TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 cipher suite support

[skmcgrail]

Description of changes:

Adds support for the TLS 1.2 cipher suite TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (ECDHE-RSA-AES256-SHA384).

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[skmcgrail]

The parsed updated client hello message:

[
  {
    "ClientHello": {
      "version": "Tls12",
      "random_data": "00000000000000000000000000000000",
      "session_id": "",
      "cipherlist": [
        "0xcca9(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256)",
        "0xcca8(TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256)",
        "0xc02b(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)",
        "0xc02f(TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)",
        "0xc02c(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384)",
        "0xc030(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384)",
        "0xc009(TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA)",
        "0xc013(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA)",
        "0xc027(TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256)",
        "0xc00a(TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA)",
        "0xc014(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA)",
        "0xc028(TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384)",
        "0x009c(TLS_RSA_WITH_AES_128_GCM_SHA256)",
        "0x009d(TLS_RSA_WITH_AES_256_GCM_SHA384)",
        "0x002f(TLS_RSA_WITH_AES_128_CBC_SHA)",
        "0x003c(TLS_RSA_WITH_AES_128_CBC_SHA256)",
        "0x0035(TLS_RSA_WITH_AES_256_CBC_SHA)"
      ],
      "compressionlist": [
        "Null"
      ],
      "extensions": [
        "TlsExtension::ExtendedMasterSecret",
        "TlsExtension::RenegotiationInfo(data=[])",
        "TlsExtension::EllipticCurves([\"EcdhX25519\", \"Secp256r1\", \"Secp384r1\"])",
        "TlsExtension::EcPointFormats([0])",
        "TlsExtension::SessionTicket(data=[])",
        "TlsExtension::SignatureAlgorithms([\"ecdsa_secp256r1_sha256\", \"rsa_pss_rsae_sha256\", \"rsa_pkcs1_sha256\", \"ecdsa_secp384r1_sha384\", \"rsa_pss_rsae_sha384\", \"rsa_pkcs1_sha384\", \"rsa_pss_rsae_sha512\", \"rsa_pkcs1_sha512\", \"rsa_pkcs1_sha1\"])"
      ]
    }
  }
]

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 89.36170% with 10 lines in your changes are missing coverage. Please review.

Project coverage is 77.00%. Comparing base (ad40a9a) to head (d4fa43f).

Files	Patch %	Lines
ssl/ssl_cipher.cc	40.00%	6 Missing ⚠️
crypto/cipher_extra/tls_cbc.c	94.80%	4 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1455   +/-   ##
=======================================
  Coverage   76.99%   77.00%           
=======================================
  Files         425      425           
  Lines       71546    71628   +82     
=======================================
+ Hits        55088    55154   +66     
- Misses      16458    16474   +16     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[samuel40791765]

Can we also document the new cipher support here?

• https://github.com/aws/aws-lc/blob/d09d4230f72ac6eca54d61a129bf22701136d515/docs/porting/functionality-differences.md#libssl-tls-supported-ciphersuites