Support TLS_FALLBACK_SCSV.

[openssl.git] / ssl / tls1.h

diff --git a/ssl/tls1.h b/ssl/tls1.h
index 45fc0a20853315107fb22083914fc7161282cef2..3c8de7303273b3942dee13f8e6db7743bf15d855 100644 (file)
--- a/ssl/tls1.h
+++ b/ssl/tls1.h
@@ -159,17 +159,19 @@ extern "C" {
 
 #define TLS1_ALLOW_EXPERIMENTAL_CIPHERSUITES   0
 
+#define TLS1_VERSION                   0x0301
+#define TLS1_1_VERSION                 0x0302
 #define TLS1_2_VERSION                 0x0303
-#define TLS1_2_VERSION_MAJOR           0x03
-#define TLS1_2_VERSION_MINOR           0x03
+#define TLS_MAX_VERSION                        TLS1_2_VERSION
+
+#define TLS1_VERSION_MAJOR             0x03
+#define TLS1_VERSION_MINOR             0x01
 
-#define TLS1_1_VERSION                 0x0302
 #define TLS1_1_VERSION_MAJOR           0x03
 #define TLS1_1_VERSION_MINOR           0x02
 
-#define TLS1_VERSION                   0x0301
-#define TLS1_VERSION_MAJOR             0x03
-#define TLS1_VERSION_MINOR             0x01
+#define TLS1_2_VERSION_MAJOR           0x03
+#define TLS1_2_VERSION_MINOR           0x03
 
 #define TLS1_get_version(s) \
                ((s->version >> 8) == TLS1_VERSION_MAJOR ? s->version : 0)
@@ -187,6 +189,7 @@ extern "C" {
 #define TLS1_AD_PROTOCOL_VERSION       70      /* fatal */
 #define TLS1_AD_INSUFFICIENT_SECURITY  71      /* fatal */
 #define TLS1_AD_INTERNAL_ERROR         80      /* fatal */
+#define TLS1_AD_INAPPROPRIATE_FALLBACK 86      /* fatal */
 #define TLS1_AD_USER_CANCELLED         90
 #define TLS1_AD_NO_RENEGOTIATION       100
 /* codes 110-114 are from RFC3546 */
@@ -206,11 +209,9 @@ extern "C" {
 #define TLSEXT_TYPE_status_request             5
 /* ExtensionType values from RFC4681 */
 #define TLSEXT_TYPE_user_mapping               6
-
 /* ExtensionType values from RFC5878 */
 #define TLSEXT_TYPE_client_authz               7
 #define TLSEXT_TYPE_server_authz               8
-
 /* ExtensionType values from RFC6091 */
 #define TLSEXT_TYPE_cert_type          9
 
@@ -233,6 +234,12 @@ extern "C" {
 /* ExtensionType value from draft-ietf-tls-applayerprotoneg-00 */
 #define TLSEXT_TYPE_application_layer_protocol_negotiation 16
 
+/* ExtensionType value for TLS padding extension.
+ * http://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
+ * http://tools.ietf.org/html/draft-agl-tls-padding-03
+ */
+#define TLSEXT_TYPE_padding    21
+
 /* ExtensionType value from RFC4507 */
 #define TLSEXT_TYPE_session_ticket             35
 
@@ -240,7 +247,7 @@ extern "C" {
 #if 0 /* will have to be provided externally for now ,
        * i.e. build with -DTLSEXT_TYPE_opaque_prf_input=38183
        * using whatever extension number you'd like to try */
-# define TLSEXT_TYPE_opaque_prf_input          ?? */
+# define TLSEXT_TYPE_opaque_prf_input          ??
 #endif
 
 /* Temporary extension type */
@@ -297,14 +304,6 @@ extern "C" {
 
 #define TLSEXT_MAXLEN_host_name 255
 
-/* From RFC 5878 */
-#define TLSEXT_SUPPLEMENTALDATATYPE_authz_data 16386
-/* This is not IANA assigned. See
- * https://www.iana.org/assignments/tls-parameters/tls-parameters.xml#authorization-data-rules */
-#define TLSEXT_AUTHZDATAFORMAT_audit_proof 182
-
-#define TLSEXT_MAXLEN_supplemental_data 1024*16 /* Let's limit to 16k */
-
 const char *SSL_get_servername(const SSL *s, const int type);
 int SSL_get_servername_type(const SSL *s);
 /* SSL_export_keying_material exports a value derived from the master secret,
@@ -390,13 +389,6 @@ SSL_CTX_ctrl(ctx,SSL_CTRL_SET_TLSEXT_OPAQUE_PRF_INPUT_CB_ARG, 0, arg)
 #define SSL_CTX_set_tlsext_ticket_key_cb(ssl, cb) \
 SSL_CTX_callback_ctrl(ssl,SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB,(void (*)(void))cb)
 
-/* Used by clients to process audit proofs. */
-#define SSL_CTX_set_tlsext_authz_server_audit_proof_cb(ctx, cb) \
-SSL_CTX_callback_ctrl(ctx, SSL_CTRL_SET_TLSEXT_AUTHZ_SERVER_AUDIT_PROOF_CB,(void (*)(void))cb)
-
-#define SSL_CTX_set_tlsext_authz_server_audit_proof_cb_arg(ctx, arg) \
-SSL_CTX_ctrl(ctx, SSL_CTRL_SET_TLSEXT_AUTHZ_SERVER_AUDIT_PROOF_CB_ARG, 0, arg);
-
 #ifndef OPENSSL_NO_HEARTBEATS
 #define SSL_TLSEXT_HB_ENABLED                          0x01
 #define SSL_TLSEXT_HB_DONT_SEND_REQUESTS       0x02
@@ -562,10 +554,6 @@ SSL_CTX_ctrl(ctx, SSL_CTRL_SET_TLSEXT_AUTHZ_SERVER_AUDIT_PROOF_CB_ARG, 0, arg);
 #define TLS1_CK_ECDH_RSA_WITH_AES_128_GCM_SHA256        0x0300C031
 #define TLS1_CK_ECDH_RSA_WITH_AES_256_GCM_SHA384        0x0300C032
 
-#define TLS1_CK_ECDHE_RSA_CHACHA20_POLY1305            0x0300CC13
-#define TLS1_CK_ECDHE_ECDSA_CHACHA20_POLY1305          0x0300CC14
-#define TLS1_CK_DHE_RSA_CHACHA20_POLY1305              0x0300CC15
-
 /* XXX
  * Inconsistency alert:
  * The OpenSSL names of ciphers with ephemeral DH here include the string
@@ -717,10 +705,6 @@ SSL_CTX_ctrl(ctx, SSL_CTRL_SET_TLSEXT_AUTHZ_SERVER_AUDIT_PROOF_CB_ARG, 0, arg);
 #define TLS1_TXT_ECDH_RSA_WITH_AES_128_GCM_SHA256       "ECDH-RSA-AES128-GCM-SHA256"
 #define TLS1_TXT_ECDH_RSA_WITH_AES_256_GCM_SHA384       "ECDH-RSA-AES256-GCM-SHA384"
 
-#define TLS1_TXT_ECDHE_RSA_WITH_CHACHA20_POLY1305      "ECDHE-RSA-CHACHA20-POLY1305"
-#define TLS1_TXT_ECDHE_ECDSA_WITH_CHACHA20_POLY1305    "ECDHE-ECDSA-CHACHA20-POLY1305"
-#define TLS1_TXT_DHE_RSA_WITH_CHACHA20_POLY1305                "DHE-RSA-CHACHA20-POLY1305"
-
 #define TLS_CT_RSA_SIGN                        1
 #define TLS_CT_DSS_SIGN                        2
 #define TLS_CT_RSA_FIXED_DH            3