generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix and improve SSL_MODE_SEND_FALLBACK_SCSV documentation.

Browse Source 
Reviewed-by: Rich Salz <rsalz@openssl.org>
This commit is contained in:
Bodo Moeller 2014-10-21 22:39:26 +02:00
parent d60de314f4
commit 981545e1e7
2 changed files with 13 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
doc/ssl/SSL_CTX_set_mode.pod
View File

@ -71,12 +71,16 @@ SSL_CTX->freelist_max_len, which defaults to 32. Using this flag can
save around 34k per idle SSL connection. save around 34k per idle SSL connection.
This flag has no effect on SSL v2 connections, or on DTLS connections. This flag has no effect on SSL v2 connections, or on DTLS connections.
=item SSL_MODE_FALLBACK_SCSV =item SSL_MODE_SEND_FALLBACK_SCSV
Send TLS_FALLBACK_SCSV in the ClientHello. Send TLS_FALLBACK_SCSV in the ClientHello.
To be set by applications that reconnect with a downgraded protocol To be set only by applications that reconnect with a downgraded protocol
version; see draft-ietf-tls-downgrade-scsv-00 for details. version; see draft-ietf-tls-downgrade-scsv-00 for details.
DO NOT ENABLE THIS if your application attempts a normal handshake.
Only use this in explicit fallback retries, following the guidance
in draft-ietf-tls-downgrade-scsv-00.
=back =back
=head1 RETURN VALUES =head1 RETURN VALUES

9
ssl/ssl.h
View File

@ -682,8 +682,13 @@ struct ssl_session_st
#define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L #define SSL_MODE_SEND_CLIENTHELLO_TIME 0x00000020L
#define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L #define SSL_MODE_SEND_SERVERHELLO_TIME 0x00000040L
/* Send TLS_FALLBACK_SCSV in the ClientHello. /* Send TLS_FALLBACK_SCSV in the ClientHello.
* To be set by applications that reconnect with a downgraded protocol * To be set only by applications that reconnect with a downgraded protocol
* version; see draft-ietf-tls-downgrade-scsv-00 for details. */ * version; see draft-ietf-tls-downgrade-scsv-00 for details.
*
* DO NOT ENABLE THIS if your application attempts a normal handshake.
* Only use this in explicit fallback retries, following the guidance
* in draft-ietf-tls-downgrade-scsv-00.
*/
#define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L #define SSL_MODE_SEND_FALLBACK_SCSV 0x00000080L
/* Cert related flags */ /* Cert related flags */