Package init
This commit is contained in:
dogsheng
parent
f6abdd32e1
commit
467816af2c
@ -1,88 +0,0 @@
|
||||
From edce31a2904846ae74e3c011f2cf5fddc963459e Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Jakub=20=C4=8Cajka?= <jcajka@redhat.com>
|
||||
Date: Thu, 22 Mar 2018 12:07:32 +0100
|
||||
Subject: [PATCH 1/3] Don't use the bundled tzdata at runtime, except for the
|
||||
internal test suite
|
||||
|
||||
---
|
||||
src/time/internal_test.go | 7 +++++--
|
||||
src/time/zoneinfo_test.go | 3 ++-
|
||||
src/time/zoneinfo_unix.go | 2 --
|
||||
3 files changed, 7 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/src/time/internal_test.go b/src/time/internal_test.go
|
||||
index 76d5524124..e81ace5f64 100644
|
||||
--- a/src/time/internal_test.go
|
||||
+++ b/src/time/internal_test.go
|
||||
@@ -4,13 +4,15 @@
|
||||
|
||||
package time
|
||||
|
||||
+import "runtime"
|
||||
+
|
||||
func init() {
|
||||
// force US/Pacific for time zone tests
|
||||
ForceUSPacificForTesting()
|
||||
}
|
||||
|
||||
func initTestingZone() {
|
||||
- z, err := loadLocation("America/Los_Angeles", zoneSources[len(zoneSources)-1:])
|
||||
+ z, err := loadLocation("America/Los_Angeles", zoneSources)
|
||||
if err != nil {
|
||||
panic("cannot load America/Los_Angeles for testing: " + err.Error())
|
||||
}
|
||||
@@ -21,8 +23,9 @@ func initTestingZone() {
|
||||
var OrigZoneSources = zoneSources
|
||||
|
||||
func forceZipFileForTesting(zipOnly bool) {
|
||||
- zoneSources = make([]string, len(OrigZoneSources))
|
||||
+ zoneSources = make([]string, len(OrigZoneSources)+1)
|
||||
copy(zoneSources, OrigZoneSources)
|
||||
+ zoneSources = append(zoneSources, runtime.GOROOT()+"/lib/time/zoneinfo.zip")
|
||||
if zipOnly {
|
||||
zoneSources = zoneSources[len(zoneSources)-1:]
|
||||
}
|
||||
diff --git a/src/time/zoneinfo_test.go b/src/time/zoneinfo_test.go
|
||||
index 7a55d4f618..6063ca1195 100644
|
||||
--- a/src/time/zoneinfo_test.go
|
||||
+++ b/src/time/zoneinfo_test.go
|
||||
@@ -8,6 +8,7 @@ import (
|
||||
"fmt"
|
||||
"os"
|
||||
"reflect"
|
||||
+ "runtime"
|
||||
"testing"
|
||||
"time"
|
||||
)
|
||||
@@ -128,7 +129,7 @@ func TestLoadLocationFromTZData(t *testing.T) {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
- tzinfo, err := time.LoadTzinfo(locationName, time.OrigZoneSources[len(time.OrigZoneSources)-1])
|
||||
+ tzinfo, err := time.LoadTzinfo(locationName, runtime.GOROOT()+"/lib/time/zoneinfo.zip")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
diff --git a/src/time/zoneinfo_unix.go b/src/time/zoneinfo_unix.go
|
||||
index 88313aa0ed..d9596115ef 100644
|
||||
--- a/src/time/zoneinfo_unix.go
|
||||
+++ b/src/time/zoneinfo_unix.go
|
||||
@@ -12,7 +12,6 @@
|
||||
package time
|
||||
|
||||
import (
|
||||
- "runtime"
|
||||
"syscall"
|
||||
)
|
||||
|
||||
@@ -22,7 +21,6 @@ var zoneSources = []string{
|
||||
"/usr/share/zoneinfo/",
|
||||
"/usr/share/lib/zoneinfo/",
|
||||
"/usr/lib/locale/TZ/",
|
||||
- runtime.GOROOT() + "/lib/time/zoneinfo.zip",
|
||||
}
|
||||
|
||||
func initLocal() {
|
||||
--
|
||||
2.14.3
|
||||
|
||||
@ -1,41 +0,0 @@
|
||||
From 817407fc2d6a861e65086388766f58082d38bc0b Mon Sep 17 00:00:00 2001
|
||||
From: Michael Munday <munday@ca.ibm.com>
|
||||
Date: Tue, 17 Jan 2017 11:33:38 -0500
|
||||
Subject: [PATCH 2/3] syscall: expose IfInfomsg.X__ifi_pad on s390x
|
||||
|
||||
Exposing this field on s390x improves compatibility with the other
|
||||
linux architectures, all of which already expose it.
|
||||
|
||||
Fixes #18628 and updates #18632.
|
||||
|
||||
Change-Id: I08e8e1eb705f898cd8822f8bee0d61ce11d514b5
|
||||
---
|
||||
src/syscall/ztypes_linux_s390x.go | 12 ++++++------
|
||||
1 file changed, 6 insertions(+), 6 deletions(-)
|
||||
|
||||
diff --git a/src/syscall/ztypes_linux_s390x.go b/src/syscall/ztypes_linux_s390x.go
|
||||
index 63c4a83b19..b5894255df 100644
|
||||
--- a/src/syscall/ztypes_linux_s390x.go
|
||||
+++ b/src/syscall/ztypes_linux_s390x.go
|
||||
@@ -449,12 +449,12 @@ type RtAttr struct {
|
||||
}
|
||||
|
||||
type IfInfomsg struct {
|
||||
- Family uint8
|
||||
- _ uint8
|
||||
- Type uint16
|
||||
- Index int32
|
||||
- Flags uint32
|
||||
- Change uint32
|
||||
+ Family uint8
|
||||
+ X__ifi_pad uint8
|
||||
+ Type uint16
|
||||
+ Index int32
|
||||
+ Flags uint32
|
||||
+ Change uint32
|
||||
}
|
||||
|
||||
type IfAddrmsg struct {
|
||||
--
|
||||
2.14.3
|
||||
|
||||
@ -1,44 +0,0 @@
|
||||
From 867a07a179ebcb40143c76403f7f232b90812059 Mon Sep 17 00:00:00 2001
|
||||
From: Filippo Valsorda <filippo@golang.org>
|
||||
Date: Tue, 22 Jan 2019 16:02:41 -0500
|
||||
Subject: [PATCH] [release-branch.go1.11-security] crypto/elliptic: reduce
|
||||
subtraction term to prevent long busy loop
|
||||
|
||||
If beta8 is unusually large, the addition loop might take a very long
|
||||
time to bring x3-beta8 back positive.
|
||||
|
||||
This would lead to a DoS vulnerability in the implementation of the
|
||||
P-521 and P-384 elliptic curves that may let an attacker craft inputs
|
||||
to ScalarMult that consume excessive amounts of CPU.
|
||||
|
||||
This fixes CVE-2019-6486.
|
||||
|
||||
Change-Id: Ia969e8b5bf5ac4071a00722de9d5e4d856d8071a
|
||||
Reviewed-on: https://team-review.git.corp.google.com/c/399777
|
||||
Reviewed-by: Adam Langley <agl@google.com>
|
||||
Reviewed-by: Julie Qiu <julieqiu@google.com>
|
||||
(cherry picked from commit 746d6abe2dfb9ce7609f8e1e1a8dcb7e221f423e)
|
||||
Reviewed-on: https://team-review.git.corp.google.com/c/401142
|
||||
Reviewed-by: Filippo Valsorda <valsorda@google.com>
|
||||
---
|
||||
src/crypto/elliptic/elliptic.go | 3 ++-
|
||||
1 file changed, 2 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/src/crypto/elliptic/elliptic.go b/src/crypto/elliptic/elliptic.go
|
||||
index 4fc2b5e521..c84657c5e3 100644
|
||||
--- a/src/crypto/elliptic/elliptic.go
|
||||
+++ b/src/crypto/elliptic/elliptic.go
|
||||
@@ -210,8 +210,9 @@ func (curve *CurveParams) doubleJacobian(x, y, z *big.Int) (*big.Int, *big.Int,
|
||||
|
||||
x3 := new(big.Int).Mul(alpha, alpha)
|
||||
beta8 := new(big.Int).Lsh(beta, 3)
|
||||
+ beta8.Mod(beta8, curve.P)
|
||||
x3.Sub(x3, beta8)
|
||||
- for x3.Sign() == -1 {
|
||||
+ if x3.Sign() == -1 {
|
||||
x3.Add(x3, curve.P)
|
||||
}
|
||||
x3.Mod(x3, curve.P)
|
||||
--
|
||||
2.17.1
|
||||
|
||||
@ -1,173 +0,0 @@
|
||||
From e152b01a468a1c18a290bf9aec52ccea7693c7f2 Mon Sep 17 00:00:00 2001
|
||||
From: Filippo Valsorda <filippo@golang.org>
|
||||
Date: Mon, 12 Aug 2019 16:59:30 -0400
|
||||
Subject: [PATCH] [release-branch.go1.11-security] net/http: update bundled
|
||||
http2 to import security fix
|
||||
|
||||
Apply the following unpublished golang.org/x/net commit.
|
||||
|
||||
commit b1cc14aba47abf96f96818003fa4caad3a4b4e86
|
||||
Author: Filippo Valsorda <filippo@golang.org>
|
||||
Date: Sun Aug 11 02:12:18 2019 -0400
|
||||
|
||||
[release-branch.go1.11] http2: limit number of control frames in server send queue
|
||||
|
||||
An attacker could cause servers to queue an unlimited number of PING
|
||||
ACKs or RST_STREAM frames by soliciting them and not reading them, until
|
||||
the program runs out of memory.
|
||||
|
||||
Limit control frames in the queue to a few thousands (matching the limit
|
||||
imposed by other vendors) by counting as they enter and exit the scheduler,
|
||||
so the protection will work with any WriteScheduler.
|
||||
|
||||
Once the limit is exceeded, close the connection, as we have no way to
|
||||
communicate with the peer.
|
||||
|
||||
Change-Id: I842968fc6ed3eac654b497ade8cea86f7267886b
|
||||
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/525552
|
||||
Reviewed-by: Brad Fitzpatrick <bradfitz@google.com>
|
||||
(cherry picked from commit 589ad6cc5321fb68a90370348a241a5da0a2cc80)
|
||||
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/526070
|
||||
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
|
||||
|
||||
Fixes CVE-2019-9512 and CVE-2019-9514
|
||||
Updates #33606
|
||||
|
||||
Change-Id: Iecedf1cc63ec7a1cd75661ec591d91ebc911cc64
|
||||
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/526072
|
||||
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
|
||||
---
|
||||
src/net/http/h2_bundle.go | 54 +++++++++++++++++++++++++++++++++++++++--------
|
||||
1 file changed, 45 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/src/net/http/h2_bundle.go b/src/net/http/h2_bundle.go
|
||||
index 2cd2b86..6182495 100644
|
||||
--- a/src/net/http/h2_bundle.go
|
||||
+++ b/src/net/http/h2_bundle.go
|
||||
@@ -3835,10 +3835,11 @@ func (p *http2pipe) Done() <-chan struct{} {
|
||||
}
|
||||
|
||||
const (
|
||||
- http2prefaceTimeout = 10 * time.Second
|
||||
- http2firstSettingsTimeout = 2 * time.Second // should be in-flight with preface anyway
|
||||
- http2handlerChunkWriteSize = 4 << 10
|
||||
- http2defaultMaxStreams = 250 // TODO: make this 100 as the GFE seems to?
|
||||
+ http2prefaceTimeout = 10 * time.Second
|
||||
+ http2firstSettingsTimeout = 2 * time.Second // should be in-flight with preface anyway
|
||||
+ http2handlerChunkWriteSize = 4 << 10
|
||||
+ http2defaultMaxStreams = 250 // TODO: make this 100 as the GFE seems to?
|
||||
+ http2maxQueuedControlFrames = 10000
|
||||
)
|
||||
|
||||
var (
|
||||
@@ -3946,6 +3947,15 @@ func (s *http2Server) maxConcurrentStreams() uint32 {
|
||||
return http2defaultMaxStreams
|
||||
}
|
||||
|
||||
+// maxQueuedControlFrames is the maximum number of control frames like
|
||||
+// SETTINGS, PING and RST_STREAM that will be queued for writing before
|
||||
+// the connection is closed to prevent memory exhaustion attacks.
|
||||
+func (s *http2Server) maxQueuedControlFrames() int {
|
||||
+ // TODO: if anybody asks, add a Server field, and remember to define the
|
||||
+ // behavior of negative values.
|
||||
+ return http2maxQueuedControlFrames
|
||||
+}
|
||||
+
|
||||
type http2serverInternalState struct {
|
||||
mu sync.Mutex
|
||||
activeConns map[*http2serverConn]struct{}
|
||||
@@ -4254,6 +4264,7 @@ type http2serverConn struct {
|
||||
sawFirstSettings bool // got the initial SETTINGS frame after the preface
|
||||
needToSendSettingsAck bool
|
||||
unackedSettings int // how many SETTINGS have we sent without ACKs?
|
||||
+ queuedControlFrames int // control frames in the writeSched queue
|
||||
clientMaxStreams uint32 // SETTINGS_MAX_CONCURRENT_STREAMS from client (our PUSH_PROMISE limit)
|
||||
advMaxStreams uint32 // our SETTINGS_MAX_CONCURRENT_STREAMS advertised the client
|
||||
curClientStreams uint32 // number of open streams initiated by the client
|
||||
@@ -4644,6 +4655,14 @@ func (sc *http2serverConn) serve() {
|
||||
}
|
||||
}
|
||||
|
||||
+ // If the peer is causing us to generate a lot of control frames,
|
||||
+ // but not reading them from us, assume they are trying to make us
|
||||
+ // run out of memory.
|
||||
+ if sc.queuedControlFrames > sc.srv.maxQueuedControlFrames() {
|
||||
+ sc.vlogf("http2: too many control frames in send queue, closing connection")
|
||||
+ return
|
||||
+ }
|
||||
+
|
||||
// Start the shutdown timer after sending a GOAWAY. When sending GOAWAY
|
||||
// with no error code (graceful shutdown), don't start the timer until
|
||||
// all open streams have been completed.
|
||||
@@ -4845,6 +4864,14 @@ func (sc *http2serverConn) writeFrame(wr http2FrameWriteRequest) {
|
||||
}
|
||||
|
||||
if !ignoreWrite {
|
||||
+ if wr.isControl() {
|
||||
+ sc.queuedControlFrames++
|
||||
+ // For extra safety, detect wraparounds, which should not happen,
|
||||
+ // and pull the plug.
|
||||
+ if sc.queuedControlFrames < 0 {
|
||||
+ sc.conn.Close()
|
||||
+ }
|
||||
+ }
|
||||
sc.writeSched.Push(wr)
|
||||
}
|
||||
sc.scheduleFrameWrite()
|
||||
@@ -4962,10 +4989,8 @@ func (sc *http2serverConn) wroteFrame(res http2frameWriteResult) {
|
||||
// If a frame is already being written, nothing happens. This will be called again
|
||||
// when the frame is done being written.
|
||||
//
|
||||
-// If a frame isn't being written we need to send one, the best frame
|
||||
-// to send is selected, preferring first things that aren't
|
||||
-// stream-specific (e.g. ACKing settings), and then finding the
|
||||
-// highest priority stream.
|
||||
+// If a frame isn't being written and we need to send one, the best frame
|
||||
+// to send is selected by writeSched.
|
||||
//
|
||||
// If a frame isn't being written and there's nothing else to send, we
|
||||
// flush the write buffer.
|
||||
@@ -4993,6 +5018,9 @@ func (sc *http2serverConn) scheduleFrameWrite() {
|
||||
}
|
||||
if !sc.inGoAway || sc.goAwayCode == http2ErrCodeNo {
|
||||
if wr, ok := sc.writeSched.Pop(); ok {
|
||||
+ if wr.isControl() {
|
||||
+ sc.queuedControlFrames--
|
||||
+ }
|
||||
sc.startFrameWrite(wr)
|
||||
continue
|
||||
}
|
||||
@@ -5285,6 +5313,8 @@ func (sc *http2serverConn) processSettings(f *http2SettingsFrame) error {
|
||||
if err := f.ForeachSetting(sc.processSetting); err != nil {
|
||||
return err
|
||||
}
|
||||
+ // TODO: judging by RFC 7540, Section 6.5.3 each SETTINGS frame should be
|
||||
+ // acknowledged individually, even if multiple are received before the ACK.
|
||||
sc.needToSendSettingsAck = true
|
||||
sc.scheduleFrameWrite()
|
||||
return nil
|
||||
@@ -9476,7 +9506,7 @@ type http2WriteScheduler interface {
|
||||
|
||||
// Pop dequeues the next frame to write. Returns false if no frames can
|
||||
// be written. Frames with a given wr.StreamID() are Pop'd in the same
|
||||
- // order they are Push'd.
|
||||
+ // order they are Push'd. No frames should be discarded except by CloseStream.
|
||||
Pop() (wr http2FrameWriteRequest, ok bool)
|
||||
}
|
||||
|
||||
@@ -9520,6 +9550,12 @@ func (wr http2FrameWriteRequest) StreamID() uint32 {
|
||||
return wr.stream.id
|
||||
}
|
||||
|
||||
+// isControl reports whether wr is a control frame for MaxQueuedControlFrames
|
||||
+// purposes. That includes non-stream frames and RST_STREAM frames.
|
||||
+func (wr http2FrameWriteRequest) isControl() bool {
|
||||
+ return wr.stream == nil
|
||||
+}
|
||||
+
|
||||
// DataSize returns the number of flow control bytes that must be consumed
|
||||
// to write this entire frame. This is 0 for non-DATA frames.
|
||||
func (wr http2FrameWriteRequest) DataSize() int {
|
||||
--
|
||||
1.9.4
|
||||
|
||||
Binary file not shown.
Loading…
x
Reference in New Issue
Block a user