crypto/tls: export the verified chains.

The verified chains are the chains that were actually verified.

R=bradfitz
CC=golang-dev
https://golang.org/cl/4462046

diff --git a/src/pkg/crypto/tls/common.go b/src/pkg/crypto/tls/common.go
index 204d255314b3ccadf5a0804a75f2bece85234dd6..0b26aae84d1429da4b7a8670a2bc69e572be053e 100644 (file)
--- a/src/pkg/crypto/tls/common.go
+++ b/src/pkg/crypto/tls/common.go
@@ -100,6 +100,8 @@ type ConnectionState struct {
 
        // the certificate chain that was presented by the other side
        PeerCertificates []*x509.Certificate
+       // the verified certificate chains built from PeerCertificates.
+       VerifiedChains [][]*x509.Certificate
 }
 
 // A Config structure is used to configure a TLS client or server. After one

diff --git a/src/pkg/crypto/tls/conn.go b/src/pkg/crypto/tls/conn.go
index 63d56310c325307ce1982bada85b2e18a854cc5a..48d3f725b49c62179ac42761dc5c13b51259776c 100644 (file)
--- a/src/pkg/crypto/tls/conn.go
+++ b/src/pkg/crypto/tls/conn.go
@@ -768,6 +768,7 @@ func (c *Conn) ConnectionState() ConnectionState {
                state.NegotiatedProtocolIsMutual = !c.clientProtocolFallback
                state.CipherSuite = c.cipherSuite
                state.PeerCertificates = c.peerCertificates
+               state.VerifiedChains = c.verifiedChains
        }
 
        return state