From a69e7d507c0a11aa4ac7b43b4d66dbbe91987fc2 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Oct 28 2020 08:11:43 +0000 Subject: import golang-1.15.2-1.module+el8.4.0+8491+2c56e43f --- diff --git a/.gitignore b/.gitignore index 21f722c..a04fffc 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/go-go-1.15.0-2-openssl-fips.tar.gz +SOURCES/go-go-1.15.2-1-openssl-fips.tar.gz diff --git a/.golang.metadata b/.golang.metadata index 3ed7b9c..d7a09d2 100644 --- a/.golang.metadata +++ b/.golang.metadata @@ -1 +1 @@ -419f3d1b92d91718c92a9fb2012f926d090657f2 SOURCES/go-go-1.15.0-2-openssl-fips.tar.gz +95a0e63d7483c2a4ae3d15e5ce9f5c6706c32a01 SOURCES/go-go-1.15.2-1-openssl-fips.tar.gz diff --git a/SOURCES/golang-1.15-warnCN.patch b/SOURCES/golang-1.15-warnCN.patch new file mode 100644 index 0000000..5d9cf82 --- /dev/null +++ b/SOURCES/golang-1.15-warnCN.patch @@ -0,0 +1,25 @@ +diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go +index 50f4d4a..121fd1b 100644 +--- a/src/crypto/x509/verify.go ++++ b/src/crypto/x509/verify.go +@@ -20,6 +20,9 @@ import ( + + // ignoreCN disables interpreting Common Name as a hostname. See issue 24151. + var ignoreCN = !strings.Contains(os.Getenv("GODEBUG"), "x509ignoreCN=0") ++// if using Common Name as a hostname is enabled via x509ignoreCN=0, ++// warnCN enables a warning whenever Common Name is interpreted as a hostname. ++var warnCN = strings.Contains(os.Getenv("GODEBUG"), "x509warnCN=1") + + type InvalidReason int + +@@ -1078,6 +1081,10 @@ func (c *Certificate) VerifyHostname(h string) error { + names := c.DNSNames + if c.commonNameAsHostname() { + names = []string{c.Subject.CommonName} ++ if warnCN { ++ fmt.Fprintf(os.Stderr, "x509: Warning - certificate relies on legacy Common Name field. " + ++ "Using CN without SAN is deprecated and will not work in future versions.\n") ++ } + } + + candidateName := toLowerCaseASCII(h) // Save allocations inside the loop. diff --git a/SOURCES/net-http-graceful-shutdown.patch b/SOURCES/net-http-graceful-shutdown.patch new file mode 100644 index 0000000..90dd711 --- /dev/null +++ b/SOURCES/net-http-graceful-shutdown.patch @@ -0,0 +1,157 @@ +diff --git a/src/net/http/export_test.go b/src/net/http/export_test.go +index 657ff9d..67a74ae 100644 +--- a/src/net/http/export_test.go ++++ b/src/net/http/export_test.go +@@ -274,6 +274,17 @@ func (s *Server) ExportAllConnsIdle() bool { + return true + } + ++func (s *Server) ExportAllConnsByState() map[ConnState]int { ++ states := map[ConnState]int{} ++ s.mu.Lock() ++ defer s.mu.Unlock() ++ for c := range s.activeConn { ++ st, _ := c.getState() ++ states[st] += 1 ++ } ++ return states ++} ++ + func (r *Request) WithT(t *testing.T) *Request { + return r.WithContext(context.WithValue(r.Context(), tLogKey{}, t.Logf)) + } +diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go +index 5f56932..806272b 100644 +--- a/src/net/http/serve_test.go ++++ b/src/net/http/serve_test.go +@@ -5519,16 +5519,23 @@ func TestServerSetKeepAlivesEnabledClosesConns(t *testing.T) { + } + } + +-func TestServerShutdown_h1(t *testing.T) { testServerShutdown(t, h1Mode) } +-func TestServerShutdown_h2(t *testing.T) { testServerShutdown(t, h2Mode) } ++func TestServerShutdown_h1(t *testing.T) { ++ testServerShutdown(t, h1Mode) ++} ++func TestServerShutdown_h2(t *testing.T) { ++ testServerShutdown(t, h2Mode) ++} + + func testServerShutdown(t *testing.T, h2 bool) { + setParallel(t) + defer afterTest(t) + var doShutdown func() // set later ++ var doStateCount func() + var shutdownRes = make(chan error, 1) ++ var statesRes = make(chan map[ConnState]int, 1) + var gotOnShutdown = make(chan struct{}, 1) + handler := HandlerFunc(func(w ResponseWriter, r *Request) { ++ doStateCount() + go doShutdown() + // Shutdown is graceful, so it should not interrupt + // this in-flight response. Add a tiny sleep here to +@@ -5545,6 +5552,9 @@ func testServerShutdown(t *testing.T, h2 bool) { + doShutdown = func() { + shutdownRes <- cst.ts.Config.Shutdown(context.Background()) + } ++ doStateCount = func() { ++ statesRes <- cst.ts.Config.ExportAllConnsByState() ++ } + get(t, cst.c, cst.ts.URL) // calls t.Fail on failure + + if err := <-shutdownRes; err != nil { +@@ -5556,6 +5566,10 @@ func testServerShutdown(t *testing.T, h2 bool) { + t.Errorf("onShutdown callback not called, RegisterOnShutdown broken?") + } + ++ if states := <-statesRes; states[StateActive] != 1 { ++ t.Errorf("connection in wrong state, %v", states) ++ } ++ + res, err := cst.c.Get(cst.ts.URL) + if err == nil { + res.Body.Close() +diff --git a/src/net/http/server.go b/src/net/http/server.go +index d41b5f6..14a6336 100644 +--- a/src/net/http/server.go ++++ b/src/net/http/server.go +@@ -324,7 +324,7 @@ func (c *conn) hijackLocked() (rwc net.Conn, buf *bufio.ReadWriter, err error) { + return nil, nil, fmt.Errorf("unexpected Peek failure reading buffered byte: %v", err) + } + } +- c.setState(rwc, StateHijacked) ++ c.setState(rwc, StateHijacked, runHooks) + return + } + +@@ -1737,7 +1737,12 @@ func validNextProto(proto string) bool { + return true + } + +-func (c *conn) setState(nc net.Conn, state ConnState) { ++const ( ++ runHooks = true ++ skipHooks = false ++) ++ ++func (c *conn) setState(nc net.Conn, state ConnState, runHook bool) { + srv := c.server + switch state { + case StateNew: +@@ -1750,6 +1755,9 @@ func (c *conn) setState(nc net.Conn, state ConnState) { + } + packedState := uint64(time.Now().Unix()<<8) | uint64(state) + atomic.StoreUint64(&c.curState.atomic, packedState) ++ if !runHook { ++ return ++ } + if hook := srv.ConnState; hook != nil { + hook(nc, state) + } +@@ -1803,7 +1811,7 @@ func (c *conn) serve(ctx context.Context) { + } + if !c.hijacked() { + c.close() +- c.setState(c.rwc, StateClosed) ++ c.setState(c.rwc, StateClosed, runHooks) + } + }() + +@@ -1831,6 +1839,10 @@ func (c *conn) serve(ctx context.Context) { + if proto := c.tlsState.NegotiatedProtocol; validNextProto(proto) { + if fn := c.server.TLSNextProto[proto]; fn != nil { + h := initALPNRequest{ctx, tlsConn, serverHandler{c.server}} ++ // Mark freshly created HTTP/2 as active and prevent any server state hooks ++ // from being run on these connections. This prevents closeIdleConns from ++ // closing such connections. See issue https://golang.org/issue/39776. ++ c.setState(c.rwc, StateActive, skipHooks) + fn(c.server, tlsConn, h) + } + return +@@ -1851,7 +1863,7 @@ func (c *conn) serve(ctx context.Context) { + w, err := c.readRequest(ctx) + if c.r.remain != c.server.initialReadLimitSize() { + // If we read any bytes off the wire, we're active. +- c.setState(c.rwc, StateActive) ++ c.setState(c.rwc, StateActive, runHooks) + } + if err != nil { + const errorHeaders = "\r\nContent-Type: text/plain; charset=utf-8\r\nConnection: close\r\n\r\n" +@@ -1934,7 +1946,7 @@ func (c *conn) serve(ctx context.Context) { + } + return + } +- c.setState(c.rwc, StateIdle) ++ c.setState(c.rwc, StateIdle, runHooks) + c.curReq.Store((*response)(nil)) + + if !w.conn.server.doKeepAlives() { +@@ -2965,7 +2977,7 @@ func (srv *Server) Serve(l net.Listener) error { + } + tempDelay = 0 + c := srv.newConn(rw) +- c.setState(c.rwc, StateNew) // before Serve can return ++ c.setState(c.rwc, StateNew, runHooks) // before Serve can return + go c.serve(connCtx) + } + } diff --git a/SPECS/golang.spec b/SPECS/golang.spec index 3f81784..95b1baa 100644 --- a/SPECS/golang.spec +++ b/SPECS/golang.spec @@ -96,8 +96,8 @@ %endif %global go_api 1.15 -%global go_version 1.15.0 -%global pkg_release 2 +%global go_version 1.15.2 +%global pkg_release 1 Name: golang Version: %{go_version} @@ -144,6 +144,16 @@ Patch221: fix_TestScript_list_std.patch # https://go-review.googlesource.com/c/go/+/240917 #Patch240917: ppc64le_fix_missing_deferreturn.patch +# Add an env var to optionally trigger a warning in x509 when +# Common Name is used as hostname +# rhbz#1889437 +Patch223: golang-1.15-warnCN.patch + +# Gracefully shut down http2 connections +# https://go-review.googlesource.com/c/go/+/240278 +# rhbz#1888673 +Patch224: net-http-graceful-shutdown.patch + # Having documentation separate was broken Obsoletes: %{name}-docs < 1.1-4 @@ -239,6 +249,10 @@ Requires: %{name} = %{version}-%{release} #%patch240917 -p1 +%patch223 -p1 + +%patch224 -p1 + cp %{SOURCE1} ./src/runtime/ %build @@ -505,6 +519,15 @@ cd .. %endif %changelog +* Mon Oct 19 2020 David Benoit - 1.15.2-1 +- Rebase to 1.15.2 +- fix rhbz#1872622 in commit af9a1b1f6567a1c5273a134d395bfe7bb840b7f8 +- Resolves: rhbz#1872622 +- add net/http graceful shutdown patch +- Resolves: rhbz#1888673 +- add x509warnCN patch +- Resolves: rhbz#1889437 + * Wed Sep 09 2020 Alejandro Sáez - 1.15.0-1 - Rebase to 1.15.0 - Related: rhbz#1870531