Add a dedicated error code for TLS 1.3 interference.

third_party/tlslite/tlslite/tlsconnection.py

 # Authors: 
 #   Trevor Perrin
 #   Google - added reqCAs parameter
 #   Google (adapted by Sam Rushing and Marcelo Fernandez) - NPN support
 #   Dimitris Moraitis - Anon ciphersuites
 #   Martin von Loewis - python 3 port
 #   Yngve Pettersen (ported by Paul Sokolovsky) - TLS 1.2
 #
 # See the LICENSE file for legal information regarding use of this file.
 
@@ skipping 1439 matching lines @@
             srpUsername, clientCertChain, serverCertChain,
             tackExt, serverHello.tackExt!=None, serverName)
             
         #Add the session object to the session cache
         if sessionCache and sessionID:
             sessionCache[sessionID] = self.session
 
         self._handshakeDone(resumed=False)
 
 
+    def _isIntolerant(self, settings, clientHello):
+        if settings.tlsIntolerant is None:
+            return False
+        clientVersion = clientHello.client_version
+        if clientHello.has_supported_versions:
+            clientVersion = (3, 4)
+        return clientVersion >= settings.tlsIntolerant
+
+
     def _serverGetClientHello(self, settings, certChain, verifierDB,
                                 sessionCache, anon, fallbackSCSV):
         #Tentatively set version to most-desirable version, so if an error
         #occurs parsing the ClientHello, this is what we'll use for the
         #error alert
         self.version = settings.maxVersion
 
         #Get ClientHello
         for result in self._getMsg(ContentType.handshake,
                                    HandshakeType.client_hello):
             if result in (0,1): yield result
             else: break
         clientHello = result
 
         #If client's version is too low, reject it
         if clientHello.client_version < settings.minVersion:
             self.version = settings.minVersion
             for result in self._sendError(\
                   AlertDescription.protocol_version,
                   "Too old version: %s" % str(clientHello.client_version)):
                 yield result
 
         #If simulating TLS intolerance, reject certain TLS versions.
-        elif (settings.tlsIntolerant is not None and
-              clientHello.client_version >= settings.tlsIntolerant):
+        elif self._isIntolerant(settings, clientHello):
             if settings.tlsIntoleranceType == "alert":
                 for result in self._sendError(\
                     AlertDescription.handshake_failure):
                     yield result
             elif settings.tlsIntoleranceType == "close":
                 self._abruptClose()
                 raise TLSUnsupportedError("Simulating version intolerance")
             elif settings.tlsIntoleranceType == "reset":
                 self._abruptClose(reset=True)
                 raise TLSUnsupportedError("Simulating version intolerance")
@@ skipping 583 matching lines @@
             seed += bytearray(2)
             seed[len(seed) - 2] = len(context) >> 8
             seed[len(seed) - 1] = len(context) & 0xFF
             seed += context
         if self.version in ((3,1), (3,2)):
             return PRF(self.session.masterSecret, label, seed, length)
         elif self.version == (3,3):
             return PRF_1_2(self.session.masterSecret, label, seed, length)
         else:
             raise AssertionError()