Improve the TLS intolerant server testing support added in r134129

third_party/tlslite/tlslite/TLSConnection.py

 """
 MAIN CLASS FOR TLS LITE (START HERE!).
 """
 from __future__ import generators
 
 import socket
 from utils.compat import formatExceptionTrace
 from TLSRecordLayer import TLSRecordLayer
 from Session import Session
 from constants import *
@@ skipping 914 matching lines @@
 
             #Mark the connection as open
             self.session._setResumable(True)
             self._handshakeDone(resumed=False)
 
 
 
     def handshakeServer(self, sharedKeyDB=None, verifierDB=None,
                         certChain=None, privateKey=None, reqCert=False,
                         sessionCache=None, settings=None, checker=None,
-                        reqCAs=None, tlsIntolerant=False):
+                        reqCAs=None, tlsIntolerant=0):
         """Perform a handshake in the role of server.
 
         This function performs an SSL or TLS handshake.  Depending on
         the arguments and the behavior of the client, this function can
         perform a shared-key, SRP, or certificate-based handshake.  It
         can also perform a combined SRP and server-certificate
         handshake.
 
         Like any handshake function, this can be called on a closed
         TLS connection, or on a TLS connection that is already open.
@@ skipping 66 matching lines @@
         """
         for result in self.handshakeServerAsync(sharedKeyDB, verifierDB,
                 certChain, privateKey, reqCert, sessionCache, settings,
                 checker, reqCAs, tlsIntolerant):
             pass
 
 
     def handshakeServerAsync(self, sharedKeyDB=None, verifierDB=None,
                              certChain=None, privateKey=None, reqCert=False,
                              sessionCache=None, settings=None, checker=None,
-                             reqCAs=None, tlsIntolerant=False):
+                             reqCAs=None, tlsIntolerant=0):
         """Start a server handshake operation on the TLS connection.
 
         This function returns a generator which behaves similarly to
         handshakeServer().  Successive invocations of the generator
         will return 0 if it is waiting to read from the socket, 1 if it is
         waiting to write to the socket, or it will raise StopIteration
         if the handshake operation is complete.
 
         @rtype: iterable
         @return: A generator; see above for details.
@@ skipping 72 matching lines @@
         clientHello = result
 
         #If client's version is too low, reject it
         if clientHello.client_version < settings.minVersion:
             self.version = settings.minVersion
             for result in self._sendError(\
                   AlertDescription.protocol_version,
                   "Too old version: %s" % str(clientHello.client_version)):
                 yield result
 
-        if tlsIntolerant and clientHello.client_version > (3, 0):
+        #If tlsIntolerant is nonzero, reject certain TLS versions.
+        #1: reject all TLS versions.
+        #2: reject TLS 1.1 or higher.
+        #3: reject TLS 1.2 or higher.
+        if (tlsIntolerant == 1 and clientHello.client_version > (3, 0) or
+            tlsIntolerant == 2 and clientHello.client_version > (3, 1) or
+            tlsIntolerant == 3 and clientHello.client_version > (3, 2)):
             for result in self._sendError(\
                     AlertDescription.handshake_failure):
                 yield result
 
         #If client's version is too high, propose my highest version
         elif clientHello.client_version > settings.maxVersion:
             self.version = settings.maxVersion
 
         else:
             #Set the version to the client's version
@@ skipping 483 matching lines @@
         if len(publicKey) < settings.minKeySize:
             for result in self._sendError(AlertDescription.handshake_failure,
                     "Other party's public key too small: %d" % len(publicKey)):
                 yield result
         if len(publicKey) > settings.maxKeySize:
             for result in self._sendError(AlertDescription.handshake_failure,
                     "Other party's public key too large: %d" % len(publicKey)):
                 yield result
 
         yield publicKey, certChain