tree 6fd231cb03d24b0eca9797192f47fe4d8ff9d12c
parent e3418028023f6399bee43d78db1ee7f374f52dc2
author David Benjamin <davidben@google.com> 1539037877 -0500
committer CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> 1539201019 +0000

Add a per-SSL TLS 1.3 downgrade enforcement option and improve tests.

Due to non-compliant middleboxes, it is possible we'll need to do some
surgery to this mechanism. Making it per-SSL is a little more flexible
and also eases some tests in Chromium until we get its SSL_CTX usage
fixed up.

Also fix up BoringSSL tests. We forgot to test it at TLS 1.0 and use the
-expect-tls13-downgrade flag.

Bug: 226
Change-Id: Ib39227e74e2d6f5e1fbc1ebcc091e751471b3cdc
Reviewed-on: https://boringssl-review.googlesource.com/c/32424
Reviewed-by: Steven Valdez <svaldez@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>