[dev.boringcrypto] all: merge master into dev.boringcrypto

Change-Id: Iba19903f0565b11c648e1fa6effc07b8f97dc322

diff --cc src/cmd/compile/internal/gc/reflect.go
Simple merge

diff --cc src/cmd/go/go_test.go
Simple merge

diff --cc src/cmd/go/internal/load/pkg.go
Simple merge

diff --cc src/cmd/link/internal/ld/lib.go
Simple merge

diff --cc src/crypto/rand/rand_unix.go
index 2bd77f327f5f2758383fcabdf6a36124a920c232,548a5e4cb9a4d3d97c85d8459199324bd14443ce..8bc4abf40c69b5e3c9e5b03fd09ad3b9a36c5d18
--- 1/src/crypto/rand/rand_unix.go
--- 2/src/crypto/rand/rand_unix.go
+++ b/src/crypto/rand/rand_unix.go
@@@ -53,8 -47,11 +53,12 @@@ type devReader struct 
  // urandom-style randomness.
  var altGetRandom func([]byte) (ok bool)
  
+ func warnBlocked() {
+       println("crypto/rand: blocked for 60 seconds waiting to read random data from the kernel")
+ }
+ 
  func (r *devReader) Read(b []byte) (n int, err error) {
 +      boring.Unreachable()
        if atomic.CompareAndSwapInt32(&r.used, 0, 1) {
                // First use of randomness. Start timer to warn about
                // being blocked on entropy not being available.

diff --cc src/crypto/tls/cipher_suites.go
index cbe14f8dbd79094bcd9ca16239d383eb98210a82,9a356758fbfc5dc09835bc6db3c1cee86983f5f1..6596562fb13ecfa8f7aeec0455a48775e6392f39
--- 1/src/crypto/tls/cipher_suites.go
--- 2/src/crypto/tls/cipher_suites.go
+++ b/src/crypto/tls/cipher_suites.go
@@@ -249,30 -247,15 +249,21 @@@ func cipherAES(key, iv []byte, isRead b
        return cipher.NewCBCEncrypter(block, iv)
  }
  
- // macSHA1 returns a macFunction for the given protocol version.
- func macSHA1(version uint16, key []byte) macFunction {
+ // macSHA1 returns a SHA-1 based constant time MAC.
+ func macSHA1(key []byte) hash.Hash {
 -      return hmac.New(newConstantTimeHash(sha1.New), key)
 +      h := sha1.New
 +      // The BoringCrypto SHA1 does not have a constant-time
 +      // checksum function, so don't try to use it.
 +      if !boring.Enabled {
 +              h = newConstantTimeHash(h)
 +      }
-       return tls10MAC{h: hmac.New(h, key)}
++      return hmac.New(h, key)
  }
  
- // macSHA256 returns a SHA-256 based MAC. These are only supported in TLS 1.2
- // so the given version is ignored.
- func macSHA256(version uint16, key []byte) macFunction {
-       return tls10MAC{h: hmac.New(sha256.New, key)}
- }
- 
- type macFunction interface {
-       // Size returns the length of the MAC.
-       Size() int
-       // MAC appends the MAC of (seq, header, data) to out. The extra data is fed
-       // into the MAC after obtaining the result to normalize timing. The result
-       // is only valid until the next invocation of MAC as the buffer is reused.
-       MAC(seq, header, data, extra []byte) []byte
+ // macSHA256 returns a SHA-256 based MAC. This is only supported in TLS 1.2 and
+ // is currently only used in disabled-by-default cipher suites.
+ func macSHA256(key []byte) hash.Hash {
+       return hmac.New(sha256.New, key)
  }
  
  type aead interface {

diff --cc src/crypto/tls/common.go
Simple merge

diff --cc src/crypto/tls/handshake_client.go
Simple merge

diff --cc src/crypto/tls/handshake_client_tls13.go
Simple merge

diff --cc src/crypto/tls/handshake_server.go
Simple merge

diff --cc src/crypto/tls/handshake_server_tls13.go
Simple merge

diff --cc src/crypto/x509/verify.go
Simple merge

diff --cc src/go/build/build.go
Simple merge

diff --cc src/go/build/deps_test.go
Simple merge