Get channel binding binding information for TLS connection

[fedor-brunner]

Channel Bindings for TLS (RFC 5929, RFC 5056). Channel Bindings for TLS is very usefull because it can be used to detect MiTM attacks when the attacker is using valid certificates (certificates signed by Certification Authority).

For example: if a XMPP client is connecting to a XMPP server and the SCRAM-SHA-1-PLUS authentication mechanism is used during login (RFC 5802), the login will fail in the presence of MiTM attacker, because the TLS channel binding data is used in calculation of password hashes.

The method get_channel_binding supports only "tls-unique" channel binding. It can used the same way as get_channel_binding() in Python 3 ssl module.
http://docs.python.org/3/library/ssl.html

[exarkun]

All pyOpenSSL APIs should have a docstring explaining what they are for, what their parameters mean, and what they return and raise.

Also please expand abbreviations. I think that "cb" is short for "channel binding"? You can probably just call this "type" here. Alternatively, "channel_binding_type" or "binding_type".

Also please declare a constant for magic strings like "tls-unique" so that applications don't have to be careful to spell a string literal just right.

[exarkun]

Thanks. I've left some inline comments. Two more things:

• the build is failing on travis - apparently because these APIs have not yet been added to cryptography.
• Please also add howto-style documentation (in the doc directory) for any new APIs.

Thanks again!

[fedor-brunner]

The code in cryptography has been merged only recently
pyca/cryptography#686
I wanted to make the code compatible with Python 3 ssl module, but I will change the code to wrappers of session_reused, get_finished, and get_peer_finished . Then get_channel_binding() can be implemented directly in application.

http://docs.python.org/3/library/ssl.html#ssl.SSLSocket.get_channel_binding