Filippo Valsorda 95c5ec67ea crypto/x509: treat certificate names with trailing dots as invalid ... Trailing dots are not allowed in certificate fields like CN and SANs (while they are allowed and ignored as inputs to verification APIs). Move to considering names with trailing dots in certificates as invalid hostnames. Following the rule of CL 231378, these invalid names lose wildcard processing, but can still match if there is a 1:1 match, trailing dot included, with the VerifyHostname input. They also become ignored Common Name values regardless of the GODEBUG=x509ignoreCN=X value, because we have to ignore invalid hostnames in Common Name for #24151. The error message automatically accounts for this, and doesn't suggest the environment variable. You don't get to use a legacy deprecated field AND invalid hostnames. (While at it, also consider wildcards in VerifyHostname inputs as invalid hostnames, not that it should change any observed behavior.) Change-Id: Iecdee8927df50c1d9daf904776b051de9f5e76ad Reviewed-on: https://go-review.googlesource.com/c/go/+/231380 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Katie Hockman <katie@golang.org>		2020-05-08 00:05:42 +00:00
..
internal/macOS	crypto/x509: use Security.framework without cgo for roots on macOS	2020-05-07 19:22:19 +00:00
pkix	crypto/x509/pkix: improve docs and Name.String()	2020-04-29 18:50:32 +00:00
testdata
cert_pool.go	crypto/x509: consider parents by Subject if AKID has no match	2019-02-07 17:57:03 +00:00
example_test.go	crypto/x509: add Ed25519 to ExampleParsePKIXPublicKey	2019-07-29 16:52:01 +00:00
name_constraints_test.go	src: gofmt -s	2019-09-09 18:57:05 +00:00
pem_decrypt_test.go	all: remove PEM-encoded private keys from tests	2019-05-21 20:03:55 +00:00
pem_decrypt.go
pkcs1.go	crypto/x509: normalize and expand docs of Parse and Marshal functions	2019-06-20 19:38:48 +00:00
pkcs8_test.go	crypto/x509: add support for Ed25519 certificates and keys	2019-05-15 18:51:12 +00:00
pkcs8.go	crypto/x509: fix godoc for MarshalPKCS8PrivateKey	2020-02-05 21:53:13 +00:00
root_aix.go
root_bsd.go
root_cgo_darwin_amd64.go	crypto/x509: use Security.framework without cgo for roots on macOS	2020-05-07 19:22:19 +00:00
root_darwin_amd64.go	crypto/x509: use Security.framework without cgo for roots on macOS	2020-05-07 19:22:19 +00:00
root_darwin_arm64_gen.go	crypto/x509: use Security.framework without cgo for roots on macOS	2020-05-07 19:22:19 +00:00
root_darwin_arm64.go	crypto/x509: use Security.framework without cgo for roots on macOS	2020-05-07 19:22:19 +00:00
root_darwin_test.go	crypto/x509: use Security.framework without cgo for roots on macOS	2020-05-07 19:22:19 +00:00
root_js.go
root_linux.go	crypto/x509: look for CAs at /etc/ssl/cert.pem for Alpine Linux	2019-03-26 22:10:49 +00:00
root_omit_test.go	crypto/x509: add x509omitbundledroots build tag to not embed roots	2020-04-24 05:30:31 +00:00
root_omit.go	crypto/x509: use Security.framework without cgo for roots on macOS	2020-05-07 19:22:19 +00:00
root_plan9.go
root_solaris.go
root_unix_test.go	crypto/x509: don't read symlinked root certs from disk twice	2020-05-05 05:13:26 +00:00
root_unix.go	crypto/x509: don't read symlinked root certs from disk twice	2020-05-05 05:13:26 +00:00
root_windows.go	crypto/x509: mitigate CVE-2020-0601 verification bypass on Windows	2020-01-23 22:31:25 +00:00
root.go
sec1_test.go	crypto/x509: improve error when PKCS1, PKCS8, EC keys are mixed up	2019-02-27 19:34:12 +00:00
sec1.go	math/big: add (*Int).FillBytes	2020-05-05 00:36:44 +00:00
test-file.crt
verify_test.go	crypto/x509: treat certificate names with trailing dots as invalid	2020-05-08 00:05:42 +00:00
verify.go	crypto/x509: treat certificate names with trailing dots as invalid	2020-05-08 00:05:42 +00:00
x509_test_import.go	all: remove PEM-encoded private keys from tests	2019-05-21 20:03:55 +00:00
x509_test.go	crypto/x509: treat certificate names with trailing dots as invalid	2020-05-08 00:05:42 +00:00
x509.go	crypto/x509: disallow setting MaxPathLen without IsCA	2020-04-22 16:45:05 +00:00