1. 28 Oct, 2018 7 commits
  2. 27 Oct, 2018 7 commits
  3. 26 Oct, 2018 11 commits
  4. 25 Oct, 2018 14 commits
  5. 24 Oct, 2018 1 commit
    • Brad Fitzpatrick's avatar
      crypto/tls, net/http: reject HTTP requests to HTTPS server · c942191c
      Brad Fitzpatrick authored
      This adds a crypto/tls.RecordHeaderError.Conn field containing the TLS
      underlying net.Conn for non-TLS handshake errors, and then uses it in
      the net/http Server to return plaintext HTTP 400 errors when a client
      mistakenly sends a plaintext HTTP request to an HTTPS server. This is the
      same behavior as Apache.
      
      Also in crypto/tls: swap two error paths to not use a value before
      it's valid, and don't send a alert record when a handshake contains a
      bogus TLS record (a TLS record in response won't help a non-TLS
      client).
      
      Fixes #23689
      
      Change-Id: Ife774b1e3886beb66f25ae4587c62123ccefe847
      Reviewed-on: https://go-review.googlesource.com/c/143177Reviewed-by: default avatarFilippo Valsorda <filippo@golang.org>
      c942191c