Add a new GetTlsUniqueChannelBinding method to SSLSocket, and implement nss version.

net/socket/ssl_socket.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_SOCKET_SSL_SOCKET_H_
 #define NET_SOCKET_SSL_SOCKET_H_
 
 #include "base/basictypes.h"
 #include "base/string_piece.h"
 #include "net/socket/stream_socket.h"
 
 namespace net {
 
 // SSLSocket interface defines method that are common between client
 // and server SSL sockets.
 class NET_EXPORT SSLSocket : public StreamSocket {
 public:
   virtual ~SSLSocket() {}
 
   // Exports data derived from the SSL master-secret (see RFC 5705).
   // If |has_context| is false, uses the no-context construction from the
   // RFC and |context| is ignored.  The call will fail with an error if
   // the socket is not connected or the SSL implementation does not
   // support the operation.
   virtual int ExportKeyingMaterial(const base::StringPiece& label,
                                    bool has_context,
                                    const base::StringPiece& context,
                                    unsigned char* out,
                                    unsigned int outlen) = 0;
+
+  // Returns the tls-unique channel bindings (see RFC 5929).
+  // At most, |outlen_max| bytes will be written to |out|.  The
+  // actual number of bytes written will be set in |outlen|.

[wtc, 2012/07/30 20:05:08]

Nit: remove the comma after "At most".  Add '*' before outlen.

[Ryan Hamilton, 2012/07/30 21:37:58]

Done.

+  virtual int GetTlsUniqueChannelBinding(unsigned char* out,

[wtc, 2012/07/30 20:05:08]

Please spell "TLS" in all caps.

History: our Style Guide does not mandate how abbreviations
should be spelled in function or class names.  The base and
net components followed the WebKit/Apple style of spelling
abbreviations in all caps.  This style isn't consistently
followed in net (for example, HTTP is often spelled "Http").

It may be better to define this method as
GetChannelBinding, which takes the channel binding type
(specified an enum or a string) as an input argument.
We can do this later when we need to use another channel
binding type.

[Ryan Hamilton, 2012/07/30 21:37:58]

Done.

+                                         unsigned int *outlen,
+                                         unsigned int outlen_max) = 0;

[wtc, 2012/07/30 20:05:08]

We probably should just use a
  std::string* out
output argument.  At least, use size_t instead of
unsigned int as the type of length.  But I noticed that
the existing ExportKeyingMaterial method above is already
using 'unsigned int' as the type of length.  (The use
of unsigned int for lengths is an NSS-ism.)

[Ryan Hamilton, 2012/07/30 21:37:58]

Done.

 };
 
 }  // namespace net
 
 #endif  // NET_SOCKET_SSL_SOCKET_H_