net: add test for TLS_FALLBACK_SCSV

third_party/tlslite/tlslite/TLSConnection.py

 """
 MAIN CLASS FOR TLS LITE (START HERE!).
 """
 from __future__ import generators
 
 import socket
 from utils.compat import formatExceptionTrace
 from TLSRecordLayer import TLSRecordLayer
 from Session import Session
 from constants import *
@@ skipping 919 matching lines @@
             #Mark the connection as open
             self.session._setResumable(True)
             self._handshakeDone(resumed=False)
 
 
 
     def handshakeServer(self, sharedKeyDB=None, verifierDB=None,
                         certChain=None, privateKey=None, reqCert=False,
                         sessionCache=None, settings=None, checker=None,
                         reqCAs=None, tlsIntolerant=0,
-                        signedCertTimestamps=None):
+                        signedCertTimestamps=None,
+                        fallbackSCSV=False):

[wtc, 2013/12/13 16:19:21]

Nit: just noticed that we should document the new fallbackSCSV parameter below.
The tlsIntolerant parameter isn't documented either.

[agl, 2013/12/16 15:56:04]

Done in http://src.chromium.org/viewvc/chrome?revision=240907&view=revision

         """Perform a handshake in the role of server.
 
         This function performs an SSL or TLS handshake.  Depending on
         the arguments and the behavior of the client, this function can
         perform a shared-key, SRP, or certificate-based handshake.  It
         can also perform a combined SRP and server-certificate
         handshake.
 
         Like any handshake function, this can be called on a closed
         TLS connection, or on a TLS connection that is already open.
@@ skipping 64 matching lines @@
 
         @raise socket.error: If a socket error occurs.
         @raise tlslite.errors.TLSAbruptCloseError: If the socket is closed
         without a preceding alert.
         @raise tlslite.errors.TLSAlert: If a TLS alert is signalled.
         @raise tlslite.errors.TLSAuthenticationError: If the checker
         doesn't like the other party's authentication credentials.
         """
         for result in self.handshakeServerAsync(sharedKeyDB, verifierDB,
                 certChain, privateKey, reqCert, sessionCache, settings,
-                checker, reqCAs, tlsIntolerant, signedCertTimestamps):
+                checker, reqCAs, tlsIntolerant, signedCertTimestamps,
+                fallbackSCSV):
             pass
 
 
     def handshakeServerAsync(self, sharedKeyDB=None, verifierDB=None,
                              certChain=None, privateKey=None, reqCert=False,
                              sessionCache=None, settings=None, checker=None,
                              reqCAs=None, tlsIntolerant=0,
-                             signedCertTimestamps=None):
+                             signedCertTimestamps=None,
+                             fallbackSCSV=False):
         """Start a server handshake operation on the TLS connection.
 
         This function returns a generator which behaves similarly to
         handshakeServer().  Successive invocations of the generator
         will return 0 if it is waiting to read from the socket, 1 if it is
         waiting to write to the socket, or it will raise StopIteration
         if the handshake operation is complete.
 
         @rtype: iterable
         @return: A generator; see above for details.
         """
         handshaker = self._handshakeServerAsyncHelper(\
             sharedKeyDB=sharedKeyDB,
             verifierDB=verifierDB, certChain=certChain,
             privateKey=privateKey, reqCert=reqCert,
             sessionCache=sessionCache, settings=settings,
             reqCAs=reqCAs,
             tlsIntolerant=tlsIntolerant,
-            signedCertTimestamps=signedCertTimestamps)
+            signedCertTimestamps=signedCertTimestamps,
+            fallbackSCSV=fallbackSCSV)
         for result in self._handshakeWrapperAsync(handshaker, checker):
             yield result
 
 
     def _handshakeServerAsyncHelper(self, sharedKeyDB, verifierDB,
                                     certChain, privateKey, reqCert,
                                     sessionCache, settings, reqCAs,
-                                    tlsIntolerant, signedCertTimestamps):
+                                    tlsIntolerant, signedCertTimestamps,
+                                    fallbackSCSV):
 
         self._handshakeStart(client=False)
 
         if (not sharedKeyDB) and (not verifierDB) and (not certChain):
             raise ValueError("Caller passed no authentication credentials")
         if certChain and not privateKey:
             raise ValueError("Caller passed a certChain but no privateKey")
         if privateKey and not certChain:
             raise ValueError("Caller passed a privateKey but no certChain")
         if reqCAs and not reqCert:
@@ skipping 63 matching lines @@
         #2: reject TLS 1.1 or higher.
         #3: reject TLS 1.2 or higher.
         if (tlsIntolerant == 1 and clientHello.client_version > (3, 0) or
             tlsIntolerant == 2 and clientHello.client_version > (3, 1) or
             tlsIntolerant == 3 and clientHello.client_version > (3, 2)):
             for result in self._sendError(\
                     AlertDescription.handshake_failure):
                 yield result
 
         #If client's version is too high, propose my highest version
-        elif clientHello.client_version > settings.maxVersion:
+        if clientHello.client_version > settings.maxVersion:
             self.version = settings.maxVersion
-
         else:
             #Set the version to the client's version
             self.version = clientHello.client_version
+            if (fallbackSCSV and
+                clientHello.client_version < settings.maxVersion):
+                for cipherSuite in clientHello.cipher_suites:
+                    if cipherSuite == 0x5600:
+                        for result in self._sendError(\
+                                AlertDescription.inappropriate_fallback):
+                            yield result
 
         #Get the client nonce; create server nonce
         clientRandom = clientHello.random
         serverRandom = getRandomBytes(32)
 
         #Calculate the first cipher suite intersection.
         #This is the 'privileged' ciphersuite.  We'll use it if we're
         #doing a shared-key resumption or a new negotiation.  In fact,
         #the only time we won't use it is if we're resuming a non-sharedkey
         #session, in which case we use the ciphersuite from the session.
@@ skipping 490 matching lines @@
         if len(publicKey) < settings.minKeySize:
             for result in self._sendError(AlertDescription.handshake_failure,
                     "Other party's public key too small: %d" % len(publicKey)):
                 yield result
         if len(publicKey) > settings.maxKeySize:
             for result in self._sendError(AlertDescription.handshake_failure,
                     "Other party's public key too large: %d" % len(publicKey)):
                 yield result
 
         yield publicKey, certChain