| diff --git a/third_party/tlslite/tlslite/tlsconnection.py b/third_party/tlslite/tlslite/tlsconnection.py |
| index e8dd859..8415592 100755 |
| --- a/third_party/tlslite/tlslite/tlsconnection.py |
| +++ b/third_party/tlslite/tlslite/tlsconnection.py |
| @@ -965,7 +965,8 @@ class TLSConnection(TLSRecordLayer): |
| sessionCache=None, settings=None, checker=None, |
| reqCAs = None, |
| tacks=None, activationFlags=0, |
| - nextProtos=None, anon=False): |
| + nextProtos=None, anon=False, |
| + tlsIntolerant=None): |
| """Perform a handshake in the role of server. |
| |
| This function performs an SSL or TLS handshake. Depending on |
| @@ -1034,6 +1035,11 @@ class TLSConnection(TLSRecordLayer): |
| clients through the Next-Protocol Negotiation Extension, |
| if they support it. |
| |
| + @type tlsIntolerant: (int, int) or None |
| + @param tlsIntolerant: If tlsIntolerant is not None, the server will |
| + simulate TLS version intolerance by returning a fatal handshake_failure |
| + alert to all TLS versions tlsIntolerant or higher. |
| + |
| @raise socket.error: If a socket error occurs. |
| @raise tlslite.errors.TLSAbruptCloseError: If the socket is closed |
| without a preceding alert. |
| @@ -1045,7 +1051,7 @@ class TLSConnection(TLSRecordLayer): |
| certChain, privateKey, reqCert, sessionCache, settings, |
| checker, reqCAs, |
| tacks=tacks, activationFlags=activationFlags, |
| - nextProtos=nextProtos, anon=anon): |
| + nextProtos=nextProtos, anon=anon, tlsIntolerant=tlsIntolerant): |
| pass |
| |
| |
| @@ -1054,7 +1060,8 @@ class TLSConnection(TLSRecordLayer): |
| sessionCache=None, settings=None, checker=None, |
| reqCAs=None, |
| tacks=None, activationFlags=0, |
| - nextProtos=None, anon=False |
| + nextProtos=None, anon=False, |
| + tlsIntolerant=None |
| ): |
| """Start a server handshake operation on the TLS connection. |
| |
| @@ -1073,7 +1080,8 @@ class TLSConnection(TLSRecordLayer): |
| sessionCache=sessionCache, settings=settings, |
| reqCAs=reqCAs, |
| tacks=tacks, activationFlags=activationFlags, |
| - nextProtos=nextProtos, anon=anon) |
| + nextProtos=nextProtos, anon=anon, |
| + tlsIntolerant=tlsIntolerant) |
| for result in self._handshakeWrapperAsync(handshaker, checker): |
| yield result |
| |
| @@ -1082,7 +1090,8 @@ class TLSConnection(TLSRecordLayer): |
| certChain, privateKey, reqCert, sessionCache, |
| settings, reqCAs, |
| tacks, activationFlags, |
| - nextProtos, anon): |
| + nextProtos, anon, |
| + tlsIntolerant): |
| |
| self._handshakeStart(client=False) |
| |
| @@ -1114,7 +1123,7 @@ class TLSConnection(TLSRecordLayer): |
| # Handle ClientHello and resumption |
| for result in self._serverGetClientHello(settings, certChain,\ |
| verifierDB, sessionCache, |
| - anon): |
| + anon, tlsIntolerant): |
| if result in (0,1): yield result |
| elif result == None: |
| self._handshakeDone(resumed=True) |
| @@ -1211,7 +1220,7 @@ class TLSConnection(TLSRecordLayer): |
| |
| |
| def _serverGetClientHello(self, settings, certChain, verifierDB, |
| - sessionCache, anon): |
| + sessionCache, anon, tlsIntolerant): |
| #Initialize acceptable cipher suites |
| cipherSuites = [] |
| if verifierDB: |
| @@ -1246,6 +1255,13 @@ class TLSConnection(TLSRecordLayer): |
| "Too old version: %s" % str(clientHello.client_version)): |
| yield result |
| |
| + #If simulating TLS intolerance, reject certain TLS versions. |
| + elif (tlsIntolerant is not None and |
| + clientHello.client_version >= tlsIntolerant): |
| + for result in self._sendError(\ |
| + AlertDescription.handshake_failure): |
| + yield result |
| + |
| #If client's version is too high, propose my highest version |
| elif clientHello.client_version > settings.maxVersion: |
| self.version = settings.maxVersion |