Bring hyper to draft-13 of HTTP/2.

[Lukasa]

Spec is here. Side-by-side diff is here.

Changes to make:

• Make sure that HEADERS frames with END_STREAM set are allowed to be followed by CONTINUATION frames. (Completed in e59233f.)
• Receiving frames of unknown type is no longer an error, simply discard them. Log that we did so. (Completed in f229d37.)
• Padding has changed again. Update our mixin to cope. (section 6.1) (Completed in a7c42db.)
• Data compression was removed. (section 6.1) (Completed in f4cb68e.)
• Make sure that we include the padding metadata field in the flow control size. (Completed in 260b4f9.)
• Setting IDs are now 16 bit, not 8. (section 6.5.1) (Completed in 34f09a8.)
• SETTINGS_COMPRESS_DATA is gone. (section 6.5.1) (Completed in f4cb68e.)
• CONTINUATION frames can no longer be padded. (Completed in a7c42db.)
• The ALT_SVC frame is gone (though it will be in the extension, so maybe don't delete it just yet: instead, start implementing the extension). (I'm leaving the ALT_SVC frame in place, but continuing to track implementing the extension in Support Alt-Svc #30.)
• Allow trailing HEADERS frames (section 8.1). (Completed in 6620630.)
• Discard any header field beginning with a colon other than the understood ones. (Completed in 7be2800.)
• "Header fields containing multiple values MUST be concatenated unless the order is known to be insignificant". Work out how we do this. (section 8.1.2.3) (Deferred until a good API can be workshopped, tracked roughly by Combine repeated response headers by concatenating their values with a comma separator #36.)
• MUST disable TLS renegotiation. (section 9.2.1) (Appears to be impossible in OpenSSL, so marking as complete.)
• Restricted cipher suites (section 9.2.2) (Deferred, tracked in Cipher Checking #64.)
• Bring HPACK to draft 8, see Bring hyper's HPACK implementation to draft-8. #62. (Completed in cececed.)
• Update hyper NPN/ALPN token to -13. (Completed in 8064e2c.)

[Lukasa]

Let's deal with the restricted cipher suites for a moment. What does that look like in OpenSSL format? The rules are:

1. MUST only be used with cipher suites that support ephemeral key exchange (DHE and ECDHE).
2. Ephemeral key exchange MUST have a minimum size of 2048 bits for DHE or security level of 128 bits for ECDHE
3. Clients MUST accept DHE sizes of up to 4096 bits.
4. HTTP MUST NOT be used with cipher suites that use stream or block ciphers.
5. Authenticated Encryption with Additional Data (AEAD) modes, such as the Galois Counter Model (GCM) mode for AES [RFC5288] are acceptable.
6. If we offer more cipher suites to allow for non-HTTP/2 connections, we must abort if they negotiate too low a level of security with INADEQUATE_SECURITY error code.

I have no idea how to enforce rule 2 in OpenSSL, so let's leave it aside for now. My reading of rule 4 is that we may not use AES-CBC, so that rules those out too. This leaves us with (AFAICT, I am not a cryptographer):

DHE-RSA-AES128-GCM-SHA256
DHE-RSA-AES256-GCM-SHA384
ECDHE-RSA-AES128-GCM-SHA256
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-AES128-GCM-SHA256
ECDHE-ECDSA-AES256-GCM-SHA384

All of these are from the TLSv1.2 suite, which is fine by me.

[dimaqq]

a bit OT: here's a decent layman resource:
http://pyvideo.org/video/2651/the-sorry-state-of-ssl

[public]

@Lukasa I believe OpenSSL will tend to use the same number of bits as the servers private key for DHE. It depends on various parameters of the connection though. You should take a look at the ssl_get_auto_dh function to learn more about this.

[Lukasa]

Disabling TLS renegotiation entirely doesn't seem to be possible in OpenSSL. I haven't seen an API for it. Might have to hunt around.

[Lukasa]

Annoyingly, changing the cipher suite breaks the tests on Travis. Would rather not have to update OpenSSL for each of the Travis tests.

[Lukasa]

Now deferring the cipher suite work to #64.

[Lukasa]

Allow trailing HEADERS frames (section 8.1).

This is fairly easy, actually. Looks like so long as the stream clears self.header_data when it has decoded the headers, and we make sure we append to self.response_errors rather than overwriting it, this will probably just work.

Sometimes it's a good thing that hyper plays fast and loose with the FSM.

[Lukasa]

Only missing HPACK now.

[Lukasa]

HPACK is done.

[Lukasa]