code review 7336046: crypto/x509: support IP SANs.

crypto/x509: support IP SANs.

Subject Alternative Names in X.509 certificates may include IP
addresses. This change adds support for marshaling, unmarshaling and
verifying this form of SAN.

It also causes IP addresses to only be checked against IP SANs,
rather than against hostnames as was previously the case. This
reflects RFC 6125.

Fixes issue 4658.

[agl1, 2013-02-14 21:58:53]

Hello golang-dev@googlegroups.com (cc: golang-dev@googlegroups.com),

I'd like you to review this change to
https://code.google.com/p/go/

[mikio, 2013-02-14 22:12:02]

just skimming

https://codereview.appspot.com/7336046/diff/7001/src/pkg/crypto/x509/x509.go
File src/pkg/crypto/x509/x509.go (right):

https://codereview.appspot.com/7336046/diff/7001/src/pkg/crypto/x509/x509.go#...
src/pkg/crypto/x509/x509.go:849: case 4, 16:
you can use net.IPv4len and IPv6len

[bradfitz, 2013-02-14 22:14:19]

LGTM

https://codereview.appspot.com/7336046/diff/7001/src/pkg/crypto/x509/verify.go
File src/pkg/crypto/x509/verify.go (right):

https://codereview.appspot.com/7336046/diff/7001/src/pkg/crypto/x509/verify.g...
src/pkg/crypto/x509/verify.go:77: valid += ", "
this string += is a little gross, but I guess it's just an Error() method.

https://codereview.appspot.com/7336046/diff/7001/src/pkg/net/http/httptest/se...
File src/pkg/net/http/httptest/server.go (right):

https://codereview.appspot.com/7336046/diff/7001/src/pkg/net/http/httptest/se...
src/pkg/net/http/httptest/server.go:203: // localhostCert is a PEM-encoded TLS
cert with SAN IPs
please include here a comment about how these files were generated, like I
included in my CL here:

https://codereview.appspot.com/7307098/diff/8002/src/pkg/net/http/httptest/se...

Maybe also update the gencerts command, like I did here:

https://codereview.appspot.com/7307098/diff/8002/src/pkg/crypto/tls/generate_...

[agl1, 2013-02-14 23:31:54]

https://codereview.appspot.com/7336046/diff/7001/src/pkg/crypto/x509/x509.go
File src/pkg/crypto/x509/x509.go (right):

https://codereview.appspot.com/7336046/diff/7001/src/pkg/crypto/x509/x509.go#...
src/pkg/crypto/x509/x509.go:849: case 4, 16:
On 2013/02/14 22:12:02, mikio wrote:
> you can use net.IPv4len and IPv6len

Done.

https://codereview.appspot.com/7336046/diff/7001/src/pkg/net/http/httptest/se...
File src/pkg/net/http/httptest/server.go (right):

https://codereview.appspot.com/7336046/diff/7001/src/pkg/net/http/httptest/se...
src/pkg/net/http/httptest/server.go:203: // localhostCert is a PEM-encoded TLS
cert with SAN IPs
On 2013/02/14 22:14:19, bradfitz wrote:
> please include here a comment about how these files were generated, like I
> included in my CL here:
> 
>
https://codereview.appspot.com/7307098/diff/8002/src/pkg/net/http/httptest/se...
> 
> Maybe also update the gencerts command, like I did here:
> 
>
https://codereview.appspot.com/7307098/diff/8002/src/pkg/crypto/tls/generate_...

Done. PTAL.

[bradfitz, 2013-02-14 23:36:25]

LGTM

https://codereview.appspot.com/7336046/diff/5006/src/pkg/crypto/tls/generate_...
File src/pkg/crypto/tls/generate_cert.go (right):

https://codereview.appspot.com/7336046/diff/5006/src/pkg/crypto/tls/generate_...
src/pkg/crypto/tls/generate_cert.go:29: host      = flag.String("host", "",
"Comma separated hostnamesn and IPs to generate a certificate for")
Comma-separated (hyphen) and extra typo "n" character in there.

https://codereview.appspot.com/7336046/diff/5006/src/pkg/crypto/tls/generate_...
src/pkg/crypto/tls/generate_cert.go:30: validFrom = flag.String("start-date",
"", "Creation date formatted as Jan 1 12:13:14 2011")
as 15:04:05 (using 15 makes it obvious how to do PM)

[mikio, 2013-02-14 23:43:38]

LGTM

[agl1, 2013-02-15 15:40:27]

*** Submitted as https://code.google.com/p/go/source/detail?r=e1a94ec9f285 ***

crypto/x509: support IP SANs.

Subject Alternative Names in X.509 certificates may include IP
addresses. This change adds support for marshaling, unmarshaling and
verifying this form of SAN.

It also causes IP addresses to only be checked against IP SANs,
rather than against hostnames as was previously the case. This
reflects RFC 6125.

Fixes issue 4658.

R=golang-dev, mikioh.mikioh, bradfitz
CC=golang-dev
https://codereview.appspot.com/7336046

https://codereview.appspot.com/7336046/diff/5006/src/pkg/crypto/tls/generate_...
File src/pkg/crypto/tls/generate_cert.go (right):

https://codereview.appspot.com/7336046/diff/5006/src/pkg/crypto/tls/generate_...
src/pkg/crypto/tls/generate_cert.go:29: host      = flag.String("host", "",
"Comma separated hostnamesn and IPs to generate a certificate for")
On 2013/02/14 23:36:25, bradfitz wrote:
> Comma-separated (hyphen) and extra typo "n" character in there.

Done.

https://codereview.appspot.com/7336046/diff/5006/src/pkg/crypto/tls/generate_...
src/pkg/crypto/tls/generate_cert.go:30: validFrom = flag.String("start-date",
"", "Creation date formatted as Jan 1 12:13:14 2011")
On 2013/02/14 23:36:25, bradfitz wrote:
> as 15:04:05 (using 15 makes it obvious how to do PM)

Done.