crypto/tls: make cipher suite preference ordering automatic

We now have a (well, two, depending on AES hardware support) universal
cipher suite preference order, based on their security and performance.
Peer and application lists are now treated as filters (and AES hardware
support hints) that are applied to this universal order.

This removes a complex and nuanced decision from the application's
responsibilities, one which we are better equipped to make and which
applications usually don't need to have an opinion about. It also lets
us worry less about what suites we support or enable, because we can be
confident that bad ones won't be selected over good ones.

This also moves 3DES suites to InsecureCipherSuites(), even if they are
not disabled by default. Just because we can keep them as a last resort
it doesn't mean they are secure. Thankfully we had not promised that
Insecure means disabled by default.

Notable test changes:

  - TestCipherSuiteCertPreferenceECDSA was testing that we'd pick the
    right certificate regardless of CipherSuite ordering, which is now
    completely ignored, as tested by TestCipherSuitePreference. Removed.

  - The openssl command of TestHandshakeServerExportKeyingMaterial was
    broken for TLS 1.0 in CL 262857, but its golden file was not
    regenerated, so the test kept passing. It now broke because the
    selected suite from the ones in the golden file changed.

  - In TestAESCipherReordering, "server strongly prefers AES-GCM" is
    removed because there is no way for a server to express a strong
    preference anymore; "client prefers AES-GCM and AES-CBC over ChaCha"
    switched to ChaCha20 when the server lacks AES hardware; and finally
    "client supports multiple AES-GCM" changed to always prefer AES-128
    per the universal preference list.

    * this is going back on an explicit decision from CL 262857, and
      while that client order is weird and does suggest a strong dislike
      for ChaCha20, we have a strong dislike for software AES, so it
      didn't feel worth making the logic more complex

  - All Client-* golden files had to be regenerated because the
    ClientHello cipher suites have changed.
    (Even when Config.CipherSuites was limited to one suite, the TLS 1.3
    default order changed.)

Fixes #45430
Fixes #41476 (as 3DES is now always the last resort)

Change-Id: If5f5d356c0f8d1f1c7542fb06644a478d6bad1e5
Reviewed-on: https://go-review.googlesource.com/c/go/+/314609
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Trust: Filippo Valsorda <filippo@golang.org>

1 files changed, 19 insertions, 19 deletions

diff --git a/src/crypto/tls/testdata/Client-TLSv12-RSA-RC4 b/src/crypto/tls/testdata/Client-TLSv12-RSA-RC4
index ab2c4eb14d..12fb594c04 100644
--- a/src/crypto/tls/testdata/Client-TLSv12-RSA-RC4
+++ b/src/crypto/tls/testdata/Client-TLSv12-RSA-RC4
@@ -3,10 +3,10 @@
 00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
 00000020  00 00 00 00 00 00 00 00  00 00 00 20 00 00 00 00  |........... ....|
 00000030  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 32 cc a8  |.............2..|
-00000050  cc a9 c0 2f c0 2b c0 30  c0 2c c0 27 c0 13 c0 23  |.../.+.0.,.'...#|
-00000060  c0 09 c0 14 c0 0a 00 9c  00 9d 00 3c 00 2f 00 35  |...........<./.5|
-00000070  c0 12 00 0a 00 05 c0 11  c0 07 13 01 13 03 13 02  |................|
+00000040  00 00 00 00 00 00 00 00  00 00 00 00 00 32 cc a9  |.............2..|
+00000050  cc a8 c0 2b c0 2f c0 2c  c0 30 c0 09 c0 13 c0 0a  |...+./.,.0......|
+00000060  c0 14 00 9c 00 9d 00 2f  00 35 c0 12 00 0a c0 23  |......./.5.....#|
+00000070  c0 27 00 3c c0 07 c0 11  00 05 13 03 13 01 13 02  |.'.<............|
 00000080  01 00 00 7b 00 05 00 05  01 00 00 00 00 00 0a 00  |...{............|
 00000090  0a 00 08 00 1d 00 17 00  18 00 19 00 0b 00 02 01  |................|
 000000a0  00 00 0d 00 1a 00 18 08  04 04 03 08 07 08 05 08  |................|
@@ -16,11 +16,11 @@
 000000e0  e5 7d a3 47 cd 62 43 15  28 da ac 5f bb 29 07 30  |.}.G.bC.(.._.).0|
 000000f0  ff f6 84 af c4 cf c2 ed  90 99 5f 58 cb 3b 74     |.........._X.;t|
 >>> Flow 2 (server to client)
-00000000  16 03 03 00 51 02 00 00  4d 03 03 34 50 1f 52 15  |....Q...M..4P.R.|
-00000010  85 c7 85 2c 4d a9 b2 0c  49 e5 a3 ea 57 21 96 39  |...,M...I...W!.9|
-00000020  db c9 97 b6 c4 d0 81 9a  39 a3 e8 20 59 f5 b9 db  |........9.. Y...|
-00000030  58 2e ef 1c b3 85 96 27  6a 23 71 3f 5c 72 ce cf  |X......'j#q?\r..|
-00000040  c5 b7 fe 05 00 f4 65 06  54 c1 2e 7c 00 05 00 00  |......e.T..|....|
+00000000  16 03 03 00 51 02 00 00  4d 03 03 b0 e7 ee 09 45  |....Q...M......E|
+00000010  36 f1 7a 92 be 9e d8 9d  ae cd c1 4e b2 12 94 3e  |6.z........N...>|
+00000020  6c 34 71 ed 5f e0 97 7f  25 e4 dd 20 f4 43 01 03  |l4q._...%.. .C..|
+00000030  88 33 26 7f 48 c1 f2 d1  4d d3 f8 1a bd 86 4c 50  |.3&.H...M.....LP|
+00000040  18 89 dc 08 99 f1 51 c5  84 be b9 fd 00 05 00 00  |......Q.........|
 00000050  05 ff 01 00 01 00 16 03  03 02 59 0b 00 02 55 00  |..........Y...U.|
 00000060  02 52 00 02 4f 30 82 02  4b 30 82 01 b4 a0 03 02  |.R..O0..K0......|
 00000070  01 02 02 09 00 e8 f0 9d  3f e2 5b ea a6 30 0d 06  |........?.[..0..|
@@ -70,15 +70,15 @@
 00000060  c5 70 0f 08 83 48 e9 48  ef 6e 50 8b 05 7e e5 84  |.p...H.H.nP..~..|
 00000070  25 fa 55 c7 ae 31 02 27  00 ef 3f 98 86 20 12 89  |%.U..1.'..?.. ..|
 00000080  91 59 28 b4 f7 d7 af d2  69 61 35 14 03 03 00 01  |.Y(.....ia5.....|
-00000090  01 16 03 03 00 24 ab 48  84 ae 77 f9 8b 82 44 52  |.....$.H..w...DR|
-000000a0  3e 65 94 27 cc f2 08 a7  f2 e5 21 0c 02 d0 89 ac  |>e.'......!.....|
-000000b0  50 be 69 57 c9 7c a0 f2  7f 6d                    |P.iW.|...m|
+00000090  01 16 03 03 00 24 08 65  01 80 0d 59 b8 ac 0f 09  |.....$.e...Y....|
+000000a0  bf 61 31 32 e0 74 e9 f4  72 e3 2c 79 11 4d b2 a2  |.a12.t..r.,y.M..|
+000000b0  55 65 94 c8 cd 0a 61 99  07 b8                    |Ue....a...|
 >>> Flow 4 (server to client)
-00000000  14 03 03 00 01 01 16 03  03 00 24 61 94 21 65 0f  |..........$a.!e.|
-00000010  10 ba 0c a6 d9 e3 08 54  86 ae f9 64 c7 e7 f4 4b  |.......T...d...K|
-00000020  aa f5 19 ca 2a 0d 50 88  85 42 32 14 04 29 d9     |....*.P..B2..).|
+00000000  14 03 03 00 01 01 16 03  03 00 24 04 20 46 cd fb  |..........$. F..|
+00000010  6c 46 9c 47 21 03 fe 9b  a4 c6 da 2c 71 2f db 92  |lF.G!......,q/..|
+00000020  40 da 7d 46 2e e4 9c 81  86 89 7f 53 46 91 28     |@.}F.......SF.(|
 >>> Flow 5 (client to server)
-00000000  17 03 03 00 1a cb 1d 43  67 de 7a 20 c7 ed 46 99  |.......Cg.z ..F.|
-00000010  86 1f b9 61 9f c6 34 9a  07 37 3c 94 45 b4 40 15  |...a..4..7<.E.@.|
-00000020  03 03 00 16 4e ac d3 12  23 b4 33 bc 5b 03 91 7e  |....N...#.3.[..~|
-00000030  d9 d0 7f d7 48 3e 8c 16  16 ec                    |....H>....|
+00000000  17 03 03 00 1a 89 2b 2e  49 21 19 b7 d0 df 85 da  |......+.I!......|
+00000010  b8 a7 f3 73 5f fe 44 e5  0c a1 af 16 74 93 bc 15  |...s_.D.....t...|
+00000020  03 03 00 16 5f 9e 64 d0  91 50 34 44 cf f6 1f e0  |...._.d..P4D....|
+00000030  e0 13 b9 67 da 5c 99 16  f1 b3                    |...g.\....|