Add TLS-SRP (RFC 5054) support

third_party/tlslite/tlslite/TLSConnection.py

Index: third_party/tlslite/tlslite/TLSConnection.py
diff --git a/third_party/tlslite/tlslite/TLSConnection.py b/third_party/tlslite/tlslite/TLSConnection.py
index 7e38a2326877d69411eb449c87f7062fa751f958..4948683f7d8785609e4ed93cac0a65fb21c673ef 100644
--- a/third_party/tlslite/tlslite/TLSConnection.py
+++ b/third_party/tlslite/tlslite/TLSConnection.py
@@ -514,7 +514,7 @@ class TLSConnection(TLSRecordLayer):
         for result in self._sendMsg(clientHello):
             yield result
 
-        #Get ServerHello (or missing_srp_username)
+        #Get ServerHello (or unknown_psk_identity)
         for result in self._getMsg((ContentType.handshake,
                                   ContentType.alert),
                                   HandshakeType.server_hello):
@@ -529,20 +529,17 @@ class TLSConnection(TLSRecordLayer):
         elif isinstance(msg, Alert):
             alert = msg
 
-            #If it's not a missing_srp_username, re-raise
-            if alert.description != AlertDescription.missing_srp_username:
+            #If it's not a unknown_psk_identity, re-raise
+            if alert.description != AlertDescription.unknown_psk_identity:
                 self._shutdown(False)
                 raise TLSRemoteAlert(alert)
 
-            #If we're not in SRP callback mode, we won't have offered SRP
-            #without a username, so we shouldn't get this alert
-            if not srpCallback:
-                for result in self._sendError(\
-                                AlertDescription.unexpected_message):
-                    yield result
-            srpParams = srpCallback()
-            #If the callback returns None, cancel the handshake
-            if srpParams == None:
+            #Our SRP credentials were wrong, so try getting new ones.
+            if srpCallback:
+                srpParams = srpCallback()
+
+            #If we can't get different credentials, cancel the handshake
+            if srpParams == None or not srpCallback:
                 for result in self._sendError(AlertDescription.user_canceled):
                     yield result
 
@@ -1259,8 +1256,8 @@ class TLSConnection(TLSRecordLayer):
 
                 #Ask the client to re-send ClientHello with one
                 for result in self._sendMsg(Alert().create(\
-                        AlertDescription.missing_srp_username,
-                        AlertLevel.warning)):
+                        AlertDescription.unknown_psk_identity,
+                        AlertLevel.fatal)):
                     yield result
 
                 #Get ClientHello
@@ -1323,7 +1320,7 @@ class TLSConnection(TLSRecordLayer):
                 entry = verifierDB[self.allegedSrpUsername]
             except KeyError:
                 for result in self._sendError(\
-                        AlertDescription.unknown_srp_username):
+                        AlertDescription.unknown_psk_identity):
                     yield result
             (N, g, s, v) = entry