code review 9795043: crypto/tls: Check all certificates in the path.

crypto/tls: Check all certificates in the path.

Currently we only check the leaf node's issuer against the list of
distinguished names in the server's CertificateRequest message. This
will fail if the client certiciate has more than one certificate in
the path and the leaf node issuer isn't in the list of distinguished
names, but the issuer's issuer was in the distinguished names.

[jvshahid, 2013-05-26 23:45:45]

Hello golang-dev@googlegroups.com,

I'd like you to review this change to
https://code.google.com/p/go/

[gobot, 2013-05-27 00:54:54]

R=agl (assigned by dsymonds)

[agl1, 2013-05-29 14:39:21]

LGTM with nits.

https://codereview.appspot.com/9795043/diff/13001/src/pkg/crypto/tls/handshak...
File src/pkg/crypto/tls/handshake_client.go (right):

https://codereview.appspot.com/9795043/diff/13001/src/pkg/crypto/tls/handshak...
src/pkg/crypto/tls/handshake_client.go:200: for i, cert := range
c.config.Certificates {
s/cert/chain/

https://codereview.appspot.com/9795043/diff/13001/src/pkg/crypto/tls/handshak...
src/pkg/crypto/tls/handshake_client.go:205: for idx, node := range
cert.Certificate {
Rather than i and idx, let's call this one j.

https://codereview.appspot.com/9795043/diff/13001/src/pkg/crypto/tls/handshak...
src/pkg/crypto/tls/handshake_client.go:205: for idx, node := range
cert.Certificate {
s/node/cert/

https://codereview.appspot.com/9795043/diff/13001/src/pkg/crypto/tls/handshak...
src/pkg/crypto/tls/handshake_client.go:206: var certOnPath *x509.Certificate
x509 := cert.Leaf
if j != 0 || x509 == nil {
  if x509, err = x509.ParseCertificate...

[jvshahid, 2013-05-29 15:13:30]

Hello agl@chromium.org, agl@golang.org (cc: gobot@golang.org,
golang-dev@googlegroups.com),

Please take another look.

[jvshahid, 2013-05-29 15:16:08]

On 2013/05/29 15:13:30, jvshahid wrote:
> Hello mailto:agl@chromium.org, mailto:agl@golang.org (cc:
mailto:gobot@golang.org,
> mailto:golang-dev@googlegroups.com),
> 
> Please take another look.

I couldn't call the variable x509 because it conflicts with the package name.
Instead I called it x509Cert. Other than that, all the other changes were made.
Thx.

[agl1, 2013-05-29 15:21:44]

*** Submitted as https://code.google.com/p/go/source/detail?r=64a3ac450b0d ***

      crypto/tls: Check all certificates in the path.

Currently we only check the leaf node's issuer against the list of
distinguished names in the server's CertificateRequest message. This
will fail if the client certiciate has more than one certificate in
the path and the leaf node issuer isn't in the list of distinguished
names, but the issuer's issuer was in the distinguished names.

R=agl, agl
CC=gobot, golang-dev
https://codereview.appspot.com/9795043

Committer: Adam Langley <agl@golang.org>