Implement TLS_FALLBACK_SCSV for SSLClientSocketOpenSSL.

third_party/tlslite/patches/fallback_scsv.patch

 diff --git a/third_party/tlslite/tlslite/constants.py b/third_party/tlslite/tlslite/constants.py
 index b3bad2d..d132b78 100755
 --- a/third_party/tlslite/tlslite/constants.py
 +++ b/third_party/tlslite/tlslite/constants.py
 @@ -106,6 +106,7 @@ class AlertDescription:
      protocol_version = 70
      insufficient_security = 71
      internal_error = 80
 +    inappropriate_fallback = 86
      user_canceled = 90
@@ skipping 97 matching lines @@
                  self._handshakeDone(resumed=True)                
 @@ -1234,7 +1243,7 @@ class TLSConnection(TLSRecordLayer):
  
  
      def _serverGetClientHello(self, settings, certChain, verifierDB,
 -                                sessionCache, anon, tlsIntolerant):
 +                                sessionCache, anon, tlsIntolerant, fallbackSCSV):
          #Initialize acceptable cipher suites
          cipherSuites = []
          if verifierDB:
-@@ -1280,6 +1289,13 @@ class TLSConnection(TLSRecordLayer):
+@@ -1280,6 +1289,14 @@ class TLSConnection(TLSRecordLayer):
          elif clientHello.client_version > settings.maxVersion:
              self.version = settings.maxVersion
  
 +        #Detect if the client performed an inappropriate fallback.
 +        elif fallbackSCSV and clientHello.client_version < settings.maxVersion:
++            self.version = clientHello.client_version
 +            if CipherSuite.TLS_FALLBACK_SCSV in clientHello.cipher_suites:
 +                for result in self._sendError(\
 +                        AlertDescription.inappropriate_fallback):
 +                    yield result
 +
          else:
              #Set the version to the client's version
              self.version = clientHello.client_version