third_party/tlslite/patches/tls_intolerant.patch

diff --git a/third_party/tlslite/tlslite/tlsconnection.py b/third_party/tlslite/tlslite/tlsconnection.py
index e8dd859..8415592 100755
--- a/third_party/tlslite/tlslite/tlsconnection.py
+++ b/third_party/tlslite/tlslite/tlsconnection.py
@@ -965,7 +965,8 @@ class TLSConnection(TLSRecordLayer):
                         sessionCache=None, settings=None, checker=None,
                         reqCAs = None, 
                         tacks=None, activationFlags=0,
-                        nextProtos=None, anon=False):
+                        nextProtos=None, anon=False,
+                        tlsIntolerant=None):
         """Perform a handshake in the role of server.
 
         This function performs an SSL or TLS handshake.  Depending on
@@ -1034,6 +1035,11 @@ class TLSConnection(TLSRecordLayer):
         clients through the Next-Protocol Negotiation Extension, 
         if they support it.
 
+        @type tlsIntolerant: (int, int) or None
+        @param tlsIntolerant: If tlsIntolerant is not None, the server will
+        simulate TLS version intolerance by returning a fatal handshake_failure
+        alert to all TLS versions tlsIntolerant or higher.
+
         @raise socket.error: If a socket error occurs.
         @raise tlslite.errors.TLSAbruptCloseError: If the socket is closed
         without a preceding alert.
@@ -1045,7 +1051,7 @@ class TLSConnection(TLSRecordLayer):
                 certChain, privateKey, reqCert, sessionCache, settings,
                 checker, reqCAs, 
                 tacks=tacks, activationFlags=activationFlags, 
-                nextProtos=nextProtos, anon=anon):
+                nextProtos=nextProtos, anon=anon, tlsIntolerant=tlsIntolerant):
             pass
 
 
@@ -1054,7 +1060,8 @@ class TLSConnection(TLSRecordLayer):
                              sessionCache=None, settings=None, checker=None,
                              reqCAs=None, 
                              tacks=None, activationFlags=0,
-                             nextProtos=None, anon=False
+                             nextProtos=None, anon=False,
+                             tlsIntolerant=None
                              ):
         """Start a server handshake operation on the TLS connection.
 
@@ -1073,7 +1080,8 @@ class TLSConnection(TLSRecordLayer):
             sessionCache=sessionCache, settings=settings, 
             reqCAs=reqCAs, 
             tacks=tacks, activationFlags=activationFlags, 
-            nextProtos=nextProtos, anon=anon)
+            nextProtos=nextProtos, anon=anon,
+            tlsIntolerant=tlsIntolerant)
         for result in self._handshakeWrapperAsync(handshaker, checker):
             yield result
 
@@ -1082,7 +1090,8 @@ class TLSConnection(TLSRecordLayer):
                              certChain, privateKey, reqCert, sessionCache,
                              settings, reqCAs, 
                              tacks, activationFlags, 
-                             nextProtos, anon):
+                             nextProtos, anon,
+                             tlsIntolerant):
 
         self._handshakeStart(client=False)
 
@@ -1114,7 +1123,7 @@ class TLSConnection(TLSRecordLayer):
         # Handle ClientHello and resumption
         for result in self._serverGetClientHello(settings, certChain,\
                                             verifierDB, sessionCache,
-                                            anon):
+                                            anon, tlsIntolerant):
             if result in (0,1): yield result
             elif result == None:
                 self._handshakeDone(resumed=True)                
@@ -1211,7 +1220,7 @@ class TLSConnection(TLSRecordLayer):
 
 
     def _serverGetClientHello(self, settings, certChain, verifierDB,
-                                sessionCache, anon):
+                                sessionCache, anon, tlsIntolerant):
         #Initialize acceptable cipher suites
         cipherSuites = []
         if verifierDB:
@@ -1246,6 +1255,13 @@ class TLSConnection(TLSRecordLayer):
                   "Too old version: %s" % str(clientHello.client_version)):
                 yield result
 
+        #If simulating TLS intolerance, reject certain TLS versions.
+        elif (tlsIntolerant is not None and
+            clientHello.client_version >= tlsIntolerant):
+            for result in self._sendError(\
+                    AlertDescription.handshake_failure):
+                yield result
+
         #If client's version is too high, propose my highest version
         elif clientHello.client_version > settings.maxVersion:
             self.version = settings.maxVersion