Don't maintain a second level of timeouts.

Don't maintain a second level of timeouts.

This second level of timeouts is not maintained correctly in the case of
TLS 1.2 ticket renewals. BoringSSL does not extend ticket lifetimes on
ticket renewals because the master secret is unchanged, but BoringSSL's
default is two hours, while SSLClientSessionCache uses one hour. This
meant that TLS 1.2 ticket renewals currently extend the one hour
lifetime up to a two hour non-renewable lifetime.

This makes no sense. Instead, have SSLClientSessionCache query
SSL_SESSION timeout fields. Then configure the SSL_CTX to match the old
timeout to preserve the existing behavior. (Though I suspect one vs two
hours isn't a big difference and we could just leave it at BoringSSL
defaults.)

Do this both to fix our TLS 1.2 ticket renewal policy and prepare for
TLS 1.3 which will involve a more complex timeout policy. (Resumptions
do an ECDH and renewals incorporate that key material, so longer and
renewable lifetimes makes sense, but we will still need a non-renewable
timeout for when we require a fresh signature.)

BUG=630147
Committed: https://crrev.com/99ce6308c09c342dbf6cdabda0bdbc1452ee036d
Cr-Commit-Position: refs/heads/master@{#430961}

[davidben, 2016-11-04 18:40:31]

The CQ bit was checked by davidben@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-11-04 18:40:55]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[davidben, 2016-11-04 18:41:20]

davidben@chromium.org changed reviewers:
+ svaldez@chromium.org

[commit-bot: I haz the power, 2016-11-04 21:26:32]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-11-04 21:26:33]

Dry run: Try jobs failed on following builders:
  win_chromium_x64_rel_ng on master.tryserver.chromium.win (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_x64_...)

[svaldez, 2016-11-07 17:30:15]

lgtm

[davidben, 2016-11-09 00:48:22]

The CQ bit was checked by davidben@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-11-09 00:48:51]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[davidben, 2016-11-09 01:48:28]

asfasdfasdfasd base::Time is terrible. Turns out base::Time::ToTimeT is
discontinuous at zero, which SimpleTestClock initializes itself at. I think this
should work.

[commit-bot: I haz the power, 2016-11-09 02:29:14]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-11-09 02:29:15]

Dry run: This issue passed the CQ dry run.

[svaldez, 2016-11-09 17:24:29]

The CQ bit was checked by svaldez@chromium.org

[svaldez, 2016-11-09 17:24:29]

lgtm

[commit-bot: I haz the power, 2016-11-09 17:25:03]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-11-09 17:30:57]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-11-09 17:32:38]

Description was changed from

==========
Don't maintain a second level of timeouts.

This second level of timeouts is not maintained correctly in the case of
TLS 1.2 ticket renewals. BoringSSL does not extend ticket lifetimes on
ticket renewals because the master secret is unchanged, but BoringSSL's
default is two hours, while SSLClientSessionCache uses one hour. This
meant that TLS 1.2 ticket renewals currently extend the one hour
lifetime up to a two hour non-renewable lifetime.

This makes no sense. Instead, have SSLClientSessionCache query
SSL_SESSION timeout fields. Then configure the SSL_CTX to match the old
timeout to preserve the existing behavior. (Though I suspect one vs two
hours isn't a big difference and we could just leave it at BoringSSL
defaults.)

Do this both to fix our TLS 1.2 ticket renewal policy and prepare for
TLS 1.3 which will involve a more complex timeout policy. (Resumptions
do an ECDH and renewals incorporate that key material, so longer and
renewable lifetimes makes sense, but we will still need a non-renewable
timeout for when we require a fresh signature.)

BUG=630147
==========

to

==========
Don't maintain a second level of timeouts.

This second level of timeouts is not maintained correctly in the case of
TLS 1.2 ticket renewals. BoringSSL does not extend ticket lifetimes on
ticket renewals because the master secret is unchanged, but BoringSSL's
default is two hours, while SSLClientSessionCache uses one hour. This
meant that TLS 1.2 ticket renewals currently extend the one hour
lifetime up to a two hour non-renewable lifetime.

This makes no sense. Instead, have SSLClientSessionCache query
SSL_SESSION timeout fields. Then configure the SSL_CTX to match the old
timeout to preserve the existing behavior. (Though I suspect one vs two
hours isn't a big difference and we could just leave it at BoringSSL
defaults.)

Do this both to fix our TLS 1.2 ticket renewal policy and prepare for
TLS 1.3 which will involve a more complex timeout policy. (Resumptions
do an ECDH and renewals incorporate that key material, so longer and
renewable lifetimes makes sense, but we will still need a non-renewable
timeout for when we require a fresh signature.)

BUG=630147

Committed: https://crrev.com/99ce6308c09c342dbf6cdabda0bdbc1452ee036d
Cr-Commit-Position: refs/heads/master@{#430961}
==========

[commit-bot: I haz the power, 2016-11-09 17:32:39]

Patchset 2 (id:??) landed as
https://crrev.com/99ce6308c09c342dbf6cdabda0bdbc1452ee036d
Cr-Commit-Position: refs/heads/master@{#430961}