languages/go
languages/go
1
0
Fork 0
mirror of https://github.com/golang/go synced 2024-09-15 22:20:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

net/http: remove test-only private key from production binaries

Browse source 
The net/http/internal package contains a PEM-encoded private key used in
tests. This key is initialized at init time, which prevents it from
being stripped by the linker in non-test binaries.

Move the certificate and key to a new net/http/internal/testcert
package to ensure it is only included in binaries that reference it.

Fixes #46677.

Change-Id: Ie98bda529169314cc791063e7ce4d99ef99113c8
Reviewed-on: https://go-review.googlesource.com/c/go/+/326771
Trust: Damien Neil <dneil@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Bryan C. Mills <bcmills@google.com>
This commit is contained in:
Damien Neil 2021-06-10 10:50:37 -07:00
parent 8d11b1d117
commit 770f1de8c5
6 changed files with 16 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/go/build/deps_test.go
View file

@ -440,7 +440,8 @@ var depsRules = `
# HTTP, King of Dependencies.
FMT
< golang.org/x/net/http2/hpack, net/http/internal, net/http/internal/ascii;
< golang.org/x/net/http2/hpack
< net/http/internal, net/http/internal/ascii, net/http/internal/testcert;
FMT, NET, container/list, encoding/binary, log
< golang.org/x/text/transform
@ -459,6 +460,7 @@ var depsRules = `
golang.org/x/net/http2/hpack,
net/http/internal,
net/http/internal/ascii,
net/http/internal/testcert,
net/http/httptrace,
mime/multipart,
log

4
src/net/http/httptest/server.go
View file

@ -14,7 +14,7 @@ import (
"log"
"net"
"net/http"
"net/http/internal"
"net/http/internal/testcert"
"os"
"strings"
"sync"
@ -144,7 +144,7 @@ func (s *Server) StartTLS() {
if s.client == nil {
s.client = &http.Client{Transport: &http.Transport{}}
}
cert, err := tls.X509KeyPair(internal.LocalhostCert, internal.LocalhostKey)
cert, err := tls.X509KeyPair(testcert.LocalhostCert, testcert.LocalhostKey)
if err != nil {
panic(fmt.Sprintf("httptest: NewTLSServer: %v", err))
}

5
src/net/http/internal/testcert.go → src/net/http/internal/testcert/testcert.go
View file

@ -2,7 +2,8 @@
// Use of this source code is governed by a BSD-style
// license that can be found in the LICENSE file.
package internal
// Package testcert contains a test-only localhost certificate.
package testcert
import "strings"
@ -25,7 +26,7 @@ h1fIw3cSS2OolhloGw/XM6RWPWtPAlGykKLciQrBru5NAPvCMsb/I1DAceTiotQM
fblo6RBxUQ==
-----END CERTIFICATE-----`)
// LocalhostKey is the private key for localhostCert.
// LocalhostKey is the private key for LocalhostCert.
var LocalhostKey = []byte(testingKey(`-----BEGIN RSA TESTING KEY-----
MIICXgIBAAKBgQDuLnQAI3mDgey3VBzWnB2L39JUU4txjeVE6myuDqkM/uGlfjb9
SjY1bIw4iA5sBBZzHi3z0h1YV8QPuxEbi4nW91IJm2gsvvZhIrCHS3l6afab4pZB

7
src/net/http/serve_test.go
View file

@ -25,6 +25,7 @@ import (
"net/http/httptest"
"net/http/httputil"
"net/http/internal"
"net/http/internal/testcert"
"net/url"
"os"
"os/exec"
@ -1475,7 +1476,7 @@ func TestServeTLS(t *testing.T) {
defer afterTest(t)
defer SetTestHookServerServe(nil)
cert, err := tls.X509KeyPair(internal.LocalhostCert, internal.LocalhostKey)
cert, err := tls.X509KeyPair(testcert.LocalhostCert, testcert.LocalhostKey)
if err != nil {
t.Fatal(err)
}
@ -1599,7 +1600,7 @@ func TestAutomaticHTTP2_Serve_WithTLSConfig(t *testing.T) {
}
func TestAutomaticHTTP2_ListenAndServe(t *testing.T) {
cert, err := tls.X509KeyPair(internal.LocalhostCert, internal.LocalhostKey)
cert, err := tls.X509KeyPair(testcert.LocalhostCert, testcert.LocalhostKey)
if err != nil {
t.Fatal(err)
}
@ -1609,7 +1610,7 @@ func TestAutomaticHTTP2_ListenAndServe(t *testing.T) {
}
func TestAutomaticHTTP2_ListenAndServe_GetCertificate(t *testing.T) {
cert, err := tls.X509KeyPair(internal.LocalhostCert, internal.LocalhostKey)
cert, err := tls.X509KeyPair(testcert.LocalhostCert, testcert.LocalhostKey)
if err != nil {
t.Fatal(err)
}

4
src/net/http/transport_internal_test.go
View file

@ -12,7 +12,7 @@ import (
"errors"
"io"
"net"
"net/http/internal"
"net/http/internal/testcert"
"strings"
"testing"
)
@ -191,7 +191,7 @@ func (f roundTripFunc) RoundTrip(r *Request) (*Response, error) {
// Issue 25009
func TestTransportBodyAltRewind(t *testing.T) {
cert, err := tls.X509KeyPair(internal.LocalhostCert, internal.LocalhostKey)
cert, err := tls.X509KeyPair(testcert.LocalhostCert, testcert.LocalhostKey)
if err != nil {
t.Fatal(err)
}

4
src/net/http/transport_test.go
View file

@ -30,7 +30,7 @@ import (
"net/http/httptest"
"net/http/httptrace"
"net/http/httputil"
"net/http/internal"
"net/http/internal/testcert"
"net/textproto"
"net/url"
"os"
@ -4299,7 +4299,7 @@ func TestTransportReuseConnEmptyResponseBody(t *testing.T) {
// Issue 13839
func TestNoCrashReturningTransportAltConn(t *testing.T) {
cert, err := tls.X509KeyPair(internal.LocalhostCert, internal.LocalhostKey)
cert, err := tls.X509KeyPair(testcert.LocalhostCert, testcert.LocalhostKey)
if err != nil {
t.Fatal(err)
}