diff --git a/0001-Modify-go.env.patch b/0001-Modify-go.env.patch new file mode 100644 index 0000000000000000000000000000000000000000..d0b18c78d8f99a0a58d5e2caf09dcaf2e280f5f8 --- /dev/null +++ b/0001-Modify-go.env.patch @@ -0,0 +1,30 @@ +From 52d9cfec8124a9c7382bed5284246d9b18a21eb4 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= +Date: Wed, 16 Aug 2023 07:06:38 +0200 +Subject: [PATCH] Modify go.env + +Change GOPROXY, GOSUMDB, and GOTOOLCHAIN +--- + go.env | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/go.env b/go.env +index 6ff2b921d4..087208cd7c 100644 +--- a/go.env ++++ b/go.env +@@ -4,9 +4,9 @@ + + # Use the Go module mirror and checksum database by default. + # See https://proxy.golang.org for details. +-GOPROXY=https://proxy.golang.org,direct +-GOSUMDB=sum.golang.org ++GOPROXY=direct ++GOSUMDB=off + + # Automatically download newer toolchains as directed by go.mod files. + # See https://go.dev/doc/toolchain for details. +-GOTOOLCHAIN=auto ++GOTOOLCHAIN=local +-- +2.41.0 + diff --git a/0001-crypto-tls-restrict-RSA-keys-in-certificates-to-8192.patch b/0001-crypto-tls-restrict-RSA-keys-in-certificates-to-8192.patch deleted file mode 100644 index 24dfde604c89646cd52e171e23def74a764e50b8..0000000000000000000000000000000000000000 --- a/0001-crypto-tls-restrict-RSA-keys-in-certificates-to-8192.patch +++ /dev/null @@ -1,125 +0,0 @@ -diff -uprN go.orig/src/crypto/tls/handshake_client.go go/src/crypto/tls/handshake_client.go ---- go.orig/src/crypto/tls/handshake_client.go 2023-09-01 09:49:36.497825128 +0000 -+++ go/src/crypto/tls/handshake_client.go 2023-09-01 10:14:49.605105116 +0000 -@@ -857,6 +857,10 @@ func (hs *clientHandshakeState) sendFini - return nil - } - -+// maxRSAKeySize is the maximum RSA key size in bits that we are willing -+// to verify the signatures of during a TLS handshake. -+const maxRSAKeySize = 8192 -+ - // verifyServerCertificate parses and verifies the provided chain, setting - // c.verifiedChains and c.peerCertificates or sending the appropriate alert. - func (c *Conn) verifyServerCertificate(certificates [][]byte) error { -@@ -868,6 +872,10 @@ func (c *Conn) verifyServerCertificate(c - c.sendAlert(alertBadCertificate) - return errors.New("tls: failed to parse certificate from server: " + err.Error()) - } -+ if cert.cert.PublicKeyAlgorithm == x509.RSA && cert.cert.PublicKey.(*rsa.PublicKey).N.BitLen() > maxRSAKeySize { -+ c.sendAlert(alertBadCertificate) -+ return fmt.Errorf("tls: server sent certificate containing RSA key larger than %d bits", maxRSAKeySize) -+ } - activeHandles[i] = cert - certs[i] = cert.cert - } -diff -uprN go.orig/src/crypto/tls/handshake_client_test.go go/src/crypto/tls/handshake_client_test.go ---- go.orig/src/crypto/tls/handshake_client_test.go 2023-09-01 09:49:36.498825137 +0000 -+++ go/src/crypto/tls/handshake_client_test.go 2023-09-01 10:17:01.077258997 +0000 -@@ -2616,3 +2616,82 @@ func TestClientHandshakeContextCancellat - t.Error("Client connection was not closed when the context was canceled") - } - } -+ -+ -+// discardConn wraps a net.Conn but discards all writes, but reports that they happened. -+type discardConn struct { -+ net.Conn -+} -+ -+func (dc *discardConn) Write(data []byte) (int, error) { -+ return len(data), nil -+} -+ -+// largeRSAKeyCertPEM contains a 8193 bit RSA key -+const largeRSAKeyCertPEM = `-----BEGIN CERTIFICATE----- -+MIIInjCCBIWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADASMRAwDgYDVQQDEwd0ZXN0 -+aW5nMB4XDTIzMDYwNzIxMjMzNloXDTIzMDYwNzIzMjMzNlowEjEQMA4GA1UEAxMH -+dGVzdGluZzCCBCIwDQYJKoZIhvcNAQEBBQADggQPADCCBAoCggQBAWdHsf6Rh2Ca -+n2SQwn4t4OQrOjbLLdGE1pM6TBKKrHUFy62uEL8atNjlcfXIsa4aEu3xNGiqxqur -+ZectlkZbm0FkaaQ1Wr9oikDY3KfjuaXdPdO/XC/h8AKNxlDOylyXwUSK/CuYb+1j -+gy8yF5QFvVfwW/xwTlHmhUeSkVSQPosfQ6yXNNsmMzkd+ZPWLrfq4R+wiNtwYGu0 -+WSBcI/M9o8/vrNLnIppoiBJJ13j9CR1ToEAzOFh9wwRWLY10oZhoh1ONN1KQURx4 -+qedzvvP2DSjZbUccdvl2rBGvZpzfOiFdm1FCnxB0c72Cqx+GTHXBFf8bsa7KHky9 -+sNO1GUanbq17WoDNgwbY6H51bfShqv0CErxatwWox3we4EcAmFHPVTCYL1oWVMGo -+a3Eth91NZj+b/nGhF9lhHKGzXSv9brmLLkfvM1jA6XhNhA7BQ5Vz67lj2j3XfXdh -+t/BU5pBXbL4Ut4mIhT1YnKXAjX2/LF5RHQTE8Vwkx5JAEKZyUEGOReD/B+7GOrLp -+HduMT9vZAc5aR2k9I8qq1zBAzsL69lyQNAPaDYd1BIAjUety9gAYaSQffCgAgpRO -+Gt+DYvxS+7AT/yEd5h74MU2AH7KrAkbXOtlwupiGwhMVTstncDJWXMJqbBhyHPF8 -+3UmZH0hbL4PYmzSj9LDWQQXI2tv6vrCpfts3Cqhqxz9vRpgY7t1Wu6l/r+KxYYz3 -+1pcGpPvRmPh0DJm7cPTiXqPnZcPt+ulSaSdlxmd19OnvG5awp0fXhxryZVwuiT8G -+VDkhyARrxYrdjlINsZJZbQjO0t8ketXAELJOnbFXXzeCOosyOHkLwsqOO96AVJA8 -+45ZVL5m95ClGy0RSrjVIkXsxTAMVG6SPAqKwk6vmTdRGuSPS4rhgckPVDHmccmuq -+dfnT2YkX+wB2/M3oCgU+s30fAHGkbGZ0pCdNbFYFZLiH0iiMbTDl/0L/z7IdK0nH -+GLHVE7apPraKC6xl6rPWsD2iSfrmtIPQa0+rqbIVvKP5JdfJ8J4alI+OxFw/znQe -+V0/Rez0j22Fe119LZFFSXhRv+ZSvcq20xDwh00mzcumPWpYuCVPozA18yIhC9tNn -+ALHndz0tDseIdy9vC71jQWy9iwri3ueN0DekMMF8JGzI1Z6BAFzgyAx3DkHtwHg7 -+B7qD0jPG5hJ5+yt323fYgJsuEAYoZ8/jzZ01pkX8bt+UsVN0DGnSGsI2ktnIIk3J -+l+8krjmUy6EaW79nITwoOqaeHOIp8m3UkjEcoKOYrzHRKqRy+A09rY+m/cAQaafW -+4xp0Zv7qZPLwnu0jsqB4jD8Ll9yPB02ndsoV6U5PeHzTkVhPml19jKUAwFfs7TJg -+kXy+/xFhYVUCAwEAATANBgkqhkiG9w0BAQsFAAOCBAIAAQnZY77pMNeypfpba2WK -+aDasT7dk2JqP0eukJCVPTN24Zca+xJNPdzuBATm/8SdZK9lddIbjSnWRsKvTnO2r -+/rYdlPf3jM5uuJtb8+Uwwe1s+gszelGS9G/lzzq+ehWicRIq2PFcs8o3iQMfENiv -+qILJ+xjcrvms5ZPDNahWkfRx3KCg8Q+/at2n5p7XYjMPYiLKHnDC+RE2b1qT20IZ -+FhuK/fTWLmKbfYFNNga6GC4qcaZJ7x0pbm4SDTYp0tkhzcHzwKhidfNB5J2vNz6l -+Ur6wiYwamFTLqcOwWo7rdvI+sSn05WQBv0QZlzFX+OAu0l7WQ7yU+noOxBhjvHds -+14+r9qcQZg2q9kG+evopYZqYXRUNNlZKo9MRBXhfrISulFAc5lRFQIXMXnglvAu+ -+Ipz2gomEAOcOPNNVldhKAU94GAMJd/KfN0ZP7gX3YvPzuYU6XDhag5RTohXLm18w -+5AF+ES3DOQ6ixu3DTf0D+6qrDuK+prdX8ivcdTQVNOQ+MIZeGSc6NWWOTaMGJ3lg -+aZIxJUGdo6E7GBGiC1YTjgFKFbHzek1LRTh/LX3vbSudxwaG0HQxwsU9T4DWiMqa -+Fkf2KteLEUA6HrR+0XlAZrhwoqAmrJ+8lCFX3V0gE9lpENfVHlFXDGyx10DpTB28 -+DdjnY3F7EPWNzwf9P3oNT69CKW3Bk6VVr3ROOJtDxVu1ioWo3TaXltQ0VOnap2Pu -+sa5wfrpfwBDuAS9JCDg4ttNp2nW3F7tgXC6xPqw5pvGwUppEw9XNrqV8TZrxduuv -+rQ3NyZ7KSzIpmFlD3UwV/fGfz3UQmHS6Ng1evrUID9DjfYNfRqSGIGjDfxGtYD+j -+Z1gLJZuhjJpNtwBkKRtlNtrCWCJK2hidK/foxwD7kwAPo2I9FjpltxCRywZUs07X -+KwXTfBR9v6ij1LV6K58hFS+8ezZyZ05CeVBFkMQdclTOSfuPxlMkQOtjp8QWDj+F -+j/MYziT5KBkHvcbrjdRtUJIAi4N7zCsPZtjik918AK1WBNRVqPbrgq/XSEXMfuvs -+6JbfK0B76vdBDRtJFC1JsvnIrGbUztxXzyQwFLaR/AjVJqpVlysLWzPKWVX6/+SJ -+u1NQOl2E8P6ycyBsuGnO89p0S4F8cMRcI2X1XQsZ7/q0NBrOMaEp5T3SrWo9GiQ3 -+o2SBdbs3Y6MBPBtTu977Z/0RO63J3M5i2tjUiDfrFy7+VRLKr7qQ7JibohyB8QaR -+9tedgjn2f+of7PnP/PEl1cCphUZeHM7QKUMPT8dbqwmKtlYY43EHXcvNOT5IBk3X -+9lwJoZk/B2i+ZMRNSP34ztAwtxmasPt6RAWGQpWCn9qmttAHAnMfDqe7F7jVR6rS -+u58= -+-----END CERTIFICATE-----` -+ -+func TestHandshakeRSATooBig(t *testing.T) { -+ testCert, _ := pem.Decode([]byte(largeRSAKeyCertPEM)) -+ -+ c := &Conn{conn: &discardConn{}, config: testConfig.Clone()} -+ -+ expectedErr := "tls: server sent certificate containing RSA key larger than 8192 bits" -+ err := c.verifyServerCertificate([][]byte{testCert.Bytes}) -+ if err == nil || err.Error() != expectedErr { -+ t.Errorf("Conn.verifyServerCertificate unexpected error: want %q, got %q", expectedErr, err) -+ } -+ -+ expectedErr = "tls: client sent certificate containing RSA key larger than 8192 bits" -+ err = c.processCertsFromClient(Certificate{Certificate: [][]byte{testCert.Bytes}}) -+ if err == nil || err.Error() != expectedErr { -+ t.Errorf("Conn.processCertsFromClient unexpected error: want %q, got %q", expectedErr, err) -+ } -+} -diff -uprN go.orig/src/crypto/tls/handshake_server.go go/src/crypto/tls/handshake_server.go ---- go.orig/src/crypto/tls/handshake_server.go 2023-09-01 09:49:36.498825137 +0000 -+++ go/src/crypto/tls/handshake_server.go 2023-09-01 10:18:29.072031301 +0000 -@@ -818,6 +818,10 @@ func (c *Conn) processCertsFromClient(ce - c.sendAlert(alertBadCertificate) - return errors.New("tls: failed to parse client certificate: " + err.Error()) - } -+ if certs[i].PublicKeyAlgorithm == x509.RSA && certs[i].PublicKey.(*rsa.PublicKey).N.BitLen() > maxRSAKeySize { -+ c.sendAlert(alertBadCertificate) -+ return fmt.Errorf("tls: client sent certificate containing RSA key larger than %d bits", maxRSAKeySize) -+ } - } - - if len(certs) == 0 && requiresClientCert(c.config.ClientAuth) { diff --git a/0004-cmd-link-use-gold-on-ARM-ARM64-only-if-gold-is-avail.patch b/0002-cmd-link-use-gold-on-ARM-ARM64-only-if-gold-is-avail.patch similarity index 36% rename from 0004-cmd-link-use-gold-on-ARM-ARM64-only-if-gold-is-avail.patch rename to 0002-cmd-link-use-gold-on-ARM-ARM64-only-if-gold-is-avail.patch index d0a714976dc42f63c3f301321883dfc6444213f4..5341d6d6a87bfcee82bb3bf80fc0512bbfdb3577 100644 --- a/0004-cmd-link-use-gold-on-ARM-ARM64-only-if-gold-is-avail.patch +++ b/0002-cmd-link-use-gold-on-ARM-ARM64-only-if-gold-is-avail.patch @@ -1,38 +1,20 @@ -From 5ccf9f47bf4f5ba53e0ab7338a7fd4626714cfb2 Mon Sep 17 00:00:00 2001 -From: Jeffery To -Date: Tue, 23 Nov 2021 15:05:37 +0800 -Subject: [PATCH] cmd/link: use gold on ARM/ARM64 only if gold is available +From 7506da0af38aa307f45664f0c787b5767cc7a87f Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Alejandro=20S=C3=A1ez?= +Date: Thu, 22 Jun 2023 17:19:00 +0200 +Subject: [PATCH] Force gold in aarch64 until binutils 2.41 is on Fedora -COPY relocation handling on ARM/ARM64 has been fixed in recent versions -of the GNU linker. This switches to gold only if gold is available. - -Fixes #22040. --- - src/cmd/link/internal/ld/lib.go | 19 +++++++------------ - 1 file changed, 7 insertions(+), 12 deletions(-) + src/cmd/link/internal/ld/lib.go | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/src/cmd/link/internal/ld/lib.go b/src/cmd/link/internal/ld/lib.go -index 9e13db7b71..2b379259a2 100644 +index 91e2d5149c..99c305530b 100644 --- a/src/cmd/link/internal/ld/lib.go +++ b/src/cmd/link/internal/ld/lib.go -@@ -1390,25 +1390,20 @@ func (ctxt *Link) hostlink() { - } +@@ -1605,15 +1605,13 @@ func (ctxt *Link) hostlink() { + // https://go.dev/issue/22040 + altLinker = "gold" - if ctxt.Arch.InFamily(sys.ARM, sys.ARM64) && buildcfg.GOOS == "linux" { -- // On ARM, the GNU linker will generate COPY relocations -- // even with -znocopyreloc set. -+ // On ARM, older versions of the GNU linker will generate -+ // COPY relocations even with -znocopyreloc set. - // https://sourceware.org/bugzilla/show_bug.cgi?id=19962 - // -- // On ARM64, the GNU linker will fail instead of -- // generating COPY relocations. -+ // On ARM64, older versions of the GNU linker will fail -+ // instead of generating COPY relocations. - // -- // In both cases, switch to gold. -- altLinker = "gold" -- - // If gold is not installed, gcc will silently switch - // back to ld.bfd. So we parse the version information - // and provide a useful error if gold is missing. @@ -42,12 +24,12 @@ index 9e13db7b71..2b379259a2 100644 cmd := exec.Command(name, args...) if out, err := cmd.CombinedOutput(); err == nil { - if !bytes.Contains(out, []byte("GNU gold")) { -- log.Fatalf("ARM external linker must be gold (issue #15696), but is not: %s", out) +- log.Fatalf("ARM64 external linker must be gold (issue #15696, 22040), but is not: %s", out) + if bytes.Contains(out, []byte("GNU gold")) { + altLinker = "gold" } } } -- -2.32.0 +2.40.1 diff --git a/0002-fix-CVE-2023-39323.patch b/0002-fix-CVE-2023-39323.patch deleted file mode 100644 index 04030925a28df6414993a85610108514b85e5d64..0000000000000000000000000000000000000000 --- a/0002-fix-CVE-2023-39323.patch +++ /dev/null @@ -1,113 +0,0 @@ -From 31d5b604ac0adb58aec4870ac1b974c08312fd49 Mon Sep 17 00:00:00 2001 -From: Ian Lance Taylor -Date: Wed, 20 Sep 2023 16:16:29 -0700 -Subject: [PATCH] [release-branch.go1.20] cmd/compile: use absolute file name - in isCgo check - -For #23672 -Updates #63211 -Fixes #63213 -Fixes CVE-2023-39323 - -Change-Id: I4586a69e1b2560036afec29d53e53cf25e6c7352 -Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2032884 -Reviewed-by: Matthew Dempsky -Reviewed-by: Roland Shoemaker -(cherry picked from commit 9b19e751918dd218035811b1ef83a8c2693b864a) -Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2037629 -Reviewed-by: Tatiana Bradley -Run-TryBot: Roland Shoemaker -Reviewed-by: Damien Neil -Reviewed-on: https://go-review.googlesource.com/c/go/+/533195 -Auto-Submit: Michael Pratt -Reviewed-by: Ian Lance Taylor -TryBot-Bypass: Michael Pratt -Reviewed-by: Than McIntosh ---- - misc/cgo/errors/errors_test.go | 24 ++++++++++++++++-------- - misc/cgo/errors/testdata/err5.go | 11 +++++++++++ - src/cmd/compile/internal/noder/noder.go | 8 +++++++- - 3 files changed, 34 insertions(+), 9 deletions(-) - create mode 100644 misc/cgo/errors/testdata/err5.go - -diff --git a/misc/cgo/errors/errors_test.go b/misc/cgo/errors/errors_test.go -index 9718b7f9fb4d0..8168032dc35bc 100644 ---- a/misc/cgo/errors/errors_test.go -+++ b/misc/cgo/errors/errors_test.go -@@ -36,16 +36,23 @@ func check(t *testing.T, file string) { - continue - } - -- _, frag, ok := bytes.Cut(line, []byte("ERROR HERE: ")) -- if !ok { -- continue -+ if _, frag, ok := bytes.Cut(line, []byte("ERROR HERE: ")); ok { -+ re, err := regexp.Compile(fmt.Sprintf(":%d:.*%s", i+1, frag)) -+ if err != nil { -+ t.Errorf("Invalid regexp after `ERROR HERE: `: %#q", frag) -+ continue -+ } -+ errors = append(errors, re) - } -- re, err := regexp.Compile(fmt.Sprintf(":%d:.*%s", i+1, frag)) -- if err != nil { -- t.Errorf("Invalid regexp after `ERROR HERE: `: %#q", frag) -- continue -+ -+ if _, frag, ok := bytes.Cut(line, []byte("ERROR MESSAGE: ")); ok { -+ re, err := regexp.Compile(string(frag)) -+ if err != nil { -+ t.Errorf("Invalid regexp after `ERROR MESSAGE: `: %#q", frag) -+ continue -+ } -+ errors = append(errors, re) - } -- errors = append(errors, re) - } - if len(errors) == 0 { - t.Fatalf("cannot find ERROR HERE") -@@ -106,6 +113,7 @@ func TestReportsTypeErrors(t *testing.T) { - for _, file := range []string{ - "err1.go", - "err2.go", -+ "err5.go", - "issue11097a.go", - "issue11097b.go", - "issue18452.go", -diff --git a/misc/cgo/errors/testdata/err5.go b/misc/cgo/errors/testdata/err5.go -new file mode 100644 -index 0000000000000..c12a290d3890f ---- /dev/null -+++ b/misc/cgo/errors/testdata/err5.go -@@ -0,0 +1,11 @@ -+// Copyright 2023 The Go Authors. All rights reserved. -+// Use of this source code is governed by a BSD-style -+// license that can be found in the LICENSE file. -+ -+package main -+ -+//line /tmp/_cgo_.go:1 -+//go:cgo_dynamic_linker "/elf/interp" -+// ERROR MESSAGE: only allowed in cgo-generated code -+ -+func main() {} -diff --git a/src/cmd/compile/internal/noder/noder.go b/src/cmd/compile/internal/noder/noder.go -index d0d95451ac0d3..c99c085037e23 100644 ---- a/src/cmd/compile/internal/noder/noder.go -+++ b/src/cmd/compile/internal/noder/noder.go -@@ -359,8 +359,14 @@ func (p *noder) pragma(pos syntax.Pos, blankLine bool, text string, old syntax.P - // contain cgo directives, and for security reasons - // (primarily misuse of linker flags), other files are not. - // See golang.org/issue/23672. -+// Note that cmd/go ignores files whose names start with underscore, -+// so the only _cgo_ files we will see from cmd/go are generated by cgo. -+// It's easy to bypass this check by calling the compiler directly; -+// we only protect against uses by cmd/go. - func isCgoGeneratedFile(pos syntax.Pos) bool { -- return strings.HasPrefix(filepath.Base(trimFilename(pos.Base())), "_cgo_") -+ // We need the absolute file, independent of //line directives, -+ // so we call pos.Base().Pos(). -+ return strings.HasPrefix(filepath.Base(trimFilename(pos.Base().Pos().Base())), "_cgo_") - } - - // safeArg reports whether arg is a "safe" command-line argument, diff --git a/0003-cmd-go-disable-Google-s-proxy-and-sumdb.patch b/0003-cmd-go-disable-Google-s-proxy-and-sumdb.patch deleted file mode 100644 index fba971319a072e18f6dc93880a7554b4c3a01ebb..0000000000000000000000000000000000000000 --- a/0003-cmd-go-disable-Google-s-proxy-and-sumdb.patch +++ /dev/null @@ -1,48 +0,0 @@ -From fa250374b727439159bc9f203b854bb5df00186f Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Jakub=20=C4=8Cajka?= -Date: Mon, 27 May 2019 15:12:53 +0200 -Subject: [PATCH 3/3] cmd/go: disable Google's proxy and sumdb - ---- - src/cmd/go/internal/cfg/cfg.go | 4 ++-- - src/cmd/go/testdata/script/mod_sumdb_golang.txt | 6 +++--- - 2 files changed, 5 insertions(+), 5 deletions(-) - -diff --git a/src/cmd/go/internal/cfg/cfg.go b/src/cmd/go/internal/cfg/cfg.go -index 57a3c1ff6f..e56c60e591 100644 ---- a/src/cmd/go/internal/cfg/cfg.go -+++ b/src/cmd/go/internal/cfg/cfg.go -@@ -266,8 +266,8 @@ var ( - GOPPC64 = envOr("GOPPC64", fmt.Sprintf("%s%d", "power", buildcfg.GOPPC64)) - GOWASM = envOr("GOWASM", fmt.Sprint(buildcfg.GOWASM)) - -- GOPROXY = envOr("GOPROXY", "https://proxy.golang.org,direct") -- GOSUMDB = envOr("GOSUMDB", "sum.golang.org") -+ GOPROXY = envOr("GOPROXY", "direct") -+ GOSUMDB = envOr("GOSUMDB", "off") - GOPRIVATE = Getenv("GOPRIVATE") - GONOPROXY = envOr("GONOPROXY", GOPRIVATE) - GONOSUMDB = envOr("GONOSUMDB", GOPRIVATE) -diff --git a/src/cmd/go/testdata/script/mod_sumdb_golang.txt b/src/cmd/go/testdata/script/mod_sumdb_golang.txt -index becd88b52e..b2a1250372 100644 ---- a/src/cmd/go/testdata/script/mod_sumdb_golang.txt -+++ b/src/cmd/go/testdata/script/mod_sumdb_golang.txt -@@ -2,12 +2,12 @@ - env GOPROXY= - env GOSUMDB= - go env GOPROXY --stdout '^https://proxy.golang.org,direct$' -+stdout '^direct$' - go env GOSUMDB --stdout '^sum.golang.org$' -+stdout '^off$' - env GOPROXY=https://proxy.golang.org - go env GOSUMDB --stdout '^sum.golang.org$' -+stdout '^off$' - - # Download direct from github. - --- -2.31.1 - diff --git a/0005-fix-CVE-2023-39326.patch b/0005-fix-CVE-2023-39326.patch deleted file mode 100644 index 85dd15ff588a89115d404ca536c6afe33adfccf5..0000000000000000000000000000000000000000 --- a/0005-fix-CVE-2023-39326.patch +++ /dev/null @@ -1,174 +0,0 @@ -From 6446af942e2e2b161c4ec1b60d9703a2b55dc4dd Mon Sep 17 00:00:00 2001 -From: Damien Neil -Date: Tue, 7 Nov 2023 10:47:56 -0800 -Subject: [PATCH] [release-branch.go1.20] net/http: limit chunked data overhead - -The chunked transfer encoding adds some overhead to -the content transferred. When writing one byte per -chunk, for example, there are five bytes of overhead -per byte of data transferred: "1\r\nX\r\n" to send "X". - -Chunks may include "chunk extensions", -which we skip over and do not use. -For example: "1;chunk extension here\r\nX\r\n". - -A malicious sender can use chunk extensions to add -about 4k of overhead per byte of data. -(The maximum chunk header line size we will accept.) - -Track the amount of overhead read in chunked data, -and produce an error if it seems excessive. - -Updates #64433 -Fixes #64434 -Fixes CVE-2023-39326 - -Change-Id: I40f8d70eb6f9575fb43f506eb19132ccedafcf39 -Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2076135 -Reviewed-by: Tatiana Bradley -Reviewed-by: Roland Shoemaker -(cherry picked from commit 3473ae72ee66c60744665a24b2fde143e8964d4f) -Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2095407 -Run-TryBot: Roland Shoemaker -TryBot-Result: Security TryBots -Reviewed-by: Damien Neil -Reviewed-on: https://go-review.googlesource.com/c/go/+/547355 -Reviewed-by: Dmitri Shuralyov -LUCI-TryBot-Result: Go LUCI ---- - src/net/http/internal/chunked.go | 36 +++++++++++++--- - src/net/http/internal/chunked_test.go | 59 +++++++++++++++++++++++++++ - 2 files changed, 89 insertions(+), 6 deletions(-) - -diff --git a/src/net/http/internal/chunked.go b/src/net/http/internal/chunked.go -index 5a174415dc401..8b6e94b5d49cc 100644 ---- a/src/net/http/internal/chunked.go -+++ b/src/net/http/internal/chunked.go -@@ -39,7 +39,8 @@ type chunkedReader struct { - n uint64 // unread bytes in chunk - err error - buf [2]byte -- checkEnd bool // whether need to check for \r\n chunk footer -+ checkEnd bool // whether need to check for \r\n chunk footer -+ excess int64 // "excessive" chunk overhead, for malicious sender detection - } - - func (cr *chunkedReader) beginChunk() { -@@ -49,10 +50,38 @@ func (cr *chunkedReader) beginChunk() { - if cr.err != nil { - return - } -+ cr.excess += int64(len(line)) + 2 // header, plus \r\n after the chunk data -+ line = trimTrailingWhitespace(line) -+ line, cr.err = removeChunkExtension(line) -+ if cr.err != nil { -+ return -+ } - cr.n, cr.err = parseHexUint(line) - if cr.err != nil { - return - } -+ // A sender who sends one byte per chunk will send 5 bytes of overhead -+ // for every byte of data. ("1\r\nX\r\n" to send "X".) -+ // We want to allow this, since streaming a byte at a time can be legitimate. -+ // -+ // A sender can use chunk extensions to add arbitrary amounts of additional -+ // data per byte read. ("1;very long extension\r\nX\r\n" to send "X".) -+ // We don't want to disallow extensions (although we discard them), -+ // but we also don't want to allow a sender to reduce the signal/noise ratio -+ // arbitrarily. -+ // -+ // We track the amount of excess overhead read, -+ // and produce an error if it grows too large. -+ // -+ // Currently, we say that we're willing to accept 16 bytes of overhead per chunk, -+ // plus twice the amount of real data in the chunk. -+ cr.excess -= 16 + (2 * int64(cr.n)) -+ if cr.excess < 0 { -+ cr.excess = 0 -+ } -+ if cr.excess > 16*1024 { -+ cr.err = errors.New("chunked encoding contains too much non-data") -+ } - if cr.n == 0 { - cr.err = io.EOF - } -@@ -140,11 +169,6 @@ func readChunkLine(b *bufio.Reader) ([]byte, error) { - if len(p) >= maxLineLength { - return nil, ErrLineTooLong - } -- p = trimTrailingWhitespace(p) -- p, err = removeChunkExtension(p) -- if err != nil { -- return nil, err -- } - return p, nil - } - -diff --git a/src/net/http/internal/chunked_test.go b/src/net/http/internal/chunked_test.go -index 5e29a786dd61e..b99090c1f8ad7 100644 ---- a/src/net/http/internal/chunked_test.go -+++ b/src/net/http/internal/chunked_test.go -@@ -239,3 +239,62 @@ func TestChunkEndReadError(t *testing.T) { - t.Errorf("expected %v, got %v", readErr, err) - } - } -+ -+func TestChunkReaderTooMuchOverhead(t *testing.T) { -+ // If the sender is sending 100x as many chunk header bytes as chunk data, -+ // we should reject the stream at some point. -+ chunk := []byte("1;") -+ for i := 0; i < 100; i++ { -+ chunk = append(chunk, 'a') // chunk extension -+ } -+ chunk = append(chunk, "\r\nX\r\n"...) -+ const bodylen = 1 << 20 -+ r := NewChunkedReader(&funcReader{f: func(i int) ([]byte, error) { -+ if i < bodylen { -+ return chunk, nil -+ } -+ return []byte("0\r\n"), nil -+ }}) -+ _, err := io.ReadAll(r) -+ if err == nil { -+ t.Fatalf("successfully read body with excessive overhead; want error") -+ } -+} -+ -+func TestChunkReaderByteAtATime(t *testing.T) { -+ // Sending one byte per chunk should not trip the excess-overhead detection. -+ const bodylen = 1 << 20 -+ r := NewChunkedReader(&funcReader{f: func(i int) ([]byte, error) { -+ if i < bodylen { -+ return []byte("1\r\nX\r\n"), nil -+ } -+ return []byte("0\r\n"), nil -+ }}) -+ got, err := io.ReadAll(r) -+ if err != nil { -+ t.Errorf("unexpected error: %v", err) -+ } -+ if len(got) != bodylen { -+ t.Errorf("read %v bytes, want %v", len(got), bodylen) -+ } -+} -+ -+type funcReader struct { -+ f func(iteration int) ([]byte, error) -+ i int -+ b []byte -+ err error -+} -+ -+func (r *funcReader) Read(p []byte) (n int, err error) { -+ if len(r.b) == 0 && r.err == nil { -+ r.b, r.err = r.f(r.i) -+ r.i++ -+ } -+ n = copy(p, r.b) -+ r.b = r.b[n:] -+ if len(r.b) > 0 { -+ return n, nil -+ } -+ return n, r.err -+} diff --git a/0006-fix-CVE-2023-39318.patch b/0006-fix-CVE-2023-39318.patch deleted file mode 100644 index bf0f53b972570d1353b0033fe4484c49f06c5e34..0000000000000000000000000000000000000000 --- a/0006-fix-CVE-2023-39318.patch +++ /dev/null @@ -1,255 +0,0 @@ -From 023b542edf38e2a1f87fcefb9f75ff2f99401b4c Mon Sep 17 00:00:00 2001 -From: Roland Shoemaker -Date: Thu, 3 Aug 2023 12:24:13 -0700 -Subject: [PATCH] [release-branch.go1.20] html/template: support HTML-like - comments in script contexts - -Per Appendix B.1.1 of the ECMAScript specification, support HTML-like -comments in script contexts. Also per section 12.5, support hashbang -comments. This brings our parsing in-line with how browsers treat these -comment types. - -Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for -reporting this issue. - -Fixes #62196 -Fixes #62395 -Fixes CVE-2023-39318 - -Change-Id: Id512702c5de3ae46cf648e268cb10e1eb392a181 -Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1976593 -Run-TryBot: Roland Shoemaker -Reviewed-by: Tatiana Bradley -Reviewed-by: Damien Neil -Reviewed-by: Dmitri Shuralyov -Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/2014620 -Reviewed-on: https://go-review.googlesource.com/c/go/+/526098 -Run-TryBot: Cherry Mui -TryBot-Result: Gopher Robot ---- - src/html/template/context.go | 6 ++- - src/html/template/escape.go | 5 +- - src/html/template/escape_test.go | 10 ++++ - src/html/template/state_string.go | 26 +++++----- - src/html/template/transition.go | 80 ++++++++++++++++++++----------- - 5 files changed, 84 insertions(+), 43 deletions(-) - -diff --git a/src/html/template/context.go b/src/html/template/context.go -index c28fb0c5ea8ef..e07a0c4a027d0 100644 ---- a/src/html/template/context.go -+++ b/src/html/template/context.go -@@ -128,6 +128,10 @@ const ( - stateJSBlockCmt - // stateJSLineCmt occurs inside a JavaScript // line comment. - stateJSLineCmt -+ // stateJSHTMLOpenCmt occurs inside a JavaScript HTML-like comment. -+ stateJSHTMLCloseCmt - // stateCSS occurs inside a