kris/th5
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
6918d87d90
th5/testdata/Client-TLSv12-RenegotiateOnce

250 lines
19 KiB
Plaintext
Raw Normal View History

crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 1 (client to server)
crypto/tls: support AES-128-CBC cipher suites with SHA-256. These were new with TLS 1.2 and, reportedly, some servers require it. Since it's easy, this change adds suport for three flavours of AES-128-CBC with SHA-256 MACs. Other testdata/ files have to be updated because this changes the list of cipher suites offered by default by the client. Fixes #15487. Change-Id: I1b14330c31eeda20185409a37072343552c3464f Reviewed-on: https://go-review.googlesource.com/27315 Run-TryBot: Adam Langley <agl@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Jonathan Rudenberg <jonathan@titanous.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-08-18 00:45:47 +01:00
00000000 16 03 01 00 8b 01 00 00 87 03 03 00 00 00 00 00 |................|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
crypto/tls: support AES-128-CBC cipher suites with SHA-256. These were new with TLS 1.2 and, reportedly, some servers require it. Since it's easy, this change adds suport for three flavours of AES-128-CBC with SHA-256 MACs. Other testdata/ files have to be updated because this changes the list of cipher suites offered by default by the client. Fixes #15487. Change-Id: I1b14330c31eeda20185409a37072343552c3464f Reviewed-on: https://go-review.googlesource.com/27315 Run-TryBot: Adam Langley <agl@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Jonathan Rudenberg <jonathan@titanous.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-08-18 00:45:47 +01:00
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 28 c0 2f |.............(./|
00000030 c0 2b c0 30 c0 2c c0 27 c0 13 c0 23 c0 09 c0 14 |.+.0.,.'...#....|
00000040 c0 0a 00 9c 00 9d 00 3c 00 2f 00 35 c0 12 00 0a |.......<./.5....|
00000050 00 05 c0 11 c0 07 01 00 00 36 00 05 00 05 01 00 |.........6......|
00000060 00 00 00 00 0a 00 08 00 06 00 17 00 18 00 19 00 |................|
00000070 0b 00 02 01 00 00 0d 00 0e 00 0c 04 01 04 03 05 |................|
00000080 01 05 03 02 01 02 03 ff 01 00 01 00 00 12 00 00 |................|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 2 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 00 59 02 00 00 55 03 03 d0 8f ad 7c 5c |....Y...U.....|\|
00000010 c1 51 df d4 b5 9f df 51 97 c9 5e 32 63 a1 c1 51 |.Q.....Q..^2c..Q|
00000020 04 1f 16 56 c7 0a 7e ee 4d b7 35 20 e8 5f ae 69 |...V..~.M.5 ._.i|
00000030 a3 ad f2 2d ba d3 c5 8c 07 b1 b9 38 39 b5 ef 1e |...-.......89...|
00000040 7a 5e 2d f0 63 7a 60 4f 43 10 07 e1 c0 2f 00 00 |z^-.cz`OC..../..|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
00000050 0d ff 01 00 01 00 00 0b 00 04 03 00 01 02 16 03 |................|
crypto/x509: require a NULL parameters for RSA public keys. The RFC is clear that the Parameters in an AlgorithmIdentifer for an RSA public key must be NULL. BoringSSL enforces this so we have strong evidence that this is a widely compatible change. Embarrassingly enough, the major source of violations of this is us. Go used to get this correct in only one of two places. This was only fixed in 2013 (with 4874bc9b). That's why lots of test certificates are updated in this change. Fixes #16166. Change-Id: Ib9a4551349354c66e730d44eb8cee4ec402ea8ab Reviewed-on: https://go-review.googlesource.com/27312 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-08-17 23:55:15 +01:00
00000060 03 02 59 0b 00 02 55 00 02 52 00 02 4f 30 82 02 |..Y...U..R..O0..|
00000070 4b 30 82 01 b4 a0 03 02 01 02 02 09 00 e8 f0 9d |K0..............|
00000080 3f e2 5b ea a6 30 0d 06 09 2a 86 48 86 f7 0d 01 |?.[..0...*.H....|
00000090 01 0b 05 00 30 1f 31 0b 30 09 06 03 55 04 0a 13 |....0.1.0...U...|
000000a0 02 47 6f 31 10 30 0e 06 03 55 04 03 13 07 47 6f |.Go1.0...U....Go|
000000b0 20 52 6f 6f 74 30 1e 17 0d 31 36 30 31 30 31 30 | Root0...1601010|
000000c0 30 30 30 30 30 5a 17 0d 32 35 30 31 30 31 30 30 |00000Z..25010100|
000000d0 30 30 30 30 5a 30 1a 31 0b 30 09 06 03 55 04 0a |0000Z0.1.0...U..|
000000e0 13 02 47 6f 31 0b 30 09 06 03 55 04 03 13 02 47 |..Go1.0...U....G|
000000f0 6f 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 |o0..0...*.H.....|
00000100 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 db 46 |.......0.......F|
00000110 7d 93 2e 12 27 06 48 bc 06 28 21 ab 7e c4 b6 a2 |}...'.H..(!.~...|
00000120 5d fe 1e 52 45 88 7a 36 47 a5 08 0d 92 42 5b c2 |]..RE.z6G....B[.|
00000130 81 c0 be 97 79 98 40 fb 4f 6d 14 fd 2b 13 8b c2 |....y.@.Om..+...|
00000140 a5 2e 67 d8 d4 09 9e d6 22 38 b7 4a 0b 74 73 2b |..g....."8.J.ts+|
00000150 c2 34 f1 d1 93 e5 96 d9 74 7b f3 58 9f 6c 61 3c |.4......t{.X.la<|
00000160 c0 b0 41 d4 d9 2b 2b 24 23 77 5b 1c 3b bd 75 5d |..A..++$#w[.;.u]|
00000170 ce 20 54 cf a1 63 87 1d 1e 24 c4 f3 1d 1a 50 8b |. T..c...$....P.|
00000180 aa b6 14 43 ed 97 a7 75 62 f4 14 c8 52 d7 02 03 |...C...ub...R...|
00000190 01 00 01 a3 81 93 30 81 90 30 0e 06 03 55 1d 0f |......0..0...U..|
000001a0 01 01 ff 04 04 03 02 05 a0 30 1d 06 03 55 1d 25 |.........0...U.%|
000001b0 04 16 30 14 06 08 2b 06 01 05 05 07 03 01 06 08 |..0...+.........|
000001c0 2b 06 01 05 05 07 03 02 30 0c 06 03 55 1d 13 01 |+.......0...U...|
000001d0 01 ff 04 02 30 00 30 19 06 03 55 1d 0e 04 12 04 |....0.0...U.....|
000001e0 10 9f 91 16 1f 43 43 3e 49 a6 de 6d b6 80 d7 9f |.....CC>I..m....|
000001f0 60 30 1b 06 03 55 1d 23 04 14 30 12 80 10 48 13 |`0...U.#..0...H.|
00000200 49 4d 13 7e 16 31 bb a3 01 d5 ac ab 6e 7b 30 19 |IM.~.1......n{0.|
00000210 06 03 55 1d 11 04 12 30 10 82 0e 65 78 61 6d 70 |..U....0...examp|
00000220 6c 65 2e 67 6f 6c 61 6e 67 30 0d 06 09 2a 86 48 |le.golang0...*.H|
00000230 86 f7 0d 01 01 0b 05 00 03 81 81 00 9d 30 cc 40 |.............0.@|
00000240 2b 5b 50 a0 61 cb ba e5 53 58 e1 ed 83 28 a9 58 |+[P.a...SX...(.X|
00000250 1a a9 38 a4 95 a1 ac 31 5a 1a 84 66 3d 43 d3 2d |..8....1Z..f=C.-|
00000260 d9 0b f2 97 df d3 20 64 38 92 24 3a 00 bc cf 9c |...... d8.$:....|
00000270 7d b7 40 20 01 5f aa d3 16 61 09 a2 76 fd 13 c3 |}.@ ._...a..v...|
00000280 cc e1 0c 5c ee b1 87 82 f1 6c 04 ed 73 bb b3 43 |...\.....l..s..C|
00000290 77 8d 0c 1c f1 0f a1 d8 40 83 61 c9 4c 72 2b 9d |w.......@.a.Lr+.|
000002a0 ae db 46 06 06 4d f4 c1 b3 3e c0 d1 bd 42 d4 db |..F..M...>...B..|
000002b0 fe 3d 13 60 84 5c 21 d3 3b e9 fa e7 16 03 03 00 |.=.`.\!.;.......|
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
000002c0 cd 0c 00 00 c9 03 00 17 41 04 83 e4 35 de e3 59 |........A...5..Y|
000002d0 fd 3c 52 7d 20 97 25 7d 1d c2 8b ad 46 af 18 9e |.<R} .%}....F...|
000002e0 70 d0 97 44 f0 92 c7 eb 74 2e 49 bd 32 63 2b 78 |p..D....t.I.2c+x|
000002f0 c1 0c a9 70 31 1f a7 41 98 fb e8 71 a8 31 a7 6b |...p1..A...q.1.k|
00000300 53 27 34 72 e9 fd 7b f2 61 a6 04 01 00 80 26 22 |S'4r..{.a.....&"|
00000310 53 23 07 76 1c df 3e 9a 57 15 a0 ff 9b 92 e4 6d |S#.v..>.W......m|
00000320 8a 8a 5a 5d a7 69 c2 09 bb 7d 1d 30 58 4e 7d 38 |..Z].i...}.0XN}8|
00000330 de ec 97 52 eb 80 00 d6 20 cc 51 b7 3f 6c 8b 4a |...R.... .Q.?l.J|
00000340 f6 05 8e e5 15 63 98 24 da 10 17 dd aa 73 ab ff |.....c.$.....s..|
00000350 d0 55 1c cd b7 e8 fd cf 93 f1 13 62 14 e4 4a a0 |.U.........b..J.|
00000360 bf 15 09 68 47 d7 6c 24 06 b3 62 ac c5 70 b5 6d |...hG.l$..b..p.m|
00000370 ae 54 95 d2 4b 49 51 3f c6 cf 57 c5 dd 5d a5 b3 |.T..KIQ?..W..]..|
00000380 9a bb df a6 98 43 a5 b3 65 dc 3e 15 31 e0 16 03 |.....C..e.>.1...|
crypto/x509: require a NULL parameters for RSA public keys. The RFC is clear that the Parameters in an AlgorithmIdentifer for an RSA public key must be NULL. BoringSSL enforces this so we have strong evidence that this is a widely compatible change. Embarrassingly enough, the major source of violations of this is us. Go used to get this correct in only one of two places. This was only fixed in 2013 (with 4874bc9b). That's why lots of test certificates are updated in this change. Fixes #16166. Change-Id: Ib9a4551349354c66e730d44eb8cee4ec402ea8ab Reviewed-on: https://go-review.googlesource.com/27312 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-08-17 23:55:15 +01:00
00000390 03 00 04 0e 00 00 00 |.......|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 3 (client to server)
00000000 16 03 03 00 46 10 00 00 42 41 04 1e 18 37 ef 0d |....F...BA...7..|
00000010 19 51 88 35 75 71 b5 e5 54 5b 12 2e 8f 09 67 fd |.Q.5uq..T[....g.|
00000020 a7 24 20 3e b2 56 1c ce 97 28 5e f8 2b 2d 4f 9e |.$ >.V...(^.+-O.|
00000030 f1 07 9f 6c 4b 5b 83 56 e2 32 42 e9 58 b6 d7 49 |...lK[.V.2B.X..I|
00000040 a6 b5 68 1a 41 03 56 6b dc 5a 89 14 03 03 00 01 |..h.A.Vk.Z......|
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000050 01 16 03 03 00 28 00 00 00 00 00 00 00 00 29 1e |.....(........).|
00000060 f5 7d 69 cf 87 63 a7 68 94 5b 63 79 ea 69 cb 18 |.}i..c.h.[cy.i..|
00000070 93 ce c5 8a 6d 08 12 5a 25 29 b6 e3 8e d9 |....m..Z%)....|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 4 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 14 03 03 00 01 01 16 03 03 00 28 dc 61 07 b0 47 |..........(.a..G|
00000010 de b3 54 36 57 08 d0 3b 03 8d a0 bc d5 d9 33 44 |..T6W..;......3D|
00000020 2c e6 0e 83 d2 2b 76 68 79 40 3d bd dc 94 b3 78 |,....+vhy@=....x|
00000030 f3 a9 90 |...|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 5 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 17 03 03 00 1e 00 00 00 00 00 00 00 01 f9 c2 34 |...............4|
00000010 5f 2a 2d ed 0a b4 ad 06 df b0 a9 b8 d4 c0 c8 40 |_*-............@|
00000020 86 c8 12 |...|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 6 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 00 1c dc 61 07 b0 47 de b3 55 e6 b0 75 |......a..G..U..u|
00000010 46 b3 e7 a0 f2 83 e9 18 cf 06 1d 3c 31 a2 ba a7 |F..........<1...|
00000020 80 |.|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 7 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 00 af 00 00 00 00 00 00 00 02 cc 27 82 |..............'.|
00000010 46 a9 cf ee e3 94 6b 8b a9 e2 08 e1 b9 f1 60 c8 |F.....k.......`.|
00000020 57 46 61 c0 7a a8 d1 31 1e 6f 0c d0 5b 29 ca 85 |WFa.z..1.o..[)..|
00000030 86 42 ba 0b df 5e d2 87 6e 86 43 3f 99 42 5d b2 |.B...^..n.C?.B].|
00000040 65 1d f7 a8 fb 6e 93 58 c7 52 ec a6 b8 ef d7 69 |e....n.X.R.....i|
00000050 7b 3a f4 a5 db 3b bd 2c 1a d6 8d 3b db 18 be 33 |{:...;.,...;...3|
00000060 b1 c7 57 d3 6a 70 41 ff 86 08 ce b8 69 e8 20 29 |..W.jpA.....i. )|
00000070 c5 42 e5 bd d0 e5 0a 90 dd fb ae cf dc f1 f5 87 |.B..............|
00000080 24 88 bb 5d 98 8f dd 4b c4 df 1c 8c 4c 30 19 ee |$..]...K....L0..|
00000090 22 7b 34 f7 e1 b7 94 38 62 35 a4 b5 24 dd bb 10 |"{4....8b5..$...|
000000a0 47 09 18 71 7f ba fc 49 79 40 ca 98 d7 a7 53 b6 |G..q...Iy@....S.|
000000b0 8d 07 5e 75 |..^u|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 8 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 00 89 dc 61 07 b0 47 de b3 56 aa 83 11 |......a..G..V...|
00000010 cb 18 ad c3 f8 44 c0 d3 34 2f f1 dc 97 86 59 ec |.....D..4/....Y.|
00000020 f9 f6 ff dd 09 84 9a f0 7b 77 93 24 06 1d 58 6f |........{w.$..Xo|
00000030 80 93 9b 10 fc ad 65 22 62 4a ad 31 2d 2e 8b 17 |......e"bJ.1-...|
00000040 f8 09 dc aa f4 67 86 db 28 14 d1 36 3c e7 60 1a |.....g..(..6<.`.|
00000050 4b 1e 2c f0 d6 ce 34 d6 ee 6a 5e 92 bd e5 3e d8 |K.,...4..j^...>.|
00000060 de 7a e9 03 69 5d 28 4e d6 7c ef 1b 4b da ed 80 |.z..i](N.|..K...|
00000070 3c 39 17 ea 36 6a 71 2c 12 7b 63 19 4c 5d 65 b2 |<9..6jq,.{c.L]e.|
00000080 3f 55 9b 65 86 0f 73 2a a7 b8 a4 2e ab 83 16 03 |?U.e..s*........|
00000090 03 02 71 dc 61 07 b0 47 de b3 57 38 03 44 38 6f |..q.a..G..W8.D8o|
000000a0 8b e4 93 68 fe 4b 58 09 de 5f c1 9e 6c ab bf 65 |...h.KX.._..l..e|
000000b0 70 37 b1 12 46 e7 eb e2 86 26 67 0a 30 e9 91 09 |p7..F....&g.0...|
000000c0 7a 4c d4 bb 01 52 5b 77 a8 61 69 5e 8b 1b 03 a6 |zL...R[w.ai^....|
000000d0 97 7f b0 6e 71 9d d4 32 3f df 71 35 5c 83 6e bc |...nq..2?.q5\.n.|
000000e0 ed ac cb 54 90 d1 f6 1b 6e 15 cf 4a a5 b1 0a 85 |...T....n..J....|
000000f0 01 0c b5 cf ae 9e 41 7e bc 59 81 53 64 af f7 5c |......A~.Y.Sd..\|
00000100 f9 07 be d7 35 01 b6 1d 1e 0f 74 4e 38 5b f6 6c |....5.....tN8[.l|
00000110 02 74 a5 04 10 e9 6c 55 89 f6 e7 3d f7 2a a1 62 |.t....lU...=.*.b|
00000120 3e 2d 0e c6 6d 12 0a db 95 6d 38 a0 a0 13 c8 88 |>-..m....m8.....|
00000130 c8 7d f1 a9 9e bd 0c cb 0a af 5a 07 3d ee 5e 2e |.}........Z.=.^.|
00000140 74 18 ca 5b c6 f0 d3 57 9d ea fb 74 8e 6f a2 70 |t..[...W...t.o.p|
00000150 09 69 e2 e5 92 c0 83 2e 2c df 16 9d 71 a4 29 51 |.i......,...q.)Q|
00000160 c8 e9 13 c6 fc 2b 4b 4d ad cf d9 0a 47 8e ae d3 |.....+KM....G...|
00000170 0a 88 aa f8 28 be 88 dc b1 d3 03 a0 23 7d f6 f7 |....(.......#}..|
00000180 cd d1 81 fe b6 6a a4 7c 21 d4 c7 3d 5e 17 83 b6 |.....j.|!..=^...|
00000190 ce cd 45 6e ed 3c d1 f3 e2 a8 68 6e 91 b1 e7 4e |..En.<....hn...N|
000001a0 35 60 df c7 e6 cb e2 c8 c6 2d 68 d7 4d 8c ac c3 |5`.......-h.M...|
000001b0 71 6b 46 a0 c3 7d a0 59 22 01 ed 26 6d e2 d2 4c |qkF..}.Y"..&m..L|
000001c0 8c b9 94 17 18 98 96 a2 52 ec 24 b7 f3 09 5e e4 |........R.$...^.|
000001d0 89 f8 23 f3 73 5f 3c 3d 15 67 05 c9 39 f7 71 88 |..#.s_<=.g..9.q.|
000001e0 9e 86 18 2e ae 47 4f 3e d7 2c fa 29 f1 c0 58 94 |.....GO>.,.)..X.|
000001f0 5f 37 26 1c f1 87 5c b5 fb c4 4d 9e ae 17 40 7c |_7&...\...M...@||
00000200 fa e7 b6 e8 9c 3a 43 13 8d 3c 00 5c 72 fc 40 c1 |.....:C..<.\r.@.|
00000210 03 0f fd 4c c0 5b d8 42 30 6b 3a 05 85 05 9d db |...L.[.B0k:.....|
00000220 ab 34 00 d1 cd 6f 74 eb d3 ed 49 f8 d3 ca 35 59 |.4...ot...I...5Y|
00000230 90 d4 93 4e 04 8d 73 13 dc 21 de 40 94 2f d6 3a |...N..s..!.@./.:|
00000240 aa a1 47 94 18 3b 56 18 91 18 22 e7 56 e8 6c b4 |..G..;V...".V.l.|
00000250 9f 47 09 b1 c4 8c ba 3d 45 8f b8 82 fa 03 61 df |.G.....=E.....a.|
00000260 55 9a 31 a8 03 13 ab b1 b0 38 68 7d e9 3e c0 bc |U.1......8h}.>..|
00000270 6c d8 75 8f 4c 10 09 07 3b 7e a5 dc ec 77 02 c4 |l.u.L...;~...w..|
00000280 8d a0 ad 30 55 4d f8 8e 06 d4 47 ea 8a 29 ee 1d |...0UM....G..)..|
00000290 93 fb 51 17 3d 93 ab 57 34 1f 4d 85 90 fe e4 88 |..Q.=..W4.M.....|
000002a0 ab 4a 0f 43 c4 b7 73 70 fc fe 46 db 59 79 f3 34 |.J.C..sp..F.Yy.4|
000002b0 d1 48 61 a7 6b 45 bc e3 b7 9e 02 ce a0 c8 a8 4f |.Ha.kE.........O|
000002c0 01 7e bd 96 7f c3 5e 33 d8 1b 87 7f 7f 98 dc 60 |.~....^3.......`|
000002d0 ff f8 41 3a 7d ea 40 71 ab 6f f3 fd eb b1 49 54 |..A:}.@q.o....IT|
000002e0 91 35 f2 49 e0 59 86 f5 7d e0 47 b1 fd 03 f0 a4 |.5.I.Y..}.G.....|
000002f0 69 a1 27 87 ef c7 a4 e3 b9 cf 5e 81 6a c0 86 19 |i.'.......^.j...|
00000300 e1 e9 60 d2 16 03 03 00 e5 dc 61 07 b0 47 de b3 |..`.......a..G..|
00000310 58 c5 55 fc 9d ec dd 21 9b 1c 21 1a 02 b2 a1 34 |X.U....!..!....4|
00000320 e3 ea 8b f6 ff 85 e1 65 3f 3d f2 df 89 56 7f 76 |.......e?=...V.v|
00000330 56 f1 de 1e 22 90 03 f7 32 74 67 64 54 ce cd 05 |V..."...2tgdT...|
00000340 39 b0 48 c9 d6 fd 07 bd a3 e5 5d ea 54 68 95 23 |9.H.......].Th.#|
00000350 72 0b ec 1b 22 b4 9e 09 98 be c7 c3 03 ce 97 95 |r..."...........|
00000360 c0 31 d8 c1 48 b3 bc b8 76 69 19 1a 8a eb 41 08 |.1..H...vi....A.|
00000370 c2 a2 b1 f6 fb d9 01 1e 12 22 a4 90 12 97 61 f0 |........."....a.|
00000380 79 5b cc 82 5c 3c d0 38 28 1c 70 d2 24 f5 02 4c |y[..\<.8(.p.$..L|
00000390 b9 dc f3 6f 10 e7 63 7d 2a e5 7c b1 55 37 b1 37 |...o..c}*.|.U7.7|
000003a0 b3 7d 67 d7 06 b7 83 a0 f9 e9 e5 40 f2 6a 52 ee |.}g........@.jR.|
000003b0 70 06 c2 92 bc 0c c3 55 ff 73 98 58 f6 c7 4d 50 |p......U.s.X..MP|
000003c0 8b fe 69 ac ae 7e bf 7e 22 33 11 0c e3 e4 04 65 |..i..~.~"3.....e|
000003d0 aa 71 4c 52 0b 3c a8 c3 d1 a2 77 2b 03 e7 b6 72 |.qLR.<....w+...r|
000003e0 53 d5 c9 f2 3a 88 51 01 26 f0 15 92 ca ed 16 03 |S...:.Q.&.......|
000003f0 03 00 42 dc 61 07 b0 47 de b3 59 a9 38 ea 5e a2 |..B.a..G..Y.8.^.|
00000400 dc 8e 61 8a 36 8b df 7d 94 cc 9e 4d b5 e7 ed 98 |..a.6..}...M....|
00000410 70 1f b6 05 a4 92 98 e3 81 56 ae fe cf 60 90 71 |p........V...`.q|
00000420 7d e1 b3 52 71 2a 41 b2 88 47 3e bb f9 83 40 1a |}..Rq*A..G>...@.|
00000430 1b dd 4d cd e0 16 03 03 00 1c dc 61 07 b0 47 de |..M........a..G.|
00000440 b3 5a 6c e8 c1 8f e5 32 03 e9 2d 9f 5e b9 a1 03 |.Zl....2..-.^...|
00000450 30 08 89 eb 60 2d |0...`-|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 9 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 02 71 00 00 00 00 00 00 00 03 c8 62 78 |....q.........bx|
00000010 36 de 67 bf c2 e0 5e 6d d3 d5 9b 78 9d d8 a3 ee |6.g...^m...x....|
00000020 dc 87 9d dc f9 c4 07 a1 fa 5a 6c 5c 4a 3a 77 4d |.........Zl\J:wM|
00000030 5e ac 07 7a 10 f1 d4 00 3d 91 97 17 28 aa 08 61 |^..z....=...(..a|
00000040 ad 1c 55 61 ab 2f d7 21 c5 49 48 a5 f0 5e c9 30 |..Ua./.!.IH..^.0|
00000050 38 a3 ea ec 6b 51 8b 30 c9 e4 af b9 49 83 d3 69 |8...kQ.0....I..i|
00000060 2a d5 97 75 c7 ec 6d 38 05 f6 a9 00 37 dd 73 bc |*..u..m8....7.s.|
00000070 45 a9 c2 d8 5b 55 54 93 11 4c 52 7d 0c 3b f2 50 |E...[UT..LR}.;.P|
00000080 d7 70 c4 59 e6 42 f3 8a 45 79 15 f7 18 ce 7e d7 |.p.Y.B..Ey....~.|
00000090 72 07 ec c7 77 2c 71 f1 38 de d4 f8 ce 80 e7 a9 |r...w,q.8.......|
000000a0 ef 3b b4 e8 73 f4 10 ca 5b 03 f5 30 86 f1 c3 74 |.;..s...[..0...t|
000000b0 83 ed 26 93 f3 71 35 59 58 e5 a1 be 40 14 2c 57 |..&..q5YX...@.,W|
000000c0 8a b7 18 23 c5 e4 53 41 17 d0 a7 a7 d9 18 29 64 |...#..SA......)d|
000000d0 48 5e 2a 70 da 1f 70 ac 3b b6 0c b2 2a da bd 38 |H^*p..p.;...*..8|
000000e0 99 d5 cc 71 b1 2e 27 11 22 65 0d bd ca 73 dc ac |...q..'."e...s..|
000000f0 98 f0 48 54 c1 36 40 9e 11 87 05 77 18 31 80 09 |..HT.6@....w.1..|
00000100 c1 1b df f8 20 cc 7b b3 80 93 fb f2 7c b7 30 32 |.... .{.....|.02|
00000110 22 fa db af 2d 45 6e 3e 75 0d e8 85 9b ce 96 0f |"...-En>u.......|
00000120 99 f7 9c 4d 13 f6 08 20 ab 8a e2 f2 b7 08 3c fe |...M... ......<.|
00000130 2f 39 bb 9d 59 d7 14 f4 2e 94 c0 21 52 50 cf 59 |/9..Y......!RP.Y|
00000140 0f b0 7e fa 9f 46 46 19 18 68 3a 0c ac 3b c6 79 |..~..FF..h:..;.y|
00000150 b7 77 83 29 2d 1f 97 1d 7e 16 c6 7b 89 d0 75 45 |.w.)-...~..{..uE|
00000160 be 7c a6 31 af e5 33 91 f1 e8 4f 5a 2c 58 e7 d4 |.|.1..3...OZ,X..|
00000170 30 f1 19 8b 9c f5 11 3c b1 49 78 af f1 f5 31 29 |0......<.Ix...1)|
00000180 f0 9e 21 2d 45 a1 fb 4a 40 44 64 68 e4 2e 73 40 |..!-E..J@Ddh..s@|
00000190 91 8d b4 a1 61 5f b7 ee d1 87 f1 be 99 b5 b3 eb |....a_..........|
000001a0 1a b4 52 35 96 af 61 bd d0 bc cd 41 8c 8b 96 3b |..R5..a....A...;|
000001b0 70 79 fb b0 e5 9b f6 cb 13 47 00 99 9d 87 cc 71 |py.......G.....q|
000001c0 f2 a5 74 17 11 ba 3d 43 b0 d9 90 66 e7 0f d1 04 |..t...=C...f....|
000001d0 8c 9d ff 4b 2d c9 1c d4 7d 6b 5f 5c d0 bb 61 a5 |...K-...}k_\..a.|
000001e0 eb fb b1 6f 2a 25 41 aa ef b7 92 f1 fe d7 b8 72 |...o*%A........r|
000001f0 4e 7c f4 8a 1d fb 0e 6e fd 39 04 93 c2 19 7e 95 |N|.....n.9....~.|
00000200 55 62 7d c9 95 64 d2 3f ba bd 3a 0a 3d a7 fd 2f |Ub}..d.?..:.=../|
00000210 70 86 a4 b6 4b c3 81 d5 fa 4a 17 6f 1f c5 e8 6d |p...K....J.o...m|
00000220 bc 2d 49 af f0 c8 d9 ea 62 0b 81 43 53 3c a5 79 |.-I.....b..CS<.y|
00000230 44 ff 9e 62 78 63 de 7e 15 2a ec 91 d6 ae a3 2d |D..bxc.~.*.....-|
00000240 57 00 89 b2 43 06 5b bd 8c 3f ec 74 d6 b0 7d 6a |W...C.[..?.t..}j|
00000250 b5 c8 d0 13 e1 40 ce 3f 95 36 64 75 6d 61 e1 12 |.....@.?.6duma..|
00000260 a5 53 90 7c 95 ef 15 40 3b ae 00 52 0c bd b5 80 |.S.|...@;..R....|
00000270 96 e7 e2 d3 a3 d9 16 03 03 00 5e 00 00 00 00 00 |..........^.....|
00000280 00 00 04 ed 6b 0e fe 2e 8d db a1 1b f4 2c 2a e6 |....k........,*.|
00000290 b9 be 51 d5 8d d9 8c 09 36 ab 43 46 84 44 f0 43 |..Q.....6.CF.D.C|
000002a0 da 85 cb c4 ab 31 a9 46 19 4a 6b c3 32 5b 32 14 |.....1.F.Jk.2[2.|
000002b0 d5 ca 17 c7 30 aa c4 5c 17 38 f2 22 e6 8c cc 0e |....0..\.8."....|
000002c0 cd e6 4c b4 90 df 1a f1 04 6b ee 91 f3 29 04 ce |..L......k...)..|
000002d0 b7 9f 47 c6 15 9f f7 00 34 16 03 03 00 a0 00 00 |..G.....4.......|
000002e0 00 00 00 00 00 05 15 10 0d 8b 37 50 ea 57 b2 80 |..........7P.W..|
000002f0 99 7c 19 0a 5c 5f 2b 9d aa 3d 07 55 b5 ad d2 e4 |.|..\_+..=.U....|
00000300 f6 81 ac 2a 14 d7 ba f0 d9 f2 ca c5 68 b5 6b fa |...*........h.k.|
00000310 14 82 ee 15 a0 b4 64 53 61 83 de 32 d4 3a 94 3f |......dSa..2.:.?|
00000320 f5 aa 3f d6 db 95 02 55 20 1b cb 64 86 82 60 e2 |..?....U ..d..`.|
00000330 b4 73 d2 34 b7 e5 25 aa 2d eb 4e 54 8e b6 62 d6 |.s.4..%.-.NT..b.|
00000340 59 e4 e2 a3 55 bc c6 a7 7d bf ea 15 86 6d ff ab |Y...U...}....m..|
00000350 3c 66 9e 70 35 b8 e6 da eb b8 1d 4c 42 f7 37 2c |<f.p5......LB.7,|
00000360 cc da 15 1c da 40 1e 8b 71 f6 1a c5 cc b1 58 d9 |.....@..q.....X.|
00000370 3b 1e 9a 30 13 c4 5e dc e8 66 9a 38 3d 1c 14 03 |;..0..^..f.8=...|
00000380 03 00 19 00 00 00 00 00 00 00 06 0d be a5 be 34 |...............4|
00000390 0d c7 d2 db 75 0a 66 e7 32 a4 60 d4 16 03 03 00 |....u.f.2.`.....|
000003a0 28 00 00 00 00 00 00 00 00 15 8e c6 9c 8e 3e fe |(.............>.|
000003b0 f1 71 ff 38 df 7e 47 86 47 0e 07 93 6f 1c fc 3e |.q.8.~G.G...o..>|
000003c0 43 a9 55 73 14 f9 1a 03 cf |C.Us.....|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 10 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 14 03 03 00 19 dc 61 07 b0 47 de b3 5b 79 38 7d |......a..G..[y8}|
00000010 3f e2 f7 da 0e 9b 06 de 96 d1 81 8c c6 75 16 03 |?............u..|
00000020 03 00 28 51 d6 d7 c6 a9 7b ba 7d 50 af 15 35 ea |..(Q....{.}P..5.|
00000030 02 ee 38 f0 32 9b 6a 9c 8a a6 7a 11 58 9b ba 1d |..8.2.j...z.X...|
00000040 c2 c4 81 5c bd 84 be c3 af a9 c9 17 03 03 00 21 |...\...........!|
00000050 51 d6 d7 c6 a9 7b ba 7e eb 69 5a de 10 a7 46 bf |Q....{.~.iZ...F.|
00000060 a4 d9 05 fb 23 79 3e 3c 96 ea 02 56 4e b1 1c e3 |....#y><...VN...|
00000070 b0 |.|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 11 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 15 03 03 00 1a 00 00 00 00 00 00 00 01 b5 05 b2 |................|
00000010 56 10 fb 8d fd 54 39 85 f3 a8 0f f4 10 bf 5d |V....T9.......]|
Reference in New Issue Copy Permalink