Support TLS_FALLBACK_SCSV.

[openssl.git] / ssl / ssl.h

diff --git a/ssl/ssl.h b/ssl/ssl.h
index dc034d5f360e870e0cc34db8832ec7545920e730..2e0df6625dcd592201706922d3556f1a01d414d5 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -681,6 +681,10 @@ struct ssl_session_st
  */
 #define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L
 #define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L
+/* Send TLS_FALLBACK_SCSV in the ClientHello.
+ * To be set by applications that reconnect with a downgraded protocol
+ * version; see draft-ietf-tls-downgrade-scsv-00 for details. */
+#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L
 
 /* Cert related flags */
 /* Many implementations ignore some aspects of the TLS standards such as
@@ -1683,6 +1687,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 #define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
 #define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE
 #define SSL_AD_UNKNOWN_PSK_IDENTITY     TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */
+#define SSL_AD_INAPPROPRIATE_FALLBACK  TLS1_AD_INAPPROPRIATE_FALLBACK /* fatal */
 
 #define SSL_ERROR_NONE                 0
 #define SSL_ERROR_SSL                  1
@@ -1821,6 +1826,9 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 #define SSL_CTRL_SELECT_CURRENT_CERT           116
 #define SSL_CTRL_SET_CURRENT_CERT              117
 
+#define SSL_CTRL_CHECK_PROTO_VERSION           119
+
+
 #define SSL_CERT_SET_FIRST                     1
 #define SSL_CERT_SET_NEXT                      2
 #define SSL_CERT_SET_SERVER                    3
@@ -2765,6 +2773,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_HTTP_REQUEST                              156
 #define SSL_R_ILLEGAL_PADDING                           283
 #define SSL_R_ILLEGAL_SUITEB_DIGEST                     380
+#define SSL_R_INAPPROPRIATE_FALLBACK                    373
 #define SSL_R_INCONSISTENT_COMPRESSION                  340
 #define SSL_R_INVALID_CHALLENGE_LENGTH                  158
 #define SSL_R_INVALID_COMMAND                           280
@@ -2921,6 +2930,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED             1021
 #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR                         1051
 #define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION            1060
+#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK        1086
 #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY                 1071
 #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR                1080
 #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION              1100