go, branch go1.14.6

[release-branch.go1.14] go1.14.6

2020-07-16T22:23:28Z

Change-Id: If9f503098056bd86b2bf51e3297b1bcecd8453bb Reviewed-on: https://go-review.googlesource.com/c/go/+/243138 Run-TryBot: Andrew Bonventre TryBot-Result: Gobot Gobot Reviewed-by: Dmitri Shuralyov

[release-branch.go1.14] testing: capture testname on --- PASS and --- FAIL lines

2020-07-16T18:22:52Z

This fixes an issue raised at https://github.com/golang/go/issues/38458#issuecomment-635617670 in which --- PASS and --- FAIL lines would not trigger --- CONT lines of other tests. Updates #38458. For #39308. Change-Id: I0d8cc54d682a370d0a6ea6816a11b2e462a92efe Reviewed-on: https://go-review.googlesource.com/c/go/+/235997 Run-TryBot: Emmanuel Odeke TryBot-Result: Gobot Gobot Reviewed-by: Bryan C. Mills Reviewed-on: https://go-review.googlesource.com/c/go/+/242058 Reviewed-by: Jean de Klerk Reviewed-by: Emmanuel Odeke Run-TryBot: Dmitri Shuralyov

[release-branch.go1.14] cmd/go: fix parallel chatty tests on solaris-amd64 builder

2020-07-16T18:22:15Z

The parallel chatty tests added in CL 229085 fail on the solaris-amd64-oraclerel builder, because a +NN:NN offset time zone is used. Allow for the `+` character in the corresponding regex to fix these tests. Also move the '-' to the end of the character class, so it is not interpreted as the range 9-T. Updates #38458. For #39308. Change-Id: Iec9ae82ba45d2490176f274f0dc6812666eae718 Reviewed-on: https://go-review.googlesource.com/c/go/+/234978 Run-TryBot: Tobias Klauser TryBot-Result: Gobot Gobot Reviewed-by: Ian Lance Taylor Reviewed-on: https://go-review.googlesource.com/c/go/+/242059 Run-TryBot: Dmitri Shuralyov

[release-branch.go1.14] testing: reformat test chatty output

2020-07-16T18:20:50Z

In #24929, we decided to stream chatty test output. It looks like, foo_test.go:138: TestFoo/sub-1: hello from subtest 1 foo_test.go:138: TestFoo/sub-2: hello from subtest 2 In this CL, we refactor the output to be grouped by === CONT lines, preserving the old test-file-before-log-line behavior: === CONT TestFoo/sub-1 foo_test.go:138 hello from subtest 1 === CONT TestFoo/sub-2 foo_test.go:138 hello from subtest 2 This should remove a layer of verbosity from tests, and make it easier to group together related lines. It also returns to a more familiar format (the pre-streaming format), whilst still preserving the streaming feature. Updates #38458. Fixes #39308. Change-Id: Iaef94c580d69cdd541b2ef055aa004f50d72d078 Reviewed-on: https://go-review.googlesource.com/c/go/+/229085 Run-TryBot: Emmanuel Odeke TryBot-Result: Gobot Gobot Reviewed-by: Bryan C. Mills Reviewed-by: Andrew Bonventre Reviewed-on: https://go-review.googlesource.com/c/go/+/242057 Reviewed-by: Jean de Klerk Reviewed-by: Emmanuel Odeke Run-TryBot: Jean de Klerk

[release-branch.go1.14] database/sql: backport 5 Tx rollback related CLs

2020-07-16T00:35:30Z

Manually backported the subject CLs, because of lack of Gerrit "forge-author" permissions, but also because the prior cherry picks didn't apply cleanly, due to a tight relation chain. The backport comprises of: * CL 174122 * CL 216197 * CL 223963 * CL 216240 * CL 216241 Note: Due to the restrictions that we cannot retroactively introduce API changes to Go1.14.6 that weren't in Go1.14, the Conn.Validator interface (from CL 174122, CL 223963) isn't exposed, and drivers will just be inspected, for if they have an IsValid() bool method implemented. For a description of the content of each CL: * CL 174122: database/sql: process all Session Resets synchronously Adds a new interface, driver.ConnectionValidator, to allow drivers to signal they should not be used again, separatly from the session resetter interface. This is done now that the session reset is done after the connection is put into the connection pool. Previous behavior attempted to run Session Resets in a background worker. This implementation had two problems: untested performance gains for additional complexity, and failures when the pool size exceeded the connection reset channel buffer size. * CL 216197: database/sql: check conn expiry when returning to pool, not when handing it out With the original connection reuse strategy, it was possible that when a new connection was requested, the pool would wait for an an existing connection to return for re-use in a full connection pool, and then it would check if the returned connection was expired. If the returned connection expired while awaiting re-use, it would return an error to the location requestiong the new connection. The existing call sites requesting a new connection was often the last attempt at returning a connection for a query. This would then result in a failed query. This change ensures that we perform the expiry check right before a connection is inserted back in to the connection pool for while requesting a new connection. If requesting a new connection it will no longer fail due to the connection expiring. * CL 216240: database/sql: prevent Tx statement from committing after rollback It was possible for a Tx that was aborted for rollback asynchronously to execute a query after the rollback had completed on the database, which often would auto commit the query outside of the transaction. By W-locking the tx.closemu prior to issuing the rollback connection it ensures any Tx query either fails or finishes on the Tx, and never after the Tx has rolled back. * CL 216241: database/sql: on Tx rollback, retain connection if driver can reset session Previously the Tx would drop the connection after rolling back from a context cancel. Now if the driver can reset the session, keep the connection. * CL 223963 database/sql: add test for Conn.Validator interface This addresses comments made by Russ after https://golang.org/cl/174122 was merged. It addes a test for the connection validator and renames the interface to just "Validator". Updates #31480 Updates #32530 Updates #32942 Updates #34775 Fixes #39101 Change-Id: I043d2d724a367588689fd7d6f3cecb39abeb042c Reviewed-on: https://go-review.googlesource.com/c/go/+/242102 Run-TryBot: Emmanuel Odeke TryBot-Result: Gobot Gobot Reviewed-by: Daniel Theophanes

[release-branch.go1.14] all: merge release-branch.go1.14-security into release-branch.go1.14

2020-07-14T18:50:56Z

Change-Id: Ia002311f7206f11a98929361f55eb2ab765b7d5c

[release-branch.go1.14-security] go1.14.5

2020-07-14T14:10:30Z

Change-Id: Ic2fb9041f6610dd5ce54185e674ab4b62fabf3b5 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/794130 Reviewed-by: Katie Hockman

[release-branch.go1.14-security] crypto/x509: respect VerifyOptions.KeyUsages on Windows

2020-07-14T12:24:21Z

When using the platform verifier on Windows (because Roots is nil) we were always enforcing server auth EKUs if DNSName was set, and none otherwise. If an application was setting KeyUsages, they were not being respected. Started correctly surfacing IncompatibleUsage errors from the system verifier, as those are the ones applications will see if they are affected by this change. Also refactored verify_test.go to make it easier to add tests for this, and replaced the EKULeaf chain with a new one that doesn't have a SHA-1 signature. Thanks to Niall Newman for reporting this. Fixes #39360 Fixes CVE-2020-14039 Change-Id: If5c00d615f2944f7d57007891aae1307f9571c32 Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/774414 Reviewed-by: Katie Hockman Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/793511 Reviewed-by: Filippo Valsorda

[release-branch.go1.14-security] net/http: synchronize "100 Continue" write and Handler writes

2020-07-13T20:58:01Z

The expectContinueReader writes to the connection on the first Request.Body read. Since a Handler might be doing a read in parallel or before a write, expectContinueReader needs to synchronize with the ResponseWriter, and abort if a response already went out. The tests will land in a separate CL. Fixes #34902 Fixes CVE-2020-15586 Change-Id: Icdd8dd539f45e8863762bd378194bb4741e875fc Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/793350 Reviewed-by: Filippo Valsorda (cherry picked from commit b5e504f4a07c572744b228fa1b10e3989c4c44f3) Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/793500

[release-branch.go1.14] net/http: fix panic with If-None-Match value in http.ServeContent

2020-07-13T18:33:06Z

Updates #39817. Fixes #39920. Change-Id: I79f2ad7c836a8a46569f603aca583fdd526d22dc GitHub-Last-Rev: 5b88aada219aaa2af0c7e1969ed6fa646117d9da GitHub-Pull-Request: golang/go#39821 Reviewed-on: https://go-review.googlesource.com/c/go/+/239699 Run-TryBot: Brad Fitzpatrick TryBot-Result: Gobot Gobot Reviewed-by: Brad Fitzpatrick (cherry picked from commit ce81a8f5e4f6c33036aa0777fabc47eeeab468dc) Reviewed-on: https://go-review.googlesource.com/c/go/+/240343 Run-TryBot: Emmanuel Odeke Reviewed-by: Emmanuel Odeke