http.TimeFormat hard-codes GMT and is documented that:

> TimeFormat is the time format to use when generating times in HTTP
> headers. It is like time.RFC1123 but hard-codes GMT as the time
> zone. The time being formatted must be in UTC for Format to generate
> the correct format.

These two users weren't UTC-ifying the time.Time first.

Fixes golang/go#25015

Change-Id: I82be01856260e363361137fd9651b1940f439f21
Reviewed-on: https://go-review.googlesource.com/113795
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>

Change-Id: I889a02587b39e448ccdc5d723183ab550104ec5b
Reviewed-on: https://go-review.googlesource.com/112816Reviewed-by: Ian Lance Taylor <iant@golang.org>

When a Content-Type that triggers content sniffing in old (but still in
significant use) browsers is sent, add the
X-Content-Type-Options: nosniff header, unless explicitly disabled.

Expose httpguts.SniffedContentType for use in the HTTP 1 implementation.

Will be tested by net/http.TestNoSniffHeader_h2.

Updates golang/go#24513

Change-Id: Id1ffea867a496393cb52c5a9f45af97d4b2fcf12
Reviewed-on: https://go-review.googlesource.com/112015
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Change-Id: Ic81b9ab72be34a95e677a1dd40e970f86109eefc
Reviewed-on: https://go-review.googlesource.com/111935
Run-TryBot: Mikio Hara <mikioh.mikioh@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Dynamic table size updates must occur at the beginning of the first
header block.

Updates golang/go#25023

Change-Id: I7fd4f191da0a97cab26666545191460a6f6c1433
Reviewed-on: https://go-review.googlesource.com/111681Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

httplex was the original package name for shared code between net/http
and x/net/http2, but its name was too specific, and http/httpguts was
added later for other shared code.

We discussed merging httplex into httpguts at the time, but it didn't
happen earlier. This finishes the move.

Updates golang/go#23908

Change-Id: Ic7d6f39e584ca579d34b5ef5ec6a0c002a38a83c
Reviewed-on: https://go-review.googlesource.com/111875Reviewed-by: Andrew Bonventre <andybons@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Fixes golang/go#25230

Change-Id: Ie16295552fcd414555153626f62170ffb7bdba1d
Reviewed-on: https://go-review.googlesource.com/111835Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

This commit adds the js/wasm architecture
to the internal/nettest package.

js/wasm currently uses the same fake networking as nacl.
Support for real networking will be added later.

Related to https://go-review.googlesource.com/c/go/+/109995

Change-Id: Ic914175374d7588dcb3c078da0e0e71c88323d1a
Reviewed-on: https://go-review.googlesource.com/110895Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

If conn closes but the request cancel select is still blocked
we must close the connection wait channel.

Updates golang/go#24776 (needs bundle into std for fix)

Change-Id: I7e3ffdf2dd9b127727e24fe262b2f4c5d96fc184
Reviewed-on: https://go-review.googlesource.com/108415
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Updates golang/go#23071

Change-Id: Ifef79e077801422eb273af3e5a541c85c63bfce4
Reviewed-on: https://go-review.googlesource.com/107575Reviewed-by: Nigel Tao <nigeltao@golang.org>

The header X-Content-Type-Options:nosniff is an explicit directive that
content-type should not be sniffed.

----

https://fetch.spec.whatwg.org/#x-content-type-options-header
defines the X-Content-Type-Options header.

["Polyglots: Crossing Origins by Crossing Formats"](http://citeseerx.ist.psu.edu
/viewdoc/download?doi=10.1.1.905.2946&rep=rep1&type=pdf)
explains Polyglot attacks in more detail.

Fixes golang/go#24795

Change-Id: Ibcc2d6a561394392ad0bf112eecc01c43823a2a2
Reviewed-on: https://go-review.googlesource.com/107295Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Updates golang/go#23071

Change-Id: I73d7302c5bde4441aa824093fdcce52e8bb51e31
Reviewed-on: https://go-review.googlesource.com/107379
Run-TryBot: Kunpei Sakai <namusyaka@gmail.com>
Reviewed-by: Nigel Tao <nigeltao@golang.org>

Updates golang/go#23071

Change-Id: I07aae04757e83a3a03681a2ce92e4cab194ef64a
Reviewed-on: https://go-review.googlesource.com/107198
Run-TryBot: Kunpei Sakai <namusyaka@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Nigel Tao <nigeltao@golang.org>

Introduce a common package x/net/http/httpguts which can be vendored by
net/http to share detail implementations of the HTTP specification with
x/net/http2.

Updates golang/go#23908

Change-Id: Id5a2d51e05135436cf406c4c4d1b13fca7f84a32
Reviewed-on: https://go-review.googlesource.com/104042Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

See:
https://html.spec.whatwg.org/multipage/parsing.html#parsing-main-intemplate

Updates golang/go#23071

Change-Id: I36529b7cf5d2adf159ed5c471fba9f67890b7eb9
Reviewed-on: https://go-review.googlesource.com/94838
Run-TryBot: Kunpei Sakai <namusyaka@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Nigel Tao <nigeltao@golang.org>

This change factors out the code related to SOCKS protocol version 5
from the golang/x/net/proxy package and provides new SOCKS-specific
API to fix the following:
- inflexbility of forward proxy connection setup; e.g., no support for
  context-based deadline or canceling, no support for dial deadline,
  no support for working with external authentication mechanisms,
- useless error values for troubleshooting.

The new package socks is supposed to be used by the net/http package
of standard library and proxy package of golang.org/x/net repository.

Fixes golang/go#11682.
Updates golang/go#17759.
Updates golang/go#19354.
Updates golang/go#19688.
Fixes golang/go#21333.

Change-Id: I24098ac8522dcbdceb03d534147c5101ec9e7350
Reviewed-on: https://go-review.googlesource.com/38278
Run-TryBot: Mikio Hara <mikioh.mikioh@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

The net.Listener interface specifies that on Close:
// Any blocked Accept operations will be unblocked and return errors.

Fixes golang/go#24458

Change-Id: I4a61a79db9579a40b536aa65c8077da87aa25156
Reviewed-on: https://go-review.googlesource.com/101535Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Change-Id: I008840a981179bb9397735b88155d7476ae76599
Reviewed-on: https://go-review.googlesource.com/101296Reviewed-by: Ian Gudger <igudger@google.com>

This change introduces OPTResourse type to support DNS messages
containing various extension options as defined in RFC 6891.
Parsing and building OPT pseudo records requires allocations like TXT
records.

Also adds DNSSECAllowed, ExtendedRCode and SetEDNS0 methods to
ResourceHeader for convenience.

Updates golang/go#6464.
Updates golang/go#16218.

Change-Id: Ib72cea277201e4122c6b5effa320084ff351c886
Reviewed-on: https://go-review.googlesource.com/47170Reviewed-by: Ian Gudger <igudger@google.com>

This change implements support for extended echo request and reply
messages, and interface identification object that can be used to test
the status of a probed interface via a proxy interface from a probing
interface as defined in RFC 8335.

It's package user's responsibility to make a complete RFC-compliant
PROBE initiator implementation using ipv4, ipv6 and icmp packages of
x/net repository.

Fixes golang/go#24440.

Change-Id: I87ab8a7581c4d41a0c579805b0e3043e48ac85f0
Reviewed-on: https://go-review.googlesource.com/63999Reviewed-by: Ian Lance Taylor <iant@golang.org>

Updates golang/go#24440.

Change-Id: Idbe22ca853ea4771bb979782ef3bac8b03c59b87
Reviewed-on: https://go-review.googlesource.com/63998
Run-TryBot: Mikio Hara <mikioh.mikioh@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Updates golang/go#24440.

Change-Id: Icd7dbb9b6748ba8dd165eec1c0021650b7f4d97d
Reviewed-on: https://go-review.googlesource.com/63997
Run-TryBot: Mikio Hara <mikioh.mikioh@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Updates golang/go#24440.

Change-Id: Ic56bb1add57831d6c94f148d209417be5aa22cb2
Reviewed-on: https://go-review.googlesource.com/63996
Run-TryBot: Mikio Hara <mikioh.mikioh@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

This change reorganizes the existing test cases for supporting new
messages and extension in upcoming CLs. It also renames ping_test.go
to diag_test.go for clarification.

Updates golang/go#24440.

Change-Id: I5753a2ddbe76423d996a37f583fcf32b65d380e9
Reviewed-on: https://go-review.googlesource.com/63995Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Updates golang/go#10622

Change-Id: Iadf0ff0fd223a315130941464040aef5e71f6130
Reviewed-on: https://go-review.googlesource.com/100055
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Matthew Dempsky <mdempsky@google.com>

Updates golang/go#24185

Change-Id: Ifbd5b9c8c8bb11635c49a390a8deda8bfed8e849
Reviewed-on: https://go-review.googlesource.com/100685Reviewed-by: Ian Lance Taylor <iant@golang.org>

Previously, we only accepted a single string for TXT records and then
chunked it into 255 byte segments. This is wrong. TXT records are a
sequence of strings, each up to 255 bytes.

Updates golang/go#24288

Change-Id: Ib2c085ec127ccecf0c7bda930100b667cabc1f4b
Reviewed-on: https://go-review.googlesource.com/100196Reviewed-by: Matthew Dempsky <mdempsky@google.com>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Fixes golang/go#24346

Change-Id: I6b32d79135c0843d62425f4cc4c18f5a0eb9efd3
Reviewed-on: https://go-review.googlesource.com/100155Reviewed-by: Ian Lance Taylor <iant@golang.org>

CL generated mechanically with github.com/mdempsky/unconvert.

Change-Id: I22eea0b991462dd00f3fa28073a8b886e19bc068
Reviewed-on: https://go-review.googlesource.com/100095
Run-TryBot: Kunpei Sakai <namusyaka@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Alberto Donizetti <alb.donizetti@gmail.com>

This change protects fields mutated by Trace methods with a mutex.
In particular it fixes races caused by concurrent calls to IsError,
and viewing active traces in /debug/requests.

Includes changes from CL/67730.

Updates golang/go#24231

Change-Id: I07db54c2642efe0ea0e3ffeb54ec796ae51e70ef
Reviewed-on: https://go-review.googlesource.com/98535
Run-TryBot: Hyang-Ah Hana Kim <hyangah@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Hyang-Ah Hana Kim <hyangah@gmail.com>

So https://http2.golang.org/reqinfo has a RemoteAddr of the client's
actual IP address.

Change-Id: I9db52b2f451ad937d013dd78078e4228e732ffe0
Reviewed-on: https://go-review.googlesource.com/99235Reviewed-by: David Anderson <danderson@google.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Updates golang/go#16218

Change-Id: I078395a8c3967c2ac6a6e86f1528a431346b8ff4
Reviewed-on: https://go-review.googlesource.com/98755Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

The new appending behavior is required for an efficient DNS client.

(*Builder).Start was intended to append, but didn't. This was a mistake
(all tests and examples assumed that it did).

In addition, message compression when appending has been fixed.

Updates golang/go#16218

Change-Id: I3f42aa6e653e2990fa90368a2803e588ea15b85a
Reviewed-on: https://go-review.googlesource.com/97716Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Change-Id: I5dc9a8fa647ccb34caae9a1342012cb36d1fcc22
Reviewed-on: https://go-review.googlesource.com/94975Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

See https://html.spec.whatwg.org/multipage/parsing.html#the-list-of-active-formatting-elements

Updates golang/go#23071

Change-Id: I015c394ed34d721e9e4a4d3e797d06d750c1864e
Reviewed-on: https://go-review.googlesource.com/94837Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Updates golang/go#23071

See https://html.spec.whatwg.org/multipage/

Change-Id: I1bde6e07ae9270ba7b320474b9bec8ec09a79f16
Reviewed-on: https://go-review.googlesource.com/94355Reviewed-by: Nigel Tao <nigeltao@golang.org>

Replace references to the obsoleted RFC 2616 with references to RFC
7230 through 7235, to avoid unnecessary confusion.

Updates golang/go#21974

Change-Id: Idbe3e73199f0bef9dbdbe1b75c39382799cd646c
Reviewed-on: https://go-review.googlesource.com/94555Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>

Update the list to revision 0f3b07d9aab6d6c9fe74990af98316468d40f488
(2018-01-25T09:22:16Z).

Change-Id: I3a41aeef98e1245cfd7f7fa5958f986ff313e65a
Reviewed-on: https://go-review.googlesource.com/91836Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

We mustn't use data from p.header to pre-allocate slices for Message.Question, etc.
Otherwise an attacker can force the allocation of several MiB per parsed message,
which can lead to a DoS via putting pressure on the GC.

Fixes golang/go#23214

Change-Id: I6c99577f625b08331b438533adb6b8167bcd1ec5
Reviewed-on: https://go-review.googlesource.com/85135Reviewed-by: Ian Gudger <igudger@google.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>

Change-Id: I1cdb799ce509f94e3541bf3e94cb75b3797269f6
Reviewed-on: https://go-review.googlesource.com/91517Reviewed-by: Andrew Bonventre <andybons@golang.org>