net/http: return error from Serve if http2.ConfigureServer returns an error

In https://golang.org/cl/15860 http2.ConfigureServer was changed to
return an error if explicit CipherSuites are listed and they're not
compliant with the HTTP/2 spec.

This is the net/http side of the change, to look at the return value
from ConfigureServer and propagate it in Server.Serve.

h2_bundle.go will be updated in a future CL. There are too many other
http2 changes pending to be worth updating it now. Instead,
h2_bundle.go is minimally updated by hand in this CL so at least the
net/http change will compile.

Updates #12895

Change-Id: I4df7a097faff2d235742c2d310c333bd3fd5c08e
Reviewed-on: https://go-review.googlesource.com/16065
Reviewed-by: Andrew Gerrand <adg@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

diff --git a/src/net/http/h2_bundle.go b/src/net/http/h2_bundle.go
index b3ef7157c71af5e03b9f7dac05f3f375981f3576..68e6d798615fe7903ff9a0b83a5d5e3db0147ecf 100644 (file)
--- a/src/net/http/h2_bundle.go
+++ b/src/net/http/h2_bundle.go
@@ -1815,7 +1815,7 @@ func (s *http2Server) maxConcurrentStreams() uint32 {
 // The configuration conf may be nil.
 //
 // ConfigureServer must be called before s begins serving.
-func http2ConfigureServer(s *Server, conf *http2Server) {
+func http2ConfigureServer(s *Server, conf *http2Server) error {
        if conf == nil {
                conf = new(http2Server)
        }
@@ -1861,6 +1861,7 @@ func http2ConfigureServer(s *Server, conf *http2Server) {
        }
        s.TLSNextProto[http2NextProtoTLS] = protoHandler
        s.TLSNextProto["h2-14"] = protoHandler
+       return nil // temporary manual edit to h2_bundle.go, to be deleted once we update from x/net again
 }
 
 func (srv *http2Server) handleConn(hs *Server, c net.Conn, h Handler) {

diff --git a/src/net/http/server.go b/src/net/http/server.go
index dc4f100e014a26f2cc7bc7da6f38cc806f1f3225..a2245fe6bfc956c9a67ced3bd1c8c14d578c13d4 100644 (file)
--- a/src/net/http/server.go
+++ b/src/net/http/server.go
@@ -1808,6 +1808,7 @@ type Server struct {
 
        disableKeepAlives int32     // accessed atomically.
        nextProtoOnce     sync.Once // guards initialization of TLSNextProto in Serve
+       nextProtoErr      error
 }
 
 // A ConnState represents the state of a client connection to a server.
@@ -1898,6 +1899,10 @@ func (srv *Server) Serve(l net.Listener) error {
        defer l.Close()
        var tempDelay time.Duration // how long to sleep on accept failure
        srv.nextProtoOnce.Do(srv.setNextProtoDefaults)
+       if srv.nextProtoErr != nil {
+               // Error from http2 ConfigureServer (e.g. bad ciphersuites)
+               return srv.nextProtoErr
+       }
        for {
                rw, e := l.Accept()
                if e != nil {
@@ -2054,11 +2059,13 @@ func (srv *Server) ListenAndServeTLS(certFile, keyFile string) error {
        return srv.Serve(tlsListener)
 }
 
+// setNextProtoDefaults configures HTTP/2.
+// It must only be called via srv.nextProtoOnce.
 func (srv *Server) setNextProtoDefaults() {
        // Enable HTTP/2 by default if the user hasn't otherwise
        // configured their TLSNextProto map.
        if srv.TLSNextProto == nil {
-               http2ConfigureServer(srv, nil)
+               srv.nextProtoErr = http2ConfigureServer(srv, nil)
        }
 }