delta/go-git.git/src/crypto/tls, branch dev.debug

crypto/tls: pass argument to serverInit rather than using a field in Config.

2017-05-16T18:23:28+00:00

Updates #20164.

Change-Id: Ib900095e7885f25cd779750674a712c770603ca8
Reviewed-on: https://go-review.googlesource.com/42137
Reviewed-by: Russ Cox 
Reviewed-by: Ian Lance Taylor 
Run-TryBot: Ian Lance Taylor 
TryBot-Result: Gobot Gobot

crypto/tls: recommend P256 elliptic curve

2017-04-10T17:40:01+00:00

Users (like myself) may be tempted to think the higher-numbered curve
is somehow better or more secure, but P256 is currently the best
ECDSA implementation, due to its better support in TLS clients, and a
constant time implementation.

For example, sites that present a certificate signed with P521
currently fail to load in Chrome stable, and the error on the Go side
says simply "remote error: tls: illegal parameter".

Fixes #19901.

Change-Id: Ia5e689e7027ec423624627420e33029c56f0bd82
Reviewed-on: https://go-review.googlesource.com/40211
Reviewed-by: Brad Fitzpatrick

crypto/tls: make Config.Clone also clone the GetClientCertificate field

2017-03-02T19:43:07+00:00

Using GetClientCertificate with the http client is currently completely
broken because inside the transport we clone the tls.Config and pass it
off to the tls.Client. Since tls.Config.Clone() does not pass forward
the GetClientCertificate field, GetClientCertificate is ignored in this
context.

Fixes #19264

Change-Id: Ie214f9f0039ac7c3a2dab8ffd14d30668bdb4c71
Signed-off-by: Mike Danese 
Reviewed-on: https://go-review.googlesource.com/37541
Reviewed-by: Filippo Valsorda 
Reviewed-by: Adam Langley 
Run-TryBot: Adam Langley 
TryBot-Result: Gobot Gobot

crypto/tls: use io.ReadFull in conn_test.go

2017-02-24T02:36:10+00:00

An io.Reader does not guarantee that it will read in the entire buffer.
To ensure that property, io.ReadFull should be used instead.

Change-Id: I0b863135ab9abc40e813f9dac07bfb2a76199950
Reviewed-on: https://go-review.googlesource.com/37403
Reviewed-by: Mikio Hara 
Run-TryBot: Mikio Hara 
TryBot-Result: Gobot Gobot

crypto/tls: don't hold lock when closing underlying net.Conn.

2017-02-09T19:02:55+00:00

There's no need to hold the handshake lock across this call and it can
lead to deadlocks if the net.Conn calls back into the tls.Conn.

Fixes #18426.

Change-Id: Ib1b2813cce385949d970f8ad2e52cfbd1390e624
Reviewed-on: https://go-review.googlesource.com/36561
Run-TryBot: Adam Langley 
TryBot-Result: Gobot Gobot 
Reviewed-by: Brad Fitzpatrick

crypto/tls: fix link to more info about channel bindings

2017-02-08T19:57:15+00:00

Link in the description of TLSUnique field of ConnectionState struct
leads to an article that is no longer available, so this commit
replaces it with link to a copy of the very same article on another
site.

Fixes #18842.

Change-Id: I8f8d298c4774dc0fbbad5042db0684bb3220aee8
Reviewed-on: https://go-review.googlesource.com/36052
Reviewed-by: Filippo Valsorda 
Reviewed-by: Adam Langley

crypto/tls: document that only tickets are supported.

2017-02-08T17:54:06+00:00

This change clarifies that only ticket-based resumption is supported by
crypto/tls. It's not clear where to document this for a server,
although perhaps it's obvious there because there's nowhere to plug in
the storage that would be needed by SessionID-based resumption.

Fixes #18607

Change-Id: Iaaed53e8d8f2f45c2f24c0683052df4be6340922
Reviewed-on: https://go-review.googlesource.com/36560
Reviewed-by: Brad Fitzpatrick

cmd/link, crypto/tls: don't use append loops

2017-02-07T16:42:32+00:00

Change-Id: Ib47e295e8646b769c30fd81e5c7f20f964df163e
Reviewed-on: https://go-review.googlesource.com/36335
Reviewed-by: Filippo Valsorda 
Reviewed-by: Brad Fitzpatrick 
Run-TryBot: Brad Fitzpatrick 
TryBot-Result: Gobot Gobot

crypto/tls: reject SNI values with a trailing dot.

2017-02-01T21:59:57+00:00

SNI values may not include a trailing dot according to
https://tools.ietf.org/html/rfc6066#section-3. Although crypto/tls
handled this correctly as a client, it didn't reject this as a server.

This change makes sending an SNI value with a trailing dot a fatal
error.

Updates #18114.

Change-Id: Ib7897ab40e98d4a7a4646ff8469a55233621f631
Reviewed-on: https://go-review.googlesource.com/33904
Run-TryBot: Brad Fitzpatrick 
TryBot-Result: Gobot Gobot 
Reviewed-by: Brad Fitzpatrick

crypto/tls: document ConnectionState.NegotiatedProtocol more clearly

2017-02-01T21:48:27+00:00

ConnectionState.NegotiatedProtocol's documentation implies that it will
always be from Config.NextProtos. This commit clarifies that there is no
guarantee.

This commit also adds a note to
ConnectionState.NegotiatedProtocolIsMutual, making it clear that it is
client side only.

Fixes #18841

Change-Id: Icd028af8042f31e45575f1080c5e9bd3012e03d7
Reviewed-on: https://go-review.googlesource.com/35917
Reviewed-by: Filippo Valsorda 
Reviewed-by: Adam Langley 
Reviewed-by: Brad Fitzpatrick 
Run-TryBot: Adam Langley 
TryBot-Result: Gobot Gobot