Previously we checked the certificate chain from the leaf
upwards and expected to jump from the last cert in the chain to
a root certificate.
Although technically correct, there are a number of sites with
problems including out-of-order certs, superfluous certs and
missing certs.
The last of these requires AIA chasing, which is a lot of
complexity. However, we can address the more common cases by
using a pool building algorithm, as browsers do.
We build a pool of root certificates and a pool from the
server's chain. We then try to build a path to a root
certificate, using either of these pools.
This differs from the behaviour of, say, Firefox in that Firefox
will accumulate intermedite certificate in a persistent pool in
the hope that it can use them to fill in gaps in future chains.
We don't do that because it leads to confusing errors which only
occur based on the order to sites visited.
This change also enabled SNI for tls.Dial so that sites will return
the correct certificate chain.
R=rsc
CC=golang-dev
https://golang.org/cl/2916041
Prefix all external symbols in runtime by runtime·,
to avoid conflicts with possible symbols of the same
name in linked-in C libraries. The obvious conflicts
are printf, malloc, and free, but hide everything to
avoid future pain.
The symbols left alone are:
** known to cgo **
_cgo_free
_cgo_malloc
libcgo_thread_start
initcgo
ncgocall
** known to linker **
_rt0_$GOARCH
_rt0_$GOARCH_$GOOS
text
etext
data
end
pclntab
epclntab
symtab
esymtab
** known to C compiler **
_divv
_modv
_div64by32
etc (arch specific)
Tested on darwin/386, darwin/amd64, linux/386, linux/amd64.
Built (but not tested) for freebsd/386, freebsd/amd64, linux/arm, windows/386.
R=r, PeterGo
CC=golang-dev
https://golang.org/cl/2899041
Previously all the functions took two arguments: src, dst. This is the
reverse of the usual Go style and worth changing sooner rather than
later.
Unfortunately, this is a change that the type system doesn't help
with. However, it's not a subtle change: any unittest worth the name
should catch this.
R=rsc, r
CC=golang-dev
https://golang.org/cl/2751042
CAST5 is the default OpenPGP cipher.
(This won't make Rob any happier about the size of crypto/, of course.)
It already has dst, src in that order but it doesn't have any users yet so I figure it's better than changing it later.
R=rsc, gri, r
CC=golang-dev
https://golang.org/cl/2762042
There's no need to hold the client mutex when calling encode, since encode itself
uses a mutex to make the writes atomic. However, we need to keep
the messages ordered, so add a mutex for that purpose alone.
Fixes#1244.
R=rsc
CC=golang-dev
https://golang.org/cl/2833041
First step towards a more light-weight implementation of token.Position:
- only use token.Position for reporting token and error position
- use offsets only for scanner control
- no interface changes yet
R=rsc
CC=golang-dev
https://golang.org/cl/2825041
1) Be sure to use the eval-time encoder/decoder rather than
the compile-time decoder. In a few cases the receiver for
the compiling encoder was being pickled incorrectly into a
closure.
(This is the fix for issue 1238).
2) Get the innermost name right when given a pointer to an
unnamed type.
3) Use a count to delineate interface values, making it
possible to ignore values without having a concrete type
to encode into. This is a protocol change but only for the
new feature, so it shouldn't affect anyone. The old test
worked because, amazingly, it depended on bug #1.
Fixes#1238.
R=rsc, albert.strasheim
CC=golang-dev
https://golang.org/cl/2806041
Rather than updating the stripped-down regexp implementation embedded
in testing, delete it by passing the one function we need from the package
main file created by gotest.
R=rsc
CC=golang-dev
https://golang.org/cl/2761043
