Bug 1716563

Summary:	GnuTLS doesn't send downgrade sentinels with TLS 1.3 disabled
Product:	Red Hat Enterprise Linux 8	Reporter:	Alicja Kario <hkario>
Component:	gnutls	Assignee:	Daiki Ueno <dueno>
Status:	CLOSED UPSTREAM	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	8.0	CC:	asosedki, ssorce
Target Milestone:	rc	Keywords:	Triaged
Target Release:	---	Flags:	dueno: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-01-19 15:42:01 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alicja Kario 2019-06-03 15:47:28 UTC

Description of problem:
When the GnuTLS server has TLS 1.3 disabled, connections that negotiate TLS 1.0 or TLS 1.1 will not receive a downgrade sentinel in ServerHello random

Version-Release number of selected component (if applicable):
gnutls-3.6.8-1.el8

How reproducible:
always

Steps to Reproduce:
1. gnutls-serv --priority @SYSTEM:-VERS-TLS1.3 ...
2. tlsfuzzer/scripts/test-downgrade-protection.py --server-max-protocol=TLSv1.2
3.

Actual results:
AssertionError: Server failed to set downgrade protection sentinel in ServerHello.random value


Expected results:
test pass

Additional info: