The Solaris version of MakeRaw already sets VMIN and VTIME explicitly
such that a read returns when one character is available.
cfmakeraw (whose behavior MakeRaw replicate) in glibc and the BSD's libc
also set these values explicitly, so it should be done in the Linux/BSD
versions of MakeRaw as well to be consistent.
Change-Id: I531641ec87fd6a21b7a544b9a464bb90045b0bb1
Reviewed-on: https://go-review.googlesource.com/53570
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Avelino <t@avelino.xxx>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
This matches the implementation in NaCL, so a user can generate
a crypto_auth digest in another language and verify it with Go, or
vice versa.
Fixesgolang/go#20265.
Change-Id: Ice96abb9347a5318a16ced5152ebfa7d9ebdd285
Reviewed-on: https://go-review.googlesource.com/51932
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Use GetConsoleMode, SetConsoleMode and GetConsoleScreenBufferInfo and
the corresponding types and constants from golang.org/x/sys/windows
instead of locally defining them.
Change-Id: I69292a47114d071be261ffda6ca620a0b9820d00
Reviewed-on: https://go-review.googlesource.com/52990
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alex Brainman <alex.brainman@gmail.com>
The existing implementation checks to see if the session key size is a
multiple of the cipher blocksize. This fails for AES-192, which has a
keysize of 24 bytes and a 16 byte block size. Instead it should simply
check to ensure that the Session Key length is equal to the cipher
KeySize.
Fixesgolang/go#17060
Change-Id: I1dc78129f7fb2ca5ec71b650a2adcb3752dca885
Reviewed-on: https://go-review.googlesource.com/35848
Reviewed-by: Adam Langley <agl@golang.org>
Reviewed-by: Emmanuel Odeke <emm.odeke@gmail.com>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Use the TCGETS/TCSETS and TIOCGETA/TIOCSETA definitions from x/sys/unix
instead of manually declaring them or using the corresponding
definitions from syscall.
Change-Id: I37c2c8124d251eb47467b4184a7cc39781775f11
Reviewed-on: https://go-review.googlesource.com/51690
Reviewed-by: Matt Layher <mdlayher@gmail.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Matt Layher <mdlayher@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Move the README to README.md so Gerrit can render it; currently
Gerrit only renders files named exactly "README.md" (for example at
https://go.googlesource.com/go).
Add more links to the README explaining how to file issues,
how to submit code changes, where to download the code to and
how to get it. Hopefully this should help people who go to
https://go.googlesource.com/crypto or https://github.com/golang/crypto
figure out how to get started with development.
Change-Id: I5406d0e6a562ef4a4146b66edc53a6fba7a9c3ee
Reviewed-on: https://go-review.googlesource.com/49811
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
The writing side would generate a maximum of 19 bytes of padding, so
the reading side erroneously checked this. However, RFC 5647 specifies
255 as the maximum amount of padding for AES-GCM.
Fixesgolang/go#18953.
Change-Id: I416b0023c6e4cbd91a6a1b4214a03f1663b77248
Reviewed-on: https://go-review.googlesource.com/47590
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Many websites now support HTTPS that may not at the time the code was
committed; let's use the HTTPS links where we can.
Change-Id: I7099dfa0dbb213294e65b4387f343d6e8f955b97
Reviewed-on: https://go-review.googlesource.com/47131
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Enables HTTP/2 on any servers used with the autocert listener
by setting "h2" in NextProtos of the listener *tls.Config.
Also adds a warning to the listener documentation that it
enables HTTP/2.
Fixesgolang/go#20572
Change-Id: If7c0f5722f0b1781789219fc4e84da3f19a89ab7
Reviewed-on: https://go-review.googlesource.com/45630
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
These largely follow the pattern laid out in the secretbox example
file. Hopefully they should demonstrate the best ways to use the `box`
primitives.
Change-Id: I99be5f886e6ffe5f859268d6caa282e263eeacd0
Reviewed-on: https://go-review.googlesource.com/44736
Reviewed-by: Adam Langley <agl@golang.org>
Although a 128-bit digest provides little collision resistance it can be
used as a MAC, as found in the WireGuard protocol.
Change-Id: I06ee528e5711035da8f1b254c223a6fda8890abf
Reviewed-on: https://go-review.googlesource.com/39370
Reviewed-by: Adam Langley <agl@golang.org>
ParseResponseForCert would previously complain about an invalid hash OID
if the response contained no SingleResponse matching the certificate
provided by the caller.
Fixesgolang/go#19540
Change-Id: I0354c4048707a788ed3d184cc88b4f13f65544ba
Reviewed-on: https://go-review.googlesource.com/44005
Reviewed-by: Adam Langley <agl@golang.org>
This change does two things:
1. Fix a length checking bug in the Decrypt function.
2. Use binary.LittleEndian for byte conversions.
Fixesgolang/go#19881
Change-Id: I9d33b92f2bd7e6ca8f69308388f1e8a5c6df2be8
Reviewed-on: https://go-review.googlesource.com/39954
Reviewed-by: Adam Langley <agl@golang.org>
SSH host certificates are expected to contain hostnames only,
not "host:port" format.
This change allows Go clients to connect to OpenSSH servers that
use host certificates.
Note, this change will break any clients that use ssh.NewClientConn()
with an `addr` that is not in `host:port` format (they will see a
"missing port in address" error).
Fixes bug 20273.
Change-Id: I5a306c6b7b419a737e1f0f9c5ca8c585e21a45a4
Reviewed-on: https://go-review.googlesource.com/43475
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
The bcrypt implementation must append a zero byte to the user provided key
to be compatible to C implementations.
This will change the user provided key if the slice has enough capacity to
hold the extra zero byte.
This change always allocates a new slice for the C-compatible key.
Fixesgolang/go#20425
Change-Id: I8dc4e840c29711daabdabe58d83643cc0103cedd
Reviewed-on: https://go-review.googlesource.com/43715
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Dialing the 0.0.0.0 address (as returned by net.Addr().String() for a
net.Listen("tcp", ":1") address) is not yet guaranteed to work. It's
currently OS-dependent.
For some reason it works on Go 1.8+, but it hasn't yet been defined to
work reliably.
Fix the tests for now (since we need to support older Go releases),
even if this might work in the future.
Updates golang/go#18806
Change-Id: I2f0476b1d4f2673ab64ffedfa733f2d92fceb6ff
Reviewed-on: https://go-review.googlesource.com/42496
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
This change makes the Manager try creating a certificate
again, after a previously unsuccessful attempt.
The implementation is based on a timer, to prevent hitting
an ACME CA with too high QPS when under a heavy load.
The timer is hardcoded to 1 minute.
Fixesgolang/go#17740.
Change-Id: I46a49201cf423be3360633a89209d7b2bccc1d76
Reviewed-on: https://go-review.googlesource.com/41694
Run-TryBot: Alex Vaghin <ddos@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
This is a breaking change.
This adds a new hostkey callback which takes the hostname field
restrictions into account when validating host certificates.
Prior to this, a known_hosts file with the following entry
@cert-authority *.example.com ssh-rsa <example.com public key>
would, when passed to knownhosts.New() generate an ssh.HostKeyCallback
that would accept all host certificates signed by the example.com public
key, no matter what host the client was connecting to.
After this change, that known_hosts entry can only be used to validate
host certificates presented when connecting to hosts under *.example.com
This also renames IsAuthority to IsUserAuthority to make its intended
purpose more clear.
Change-Id: I7188a53fdd40a8c0bc21983105317b3498f567bb
Reviewed-on: https://go-review.googlesource.com/41751
Reviewed-by: Han-Wen Nienhuys <hanwen@google.com>
Run-TryBot: Han-Wen Nienhuys <hanwen@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Tobias Klauser
Gh0u1L5
Kevin Burke
Artyom Pervukhin
Adam Langley
mdp
Wei Congrui
Joe Kyo
Tobias Assarsson
Brad Fitzpatrick
sukrithanda
sbuss
Martin Kreichgauer
Spencer Tung
Andreas Auernhammer
Han-Wen Nienhuys
Yasuhiro Matsumoto
Dave Cheney
Jeff Hodges
Johan Brandhorst
Mathias Hall-Andersen
Adam Eijdenberg
Catalin Nicutar
Martin Möhrmann
Peter Moody
Alex Vaghin