Enable policy checking by default now that we are DAG implementation based.

This ensures that we will no longer silently ignore a certificate with
a critical policy extention by default.

ok tb@

1 files changed, 12 insertions, 1 deletions

diff --git a/src/regress/lib/libcrypto/x509/policy/policy.c b/src/regress/lib/libcrypto/x509/policy/policy.c
index 289f96db78..70f60af0a3 100644
--- a/src/regress/lib/libcrypto/x509/policy/policy.c
+++ b/src/regress/lib/libcrypto/x509/policy/policy.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: policy.c,v 1.9 2023/04/28 14:45:51 tb Exp $ */
+/* $OpenBSD: policy.c,v 1.10 2023/04/28 16:50:16 beck Exp $ */
 /*
  * Copyright (c) 2020 Joel Sing <jsing@openbsd.org>
  * Copyright (c) 2020-2023 Bob Beck <beck@openbsd.org>
@@ -328,6 +328,17 @@ struct verify_cert_test verify_cert_tests[] = {
                 .want_legacy_error = X509_V_ERR_INVALID_POLICY_EXTENSION,
                 .want_legacy_error_depth = 0,
         },
+        {
+                .id = "invalid leaf without explicit policy",
+                .root_file = CERTSDIR "/" "policy_root.pem",
+                .intermediate_file = CERTSDIR "/" "policy_intermediate.pem",
+                .leaf_file = CERTSDIR "/" "policy_leaf_invalid.pem",
+                .want_chains = 0,
+                .want_error = X509_V_ERR_INVALID_POLICY_EXTENSION,
+                .want_error_depth = 0,
+                .want_legacy_error = X509_V_ERR_INVALID_POLICY_EXTENSION,
+                .want_legacy_error_depth = 0,
+        },
         /*  There is a duplicate policy in the leaf policy extension. */
         {
                 .id = "1 in duplicate policy extension in leaf",