Implement AES-GCM in tlslite.

Implement AES-GCM in tlslite.

This adds controls to the C++ test server but doesn't use them yet. Also
ensure that tlslite never selects a 1.2 cipher suite when negotiating an
older version.

BUG=450733
Committed: https://crrev.com/a526e23bc6fe686468b00b62d620567baf85c916
Cr-Commit-Position: refs/heads/master@{#313809}

[davidben, 2015-01-25 02:19:39]

davidben@chromium.org changed reviewers:
+ agl@chromium.org, rsleevi@chromium.org

[davidben, 2015-01-25 02:19:40]

Now we'll be good with False Start until we decide we really hate FFDHE.

This probably wants some combination of the both of you as reviewers.

[davidben, 2015-01-25 02:43:41]

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
File third_party/tlslite/tlslite/handshakesettings.py (left):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/handshakesettings.py:15: # issues such as timing
attacks
This and similar comments removed because I'm pretty sure they're false. The
order of the parameters in HandshakeSettings doesn't actually do anything, as
far as I can tell.

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/handshakesettings.py:202: other.macNames = [e for e
in self.macNames if e != "sha256"]
Moved to constants.py to handle the server end too.

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
File third_party/tlslite/tlslite/utils/cipherfactory.py (right):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/utils/cipherfactory.py:67: implList = ["pycrypto",
"python"]
"openssl", or rather, M2Crypto is intentionally omitted here. It doesn't expose
OpenSSL's actual AES-GCM implementation. I did try to use AES_encrypt to
implement the raw block cipher, but M2Crypto's low-level AES wrappers... don't
actually work...

https://github.com/M2Crypto/M2Crypto/blob/master/SWIG/_aes.i (note what gets
passed into AES_encrypt's first argument)

...and then I decided this wasn't worth bothering with, though we could
certainly pull the raw block cipher out of an ECB mode or something.

[agl, 2015-01-29 19:38:17]

LGTM

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/READ...
File third_party/tlslite/README.chromium (right):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/READ...
third_party/tlslite/README.chromium:38: before 1.2 as a server.
Maybe "before 1.2 as a server" -> "unless >= TLS 1.2 is negotiated".

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
File third_party/tlslite/tlslite/tlsrecordlayer.py (right):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/tlsrecordlayer.py:1005: plaintextLen = len(b) -
self._readState.encContext.tagLength
This can end up negative, but that doesn't appear to matter.

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
File third_party/tlslite/tlslite/utils/aesgcm.py (right):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/utils/aesgcm.py:146: # The initial counter value is
the nonce, followed with a 32-bit counter
s/with/by/

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
File third_party/tlslite/tlslite/utils/python_aesgcm.py (right):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/utils/python_aesgcm.py:9: 
extra blank line not needed?

[Ryan Sleevi, 2015-01-29 20:50:49]

LGTM % nits.

Do you plan to send a PR to upstream? You should just need to send this patch
through OSPO first as an FYI for them to greenlight sending it upstream (yes,
this is the weird state where we can land it in Chromium, but it requires
paperwork to upstream)

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
File third_party/tlslite/tlslite/tlsrecordlayer.py (right):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/tlsrecordlayer.py:596: #Encrypt for Block or Stream
Cipher
comment update?

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/tlsrecordlayer.py:600: #Assemble the AD.
expand this acronym?

#Assemble the authenticated data

...
authData = seqNumBytes + ...

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/tlsrecordlayer.py:601: seqnumBytes =
self._writeState.getSeqNumBytes()
nit: naming wise, should this be seqNumBytes?

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/tlsrecordlayer.py:613: #nonce.
"explicit variable nonce" - this is just explicit nonce, right? What does the
"variable" here refer to?

[davidben, 2015-01-29 20:58:55]

On 2015/01/29 20:50:49, Ryan Sleevi wrote:
> Do you plan to send a PR to upstream? You should just need to send this patch
> through OSPO first as an FYI for them to greenlight sending it upstream (yes,
> this is the weird state where we can land it in Chromium, but it requires
> paperwork to upstream)

Yup. I actually got them to okay the previous batch of patches, but I sat on it
and they got rebased, so I was going to ping OSPO a second time when this lands.

[davidben, 2015-01-29 21:40:59]

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/READ...
File third_party/tlslite/README.chromium (right):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/READ...
third_party/tlslite/README.chromium:38: before 1.2 as a server.
On 2015/01/29 19:38:17, agl wrote:
> Maybe "before 1.2 as a server" -> "unless >= TLS 1.2 is negotiated".

Done.

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
File third_party/tlslite/tlslite/tlsrecordlayer.py (right):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/tlsrecordlayer.py:596: #Encrypt for Block or Stream
Cipher
On 2015/01/29 20:50:48, Ryan Sleevi wrote:
> comment update?

Done.

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/tlsrecordlayer.py:600: #Assemble the AD.
On 2015/01/29 20:50:49, Ryan Sleevi wrote:
> expand this acronym?
> 
> #Assemble the authenticated data
> 
> ...
> authData = seqNumBytes + ...

Done.

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/tlsrecordlayer.py:601: seqnumBytes =
self._writeState.getSeqNumBytes()
On 2015/01/29 20:50:48, Ryan Sleevi wrote:
> nit: naming wise, should this be seqNumBytes?

Copy-and-paste from MAC block above, but I agree. Done.

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/tlsrecordlayer.py:613: #nonce.
On 2015/01/29 20:50:49, Ryan Sleevi wrote:
> "explicit variable nonce" - this is just explicit nonce, right? What does the
> "variable" here refer to?

As opposed to the fixed half of the nonce. (GCM nonce is concatenation of 4
bytes of fixed nonce, derived from key material, and 8 bytes of variable nonce.)
I'm mostly borrowing these terms from BoringSSL's code.

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/tlsrecordlayer.py:1005: plaintextLen = len(b) -
self._readState.encContext.tagLength
On 2015/01/29 19:38:17, agl wrote:
> This can end up negative, but that doesn't appear to matter.

Added a check anyway for good measure. I think a negative value will throw;
bytearray gets grumpy if inputs aren't in range.

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
File third_party/tlslite/tlslite/utils/aesgcm.py (right):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/utils/aesgcm.py:146: # The initial counter value is
the nonce, followed with a 32-bit counter
On 2015/01/29 19:38:17, agl wrote:
> s/with/by/

Done.

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
File third_party/tlslite/tlslite/utils/python_aesgcm.py (right):

https://codereview.chromium.org/875683002/diff/60001/third_party/tlslite/tlsl...
third_party/tlslite/tlslite/utils/python_aesgcm.py:9: 
On 2015/01/29 19:38:17, agl wrote:
> extra blank line not needed?

Done.

[davidben, 2015-01-29 21:41:54]

The CQ bit was checked by davidben@chromium.org

[commit-bot: I haz the power, 2015-01-29 21:43:10]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/875683002/80001

[commit-bot: I haz the power, 2015-01-29 22:33:22]

Committed patchset #5 (id:80001)

[commit-bot: I haz the power, 2015-01-29 22:34:44]

Patchset 5 (id:??) landed as
https://crrev.com/a526e23bc6fe686468b00b62d620567baf85c916
Cr-Commit-Position: refs/heads/master@{#313809}