Fix extended master secret implementation in tlslite

third_party/tlslite/patches/extended_master_secret.patch

 diff --git a/third_party/tlslite/tlslite/constants.py b/third_party/tlslite/tlslite/constants.py
 index 6d78a20..f9c8676 100644
 --- a/third_party/tlslite/tlslite/constants.py
 +++ b/third_party/tlslite/tlslite/constants.py
 @@ -55,6 +55,7 @@ class ExtensionType:    # RFC 6066 / 4366
      srp = 12            # RFC 5054  
      cert_type = 9       # RFC 6091
      signed_cert_timestamps = 18  # RFC 6962
 +    extended_master_secret = 23  # draft-ietf-tls-session-hash-06
      tack = 0xF300
      supports_npn = 13172
      channel_id = 30032
 diff --git a/third_party/tlslite/tlslite/handshakesettings.py b/third_party/tlslite/tlslite/handshakesettings.py
-index 605ed42..7679823 100644
+index 605ed42..a7b6ab9 100644
 --- a/third_party/tlslite/tlslite/handshakesettings.py
 +++ b/third_party/tlslite/tlslite/handshakesettings.py
 @@ -111,6 +111,10 @@ class HandshakeSettings(object):
      @type alertAfterHandshake: bool
      @ivar alertAfterHandshake: If true, the server will send a fatal
      alert immediately after the handshake completes.
 +
 +    @type enableExtendedMasterSecret: bool
 +    @ivar enableExtendedMasterSecret: If true, the server supports the extended
 +    master secret TLS extension and will negotiated it with supporting clients.
      
      Note that TACK support is not standardized by IETF and uses a temporary
      TLS Extension number, so should NOT be used in production software.
 @@ -129,6 +133,7 @@ class HandshakeSettings(object):
          self.tlsIntoleranceType = 'alert'
          self.useExperimentalTackExtension = False
          self.alertAfterHandshake = False
 +        self.enableExtendedMasterSecret = True
  
      # Validates the min/max fields, and certificateTypes
      # Filters out unsupported cipherNames and cipherImplementations
+@@ -146,6 +151,7 @@ class HandshakeSettings(object):
+         other.tlsIntolerant = self.tlsIntolerant
+         other.tlsIntoleranceType = self.tlsIntoleranceType
+         other.alertAfterHandshake = self.alertAfterHandshake
++        other.enableExtendedMasterSecret = self.enableExtendedMasterSecret
+ 
+         if not cipherfactory.tripleDESPresent:
+             other.cipherNames = [e for e in self.cipherNames if e != "3des"]
 diff --git a/third_party/tlslite/tlslite/mathtls.py b/third_party/tlslite/tlslite/mathtls.py
 index 60a331a..0a23fe1 100644
 --- a/third_party/tlslite/tlslite/mathtls.py
 +++ b/third_party/tlslite/tlslite/mathtls.py
 @@ -67,16 +67,20 @@ def PRF_SSL(secret, seed, length):
              index += 1
      return bytes
  
 -def calcMasterSecret(version, premasterSecret, clientRandom, serverRandom):
 +def calcMasterSecret(version, premasterSecret, clientRandom, serverRandom,
@@ skipping 167 matching lines @@
 @@ -1256,3 +1260,9 @@ class TLSRecordLayer(object):
  
          return md5Bytes + shaBytes
  
 +    def _getHandshakeHash(self):
 +        if self.version in ((3,1), (3,2)):
 +            return self._handshake_md5.digest() + \
 +                self._handshake_sha.digest()
 +        elif self.version == (3,3):
 +            return self._handshake_sha256.digest()