GitLab

TLS 1.3 includes a server_random-based anti-downgrade mechanism which
gives it a stronger anti-downgrade store than prior versions of TLS.
(This is essentially working around a bug in TLS 1.2 where it did not
incorporate enough into the signature.) This is a few security
improvement for Chrome users that should not disrupt the existing
ecosystem.

Unfortunately, we are aware that some Cisco middleboxes have buggy TLS
1.2 implementations that fail to generate their own server random value.
Instead, they copy over another server's random value. This is invalid
and does not comply with the TLS 1.2 specification. See
https://www.ietf.org/mail-archive/web/tls/current/msg25168.html

Due to deployment considerations, this feature cannot be enabled until
TLS 1.3 is final. In preparation for that, this CL adds metrics to
determine the prevalance of these and potentially other non-compliant
middlebox products out there.

Bug: boringssl:226
Change-Id: Ie1288fadf84ff6988c741ceef1465c25559a369a
Reviewed-on: https://chromium-review.googlesource.com/891499Reviewed-by: Steven Valdez <svaldez@chromium.org>
Reviewed-by: Alexei Svitkine <asvitkine@chromium.org>
Commit-Queue: Steven Valdez <svaldez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#533811}