Roll src/third_party/boringssl/src 3cab5572b..95c6956

Roll src/third_party/boringssl/src 3cab5572b..95c6956

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc30dc8d21b2a4bd..95c69563dc5422c3b3cd3a0bf435944a7530a12d

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none

Committed: https://crrev.com/0653c8d1980d98cbf099a9c4306412ba59b721bb
Cr-Commit-Position: refs/heads/master@{#404310}

[davidben, 2016-06-29 19:21:46]

davidben@chromium.org changed reviewers:
+ mpearson@chromium.org, svaldez@chromium.org

[davidben, 2016-06-29 19:21:47]

Sending this out for review now since I'd already put it together, but I won't
land until after branch point since rolling BoringSSL just before branch seems
bad manners.

mpearson for histograms.xml.

https://codereview.chromium.org/2108153003/diff/1/tools/metrics/histograms/hi...
File tools/metrics/histograms/histograms.xml (right):

https://codereview.chromium.org/2108153003/diff/1/tools/metrics/histograms/hi...
tools/metrics/histograms/histograms.xml:90476: +<enum
name="SSLSignatureAlgorithm" type="int">
This is a little messy. So the values come from here:
https://tlswg.github.io/tls13-spec/#rfc.section.6.3.2.2

Except for ecdsa_sha1 which comes from here which still hasn't been merged yet.
https://github.com/tlswg/tls13-spec/pull/488/files

In TLS 1.3, we're being Clever (TM) and reinterpret_cast'ing a pair of u8s into
a u16. Since we're still implementing 1.3, I've only transcribed the values
corresponding to TLS 1.2 algorithms for now. But I want to make this change now
so we can start making the BoringSSL API fit the post-1.3 world. (Also having
the other half of the algorithm in there would have been really useful. That I
was only recording the hash was a mistake.)

For more fun, these involve a hex to decimal conversion. :-)

[Mark P, 2016-06-29 19:54:17]

histograms.xml lgtm
assuming you have satisfactory assumes to the comments below

--mark

https://codereview.chromium.org/2108153003/diff/1/tools/metrics/histograms/hi...
File tools/metrics/histograms/histograms.xml (right):

https://codereview.chromium.org/2108153003/diff/1/tools/metrics/histograms/hi...
tools/metrics/histograms/histograms.xml:90476: +<enum
name="SSLSignatureAlgorithm" type="int">
On 2016/06/29 19:21:47, davidben wrote:
> This is a little messy. So the values come from here:
> https://tlswg.github.io/tls13-spec/#rfc.section.6.3.2.2
> 
> Except for ecdsa_sha1 which comes from here which still hasn't been merged
yet.
> https://github.com/tlswg/tls13-spec/pull/488/files
> 
> In TLS 1.3, we're being Clever (TM) and reinterpret_cast'ing a pair of u8s
into
> a u16. Since we're still implementing 1.3, I've only transcribed the values
> corresponding to TLS 1.2 algorithms for now. But I want to make this change
now
> so we can start making the BoringSSL API fit the post-1.3 world. (Also having
> the other half of the algorithm in there would have been really useful. That I
> was only recording the hash was a mistake.)
> 
> For more fun, these involve a hex to decimal conversion. :-)

Thanks for the explanation.  And I checked your math (hex -> decimal).

Do you have plans to support / add the other algorithms?  I assume you don't
support them now, right?
       /* RSASSA-PSS algorithms */
       rsa_pss_sha256 (0x0700),
       rsa_pss_sha384 (0x0701),
       rsa_pss_sha512 (0x0702),

       /* EdDSA algorithms */
       ed25519 (0x0703),
       ed448 (0x0704),

Also, have you double-checked using about:histograms that this works correctly?

[davidben, 2016-06-29 19:58:04]

https://codereview.chromium.org/2108153003/diff/1/tools/metrics/histograms/hi...
File tools/metrics/histograms/histograms.xml (right):

https://codereview.chromium.org/2108153003/diff/1/tools/metrics/histograms/hi...
tools/metrics/histograms/histograms.xml:90476: +<enum
name="SSLSignatureAlgorithm" type="int">
On 2016/06/29 19:54:17, Mark P wrote:
> On 2016/06/29 19:21:47, davidben wrote:
> > This is a little messy. So the values come from here:
> > https://tlswg.github.io/tls13-spec/#rfc.section.6.3.2.2
> > 
> > Except for ecdsa_sha1 which comes from here which still hasn't been merged
> yet.
> > https://github.com/tlswg/tls13-spec/pull/488/files
> > 
> > In TLS 1.3, we're being Clever (TM) and reinterpret_cast'ing a pair of u8s
> into
> > a u16. Since we're still implementing 1.3, I've only transcribed the values
> > corresponding to TLS 1.2 algorithms for now. But I want to make this change
> now
> > so we can start making the BoringSSL API fit the post-1.3 world. (Also
having
> > the other half of the algorithm in there would have been really useful. That
I
> > was only recording the hash was a mistake.)
> > 
> > For more fun, these involve a hex to decimal conversion. :-)
> 
> Thanks for the explanation.  And I checked your math (hex -> decimal).

Thanks. Yeah, I wouldn't mind it if we could enter these in hex and save poking
about Google Calculator. :-)

> Do you have plans to support / add the other algorithms?  I assume you don't
> support them now, right?
>        /* RSASSA-PSS algorithms */
>        rsa_pss_sha256 (0x0700),
>        rsa_pss_sha384 (0x0701),
>        rsa_pss_sha512 (0x0702),

We don't support them no, now. They're not defined in TLS 1.2. When we implement
TLS 1.3, we will. I figured I'd wait until we actually had them in code, in case
the TLSWG, I dunno, changes the numbers or something.

>        /* EdDSA algorithms */
>        ed25519 (0x0703),
>        ed448 (0x0704),

I would like to support Ed25519 someday (we have the low-level code in BoringSSL
now). But this is predicated on the CA system coming up with Ed25519
certificates, so it may not be for a loooooong while. :-)

> Also, have you double-checked using about:histograms that this works
correctly?

Looks to be good.

[Mark P, 2016-06-29 20:10:06]

histograms.xml still lgtm (yes, I know there's no new patchset; no new patchset
is required)

[davidben, 2016-06-29 20:56:09]

Description was changed from

==========
Roll src/third_party/boringssl/src 3cab5572b..352d0a9c6

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

BUG=none
==========

to

==========
Roll src/third_party/boringssl/src 3cab5572b..352d0a9c6

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none
==========

[davidben, 2016-06-29 20:56:33]

davidben@chromium.org changed reviewers:
+ agrieve@chromium.org

[davidben, 2016-06-29 20:56:33]

+agrieve for build/

[davidben, 2016-06-29 20:57:05]

Description was changed from

==========
Roll src/third_party/boringssl/src 3cab5572b..352d0a9c6

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none
==========

to

==========
Roll src/third_party/boringssl/src 3cab5572b..352d0a9c6

[NOT TO LAND UNTIL AFTER BRANCH POINT SINCE ROLLING
BORINGSSL A DAY BEFORE BRANCH IS PROBABLY BAD MANNERS.]

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none
==========

[agrieve, 2016-06-30 00:00:18]

On 2016/06/29 20:56:33, davidben wrote:
> +agrieve for build/

build lgtm

[davidben, 2016-07-06 21:57:13]

Description was changed from

==========
Roll src/third_party/boringssl/src 3cab5572b..352d0a9c6

[NOT TO LAND UNTIL AFTER BRANCH POINT SINCE ROLLING
BORINGSSL A DAY BEFORE BRANCH IS PROBABLY BAD MANNERS.]

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none
==========

to

==========
Roll src/third_party/boringssl/src 3cab5572b..352d0a9c6

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none
==========

[davidben, 2016-07-07 00:02:14]

Description was changed from

==========
Roll src/third_party/boringssl/src 3cab5572b..352d0a9c6

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none
==========

to

==========
Roll src/third_party/boringssl/src 3cab5572b..95c6956

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none
==========

[davidben, 2016-07-07 00:03:12]

svaldez: This should be ready to be looked at now.

[svaldez, 2016-07-07 14:51:13]

On 2016/07/07 00:03:12, davidben wrote:
> svaldez: This should be ready to be looked at now.

lgtm.

[davidben, 2016-07-07 21:25:31]

The CQ bit was checked by davidben@chromium.org

[davidben, 2016-07-07 21:25:32]

The patchset sent to the CQ was uploaded after l-g-t-m from
mpearson@chromium.org, agrieve@chromium.org
Link to the patchset: https://codereview.chromium.org/2108153003/#ps40001
(title: "roll a little further")

[commit-bot: I haz the power, 2016-07-07 21:26:51]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-07-07 23:29:17]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-07-07 23:29:19]

Try jobs failed on following builders:
  mac_chromium_gyp_rel on master.tryserver.chromium.mac (JOB_TIMED_OUT, no build
URL)

[davidben, 2016-07-07 23:30:03]

The CQ bit was checked by davidben@chromium.org

[commit-bot: I haz the power, 2016-07-07 23:30:29]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-07-08 02:16:32]

Description was changed from

==========
Roll src/third_party/boringssl/src 3cab5572b..95c6956

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none
==========

to

==========
Roll src/third_party/boringssl/src 3cab5572b..95c6956

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none
==========

[commit-bot: I haz the power, 2016-07-08 02:16:33]

Committed patchset #3 (id:40001)

[commit-bot: I haz the power, 2016-07-08 02:19:24]

Description was changed from

==========
Roll src/third_party/boringssl/src 3cab5572b..95c6956

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none
==========

to

==========
Roll src/third_party/boringssl/src 3cab5572b..95c6956

https://boringssl.googlesource.com/boringssl/+log/3cab5572b1fcf5a8f6018529dc3...

This also updates the Net.SSLServerKeyExchangeHash histogram to use the full
signature algorithm value, in preparation for TLS 1.3 which treats the two as
one unit.

It also trims gn_migration.gypi since boringssl_unittests pulls in all those
smaller targets anyway and gets updated automatically as the set of BoringSSL
tests changes.

BUG=none

Committed: https://crrev.com/0653c8d1980d98cbf099a9c4306412ba59b721bb
Cr-Commit-Position: refs/heads/master@{#404310}
==========

[commit-bot: I haz the power, 2016-07-08 02:19:25]

Patchset 3 (id:??) landed as
https://crrev.com/0653c8d1980d98cbf099a9c4306412ba59b721bb
Cr-Commit-Position: refs/heads/master@{#404310}