crypto/tls: enable TLS 1.3 and update tests

To disable TLS 1.3, simply remove VersionTLS13 from supportedVersions,
as tested by TestEscapeRoute, and amend documentation. To make it
opt-in, revert the change to (*Config).supportedVersions from this CL.

I did not have the heart to implement the early data skipping feature
when I realized that it did not offer a choice between two
abstraction-breaking options, but demanded them both (look for handshake
type in case of HelloRetryRequest, trial decryption otherwise). It's a
lot of complexity for an apparently small gain, but if anyone has strong
opinions about it let me know.

Note that in TLS 1.3 alerts are encrypted, so the close_notify peeking
to return (n > 0, io.EOF) from Read doesn't work. If we are lucky, those
servers that unexpectedly close connections after serving a single
request will have stopped (maybe thanks to H/2) before they got updated
to TLS 1.3.

Relatedly, session tickets are now provisioned on the client first Read
instead of at Handshake time, because they are, well, post-handshake
messages. If this proves to be a problem we might try to peek at them.

Doubled the tests that cover logic that's different in TLS 1.3.

The benchmarks for TLS 1.2 compared to be0f3c286b5 (before TLS 1.3 and
its refactors, after CL 142817 changed them to use real connections)
show little movement.

name                                       old time/op   new time/op   delta
HandshakeServer/RSA-8                        795µs ± 1%    798µs ± 1%    ~     (p=0.057 n=10+18)
HandshakeServer/ECDHE-P256-RSA-8             903µs ± 0%    909µs ± 1%  +0.68%  (p=0.000 n=8+17)
HandshakeServer/ECDHE-P256-ECDSA-P256-8      198µs ± 0%    204µs ± 1%  +3.24%  (p=0.000 n=9+18)
HandshakeServer/ECDHE-X25519-ECDSA-P256-8    202µs ± 3%    208µs ± 1%  +2.98%  (p=0.000 n=9+20)
HandshakeServer/ECDHE-P521-ECDSA-P521-8     15.5ms ± 1%   15.9ms ± 2%  +2.49%  (p=0.000 n=10+20)
Throughput/MaxPacket/1MB-8                  5.81ms ±23%   6.14ms ±44%    ~     (p=0.605 n=8+18)
Throughput/MaxPacket/2MB-8                  8.91ms ±22%   8.74ms ±33%    ~     (p=0.498 n=9+19)
Throughput/MaxPacket/4MB-8                  12.8ms ± 3%   14.0ms ±10%  +9.74%  (p=0.000 n=10+17)
Throughput/MaxPacket/8MB-8                  25.1ms ± 7%   24.6ms ±16%    ~     (p=0.129 n=9+19)
Throughput/MaxPacket/16MB-8                 46.3ms ± 4%   45.9ms ±12%    ~     (p=0.340 n=9+20)
Throughput/MaxPacket/32MB-8                 88.5ms ± 4%   86.0ms ± 4%  -2.82%  (p=0.004 n=10+20)
Throughput/MaxPacket/64MB-8                  173ms ± 2%    167ms ± 7%  -3.42%  (p=0.001 n=10+19)
Throughput/DynamicPacket/1MB-8              5.88ms ± 4%   6.59ms ±64%    ~     (p=0.232 n=9+18)
Throughput/DynamicPacket/2MB-8              9.08ms ±12%   8.73ms ±21%    ~     (p=0.408 n=10+18)
Throughput/DynamicPacket/4MB-8              14.2ms ± 5%   14.0ms ±11%    ~     (p=0.188 n=9+19)
Throughput/DynamicPacket/8MB-8              25.1ms ± 6%   24.0ms ± 7%  -4.39%  (p=0.000 n=10+18)
Throughput/DynamicPacket/16MB-8             45.6ms ± 3%   43.3ms ± 1%  -5.22%  (p=0.000 n=10+8)
Throughput/DynamicPacket/32MB-8             88.4ms ± 3%   84.8ms ± 2%  -4.06%  (p=0.000 n=10+10)
Throughput/DynamicPacket/64MB-8              175ms ± 3%    167ms ± 2%  -4.63%  (p=0.000 n=10+10)
Latency/MaxPacket/200kbps-8                  694ms ± 0%    694ms ± 0%  -0.02%  (p=0.000 n=9+9)
Latency/MaxPacket/500kbps-8                  279ms ± 0%    279ms ± 0%  -0.09%  (p=0.000 n=10+10)
Latency/MaxPacket/1000kbps-8                 140ms ± 0%    140ms ± 0%  -0.15%  (p=0.000 n=10+9)
Latency/MaxPacket/2000kbps-8                71.1ms ± 0%   71.0ms ± 0%  -0.09%  (p=0.001 n=8+9)
Latency/MaxPacket/5000kbps-8                30.5ms ± 6%   30.1ms ± 6%    ~     (p=0.905 n=10+9)
Latency/DynamicPacket/200kbps-8              134ms ± 0%    134ms ± 0%    ~     (p=0.796 n=9+9)
Latency/DynamicPacket/500kbps-8             54.8ms ± 0%   54.7ms ± 0%  -0.18%  (p=0.000 n=8+10)
Latency/DynamicPacket/1000kbps-8            28.5ms ± 0%   29.1ms ± 8%    ~     (p=0.173 n=8+10)
Latency/DynamicPacket/2000kbps-8            15.3ms ± 6%   15.9ms ±10%    ~     (p=0.905 n=9+10)
Latency/DynamicPacket/5000kbps-8            9.14ms ±21%   9.65ms ±82%    ~     (p=0.529 n=10+10)

name                                       old speed     new speed     delta
Throughput/MaxPacket/1MB-8                 175MB/s ±13%  167MB/s ±64%    ~     (p=0.646 n=7+20)
Throughput/MaxPacket/2MB-8                 241MB/s ±25%  241MB/s ±40%    ~     (p=0.660 n=9+20)
Throughput/MaxPacket/4MB-8                 328MB/s ± 3%  300MB/s ± 9%  -8.70%  (p=0.000 n=10+17)
Throughput/MaxPacket/8MB-8                 335MB/s ± 7%  340MB/s ±17%    ~     (p=0.212 n=9+20)
Throughput/MaxPacket/16MB-8                363MB/s ± 4%  367MB/s ±11%    ~     (p=0.340 n=9+20)
Throughput/MaxPacket/32MB-8                379MB/s ± 4%  390MB/s ± 4%  +2.93%  (p=0.004 n=10+20)
Throughput/MaxPacket/64MB-8                388MB/s ± 2%  401MB/s ± 7%  +3.25%  (p=0.004 n=10+20)
Throughput/DynamicPacket/1MB-8             178MB/s ± 4%  157MB/s ±73%    ~     (p=0.127 n=9+20)
Throughput/DynamicPacket/2MB-8             232MB/s ±11%  243MB/s ±18%    ~     (p=0.415 n=10+18)
Throughput/DynamicPacket/4MB-8             296MB/s ± 5%  299MB/s ±15%    ~     (p=0.295 n=9+20)
Throughput/DynamicPacket/8MB-8             334MB/s ± 6%  350MB/s ± 7%  +4.58%  (p=0.000 n=10+18)
Throughput/DynamicPacket/16MB-8            368MB/s ± 3%  388MB/s ± 1%  +5.48%  (p=0.000 n=10+8)
Throughput/DynamicPacket/32MB-8            380MB/s ± 3%  396MB/s ± 2%  +4.20%  (p=0.000 n=10+10)
Throughput/DynamicPacket/64MB-8            384MB/s ± 3%  403MB/s ± 2%  +4.83%  (p=0.000 n=10+10)

Comparing TLS 1.2 and TLS 1.3 at tip shows a slight (~5-10%) slowdown of
handshakes, which might be worth looking at next cycle, but the latency
improvements are expected to overshadow that.

name                                       old time/op   new time/op   delta
HandshakeServer/ECDHE-P256-RSA-8             909µs ± 1%    963µs ± 0%   +5.87%  (p=0.000 n=17+18)
HandshakeServer/ECDHE-P256-ECDSA-P256-8      204µs ± 1%    225µs ± 2%  +10.20%  (p=0.000 n=18+20)
HandshakeServer/ECDHE-X25519-ECDSA-P256-8    208µs ± 1%    230µs ± 2%  +10.35%  (p=0.000 n=20+18)
HandshakeServer/ECDHE-P521-ECDSA-P521-8     15.9ms ± 2%   15.9ms ± 1%     ~     (p=0.444 n=20+19)
Throughput/MaxPacket/1MB-8                  6.14ms ±44%   7.07ms ±46%     ~     (p=0.057 n=18+19)
Throughput/MaxPacket/2MB-8                  8.74ms ±33%   8.61ms ± 9%     ~     (p=0.552 n=19+17)
Throughput/MaxPacket/4MB-8                  14.0ms ±10%   14.1ms ±12%     ~     (p=0.707 n=17+20)
Throughput/MaxPacket/8MB-8                  24.6ms ±16%   25.6ms ±14%     ~     (p=0.107 n=19+20)
Throughput/MaxPacket/16MB-8                 45.9ms ±12%   44.7ms ± 6%     ~     (p=0.607 n=20+19)
Throughput/MaxPacket/32MB-8                 86.0ms ± 4%   87.9ms ± 8%     ~     (p=0.113 n=20+19)
Throughput/MaxPacket/64MB-8                  167ms ± 7%    169ms ± 2%   +1.26%  (p=0.011 n=19+19)
Throughput/DynamicPacket/1MB-8              6.59ms ±64%   6.79ms ±43%     ~     (p=0.480 n=18+19)
Throughput/DynamicPacket/2MB-8              8.73ms ±21%   9.58ms ±13%   +9.71%  (p=0.006 n=18+20)
Throughput/DynamicPacket/4MB-8              14.0ms ±11%   13.9ms ±10%     ~     (p=0.687 n=19+20)
Throughput/DynamicPacket/8MB-8              24.0ms ± 7%   24.6ms ± 8%   +2.36%  (p=0.045 n=18+17)
Throughput/DynamicPacket/16MB-8             43.3ms ± 1%   44.3ms ± 2%   +2.48%  (p=0.001 n=8+9)
Throughput/DynamicPacket/32MB-8             84.8ms ± 2%   86.7ms ± 2%   +2.27%  (p=0.000 n=10+10)
Throughput/DynamicPacket/64MB-8              167ms ± 2%    170ms ± 3%   +1.89%  (p=0.005 n=10+10)
Latency/MaxPacket/200kbps-8                  694ms ± 0%    699ms ± 0%   +0.65%  (p=0.000 n=9+10)
Latency/MaxPacket/500kbps-8                  279ms ± 0%    280ms ± 0%   +0.68%  (p=0.000 n=10+10)
Latency/MaxPacket/1000kbps-8                 140ms ± 0%    141ms ± 0%   +0.59%  (p=0.000 n=9+9)
Latency/MaxPacket/2000kbps-8                71.0ms ± 0%   71.3ms ± 0%   +0.42%  (p=0.000 n=9+9)
Latency/MaxPacket/5000kbps-8                30.1ms ± 6%   30.7ms ±10%   +1.93%  (p=0.019 n=9+9)
Latency/DynamicPacket/200kbps-8              134ms ± 0%    138ms ± 0%   +3.22%  (p=0.000 n=9+10)
Latency/DynamicPacket/500kbps-8             54.7ms ± 0%   56.3ms ± 0%   +3.03%  (p=0.000 n=10+8)
Latency/DynamicPacket/1000kbps-8            29.1ms ± 8%   29.1ms ± 0%     ~     (p=0.173 n=10+8)
Latency/DynamicPacket/2000kbps-8            15.9ms ±10%   16.4ms ±36%     ~     (p=0.633 n=10+8)
Latency/DynamicPacket/5000kbps-8            9.65ms ±82%   8.32ms ± 8%     ~     (p=0.573 n=10+8)

name                                       old speed     new speed     delta
Throughput/MaxPacket/1MB-8                 167MB/s ±64%  155MB/s ±55%     ~     (p=0.224 n=20+19)
Throughput/MaxPacket/2MB-8                 241MB/s ±40%  244MB/s ± 9%     ~     (p=0.407 n=20+17)
Throughput/MaxPacket/4MB-8                 300MB/s ± 9%  298MB/s ±11%     ~     (p=0.707 n=17+20)
Throughput/MaxPacket/8MB-8                 340MB/s ±17%  330MB/s ±13%     ~     (p=0.201 n=20+20)
Throughput/MaxPacket/16MB-8                367MB/s ±11%  375MB/s ± 5%     ~     (p=0.607 n=20+19)
Throughput/MaxPacket/32MB-8                390MB/s ± 4%  382MB/s ± 8%     ~     (p=0.113 n=20+19)
Throughput/MaxPacket/64MB-8                401MB/s ± 7%  397MB/s ± 2%   -0.96%  (p=0.030 n=20+19)
Throughput/DynamicPacket/1MB-8             157MB/s ±73%  156MB/s ±39%     ~     (p=0.738 n=20+20)
Throughput/DynamicPacket/2MB-8             243MB/s ±18%  220MB/s ±14%   -9.65%  (p=0.006 n=18+20)
Throughput/DynamicPacket/4MB-8             299MB/s ±15%  303MB/s ± 9%     ~     (p=0.512 n=20+20)
Throughput/DynamicPacket/8MB-8             350MB/s ± 7%  342MB/s ± 8%   -2.27%  (p=0.045 n=18+17)
Throughput/DynamicPacket/16MB-8            388MB/s ± 1%  378MB/s ± 2%   -2.41%  (p=0.001 n=8+9)
Throughput/DynamicPacket/32MB-8            396MB/s ± 2%  387MB/s ± 2%   -2.21%  (p=0.000 n=10+10)
Throughput/DynamicPacket/64MB-8            403MB/s ± 2%  396MB/s ± 3%   -1.84%  (p=0.005 n=10+10)

Fixes #9671

Change-Id: Ieb57c5140eb2c083b8be0d42b240cd2eeec0dcf6
Reviewed-on: https://go-review.googlesource.com/c/147638
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>

1 files changed, 26 insertions, 26 deletions

diff --git a/src/crypto/tls/testdata/Server-SSLv3-RSA-RC4 b/src/crypto/tls/testdata/Server-SSLv3-RSA-RC4
index f5674ccd67..6feee485ac 100644
--- a/src/crypto/tls/testdata/Server-SSLv3-RSA-RC4
+++ b/src/crypto/tls/testdata/Server-SSLv3-RSA-RC4
@@ -1,12 +1,12 @@
 >>> Flow 1 (client to server)
-00000000  16 03 00 00 2f 01 00 00  2b 03 00 3f cc 8d 3f f0  |..../...+..?..?.|
-00000010  c9 36 6f 43 43 c1 46 45  cd bf e5 ba 02 e6 55 2c  |.6oCC.FE......U,|
-00000020  3a 24 4a db cb a8 f2 1d  26 3e ef 00 00 04 00 05  |:$J.....&>......|
+00000000  16 03 00 00 2f 01 00 00  2b 03 00 d6 26 87 86 f3  |..../...+...&...|
+00000010  3f e3 08 85 7a fc 3c fe  91 44 1a 68 9f c8 77 10  |?...z.<..D.h..w.|
+00000020  5e af fa b9 e1 09 5f fb  fa ad dd 00 00 04 00 05  |^....._.........|
 00000030  00 ff 01 00                                       |....|
 >>> Flow 2 (server to client)
 00000000  16 03 00 00 31 02 00 00  2d 03 00 00 00 00 00 00  |....1...-.......|
 00000010  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
-00000020  00 00 00 00 00 00 00 00  00 00 00 00 00 05 00 00  |................|
+00000020  00 00 00 44 4f 57 4e 47  52 44 00 00 00 05 00 00  |...DOWNGRD......|
 00000030  05 ff 01 00 01 00 16 03  00 02 59 0b 00 02 55 00  |..........Y...U.|
 00000040  02 52 00 02 4f 30 82 02  4b 30 82 01 b4 a0 03 02  |.R..O0..K0......|
 00000050  01 02 02 09 00 e8 f0 9d  3f e2 5b ea a6 30 0d 06  |........?.[..0..|
@@ -47,26 +47,26 @@
 00000280  b3 3e c0 d1 bd 42 d4 db  fe 3d 13 60 84 5c 21 d3  |.>...B...=.`.\!.|
 00000290  3b e9 fa e7 16 03 00 00  04 0e 00 00 00           |;............|
 >>> Flow 3 (client to server)
-00000000  16 03 00 00 84 10 00 00  80 13 5d 75 f0 6d 24 54  |..........]u.m$T|
-00000010  f5 a1 f0 13 86 61 ce ea  66 86 06 eb c8 27 78 9f  |.....a..f....'x.|
-00000020  10 0d ef 94 3f 1b fb 8c  11 14 67 2a 0e 2a 1b cf  |....?.....g*.*..|
-00000030  ae 5a cb ac b8 b2 ea a8  70 85 ee fd 88 a9 61 a4  |.Z......p.....a.|
-00000040  75 66 86 a5 88 96 a0 0d  6f 77 fe 63 5e 88 60 4d  |uf......ow.c^.`M|
-00000050  f6 b7 93 28 99 72 e8 60  ed 64 9a 3f e6 12 ea ee  |...(.r.`.d.?....|
-00000060  83 58 d4 0c 19 e0 2b ce  b0 b4 fa 73 9f 78 d9 09  |.X....+....s.x..|
-00000070  8c 17 b8 f5 04 e1 de c4  fe a9 1a aa ba 0d be f3  |................|
-00000080  c8 e1 e4 e8 cc 39 4c f0  b9 14 03 00 00 01 01 16  |.....9L.........|
-00000090  03 00 00 3c 1b 70 07 7f  ad 8f a7 78 fd e8 eb b2  |...<.p.....x....|
-000000a0  9a 54 86 a2 dd bc fa b6  0a 52 48 24 79 6a 04 f6  |.T.......RH$yj..|
-000000b0  28 80 1f b7 b1 c6 4e 07  a3 52 60 5a 5a 81 14 11  |(.....N..R`ZZ...|
-000000c0  d2 ee 33 71 e7 d3 ba 3e  4b 31 81 f2 f0 49 ee e4  |..3q...>K1...I..|
+00000000  16 03 00 00 84 10 00 00  80 d2 67 c1 73 bb 95 8d  |..........g.s...|
+00000010  b2 e7 30 ca 6c 53 eb f0  34 e5 26 11 0b 91 e9 0a  |..0.lS..4.&.....|
+00000020  cb 7d 9f d8 f9 01 38 06  01 83 29 a7 1d 69 b8 a1  |.}....8...)..i..|
+00000030  1f aa bf 73 1e 26 82 ed  44 f5 82 ec 95 69 88 4b  |...s.&..D....i.K|
+00000040  b7 ce dd 52 c1 a6 3f be  b8 02 23 a5 f3 0c 1e 36  |...R..?...#....6|
+00000050  f9 c9 00 1f da e9 d5 38  48 b0 24 5e 25 c1 d4 cb  |.......8H.$^%...|
+00000060  64 c2 16 ff 94 d6 bd e2  e1 bf 7a 98 d9 77 09 a1  |d.........z..w..|
+00000070  c4 f0 99 e6 57 89 02 c8  dd f0 d5 94 d8 44 34 0b  |....W........D4.|
+00000080  7a 08 52 95 75 20 02 0a  83 14 03 00 00 01 01 16  |z.R.u ..........|
+00000090  03 00 00 3c e9 19 7a 94  45 9a b0 ec 3f 8f 1d 19  |...<..z.E...?...|
+000000a0  64 65 45 6c e8 4e e3 c8  c8 c6 dc d3 a1 05 cf ea  |deEl.N..........|
+000000b0  fa cf 59 74 93 84 53 a3  bd 7b f0 07 64 92 ea a2  |..Yt..S..{..d...|
+000000c0  f1 2a ea 29 4a 80 c6 99  76 3c 7e c3 f7 b0 e5 e2  |.*.)J...v<~.....|
 >>> Flow 4 (server to client)
-00000000  14 03 00 00 01 01 16 03  00 00 3c 47 20 7c b9 0d  |..........<G |..|
-00000010  f8 59 c0 79 25 ae 8a f3  f5 7d 0c f5 62 d4 a5 5b  |.Y.y%....}..b..[|
-00000020  f6 08 36 cc 99 21 ac 80  04 48 49 2c 04 7c 87 08  |..6..!...HI,.|..|
-00000030  d3 10 43 a9 6a ec 99 96  99 0a fa cb db 95 6f fe  |..C.j.........o.|
-00000040  b1 75 77 1e b7 a9 9d 17  03 00 00 21 1a 2f bc 70  |.uw........!./.p|
-00000050  2c 00 6b 55 e1 e5 81 17  1c b7 a1 11 d7 21 c1 2f  |,.kU.........!./|
-00000060  3e 95 f8 48 74 a4 97 0a  9d a2 0b bc d4 15 03 00  |>..Ht...........|
-00000070  00 16 67 0d 6d 69 53 87  92 23 21 51 72 f6 31 73  |..g.miS..#!Qr.1s|
-00000080  db bd 3c e6 f4 12 4c 69                           |..<...Li|
+00000000  14 03 00 00 01 01 16 03  00 00 3c 14 6c 96 8a 5e  |..........<.l..^|
+00000010  ab 93 c2 65 9b 22 57 31  e6 f1 ce 6a a2 28 31 e8  |...e."W1...j.(1.|
+00000020  b5 c3 e7 07 98 2f 0b 40  b7 65 ec 92 f5 60 61 c2  |...../.@.e...`a.|
+00000030  25 40 91 2f fa a4 4e 4a  ad 7b b3 2a 26 23 d3 04  |%@./..NJ.{.*&#..|
+00000040  0f c2 2e 95 82 9d 4b 17  03 00 00 21 5e c6 1e 2c  |......K....!^..,|
+00000050  49 23 4d 14 b2 87 4b c2  f9 09 17 f0 1a 11 15 50  |I#M...K........P|
+00000060  52 d3 85 7b 25 0e e5 2c  7b 74 4b 5e 9d 15 03 00  |R..{%..,{tK^....|
+00000070  00 16 6b aa 31 b5 e4 ff  02 0a 39 bc d7 57 51 a1  |..k.1.....9..WQ.|
+00000080  42 07 c9 ba 2b 35 26 b7                           |B...+5&.|