Implement MaxHeaderValueCount support for both the HTTP/1 and HTTP/2
server. This allows servers who want to support large headers such as
SSO or OIDC cookies (and therefore has to set MaxHeaderBytes to a large
value), to still limit the number of headers that they are willing to
accept.
Also added the usual note for linknamed symbols for
net/textproto.readMIMEHeader, which seems to have been missed
originally.
Release note changes will be added directly in x/website.
For #79936
Change-Id: I600ac6c492f64f9cfa2730836be64dc76a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/795460
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
There are some exported package APIs that have started out as being
gated behind a GOEXPERIMENT, requiring users to explicitly opt in,
and have since become enabled for all users. This was done by having
their experiment enabled as a baseline, even when GOEXPERIMENT is left
as the empty string.
It's necessary to populate the go/build.Context.ToolTags field for
those APIs to be found by the API check. We can't directly use
build.Context.Default since that only has the ToolTags for the current
platform, so compute ToolTags from buildcfg, the same source that the
go/build package populates the default build context from.
A difference is that the API check always passes the empty GOEXPERIMENT
string to ParseGOEXPERIMENT, ignoring any potential GOEXPERIMENT set in
the environment.
For #79733.
Fixes#79737.
Change-Id: I2c4502c4f5416b4ce0466d6dd6dd030b6fdcf1ca
Cq-Include-Trybots: luci.golang.try:gotip-linux-amd64-longtest
Reviewed-on: https://go-review.googlesource.com/c/go/+/784980
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Michael Pratt <mpratt@google.com>
Add a new optional interface for driver.Rows which permits
the driver to scan directly into the user-provided []any.
Export the convertAssign function, to permit drivers
to fall back to the old assignment path.
Using the prior Rows interface, a driver provides values
with a function like:
func (rows *Rows) Next(dest []Value) error {
dest[0] = "some value"
return nil
}
Using the new RowsColumnScanner interface, the
equivalent is:
func (rows *Rows) ScanColumn(scanCtx driver.ScanContext, index int, dest any) error {
return sql.ConvertAssign(scanCtx, dest, "some value")
}
Fixes#67546
Change-Id: I421f5639a12c78c76d377534b5a82f846a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777961
Reviewed-by: Austin Clements <austin@google.com>
Reviewed-by: Alan Donovan <adonovan@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Tested against Google Chrome Canary 150.0.7834.0.
The Client-TLSv10, Client-TLSv11, and Client-TLSv12 recordings need to
change because they are configured with a version range that includes
TLS 1.3 (even if the OpenSSL server selects the lower one), so they
include ML-DSA signature algorithms in the Client Hello. The
Client-TLSv13 and Server-TLSv13-ClientAuthRequested* recordings need to
change because they now advertise ML-DSA support.
Because of #79481, we need to regenerate all recordings anyway, so defer
doing so to the next CL 779662, to avoid churning twice and bloating the
git history.
Fixes#78888
Change-Id: I14e6a89b459166155261aa8fc0edb83c6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/776709
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
TryBot-Bypass: Filippo Valsorda <filippo@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
It is made very clear at https://go.dev/wiki/Deprecated and
at https://go.dev/ref/mod#go-mod-file-module-deprecation that a
Deprecated: prefix must be at the start of a paragraph;
it cannot be in the middle of a paragraph, nor can it be in the middle
of a sentence (as demonstrated above). Update isDeprecated accordingly.
This involves updating a frozen api/go1.16.txt file to correct the fact
that go/importer.ForCompiler was accidentally listed as deprecated. The
API of Go 1.16 itself isn't changing, this is merely a consequence of
the cmd/api checker in Go 1.27 starting to report a more accurate actual
API after receiving this bug fix. Fortunately there was nothing else in
the standard library affected by this.
For #79139.
Fixes#79145.
Change-Id: I456b88e3253cacb230aa7c3c5ab4972c80c356e6
Reviewed-on: https://go-review.googlesource.com/c/go/+/774881
TryBot-Bypass: Dmitri Shuralyov <dmitshur@golang.org>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Alan Donovan <adonovan@google.com>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
This CL defines a hash function for Types using the
maphash.Hasher API proposed in #70471 (CL 657296)
that is consistent with the equivalence relation
of types.Identical.
It also defines a variant, HasherIgnoreTypes, that is
consistent with types.IdenticalIgnoreTags. (The actual
hash functions are identical: both ignore tags.)
The logic of the hash function was derived from
golang.org/x/tools/go/types/typeutil.Hash.
+ test, doc, relnote
Fixes#69420
Updates #70471
Change-Id: I1947cda6aec229d56eeda13decfb05eb266770f9
Reviewed-on: https://go-review.googlesource.com/c/go/+/657297
Reviewed-by: Robert Griesemer <gri@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Jonathan Amsterdam <jba@google.com>
Auto-Submit: Alan Donovan <adonovan@google.com>
Hasher is the standard interface for expressing custom hash
functions and equivalence relations for arbitrary data types.
This allows them to be used in hash-based collection types
such as a hash table (CL 612217) or a Bloom filter (CL 740440).
The ComparableHasher type is an implementation of the Hasher
interface for comparable values that is consistent with their
usual equivalence relation (==).
Fixes#70471
Change-Id: Iaa42eb7017d9c4dab487ad6c842c68a81fa7d28a
Reviewed-on: https://go-review.googlesource.com/c/go/+/657296
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Hongxiang Jiang <hxjiang@golang.org>
Reviewed-by: Junyang Shao <shaojunyang@google.com>
Auto-Submit: Alan Donovan <adonovan@google.com>
TryBot-Bypass: Alan Donovan <adonovan@google.com>
Process:
- Disable unicode TestProperties.
- Run UNICODE_VERSION=17.0.0 go -C ../src/golang.org/x/text generate
- Run go generate strconv
- Update unicode TestProperties by hand to add missing test cases.
This will break x/text using the main repo until the corresponding
x/text CL is submitted. It should not break anything else.
For #77266.
Change-Id: Ia3ffb5a81e212b991714eef70eebfca98a0c8aab
Reviewed-on: https://go-review.googlesource.com/c/go/+/737420
Reviewed-by: Rob Pike <r@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
TryBot-Bypass: Russ Cox <rsc@golang.org>
This reverts CL 588435.
This new API is difficult to use correctly, and in many cases cannot
be used efficiently. We're going to work on this problem a bit more.
The release notes are removed by CL 729340, since they were moved to
the x/website repository since the original CL was made.
Reopens#67546.
Change-Id: I2a2bd25f2fce5f02e4d28cd33a9cc651bf35ab50
Reviewed-on: https://go-review.googlesource.com/c/go/+/729360
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Sean Liao <sean@liao.dev>
First, we centralize all random bytes generation through drbg.Read. The
rest of the FIPS 140-3 module can't use external functions anyway, so
drbg.Read needs to have all the logic.
Then, make sure that the crypto/... tree uses drbg.Read (or the new
crypto/internal/rand.Reader wrapper) instead of crypto/rand, so it is
unaffected by applications setting crypto/rand.Reader.
Next, pass all unspecified random io.Reader parameters through the new
crypto/internal/rand.CustomReader, which just redirects to drbg.Read
unless GODEBUG=cryptocustomrand=1 is set. Move all the calls to
MaybeReadByte there, since it's only needed for these custom Readers.
Finally, add testing/cryptotest.SetGlobalRandom which sets
crypto/rand.Reader to a locked deterministic source and overrides
drbg.Read. This way SetGlobalRandom should affect all cryptographic
randomness in the standard library.
Fixes#70942
Co-authored-by: qiulaidongfeng <2645477756@qq.com>
Change-Id: I6a6a69641311d9fac318abcc6d79677f0e406100
Reviewed-on: https://go-review.googlesource.com/c/go/+/724480
Reviewed-by: Nicholas Husin <nsh@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Nicholas Husin <husin@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
This commit adds fields to the ClientHelloInfo and ConnectionState
structures to represent hello retry request state information.
ClientHelloInfo gains a new HelloRetryRequest bool field that indicates
if the client hello was sent in response to a TLS 1.3 hello retry
request message previously emitted by the server.
ConnectionState gains a new HelloRetryRequest bool field that indicates
(depending on the connection role) whether the client received a TLS 1.3
hello retry request message from the server, or whether the server sent
such a message to a client.
Fixes#74425
Change-Id: Ic1a5290b8a4ba1568da1d2c2cf9f148150955fa5
Reviewed-on: https://go-review.googlesource.com/c/go/+/717440
Reviewed-by: Roland Shoemaker <roland@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Cherry Mui <cherryyz@google.com>
Auto-Submit: Daniel McCarney <daniel@binaryparadox.net>
This CL causes the parser to record in a new field, BasicLit.EndPos,
the actual end position of each literal token, and to use it in
BasicLit.End. Previously, the End was computed heuristically as
Pos + len(Value). This heuristic is incorrect for a multiline
raw string literal on Windows, since the scanner normalizes
\r\n to \n.
Unfortunately the actual end position is not returned by the
Scanner.Scan method, so the scanner and parser conspire
using a global variable in the go/internal/scannerhook
package to communicate.
+ test, api change, relnote
Fixes#76031
Change-Id: I57c18a44e85f7403d470ba23d41dcdcc5a9432c2
Reviewed-on: https://go-review.googlesource.com/c/go/+/720060
Reviewed-by: Robert Griesemer <gri@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Nicholas S. Husin