1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
3 /* This Source Code Form is subject to the terms of the Mozilla Public
4 * License, v. 2.0. If a copy of the MPL was not distributed with this
5 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
6
7 #include "nsNSSIOLayer.h"
8 #include "sslproto.h"
9 #include "sslerr.h"
10
11 #include "gtest/gtest.h"
12
13 constexpr auto HOST = "example.org"_ns;
14 const int16_t PORT = 443;
15
16 class psm_TLSIntoleranceTest : public ::testing::Test {
17 protected:
18 nsSSLIOLayerHelpers helpers;
19 };
20
TEST_F(psm_TLSIntoleranceTest,FullFallbackProcess)21 TEST_F(psm_TLSIntoleranceTest, FullFallbackProcess) {
22 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, helpers.mVersionFallbackLimit);
23
24 // No adjustment made when there is no entry for the site.
25 {
26 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
27 SSL_LIBRARY_VERSION_TLS_1_2};
28 helpers.adjustForTLSIntolerance(HOST, PORT, range);
29 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
30 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
31 }
32
33 {
34 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
35 SSL_LIBRARY_VERSION_TLS_1_2};
36 helpers.adjustForTLSIntolerance(HOST, PORT, range);
37 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
38 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
39
40 ASSERT_TRUE(helpers.rememberIntolerantAtVersion(HOST, PORT, range.min,
41 range.max, 0));
42 }
43
44 {
45 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
46 SSL_LIBRARY_VERSION_TLS_1_2};
47 helpers.adjustForTLSIntolerance(HOST, PORT, range);
48 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
49 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
50
51 ASSERT_TRUE(helpers.rememberIntolerantAtVersion(HOST, PORT, range.min,
52 range.max, 0));
53 }
54
55 {
56 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
57 SSL_LIBRARY_VERSION_TLS_1_2};
58 helpers.adjustForTLSIntolerance(HOST, PORT, range);
59 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
60 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.max);
61
62 ASSERT_FALSE(helpers.rememberIntolerantAtVersion(HOST, PORT, range.min,
63 range.max, 0));
64 }
65
66 {
67 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
68 SSL_LIBRARY_VERSION_TLS_1_2};
69 helpers.adjustForTLSIntolerance(HOST, PORT, range);
70 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
71 // When rememberIntolerantAtVersion returns false, it also resets the
72 // intolerance information for the server.
73 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
74 }
75 }
76
TEST_F(psm_TLSIntoleranceTest,DisableFallbackWithHighLimit)77 TEST_F(psm_TLSIntoleranceTest, DisableFallbackWithHighLimit) {
78 // this value disables version fallback entirely: with this value, all efforts
79 // to mark an origin as version intolerant fail
80 helpers.mVersionFallbackLimit = SSL_LIBRARY_VERSION_TLS_1_2;
81 ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
82 HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_2, 0));
83 ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
84 HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_1, 0));
85 ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
86 HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_0, 0));
87 }
88
TEST_F(psm_TLSIntoleranceTest,FallbackLimitBelowMin)89 TEST_F(psm_TLSIntoleranceTest, FallbackLimitBelowMin) {
90 // check that we still respect the minimum version,
91 // when it is higher than the fallback limit
92 ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
93 HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_1, SSL_LIBRARY_VERSION_TLS_1_2, 0));
94 {
95 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
96 SSL_LIBRARY_VERSION_TLS_1_2};
97 helpers.adjustForTLSIntolerance(HOST, PORT, range);
98 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
99 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
100 }
101
102 ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
103 HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_1, SSL_LIBRARY_VERSION_TLS_1_1, 0));
104 }
105
TEST_F(psm_TLSIntoleranceTest,TolerantOverridesIntolerant1)106 TEST_F(psm_TLSIntoleranceTest, TolerantOverridesIntolerant1) {
107 ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
108 HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_1, 0));
109 helpers.rememberTolerantAtVersion(HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_1);
110 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
111 SSL_LIBRARY_VERSION_TLS_1_2};
112 helpers.adjustForTLSIntolerance(HOST, PORT, range);
113 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
114 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
115 }
116
TEST_F(psm_TLSIntoleranceTest,TolerantOverridesIntolerant2)117 TEST_F(psm_TLSIntoleranceTest, TolerantOverridesIntolerant2) {
118 ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
119 HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_1, 0));
120 helpers.rememberTolerantAtVersion(HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_2);
121 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
122 SSL_LIBRARY_VERSION_TLS_1_2};
123 helpers.adjustForTLSIntolerance(HOST, PORT, range);
124 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
125 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
126 }
127
TEST_F(psm_TLSIntoleranceTest,IntolerantDoesNotOverrideTolerant)128 TEST_F(psm_TLSIntoleranceTest, IntolerantDoesNotOverrideTolerant) {
129 // No adjustment made when there is no entry for the site.
130 helpers.rememberTolerantAtVersion(HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_1);
131 // false because we reached the floor set by rememberTolerantAtVersion.
132 ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
133 HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_1, 0));
134 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
135 SSL_LIBRARY_VERSION_TLS_1_2};
136 helpers.adjustForTLSIntolerance(HOST, PORT, range);
137 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
138 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
139 }
140
TEST_F(psm_TLSIntoleranceTest,PortIsRelevant)141 TEST_F(psm_TLSIntoleranceTest, PortIsRelevant) {
142 helpers.rememberTolerantAtVersion(HOST, 1, SSL_LIBRARY_VERSION_TLS_1_2);
143 ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
144 HOST, 1, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_2, 0));
145 ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
146 HOST, 2, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_2, 0));
147
148 {
149 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
150 SSL_LIBRARY_VERSION_TLS_1_2};
151 helpers.adjustForTLSIntolerance(HOST, 1, range);
152 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
153 }
154
155 {
156 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
157 SSL_LIBRARY_VERSION_TLS_1_2};
158 helpers.adjustForTLSIntolerance(HOST, 2, range);
159 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
160 }
161 }
162
TEST_F(psm_TLSIntoleranceTest,IntoleranceReasonInitial)163 TEST_F(psm_TLSIntoleranceTest, IntoleranceReasonInitial) {
164 ASSERT_EQ(0, helpers.getIntoleranceReason(HOST, 1));
165
166 helpers.rememberTolerantAtVersion(HOST, 2, SSL_LIBRARY_VERSION_TLS_1_2);
167 ASSERT_EQ(0, helpers.getIntoleranceReason(HOST, 2));
168 }
169
TEST_F(psm_TLSIntoleranceTest,IntoleranceReasonStored)170 TEST_F(psm_TLSIntoleranceTest, IntoleranceReasonStored) {
171 helpers.rememberIntolerantAtVersion(HOST, 1, SSL_LIBRARY_VERSION_TLS_1_0,
172 SSL_LIBRARY_VERSION_TLS_1_2,
173 SSL_ERROR_BAD_SERVER);
174 ASSERT_EQ(SSL_ERROR_BAD_SERVER, helpers.getIntoleranceReason(HOST, 1));
175
176 helpers.rememberIntolerantAtVersion(HOST, 1, SSL_LIBRARY_VERSION_TLS_1_0,
177 SSL_LIBRARY_VERSION_TLS_1_1,
178 SSL_ERROR_BAD_MAC_READ);
179 ASSERT_EQ(SSL_ERROR_BAD_MAC_READ, helpers.getIntoleranceReason(HOST, 1));
180 }
181
TEST_F(psm_TLSIntoleranceTest,IntoleranceReasonCleared)182 TEST_F(psm_TLSIntoleranceTest, IntoleranceReasonCleared) {
183 ASSERT_EQ(0, helpers.getIntoleranceReason(HOST, 1));
184
185 helpers.rememberIntolerantAtVersion(HOST, 1, SSL_LIBRARY_VERSION_TLS_1_0,
186 SSL_LIBRARY_VERSION_TLS_1_2,
187 SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT);
188 ASSERT_EQ(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT,
189 helpers.getIntoleranceReason(HOST, 1));
190
191 helpers.rememberTolerantAtVersion(HOST, 1, SSL_LIBRARY_VERSION_TLS_1_2);
192 ASSERT_EQ(0, helpers.getIntoleranceReason(HOST, 1));
193 }
194
TEST_F(psm_TLSIntoleranceTest,TLSForgetIntolerance)195 TEST_F(psm_TLSIntoleranceTest, TLSForgetIntolerance) {
196 {
197 ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
198 HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_2,
199 0));
200
201 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
202 SSL_LIBRARY_VERSION_TLS_1_2};
203 helpers.adjustForTLSIntolerance(HOST, PORT, range);
204 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
205 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
206 }
207
208 {
209 helpers.forgetIntolerance(HOST, PORT);
210
211 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
212 SSL_LIBRARY_VERSION_TLS_1_2};
213 helpers.adjustForTLSIntolerance(HOST, PORT, range);
214 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
215 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
216 }
217 }
218
TEST_F(psm_TLSIntoleranceTest,TLSDontForgetTolerance)219 TEST_F(psm_TLSIntoleranceTest, TLSDontForgetTolerance) {
220 {
221 helpers.rememberTolerantAtVersion(HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_1);
222
223 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
224 SSL_LIBRARY_VERSION_TLS_1_2};
225 helpers.adjustForTLSIntolerance(HOST, PORT, range);
226 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
227 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
228 }
229
230 {
231 ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
232 HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_2,
233 0));
234
235 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
236 SSL_LIBRARY_VERSION_TLS_1_2};
237 helpers.adjustForTLSIntolerance(HOST, PORT, range);
238 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
239 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
240 }
241
242 {
243 helpers.forgetIntolerance(HOST, PORT);
244
245 SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
246 SSL_LIBRARY_VERSION_TLS_1_2};
247 helpers.adjustForTLSIntolerance(HOST, PORT, range);
248 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
249 ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
250 }
251 }
252
TEST_F(psm_TLSIntoleranceTest,TLSPerSiteFallbackLimit)253 TEST_F(psm_TLSIntoleranceTest, TLSPerSiteFallbackLimit) {
254 constexpr auto example_com = "example.com"_ns;
255 constexpr auto example_net = "example.net"_ns;
256 constexpr auto example_org = "example.org"_ns;
257
258 helpers.mVersionFallbackLimit = SSL_LIBRARY_VERSION_TLS_1_0;
259
260 ASSERT_FALSE(
261 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
262 ASSERT_FALSE(
263 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
264 ASSERT_TRUE(
265 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
266 ASSERT_FALSE(
267 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
268 ASSERT_FALSE(
269 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
270 ASSERT_TRUE(
271 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
272 ASSERT_FALSE(
273 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
274 ASSERT_FALSE(
275 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
276 ASSERT_TRUE(
277 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
278
279 helpers.mVersionFallbackLimit = SSL_LIBRARY_VERSION_TLS_1_2;
280
281 ASSERT_TRUE(
282 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
283 ASSERT_TRUE(
284 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
285 ASSERT_TRUE(
286 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
287 ASSERT_TRUE(
288 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
289 ASSERT_TRUE(
290 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
291 ASSERT_TRUE(
292 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
293 ASSERT_TRUE(
294 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
295 ASSERT_TRUE(
296 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
297 ASSERT_TRUE(
298 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
299
300 helpers.setInsecureFallbackSites(example_com);
301
302 ASSERT_FALSE(
303 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
304 ASSERT_FALSE(
305 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
306 ASSERT_TRUE(
307 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
308 ASSERT_TRUE(
309 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
310 ASSERT_TRUE(
311 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
312 ASSERT_TRUE(
313 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
314 ASSERT_TRUE(
315 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
316 ASSERT_TRUE(
317 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
318 ASSERT_TRUE(
319 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
320
321 helpers.setInsecureFallbackSites("example.com,example.net"_ns);
322
323 ASSERT_FALSE(
324 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
325 ASSERT_FALSE(
326 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
327 ASSERT_TRUE(
328 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
329 ASSERT_FALSE(
330 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
331 ASSERT_FALSE(
332 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
333 ASSERT_TRUE(
334 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
335 ASSERT_TRUE(
336 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
337 ASSERT_TRUE(
338 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
339 ASSERT_TRUE(
340 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
341
342 helpers.setInsecureFallbackSites(example_net);
343
344 ASSERT_TRUE(
345 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
346 ASSERT_TRUE(
347 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
348 ASSERT_TRUE(
349 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
350 ASSERT_FALSE(
351 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
352 ASSERT_FALSE(
353 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
354 ASSERT_TRUE(
355 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
356 ASSERT_TRUE(
357 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
358 ASSERT_TRUE(
359 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
360 ASSERT_TRUE(
361 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
362
363 helpers.setInsecureFallbackSites(""_ns);
364
365 ASSERT_TRUE(
366 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
367 ASSERT_TRUE(
368 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
369 ASSERT_TRUE(
370 helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
371 ASSERT_TRUE(
372 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
373 ASSERT_TRUE(
374 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
375 ASSERT_TRUE(
376 helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
377 ASSERT_TRUE(
378 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
379 ASSERT_TRUE(
380 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
381 ASSERT_TRUE(
382 helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
383 }
384