cryptcheck/fallback_scsv.patch

diff --git a/ext/openssl/deprecation.rb b/ext/openssl/deprecation.rb
index d773536..f4a6c4b 100644
--- a/ext/openssl/deprecation.rb
+++ b/ext/openssl/deprecation.rb
@@ -19,4 +19,9 @@ def self.check_func(func, header)
     have_func(func, header, deprecated_warning_flag) and
       have_header(header, nil, deprecated_warning_flag)
   end
+
+  def self.check_func_or_macro(func, header)
+    check_func(func, header) or
+    have_macro(func, header) && $defs.push("-DHAVE_#{func.upcase}")
+  end
 end
diff --git a/ext/openssl/lib/openssl/ssl.rb b/ext/openssl/lib/openssl/ssl.rb
index 9893757..bcb167e 100644
--- a/ext/openssl/lib/openssl/ssl.rb
+++ b/ext/openssl/lib/openssl/ssl.rb
@@ -105,11 +105,12 @@ class SSLContext
       #    SSLContext.new("SSLv23_client") => ctx
       #
       # You can get a list of valid methods with OpenSSL::SSL::SSLContext::METHODS
-      def initialize(version = nil)
+      def initialize(version = nil, fallback_scsv: false)
         INIT_VARS.each { |v| instance_variable_set v, nil }
         self.options = self.options | OpenSSL::SSL::OP_ALL
         return unless version
         self.ssl_version = version
+        self.enable_fallback_scsv if fallback_scsv
       end
 
       ##
diff --git a/ext/openssl/ossl_ssl.c b/ext/openssl/ossl_ssl.c
index cc17a0c..9f7ee0b 100644
--- a/ext/openssl/ossl_ssl.c
+++ b/ext/openssl/ossl_ssl.c
@@ -978,6 +978,31 @@ ossl_sslctx_set_ciphers(VALUE self, VALUE v)
     return v;
 }
 
+/*
+ * call-seq:
+ *    ctx.enable_fallback_scsv() => nil
+ *
+ * Activate TLS_FALLBACK_SCSV for this context.
+ * See RFC 7507.
+ */
+static VALUE
+ossl_sslctx_enable_fallback_scsv(VALUE self)
+{
+    SSL_CTX *ctx;
+
+    GetSSLCTX(self, ctx);
+    if(!ctx){
+        rb_warning("SSL_CTX is not initialized.");
+        return Qnil;
+    }
+
+    long modes = SSL_CTX_get_mode(ctx);
+	modes |= SSL_MODE_SEND_FALLBACK_SCSV;
+	SSL_CTX_set_mode(ctx, modes);
+
+    return Qnil;
+}
+
 #if !defined(OPENSSL_NO_EC)
 /*
  * call-seq:
@@ -2330,6 +2355,7 @@ Init_ossl_ssl(void)
     rb_define_method(cSSLContext, "ciphers",     ossl_sslctx_get_ciphers, 0);
     rb_define_method(cSSLContext, "ciphers=",    ossl_sslctx_set_ciphers, 1);
     rb_define_method(cSSLContext, "ecdh_curves=", ossl_sslctx_set_ecdh_curves, 1);
+    rb_define_method(cSSLContext, "enable_fallback_scsv", ossl_sslctx_enable_fallback_scsv, 0);
 
     rb_define_method(cSSLContext, "setup", ossl_sslctx_setup, 0);