diff --git a/include/mbedtls/ssl_internal.h b/include/mbedtls/ssl_internal.h
index 600d4d1..03a4473 100644
--- a/include/mbedtls/ssl_internal.h
+++ b/include/mbedtls/ssl_internal.h
@@ -581,6 +581,12 @@
     mbedtls_cipher_context_t cipher_ctx_enc;    /*!<  encryption context      */
     mbedtls_cipher_context_t cipher_ctx_dec;    /*!<  decryption context      */
 
+#if defined(MBEDTLS_SSL_ENCRYPT_THEN_MAC)
+    int encrypt_then_mac;       /*!< flag for EtM activation                */
+#endif
+
+    int minor_ver;
+
     /*
      * Session specific compression layer
      */
@@ -593,11 +599,6 @@
 /*
  * Internal representation of record frames
  *
- * The header layout is chosen to facilitate the computation of
- * authentication tags which often use the header bytes laid out
- * exactly as in the struct; note that it does not match what's
- * transferred on the wire.
- *
  * Instances come in two flavors:
  * (1) Encrypted
  *     These always have data_offset = 0
@@ -617,7 +618,6 @@
     uint8_t ctr[8];         /*!< Record sequence number        */
     uint8_t type;           /*!< Record type                   */
     uint8_t ver[2];         /*!< SSL/TLS version               */
-    uint8_t len[2];         /*!< Content length, little endian */
 
     unsigned char *buf;     /*!< Memory buffer enclosing the record content */
     size_t buf_len;         /*!< Buffer length */