[Converge] SSLv2/3 disable/enable related commits

[jasnell]

These commits deal with the SSLv2/v3 enabling/disabling by default. These need to be reconciled with the related changes that have already been made in io.js. This issue may be updated to include additional related commits if necessary.

• b9283cf9d17a51f9654b438216ecb743ed69a7ce tls: honorCipherOrder should not degrade defaults - nodejs/node-v0.x-archive@b9283cf
• 1349b680badeb5d08ad82811af8350dc3e0f0397 crypto: allow forcing SSLv2/v3 via secureProtocol - nodejs/node-v0.x-archive@1349b68
• 6c8593d4568b59770aeb5b2cfa1fdc23ac422523 crypto: move disaling SSLv2/3 into JavaScript - nodejs/node-v0.x-archive@6c8593d

[Fishrock123]

Moved from nodejs/node#16

I think the sslv2/sslv3 stuff may need to be re-written to adapt to io.js changes, or maybe we could revert io.js changes?

Either that or we discuss dropping it again, which we should probably discuss anyways, since re-writing a patch when possible reversion in discussion afterwards before release makes little sense.

[Fishrock123]

0ec78c961b32abf732620682678439c51f74dc86 configure: disable ssl2/ssl3 by default
d6712917f5842fb7124f85902b7e6f68f12f4865 doc: document why SSL2/SSL3 is disabled
c1f4aacc75c0a64a81a2be8d6a3a23aa21a31b15 build: revert change to disable ssl2 and ssl3

Should also be moved here.

[jasnell]

69080f5474369fc7fc4be7ab74ad2e1619eb2fbc tls: enforce secureOptions on incoming clients - nodejs/node-v0.x-archive@69080f5

[jasnell]

8d045a30e95602b443eb259a5021d33feb4df079 tests: add TLS tests matrix - nodejs/node-v0.x-archive@8d045a3

These will likely need to be refactored a bit as well.

[jasnell]

d230fa9eb7364edac09f65a27e11718671d8e773 doc: fix typo secureOptions in tls - nodejs/node-v0.x-archive@d230fa9

[bnoordhuis]

I've commented on it elsewhere but I'm fairly sure there is little support for enabling SSLv2/3 again in io.js, even if it's behind a flag.

/cc @nodejs/crypto

[jasnell]

Related: nodejs/node#19

[jasnell]

Another related: 408bffe212c350a56218e3562e5315da65235a2f test: fix ssl/tls options matrix test - nodejs/node-v0.x-archive@408bffe

[rvagg]

-1 from me, probably another TSC discussion topic

[jasnell]

Ok, given that --enable-ssl2 and --enable-ssl3 were explicitly removed from io.js, this would need to be handled as a revert. @misterdjules @trevnorris @orangemocha @mhdawson @srl295 : if we think these should land in the converged repo, then we'd need to present an argument for reverting the io.js change.

We (IBM) are currently investigating our stuff to see what impact this would have on deployed code but, in general, I'm pretty certain that I'd be -1 on reverting which means these particular commits from joyent/node would not land in the converged stream.

[orangemocha]

No objections from me on leaving those out. I think the rationale for introducing the flags was to mitigate the breaking change in a stable/LTS release. I think it's fine to drop the flags in the converged repo.

[jasnell]

TSC Discussion: there's currently no interest in re-enabling ssl2 and ssl3 support. IBM will continue to investigate impact and will open a new issue if the changes need to be reverted. These commits should not land.