Fix no-ssl3 configuration option

[openssl.git] / ssl / ssl.h

diff --git a/ssl/ssl.h b/ssl/ssl.h
index f363e8f3bcedb74b92ac38421e11057acdcd55bf..a0db4f2a21fd5fe0fdd521473add6dcc5819037a 100644 (file)
--- a/ssl/ssl.h
+++ b/ssl/ssl.h
@@ -393,18 +393,18 @@ typedef int (*tls_session_secret_cb_fn)(SSL *s, void *secret, int *secret_len, S
 /* Typedefs for handling custom extensions */
 
 typedef int (*custom_ext_add_cb)(SSL *s, unsigned int ext_type,
-                                         const unsigned char **out,
-                                         size_t *outlen, int *al,
-                                          void *add_arg);
+                                const unsigned char **out,
+                                size_t *outlen, int *al,
+                                void *add_arg);
 
 typedef void (*custom_ext_free_cb)(SSL *s, unsigned int ext_type,
-                                          const unsigned char *out,
-                                          void *add_arg);
+                                  const unsigned char *out,
+                                  void *add_arg);
 
 typedef int (*custom_ext_parse_cb)(SSL *s, unsigned int ext_type,
-                                          const unsigned char *in,
-                                          size_t inlen, int *al,
-                                          void *parse_arg);
+                                  const unsigned char *in,
+                                  size_t inlen, int *al,
+                                  void *parse_arg);
 
 
 #endif
@@ -685,6 +685,10 @@ struct ssl_session_st
  */
 #define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L
 #define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L
+/* Send TLS_FALLBACK_SCSV in the ClientHello.
+ * To be set by applications that reconnect with a downgraded protocol
+ * version; see draft-ietf-tls-downgrade-scsv-00 for details. */
+#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L
 
 /* Cert related flags */
 /* Many implementations ignore some aspects of the TLS standards such as
@@ -1253,17 +1257,19 @@ const char *SSL_get_psk_identity(const SSL *s);
 #ifndef OPENSSL_NO_TLSEXT
 /* Register callbacks to handle custom TLS Extensions for client or server. */
 
-int SSL_CTX_set_custom_cli_ext(SSL_CTX *ctx, unsigned int ext_type,
-                              custom_ext_add_cb add_cb,
-                              custom_ext_free_cb free_cb,
-                               void *add_arg,
-                              custom_ext_parse_cb parse_cb, void *parse_arg);
+int SSL_CTX_add_client_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
+                                 custom_ext_add_cb add_cb,
+                                 custom_ext_free_cb free_cb,
+                                 void *add_arg,
+                                 custom_ext_parse_cb parse_cb,
+                                 void *parse_arg);
 
-int SSL_CTX_set_custom_srv_ext(SSL_CTX *ctx, unsigned int ext_type,
-                              custom_ext_add_cb add_cb,
-                              custom_ext_free_cb free_cb,
-                               void *add_arg,
-                              custom_ext_parse_cb parse_cb, void *parse_arg);
+int SSL_CTX_add_server_custom_ext(SSL_CTX *ctx, unsigned int ext_type,
+                                 custom_ext_add_cb add_cb,
+                                 custom_ext_free_cb free_cb,
+                                 void *add_arg,
+                                 custom_ext_parse_cb parse_cb,
+                                 void *parse_arg);
 
 int SSL_extension_supported(unsigned int ext_type);
 
@@ -1691,6 +1697,7 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 #define SSL_AD_BAD_CERTIFICATE_STATUS_RESPONSE TLS1_AD_BAD_CERTIFICATE_STATUS_RESPONSE
 #define SSL_AD_BAD_CERTIFICATE_HASH_VALUE TLS1_AD_BAD_CERTIFICATE_HASH_VALUE
 #define SSL_AD_UNKNOWN_PSK_IDENTITY     TLS1_AD_UNKNOWN_PSK_IDENTITY /* fatal */
+#define SSL_AD_INAPPROPRIATE_FALLBACK  TLS1_AD_INAPPROPRIATE_FALLBACK /* fatal */
 
 #define SSL_ERROR_NONE                 0
 #define SSL_ERROR_SSL                  1
@@ -1830,11 +1837,14 @@ DECLARE_PEM_rw(SSL_SESSION, SSL_SESSION)
 #define SSL_CTRL_SELECT_CURRENT_CERT           116
 #define SSL_CTRL_SET_CURRENT_CERT              117
 
+#define SSL_CTRL_SET_DH_AUTO                   118
+#define SSL_CTRL_CHECK_PROTO_VERSION           119
+
+
 #define SSL_CERT_SET_FIRST                     1
 #define SSL_CERT_SET_NEXT                      2
 #define SSL_CERT_SET_SERVER                    3
 
-#define SSL_CTRL_SET_DH_AUTO                   118
 
 #define DTLSv1_get_timeout(ssl, arg) \
        SSL_ctrl(ssl,DTLS_CTRL_GET_TIMEOUT,0, (void *)arg)
@@ -2081,11 +2091,9 @@ STACK_OF(X509_NAME) *SSL_load_client_CA_file(const char *file);
 int    SSL_add_file_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs,
                                            const char *file);
 #ifndef OPENSSL_SYS_VMS
-#ifndef OPENSSL_SYS_MACINTOSH_CLASSIC /* XXXXX: Better scheme needed! [was: #ifndef MAC_OS_pre_X] */
 int    SSL_add_dir_cert_subjects_to_stack(STACK_OF(X509_NAME) *stackCAs,
                                           const char *dir);
 #endif
-#endif
 
 #endif
 
@@ -2869,6 +2877,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_HTTP_REQUEST                              156
 #define SSL_R_ILLEGAL_PADDING                           283
 #define SSL_R_ILLEGAL_SUITEB_DIGEST                     380
+#define SSL_R_INAPPROPRIATE_FALLBACK                    373
 #define SSL_R_INCONSISTENT_COMPRESSION                  340
 #define SSL_R_INVALID_CHALLENGE_LENGTH                  158
 #define SSL_R_INVALID_COMMAND                           280
@@ -3027,6 +3036,7 @@ void ERR_load_SSL_strings(void);
 #define SSL_R_TLSV1_ALERT_DECRYPTION_FAILED             1021
 #define SSL_R_TLSV1_ALERT_DECRYPT_ERROR                         1051
 #define SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION            1060
+#define SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK        1086
 #define SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY                 1071
 #define SSL_R_TLSV1_ALERT_INTERNAL_ERROR                1080
 #define SSL_R_TLSV1_ALERT_NO_RENEGOTIATION              1100