Drop policy printing from openssl

Nothing really uses the policy tree. It's desgined with built-in DoS
capabilities directly from the RFC. It will be removed from the attack
surface and replaced with something equivalent that doesn't grow
exponentially with the depth.

This removes the only reason the policy tree itself ever leaked out of
the library.

ok jsing

1 files changed, 1 insertions, 42 deletions

diff --git a/src/usr.bin/openssl/apps.c b/src/usr.bin/openssl/apps.c
index fd13371f5d..592a68980a 100644
--- a/src/usr.bin/openssl/apps.c
+++ b/src/usr.bin/openssl/apps.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: apps.c,v 1.62 2022/01/10 12:17:49 tb Exp $ */
+/* $OpenBSD: apps.c,v 1.63 2023/04/14 15:27:13 tb Exp $ */
 /*
  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
  *
@@ -1951,47 +1951,6 @@ pkey_ctrl_string(EVP_PKEY_CTX *ctx, char *value)
         return rv;
 }
 
-static void
-nodes_print(BIO *out, const char *name, STACK_OF(X509_POLICY_NODE) *nodes)
-{
-        X509_POLICY_NODE *node;
-        int i;
-
-        BIO_printf(out, "%s Policies:", name);
-        if (nodes) {
-                BIO_puts(out, "\n");
-                for (i = 0; i < sk_X509_POLICY_NODE_num(nodes); i++) {
-                        node = sk_X509_POLICY_NODE_value(nodes, i);
-                        X509_POLICY_NODE_print(out, node, 2);
-                }
-        } else
-                BIO_puts(out, " <empty>\n");
-}
-
-void
-policies_print(BIO *out, X509_STORE_CTX *ctx)
-{
-        X509_POLICY_TREE *tree;
-        int explicit_policy;
-        int free_out = 0;
-
-        if (out == NULL) {
-                out = BIO_new_fp(stderr, BIO_NOCLOSE);
-                free_out = 1;
-        }
-        tree = X509_STORE_CTX_get0_policy_tree(ctx);
-        explicit_policy = X509_STORE_CTX_get_explicit_policy(ctx);
-
-        BIO_printf(out, "Require explicit Policy: %s\n",
-            explicit_policy ? "True" : "False");
-
-        nodes_print(out, "Authority", X509_policy_tree_get0_policies(tree));
-        nodes_print(out, "User", X509_policy_tree_get0_user_policies(tree));
-
-        if (free_out)
-                BIO_free(out);
-}
-
 /*
  * next_protos_parse parses a comma separated list of strings into a string
  * in a format suitable for passing to SSL_CTX_set_next_protos_advertised.