1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
3 /* This Source Code Form is subject to the terms of the Mozilla Public
4  * License, v. 2.0. If a copy of the MPL was not distributed with this
5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
6 
7 #include "nsNSSIOLayer.h"
8 #include "sslproto.h"
9 #include "sslerr.h"
10 
11 #include "gtest/gtest.h"
12 
13 constexpr auto HOST = "example.org"_ns;
14 const int16_t PORT = 443;
15 
16 class psm_TLSIntoleranceTest : public ::testing::Test {
17  protected:
18   nsSSLIOLayerHelpers helpers;
19 };
20 
TEST_F(psm_TLSIntoleranceTest,FullFallbackProcess)21 TEST_F(psm_TLSIntoleranceTest, FullFallbackProcess) {
22   ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, helpers.mVersionFallbackLimit);
23 
24   // No adjustment made when there is no entry for the site.
25   {
26     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
27                              SSL_LIBRARY_VERSION_TLS_1_2};
28     helpers.adjustForTLSIntolerance(HOST, PORT, range);
29     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
30     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
31   }
32 
33   {
34     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
35                              SSL_LIBRARY_VERSION_TLS_1_2};
36     helpers.adjustForTLSIntolerance(HOST, PORT, range);
37     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
38     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
39 
40     ASSERT_TRUE(helpers.rememberIntolerantAtVersion(HOST, PORT, range.min,
41                                                     range.max, 0));
42   }
43 
44   {
45     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
46                              SSL_LIBRARY_VERSION_TLS_1_2};
47     helpers.adjustForTLSIntolerance(HOST, PORT, range);
48     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
49     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
50 
51     ASSERT_TRUE(helpers.rememberIntolerantAtVersion(HOST, PORT, range.min,
52                                                     range.max, 0));
53   }
54 
55   {
56     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
57                              SSL_LIBRARY_VERSION_TLS_1_2};
58     helpers.adjustForTLSIntolerance(HOST, PORT, range);
59     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
60     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.max);
61 
62     ASSERT_FALSE(helpers.rememberIntolerantAtVersion(HOST, PORT, range.min,
63                                                      range.max, 0));
64   }
65 
66   {
67     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
68                              SSL_LIBRARY_VERSION_TLS_1_2};
69     helpers.adjustForTLSIntolerance(HOST, PORT, range);
70     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
71     // When rememberIntolerantAtVersion returns false, it also resets the
72     // intolerance information for the server.
73     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
74   }
75 }
76 
TEST_F(psm_TLSIntoleranceTest,DisableFallbackWithHighLimit)77 TEST_F(psm_TLSIntoleranceTest, DisableFallbackWithHighLimit) {
78   // this value disables version fallback entirely: with this value, all efforts
79   // to mark an origin as version intolerant fail
80   helpers.mVersionFallbackLimit = SSL_LIBRARY_VERSION_TLS_1_2;
81   ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
82       HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_2, 0));
83   ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
84       HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_1, 0));
85   ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
86       HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_0, 0));
87 }
88 
TEST_F(psm_TLSIntoleranceTest,FallbackLimitBelowMin)89 TEST_F(psm_TLSIntoleranceTest, FallbackLimitBelowMin) {
90   // check that we still respect the minimum version,
91   // when it is higher than the fallback limit
92   ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
93       HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_1, SSL_LIBRARY_VERSION_TLS_1_2, 0));
94   {
95     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
96                              SSL_LIBRARY_VERSION_TLS_1_2};
97     helpers.adjustForTLSIntolerance(HOST, PORT, range);
98     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
99     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
100   }
101 
102   ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
103       HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_1, SSL_LIBRARY_VERSION_TLS_1_1, 0));
104 }
105 
TEST_F(psm_TLSIntoleranceTest,TolerantOverridesIntolerant1)106 TEST_F(psm_TLSIntoleranceTest, TolerantOverridesIntolerant1) {
107   ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
108       HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_1, 0));
109   helpers.rememberTolerantAtVersion(HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_1);
110   SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
111                            SSL_LIBRARY_VERSION_TLS_1_2};
112   helpers.adjustForTLSIntolerance(HOST, PORT, range);
113   ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
114   ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
115 }
116 
TEST_F(psm_TLSIntoleranceTest,TolerantOverridesIntolerant2)117 TEST_F(psm_TLSIntoleranceTest, TolerantOverridesIntolerant2) {
118   ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
119       HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_1, 0));
120   helpers.rememberTolerantAtVersion(HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_2);
121   SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
122                            SSL_LIBRARY_VERSION_TLS_1_2};
123   helpers.adjustForTLSIntolerance(HOST, PORT, range);
124   ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
125   ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
126 }
127 
TEST_F(psm_TLSIntoleranceTest,IntolerantDoesNotOverrideTolerant)128 TEST_F(psm_TLSIntoleranceTest, IntolerantDoesNotOverrideTolerant) {
129   // No adjustment made when there is no entry for the site.
130   helpers.rememberTolerantAtVersion(HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_1);
131   // false because we reached the floor set by rememberTolerantAtVersion.
132   ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
133       HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_1, 0));
134   SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
135                            SSL_LIBRARY_VERSION_TLS_1_2};
136   helpers.adjustForTLSIntolerance(HOST, PORT, range);
137   ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
138   ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
139 }
140 
TEST_F(psm_TLSIntoleranceTest,PortIsRelevant)141 TEST_F(psm_TLSIntoleranceTest, PortIsRelevant) {
142   helpers.rememberTolerantAtVersion(HOST, 1, SSL_LIBRARY_VERSION_TLS_1_2);
143   ASSERT_FALSE(helpers.rememberIntolerantAtVersion(
144       HOST, 1, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_2, 0));
145   ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
146       HOST, 2, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_2, 0));
147 
148   {
149     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
150                              SSL_LIBRARY_VERSION_TLS_1_2};
151     helpers.adjustForTLSIntolerance(HOST, 1, range);
152     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
153   }
154 
155   {
156     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
157                              SSL_LIBRARY_VERSION_TLS_1_2};
158     helpers.adjustForTLSIntolerance(HOST, 2, range);
159     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
160   }
161 }
162 
TEST_F(psm_TLSIntoleranceTest,IntoleranceReasonInitial)163 TEST_F(psm_TLSIntoleranceTest, IntoleranceReasonInitial) {
164   ASSERT_EQ(0, helpers.getIntoleranceReason(HOST, 1));
165 
166   helpers.rememberTolerantAtVersion(HOST, 2, SSL_LIBRARY_VERSION_TLS_1_2);
167   ASSERT_EQ(0, helpers.getIntoleranceReason(HOST, 2));
168 }
169 
TEST_F(psm_TLSIntoleranceTest,IntoleranceReasonStored)170 TEST_F(psm_TLSIntoleranceTest, IntoleranceReasonStored) {
171   helpers.rememberIntolerantAtVersion(HOST, 1, SSL_LIBRARY_VERSION_TLS_1_0,
172                                       SSL_LIBRARY_VERSION_TLS_1_2,
173                                       SSL_ERROR_BAD_SERVER);
174   ASSERT_EQ(SSL_ERROR_BAD_SERVER, helpers.getIntoleranceReason(HOST, 1));
175 
176   helpers.rememberIntolerantAtVersion(HOST, 1, SSL_LIBRARY_VERSION_TLS_1_0,
177                                       SSL_LIBRARY_VERSION_TLS_1_1,
178                                       SSL_ERROR_BAD_MAC_READ);
179   ASSERT_EQ(SSL_ERROR_BAD_MAC_READ, helpers.getIntoleranceReason(HOST, 1));
180 }
181 
TEST_F(psm_TLSIntoleranceTest,IntoleranceReasonCleared)182 TEST_F(psm_TLSIntoleranceTest, IntoleranceReasonCleared) {
183   ASSERT_EQ(0, helpers.getIntoleranceReason(HOST, 1));
184 
185   helpers.rememberIntolerantAtVersion(HOST, 1, SSL_LIBRARY_VERSION_TLS_1_0,
186                                       SSL_LIBRARY_VERSION_TLS_1_2,
187                                       SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT);
188   ASSERT_EQ(SSL_ERROR_HANDSHAKE_UNEXPECTED_ALERT,
189             helpers.getIntoleranceReason(HOST, 1));
190 
191   helpers.rememberTolerantAtVersion(HOST, 1, SSL_LIBRARY_VERSION_TLS_1_2);
192   ASSERT_EQ(0, helpers.getIntoleranceReason(HOST, 1));
193 }
194 
TEST_F(psm_TLSIntoleranceTest,TLSForgetIntolerance)195 TEST_F(psm_TLSIntoleranceTest, TLSForgetIntolerance) {
196   {
197     ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
198         HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_2,
199         0));
200 
201     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
202                              SSL_LIBRARY_VERSION_TLS_1_2};
203     helpers.adjustForTLSIntolerance(HOST, PORT, range);
204     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
205     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
206   }
207 
208   {
209     helpers.forgetIntolerance(HOST, PORT);
210 
211     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
212                              SSL_LIBRARY_VERSION_TLS_1_2};
213     helpers.adjustForTLSIntolerance(HOST, PORT, range);
214     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
215     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
216   }
217 }
218 
TEST_F(psm_TLSIntoleranceTest,TLSDontForgetTolerance)219 TEST_F(psm_TLSIntoleranceTest, TLSDontForgetTolerance) {
220   {
221     helpers.rememberTolerantAtVersion(HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_1);
222 
223     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
224                              SSL_LIBRARY_VERSION_TLS_1_2};
225     helpers.adjustForTLSIntolerance(HOST, PORT, range);
226     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
227     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
228   }
229 
230   {
231     ASSERT_TRUE(helpers.rememberIntolerantAtVersion(
232         HOST, PORT, SSL_LIBRARY_VERSION_TLS_1_0, SSL_LIBRARY_VERSION_TLS_1_2,
233         0));
234 
235     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
236                              SSL_LIBRARY_VERSION_TLS_1_2};
237     helpers.adjustForTLSIntolerance(HOST, PORT, range);
238     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
239     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_1, range.max);
240   }
241 
242   {
243     helpers.forgetIntolerance(HOST, PORT);
244 
245     SSLVersionRange range = {SSL_LIBRARY_VERSION_TLS_1_0,
246                              SSL_LIBRARY_VERSION_TLS_1_2};
247     helpers.adjustForTLSIntolerance(HOST, PORT, range);
248     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_0, range.min);
249     ASSERT_EQ(SSL_LIBRARY_VERSION_TLS_1_2, range.max);
250   }
251 }
252 
TEST_F(psm_TLSIntoleranceTest,TLSPerSiteFallbackLimit)253 TEST_F(psm_TLSIntoleranceTest, TLSPerSiteFallbackLimit) {
254   constexpr auto example_com = "example.com"_ns;
255   constexpr auto example_net = "example.net"_ns;
256   constexpr auto example_org = "example.org"_ns;
257 
258   helpers.mVersionFallbackLimit = SSL_LIBRARY_VERSION_TLS_1_0;
259 
260   ASSERT_FALSE(
261       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
262   ASSERT_FALSE(
263       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
264   ASSERT_TRUE(
265       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
266   ASSERT_FALSE(
267       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
268   ASSERT_FALSE(
269       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
270   ASSERT_TRUE(
271       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
272   ASSERT_FALSE(
273       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
274   ASSERT_FALSE(
275       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
276   ASSERT_TRUE(
277       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
278 
279   helpers.mVersionFallbackLimit = SSL_LIBRARY_VERSION_TLS_1_2;
280 
281   ASSERT_TRUE(
282       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
283   ASSERT_TRUE(
284       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
285   ASSERT_TRUE(
286       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
287   ASSERT_TRUE(
288       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
289   ASSERT_TRUE(
290       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
291   ASSERT_TRUE(
292       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
293   ASSERT_TRUE(
294       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
295   ASSERT_TRUE(
296       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
297   ASSERT_TRUE(
298       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
299 
300   helpers.setInsecureFallbackSites(example_com);
301 
302   ASSERT_FALSE(
303       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
304   ASSERT_FALSE(
305       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
306   ASSERT_TRUE(
307       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
308   ASSERT_TRUE(
309       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
310   ASSERT_TRUE(
311       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
312   ASSERT_TRUE(
313       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
314   ASSERT_TRUE(
315       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
316   ASSERT_TRUE(
317       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
318   ASSERT_TRUE(
319       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
320 
321   helpers.setInsecureFallbackSites("example.com,example.net"_ns);
322 
323   ASSERT_FALSE(
324       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
325   ASSERT_FALSE(
326       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
327   ASSERT_TRUE(
328       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
329   ASSERT_FALSE(
330       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
331   ASSERT_FALSE(
332       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
333   ASSERT_TRUE(
334       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
335   ASSERT_TRUE(
336       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
337   ASSERT_TRUE(
338       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
339   ASSERT_TRUE(
340       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
341 
342   helpers.setInsecureFallbackSites(example_net);
343 
344   ASSERT_TRUE(
345       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
346   ASSERT_TRUE(
347       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
348   ASSERT_TRUE(
349       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
350   ASSERT_FALSE(
351       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
352   ASSERT_FALSE(
353       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
354   ASSERT_TRUE(
355       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
356   ASSERT_TRUE(
357       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
358   ASSERT_TRUE(
359       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
360   ASSERT_TRUE(
361       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
362 
363   helpers.setInsecureFallbackSites(""_ns);
364 
365   ASSERT_TRUE(
366       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_2));
367   ASSERT_TRUE(
368       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_1));
369   ASSERT_TRUE(
370       helpers.fallbackLimitReached(example_com, SSL_LIBRARY_VERSION_TLS_1_0));
371   ASSERT_TRUE(
372       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_2));
373   ASSERT_TRUE(
374       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_1));
375   ASSERT_TRUE(
376       helpers.fallbackLimitReached(example_net, SSL_LIBRARY_VERSION_TLS_1_0));
377   ASSERT_TRUE(
378       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_2));
379   ASSERT_TRUE(
380       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_1));
381   ASSERT_TRUE(
382       helpers.fallbackLimitReached(example_org, SSL_LIBRARY_VERSION_TLS_1_0));
383 }
384