kris/th5
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
7ef5c9eac8
th5/testdata/Client-TLSv12-RenegotiateTwice

407 lines
30 KiB
Plaintext
Raw Normal View History

crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 1 (client to server)
crypto/tls: support AES-128-CBC cipher suites with SHA-256. These were new with TLS 1.2 and, reportedly, some servers require it. Since it's easy, this change adds suport for three flavours of AES-128-CBC with SHA-256 MACs. Other testdata/ files have to be updated because this changes the list of cipher suites offered by default by the client. Fixes #15487. Change-Id: I1b14330c31eeda20185409a37072343552c3464f Reviewed-on: https://go-review.googlesource.com/27315 Run-TryBot: Adam Langley <agl@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Jonathan Rudenberg <jonathan@titanous.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-08-18 00:45:47 +01:00
00000000 16 03 01 00 8b 01 00 00 87 03 03 00 00 00 00 00 |................|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
crypto/tls: support AES-128-CBC cipher suites with SHA-256. These were new with TLS 1.2 and, reportedly, some servers require it. Since it's easy, this change adds suport for three flavours of AES-128-CBC with SHA-256 MACs. Other testdata/ files have to be updated because this changes the list of cipher suites offered by default by the client. Fixes #15487. Change-Id: I1b14330c31eeda20185409a37072343552c3464f Reviewed-on: https://go-review.googlesource.com/27315 Run-TryBot: Adam Langley <agl@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> Reviewed-by: Jonathan Rudenberg <jonathan@titanous.com> TryBot-Result: Gobot Gobot <gobot@golang.org>
2016-08-18 00:45:47 +01:00
00000020 00 00 00 00 00 00 00 00 00 00 00 00 00 28 c0 2f |.............(./|
00000030 c0 2b c0 30 c0 2c c0 27 c0 13 c0 23 c0 09 c0 14 |.+.0.,.'...#....|
00000040 c0 0a 00 9c 00 9d 00 3c 00 2f 00 35 c0 12 00 0a |.......<./.5....|
00000050 00 05 c0 11 c0 07 01 00 00 36 00 05 00 05 01 00 |.........6......|
00000060 00 00 00 00 0a 00 08 00 06 00 17 00 18 00 19 00 |................|
00000070 0b 00 02 01 00 00 0d 00 0e 00 0c 04 01 04 03 05 |................|
00000080 01 05 03 02 01 02 03 ff 01 00 01 00 00 12 00 00 |................|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 2 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 00 59 02 00 00 55 03 03 ef 61 1c 86 c9 |....Y...U...a...|
00000010 ee 30 91 d1 11 c7 da 05 50 0a a4 59 84 3a 7b 5d |.0......P..Y.:{]|
00000020 a0 12 7d 8e a7 7c 0b ad b1 b4 24 20 04 66 50 88 |..}..|....$ .fP.|
00000030 fd 57 a6 83 51 f9 1a b7 36 ce 96 f1 1b 08 24 95 |.W..Q...6.....$.|
00000040 77 48 8d 53 b4 4a 17 a0 ce 21 42 41 c0 2f 00 00 |wH.S.J...!BA./..|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
00000050 0d ff 01 00 01 00 00 0b 00 04 03 00 01 02 16 03 |................|
crypto/x509: require a NULL parameters for RSA public keys. The RFC is clear that the Parameters in an AlgorithmIdentifer for an RSA public key must be NULL. BoringSSL enforces this so we have strong evidence that this is a widely compatible change. Embarrassingly enough, the major source of violations of this is us. Go used to get this correct in only one of two places. This was only fixed in 2013 (with 4874bc9b). That's why lots of test certificates are updated in this change. Fixes #16166. Change-Id: Ib9a4551349354c66e730d44eb8cee4ec402ea8ab Reviewed-on: https://go-review.googlesource.com/27312 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-08-17 23:55:15 +01:00
00000060 03 02 59 0b 00 02 55 00 02 52 00 02 4f 30 82 02 |..Y...U..R..O0..|
00000070 4b 30 82 01 b4 a0 03 02 01 02 02 09 00 e8 f0 9d |K0..............|
00000080 3f e2 5b ea a6 30 0d 06 09 2a 86 48 86 f7 0d 01 |?.[..0...*.H....|
00000090 01 0b 05 00 30 1f 31 0b 30 09 06 03 55 04 0a 13 |....0.1.0...U...|
000000a0 02 47 6f 31 10 30 0e 06 03 55 04 03 13 07 47 6f |.Go1.0...U....Go|
000000b0 20 52 6f 6f 74 30 1e 17 0d 31 36 30 31 30 31 30 | Root0...1601010|
000000c0 30 30 30 30 30 5a 17 0d 32 35 30 31 30 31 30 30 |00000Z..25010100|
000000d0 30 30 30 30 5a 30 1a 31 0b 30 09 06 03 55 04 0a |0000Z0.1.0...U..|
000000e0 13 02 47 6f 31 0b 30 09 06 03 55 04 03 13 02 47 |..Go1.0...U....G|
000000f0 6f 30 81 9f 30 0d 06 09 2a 86 48 86 f7 0d 01 01 |o0..0...*.H.....|
00000100 01 05 00 03 81 8d 00 30 81 89 02 81 81 00 db 46 |.......0.......F|
00000110 7d 93 2e 12 27 06 48 bc 06 28 21 ab 7e c4 b6 a2 |}...'.H..(!.~...|
00000120 5d fe 1e 52 45 88 7a 36 47 a5 08 0d 92 42 5b c2 |]..RE.z6G....B[.|
00000130 81 c0 be 97 79 98 40 fb 4f 6d 14 fd 2b 13 8b c2 |....y.@.Om..+...|
00000140 a5 2e 67 d8 d4 09 9e d6 22 38 b7 4a 0b 74 73 2b |..g....."8.J.ts+|
00000150 c2 34 f1 d1 93 e5 96 d9 74 7b f3 58 9f 6c 61 3c |.4......t{.X.la<|
00000160 c0 b0 41 d4 d9 2b 2b 24 23 77 5b 1c 3b bd 75 5d |..A..++$#w[.;.u]|
00000170 ce 20 54 cf a1 63 87 1d 1e 24 c4 f3 1d 1a 50 8b |. T..c...$....P.|
00000180 aa b6 14 43 ed 97 a7 75 62 f4 14 c8 52 d7 02 03 |...C...ub...R...|
00000190 01 00 01 a3 81 93 30 81 90 30 0e 06 03 55 1d 0f |......0..0...U..|
000001a0 01 01 ff 04 04 03 02 05 a0 30 1d 06 03 55 1d 25 |.........0...U.%|
000001b0 04 16 30 14 06 08 2b 06 01 05 05 07 03 01 06 08 |..0...+.........|
000001c0 2b 06 01 05 05 07 03 02 30 0c 06 03 55 1d 13 01 |+.......0...U...|
000001d0 01 ff 04 02 30 00 30 19 06 03 55 1d 0e 04 12 04 |....0.0...U.....|
000001e0 10 9f 91 16 1f 43 43 3e 49 a6 de 6d b6 80 d7 9f |.....CC>I..m....|
000001f0 60 30 1b 06 03 55 1d 23 04 14 30 12 80 10 48 13 |`0...U.#..0...H.|
00000200 49 4d 13 7e 16 31 bb a3 01 d5 ac ab 6e 7b 30 19 |IM.~.1......n{0.|
00000210 06 03 55 1d 11 04 12 30 10 82 0e 65 78 61 6d 70 |..U....0...examp|
00000220 6c 65 2e 67 6f 6c 61 6e 67 30 0d 06 09 2a 86 48 |le.golang0...*.H|
00000230 86 f7 0d 01 01 0b 05 00 03 81 81 00 9d 30 cc 40 |.............0.@|
00000240 2b 5b 50 a0 61 cb ba e5 53 58 e1 ed 83 28 a9 58 |+[P.a...SX...(.X|
00000250 1a a9 38 a4 95 a1 ac 31 5a 1a 84 66 3d 43 d3 2d |..8....1Z..f=C.-|
00000260 d9 0b f2 97 df d3 20 64 38 92 24 3a 00 bc cf 9c |...... d8.$:....|
00000270 7d b7 40 20 01 5f aa d3 16 61 09 a2 76 fd 13 c3 |}.@ ._...a..v...|
00000280 cc e1 0c 5c ee b1 87 82 f1 6c 04 ed 73 bb b3 43 |...\.....l..s..C|
00000290 77 8d 0c 1c f1 0f a1 d8 40 83 61 c9 4c 72 2b 9d |w.......@.a.Lr+.|
000002a0 ae db 46 06 06 4d f4 c1 b3 3e c0 d1 bd 42 d4 db |..F..M...>...B..|
000002b0 fe 3d 13 60 84 5c 21 d3 3b e9 fa e7 16 03 03 00 |.=.`.\!.;.......|
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
000002c0 cd 0c 00 00 c9 03 00 17 41 04 c7 1f 36 21 38 eb |........A...6!8.|
000002d0 e1 da bf e3 a5 92 ef 4d 45 4c 96 70 f1 3c 50 ee |.......MEL.p.<P.|
000002e0 4c d7 db f7 e0 31 e3 be 60 a3 f1 f7 e3 0a ce 51 |L....1..`......Q|
000002f0 e7 bb 87 08 62 5d 70 26 14 2c 9f de 92 7f 42 7e |....b]p&.,....B~|
00000300 50 04 56 b1 0c c9 e1 4a 30 a8 04 01 00 80 25 6a |P.V....J0.....%j|
00000310 70 ee 08 92 9d 5e 8a 80 a8 bc 8d 2d 95 30 cb b2 |p....^.....-.0..|
00000320 a4 5b eb 60 2e 96 28 54 6b 46 89 29 5d 6c de e6 |.[.`..(TkF.)]l..|
00000330 6f 40 9e 04 d5 7a 1a e7 7a e1 79 b0 a3 c6 37 d3 |o@...z..z.y...7.|
00000340 83 0f 10 8d f5 2f ba 6a ee 71 4e 2a bd 8f 30 cc |...../.j.qN*..0.|
00000350 8f 2f a2 87 d6 7f 53 a0 d5 a2 73 76 08 d5 79 08 |./....S...sv..y.|
00000360 ac 88 39 8b 07 ae 4a 01 b2 64 74 82 de ab d2 5d |..9...J..dt....]|
00000370 33 bf 5c fe 9d 02 22 46 2f fa 9a 2f fa 57 80 52 |3.\..."F/../.W.R|
00000380 d1 bc 6a e5 cb 59 fa cc e2 c8 d1 80 2d 64 16 03 |..j..Y......-d..|
crypto/x509: require a NULL parameters for RSA public keys. The RFC is clear that the Parameters in an AlgorithmIdentifer for an RSA public key must be NULL. BoringSSL enforces this so we have strong evidence that this is a widely compatible change. Embarrassingly enough, the major source of violations of this is us. Go used to get this correct in only one of two places. This was only fixed in 2013 (with 4874bc9b). That's why lots of test certificates are updated in this change. Fixes #16166. Change-Id: Ib9a4551349354c66e730d44eb8cee4ec402ea8ab Reviewed-on: https://go-review.googlesource.com/27312 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-08-17 23:55:15 +01:00
00000390 03 00 04 0e 00 00 00 |.......|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 3 (client to server)
00000000 16 03 03 00 46 10 00 00 42 41 04 1e 18 37 ef 0d |....F...BA...7..|
00000010 19 51 88 35 75 71 b5 e5 54 5b 12 2e 8f 09 67 fd |.Q.5uq..T[....g.|
00000020 a7 24 20 3e b2 56 1c ce 97 28 5e f8 2b 2d 4f 9e |.$ >.V...(^.+-O.|
00000030 f1 07 9f 6c 4b 5b 83 56 e2 32 42 e9 58 b6 d7 49 |...lK[.V.2B.X..I|
00000040 a6 b5 68 1a 41 03 56 6b dc 5a 89 14 03 03 00 01 |..h.A.Vk.Z......|
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000050 01 16 03 03 00 28 00 00 00 00 00 00 00 00 8e 77 |.....(.........w|
00000060 d5 cd 3a 36 aa 0f b8 d4 92 20 be ca 3b f5 74 74 |..:6..... ..;.tt|
00000070 7c 89 e6 8b a2 92 56 ca ca 91 92 f0 20 44 ||.....V..... D|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 4 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 14 03 03 00 01 01 16 03 03 00 28 f4 ab 49 aa 08 |..........(..I..|
00000010 16 71 3b 0e fa 97 30 03 73 60 7e 73 e0 63 b4 38 |.q;...0.s`~s.c.8|
00000020 b3 19 15 17 25 c4 f4 c1 0c b4 c9 3e e6 94 56 25 |....%......>..V%|
00000030 3c a4 25 |<.%|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 5 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 17 03 03 00 1e 00 00 00 00 00 00 00 01 df 72 ee |..............r.|
00000010 e7 65 97 48 d3 47 7a 3c df 39 c7 29 00 14 09 41 |.e.H.Gz<.9.)...A|
00000020 31 02 01 |1..|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 6 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 00 1c f4 ab 49 aa 08 16 71 3c fc f2 15 |.......I...q<...|
00000010 e0 e1 c8 dd 74 f8 33 af 25 f7 64 d1 d1 11 92 2a |....t.3.%.d....*|
00000020 b1 |.|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 7 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 00 af 00 00 00 00 00 00 00 02 97 1d 91 |................|
00000010 65 55 ce 20 d9 30 4b 94 a2 37 f3 aa 4c aa 17 69 |eU. .0K..7..L..i|
00000020 d3 af fd 28 52 ae 91 5d c0 bc 8c 3b 54 68 98 16 |...(R..]...;Th..|
00000030 72 f0 65 9f ad cd 78 d0 87 af 77 49 0b d4 73 22 |r.e...x...wI..s"|
00000040 f9 ae e7 94 f6 63 6c 00 2d 32 2c 7b a9 e5 b5 12 |.....cl.-2,{....|
00000050 43 ea 6e 04 44 f5 4f e7 c3 a9 bf 2c 13 fe 4e a6 |C.n.D.O....,..N.|
00000060 97 f9 12 1d 54 75 6d e7 91 db f4 01 0d 5c 2d 7c |....Tum......\-||
00000070 c7 1f f7 98 68 ff 67 3f c0 81 c4 8c 84 49 a8 54 |....h.g?.....I.T|
00000080 fa 10 d5 0c e4 09 58 ed 4e 77 9f 12 73 2c 49 76 |......X.Nw..s,Iv|
00000090 52 7d ed 36 dc b5 36 bf 16 7c 28 53 7b e0 b8 20 |R}.6..6..|(S{.. |
000000a0 1e 23 63 af 98 a3 95 b1 33 32 a6 26 10 33 c7 80 |.#c.....32.&.3..|
000000b0 32 19 8f 6f |2..o|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 8 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 00 89 f4 ab 49 aa 08 16 71 3d f2 ea bb |.......I...q=...|
00000010 28 9b 7a b2 e3 10 07 f2 8a 9e f6 02 fe 47 fe 26 |(.z..........G.&|
00000020 23 9c 5e 18 67 ad ec 45 94 4b 40 d4 a8 4a 11 ef |#.^.g..E.K@..J..|
00000030 67 07 b0 5e e3 58 bb f8 2a 46 fc 5a 0f 6c d1 d9 |g..^.X..*F.Z.l..|
00000040 98 72 55 bd 45 15 2f 3a 87 4e 49 68 40 a8 c8 0a |.rU.E./:.NIh@...|
00000050 5c fb 23 32 ce 72 3a 13 6e a4 15 fa d6 53 73 77 |\.#2.r:.n....Ssw|
00000060 36 44 86 67 b3 c8 e7 65 f0 ef 53 cc 87 91 b0 4a |6D.g...e..S....J|
00000070 70 01 22 62 d9 31 23 bc b8 26 17 03 6e 02 d8 fd |p."b.1#..&..n...|
00000080 8a 4a 75 fc 08 58 a9 0b 50 1e 7d bf 38 3c 16 03 |.Ju..X..P.}.8<..|
00000090 03 02 71 f4 ab 49 aa 08 16 71 3e 15 6d d8 c8 ad |..q..I...q>.m...|
000000a0 44 2d 49 b9 e3 e1 1b da 22 e0 65 16 a1 cd 77 17 |D-I.....".e...w.|
000000b0 40 de 68 18 a6 af 7c 0a e4 66 d0 30 ed 4d ca 8d |@.h...|..f.0.M..|
000000c0 9d a6 27 59 3e 6b 25 56 6f 47 e5 50 98 dd 53 e9 |..'Y>k%VoG.P..S.|
000000d0 53 35 5a 76 82 f0 cb 9a a2 98 10 fb c5 9d 43 a6 |S5Zv..........C.|
000000e0 e7 e3 01 bf 86 2f 41 fc fd 7e c8 d8 0e b8 a8 79 |...../A..~.....y|
000000f0 62 53 75 1b 67 4b 8b d3 6c ba 94 28 af 31 d2 3c |bSu.gK..l..(.1.<|
00000100 c4 2c 2c 86 1d 1f 11 fa f4 df 8e c4 46 22 db 26 |.,,.........F".&|
00000110 68 4f b5 a0 87 f2 82 bb 9d 31 c0 d8 41 57 53 c7 |hO.......1..AWS.|
00000120 4b 7f 01 43 43 28 ea bb 27 83 8d 3d 60 b9 62 b2 |K..CC(..'..=`.b.|
00000130 66 e6 cc b5 be a3 e2 2f a1 c8 ae 49 3c 4d b1 dc |f....../...I<M..|
00000140 b2 7d 30 9b dc 64 04 dc 67 61 ba 85 36 29 c7 7b |.}0..d..ga..6).{|
00000150 f6 bf 59 62 8d 3d 19 5d 9a ba cf 30 b6 18 0a 60 |..Yb.=.]...0...`|
00000160 7a aa 2c a6 48 44 9c 07 18 e2 40 93 a6 4b 39 eb |z.,.HD....@..K9.|
00000170 b1 69 9d 0d 5c e0 9d 52 3e 47 70 fb 3b 19 34 f2 |.i..\..R>Gp.;.4.|
00000180 01 15 e0 0c 04 9e 2e d7 b0 c7 18 b7 95 67 8c 84 |.............g..|
00000190 61 2c f6 08 39 53 b1 29 94 ca c5 8e 70 48 18 8a |a,..9S.)....pH..|
000001a0 c3 36 22 c3 84 e8 55 89 ab c7 50 1e 7d ec 81 6c |.6"...U...P.}..l|
000001b0 3d 33 50 84 b6 e4 ef d7 e6 43 45 c0 9f e4 87 1a |=3P......CE.....|
000001c0 0a 67 4f f6 57 3d 0e b4 7a 0a f6 ba 69 47 85 ea |.gO.W=..z...iG..|
000001d0 5d 1a 55 28 3d 90 3a 6d c5 ed ac 3c 49 ec c1 f3 |].U(=.:m...<I...|
000001e0 a0 e4 47 99 15 72 cf a9 5e fa 78 24 5c 7e 43 f5 |..G..r..^.x$\~C.|
000001f0 36 60 4d 0e 2e a0 83 3c 4b a1 cb 55 1b 97 4c 9f |6`M....<K..U..L.|
00000200 08 3c 5d c7 bd 61 b5 ad 2c db 8a 61 ea 49 fa 72 |.<]..a..,..a.I.r|
00000210 2e 41 57 ee fc c0 35 58 c6 6f da c7 ea 58 ff db |.AW...5X.o...X..|
00000220 99 47 5f f2 2e 4b 19 cf 0e 72 e1 6f 14 ed 18 b7 |.G_..K...r.o....|
00000230 7d 78 cf 69 d1 63 e5 12 84 a9 95 5d bf 8d 77 b8 |}x.i.c.....]..w.|
00000240 e4 dc 8b fd 13 30 f4 38 6b d1 bd f8 6b 9e 14 32 |.....0.8k...k..2|
00000250 52 b8 eb 7a 92 a6 ac f9 cb d4 ea 50 3d 53 66 25 |R..z.......P=Sf%|
00000260 7c 26 f8 bc 87 46 f2 8b fa 78 ec 93 74 28 03 e9 ||&...F...x..t(..|
00000270 47 05 ec 8b 1d 70 9e f2 07 24 43 8c 2c 4b e2 0f |G....p...$C.,K..|
00000280 49 19 c5 68 61 a6 74 83 db c4 fe a6 e7 b2 7c 8a |I..ha.t.......|.|
00000290 e7 b0 f7 67 8b bc 54 7e a1 62 37 83 23 cf c9 31 |...g..T~.b7.#..1|
000002a0 25 9c 07 6b 74 37 08 38 82 65 59 a4 7e f5 35 ad |%..kt7.8.eY.~.5.|
000002b0 f3 c9 f5 32 37 e2 ee 4d 78 de 1e 59 b0 3e 81 30 |...27..Mx..Y.>.0|
000002c0 c1 da 6b 11 ac b4 a5 b7 e6 b3 b8 df a7 42 4d b8 |..k..........BM.|
000002d0 3b c2 a7 fe e6 66 b4 c2 dd 91 03 35 46 b5 86 6a |;....f.....5F..j|
000002e0 39 3f 1b 25 77 35 8c 31 7e 0b 3b 63 ed 6c 6c cf |9?.%w5.1~.;c.ll.|
000002f0 6f eb 8e 9f f1 dd 0d f1 36 51 92 5e a2 f5 ad 3e |o.......6Q.^...>|
00000300 eb d7 96 ae 16 03 03 00 e5 f4 ab 49 aa 08 16 71 |...........I...q|
00000310 3f c6 e0 e2 9c 98 c0 71 c0 41 d3 d4 c4 03 4e a6 |?......q.A....N.|
00000320 69 da bb 23 81 84 5f bd 39 1c 16 00 34 ad 3d dd |i..#.._.9...4.=.|
00000330 ee f8 03 0b 07 f4 90 68 2f 49 57 21 c3 b2 4c 00 |.......h/IW!..L.|
00000340 fd 06 4b 7a 72 fc 50 06 26 a4 6c 44 92 61 c3 aa |..Kzr.P.&.lD.a..|
00000350 76 98 f8 6c c7 9f 38 b2 6c a2 26 38 b7 f3 f4 aa |v..l..8.l.&8....|
00000360 56 ff a3 ac 4a ce a2 a2 5e 77 dc e2 29 df e1 24 |V...J...^w..)..$|
00000370 2c e4 b0 5b fc 7e 39 51 ee 5b 96 18 d5 d8 04 ba |,..[.~9Q.[......|
00000380 a1 fb a6 11 d7 27 fc 17 58 b9 e8 43 a2 ce dc 6d |.....'..X..C...m|
00000390 2b d6 44 6f 08 c9 37 f6 43 7a 3d dc 5c d3 55 5c |+.Do..7.Cz=.\.U\|
000003a0 13 09 84 4e b5 3b 6f 4f bf e4 74 e0 cd d6 a2 c6 |...N.;oO..t.....|
000003b0 1a d3 65 44 8f 21 a0 04 f7 97 fc a9 f7 cd 3a 01 |..eD.!........:.|
000003c0 3c ea 95 e8 ba 1f cc 88 48 66 5e b9 a4 2b 26 dd |<.......Hf^..+&.|
000003d0 b5 73 54 47 4c 5c d9 fb c6 fa db 98 6e ba 77 6f |.sTGL\......n.wo|
000003e0 6f d8 c6 e9 c3 e1 6b 59 b7 e0 08 16 30 4d 16 03 |o.....kY....0M..|
000003f0 03 00 42 f4 ab 49 aa 08 16 71 40 fa e0 25 7c 6f |..B..I...q@..%|o|
00000400 f7 1e 5b 19 8a 31 4e 48 ce da c2 97 3a 62 85 ae |..[..1NH....:b..|
00000410 07 d1 27 52 1b c1 f2 48 c5 1b ee bf 72 ac 29 5e |..'R...H....r.)^|
00000420 8f 5f 71 f4 85 07 54 61 d0 54 31 99 d6 9b 9c 73 |._q...Ta.T1....s|
00000430 16 93 8a 31 e2 16 03 03 00 1c f4 ab 49 aa 08 16 |...1........I...|
00000440 71 41 70 18 29 89 1a 9e 4f 6b 8d 02 fa 91 e0 f0 |qAp.)...Ok......|
00000450 5d 9c 9e a9 01 8d |].....|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 9 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 02 71 00 00 00 00 00 00 00 03 23 0f d3 |....q........#..|
00000010 6c b4 ee 06 48 2f 9f 75 99 cc 94 4a 9e ff c0 4b |l...H/.u...J...K|
00000020 30 fa 2b bf 54 a7 f2 05 ff 63 7b 43 a3 ac 04 a3 |0.+.T....c{C....|
00000030 71 39 57 00 2a d1 80 48 9c bf 19 12 60 35 d6 89 |q9W.*..H....`5..|
00000040 49 c7 57 6e 7c a6 27 ab 97 f3 f6 ab 6d b9 f0 ab |I.Wn|.'.....m...|
00000050 7f 9a cc 06 92 22 08 44 3b 94 2b 0e 31 6a 93 96 |.....".D;.+.1j..|
00000060 89 7f 4a 6c 06 df dc a6 1f e7 c4 7b 72 0e ed 04 |..Jl.......{r...|
00000070 d6 c7 ff 48 b6 0c 53 fd a8 4f 42 89 c5 97 2a 9c |...H..S..OB...*.|
00000080 22 1f df cc c0 cc 86 0d ea 45 36 88 93 01 27 78 |"........E6...'x|
00000090 ab 9c d0 59 fc 63 dd 53 04 a3 a7 21 e3 26 22 95 |...Y.c.S...!.&".|
000000a0 f0 63 21 13 04 f7 d1 5a 6e c0 03 ef b6 9d 87 e9 |.c!....Zn.......|
000000b0 b0 fc c2 40 4e f7 9b 25 c4 ae d4 cc 05 3a 41 5a |...@N..%.....:AZ|
000000c0 a3 c2 42 1e 5b 7d 6d 03 f0 e3 6a 2c 92 98 ca 46 |..B.[}m...j,...F|
000000d0 7d 8a 11 45 1b 12 ca c9 b2 e7 e2 a2 b8 ad f7 ad |}..E............|
000000e0 bb 2b 70 ab 0a 87 ac 7c f7 55 2c 5c 0e 6e 90 de |.+p....|.U,\.n..|
000000f0 89 1e e0 d3 a1 a5 80 b7 25 bb d4 df 35 ad ad ed |........%...5...|
00000100 8e e9 21 da 30 62 51 d8 8d 45 fb ee 40 dc e8 f4 |..!.0bQ..E..@...|
00000110 f6 bd b0 ad 2f 23 6b fc 62 4d 51 8f 30 c2 b8 c2 |..../#k.bMQ.0...|
00000120 2b 16 dc 86 cf 19 b4 aa 48 9b b6 c5 3b 15 29 c4 |+.......H...;.).|
00000130 a0 7f 40 74 89 95 ba 62 b5 13 ed 69 99 a5 8c 9d |..@t...b...i....|
00000140 d2 2d bc 2c c1 db 4d 4d c8 f5 94 8b 5b ad 0d a9 |.-.,..MM....[...|
00000150 51 52 a9 c5 85 7a b6 48 4d 44 92 1e 51 53 af 64 |QR...z.HMD..QS.d|
00000160 39 4b c1 ad d8 e4 43 19 c7 e6 ec 44 33 31 01 89 |9K....C....D31..|
00000170 40 e3 93 22 3c 97 42 0f 8e 49 3a ca a4 08 ca 02 |@.."<.B..I:.....|
00000180 96 2b 83 3b 5d 1e 98 9c f9 ec 31 6e 03 8d 52 56 |.+.;].....1n..RV|
00000190 9f 8a d6 2b a6 bc 99 89 f1 c2 76 f4 fa 56 f1 9f |...+......v..V..|
000001a0 1c d8 4f bd e2 9b af 02 bb f7 71 ba 27 85 e0 9a |..O.......q.'...|
000001b0 c9 30 09 d0 ce 4f 06 80 a7 29 34 a8 eb 52 49 a8 |.0...O...)4..RI.|
000001c0 b9 7d de b2 51 5f f9 d9 84 52 73 03 60 db ee 97 |.}..Q_...Rs.`...|
000001d0 b9 ca da e5 f1 4b 38 c6 36 eb 25 8e 62 59 7a 8a |.....K8.6.%.bYz.|
000001e0 e9 59 0f 41 30 8d 33 64 1a 1a ee 0d 79 1c da 53 |.Y.A0.3d....y..S|
000001f0 f4 e1 04 2e 5b 6a cb 4f 0a b6 3a b1 76 49 41 cb |....[j.O..:.vIA.|
00000200 1d 59 0d 1d a6 89 22 ee 33 60 2b 7f a8 43 3a c7 |.Y....".3`+..C:.|
00000210 26 65 1b 56 54 83 09 6d ec 08 ef db bd 61 71 ee |&e.VT..m.....aq.|
00000220 2e 49 00 0b cf 89 e9 d5 48 a3 c1 6a b7 6c e1 6a |.I......H..j.l.j|
00000230 1a d1 f1 f7 03 25 4a 98 48 9b 59 eb 8e b4 b1 4b |.....%J.H.Y....K|
00000240 0f 0b 35 6d c1 e2 8e b9 96 35 dc da 2f 53 21 45 |..5m.....5../S!E|
00000250 7a d0 3d 8e 20 99 f3 22 e0 e4 33 83 95 04 6a 4c |z.=. .."..3...jL|
00000260 91 fc 0c 90 57 dd b9 9c 19 37 5e d4 2e cd ff 34 |....W....7^....4|
00000270 22 44 d3 d1 69 13 16 03 03 00 5e 00 00 00 00 00 |"D..i.....^.....|
00000280 00 00 04 53 f5 4d 21 83 84 9c 36 8e ce 3b 27 8c |...S.M!...6..;'.|
00000290 9f fd 85 28 56 09 c6 99 a2 af cc 7d 2d af 85 79 |...(V......}-..y|
000002a0 78 3d f4 88 cd 60 89 40 a2 e4 bb f2 ae 45 53 48 |x=...`.@.....ESH|
000002b0 6d e9 ca a2 36 7d 25 01 38 e9 77 01 1d 05 b0 58 |m...6}%.8.w....X|
000002c0 5b da 87 c5 5c df 7e b0 f6 6d a7 38 8a 63 a3 43 |[...\.~..m.8.c.C|
000002d0 60 18 40 7b 5b c1 05 92 b5 16 03 03 00 a0 00 00 |`.@{[...........|
000002e0 00 00 00 00 00 05 8b df bf 56 8b 21 81 b1 7d 55 |.........V.!..}U|
000002f0 89 e7 b6 c7 2e 68 6d 05 e3 d3 af 31 ef be a2 db |.....hm....1....|
00000300 1d d2 ec f0 8e db a4 76 cb 42 df 29 1d 4d 86 c1 |.......v.B.).M..|
00000310 e4 32 f2 a1 f6 4a c3 82 70 f8 cf a5 41 af 44 b5 |.2...J..p...A.D.|
00000320 47 c9 6e ee 75 38 44 08 a7 81 f6 da d6 68 c9 53 |G.n.u8D......h.S|
00000330 e5 2f f0 a9 0f db 5d 4b d0 4c 01 e4 e3 a1 2f a7 |./....]K.L..../.|
00000340 99 75 1c 3e 7a 47 f0 78 ef 61 f2 d6 da 0f c0 08 |.u.>zG.x.a......|
00000350 03 6f 13 3c a5 d2 24 18 c2 6a db 58 e1 d4 8a 27 |.o.<..$..j.X...'|
00000360 78 a6 e0 ec 9b e9 5f 94 b8 48 f2 bc e6 29 d4 60 |x....._..H...).`|
00000370 89 ed 79 52 ce 95 5c b3 c4 81 cf 9d cb 5b 14 03 |..yR..\......[..|
00000380 03 00 19 00 00 00 00 00 00 00 06 46 6b 4e 92 89 |...........FkN..|
00000390 d3 45 bf 20 0b 7a 6a 0d 71 8f eb 06 16 03 03 00 |.E. .zj.q.......|
000003a0 28 00 00 00 00 00 00 00 00 68 c4 4c 4f 17 4a 4d |(........h.LO.JM|
000003b0 73 fe 0a b8 a2 2f e4 8a d6 62 d7 40 ca 04 83 22 |s..../...b.@..."|
000003c0 41 c9 1f 8f f2 44 bb 88 32 |A....D..2|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 10 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 14 03 03 00 19 f4 ab 49 aa 08 16 71 42 9d 75 f7 |.......I...qB.u.|
00000010 35 40 8d b7 01 de 6a 81 bf ed fa d1 85 fa 16 03 |5@....j.........|
00000020 03 00 28 7a 20 c2 1d 3e 3c 2d 69 ac 93 5b b6 dc |..(z ..><-i..[..|
00000030 d9 08 e8 80 9c 10 7d d0 d7 64 55 d8 7e af f6 a0 |......}..dU.~...|
00000040 98 7c 16 99 24 ba 9d d3 96 43 a4 17 03 03 00 21 |.|..$....C.....!|
00000050 7a 20 c2 1d 3e 3c 2d 6a 63 af 4e e0 22 3a 61 68 |z ..><-jc.N.":ah|
00000060 2c c3 d7 7b c9 80 46 51 cf 8b b0 af 02 3c 5d a9 |,..{..FQ.....<].|
00000070 3a 16 03 03 00 1c 7a 20 c2 1d 3e 3c 2d 6b 24 26 |:.....z ..><-k$&|
00000080 da ff 4d 39 fb 70 85 9d 25 e2 23 ef af bb 27 93 |..M9.p..%.#...'.|
00000090 c0 f5 |..|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 11 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 00 af 00 00 00 00 00 00 00 01 ac bb 56 |...............V|
00000010 33 88 ab 77 b9 93 64 7b 8d 42 bf 2e 65 36 60 07 |3..w..d{.B..e6`.|
00000020 f2 d4 22 2a 75 ac 04 9e 11 48 85 ef 96 09 ae a3 |.."*u....H......|
00000030 af 37 7f 4c 01 5e 3a e2 0f 72 b2 77 40 56 a6 c2 |.7.L.^:..r.w@V..|
00000040 26 19 f2 67 8e a6 92 91 6f f6 59 5e ec 2e 35 3a |&..g....o.Y^..5:|
00000050 1e 03 e3 50 99 8f a3 ba 82 30 3c 24 83 55 9f be |...P.....0<$.U..|
00000060 4b 0b a7 86 64 42 25 0d 80 1c 88 e2 a3 c8 3e 6d |K...dB%.......>m|
00000070 de 43 46 4e 37 61 32 63 b4 af 77 d1 ba 77 c9 69 |.CFN7a2c..w..w.i|
00000080 11 4a a8 fd 9d be 8d d8 dc 8e ea f5 12 52 c9 c2 |.J...........R..|
00000090 c3 34 a0 72 55 34 87 21 aa 93 79 34 64 17 0e 02 |.4.rU4.!..y4d...|
000000a0 37 a0 9d ea 1b c2 71 4b 46 c7 5e 0a 84 b2 57 d6 |7.....qKF.^...W.|
000000b0 5e 31 8f c1 |^1..|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 12 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 00 89 7a 20 c2 1d 3e 3c 2d 6c c8 b4 49 |.....z ..><-l..I|
00000010 38 99 74 59 97 53 30 1c b3 a0 cd d0 01 33 53 cc |8.tY.S0......3S.|
00000020 84 f3 db 3b c2 92 6b c0 6e 46 62 04 66 0d 32 cb |...;..k.nFb.f.2.|
00000030 72 22 db 95 66 ce ff a6 1f 43 03 05 2d da 47 b1 |r"..f....C..-.G.|
00000040 34 67 aa 3f eb a5 fa da c5 2f c1 43 04 62 9e 70 |4g.?...../.C.b.p|
00000050 9f 07 d1 0d 8c 5b c0 b0 32 2f 2e d3 26 cf 1d 18 |.....[..2/..&...|
00000060 c6 dc 42 f2 a5 4f d8 64 03 24 17 7c 83 b9 64 1c |..B..O.d.$.|..d.|
00000070 33 9b d1 87 59 f8 f4 f5 87 ce 47 f1 59 fe db 78 |3...Y.....G.Y..x|
00000080 a2 1c ee 71 bb 00 41 cc 0d a0 89 0a b1 aa 16 03 |...q..A.........|
00000090 03 02 71 7a 20 c2 1d 3e 3c 2d 6d f1 4d 60 35 28 |..qz ..><-m.M`5(|
000000a0 a5 5f 97 2b 51 5b b2 02 7b b7 eb 23 15 20 02 a0 |._.+Q[..{..#. ..|
000000b0 a3 fd 7b 90 29 f8 98 2e d7 6f 05 70 bd 5b 64 d3 |..{.)....o.p.[d.|
000000c0 aa 67 54 e0 04 b1 7a 5c 5a 4d bb e7 e6 29 34 66 |.gT...z\ZM...)4f|
000000d0 81 6e 71 94 28 22 90 db 24 c3 c9 bb 9d fb 3b 4c |.nq.("..$.....;L|
000000e0 7f fe ba ad 69 ca 87 26 e6 bd 29 5b e2 a7 75 8a |....i..&..)[..u.|
000000f0 e5 00 bc 6a 51 42 ff 1f 5b ff a0 b7 e2 0f 9d e6 |...jQB..[.......|
00000100 b6 62 ff 7d f4 58 a9 98 3e 4d 53 c0 d0 e3 c4 ac |.b.}.X..>MS.....|
00000110 46 6f e1 b7 68 5f 5f 90 c2 0b a6 85 9d bf ec 84 |Fo..h__.........|
00000120 b4 7e 35 91 e0 19 b2 06 f0 55 b6 e4 23 78 a7 c8 |.~5......U..#x..|
00000130 76 a0 a5 e6 b1 59 fd da 04 bd 49 51 8f 3b 67 37 |v....Y....IQ.;g7|
00000140 75 73 84 75 b5 88 1c 11 5b 48 be e3 3d db 7e 3c |us.u....[H..=.~<|
00000150 9d 1e 95 41 56 67 d2 98 06 36 7f 83 3c 25 a2 4c |...AVg...6..<%.L|
00000160 5d 93 b2 75 a3 89 7c a0 e5 bf 2e 21 58 d4 25 ff |]..u..|....!X.%.|
00000170 00 e2 01 60 50 33 5c 70 ca a2 20 d6 67 d4 b2 cb |...`P3\p.. .g...|
00000180 90 2f 9b 86 4f 1f c5 a4 6d ec 82 60 5b 56 70 7f |./..O...m..`[Vp.|
00000190 94 be 72 1a 44 6b 6b 08 e7 5e d4 cb c0 4b b2 cb |..r.Dkk..^...K..|
000001a0 ac e8 a9 3e 28 ce b8 9b 93 6b c2 67 4c b7 ad 87 |...>(....k.gL...|
000001b0 19 d2 c0 b4 5b 29 82 22 10 f0 d0 04 b0 2e 46 fc |....[)."......F.|
000001c0 90 c3 d5 0e d1 b6 61 74 ae 4d f2 90 14 51 d3 6f |......at.M...Q.o|
000001d0 df cc bb ed bc f9 9b 2b 63 62 bf 08 09 7d 10 31 |.......+cb...}.1|
000001e0 b8 05 ad f6 ee d5 e5 5c 6e b9 1f 73 c8 bc 9d 33 |.......\n..s...3|
000001f0 8d b1 1e d3 5b 8f bd ea b9 8c 02 05 f8 84 ff b7 |....[...........|
00000200 bd d5 2b ce f4 f9 c7 92 7c 4b 62 17 18 3d 72 40 |..+.....|Kb..=r@|
00000210 66 cf 8a 02 d0 fa 90 30 62 1d 6d ba 9f b6 53 6c |f......0b.m...Sl|
00000220 40 3d e7 eb 2e 88 06 67 8d 53 d9 84 66 a0 c5 9d |@=.....g.S..f...|
00000230 60 31 21 40 13 17 10 c2 89 1b 39 8f cd 0f 27 7f |`1!@......9...'.|
00000240 d0 84 3e 78 ce 9b 91 5d 8c 67 30 a3 30 e1 77 f5 |..>x...].g0.0.w.|
00000250 7b 86 6b f4 01 26 c2 46 73 49 1b 69 e0 24 9d 8d |{.k..&.FsI.i.$..|
00000260 b2 0b 8b 80 28 05 3e d4 09 e2 f6 90 1f 7f 50 d0 |....(.>.......P.|
00000270 86 d4 f1 ce a9 4f 2f 3a 4d 9d 72 2c 2d e9 d0 d8 |.....O/:M.r,-...|
00000280 a3 cb 28 16 f3 1d 11 41 1c c7 92 2d e0 c2 ba 0b |..(....A...-....|
00000290 57 86 84 93 d7 a9 51 43 2f d1 df c8 f0 ef e6 b4 |W.....QC/.......|
000002a0 31 43 c2 1f dc 7c 30 3e 5c b6 6f d7 37 0c de 0f |1C...|0>\.o.7...|
000002b0 43 76 6d cd da fb 2a 57 17 9c 0f 53 d1 e5 ce 61 |Cvm...*W...S...a|
000002c0 00 dc 4b 0f 90 70 3b b6 1c a3 38 1d 5e 0d b1 3d |..K..p;...8.^..=|
000002d0 40 15 ec eb 6f ed c9 c6 c5 26 ae da 46 b5 00 6a |@...o....&..F..j|
000002e0 68 1e 9d b7 4e 42 a5 a3 4d 8d bc 5e 52 cc a3 44 |h...NB..M..^R..D|
000002f0 e3 72 86 be 70 d2 cf 11 3a 5f 25 dc 3a b3 e3 ee |.r..p...:_%.:...|
00000300 31 45 4b cc 16 03 03 00 e5 7a 20 c2 1d 3e 3c 2d |1EK......z ..><-|
00000310 6e 40 dd 3e 1f d0 91 3e bd 15 68 cb 36 24 40 16 |n@.>...>..h.6$@.|
00000320 25 71 38 95 f3 ba c6 63 ae aa 29 7a e2 f8 1d 1b |%q8....c..)z....|
00000330 79 5f 5a 19 9f 4b eb 30 cf ad f0 72 e8 b4 2a a4 |y_Z..K.0...r..*.|
00000340 e0 d6 c1 44 b6 05 e2 ba e7 6e fc 9d 82 59 d1 a6 |...D.....n...Y..|
00000350 f9 2a bb 15 a8 bd e5 61 e4 7f 8c 17 38 d9 34 0d |.*.....a....8.4.|
00000360 21 b5 80 78 7e a6 03 af af 9d 83 c9 41 d9 89 04 |!..x~.......A...|
00000370 b7 06 65 33 d4 2b 97 75 a4 8b d5 63 0e c9 06 d6 |..e3.+.u...c....|
00000380 06 c1 fe ce 96 dc c8 3b 0d 18 02 d4 e7 7e e6 c8 |.......;.....~..|
00000390 f4 da b0 0f 1b 1c 49 73 b3 85 70 2e 43 d3 89 42 |......Is..p.C..B|
000003a0 ac 7f 56 69 fd 85 d8 a7 60 90 37 02 b0 c3 fc 87 |..Vi....`.7.....|
000003b0 10 04 f5 e6 29 a6 24 61 d2 ec ba 6b e9 02 94 b0 |....).$a...k....|
000003c0 c7 3c b5 9b 74 7e d7 e1 78 ce b2 4d 0c ef 7c cc |.<..t~..x..M..|.|
000003d0 c2 a5 32 d3 3b 9a b4 df 07 7a c4 c6 55 bd 95 e1 |..2.;....z..U...|
000003e0 40 24 5f 92 63 7f 38 ff 6f fb fa 61 1b f3 16 03 |@$_.c.8.o..a....|
000003f0 03 00 42 7a 20 c2 1d 3e 3c 2d 6f 34 89 7c 3a 9a |..Bz ..><-o4.|:.|
00000400 75 0b 68 6b 7e eb 87 c1 30 27 0f 9e 4f 9d 58 f4 |u.hk~...0'..O.X.|
00000410 27 38 c0 d7 cf 4f 8d 74 7b 18 1f b3 b7 51 16 aa |'8...O.t{....Q..|
00000420 53 e8 bc 43 3e 40 1a a4 da 6f b0 57 92 a7 37 4f |S..C>@...o.W..7O|
00000430 70 fd f1 bc 77 16 03 03 00 1c 7a 20 c2 1d 3e 3c |p...w.....z ..><|
00000440 2d 70 ee 59 90 0a c3 b1 25 e7 67 51 10 b6 9b 06 |-p.Y....%.gQ....|
00000450 6b 71 66 d2 aa e8 |kqf...|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 13 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 03 02 71 00 00 00 00 00 00 00 02 6f 24 b6 |....q........o$.|
00000010 bf d6 f9 08 28 0e 73 38 ac 9f 2f cd 67 94 f1 cc |....(.s8../.g...|
00000020 90 29 42 a9 39 d6 c4 eb ca ad a6 e0 70 4b 57 30 |.)B.9.......pKW0|
00000030 67 fc 7f 96 17 0c 9e cb 8b 4e ad 29 68 6d d9 f7 |g........N.)hm..|
00000040 ec 39 31 a3 1e ec 26 57 f0 18 42 be 5a df 9e 3d |.91...&W..B.Z..=|
00000050 89 34 9c 4d c4 aa fe ae 14 ea 67 15 ca d1 f5 c1 |.4.M......g.....|
00000060 6d c7 25 d2 b5 6e f3 c6 a9 69 19 c9 d2 8a fc c5 |m.%..n...i......|
00000070 c5 10 14 cd 30 e2 a6 20 9d 53 32 68 8d f1 d4 d6 |....0.. .S2h....|
00000080 ea eb 5f 3e 08 24 57 02 65 73 f5 8c 6b d2 67 1d |.._>.$W.es..k.g.|
00000090 8b ec ed c5 a2 52 f3 05 c2 96 a6 4c a4 cf e6 c3 |.....R.....L....|
000000a0 83 8c 24 34 75 d9 07 df 13 e6 14 98 74 6b 1c 30 |..$4u.......tk.0|
000000b0 3f 2a f8 90 f0 3b 56 5e d8 2f ce e9 bc a9 42 b1 |?*...;V^./....B.|
000000c0 ca 35 09 1d 5c 54 a9 53 76 a5 3c 77 16 0e f9 a8 |.5..\T.Sv.<w....|
000000d0 a1 e0 74 39 6a f3 2b 6c 92 de 33 1b 71 e9 59 2f |..t9j.+l..3.q.Y/|
000000e0 7f 5b e5 b4 c3 b7 03 0b 9c 20 94 1e 65 b0 3e 77 |.[....... ..e.>w|
000000f0 c5 13 f1 e5 83 40 2d 90 f2 e1 52 e7 8d 98 00 15 |.....@-...R.....|
00000100 9f 0f 99 1a 0d 6e 65 cc 79 7e a7 2e 49 0f 86 e8 |.....ne.y~..I...|
00000110 a7 e5 06 b4 55 50 30 5c 1f ac 43 a7 9b 8a 80 ff |....UP0\..C.....|
00000120 6c 83 3a 42 45 b4 92 69 b4 4a c4 d7 d4 e0 e0 d4 |l.:BE..i.J......|
00000130 3b cc 1d c6 27 c1 f2 07 a4 f8 cc 6f 2b 9a 3f de |;...'......o+.?.|
00000140 f4 1b 8d 51 73 45 ad b4 03 5e 86 02 3a 7c 03 ce |...QsE...^..:|..|
00000150 92 a1 8f 71 b1 8a 57 05 1b 54 21 e4 c9 af 32 96 |...q..W..T!...2.|
00000160 a6 2f df ee e0 54 9f 3f ba ee fe d0 75 7d 51 92 |./...T.?....u}Q.|
00000170 81 59 9a 8c 56 35 7f 2d ee 65 d8 9c 13 2b 3b b2 |.Y..V5.-.e...+;.|
00000180 1d cd 66 0c 7d 3c 74 b4 7f 97 59 17 46 8f 75 50 |..f.}<t...Y.F.uP|
00000190 f5 c6 d0 77 ad e7 06 b1 c8 5b 30 fd 9c a0 ac 5f |...w.....[0...._|
000001a0 c5 d4 e8 20 21 00 a7 f5 b3 f4 8a 7f eb a2 00 61 |... !..........a|
000001b0 45 b9 2b 40 f6 9a a6 7f 52 da 94 14 4c 7c d6 e9 |E.+@....R...L|..|
000001c0 49 68 ed da 90 01 69 cb f4 dc 55 41 cd 66 16 ed |Ih....i...UA.f..|
000001d0 18 e9 e7 1f 02 bf d2 ec 66 12 ff e4 7d dc e2 d8 |........f...}...|
000001e0 90 ba b7 73 e7 9d 96 77 aa 9c c6 af 62 0c 5c b1 |...s...w....b.\.|
000001f0 57 0a 03 e4 44 58 7f b3 79 b0 4f f2 78 90 64 d3 |W...DX..y.O.x.d.|
00000200 41 f4 56 56 30 0c 57 04 8f 11 bd c4 cc b3 9d cb |A.VV0.W.........|
00000210 13 a7 81 78 bf cf ed 2d cc 5c 09 54 ba 36 e7 e0 |...x...-.\.T.6..|
00000220 a6 42 e8 c1 f7 bd 14 d0 e8 a7 50 71 1f a4 e0 b0 |.B........Pq....|
00000230 6d d6 98 76 19 0e 2f e3 ad c4 82 04 9e 8a 4a f6 |m..v../.......J.|
00000240 31 57 01 9b c5 f6 b6 56 7a cb 39 fa 3c 97 52 1c |1W.....Vz.9.<.R.|
00000250 88 8d 3c e4 98 d1 72 9a 51 9e d5 36 fd 44 7b 6f |..<...r.Q..6.D{o|
00000260 37 c4 76 4b 1f 3a 1f d2 e8 b0 d6 78 29 e8 4a 42 |7.vK.:.....x).JB|
00000270 6b 83 08 e8 6f 09 16 03 03 00 5e 00 00 00 00 00 |k...o.....^.....|
00000280 00 00 03 0e 1c a5 6c c1 72 32 d4 eb 06 53 0d 41 |......l.r2...S.A|
00000290 93 e1 f8 db 43 b3 45 d2 f5 6d 67 32 55 9d 33 1d |....C.E..mg2U.3.|
000002a0 fb 12 fe 48 0f e5 a4 83 f0 73 c1 35 03 ea a0 4d |...H.....s.5...M|
000002b0 f6 3d d9 31 0b 70 55 52 ba 9d bb f5 8a d3 f3 cd |.=.1.pUR........|
000002c0 17 28 24 72 3d 2b fa 57 0a 3a 50 b3 27 91 d5 d2 |.($r=+.W.:P.'...|
000002d0 a7 5d 99 88 71 98 e9 79 1f 16 03 03 00 a0 00 00 |.]..q..y........|
000002e0 00 00 00 00 00 04 9f be d5 6d ea ba e7 46 f1 c5 |.........m...F..|
000002f0 10 27 c2 47 4c 2a 45 3e fe 4c 90 e2 3b 8f c5 cf |.'.GL*E>.L..;...|
00000300 df d6 93 40 10 65 77 0d d0 97 1d af 22 8a 48 9f |...@.ew.....".H.|
00000310 ba 43 19 19 4a 50 d3 b4 4a f8 70 39 fe b8 39 af |.C..JP..J.p9..9.|
00000320 6e d8 e9 3e 33 5d a4 b5 37 a9 88 87 06 4e b8 9f |n..>3]..7....N..|
00000330 67 9b 0a fc ec e4 cf 7b cc 41 6a a3 20 f8 ae 9d |g......{.Aj. ...|
00000340 6f f9 85 a9 77 c9 5c 7b 31 75 85 b9 43 a8 cc 5f |o...w.\{1u..C.._|
00000350 c1 47 bd 31 15 61 3b ac 8d 2b 92 56 33 12 a8 fa |.G.1.a;..+.V3...|
00000360 be 42 03 5f 57 6e 40 63 3f f8 87 d1 4a 5c 11 99 |.B._Wn@c?...J\..|
00000370 7d 31 cd 13 95 44 e1 a4 22 9b 58 64 6a 25 14 03 |}1...D..".Xdj%..|
00000380 03 00 19 00 00 00 00 00 00 00 05 c1 fa 7d 26 1e |.............}&.|
00000390 2c 71 d5 c8 76 2a 6e 69 58 55 b9 7c 16 03 03 00 |,q..v*niXU.|....|
000003a0 28 00 00 00 00 00 00 00 00 81 7a 4e 36 a5 96 c0 |(.........zN6...|
000003b0 9f 46 6e 29 1a cb 06 cd 62 4d a3 14 6c 59 e6 e0 |.Fn)....bM..lY..|
000003c0 4a ca 84 cb 07 28 5d 1f a1 |J....(]..|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 14 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 14 03 03 00 19 7a 20 c2 1d 3e 3c 2d 71 89 d6 e0 |.....z ..><-q...|
00000010 81 c6 82 a7 40 2f 3e 1e 8c e3 e1 8f dc a2 16 03 |....@/>.........|
00000020 03 00 28 a2 41 d8 86 76 bd 14 82 e7 6a f4 24 2b |..(.A..v....j.$+|
00000030 f3 c0 96 9c f0 70 75 11 c8 bc 9c c9 69 95 31 6f |.....pu.....i.1o|
00000040 09 7d 55 09 c7 81 0d d5 36 58 bf 17 03 03 00 21 |.}U.....6X.....!|
00000050 a2 41 d8 86 76 bd 14 83 ff 94 3c e4 8f 4a 25 7a |.A..v.....<..J%z|
00000060 45 65 88 77 e6 87 dc 63 29 8f 44 67 70 0d 25 0f |Ee.w...c).Dgp.%.|
00000070 de |.|
crypto/tls: allow renegotiation to be handled by a client. This change adds Config.Renegotiation which controls whether a TLS client will accept renegotiation requests from a server. This is used, for example, by some web servers that wish to “add” a client certificate to an HTTPS connection. This is disabled by default because it significantly complicates the state machine. Originally, handshakeMutex was taken before locking either Conn.in or Conn.out. However, if renegotiation is permitted then a handshake may be triggered during a Read() call. If Conn.in were unlocked before taking handshakeMutex then a concurrent Read() call could see an intermediate state and trigger an error. Thus handshakeMutex is now locked after Conn.in and the handshake functions assume that Conn.in is locked for the duration of the handshake. Additionally, handshakeMutex used to protect Conn.out also. With the possibility of renegotiation that's no longer viable and so writeRecordLocked has been split off. Fixes #5742. Change-Id: I935914db1f185d507ff39bba8274c148d756a1c8 Reviewed-on: https://go-review.googlesource.com/22475 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Russ Cox <rsc@golang.org>
2016-04-26 18:45:35 +01:00
>>> Flow 15 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 15 03 03 00 1a 00 00 00 00 00 00 00 01 26 a8 f1 |.............&..|
00000010 b6 ae af 74 3b 31 70 08 49 cd 85 ab f4 82 3d |...t;1p.I.....=|
Reference in New Issue Copy Permalink