Update Token Binding code to the latest drafts

third_party/tlslite/tlslite/messages.py

 # Authors: 
 #   Trevor Perrin
 #   Google - handling CertificateRequest.certificate_types
 #   Google (adapted by Sam Rushing and Marcelo Fernandez) - NPN support
 #   Dimitris Moraitis - Anon ciphersuites
 #   Yngve Pettersen (ported by Paul Sokolovsky) - TLS 1.2
 #
 # See the LICENSE file for legal information regarding use of this file.
 
 """Classes representing TLS messages."""
@@ skipping 122 matching lines @@
         self.srp_username = None        # a string
         self.tack = False
         self.alpn_protos_advertised = None
         self.supports_npn = False
         self.server_name = bytearray(0)
         self.channel_id = False
         self.extended_master_secret = False
         self.tb_client_params = []
         self.support_signed_cert_timestamps = False
         self.status_request = False
+        self.ri = False
 
     def create(self, version, random, session_id, cipher_suites,
                certificate_types=None, srpUsername=None,
                tack=False, alpn_protos_advertised=None,
                supports_npn=False, serverName=None):
         self.client_version = version
         self.random = random
         self.session_id = session_id
         self.cipher_suites = cipher_suites
         self.certificate_types = certificate_types
@@ skipping 63 matching lines @@
                                 break
                     elif extType == ExtensionType.channel_id:
                         self.channel_id = True
                     elif extType == ExtensionType.extended_master_secret:
                         self.extended_master_secret = True
                     elif extType == ExtensionType.token_binding:
                         tokenBindingBytes = p.getFixBytes(extLength)
                         p2 = Parser(tokenBindingBytes)
                         ver_minor = p2.get(1)
                         ver_major = p2.get(1)
-                        if (ver_major, ver_minor) >= (0, 6):
+                        if (ver_major, ver_minor) >= (0, 10):
                             p2.startLengthCheck(1)
                             while not p2.atLengthCheck():
                                 self.tb_client_params.append(p2.get(1))
                     elif extType == ExtensionType.signed_cert_timestamps:
                         if extLength:
                             raise SyntaxError()
                         self.support_signed_cert_timestamps = True
                     elif extType == ExtensionType.status_request:
                         # Extension contents are currently ignored.
                         # According to RFC 6066, this is not strictly forbidden
                         # (although it is suboptimal):
                         # Servers that receive a client hello containing the
                         # "status_request" extension MAY return a suitable
                         # certificate status response to the client along with
                         # their certificate.  If OCSP is requested, they
                         # SHOULD use the information contained in the extension
                         # when selecting an OCSP responder and SHOULD include
                         # request_extensions in the OCSP request.
                         p.getFixBytes(extLength)
                         self.status_request = True
+                    elif extType == ExtensionType.renegotiation_info:
+                        # We don't support renegotiation, so if we receive this
+                        # extension, it should contain a single null byte.
+                        if extLength != 1 or p.getFixBytes(extLength)[0] != 0:
+                            raise SyntaxError()
+                        self.ri = True
                     else:
                         _ = p.getFixBytes(extLength)
                     index2 = p.index
                     if index2 - index1 != extLength:
                         raise SyntaxError("Bad length for extension_data")
                     soFar += 4 + extLength
+            if CipherSuite.TLS_EMPTY_RENEGOTIATION_INFO_SCSV in self.cipher_suites:
+                self.ri = True
             p.stopLengthCheck()
         return self
 
     def write(self):
         w = Writer()
         w.add(self.client_version[0], 1)
         w.add(self.client_version[1], 1)
         w.addFixSeq(self.random, 1)
         w.addVarSeq(self.session_id, 1, 1)
         w.addVarSeq(self.cipher_suites, 2, 2)
@@ skipping 57 matching lines @@
         self.compression_method = 0
         self.tackExt = None
         self.alpn_proto_selected = None
         self.next_protos_advertised = None
         self.next_protos = None
         self.channel_id = False
         self.extended_master_secret = False
         self.tb_params = None
         self.signed_cert_timestamps = None
         self.status_request = False
+        self.send_ri = False
 
     def create(self, version, random, session_id, cipher_suite,
                certificate_type, tackExt, alpn_proto_selected,
                next_protos_advertised):
         self.server_version = version
         self.random = random
         self.session_id = session_id
         self.cipher_suite = cipher_suite
         self.certificate_type = certificate_type
         self.compression_method = 0
@@ skipping 74 matching lines @@
             w2.add(0, 2)
         if self.extended_master_secret:
             w2.add(ExtensionType.extended_master_secret, 2)
             w2.add(0, 2)
         if self.tb_params:
             w2.add(ExtensionType.token_binding, 2)
             # length of extension
             w2.add(4, 2)
             # version
             w2.add(0, 1)
-            w2.add(6, 1)
+            w2.add(10, 1)
             # length of params (defined as variable length <1..2^8-1>, but in
             # this context the server can only send a single value.
             w2.add(1, 1)
             w2.add(self.tb_params, 1)
         if self.signed_cert_timestamps:
             w2.add(ExtensionType.signed_cert_timestamps, 2)
             w2.addVarSeq(bytearray(self.signed_cert_timestamps), 1, 2)
         if self.status_request:
             w2.add(ExtensionType.status_request, 2)
             w2.add(0, 2)
+        if self.send_ri:
+            w2.add(ExtensionType.renegotiation_info, 2)
+            w2.add(1, 2)
+            w2.add(0, 1)
         if len(w2.bytes):
             w.add(len(w2.bytes), 2)
             w.bytes += w2.bytes        
         return self.postWrite(w)
 
 
 class Certificate(HandshakeMsg):
     def __init__(self, certificateType):
         HandshakeMsg.__init__(self, HandshakeType.certificate)
         self.certificateType = certificateType
@@ skipping 419 matching lines @@
         newMsg = ApplicationData().create(self.bytes[:1])
         self.bytes = self.bytes[1:]
         return newMsg
 
     def parse(self, p):
         self.bytes = p.bytes
         return self
 
     def write(self):
         return self.bytes