Implement downgrade signaling in Go. [Originally written by nharper, revised by davidben.] When we add this in the real code, this will want ample tests and hooks for bugs, but get the core logic in to start with. Change-Id: I86cf0b6416c9077dbb6471a1802ae984b8fa6c72 Reviewed-on: https://boringssl-review.googlesource.com/8598 Reviewed-by: David Benjamin <davidben@google.com>

diff --git a/ssl/test/runner/common.go b/ssl/test/runner/common.go
index db3f270..f0b945d 100644
--- a/ssl/test/runner/common.go
+++ b/ssl/test/runner/common.go

@@ -1262,3 +1262,9 @@
 	}
 	return false
 }
+
+var (
+	// See draft-ietf-tls-tls13-13, section 6.3.1.2.
+	downgradeTLS13 = []byte{0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x01}
+	downgradeTLS12 = []byte{0x44, 0x4f, 0x57, 0x4e, 0x47, 0x52, 0x44, 0x00}
+)

diff --git a/ssl/test/runner/handshake_client.go b/ssl/test/runner/handshake_client.go
index 5496fa2..544eec3 100644
--- a/ssl/test/runner/handshake_client.go
+++ b/ssl/test/runner/handshake_client.go

@@ -301,6 +301,21 @@
 	}
 	c.haveVers = true
 
+	// Check for downgrade signals in the server random, per
+	// draft-ietf-tls-tls13-13, section 6.3.1.2.
+	if c.vers <= VersionTLS12 && c.config.maxVersion(c.isDTLS) >= VersionTLS13 {
+		if bytes.Equal(serverHello.random[:8], downgradeTLS13) {
+			c.sendAlert(alertProtocolVersion)
+			return errors.New("tls: downgrade from TLS 1.3 detected")
+		}
+	}
+	if c.vers <= VersionTLS11 && c.config.maxVersion(c.isDTLS) >= VersionTLS12 {
+		if bytes.Equal(serverHello.random[:8], downgradeTLS12) {
+			c.sendAlert(alertProtocolVersion)
+			return errors.New("tls: downgrade from TLS 1.2 detected")
+		}
+	}
+
 	suite := mutualCipherSuite(c.config.cipherSuites(), serverHello.cipherSuite)
 	if suite == nil {
 		c.sendAlert(alertHandshakeFailure)

diff --git a/ssl/test/runner/handshake_server.go b/ssl/test/runner/handshake_server.go
index cb9ef2c..a5bfed7 100644
--- a/ssl/test/runner/handshake_server.go
+++ b/ssl/test/runner/handshake_server.go

@@ -263,6 +263,13 @@
 		c.sendAlert(alertInternalError)
 		return false, err
 	}
+	// Signal downgrades in the server random, per draft-ietf-tls-tls13-13, section 6.3.1.2.
+	if c.vers <= VersionTLS12 && config.maxVersion(c.isDTLS) >= VersionTLS13 {
+		copy(hs.hello.random[:8], downgradeTLS13)
+	}
+	if c.vers <= VersionTLS11 && config.maxVersion(c.isDTLS) == VersionTLS12 {
+		copy(hs.hello.random[:8], downgradeTLS12)
+	}
 
 	foundCompression := false
 	// We only support null compression, so check that the client offered it.