delta/go-git.git/src/crypto, branch dev.typealias

[release-branch.go1.8] crypto/elliptic: fix carry bug in x86-64 P-256 implementation.

2017-05-23T17:31:44+00:00

Patch from Vlad Krasnov and confirmed to be under CLA.

Fixes #20040.

Change-Id: Ieb8436c4dcb6669a1620f1e0d257efd047b1b87c
Reviewed-on: https://go-review.googlesource.com/41070
Run-TryBot: Adam Langley 
TryBot-Result: Gobot Gobot 
Reviewed-by: Brad Fitzpatrick 
(cherry picked from commit 9294fa2749ffee7edbbb817a0ef9fe633136fa9c)
Reviewed-on: https://go-review.googlesource.com/43770
Run-TryBot: Brad Fitzpatrick 
Reviewed-by: Chris Broadfoot

[release-branch.go1.8] crypto/tls: make Config.Clone also clone the GetClientCertificate field

2017-03-08T21:19:55+00:00

Using GetClientCertificate with the http client is currently completely
broken because inside the transport we clone the tls.Config and pass it
off to the tls.Client. Since tls.Config.Clone() does not pass forward
the GetClientCertificate field, GetClientCertificate is ignored in this
context.

Fixes #19264

Change-Id: Ie214f9f0039ac7c3a2dab8ffd14d30668bdb4c71
Signed-off-by: Mike Danese 
Reviewed-on: https://go-review.googlesource.com/37541
Reviewed-by: Filippo Valsorda 
Reviewed-by: Adam Langley 
Run-TryBot: Adam Langley 
TryBot-Result: Gobot Gobot 
(cherry picked from commit 87649d32ad16a9a0b7bd5dbd1c124b2032a270f1)
Reviewed-on: https://go-review.googlesource.com/37946
Run-TryBot: Brad Fitzpatrick 
Reviewed-by: Tom Bergan

[release-branch.go1.8] crypto/x509: check for new tls-ca-bundle.pem last

2017-02-08T17:50:39+00:00

We added CentOS 7's /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem
to the list in response to #17549 - not being able to find any certs otherwise.

Now we have #18813, where CentOS 6 apparently has both that file
and /etc/pki/tls/certs/ca-bundle.crt, and the latter is complete while
the former is not.

Moving the new CentOS 7 file to the bottom of the list should fix both
problems: the CentOS 7 system that didn't have any of the other files
in the list will still find the new one, and existing systems will still
keep using what they were using instead of preferring the new path
that may or may not be complete on some systems.

Fixes #18813.

Change-Id: I5275ab67424b95e7210e14938d3e986c8caee0ba
Reviewed-on: https://go-review.googlesource.com/36429
Run-TryBot: Russ Cox 
Reviewed-by: Adam Langley 
Reviewed-on: https://go-review.googlesource.com/36530
TryBot-Result: Gobot Gobot 
Reviewed-by: Brad Fitzpatrick

crypto/x509: revert SystemCertPool implementation for Windows

2017-01-18T05:41:15+00:00

Updates #18609

Change-Id: I8306135660f52cf625bed4c7f53f632e527617de
Reviewed-on: https://go-review.googlesource.com/35265
Run-TryBot: Brad Fitzpatrick 
TryBot-Result: Gobot Gobot 
Reviewed-by: Russ Cox 
Reviewed-by: Quentin Smith

crypto/tls: disable CBC cipher suites with SHA-256 by default

2017-01-17T16:41:09+00:00

As is, they were fully vulnerable to the Lucky13 attack. The SHA1
variants implement limited countermeasures (see f28cf8346c4) but the
SHA256 ones are apparently used rarely enough (see 8741504888b) that
it's not worth the extra code.

Instead, disable them by default and update the warning.

Updates #13385
Updates #15487

Change-Id: I45b8b716001e2fa0811b17e25be76e2512e5abb2
Reviewed-on: https://go-review.googlesource.com/35290
Reviewed-by: Adam Langley 
Reviewed-by: Brad Fitzpatrick 
Run-TryBot: Matt Layher 
TryBot-Result: Gobot Gobot

crypto/dsa: gofmt

2017-01-11T17:10:59+00:00

Somehow this file didn't get gofmted after the last change, which
interferes with merges.

Change-Id: I965cfdbf27a01124a6ed300be9687ff84f68f9a1
Reviewed-on: https://go-review.googlesource.com/35064
Reviewed-by: Matt Layher 
Reviewed-by: Adam Langley 
Reviewed-by: Brad Fitzpatrick 
Run-TryBot: Matt Layher 
TryBot-Result: Gobot Gobot

crypto: detect BMI usability on AMD64 for sha1 and sha256

2017-01-05T15:37:37+00:00

The existing implementations on AMD64 only detects AVX2 usability,
when they also contains BMI (bit-manipulation instructions).
These instructions crash the running program as 'unknown instructions'
on the architecture, e.g. i3-4000M, which supports AVX2 but not
support BMI.

This change added the detections for BMI1 and BMI2 to AMD64 runtime with
two flags as the result, `support_bmi1` and `support_bmi2`,
in runtime/runtime2.go. It also completed the condition to run AVX2 version
in packages crypto/sha1 and crypto/sha256.

Fixes #18512

Change-Id: I917bf0de365237740999de3e049d2e8f2a4385ad
Reviewed-on: https://go-review.googlesource.com/34850
Reviewed-by: Ian Lance Taylor 
Run-TryBot: Ian Lance Taylor 
TryBot-Result: Gobot Gobot

crypto/x509: fix spelling/grammar in comments

2016-12-20T04:56:53+00:00

Also tweak one of the comment lines to fit in 80 characters.

Change-Id: I9c6d2028c29318ba9264486590056cb1ffc8219e
Reviewed-on: https://go-review.googlesource.com/34655
Reviewed-by: Brad Fitzpatrick

crypto/x509: speed up and deflake non-cgo Darwin root cert discovery

2016-12-20T04:48:09+00:00

Piping into security verify-cert only worked on macOS Sierra, and was
flaky for unknown reasons. Users reported that the number of trusted
root certs stopped randomly jumping around once they switched to using
verify-cert against files on disk instead of /dev/stdin.

But even using "security verify-cert" on 150-200 certs took too
long. It took 3.5 seconds on my machine. More than 4 goroutines
hitting verify-cert didn't help much, and soon started to hurt
instead.

New strategy, from comments in the code:

// 1. Run "security trust-settings-export" and "security
//    trust-settings-export -d" to discover the set of certs with some
//    user-tweaked trusy policy. We're too lazy to parse the XML (at
//    least at this stage of Go 1.8) to understand what the trust
//    policy actually is. We just learn that there is _some_ policy.
//
// 2. Run "security find-certificate" to dump the list of system root
//    CAs in PEM format.
//
// 3. For each dumped cert, conditionally verify it with "security
//    verify-cert" if that cert was in the set discovered in Step 1.
//    Without the Step 1 optimization, running "security verify-cert"
//    150-200 times takes 3.5 seconds. With the optimization, the
//    whole process takes about 180 milliseconds with 1 untrusted root
//    CA. (Compared to 110ms in the cgo path)

Fixes #18203

Change-Id: I4e9c11fa50d0273c615382e0d8f9fd03498d4cb4
Reviewed-on: https://go-review.googlesource.com/34389
Run-TryBot: Brad Fitzpatrick 
TryBot-Result: Gobot Gobot 
Reviewed-by: Ian Lance Taylor 
Reviewed-by: Quentin Smith

crypto/tls: fix a typo

2016-12-19T06:01:04+00:00

Change-Id: Id0044c45c23c12ee0bca362a9cdd25369ed7776c
Reviewed-on: https://go-review.googlesource.com/34533
Run-TryBot: Mikio Hara 
TryBot-Result: Gobot Gobot 
Reviewed-by: Brad Fitzpatrick