ssl: Correct cert path construction, solves CVE-2020-35733
ssl: Correct cert path construction, solves CVE-2020-35733

The certificate path used as input to
public_key:pkix_path_validation/3 is basically the reverse
certificate chain sent by the peer, excluding the ROOT that may
or may not be sent by the peer. TLS-1.3 does however specify that
that chains could be unordered (as log as the peer certificate is
first) and chains can contain extraneous certificates. In
addition certificates can be missing, but if we own them so that we
can reconstruct the chain that should also be acceptable too and
also the user could choose to put their trust in an intermediate
certificate, that is shortening the chain that should be validated.

When completing the support for all of the above in commit
d24a220c3b867caef83026ba31d2656366da4322 a bug was introduced that
could be exploited to construct fake certificate chains that could
be validated. This commit fixes that. Also comments
and name enhancments are done to make the code easier to understand.
In doing so limit chain alternatives for avoiding using more memory
than necessary. A better solution will be added in later commit.

uabboli/otp,vladdu/otp,getong/otp,g-andrade/otp,jj1bdx/otp,rlipscombe/otp,rlipscombe/otp,potatosalad/otp,isvilen/otp,uabboli/otp,emacsmirror/erlang,mikpe/otp,dgud/otp,erlang/otp,ferd/otp,ferd/otp,rlipscombe/otp,dumbbell/otp,g-andrade/otp,lrascao/otp,erlang/otp,isvilen/otp,vinoski/otp,mikpe/otp,rlipscombe/otp,dgud/otp,getong/otp,isvilen/otp,dumbbell/otp,vinoski/otp,ferd/otp,erlang/otp,uabboli/otp,erlang/otp,getong/otp,dumbbell/otp,g-andrade/otp,jj1bdx/otp,g-andrade/otp,erlang/otp,g-andrade/otp,potatosalad/otp,vinoski/otp,potatosalad/otp,vladdu/otp,bjorng/otp,ferd/otp,dgud/otp,isvilen/otp,jj1bdx/otp,bjorng/otp,erlang/otp,dgud/otp,dgud/otp,getong/otp,erlang/otp,isvilen/otp,dgud/otp,bjorng/otp,getong/otp,jj1bdx/otp,ferd/otp,uabboli/otp,getong/otp,emacsmirror/erlang,potatosalad/otp,lrascao/otp,isvilen/otp,vladdu/otp,dumbbell/otp,uabboli/otp,dgud/otp,jj1bdx/otp,dumbbell/otp,jj1bdx/otp,getong/otp,ferd/otp,getong/otp,vinoski/otp,potatosalad/otp,erlang/otp,erlang/otp,dumbbell/otp,jj1bdx/otp,lrascao/otp,vinoski/otp,isvilen/otp,isvilen/otp,vladdu/otp,mikpe/otp,uabboli/otp,lrascao/otp,ferd/otp,g-andrade/otp,lrascao/otp,rlipscombe/otp,dgud/otp,dgud/otp,g-andrade/otp,mikpe/otp,vinoski/otp,rlipscombe/otp,rlipscombe/otp,vladdu/otp,emacsmirror/erlang,ferd/otp,rlipscombe/otp,dumbbell/otp,dgud/otp,erlang/otp,emacsmirror/erlang,potatosalad/otp,emacsmirror/erlang,uabboli/otp,emacsmirror/erlang,bjorng/otp,dumbbell/otp,potatosalad/otp,emacsmirror/erlang,bjorng/otp,vladdu/otp,mikpe/otp,g-andrade/otp,dumbbell/otp,mikpe/otp,dumbbell/otp,ferd/otp,vinoski/otp,rlipscombe/otp,vladdu/otp,g-andrade/otp,jj1bdx/otp,bjorng/otp,isvilen/otp,uabboli/otp,bjorng/otp,potatosalad/otp,vladdu/otp,mikpe/otp,vladdu/otp,vinoski/otp,bjorng/otp,lrascao/otp,potatosalad/otp,emacsmirror/erlang,emacsmirror/erlang,jj1bdx/otp,potatosalad/otp,isvilen/otp,getong/otp,mikpe/otp,g-andrade/otp,mikpe/otp,bjorng/otp,lrascao/otp,emacsmirror/erlang,vinoski/otp,rlipscombe/otp,bjorng/otp,getong/otp,vinoski/otp,lrascao/otp,lrascao/otp,mikpe/otp,uabboli/otp,jj1bdx/otp