Implement extended master secret in tlslite (again)

third_party/tlslite/tlslite/tlsrecordlayer.py

 # Authors: 
 #   Trevor Perrin
 #   Google (adapted by Sam Rushing) - NPN support
 #   Martin von Loewis - python 3 port
 #   Yngve Pettersen (ported by Paul Sokolovsky) - TLS 1.2
 #
 # See the LICENSE file for legal information regarding use of this file.
 
 """Helper class for TLSConnection."""
 from __future__ import generators
@@ skipping 101 matching lines @@
 
         #Buffers for processing messages
         self._handshakeBuffer = []
         self.clearReadBuffer()
         self.clearWriteBuffer()
 
         #Handshake digests
         self._handshake_md5 = hashlib.md5()
         self._handshake_sha = hashlib.sha1()
         self._handshake_sha256 = hashlib.sha256()
+        self._ems_handshake_hash = b""
 
         #TLS Protocol Version
         self.version = (0,0) #read-only
         self._versionCheck = False #Once we choose a version, this is True
 
         #Current and Pending connection states
         self._writeState = _ConnectionState()
         self._readState = _ConnectionState()
         self._pendingWriteState = _ConnectionState()
         self._pendingReadState = _ConnectionState()
@@ skipping 675 matching lines @@
                     if subType not in secondaryType:
                         for result in self._sendError(\
                                 AlertDescription.unexpected_message,
                                 "Expecting %s, got %s" % (str(secondaryType), subType)):
                             yield result
 
                 #Update handshake hashes
                 self._handshake_md5.update(compat26Str(p.bytes))
                 self._handshake_sha.update(compat26Str(p.bytes))
                 self._handshake_sha256.update(compat26Str(p.bytes))
+                if subType == HandshakeType.client_key_exchange:
+                    self._ems_handshake_hash = self._getHandshakeHash()

[davidben, 2015/08/20 15:31:46]

Oh. That was the problem. Right. The dumb thing where the spec is unclear about
when to sample.

I think this would be better if the key exchange code gave you the master
secret, rather than the premaster, and then you don't need to save it. But the
way this code is organized, that would be kind of a mess with all the useless
key exchanges supported, so this is probably the easiest. I'm not going to ask
you to refactor this monster. :-)

Upstream would (rightly) complain, but I've mostly given up on trying to
upstream our patches. The code is too much of a mess and I don't really have the
time to rewrite it. :-)

 
                 #Parse based on handshake type
                 if subType == HandshakeType.client_hello:
                     yield ClientHello(recordHeader.ssl2).parse(p)
                 elif subType == HandshakeType.server_hello:
                     yield ServerHello().parse(p)
                 elif subType == HandshakeType.certificate:
                     yield Certificate(constructorType).parse(p)
                 elif subType == HandshakeType.certificate_request:
                     yield CertificateRequest(self.version).parse(p)
@@ skipping 278 matching lines @@
 
         yield b
 
     def _handshakeStart(self, client):
         if not self.closed:
             raise ValueError("Renegotiation disallowed for security reasons")
         self._client = client
         self._handshake_md5 = hashlib.md5()
         self._handshake_sha = hashlib.sha1()
         self._handshake_sha256 = hashlib.sha256()
+        self._ems_handshake_hash = b""
         self._handshakeBuffer = []
         self.allegedSrpUsername = None
         self._refCount = 1
 
     def _handshakeDone(self, resumed):
         self.resumed = resumed
         self.closed = False
 
     def _calcPendingStates(self, cipherSuite, masterSecret,
             clientRandom, serverRandom, implementations):
@@ skipping 124 matching lines @@
         imac_md5.update(compatHMAC(label + masterSecret + bytearray([0x36]*48)))
         imac_sha.update(compatHMAC(label + masterSecret + bytearray([0x36]*40)))
 
         md5Bytes = MD5(masterSecret + bytearray([0x5c]*48) + \
                          bytearray(imac_md5.digest()))
         shaBytes = SHA1(masterSecret + bytearray([0x5c]*40) + \
                          bytearray(imac_sha.digest()))
 
         return md5Bytes + shaBytes
 
+    def _getHandshakeHash(self):
+        if self.version in ((3,1), (3,2)):
+            return self._handshake_md5.digest() + \
+                self._handshake_sha.digest()
+        elif self.version == (3,3):
+            return self._handshake_sha256.digest()