Stowage/go
2
0
Fork 0
mirror of https://github.com/golang/go.git synced 2026-06-27 19:30:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

crypto/tls: remove the x509keypairleaf GODEBUG setting

Browse source 
Fixes #75316

Change-Id: I241af97bf6a05e94f40a9f62393ed4fe6a6a6964
Reviewed-on: https://go-review.googlesource.com/c/go/+/777384
Reviewed-by: David Chase <drchase@google.com>
LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
This commit is contained in:
Filippo Valsorda 2026-05-12 16:13:26 -04:00 • committed by Gopher Robot
parent 1634ae8c7c
commit 2f57f7626e
5 changed files with 15 additions and 56 deletions
Download patch file Download diff file Expand all files Collapse all files

2
doc/godebug.md
View file

@ -166,6 +166,8 @@ Go 1.27 removed the `tls3des` setting, as noted in the [Go 1.23](#go-123) sectio
Go 1.27 removed the `tls10server` setting, as noted in the [Go 1.22](#go-122) section.
Go 1.27 removed the `x509keypairleaf` setting, as noted in the [Go 1.23](#go-123) section.
Go 1.27 added a new `htmlmetacontenturlescape` setting that controls whether
html/template will escape URLs in the `url=` portion of the content attribute of
HTML meta tags. The default `htmlmetacontentescape=1` will cause URLs to be

18
src/crypto/tls/tls.go
View file

@ -34,7 +34,6 @@ import (
"encoding/pem"
"errors"
"fmt"
"internal/godebug"
"net"
"os"
"strings"
@ -240,10 +239,6 @@ func (d *Dialer) DialContext(ctx context.Context, network, addr string) (net.Con
// files. The files must contain PEM encoded data. The certificate file may
// contain intermediate certificates following the leaf certificate to form a
// certificate chain. On successful return, Certificate.Leaf will be populated.
//
// Before Go 1.23 Certificate.Leaf was left nil, and the parsed certificate was
// discarded. This behavior can be re-enabled by setting "x509keypairleaf=0"
// in the GODEBUG environment variable.
func LoadX509KeyPair(certFile, keyFile string) (Certificate, error) {
certPEMBlock, err := os.ReadFile(certFile)
if err != nil {
@ -256,14 +251,8 @@ func LoadX509KeyPair(certFile, keyFile string) (Certificate, error) {
return X509KeyPair(certPEMBlock, keyPEMBlock)
}
var x509keypairleaf = godebug.New("x509keypairleaf")
// X509KeyPair parses a public/private key pair from a pair of
// PEM encoded data. On successful return, Certificate.Leaf will be populated.
//
// Before Go 1.23 Certificate.Leaf was left nil, and the parsed certificate was
// discarded. This behavior can be re-enabled by setting "x509keypairleaf=0"
// in the GODEBUG environment variable.
func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error) {
fail := func(err error) (Certificate, error) { return Certificate{}, err }
@ -317,12 +306,7 @@ func X509KeyPair(certPEMBlock, keyPEMBlock []byte) (Certificate, error) {
if err != nil {
return fail(err)
}
if x509keypairleaf.Value() != "0" {
cert.Leaf = x509Cert
} else {
x509keypairleaf.IncNonDefault()
}
cert.Leaf = x509Cert
cert.PrivateKey, err = parsePrivateKey(keyDERBlock.Bytes)
if err != nil {

36
src/crypto/tls/tls_test.go
View file

@ -2541,35 +2541,13 @@ func TestX509KeyPairPopulateCertificate(t *testing.T) {
}
certPEM := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certDER})
t.Run("x509keypairleaf=0", func(t *testing.T) {
testenv.SetGODEBUG(t, "x509keypairleaf=0")
cert, err := X509KeyPair(certPEM, keyPEM)
if err != nil {
t.Fatal(err)
}
if cert.Leaf != nil {
t.Fatal("Leaf should not be populated")
}
})
t.Run("x509keypairleaf=1", func(t *testing.T) {
testenv.SetGODEBUG(t, "x509keypairleaf=1")
cert, err := X509KeyPair(certPEM, keyPEM)
if err != nil {
t.Fatal(err)
}
if cert.Leaf == nil {
t.Fatal("Leaf should be populated")
}
})
t.Run("GODEBUG unset", func(t *testing.T) {
cert, err := X509KeyPair(certPEM, keyPEM)
if err != nil {
t.Fatal(err)
}
if cert.Leaf == nil {
t.Fatal("Leaf should be populated")
}
})
cert, err := X509KeyPair(certPEM, keyPEM)
if err != nil {
t.Fatal(err)
}
if cert.Leaf == nil {
t.Fatal("Leaf should be populated")
}
}
func TestEarlyLargeCertMsg(t *testing.T) {

10
src/internal/godebugs/table.go
View file

@ -73,7 +73,6 @@ var All = []Info{
{Name: "urlstrictcolons", Package: "net/url", Changed: 26, Old: "0"},
{Name: "winreadlinkvolume", Package: "os", Changed: 23, Old: "0"},
{Name: "winsymlink", Package: "os", Changed: 23, Old: "0"},
{Name: "x509keypairleaf", Package: "crypto/tls", Changed: 23, Old: "0"},
{Name: "x509negativeserial", Package: "crypto/x509", Changed: 23, Old: "1"},
{Name: "x509rsacrt", Package: "crypto/x509", Changed: 24, Old: "0"},
{Name: "x509sha256skid", Package: "crypto/x509", Changed: 25, Old: "0"},
@ -95,10 +94,11 @@ type RemovedInfo struct {
var Removed = []RemovedInfo{
{Name: "x509sha1", Removed: 24},
{Name: "gotypesalias", Removed: 27},
{Name: "tlsunsafeekm", Removed: 27}, // Old: "1"
{Name: "tlsrsakex", Removed: 27}, // Old: "1"
{Name: "tls3des", Removed: 27}, // Old: "1"
{Name: "tls10server", Removed: 27}, // Old: "1"
{Name: "tlsunsafeekm", Removed: 27}, // Old: "1"
{Name: "tlsrsakex", Removed: 27}, // Old: "1"
{Name: "tls3des", Removed: 27}, // Old: "1"
{Name: "tls10server", Removed: 27}, // Old: "1"
{Name: "x509keypairleaf", Removed: 27}, // Old: "0"
}
// Lookup returns the Info with the given name.

5
src/runtime/metrics/doc.go
View file

@ -407,11 +407,6 @@ Below is the full list of supported metrics, ordered lexicographically.
The number of non-default behaviors executed by the os package
due to a non-default GODEBUG=winsymlink=... setting.
/godebug/non-default-behavior/x509keypairleaf:events
The number of non-default behaviors executed by the crypto/tls
package due to a non-default GODEBUG=x509keypairleaf=...
setting.
/godebug/non-default-behavior/x509negativeserial:events
The number of non-default behaviors executed by the crypto/x509
package due to a non-default GODEBUG=x509negativeserial=...