Skip to content

Commit feb6401

Browse files
dbenoit17dbenoit17
authored
Update to Go 1.23.4 (#250)
Backport golang/go@3417000
1 parent b802af5 commit feb6401

File tree

2 files changed

+259
-1
lines changed

2 files changed

+259
-1
lines changed

‎config/versions.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
{
22
"github.com/golang-fips/go": "main",
33
"github.com/golang-fips/openssl": "61a53ab338d5f1657c6fe5d856d24528bfdd731d",
4-
"github.com/golang/go": "go1.23.2"
4+
"github.com/golang/go": "go1.23.4"
55
}

‎patches/023-crypto-tls-fix-config-time.patch‎

Lines changed: 258 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,258 @@
1+
From c75f914df6014f5491838542de39a67d628851ae Mon Sep 17 00:00:00 2001
2+
From: Filippo Valsorda <[email protected]>
3+
Date: Thu, 2 Jan 2025 01:34:40 +0100
4+
Subject: [PATCH] [release-branch.go1.23] crypto/tls: fix Config.Time in tests
5+
using expired certificates
6+
7+
Updates #71077
8+
Fixes #71104
9+
10+
Change-Id: I6a6a465685f3bd50a5bb35a160f87b59b74fa6af
11+
Reviewed-on: https://go-review.googlesource.com/c/go/+/639655
12+
Auto-Submit: Ian Lance Taylor <[email protected]>
13+
Reviewed-by: Damien Neil <[email protected]>
14+
LUCI-TryBot-Result: Go LUCI <[email protected]>
15+
Auto-Submit: Filippo Valsorda <[email protected]>
16+
Auto-Submit: Damien Neil <[email protected]>
17+
Reviewed-by: Joel Sing <[email protected]>
18+
Reviewed-by: Ian Lance Taylor <[email protected]>
19+
Reviewed-on: https://go-review.googlesource.com/c/go/+/640315
20+
Reviewed-by: Filippo Valsorda <[email protected]>
21+
---
22+
src/crypto/tls/handshake_client_test.go | 30 +++++++++++++++----------
23+
src/crypto/tls/handshake_server_test.go | 2 ++
24+
src/crypto/tls/handshake_test.go | 5 +++++
25+
src/crypto/tls/tls_test.go | 6 ++---
26+
4 files changed, 27 insertions(+), 16 deletions(-)
27+
28+
diff --git a/src/crypto/tls/handshake_client_test.go b/src/crypto/tls/handshake_client_test.go
29+
index 1bec17d34b..542b15af0e 100644
30+
--- a/src/crypto/tls/handshake_client_test.go
31+
+++ b/src/crypto/tls/handshake_client_test.go
32+
@@ -852,6 +852,7 @@ func testResumption(t *testing.T, version uint16) {
33+
MaxVersion: version,
34+
CipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA},
35+
Certificates: testConfig.Certificates,
36+
+ Time: testTime,
37+
}
38+
39+
issuer, err := x509.ParseCertificate(testRSACertificateIssuer)
40+
@@ -868,6 +869,7 @@ func testResumption(t *testing.T, version uint16) {
41+
ClientSessionCache: NewLRUClientSessionCache(32),
42+
RootCAs: rootCAs,
43+
ServerName: "example.golang",
44+
+ Time: testTime,
45+
}
46+
47+
testResumeState := func(test string, didResume bool) {
48+
@@ -914,7 +916,7 @@ func testResumption(t *testing.T, version uint16) {
49+
50+
// An old session ticket is replaced with a ticket encrypted with a fresh key.
51+
ticket = getTicket()
52+
- serverConfig.Time = func() time.Time { return time.Now().Add(24*time.Hour + time.Minute) }
53+
+ serverConfig.Time = func() time.Time { return testTime().Add(24*time.Hour + time.Minute) }
54+
testResumeState("ResumeWithOldTicket", true)
55+
if bytes.Equal(ticket, getTicket()) {
56+
t.Fatal("old first ticket matches the fresh one")
57+
@@ -922,13 +924,13 @@ func testResumption(t *testing.T, version uint16) {
58+
59+
// Once the session master secret is expired, a full handshake should occur.
60+
ticket = getTicket()
61+
- serverConfig.Time = func() time.Time { return time.Now().Add(24*8*time.Hour + time.Minute) }
62+
+ serverConfig.Time = func() time.Time { return testTime().Add(24*8*time.Hour + time.Minute) }
63+
testResumeState("ResumeWithExpiredTicket", false)
64+
if bytes.Equal(ticket, getTicket()) {
65+
t.Fatal("expired first ticket matches the fresh one")
66+
}
67+
68+
- serverConfig.Time = func() time.Time { return time.Now() } // reset the time back
69+
+ serverConfig.Time = testTime // reset the time back
70+
key1 := randomKey()
71+
serverConfig.SetSessionTicketKeys([][32]byte{key1})
72+
73+
@@ -945,11 +947,11 @@ func testResumption(t *testing.T, version uint16) {
74+
testResumeState("KeyChangeFinish", true)
75+
76+
// Age the session ticket a bit, but not yet expired.
77+
- serverConfig.Time = func() time.Time { return time.Now().Add(24*time.Hour + time.Minute) }
78+
+ serverConfig.Time = func() time.Time { return testTime().Add(24*time.Hour + time.Minute) }
79+
testResumeState("OldSessionTicket", true)
80+
ticket = getTicket()
81+
// Expire the session ticket, which would force a full handshake.
82+
- serverConfig.Time = func() time.Time { return time.Now().Add(24*8*time.Hour + time.Minute) }
83+
+ serverConfig.Time = func() time.Time { return testTime().Add(24*8*time.Hour + 2*time.Minute) }
84+
testResumeState("ExpiredSessionTicket", false)
85+
if bytes.Equal(ticket, getTicket()) {
86+
t.Fatal("new ticket wasn't provided after old ticket expired")
87+
@@ -957,7 +959,7 @@ func testResumption(t *testing.T, version uint16) {
88+
89+
// Age the session ticket a bit at a time, but don't expire it.
90+
d := 0 * time.Hour
91+
- serverConfig.Time = func() time.Time { return time.Now().Add(d) }
92+
+ serverConfig.Time = func() time.Time { return testTime().Add(d) }
93+
deleteTicket()
94+
testResumeState("GetFreshSessionTicket", false)
95+
for i := 0; i < 13; i++ {
96+
@@ -968,7 +970,7 @@ func testResumption(t *testing.T, version uint16) {
97+
// handshake occurs for TLS 1.2. Resumption should still occur for
98+
// TLS 1.3 since the client should be using a fresh ticket sent over
99+
// by the server.
100+
- d += 12 * time.Hour
101+
+ d += 12*time.Hour + time.Minute
102+
if version == VersionTLS13 {
103+
testResumeState("ExpiredSessionTicket", true)
104+
} else {
105+
@@ -984,6 +986,7 @@ func testResumption(t *testing.T, version uint16) {
106+
MaxVersion: version,
107+
CipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA},
108+
Certificates: testConfig.Certificates,
109+
+ Time: testTime,
110+
}
111+
serverConfig.SetSessionTicketKeys([][32]byte{key2})
112+
113+
@@ -1009,6 +1012,7 @@ func testResumption(t *testing.T, version uint16) {
114+
CurvePreferences: []CurveID{CurveP521, CurveP384, CurveP256},
115+
MaxVersion: version,
116+
Certificates: testConfig.Certificates,
117+
+ Time: testTime,
118+
}
119+
testResumeState("InitialHandshake", false)
120+
testResumeState("WithHelloRetryRequest", true)
121+
@@ -1018,6 +1022,7 @@ func testResumption(t *testing.T, version uint16) {
122+
MaxVersion: version,
123+
CipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA},
124+
Certificates: testConfig.Certificates,
125+
+ Time: testTime,
126+
}
127+
}
128+
129+
@@ -1736,6 +1741,7 @@ func testVerifyConnection(t *testing.T, version uint16) {
130+
serverConfig := &Config{
131+
MaxVersion: version,
132+
Certificates: []Certificate{testConfig.Certificates[0]},
133+
+ Time: testTime,
134+
ClientCAs: rootCAs,
135+
NextProtos: []string{"protocol1"},
136+
}
137+
@@ -1749,6 +1755,7 @@ func testVerifyConnection(t *testing.T, version uint16) {
138+
RootCAs: rootCAs,
139+
ServerName: "example.golang",
140+
Certificates: []Certificate{testConfig.Certificates[0]},
141+
+ Time: testTime,
142+
NextProtos: []string{"protocol1"},
143+
}
144+
test.configureClient(clientConfig, &clientCalled)
145+
@@ -1791,8 +1798,6 @@ func testVerifyPeerCertificate(t *testing.T, version uint16) {
146+
rootCAs := x509.NewCertPool()
147+
rootCAs.AddCert(issuer)
148+
149+
- now := func() time.Time { return time.Unix(1476984729, 0) }
150+
-
151+
sentinelErr := errors.New("TestVerifyPeerCertificate")
152+
153+
verifyPeerCertificateCallback := func(called *bool, rawCerts [][]byte, validatedChains [][]*x509.Certificate) error {
154+
@@ -2038,7 +2043,7 @@ func testVerifyPeerCertificate(t *testing.T, version uint16) {
155+
config.ServerName = "example.golang"
156+
config.ClientAuth = RequireAndVerifyClientCert
157+
config.ClientCAs = rootCAs
158+
- config.Time = now
159+
+ config.Time = testTime
160+
config.MaxVersion = version
161+
config.Certificates = make([]Certificate, 1)
162+
config.Certificates[0].Certificate = [][]byte{testRSACertificate}
163+
@@ -2055,7 +2060,7 @@ func testVerifyPeerCertificate(t *testing.T, version uint16) {
164+
config := testConfig.Clone()
165+
config.ServerName = "example.golang"
166+
config.RootCAs = rootCAs
167+
- config.Time = now
168+
+ config.Time = testTime
169+
config.MaxVersion = version
170+
test.configureClient(config, &clientCalled)
171+
clientErr := Client(c, config).Handshake()
172+
@@ -2369,7 +2374,7 @@ func testGetClientCertificate(t *testing.T, version uint16) {
173+
serverConfig.RootCAs = x509.NewCertPool()
174+
serverConfig.RootCAs.AddCert(issuer)
175+
serverConfig.ClientCAs = serverConfig.RootCAs
176+
- serverConfig.Time = func() time.Time { return time.Unix(1476984729, 0) }
177+
+ serverConfig.Time = testTime
178+
serverConfig.MaxVersion = version
179+
180+
clientConfig := testConfig.Clone()
181+
@@ -2540,6 +2545,7 @@ func testResumptionKeepsOCSPAndSCT(t *testing.T, ver uint16) {
182+
ClientSessionCache: NewLRUClientSessionCache(32),
183+
ServerName: "example.golang",
184+
RootCAs: roots,
185+
+ Time: testTime,
186+
}
187+
serverConfig := testConfig.Clone()
188+
serverConfig.MaxVersion = ver
189+
diff --git a/src/crypto/tls/handshake_server_test.go b/src/crypto/tls/handshake_server_test.go
190+
index 94d3d0f6dc..bbfe44bd97 100644
191+
--- a/src/crypto/tls/handshake_server_test.go
192+
+++ b/src/crypto/tls/handshake_server_test.go
193+
@@ -501,6 +501,7 @@ func testCrossVersionResume(t *testing.T, version uint16) {
194+
serverConfig := &Config{
195+
CipherSuites: []uint16{TLS_RSA_WITH_AES_128_CBC_SHA},
196+
Certificates: testConfig.Certificates,
197+
+ Time: testTime,
198+
}
199+
clientConfig := &Config{
200+
CipherSuites: []uint16{TLS_RSA_WITH_AES_128_CBC_SHA},
201+
@@ -508,6 +509,7 @@ func testCrossVersionResume(t *testing.T, version uint16) {
202+
ClientSessionCache: NewLRUClientSessionCache(1),
203+
ServerName: "servername",
204+
MinVersion: VersionTLS12,
205+
+ Time: testTime,
206+
}
207+
208+
// Establish a session at TLS 1.3.
209+
diff --git a/src/crypto/tls/handshake_test.go b/src/crypto/tls/handshake_test.go
210+
index 41c2643f2a..803aa73657 100644
211+
--- a/src/crypto/tls/handshake_test.go
212+
+++ b/src/crypto/tls/handshake_test.go
213+
@@ -519,6 +519,11 @@ func fromHex(s string) []byte {
214+
return b
215+
}
216+
217+
+// testTime is 2016-10-20T17:32:09.000Z, which is within the validity period of
218+
+// [testRSACertificate], [testRSACertificateIssuer], [testRSA2048Certificate],
219+
+// [testRSA2048CertificateIssuer], and [testECDSACertificate].
220+
+var testTime = func() time.Time { return time.Unix(1476984729, 0) }
221+
+
222+
var testRSACertificate = fromHex("3082024b308201b4a003020102020900e8f09d3fe25beaa6300d06092a864886f70d01010b0500301f310b3009060355040a1302476f3110300e06035504031307476f20526f6f74301e170d3136303130313030303030305a170d3235303130313030303030305a301a310b3009060355040a1302476f310b300906035504031302476f30819f300d06092a864886f70d010101050003818d0030818902818100db467d932e12270648bc062821ab7ec4b6a25dfe1e5245887a3647a5080d92425bc281c0be97799840fb4f6d14fd2b138bc2a52e67d8d4099ed62238b74a0b74732bc234f1d193e596d9747bf3589f6c613cc0b041d4d92b2b2423775b1c3bbd755dce2054cfa163871d1e24c4f31d1a508baab61443ed97a77562f414c852d70203010001a38193308190300e0603551d0f0101ff0404030205a0301d0603551d250416301406082b0601050507030106082b06010505070302300c0603551d130101ff0402300030190603551d0e041204109f91161f43433e49a6de6db680d79f60301b0603551d230414301280104813494d137e1631bba301d5acab6e7b30190603551d1104123010820e6578616d706c652e676f6c616e67300d06092a864886f70d01010b0500038181009d30cc402b5b50a061cbbae55358e1ed8328a9581aa938a495a1ac315a1a84663d43d32dd90bf297dfd320643892243a00bccf9c7db74020015faad3166109a276fd13c3cce10c5ceeb18782f16c04ed73bbb343778d0c1cf10fa1d8408361c94c722b9daedb4606064df4c1b33ec0d1bd42d4dbfe3d1360845c21d33be9fae7")
223+
224+
var testRSACertificateIssuer = fromHex("3082021930820182a003020102020900ca5e4e811a965964300d06092a864886f70d01010b0500301f310b3009060355040a1302476f3110300e06035504031307476f20526f6f74301e170d3136303130313030303030305a170d3235303130313030303030305a301f310b3009060355040a1302476f3110300e06035504031307476f20526f6f7430819f300d06092a864886f70d010101050003818d0030818902818100d667b378bb22f34143b6cd2008236abefaf2852adf3ab05e01329e2c14834f5105df3f3073f99dab5442d45ee5f8f57b0111c8cb682fbb719a86944eebfffef3406206d898b8c1b1887797c9c5006547bb8f00e694b7a063f10839f269f2c34fff7a1f4b21fbcd6bfdfb13ac792d1d11f277b5c5b48600992203059f2a8f8cc50203010001a35d305b300e0603551d0f0101ff040403020204301d0603551d250416301406082b0601050507030106082b06010505070302300f0603551d130101ff040530030101ff30190603551d0e041204104813494d137e1631bba301d5acab6e7b300d06092a864886f70d01010b050003818100c1154b4bab5266221f293766ae4138899bd4c5e36b13cee670ceeaa4cbdf4f6679017e2fe649765af545749fe4249418a56bd38a04b81e261f5ce86b8d5c65413156a50d12449554748c59a30c515bc36a59d38bddf51173e899820b282e40aa78c806526fd184fb6b4cf186ec728edffa585440d2b3225325f7ab580e87dd76")
225+
diff --git a/src/crypto/tls/tls_test.go b/src/crypto/tls/tls_test.go
226+
index fc5040635f..13c5ddced2 100644
227+
--- a/src/crypto/tls/tls_test.go
228+
+++ b/src/crypto/tls/tls_test.go
229+
@@ -1112,8 +1112,6 @@ func TestConnectionState(t *testing.T) {
230+
rootCAs := x509.NewCertPool()
231+
rootCAs.AddCert(issuer)
232+
233+
- now := func() time.Time { return time.Unix(1476984729, 0) }
234+
-
235+
const alpnProtocol = "golang"
236+
const serverName = "example.golang"
237+
var scts = [][]byte{[]byte("dummy sct 1"), []byte("dummy sct 2")}
238+
@@ -1129,7 +1127,7 @@ func TestConnectionState(t *testing.T) {
239+
}
240+
t.Run(name, func(t *testing.T) {
241+
config := &Config{
242+
- Time: now,
243+
+ Time: testTime,
244+
Rand: zeroSource{},
245+
Certificates: make([]Certificate, 1),
246+
MaxVersion: v,
247+
@@ -1760,7 +1758,7 @@ func testVerifyCertificates(t *testing.T, version uint16) {
248+
var serverVerifyPeerCertificates, clientVerifyPeerCertificates bool
249+
250+
clientConfig := testConfig.Clone()
251+
- clientConfig.Time = func() time.Time { return time.Unix(1476984729, 0) }
252+
+ clientConfig.Time = testTime
253+
clientConfig.MaxVersion = version
254+
clientConfig.MinVersion = version
255+
clientConfig.RootCAs = rootCAs
256+
--
257+
2.47.1
258+

0 commit comments

Comments
 (0)