Set Token-Binding HTTP header

third_party/tlslite/tlslite/tlsconnection.py

 # Authors: 
 #   Trevor Perrin
 #   Google - added reqCAs parameter
 #   Google (adapted by Sam Rushing and Marcelo Fernandez) - NPN support
 #   Dimitris Moraitis - Anon ciphersuites
 #   Martin von Loewis - python 3 port
 #   Yngve Pettersen (ported by Paul Sokolovsky) - TLS 1.2
 #
 # See the LICENSE file for legal information regarding use of this file.
 
@@ skipping 591 matching lines @@
                             serverHello.random,
                             cipherSuite, settings.cipherImplementations,
                             nextProto):
                 if result in (0,1): yield result
                 else: break
         masterSecret = result
         
         # Create the session object which is used for resumptions
         self.session = Session()
         self.session.create(masterSecret, serverHello.session_id, cipherSuite,
-            srpUsername, clientCertChain, serverCertChain,
-            tackExt, serverHello.tackExt!=None, serverName)
+            srpUsername, clientCertChain, serverCertChain, clientHello.random,
+            serverHello.random, tackExt, serverHello.tackExt!=None, serverName)
         self._handshakeDone(resumed=False)
 
 
     def _clientSendClientHello(self, settings, session, srpUsername,
                                 srpParams, certParams, anonParams, 
                                 serverName, nextProtos, reqTack):
         #Initialize acceptable ciphersuites
         cipherSuites = [CipherSuite.TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
         if srpParams:
             cipherSuites += CipherSuite.getSrpAllSuites(settings)
@@ skipping 780 matching lines @@
             serverCertChain = certChain
         else:
             serverCertChain = None
         srpUsername = None
         serverName = None
         if clientHello.srp_username:
             srpUsername = clientHello.srp_username.decode("utf-8")
         if clientHello.server_name:
             serverName = clientHello.server_name.decode("utf-8")
         self.session.create(masterSecret, serverHello.session_id, cipherSuite,
-            srpUsername, clientCertChain, serverCertChain,
-            tackExt, serverHello.tackExt!=None, serverName)
+            srpUsername, clientCertChain, serverCertChain, clientHello.random,
+            serverHello.random, tackExt, serverHello.tackExt!=None, serverName)
             
         #Add the session object to the session cache
         if sessionCache and sessionID:
             sessionCache[sessionID] = self.session
 
         self._handshakeDone(resumed=False)
 
 
     def _serverGetClientHello(self, settings, certChain, verifierDB,
                                 sessionCache, anon, fallbackSCSV):
@@ skipping 103 matching lines @@
             #If a session is found..
             if session:
                 #Send ServerHello
                 serverHello = ServerHello()
                 serverHello.create(self.version, getRandomBytes(32),
                                    session.sessionID, session.cipherSuite,
                                    CertificateType.x509, None, None)
                 serverHello.extended_master_secret = \
                     clientHello.extended_master_secret and \
                     settings.enableExtendedMasterSecret
+                for param in clientHello.tb_client_params:
+                    if param in settings.supportedTokenBindingParams:
+                          serverHello.tb_params = param
+                          break
                 for result in self._sendMsg(serverHello):
                     yield result
 
                 #From here on, the client's messages must have right version
                 self._versionCheck = True
 
                 #Calculate pending connection states
                 self._calcPendingStates(session.cipherSuite, 
                                         session.masterSecret,
                                         clientHello.random, 
@@ skipping 457 matching lines @@
             except TLSAlert as alert:
                 if not self.fault:
                     raise
                 if alert.description not in Fault.faultAlerts[self.fault]:
                     raise TLSFaultError(str(alert))
                 else:
                     pass
             except:
                 self._shutdown(False)
                 raise