What version of Go are you using (go version)?
$ go version
go version go1.15.3 linux/amd64
Does this issue reproduce with the latest release?
Yes, I think so
What operating system and processor architecture are you using (go env)?
go env Output
$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/home/shaun/.cache/go-build"
GOENV="/home/shaun/.config/go/env"
GOEXE=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/home/shaun/go-os/pkg/mod"
GONOPROXY="github.com/tigera/*"
GONOSUMDB="github.com/tigera/*"
GOOS="linux"
GOPATH="/home/shaun/go-os"
GOPRIVATE="github.com/tigera/*"
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GCCGO="gccgo"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/home/shaun/go-os/src/github.com/projectcalico/typha/go.mod"
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build310145214=/tmp/go-build -gno-record-gcc-switches"
What did you do?
Create a TLS connection with a mismatched certificate (this is in a unit test, which was testing the "bad path").
What did you expect to see?
With <=TLSv12, I get an error from DialWithDialer(). This feels like the natural time to return connection set-up errors and it makes it more obvious to the caller that the issue is with the parameters of the connection.
(We had this pinned because tests started failing when we updated to go v1.13 so we made a quick fix; I'm just coming back to that to investigate...)
What did you see instead?
With <=TLSv13, I get no error from DialWithDialer(), but later reads fail with
remote error: tls: bad certificate type=""
for example. So, looks like there's no compromise in security but the error appears as a problem with the established connection rather than a problem with establishing the connection in the first place.
What version of Go are you using (
go version)?Does this issue reproduce with the latest release?
Yes, I think so
What operating system and processor architecture are you using (
go env)?go envOutputWhat did you do?
Create a TLS connection with a mismatched certificate (this is in a unit test, which was testing the "bad path").
What did you expect to see?
With <=TLSv12, I get an error from
DialWithDialer(). This feels like the natural time to return connection set-up errors and it makes it more obvious to the caller that the issue is with the parameters of the connection.(We had this pinned because tests started failing when we updated to go v1.13 so we made a quick fix; I'm just coming back to that to investigate...)
What did you see instead?
With <=TLSv13, I get no error from
DialWithDialer(), but later reads fail withfor example. So, looks like there's no compromise in security but the error appears as a problem with the established connection rather than a problem with establishing the connection in the first place.