Add TLS-SRP (RFC 5054) support

third_party/tlslite/tlslite/constants.py

 """Constants used in various places."""
 
 class CertificateType:
     x509 = 0
     openpgp = 1
     cryptoID = 2
 
 class ClientCertificateType:
     rsa_sign = 1
     dss_sign = 2
@@ skipping 12 matching lines @@
     client_key_exchange = 16
     finished = 20
 
 class ContentType:
     change_cipher_spec = 20
     alert = 21
     handshake = 22
     application_data = 23
     all = (20,21,22,23)
 
+class ClientHelloExtension:
+    srp = 12
+
 class AlertLevel:
     warning = 1
     fatal = 2
 
 class AlertDescription:
     """
     @cvar bad_record_mac: A TLS record failed to decrypt properly.
 
     If this occurs during a shared-key or SRP handshake it most likely
     indicates a bad password.  It may also indicate an implementation
@@ skipping 38 matching lines @@
     unknown_ca = 48
     access_denied = 49
     decode_error = 50
     decrypt_error = 51
     export_restriction = 60
     protocol_version = 70
     insufficient_security = 71
     internal_error = 80
     user_canceled = 90
     no_renegotiation = 100
-    unknown_srp_username = 120
-    missing_srp_username = 121
-    untrusted_srp_parameters = 122
+    unknown_psk_identity = 115
+    untrusted_srp_parameters = 122 # TODO(sqs): probably outdated wrt RFC 5054
 
 class CipherSuite:
-    TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA  = 0x0050
-    TLS_SRP_SHA_WITH_AES_128_CBC_SHA = 0x0053
-    TLS_SRP_SHA_WITH_AES_256_CBC_SHA = 0x0056
+    TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA  = 0xC01A
+    TLS_SRP_SHA_WITH_AES_128_CBC_SHA = 0xC01D
+    TLS_SRP_SHA_WITH_AES_256_CBC_SHA = 0xC020
 
-    TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA = 0x0051
-    TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA = 0x0054
-    TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA = 0x0057
+    TLS_SRP_SHA_RSA_WITH_3DES_EDE_CBC_SHA = 0xC01B
+    TLS_SRP_SHA_RSA_WITH_AES_128_CBC_SHA = 0xC01E
+    TLS_SRP_SHA_RSA_WITH_AES_256_CBC_SHA = 0xC021
+
+    # TODO(sqs): No SRP DSS cipher suites
 
     TLS_RSA_WITH_3DES_EDE_CBC_SHA = 0x000A
     TLS_RSA_WITH_AES_128_CBC_SHA = 0x002F
     TLS_RSA_WITH_AES_256_CBC_SHA = 0x0035
     TLS_RSA_WITH_RC4_128_SHA = 0x0005
 
     srpSuites = []
     srpSuites.append(TLS_SRP_SHA_WITH_3DES_EDE_CBC_SHA)
     srpSuites.append(TLS_SRP_SHA_WITH_AES_128_CBC_SHA)
     srpSuites.append(TLS_SRP_SHA_WITH_AES_256_CBC_SHA)
@@ skipping 82 matching lines @@
 
     badB = 201
     serverFaults = range(201,202)
 
     badFinished = 300
     badMAC = 301
     badPadding = 302
     genericFaults = range(300,303)
 
     faultAlerts = {\
-        badUsername: (AlertDescription.unknown_srp_username, \
-                      AlertDescription.bad_record_mac),\
+        badUsername: (AlertDescription.unknown_psk_identity, \
+                      AlertDescription.bad_record_mac, \
+                      AlertDescription.user_canceled),\
         badPassword: (AlertDescription.bad_record_mac,),\
         badA: (AlertDescription.illegal_parameter,),\
         badIdentifier: (AlertDescription.handshake_failure,),\
         badSharedKey: (AlertDescription.bad_record_mac,),\
         badPremasterPadding: (AlertDescription.bad_record_mac,),\
         shortPremasterSecret: (AlertDescription.bad_record_mac,),\
         badVerifyMessage: (AlertDescription.decrypt_error,),\
         badFinished: (AlertDescription.decrypt_error,),\
         badMAC: (AlertDescription.bad_record_mac,),\
         badPadding: (AlertDescription.bad_record_mac,)
         }
 
     faultNames = {\
         badUsername: "bad username",\
         badPassword: "bad password",\
         badA: "bad A",\
         badIdentifier: "bad identifier",\
         badSharedKey: "bad sharedkey",\
         badPremasterPadding: "bad premaster padding",\
         shortPremasterSecret: "short premaster secret",\
         badVerifyMessage: "bad verify message",\
         badFinished: "bad finished message",\
         badMAC: "bad MAC",\
         badPadding: "bad padding"
         }