| commit | 07a31bc3da1115775c6607fa400e2d147f6c17c3 | [log] [tgz] |
|---|---|---|
| author | Adam Langley <agl@golang.org> | Wed Oct 26 13:57:08 2016 -0700 |
| committer | Adam Langley <agl@golang.org> | Thu Oct 27 17:10:53 2016 +0000 |
| tree | 1829ee8df15e60383844ab5c43c3b7ba2079d57b | |
| parent | a047b6bf7d90cc7185f18af3c179dfc7e66b66e9 [diff] |
crypto/x509: don't accept a root that already appears in a chain. Since a root certificate is self-signed, it's a valid child of itself. If a root certificate appeared both in the pool of intermediates and roots the verification code could find a chain which included it twice: first as an intermediate and then as a root. (Existing checks prevented the code from looping any more.) This change stops the exact same certificate from appearing twice in a chain. This simplifies the results in the face of the common configuration error of a TLS server returning a root certificate. (This should also stop two different versions of the “same” root appearing in a chain because the self-signature on one will not validate for the other.) Fixes #16800. Change-Id: I004853baa0eea27b44d47b9b34f96113a92ebac8 Reviewed-on: https://go-review.googlesource.com/32121 Run-TryBot: Adam Langley <agl@golang.org> Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org>
Go is an open source programming language that makes it easy to build simple, reliable, and efficient software.
For documentation about how to install and use Go, visit https://golang.org/ or load doc/install-source.html in your web browser.
Our canonical Git repository is located at https://go.googlesource.com/go. There is a mirror of the repository at https://github.com/golang/go.
Go is the work of hundreds of contributors. We appreciate your help!
To contribute, please read the contribution guidelines: https://golang.org/doc/contribute.html
Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.
If you have just untarred a binary Go distribution, you need to set the environment variable $GOROOT to the full path of the go directory (the one containing this file). You can omit the variable if you unpack it into /usr/local/go, or if you rebuild from sources by running all.bash (see doc/install-source.html). You should also add the Go binary directory $GOROOT/bin to your shell's path.
For example, if you extracted the tar file into $HOME/go, you might put the following in your .profile:
export GOROOT=$HOME/go export PATH=$PATH:$GOROOT/bin
See https://golang.org/doc/install or doc/install.html for more details.