Preserve transport errors for OpenSSL sockets.

third_party/tlslite/tlslite/handshakesettings.py

 # Authors: 
 #   Trevor Perrin
 #   Dave Baggett (Arcode Corporation) - cleanup handling of constants
 #
 # See the LICENSE file for legal information regarding use of this file.
 
 """Class for setting handshake parameters."""
 
 from .constants import CertificateType
 from .utils import cryptomath
@@ skipping 74 matching lines @@
 
     @type maxVersion: tuple
     @ivar maxVersion: The maximum allowed SSL/TLS version.
 
     This variable can be set to (3,0) for SSL 3.0, (3,1) for
     TLS 1.0, or (3,2) for TLS 1.1.  If the other party wishes to
     use a higher version, a protocol_version alert will be signalled.
     The default is (3,2).  (WARNING: Some servers may (improperly)
     reject clients which offer support for TLS 1.1.  In this case,
     try lowering maxVersion to (3,1)).
+
+    @type tlsIntolerant: tuple
+    @ivar tlsIntolerant: TLS version intolerance for servers.
+
+    If tlsIntolerant is not None, the server will simulate TLS version
+    intolerance by returning a fatal handshake_failure alert or a TCP reset to
+    all TLS versions tlsIntolerant or higher.
+
+    @type resetOnIntolerance: bool
+    @ivar resetOnIntolerance: Whether to send a TCP reset on TLS intolerance.
+
+    If resetOnIntolerance is True, the server will simulate TLS version
+    intolerance with a TCP reset rather than with a fatal handshake_failuer
+    alert.
     
     @type useExperimentalTackExtension: bool
     @ivar useExperimentalTackExtension: Whether to enabled TACK support.
     
     Note that TACK support is not standardized by IETF and uses a temporary
     TLS Extension number, so should NOT be used in production software.
     """
     def __init__(self):
         self.minKeySize = 1023
         self.maxKeySize = 8193
         self.cipherNames = CIPHER_NAMES
         self.macNames = MAC_NAMES
         self.keyExchangeNames = KEY_EXCHANGE_NAMES
         self.cipherImplementations = CIPHER_IMPLEMENTATIONS
         self.certificateTypes = CERTIFICATE_TYPES
         self.minVersion = (3,0)
         self.maxVersion = (3,2)
+        self.tlsIntolerant = None
+        self.resetOnIntolerance = False
         self.useExperimentalTackExtension = False
 
     # Validates the min/max fields, and certificateTypes
     # Filters out unsupported cipherNames and cipherImplementations
     def _filter(self):
         other = HandshakeSettings()
         other.minKeySize = self.minKeySize
         other.maxKeySize = self.maxKeySize
         other.cipherNames = self.cipherNames
         other.macNames = self.macNames
         other.keyExchangeNames = self.keyExchangeNames
         other.cipherImplementations = self.cipherImplementations
         other.certificateTypes = self.certificateTypes
         other.minVersion = self.minVersion
         other.maxVersion = self.maxVersion
+        other.tlsIntolerant = self.tlsIntolerant
+        other.resetOnIntolerance = self.resetOnIntolerance
 
         if not cipherfactory.tripleDESPresent:
             other.cipherNames = [e for e in self.cipherNames if e != "3des"]
         if len(other.cipherNames)==0:
             raise ValueError("No supported ciphers")
         if len(other.certificateTypes)==0:
             raise ValueError("No supported certificate types")
 
         if not cryptomath.m2cryptoLoaded:
             other.cipherImplementations = \
@@ skipping 40 matching lines @@
         return other
 
     def _getCertificateTypes(self):
         l = []
         for ct in self.certificateTypes:
             if ct == "x509":
                 l.append(CertificateType.x509)
             else:
                 raise AssertionError()
         return l