crypto/tls: report TLS version in ConnectionState.

Fixes #7231.

LGTM=bradfitz
R=golang-codereviews, bradfitz
CC=golang-codereviews
https://golang.org/cl/68250043

diff --git a/src/pkg/crypto/tls/common.go b/src/pkg/crypto/tls/common.go
index 661d38e01598797adc7c6e51601ee1725e2e6e63..0f59f702f8b7067c43f6dfe3004c5ed3bfded382 100644 (file)
--- a/src/pkg/crypto/tls/common.go
+++ b/src/pkg/crypto/tls/common.go
@@ -155,6 +155,7 @@ var supportedClientCertSignatureAlgorithms = []signatureAndHash{
 
 // ConnectionState records basic TLS details about the connection.
 type ConnectionState struct {
+       Version                    uint16                // TLS version used by the connection (e.g. VersionTLS12)
        HandshakeComplete          bool                  // TLS handshake is complete
        DidResume                  bool                  // connection resumes a previous TLS connection
        CipherSuite                uint16                // cipher suite in use (TLS_RSA_WITH_RC4_128_SHA, ...)

diff --git a/src/pkg/crypto/tls/conn.go b/src/pkg/crypto/tls/conn.go
index c33549c9efffa3ee83d17b6f6d21e0eaef213483..f1bb3f613d1115159e2ea891310d1cb08c7816ad 100644 (file)
--- a/src/pkg/crypto/tls/conn.go
+++ b/src/pkg/crypto/tls/conn.go
@@ -969,6 +969,7 @@ func (c *Conn) ConnectionState() ConnectionState {
        var state ConnectionState
        state.HandshakeComplete = c.handshakeComplete
        if c.handshakeComplete {
+               state.Version = c.vers
                state.NegotiatedProtocol = c.clientProtocol
                state.DidResume = c.didResume
                state.NegotiatedProtocolIsMutual = !c.clientProtocolFallback

diff --git a/src/pkg/crypto/tls/handshake_server_test.go b/src/pkg/crypto/tls/handshake_server_test.go
index 9ba155fc5f5d8645d4f8724aaf73852f2b755ae8..c3e36785b5d0fff4a0413d934b91372d12e73ab7 100644 (file)
--- a/src/pkg/crypto/tls/handshake_server_test.go
+++ b/src/pkg/crypto/tls/handshake_server_test.go
@@ -195,6 +195,23 @@ func testHandshake(clientConfig, serverConfig *Config) (state ConnectionState, e
        return
 }
 
+func TestVersion(t *testing.T) {
+       serverConfig := &Config{
+               Certificates: testConfig.Certificates,
+               MaxVersion:   VersionTLS11,
+       }
+       clientConfig := &Config{
+               InsecureSkipVerify: true,
+       }
+       state, err := testHandshake(clientConfig, serverConfig)
+       if err != nil {
+               t.Fatalf("handshake failed: %s", err)
+       }
+       if state.Version != VersionTLS11 {
+               t.Fatalf("Incorrect version %x, should be %x", state.Version, VersionTLS11)
+       }
+}
+
 func TestCipherSuitePreference(t *testing.T) {
        serverConfig := &Config{
                CipherSuites: []uint16{TLS_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA},