_METHOD
 const SSL_METHOD *SSLv3_method(void);          /* SSLv3 */
 const SSL_METHOD *SSLv3_server_method(void);   /* SSLv3 */
 const SSL_METHOD *SSLv3_client_method(void);   /* SSLv3 */
+#endif
 
-const SSL_METHOD *SSLv23_method(void); /* SSLv3 but can rollback to v2 */
-const SSL_METHOD *SSLv23_server_method(void);  /* SSLv3 but can rollback to v2 */
-const SSL_METHOD *SSLv23_client_method(void);  /* SSLv3 but can rollback to v2 */
+const SSL_METHOD *SSLv23_method(void); /* Negotiate highest available SSL/TLS version */
+const SSL_METHOD *SSLv23_server_method(void);  /* Negotiate highest available SSL/TLS version */
+const SSL_METHOD *SSLv23_client_method(void);  /* Negotiate highest available SSL/TLS version */
 
 const SSL_METHOD *TLSv1_method(void);          /* TLSv1.0 */
 const SSL_METHOD *TLSv1_server_method(void);   /* TLSv1.0 */
@@ -2056,6 +2075,10 @@ int SSL_set_session_secret_cb(SSL *s, tls_session_secret_cb_fn tls_session_secre
 void SSL_set_debug(SSL *s, int debug);
 int SSL_cache_hit(SSL *s);
 
+#ifndef OPENSSL_NO_UNIT_TEST
+const struct openssl_ssl_test_functions *SSL_test_functions(void);
+#endif
+
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
  * made after this point may be overwritten when the script is next run.
@@ -2321,6 +2344,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_BAD_SRP_B_LENGTH                          348
 #define SSL_R_BAD_SRP_G_LENGTH                          349
 #define SSL_R_BAD_SRP_N_LENGTH                          350
+#define SSL_R_BAD_SRP_PARAMETERS                        371
 #define SSL_R_BAD_SRP_S_LENGTH                          351
 #define SSL_R_BAD_SRTP_MKI_VALUE                        352
 #define SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST          353
@@ -2374,6 +2398,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_HTTPS_PROXY_REQUEST                       155
 #define SSL_R_HTTP_REQUEST                              156
 #define SSL_R_ILLEGAL_PADDING                           283
+#define SSL_R_INAPPROPRIATE_FALLBACK                    373
 #define SSL_R_INCONSISTENT_COMPRESSION                  340
 #define SSL_R_INVALID_CHALLENGE_LENGTH                  158
 #define SSL_R_INVALID_COMMAND                           280
@@ -2520,6 +2545,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED             1021
 #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR                         1051
 #define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION            1060
+#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK        1086
 #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY                 1071
 #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR                1080
 #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION              1100