Commit Graph

2137 Commits

Author SHA1 Message Date
Charlie Getzen 3bd7427b9c More accurate error message; merge multiple boolean variables into one error variable 2021-10-16 17:54:41 -05:00
Charlie Getzen 080cc9f6a7
Update server.go 2021-10-15 10:12:56 -05:00
Charlie Getzen 0b667ac94e TimeoutHandler: distinguish between timeouts and client hangups 2021-10-14 15:09:05 -05:00
Koichi Shiraishi aded1679ef internal/poll,net: support poll.Sendfile for darwin
darwin already supports syscall.Sendfile.

Change-Id: Id3db06591ffad0550b4173bacddeb0acfe355f9e
Reviewed-on: https://go-review.googlesource.com/c/go/+/355109
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Trust: Alexander Rakoczy <alex@golang.org>
2021-10-13 16:41:20 +00:00
Amelia Downs 69041c79dc net: add examples for remaining IP functions
Fixes #48848

Change-Id: If85fc16ed10a26eca840ed128ab47c5f00776ddd
Reviewed-on: https://go-review.googlesource.com/c/go/+/346289
Reviewed-by: Amelia Downs <adowns@vmware.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Trust: Alexander Rakoczy <alex@golang.org>
2021-10-13 16:36:59 +00:00
Daniel Martí d973bb107e encoding/gob: follow documented io.EOF semantics
The docs say:

	If the input is at EOF, Decode returns io.EOF and does not modify e.

However, the added test fails:

	--- FAIL: TestDecodePartial (0.00s)
		encoder_test.go:1263: 31/81: expected io.ErrUnexpectedEOF: EOF
		encoder_test.go:1263: 51/81: expected io.ErrUnexpectedEOF: EOF

In particular, the decoder would return io.EOF after reading a valid
message for a type specification, and then hit EOF before reading a data
item message.

Fix that by only allowing a Decode call to return io.EOF if the reader
hits EOF immediately, without successfully reading any message.
Otherwise, hitting EOF is an ErrUnexpectedEOF, like in other cases.

Also fix a net/rpc test that, coincidentally, expected an io.EOF
as an error when feeding bad non-zero data to a gob decoder.
An io.ErrUnexpectedEOF is clearly better in that scenario.

Fixes #48905.

Change-Id: Ied6a0d8ac8377f89646319a18c0380c4f2b09b85
Reviewed-on: https://go-review.googlesource.com/c/go/+/354972
Trust: Daniel Martí <mvdan@mvdan.cc>
Run-TryBot: Daniel Martí <mvdan@mvdan.cc>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Rob Pike <r@golang.org>
2021-10-11 21:58:33 +00:00
John Kelly c8dd89ed3d net/http: add Cookie.Valid method
The (*http.Cookie).String method used by SetCookie will silently discard
or sanitize any fields it deems invalid, making it difficult to tell
whether a cookie will be sent as expected.

This change introduces a new (*http.Cookie).Valid method which may be
used to check if any cookie fields will be discarded or sanitized prior
to calling (*http.Cookie).String.

Fixes #46370

Change-Id: I2db80078de190d267a9c675a9717c8be8acc8704
Reviewed-on: https://go-review.googlesource.com/c/go/+/338590
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Trust: Cherry Mui <cherryyz@google.com>
Trust: Damien Neil <dneil@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
2021-10-06 23:26:57 +00:00
Damien Neil 7109323af5 all: update golang.org/x/net to pull in CL 353390
Fixes #48564.
Fixes #23559.

Change-Id: I8e0b646c4791d3a6fb17df1af0a7175b68ce8983
Reviewed-on: https://go-review.googlesource.com/c/go/+/353870
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-10-06 16:42:27 +00:00
Russ Cox 4d8db00641 all: use bytes.Cut, strings.Cut
Many uses of Index/IndexByte/IndexRune/Split/SplitN
can be written more clearly using the new Cut functions.
Do that. Also rewrite to other functions if that's clearer.

For #46336.

Change-Id: I68d024716ace41a57a8bf74455c62279bde0f448
Reviewed-on: https://go-review.googlesource.com/c/go/+/351711
Trust: Russ Cox <rsc@golang.org>
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-10-06 15:53:04 +00:00
Damien Neil 72c52bfbe2 net/http: parse HTTP version strings according to RFC 7230
RFC 2616 permits multiple digits in the major and minor numbers of an
HTTP version:

	https://datatracker.ietf.org/doc/html/rfc2616#section-3.1

RFC 7230 obsoletes 2616 and tightens the specification to permit only a
single digit in the major and minor number:

	https://datatracker.ietf.org/doc/html/rfc7230#section-2.6

Use the stricter definition.

Also fix a bug which caused version numbers with a leading "+" to
be accepted (e.g., "HTTP/1.+1".)

Fixes #46587.

Change-Id: Ic5923bb858e5ac402cfde486fba2c075e221553d
Reviewed-on: https://go-review.googlesource.com/c/go/+/325874
Trust: Damien Neil <dneil@google.com>
Trust: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-10-06 00:43:45 +00:00
Damien Neil a7fe161ccc net: don't use syscall.NET_RT_IFLISTL on FreeBSD
The golang.org/x/net/route package can't parse the RIB returned
by NET_RT_IFLISTL. Use the route.RIBTypeInterface constant
instead, leaving the choice of syscall up to the route package.

Fixes #48553.

Change-Id: Ida4bd6e332c0dc6dc871d3a93cfb56c0fbc93e1b
Reviewed-on: https://go-review.googlesource.com/c/go/+/353611
Trust: Damien Neil <dneil@google.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
2021-10-02 16:05:55 +00:00
Leon Klingele 64da5e0fd5 net/http/pprof: use "curl" instead of "wget" in usage example
The "curl" binary is already used at several other places inside
the code base, whereas this was the only occurrence of "wget".

Change-Id: I2b9c5c353d08b3ba8289819b4a602c51f1ebd593
GitHub-Last-Rev: abf9485522
GitHub-Pull-Request: golang/go#48718
Reviewed-on: https://go-review.googlesource.com/c/go/+/353401
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Cherry Mui <cherryyz@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
2021-10-02 00:31:26 +00:00
Ian Lance Taylor cf241a34a2 net: consistently return DNSError on lookup failure
Previously if we failed because the context timed out or was canceled,
we returned errCanceled or errTimeout.

Fixes #39178

Change-Id: I11bd7ebfaa7e5775fb05dfbb6b67f8307c8d8697
Reviewed-on: https://go-review.googlesource.com/c/go/+/353400
Trust: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
2021-10-02 00:18:01 +00:00
Eli Bendersky c894b442d1 net/rpc: remove warnings on incompatible methods at registration
When registering an RPC server, the type being registered may
have additional methods that are not meant to be exposed as
RPC endpoints. Remove the warnings net/rpc produces in
this case. The functionality to report warnings is kept in the code
with a compile-time constant that can be enabled for debugging.

The documentation of net/rpc states that only methods
satisfying a set of criteria will be made available, while other
methods will be ignored.

Fixes #19957

Change-Id: I5f8a148b4be1fdfffb2cd2029871193eaf24b751
Reviewed-on: https://go-review.googlesource.com/c/go/+/350009
Reviewed-by: Daniel Lublin <daniel@lublin.se>
Reviewed-by: Damien Neil <dneil@google.com>
Trust: Carlos Amedee <carlos@golang.org>
2021-09-18 06:04:41 +00:00
Dan Kortschak 8d2a9c32a2 all: remove incorrectly repeated words in comments
Change-Id: Icbf36e1cd8311b40d18177464e7c41dd8cb1c65b
Reviewed-on: https://go-review.googlesource.com/c/go/+/340350
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Trust: Carlos Amedee <carlos@golang.org>
2021-09-16 23:57:40 +00:00
Damien Neil a53e3d5f88 net: deprecate (net.Error).Temporary
Fixes #45729.

Change-Id: I819dd0cc79fc23baac46cafd78bb80f5133c992b
Reviewed-on: https://go-review.googlesource.com/c/go/+/340261
Trust: Damien Neil <dneil@google.com>
Trust: Bryan C. Mills <bcmills@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-09-09 16:32:28 +00:00
Damien Neil acc2957bc9 net/http: fix hang in probing for a zero-length request body
Fix a hang that occurs when making a request and all of the following apply:
* The request method is one of GET, HEAD, DELETE, OPTIONS, PROPFIND, or SEARCH.
* The Request.Body is non-nil.
* The content length is not set, or is set to -1.
* Transfer-Encoding: chunked is not set.
* The request body does not respond to a read within 200ms.

In this case, we give up on probing for a zero-length body and send the
request while the probe completes in the background. Fix a bug in the
io.Reader wrapping the in-flight probe: It should return io.EOF after
the probe completes, but does not.

Fixes #47568.

Change-Id: I7f9188c96e1210055df68424081af927006e4816
Reviewed-on: https://go-review.googlesource.com/c/go/+/340256
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ingo Oeser <nightlyone@googlemail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-09-02 17:00:30 +00:00
Damien Neil 2a463a22ce net/http: close request body after recovering from a handler panic
When recovering from a panic in a HTTP handler, close the request body
before closing the *conn, ensuring that the *conn's bufio.Reader is safe
to recycle.

Fixes #46866.

Change-Id: I3fe304592e3b423a0970727d68bc1229c3752939
Reviewed-on: https://go-review.googlesource.com/c/go/+/329922
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-09-02 16:59:57 +00:00
Damien Neil 0bfd6fcea6 all: update golang.org/x/net to pull in CL 346890
For #42777.

Change-Id: I963db8c666e8bcf0fc4f390b359db6408a0f792b
Reviewed-on: https://go-review.googlesource.com/c/go/+/347010
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
2021-09-01 22:28:21 +00:00
Tobias Klauser d384ebde60 net: enable multicast listener tests on solaris/illumos
It seems everything is in place for these tests to pass on solaris and
illumos, so enable them.

Fixes #7399

Change-Id: If6defb651ef9c5059c1aeccbc4fc13a12a86b682
Reviewed-on: https://go-review.googlesource.com/c/go/+/346149
Trust: Tobias Klauser <tobias.klauser@gmail.com>
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
2021-08-31 04:26:31 +00:00
HuanCheng 5045477be8 net/http: fix typo in header.go
Change-Id: Ia6df881badf9a704c7f56967404d37e230b88a09
Reviewed-on: https://go-review.googlesource.com/c/go/+/343969
Reviewed-by: Damien Neil <dneil@google.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Trust: Damien Neil <dneil@google.com>
2021-08-20 18:55:57 +00:00
Yasuhiro Matsumoto 4012fea822 all: fix typos
Change-Id: I83180c472db8795803c1b9be3a33f35959e4dcc2
Reviewed-on: https://go-review.googlesource.com/c/go/+/336889
Reviewed-by: Rob Pike <r@golang.org>
Reviewed-by: Austin Clements <austin@google.com>
2021-08-17 13:54:10 +00:00
Josh Bleecher Snyder 9c5eb16f6c net: reduce allocation size in ReadFromUDP
Switch to concrete types. Bring your own object to fill in.

Allocate just enough for the IP byte slice.
The allocation is now just 4 bytes for IPv4,
which puts it in the tiny allocator, which is much faster.

name                  old time/op    new time/op    delta
WriteToReadFromUDP-8    13.7µs ± 1%    13.4µs ± 2%   -2.49%  (p=0.000 n=10+10)

name                  old alloc/op   new alloc/op   delta
WriteToReadFromUDP-8     32.0B ± 0%      4.0B ± 0%  -87.50%  (p=0.000 n=10+10)

name                  old allocs/op  new allocs/op  delta
WriteToReadFromUDP-8      1.00 ± 0%      1.00 ± 0%     ~     (all equal)

Windows is temporarily stubbed out.

Updates #43451

Change-Id: Ief506f891b401d28715d22dce6ebda037941924e
Reviewed-on: https://go-review.googlesource.com/c/go/+/331490
Trust: Josh Bleecher Snyder <josharian@gmail.com>
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Josh Bleecher Snyder <josharian@gmail.com>
Run-TryBot: Damien Neil <dneil@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
2021-08-16 23:57:02 +00:00
Josh Bleecher Snyder d9349175ad net: remove allocation from UDPConn.WriteTo
Duplicate some code to avoid an interface.

name                  old time/op    new time/op    delta
WriteToReadFromUDP-8    6.38µs ±20%    5.59µs ±10%  -12.38%  (p=0.001 n=10+9)

name                  old alloc/op   new alloc/op   delta
WriteToReadFromUDP-8     64.0B ± 0%     32.0B ± 0%  -50.00%  (p=0.000 n=10+10)

name                  old allocs/op  new allocs/op  delta
WriteToReadFromUDP-8      2.00 ± 0%      1.00 ± 0%  -50.00%  (p=0.000 n=10+10)

Windows is temporarily stubbed out.

Updates #43451

Change-Id: Ied15ff92268c652cf445836e0446025eaeb60cc9
Reviewed-on: https://go-review.googlesource.com/c/go/+/331489
Trust: Josh Bleecher Snyder <josharian@gmail.com>
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Josh Bleecher Snyder <josharian@gmail.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
2021-08-16 23:54:32 +00:00
Andy Pan c04a32e59a net: avoid memory copy calling absDomainName
Change-Id: I8ea9bec8bc33e29b8c265fbca40871bc23667144
Reviewed-on: https://go-review.googlesource.com/c/go/+/330470
Reviewed-by: Damien Neil <dneil@google.com>
Trust: Damien Neil <dneil@google.com>
Trust: Michael Knyszek <mknyszek@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
2021-08-16 21:38:38 +00:00
Damien Neil ec27168712 net/http: drop headers with invalid keys in Header.Write
Don't let handlers inject unexpected headers by setting keys like:
	w.Header().Set("Evil: x\r\nSmuggle", y)

Fixes #47711.

Change-Id: I459ce1c79bc273a84230a0f5b665f81c46dbc672
Reviewed-on: https://go-review.googlesource.com/c/go/+/342530
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
2021-08-16 20:02:13 +00:00
Matt Layher a0adf91d85 internal/syscall/unix: change Ioctl arg type to unsafe.Pointer on AIX
Without this change, this code is technically in violation of the
unsafe.Pointer rules since the conversion from unsafe.Pointer to uintptr has
to happen when calling into the syscall6 assembly implementation.

Change-Id: I4821f5bf9788c8fa2efeb041f811ed092e07ae74
Reviewed-on: https://go-review.googlesource.com/c/go/+/340949
Trust: Matt Layher <mdlayher@gmail.com>
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-08-16 16:58:24 +00:00
hitzhangjie 7eaabae84d net: update IP.String doc to reflect RFC 5952 conformance
Fixes #44485

Change-Id: I1b1bf14245ef738342ec881ac4c99adbfc9c5b7d
GitHub-Last-Rev: ae0242c6d6
GitHub-Pull-Request: golang/go#47394
Reviewed-on: https://go-review.googlesource.com/c/go/+/337409
Trust: Dmitri Shuralyov <dmitshur@golang.org>
Trust: Damien Neil <dneil@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
2021-08-13 21:53:07 +00:00
Damien Neil 6e738868a7 net/http: speed up and deflake TestCancelRequestWhenSharingConnection
This test made many requests over the same connection for 10
seconds, trusting that this will exercise the request cancelation
race from #41600.

Change the test to exhibit the specific race in a targeted fashion
with only two requests.

Updates #41600.
Updates #47016.

Change-Id: If99c9b9331ff645f6bb67fe9fb79b8aab8784710
Reviewed-on: https://go-review.googlesource.com/c/go/+/339594
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Heschi Kreinick <heschi@google.com>
2021-08-04 15:26:45 +00:00
Damien Neil b7a85e0003 net/http/httputil: close incoming ReverseProxy request body
Reading from an incoming request body after the request handler aborts
with a panic can cause a panic, becuse http.Server does not (contrary
to its documentation) close the request body in this case.

Always close the incoming request body in ReverseProxy.ServeHTTP to
ensure that any in-flight outgoing requests using the body do not
read from it.

Updates #46866
Fixes CVE-2021-36221

Change-Id: I310df269200ad8732c5d9f1a2b00de68725831df
Reviewed-on: https://go-review.googlesource.com/c/go/+/333191
Trust: Damien Neil <dneil@google.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-07-30 14:01:30 +00:00
shota3506 aa4e0f528e net/http: correct capitalization in cancelTimeBody comment
Change-Id: I7acda22c01c5350ebf5ddabb1c12af96d368de5d
GitHub-Last-Rev: 3e5c022f87
GitHub-Pull-Request: golang/go#47160
Reviewed-on: https://go-review.googlesource.com/c/go/+/334229
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Trust: Cherry Mui <cherryyz@google.com>
Run-TryBot: Ian Lance Taylor <iant@golang.org>
2021-07-16 02:43:48 +00:00
Roland Shoemaker 296ddf2a93 net: filter bad names from Lookup functions instead of hard failing
Instead of hard failing on a single bad record, filter the bad records
and return anything valid. This only applies to the methods which can
return multiple records, LookupMX, LookupNS, LookupSRV, and LookupAddr.

When bad results are filtered out, also return an error, indicating
that this filtering has happened.

Updates #46241
Fixes #46979

Change-Id: I6493e0002beaf89f5a9795333a93605abd30d171
Reviewed-on: https://go-review.googlesource.com/c/go/+/332549
Trust: Roland Shoemaker <roland@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-07-08 17:53:43 +00:00
Sean Liao 912f075047 net/http: mention socks5 support in proxy
Change-Id: I55b6d5c77221569eeafea625379affd476a65772
Reviewed-on: https://go-review.googlesource.com/c/go/+/326011
Reviewed-by: Damien Neil <dneil@google.com>
Trust: Dmitri Shuralyov <dmitshur@golang.org>
2021-07-02 21:06:08 +00:00
Roland Shoemaker 03761ede02 net: don't reject null mx records
Bypass hostname validity checking when a null mx record is returned as,
defined in RFC 7505.

Updates #46979

Change-Id: Ibe683bd6b47333a8ff30909fb2680ec8e10696ef
Reviewed-on: https://go-review.googlesource.com/c/go/+/332094
Trust: Roland Shoemaker <roland@golang.org>
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
2021-07-01 19:09:57 +00:00
Xiangdong Ji f9d50953b9 net: fix failure of TestCVE202133195
TestCVE202133195 fails in testing LookupSRV if /etc/resolv.conf sets the option
'ndots' larger than the number of dots in the domain name under query.

Fix the issue by making the input domain name in test codes 'rooted' to skip search
list qualifying.

Fixes #46955

Change-Id: I1909fa7e54e9c9af57623e57cafc905729ff99fa
Reviewed-on: https://go-review.googlesource.com/c/go/+/330842
Reviewed-by: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Trust: Dmitri Shuralyov <dmitshur@golang.org>
2021-06-29 21:54:24 +00:00
Bryan C. Mills a9bb38222a net: remove hard-coded timeout in dialClosedPort test helper
The helper function claims that dialing a closed port should be
"nearly instantaneous", but that is empirically not the case on
OpenBSD or Windows. The tests do not appear to be particularly
sensitive to the exact upper bound otherwise, so let's just
remove the arbitrary latency assumption.

Fixes #46884

Change-Id: If00c9fdc3063da6aaf60d365d4a2ee2c94dc6df1
Reviewed-on: https://go-review.googlesource.com/c/go/+/330250
Trust: Bryan C. Mills <bcmills@google.com>
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-06-24 03:45:33 +00:00
Bryan C. Mills 73496e0df0 net: use absDomainName in the Windows lookupPTR test helper
The real net code uses subtle heuristics to transform a domain name
to its absolute form. Since lookupPTR isn't checking that
transformation specifically, it should use the real code instead of
using a different heuristic.

Fixes #46882

Change-Id: I503357e0f62059c37c359cd54b44d343c7d5ab2a
Reviewed-on: https://go-review.googlesource.com/c/go/+/330249
Trust: Bryan C. Mills <bcmills@google.com>
Trust: Alex Brainman <alex.brainman@gmail.com>
Run-TryBot: Bryan C. Mills <bcmills@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
2021-06-24 00:39:41 +00:00
Filippo Valsorda d77f4c0c5c net/http: improve some server docs
Change-Id: I04662a08e07c49f629f9067a89bf453e697d44dd
Reviewed-on: https://go-review.googlesource.com/c/go/+/327813
Trust: Filippo Valsorda <filippo@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
2021-06-15 20:59:42 +00:00
Damien Neil 770f1de8c5 net/http: remove test-only private key from production binaries
The net/http/internal package contains a PEM-encoded private key used in
tests. This key is initialized at init time, which prevents it from
being stripped by the linker in non-test binaries.

Move the certificate and key to a new net/http/internal/testcert
package to ensure it is only included in binaries that reference it.

Fixes #46677.

Change-Id: Ie98bda529169314cc791063e7ce4d99ef99113c8
Reviewed-on: https://go-review.googlesource.com/c/go/+/326771
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Bryan C. Mills <bcmills@google.com>
2021-06-10 20:20:58 +00:00
Filippo Valsorda e4e7807d24 net/http: add AllowQuerySemicolons
Fixes #45973

Change-Id: I6cbe05f5d1d3c324900c74314b0ea0e12524d7f2
Reviewed-on: https://go-review.googlesource.com/c/go/+/326309
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
Trust: Katie Hockman <katie@golang.org>
Trust: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
2021-06-09 16:59:02 +00:00
Katie Hockman e6dda19888 net/url: reject query values with semicolons
Semicolons are no longer valid separators, so
net/url.ParseQuery will now return an error
if any part of the query contains a semicolon.

net/http.(*Request).ParseMultipartForm has been
changed to fall through and continue parsing
even if the call to (*Request).ParseForm fails.

This change also includes a few minor refactors
to existing tests.

Fixes #25192

Change-Id: Iba3f108950fb99b9288e402c41fe71ca3a2ababd
Reviewed-on: https://go-review.googlesource.com/c/go/+/325697
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-06-09 15:44:42 +00:00
Roland Shoemaker d3e3d03666 net: reject leading zeros in IP address parsers
In both net.ParseIP and net.ParseCIDR reject leading zeros in the
dot-decimal notation of IPv4 addresses.

Fixes #30999
Fixes #43389

Change-Id: I2b6a31fe84db89ac828cf5ed03eaa586ee96ab68
Reviewed-on: https://go-review.googlesource.com/c/go/+/325829
Trust: Roland Shoemaker <roland@golang.org>
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
2021-06-08 20:23:22 +00:00
Damien Neil 831f9376d8 net/http: fix ResponseWriter.ReadFrom with short reads
CL 249238 changes ResponseWriter.ReadFrom to probe the source with
a single read of sniffLen bytes before writing the response header.
If the source returns less than sniffLen bytes without reaching
EOF, this can cause Content-Type and Content-Length detection to
fail.

Fix ResponseWrite.ReadFrom to copy a full sniffLen bytes from
the source as a probe.

Drop the explicit call to w.WriteHeader; writing the probe will
trigger a WriteHeader call.

Consistently use io.CopyBuffer; ReadFrom has already acquired a
copy buffer, so it may as well use it.

Fixes #44953.

Change-Id: Ic49305fb827a2bd7da4764b68d64b797b5157dc0
Reviewed-on: https://go-review.googlesource.com/c/go/+/301449
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
2021-06-04 17:33:24 +00:00
Roland Shoemaker dd7ba3ba2c net: don't rely on system hosts in TestCVE202133195
Also don't unnecessarily deref the error return.

Fixes #46504

Change-Id: I22d14ac76776f8988fa0774bdcb5fcd801ce0185
Reviewed-on: https://go-review.googlesource.com/c/go/+/324190
Trust: David Chase <drchase@google.com>
Trust: Damien Neil <dneil@google.com>
Run-TryBot: David Chase <drchase@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
2021-06-02 21:39:28 +00:00
Manlio Perillo 193d514131 net/http: correct Client.Do doc about context cancelation
The documentation of the Client.Do method and Get function incorrectly
stated that, in case of context cancelation, the returned url.Error
Timeout method returns true.

Update the documentation to correctly match the implementation.
See also CL 200798 that, due to an oversight, corrected only the
documentation of the Client.Get method.

Remove a TODO note added in CL 125575 (net/http: document that Client
methods always return *url.Error), since it is no longer applicable
after CL 200798 (net/http: fix and lock-in Client.Do docs on request
cancelation).

Fixes #46402

Change-Id: Ied2ee971ba22b61777762dbb19f16e08686634ca
Reviewed-on: https://go-review.googlesource.com/c/go/+/323089
Reviewed-by: Damien Neil <dneil@google.com>
Trust: Michael Knyszek <mknyszek@google.com>
2021-05-27 21:41:58 +00:00
Roland Shoemaker cdcd02842d net: verify results from Lookup* are valid domain names
For the methods LookupCNAME, LookupSRV, LookupMX, LookupNS, and
LookupAddr check that the returned domain names are in fact valid DNS
names using the existing isDomainName function.

Thanks to Philipp Jeitner and Haya Shulman from Fraunhofer SIT for
reporting this issue.

Fixes #46241
Fixes CVE-2021-33195

Change-Id: I47a4f58c031cb752f732e88bbdae7f819f0af4f3
Reviewed-on: https://go-review.googlesource.com/c/go/+/323131
Trust: Roland Shoemaker <roland@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
2021-05-27 19:55:46 +00:00
Roland Shoemaker fca7b8f3e6 Revert "net: verify results from Lookup* are valid domain names"
This reverts commit c89f1224a5.

Reason for revert: reverting so we can apply follow-up fixes and do a single cherry pick.

Change-Id: I16c6283a0bcab056216f330fb98fa3b5f2b0780c
Reviewed-on: https://go-review.googlesource.com/c/go/+/323129
Reviewed-by: Katie Hockman <katie@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Katie Hockman <katie@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
2021-05-27 15:33:46 +00:00
Filippo Valsorda 950fa11c4c net/http/httputil: always remove hop-by-hop headers
Previously, we'd fail to remove the Connection header from a request
like this:

    Connection:
    Connection: x-header

Fixes #46313
Fixes CVE-2021-33197

Change-Id: Ie3009e926ceecfa86dfa6bcc6fe14ff01086be7d
Reviewed-on: https://go-review.googlesource.com/c/go/+/321929
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
Trust: Katie Hockman <katie@golang.org>
Trust: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
2021-05-27 15:00:58 +00:00
Roland Shoemaker c89f1224a5 net: verify results from Lookup* are valid domain names
For the methods LookupCNAME, LookupSRV, LookupMX, LookupNS, and
LookupAddr check that the returned domain names are in fact valid DNS
names using the existing isDomainName function.

Thanks to Philipp Jeitner and Haya Shulman from Fraunhofer SIT for
reporting this issue.

Fixes #46241
Fixes CVE-2021-33195

Change-Id: Icf231acd93178a3b6aec3f178cff7e693f74ef8c
Reviewed-on: https://go-review.googlesource.com/c/go/+/320949
Trust: Roland Shoemaker <roland@golang.org>
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
2021-05-24 22:27:31 +00:00
Dmitri Shuralyov 6c1c055d1e cmd/internal/moddeps: use filepath.SkipDir only on directories
If a filepath.WalkFunc returns filepath.SkipDir when invoked on a
non-directory file, it skips the remaining files in the containing
directory.¹

CL 276272 accidentally added a code path that triggers this behavior
whenever filepath.Walk reaches a non-directory file that begins with
a dot, such as .gitattributes or .DS_Store, causing findGorootModules
to return early without finding any modules in GOROOT. Tests that use
it ceased to provide test coverage that the tree is tidy.

Add an explicit check for info.IsDir in the 5 places that intend to
use filepath.SkipDir to skip traversing that directory. Even paths
like GOROOT/bin and GOROOT/pkg which are unlikely to be anything but
a directory are worth checking, since the goal of moddeps is to take
a possibly problematic GOROOT tree as input and detect problems.

While the goal of findGorootModules is to find all modules in GOROOT
programmatically (in case new modules are added or modified), there
are 4 modules now that are quite likely to exist, so check for their
presence to avoid similar regressions. (It's not hard to update this
test if a well-known GOROOT module is removed or otherwise modified;
but if it becomes hard we can simplify it to check for a reasonable
number of modules instead.)

Also fix the minor skew that has crept in since the test got disabled.

¹ This wasn't necessarily an intentional design decision, but it was
  found only when Go 1.4 was already out. See CL 11690 for details.

Fixes #46254.

Change-Id: Id55ed926f8c0094b1af923070de72bacca05996f
Reviewed-on: https://go-review.googlesource.com/c/go/+/320991
Trust: Dmitri Shuralyov <dmitshur@golang.org>
Run-TryBot: Dmitri Shuralyov <dmitshur@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Bryan C. Mills <bcmills@google.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
2021-05-19 15:20:08 +00:00