view tests/test-ancestor.py.out @ 28525:dfb21c34e07d

sslutil: allow multiple fingerprints per host

Certificate pinning via [hostfingerprints] is a useful security
feature. Currently, we only support one fingerprint per hostname.
This is simple but it fails in the real world:

* Switching certificates breaks clients until they change the
  pinned certificate fingerprint. This incurs client downtime
  and can require massive amounts of coordination to perform
  certificate changes.
* Some servers operate with multiple certificates on the same
  hostname.

This patch adds support for defining multiple certificate
fingerprints per host. This overcomes the deficiencies listed
above. I anticipate the primary use case of this feature will
be to define both the old and new certificate so a certificate
transition can occur with minimal interruption, so this scenario
has been called out in the help documentation.

% lazy ancestor set for [], stoprev = 0, inclusive = False
membership: []
iteration:  []
% lazy ancestor set for [11, 13], stoprev = 0, inclusive = False
membership: [7, 8, 3, 4, 1, 0]
iteration:  [3, 7, 8, 1, 4, 0, 2]
% lazy ancestor set for [1, 3], stoprev = 0, inclusive = False
membership: [1, 0]
iteration:  [0, 1]
% lazy ancestor set for [11, 13], stoprev = 0, inclusive = True
membership: [11, 13, 7, 8, 3, 4, 1, 0]
iteration:  [11, 13, 3, 7, 8, 1, 4, 0, 2]
% lazy ancestor set for [11, 13], stoprev = 6, inclusive = False
membership: [7, 8]
iteration:  [7, 8]
% lazy ancestor set for [11, 13], stoprev = 6, inclusive = True
membership: [11, 13, 7, 8]
iteration:  [11, 13, 7, 8]