Update third_party/tlslite to 0.4.8.

third_party/tlslite/tlslite/messages.py

 # Authors: 
 #   Trevor Perrin
 #   Google - handling CertificateRequest.certificate_types
 #   Google (adapted by Sam Rushing and Marcelo Fernandez) - NPN support
 #   Dimitris Moraitis - Anon ciphersuites
+#   Yngve Pettersen (ported by Paul Sokolovsky) - TLS 1.2
 #
 # See the LICENSE file for legal information regarding use of this file.
 
 """Classes representing TLS messages."""
 
 from .utils.compat import *
 from .utils.cryptomath import *
 from .errors import *
 from .utils.codec import *
 from .constants import *
@@ skipping 429 matching lines @@
         p.stopLengthCheck()
         return self
 
     def write(self):
         w = Writer()
         w.add(CertificateStatusType.ocsp, 1)
         w.addVarSeq(bytearray(self.ocsp_response), 1, 3)
         return self.postWrite(w)
 
 class CertificateRequest(HandshakeMsg):
-    def __init__(self):
+    def __init__(self, version):
         HandshakeMsg.__init__(self, HandshakeType.certificate_request)
         self.certificate_types = []
         self.certificate_authorities = []
+        self.version = version
+        self.supported_signature_algs = []
 
-    def create(self, certificate_types, certificate_authorities):
+    def create(self, certificate_types, certificate_authorities,
+               sig_algs=((HashAlgorithm.sha256, SignatureAlgorithm.rsa),)):
         self.certificate_types = certificate_types
         self.certificate_authorities = certificate_authorities
+        self.supported_signature_algs = sig_algs
         return self
 
     def parse(self, p):
         p.startLengthCheck(3)
         self.certificate_types = p.getVarList(1, 1)
+        if self.version >= (3,3):
+            self.supported_signature_algs = \
+                [(b >> 8, b & 0xff) for b in p.getVarList(2, 2)]
         ca_list_length = p.get(2)
         index = 0
         self.certificate_authorities = []
         while index != ca_list_length:
           ca_bytes = p.getVarBytes(2)
           self.certificate_authorities.append(ca_bytes)
           index += len(ca_bytes)+2
         p.stopLengthCheck()
         return self
 
     def write(self):
         w = Writer()
         w.addVarSeq(self.certificate_types, 1, 1)
+        if self.version >= (3,3):
+            w.add(2 * len(self.supported_signature_algs), 2)
+            for (hash, signature) in self.supported_signature_algs:
+                w.add(hash, 1)
+                w.add(signature, 1)
         caLength = 0
         #determine length
         for ca_dn in self.certificate_authorities:
             caLength += len(ca_dn)+2
         w.add(caLength, 2)
         #add bytes
         for ca_dn in self.certificate_authorities:
             w.addVarSeq(ca_dn, 1, 2)
         return self.postWrite(w)
 
 class ServerKeyExchange(HandshakeMsg):
-    def __init__(self, cipherSuite):
+    def __init__(self, cipherSuite, version):
         HandshakeMsg.__init__(self, HandshakeType.server_key_exchange)
         self.cipherSuite = cipherSuite
+        self.version = version
         self.srp_N = 0
         self.srp_g = 0
         self.srp_s = bytearray(0)
         self.srp_B = 0
         # Anon DH params:
         self.dh_p = 0
         self.dh_g = 0
         self.dh_Ys = 0
         self.signature = bytearray(0)
 
@@ skipping 38 matching lines @@
             w.addVarSeq(numberToByteArray(self.dh_g), 1, 2)
             w.addVarSeq(numberToByteArray(self.dh_Ys), 1, 2)
         else:
             assert(False)
         return w.bytes
 
     def write(self):
         w = Writer()
         w.bytes += self.write_params()
         if self.cipherSuite in CipherSuite.certAllSuites:
+            if self.version >= (3,3):
+                # TODO: Signature algorithm negotiation not supported.
+                w.add(HashAlgorithm.sha1, 1)
+                w.add(SignatureAlgorithm.rsa, 1)
             w.addVarSeq(self.signature, 1, 2)
         return self.postWrite(w)
 
     def hash(self, clientRandom, serverRandom):
         bytes = clientRandom + serverRandom + self.write_params()
+        if self.version >= (3,3):
+            # TODO: Signature algorithm negotiation not supported.
+            return SHA1(bytes)
         return MD5(bytes) + SHA1(bytes)
 
 class ServerHelloDone(HandshakeMsg):
     def __init__(self):
         HandshakeMsg.__init__(self, HandshakeType.server_hello_done)
 
     def create(self):
         return self
 
     def parse(self, p):
@@ skipping 23 matching lines @@
     
     def createDH(self, dh_Yc):
         self.dh_Yc = dh_Yc
         return self
     
     def parse(self, p):
         p.startLengthCheck(3)
         if self.cipherSuite in CipherSuite.srpAllSuites:
             self.srp_A = bytesToNumber(p.getVarBytes(2))
         elif self.cipherSuite in CipherSuite.certSuites:
-            if self.version in ((3,1), (3,2)):
+            if self.version in ((3,1), (3,2), (3,3)):
                 self.encryptedPreMasterSecret = p.getVarBytes(2)
             elif self.version == (3,0):
                 self.encryptedPreMasterSecret = \
                     p.getFixBytes(len(p.bytes)-p.index)
             else:
                 raise AssertionError()
         elif self.cipherSuite in CipherSuite.dhAllSuites:
             self.dh_Yc = bytesToNumber(p.getVarBytes(2))            
         else:
             raise AssertionError()
         p.stopLengthCheck()
         return self
 
     def write(self):
         w = Writer()
         if self.cipherSuite in CipherSuite.srpAllSuites:
             w.addVarSeq(numberToByteArray(self.srp_A), 1, 2)
         elif self.cipherSuite in CipherSuite.certSuites:
-            if self.version in ((3,1), (3,2)):
+            if self.version in ((3,1), (3,2), (3,3)):
                 w.addVarSeq(self.encryptedPreMasterSecret, 1, 2)
             elif self.version == (3,0):
                 w.addFixSeq(self.encryptedPreMasterSecret, 1)
             else:
                 raise AssertionError()
         elif self.cipherSuite in CipherSuite.anonSuites:
             w.addVarSeq(numberToByteArray(self.dh_Yc), 1, 2)            
         else:
             raise AssertionError()
         return self.postWrite(w)
 
 class CertificateVerify(HandshakeMsg):
     def __init__(self):
+        # TODO: This does not handle the SignatureAlgorithm in TLS 1.2.
         HandshakeMsg.__init__(self, HandshakeType.certificate_verify)
         self.signature = bytearray(0)
 
     def create(self, signature):
         self.signature = signature
         return self
 
     def parse(self, p):
         p.startLengthCheck(3)
         self.signature = p.getVarBytes(2)
@@ skipping 56 matching lines @@
         self.verify_data = bytearray(0)
 
     def create(self, verify_data):
         self.verify_data = verify_data
         return self
 
     def parse(self, p):
         p.startLengthCheck(3)
         if self.version == (3,0):
             self.verify_data = p.getFixBytes(36)
-        elif self.version in ((3,1), (3,2)):
+        elif self.version in ((3,1), (3,2), (3,3)):
             self.verify_data = p.getFixBytes(12)
         else:
             raise AssertionError()
         p.stopLengthCheck()
         return self
 
     def write(self):
         w = Writer()
         w.addFixSeq(self.verify_data, 1)
         return self.postWrite(w)
@@ skipping 33 matching lines @@
         newMsg = ApplicationData().create(self.bytes[:1])
         self.bytes = self.bytes[1:]
         return newMsg
 
     def parse(self, p):
         self.bytes = p.bytes
         return self
 
     def write(self):
         return self.bytes