crypto/tls: not support any TLS_DHE ciphers

[slayercat]

Please answer these questions before submitting your issue. Thanks!

What version of Go are you using (go version)?

go version go1.8 linux/amd64

What operating system and processor architecture are you using (go env)?

[root@localhost es_gateway]# go env
GOARCH="amd64"
GOBIN=""
GOEXE=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOOS="linux"
GOPATH="/disk/GOPATH"
GORACE=""
GOROOT="/opt/go/go"
GOTOOLDIR="/opt/go/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
CC="gcc"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build470410673=/tmp/go-build -gno-record-gcc-switches"
CXX="g++"
CGO_ENABLED="1"
PKG_CONFIG="pkg-config"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
[root@localhost es_gateway]#

What did you do?

    r.RequestURI = ""
    client := http.Client{
        Transport: &http.Transport{
            TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
        },  
    }   
    resp, err := client.Do(r)

Server cipher support:

[2017-04-12 01:59:20,175][INFO ][com.floragunn.searchguard.ssl.DefaultSearchGuardKeyStore] sslTransportClientProvider:JDK with ciphers [TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256]

TLS won't talk to server because TLS handshake failure.

What did you expect to see?

TLS talk success.

What did you see instead?

remote error: tls: handshake failure

[slayercat]

I did some google and found some code here:

https://android.googlesource.com/platform/external/boringssl/+/master/src/ssl/test/runner/cipher_suites.go

I can't see why not to use it.

[slayercat]

I'm cleaning the code and trying to migrate it to here. Please let me know if there's some thing I ignored

[bradfitz]

Dup of #7758

@slayercat, the author of the code you found is the same author of Go's crypto/tls package. It's not in Go due to:

#7758 (comment)

DHE is slow, has compatibility issues over 1024 bits and is getting removed in browsers. No plans to support it.

It's only in the test code you found for testing boringssl.