-/* $OpenBSD: policy.c,v 1.6 2023/04/28 08:50:08 beck Exp $ */
+/* $OpenBSD: policy.c,v 1.7 2023/04/28 08:53:20 beck Exp $ */
/*
* Copyright (c) 2020 Joel Sing <jsing@openbsd.org>
* Copyright (c) 2020-2021 Bob Beck <beck@openbsd.org>
*error = 0;
*error_depth = 0;
-
if (!certs_from_file(roots_file, &roots))
errx(1, "failed to load roots from '%s'", roots_file);
if (!certs_from_file(leaf_file, &bundle))
int flags = X509_V_FLAG_POLICY_CHECK;
flags |= verify_flags;
if (mode == MODE_LEGACY_VFY)
- flags |= X509_V_FLAG_LEGACY_VERIFY;
+ flags |= X509_V_FLAG_LEGACY_VERIFY;
X509_STORE_CTX_set_flags(xsc, flags);
if (verbose)
X509_STORE_CTX_set0_trusted_stack(xsc, roots);
if (policy_oid != NULL) {
- X509_VERIFY_PARAM * param = X509_STORE_CTX_get0_param(xsc);
- ASN1_OBJECT * copy = OBJ_dup(policy_oid);
+ X509_VERIFY_PARAM *param = X509_STORE_CTX_get0_param(xsc);
+ ASN1_OBJECT *copy = OBJ_dup(policy_oid);
X509_VERIFY_PARAM_add0_policy(param, copy);
}
if (policy_oid2 != NULL) {
- X509_VERIFY_PARAM * param = X509_STORE_CTX_get0_param(xsc);
- ASN1_OBJECT * copy = OBJ_dup(policy_oid2);
+ X509_VERIFY_PARAM *param = X509_STORE_CTX_get0_param(xsc);
+ ASN1_OBJECT *copy = OBJ_dup(policy_oid2);
X509_VERIFY_PARAM_add0_policy(param, copy);
}
.want_chains = 0,
.want_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_error_depth = 0,
- .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
+ .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_legacy_error_depth = 0,
},
// requireExplicitPolicy applies even if the application does not configure a
.want_chains = 0,
.want_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_error_depth = 0,
- .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
+ .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_legacy_error_depth = 0,
},
// A leaf can also set requireExplicitPolicy but should work with none
.leaf_file = CERTSDIR "/" "policy_leaf_require.pem",
.want_chains = 1,
},
- // A leaf can also set requireExplicitPolicy but should fail with policy
+ // A leaf can also set requireExplicitPolicy but should fail with policy
{
.id = "oid3, explicit policy unset, with leaf requiring policy",
.root_file = CERTSDIR "/" "policy_root.pem",
.want_chains = 0,
.want_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_error_depth = 0,
- .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
+ .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_legacy_error_depth = 0,
},
// requireExplicitPolicy is a count of certificates to skip. If the value is
.want_chains = 0,
.want_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_error_depth = 0,
- .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
+ .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_legacy_error_depth = 0,
},
{
.want_chains = 0,
.want_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_error_depth = 0,
- .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
+ .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_legacy_error_depth = 0,
},
{
.want_chains = 0,
.want_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_error_depth = 0,
- .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
+ .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_legacy_error_depth = 0,
},
// An intermediate that requires an explicit policy, but then specifies no
.want_chains = 0,
.want_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_error_depth = 0,
- .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
+ .want_legacy_error = X509_V_ERR_NO_EXPLICIT_POLICY,
.want_legacy_error_depth = 0,
},
// A constrained intermediate's policy extension has a duplicate policy, which
.want_chains = 0,
.want_error = X509_V_ERR_INVALID_POLICY_EXTENSION,
.want_error_depth = 0,
- .want_legacy_error = X509_V_ERR_INVALID_POLICY_EXTENSION,
+ .want_legacy_error = X509_V_ERR_INVALID_POLICY_EXTENSION,
.want_legacy_error_depth = 0,
},
// The leaf asserts anyPolicy, but the intermediate does not. The resulting
fprintf(stderr, "\n");
ASN1_OBJECT_free(policy_oid);
ASN1_OBJECT_free(policy_oid2);
-
}
return failed;
}