code review 5857043: crypto/tls: don't select ECC ciphersuites with no mutua...

crypto/tls: don't select ECC ciphersuites with no mutual curve.

The existing code that tried to prevent ECC ciphersuites from being
selected when there were no mutual curves still left |suite| set.
This lead to a panic on a nil pointer when there were no acceptable
ciphersuites at all.

Thanks to George Kadianakis for pointing it out.

[agl1, 2012-03-20 18:16:46]

Hello golang-dev@googlegroups.com (cc: golang-dev@googlegroups.com),

I'd like you to review this change to
https://go.googlecode.com/hg/

[r, 2012-03-22 03:32:26]

LGTM but what's your opinion wrt Go 1 and this change?

[agl1, 2012-03-22 15:27:07]

On Wed, Mar 21, 2012 at 11:32 PM,  <r@golang.org> wrote:
> LGTM but what's your opinion wrt Go 1 and this change?

Since it allows external clients to cause a nil pointer panic, I think
it would be nice to get in for Go 1.


Cheers

AGL

[bradfitz, 2012-03-22 15:36:25]

LGTM too

On Thu, Mar 22, 2012 at 8:27 AM, Adam Langley <agl@golang.org> wrote:

> On Wed, Mar 21, 2012 at 11:32 PM,  <r@golang.org> wrote:
> > LGTM but what's your opinion wrt Go 1 and this change?
>
> Since it allows external clients to cause a nil pointer panic, I think
> it would be nice to get in for Go 1.
>

As somebody running public-facing https Go servers, I agree.  :-)

[agl1, 2012-03-22 23:50:39]

(p.s. I'll wait for someone to stand up an officially say that it's
good to land.)


Cheers

AGL

[r, 2012-03-22 23:56:00]

LGTM for now

[agl1, 2012-03-23 14:49:09]

*** Submitted as http://code.google.com/p/go/source/detail?r=1b55ed5c1e42 ***

crypto/tls: don't select ECC ciphersuites with no mutual curve.

The existing code that tried to prevent ECC ciphersuites from being
selected when there were no mutual curves still left |suite| set.
This lead to a panic on a nil pointer when there were no acceptable
ciphersuites at all.

Thanks to George Kadianakis for pointing it out.

R=golang-dev, r, bradfitz
CC=golang-dev
http://codereview.appspot.com/5857043