kris/th5
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
7ef5c9eac8
th5/testdata/Server-TLSv12-Resume

45 lines
3.2 KiB
Plaintext
Raw Normal View History

crypto/tls: rework reference tests. The practice of storing reference connections for testing has worked reasonably well, but the large blocks of literal data in the .go files is ugly and updating the tests is a real problem because their number has grown. This CL changes the way that reference tests work. It's now possible to automatically update the tests and the test data is now stored in testdata/. This should make it easier to implement changes that affect all connections, like implementing the renegotiation extension. R=golang-codereviews, r CC=golang-codereviews https://golang.org/cl/42060044
2013-12-20 16:37:05 +00:00
>>> Flow 1 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 16 03 01 00 f9 01 00 00 f5 03 03 87 90 a5 92 ea |................|
00000010 48 25 c2 91 01 8a e4 bb 16 2d d3 8c b7 e9 a3 9a |H%.......-......|
00000020 6d e1 6f b4 11 f3 9b 61 c9 03 cf 20 d9 a8 04 8f |m.o....a... ....|
00000030 3b f8 1c 73 d8 4b 55 40 43 95 26 1f ed 67 cc 18 |;..s.KU@C.&..g..|
00000040 0d 8f e8 d4 ab 1a 2e 53 d0 e6 89 d8 00 04 00 2f |.......S......./|
00000050 00 ff 01 00 00 a8 00 23 00 78 50 46 ad c1 db a8 |.......#.xPF....|
crypto/x509: require a NULL parameters for RSA public keys. The RFC is clear that the Parameters in an AlgorithmIdentifer for an RSA public key must be NULL. BoringSSL enforces this so we have strong evidence that this is a widely compatible change. Embarrassingly enough, the major source of violations of this is us. Go used to get this correct in only one of two places. This was only fixed in 2013 (with 4874bc9b). That's why lots of test certificates are updated in this change. Fixes #16166. Change-Id: Ib9a4551349354c66e730d44eb8cee4ec402ea8ab Reviewed-on: https://go-review.googlesource.com/27312 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-08-17 23:55:15 +01:00
00000060 38 86 7b 2b bb fd d0 c3 42 3e 00 00 00 00 00 00 |8.{+....B>......|
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000070 00 00 00 00 00 00 00 00 00 00 94 6f 2c 9f 83 61 |...........o,..a|
00000080 ba 85 c2 4f 82 f7 76 6c 2f 9d 4c 16 0e 46 88 f4 |...O..vl/.L..F..|
00000090 1b 1b 35 62 9c c7 e6 0e 44 a4 62 8c 1e 2d 53 f3 |..5b....D.b..-S.|
000000a0 8b cd a6 ca dc 12 52 b4 43 a9 d0 16 4c 9a f7 a6 |......R.C...L...|
000000b0 33 94 f7 58 26 2b 75 74 62 e3 11 dc f6 40 b0 ab |3..X&+utb....@..|
000000c0 32 8b 79 63 d1 7e d8 9f db cf cf 25 29 ea e9 89 |2.yc.~.....%)...|
000000d0 43 39 00 0d 00 20 00 1e 06 01 06 02 06 03 05 01 |C9... ..........|
crypto/x509: require a NULL parameters for RSA public keys. The RFC is clear that the Parameters in an AlgorithmIdentifer for an RSA public key must be NULL. BoringSSL enforces this so we have strong evidence that this is a widely compatible change. Embarrassingly enough, the major source of violations of this is us. Go used to get this correct in only one of two places. This was only fixed in 2013 (with 4874bc9b). That's why lots of test certificates are updated in this change. Fixes #16166. Change-Id: Ib9a4551349354c66e730d44eb8cee4ec402ea8ab Reviewed-on: https://go-review.googlesource.com/27312 Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-08-17 23:55:15 +01:00
000000e0 05 02 05 03 04 01 04 02 04 03 03 01 03 02 03 03 |................|
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
000000f0 02 01 02 02 02 03 00 16 00 00 00 17 00 00 |..............|
crypto/tls: rework reference tests. The practice of storing reference connections for testing has worked reasonably well, but the large blocks of literal data in the .go files is ugly and updating the tests is a real problem because their number has grown. This CL changes the way that reference tests work. It's now possible to automatically update the tests and the test data is now stored in testdata/. This should make it easier to implement changes that affect all connections, like implementing the renegotiation extension. R=golang-codereviews, r CC=golang-codereviews https://golang.org/cl/42060044
2013-12-20 16:37:05 +00:00
>>> Flow 2 (server to client)
crypto/tls: support renegotiation extension. The renegotiation extension was introduced[1] due to an attack by Ray in which a client's handshake was spliced into a connection that was renegotiating, thus giving an attacker the ability to inject an arbitary prefix into the connection. Go has never supported renegotiation as a server and so this attack doesn't apply. As a client, it's possible that at some point in the future the population of servers will be sufficiently updated that it'll be possible to reject connections where the server hasn't demonstrated that it has been updated to address this problem. We're not at that point yet, but it's good for Go servers to support the extension so that it might be possible to do in the future. [1] https://tools.ietf.org/search/rfc5746 R=golang-codereviews, mikioh.mikioh CC=golang-codereviews https://golang.org/cl/48580043
2014-01-09 18:38:11 +00:00
00000000 16 03 03 00 51 02 00 00 4d 03 03 00 00 00 00 00 |....Q...M.......|
crypto/tls: rework reference tests. The practice of storing reference connections for testing has worked reasonably well, but the large blocks of literal data in the .go files is ugly and updating the tests is a real problem because their number has grown. This CL changes the way that reference tests work. It's now possible to automatically update the tests and the test data is now stored in testdata/. This should make it easier to implement changes that affect all connections, like implementing the renegotiation extension. R=golang-codereviews, r CC=golang-codereviews https://golang.org/cl/42060044
2013-12-20 16:37:05 +00:00
00000010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000020 00 00 00 00 00 00 00 00 00 00 00 20 d9 a8 04 8f |........... ....|
00000030 3b f8 1c 73 d8 4b 55 40 43 95 26 1f ed 67 cc 18 |;..s.KU@C.&..g..|
00000040 0d 8f e8 d4 ab 1a 2e 53 d0 e6 89 d8 00 2f 00 00 |.......S...../..|
crypto/tls: support renegotiation extension. The renegotiation extension was introduced[1] due to an attack by Ray in which a client's handshake was spliced into a connection that was renegotiating, thus giving an attacker the ability to inject an arbitary prefix into the connection. Go has never supported renegotiation as a server and so this attack doesn't apply. As a client, it's possible that at some point in the future the population of servers will be sufficiently updated that it'll be possible to reject connections where the server hasn't demonstrated that it has been updated to address this problem. We're not at that point yet, but it's good for Go servers to support the extension so that it might be possible to do in the future. [1] https://tools.ietf.org/search/rfc5746 R=golang-codereviews, mikioh.mikioh CC=golang-codereviews https://golang.org/cl/48580043
2014-01-09 18:38:11 +00:00
00000050 05 ff 01 00 01 00 14 03 03 00 01 01 16 03 03 00 |................|
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000060 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |@...............|
00000070 00 31 1c ed f9 93 71 b9 b1 52 b7 8c d2 cc 1c ea |.1....q..R......|
00000080 2b bb c3 56 88 d4 40 ff 71 d4 33 4b 1a 17 6e ab |+..V..@.q.3K..n.|
00000090 70 78 3f 87 bf cd 8c 67 91 a0 17 d7 ee 16 37 68 |px?....g......7h|
000000a0 5b |[|
crypto/tls: rework reference tests. The practice of storing reference connections for testing has worked reasonably well, but the large blocks of literal data in the .go files is ugly and updating the tests is a real problem because their number has grown. This CL changes the way that reference tests work. It's now possible to automatically update the tests and the test data is now stored in testdata/. This should make it easier to implement changes that affect all connections, like implementing the renegotiation extension. R=golang-codereviews, r CC=golang-codereviews https://golang.org/cl/42060044
2013-12-20 16:37:05 +00:00
>>> Flow 3 (client to server)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 14 03 03 00 01 01 16 03 03 00 40 a5 40 0c 73 e9 |..........@.@.s.|
00000010 c5 b5 65 d6 1c a7 17 c4 9b 3f 1a 6d e1 02 c4 b0 |..e......?.m....|
00000020 27 9b ab 24 d5 68 d3 98 3e 06 13 c3 d9 a7 b9 07 |'..$.h..>.......|
00000030 fb fa fa 1b ba 41 b4 26 94 ba e7 5c a3 bf ae b7 |.....A.&...\....|
00000040 69 f9 55 71 bd 04 97 04 0c fc 96 |i.Uq.......|
crypto/tls: rework reference tests. The practice of storing reference connections for testing has worked reasonably well, but the large blocks of literal data in the .go files is ugly and updating the tests is a real problem because their number has grown. This CL changes the way that reference tests work. It's now possible to automatically update the tests and the test data is now stored in testdata/. This should make it easier to implement changes that affect all connections, like implementing the renegotiation extension. R=golang-codereviews, r CC=golang-codereviews https://golang.org/cl/42060044
2013-12-20 16:37:05 +00:00
>>> Flow 4 (server to client)
crypto/tls: switch to OpenSSL 1.1.0 for test data. We will need OpenSSL 1.1.0 in order to test some of the features expected for Go 1.8. However, 1.1.0 also disables (by default) some things that we still want to test, such as RC4, 3DES and SSLv3. Thus developers wanting to update the crypto/tls test data will need to build OpenSSL from source. This change updates the test data with transcripts generated by 1.1.0 (in order to reduce future diffs) and also causes a banner to be printed if 1.1.0 is not used when updating. (The test for an ALPN mismatch is removed because OpenSSL now terminates the connection with a fatal alert if no known ALPN protocols are offered. There's no point testing against this because it's an OpenSSL behaviour.) Change-Id: I957516975e0b8c7def84184f65c81d0b68f1c551 Reviewed-on: https://go-review.googlesource.com/30821 Run-TryBot: Adam Langley <agl@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2016-10-11 18:08:57 +01:00
00000000 17 03 03 00 40 00 00 00 00 00 00 00 00 00 00 00 |....@...........|
00000010 00 00 00 00 00 fc f8 67 97 50 34 a5 05 b2 f0 ea |.......g.P4.....|
00000020 77 5c bb 63 78 79 a4 a0 58 37 3b ae 96 9a c5 16 |w\.cxy..X7;.....|
00000030 82 9c b0 4b 02 27 01 0d c9 ac e0 f5 3d d6 32 f7 |...K.'......=.2.|
00000040 df 41 68 b0 38 15 03 03 00 30 00 00 00 00 00 00 |.Ah.8....0......|
00000050 00 00 00 00 00 00 00 00 00 00 ea 57 3b c1 9f f4 |...........W;...|
00000060 79 d7 76 f0 d6 1c 9d cd 0e 5a 2a 98 29 36 96 47 |y.v......Z*.)6.G|
00000070 4e 9c 76 ef 4c 69 c1 e3 4b b3 |N.v.Li..K.|
Reference in New Issue Copy Permalink