crypto/x509: Verify on macOS does not return typed errors #56891

wneessen · 2022-11-21T23:13:26Z

What version of Go are you using (`go version`)?

$ go version
go version go1.19.3 darwin/arm64

(But the issue apparently started in 1.18)

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (`go env`)?

Darwin arm64

go env Output

$ go env
GO111MODULE=""

GOARCH="arm64"

GOBIN=""

GOCACHE="/Users/wneessen/Library/Caches/go-build"

GOENV="/Users/wneessen/Library/Application Support/go/env"

GOEXE=""

GOEXPERIMENT=""

GOFLAGS=""

GOHOSTARCH="arm64"

GOHOSTOS="darwin"

GOINSECURE=""

GOMODCACHE="/Users/wneessen/go/pkg/mod"

GONOPROXY=""

GONOSUMDB=""

GOOS="darwin"

GOPATH="/Users/wneessen/go"

GOPRIVATE=""

GOPROXY="https://proxy.golang.org,direct"

GOROOT="/opt/homebrew/Cellar/go/1.19.3/libexec"

GOSUMDB="sum.golang.org"

GOTMPDIR=""

GOTOOLDIR="/opt/homebrew/Cellar/go/1.19.3/libexec/pkg/tool/darwin_arm64"

GOVCS=""

GOVERSION="go1.19.3"

GCCGO="gccgo"

AR="ar"

CC="clang"

CXX="clang++"

CGO_ENABLED="1"

GOMOD="/Users/wneessen/go/src/dev-to-example/go.mod"

GOWORK=""

CGO_CFLAGS="-g -O2"

CGO_CPPFLAGS=""

CGO_CXXFLAGS="-g -O2"

CGO_FFLAGS="-g -O2"

CGO_LDFLAGS="-g -O2"

PKG_CONFIG="pkg-config"

GOGCCFLAGS="-fPIC -arch arm64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/lw/f2psdp2s5fg4z_jw0q58rdgm0000gn/T/go-build119423787=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

package main

import (
	"crypto/x509"
	"errors"
	"fmt"
	"net/http"
	"net/url"
	"reflect"
)

func main() {
	_, err := http.Get("https://expired.badssl.com/")
	if err != nil {
		switch {
		case errors.As(err, &x509.CertificateInvalidError{Reason: x509.Expired}):
			fmt.Printf("Certificate is expired...\n")
		default:
			if ue, ok := err.(*url.Error); ok {
				fmt.Printf("Unwrapped error is type: %s\n", reflect.TypeOf(ue.Err))
			}
		}
	}
}

What did you expect to see?

I expect to see the "Certificate is expired..." output

What did you see instead?

I received this: Unwrapped error is type: *errors.errorString

The text was updated successfully, but these errors were encountered:

wneessen · 2022-11-21T23:15:13Z

On @FiloSottile's advise, I am pinging him and @rolandshoemaker

rolandshoemaker · 2022-11-21T23:53:14Z

This will also be an issue on Windows.

Probably reasonable that we should try to convert to a Go style CertificateInvalidError if we can. I know macOS does provide relatively good insight into trust failures (i.e. https://developer.apple.com/documentation/security/certificate_key_and_trust_services/trust/discovering_why_a_trust_evaluation_failed), not entirely sure about Windows (I assume there is probably something, but 🤷).

rolandshoemaker · 2022-11-21T23:54:08Z

Oh hah, we actually already do this on Windows 🤦.

gopherbot · 2022-11-22T00:50:01Z

Change https://go.dev/cl/452620 mentions this issue: crypto/x509: return typed verification errors on macOS

rolandshoemaker · 2022-11-22T19:44:27Z

@golang/release requesting a freeze exception for this. It's a relatively minor change which simply changes error return types and as such is not very high risk, but should fix a regression that was present in 1.19 that makes macOS behave differently from all other platforms.

bcmills · 2022-11-22T21:30:21Z

should fix a regression that was present in 1.19 that makes macOS behave differently from all other platforms.

If approved for a freeze exception, should it also be backported to 1.19 (on the same grounds)?

dmitshur · 2022-11-22T21:54:33Z

@golang/release requesting a freeze exception for this.

@rolandshoemaker Thanks for letting us know. A freeze exception shouldn't be needed here since this looks like an unintentional bug on macOS rather than new functionality. It's relatively early in the 1.20 freeze and it seems the fix should be safe to land at this stage, so please proceed if that works well for you, otherwise leaving this for 1.21 is fine.

rolandshoemaker · 2022-11-22T22:06:40Z

@dmitshur 👍 sounds good.

rolandshoemaker · 2022-11-22T22:07:16Z

@bcmills yeah I think we should probably backport it to 1.19 as well.

heschi · 2022-11-22T22:11:42Z

Dmitri pointed out in chat that this constitutes an API change and as such would have to be well-justified as a backport.

rolandshoemaker · 2022-12-21T18:02:08Z

@gopherbot please open backport issues. This issue makes macOS behave differently from every other platform, which otherwise return consistent types for verification errors. This was an inadvertent breaking API change introduced in 1.18, and is likely causing silent issues in code that expects consistent behavior across platforms when verifying certificates. Currently working around this requires adding macOS specific code in order to catch specific verification failures.

gopherbot · 2022-12-21T18:02:28Z

Backport issue(s) opened: #57426 (for 1.18), #57427 (for 1.19; manually opened).

Remember to create the cherry-pick CL(s) as soon as the patch is submitted to master, according to https://go.dev/wiki/MinorReleases.

rolandshoemaker · 2022-12-21T18:03:45Z

Did mentioning 1.18 in my comment trick gopherbot into only opening an issue for 1.18?

dmitshur · 2022-12-21T18:05:36Z

Yes, unfortunately (see #27489 and #25574). You'll need to make a 1.19 copy manually.

rolandshoemaker · 2022-12-21T18:14:14Z

Heh, whoops, manual it is.

gopherbot · 2023-01-06T14:47:49Z

Change https://go.dev/cl/460895 mentions this issue: [release-branch.go1.19] crypto/x509: return typed verification errors on macOS

gopherbot · 2023-01-06T14:54:16Z

Change https://go.dev/cl/460896 mentions this issue: [release-branch.go1.18] crypto/x509: return typed verification errors on macOS

… on macOS On macOS return the error code from SecTrustEvaluateWithError, and use it to create typed errors that can be returned from Verify. Updates #56891 Fixes #57426 Change-Id: Ib597ce202abb60702f730e75da583894422e4c14 Reviewed-on: https://go-review.googlesource.com/c/go/+/452620 Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> (cherry picked from commit c9a10d4) Reviewed-on: https://go-review.googlesource.com/c/go/+/460896 Reviewed-by: Carlos Amedee <carlos@golang.org> Auto-Submit: Heschi Kreinick <heschi@google.com> Reviewed-by: Heschi Kreinick <heschi@google.com> Run-TryBot: Filippo Valsorda <filippo@golang.org>

… on macOS On macOS return the error code from SecTrustEvaluateWithError, and use it to create typed errors that can be returned from Verify. Updates #56891 Fixes #57427 Change-Id: Ib597ce202abb60702f730e75da583894422e4c14 Reviewed-on: https://go-review.googlesource.com/c/go/+/452620 Run-TryBot: Roland Shoemaker <roland@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gopher Robot <gobot@golang.org> Reviewed-by: Dmitri Shuralyov <dmitshur@google.com> (cherry picked from commit c9a10d4) Reviewed-on: https://go-review.googlesource.com/c/go/+/460895 Run-TryBot: Filippo Valsorda <filippo@golang.org> Reviewed-by: Heschi Kreinick <heschi@google.com> Auto-Submit: Heschi Kreinick <heschi@google.com> Reviewed-by: Carlos Amedee <carlos@golang.org>

Only falls back to macOS-specific x509 error assertion if the initial typed assertion failed. Fixes test failure when running with Go 1.20, 1.19.5 or 1.18.10 due to golang/go#56891

* CBG-2608: update websocket implementation * CBG-1901: Update ISGR/Blip to nhooyr.io/websocket (#5421) * Update ISGR/Blip to nhooyr.io/websocket * Fix manifest path * Update manifest for couchbasedeps compress * Bump go-blip manifest * CBG-2242: fix errors.As in tests (#5739) * errors as fix * Assert on typed x509 error first before macOS-specific fallback (#6011) Only falls back to macOS-specific x509 error assertion if the initial typed assertion failed. Fixes test failure when running with Go 1.20, 1.19.5 or 1.18.10 due to golang/go#56891 * missed dependency upgrades to json iterator, and reflect to stop panics --------- Co-authored-by: Ben Brooks <ben.brooks@couchbase.com>

rolandshoemaker added this to the Go1.21 milestone Nov 21, 2022

rolandshoemaker added the NeedsFix The path to resolution is known, but the work has not been done. label Nov 21, 2022

rolandshoemaker changed the title ~~crypto/x509: 1.18+ on macOS not returning typed errors for certificate errors (i. e. expired certificate)~~ crypto/x509: Verify on macOS does not return typed errors Nov 21, 2022

seankhliao added the OS-Darwin label Nov 22, 2022

rolandshoemaker changed the title ~~crypto/x509: Verify on macOS does not return typed errors~~ crypto/x509: Verify on macOS does not return typed errors [freeze exception] Nov 22, 2022

dmitshur changed the title ~~crypto/x509: Verify on macOS does not return typed errors [freeze exception]~~ crypto/x509: Verify on macOS does not return typed errors Nov 22, 2022

gopherbot mentioned this issue Dec 21, 2022

crypto/x509: Verify on macOS does not return typed errors [1.18 backport] #57426

Closed

rolandshoemaker mentioned this issue Dec 21, 2022

crypto/x509: Verify on macOS does not return typed errors [1.19 backport] #57427

Closed

gopherbot closed this as completed in c9a10d4 Dec 21, 2022

dmitshur modified the milestones: Go1.21, Go1.20 Dec 21, 2022

bbrks mentioned this issue Jan 11, 2023

Assert on typed x509 error first before macOS-specific fallback couchbase/sync_gateway#6011

Merged

yanggangtony mentioned this issue Jan 13, 2023

build: bump golang 1.19.4 -> 1.19.5 open-policy-agent/opa#5557

Merged

This was referenced Feb 6, 2023

crypto/x509: go1.18 stops returning typed errors when using system roots on darwin #52010

Closed

Bug 2097830: macOS: certificate is untrusted error openshift/oc#1207

Closed

golang locked and limited conversation to collaborators Jan 6, 2024

gopherbot added the FrozenDueToAge label Jan 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

crypto/x509: Verify on macOS does not return typed errors #56891

crypto/x509: Verify on macOS does not return typed errors #56891

wneessen commented Nov 21, 2022

wneessen commented Nov 21, 2022

rolandshoemaker commented Nov 21, 2022

rolandshoemaker commented Nov 21, 2022

gopherbot commented Nov 22, 2022

rolandshoemaker commented Nov 22, 2022

bcmills commented Nov 22, 2022

dmitshur commented Nov 22, 2022

rolandshoemaker commented Nov 22, 2022

rolandshoemaker commented Nov 22, 2022

heschi commented Nov 22, 2022

rolandshoemaker commented Dec 21, 2022

gopherbot commented Dec 21, 2022 •

edited by dmitshur

rolandshoemaker commented Dec 21, 2022

dmitshur commented Dec 21, 2022

rolandshoemaker commented Dec 21, 2022

gopherbot commented Jan 6, 2023

gopherbot commented Jan 6, 2023

crypto/x509: Verify on macOS does not return typed errors #56891

crypto/x509: Verify on macOS does not return typed errors #56891

Comments

wneessen commented Nov 21, 2022

What version of Go are you using (go version)?

Does this issue reproduce with the latest release?

What operating system and processor architecture are you using (go env)?

What did you do?

What did you expect to see?

What did you see instead?

wneessen commented Nov 21, 2022

rolandshoemaker commented Nov 21, 2022

rolandshoemaker commented Nov 21, 2022

gopherbot commented Nov 22, 2022

rolandshoemaker commented Nov 22, 2022

bcmills commented Nov 22, 2022

dmitshur commented Nov 22, 2022

rolandshoemaker commented Nov 22, 2022

rolandshoemaker commented Nov 22, 2022

heschi commented Nov 22, 2022

rolandshoemaker commented Dec 21, 2022

gopherbot commented Dec 21, 2022 • edited by dmitshur

rolandshoemaker commented Dec 21, 2022

dmitshur commented Dec 21, 2022

rolandshoemaker commented Dec 21, 2022

gopherbot commented Jan 6, 2023

gopherbot commented Jan 6, 2023

What version of Go are you using (`go version`)?

What operating system and processor architecture are you using (`go env`)?

gopherbot commented Dec 21, 2022 •

edited by dmitshur