discriminate Cloudflare TLS versions

app.py

@@ -538,25 +538,31 @@ async def transport_diagnostic():
             finally:
                 sock.close()
 
-            t0 = time.monotonic()
-            raw = socket.socket(family, socktype, proto)
-            raw.settimeout(3.0)
-            try:
-                raw.connect(sockaddr)
-                context = ssl.create_default_context()
-                with context.wrap_socket(raw, server_hostname=host) as tls_sock:
+            for tls_name, tls_version in (
+                ("TLSv1_2", ssl.TLSVersion.TLSv1_2),
+                ("TLSv1_3", ssl.TLSVersion.TLSv1_3),
+            ):
+                t0 = time.monotonic()
+                raw = socket.socket(family, socktype, proto)
+                raw.settimeout(3.0)
+                try:
+                    raw.connect(sockaddr)
+                    context = ssl.create_default_context()
+                    context.minimum_version = tls_version
+                    context.maximum_version = tls_version
+                    with context.wrap_socket(raw, server_hostname=host) as tls_sock:
+                        result["tls"].append({
+                            "family": label, "requested": tls_name, "ok": True,
+                            "version": tls_sock.version(),
+                            "elapsed_ms": round((time.monotonic() - t0) * 1000, 1),
+                        })
+                except Exception as exc:
                     result["tls"].append({
-                        "family": label, "ok": True,
-                        "version": tls_sock.version(),
+                        "family": label, "requested": tls_name, "ok": False,
+                        "error": type(exc).__name__,
                         "elapsed_ms": round((time.monotonic() - t0) * 1000, 1),
                     })
-            except Exception as exc:
-                result["tls"].append({
-                    "family": label, "ok": False,
-                    "error": type(exc).__name__,
-                    "elapsed_ms": round((time.monotonic() - t0) * 1000, 1),
-                })
-                raw.close()
+                    raw.close()
 
         result["dns_elapsed_ms"] = round((time.monotonic() - started) * 1000, 1)
 

test_transport_diag.py

@@ -18,3 +18,11 @@ class TransportDiagnosticRouteTest(unittest.TestCase):
 
 if __name__ == "__main__":
     unittest.main()
+
+
+class TransportDiagnosticTLSVersionTest(unittest.TestCase):
+    def test_probe_discriminates_tls12_and_tls13(self):
+        import inspect
+        source = inspect.getsource(app.transport_diagnostic)
+        self.assertIn("TLSv1_2", source)
+        self.assertIn("TLSv1_3", source)