Skip to content

Commit 0004724

Browse files
bradfitzbradfitz
committed
doc: more additions to go1.8.html
Adds crypto/tls, crypto/x509, math/big, mime. TBR=See https://golang.org/cl/33244 Updates #17929 Change-Id: I3fa3739e56f8c005e2a43c19f525cc5e2d981935 Reviewed-on: https://go-review.googlesource.com/33666 Reviewed-by: Brad Fitzpatrick <[email protected]>
1 parent 268bc39 commit 0004724

File tree

2 files changed

+190
-40
lines changed

2 files changed

+190
-40
lines changed

‎doc/go1.8.html

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -541,6 +541,122 @@ <h3 id="minor_library_changes">Minor changes to the library</h3>
541541
</dd>
542542
</dl>
543543

544+
<dl id="crypto_tls"><dt><a href="/pkg/crypto/tls/">crypto/tls</a></dt>
545+
<dd>
546+
<p> <!-- CL 25159, CL 31318 -->
547+
The new method
548+
<a href="/pkg/crypto/tls/#Conn.CloseWrite"><code>Conn.CloseWrite</code></a>
549+
allows TLS connections to be half closed.
550+
</p>
551+
552+
<p> <!-- CL 28075 -->
553+
The new method
554+
<a href="/pkg/crypto/tls/#Config.Clone"><code>Config.Clone</code></a>
555+
clones a TLS configuration.
556+
</p>
557+
558+
<p>
559+
<!-- CL 30790 -->
560+
The new <a href="/pkg/crypto/tls/#Config.GetConfigForClient"><code>Config.GetConfigForClient</code></a> (TODO: make link work)
561+
callback allows selecting a configuration for a client dynamically, based
562+
on the client's
563+
<a href="/pkg/crypto/tls/#ClientHelloInfo"><code>ClientHelloInfo</code></a>.
564+
565+
<!-- CL 31391, CL 32119 -->
566+
The <a href="/pkg/crypto/tls/#ClientHelloInfo"><code>ClientHelloInfo</code></a>
567+
struct now has new
568+
fields <code>Conn</code>, <code>SignatureSchemes</code> (using
569+
the new
570+
type <a href="/kg/crypto/tls/#SignatureScheme"><code>SignatureScheme</code></a>),
571+
<code>SupportedProtos</code>, and <code>SupportedVersions</code>.
572+
</p>
573+
574+
<p> <!-- CL 32115 -->
575+
The new <a href="/pkg/crypto/tls/#Config.GetClientCertificate"><code>Config.GetClientCertificate</code></a> (TODO: make link work)
576+
callback allows selecting a client certificate based on the server's
577+
TLS <code>CertificateRequest</code> message, represented by the new
578+
<a href="/pkg/crypto/tls/#CertificateRequestInfo"><code>CertificateRequestInfo</code></a>.
579+
</p>
580+
581+
<p> <!-- CL 27434 -->
582+
The new
583+
<a href="/pkg/crypto/tls/#Config.KeyLogWriter"><code>Config.KeyLogWriter</code></a>
584+
(TODO: make link work) allows debugging TLS connections
585+
in <a href="https://www.wireshark.org/">WireShark</a> and
586+
similar tools.
587+
</p>
588+
589+
<p> <!-- CL 32115 -->
590+
The new
591+
<a href="/pkg/crypto/tls/#Config.VerifyPeerCertificate"><code>Config.VerifyPeerCertificate</code></a>
592+
(TODO: make link work)
593+
callback allows additional validation of a peer's presented certificate.
594+
</p>
595+
596+
<p> <!-- CL 18130 -->
597+
The <code>crypto/tls</code> package now implements basic
598+
countermeasures against CBC padding oracles. There should be
599+
no explicit secret-dependent timings, but it does not attempt to
600+
normalize memory accesses to prevent cache timing leaks.
601+
</p>
602+
603+
<p>
604+
The <code>crypto/tls</code> package now supports
605+
X25519 and <!-- CL 30824, CL 30825 -->
606+
ChaCha20-Poly1305. <!-- CL 30957, CL 30958 -->
607+
ChaCha20-Poly1305 is now prioritized unless <!-- CL 32871 -->
608+
AES-GCM when hardware support is present.
609+
</p>
610+
611+
<p> <!-- CL 27315 -->
612+
AES-128-CBC cipher suites with SHA-256 are also
613+
now supported.
614+
</p>
615+
616+
</dd>
617+
</dl>
618+
619+
<dl id="crypto_x509"><dt><a href="/pkg/crypto/x509/">crypto/x509</a></dt>
620+
<dd>
621+
<p> <!-- CL 30578 -->
622+
<a href="/pkg/crypto/x509/#SystemCertPool"><code>SystemCertPool</code></a>
623+
is now implemented on Windows.
624+
</p>
625+
626+
<p> <!-- CL 24743 -->
627+
PSS signatures are now supported.
628+
</p>
629+
630+
<p> <!-- CL 32644 -->
631+
<a href="/pkg/crypto/x509/#UnknownAuthorityError"><code>UnknownAuthorityError</code></a>
632+
now has a <code>Cert</code> field, reporting the untrusted
633+
certificate.
634+
</p>
635+
636+
<p>
637+
Certificate validation is more permissive in a few cases and
638+
stricter in a few other cases.
639+
<!--
640+
crypto/x509: allow a leaf certificate to be specified directly as root (CL 27393)
641+
crypto/x509: check that the issuer name matches the issuer's subject name (CL 23571)
642+
crypto/x509: don't accept a root that already appears in a chain. (CL 32121)
643+
crypto/x509: fix name constraints handling (CL 30155)
644+
crypto/x509: parse all names in an RDN (CL 30810)
645+
crypto/x509: recognise ISO OID for RSA+SHA1 (CL 27394)
646+
crypto/x509: require a NULL parameters for RSA public keys (CL 16166, CL 27312)
647+
crypto/x509: return error for missing SerialNumber (CL 27238)
648+
-->
649+
</p>
650+
651+
<p><!-- CL 30375 -->
652+
Root certificates will now also be looked for
653+
at <code>/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem</code>
654+
on Linux, to support RHEL and CentOS.
655+
</p>
656+
657+
</dd>
658+
</dl>
659+
544660
<dl id="database_sql"><dt><a href="/pkg/database/sql/">database/sql</a></dt>
545661
<dd>
546662
<p>
@@ -725,6 +841,29 @@ <h3 id="minor_library_changes">Minor changes to the library</h3>
725841
</dd>
726842
</dl>
727843

844+
<dl id="math_big"><dt><a href="/pkg/math/big/">math/big</a></dt>
845+
<dd>
846+
<p><!-- CL 30706 -->
847+
The new method
848+
<a href="/pkg/math/big/#Int.Sqrt"><code>Int.Sqrt</code></a>
849+
calculates ⌊√x⌋.
850+
</p>
851+
852+
<p>
853+
The new method
854+
<a href="/pkg/math/big/#Float.Scan"><code>Float.Scan</code></a>
855+
is a support routine for
856+
<a href="/pkg/fmt/#Scanner"><code>fmt.Scanner</code></a>.
857+
</p>
858+
859+
<p>
860+
<a href="/pkg/math/big/#Int.ModInverse"><code>Int.ModInverse</code></a>
861+
now supports negative numbers.
862+
</p>
863+
864+
</dd>
865+
</dl>
866+
728867
<dl id="math_rand"><dt><a href="/pkg/math/rand/">math/rand</a></dt>
729868
<dd>
730869

@@ -742,6 +881,23 @@ <h3 id="minor_library_changes">Minor changes to the library</h3>
742881
</dd>
743882
</dl>
744883

884+
<dl id="mime"><dt><a href="/pkg/mime/">mime</a></dt>
885+
<dd>
886+
<p> <!-- CL 32175 -->
887+
<a href="/pkg/mime/#ParseMediaType"><code>ParseMediaType</code></a>
888+
now preserves unnecessary backslash escapes as literals,
889+
in order to support MSIE.
890+
When MSIE sends a full file path (in "intranet mode"), it does not
891+
escape backslashes: <code>"C:\dev\go\foo.txt"</code>, not
892+
<code>"C:\\dev\\go\\foo.txt"</code>.
893+
If we see an unnecessary backslash escape, we now assume it is from MSIE
894+
and intended as a literal backslash.
895+
No known MIME generators emit unnecessary backslash escapes
896+
for simple token characters like numbers and letters.
897+
</p>
898+
</dd>
899+
</dl>
900+
745901
<dl id="mime_quotedprintable"><dt><a href="/pkg/mime/quotedprintable/">mime/quotedprintable</a></dt>
746902
<dd>
747903

‎doc/go1.8.txt

Lines changed: 34 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -91,40 +91,6 @@ cmd/vet: skip printf check for non-constant format string during failed import (
9191

9292
crypto/cipher: enforce message size limits for GCM (CL 28410)
9393

94-
crypto/tls: add CloseWrite method to Conn (CL 25159, 31318)
95-
crypto/tls: add Config.Clone (CL 28075)
96-
crypto/tls: add Config.GetConfigForClient (CL 30790)
97-
crypto/tls: add GetClientCertificate callback (CL 32115)
98-
crypto/tls: add KeyLogWriter for debugging (CL 27434)
99-
crypto/tls: add VerifyPeerCertificate to tls.Config (CL 26654)
100-
crypto/tls: add a SignatureScheme type. (CL 32119)
101-
crypto/tls: don't generate random ticket keys if already set (CL 27317)
102-
crypto/tls: enable ChaCha20-Poly1305 cipher suites by default. (CL 30958)
103-
crypto/tls: expand ClientHelloInfo (CL 31391)
104-
crypto/tls: fix deadlock when racing to complete handshake (CL 29164)
105-
crypto/tls: flush the buffer on handshake errors (CL 28818)
106-
crypto/tls: implement countermeasures against CBC padding oracles (CL 18130)
107-
crypto/tls: set Conn.ConnectionState.ServerName unconditionally (CL 22862)
108-
crypto/tls: support AES-128-CBC cipher suites with SHA-256 (CL 27315)
109-
crypto/tls: support ChaCha20-Poly1305. (CL 30957)
110-
crypto/tls: support X25519 (CL 30824, CL 30825)
111-
crypto/{tls,cipher,internal/cryptohw}: prioritise AES-GCM when hardware support is present. (CL 32871)
112-
113-
crypto/x509: Fix bug in UnknownAuthorityError.Error (CL 27992)
114-
crypto/x509: allow a leaf certificate to be specified directly as root (CL 27393)
115-
crypto/x509: check that the issuer name matches the issuer's subject name (CL 23571)
116-
crypto/x509: don't accept a root that already appears in a chain. (CL 32121)
117-
crypto/x509: expose UnknownAuthorityError.Cert (CL 32644)
118-
crypto/x509: fix name constraints handling (CL 30155)
119-
crypto/x509: implement SystemCertPool on Windows (CL 30578)
120-
crypto/x509: parse all names in an RDN (CL 30810)
121-
crypto/x509: recognise ISO OID for RSA+SHA1 (CL 27394)
122-
crypto/x509: require a NULL parameters for RSA public keys (CL 16166)
123-
crypto/x509: require a NULL parameters for RSA public keys (CL 27312)
124-
crypto/x509: return error for missing SerialNumber (CL 27238)
125-
crypto/x509: support PSS signatures (CL 24743)
126-
crypto/x509: support RHEL 7 cert bundle (CL 30375)
127-
12894
encoding/asn1: return error for unexported fields in Marshal, Unmarshal (CL 31540)
12995

13096
encoding/xml: add wildcard support for collecting all attributes (CL 30946)
@@ -148,12 +114,6 @@ html/template: check "type" attribute in <script> (CL 14336)
148114

149115
internal/trace: fix analysis of EvGoWaiting/EvGoInSyscall events (CL 25572)
150116

151-
math/big: add (*Int).Sqrt (CL 30706)
152-
math/big: implement Float.Scan, type assert fmt interfaces to enforce docs (CL 30723)
153-
math/big: support negative numbers in ModInverse (CL 29299)
154-
155-
mime: preserve unnecessary backslash escapes as literals (CL 32175)
156-
157117
net/http/httptest: fill ContentLength in recorded Response (CL 28302)
158118
net/http/httptrace: add ClientTrace.TLSHandshakeStart & TLSHandshakeDone (CL 30359)
159119
net/http/httputil: add ModifyResponse to reverseProxy (CL 32356)
@@ -402,6 +362,36 @@ compress/flate: make compression level 0 consistent (CL 31174)
402362
compress/flate: tighten the BestSpeed max match offset bound. (CL 32149)
403363
compress/gzip: only encode MTIME if it is valid (CL 32325)
404364
context: make DeadlineExceeded implement net.Error (CL 30370)
365+
crypto/tls: add CloseWrite method to Conn (CL 25159, 31318)
366+
crypto/tls: add Config.Clone (CL 28075)
367+
crypto/tls: add Config.GetConfigForClient (CL 30790)
368+
crypto/tls: add GetClientCertificate callback (CL 32115)
369+
crypto/tls: add KeyLogWriter for debugging (CL 27434)
370+
crypto/tls: add VerifyPeerCertificate to tls.Config (CL 26654)
371+
crypto/tls: add a SignatureScheme type. (CL 32119)
372+
crypto/tls: don't generate random ticket keys if already set (CL 27317)
373+
crypto/tls: enable ChaCha20-Poly1305 cipher suites by default. (CL 30958)
374+
crypto/tls: expand ClientHelloInfo (CL 31391)
375+
crypto/tls: fix deadlock when racing to complete handshake (CL 29164)
376+
crypto/tls: flush the buffer on handshake errors (CL 28818)
377+
crypto/tls: implement countermeasures against CBC padding oracles (CL 18130)
378+
crypto/tls: set Conn.ConnectionState.ServerName unconditionally (CL 22862)
379+
crypto/tls: support AES-128-CBC cipher suites with SHA-256 (CL 27315)
380+
crypto/tls: support ChaCha20-Poly1305. (CL 30957)
381+
crypto/tls: support X25519 (CL 30824, CL 30825)
382+
crypto/{tls,cipher,internal/cryptohw}: prioritise AES-GCM when hardware support is present. (CL 32871)
383+
crypto/x509: support PSS signatures (CL 24743)
384+
crypto/x509: implement SystemCertPool on Windows (CL 30578)
385+
crypto/x509: expose UnknownAuthorityError.Cert (CL 32644)
386+
crypto/x509: allow a leaf certificate to be specified directly as root (CL 27393)
387+
crypto/x509: check that the issuer name matches the issuer's subject name (CL 23571)
388+
crypto/x509: don't accept a root that already appears in a chain. (CL 32121)
389+
crypto/x509: fix name constraints handling (CL 30155)
390+
crypto/x509: parse all names in an RDN (CL 30810)
391+
crypto/x509: recognise ISO OID for RSA+SHA1 (CL 27394)
392+
crypto/x509: require a NULL parameters for RSA public keys (CL 16166, CL 27312)
393+
crypto/x509: return error for missing SerialNumber (CL 27238)
394+
crypto/x509: support RHEL 7 cert bundle (CL 30375)
405395
database/sql: accept nil pointers to Valuers implemented on value receivers (CL 31259)
406396
database/sql: add Pinger interface to driver Conn (CL 32136)
407397
database/sql: add context helper methods and transaction types (CL 31258)
@@ -425,7 +415,11 @@ image/png: implement grayscale transparency. (CL 32143)
425415
image/png: implement truecolor transparency. (CL 32140)
426416
image/png: improve compression by skipping filter for paletted images (CL 29872)
427417
lib/time: update tzdata to 2016i (CL 33029)
418+
math/big: add (*Int).Sqrt (CL 30706)
419+
math/big: implement Float.Scan, type assert fmt interfaces to enforce docs (CL 30723)
420+
math/big: support negative numbers in ModInverse (CL 29299)
428421
math/rand: add Rand.Uint64 (CL 27253)
422+
mime: preserve unnecessary backslash escapes as literals (CL 32175)
429423
mime/quotedprintable: accept = not followed by 2 hex digits as literal equals (CL 32174)
430424
mime/quotedprintable: accept trailing soft line-break at the end of message (CL 27530)
431425
net/http, net/http/httptest: make http2's TrailerPrefix work for http1 (CL 32479)

0 commit comments

Comments
 (0)