crypto/tls: remove tls10default GODEBUG flag

Updates #45428

Change-Id: Ic2ff459e6a3f1e8ded2a770c11d34067c0b39a8a
Reviewed-on: https://go-review.googlesource.com/c/go/+/400974
Reviewed-by: Filippo Valsorda <valsorda@google.com>
Auto-Submit: Filippo Valsorda <valsorda@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Filippo Valsorda <valsorda@google.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>

diff --git a/doc/go1.19.html b/doc/go1.19.html
index 8305dececea780562d93ba7720f143366ca63615..51b5a54e167a66b10b1e5ffea9337e14490fdfd6 100644 (file)
--- a/doc/go1.19.html
+++ b/doc/go1.19.html
@@ -92,6 +92,16 @@ Do not send CLs removing the interior tags from such phrases.
   TODO: complete this section
 </p>
 
+<dl id="crypto/tls"><dt><a href="/pkg/crypto/tls/">crypto/tls</a></dt>
+  <dd>
+    <p><!-- CL 400974 -->
+      The <code>tls10default</code> <code>GODEBUG</code> option has been
+      removed. It is still possible to enable TLS 1.0 client-side by setting
+      <code>Config.MinVersion</code>.
+    </p>
+  </dd>
+</dl><!-- crypto/tls -->
+
 <dl id="image/draw"><dt><a href="/pkg/image/draw/">image/draw</a></dt>
   <dd>
     <p><!-- CL 396795 -->

diff --git a/src/crypto/tls/common.go b/src/crypto/tls/common.go
index e6e7598ce97ea13c4fe6934826eac532bd8783fa..59b41effbe166e31300f03a4052a51974ddce0b8 100644 (file)
--- a/src/crypto/tls/common.go
+++ b/src/crypto/tls/common.go
@@ -18,7 +18,6 @@ import (
        "crypto/x509"
        "errors"
        "fmt"
-       "internal/godebug"
        "io"
        "net"
        "strings"
@@ -974,9 +973,6 @@ var supportedVersions = []uint16{
        VersionTLS10,
 }
 
-// debugEnableTLS10 enables TLS 1.0. See issue 45428.
-var debugEnableTLS10 = godebug.Get("tls10default") == "1"
-
 // roleClient and roleServer are meant to call supportedVersions and parents
 // with more readability at the callsite.
 const roleClient = true
@@ -985,7 +981,7 @@ const roleServer = false
 func (c *Config) supportedVersions(isClient bool) []uint16 {
        versions := make([]uint16, 0, len(supportedVersions))
        for _, v := range supportedVersions {
-               if (c == nil || c.MinVersion == 0) && !debugEnableTLS10 &&
+               if (c == nil || c.MinVersion == 0) &&
                        isClient && v < VersionTLS12 {
                        continue
                }

diff --git a/src/crypto/tls/handshake_server_test.go b/src/crypto/tls/handshake_server_test.go
index 16a22542ebf502b85ec866519018a5e9b761f81d..1f3a174d582e0a8249f871644f9e525d424aa08e 100644 (file)
--- a/src/crypto/tls/handshake_server_test.go
+++ b/src/crypto/tls/handshake_server_test.go
@@ -400,16 +400,6 @@ func TestVersion(t *testing.T) {
        if err == nil {
                t.Fatalf("expected failure to connect with TLS 1.0/1.1")
        }
-
-       defer func(old bool) { debugEnableTLS10 = old }(debugEnableTLS10)
-       debugEnableTLS10 = true
-       _, _, err = testHandshake(t, clientConfig, serverConfig)
-       if err != nil {
-               t.Fatalf("handshake failed: %s", err)
-       }
-       if state.Version != VersionTLS11 {
-               t.Fatalf("incorrect version %x, should be %x", state.Version, VersionTLS11)
-       }
 }
 
 func TestCipherSuitePreference(t *testing.T) {