Use Policy field for CA policies

Signed-off-by: Sorin Dumitru <[email protected]>

Author: sorindumitru

pkg/server/ca/manager/manager_test.go

@@ -7,7 +7,6 @@ import (
 	"crypto/rsa"
 	"crypto/x509"
 	"crypto/x509/pkix"
-	"encoding/asn1"
 	"errors"
 	"fmt"
 	"math/big"
@@ -161,17 +160,17 @@ func TestCAPolicyIdentifiers(t *testing.T) {
 
 	test := setupTest(t)
 	test.initSelfSignedManager()
-	test.cc.policyIdentifiers = []asn1.ObjectIdentifier{
-		asn1.ObjectIdentifier{1, 2, 3, 4},
-	}
+	policy, err := x509.ParseOID("1.2.3.4")
+	require.NoError(t, err)
+	test.cc.policies = append(test.cc.policies, policy)
 
 	t.Run("contains policy identifiers", func(t *testing.T) {
 		require.NoError(t, test.m.PrepareX509CA(ctx))
 
 		currentSlot := test.m.GetCurrentX509CASlot()
 		slot := currentSlot.(*x509CASlot)
 		require.NotNil(t, slot.x509CA)
-		require.Equal(t, slot.x509CA.Certificate.PolicyIdentifiers, test.cc.policyIdentifiers)
+		require.Equal(t, slot.x509CA.Certificate.Policies, test.cc.policies)
 	})
 }
 
@@ -1575,11 +1574,11 @@ func (s *fakeCA) NotifyTaintedX509Authorities(taintedAuthorities []*x509.Certifi
 type fakeCC struct {
 	catalog.PluginInfo
 
-	policyIdentifiers []asn1.ObjectIdentifier
+	policies []x509.OID
 }
 
 func (cc fakeCC) ComposeServerX509CA(_ context.Context, attributes credentialcomposer.X509CAAttributes) (credentialcomposer.X509CAAttributes, error) {
-	attributes.PolicyIdentifiers = append(attributes.PolicyIdentifiers, cc.policyIdentifiers...)
+	attributes.Policies = append(attributes.Policies, cc.policies...)
 	return attributes, nil
 }
 

pkg/server/credtemplate/builder.go

@@ -181,7 +181,9 @@ func (b *Builder) BuildSelfSignedX509CATemplate(ctx context.Context, params Self
 		if err != nil {
 			return nil, err
 		}
-		applyX509CAAttributes(tmpl, attributes)
+		if err := applyX509CAAttributes(tmpl, attributes); err != nil {
+			return nil, err
+		}
 	}
 
 	return tmpl, nil
@@ -198,11 +200,13 @@ func (b *Builder) BuildUpstreamSignedX509CACSR(ctx context.Context, params Upstr
 		if err != nil {
 			return nil, err
 		}
-		applyX509CAAttributes(tmpl, attributes)
+		if err := applyX509CAAttributes(tmpl, attributes); err != nil {
+			return nil, err
+		}
 	}
 
 	// Create the CertificateRequest from the Certificate template. The
-	// PolicyIdentifiers field is ignored since that can be applied by the
+	// Policies field is ignored since that can be applied by the
 	// upstream signer and isn't a part of the native CertificateRequest type.
 	// TODO: maybe revisit this if needed and embed the policy identifiers in
 	// the extra extensions.
@@ -237,7 +241,9 @@ func (b *Builder) BuildDownstreamX509CATemplate(ctx context.Context, params Down
 		if err != nil {
 			return nil, err
 		}
-		applyX509CAAttributes(tmpl, attributes)
+		if err := applyX509CAAttributes(tmpl, attributes); err != nil {
+			return nil, err
+		}
 	}
 
 	return tmpl, nil
@@ -458,9 +464,9 @@ func (b *Builder) computeX509SVIDLifetime(parentChain []*x509.Certificate, ttl t
 
 func x509CAAttributesFromTemplate(tmpl *x509.Certificate) credentialcomposer.X509CAAttributes {
 	return credentialcomposer.X509CAAttributes{
-		Subject:           tmpl.Subject,
-		PolicyIdentifiers: tmpl.PolicyIdentifiers,
-		ExtraExtensions:   tmpl.ExtraExtensions,
+		Subject:         tmpl.Subject,
+		Policies:        tmpl.Policies,
+		ExtraExtensions: tmpl.ExtraExtensions,
 	}
 }
 func x509SVIDAttributesFromTemplate(tmpl *x509.Certificate) credentialcomposer.X509SVIDAttributes {
@@ -471,10 +477,11 @@ func x509SVIDAttributesFromTemplate(tmpl *x509.Certificate) credentialcomposer.X
 	}
 }
 
-func applyX509CAAttributes(tmpl *x509.Certificate, attribs credentialcomposer.X509CAAttributes) {
+func applyX509CAAttributes(tmpl *x509.Certificate, attribs credentialcomposer.X509CAAttributes) error {
 	tmpl.Subject = attribs.Subject
-	tmpl.PolicyIdentifiers = attribs.PolicyIdentifiers
+	tmpl.Policies = attribs.Policies
 	tmpl.ExtraExtensions = attribs.ExtraExtensions
+	return nil
 }
 
 func applyX509SVIDAttributes(tmpl *x509.Certificate, attribs credentialcomposer.X509SVIDAttributes) {