Require ECDHE for False Start.

Require ECDHE for False Start.

This adds just enough of an implementation of ECDHE_RSA to tlslite to
support it on the server side.

It also rolls BoringSSL e2e1326..4d78718 to pick up the corresponding
BoringSSL change. Summary of changes available at:

https://boringssl.googlesource.com/boringssl/+log/e2e1326..4d78718

BUG=460271
Committed: https://crrev.com/8f7efab800fc6987499c5365fce22349e3a4ef50
Cr-Commit-Position: refs/heads/master@{#323645}

[davidben, 2015-04-02 00:03:59]

davidben@chromium.org changed reviewers:
+ agl@chromium.org, rsleevi@chromium.org

[davidben, 2015-04-02 00:04:00]

Tests are expected to fail on BoringSSL ports right now. I'll update it later to
roll in https://boringssl-review.googlesource.com/#/c/4192/ atomically.

[davidben, 2015-04-02 00:20:36]

https://codereview.chromium.org/1057733002/diff/1/third_party/tlslite/tlslite...
File third_party/tlslite/tlslite/utils/p256.py (right):

https://codereview.chromium.org/1057733002/diff/1/third_party/tlslite/tlslite...
third_party/tlslite/tlslite/utils/p256.py:2: # See the LICENSE file for legal
information regarding use of this file.
FYI, Adam, I reindented and changed a few names on your code just to fit a
little better with tlslite's style.

[agl, 2015-04-02 00:36:43]

LGTM.

(Have just landed the BoringSSL change.)

https://codereview.chromium.org/1057733002/diff/1/net/ssl/ssl_cipher_suite_na...
File net/ssl/ssl_cipher_suite_names.cc (right):

https://codereview.chromium.org/1057733002/diff/1/net/ssl/ssl_cipher_suite_na...
net/ssl/ssl_cipher_suite_names.cc:307: int key_exchange;
these could all be one line.

https://codereview.chromium.org/1057733002/diff/1/net/ssl/ssl_cipher_suite_na...
net/ssl/ssl_cipher_suite_names.cc:363: int key_exchange;
ditto.

https://codereview.chromium.org/1057733002/diff/1/net/ssl/ssl_cipher_suite_na...
net/ssl/ssl_cipher_suite_names.cc:396: int key_exchange;
ditto.

[Ryan Sleevi, 2015-04-02 00:42:58]

LGTM % nit

https://codereview.chromium.org/1057733002/diff/1/net/socket/ssl_client_socke...
File net/socket/ssl_client_socket_unittest.cc (right):

https://codereview.chromium.org/1057733002/diff/1/net/socket/ssl_client_socke...
net/socket/ssl_client_socket_unittest.cc:2936: // Test that False Start is
disabled without perfect forward secrecy.
Is this comment correct? DHE is PFS

[davidben, 2015-04-02 16:48:31]

Also rolled forward to incorporate BoringSSL changes. Will CQ once try bots are
green. (There's a chance they won't be since this also picked up my C++-ing of
boringssl_unittests.)

https://codereview.chromium.org/1057733002/diff/1/net/socket/ssl_client_socke...
File net/socket/ssl_client_socket_unittest.cc (right):

https://codereview.chromium.org/1057733002/diff/1/net/socket/ssl_client_socke...
net/socket/ssl_client_socket_unittest.cc:2936: // Test that False Start is
disabled without perfect forward secrecy.
On 2015/04/02 00:42:58, Ryan Sleevi wrote:
> Is this comment correct? DHE is PFS

Done.

https://codereview.chromium.org/1057733002/diff/1/net/ssl/ssl_cipher_suite_na...
File net/ssl/ssl_cipher_suite_names.cc (right):

https://codereview.chromium.org/1057733002/diff/1/net/ssl/ssl_cipher_suite_na...
net/ssl/ssl_cipher_suite_names.cc:307: int key_exchange;
On 2015/04/02 00:36:43, agl wrote:
> these could all be one line.

Done.

https://codereview.chromium.org/1057733002/diff/1/net/ssl/ssl_cipher_suite_na...
net/ssl/ssl_cipher_suite_names.cc:363: int key_exchange;
On 2015/04/02 00:36:43, agl wrote:
> ditto.

Done.

https://codereview.chromium.org/1057733002/diff/1/net/ssl/ssl_cipher_suite_na...
net/ssl/ssl_cipher_suite_names.cc:396: int key_exchange;
On 2015/04/02 00:36:43, agl wrote:
> ditto.

Done.

[davidben, 2015-04-02 18:30:43]

Looks like inttypes.h + C++ makes Android grumpy.
https://boringssl-review.googlesource.com/#/c/4202/ should fix it.

[agl, 2015-04-02 18:42:07]

lgtm

[davidben, 2015-04-02 19:07:19]

The CQ bit was checked by davidben@chromium.org

[davidben, 2015-04-02 19:07:19]

The patchset sent to the CQ was uploaded after l-g-t-m from
rsleevi@chromium.org, agl@chromium.org
Link to the patchset: https://codereview.chromium.org/1057733002/#ps40001
(title: "roll just a little further")

[commit-bot: I haz the power, 2015-04-02 19:09:29]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1057733002/40001

[commit-bot: I haz the power, 2015-04-02 20:09:14]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-04-02 20:09:16]

Try jobs failed on following builders:
  android_clang_dbg_recipe on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/android_clang_d...)

[davidben, 2015-04-02 20:41:32]

The CQ bit was checked by davidben@chromium.org

[davidben, 2015-04-02 20:41:32]

The patchset sent to the CQ was uploaded after l-g-t-m from agl@chromium.org,
rsleevi@chromium.org
Link to the patchset: https://codereview.chromium.org/1057733002/#ps60001
(title: "fix components build")

[commit-bot: I haz the power, 2015-04-02 20:42:29]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1057733002/60001

[commit-bot: I haz the power, 2015-04-02 21:06:18]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2015-04-02 21:06:19]

Try jobs failed on following builders:
  linux_chromium_gn_rel on tryserver.chromium.linux (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

[davidben, 2015-04-02 21:11:04]

On 2015/04/02 21:06:19, I haz the power (commit-bot) wrote:
> Try jobs failed on following builders:
>   linux_chromium_gn_rel on tryserver.chromium.linux (JOB_FAILED,
>
http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_...)

Retrying. That one doesn't look like me for a change.

[davidben, 2015-04-02 21:11:09]

The CQ bit was checked by davidben@chromium.org

[commit-bot: I haz the power, 2015-04-02 21:14:05]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1057733002/60001

[commit-bot: I haz the power, 2015-04-03 05:39:29]

Committed patchset #4 (id:60001)

[alph, 2015-04-03 08:06:20]

A revert of this CL (patchset #4 id:60001) has been created in
https://codereview.chromium.org/1055683005/ by alph@chromium.org.

The reason for reverting is: Suspecting guilty for broken Win link:
http://build.chromium.org/p/chromium.win/builders/Win8%20GN/builds/5998.

[davidben, 2015-04-03 17:06:09]

On 2015/04/03 08:06:20, alph wrote:
> A revert of this CL (patchset #4 id:60001) has been created in
> https://codereview.chromium.org/1055683005/ by mailto:alph@chromium.org.
> 
> The reason for reverting is: Suspecting guilty for broken Win link:
> http://build.chromium.org/p/chromium.win/builders/Win8%20GN/builds/5998.

Looks like the new thread-local storage bits cause a symbol collision on
Windows. This should fix it:
https://boringssl-review.googlesource.com/#/c/4217/

[commit-bot: I haz the power, 2015-04-03 20:33:16]

Patchset 4 (id:??) landed as
https://crrev.com/8f7efab800fc6987499c5365fce22349e3a4ef50
Cr-Commit-Position: refs/heads/master@{#323645}