Go TLS And Compiler Safety Notes For Data Services

The Go project recorded 62 commits across 342 files in the review window. For engineers running Go data services, the useful signals are stricter TLS parsing, compiler correctness fixes on several targets, and more reliable coverage for selected dependencies.

The TLS parser now rejects known extensions when they appear in handshake messages where the protocol does not allow them. The extension placement change adds explicit rejection paths for EncryptedExtensions, TLS 1.3 NewSessionTicket, CertificateRequest, and Certificate messages. Unknown extensions can still be ignored where the protocol permits that behavior, but a known extension no longer gets the same treatment merely because it arrived in the wrong context.

That distinction matters at ingestion edges. A collector, gateway, or metadata service may open TLS sessions to endpoints outside its direct control. Rejecting an invalid transcript early reduces ambiguity between peers and avoids accepting a message shape that Go already knows is forbidden.

A separate ECH length fix changes length arithmetic in parseECHConfigList so a crafted 65,538 byte payload cannot wrap a 16 bit calculation and trap the parser in an infinite loop. The commit notes that common delivery paths cap these payloads at 65,535 bytes, so regular clients are not considered exposed. Systems that load ECH configuration bytes from another discovery or configuration channel still gain a precise failure instead of a stuck parser.

The port parsing change makes direct connections and proxy tunnels derive tls.Config.ServerName through net.SplitHostPort. The relevant work sits in src/net/http/transport.go, one of the most frequently changed files in this window.

This is not a throughput improvement. It removes two implementations of the same certificate identity rule. That makes malformed addresses fail through one path and keeps proxy traffic from applying a subtly different host extraction rule than direct traffic. Teams with custom transports should still set ServerName explicitly when the certificate name is intentionally different from the dial target.

The nearby HTTP/3 registration rework is more provisional. It lets tests provide a fake packet network and passes a prepared TLS configuration into the external HTTP/3 transport. It is one half of a paired change with x/net/http3, and it temporarily removes HTTP/3 support from ListenAndServeTLS while tests use ServeTLS. Anyone testing Go at tip should update the standard library and x/net sides together.

The MIPS work addresses a concrete silent corruption path. Before the multiply and divide result rewrite, results could remain in the special HI and LO registers. Spilling one of those values required REGTMP. A stack frame too large for a 16 bit offset could also require REGTMP to materialize the spill address, clobbering the value before the store.

Results now move into general registers as part of the operation. The following allocator cleanup removes HI and LO support from register allocation. The size of the change is visible in the generated opGen.go and the MIPS operation definitions in MIPSOps.go. This favors a simpler allocator contract. The commits make no performance claim, so the practical reason to care is correct output on large stack frames.

At the newer end of the architecture range, an experimental SIMD jump table fix truncates variable uint64 indices to uint8 before dispatch. The table has 256 entries. Values above 255 could previously jump outside it and corrupt control flow, while the spectre=ret fallback selected case 255. The fix matters only to code built with the SIMD experiment today, but the failure mode justified correcting before wider use.

The dependency coverage correction fixes builds where -coverpkg selects a dependency but excludes the main package. The selection path returned before adding the registration hook to the main package, so the covered dependency could not emit its metadata and counters. src/cmd/go/internal/load/pkg.go now retains the main package in registration only mode.

This helps tests that isolate shared connector, codec, or protocol packages behind a small command. Coverage can now describe the dependency actually under test without forcing the command package into the measurement set.

The vet integration test update also makes the test suite enumerate every analyzer in vet.Suite and supplies missing fixtures. This is coverage of the vet tool itself, not a new analyzer or a new warning policy. Its value is preventing analyzers from entering the suite without a minimal end to end check.

  • These changes are on master, not a tagged release. Check the eventual release notes before changing production toolchains.

  • MIPS users should prioritize the compiler fixes, especially for binaries with large stack frames. Other teams can treat that work as target specific.

  • HTTP/3 integration still spans the Go repository and x/net. Keep those revisions aligned during tip testing, and do not assume ListenAndServeTLS support until the temporary gap closes.