code review 15570044: crypto/x509: name constraints should be a disjunction.

crypto/x509: name constraints should be a disjunction.

The code was requiring that all constraints be met, but it should be
satisfied by meeting *any* of them.

[agl1, 2013-10-21 20:49:39]

Hello golang-dev@googlegroups.com (cc: golang-dev@googlegroups.com),

I'd like you to review this change to
https://code.google.com/p/go/

[bradfitz, 2013-10-21 21:01:28]

Fixes issue NNN ?

Is this a regression from Go 1.1?



On Mon, Oct 21, 2013 at 1:49 PM, <agl@golang.org> wrote:

> Reviewers: golang-dev1,
>
> Message:
> Hello golang-dev@googlegroups.com (cc: golang-dev@googlegroups.com),
>
> I'd like you to review this change to
> https://code.google.com/p/go/
>
>
> Description:
> crypto/x509: name constraints should be a disjunction.
>
> The code was requiring that all constraints be met, but it should be
> satisfied by meeting *any* of them.
>
> Please review this at
https://codereview.appspot.**com/15570044/<https://codereview.appspot.com/155...
>
> Affected files (+188, -1 lines):
>   M src/pkg/crypto/x509/verify.go
>   M src/pkg/crypto/x509/verify_**test.go
>
>
> --
>
> ---You received this message because you are subscribed to the Google
> Groups "golang-dev" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to
golang-dev+unsubscribe@**googlegroups.com<golang-dev%2Bunsubscribe@googlegrou...
> .
> For more options, visit
https://groups.google.com/**groups/opt_out<https://groups.google.com/groups/o...
> .
>

[agl1, 2013-10-21 21:04:58]

On Mon, Oct 21, 2013 at 5:01 PM, Brad Fitzpatrick <bradfitz@golang.org> wrote:
> Fixes issue NNN ?

This was reported on golang-nuts:
https://groups.google.com/forum/#!topic/Golang-Nuts/S3MSUe2jCqg

> Is this a regression from Go 1.1?

No, it's just a rare certificate feature so we didn't notice.
(Although it's becoming less rare.)


Cheers

AGL

[bradfitz, 2013-10-21 21:07:07]

LGTM

Code LGTM and I think it's probably okay for Go 1.2, but wait for somebody else
to say so too.

[r, 2013-10-21 22:33:15]

LGTM

[agl1, 2013-10-21 23:01:37]

*** Submitted as https://code.google.com/p/go/source/detail?r=b4c37131e846 ***

crypto/x509: name constraints should be a disjunction.

The code was requiring that all constraints be met, but it should be
satisfied by meeting *any* of them.

R=golang-dev, bradfitz, r
CC=golang-dev
https://codereview.appspot.com/15570044