boringssl/crypto/x509/test/policy_intermediate.pem

Fix handling of EXFLAG_INVALID_POLICY on the leaf. X509_policy_check returns -1 if some certificate had an unparseable extension, in which case it sets EXFLAG_INVALID_POLICY on it. The calling code then iterates over the certificates to find the offending one, so the callback has a chance to undo it. But it skips i = 0, the leaf, and instead just silentely returns success. We really should cut down on the callback's ability to mess things up here but, in the meantime, fix this. Also add a test covering this case. While I'm here, I've updated make_invalid_extensions.go, which I pulled some code from, to rename fooOrPanic to mustFoo. That seems to be the convention in the Go standard library. (regexp.MustCompile, etc.) Change-Id: Ib07c9f4175e66483bd7c0f7d49aea931bf36e53f Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/55748 Auto-Submit: David Benjamin <davidben@google.com> Reviewed-by: Bob Beck <bbe@google.com> Commit-Queue: David Benjamin <davidben@google.com> 2 years ago			`-----BEGIN CERTIFICATE-----`
			`MIIBrDCCAVGgAwIBAgIBAjAKBggqhkjOPQQDAjAWMRQwEgYDVQQDEwtQb2xpY3kg`
			`Um9vdDAgFw0wMDAxMDEwMDAwMDBaGA8yMTAwMDEwMTAwMDAwMFowHjEcMBoGA1UE`
			`AxMTUG9saWN5IEludGVybWVkaWF0ZTBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IA`
			`BOI6fKiM3jFLkLyAn88cvlw4SwxuygRjopP3FFBKHyUQvh3VVvfqSpSCSmp50Qia`
			`jQ6Dg7CTpVZVVH+bguT7JTCjgYUwgYIwDgYDVR0PAQH/BAQDAgIEMBMGA1UdJQQM`
			`MAoGCCsGAQUFBwMBMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJDS9/4O7qhr`
			`CIRhwsXrPVBagG2uMCsGA1UdIAQkMCIwDwYNKoZIhvcSBAGEtwkCATAPBg0qhkiG`
			`9xIEAYS3CQICMAoGCCqGSM49BAMCA0kAMEYCIQCcgAbQr/HNdHwPEcWotOqtXXGH`
			`di6cAJtWaSynP8+UoQIhAPEMK79OO+tJHzmD0N01OdZefAwKlYZvDCQvAfAQVf7j`
			`-----END CERTIFICATE-----`