main: Use latest Go 1.25 features if possible. - #3504
Conversation
c4e41c3 to
9eee05d
Compare
davecgh
changed the title
aa9d32e to
efa3666
Compare
|
Change looks fine but there are many more compatibility flags that this removes (everything since the main module's declared Go 1.19): |
efa3666 to
5337399
Compare
|
EDIT: Nevermind. it's my
Hmm, I must be missing something. Without these changes, I see: |
|
Yeah, and my go.work was at 1.23 so there are even more beyond that.
|
1867914 to
13cfd9e
Compare
|
Which debug flag is the new note from the commit message referring to? All the tls and x509 options I see don't appear to affect existing certificates. The tls options only affect the algorithms that the server will use to negotiate a symmetric key, and x509rsacrt=0 (this one looks the most suspect) only restores the previous behavior of ignoring the precomputed CRT values of a RSA private key (CRT != certificate). If RSA certificates were really not usable anymore, we would want to nuke generating RSA4096 keys from |
|
I also modified gencerts to set |
I'll detail it here, but after looking again, I conflated the summary I was looking at. It's the supported TLS 1.2 cipher suites (for kx) that removed RSA and SHA-1 algorithms instead of the supported cert keys. The note originally pointed out that the RSA keys in certs are now required to be at least 1024 bits, but I updated it to instead call out the RSA keys weren't supported at all due to the aforementioned conflation. I'll update it to revert to that here in a bit. The flags in question are:
// If CipherSuites is nil, a safe default list is used. The default cipher
// suites might change over time. In Go 1.22 RSA key exchange based cipher
// suites were removed from the default list, but can be re-added with the
// GODEBUG setting tlsrsakex=1.
|
13cfd9e to
7f47d87
Compare
In order to avoid breaking backwards compatibility, newer versions of Go toolchains automatically set GODEBUG flags to disable any changes that are not strictly backwards compatible when compiling old code. However, it is often the case that older code will work properly with the new features and security updates enabled and those updates are generally desirable. The existing code in the main module will all work properly with all changes in Go 1.25, so this adds a directive when building with Go 1.25 or newer to override and remove the default GODEBUG flags which disable newer features and security updates that are not strictly backwards compatible. In other words, it ensures the new features and security updates implemented in Go 1.25 are enabled when building with Go 1.25 or newer. The specific GODEBUG flags removed are: - `asynctimerchan=1` - `containermaxprocs=0` - `decoratemappings=0` - `gotestjsonbuildtext=1` - `gotypesalias=0` - `httplaxcontentlength=1` - `httpmuxgo121=1` - `httpservecontentkeepheaders=1` - `multipathtcp=0` - `panicnil=1` - `randseednop=0` - `rsa1024min=0` - `tls10server=1` - `tls3des=1` - `tlsmlkem=0` - `tlsrsakex=1` - `tlssha1=1` - `tlsunsafeekm=1` - `updatemaxprocs=0` - `winreadlinkvolume=0` - `winsymlink=0` - `x509keypairleaf=0` - `x509negativeserial=1` - `x509rsacrt=0` - `x509sha256skid=0` - `x509usepolicies=0` The only notable change that could potential affect existing deployments is that it is no longer possible to use certificates that use RSA keys with less than 1024 bits. This is very unlikely to affect anyone in practice because the default generated certificates use ECC and there is not even an option to generate RSA certificates with dcrd itself. Further, the separate gencerts utility does support generating RSA certs, but those use 4096-bit RSA keys. In other words, a user would have needed to generate such a certificate with external tools, such as openssl, which would require them to know exactly what they're doing and so it would be easy for them to generate new certs if the change were to actually affect them.
7f47d87 to
c2a2915
Compare
2 participants
In order to avoid breaking backwards compatibility, newer versions of Go toolchains automatically set
GODEBUGflags to disable any changes that are not strictly backwards compatible when compiling old code. However, it is often the case that older code will work properly with the new features and security updates enabled and those updates are generally desirable.The existing code in the main module will all work properly with all changes in Go 1.25, so this adds a directive when building with Go 1.25 or newer to override and remove the default
GODEBUGflags which disable newer features and security updates that are not strictly backwards compatible. In other words, it ensures the new features and security updates implemented in Go 1.25 are enabled when building with Go 1.25 or newer.The specific
GODEBUGflags removed are:asynctimerchan=1containermaxprocs=0decoratemappings=0gotestjsonbuildtext=1gotypesalias=0httplaxcontentlength=1httpmuxgo121=1httpservecontentkeepheaders=1multipathtcp=0panicnil=1randseednop=0rsa1024min=0tls10server=1tls3des=1tlsmlkem=0tlsrsakex=1tlssha1=1tlsunsafeekm=1updatemaxprocs=0winreadlinkvolume=0winsymlink=0x509keypairleaf=0x509negativeserial=1x509rsacrt=0x509sha256skid=0x509usepolicies=0The only notable change that could potential affect existing deployments is that it is no longer possible to use certificates that use RSA keys with less than 1024 bits. This is very unlikely to affect anyone in practice because the default generated certificates use ECC and there is not even an option to generate RSA certificates with
dcrditself. Further, the separategencertsutility does support generating RSA certs, but those use 4096-bit RSA keys. In other words, a user would have needed to generate such a certificate with external tools, such as openssl, which would require them to know exactly what they're doing and so it would be easy for them to generate new certs if the change were to actually affect them.