[dev.power64] code review 160200044: build: merge default into dev.power64

src/pkg/crypto/tls/conn.go

 // Copyright 2010 The Go Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
 // TLS low level connection and record layer
 
 package tls
 
 import (
         "bytes"
@@ skipping 24 matching lines @@
         handshakeComplete bool
         didResume         bool // whether this connection was a session resumption
         cipherSuite       uint16
         ocspResponse      []byte // stapled OCSP response
         peerCertificates  []*x509.Certificate
         // verifiedChains contains the certificate chains that we built, as
         // opposed to the ones presented by the server.
         verifiedChains [][]*x509.Certificate
         // serverName contains the server name indicated by the client, if any.
         serverName string
+        // firstFinished contains the first Finished hash sent during the
+        // handshake. This is the "tls-unique" channel binding value.
+        firstFinished [12]byte
 
         clientProtocol         string
         clientProtocolFallback bool
 
         // input/output
         in, out  halfConn     // in.Mutex < out.Mutex
         rawInput *block       // raw input, right off the wire
         input    *block       // application data waiting to be read
         hand     bytes.Buffer // handshake data waiting to be read
 
@@ skipping 932 matching lines @@
         state.HandshakeComplete = c.handshakeComplete
         if c.handshakeComplete {
                 state.Version = c.vers
                 state.NegotiatedProtocol = c.clientProtocol
                 state.DidResume = c.didResume
                 state.NegotiatedProtocolIsMutual = !c.clientProtocolFallback
                 state.CipherSuite = c.cipherSuite
                 state.PeerCertificates = c.peerCertificates
                 state.VerifiedChains = c.verifiedChains
                 state.ServerName = c.serverName
+                if !c.didResume {
+                        state.TLSUnique = c.firstFinished[:]
+                }
         }
 
         return state
 }
 
 // OCSPResponse returns the stapled OCSP response from the TLS server, if
 // any. (Only valid for client connections.)
 func (c *Conn) OCSPResponse() []byte {
         c.handshakeMutex.Lock()
         defer c.handshakeMutex.Unlock()
 
         return c.ocspResponse
 }
 
 // VerifyHostname checks that the peer certificate chain is valid for
 // connecting to host.  If so, it returns nil; if not, it returns an error
 // describing the problem.
 func (c *Conn) VerifyHostname(host string) error {
         c.handshakeMutex.Lock()
         defer c.handshakeMutex.Unlock()
         if !c.isClient {
                 return errors.New("tls: VerifyHostname called on TLS server connection")
         }
         if !c.handshakeComplete {
                 return errors.New("tls: handshake has not yet been performed")
         }
         return c.peerCertificates[0].VerifyHostname(host)
 }