jiebi/CodeConvo huggingface dataset:
// TolerationsTolerateTaintsWithFilter checks if given tolerations tolerates // all the taints that apply to the filter in given taint list. <ins> // DEPRECATED: Please use FindMatchingUntoleratedTaint instead. </ins> func TolerationsTolerateTaintsWithFilter(tolerations []v1.Toleration, taints []v1.Taint, applyFilter taintsFilterFunc) bool { <del> if len(taints) == 0 { return true } </del> <ins> _, isUntolerated := FindMatchingUntoleratedTaint(taints, tolerations, applyFilter) return !isUntolerated } </ins> <del> for i := range taints { if applyFilter != nil && !applyFilter(&taints[i]) { continue </del> <ins> // FindMatchingUntoleratedTaint checks if the given tolerations tolerates // all the filtered taints, and returns the first taint without a toleration func FindMatchingUntoleratedTaint(taints []v1.Taint, tolerations []v1.Toleration, inclusionFilter taintsFilterFunc) (v1.Taint, bool) { filteredTaints := getFilteredTaints(taints, inclusionFilter) for _, taint := range filteredTaints { if !TolerationsTolerateTaint(tolerations, &taint) { return taint, true </ins> } <ins> } return v1.Taint{}, false } </ins> <del> if !TolerationsTolerateTaint(tolerations, &taints[i]) { return false </del> <ins> // getFilteredTaints returns a list of taints satisfying the filter predicate func getFilteredTaints(taints []v1.Taint, inclusionFilter taintsFilterFunc) []v1.Taint { if inclusionFilter == nil { return taints } filteredTaints := []v1.Taint{} for _, taint := range taints { if !inclusionFilter(&taint) { continue </ins> } <ins> filteredTaints = append(filteredTaints, taint) </ins> } <del> return true </del> <ins> return filteredTaints </ins> } // Returns true and list of Tolerations matching all Taints if all are tolerated, or false otherwise.
return framework.NewStatus(framework.Error, err.Error()) } <del> if v1helper.TolerationsTolerateTaintsWithFilter(pod.Spec.Tolerations, taints, func(t *v1.Taint) bool { </del> <ins> filterPredicate := func(t *v1.Taint) bool { </ins> // PodToleratesNodeTaints is only interested in NoSchedule and NoExecute taints. return t.Effect == v1.TaintEffectNoSchedule || t.Effect == v1.TaintEffectNoExecute <del> }) { </del> <ins> } taint, isUntolerated := v1helper.FindMatchingUntoleratedTaint(taints, pod.Spec.Tolerations, filterPredicate) if !isUntolerated { </ins> return nil } <del> return framework.NewStatus(framework.UnschedulableAndUnresolvable, ErrReasonNotMatch) </del> <ins> errReason := fmt.Sprintf("node(s) had taint {%s: %s}, that the pod didn't tolerate", taint.Key, taint.Value) return framework.NewStatus(framework.UnschedulableAndUnresolvable, errReason) </ins> } // postFilterState computed at PostFilter and used at Score.
wantStatus *framework.Status }{ { <del> name:       "A pod having no tolerations can't be scheduled onto a node with nonempty taints", pod:        podWithTolerations("pod1", []v1.Toleration{}), node:       nodeWithTaints("nodeA", []v1.Taint{{Key: "dedicated", Value: "user1", Effect: "NoSchedule"}}), wantStatus: unschedulable, </del> <ins> name: "A pod having no tolerations can't be scheduled onto a node with nonempty taints", pod:  podWithTolerations("pod1", []v1.Toleration{}), node: nodeWithTaints("nodeA", []v1.Taint{{Key: "dedicated", Value: "user1", Effect: "NoSchedule"}}), wantStatus: framework.NewStatus(framework.UnschedulableAndUnresolvable, "node(s) had taint {dedicated: user1}, that the pod didn't tolerate"), </ins> }, { name: "A pod which can be scheduled on a dedicated node assigned to user1 with effect NoSchedule",
node: nodeWithTaints("nodeA", []v1.Taint{{Key: "dedicated", Value: "user1", Effect: "NoSchedule"}}), }, { <del> name:       "A pod which can't be scheduled on a dedicated node assigned to user2 with effect NoSchedule", pod:        podWithTolerations("pod1", []v1.Toleration{{Key: "dedicated", Operator: "Equal", Value: "user2", Effect: "NoSchedule"}}), node:       nodeWithTaints("nodeA", []v1.Taint{{Key: "dedicated", Value: "user1", Effect: "NoSchedule"}}), wantStatus: unschedulable, </del> <ins> name: "A pod which can't be scheduled on a dedicated node assigned to user2 with effect NoSchedule", pod:  podWithTolerations("pod1", []v1.Toleration{{Key: "dedicated", Operator: "Equal", Value: "user2", Effect: "NoSchedule"}}), node: nodeWithTaints("nodeA", []v1.Taint{{Key: "dedicated", Value: "user1", Effect: "NoSchedule"}}), wantStatus: framework.NewStatus(framework.UnschedulableAndUnresolvable, "node(s) had taint {dedicated: user1}, that the pod didn't tolerate"), </ins> }, { name: "A pod can be scheduled onto the node, with a toleration uses operator Exists that tolerates the taints on the node",
{ name: "A pod has a toleration that keys and values match the taint on the node, but (non-empty) effect doesn't match, " + "can't be scheduled onto the node", <del> pod:        podWithTolerations("pod1", []v1.Toleration{{Key: "foo", Operator: "Equal", Value: "bar", Effect: "PreferNoSchedule"}}), node:       nodeWithTaints("nodeA", []v1.Taint{{Key: "foo", Value: "bar", Effect: "NoSchedule"}}), wantStatus: unschedulable, </del> <ins> pod:  podWithTolerations("pod1", []v1.Toleration{{Key: "foo", Operator: "Equal", Value: "bar", Effect: "PreferNoSchedule"}}), node: nodeWithTaints("nodeA", []v1.Taint{{Key: "foo", Value: "bar", Effect: "NoSchedule"}}), wantStatus: framework.NewStatus(framework.UnschedulableAndUnresolvable, "node(s) had taint {foo: bar}, that the pod didn't tolerate"), </ins> }, { name: "The pod has a toleration that keys and values match the taint on the node, the effect of toleration is empty, " +
}, { name: "The pod has a toleration that key and value don't match the taint on the node, " + <del> "but the effect of taint on node is PreferNochedule. Pod can be scheduled onto the node", </del> <ins> "but the effect of taint on node is PreferNoSchedule. Pod can be scheduled onto the node", </ins> pod:  podWithTolerations("pod1", []v1.Toleration{{Key: "dedicated", Operator: "Equal", Value: "user2", Effect: "NoSchedule"}}), node: nodeWithTaints("nodeA", []v1.Taint{{Key: "dedicated", Value: "user1", Effect: "PreferNoSchedule"}}), }, { name: "The pod has no toleration, " + <del> "but the effect of taint on node is PreferNochedule. Pod can be scheduled onto the node", </del> <ins> "but the effect of taint on node is PreferNoSchedule. Pod can be scheduled onto the node", </ins> pod:  podWithTolerations("pod1", []v1.Toleration{}), node: nodeWithTaints("nodeA", []v1.Taint{{Key: "dedicated", Value: "user1", Effect: "PreferNoSchedule"}}), },
}, // -- <ins> // k8s.io/kubernetes/pkg/apis/flowcontrol/v1alpha1 gvr("flowcontrol.apiserver.k8s.io", "v1alpha1", "flowschemas"): { Stub:             `{"metadata": {"name": "va1"}, "spec": {"priorityLevelConfiguration": {"name": "name1"}}}`, ExpectedEtcdPath: "/registry/flowschemas/va1", }, // -- // k8s.io/kubernetes/pkg/apis/flowcontrol/v1alpha1 gvr("flowcontrol.apiserver.k8s.io", "v1alpha1", "prioritylevelconfigurations"): { Stub:             `{"metadata": {"name": "conf1"}, "spec": {"type": "Limited", "limited": {"assuredConcurrencyShares":3, "limitResponse": {"type": "Reject"}}}}`, ExpectedEtcdPath: "/registry/prioritylevelconfigurations/conf1", }, // -- </ins> // k8s.io/kubernetes/pkg/apis/storage/v1beta1 gvr("storage.k8s.io", "v1beta1", "volumeattachments"): { Stub:             `{"metadata": {"name": "va2"}, "spec": {"attacher": "gce", "nodeName": "localhost", "source": {"persistentVolumeName": "pv2"}}}`,
OPENSSL_BIN=$(command -v openssl) } <ins> # Query the API server for client certificate authentication capabilities function kube::util::test_client_certificate_authentication_enabled { local output kube::util::test_openssl_installed output=$(echo  | "${OPENSSL_BIN}" s_client -connect "127.0.0.1:${SECURE_API_PORT}" 2> /dev/null  | grep -A3 'Acceptable client certificate CA names') if [[ "${output}" != *"/CN=127.0.0.1"* ]] && [[ "${output}" != *"CN = 127.0.0.1"* ]]; then echo "API server not configured for client certificate authentication" echo "Output of from acceptable client certificate check: ${output}" exit 1 fi } </ins> # creates a client CA, args are sudo, dest-dir, ca-id, purpose # purpose is dropped in after "key encipherment", you usually want # '"client auth"'
--storage-media-type="${KUBE_TEST_API_STORAGE_TYPE-}"  --cert-dir="${TMPDIR:-/tmp/}"  --service-cluster-ip-range="10.0.0.0/24"  <ins> --client-ca-file=hack/testdata/ca.crt  </ins> --token-auth-file=hack/testdata/auth-tokens.csv 1>&2 & export APISERVER_PID=$!
<ins> -----BEGIN CERTIFICATE----- MIICpjCCAY4CCQCZBiNB23olFzANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAkx MjcuMC4wLjEwIBcNMjAwNjE0MTk0OTM4WhgPMjI5NDAzMzAxOTQ5MzhaMBQxEjAQ BgNVBAMMCTEyNy4wLjAuMTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB AMxIjMd58IhiiyK4VjmuCWBUZksSs1CcQuo5HSpOqogVZ+vR5mdJDZ56Pw/NSM5c RqOB3cvjGrxYQe/lKvo9D3UmWLcRKtxdlWxCfPekioJ25/dhGOxtBQcjtp/TSqTM txprwT4fvsVwiwaURFoCOivF4xjQFG0K1i3/m7CiMHODy67M1EfJDrM7Vv5XPIuJ VF8HhWBH2HiM25ak34XhxVTX8K97k6wO9OZ5GMqbYuVobTZrSRdiv8s95rkmik6P jn0ePKqSz6cXNXgXqTl11WtsuoGgjOdB8j/noqTF3m3z17sSBqqG/xBFuSFoNceA yBDb9ohbs8oY3NIZzyMrt8MCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAFgcaqRgv qylx4ogL5iUr0K2e/8YzsvH7zLHG6xnr7HxpR/p0lQt3dPlppECZMGDKElbCgU8f xVDdZ3FOxHTJ51Vnq/U5xJo+UOMJ4sS8fEH8cfNliSsvmSKzjxpPKqbCJ7VTnkW8 lonedCPRksnhlD1U8CF21rEjKsXcLoX5PsxlS4DX3PtO0+e8aUh9F4XyZagpejq8 0ttXkWd3IyYrpFRGDlFDxIiKx7pf+mG6JZ/ms6jloBSwwcz/Nkn5FMxiq75bQuOH EV+99S2du/X2bRmD1JxCiMDw8cMacIFBr6BYXsvKOlivwfHBWk8U0f+lVi60jWje PpKFRd1mYuEZgw== -----END CERTIFICATE----- </ins>
// UpdateTransportConfig updates the transport.Config to use credentials // returned by the plugin. func (a *Authenticator) UpdateTransportConfig(c *transport.Config) error { <ins> // If a bearer token is present in the request - avoid the GetCert callback when // setting up the transport, as that triggers the exec action if the server is // also configured to allow client certificates for authentication. For requests // like "kubectl get --token (token) pods" we should assume the intention is to // use the provided token for authentication. if c.HasTokenAuth() { return nil } </ins> c.Wrap(func(rt http.RoundTripper) http.RoundTripper { return &roundTripper{a, rt} })
get(t, http.StatusOK) } <ins> func TestTokenPresentCancelsExecAction(t *testing.T) { a, err := newAuthenticator(newCache(), &api.ExecConfig{ Command:    "./testdata/test-plugin.sh", APIVersion: "client.authentication.k8s.io/v1alpha1", }) if err != nil { t.Fatal(err) } // UpdateTransportConfig returns error on existing TLS certificate callback, unless a bearer token is present in the // transport config, in which case it takes precedence cert := func() (*tls.Certificate, error) { return nil, nil } tc := &transport.Config{BearerToken: "token1", TLS: transport.TLSConfig{Insecure: true, GetCert: cert}} if err := a.UpdateTransportConfig(tc); err != nil { t.Error("Expected presence of bearer token in config to cancel exec action") } } </ins> func TestTLSCredentials(t *testing.T) { now := time.Now()
<ins> #!/usr/bin/env bash # Copyright 2020 The Kubernetes Authors. # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # #     http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. set -o errexit set -o nounset set -o pipefail run_exec_credentials_tests() { set -o nounset set -o errexit kube::log::status "Testing kubectl with configured exec credentials plugin" cat > "${TMPDIR:-/tmp}"/invalid_exec_plugin.yaml << EOF apiVersion: v1 clusters: - cluster: name: test contexts: - context: cluster: test user: invalid_token_user name: test current-context: test kind: Config preferences: {} users: - name: invalid_token_user user: exec: apiVersion: client.authentication.k8s.io/v1beta1 # Any invalid exec credential plugin will do to demonstrate command: ls EOF ### Provided --token should take precedence, thus not triggering the (invalid) exec credential plugin # Pre-condition: Client certificate authentication enabled on the API server kube::util::test_client_certificate_authentication_enabled # Command output=$(kubectl "${kube_flags_with_token[@]:?}" --kubeconfig="${TMPDIR:-/tmp}"/invalid_exec_plugin.yaml get namespace kube-system -o name || true) if [[ "${output}" == "namespace/kube-system" ]]; then kube::log::status "exec credential plugin not triggered since kubectl was called with provided --token" else kube::log::status "Unexpected output when providing --token for authentication - exec credential plugin likely triggered. Output: ${output}" exit 1 fi # Post-condition: None ### Without provided --token, the exec credential plugin should be triggered # Pre-condition: Client certificate authentication enabled on the API server - already checked by positive test above # Command output2=$(kubectl "${kube_flags_without_token[@]:?}" --kubeconfig="${TMPDIR:-/tmp}"/invalid_exec_plugin.yaml get namespace kube-system -o name 2>&1 || true) if [[ "${output2}" =~ "json parse error" ]]; then kube::log::status "exec credential plugin triggered since kubectl was called without provided --token" else kube::log::status "Unexpected output when not providing --token for authentication - exec credential plugin not triggered. Output: ${output2}" exit 1 fi # Post-condition: None rm "${TMPDIR:-/tmp}"/invalid_exec_plugin.yaml set +o nounset set +o errexit } </ins>
# source "${KUBE_ROOT}/hack/lib/test.sh" source "${KUBE_ROOT}/test/cmd/apply.sh" source "${KUBE_ROOT}/test/cmd/apps.sh" <ins> source "${KUBE_ROOT}/test/cmd/authentication.sh" </ins> source "${KUBE_ROOT}/test/cmd/authorization.sh" source "${KUBE_ROOT}/test/cmd/batch.sh" source "${KUBE_ROOT}/test/cmd/certificate.sh"
'-s' "http://127.0.0.1:${API_PORT}" ) <del> # token defined in hack/testdata/auth-tokens.csv kube_flags_with_token=( '-s' "https://127.0.0.1:${SECURE_API_PORT}" '--token=admin-token' '--insecure-skip-tls-verify=true' </del> <ins> kube_flags_without_token=( '-s' "https://127.0.0.1:${SECURE_API_PORT}" '--insecure-skip-tls-verify=true' </ins> ) <ins> # token defined in hack/testdata/auth-tokens.csv kube_flags_with_token=( "${kube_flags_without_token[@]}" '--token=admin-token' ) </ins> if [[ -z "${ALLOW_SKEW:-}" ]]; then kube_flags+=('--match-server-version') kube_flags_with_token+=('--match-server-version')
echo "Running GKE internal configuration script" . "${KUBE_HOME}/bin/gke-internal-configure-helper.sh" gke-internal-master-start <ins> elif [[ -n "${KUBE_BEARER_TOKEN:-}" ]]; then echo "setting up local admin kubeconfig" create-kubeconfig "local-admin" "${KUBE_BEARER_TOKEN}" echo "export KUBECONFIG=/etc/srv/kubernetes/local-admin/kubeconfig" > /etc/profile.d/kubeconfig.sh </ins> fi }
// AfterEach deletes the namespace, after reading its events. func (f *Framework) AfterEach() { <ins> // If BeforeEach never started AfterEach should be skipped. // Currently some tests under e2e/storage have this condition. if !f.beforeEachStarted { return } </ins> RemoveCleanupAction(f.cleanupHandle) <ins> // This should not happen. Given ClientSet is a public field a test must have updated it! // Error out early before any API calls during cleanup. if f.ClientSet == nil { Failf("The framework ClientSet must not be nil at this point") } </ins> // DeleteNamespace at the very end in defer, to avoid any // expectation failures preventing deleting the namespace. defer func() {
# cleanup kubectl delete svc prune-svc 2>&1 "${kube_flags[@]:?}" <ins> ## kubectl apply --prune can prune resources not in the defaulted namespace # Pre-Condition: namespace nsb exists; no POD exists kubectl create ns nsb kube::test::get_object_assert pods "{{range.items}}{{${id_field:?}}}:{{end}}" '' # apply a into namespace nsb kubectl apply --namespace nsb -f hack/testdata/prune/a.yaml "${kube_flags[@]:?}" kube::test::get_object_assert 'pods a -n nsb' "{{${id_field:?}}}" 'a' # apply b with namespace kubectl apply --namespace nsb -f hack/testdata/prune/b.yaml "${kube_flags[@]:?}" kube::test::get_object_assert 'pods b -n nsb' "{{${id_field:?}}}" 'b' # apply --prune must prune a kubectl apply --prune --all -f hack/testdata/prune/b.yaml # check wrong pod doesn't exist output_message=$(! kubectl get pods a -n nsb 2>&1 "${kube_flags[@]:?}") kube::test::if_has_string "${output_message}" 'pods "a" not found' # check right pod exists kube::test::get_object_assert 'pods b -n nsb' "{{${id_field:?}}}" 'b' # cleanup kubectl delete ns nsb ## kubectl apply -n must fail if input file contains namespace other than the one given in -n output_message=$(! kubectl apply -n foo -f hack/testdata/prune/b.yaml 2>&1 "${kube_flags[@]:?}") kube::test::if_has_string "${output_message}" 'the namespace from the provided object "nsb" does not match the namespace "foo".' </ins> ## kubectl apply -f some.yml --force # Pre-condition: no service exists
if err != nil { return err } <ins> if cml.cm.Annotations == nil { cml.cm.Annotations = make(map[string]string) } </ins> cml.cm.Annotations[LeaderElectionRecordAnnotationKey] = string(recordBytes) cml.cm, err = cml.Client.ConfigMaps(cml.ConfigMapMeta.Namespace).Update(cml.cm) return err
if nodeID != "" { return true, nil } <del> // kubelet plugin registration service not implemented is a terminal error, no need to retry if strings.Contains(getNodeInfoError.Error(), "no handler registered for plugin type") { return false, getNodeInfoError </del> <ins> if getNodeInfoError != nil { klog.Warningf("Error calling CSI NodeGetInfo(): %v", getNodeInfoError.Error()) </ins> } // Continue with exponential backoff return false, nil
csipbv1 "github.com/container-storage-interface/spec/lib/go/csi" api "k8s.io/api/core/v1" "k8s.io/apimachinery/pkg/api/resource" <ins> "k8s.io/apimachinery/pkg/util/wait" </ins> "k8s.io/kubernetes/pkg/volume" "k8s.io/kubernetes/pkg/volume/csi/fake" volumetypes "k8s.io/kubernetes/pkg/volume/util/types"
} nodeID, maxVolumePerNode, accessibleTopology, err := client.NodeGetInfo(context.Background()) <del> checkErr(t, tc.mustFail, err) </del> <ins> if tc.mustTimeout { if wait.ErrWaitTimeout.Error() != err.Error() { t.Errorf("should have timed out : %s", tc.name) } } else { checkErr(t, tc.mustFail, err) } </ins> if nodeID != tc.expectedNodeID { t.Errorf("expected nodeID: %v; got: %v", tc.expectedNodeID, nodeID)
exit 1 fi <ins> # Travis continuous build uses a head go release that doesn't report # a version number, so we skip this check on Travis.  Its unnecessary # there anyway. if [ ${TRAVIS} != "true" ]; then GO_VERSION=($(go version)) if [ ${GO_VERSION[2]} < "go1.2" ]; then echo "Detected go version: ${GO_VERSION}." echo "Kubernetes requires go version 1.2 or greater." echo "Please install Go version 1.2 or later" exit 1 fi fi </ins> pushd $(dirname "${BASH_SOURCE}")/.. >/dev/null KUBE_REPO_ROOT="${PWD}" KUBE_TARGET="${KUBE_REPO_ROOT}/output/go"
config.PreFilter.Enabled = append(config.PreFilter.Enabled, f) config.Filter.Enabled = append(config.Filter.Enabled, f) config.PreScore.Enabled = append(config.PreScore.Enabled, f) <del> s := schedulerapi.Plugin{Name: podtopologyspread.Name, Weight: 1} </del> <ins> // Weight is doubled because: // - This is a score coming from user preference. // - It makes its signal comparable to NodeResourcesLeastAllocated. s := schedulerapi.Plugin{Name: podtopologyspread.Name, Weight: 2} </ins> config.Score.Enabled = append(config.Score.Enabled, s) }
{Name: nodepreferavoidpods.Name, Weight: 10000}, {Name: defaultpodtopologyspread.Name, Weight: 1}, {Name: tainttoleration.Name, Weight: 1}, <del> {Name: podtopologyspread.Name, Weight: 1}, </del> <ins> {Name: podtopologyspread.Name, Weight: 2}, </ins> }, }, Reserve: &schedulerapi.PluginSet{
{Name: nodepreferavoidpods.Name, Weight: 10000}, {Name: defaultpodtopologyspread.Name, Weight: 1}, {Name: tainttoleration.Name, Weight: 1}, <del> {Name: podtopologyspread.Name, Weight: 1}, </del> <ins> {Name: podtopologyspread.Name, Weight: 2}, </ins> {Name: noderesources.ResourceLimitsName, Weight: 1}, }, },
{Name: "NodePreferAvoidPods", Weight: 10000}, {Name: "DefaultPodTopologySpread", Weight: 1}, {Name: "TaintToleration", Weight: 1}, <del> {Name: "PodTopologySpread", Weight: 1}, </del> <ins> {Name: "PodTopologySpread", Weight: 2}, </ins> }, "BindPlugin":      {{Name: "DefaultBinder"}}, "ReservePlugin":   {{Name: "VolumeBinding"}},
{Name: "NodePreferAvoidPods", Weight: 10000}, {Name: "DefaultPodTopologySpread", Weight: 1}, {Name: "TaintToleration", Weight: 1}, <del> {Name: "PodTopologySpread", Weight: 1}, </del> <ins> {Name: "PodTopologySpread", Weight: 2}, </ins> }, "ReservePlugin":   {{Name: "VolumeBinding"}}, "UnreservePlugin": {{Name: "VolumeBinding"}},
"k8s.io/apimachinery/pkg/util/sets" ) <del> // ciphers maps strings into tls package cipher constants in // https://golang.org/pkg/crypto/tls/#pkg-constants // to be replaced by tls.CipherSuites() when the project migrates to go1.14. var ciphers = map[string]uint16{ "TLS_RSA_WITH_3DES_EDE_CBC_SHA":           tls.TLS_RSA_WITH_3DES_EDE_CBC_SHA, "TLS_RSA_WITH_AES_128_CBC_SHA":            tls.TLS_RSA_WITH_AES_128_CBC_SHA, "TLS_RSA_WITH_AES_256_CBC_SHA":            tls.TLS_RSA_WITH_AES_256_CBC_SHA, "TLS_RSA_WITH_AES_128_GCM_SHA256":         tls.TLS_RSA_WITH_AES_128_GCM_SHA256, "TLS_RSA_WITH_AES_256_GCM_SHA384":         tls.TLS_RSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA":    tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA":    tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA":     tls.TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA":      tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA":      tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256":   tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384":   tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384": tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305":    tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305, "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305":  tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305, "TLS_AES_128_GCM_SHA256":                  tls.TLS_AES_128_GCM_SHA256, "TLS_CHACHA20_POLY1305_SHA256":            tls.TLS_CHACHA20_POLY1305_SHA256, "TLS_AES_256_GCM_SHA384":                  tls.TLS_AES_256_GCM_SHA384, } </del> <ins> var ( // ciphers maps strings into tls package cipher constants in // https://golang.org/pkg/crypto/tls/#pkg-constants ciphers         = map[string]uint16{} insecureCiphers = map[string]uint16{} ) </ins> <del> // to be replaced by tls.InsecureCipherSuites() when the project migrates to go1.14. var insecureCiphers = map[string]uint16{ "TLS_RSA_WITH_RC4_128_SHA":                tls.TLS_RSA_WITH_RC4_128_SHA, "TLS_RSA_WITH_AES_128_CBC_SHA256":         tls.TLS_RSA_WITH_AES_128_CBC_SHA256, "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA":        tls.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, "TLS_ECDHE_RSA_WITH_RC4_128_SHA":          tls.TLS_ECDHE_RSA_WITH_RC4_128_SHA, "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256": tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256":   tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, </del> <ins> func init() { for _, suite := range tls.CipherSuites() { ciphers[suite.Name] = suite.ID } // keep legacy names for backward compatibility ciphers["TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305"] = tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 ciphers["TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305"] = tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 for _, suite := range tls.InsecureCipherSuites() { insecureCiphers[suite.Name] = suite.ID } </ins> } // InsecureTLSCiphers returns the cipher suites implemented by crypto/tls which have