OpenSSL 0.9.5 merge

*warning* this bumps shared lib minors for libssl and libcrypto from 2.1 to 2.2 if you are using the ssl26 packages for ssh and other things to work you will need to get new ones (see ~beck/libsslsnap/<arch>) on cvs or ~beck/src-patent.tar.gz on cvs
author: beck <> 2000-03-19 11:13:58 +0000
committer: beck <> 2000-03-19 11:13:58 +0000
commit: 796d609550df3a33fc11468741c5d2f6d3df4c11 (patch)
tree: 6c6d539061caa20372dad0ac4ddb1dfae2fbe7fe /src/lib/libcrypto/asn1
parent: 5be3114c1fd7e0dfea1e38d3abb4cbba75244419 (diff)
download: openbsd-796d609550df3a33fc11468741c5d2f6d3df4c11.tar.gz
openbsd-796d609550df3a33fc11468741c5d2f6d3df4c11.tar.bz2
openbsd-796d609550df3a33fc11468741c5d2f6d3df4c11.zip
84 files changed, 2584 insertions, 558 deletions
diff --git a/src/lib/libcrypto/asn1/Makefile.ssl b/src/lib/libcrypto/asn1/Makefile.ssl
index 5d668411f6..a17a713a75 100644
--- a/src/lib/libcrypto/asn1/Makefile.ssl
+++ b/src/lib/libcrypto/asn1/Makefile.ssl
@@ -23,34 +23,34 @@ APPS=
 LIB=$(TOP)/libcrypto.a
 LIBSRC= a_object.c a_bitstr.c a_utctm.c a_gentm.c a_time.c a_int.c a_octet.c \
-        a_print.c a_type.c a_set.c a_dup.c a_d2i_fp.c a_i2d_fp.c a_bmp.c \
+        a_null.c a_print.c a_type.c a_set.c a_dup.c a_d2i_fp.c a_i2d_fp.c a_bmp.c \
-        a_enum.c a_vis.c a_utf8.c a_sign.c a_digest.c a_verify.c \
+        a_enum.c a_vis.c a_utf8.c a_sign.c a_digest.c a_verify.c a_mbstr.c \
        x_algor.c x_val.c x_pubkey.c x_sig.c x_req.c x_attrib.c \
-        x_name.c x_cinf.c x_x509.c x_crl.c x_info.c x_spki.c nsseq.c \
+        x_name.c x_cinf.c x_x509.c x_x509a.c x_crl.c x_info.c x_spki.c nsseq.c \
        d2i_r_pr.c i2d_r_pr.c d2i_r_pu.c i2d_r_pu.c \
        d2i_s_pr.c i2d_s_pr.c d2i_s_pu.c i2d_s_pu.c \
        d2i_pu.c d2i_pr.c i2d_pu.c i2d_pr.c\
-        t_req.c t_x509.c t_crl.c t_pkey.c \
+        t_req.c t_x509.c t_x509a.c t_crl.c t_pkey.c t_spki.c t_bitst.c \
        p7_i_s.c p7_signi.c p7_signd.c p7_recip.c p7_enc_c.c p7_evp.c \
        p7_dgst.c p7_s_e.c p7_enc.c p7_lib.c \
        f_int.c f_string.c i2d_dhp.c i2d_dsap.c d2i_dhp.c d2i_dsap.c n_pkey.c \
        f_enum.c a_hdr.c x_pkey.c a_bool.c x_exten.c \
-        asn1_par.c asn1_lib.c asn1_err.c a_meth.c a_bytes.c \
+        asn1_par.c asn1_lib.c asn1_err.c a_meth.c a_bytes.c a_strnid.c \
        evp_asn1.c asn_pack.c p5_pbe.c p5_pbev2.c p8_pkey.c
 LIBOBJ= a_object.o a_bitstr.o a_utctm.o a_gentm.o a_time.o a_int.o a_octet.o \
-        a_print.o a_type.o a_set.o a_dup.o a_d2i_fp.o a_i2d_fp.o a_bmp.o \
+        a_null.o a_print.o a_type.o a_set.o a_dup.o a_d2i_fp.o a_i2d_fp.o a_bmp.o \
-        a_enum.o a_vis.o a_utf8.o a_sign.o a_digest.o a_verify.o \
+        a_enum.o a_vis.o a_utf8.o a_sign.o a_digest.o a_verify.o a_mbstr.o \
        x_algor.o x_val.o x_pubkey.o x_sig.o x_req.o x_attrib.o \
-        x_name.o x_cinf.o x_x509.o x_crl.o x_info.o x_spki.o nsseq.o \
+        x_name.o x_cinf.o x_x509.o x_x509a.o x_crl.o x_info.o x_spki.o nsseq.o \
        d2i_r_pr.o i2d_r_pr.o d2i_r_pu.o i2d_r_pu.o \
        d2i_s_pr.o i2d_s_pr.o d2i_s_pu.o i2d_s_pu.o \
        d2i_pu.o d2i_pr.o i2d_pu.o i2d_pr.o \
-        t_req.o t_x509.o t_crl.o t_pkey.o \
+        t_req.o t_x509.o t_x509a.o t_crl.o t_pkey.o t_spki.o t_bitst.o \
        p7_i_s.o p7_signi.o p7_signd.o p7_recip.o p7_enc_c.o p7_evp.o \
        p7_dgst.o p7_s_e.o p7_enc.o p7_lib.o \
        f_int.o f_string.o i2d_dhp.o i2d_dsap.o d2i_dhp.o d2i_dsap.o n_pkey.o \
        f_enum.o a_hdr.o x_pkey.o a_bool.o x_exten.o \
-        asn1_par.o asn1_lib.o asn1_err.o a_meth.o a_bytes.o \
+        asn1_par.o asn1_lib.o asn1_err.o a_meth.o a_bytes.o a_strnid.o \
        evp_asn1.o asn_pack.o p5_pbe.o p5_pbev2.o p8_pkey.o
 SRC= $(LIBSRC)
@@ -160,11 +160,13 @@ a_digest.o: ../../include/openssl/err.h ../../include/openssl/evp.h
 a_digest.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
 a_digest.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 a_digest.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-a_digest.o: ../../include/openssl/opensslv.h ../../include/openssl/rc2.h
+a_digest.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
-a_digest.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+a_digest.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
-a_digest.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+a_digest.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
-a_digest.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+a_digest.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-a_digest.o: ../../include/openssl/stack.h ../cryptlib.h
+a_digest.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+a_digest.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+a_digest.o: ../cryptlib.h
 a_dup.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 a_dup.o: ../../include/openssl/bio.h ../../include/openssl/bn.h
 a_dup.o: ../../include/openssl/buffer.h ../../include/openssl/crypto.h
@@ -207,6 +209,13 @@ a_int.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 a_int.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 a_int.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 a_int.o: ../cryptlib.h
+a_mbstr.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+a_mbstr.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+a_mbstr.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+a_mbstr.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+a_mbstr.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+a_mbstr.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+a_mbstr.o: ../cryptlib.h
 a_meth.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 a_meth.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 a_meth.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
@@ -214,6 +223,13 @@ a_meth.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 a_meth.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
 a_meth.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
 a_meth.o: ../cryptlib.h
+a_null.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+a_null.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+a_null.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+a_null.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+a_null.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+a_null.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+a_null.o: ../cryptlib.h
 a_object.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 a_object.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 a_object.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
@@ -259,6 +275,13 @@ a_sign.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 a_sign.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 a_sign.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 a_sign.o: ../cryptlib.h
+a_strnid.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+a_strnid.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+a_strnid.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
+a_strnid.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+a_strnid.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+a_strnid.o: ../../include/openssl/opensslv.h ../../include/openssl/safestack.h
+a_strnid.o: ../../include/openssl/stack.h ../cryptlib.h
 a_time.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 a_time.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
 a_time.o: ../../include/openssl/crypto.h ../../include/openssl/e_os.h
@@ -788,6 +811,24 @@ p8_pkey.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p8_pkey.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 p8_pkey.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
 p8_pkey.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+t_bitst.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
+t_bitst.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
+t_bitst.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+t_bitst.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
+t_bitst.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_bitst.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_bitst.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_bitst.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_bitst.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+t_bitst.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+t_bitst.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+t_bitst.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
+t_bitst.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+t_bitst.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+t_bitst.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+t_bitst.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+t_bitst.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+t_bitst.o: ../../include/openssl/x509v3.h ../cryptlib.h
 t_crl.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 t_crl.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 t_crl.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -812,15 +853,17 @@ t_pkey.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 t_pkey.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 t_pkey.o: ../../include/openssl/err.h ../../include/openssl/opensslconf.h
 t_pkey.o: ../../include/openssl/opensslv.h ../../include/openssl/rsa.h
-t_pkey.o: ../../include/openssl/stack.h ../cryptlib.h
+t_pkey.o: ../../include/openssl/safestack.h ../../include/openssl/stack.h
+t_pkey.o: ../cryptlib.h
 t_req.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 t_req.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 t_req.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
-t_req.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+t_req.o: ../../include/openssl/conf.h ../../include/openssl/crypto.h
-t_req.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+t_req.o: ../../include/openssl/des.h ../../include/openssl/dh.h
-t_req.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
+t_req.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
-t_req.o: ../../include/openssl/err.h ../../include/openssl/evp.h
+t_req.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
-t_req.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+t_req.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_req.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
 t_req.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
 t_req.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 t_req.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs7.h
@@ -829,7 +872,24 @@ t_req.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 t_req.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 t_req.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 t_req.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-t_req.o: ../cryptlib.h
+t_req.o: ../../include/openssl/x509v3.h ../cryptlib.h
+t_spki.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+t_spki.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+t_spki.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+t_spki.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+t_spki.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_spki.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_spki.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_spki.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_spki.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+t_spki.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+t_spki.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+t_spki.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+t_spki.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+t_spki.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+t_spki.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+t_spki.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+t_spki.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 t_x509.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 t_x509.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 t_x509.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -848,6 +908,23 @@ t_x509.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 t_x509.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
 t_x509.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 t_x509.o: ../../include/openssl/x509v3.h ../cryptlib.h
+t_x509a.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+t_x509a.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+t_x509a.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+t_x509a.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+t_x509a.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+t_x509a.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+t_x509a.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+t_x509a.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+t_x509a.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+t_x509a.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+t_x509a.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+t_x509a.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+t_x509a.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+t_x509a.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+t_x509a.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+t_x509a.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+t_x509a.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 x_algor.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 x_algor.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 x_algor.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
@@ -1088,3 +1165,20 @@ x_x509.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 x_x509.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
 x_x509.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
 x_x509.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+x_x509a.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
+x_x509a.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
+x_x509a.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
+x_x509a.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
+x_x509a.o: ../../include/openssl/des.h ../../include/openssl/dh.h
+x_x509a.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
+x_x509a.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+x_x509a.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+x_x509a.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
+x_x509a.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
+x_x509a.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+x_x509a.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+x_x509a.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+x_x509a.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+x_x509a.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+x_x509a.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+x_x509a.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
diff --git a/src/lib/libcrypto/asn1/a_bitstr.c b/src/lib/libcrypto/asn1/a_bitstr.c
index 38ea802be8..c77456b315 100644
--- a/src/lib/libcrypto/asn1/a_bitstr.c
+++ b/src/lib/libcrypto/asn1/a_bitstr.c
@@ -60,6 +60,15 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+ASN1_BIT_STRING *ASN1_BIT_STRING_new(void)
+{ return M_ASN1_BIT_STRING_new(); }
+void ASN1_BIT_STRING_free(ASN1_BIT_STRING *x)
+{ M_ASN1_BIT_STRING_free(x); }
+int ASN1_BIT_STRING_set(ASN1_BIT_STRING *x, unsigned char *d, int len)
+{ return M_ASN1_BIT_STRING_set(x, d, len); }
 int i2d_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
        {
        int ret,j,r,bits,len;
@@ -121,7 +130,7 @@ ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
        if ((a == NULL) || ((*a) == NULL))
                {
-                if ((ret=ASN1_BIT_STRING_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_BIT_STRING_new()) == NULL) return(NULL);
                }
        else
                ret=(*a);
@@ -164,7 +173,7 @@ ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
                s=NULL;
        ret->length=(int)len;
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
        ret->data=s;
        ret->type=V_ASN1_BIT_STRING;
        if (a != NULL) (*a)=ret;
@@ -173,7 +182,7 @@ ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a, unsigned char **pp,
 err:
        ASN1err(ASN1_F_D2I_ASN1_BIT_STRING,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_BIT_STRING_free(ret);
+                M_ASN1_BIT_STRING_free(ret);
        return(NULL);
        }
diff --git a/src/lib/libcrypto/asn1/a_bmp.c b/src/lib/libcrypto/asn1/a_bmp.c
index 6075871984..d9ac5a0475 100644
--- a/src/lib/libcrypto/asn1/a_bmp.c
+++ b/src/lib/libcrypto/asn1/a_bmp.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+ASN1_BMPSTRING *ASN1_BMPSTRING_new(void)
+{ return M_ASN1_BMPSTRING_new(); }
+void ASN1_BMPSTRING_free(ASN1_BMPSTRING *x)
+{ M_ASN1_BMPSTRING_free(x); }
 int i2d_ASN1_BMPSTRING(ASN1_BMPSTRING *a, unsigned char **pp)
        {
        return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
diff --git a/src/lib/libcrypto/asn1/a_bytes.c b/src/lib/libcrypto/asn1/a_bytes.c
index e452e03b88..8cde695804 100644
--- a/src/lib/libcrypto/asn1/a_bytes.c
+++ b/src/lib/libcrypto/asn1/a_bytes.c
@@ -71,7 +71,7 @@ B_ASN1_T61STRING,B_ASN1_VIDEOTEXSTRING,B_ASN1_IA5STRING,0,
 B_ASN1_UNIVERSALSTRING,B_ASN1_UNKNOWN,B_ASN1_BMPSTRING,B_ASN1_UNKNOWN,
        };
-static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c);
+static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c);
 /* type is a 'bitmap' of acceptable string types.
 */
 ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a, unsigned char **pp,
@@ -124,7 +124,7 @@ ASN1_STRING *d2i_ASN1_type_bytes(ASN1_STRING **a, unsigned char **pp,
        else
                s=NULL;
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
        ret->length=(int)len;
        ret->data=s;
        ret->type=tag;
@@ -205,7 +205,7 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
                c.tag=Ptag;
                c.xclass=Pclass;
                c.max=(length == 0)?0:(p+length);
-                if (!asn1_collate_primative(ret,&c)) 
+                if (!asn1_collate_primitive(ret,&c)) 
                        goto err; 
                else
                        {
@@ -218,8 +218,8 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
                        {
                        if ((ret->length < len) || (ret->data == NULL))
                                {
-                                if (ret->data != NULL) Free((char *)ret->data);
+                                if (ret->data != NULL) Free(ret->data);
-                                s=(unsigned char *)Malloc((int)len);
+                                s=(unsigned char *)Malloc((int)len + 1);
                                if (s == NULL)
                                        {
                                        i=ERR_R_MALLOC_FAILURE;
@@ -229,12 +229,13 @@ ASN1_STRING *d2i_ASN1_bytes(ASN1_STRING **a, unsigned char **pp, long length,
                        else
                                s=ret->data;
                        memcpy(s,p,(int)len);
+                        s[len] = '\0';
                        p+=len;
                        }
                else
                        {
                        s=NULL;
-                        if (ret->data != NULL) Free((char *)ret->data);
+                        if (ret->data != NULL) Free(ret->data);
                        }
                ret->length=(int)len;
@@ -253,11 +254,11 @@ err:
        }
-/* We are about to parse 0..n d2i_ASN1_bytes objects, we are to collapes
+/* We are about to parse 0..n d2i_ASN1_bytes objects, we are to collapse
- * them into the one struture that is then returned */
+ * them into the one structure that is then returned */
 /* There have been a few bug fixes for this function from
 * Paul Keogh <paul.keogh@sse.ie>, many thanks to him */
-static int asn1_collate_primative(ASN1_STRING *a, ASN1_CTX *c)
+static int asn1_collate_primitive(ASN1_STRING *a, ASN1_CTX *c)
        {
        ASN1_STRING *os=NULL;
        BUF_MEM b;
diff --git a/src/lib/libcrypto/asn1/a_digest.c b/src/lib/libcrypto/asn1/a_digest.c
index 8c45add557..3370aae998 100644
--- a/src/lib/libcrypto/asn1/a_digest.c
+++ b/src/lib/libcrypto/asn1/a_digest.c
@@ -58,16 +58,19 @@
 #include <stdio.h>
 #include <time.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "cryptlib.h"
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
 #include <openssl/evp.h>
 #include <openssl/buffer.h>
 #include <openssl/x509.h>
-int ASN1_digest(int (*i2d)(), EVP_MD *type, char *data, unsigned char *md,
+int ASN1_digest(int (*i2d)(), const EVP_MD *type, char *data,
-             unsigned int *len)
+                unsigned char *md, unsigned int *len)
        {
        EVP_MD_CTX ctx;
        int i;
diff --git a/src/lib/libcrypto/asn1/a_dup.c b/src/lib/libcrypto/asn1/a_dup.c
index c0a8709f3b..3202a816d0 100644
--- a/src/lib/libcrypto/asn1/a_dup.c
+++ b/src/lib/libcrypto/asn1/a_dup.c
@@ -78,6 +78,6 @@ char *ASN1_dup(int (*i2d)(), char *(*d2i)(), char *x)
        i=i2d(x,&p);
        p= b;
        ret=d2i(NULL,&p,i);
-        Free((char *)b);
+        Free(b);
        return(ret);
        }
diff --git a/src/lib/libcrypto/asn1/a_enum.c b/src/lib/libcrypto/asn1/a_enum.c
index 9239ecc439..ccf62e5a04 100644
--- a/src/lib/libcrypto/asn1/a_enum.c
+++ b/src/lib/libcrypto/asn1/a_enum.c
@@ -65,6 +65,12 @@
 * for comments on encoding see a_int.c
 */
+ASN1_ENUMERATED *ASN1_ENUMERATED_new(void)
+{ return M_ASN1_ENUMERATED_new(); }
+void ASN1_ENUMERATED_free(ASN1_ENUMERATED *x)
+{ M_ASN1_ENUMERATED_free(x); }
 int i2d_ASN1_ENUMERATED(ASN1_ENUMERATED *a, unsigned char **pp)
        {
        int pad=0,ret,r,i,t;
@@ -142,7 +148,7 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
        if ((a == NULL) || ((*a) == NULL))
                {
-                if ((ret=ASN1_ENUMERATED_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_ENUMERATED_new()) == NULL) return(NULL);
                ret->type=V_ASN1_ENUMERATED;
                }
        else
@@ -171,7 +177,12 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
                goto err;
                }
        to=s;
-        if (*p & 0x80) /* a negative number */
+        if(!len) {
+                /* Strictly speaking this is an illegal ENUMERATED but we
+                 * tolerate it.
+                 */
+                ret->type=V_ASN1_ENUMERATED;
+        } else if (*p & 0x80) /* a negative number */
                {
                ret->type=V_ASN1_NEG_ENUMERATED;
                if ((*p == 0xff) && (len != 1)) {
@@ -208,7 +219,7 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
                p+=len;
        }
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
        ret->data=s;
        ret->length=(int)len;
        if (a != NULL) (*a)=ret;
@@ -217,7 +228,7 @@ ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a, unsigned char **pp,
 err:
        ASN1err(ASN1_F_D2I_ASN1_ENUMERATED,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_ENUMERATED_free(ret);
+                M_ASN1_ENUMERATED_free(ret);
        return(NULL);
        }
@@ -231,7 +242,7 @@ int ASN1_ENUMERATED_set(ASN1_ENUMERATED *a, long v)
        if (a->length < (sizeof(long)+1))
                {
                if (a->data != NULL)
-                        Free((char *)a->data);
+                        Free(a->data);
                if ((a->data=(unsigned char *)Malloc(sizeof(long)+1)) != NULL)
                        memset((char *)a->data,0,sizeof(long)+1);
                }
@@ -295,7 +306,7 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
        int len,j;
        if (ai == NULL)
-                ret=ASN1_ENUMERATED_new();
+                ret=M_ASN1_ENUMERATED_new();
        else
                ret=ai;
        if (ret == NULL)
@@ -311,7 +322,7 @@ ASN1_ENUMERATED *BN_to_ASN1_ENUMERATED(BIGNUM *bn, ASN1_ENUMERATED *ai)
        ret->length=BN_bn2bin(bn,ret->data);
        return(ret);
 err:
-        if (ret != ai) ASN1_ENUMERATED_free(ret);
+        if (ret != ai) M_ASN1_ENUMERATED_free(ret);
        return(NULL);
        }
diff --git a/src/lib/libcrypto/asn1/a_gentm.c b/src/lib/libcrypto/asn1/a_gentm.c
index 226474f057..84062170e8 100644
--- a/src/lib/libcrypto/asn1/a_gentm.c
+++ b/src/lib/libcrypto/asn1/a_gentm.c
@@ -63,6 +63,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_new(void)
+{ return M_ASN1_GENERALIZEDTIME_new(); }
+void ASN1_GENERALIZEDTIME_free(ASN1_GENERALIZEDTIME *x)
+{ M_ASN1_GENERALIZEDTIME_free(x); }
 int i2d_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME *a, unsigned char **pp)
        {
 #ifdef CHARSET_EBCDIC
@@ -106,7 +112,7 @@ ASN1_GENERALIZEDTIME *d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a,
        return(ret);
 err:
        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_GENERALIZEDTIME_free(ret);
+                M_ASN1_GENERALIZEDTIME_free(ret);
        return(NULL);
        }
@@ -193,7 +199,7 @@ ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,
 #endif
        if (s == NULL)
-                s=ASN1_GENERALIZEDTIME_new();
+                s=M_ASN1_GENERALIZEDTIME_new();
        if (s == NULL)
                return(NULL);
diff --git a/src/lib/libcrypto/asn1/a_hdr.c b/src/lib/libcrypto/asn1/a_hdr.c
index 1171d36443..434610e8e1 100644
--- a/src/lib/libcrypto/asn1/a_hdr.c
+++ b/src/lib/libcrypto/asn1/a_hdr.c
@@ -102,7 +102,7 @@ ASN1_HEADER *ASN1_HEADER_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,ASN1_HEADER);
-        M_ASN1_New(ret->header,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->header,M_ASN1_OCTET_STRING_new);
        ret->meth=NULL;
        ret->data=NULL;
        return(ret);
@@ -112,8 +112,8 @@ ASN1_HEADER *ASN1_HEADER_new(void)
 void ASN1_HEADER_free(ASN1_HEADER *a)
        {
        if (a == NULL) return;
-        ASN1_OCTET_STRING_free(a->header);
+        M_ASN1_OCTET_STRING_free(a->header);
        if (a->meth != NULL)
                a->meth->destroy(a->data);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/a_i2d_fp.c b/src/lib/libcrypto/asn1/a_i2d_fp.c
index 6bd845443c..d9b8035e17 100644
--- a/src/lib/libcrypto/asn1/a_i2d_fp.c
+++ b/src/lib/libcrypto/asn1/a_i2d_fp.c
@@ -108,6 +108,6 @@ int ASN1_i2d_bio(int (*i2d)(), BIO *out, unsigned char *x)
                j+=i;
                n-=i;
                }
-        Free((char *)b);
+        Free(b);
        return(ret);
        }
diff --git a/src/lib/libcrypto/asn1/a_int.c b/src/lib/libcrypto/asn1/a_int.c
index d05436378b..8b6794e8c1 100644
--- a/src/lib/libcrypto/asn1/a_int.c
+++ b/src/lib/libcrypto/asn1/a_int.c
@@ -60,6 +60,18 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+ASN1_INTEGER *ASN1_INTEGER_new(void)
+{ return M_ASN1_INTEGER_new();}
+void ASN1_INTEGER_free(ASN1_INTEGER *x)
+{ M_ASN1_INTEGER_free(x);}
+ASN1_INTEGER *ASN1_INTEGER_dup(ASN1_INTEGER *x)
+{ return M_ASN1_INTEGER_dup(x);}
+int ASN1_INTEGER_cmp(ASN1_INTEGER *x, ASN1_INTEGER *y)
+{ return M_ASN1_INTEGER_cmp(x,y);}
 /* 
 * This converts an ASN1 INTEGER into its DER encoding.
 * The internal representation is an ASN1_STRING whose data is a big endian
@@ -160,7 +172,7 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
        if ((a == NULL) || ((*a) == NULL))
                {
-                if ((ret=ASN1_INTEGER_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_INTEGER_new()) == NULL) return(NULL);
                ret->type=V_ASN1_INTEGER;
                }
        else
@@ -190,7 +202,12 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
                goto err;
                }
        to=s;
-        if (*p & 0x80) /* a negative number */
+        if(!len) {
+                /* Strictly speaking this is an illegal INTEGER but we
+                 * tolerate it.
+                 */
+                ret->type=V_ASN1_INTEGER;
+        } else if (*p & 0x80) /* a negative number */
                {
                ret->type=V_ASN1_NEG_INTEGER;
                if ((*p == 0xff) && (len != 1)) {
@@ -231,7 +248,7 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
                memcpy(s,p,(int)len);
        }
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
        ret->data=s;
        ret->length=(int)len;
        if (a != NULL) (*a)=ret;
@@ -240,7 +257,7 @@ ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a, unsigned char **pp,
 err:
        ASN1err(ASN1_F_D2I_ASN1_INTEGER,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_INTEGER_free(ret);
+                M_ASN1_INTEGER_free(ret);
        return(NULL);
        }
@@ -260,7 +277,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
        if ((a == NULL) || ((*a) == NULL))
                {
-                if ((ret=ASN1_INTEGER_new()) == NULL) return(NULL);
+                if ((ret=M_ASN1_INTEGER_new()) == NULL) return(NULL);
                ret->type=V_ASN1_INTEGER;
                }
        else
@@ -289,7 +306,8 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
                goto err;
                }
        to=s;
-                ret->type=V_ASN1_INTEGER;
+        ret->type=V_ASN1_INTEGER;
+        if(len) {
                if ((*p == 0) && (len != 1))
                        {
                        p++;
@@ -297,8 +315,9 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
                        }
                memcpy(s,p,(int)len);
                p+=len;
+        }
-        if (ret->data != NULL) Free((char *)ret->data);
+        if (ret->data != NULL) Free(ret->data);
        ret->data=s;
        ret->length=(int)len;
        if (a != NULL) (*a)=ret;
@@ -307,7 +326,7 @@ ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a, unsigned char **pp,
 err:
        ASN1err(ASN1_F_D2I_ASN1_UINTEGER,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_INTEGER_free(ret);
+                M_ASN1_INTEGER_free(ret);
        return(NULL);
        }
@@ -321,7 +340,7 @@ int ASN1_INTEGER_set(ASN1_INTEGER *a, long v)
        if (a->length < (sizeof(long)+1))
                {
                if (a->data != NULL)
-                        Free((char *)a->data);
+                        Free(a->data);
                if ((a->data=(unsigned char *)Malloc(sizeof(long)+1)) != NULL)
                        memset((char *)a->data,0,sizeof(long)+1);
                }
@@ -385,7 +404,7 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
        int len,j;
        if (ai == NULL)
-                ret=ASN1_INTEGER_new();
+                ret=M_ASN1_INTEGER_new();
        else
                ret=ai;
        if (ret == NULL)
@@ -401,7 +420,7 @@ ASN1_INTEGER *BN_to_ASN1_INTEGER(BIGNUM *bn, ASN1_INTEGER *ai)
        ret->length=BN_bn2bin(bn,ret->data);
        return(ret);
 err:
-        if (ret != ai) ASN1_INTEGER_free(ret);
+        if (ret != ai) M_ASN1_INTEGER_free(ret);
        return(NULL);
        }
diff --git a/src/lib/libcrypto/asn1/a_mbstr.c b/src/lib/libcrypto/asn1/a_mbstr.c
new file mode 100644
index 0000000000..7a710d5459
--- /dev/null
+++ b/src/lib/libcrypto/asn1/a_mbstr.c
@@ -0,0 +1,390 @@
+/* a_mbstr.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <stdio.h>
+#include <ctype.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+static int traverse_string(const unsigned char *p, int len, int inform,
+                 int (*rfunc)(unsigned long value, void *in), void *arg);
+static int in_utf8(unsigned long value, void *arg);
+static int out_utf8(unsigned long value, void *arg);
+static int type_str(unsigned long value, void *arg);
+static int cpy_asc(unsigned long value, void *arg);
+static int cpy_bmp(unsigned long value, void *arg);
+static int cpy_univ(unsigned long value, void *arg);
+static int cpy_utf8(unsigned long value, void *arg);
+static int is_printable(unsigned long value);
+/* These functions take a string in UTF8, ASCII or multibyte form and
+ * a mask of permissible ASN1 string types. It then works out the minimal
+ * type (using the order Printable < IA5 < T61 < BMP < Universal < UTF8)
+ * and creates a string of the correct type with the supplied data.
+ * Yes this is horrible: it has to be :-(
+ * The 'ncopy' form checks minimum and maximum size limits too.
+ */
+int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask)
+{
+        return ASN1_mbstring_ncopy(out, in, len, inform, mask, 0, 0);
+}
+int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask, 
+                                        long minsize, long maxsize)
+{
+        int str_type;
+        int ret;
+        int outform, outlen;
+        ASN1_STRING *dest;
+        unsigned char *p;
+        int nchar;
+        char strbuf[32];
+        int (*cpyfunc)(unsigned long,void *) = NULL;
+        if(len == -1) len = strlen((const char *)in);
+        if(!mask) mask = DIRSTRING_TYPE;
+        /* First do a string check and work out the number of characters */
+        switch(inform) {
+                case MBSTRING_BMP:
+                if(len & 1) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                         ASN1_R_INVALID_BMPSTRING_LENGTH);
+                        return -1;
+                }
+                nchar = len >> 1;
+                break;
+                case MBSTRING_UNIV:
+                if(len & 3) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                         ASN1_R_INVALID_UNIVERSALSTRING_LENGTH);
+                        return -1;
+                }
+                nchar = len >> 2;
+                break;
+                case MBSTRING_UTF8:
+                nchar = 0;
+                /* This counts the characters and does utf8 syntax checking */
+                ret = traverse_string(in, len, MBSTRING_UTF8, in_utf8, &nchar);
+                if(ret < 0) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                                 ASN1_R_INVALID_UTF8STRING);
+                        return -1;
+                }
+                break;
+                case MBSTRING_ASC:
+                nchar = len;
+                break;
+                default:
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_UNKNOWN_FORMAT);
+                return -1;
+        }
+        if((minsize > 0) && (nchar < minsize)) {
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_SHORT);
+                sprintf(strbuf, "%ld", minsize);
+                ERR_add_error_data(2, "minsize=", strbuf);
+                return -1;
+        }
+        if((maxsize > 0) && (nchar > maxsize)) {
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_STRING_TOO_LONG);
+                sprintf(strbuf, "%ld", maxsize);
+                ERR_add_error_data(2, "maxsize=", strbuf);
+                return -1;
+        }
+        /* Now work out minimal type (if any) */
+        if(traverse_string(in, len, inform, type_str, &mask) < 0) {
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY, ASN1_R_ILLEGAL_CHARACTERS);
+                return -1;
+        }
+        /* Now work out output format and string type */
+        outform = MBSTRING_ASC;
+        if(mask & B_ASN1_PRINTABLESTRING) str_type = V_ASN1_PRINTABLESTRING;
+        else if(mask & B_ASN1_IA5STRING) str_type = V_ASN1_IA5STRING;
+        else if(mask & B_ASN1_T61STRING) str_type = V_ASN1_T61STRING;
+        else if(mask & B_ASN1_BMPSTRING) {
+                str_type = V_ASN1_BMPSTRING;
+                outform = MBSTRING_BMP;
+        } else if(mask & B_ASN1_UNIVERSALSTRING) {
+                str_type = V_ASN1_UNIVERSALSTRING;
+                outform = MBSTRING_UNIV;
+        } else {
+                str_type = V_ASN1_UTF8STRING;
+                outform = MBSTRING_UTF8;
+        }
+        if(!out) return str_type;
+        if(*out) {
+                dest = *out;
+                if(dest->data) {
+                        dest->length = 0;
+                        Free(dest->data);
+                        dest->data = NULL;
+                }
+                dest->type = str_type;
+        } else {
+                dest = ASN1_STRING_type_new(str_type);
+                if(!dest) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,
+                                                        ERR_R_MALLOC_FAILURE);
+                        return -1;
+                }
+                *out = dest;
+        }
+        /* If both the same type just copy across */
+        if(inform == outform) {
+                if(!ASN1_STRING_set(dest, in, len)) {
+                        ASN1err(ASN1_F_ASN1_MBSTRING_COPY,ERR_R_MALLOC_FAILURE);
+                        return -1;
+                }
+                return str_type;
+        } 
+        /* Work out how much space the destination will need */
+        switch(outform) {
+                case MBSTRING_ASC:
+                outlen = nchar;
+                cpyfunc = cpy_asc;
+                break;
+                case MBSTRING_BMP:
+                outlen = nchar << 1;
+                cpyfunc = cpy_bmp;
+                break;
+                case MBSTRING_UNIV:
+                outlen = nchar << 2;
+                cpyfunc = cpy_univ;
+                break;
+                case MBSTRING_UTF8:
+                outlen = 0;
+                traverse_string(in, len, inform, out_utf8, &outlen);
+                cpyfunc = cpy_utf8;
+                break;
+        }
+        if(!(p = Malloc(outlen + 1))) {
+                ASN1_STRING_free(dest);
+                ASN1err(ASN1_F_ASN1_MBSTRING_COPY,ERR_R_MALLOC_FAILURE);
+                return -1;
+        }
+        dest->length = outlen;
+        dest->data = p;
+        p[outlen] = 0;
+        traverse_string(in, len, inform, cpyfunc, &p);
+        return str_type;        
+}
+/* This function traverses a string and passes the value of each character
+ * to an optional function along with a void * argument.
+ */
+static int traverse_string(const unsigned char *p, int len, int inform,
+                 int (*rfunc)(unsigned long value, void *in), void *arg)
+{
+        unsigned long value;
+        int ret;
+        while(len) {
+                if(inform == MBSTRING_ASC) {
+                        value = *p++;
+                        len--;
+                } else if(inform == MBSTRING_BMP) {
+                        value = *p++ << 8;
+                        value |= *p++;
+                        len -= 2;
+                } else if(inform == MBSTRING_UNIV) {
+                        value = *p++ << 24;
+                        value |= *p++ << 16;
+                        value |= *p++ << 8;
+                        value |= *p++;
+                        len -= 4;
+                } else {
+                        ret = UTF8_getc(p, len, &value);
+                        if(ret < 0) return -1;
+                        len -= ret;
+                        p += ret;
+                }
+                if(rfunc) {
+                        ret = rfunc(value, arg);
+                        if(ret <= 0) return ret;
+                }
+        }
+        return 1;
+}
+/* Various utility functions for traverse_string */
+/* Just count number of characters */
+static int in_utf8(unsigned long value, void *arg)
+{
+        int *nchar;
+        nchar = arg;
+        (*nchar)++;
+        return 1;
+}
+/* Determine size of output as a UTF8 String */
+static int out_utf8(unsigned long value, void *arg)
+{
+        long *outlen;
+        outlen = arg;
+        *outlen += UTF8_putc(NULL, -1, value);
+        return 1;
+}
+/* Determine the "type" of a string: check each character against a
+ * supplied "mask".
+ */
+static int type_str(unsigned long value, void *arg)
+{
+        unsigned long types;
+        types = *((unsigned long *)arg);
+        if((types & B_ASN1_PRINTABLESTRING) && !is_printable(value))
+                                        types &= ~B_ASN1_PRINTABLESTRING;
+        if((types & B_ASN1_IA5STRING) && (value > 127))
+                                        types &= ~B_ASN1_IA5STRING;
+        if((types & B_ASN1_T61STRING) && (value > 0xff))
+                                        types &= ~B_ASN1_T61STRING;
+        if((types & B_ASN1_BMPSTRING) && (value > 0xffff))
+                                        types &= ~B_ASN1_BMPSTRING;
+        if(!types) return -1;
+        *((unsigned long *)arg) = types;
+        return 1;
+}
+/* Copy one byte per character ASCII like strings */
+static int cpy_asc(unsigned long value, void *arg)
+{
+        unsigned char **p, *q;
+        p = arg;
+        q = *p;
+        *q = (unsigned char) value;
+        (*p)++;
+        return 1;
+}
+/* Copy two byte per character BMPStrings */
+static int cpy_bmp(unsigned long value, void *arg)
+{
+        unsigned char **p, *q;
+        p = arg;
+        q = *p;
+        *q++ = (unsigned char) ((value >> 8) & 0xff);
+        *q = (unsigned char) (value & 0xff);
+        *p += 2;
+        return 1;
+}
+/* Copy four byte per character UniversalStrings */
+static int cpy_univ(unsigned long value, void *arg)
+{
+        unsigned char **p, *q;
+        p = arg;
+        q = *p;
+        *q++ = (unsigned char) ((value >> 24) & 0xff);
+        *q++ = (unsigned char) ((value >> 16) & 0xff);
+        *q++ = (unsigned char) ((value >> 8) & 0xff);
+        *q = (unsigned char) (value & 0xff);
+        *p += 4;
+        return 1;
+}
+/* Copy to a UTF8String */
+static int cpy_utf8(unsigned long value, void *arg)
+{
+        unsigned char **p;
+        int ret;
+        p = arg;
+        /* We already know there is enough room so pass 0xff as the length */
+        ret = UTF8_putc(*p, 0xff, value);
+        *p += ret;
+        return 1;
+}
+/* Return 1 if the character is permitted in a PrintableString */
+static int is_printable(unsigned long value)
+{
+        int ch;
+        if(value > 0x7f) return 0;
+        ch = (int) value;
+        /* Note: we can't use 'isalnum' because certain accented 
+         * characters may count as alphanumeric in some environments.
+         */
+        if((ch >= 'a') && (ch <= 'z')) return 1;
+        if((ch >= 'A') && (ch <= 'Z')) return 1;
+        if((ch >= '0') && (ch <= '9')) return 1;
+        if ((ch == ' ') || strchr("'()+,-./:=?", ch)) return 1;
+        return 0;
+}
diff --git a/src/lib/libcrypto/asn1/a_null.c b/src/lib/libcrypto/asn1/a_null.c
new file mode 100644
index 0000000000..119fd784be
--- /dev/null
+++ b/src/lib/libcrypto/asn1/a_null.c
@@ -0,0 +1,119 @@
+/* a_null.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+/* ASN1 functions for NULL type. For compatibility with other ASN1 code
+ * it returns a pointer to an "ASN1_NULL" structure. The new/free functions
+ * don't need to do any allocating because nothing is stored in a NULL.
+ */
+int i2d_ASN1_NULL(ASN1_NULL *a, unsigned char **pp)
+        {
+        if(!a) return 0;
+        if (pp) ASN1_put_object(pp,0,0,V_ASN1_NULL,V_ASN1_UNIVERSAL);
+        return 2;
+        }
+ASN1_NULL *d2i_ASN1_NULL(ASN1_NULL **a, unsigned char **pp, long length)
+        {
+        ASN1_NULL *ret = NULL;
+        unsigned char *p;
+        long len;
+        int inf,tag,xclass;
+        int i=0;
+        p= *pp;
+        inf=ASN1_get_object(&p,&len,&tag,&xclass,length);
+        if (inf & 0x80)
+                {
+                i=ASN1_R_BAD_OBJECT_HEADER;
+                goto err;
+                }
+        if (tag != V_ASN1_NULL)
+                {
+                i=ASN1_R_EXPECTING_A_NULL;
+                goto err;
+                }
+        if (len != 0)
+                {
+                i=ASN1_R_NULL_IS_WRONG_LENGTH;
+                goto err;
+                }
+        ret=(ASN1_NULL *)1;
+        if (a != NULL) (*a)=ret;
+        *pp=p;
+        return(ret);
+err:
+        ASN1err(ASN1_F_D2I_ASN1_NULL,i);
+        return(ret);
+        }
+ASN1_NULL *ASN1_NULL_new(void)
+{
+        return (ASN1_NULL *)1;
+}
+void ASN1_NULL_free(ASN1_NULL *a)
+{
+        return;
+}
diff --git a/src/lib/libcrypto/asn1/a_object.c b/src/lib/libcrypto/asn1/a_object.c
index b94b418ee8..09d56fb669 100644
--- a/src/lib/libcrypto/asn1/a_object.c
+++ b/src/lib/libcrypto/asn1/a_object.c
@@ -222,8 +222,8 @@ ASN1_OBJECT *d2i_ASN1_OBJECT(ASN1_OBJECT **a, unsigned char **pp,
                }
        if ((ret->data == NULL) || (ret->length < len))
                {
-                if (ret->data != NULL) Free((char *)ret->data);
+                if (ret->data != NULL) Free(ret->data);
-                ret->data=(unsigned char *)Malloc((int)len);
+                ret->data=(unsigned char *)Malloc(len ? (int)len : 1);
                ret->flags|=ASN1_OBJECT_FLAG_DYNAMIC_DATA;
                if (ret->data == NULL)
                        { i=ERR_R_MALLOC_FAILURE; goto err; }
@@ -269,7 +269,7 @@ void ASN1_OBJECT_free(ASN1_OBJECT *a)
        if (a == NULL) return;
        if (a->flags & ASN1_OBJECT_FLAG_DYNAMIC_STRINGS)
                {
-#ifndef CONST_STRICT /* disable purely for compile-time strict const checking. Doing this on a "real" compile will cause mempory leaks */
+#ifndef CONST_STRICT /* disable purely for compile-time strict const checking. Doing this on a "real" compile will cause memory leaks */
                if (a->sn != NULL) Free((void *)a->sn);
                if (a->ln != NULL) Free((void *)a->ln);
 #endif
diff --git a/src/lib/libcrypto/asn1/a_octet.c b/src/lib/libcrypto/asn1/a_octet.c
index 7659a13bd3..2586f4327d 100644
--- a/src/lib/libcrypto/asn1/a_octet.c
+++ b/src/lib/libcrypto/asn1/a_octet.c
@@ -60,11 +60,23 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+ASN1_OCTET_STRING *ASN1_OCTET_STRING_new(void)
+{ return M_ASN1_OCTET_STRING_new(); }
+void ASN1_OCTET_STRING_free(ASN1_OCTET_STRING *x)
+{ M_ASN1_OCTET_STRING_free(x); }
+ASN1_OCTET_STRING *ASN1_OCTET_STRING_dup(ASN1_OCTET_STRING *x)
+{ return M_ASN1_OCTET_STRING_dup(x); }
+int ASN1_OCTET_STRING_cmp(ASN1_OCTET_STRING *a, ASN1_OCTET_STRING *b)
+{ return M_ASN1_OCTET_STRING_cmp(a, b); }
+int ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *x, unsigned char *d, int len)
+{ return M_ASN1_OCTET_STRING_set(x, d, len); }
 int i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a, unsigned char **pp)
-        {
+{ return M_i2d_ASN1_OCTET_STRING(a, pp); }
-        return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
-                V_ASN1_OCTET_STRING,V_ASN1_UNIVERSAL));
-        }
 ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,
             unsigned char **pp, long length)
diff --git a/src/lib/libcrypto/asn1/a_print.c b/src/lib/libcrypto/asn1/a_print.c
index cdec7a1561..b7bd2bd18a 100644
--- a/src/lib/libcrypto/asn1/a_print.c
+++ b/src/lib/libcrypto/asn1/a_print.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+ASN1_IA5STRING *ASN1_IA5STRING_new(void)
+{ return M_ASN1_IA5STRING_new();}
+void ASN1_IA5STRING_free(ASN1_IA5STRING *x)
+{ M_ASN1_IA5STRING_free(x);}
 int i2d_ASN1_IA5STRING(ASN1_IA5STRING *a, unsigned char **pp)
        { return(M_i2d_ASN1_IA5STRING(a,pp)); }
@@ -67,15 +73,30 @@ ASN1_IA5STRING *d2i_ASN1_IA5STRING(ASN1_IA5STRING **a, unsigned char **pp,
             long l)
        { return(M_d2i_ASN1_IA5STRING(a,pp,l)); }
+ASN1_T61STRING *ASN1_T61STRING_new(void)
+{ return M_ASN1_T61STRING_new();}
+void ASN1_T61STRING_free(ASN1_T61STRING *x)
+{ M_ASN1_T61STRING_free(x);}
 ASN1_T61STRING *d2i_ASN1_T61STRING(ASN1_T61STRING **a, unsigned char **pp,
             long l)
        { return(M_d2i_ASN1_T61STRING(a,pp,l)); }
+ASN1_PRINTABLESTRING *ASN1_PRINTABLESTRING_new(void)
+{ return M_ASN1_PRINTABLESTRING_new();}
+void ASN1_PRINTABLESTRING_free(ASN1_PRINTABLESTRING *x)
+{ M_ASN1_PRINTABLESTRING_free(x);}
 ASN1_PRINTABLESTRING *d2i_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING **a,
             unsigned char **pp, long l)
        { return(M_d2i_ASN1_PRINTABLESTRING(a,pp,
             l)); }
+int i2d_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING *a, unsigned char **pp)
+        { return(M_i2d_ASN1_PRINTABLESTRING(a,pp)); }
 int i2d_ASN1_PRINTABLE(ASN1_STRING *a, unsigned char **pp)
        { return(M_i2d_ASN1_PRINTABLE(a,pp)); }
@@ -149,6 +170,11 @@ int ASN1_UNIVERSALSTRING_to_string(ASN1_UNIVERSALSTRING *s)
        return(1);
        }
+ASN1_STRING *DIRECTORYSTRING_new(void)
+{ return M_DIRECTORYSTRING_new();}
+void DIRECTORYSTRING_free(ASN1_STRING *x)
+{ M_DIRECTORYSTRING_free(x);}
 int i2d_DIRECTORYSTRING(ASN1_STRING *a, unsigned char **pp)
        { return(M_i2d_DIRECTORYSTRING(a,pp)); }
@@ -157,6 +183,12 @@ ASN1_STRING *d2i_DIRECTORYSTRING(ASN1_STRING **a, unsigned char **pp,
             long l)
        { return(M_d2i_DIRECTORYSTRING(a,pp,l)); }
+ASN1_STRING *DISPLAYTEXT_new(void)
+{ return M_DISPLAYTEXT_new();}
+void DISPLAYTEXT_free(ASN1_STRING *x)
+{ M_DISPLAYTEXT_free(x);}
 int i2d_DISPLAYTEXT(ASN1_STRING *a, unsigned char **pp)
        { return(M_i2d_DISPLAYTEXT(a,pp)); }
diff --git a/src/lib/libcrypto/asn1/a_sign.c b/src/lib/libcrypto/asn1/a_sign.c
index 57595692e5..cfb4bca4f1 100644
--- a/src/lib/libcrypto/asn1/a_sign.c
+++ b/src/lib/libcrypto/asn1/a_sign.c
@@ -58,10 +58,13 @@
 #include <stdio.h>
 #include <time.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "cryptlib.h"
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
 #include <openssl/bn.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
@@ -126,11 +129,11 @@ int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
                ASN1err(ASN1_F_ASN1_SIGN,ERR_R_EVP_LIB);
                goto err;
                }
-        if (signature->data != NULL) Free((char *)signature->data);
+        if (signature->data != NULL) Free(signature->data);
        signature->data=buf_out;
        buf_out=NULL;
        signature->length=outl;
-        /* In the interests of compatability, I'll make sure that
+        /* In the interests of compatibility, I'll make sure that
         * the bit string has a 'not-used bits' value of 0
         */
        signature->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
@@ -138,8 +141,8 @@ int ASN1_sign(int (*i2d)(), X509_ALGOR *algor1, X509_ALGOR *algor2,
 err:
        memset(&ctx,0,sizeof(ctx));
        if (buf_in != NULL)
-                { memset((char *)buf_in,0,(unsigned int)inl); Free((char *)buf_in); }
+                { memset((char *)buf_in,0,(unsigned int)inl); Free(buf_in); }
        if (buf_out != NULL)
-                { memset((char *)buf_out,0,outll); Free((char *)buf_out); }
+                { memset((char *)buf_out,0,outll); Free(buf_out); }
        return(outl);
        }
diff --git a/src/lib/libcrypto/asn1/a_strnid.c b/src/lib/libcrypto/asn1/a_strnid.c
new file mode 100644
index 0000000000..ab8417ffab
--- /dev/null
+++ b/src/lib/libcrypto/asn1/a_strnid.c
@@ -0,0 +1,247 @@
+/* a_strnid.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <stdio.h>
+#include <ctype.h>
+#include "cryptlib.h"
+#include <openssl/asn1.h>
+#include <openssl/objects.h>
+static STACK_OF(ASN1_STRING_TABLE) *stable = NULL;
+static void st_free(ASN1_STRING_TABLE *tbl);
+static int sk_table_cmp(ASN1_STRING_TABLE **a, ASN1_STRING_TABLE **b);
+static int table_cmp(ASN1_STRING_TABLE *a, ASN1_STRING_TABLE *b);
+/* This is the global mask for the mbstring functions: this is use to
+ * mask out certain types (such as BMPString and UTF8String) because
+ * certain software (e.g. Netscape) has problems with them.
+ */
+static unsigned long global_mask = 0xFFFFFFFFL;
+void ASN1_STRING_set_default_mask(unsigned long mask)
+{
+        global_mask = mask;
+}
+unsigned long ASN1_STRING_get_default_mask(void)
+{
+        return global_mask;
+}
+/* This function sets the default to various "flavours" of configuration.
+ * based on an ASCII string. Currently this is:
+ * MASK:XXXX : a numerical mask value.
+ * nobmp : Don't use BMPStrings (just Printable, T61).
+ * pkix : PKIX recommendation in RFC2459.
+ * utf8only : only use UTF8Strings (RFC2459 recommendation for 2004).
+ * default:   the default value, Printable, T61, BMP.
+ */
+int ASN1_STRING_set_default_mask_asc(char *p)
+{
+        unsigned long mask;
+        char *end;
+        if(!strncmp(p, "MASK:", 5)) {
+                if(!p[5]) return 0;
+                mask = strtoul(p + 5, &end, 0);
+                if(*end) return 0;
+        } else if(!strcmp(p, "nombstr"))
+                         mask = ~(B_ASN1_BMPSTRING|B_ASN1_UTF8STRING);
+        else if(!strcmp(p, "pkix"))
+                        mask = ~B_ASN1_T61STRING;
+        else if(!strcmp(p, "utf8only")) mask = B_ASN1_UTF8STRING;
+        else if(!strcmp(p, "default"))
+            mask = 0xFFFFFFFFL;
+        else return 0;
+        ASN1_STRING_set_default_mask(mask);
+        return 1;
+}
+/* The following function generates an ASN1_STRING based on limits in a table.
+ * Frequently the types and length of an ASN1_STRING are restricted by a 
+ * corresponding OID. For example certificates and certificate requests.
+ */
+ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out, const unsigned char *in,
+                                        int inlen, int inform, int nid)
+{
+        ASN1_STRING_TABLE *tbl;
+        ASN1_STRING *str = NULL;
+        unsigned long mask;
+        int ret;
+        if(!out) out = &str;
+        tbl = ASN1_STRING_TABLE_get(nid);
+        if(tbl) {
+                mask = tbl->mask;
+                if(!(tbl->flags & STABLE_NO_MASK)) mask &= global_mask;
+                ret = ASN1_mbstring_ncopy(out, in, inlen, inform, tbl->mask,
+                                        tbl->minsize, tbl->maxsize);
+        } else ret = ASN1_mbstring_copy(out, in, inlen, inform, DIRSTRING_TYPE & global_mask);
+        if(ret <= 0) return NULL;
+        return *out;
+}
+/* Now the tables and helper functions for the string table:
+ */
+/* size limits: this stuff is taken straight from RFC2459 */
+#define ub_name                         32768
+#define ub_common_name                  64
+#define ub_locality_name                128
+#define ub_state_name                   128
+#define ub_organization_name            64
+#define ub_organization_unit_name       64
+#define ub_title                        64
+#define ub_email_address                128
+/* This table must be kept in NID order */
+static ASN1_STRING_TABLE tbl_standard[] = {
+{NID_commonName,                1, ub_common_name, DIRSTRING_TYPE, 0},
+{NID_countryName,               2, 2, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK},
+{NID_localityName,              1, ub_locality_name, DIRSTRING_TYPE, 0},
+{NID_stateOrProvinceName,       1, ub_state_name, DIRSTRING_TYPE, 0},
+{NID_organizationName,          1, ub_organization_name, DIRSTRING_TYPE, 0},
+{NID_organizationalUnitName,    1, ub_organization_unit_name, DIRSTRING_TYPE, 0},
+{NID_pkcs9_emailAddress,        1, ub_email_address, B_ASN1_IA5STRING, STABLE_NO_MASK},
+{NID_pkcs9_unstructuredName,    1, -1, PKCS9STRING_TYPE, 0},
+{NID_pkcs9_challengePassword,   1, -1, PKCS9STRING_TYPE, 0},
+{NID_pkcs9_unstructuredAddress, 1, -1, DIRSTRING_TYPE, 0},
+{NID_givenName,                 1, ub_name, DIRSTRING_TYPE, 0},
+{NID_surname,                   1, ub_name, DIRSTRING_TYPE, 0},
+{NID_initials,                  1, ub_name, DIRSTRING_TYPE, 0},
+{NID_name,                      1, ub_name, DIRSTRING_TYPE, 0},
+{NID_dnQualifier,               -1, -1, B_ASN1_PRINTABLESTRING, STABLE_NO_MASK}
+};
+static int sk_table_cmp(ASN1_STRING_TABLE **a, ASN1_STRING_TABLE **b)
+{
+        return (*a)->nid - (*b)->nid;
+}
+static int table_cmp(ASN1_STRING_TABLE *a, ASN1_STRING_TABLE *b)
+{
+        return a->nid - b->nid;
+}
+ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid)
+{
+        int idx;
+        ASN1_STRING_TABLE *ttmp;
+        ASN1_STRING_TABLE fnd;
+        fnd.nid = nid;
+        ttmp = (ASN1_STRING_TABLE *) OBJ_bsearch((char *)&fnd,
+                                        (char *)tbl_standard, 
+                        sizeof(tbl_standard)/sizeof(ASN1_STRING_TABLE),
+                        sizeof(ASN1_STRING_TABLE), (int(*)())table_cmp);
+        if(ttmp) return ttmp;
+        if(!stable) return NULL;
+        idx = sk_ASN1_STRING_TABLE_find(stable, &fnd);
+        if(idx < 0) return NULL;
+        return sk_ASN1_STRING_TABLE_value(stable, idx);
+}
+        
+int ASN1_STRING_TABLE_add(int nid,
+                 long minsize, long maxsize, unsigned long mask,
+                                unsigned long flags)
+{
+        ASN1_STRING_TABLE *tmp;
+        char new_nid = 0;
+        flags &= ~STABLE_FLAGS_MALLOC;
+        if(!stable) stable = sk_ASN1_STRING_TABLE_new(sk_table_cmp);
+        if(!stable) {
+                ASN1err(ASN1_F_ASN1_STRING_TABLE_ADD, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        if(!(tmp = ASN1_STRING_TABLE_get(nid))) {
+                tmp = Malloc(sizeof(ASN1_STRING_TABLE));
+                if(!tmp) {
+                        ASN1err(ASN1_F_ASN1_STRING_TABLE_ADD,
+                                                        ERR_R_MALLOC_FAILURE);
+                        return 0;
+                }
+                tmp->flags = flags | STABLE_FLAGS_MALLOC;
+                tmp->nid = nid;
+                new_nid = 1;
+        } else tmp->flags = (tmp->flags & STABLE_FLAGS_MALLOC) | flags;
+        if(minsize != -1) tmp->minsize = minsize;
+        if(maxsize != -1) tmp->maxsize = maxsize;
+        tmp->mask = mask;
+        if(new_nid) sk_ASN1_STRING_TABLE_push(stable, tmp);
+        return 1;
+}
+void ASN1_STRING_TABLE_cleanup(void)
+{
+        STACK_OF(ASN1_STRING_TABLE) *tmp;
+        tmp = stable;
+        if(!tmp) return;
+        stable = NULL;
+        sk_ASN1_STRING_TABLE_pop_free(tmp, st_free);
+}
+static void st_free(ASN1_STRING_TABLE *tbl)
+{
+        if(tbl->flags & STABLE_FLAGS_MALLOC) Free(tbl);
+}
+IMPLEMENT_STACK_OF(ASN1_STRING_TABLE)
diff --git a/src/lib/libcrypto/asn1/a_time.c b/src/lib/libcrypto/asn1/a_time.c
index c1690a5694..b193f1c71f 100644
--- a/src/lib/libcrypto/asn1/a_time.c
+++ b/src/lib/libcrypto/asn1/a_time.c
@@ -66,6 +66,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+ASN1_TIME *ASN1_TIME_new(void)
+{ return M_ASN1_TIME_new(); }
+void ASN1_TIME_free(ASN1_TIME *x)
+{ M_ASN1_TIME_free(x); }
 int i2d_ASN1_TIME(ASN1_TIME *a, unsigned char **pp)
        {
 #ifdef CHARSET_EBCDIC
diff --git a/src/lib/libcrypto/asn1/a_type.c b/src/lib/libcrypto/asn1/a_type.c
index 3f2ecee5c2..161ef81197 100644
--- a/src/lib/libcrypto/asn1/a_type.c
+++ b/src/lib/libcrypto/asn1/a_type.c
@@ -282,7 +282,7 @@ void ASN1_TYPE_free(ASN1_TYPE *a)
        {
        if (a == NULL) return;
        ASN1_TYPE_component_free(a);
-        Free((char *)(char *)a);
+        Free(a);
        }
 int ASN1_TYPE_get(ASN1_TYPE *a)
diff --git a/src/lib/libcrypto/asn1/a_utctm.c b/src/lib/libcrypto/asn1/a_utctm.c
index 688199fdd2..07565974e3 100644
--- a/src/lib/libcrypto/asn1/a_utctm.c
+++ b/src/lib/libcrypto/asn1/a_utctm.c
@@ -66,6 +66,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+ASN1_UTCTIME *ASN1_UTCTIME_new(void)
+{ return M_ASN1_UTCTIME_new(); }
+void ASN1_UTCTIME_free(ASN1_UTCTIME *x)
+{ M_ASN1_UTCTIME_free(x); }
 int i2d_ASN1_UTCTIME(ASN1_UTCTIME *a, unsigned char **pp)
        {
 #ifndef CHARSET_EBCDIC
@@ -109,7 +115,7 @@ ASN1_UTCTIME *d2i_ASN1_UTCTIME(ASN1_UTCTIME **a, unsigned char **pp,
        return(ret);
 err:
        if ((ret != NULL) && ((a == NULL) || (*a != ret)))
-                ASN1_UTCTIME_free(ret);
+                M_ASN1_UTCTIME_free(ret);
        return(NULL);
        }
@@ -192,7 +198,7 @@ ASN1_UTCTIME *ASN1_UTCTIME_set(ASN1_UTCTIME *s, time_t t)
 #endif
        if (s == NULL)
-                s=ASN1_UTCTIME_new();
+                s=M_ASN1_UTCTIME_new();
        if (s == NULL)
                return(NULL);
diff --git a/src/lib/libcrypto/asn1/a_utf8.c b/src/lib/libcrypto/asn1/a_utf8.c
index 4a8a92e9e4..b5125af224 100644
--- a/src/lib/libcrypto/asn1/a_utf8.c
+++ b/src/lib/libcrypto/asn1/a_utf8.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+ASN1_UTF8STRING *ASN1_UTF8STRING_new(void)
+{ return M_ASN1_UTF8STRING_new();}
+void ASN1_UTF8STRING_free(ASN1_UTF8STRING *x)
+{ M_ASN1_UTF8STRING_free(x);}
 int i2d_ASN1_UTF8STRING(ASN1_UTF8STRING *a, unsigned char **pp)
        {
        return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
@@ -81,3 +87,152 @@ ASN1_UTF8STRING *d2i_ASN1_UTF8STRING(ASN1_UTF8STRING **a, unsigned char **pp,
        return(ret);
        }
+/* UTF8 utilities */
+/* This parses a UTF8 string one character at a time. It is passed a pointer
+ * to the string and the length of the string. It sets 'value' to the value of
+ * the current character. It returns the number of characters read or a
+ * negative error code:
+ * -1 = string too short
+ * -2 = illegal character
+ * -3 = subsequent characters not of the form 10xxxxxx
+ * -4 = character encoded incorrectly (not minimal length).
+ */
+int UTF8_getc(const unsigned char *str, int len, unsigned long *val)
+{
+        const unsigned char *p;
+        unsigned long value;
+        int ret;
+        if(len <= 0) return 0;
+        p = str;
+        /* Check syntax and work out the encoded value (if correct) */
+        if((*p & 0x80) == 0) {
+                value = *p++ & 0x7f;
+                ret = 1;
+        } else if((*p & 0xe0) == 0xc0) {
+                if(len < 2) return -1;
+                if((p[1] & 0xc0) != 0x80) return -3;
+                value = (*p++ & 0x1f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x80) return -4;
+                ret = 2;
+        } else if((*p & 0xf0) == 0xe0) {
+                if(len < 3) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0xf) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x800) return -4;
+                ret = 3;
+        } else if((*p & 0xf8) == 0xf0) {
+                if(len < 4) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) 
+                   || ((p[3] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0x7) << 18;
+                value |= (*p++ & 0x3f) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x10000) return -4;
+                ret = 4;
+        } else if((*p & 0xfc) == 0xf8) {
+                if(len < 5) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) 
+                   || ((p[3] & 0xc0) != 0x80) 
+                   || ((p[4] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0x3) << 24;
+                value |= (*p++ & 0x3f) << 18;
+                value |= (*p++ & 0x3f) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x200000) return -4;
+                ret = 5;
+        } else if((*p & 0xfe) == 0xfc) {
+                if(len < 6) return -1;
+                if( ((p[1] & 0xc0) != 0x80)
+                   || ((p[2] & 0xc0) != 0x80) 
+                   || ((p[3] & 0xc0) != 0x80) 
+                   || ((p[4] & 0xc0) != 0x80) 
+                   || ((p[5] & 0xc0) != 0x80) ) return -3;
+                value = (*p++ & 0x1) << 30;
+                value |= (*p++ & 0x3f) << 24;
+                value |= (*p++ & 0x3f) << 18;
+                value |= (*p++ & 0x3f) << 12;
+                value |= (*p++ & 0x3f) << 6;
+                value |= *p++ & 0x3f;
+                if(value < 0x4000000) return -4;
+                ret = 6;
+        } else return -2;
+        *val = value;
+        return ret;
+}
+/* This takes a character 'value' and writes the UTF8 encoded value in
+ * 'str' where 'str' is a buffer containing 'len' characters. Returns
+ * the number of characters written or -1 if 'len' is too small. 'str' can
+ * be set to NULL in which case it just returns the number of characters.
+ * It will need at most 6 characters.
+ */
+int UTF8_putc(unsigned char *str, int len, unsigned long value)
+{
+        if(!str) len = 6;       /* Maximum we will need */
+        else if(len <= 0) return -1;
+        if(value < 0x80) {
+                if(str) *str = (unsigned char)value;
+                return 1;
+        }
+        if(value < 0x800) {
+                if(len < 2) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 6) & 0x1f) | 0xc0);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 2;
+        }
+        if(value < 0x10000) {
+                if(len < 3) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 12) & 0xf) | 0xe0);
+                        *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 3;
+        }
+        if(value < 0x200000) {
+                if(len < 4) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 18) & 0x7) | 0xf0);
+                        *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
+                        *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 4;
+        }
+        if(value < 0x4000000) {
+                if(len < 5) return -1;
+                if(str) {
+                        *str++ = (unsigned char)(((value >> 24) & 0x3) | 0xf8);
+                        *str++ = (unsigned char)(((value >> 18) & 0x3f) | 0x80);
+                        *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
+                        *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                        *str = (unsigned char)((value & 0x3f) | 0x80);
+                }
+                return 5;
+        }
+        if(len < 6) return -1;
+        if(str) {
+                *str++ = (unsigned char)(((value >> 30) & 0x1) | 0xfc);
+                *str++ = (unsigned char)(((value >> 24) & 0x3f) | 0x80);
+                *str++ = (unsigned char)(((value >> 18) & 0x3f) | 0x80);
+                *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
+                *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
+                *str = (unsigned char)((value & 0x3f) | 0x80);
+        }
+        return 6;
+}
diff --git a/src/lib/libcrypto/asn1/a_verify.c b/src/lib/libcrypto/asn1/a_verify.c
index 6383d2c698..d4aede85c3 100644
--- a/src/lib/libcrypto/asn1/a_verify.c
+++ b/src/lib/libcrypto/asn1/a_verify.c
@@ -58,10 +58,13 @@
 #include <stdio.h>
 #include <time.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "cryptlib.h"
+#ifndef NO_SYS_TYPES_H
+# include <sys/types.h>
+#endif
 #include <openssl/bn.h>
 #include <openssl/x509.h>
 #include <openssl/objects.h>
@@ -98,7 +101,7 @@ int ASN1_verify(int (*i2d)(), X509_ALGOR *a, ASN1_BIT_STRING *signature,
        EVP_VerifyUpdate(&ctx,(unsigned char *)buf_in,inl);
        memset(buf_in,0,(unsigned int)inl);
-        Free((char *)buf_in);
+        Free(buf_in);
        if (EVP_VerifyFinal(&ctx,(unsigned char *)signature->data,
                        (unsigned int)signature->length,pkey) <= 0)
diff --git a/src/lib/libcrypto/asn1/a_vis.c b/src/lib/libcrypto/asn1/a_vis.c
index 2072be780d..5cfc080bec 100644
--- a/src/lib/libcrypto/asn1/a_vis.c
+++ b/src/lib/libcrypto/asn1/a_vis.c
@@ -60,6 +60,12 @@
 #include "cryptlib.h"
 #include <openssl/asn1.h>
+ASN1_VISIBLESTRING *ASN1_VISIBLESTRING_new(void)
+{ return M_ASN1_VISIBLESTRING_new(); }
+void ASN1_VISIBLESTRING_free(ASN1_VISIBLESTRING *x)
+{ M_ASN1_VISIBLESTRING_free(x); }
 int i2d_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING *a, unsigned char **pp)
        {
        return(i2d_ASN1_bytes((ASN1_STRING *)a,pp,
diff --git a/src/lib/libcrypto/asn1/asn1.h b/src/lib/libcrypto/asn1/asn1.h
index 5c2d8999bc..99bd64a11e 100644
--- a/src/lib/libcrypto/asn1/asn1.h
+++ b/src/lib/libcrypto/asn1/asn1.h
@@ -68,6 +68,10 @@ extern "C" {
 #include <openssl/stack.h>
 #include <openssl/safestack.h>
+#ifdef VMS
+#include <openssl/vms_idhacks.h>
+#endif
 #define V_ASN1_UNIVERSAL                0x00
 #define V_ASN1_APPLICATION              0x40
 #define V_ASN1_CONTEXT_SPECIFIC         0x80
@@ -77,7 +81,7 @@ extern "C" {
 #define V_ASN1_PRIMITIVE_TAG            0x1f
 #define V_ASN1_PRIMATIVE_TAG            0x1f
-#define V_ASN1_APP_CHOOSE               -2      /* let the recipent choose */
+#define V_ASN1_APP_CHOOSE               -2      /* let the recipient choose */
 #define V_ASN1_UNDEF                    -1
 #define V_ASN1_EOC                      0
@@ -129,6 +133,13 @@ extern "C" {
 #define B_ASN1_UNKNOWN          0x1000
 #define B_ASN1_UTF8STRING       0x2000
+/* For use with ASN1_mbstring_copy() */
+#define MBSTRING_FLAG           0x1000
+#define MBSTRING_ASC            (MBSTRING_FLAG|1)
+#define MBSTRING_BMP            (MBSTRING_FLAG|2)
+#define MBSTRING_UNIV           (MBSTRING_FLAG|3)
+#define MBSTRING_UTF8           (MBSTRING_FLAG|4)
 #define DECLARE_ASN1_SET_OF(type) \
 int i2d_ASN1_SET_OF_##type(STACK_OF(type) *a,unsigned char **pp, \
                           int (*func)(type *,unsigned char **), int ex_tag, \
@@ -165,7 +176,7 @@ typedef struct asn1_ctx_st
        int tag;        /* tag from last 'get object' */
        int xclass;     /* class from last 'get object' */
        long slen;      /* length of last 'get object' */
-        unsigned char *max; /* largest value of p alowed */
+        unsigned char *max; /* largest value of p allowed */
        unsigned char *q;/* temporary variable */
        unsigned char **pp;/* variable */
        int line;       /* used in error processing */
@@ -200,7 +211,34 @@ typedef struct asn1_string_st
        long flags;
        } ASN1_STRING;
-#ifndef DEBUG
+#define STABLE_FLAGS_MALLOC     0x01
+#define STABLE_NO_MASK          0x02
+#define DIRSTRING_TYPE  \
+ (B_ASN1_PRINTABLESTRING|B_ASN1_T61STRING|B_ASN1_BMPSTRING|B_ASN1_UTF8STRING)
+#define PKCS9STRING_TYPE (DIRSTRING_TYPE|B_ASN1_IA5STRING)
+typedef struct asn1_string_table_st {
+        int nid;
+        long minsize;
+        long maxsize;
+        unsigned long mask;
+        unsigned long flags;
+} ASN1_STRING_TABLE;
+DECLARE_STACK_OF(ASN1_STRING_TABLE)
+/* size limits: this stuff is taken straight from RFC2459 */
+#define ub_name                         32768
+#define ub_common_name                  64
+#define ub_locality_name                128
+#define ub_state_name                   128
+#define ub_organization_name            64
+#define ub_organization_unit_name       64
+#define ub_title                        64
+#define ub_email_address                128
+#ifdef NO_ASN1_TYPEDEFS
 #define ASN1_INTEGER            ASN1_STRING
 #define ASN1_ENUMERATED         ASN1_STRING
 #define ASN1_BIT_STRING         ASN1_STRING
@@ -234,6 +272,8 @@ typedef struct asn1_string_st ASN1_VISIBLESTRING;
 typedef struct asn1_string_st ASN1_UTF8STRING;
 #endif
+typedef int ASN1_NULL;
 typedef struct asn1_type_st
        {
        int type;
@@ -281,60 +321,58 @@ typedef struct asn1_header_st
        ASN1_METHOD *meth;
        } ASN1_HEADER;
-#define ASN1_STRING_length(x)   ((x)->length)
+/* This is used to contain a list of bit names */
-#define ASN1_STRING_type(x)     ((x)->type)
+typedef struct BIT_STRING_BITNAME_st {
-#define ASN1_STRING_data(x)     ((x)->data)
+        int bitnum;
+        const char *lname;
+        const char *sname;
+} BIT_STRING_BITNAME;
+#define M_ASN1_STRING_length(x) ((x)->length)
+#define M_ASN1_STRING_length_set(x, n)  ((x)->length = (n))
+#define M_ASN1_STRING_type(x)   ((x)->type)
+#define M_ASN1_STRING_data(x)   ((x)->data)
 /* Macros for string operations */
-#define ASN1_BIT_STRING_new()   (ASN1_BIT_STRING *)\
+#define M_ASN1_BIT_STRING_new() (ASN1_BIT_STRING *)\
                ASN1_STRING_type_new(V_ASN1_BIT_STRING)
-#define ASN1_BIT_STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_BIT_STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_BIT_STRING_dup(a) (ASN1_BIT_STRING *)\
+#define M_ASN1_BIT_STRING_dup(a) (ASN1_BIT_STRING *)\
                ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_BIT_STRING_cmp(a,b) ASN1_STRING_cmp(\
+#define M_ASN1_BIT_STRING_cmp(a,b) ASN1_STRING_cmp(\
                (ASN1_STRING *)a,(ASN1_STRING *)b)
-#define ASN1_BIT_STRING_set(a,b,c) ASN1_STRING_set((ASN1_STRING *)a,b,c)
+#define M_ASN1_BIT_STRING_set(a,b,c) ASN1_STRING_set((ASN1_STRING *)a,b,c)
-/* i2d_ASN1_BIT_STRING() is a function */
-/* d2i_ASN1_BIT_STRING() is a function */
-#define ASN1_INTEGER_new()      (ASN1_INTEGER *)\
+#define M_ASN1_INTEGER_new()    (ASN1_INTEGER *)\
                ASN1_STRING_type_new(V_ASN1_INTEGER)
-#define ASN1_INTEGER_free(a)            ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_INTEGER_free(a)          ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_INTEGER_dup(a) (ASN1_INTEGER *)ASN1_STRING_dup((ASN1_STRING *)a)
+#define M_ASN1_INTEGER_dup(a) (ASN1_INTEGER *)ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_INTEGER_cmp(a,b)   ASN1_STRING_cmp(\
+#define M_ASN1_INTEGER_cmp(a,b) ASN1_STRING_cmp(\
                (ASN1_STRING *)a,(ASN1_STRING *)b)
-/* ASN1_INTEGER_set() is a function, also see BN_to_ASN1_INTEGER() */
-/* ASN1_INTEGER_get() is a function, also see ASN1_INTEGER_to_BN() */
-/* i2d_ASN1_INTEGER() is a function */
-/* d2i_ASN1_INTEGER() is a function */
-#define ASN1_ENUMERATED_new()   (ASN1_ENUMERATED *)\
+#define M_ASN1_ENUMERATED_new() (ASN1_ENUMERATED *)\
                ASN1_STRING_type_new(V_ASN1_ENUMERATED)
-#define ASN1_ENUMERATED_free(a)         ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_ENUMERATED_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_ENUMERATED_dup(a) (ASN1_ENUMERATED *)ASN1_STRING_dup((ASN1_STRING *)a)
+#define M_ASN1_ENUMERATED_dup(a) (ASN1_ENUMERATED *)ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_ENUMERATED_cmp(a,b)        ASN1_STRING_cmp(\
+#define M_ASN1_ENUMERATED_cmp(a,b)      ASN1_STRING_cmp(\
                (ASN1_STRING *)a,(ASN1_STRING *)b)
-/* ASN1_ENUMERATED_set() is a function, also see BN_to_ASN1_ENUMERATED() */
-/* ASN1_ENUMERATED_get() is a function, also see ASN1_ENUMERATED_to_BN() */
-/* i2d_ASN1_ENUMERATED() is a function */
-/* d2i_ASN1_ENUMERATED() is a function */
-#define ASN1_OCTET_STRING_new() (ASN1_OCTET_STRING *)\
+#define M_ASN1_OCTET_STRING_new()       (ASN1_OCTET_STRING *)\
                ASN1_STRING_type_new(V_ASN1_OCTET_STRING)
-#define ASN1_OCTET_STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_OCTET_STRING_free(a)     ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_OCTET_STRING_dup(a) (ASN1_OCTET_STRING *)\
+#define M_ASN1_OCTET_STRING_dup(a) (ASN1_OCTET_STRING *)\
                ASN1_STRING_dup((ASN1_STRING *)a)
-#define ASN1_OCTET_STRING_cmp(a,b) ASN1_STRING_cmp(\
+#define M_ASN1_OCTET_STRING_cmp(a,b) ASN1_STRING_cmp(\
                (ASN1_STRING *)a,(ASN1_STRING *)b)
-#define ASN1_OCTET_STRING_set(a,b,c)    ASN1_STRING_set((ASN1_STRING *)a,b,c)
+#define M_ASN1_OCTET_STRING_set(a,b,c)  ASN1_STRING_set((ASN1_STRING *)a,b,c)
-#define ASN1_OCTET_STRING_print(a,b)    ASN1_STRING_print(a,(ASN1_STRING *)b)
+#define M_ASN1_OCTET_STRING_print(a,b)  ASN1_STRING_print(a,(ASN1_STRING *)b)
 #define M_i2d_ASN1_OCTET_STRING(a,pp) \
                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_OCTET_STRING,\
-                V_ASN1_OCTET_STRING)
+                V_ASN1_UNIVERSAL)
-/* d2i_ASN1_OCTET_STRING() is a function */
-#define ASN1_PRINTABLE_new()    ASN1_STRING_type_new(V_ASN1_T61STRING)
+#define M_ASN1_PRINTABLE_new()  ASN1_STRING_type_new(V_ASN1_T61STRING)
-#define ASN1_PRINTABLE_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_PRINTABLE_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_PRINTABLE(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
                pp,a->type,V_ASN1_UNIVERSAL)
 #define M_d2i_ASN1_PRINTABLE(a,pp,l) \
@@ -345,10 +383,11 @@ typedef struct asn1_header_st
                        B_ASN1_BIT_STRING| \
                        B_ASN1_UNIVERSALSTRING|\
                        B_ASN1_BMPSTRING|\
+                        B_ASN1_UTF8STRING|\
                        B_ASN1_UNKNOWN)
-#define DIRECTORYSTRING_new() ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
+#define M_DIRECTORYSTRING_new() ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
-#define DIRECTORYSTRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
+#define M_DIRECTORYSTRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_DIRECTORYSTRING(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
                                                pp,a->type,V_ASN1_UNIVERSAL)
 #define M_d2i_DIRECTORYSTRING(a,pp,l) \
@@ -359,8 +398,8 @@ typedef struct asn1_header_st
                        B_ASN1_UNIVERSALSTRING|\
                        B_ASN1_UTF8STRING)
-#define DISPLAYTEXT_new() ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
+#define M_DISPLAYTEXT_new() ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
-#define DISPLAYTEXT_free(a) ASN1_STRING_free((ASN1_STRING *)a)
+#define M_DISPLAYTEXT_free(a) ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_DISPLAYTEXT(a,pp) i2d_ASN1_bytes((ASN1_STRING *)a,\
                                                pp,a->type,V_ASN1_UNIVERSAL)
 #define M_d2i_DISPLAYTEXT(a,pp,l) \
@@ -369,9 +408,9 @@ typedef struct asn1_header_st
                        B_ASN1_BMPSTRING|\
                        B_ASN1_UTF8STRING)
-#define ASN1_PRINTABLESTRING_new() (ASN1_PRINTABLESTRING *)\
+#define M_ASN1_PRINTABLESTRING_new() (ASN1_PRINTABLESTRING *)\
                ASN1_STRING_type_new(V_ASN1_PRINTABLESTRING)
-#define ASN1_PRINTABLESTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_PRINTABLESTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_PRINTABLESTRING(a,pp) \
                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_PRINTABLESTRING,\
                V_ASN1_UNIVERSAL)
@@ -379,9 +418,9 @@ typedef struct asn1_header_st
                (ASN1_PRINTABLESTRING *)d2i_ASN1_type_bytes\
                ((ASN1_STRING **)a,pp,l,B_ASN1_PRINTABLESTRING)
-#define ASN1_T61STRING_new()    (ASN1_T61STRING_STRING *)\
+#define M_ASN1_T61STRING_new()  (ASN1_T61STRING *)\
                ASN1_STRING_type_new(V_ASN1_T61STRING)
-#define ASN1_T61STRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_T61STRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_T61STRING(a,pp) \
                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_T61STRING,\
                V_ASN1_UNIVERSAL)
@@ -389,10 +428,10 @@ typedef struct asn1_header_st
                (ASN1_T61STRING *)d2i_ASN1_type_bytes\
                ((ASN1_STRING **)a,pp,l,B_ASN1_T61STRING)
-#define ASN1_IA5STRING_new()    (ASN1_IA5STRING *)\
+#define M_ASN1_IA5STRING_new()  (ASN1_IA5STRING *)\
                ASN1_STRING_type_new(V_ASN1_IA5STRING)
-#define ASN1_IA5STRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_IA5STRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_IA5STRING_dup(a)   \
+#define M_ASN1_IA5STRING_dup(a) \
                        (ASN1_IA5STRING *)ASN1_STRING_dup((ASN1_STRING *)a)
 #define M_i2d_ASN1_IA5STRING(a,pp) \
                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_IA5STRING,\
@@ -401,38 +440,25 @@ typedef struct asn1_header_st
                (ASN1_IA5STRING *)d2i_ASN1_type_bytes((ASN1_STRING **)a,pp,l,\
                        B_ASN1_IA5STRING)
-#define ASN1_UTCTIME_new()      (ASN1_UTCTIME *)\
+#define M_ASN1_UTCTIME_new()    (ASN1_UTCTIME *)\
                ASN1_STRING_type_new(V_ASN1_UTCTIME)
-#define ASN1_UTCTIME_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_UTCTIME_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_UTCTIME_dup(a) (ASN1_UTCTIME *)ASN1_STRING_dup((ASN1_STRING *)a)
+#define M_ASN1_UTCTIME_dup(a) (ASN1_UTCTIME *)ASN1_STRING_dup((ASN1_STRING *)a)
-/* i2d_ASN1_UTCTIME() is a function */
-/* d2i_ASN1_UTCTIME() is a function */
+#define M_ASN1_GENERALIZEDTIME_new()    (ASN1_GENERALIZEDTIME *)\
-/* ASN1_UTCTIME_set() is a function */
-/* ASN1_UTCTIME_check() is a function */
-#define ASN1_GENERALIZEDTIME_new()      (ASN1_GENERALIZEDTIME *)\
                ASN1_STRING_type_new(V_ASN1_GENERALIZEDTIME)
-#define ASN1_GENERALIZEDTIME_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_GENERALIZEDTIME_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_GENERALIZEDTIME_dup(a) (ASN1_GENERALIZEDTIME *)ASN1_STRING_dup(\
+#define M_ASN1_GENERALIZEDTIME_dup(a) (ASN1_GENERALIZEDTIME *)ASN1_STRING_dup(\
        (ASN1_STRING *)a)
-/* i2d_ASN1_GENERALIZEDTIME() is a function */
-/* d2i_ASN1_GENERALIZEDTIME() is a function */
-/* ASN1_GENERALIZEDTIME_set() is a function */
-/* ASN1_GENERALIZEDTIME_check() is a function */
-#define ASN1_TIME_new() (ASN1_TIME *)\
+#define M_ASN1_TIME_new()       (ASN1_TIME *)\
                ASN1_STRING_type_new(V_ASN1_UTCTIME)
-#define ASN1_TIME_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_TIME_free(a)     ASN1_STRING_free((ASN1_STRING *)a)
-#define ASN1_TIME_dup(a) (ASN1_TIME *)ASN1_STRING_dup((ASN1_STRING *)a)
+#define M_ASN1_TIME_dup(a) (ASN1_TIME *)ASN1_STRING_dup((ASN1_STRING *)a)
-/* i2d_ASN1_TIME() is a function */
+#define M_ASN1_GENERALSTRING_new()      (ASN1_GENERALSTRING *)\
-/* d2i_ASN1_TIME() is a function */
-/* ASN1_TIME_set() is a function */
-/* ASN1_TIME_check() is a function */
-#define ASN1_GENERALSTRING_new()        (ASN1_GENERALSTRING *)\
                ASN1_STRING_type_new(V_ASN1_GENERALSTRING)
-#define ASN1_GENERALSTRING_free(a)      ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_GENERALSTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_GENERALSTRING(a,pp) \
                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_GENERALSTRING,\
                        V_ASN1_UNIVERSAL)
@@ -440,9 +466,9 @@ typedef struct asn1_header_st
                (ASN1_GENERALSTRING *)d2i_ASN1_type_bytes\
                ((ASN1_STRING **)a,pp,l,B_ASN1_GENERALSTRING)
-#define ASN1_UNIVERSALSTRING_new()      (ASN1_UNIVERSALSTRING *)\
+#define M_ASN1_UNIVERSALSTRING_new()    (ASN1_UNIVERSALSTRING *)\
                ASN1_STRING_type_new(V_ASN1_UNIVERSALSTRING)
-#define ASN1_UNIVERSALSTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_UNIVERSALSTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_UNIVERSALSTRING(a,pp) \
                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_UNIVERSALSTRING,\
                        V_ASN1_UNIVERSAL)
@@ -450,9 +476,9 @@ typedef struct asn1_header_st
                (ASN1_UNIVERSALSTRING *)d2i_ASN1_type_bytes\
                ((ASN1_STRING **)a,pp,l,B_ASN1_UNIVERSALSTRING)
-#define ASN1_BMPSTRING_new()    (ASN1_BMPSTRING *)\
+#define M_ASN1_BMPSTRING_new()  (ASN1_BMPSTRING *)\
                ASN1_STRING_type_new(V_ASN1_BMPSTRING)
-#define ASN1_BMPSTRING_free(a)  ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_BMPSTRING_free(a)        ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_BMPSTRING(a,pp) \
                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_BMPSTRING,\
                        V_ASN1_UNIVERSAL)
@@ -460,9 +486,9 @@ typedef struct asn1_header_st
                (ASN1_BMPSTRING *)d2i_ASN1_type_bytes\
                ((ASN1_STRING **)a,pp,l,B_ASN1_BMPSTRING)
-#define ASN1_VISIBLESTRING_new()        (ASN1_VISIBLESTRING *)\
+#define M_ASN1_VISIBLESTRING_new()      (ASN1_VISIBLESTRING *)\
                ASN1_STRING_type_new(V_ASN1_VISIBLESTRING)
-#define ASN1_VISIBLESTRING_free(a)      ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_VISIBLESTRING_free(a)    ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_VISIBLESTRING(a,pp) \
                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_VISIBLESTRING,\
                        V_ASN1_UNIVERSAL)
@@ -470,9 +496,9 @@ typedef struct asn1_header_st
                (ASN1_VISIBLESTRING *)d2i_ASN1_type_bytes\
                ((ASN1_STRING **)a,pp,l,B_ASN1_VISIBLESTRING)
-#define ASN1_UTF8STRING_new()   (ASN1_UTF8STRING *)\
+#define M_ASN1_UTF8STRING_new() (ASN1_UTF8STRING *)\
                ASN1_STRING_type_new(V_ASN1_UTF8STRING)
-#define ASN1_UTF8STRING_free(a) ASN1_STRING_free((ASN1_STRING *)a)
+#define M_ASN1_UTF8STRING_free(a)       ASN1_STRING_free((ASN1_STRING *)a)
 #define M_i2d_ASN1_UTF8STRING(a,pp) \
                i2d_ASN1_bytes((ASN1_STRING *)a,pp,V_ASN1_UTF8STRING,\
                        V_ASN1_UNIVERSAL)
@@ -500,7 +526,7 @@ ASN1_OBJECT *	d2i_ASN1_OBJECT(ASN1_OBJECT **a,unsigned char **pp,
 DECLARE_STACK_OF(ASN1_OBJECT)
 DECLARE_ASN1_SET_OF(ASN1_OBJECT)
-ASN1_STRING *   ASN1_STRING_new(void );
+ASN1_STRING *   ASN1_STRING_new(void);
 void            ASN1_STRING_free(ASN1_STRING *a);
 ASN1_STRING *   ASN1_STRING_dup(ASN1_STRING *a);
 ASN1_STRING *   ASN1_STRING_type_new(int type );
@@ -508,23 +534,44 @@ int 		ASN1_STRING_cmp(ASN1_STRING *a, ASN1_STRING *b);
  /* Since this is used to store all sorts of things, via macros, for now, make
     its data void * */
 int             ASN1_STRING_set(ASN1_STRING *str, const void *data, int len);
+int ASN1_STRING_length(ASN1_STRING *x);
+void ASN1_STRING_length_set(ASN1_STRING *x, int n);
+int ASN1_STRING_type(ASN1_STRING *x);
+unsigned char * ASN1_STRING_data(ASN1_STRING *x);
+ASN1_BIT_STRING *       ASN1_BIT_STRING_new(void);
+void            ASN1_BIT_STRING_free(ASN1_BIT_STRING *a);
 int             i2d_ASN1_BIT_STRING(ASN1_BIT_STRING *a,unsigned char **pp);
 ASN1_BIT_STRING *d2i_ASN1_BIT_STRING(ASN1_BIT_STRING **a,unsigned char **pp,
                        long length);
+int             ASN1_BIT_STRING_set(ASN1_BIT_STRING *a, unsigned char *d,
+                        int length );
 int             ASN1_BIT_STRING_set_bit(ASN1_BIT_STRING *a, int n, int value);
 int             ASN1_BIT_STRING_get_bit(ASN1_BIT_STRING *a, int n);
+#ifdef HEADER_BIO_H
+int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
+                                BIT_STRING_BITNAME *tbl, int indent);
+#endif
+int ASN1_BIT_STRING_num_asc(char *name, BIT_STRING_BITNAME *tbl);
+int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
+                                BIT_STRING_BITNAME *tbl);
 int             i2d_ASN1_BOOLEAN(int a,unsigned char **pp);
 int             d2i_ASN1_BOOLEAN(int *a,unsigned char **pp,long length);
+ASN1_INTEGER *  ASN1_INTEGER_new(void);
+void            ASN1_INTEGER_free(ASN1_INTEGER *a);
 int             i2d_ASN1_INTEGER(ASN1_INTEGER *a,unsigned char **pp);
 ASN1_INTEGER *d2i_ASN1_INTEGER(ASN1_INTEGER **a,unsigned char **pp,
                        long length);
 ASN1_INTEGER *d2i_ASN1_UINTEGER(ASN1_INTEGER **a,unsigned char **pp,
                        long length);
+ASN1_INTEGER *  ASN1_INTEGER_dup(ASN1_INTEGER *x);
+int ASN1_INTEGER_cmp(ASN1_INTEGER *x, ASN1_INTEGER *y);
+ASN1_ENUMERATED *       ASN1_ENUMERATED_new(void);
+void            ASN1_ENUMERATED_free(ASN1_ENUMERATED *a);
 int             i2d_ASN1_ENUMERATED(ASN1_ENUMERATED *a,unsigned char **pp);
 ASN1_ENUMERATED *d2i_ASN1_ENUMERATED(ASN1_ENUMERATED **a,unsigned char **pp,
                        long length);
@@ -537,49 +584,88 @@ int ASN1_GENERALIZEDTIME_check(ASN1_GENERALIZEDTIME *a);
 ASN1_GENERALIZEDTIME *ASN1_GENERALIZEDTIME_set(ASN1_GENERALIZEDTIME *s,time_t t);
 int ASN1_GENERALIZEDTIME_set_string(ASN1_GENERALIZEDTIME *s, char *str); 
+ASN1_OCTET_STRING *     ASN1_OCTET_STRING_new(void);
+void            ASN1_OCTET_STRING_free(ASN1_OCTET_STRING *a);
 int             i2d_ASN1_OCTET_STRING(ASN1_OCTET_STRING *a,unsigned char **pp);
 ASN1_OCTET_STRING *d2i_ASN1_OCTET_STRING(ASN1_OCTET_STRING **a,
                        unsigned char **pp,long length);
+ASN1_OCTET_STRING *     ASN1_OCTET_STRING_dup(ASN1_OCTET_STRING *a);
+int     ASN1_OCTET_STRING_cmp(ASN1_OCTET_STRING *a, ASN1_OCTET_STRING *b);
+int     ASN1_OCTET_STRING_set(ASN1_OCTET_STRING *str, unsigned char *data, int len);
+ASN1_VISIBLESTRING *    ASN1_VISIBLESTRING_new(void);
+void            ASN1_VISIBLESTRING_free(ASN1_VISIBLESTRING *a);
 int     i2d_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING *a,unsigned char **pp);
 ASN1_VISIBLESTRING *d2i_ASN1_VISIBLESTRING(ASN1_VISIBLESTRING **a,
                        unsigned char **pp,long length);
+ASN1_UTF8STRING *       ASN1_UTF8STRING_new(void);
+void            ASN1_UTF8STRING_free(ASN1_UTF8STRING *a);
 int             i2d_ASN1_UTF8STRING(ASN1_UTF8STRING *a,unsigned char **pp);
 ASN1_UTF8STRING *d2i_ASN1_UTF8STRING(ASN1_UTF8STRING **a,
                        unsigned char **pp,long length);
+ASN1_NULL *     ASN1_NULL_new(void);
+void            ASN1_NULL_free(ASN1_NULL *a);
+int             i2d_ASN1_NULL(ASN1_NULL *a,unsigned char **pp);
+ASN1_NULL *d2i_ASN1_NULL(ASN1_NULL **a, unsigned char **pp,long length);
+ASN1_BMPSTRING *        ASN1_BMPSTRING_new(void);
+void            ASN1_BMPSTRING_free(ASN1_BMPSTRING *a);
 int i2d_ASN1_BMPSTRING(ASN1_BMPSTRING *a, unsigned char **pp);
 ASN1_BMPSTRING *d2i_ASN1_BMPSTRING(ASN1_BMPSTRING **a, unsigned char **pp,
        long length);
+int UTF8_getc(const unsigned char *str, int len, unsigned long *val);
+int UTF8_putc(unsigned char *str, int len, unsigned long value);
 int i2d_ASN1_PRINTABLE(ASN1_STRING *a,unsigned char **pp);
 ASN1_STRING *d2i_ASN1_PRINTABLE(ASN1_STRING **a,
        unsigned char **pp, long l);
+ASN1_PRINTABLESTRING *  ASN1_PRINTABLESTRING_new(void);
+void            ASN1_PRINTABLESTRING_free(ASN1_PRINTABLESTRING *a);
 ASN1_PRINTABLESTRING *d2i_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING **a,
        unsigned char **pp, long l);
+int i2d_ASN1_PRINTABLESTRING(ASN1_PRINTABLESTRING *a, unsigned char **pp);
+ASN1_STRING *   DIRECTORYSTRING_new(void);
+void            DIRECTORYSTRING_free(ASN1_STRING *a);
 int     i2d_DIRECTORYSTRING(ASN1_STRING *a,unsigned char **pp);
 ASN1_STRING *d2i_DIRECTORYSTRING(ASN1_STRING **a, unsigned char **pp,
                                                                 long length);
+ASN1_STRING *   DISPLAYTEXT_new(void);
+void            DISPLAYTEXT_free(ASN1_STRING *a);
 int     i2d_DISPLAYTEXT(ASN1_STRING *a,unsigned char **pp);
 ASN1_STRING *d2i_DISPLAYTEXT(ASN1_STRING **a, unsigned char **pp, long length);
+ASN1_T61STRING *        ASN1_T61STRING_new(void);
+void            ASN1_T61STRING_free(ASN1_IA5STRING *a);
 ASN1_T61STRING *d2i_ASN1_T61STRING(ASN1_T61STRING **a,
        unsigned char **pp, long l);
+ASN1_IA5STRING *        ASN1_IA5STRING_new(void);
+void            ASN1_IA5STRING_free(ASN1_IA5STRING *a);
 int i2d_ASN1_IA5STRING(ASN1_IA5STRING *a,unsigned char **pp);
 ASN1_IA5STRING *d2i_ASN1_IA5STRING(ASN1_IA5STRING **a,
        unsigned char **pp, long l);
+ASN1_UTCTIME *  ASN1_UTCTIME_new(void);
+void            ASN1_UTCTIME_free(ASN1_UTCTIME *a);
 int             i2d_ASN1_UTCTIME(ASN1_UTCTIME *a,unsigned char **pp);
 ASN1_UTCTIME *  d2i_ASN1_UTCTIME(ASN1_UTCTIME **a,unsigned char **pp,
                        long length);
+ASN1_GENERALIZEDTIME *  ASN1_GENERALIZEDTIME_new(void);
+void            ASN1_GENERALIZEDTIME_free(ASN1_GENERALIZEDTIME *a);
 int             i2d_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME *a,unsigned char **pp);
 ASN1_GENERALIZEDTIME *  d2i_ASN1_GENERALIZEDTIME(ASN1_GENERALIZEDTIME **a,unsigned char **pp,
                        long length);
+ASN1_TIME *     ASN1_TIME_new(void);
+void            ASN1_TIME_free(ASN1_TIME *a);
 int             i2d_ASN1_TIME(ASN1_TIME *a,unsigned char **pp);
 ASN1_TIME *     d2i_ASN1_TIME(ASN1_TIME **a,unsigned char **pp, long length);
 ASN1_TIME *ASN1_TIME_set(ASN1_TIME *s,time_t t);
@@ -654,6 +740,7 @@ int ASN1_TIME_print(BIO *fp,ASN1_TIME *a);
 int ASN1_STRING_print(BIO *bp,ASN1_STRING *v);
 int ASN1_parse(BIO *bp,unsigned char *pp,long len,int indent);
 #endif
+const char *ASN1_tag2str(int tag);
 /* Used to load and write netscape format cert/key */
 int i2d_ASN1_HEADER(ASN1_HEADER *a,unsigned char **pp);
@@ -687,6 +774,21 @@ unsigned char *ASN1_seq_pack(STACK *safes, int (*i2d)(), unsigned char **buf,
 void *ASN1_unpack_string(ASN1_STRING *oct, char *(*d2i)());
 ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
+void ASN1_STRING_set_default_mask(unsigned long mask);
+int ASN1_STRING_set_default_mask_asc(char *p);
+unsigned long ASN1_STRING_get_default_mask(void);
+int ASN1_mbstring_copy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask);
+int ASN1_mbstring_ncopy(ASN1_STRING **out, const unsigned char *in, int len,
+                                        int inform, unsigned long mask, 
+                                        long minsize, long maxsize);
+ASN1_STRING *ASN1_STRING_set_by_NID(ASN1_STRING **out, 
+                const unsigned char *in, int inlen, int inform, int nid);
+ASN1_STRING_TABLE *ASN1_STRING_TABLE_get(int nid);
+int ASN1_STRING_TABLE_add(int, long, long, unsigned long, unsigned long);
+void ASN1_STRING_TABLE_cleanup(void);
 /* BEGIN ERROR CODES */
 /* The following lines are auto generated by the script mkerr.pl. Any changes
 * made after this point may be overwritten when the script is next run.
@@ -699,6 +801,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_A2I_ASN1_ENUMERATED                       236
 #define ASN1_F_A2I_ASN1_INTEGER                          101
 #define ASN1_F_A2I_ASN1_STRING                           102
+#define ASN1_F_ACCESS_DESCRIPTION_NEW                    291
 #define ASN1_F_ASN1_COLLATE_PRIMITIVE                    103
 #define ASN1_F_ASN1_D2I_BIO                              104
 #define ASN1_F_ASN1_D2I_FP                               105
@@ -712,6 +815,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_ASN1_I2D_FP                               110
 #define ASN1_F_ASN1_INTEGER_SET                          111
 #define ASN1_F_ASN1_INTEGER_TO_BN                        112
+#define ASN1_F_ASN1_MBSTRING_COPY                        282
 #define ASN1_F_ASN1_OBJECT_NEW                           113
 #define ASN1_F_ASN1_PACK_STRING                          245
 #define ASN1_F_ASN1_PBE_SET                              253
@@ -719,6 +823,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_ASN1_SEQ_UNPACK                           247
 #define ASN1_F_ASN1_SIGN                                 114
 #define ASN1_F_ASN1_STRING_NEW                           115
+#define ASN1_F_ASN1_STRING_TABLE_ADD                     283
 #define ASN1_F_ASN1_STRING_TYPE_NEW                      116
 #define ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING             117
 #define ASN1_F_ASN1_TYPE_GET_OCTETSTRING                 118
@@ -730,6 +835,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_BASIC_CONSTRAINTS_NEW                     226
 #define ASN1_F_BN_TO_ASN1_ENUMERATED                     234
 #define ASN1_F_BN_TO_ASN1_INTEGER                        122
+#define ASN1_F_D2I_ACCESS_DESCRIPTION                    284
 #define ASN1_F_D2I_ASN1_BIT_STRING                       123
 #define ASN1_F_D2I_ASN1_BMPSTRING                        124
 #define ASN1_F_D2I_ASN1_BOOLEAN                          125
@@ -738,6 +844,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_D2I_ASN1_GENERALIZEDTIME                  223
 #define ASN1_F_D2I_ASN1_HEADER                           127
 #define ASN1_F_D2I_ASN1_INTEGER                          128
+#define ASN1_F_D2I_ASN1_NULL                             292
 #define ASN1_F_D2I_ASN1_OBJECT                           129
 #define ASN1_F_D2I_ASN1_OCTET_STRING                     130
 #define ASN1_F_D2I_ASN1_PRINT_TYPE                       131
@@ -765,6 +872,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_D2I_NETSCAPE_SPKAC                        143
 #define ASN1_F_D2I_NETSCAPE_SPKI                         144
 #define ASN1_F_D2I_NOTICEREF                             268
+#define ASN1_F_D2I_OTHERNAME                             287
 #define ASN1_F_D2I_PBE2PARAM                             262
 #define ASN1_F_D2I_PBEPARAM                              249
 #define ASN1_F_D2I_PBKDF2PARAM                           263
@@ -796,6 +904,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_D2I_X509                                  159
 #define ASN1_F_D2I_X509_ALGOR                            160
 #define ASN1_F_D2I_X509_ATTRIBUTE                        161
+#define ASN1_F_D2I_X509_CERT_AUX                         285
 #define ASN1_F_D2I_X509_CINF                             162
 #define ASN1_F_D2I_X509_CRL                              163
 #define ASN1_F_D2I_X509_CRL_INFO                         164
@@ -819,12 +928,14 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_I2D_DSAPARAMS                             178
 #define ASN1_F_I2D_DSAPRIVATEKEY                         179
 #define ASN1_F_I2D_DSAPUBLICKEY                          180
+#define ASN1_F_I2D_DSA_PUBKEY                            290
 #define ASN1_F_I2D_NETSCAPE_RSA                          181
 #define ASN1_F_I2D_PKCS7                                 182
 #define ASN1_F_I2D_PRIVATEKEY                            183
 #define ASN1_F_I2D_PUBLICKEY                             184
 #define ASN1_F_I2D_RSAPRIVATEKEY                         185
 #define ASN1_F_I2D_RSAPUBLICKEY                          186
+#define ASN1_F_I2D_RSA_PUBKEY                            289
 #define ASN1_F_I2D_X509_ATTRIBUTE                        187
 #define ASN1_F_I2T_ASN1_OBJECT                           188
 #define ASN1_F_NETSCAPE_CERT_SEQUENCE_NEW                229
@@ -832,6 +943,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_NETSCAPE_SPKAC_NEW                        190
 #define ASN1_F_NETSCAPE_SPKI_NEW                         191
 #define ASN1_F_NOTICEREF_NEW                             272
+#define ASN1_F_OTHERNAME_NEW                             288
 #define ASN1_F_PBE2PARAM_NEW                             264
 #define ASN1_F_PBEPARAM_NEW                              251
 #define ASN1_F_PBKDF2PARAM_NEW                           265
@@ -859,6 +971,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_F_USERNOTICE_NEW                            275
 #define ASN1_F_X509_ALGOR_NEW                            202
 #define ASN1_F_X509_ATTRIBUTE_NEW                        203
+#define ASN1_F_X509_CERT_AUX_NEW                         286
 #define ASN1_F_X509_CINF_NEW                             204
 #define ASN1_F_X509_CRL_INFO_NEW                         205
 #define ASN1_F_X509_CRL_NEW                              206
@@ -889,6 +1002,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_R_BN_LIB                                    107
 #define ASN1_R_BOOLEAN_IS_WRONG_LENGTH                   108
 #define ASN1_R_BUFFER_TOO_SMALL                          109
+#define ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER           166
 #define ASN1_R_DATA_IS_WRONG                             110
 #define ASN1_R_DECODE_ERROR                              155
 #define ASN1_R_DECODING_ERROR                            111
@@ -902,24 +1016,31 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_R_EXPECTING_A_BIT_STRING                    116
 #define ASN1_R_EXPECTING_A_BOOLEAN                       117
 #define ASN1_R_EXPECTING_A_GENERALIZEDTIME               151
+#define ASN1_R_EXPECTING_A_NULL                          164
 #define ASN1_R_EXPECTING_A_TIME                          152
 #define ASN1_R_EXPECTING_A_UTCTIME                       118
 #define ASN1_R_FIRST_NUM_TOO_LARGE                       119
 #define ASN1_R_GENERALIZEDTIME_TOO_LONG                  153
 #define ASN1_R_HEADER_TOO_LONG                           120
+#define ASN1_R_ILLEGAL_CHARACTERS                        158
+#define ASN1_R_INVALID_BMPSTRING_LENGTH                  159
 #define ASN1_R_INVALID_DIGIT                             121
 #define ASN1_R_INVALID_SEPARATOR                         122
 #define ASN1_R_INVALID_TIME_FORMAT                       123
+#define ASN1_R_INVALID_UNIVERSALSTRING_LENGTH            160
+#define ASN1_R_INVALID_UTF8STRING                        161
 #define ASN1_R_IV_TOO_LARGE                              124
 #define ASN1_R_LENGTH_ERROR                              125
 #define ASN1_R_MISSING_SECOND_NUMBER                     126
 #define ASN1_R_NON_HEX_CHARACTERS                        127
 #define ASN1_R_NOT_ENOUGH_DATA                           128
+#define ASN1_R_NULL_IS_WRONG_LENGTH                      165
 #define ASN1_R_ODD_NUMBER_OF_CHARS                       129
 #define ASN1_R_PARSING                                   130
 #define ASN1_R_PRIVATE_KEY_HEADER_MISSING                131
 #define ASN1_R_SECOND_NUMBER_TOO_LARGE                   132
 #define ASN1_R_SHORT_LINE                                133
+#define ASN1_R_STRING_TOO_LONG                           163
 #define ASN1_R_STRING_TOO_SHORT                          134
 #define ASN1_R_TAG_VALUE_TOO_HIGH                        135
 #define ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD 136
@@ -927,6 +1048,7 @@ ASN1_STRING *ASN1_pack_string(void *obj, int (*i2d)(), ASN1_OCTET_STRING **oct);
 #define ASN1_R_UNABLE_TO_DECODE_RSA_KEY                  138
 #define ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY          139
 #define ASN1_R_UNKNOWN_ATTRIBUTE_TYPE                    140
+#define ASN1_R_UNKNOWN_FORMAT                            162
 #define ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM          141
 #define ASN1_R_UNKNOWN_OBJECT_TYPE                       142
 #define ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE                   143
diff --git a/src/lib/libcrypto/asn1/asn1_err.c b/src/lib/libcrypto/asn1/asn1_err.c
index 16755a0b05..b183814242 100644
--- a/src/lib/libcrypto/asn1/asn1_err.c
+++ b/src/lib/libcrypto/asn1/asn1_err.c
@@ -69,19 +69,21 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_A2I_ASN1_ENUMERATED,0),      "a2i_ASN1_ENUMERATED"},
 {ERR_PACK(0,ASN1_F_A2I_ASN1_INTEGER,0), "a2i_ASN1_INTEGER"},
 {ERR_PACK(0,ASN1_F_A2I_ASN1_STRING,0),  "a2i_ASN1_STRING"},
+{ERR_PACK(0,ASN1_F_ACCESS_DESCRIPTION_NEW,0),   "ACCESS_DESCRIPTION_new"},
 {ERR_PACK(0,ASN1_F_ASN1_COLLATE_PRIMITIVE,0),   "ASN1_COLLATE_PRIMITIVE"},
 {ERR_PACK(0,ASN1_F_ASN1_D2I_BIO,0),     "ASN1_d2i_bio"},
 {ERR_PACK(0,ASN1_F_ASN1_D2I_FP,0),      "ASN1_d2i_fp"},
 {ERR_PACK(0,ASN1_F_ASN1_DUP,0), "ASN1_dup"},
 {ERR_PACK(0,ASN1_F_ASN1_ENUMERATED_SET,0),      "ASN1_ENUMERATED_set"},
 {ERR_PACK(0,ASN1_F_ASN1_ENUMERATED_TO_BN,0),    "ASN1_ENUMERATED_to_BN"},
-{ERR_PACK(0,ASN1_F_ASN1_GENERALIZEDTIME_NEW,0), "ASN1_GENERALIZEDTIME_NEW"},
+{ERR_PACK(0,ASN1_F_ASN1_GENERALIZEDTIME_NEW,0), "ASN1_GENERALIZEDTIME_new"},
 {ERR_PACK(0,ASN1_F_ASN1_GET_OBJECT,0),  "ASN1_get_object"},
 {ERR_PACK(0,ASN1_F_ASN1_HEADER_NEW,0),  "ASN1_HEADER_new"},
 {ERR_PACK(0,ASN1_F_ASN1_I2D_BIO,0),     "ASN1_i2d_bio"},
 {ERR_PACK(0,ASN1_F_ASN1_I2D_FP,0),      "ASN1_i2d_fp"},
 {ERR_PACK(0,ASN1_F_ASN1_INTEGER_SET,0), "ASN1_INTEGER_set"},
 {ERR_PACK(0,ASN1_F_ASN1_INTEGER_TO_BN,0),       "ASN1_INTEGER_to_BN"},
+{ERR_PACK(0,ASN1_F_ASN1_MBSTRING_COPY,0),       "ASN1_mbstring_copy"},
 {ERR_PACK(0,ASN1_F_ASN1_OBJECT_NEW,0),  "ASN1_OBJECT_new"},
 {ERR_PACK(0,ASN1_F_ASN1_PACK_STRING,0), "ASN1_pack_string"},
 {ERR_PACK(0,ASN1_F_ASN1_PBE_SET,0),     "ASN1_PBE_SET"},
@@ -89,17 +91,19 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_ASN1_SEQ_UNPACK,0),  "ASN1_seq_unpack"},
 {ERR_PACK(0,ASN1_F_ASN1_SIGN,0),        "ASN1_sign"},
 {ERR_PACK(0,ASN1_F_ASN1_STRING_NEW,0),  "ASN1_STRING_new"},
+{ERR_PACK(0,ASN1_F_ASN1_STRING_TABLE_ADD,0),    "ASN1_STRING_TABLE_add"},
 {ERR_PACK(0,ASN1_F_ASN1_STRING_TYPE_NEW,0),     "ASN1_STRING_type_new"},
 {ERR_PACK(0,ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING,0),    "ASN1_TYPE_get_int_octetstring"},
 {ERR_PACK(0,ASN1_F_ASN1_TYPE_GET_OCTETSTRING,0),        "ASN1_TYPE_get_octetstring"},
 {ERR_PACK(0,ASN1_F_ASN1_TYPE_NEW,0),    "ASN1_TYPE_new"},
 {ERR_PACK(0,ASN1_F_ASN1_UNPACK_STRING,0),       "ASN1_unpack_string"},
-{ERR_PACK(0,ASN1_F_ASN1_UTCTIME_NEW,0), "ASN1_UTCTIME_NEW"},
+{ERR_PACK(0,ASN1_F_ASN1_UTCTIME_NEW,0), "ASN1_UTCTIME_new"},
 {ERR_PACK(0,ASN1_F_ASN1_VERIFY,0),      "ASN1_verify"},
 {ERR_PACK(0,ASN1_F_AUTHORITY_KEYID_NEW,0),      "AUTHORITY_KEYID_new"},
 {ERR_PACK(0,ASN1_F_BASIC_CONSTRAINTS_NEW,0),    "BASIC_CONSTRAINTS_new"},
 {ERR_PACK(0,ASN1_F_BN_TO_ASN1_ENUMERATED,0),    "BN_to_ASN1_ENUMERATED"},
 {ERR_PACK(0,ASN1_F_BN_TO_ASN1_INTEGER,0),       "BN_to_ASN1_INTEGER"},
+{ERR_PACK(0,ASN1_F_D2I_ACCESS_DESCRIPTION,0),   "d2i_ACCESS_DESCRIPTION"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_BIT_STRING,0),      "d2i_ASN1_BIT_STRING"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_BMPSTRING,0),       "d2i_ASN1_BMPSTRING"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_BOOLEAN,0), "d2i_ASN1_BOOLEAN"},
@@ -108,6 +112,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_D2I_ASN1_GENERALIZEDTIME,0), "d2i_ASN1_GENERALIZEDTIME"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_HEADER,0),  "d2i_ASN1_HEADER"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_INTEGER,0), "d2i_ASN1_INTEGER"},
+{ERR_PACK(0,ASN1_F_D2I_ASN1_NULL,0),    "d2i_ASN1_NULL"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_OBJECT,0),  "d2i_ASN1_OBJECT"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_OCTET_STRING,0),    "d2i_ASN1_OCTET_STRING"},
 {ERR_PACK(0,ASN1_F_D2I_ASN1_PRINT_TYPE,0),      "D2I_ASN1_PRINT_TYPE"},
@@ -135,6 +140,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_D2I_NETSCAPE_SPKAC,0),       "d2i_NETSCAPE_SPKAC"},
 {ERR_PACK(0,ASN1_F_D2I_NETSCAPE_SPKI,0),        "d2i_NETSCAPE_SPKI"},
 {ERR_PACK(0,ASN1_F_D2I_NOTICEREF,0),    "d2i_NOTICEREF"},
+{ERR_PACK(0,ASN1_F_D2I_OTHERNAME,0),    "d2i_OTHERNAME"},
 {ERR_PACK(0,ASN1_F_D2I_PBE2PARAM,0),    "d2i_PBE2PARAM"},
 {ERR_PACK(0,ASN1_F_D2I_PBEPARAM,0),     "d2i_PBEPARAM"},
 {ERR_PACK(0,ASN1_F_D2I_PBKDF2PARAM,0),  "d2i_PBKDF2PARAM"},
@@ -166,6 +172,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_D2I_X509,0), "d2i_X509"},
 {ERR_PACK(0,ASN1_F_D2I_X509_ALGOR,0),   "d2i_X509_ALGOR"},
 {ERR_PACK(0,ASN1_F_D2I_X509_ATTRIBUTE,0),       "d2i_X509_ATTRIBUTE"},
+{ERR_PACK(0,ASN1_F_D2I_X509_CERT_AUX,0),        "d2i_X509_CERT_AUX"},
 {ERR_PACK(0,ASN1_F_D2I_X509_CINF,0),    "d2i_X509_CINF"},
 {ERR_PACK(0,ASN1_F_D2I_X509_CRL,0),     "d2i_X509_CRL"},
 {ERR_PACK(0,ASN1_F_D2I_X509_CRL_INFO,0),        "d2i_X509_CRL_INFO"},
@@ -189,12 +196,14 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_I2D_DSAPARAMS,0),    "i2d_DSAparams"},
 {ERR_PACK(0,ASN1_F_I2D_DSAPRIVATEKEY,0),        "i2d_DSAPrivateKey"},
 {ERR_PACK(0,ASN1_F_I2D_DSAPUBLICKEY,0), "i2d_DSAPublicKey"},
+{ERR_PACK(0,ASN1_F_I2D_DSA_PUBKEY,0),   "i2d_DSA_PUBKEY"},
 {ERR_PACK(0,ASN1_F_I2D_NETSCAPE_RSA,0), "i2d_Netscape_RSA"},
 {ERR_PACK(0,ASN1_F_I2D_PKCS7,0),        "i2d_PKCS7"},
 {ERR_PACK(0,ASN1_F_I2D_PRIVATEKEY,0),   "i2d_PrivateKey"},
 {ERR_PACK(0,ASN1_F_I2D_PUBLICKEY,0),    "i2d_PublicKey"},
 {ERR_PACK(0,ASN1_F_I2D_RSAPRIVATEKEY,0),        "i2d_RSAPrivateKey"},
 {ERR_PACK(0,ASN1_F_I2D_RSAPUBLICKEY,0), "i2d_RSAPublicKey"},
+{ERR_PACK(0,ASN1_F_I2D_RSA_PUBKEY,0),   "i2d_RSA_PUBKEY"},
 {ERR_PACK(0,ASN1_F_I2D_X509_ATTRIBUTE,0),       "i2d_X509_ATTRIBUTE"},
 {ERR_PACK(0,ASN1_F_I2T_ASN1_OBJECT,0),  "i2t_ASN1_OBJECT"},
 {ERR_PACK(0,ASN1_F_NETSCAPE_CERT_SEQUENCE_NEW,0),       "NETSCAPE_CERT_SEQUENCE_new"},
@@ -202,6 +211,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_NETSCAPE_SPKAC_NEW,0),       "NETSCAPE_SPKAC_new"},
 {ERR_PACK(0,ASN1_F_NETSCAPE_SPKI_NEW,0),        "NETSCAPE_SPKI_new"},
 {ERR_PACK(0,ASN1_F_NOTICEREF_NEW,0),    "NOTICEREF_new"},
+{ERR_PACK(0,ASN1_F_OTHERNAME_NEW,0),    "OTHERNAME_new"},
 {ERR_PACK(0,ASN1_F_PBE2PARAM_NEW,0),    "PBE2PARAM_new"},
 {ERR_PACK(0,ASN1_F_PBEPARAM_NEW,0),     "PBEPARAM_new"},
 {ERR_PACK(0,ASN1_F_PBKDF2PARAM_NEW,0),  "PBKDF2PARAM_new"},
@@ -229,6 +239,7 @@ static ERR_STRING_DATA ASN1_str_functs[]=
 {ERR_PACK(0,ASN1_F_USERNOTICE_NEW,0),   "USERNOTICE_new"},
 {ERR_PACK(0,ASN1_F_X509_ALGOR_NEW,0),   "X509_ALGOR_new"},
 {ERR_PACK(0,ASN1_F_X509_ATTRIBUTE_NEW,0),       "X509_ATTRIBUTE_new"},
+{ERR_PACK(0,ASN1_F_X509_CERT_AUX_NEW,0),        "X509_CERT_AUX_new"},
 {ERR_PACK(0,ASN1_F_X509_CINF_NEW,0),    "X509_CINF_new"},
 {ERR_PACK(0,ASN1_F_X509_CRL_INFO_NEW,0),        "X509_CRL_INFO_new"},
 {ERR_PACK(0,ASN1_F_X509_CRL_NEW,0),     "X509_CRL_new"},
@@ -262,6 +273,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ASN1_R_BN_LIB                           ,"bn lib"},
 {ASN1_R_BOOLEAN_IS_WRONG_LENGTH          ,"boolean is wrong length"},
 {ASN1_R_BUFFER_TOO_SMALL                 ,"buffer too small"},
+{ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER  ,"cipher has no object identifier"},
 {ASN1_R_DATA_IS_WRONG                    ,"data is wrong"},
 {ASN1_R_DECODE_ERROR                     ,"decode error"},
 {ASN1_R_DECODING_ERROR                   ,"decoding error"},
@@ -275,24 +287,31 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ASN1_R_EXPECTING_A_BIT_STRING           ,"expecting a bit string"},
 {ASN1_R_EXPECTING_A_BOOLEAN              ,"expecting a boolean"},
 {ASN1_R_EXPECTING_A_GENERALIZEDTIME      ,"expecting a generalizedtime"},
+{ASN1_R_EXPECTING_A_NULL                 ,"expecting a null"},
 {ASN1_R_EXPECTING_A_TIME                 ,"expecting a time"},
 {ASN1_R_EXPECTING_A_UTCTIME              ,"expecting a utctime"},
 {ASN1_R_FIRST_NUM_TOO_LARGE              ,"first num too large"},
 {ASN1_R_GENERALIZEDTIME_TOO_LONG         ,"generalizedtime too long"},
 {ASN1_R_HEADER_TOO_LONG                  ,"header too long"},
+{ASN1_R_ILLEGAL_CHARACTERS               ,"illegal characters"},
+{ASN1_R_INVALID_BMPSTRING_LENGTH         ,"invalid bmpstring length"},
 {ASN1_R_INVALID_DIGIT                    ,"invalid digit"},
 {ASN1_R_INVALID_SEPARATOR                ,"invalid separator"},
 {ASN1_R_INVALID_TIME_FORMAT              ,"invalid time format"},
+{ASN1_R_INVALID_UNIVERSALSTRING_LENGTH   ,"invalid universalstring length"},
+{ASN1_R_INVALID_UTF8STRING               ,"invalid utf8string"},
 {ASN1_R_IV_TOO_LARGE                     ,"iv too large"},
 {ASN1_R_LENGTH_ERROR                     ,"length error"},
 {ASN1_R_MISSING_SECOND_NUMBER            ,"missing second number"},
 {ASN1_R_NON_HEX_CHARACTERS               ,"non hex characters"},
 {ASN1_R_NOT_ENOUGH_DATA                  ,"not enough data"},
+{ASN1_R_NULL_IS_WRONG_LENGTH             ,"null is wrong length"},
 {ASN1_R_ODD_NUMBER_OF_CHARS              ,"odd number of chars"},
 {ASN1_R_PARSING                          ,"parsing"},
 {ASN1_R_PRIVATE_KEY_HEADER_MISSING       ,"private key header missing"},
 {ASN1_R_SECOND_NUMBER_TOO_LARGE          ,"second number too large"},
 {ASN1_R_SHORT_LINE                       ,"short line"},
+{ASN1_R_STRING_TOO_LONG                  ,"string too long"},
 {ASN1_R_STRING_TOO_SHORT                 ,"string too short"},
 {ASN1_R_TAG_VALUE_TOO_HIGH               ,"tag value too high"},
 {ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD,"the asn1 object identifier is not known for this md"},
@@ -300,6 +319,7 @@ static ERR_STRING_DATA ASN1_str_reasons[]=
 {ASN1_R_UNABLE_TO_DECODE_RSA_KEY         ,"unable to decode rsa key"},
 {ASN1_R_UNABLE_TO_DECODE_RSA_PRIVATE_KEY ,"unable to decode rsa private key"},
 {ASN1_R_UNKNOWN_ATTRIBUTE_TYPE           ,"unknown attribute type"},
+{ASN1_R_UNKNOWN_FORMAT                   ,"unknown format"},
 {ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM ,"unknown message digest algorithm"},
 {ASN1_R_UNKNOWN_OBJECT_TYPE              ,"unknown object type"},
 {ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE          ,"unknown public key type"},
diff --git a/src/lib/libcrypto/asn1/asn1_lib.c b/src/lib/libcrypto/asn1/asn1_lib.c
index 95e54ed626..be8daa8688 100644
--- a/src/lib/libcrypto/asn1/asn1_lib.c
+++ b/src/lib/libcrypto/asn1/asn1_lib.c
@@ -176,7 +176,7 @@ static int asn1_get_length(unsigned char **pp, int *inf, long *rl, int max)
        }
 /* class 0 is constructed
- * constructed == 2 for indefinitle length constructed */
+ * constructed == 2 for indefinite length constructed */
 void ASN1_put_object(unsigned char **pp, int constructed, int length, int tag,
             int xclass)
        {
@@ -349,7 +349,7 @@ int ASN1_STRING_set(ASN1_STRING *str, const void *_data, int len)
        if (data != NULL)
                {
                memcpy(str->data,data,len);
-                /* an alowance for strings :-) */
+                /* an allowance for strings :-) */
                str->data[len]='\0';
                }
        return(1);
@@ -381,8 +381,8 @@ ASN1_STRING *ASN1_STRING_type_new(int type)
 void ASN1_STRING_free(ASN1_STRING *a)
        {
        if (a == NULL) return;
-        if (a->data != NULL) Free((char *)a->data);
+        if (a->data != NULL) Free(a->data);
-        Free((char *)a);
+        Free(a);
        }
 int ASN1_STRING_cmp(ASN1_STRING *a, ASN1_STRING *b)
@@ -411,3 +411,14 @@ void asn1_add_error(unsigned char *address, int offset)
        ERR_add_error_data(4,"address=",buf1," offset=",buf2);
        }
+int ASN1_STRING_length(ASN1_STRING *x)
+{ return M_ASN1_STRING_length(x); }
+void ASN1_STRING_length_set(ASN1_STRING *x, int len)
+{ M_ASN1_STRING_length_set(x, len); return; }
+int ASN1_STRING_type(ASN1_STRING *x)
+{ return M_ASN1_STRING_type(x); }
+unsigned char * ASN1_STRING_data(ASN1_STRING *x)
+{ return M_ASN1_STRING_data(x); }
diff --git a/src/lib/libcrypto/asn1/asn1_mac.h b/src/lib/libcrypto/asn1/asn1_mac.h
index 93f9c5193c..4f2a82d340 100644
--- a/src/lib/libcrypto/asn1/asn1_mac.h
+++ b/src/lib/libcrypto/asn1/asn1_mac.h
@@ -106,6 +106,20 @@ err:\
 #define M_ASN1_D2I_start_sequence() \
        if (!asn1_GetSequence(&c,&length)) \
                { c.line=__LINE__; goto err; }
+/* Begin reading ASN1 without a surrounding sequence */
+#define M_ASN1_D2I_begin() \
+        c.slen = length;
+/* End reading ASN1 with no check on length */
+#define M_ASN1_D2I_Finish_nolen(a, func, e) \
+        *pp=c.p; \
+        if (a != NULL) (*a)=ret; \
+        return(ret); \
+err:\
+        ASN1_MAC_H_err((e),c.error,c.line); \
+        asn1_add_error(*pp,(int)(c.q- *pp)); \
+        if ((ret != NULL) && ((a == NULL) || (*a != ret))) func(ret); \
+        return(NULL)
 #define M_ASN1_D2I_end_sequence() \
        (((c.inf&1) == 0)?(c.slen <= 0): \
diff --git a/src/lib/libcrypto/asn1/asn1_par.c b/src/lib/libcrypto/asn1/asn1_par.c
index 86886606ef..d1e9816bad 100644
--- a/src/lib/libcrypto/asn1/asn1_par.c
+++ b/src/lib/libcrypto/asn1/asn1_par.c
@@ -93,55 +93,8 @@ static int asn1_print_info(BIO *bp, int tag, int xclass, int constructed,
                sprintf(str,"cont [ %d ]",tag);
        else if ((xclass & V_ASN1_APPLICATION) == V_ASN1_APPLICATION)
                sprintf(str,"appl [ %d ]",tag);
-        else if ((tag == V_ASN1_EOC) /* && (xclass == V_ASN1_UNIVERSAL) */)
+        else p = ASN1_tag2str(tag);
-                p="EOC";
-        else if (tag == V_ASN1_BOOLEAN)
-                p="BOOLEAN";
-        else if (tag == V_ASN1_INTEGER)
-                p="INTEGER";
-        else if (tag == V_ASN1_ENUMERATED)
-                p="ENUMERATED";
-        else if (tag == V_ASN1_BIT_STRING)
-                p="BIT STRING";
-        else if (tag == V_ASN1_OCTET_STRING)
-                p="OCTET STRING";
-        else if (tag == V_ASN1_NULL)
-                p="NULL";
-        else if (tag == V_ASN1_OBJECT)
-                p="OBJECT";
-        else if (tag == V_ASN1_SEQUENCE)
-                p="SEQUENCE";
-        else if (tag == V_ASN1_SET)
-                p="SET";
-        else if (tag == V_ASN1_PRINTABLESTRING)
-                p="PRINTABLESTRING";
-        else if (tag == V_ASN1_T61STRING)
-                p="T61STRING";
-        else if (tag == V_ASN1_IA5STRING)
-                p="IA5STRING";
-        else if (tag == V_ASN1_UTCTIME)
-                p="UTCTIME";
-        /* extras */
-        else if (tag == V_ASN1_NUMERICSTRING)
-                p="NUMERICSTRING";
-        else if (tag == V_ASN1_VIDEOTEXSTRING)
-                p="VIDEOTEXSTRING";
-        else if (tag == V_ASN1_GENERALIZEDTIME)
-                p="GENERALIZEDTIME";
-        else if (tag == V_ASN1_GRAPHICSTRING)
-                p="GRAPHICSTRING";
-        else if (tag == V_ASN1_VISIBLESTRING)
-                p="VISIBLESTRING";
-        else if (tag == V_ASN1_GENERALSTRING)
-                p="GENERALSTRING";
-        else if (tag == V_ASN1_UNIVERSALSTRING)
-                p="UNIVERSALSTRING";
-        else if (tag == V_ASN1_BMPSTRING)
-                p="BMPSTRING";
-        else
-                p2="(unknown)";
-                
        if (p2 != NULL)
                {
                if (BIO_printf(bp,fmt2,tag,p2) <= 0) goto err;
@@ -320,7 +273,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                                        os->length) <= 0)
                                                        goto end;
                                                }
-                                        ASN1_OCTET_STRING_free(os);
+                                        M_ASN1_OCTET_STRING_free(os);
                                        os=NULL;
                                        }
                                }
@@ -354,7 +307,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                        if (BIO_write(bp,"BAD INTEGER",11) <= 0)
                                                goto end;
                                        }
-                                ASN1_INTEGER_free(bs);
+                                M_ASN1_INTEGER_free(bs);
                                }
                        else if (tag == V_ASN1_ENUMERATED)
                                {
@@ -386,7 +339,7 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
                                        if (BIO_write(bp,"BAD ENUMERATED",11) <= 0)
                                                goto end;
                                        }
-                                ASN1_ENUMERATED_free(bs);
+                                M_ASN1_ENUMERATED_free(bs);
                                }
                        if (!nl) 
@@ -405,7 +358,28 @@ static int asn1_parse2(BIO *bp, unsigned char **pp, long length, int offset,
        ret=1;
 end:
        if (o != NULL) ASN1_OBJECT_free(o);
-        if (os != NULL) ASN1_OCTET_STRING_free(os);
+        if (os != NULL) M_ASN1_OCTET_STRING_free(os);
        *pp=p;
        return(ret);
        }
+const char *ASN1_tag2str(int tag)
+{
+        const static char *tag2str[] = {
+         "EOC", "BOOLEAN", "INTEGER", "BIT STRING", "OCTET STRING", /* 0-4 */
+         "NULL", "OBJECT", "OBJECT DESCRIPTOR", "EXTERNAL", "REAL", /* 5-9 */
+         "ENUMERATED", "<ASN1 11>", "UTF8STRING", "<ASN1 13>",      /* 10-13 */
+        "<ASN1 14>", "<ASN1 15>", "SEQUENCE", "SET",                /* 15-17 */
+        "NUMERICSTRING", "PRINTABLESTRING", "T61STRING",            /* 18-20 */
+        "VIDEOTEXSTRING", "IA5STRING", "UTCTIME","GENERALIZEDTIME", /* 21-24 */
+        "GRAPHICSTRING", "VISIBLESTRING", "GENERALSTRING",          /* 25-27 */
+        "UNIVERSALSTRING", "<ASN1 29>", "BMPSTRING"                 /* 28-30 */
+        };
+        if((tag == V_ASN1_NEG_INTEGER) || (tag == V_ASN1_NEG_ENUMERATED))
+                                                        tag &= ~0x100;
+        if(tag < 0 || tag > 30) return "(unknown)";
+        return tag2str[tag];
+}
diff --git a/src/lib/libcrypto/asn1/d2i_dhp.c b/src/lib/libcrypto/asn1/d2i_dhp.c
index a077211a4c..635ae829db 100644
--- a/src/lib/libcrypto/asn1/d2i_dhp.c
+++ b/src/lib/libcrypto/asn1/d2i_dhp.c
@@ -86,7 +86,7 @@ DH *d2i_DHparams(DH **a, unsigned char **pp, long length)
                ret->length=(int)v;
                }
-        ASN1_BIT_STRING_free(bs);
+        M_ASN1_BIT_STRING_free(bs);
        M_ASN1_D2I_Finish_2(a);
@@ -95,7 +95,7 @@ err_bn:
 err:
        ASN1err(ASN1_F_D2I_DHPARAMS,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret))) DH_free(ret);
-        if (bs != NULL) ASN1_BIT_STRING_free(bs);
+        if (bs != NULL) M_ASN1_BIT_STRING_free(bs);
        return(NULL);
        }
 #endif
diff --git a/src/lib/libcrypto/asn1/d2i_dsap.c b/src/lib/libcrypto/asn1/d2i_dsap.c
index cdd7136f51..6d1c297133 100644
--- a/src/lib/libcrypto/asn1/d2i_dsap.c
+++ b/src/lib/libcrypto/asn1/d2i_dsap.c
@@ -83,7 +83,7 @@ DSA *d2i_DSAparams(DSA **a, unsigned char **pp, long length)
        M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
        if ((ret->g=BN_bin2bn(bs->data,bs->length,ret->g)) == NULL) goto err_bn;
-        ASN1_BIT_STRING_free(bs);
+        M_ASN1_BIT_STRING_free(bs);
        M_ASN1_D2I_Finish_2(a);
@@ -92,7 +92,7 @@ err_bn:
 err:
        ASN1err(ASN1_F_D2I_DSAPARAMS,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);
-        if (bs != NULL) ASN1_BIT_STRING_free(bs);
+        if (bs != NULL) M_ASN1_BIT_STRING_free(bs);
        return(NULL);
        }
 #endif
diff --git a/src/lib/libcrypto/asn1/d2i_pr.c b/src/lib/libcrypto/asn1/d2i_pr.c
index f3d1aa6240..c92b8325d8 100644
--- a/src/lib/libcrypto/asn1/d2i_pr.c
+++ b/src/lib/libcrypto/asn1/d2i_pr.c
@@ -112,3 +112,26 @@ err:
        return(NULL);
        }
+/* This works like d2i_PrivateKey() except it automatically works out the type */
+EVP_PKEY *d2i_AutoPrivateKey(EVP_PKEY **a, unsigned char **pp,
+             long length)
+{
+        STACK_OF(ASN1_TYPE) *inkey;
+        unsigned char *p;
+        int keytype;
+        p = *pp;
+        /* Dirty trick: read in the ASN1 data into a STACK_OF(ASN1_TYPE):
+         * by analyzing it we can determine the passed structure: this
+         * assumes the input is surrounded by an ASN1 SEQUENCE.
+         */
+        inkey = d2i_ASN1_SET_OF_ASN1_TYPE(NULL, &p, length, d2i_ASN1_TYPE, 
+                        ASN1_TYPE_free, V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
+        /* Since we only need to discern "traditional format" RSA and DSA
+         * keys we can just count the elements.
+         */
+        if(sk_ASN1_TYPE_num(inkey) == 6) keytype = EVP_PKEY_DSA;
+        else keytype = EVP_PKEY_RSA;
+        sk_ASN1_TYPE_pop_free(inkey, ASN1_TYPE_free);
+        return d2i_PrivateKey(keytype, a, pp, length);
+}
diff --git a/src/lib/libcrypto/asn1/d2i_r_pr.c b/src/lib/libcrypto/asn1/d2i_r_pr.c
index 18f11b6f5e..6c8a45f821 100644
--- a/src/lib/libcrypto/asn1/d2i_r_pr.c
+++ b/src/lib/libcrypto/asn1/d2i_r_pr.c
@@ -107,7 +107,7 @@ RSA *d2i_RSAPrivateKey(RSA **a, unsigned char **pp, long length)
        if ((ret->iqmp=BN_bin2bn(bs->data,bs->length,ret->iqmp)) == NULL)
                goto err_bn;
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
        M_ASN1_D2I_Finish_2(a);
 err_bn:
@@ -115,7 +115,14 @@ err_bn:
 err:
        ASN1err(ASN1_F_D2I_RSAPRIVATEKEY,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret))) RSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
        return(NULL);
        }
+#else /* !NO_RSA */
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
 #endif
diff --git a/src/lib/libcrypto/asn1/d2i_r_pu.c b/src/lib/libcrypto/asn1/d2i_r_pu.c
index c4ae58b594..d1289f160e 100644
--- a/src/lib/libcrypto/asn1/d2i_r_pu.c
+++ b/src/lib/libcrypto/asn1/d2i_r_pu.c
@@ -81,7 +81,7 @@ RSA *d2i_RSAPublicKey(RSA **a, unsigned char **pp, long length)
        M_ASN1_D2I_get(bs,d2i_ASN1_INTEGER);
        if ((ret->e=BN_bin2bn(bs->data,bs->length,ret->e)) == NULL) goto err_bn;
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
        bs=NULL;
        M_ASN1_D2I_Finish_2(a);
@@ -91,7 +91,13 @@ err_bn:
 err:
        ASN1err(ASN1_F_D2I_RSAPUBLICKEY,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret))) RSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
        return(NULL);
        }
+#else /* !NO_RSA */
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
 #endif
diff --git a/src/lib/libcrypto/asn1/d2i_s_pr.c b/src/lib/libcrypto/asn1/d2i_s_pr.c
index 050e1cc5fb..dec2a2ebd3 100644
--- a/src/lib/libcrypto/asn1/d2i_s_pr.c
+++ b/src/lib/libcrypto/asn1/d2i_s_pr.c
@@ -91,7 +91,7 @@ DSA *d2i_DSAPrivateKey(DSA **a, unsigned char **pp, long length)
        if ((ret->priv_key=BN_bin2bn(bs->data,bs->length,ret->priv_key))
                == NULL) goto err_bn;
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
        M_ASN1_D2I_Finish_2(a);
 err_bn:
@@ -99,7 +99,7 @@ err_bn:
 err:
        ASN1err(ASN1_F_D2I_DSAPRIVATEKEY,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
        return(NULL);
        }
 #endif
diff --git a/src/lib/libcrypto/asn1/d2i_s_pu.c b/src/lib/libcrypto/asn1/d2i_s_pu.c
index 94ea1c313b..e0adaa0393 100644
--- a/src/lib/libcrypto/asn1/d2i_s_pu.c
+++ b/src/lib/libcrypto/asn1/d2i_s_pu.c
@@ -107,7 +107,7 @@ DSA *d2i_DSAPublicKey(DSA **a, unsigned char **pp, long length)
                ret->write_params=1;
                }
-        ASN1_INTEGER_free(bs);
+        M_ASN1_INTEGER_free(bs);
        bs=NULL;
        M_ASN1_D2I_Finish_2(a);
 err_bn:
@@ -115,7 +115,7 @@ err_bn:
 err:
        ASN1err(ASN1_F_D2I_DSAPUBLICKEY,i);
        if ((ret != NULL) && ((a == NULL) || (*a != ret))) DSA_free(ret);
-        if (bs != NULL) ASN1_INTEGER_free(bs);
+        if (bs != NULL) M_ASN1_INTEGER_free(bs);
        return(NULL);
        }
 #endif
diff --git a/src/lib/libcrypto/asn1/evp_asn1.c b/src/lib/libcrypto/asn1/evp_asn1.c
index 41ced49c19..3506005a71 100644
--- a/src/lib/libcrypto/asn1/evp_asn1.c
+++ b/src/lib/libcrypto/asn1/evp_asn1.c
@@ -65,8 +65,8 @@ int ASN1_TYPE_set_octetstring(ASN1_TYPE *a, unsigned char *data, int len)
        {
        ASN1_STRING *os;
-        if ((os=ASN1_OCTET_STRING_new()) == NULL) return(0);
+        if ((os=M_ASN1_OCTET_STRING_new()) == NULL) return(0);
-        if (!ASN1_OCTET_STRING_set(os,data,len)) return(0);
+        if (!M_ASN1_OCTET_STRING_set(os,data,len)) return(0);
        ASN1_TYPE_set(a,V_ASN1_OCTET_STRING,os);
        return(1);
        }
@@ -83,8 +83,8 @@ int ASN1_TYPE_get_octetstring(ASN1_TYPE *a, unsigned char *data,
                ASN1err(ASN1_F_ASN1_TYPE_GET_OCTETSTRING,ASN1_R_DATA_IS_WRONG);
                return(-1);
                }
-        p=ASN1_STRING_data(a->value.octet_string);
+        p=M_ASN1_STRING_data(a->value.octet_string);
-        ret=ASN1_STRING_length(a->value.octet_string);
+        ret=M_ASN1_STRING_length(a->value.octet_string);
        if (ret < max_len)
                num=ret;
        else
@@ -117,8 +117,8 @@ int ASN1_TYPE_set_int_octetstring(ASN1_TYPE *a, long num, unsigned char *data,
        /* Grow the 'string' */
        ASN1_STRING_set(osp,NULL,size);
-        ASN1_STRING_length(osp)=size;
+        M_ASN1_STRING_length_set(osp, size);
-        p=ASN1_STRING_data(osp);
+        p=M_ASN1_STRING_data(osp);
        ASN1_put_object(&p,1,n,V_ASN1_SEQUENCE,V_ASN1_UNIVERSAL);
          i2d_ASN1_INTEGER(&in,&p);
@@ -145,8 +145,8 @@ int ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a, long *num, unsigned char *data,
                {
                goto err;
                }
-        p=ASN1_STRING_data(a->value.sequence);
+        p=M_ASN1_STRING_data(a->value.sequence);
-        length=ASN1_STRING_length(a->value.sequence);
+        length=M_ASN1_STRING_length(a->value.sequence);
        c.pp= &p;
        c.p=p;
@@ -165,21 +165,21 @@ int ASN1_TYPE_get_int_octetstring(ASN1_TYPE *a, long *num, unsigned char *data,
        if (num != NULL)
                *num=ASN1_INTEGER_get(ai);
-        ret=ASN1_STRING_length(os);
+        ret=M_ASN1_STRING_length(os);
        if (max_len > ret)
                n=ret;
        else
                n=max_len;
        if (data != NULL)
-                memcpy(data,ASN1_STRING_data(os),n);
+                memcpy(data,M_ASN1_STRING_data(os),n);
        if (0)
                {
 err:
                ASN1err(ASN1_F_ASN1_TYPE_GET_INT_OCTETSTRING,ASN1_R_DATA_IS_WRONG);
                }
-        if (os != NULL) ASN1_OCTET_STRING_free(os);
+        if (os != NULL) M_ASN1_OCTET_STRING_free(os);
-        if (ai != NULL) ASN1_INTEGER_free(ai);
+        if (ai != NULL) M_ASN1_INTEGER_free(ai);
        return(ret);
        }
diff --git a/src/lib/libcrypto/asn1/f_enum.c b/src/lib/libcrypto/asn1/f_enum.c
index 3bcceecdb8..3d0b1107cb 100644
--- a/src/lib/libcrypto/asn1/f_enum.c
+++ b/src/lib/libcrypto/asn1/f_enum.c
@@ -161,7 +161,7 @@ int a2i_ASN1_ENUMERATED(BIO *bp, ASN1_ENUMERATED *bs, char *buf, int size)
                        if (sp == NULL)
                                {
                                ASN1err(ASN1_F_A2I_ASN1_ENUMERATED,ERR_R_MALLOC_FAILURE);
-                                if (s != NULL) Free((char *)s);
+                                if (s != NULL) Free(s);
                                goto err;
                                }
                        s=sp;
diff --git a/src/lib/libcrypto/asn1/f_int.c b/src/lib/libcrypto/asn1/f_int.c
index 55560dd814..cd57331c3f 100644
--- a/src/lib/libcrypto/asn1/f_int.c
+++ b/src/lib/libcrypto/asn1/f_int.c
@@ -168,7 +168,7 @@ int a2i_ASN1_INTEGER(BIO *bp, ASN1_INTEGER *bs, char *buf, int size)
                        if (sp == NULL)
                                {
                                ASN1err(ASN1_F_A2I_ASN1_INTEGER,ERR_R_MALLOC_FAILURE);
-                                if (s != NULL) Free((char *)s);
+                                if (s != NULL) Free(s);
                                goto err;
                                }
                        s=sp;
diff --git a/src/lib/libcrypto/asn1/f_string.c b/src/lib/libcrypto/asn1/f_string.c
index 5d0cf5a46d..088313689a 100644
--- a/src/lib/libcrypto/asn1/f_string.c
+++ b/src/lib/libcrypto/asn1/f_string.c
@@ -166,7 +166,7 @@ int a2i_ASN1_STRING(BIO *bp, ASN1_STRING *bs, char *buf, int size)
                        if (sp == NULL)
                                {
                                ASN1err(ASN1_F_A2I_ASN1_STRING,ERR_R_MALLOC_FAILURE);
-                                if (s != NULL) Free((char *)s);
+                                if (s != NULL) Free(s);
                                goto err;
                                }
                        s=sp;
diff --git a/src/lib/libcrypto/asn1/i2d_dhp.c b/src/lib/libcrypto/asn1/i2d_dhp.c
index fdda4ec41b..61eeb646f9 100644
--- a/src/lib/libcrypto/asn1/i2d_dhp.c
+++ b/src/lib/libcrypto/asn1/i2d_dhp.c
@@ -118,7 +118,7 @@ int i2d_DHparams(DH *a, unsigned char **pp)
                bs.length=BN_bn2bin(num[i],bs.data);
                i2d_ASN1_INTEGER(&bs,&p);
                }
-        Free((char *)bs.data);
+        Free(bs.data);
        ret=t;
 err:
        if (num[2] != NULL) BN_free(num[2]);
diff --git a/src/lib/libcrypto/asn1/i2d_dsap.c b/src/lib/libcrypto/asn1/i2d_dsap.c
index f36f0da4e2..4021123ba3 100644
--- a/src/lib/libcrypto/asn1/i2d_dsap.c
+++ b/src/lib/libcrypto/asn1/i2d_dsap.c
@@ -107,7 +107,7 @@ int i2d_DSAparams(DSA *a, unsigned char **pp)
                bs.length=BN_bn2bin(num[i],bs.data);
                i2d_ASN1_INTEGER(&bs,&p);
                }
-        Free((char *)bs.data);
+        Free(bs.data);
        ret=t;
 err:
        *pp=p;
diff --git a/src/lib/libcrypto/asn1/i2d_r_pr.c b/src/lib/libcrypto/asn1/i2d_r_pr.c
index 27e6844a7f..1250fa4b2d 100644
--- a/src/lib/libcrypto/asn1/i2d_r_pr.c
+++ b/src/lib/libcrypto/asn1/i2d_r_pr.c
@@ -119,9 +119,15 @@ int i2d_RSAPrivateKey(RSA *a, unsigned char **pp)
                bs.length=BN_bn2bin(num[i],bs.data);
                i2d_ASN1_INTEGER(&bs,&p);
                }
-        Free((char *)bs.data);
+        Free(bs.data);
        *pp=p;
        return(t);
        }
+#else /* !NO_RSA */
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
 #endif
diff --git a/src/lib/libcrypto/asn1/i2d_r_pu.c b/src/lib/libcrypto/asn1/i2d_r_pu.c
index 6d01bfa8b5..582b92ee4c 100644
--- a/src/lib/libcrypto/asn1/i2d_r_pu.c
+++ b/src/lib/libcrypto/asn1/i2d_r_pu.c
@@ -105,8 +105,14 @@ int i2d_RSAPublicKey(RSA *a, unsigned char **pp)
                bs.length=BN_bn2bin(num[i],bs.data);
                i2d_ASN1_INTEGER(&bs,&p);
                }
-        Free((char *)bs.data);
+        Free(bs.data);
        *pp=p;
        return(t);
        }
+#else /* !NO_RSA */
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
 #endif
diff --git a/src/lib/libcrypto/asn1/i2d_s_pr.c b/src/lib/libcrypto/asn1/i2d_s_pr.c
index 5d3dcdf197..e399ceaeb9 100644
--- a/src/lib/libcrypto/asn1/i2d_s_pr.c
+++ b/src/lib/libcrypto/asn1/i2d_s_pr.c
@@ -116,7 +116,7 @@ int i2d_DSAPrivateKey(DSA *a, unsigned char **pp)
                bs.length=BN_bn2bin(num[i],bs.data);
                i2d_ASN1_INTEGER(&bs,&p);
                }
-        Free((char *)bs.data);
+        Free(bs.data);
        *pp=p;
        return(t);
        }
diff --git a/src/lib/libcrypto/asn1/i2d_s_pu.c b/src/lib/libcrypto/asn1/i2d_s_pu.c
index 18f790f746..ca7f251b71 100644
--- a/src/lib/libcrypto/asn1/i2d_s_pu.c
+++ b/src/lib/libcrypto/asn1/i2d_s_pu.c
@@ -121,7 +121,7 @@ int i2d_DSAPublicKey(DSA *a, unsigned char **pp)
                bs.length=BN_bn2bin(num[i],bs.data);
                i2d_ASN1_INTEGER(&bs,&p);
                }
-        Free((char *)bs.data);
+        Free(bs.data);
        *pp=p;
        if(all) return(t);
        else return(tot);
diff --git a/src/lib/libcrypto/asn1/n_pkey.c b/src/lib/libcrypto/asn1/n_pkey.c
index cdc0d8b7c4..d804986b73 100644
--- a/src/lib/libcrypto/asn1/n_pkey.c
+++ b/src/lib/libcrypto/asn1/n_pkey.c
@@ -139,7 +139,7 @@ int i2d_Netscape_RSA(RSA *a, unsigned char **pp, int (*cb)())
                }
        if (pkey->private_key->data != NULL)
-                Free((char *)pkey->private_key->data);
+                Free(pkey->private_key->data);
        if ((pkey->private_key->data=(unsigned char *)Malloc(l[0])) == NULL)
                {
                ASN1err(ASN1_F_I2D_NETSCAPE_RSA,ERR_R_MALLOC_FAILURE);
@@ -205,10 +205,10 @@ RSA *d2i_Netscape_RSA(RSA **a, unsigned char **pp, long length, int (*cb)())
                (char *)os->data,os->length) != 0))
                {
                ASN1err(ASN1_F_D2I_NETSCAPE_RSA,ASN1_R_PRIVATE_KEY_HEADER_MISSING);
-                ASN1_BIT_STRING_free(os);
+                M_ASN1_BIT_STRING_free(os);
                goto err;
                }
-        ASN1_BIT_STRING_free(os);
+        M_ASN1_BIT_STRING_free(os);
        c.q=c.p;
        if ((ret=d2i_Netscape_RSA_2(a,&c.p,c.slen,cb)) == NULL) goto err;
        c.slen-=(c.p-c.q);
@@ -279,7 +279,7 @@ RSA *d2i_Netscape_RSA_2(RSA **a, unsigned char **pp, long length,
        *pp=c.p;
 err:
        if (pkey != NULL) NETSCAPE_PKEY_free(pkey);
-        if (os != NULL) ASN1_BIT_STRING_free(os);
+        if (os != NULL) M_ASN1_BIT_STRING_free(os);
        if (alg != NULL) X509_ALGOR_free(alg);
        return(ret);
        }
@@ -321,9 +321,9 @@ static NETSCAPE_PKEY *NETSCAPE_PKEY_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,NETSCAPE_PKEY);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
        M_ASN1_New(ret->algor,X509_ALGOR_new);
-        M_ASN1_New(ret->private_key,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->private_key,M_ASN1_OCTET_STRING_new);
        return(ret);
        M_ASN1_New_Error(ASN1_F_NETSCAPE_PKEY_NEW);
        }
@@ -331,11 +331,18 @@ static NETSCAPE_PKEY *NETSCAPE_PKEY_new(void)
 static void NETSCAPE_PKEY_free(NETSCAPE_PKEY *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
        X509_ALGOR_free(a->algor);
-        ASN1_OCTET_STRING_free(a->private_key);
+        M_ASN1_OCTET_STRING_free(a->private_key);
-        Free((char *)a);
+        Free(a);
        }
 #endif /* NO_RC4 */
+#else /* !NO_RSA */
+# if PEDANTIC
+static void *dummy=&dummy;
+# endif
 #endif
diff --git a/src/lib/libcrypto/asn1/p5_pbe.c b/src/lib/libcrypto/asn1/p5_pbe.c
index b831836e7b..64e90237cc 100644
--- a/src/lib/libcrypto/asn1/p5_pbe.c
+++ b/src/lib/libcrypto/asn1/p5_pbe.c
@@ -82,8 +82,8 @@ PBEPARAM *PBEPARAM_new(void)
        PBEPARAM *ret=NULL;
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret, PBEPARAM);
-        M_ASN1_New(ret->iter,ASN1_INTEGER_new);
+        M_ASN1_New(ret->iter,M_ASN1_INTEGER_new);
-        M_ASN1_New(ret->salt,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->salt,M_ASN1_OCTET_STRING_new);
        return (ret);
        M_ASN1_New_Error(ASN1_F_PBEPARAM_NEW);
 }
@@ -101,9 +101,9 @@ PBEPARAM *d2i_PBEPARAM(PBEPARAM **a, unsigned char **pp, long length)
 void PBEPARAM_free (PBEPARAM *a)
 {
        if(a==NULL) return;
-        ASN1_OCTET_STRING_free(a->salt);
+        M_ASN1_OCTET_STRING_free(a->salt);
-        ASN1_INTEGER_free (a->iter);
+        M_ASN1_INTEGER_free (a->iter);
-        Free ((char *)a);
+        Free (a);
 }
 /* Return an algorithm identifier for a PKCS#5 PBE algorithm */
@@ -129,7 +129,8 @@ X509_ALGOR *PKCS5_pbe_set(int alg, int iter, unsigned char *salt,
        }
        pbe->salt->length = saltlen;
        if (salt) memcpy (pbe->salt->data, salt, saltlen);
-        else RAND_bytes (pbe->salt->data, saltlen);
+        else if (RAND_bytes (pbe->salt->data, saltlen) <= 0)
+                return NULL;
        if (!(astype = ASN1_TYPE_new())) {
                ASN1err(ASN1_F_ASN1_PBE_SET,ERR_R_MALLOC_FAILURE);
diff --git a/src/lib/libcrypto/asn1/p5_pbev2.c b/src/lib/libcrypto/asn1/p5_pbev2.c
index 09f4bf6112..4ce06a94ab 100644
--- a/src/lib/libcrypto/asn1/p5_pbev2.c
+++ b/src/lib/libcrypto/asn1/p5_pbev2.c
@@ -104,7 +104,7 @@ void PBE2PARAM_free (PBE2PARAM *a)
        if(a==NULL) return;
        X509_ALGOR_free(a->keyfunc);
        X509_ALGOR_free(a->encryption);
-        Free ((char *)a);
+        Free (a);
 }
 int i2d_PBKDF2PARAM(PBKDF2PARAM *a, unsigned char **pp)
@@ -131,7 +131,7 @@ PBKDF2PARAM *PBKDF2PARAM_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret, PBKDF2PARAM);
        M_ASN1_New(ret->salt, ASN1_TYPE_new);
-        M_ASN1_New(ret->iter, ASN1_INTEGER_new);
+        M_ASN1_New(ret->iter, M_ASN1_INTEGER_new);
        ret->keylength = NULL;
        ret->prf = NULL;
        return (ret);
@@ -155,10 +155,10 @@ void PBKDF2PARAM_free (PBKDF2PARAM *a)
 {
        if(a==NULL) return;
        ASN1_TYPE_free(a->salt);
-        ASN1_INTEGER_free(a->iter);
+        M_ASN1_INTEGER_free(a->iter);
-        ASN1_INTEGER_free(a->keylength);
+        M_ASN1_INTEGER_free(a->keylength);
        X509_ALGOR_free(a->prf);
-        Free ((char *)a);
+        Free (a);
 }
 /* Return an algorithm identifier for a PKCS#5 v2.0 PBE algorithm:
@@ -175,19 +175,26 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
        PBKDF2PARAM *kdf = NULL;
        PBE2PARAM *pbe2 = NULL;
        ASN1_OCTET_STRING *osalt = NULL;
+        ASN1_OBJECT *obj;
+        alg_nid = EVP_CIPHER_type(cipher);
+        if(alg_nid == NID_undef) {
+                ASN1err(ASN1_F_PKCS5_PBE2_SET,
+                                ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER);
+                goto err;
+        }
+        obj = OBJ_nid2obj(alg_nid);
        if(!(pbe2 = PBE2PARAM_new())) goto merr;
        /* Setup the AlgorithmIdentifier for the encryption scheme */
        scheme = pbe2->encryption;
-        alg_nid = EVP_CIPHER_type(cipher);
+        scheme->algorithm = obj;
-        scheme->algorithm = OBJ_nid2obj(alg_nid);
        if(!(scheme->parameter = ASN1_TYPE_new())) goto merr;
        /* Create random IV */
-        RAND_bytes(iv, EVP_CIPHER_iv_length(cipher));
+        RAND_pseudo_bytes(iv, EVP_CIPHER_iv_length(cipher));
        /* Dummy cipherinit to just setup the IV */
        EVP_CipherInit(&ctx, cipher, NULL, iv, 0);
@@ -199,13 +206,13 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
        EVP_CIPHER_CTX_cleanup(&ctx);
        if(!(kdf = PBKDF2PARAM_new())) goto merr;
-        if(!(osalt = ASN1_OCTET_STRING_new())) goto merr;
+        if(!(osalt = M_ASN1_OCTET_STRING_new())) goto merr;
        if (!saltlen) saltlen = PKCS5_SALT_LEN;
        if (!(osalt->data = Malloc (saltlen))) goto merr;
        osalt->length = saltlen;
        if (salt) memcpy (osalt->data, salt, saltlen);
-        else RAND_bytes (osalt->data, saltlen);
+        else if (RAND_bytes (osalt->data, saltlen) <= 0) goto merr;
        if(iter <= 0) iter = PKCS5_DEFAULT_ITER;
        if(!ASN1_INTEGER_set(kdf->iter, iter)) goto merr;
@@ -218,7 +225,7 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
        /* If its RC2 then we'd better setup the key length */
        if(alg_nid == NID_rc2_cbc) {
-                if(!(kdf->keylength = ASN1_INTEGER_new())) goto merr;
+                if(!(kdf->keylength = M_ASN1_INTEGER_new())) goto merr;
                if(!ASN1_INTEGER_set (kdf->keylength,
                                 EVP_CIPHER_key_length(cipher))) goto merr;
        }
@@ -264,7 +271,7 @@ X509_ALGOR *PKCS5_pbe2_set(const EVP_CIPHER *cipher, int iter,
        err:
        PBE2PARAM_free(pbe2);
        /* Note 'scheme' is freed as part of pbe2 */
-        ASN1_OCTET_STRING_free(osalt);
+        M_ASN1_OCTET_STRING_free(osalt);
        PBKDF2PARAM_free(kdf);
        X509_ALGOR_free(kalg);
        X509_ALGOR_free(ret);
diff --git a/src/lib/libcrypto/asn1/p7_dgst.c b/src/lib/libcrypto/asn1/p7_dgst.c
index 62783a2b8d..cba90e94a1 100644
--- a/src/lib/libcrypto/asn1/p7_dgst.c
+++ b/src/lib/libcrypto/asn1/p7_dgst.c
@@ -101,10 +101,10 @@ PKCS7_DIGEST *PKCS7_DIGEST_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,PKCS7_DIGEST);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
        M_ASN1_New(ret->md,X509_ALGOR_new);
        M_ASN1_New(ret->contents,PKCS7_new);
-        M_ASN1_New(ret->digest,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->digest,M_ASN1_OCTET_STRING_new);
        return(ret);
        M_ASN1_New_Error(ASN1_F_PKCS7_DIGEST_NEW);
        }
@@ -112,10 +112,10 @@ PKCS7_DIGEST *PKCS7_DIGEST_new(void)
 void PKCS7_DIGEST_free(PKCS7_DIGEST *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
        X509_ALGOR_free(a->md);
        PKCS7_free(a->contents);
-        ASN1_OCTET_STRING_free(a->digest);
+        M_ASN1_OCTET_STRING_free(a->digest);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/p7_enc.c b/src/lib/libcrypto/asn1/p7_enc.c
index 4741126587..83b0e15faa 100644
--- a/src/lib/libcrypto/asn1/p7_enc.c
+++ b/src/lib/libcrypto/asn1/p7_enc.c
@@ -95,7 +95,7 @@ PKCS7_ENCRYPT *PKCS7_ENCRYPT_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,PKCS7_ENCRYPT);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
        M_ASN1_New(ret->enc_data,PKCS7_ENC_CONTENT_new);
        return(ret);
        M_ASN1_New_Error(ASN1_F_PKCS7_ENCRYPT_NEW);
@@ -104,8 +104,8 @@ PKCS7_ENCRYPT *PKCS7_ENCRYPT_new(void)
 void PKCS7_ENCRYPT_free(PKCS7_ENCRYPT *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
        PKCS7_ENC_CONTENT_free(a->enc_data);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/p7_enc_c.c b/src/lib/libcrypto/asn1/p7_enc_c.c
index a832737a38..582cc78b06 100644
--- a/src/lib/libcrypto/asn1/p7_enc_c.c
+++ b/src/lib/libcrypto/asn1/p7_enc_c.c
@@ -101,7 +101,8 @@ PKCS7_ENC_CONTENT *PKCS7_ENC_CONTENT_new(void)
        M_ASN1_New_Malloc(ret,PKCS7_ENC_CONTENT);
        /* M_ASN1_New(ret->content_type,ASN1_OBJECT_new); */
-        ret->content_type=OBJ_nid2obj(NID_pkcs7_encrypted);
+        /* We will almost always want this: so make it the default */
+        ret->content_type=OBJ_nid2obj(NID_pkcs7_data);
        M_ASN1_New(ret->algorithm,X509_ALGOR_new);
        ret->enc_data=NULL;
        return(ret);
@@ -113,7 +114,7 @@ void PKCS7_ENC_CONTENT_free(PKCS7_ENC_CONTENT *a)
        if (a == NULL) return;
        ASN1_OBJECT_free(a->content_type);
        X509_ALGOR_free(a->algorithm);
-        ASN1_OCTET_STRING_free(a->enc_data);
+        M_ASN1_OCTET_STRING_free(a->enc_data);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/p7_evp.c b/src/lib/libcrypto/asn1/p7_evp.c
index b2b3d50dcd..4e734fdd28 100644
--- a/src/lib/libcrypto/asn1/p7_evp.c
+++ b/src/lib/libcrypto/asn1/p7_evp.c
@@ -101,7 +101,7 @@ PKCS7_ENVELOPE *PKCS7_ENVELOPE_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,PKCS7_ENVELOPE);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
        M_ASN1_New(ret->recipientinfo,sk_PKCS7_RECIP_INFO_new_null);
        M_ASN1_New(ret->enc_data,PKCS7_ENC_CONTENT_new);
        return(ret);
@@ -111,9 +111,9 @@ PKCS7_ENVELOPE *PKCS7_ENVELOPE_new(void)
 void PKCS7_ENVELOPE_free(PKCS7_ENVELOPE *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
        sk_PKCS7_RECIP_INFO_pop_free(a->recipientinfo,PKCS7_RECIP_INFO_free);
        PKCS7_ENC_CONTENT_free(a->enc_data);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/p7_i_s.c b/src/lib/libcrypto/asn1/p7_i_s.c
index 7d4b457e01..d21f7ddb84 100644
--- a/src/lib/libcrypto/asn1/p7_i_s.c
+++ b/src/lib/libcrypto/asn1/p7_i_s.c
@@ -96,7 +96,7 @@ PKCS7_ISSUER_AND_SERIAL *PKCS7_ISSUER_AND_SERIAL_new(void)
        M_ASN1_New_Malloc(ret,PKCS7_ISSUER_AND_SERIAL);
        M_ASN1_New(ret->issuer,X509_NAME_new);
-        M_ASN1_New(ret->serial,ASN1_INTEGER_new);
+        M_ASN1_New(ret->serial,M_ASN1_INTEGER_new);
        return(ret);
        M_ASN1_New_Error(ASN1_F_PKCS7_ISSUER_AND_SERIAL_NEW);
        }
@@ -105,7 +105,7 @@ void PKCS7_ISSUER_AND_SERIAL_free(PKCS7_ISSUER_AND_SERIAL *a)
        {
        if (a == NULL) return;
        X509_NAME_free(a->issuer);
-        ASN1_INTEGER_free(a->serial);
+        M_ASN1_INTEGER_free(a->serial);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/p7_lib.c b/src/lib/libcrypto/asn1/p7_lib.c
index 846be17158..86db82cfa1 100644
--- a/src/lib/libcrypto/asn1/p7_lib.c
+++ b/src/lib/libcrypto/asn1/p7_lib.c
@@ -152,7 +152,7 @@ PKCS7 *d2i_PKCS7(PKCS7 **a, unsigned char **pp, long length)
                {
                if ((*a)->asn1 != NULL)
                        {
-                        Free((char *)(*a)->asn1);
+                        Free((*a)->asn1);
                        (*a)->asn1=NULL;
                        }
                (*a)->length=0;
@@ -251,7 +251,7 @@ void PKCS7_free(PKCS7 *a)
                {
                ASN1_OBJECT_free(a->type);
                }
-        Free((char *)(char *)a);
+        Free(a);
        }
 void PKCS7_content_free(PKCS7 *a)
@@ -259,7 +259,7 @@ void PKCS7_content_free(PKCS7 *a)
        if(a == NULL)
            return;
-        if (a->asn1 != NULL) Free((char *)a->asn1);
+        if (a->asn1 != NULL) Free(a->asn1);
        if (a->d.ptr != NULL)
                {
@@ -268,7 +268,7 @@ void PKCS7_content_free(PKCS7 *a)
                switch (OBJ_obj2nid(a->type))
                        {
                case NID_pkcs7_data:
-                        ASN1_OCTET_STRING_free(a->d.data);
+                        M_ASN1_OCTET_STRING_free(a->d.data);
                        break;
                case NID_pkcs7_signed:
                        PKCS7_SIGNED_free(a->d.sign);
diff --git a/src/lib/libcrypto/asn1/p7_recip.c b/src/lib/libcrypto/asn1/p7_recip.c
index 9fda4f20d4..b1abfa3b8f 100644
--- a/src/lib/libcrypto/asn1/p7_recip.c
+++ b/src/lib/libcrypto/asn1/p7_recip.c
@@ -101,10 +101,10 @@ PKCS7_RECIP_INFO *PKCS7_RECIP_INFO_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,PKCS7_RECIP_INFO);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
        M_ASN1_New(ret->issuer_and_serial,PKCS7_ISSUER_AND_SERIAL_new);
        M_ASN1_New(ret->key_enc_algor,X509_ALGOR_new);
-        M_ASN1_New(ret->enc_key,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->enc_key,M_ASN1_OCTET_STRING_new);
        ret->cert=NULL;
        return(ret);
        M_ASN1_New_Error(ASN1_F_PKCS7_RECIP_INFO_NEW);
@@ -113,10 +113,10 @@ PKCS7_RECIP_INFO *PKCS7_RECIP_INFO_new(void)
 void PKCS7_RECIP_INFO_free(PKCS7_RECIP_INFO *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
        PKCS7_ISSUER_AND_SERIAL_free(a->issuer_and_serial);
        X509_ALGOR_free(a->key_enc_algor);
-        ASN1_OCTET_STRING_free(a->enc_key);
+        M_ASN1_OCTET_STRING_free(a->enc_key);
        if (a->cert != NULL) X509_free(a->cert);
        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/p7_s_e.c b/src/lib/libcrypto/asn1/p7_s_e.c
index 90946695c9..3d18fedf8e 100644
--- a/src/lib/libcrypto/asn1/p7_s_e.c
+++ b/src/lib/libcrypto/asn1/p7_s_e.c
@@ -119,7 +119,7 @@ PKCS7_SIGN_ENVELOPE *PKCS7_SIGN_ENVELOPE_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,PKCS7_SIGN_ENVELOPE);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
        M_ASN1_New(ret->recipientinfo,sk_PKCS7_RECIP_INFO_new_null);
        M_ASN1_New(ret->md_algs,sk_X509_ALGOR_new_null);
        M_ASN1_New(ret->enc_data,PKCS7_ENC_CONTENT_new);
@@ -133,7 +133,7 @@ PKCS7_SIGN_ENVELOPE *PKCS7_SIGN_ENVELOPE_new(void)
 void PKCS7_SIGN_ENVELOPE_free(PKCS7_SIGN_ENVELOPE *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
        sk_PKCS7_RECIP_INFO_pop_free(a->recipientinfo,PKCS7_RECIP_INFO_free);
        sk_X509_ALGOR_pop_free(a->md_algs,X509_ALGOR_free);
        PKCS7_ENC_CONTENT_free(a->enc_data);
diff --git a/src/lib/libcrypto/asn1/p7_signd.c b/src/lib/libcrypto/asn1/p7_signd.c
index 74f0f522e1..f6f16a8715 100644
--- a/src/lib/libcrypto/asn1/p7_signd.c
+++ b/src/lib/libcrypto/asn1/p7_signd.c
@@ -112,7 +112,7 @@ PKCS7_SIGNED *PKCS7_SIGNED_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,PKCS7_SIGNED);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
        M_ASN1_New(ret->md_algs,sk_X509_ALGOR_new_null);
        M_ASN1_New(ret->contents,PKCS7_new);
        ret->cert=NULL;
@@ -125,7 +125,7 @@ PKCS7_SIGNED *PKCS7_SIGNED_new(void)
 void PKCS7_SIGNED_free(PKCS7_SIGNED *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
        sk_X509_ALGOR_pop_free(a->md_algs,X509_ALGOR_free);
        PKCS7_free(a->contents);
        sk_X509_pop_free(a->cert,X509_free);
diff --git a/src/lib/libcrypto/asn1/p7_signi.c b/src/lib/libcrypto/asn1/p7_signi.c
index 21132ef4dd..f74658ffe6 100644
--- a/src/lib/libcrypto/asn1/p7_signi.c
+++ b/src/lib/libcrypto/asn1/p7_signi.c
@@ -119,12 +119,12 @@ PKCS7_SIGNER_INFO *PKCS7_SIGNER_INFO_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,PKCS7_SIGNER_INFO);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
        M_ASN1_New(ret->issuer_and_serial,PKCS7_ISSUER_AND_SERIAL_new);
        M_ASN1_New(ret->digest_alg,X509_ALGOR_new);
        ret->auth_attr=NULL;
        M_ASN1_New(ret->digest_enc_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->enc_digest,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->enc_digest,M_ASN1_OCTET_STRING_new);
        ret->unauth_attr=NULL;
        ret->pkey=NULL;
        return(ret);
@@ -134,16 +134,16 @@ PKCS7_SIGNER_INFO *PKCS7_SIGNER_INFO_new(void)
 void PKCS7_SIGNER_INFO_free(PKCS7_SIGNER_INFO *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
        PKCS7_ISSUER_AND_SERIAL_free(a->issuer_and_serial);
        X509_ALGOR_free(a->digest_alg);
        sk_X509_ATTRIBUTE_pop_free(a->auth_attr,X509_ATTRIBUTE_free);
        X509_ALGOR_free(a->digest_enc_alg);
-        ASN1_OCTET_STRING_free(a->enc_digest);
+        M_ASN1_OCTET_STRING_free(a->enc_digest);
        sk_X509_ATTRIBUTE_pop_free(a->unauth_attr,X509_ATTRIBUTE_free);
        if (a->pkey != NULL)
                EVP_PKEY_free(a->pkey);
-        Free((char *)a);
+        Free(a);
        }
 IMPLEMENT_STACK_OF(PKCS7_SIGNER_INFO)
diff --git a/src/lib/libcrypto/asn1/p8_key.c b/src/lib/libcrypto/asn1/p8_key.c
new file mode 100644
index 0000000000..0b24374627
--- /dev/null
+++ b/src/lib/libcrypto/asn1/p8_key.c
@@ -0,0 +1,131 @@
+/* crypto/asn1/p8_key.c */
+/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
+ * All rights reserved.
+ *
+ * This package is an SSL implementation written
+ * by Eric Young (eay@cryptsoft.com).
+ * The implementation was written so as to conform with Netscapes SSL.
+ * 
+ * This library is free for commercial and non-commercial use as long as
+ * the following conditions are aheared to.  The following conditions
+ * apply to all code found in this distribution, be it the RC4, RSA,
+ * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
+ * included with this distribution is covered by the same copyright terms
+ * except that the holder is Tim Hudson (tjh@cryptsoft.com).
+ * 
+ * Copyright remains Eric Young's, and as such any Copyright notices in
+ * the code are not to be removed.
+ * If this package is used in a product, Eric Young should be given attribution
+ * as the author of the parts of the library used.
+ * This can be in the form of a textual message at program startup or
+ * in documentation (online or textual) provided with the package.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *    "This product includes cryptographic software written by
+ *     Eric Young (eay@cryptsoft.com)"
+ *    The word 'cryptographic' can be left out if the rouines from the library
+ *    being used are not cryptographic related :-).
+ * 4. If you include any Windows specific code (or a derivative thereof) from 
+ *    the apps directory (application code) you must include an acknowledgement:
+ *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
+ * 
+ * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * 
+ * The licence and distribution terms for any publically available version or
+ * derivative of this code cannot be changed.  i.e. this code cannot simply be
+ * copied and put under another distribution licence
+ * [including the GNU Public Licence.]
+ */
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/asn1_mac.h>
+#include <openssl/objects.h>
+int i2d_X509_KEY(X509 *a, unsigned char **pp)
+        {
+        M_ASN1_I2D_vars(a);
+        M_ASN1_I2D_len(a->cert_info,    i2d_X509_CINF);
+        M_ASN1_I2D_len(a->sig_alg,      i2d_X509_ALGOR);
+        M_ASN1_I2D_len(a->signature,    i2d_ASN1_BIT_STRING);
+        M_ASN1_I2D_seq_total();
+        M_ASN1_I2D_put(a->cert_info,    i2d_X509_CINF);
+        M_ASN1_I2D_put(a->sig_alg,      i2d_X509_ALGOR);
+        M_ASN1_I2D_put(a->signature,    i2d_ASN1_BIT_STRING);
+        M_ASN1_I2D_finish();
+        }
+X509 *d2i_X509_KEY(X509 **a, unsigned char **pp, long length)
+        {
+        M_ASN1_D2I_vars(a,X509 *,X509_new);
+        M_ASN1_D2I_Init();
+        M_ASN1_D2I_start_sequence();
+        M_ASN1_D2I_get(ret->cert_info,d2i_X509_CINF);
+        M_ASN1_D2I_get(ret->sig_alg,d2i_X509_ALGOR);
+        M_ASN1_D2I_get(ret->signature,d2i_ASN1_BIT_STRING);
+        M_ASN1_D2I_Finish(a,X509_free,ASN1_F_D2I_X509);
+        }
+X509 *X509_KEY_new(void)
+        {
+        X509_KEY *ret=NULL;
+        M_ASN1_New_Malloc(ret,X509_KEY);
+        ret->references=1;
+        ret->type=NID
+        M_ASN1_New(ret->cert_info,X509_CINF_new);
+        M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
+        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        return(ret);
+        M_ASN1_New_Error(ASN1_F_X509_NEW);
+        }
+void X509_KEY_free(X509 *a)
+        {
+        int i;
+        if (a == NULL) return;
+        i=CRYPTO_add_lock(&a->references,-1,CRYPTO_LOCK_X509_KEY);
+#ifdef REF_PRINT
+        REF_PRINT("X509_KEY",a);
+#endif
+        if (i > 0) return;
+#ifdef REF_CHECK
+        if (i < 0)
+                {
+                fprintf(stderr,"X509_KEY_free, bad reference count\n");
+                abort();
+                }
+#endif
+        X509_CINF_free(a->cert_info);
+        X509_ALGOR_free(a->sig_alg);
+        ASN1_BIT_STRING_free(a->signature);
+        Free(a);
+        }
diff --git a/src/lib/libcrypto/asn1/p8_pkey.c b/src/lib/libcrypto/asn1/p8_pkey.c
index aa9a4f6c96..59cfbe7f28 100644
--- a/src/lib/libcrypto/asn1/p8_pkey.c
+++ b/src/lib/libcrypto/asn1/p8_pkey.c
@@ -88,7 +88,7 @@ PKCS8_PRIV_KEY_INFO *PKCS8_PRIV_KEY_INFO_new(void)
        PKCS8_PRIV_KEY_INFO *ret=NULL;
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret, PKCS8_PRIV_KEY_INFO);
-        M_ASN1_New (ret->version, ASN1_INTEGER_new);
+        M_ASN1_New (ret->version, M_ASN1_INTEGER_new);
        M_ASN1_New (ret->pkeyalg, X509_ALGOR_new);
        M_ASN1_New (ret->pkey, ASN1_TYPE_new);
        ret->attributes = NULL;
@@ -109,15 +109,13 @@ PKCS8_PRIV_KEY_INFO *d2i_PKCS8_PRIV_KEY_INFO(PKCS8_PRIV_KEY_INFO **a,
        M_ASN1_D2I_get_IMP_set_opt_type(X509_ATTRIBUTE, ret->attributes,
                                        d2i_X509_ATTRIBUTE,
                                        X509_ATTRIBUTE_free, 0);
-        if (ASN1_TYPE_get(ret->pkey) == V_ASN1_SEQUENCE) 
-                                                ret->broken = PKCS8_NO_OCTET;
        M_ASN1_D2I_Finish(a, PKCS8_PRIV_KEY_INFO_free, ASN1_F_D2I_PKCS8_PRIV_KEY_INFO);
 }
 void PKCS8_PRIV_KEY_INFO_free (PKCS8_PRIV_KEY_INFO *a)
 {
        if (a == NULL) return;
-        ASN1_INTEGER_free (a->version);
+        M_ASN1_INTEGER_free (a->version);
        X509_ALGOR_free(a->pkeyalg);
        /* Clear sensitive data */
        if (a->pkey->value.octet_string)
diff --git a/src/lib/libcrypto/asn1/pkcs8.c b/src/lib/libcrypto/asn1/pkcs8.c
index 29c4ea6a29..e69de29bb2 100644
--- a/src/lib/libcrypto/asn1/pkcs8.c
+++ b/src/lib/libcrypto/asn1/pkcs8.c
@@ -1,131 +0,0 @@
-/* crypto/asn1/pkcs8.c */
-/* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
- * All rights reserved.
- *
- * This package is an SSL implementation written
- * by Eric Young (eay@cryptsoft.com).
- * The implementation was written so as to conform with Netscapes SSL.
- * 
- * This library is free for commercial and non-commercial use as long as
- * the following conditions are aheared to.  The following conditions
- * apply to all code found in this distribution, be it the RC4, RSA,
- * lhash, DES, etc., code; not just the SSL code.  The SSL documentation
- * included with this distribution is covered by the same copyright terms
- * except that the holder is Tim Hudson (tjh@cryptsoft.com).
- * 
- * Copyright remains Eric Young's, and as such any Copyright notices in
- * the code are not to be removed.
- * If this package is used in a product, Eric Young should be given attribution
- * as the author of the parts of the library used.
- * This can be in the form of a textual message at program startup or
- * in documentation (online or textual) provided with the package.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *    "This product includes cryptographic software written by
- *     Eric Young (eay@cryptsoft.com)"
- *    The word 'cryptographic' can be left out if the rouines from the library
- *    being used are not cryptographic related :-).
- * 4. If you include any Windows specific code (or a derivative thereof) from 
- *    the apps directory (application code) you must include an acknowledgement:
- *    "This product includes software written by Tim Hudson (tjh@cryptsoft.com)"
- * 
- * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- * 
- * The licence and distribution terms for any publically available version or
- * derivative of this code cannot be changed.  i.e. this code cannot simply be
- * copied and put under another distribution licence
- * [including the GNU Public Licence.]
- */
-#include <stdio.h>
-#include "cryptlib.h"
-#include <openssl/asn1_mac.h>
-#include <openssl/objects.h>
-int i2d_X509_KEY(X509 *a, unsigned char **pp)
-        {
-        M_ASN1_I2D_vars(a);
-        M_ASN1_I2D_len(a->cert_info,    i2d_X509_CINF);
-        M_ASN1_I2D_len(a->sig_alg,      i2d_X509_ALGOR);
-        M_ASN1_I2D_len(a->signature,    i2d_ASN1_BIT_STRING);
-        M_ASN1_I2D_seq_total();
-        M_ASN1_I2D_put(a->cert_info,    i2d_X509_CINF);
-        M_ASN1_I2D_put(a->sig_alg,      i2d_X509_ALGOR);
-        M_ASN1_I2D_put(a->signature,    i2d_ASN1_BIT_STRING);
-        M_ASN1_I2D_finish();
-        }
-X509 *d2i_X509_KEY(X509 **a, unsigned char **pp, long length)
-        {
-        M_ASN1_D2I_vars(a,X509 *,X509_new);
-        M_ASN1_D2I_Init();
-        M_ASN1_D2I_start_sequence();
-        M_ASN1_D2I_get(ret->cert_info,d2i_X509_CINF);
-        M_ASN1_D2I_get(ret->sig_alg,d2i_X509_ALGOR);
-        M_ASN1_D2I_get(ret->signature,d2i_ASN1_BIT_STRING);
-        M_ASN1_D2I_Finish(a,X509_free,ASN1_F_D2I_X509);
-        }
-X509 *X509_KEY_new(void)
-        {
-        X509_KEY *ret=NULL;
-        M_ASN1_New_Malloc(ret,X509_KEY);
-        ret->references=1;
-        ret->type=NID
-        M_ASN1_New(ret->cert_info,X509_CINF_new);
-        M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
-        return(ret);
-        M_ASN1_New_Error(ASN1_F_X509_NEW);
-        }
-void X509_KEY_free(X509 *a)
-        {
-        int i;
-        if (a == NULL) return;
-        i=CRYPTO_add_lock(&a->references,-1,CRYPTO_LOCK_X509_KEY);
-#ifdef REF_PRINT
-        REF_PRINT("X509_KEY",a);
-#endif
-        if (i > 0) return;
-#ifdef REF_CHECK
-        if (i < 0)
-                {
-                fprintf(stderr,"X509_KEY_free, bad reference count\n");
-                abort();
-                }
-#endif
-        X509_CINF_free(a->cert_info);
-        X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
-        Free((char *)a);
-        }
diff --git a/src/lib/libcrypto/asn1/t_bitst.c b/src/lib/libcrypto/asn1/t_bitst.c
new file mode 100644
index 0000000000..8ee789f082
--- /dev/null
+++ b/src/lib/libcrypto/asn1/t_bitst.c
@@ -0,0 +1,99 @@
+/* t_bitst.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/conf.h>
+#include <openssl/x509v3.h>
+int ASN1_BIT_STRING_name_print(BIO *out, ASN1_BIT_STRING *bs,
+                                BIT_STRING_BITNAME *tbl, int indent)
+{
+        BIT_STRING_BITNAME *bnam;
+        char first = 1;
+        BIO_printf(out, "%*s", indent, "");
+        for(bnam = tbl; bnam->lname; bnam++) {
+                if(ASN1_BIT_STRING_get_bit(bs, bnam->bitnum)) {
+                        if(!first) BIO_puts(out, ", ");
+                        BIO_puts(out, bnam->lname);
+                        first = 0;
+                }
+        }
+        BIO_puts(out, "\n");
+        return 1;
+}
+int ASN1_BIT_STRING_set_asc(ASN1_BIT_STRING *bs, char *name, int value,
+                                BIT_STRING_BITNAME *tbl)
+{
+        int bitnum;
+        bitnum = ASN1_BIT_STRING_num_asc(name, tbl);
+        if(bitnum < 0) return 0;
+        if(bs) ASN1_BIT_STRING_set_bit(bs, bitnum, value);
+        return 1;
+}
+int ASN1_BIT_STRING_num_asc(char *name, BIT_STRING_BITNAME *tbl)
+{
+        BIT_STRING_BITNAME *bnam;
+        for(bnam = tbl; bnam->lname; bnam++) {
+                if(!strcmp(bnam->sname, name) ||
+                        !strcmp(bnam->lname, name) ) return bnam->bitnum;
+        }
+        return -1;
+}
diff --git a/src/lib/libcrypto/asn1/t_crl.c b/src/lib/libcrypto/asn1/t_crl.c
index c2e447ce6f..d78e4a8f88 100644
--- a/src/lib/libcrypto/asn1/t_crl.c
+++ b/src/lib/libcrypto/asn1/t_crl.c
@@ -160,7 +160,7 @@ static void ext_print(BIO *out, X509_EXTENSION *ex)
        BIO_printf(out, ": %s\n", j ? "critical":"","");
        if(!X509V3_EXT_print(out, ex, 0, 16)) {
                BIO_printf(out, "%16s", "");
-                ASN1_OCTET_STRING_print(out,ex->value);
+                M_ASN1_OCTET_STRING_print(out,ex->value);
        }
        BIO_write(out,"\n",1);
 }
diff --git a/src/lib/libcrypto/asn1/t_pkey.c b/src/lib/libcrypto/asn1/t_pkey.c
index 0dc6e30c3d..e570ed1c47 100644
--- a/src/lib/libcrypto/asn1/t_pkey.c
+++ b/src/lib/libcrypto/asn1/t_pkey.c
@@ -133,7 +133,7 @@ int RSA_print(BIO *bp, RSA *x, int off)
        if (!print(bp,"coefficient:",x->iqmp,m,off)) goto err;
        ret=1;
 err:
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
        return(ret);
        }
 #endif /* NO_RSA */
@@ -204,7 +204,7 @@ int DSA_print(BIO *bp, DSA *x, int off)
        if ((x->g != NULL) && !print(bp,"G:   ",x->g,m,off)) goto err;
        ret=1;
 err:
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
        return(ret);
        }
 #endif /* !NO_DSA */
@@ -298,7 +298,7 @@ int DHparams_print(BIO *bp, DH *x)
        if (!print(bp,"generator:",x->g,m,4)) goto err;
        if (x->length != 0)
                {
-                if (BIO_printf(bp,"    recomented-private-length: %d bits\n",
+                if (BIO_printf(bp,"    recommended-private-length: %d bits\n",
                        (int)x->length) <= 0) goto err;
                }
        ret=1;
@@ -307,7 +307,7 @@ int DHparams_print(BIO *bp, DH *x)
 err:
                DHerr(DH_F_DHPARAMS_PRINT,reason);
                }
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
        return(ret);
        }
 #endif
@@ -352,7 +352,7 @@ int DSAparams_print(BIO *bp, DSA *x)
        if (!print(bp,"g:",x->g,m,4)) goto err;
        ret=1;
 err:
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
        DSAerr(DSA_F_DSAPARAMS_PRINT,reason);
        return(ret);
        }
diff --git a/src/lib/libcrypto/asn1/t_req.c b/src/lib/libcrypto/asn1/t_req.c
index bdd749436a..81dd6355a8 100644
--- a/src/lib/libcrypto/asn1/t_req.c
+++ b/src/lib/libcrypto/asn1/t_req.c
@@ -62,6 +62,7 @@
 #include <openssl/bn.h>
 #include <openssl/objects.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 #ifndef NO_FP_API
 int X509_REQ_print_fp(FILE *fp, X509_REQ *x)
@@ -90,6 +91,7 @@ int X509_REQ_print(BIO *bp, X509_REQ *x)
        X509_REQ_INFO *ri;
        EVP_PKEY *pkey;
        STACK_OF(X509_ATTRIBUTE) *sk;
+        STACK_OF(X509_EXTENSION) *exts;
        char str[128];
        ri=x->req_info;
@@ -161,6 +163,8 @@ int X509_REQ_print(BIO *bp, X509_REQ *x)
                        int j,type=0,count=1,ii=0;
                        a=sk_X509_ATTRIBUTE_value(sk,i);
+                        if(X509_REQ_extension_nid(OBJ_obj2nid(a->object)))
+                                                                continue;
                        sprintf(str,"%12s","");
                        if (BIO_puts(bp,str) <= 0) goto err;
                        if ((j=i2a_ASN1_OBJECT(bp,a->object)) > 0)
@@ -201,6 +205,29 @@ get_next:
                        }
                }
+        exts = X509_REQ_get_extensions(x);
+        if(exts) {
+                BIO_printf(bp,"%8sRequested Extensions:\n","");
+                for (i=0; i<sk_X509_EXTENSION_num(exts); i++) {
+                        ASN1_OBJECT *obj;
+                        X509_EXTENSION *ex;
+                        int j;
+                        ex=sk_X509_EXTENSION_value(exts, i);
+                        if (BIO_printf(bp,"%12s","") <= 0) goto err;
+                        obj=X509_EXTENSION_get_object(ex);
+                        i2a_ASN1_OBJECT(bp,obj);
+                        j=X509_EXTENSION_get_critical(ex);
+                        if (BIO_printf(bp,": %s\n",j?"critical":"","") <= 0)
+                                goto err;
+                        if(!X509V3_EXT_print(bp, ex, 0, 16)) {
+                                BIO_printf(bp, "%16s", "");
+                                M_ASN1_OCTET_STRING_print(bp,ex->value);
+                        }
+                        if (BIO_write(bp,"\n",1) <= 0) goto err;
+                }
+                sk_X509_EXTENSION_pop_free(exts, X509_EXTENSION_free);
+        }
        i=OBJ_obj2nid(x->sig_alg->algorithm);
        sprintf(str,"%4sSignature Algorithm: %s","",
                (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
diff --git a/src/lib/libcrypto/asn1/t_spki.c b/src/lib/libcrypto/asn1/t_spki.c
new file mode 100644
index 0000000000..d708434fca
--- /dev/null
+++ b/src/lib/libcrypto/asn1/t_spki.c
@@ -0,0 +1,116 @@
+/* t_spki.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/x509.h>
+#include <openssl/asn1_mac.h>
+/* Print out an SPKI */
+int NETSCAPE_SPKI_print(BIO *out, NETSCAPE_SPKI *spki)
+{
+        EVP_PKEY *pkey;
+        ASN1_IA5STRING *chal;
+        int i, n;
+        char *s;
+        BIO_printf(out, "Netscape SPKI:\n");
+        i=OBJ_obj2nid(spki->spkac->pubkey->algor->algorithm);
+        BIO_printf(out,"  Public Key Algorithm: %s\n",
+                                (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
+        pkey = X509_PUBKEY_get(spki->spkac->pubkey);
+        if(!pkey) BIO_printf(out, "  Unable to load public key\n");
+        else {
+#ifndef NO_RSA
+                if (pkey->type == EVP_PKEY_RSA)
+                        {
+                        BIO_printf(out,"  RSA Public Key: (%d bit)\n",
+                                BN_num_bits(pkey->pkey.rsa->n));
+                        RSA_print(out,pkey->pkey.rsa,2);
+                        }
+                else 
+#endif
+#ifndef NO_DSA
+                if (pkey->type == EVP_PKEY_DSA)
+                {
+                BIO_printf(out,"  DSA Public Key:\n");
+                DSA_print(out,pkey->pkey.dsa,2);
+                }
+                else
+#endif
+                        BIO_printf(out,"  Unknown Public Key:\n");
+                EVP_PKEY_free(pkey);
+        }
+        chal = spki->spkac->challenge;
+        if(chal->length)
+                BIO_printf(out, "  Challenge String: %s\n", chal->data);
+        i=OBJ_obj2nid(spki->sig_algor->algorithm);
+        BIO_printf(out,"  Signature Algorithm: %s",
+                                (i == NID_undef)?"UNKNOWN":OBJ_nid2ln(i));
+        n=spki->signature->length;
+        s=(char *)spki->signature->data;
+        for (i=0; i<n; i++)
+                {
+                if ((i%18) == 0) BIO_write(out,"\n      ",7);
+                BIO_printf(out,"%02x%s",(unsigned char)s[i],
+                                                ((i+1) == n)?"":":");
+                }
+        BIO_write(out,"\n",1);
+        return 1;
+}
diff --git a/src/lib/libcrypto/asn1/t_x509.c b/src/lib/libcrypto/asn1/t_x509.c
index 42f4d498cf..6ee1065ce9 100644
--- a/src/lib/libcrypto/asn1/t_x509.c
+++ b/src/lib/libcrypto/asn1/t_x509.c
@@ -188,11 +188,7 @@ int X509_print(BIO *bp, X509 *x)
                BIO_printf(bp,"%8sX509v3 extensions:\n","");
                for (i=0; i<n; i++)
                        {
-#if 0
-                        int data_type,pack_type;
-#endif
                        ASN1_OBJECT *obj;
                        ex=X509_get_ext(x,i);
                        if (BIO_printf(bp,"%12s","") <= 0) goto err;
                        obj=X509_EXTENSION_get_object(ex);
@@ -203,7 +199,7 @@ int X509_print(BIO *bp, X509 *x)
                        if(!X509V3_EXT_print(bp, ex, 0, 16))
                                {
                                BIO_printf(bp, "%16s", "");
-                                ASN1_OCTET_STRING_print(bp,ex->value);
+                                M_ASN1_OCTET_STRING_print(bp,ex->value);
                                }
                        if (BIO_write(bp,"\n",1) <= 0) goto err;
                        }
@@ -223,10 +219,11 @@ int X509_print(BIO *bp, X509 *x)
                        ((i+1) == n)?"":":") <= 0) goto err;
                }
        if (BIO_write(bp,"\n",1) != 1) goto err;
+        if (!X509_CERT_AUX_print(bp, x->aux, 0)) goto err;
        ret=1;
 err:
        if (str != NULL) ASN1_STRING_free(str);
-        if (m != NULL) Free((char *)m);
+        if (m != NULL) Free(m);
        return(ret);
        }
diff --git a/src/lib/libcrypto/asn1/t_x509a.c b/src/lib/libcrypto/asn1/t_x509a.c
new file mode 100644
index 0000000000..a18ebb586c
--- /dev/null
+++ b/src/lib/libcrypto/asn1/t_x509a.c
@@ -0,0 +1,102 @@
+/* t_x509a.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/asn1_mac.h>
+#include <openssl/x509.h>
+/* X509_CERT_AUX and string set routines
+ */
+int X509_CERT_AUX_print(BIO *out, X509_CERT_AUX *aux, int indent)
+{
+        char oidstr[80], first;
+        int i;
+        if(!aux) return 1;
+        if(aux->trust) {
+                first = 1;
+                BIO_printf(out, "%*sTrusted Uses:\n%*s",
+                                                indent, "", indent + 2, "");
+                for(i = 0; i < sk_ASN1_OBJECT_num(aux->trust); i++) {
+                        if(!first) BIO_puts(out, ", ");
+                        else first = 0;
+                        OBJ_obj2txt(oidstr, 80,
+                                sk_ASN1_OBJECT_value(aux->trust, i), 0);
+                        BIO_puts(out, oidstr);
+                }
+                BIO_puts(out, "\n");
+        } else BIO_printf(out, "%*sNo Trusted Uses.\n", indent, "");
+        if(aux->reject) {
+                first = 1;
+                BIO_printf(out, "%*sRejected Uses:\n%*s",
+                                                indent, "", indent + 2, "");
+                for(i = 0; i < sk_ASN1_OBJECT_num(aux->reject); i++) {
+                        if(!first) BIO_puts(out, ", ");
+                        else first = 0;
+                        OBJ_obj2txt(oidstr, 80,
+                                sk_ASN1_OBJECT_value(aux->reject, i), 0);
+                        BIO_puts(out, oidstr);
+                }
+                BIO_puts(out, "\n");
+        } else BIO_printf(out, "%*sNo Rejected Uses.\n", indent, "");
+        if(aux->alias) BIO_printf(out, "%*sAlias: %s\n", indent, "",
+                                                        aux->alias->data);
+        return 1;
+}
diff --git a/src/lib/libcrypto/asn1/x_algor.c b/src/lib/libcrypto/asn1/x_algor.c
index b2c20d139f..fe023842f8 100644
--- a/src/lib/libcrypto/asn1/x_algor.c
+++ b/src/lib/libcrypto/asn1/x_algor.c
@@ -111,7 +111,7 @@ void X509_ALGOR_free(X509_ALGOR *a)
        if (a == NULL) return;
        ASN1_OBJECT_free(a->algorithm);
        ASN1_TYPE_free(a->parameter);
-        Free((char *)a);
+        Free(a);
        }
 IMPLEMENT_STACK_OF(X509_ALGOR)
diff --git a/src/lib/libcrypto/asn1/x_attrib.c b/src/lib/libcrypto/asn1/x_attrib.c
index a1cbebf5a5..a874df79db 100644
--- a/src/lib/libcrypto/asn1/x_attrib.c
+++ b/src/lib/libcrypto/asn1/x_attrib.c
@@ -160,6 +160,6 @@ void X509_ATTRIBUTE_free(X509_ATTRIBUTE *a)
                sk_ASN1_TYPE_pop_free(a->value.set,ASN1_TYPE_free);
        else
                ASN1_TYPE_free(a->value.single);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/x_cinf.c b/src/lib/libcrypto/asn1/x_cinf.c
index fe1b18a90f..b87c8fff17 100644
--- a/src/lib/libcrypto/asn1/x_cinf.c
+++ b/src/lib/libcrypto/asn1/x_cinf.c
@@ -115,7 +115,7 @@ X509_CINF *d2i_X509_CINF(X509_CINF **a, unsigned char **pp, long length)
                {
                if (ret->version != NULL)
                        {
-                        ASN1_INTEGER_free(ret->version);
+                        M_ASN1_INTEGER_free(ret->version);
                        ret->version=NULL;
                        }
                }
@@ -129,12 +129,12 @@ X509_CINF *d2i_X509_CINF(X509_CINF **a, unsigned char **pp, long length)
                {
                if (ret->issuerUID != NULL)
                        {
-                        ASN1_BIT_STRING_free(ret->issuerUID);
+                        M_ASN1_BIT_STRING_free(ret->issuerUID);
                        ret->issuerUID=NULL;
                        }
                if (ret->subjectUID != NULL)
                        {
-                        ASN1_BIT_STRING_free(ret->subjectUID);
+                        M_ASN1_BIT_STRING_free(ret->subjectUID);
                        ret->subjectUID=NULL;
                        }
                M_ASN1_D2I_get_IMP_opt(ret->issuerUID,d2i_ASN1_BIT_STRING,  1,
@@ -170,7 +170,7 @@ X509_CINF *X509_CINF_new(void)
        M_ASN1_New_Malloc(ret,X509_CINF);
        ret->version=NULL;
-        M_ASN1_New(ret->serialNumber,ASN1_INTEGER_new);
+        M_ASN1_New(ret->serialNumber,M_ASN1_INTEGER_new);
        M_ASN1_New(ret->signature,X509_ALGOR_new);
        M_ASN1_New(ret->issuer,X509_NAME_new);
        M_ASN1_New(ret->validity,X509_VAL_new);
@@ -186,15 +186,15 @@ X509_CINF *X509_CINF_new(void)
 void X509_CINF_free(X509_CINF *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
-        ASN1_INTEGER_free(a->serialNumber);
+        M_ASN1_INTEGER_free(a->serialNumber);
        X509_ALGOR_free(a->signature);
        X509_NAME_free(a->issuer);
        X509_VAL_free(a->validity);
        X509_NAME_free(a->subject);
        X509_PUBKEY_free(a->key);
-        ASN1_BIT_STRING_free(a->issuerUID);
+        M_ASN1_BIT_STRING_free(a->issuerUID);
-        ASN1_BIT_STRING_free(a->subjectUID);
+        M_ASN1_BIT_STRING_free(a->subjectUID);
        sk_X509_EXTENSION_pop_free(a->extensions,X509_EXTENSION_free);
        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/x_crl.c b/src/lib/libcrypto/asn1/x_crl.c
index cd46bbebc2..12a42d04c7 100644
--- a/src/lib/libcrypto/asn1/x_crl.c
+++ b/src/lib/libcrypto/asn1/x_crl.c
@@ -130,9 +130,9 @@ int i2d_X509_CRL_INFO(X509_CRL_INFO *a, unsigned char **pp)
                }
        M_ASN1_I2D_put(a->sig_alg,i2d_X509_ALGOR);
        M_ASN1_I2D_put(a->issuer,i2d_X509_NAME);
-        M_ASN1_I2D_put(a->lastUpdate,i2d_ASN1_UTCTIME);
+        M_ASN1_I2D_put(a->lastUpdate,i2d_ASN1_TIME);
        if (a->nextUpdate != NULL)
-                { M_ASN1_I2D_put(a->nextUpdate,i2d_ASN1_UTCTIME); }
+                { M_ASN1_I2D_put(a->nextUpdate,i2d_ASN1_TIME); }
        M_ASN1_I2D_put_SEQUENCE_opt_type(X509_REVOKED,a->revoked,
                                         i2d_X509_REVOKED);
        M_ASN1_I2D_put_EXP_SEQUENCE_opt_type(X509_EXTENSION,a->extensions,
@@ -157,20 +157,16 @@ X509_CRL_INFO *d2i_X509_CRL_INFO(X509_CRL_INFO **a, unsigned char **pp,
        
        if ((ver == 0) && (ret->version != NULL))
                {
-                ASN1_INTEGER_free(ret->version);
+                M_ASN1_INTEGER_free(ret->version);
                ret->version=NULL;
                }
        M_ASN1_D2I_get(ret->sig_alg,d2i_X509_ALGOR);
        M_ASN1_D2I_get(ret->issuer,d2i_X509_NAME);
        M_ASN1_D2I_get(ret->lastUpdate,d2i_ASN1_TIME);
        /* Manually handle the OPTIONAL ASN1_TIME stuff */
-        if(c.slen != 0
+        /* First try UTCTime */
-           && ( (M_ASN1_next & ~V_ASN1_CONSTRUCTED) ==
+        M_ASN1_D2I_get_opt(ret->nextUpdate,d2i_ASN1_UTCTIME, V_ASN1_UTCTIME);
-                    (V_ASN1_UNIVERSAL|V_ASN1_UTCTIME)
+        /* If that doesn't work try GeneralizedTime */
-                || (M_ASN1_next & ~V_ASN1_CONSTRUCTED) ==
-                    (V_ASN1_UNIVERSAL|V_ASN1_GENERALIZEDTIME) ) ) {
-                M_ASN1_D2I_get(ret->nextUpdate,d2i_ASN1_TIME);
-        }
        if(!ret->nextUpdate) 
                M_ASN1_D2I_get_opt(ret->nextUpdate,d2i_ASN1_GENERALIZEDTIME,
                                                        V_ASN1_GENERALIZEDTIME);
@@ -190,20 +186,17 @@ X509_CRL_INFO *d2i_X509_CRL_INFO(X509_CRL_INFO **a, unsigned char **pp,
                        }
                }
-        if (ver >= 1)
+        if (ret->extensions != NULL)
                {
-                if (ret->extensions != NULL)
+                while (sk_X509_EXTENSION_num(ret->extensions))
-                        {
+                        X509_EXTENSION_free(
-                        while (sk_X509_EXTENSION_num(ret->extensions))
+                        sk_X509_EXTENSION_pop(ret->extensions));
-                                X509_EXTENSION_free(
-                                sk_X509_EXTENSION_pop(ret->extensions));
-                        }
-                        
-                M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION,ret->extensions,
-                                                d2i_X509_EXTENSION,
-                                                X509_EXTENSION_free,0,
-                                                V_ASN1_SEQUENCE);
                }
+                
+        M_ASN1_D2I_get_EXP_set_opt_type(X509_EXTENSION,ret->extensions,
+                                        d2i_X509_EXTENSION,
+                                        X509_EXTENSION_free,0,
+                                        V_ASN1_SEQUENCE);
        M_ASN1_D2I_Finish(a,X509_CRL_INFO_free,ASN1_F_D2I_X509_CRL_INFO);
        }
@@ -245,8 +238,8 @@ X509_REVOKED *X509_REVOKED_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,X509_REVOKED);
-        M_ASN1_New(ret->serialNumber,ASN1_INTEGER_new);
+        M_ASN1_New(ret->serialNumber,M_ASN1_INTEGER_new);
-        M_ASN1_New(ret->revocationDate,ASN1_UTCTIME_new);
+        M_ASN1_New(ret->revocationDate,M_ASN1_UTCTIME_new);
        ret->extensions=NULL;
        return(ret);
        M_ASN1_New_Error(ASN1_F_X509_REVOKED_NEW);
@@ -261,7 +254,7 @@ X509_CRL_INFO *X509_CRL_INFO_new(void)
        ret->version=NULL;
        M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
        M_ASN1_New(ret->issuer,X509_NAME_new);
-        M_ASN1_New(ret->lastUpdate,ASN1_UTCTIME_new);
+        M_ASN1_New(ret->lastUpdate,M_ASN1_UTCTIME_new);
        ret->nextUpdate=NULL;
        M_ASN1_New(ret->revoked,sk_X509_REVOKED_new_null);
        M_ASN1_New(ret->extensions,sk_X509_EXTENSION_new_null);
@@ -279,7 +272,7 @@ X509_CRL *X509_CRL_new(void)
        ret->references=1;
        M_ASN1_New(ret->crl,X509_CRL_INFO_new);
        M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
        return(ret);
        M_ASN1_New_Error(ASN1_F_X509_CRL_NEW);
        }
@@ -287,8 +280,8 @@ X509_CRL *X509_CRL_new(void)
 void X509_REVOKED_free(X509_REVOKED *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->serialNumber);
+        M_ASN1_INTEGER_free(a->serialNumber);
-        ASN1_UTCTIME_free(a->revocationDate);
+        M_ASN1_UTCTIME_free(a->revocationDate);
        sk_X509_EXTENSION_pop_free(a->extensions,X509_EXTENSION_free);
        Free(a);
        }
@@ -296,12 +289,12 @@ void X509_REVOKED_free(X509_REVOKED *a)
 void X509_CRL_INFO_free(X509_CRL_INFO *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
        X509_ALGOR_free(a->sig_alg);
        X509_NAME_free(a->issuer);
-        ASN1_UTCTIME_free(a->lastUpdate);
+        M_ASN1_UTCTIME_free(a->lastUpdate);
        if (a->nextUpdate)
-                ASN1_UTCTIME_free(a->nextUpdate);
+                M_ASN1_UTCTIME_free(a->nextUpdate);
        sk_X509_REVOKED_pop_free(a->revoked,X509_REVOKED_free);
        sk_X509_EXTENSION_pop_free(a->extensions,X509_EXTENSION_free);
        Free(a);
@@ -328,7 +321,7 @@ void X509_CRL_free(X509_CRL *a)
        X509_CRL_INFO_free(a->crl);
        X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
+        M_ASN1_BIT_STRING_free(a->signature);
        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/x_exten.c b/src/lib/libcrypto/asn1/x_exten.c
index d5f9e1df9e..185cbd78a0 100644
--- a/src/lib/libcrypto/asn1/x_exten.c
+++ b/src/lib/libcrypto/asn1/x_exten.c
@@ -100,10 +100,6 @@ X509_EXTENSION *d2i_X509_EXTENSION(X509_EXTENSION **a, unsigned char **pp,
        M_ASN1_D2I_start_sequence();
        M_ASN1_D2I_get(ret->object,d2i_ASN1_OBJECT);
-        if ((ret->argp != NULL) && (ret->ex_free != NULL))
-                ret->ex_free(ret);
-        ret->argl=0;
-        ret->argp=NULL;
        ret->netscape_hack=0;
        if ((c.slen != 0) &&
                (M_ASN1_next == (V_ASN1_UNIVERSAL|V_ASN1_BOOLEAN)))
@@ -126,12 +122,9 @@ X509_EXTENSION *X509_EXTENSION_new(void)
        M_ASN1_New_Malloc(ret,X509_EXTENSION);
        ret->object=OBJ_nid2obj(NID_undef);
-        M_ASN1_New(ret->value,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->value,M_ASN1_OCTET_STRING_new);
        ret->critical=0;
        ret->netscape_hack=0;
-        ret->argl=0L;
-        ret->argp=NULL;
-        ret->ex_free=NULL;
        return(ret);
        M_ASN1_New_Error(ASN1_F_X509_EXTENSION_NEW);
        }
@@ -139,10 +132,8 @@ X509_EXTENSION *X509_EXTENSION_new(void)
 void X509_EXTENSION_free(X509_EXTENSION *a)
        {
        if (a == NULL) return;
-        if ((a->argp != NULL) && (a->ex_free != NULL))
-                a->ex_free(a);
        ASN1_OBJECT_free(a->object);
-        ASN1_OCTET_STRING_free(a->value);
+        M_ASN1_OCTET_STRING_free(a->value);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/x_info.c b/src/lib/libcrypto/asn1/x_info.c
index 99ce011f07..7fdc6f9dc8 100644
--- a/src/lib/libcrypto/asn1/x_info.c
+++ b/src/lib/libcrypto/asn1/x_info.c
@@ -106,7 +106,8 @@ void X509_INFO_free(X509_INFO *x)
        if (x->x509 != NULL) X509_free(x->x509);
        if (x->crl != NULL) X509_CRL_free(x->crl);
        if (x->x_pkey != NULL) X509_PKEY_free(x->x_pkey);
-        Free((char *)x);
+        if (x->enc_data != NULL) Free(x->enc_data);
+        Free(x);
        }
 IMPLEMENT_STACK_OF(X509_INFO)
diff --git a/src/lib/libcrypto/asn1/x_name.c b/src/lib/libcrypto/asn1/x_name.c
index b09fba33fb..64baf5719d 100644
--- a/src/lib/libcrypto/asn1/x_name.c
+++ b/src/lib/libcrypto/asn1/x_name.c
@@ -253,7 +253,7 @@ void X509_NAME_ENTRY_free(X509_NAME_ENTRY *a)
        {
        if (a == NULL) return;
        ASN1_OBJECT_free(a->object);
-        ASN1_BIT_STRING_free(a->value);
+        M_ASN1_BIT_STRING_free(a->value);
        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/x_pkey.c b/src/lib/libcrypto/asn1/x_pkey.c
index b0057eb212..fe58919dbb 100644
--- a/src/lib/libcrypto/asn1/x_pkey.c
+++ b/src/lib/libcrypto/asn1/x_pkey.c
@@ -112,7 +112,7 @@ X509_PKEY *X509_PKEY_new(void)
        M_ASN1_New_Malloc(ret,X509_PKEY);
        ret->version=0;
        M_ASN1_New(ret->enc_algor,X509_ALGOR_new);
-        M_ASN1_New(ret->enc_pkey,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->enc_pkey,M_ASN1_OCTET_STRING_new);
        ret->dec_pkey=NULL;
        ret->key_length=0;
        ret->key_data=NULL;
@@ -144,8 +144,8 @@ void X509_PKEY_free(X509_PKEY *x)
 #endif
        if (x->enc_algor != NULL) X509_ALGOR_free(x->enc_algor);
-        if (x->enc_pkey != NULL) ASN1_OCTET_STRING_free(x->enc_pkey);
+        if (x->enc_pkey != NULL) M_ASN1_OCTET_STRING_free(x->enc_pkey);
        if (x->dec_pkey != NULL)EVP_PKEY_free(x->dec_pkey);
-        if ((x->key_data != NULL) && (x->key_free)) Free((char *)x->key_data);
+        if ((x->key_data != NULL) && (x->key_free)) Free(x->key_data);
-        Free((char *)(char *)x);
+        Free(x);
        }
diff --git a/src/lib/libcrypto/asn1/x_pubkey.c b/src/lib/libcrypto/asn1/x_pubkey.c
index 4ac32c59dd..81e9815222 100644
--- a/src/lib/libcrypto/asn1/x_pubkey.c
+++ b/src/lib/libcrypto/asn1/x_pubkey.c
@@ -100,7 +100,7 @@ X509_PUBKEY *X509_PUBKEY_new(void)
        M_ASN1_New_Malloc(ret,X509_PUBKEY);
        M_ASN1_New(ret->algor,X509_ALGOR_new);
-        M_ASN1_New(ret->public_key,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->public_key,M_ASN1_BIT_STRING_new);
        ret->pkey=NULL;
        return(ret);
        M_ASN1_New_Error(ASN1_F_X509_PUBKEY_NEW);
@@ -110,9 +110,9 @@ void X509_PUBKEY_free(X509_PUBKEY *a)
        {
        if (a == NULL) return;
        X509_ALGOR_free(a->algor);
-        ASN1_BIT_STRING_free(a->public_key);
+        M_ASN1_BIT_STRING_free(a->public_key);
        if (a->pkey != NULL) EVP_PKEY_free(a->pkey);
-        Free((char *)a);
+        Free(a);
        }
 int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
@@ -176,7 +176,7 @@ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey)
        if ((s=(unsigned char *)Malloc(i+1)) == NULL) goto err;
        p=s;
        i2d_PublicKey(pkey,&p);
-        if (!ASN1_BIT_STRING_set(pk->public_key,s,i)) goto err;
+        if (!M_ASN1_BIT_STRING_set(pk->public_key,s,i)) goto err;
        /* Set number of unused bits to zero */
        pk->public_key->flags&= ~(ASN1_STRING_FLAG_BITS_LEFT|0x07);
        pk->public_key->flags|=ASN1_STRING_FLAG_BITS_LEFT;
@@ -252,3 +252,113 @@ err:
        return(NULL);
        }
+/* Now two pseudo ASN1 routines that take an EVP_PKEY structure
+ * and encode or decode as X509_PUBKEY
+ */
+EVP_PKEY *d2i_PUBKEY(EVP_PKEY **a, unsigned char **pp,
+             long length)
+{
+        X509_PUBKEY *xpk;
+        EVP_PKEY *pktmp;
+        xpk = d2i_X509_PUBKEY(NULL, pp, length);
+        if(!xpk) return NULL;
+        pktmp = X509_PUBKEY_get(xpk);
+        X509_PUBKEY_free(xpk);
+        if(!pktmp) return NULL;
+        if(a) {
+                EVP_PKEY_free(*a);
+                *a = pktmp;
+        }
+        return pktmp;
+}
+int i2d_PUBKEY(EVP_PKEY *a, unsigned char **pp)
+{
+        X509_PUBKEY *xpk=NULL;
+        int ret;
+        if(!a) return 0;
+        if(!X509_PUBKEY_set(&xpk, a)) return 0;
+        ret = i2d_X509_PUBKEY(xpk, pp);
+        X509_PUBKEY_free(xpk);
+        return ret;
+}
+/* The following are equivalents but which return RSA and DSA
+ * keys
+ */
+#ifndef NO_RSA
+RSA *d2i_RSA_PUBKEY(RSA **a, unsigned char **pp,
+             long length)
+{
+        EVP_PKEY *pkey;
+        RSA *key;
+        unsigned char *q;
+        q = *pp;
+        pkey = d2i_PUBKEY(NULL, &q, length);
+        if(!pkey) return NULL;
+        key = EVP_PKEY_get1_RSA(pkey);
+        EVP_PKEY_free(pkey);
+        if(!key) return NULL;
+        *pp = q;
+        if(a) {
+                RSA_free(*a);
+                *a = key;
+        }
+        return key;
+}
+int i2d_RSA_PUBKEY(RSA *a, unsigned char **pp)
+{
+        EVP_PKEY *pktmp;
+        int ret;
+        if(!a) return 0;
+        pktmp = EVP_PKEY_new();
+        if(!pktmp) {
+                ASN1err(ASN1_F_I2D_RSA_PUBKEY, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        EVP_PKEY_set1_RSA(pktmp, a);
+        ret = i2d_PUBKEY(pktmp, pp);
+        EVP_PKEY_free(pktmp);
+        return ret;
+}
+#endif
+#ifndef NO_DSA
+DSA *d2i_DSA_PUBKEY(DSA **a, unsigned char **pp,
+             long length)
+{
+        EVP_PKEY *pkey;
+        DSA *key;
+        unsigned char *q;
+        q = *pp;
+        pkey = d2i_PUBKEY(NULL, &q, length);
+        if(!pkey) return NULL;
+        key = EVP_PKEY_get1_DSA(pkey);
+        EVP_PKEY_free(pkey);
+        if(!key) return NULL;
+        *pp = q;
+        if(a) {
+                DSA_free(*a);
+                *a = key;
+        }
+        return key;
+}
+int i2d_DSA_PUBKEY(DSA *a, unsigned char **pp)
+{
+        EVP_PKEY *pktmp;
+        int ret;
+        if(!a) return 0;
+        pktmp = EVP_PKEY_new();
+        if(!pktmp) {
+                ASN1err(ASN1_F_I2D_DSA_PUBKEY, ERR_R_MALLOC_FAILURE);
+                return 0;
+        }
+        EVP_PKEY_set1_DSA(pktmp, a);
+        ret = i2d_PUBKEY(pktmp, pp);
+        EVP_PKEY_free(pktmp);
+        return ret;
+}
+#endif
diff --git a/src/lib/libcrypto/asn1/x_req.c b/src/lib/libcrypto/asn1/x_req.c
index 9b1d6abe64..0cd572ee73 100644
--- a/src/lib/libcrypto/asn1/x_req.c
+++ b/src/lib/libcrypto/asn1/x_req.c
@@ -73,7 +73,7 @@ int i2d_X509_REQ_INFO(X509_REQ_INFO *a, unsigned char **pp)
         * allow some CA Software to accept the cert request.
         * It is not following the PKCS standards ...
         * PKCS#10 pg 5
-         * attributes [0] IMPLICIT Attibutes
+         * attributes [0] IMPLICIT Attributes
         * NOTE: no OPTIONAL ... so it *must* be there
         */
        if (a->req_kludge) 
@@ -94,7 +94,7 @@ int i2d_X509_REQ_INFO(X509_REQ_INFO *a, unsigned char **pp)
        /* this is a *nasty* hack reported to be required by some CA's.
         * It is not following the PKCS standards ...
         * PKCS#10 pg 5
-         * attributes [0] IMPLICIT Attibutes
+         * attributes [0] IMPLICIT Attributes
         * NOTE: no OPTIONAL ... so it *must* be there
         */
        if (a->req_kludge)
@@ -126,7 +126,7 @@ X509_REQ_INFO *d2i_X509_REQ_INFO(X509_REQ_INFO **a, unsigned char **pp,
         * have been reported as requiring it.
         * It is not following the PKCS standards ...
         * PKCS#10 pg 5
-         * attributes [0] IMPLICIT Attibutes
+         * attributes [0] IMPLICIT Attributes
         * NOTE: no OPTIONAL ... so it *must* be there
         */
        if (asn1_Finish(&c))
@@ -147,7 +147,7 @@ X509_REQ_INFO *X509_REQ_INFO_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,X509_REQ_INFO);
-        M_ASN1_New(ret->version,ASN1_INTEGER_new);
+        M_ASN1_New(ret->version,M_ASN1_INTEGER_new);
        M_ASN1_New(ret->subject,X509_NAME_new);
        M_ASN1_New(ret->pubkey,X509_PUBKEY_new);
        M_ASN1_New(ret->attributes,sk_X509_ATTRIBUTE_new_null);
@@ -159,11 +159,11 @@ X509_REQ_INFO *X509_REQ_INFO_new(void)
 void X509_REQ_INFO_free(X509_REQ_INFO *a)
        {
        if (a == NULL) return;
-        ASN1_INTEGER_free(a->version);
+        M_ASN1_INTEGER_free(a->version);
        X509_NAME_free(a->subject);
        X509_PUBKEY_free(a->pubkey);
        sk_X509_ATTRIBUTE_pop_free(a->attributes,X509_ATTRIBUTE_free);
-        Free((char *)a);
+        Free(a);
        }
 int i2d_X509_REQ(X509_REQ *a, unsigned char **pp)
@@ -203,7 +203,7 @@ X509_REQ *X509_REQ_new(void)
        ret->references=1;
        M_ASN1_New(ret->req_info,X509_REQ_INFO_new);
        M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
        return(ret);
        M_ASN1_New_Error(ASN1_F_X509_REQ_NEW);
        }
@@ -229,8 +229,8 @@ void X509_REQ_free(X509_REQ *a)
        X509_REQ_INFO_free(a->req_info);
        X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
+        M_ASN1_BIT_STRING_free(a->signature);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/x_sig.c b/src/lib/libcrypto/asn1/x_sig.c
index c2782d1b9c..3559bd5368 100644
--- a/src/lib/libcrypto/asn1/x_sig.c
+++ b/src/lib/libcrypto/asn1/x_sig.c
@@ -94,7 +94,7 @@ X509_SIG *X509_SIG_new(void)
        M_ASN1_New_Malloc(ret,X509_SIG);
        M_ASN1_New(ret->algor,X509_ALGOR_new);
-        M_ASN1_New(ret->digest,ASN1_OCTET_STRING_new);
+        M_ASN1_New(ret->digest,M_ASN1_OCTET_STRING_new);
        return(ret);
        M_ASN1_New_Error(ASN1_F_X509_SIG_NEW);
        }
@@ -103,8 +103,8 @@ void X509_SIG_free(X509_SIG *a)
        {
        if (a == NULL) return;
        X509_ALGOR_free(a->algor);
-        ASN1_OCTET_STRING_free(a->digest);
+        M_ASN1_OCTET_STRING_free(a->digest);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/x_spki.c b/src/lib/libcrypto/asn1/x_spki.c
index 43e0023839..8f5e7e6380 100644
--- a/src/lib/libcrypto/asn1/x_spki.c
+++ b/src/lib/libcrypto/asn1/x_spki.c
@@ -57,7 +57,7 @@
 */
 /* This module was send to me my Pat Richards <patr@x509.com> who
-  * wrote it.  It is under my Copyright with his permision
+  * wrote it.  It is under my Copyright with his permission
  */
 #include <stdio.h>
@@ -99,7 +99,7 @@ NETSCAPE_SPKAC *NETSCAPE_SPKAC_new(void)
        M_ASN1_New_Malloc(ret,NETSCAPE_SPKAC);
        M_ASN1_New(ret->pubkey,X509_PUBKEY_new);
-        M_ASN1_New(ret->challenge,ASN1_IA5STRING_new);
+        M_ASN1_New(ret->challenge,M_ASN1_IA5STRING_new);
        return(ret);
        M_ASN1_New_Error(ASN1_F_NETSCAPE_SPKAC_NEW);
        }
@@ -108,8 +108,8 @@ void NETSCAPE_SPKAC_free(NETSCAPE_SPKAC *a)
        {
        if (a == NULL) return;
        X509_PUBKEY_free(a->pubkey);
-        ASN1_IA5STRING_free(a->challenge);
+        M_ASN1_IA5STRING_free(a->challenge);
-        Free((char *)a);
+        Free(a);
        }
 int i2d_NETSCAPE_SPKI(NETSCAPE_SPKI *a, unsigned char **pp)
@@ -150,7 +150,7 @@ NETSCAPE_SPKI *NETSCAPE_SPKI_new(void)
        M_ASN1_New_Malloc(ret,NETSCAPE_SPKI);
        M_ASN1_New(ret->spkac,NETSCAPE_SPKAC_new);
        M_ASN1_New(ret->sig_algor,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
        return(ret);
        M_ASN1_New_Error(ASN1_F_NETSCAPE_SPKI_NEW);
        }
@@ -160,7 +160,7 @@ void NETSCAPE_SPKI_free(NETSCAPE_SPKI *a)
        if (a == NULL) return;
        NETSCAPE_SPKAC_free(a->spkac);
        X509_ALGOR_free(a->sig_algor);
-        ASN1_BIT_STRING_free(a->signature);
+        M_ASN1_BIT_STRING_free(a->signature);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/x_val.c b/src/lib/libcrypto/asn1/x_val.c
index 84d6f7ca4d..1a2f49ffdf 100644
--- a/src/lib/libcrypto/asn1/x_val.c
+++ b/src/lib/libcrypto/asn1/x_val.c
@@ -93,8 +93,8 @@ X509_VAL *X509_VAL_new(void)
        ASN1_CTX c;
        M_ASN1_New_Malloc(ret,X509_VAL);
-        M_ASN1_New(ret->notBefore,ASN1_TIME_new);
+        M_ASN1_New(ret->notBefore,M_ASN1_TIME_new);
-        M_ASN1_New(ret->notAfter,ASN1_TIME_new);
+        M_ASN1_New(ret->notAfter,M_ASN1_TIME_new);
        return(ret);
        M_ASN1_New_Error(ASN1_F_X509_VAL_NEW);
        }
@@ -102,8 +102,8 @@ X509_VAL *X509_VAL_new(void)
 void X509_VAL_free(X509_VAL *a)
        {
        if (a == NULL) return;
-        ASN1_TIME_free(a->notBefore);
+        M_ASN1_TIME_free(a->notBefore);
-        ASN1_TIME_free(a->notAfter);
+        M_ASN1_TIME_free(a->notAfter);
-        Free((char *)a);
+        Free(a);
        }
diff --git a/src/lib/libcrypto/asn1/x_x509.c b/src/lib/libcrypto/asn1/x_x509.c
index 7abf6b2a6b..11e564ea30 100644
--- a/src/lib/libcrypto/asn1/x_x509.c
+++ b/src/lib/libcrypto/asn1/x_x509.c
@@ -62,6 +62,9 @@
 #include <openssl/asn1_mac.h>
 #include <openssl/x509.h>
+static int x509_meth_num = 0;
+static STACK_OF(CRYPTO_EX_DATA_FUNCS) *x509_meth = NULL;
 static ASN1_METHOD meth={
        (int (*)())  i2d_X509,
        (char *(*)())d2i_X509,
@@ -113,10 +116,13 @@ X509 *X509_new(void)
        M_ASN1_New_Malloc(ret,X509);
        ret->references=1;
        ret->valid=0;
+        ret->ex_flags = 0;
        ret->name=NULL;
+        ret->aux=NULL;
        M_ASN1_New(ret->cert_info,X509_CINF_new);
        M_ASN1_New(ret->sig_alg,X509_ALGOR_new);
-        M_ASN1_New(ret->signature,ASN1_BIT_STRING_new);
+        M_ASN1_New(ret->signature,M_ASN1_BIT_STRING_new);
+        CRYPTO_new_ex_data(x509_meth, ret, &ret->ex_data);
        return(ret);
        M_ASN1_New_Error(ASN1_F_X509_NEW);
        }
@@ -140,12 +146,65 @@ void X509_free(X509 *a)
                }
 #endif
-        /* CRYPTO_free_ex_data(bio_meth,(char *)a,&a->ex_data); */
+        CRYPTO_free_ex_data(x509_meth,a,&a->ex_data);
        X509_CINF_free(a->cert_info);
        X509_ALGOR_free(a->sig_alg);
-        ASN1_BIT_STRING_free(a->signature);
+        M_ASN1_BIT_STRING_free(a->signature);
+        X509_CERT_AUX_free(a->aux);
        if (a->name != NULL) Free(a->name);
-        Free((char *)a);
+        Free(a);
+        }
+int X509_get_ex_new_index(long argl, void *argp, CRYPTO_EX_new *new_func,
+             CRYPTO_EX_dup *dup_func, CRYPTO_EX_free *free_func)
+        {
+        x509_meth_num++;
+        return(CRYPTO_get_ex_new_index(x509_meth_num-1,
+                &x509_meth,argl,argp,new_func,dup_func,free_func));
+        }
+int X509_set_ex_data(X509 *r, int idx, void *arg)
+        {
+        return(CRYPTO_set_ex_data(&r->ex_data,idx,arg));
        }
+void *X509_get_ex_data(X509 *r, int idx)
+        {
+        return(CRYPTO_get_ex_data(&r->ex_data,idx));
+        }
+/* X509_AUX ASN1 routines. X509_AUX is the name given to
+ * a certificate with extra info tagged on the end. Since these
+ * functions set how a certificate is trusted they should only
+ * be used when the certificate comes from a reliable source
+ * such as local storage.
+ *
+ */
+X509 *d2i_X509_AUX(X509 **a, unsigned char **pp, long length)
+{
+        unsigned char *q;
+        X509 *ret;
+        /* Save start position */
+        q = *pp;
+        ret = d2i_X509(a, pp, length);
+        /* If certificate unreadable then forget it */
+        if(!ret) return NULL;
+        /* update length */
+        length -= *pp - q;
+        if(!length) return ret;
+        if(!d2i_X509_CERT_AUX(&ret->aux, pp, length)) goto err;
+        return ret;
+        err:
+        X509_free(ret);
+        return NULL;
+}
+int i2d_X509_AUX(X509 *a, unsigned char **pp)
+{
+        int length;
+        length = i2d_X509(a, pp);
+        if(a) length += i2d_X509_CERT_AUX(a->aux, pp);
+        return length;
+}
diff --git a/src/lib/libcrypto/asn1/x_x509a.c b/src/lib/libcrypto/asn1/x_x509a.c
new file mode 100644
index 0000000000..b9987ea968
--- /dev/null
+++ b/src/lib/libcrypto/asn1/x_x509a.c
@@ -0,0 +1,200 @@
+/* a_x509a.c */
+/* Written by Dr Stephen N Henson (shenson@bigfoot.com) for the OpenSSL
+ * project 1999.
+ */
+/* ====================================================================
+ * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer. 
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * 3. All advertising materials mentioning features or use of this
+ *    software must display the following acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
+ *
+ * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
+ *    endorse or promote products derived from this software without
+ *    prior written permission. For written permission, please contact
+ *    licensing@OpenSSL.org.
+ *
+ * 5. Products derived from this software may not be called "OpenSSL"
+ *    nor may "OpenSSL" appear in their names without prior written
+ *    permission of the OpenSSL Project.
+ *
+ * 6. Redistributions of any form whatsoever must retain the following
+ *    acknowledgment:
+ *    "This product includes software developed by the OpenSSL Project
+ *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
+ * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
+ * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
+ * OF THE POSSIBILITY OF SUCH DAMAGE.
+ * ====================================================================
+ *
+ * This product includes cryptographic software written by Eric Young
+ * (eay@cryptsoft.com).  This product includes software written by Tim
+ * Hudson (tjh@cryptsoft.com).
+ *
+ */
+#include <stdio.h>
+#include "cryptlib.h"
+#include <openssl/evp.h>
+#include <openssl/asn1_mac.h>
+#include <openssl/x509.h>
+/* X509_CERT_AUX routines. These are used to encode additional
+ * user modifiable data about a certificate. This data is
+ * appended to the X509 encoding when the *_X509_AUX routines
+ * are used. This means that the "traditional" X509 routines
+ * will simply ignore the extra data. 
+ */
+static X509_CERT_AUX *aux_get(X509 *x);
+X509_CERT_AUX *d2i_X509_CERT_AUX(X509_CERT_AUX **a, unsigned char **pp, long length)
+{
+        M_ASN1_D2I_vars(a, X509_CERT_AUX *, X509_CERT_AUX_new);
+        
+        M_ASN1_D2I_Init();
+        M_ASN1_D2I_start_sequence();
+        M_ASN1_D2I_get_seq_opt_type(ASN1_OBJECT, ret->trust,
+                                        d2i_ASN1_OBJECT, ASN1_OBJECT_free);
+        M_ASN1_D2I_get_IMP_set_opt_type(ASN1_OBJECT, ret->reject,
+                                        d2i_ASN1_OBJECT, ASN1_OBJECT_free, 0);
+        M_ASN1_D2I_get_opt(ret->alias, d2i_ASN1_UTF8STRING, V_ASN1_UTF8STRING);
+        M_ASN1_D2I_get_opt(ret->keyid, d2i_ASN1_OCTET_STRING, V_ASN1_OCTET_STRING);
+        M_ASN1_D2I_get_IMP_set_opt_type(X509_ALGOR, ret->other,
+                                        d2i_X509_ALGOR, X509_ALGOR_free, 1);
+        M_ASN1_D2I_Finish(a, X509_CERT_AUX_free, ASN1_F_D2I_X509_CERT_AUX);
+}
+X509_CERT_AUX *X509_CERT_AUX_new()
+{
+        X509_CERT_AUX *ret = NULL;
+        ASN1_CTX c;
+        M_ASN1_New_Malloc(ret, X509_CERT_AUX);
+        ret->trust = NULL;
+        ret->reject = NULL;
+        ret->alias = NULL;
+        ret->keyid = NULL;
+        ret->other = NULL;
+        return(ret);
+        M_ASN1_New_Error(ASN1_F_X509_CERT_AUX_NEW);
+}
+void X509_CERT_AUX_free(X509_CERT_AUX *a)
+{
+        if(a == NULL) return;
+        sk_ASN1_OBJECT_pop_free(a->trust, ASN1_OBJECT_free);
+        sk_ASN1_OBJECT_pop_free(a->reject, ASN1_OBJECT_free);
+        ASN1_UTF8STRING_free(a->alias);
+        ASN1_OCTET_STRING_free(a->keyid);
+        sk_X509_ALGOR_pop_free(a->other, X509_ALGOR_free);
+        Free(a);
+}
+int i2d_X509_CERT_AUX(X509_CERT_AUX *a, unsigned char **pp)
+{
+        M_ASN1_I2D_vars(a);
+        M_ASN1_I2D_len_SEQUENCE_opt_type(ASN1_OBJECT, a->trust, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_len_IMP_SEQUENCE_opt_type(ASN1_OBJECT, a->reject, i2d_ASN1_OBJECT, 0);
+        M_ASN1_I2D_len(a->alias, i2d_ASN1_UTF8STRING);
+        M_ASN1_I2D_len(a->keyid, i2d_ASN1_OCTET_STRING);
+        M_ASN1_I2D_len_IMP_SEQUENCE_opt_type(X509_ALGOR, a->other, i2d_X509_ALGOR, 1);
+        M_ASN1_I2D_seq_total();
+        M_ASN1_I2D_put_SEQUENCE_opt_type(ASN1_OBJECT, a->trust, i2d_ASN1_OBJECT);
+        M_ASN1_I2D_put_IMP_SEQUENCE_opt_type(ASN1_OBJECT, a->reject, i2d_ASN1_OBJECT, 0);
+        M_ASN1_I2D_put(a->alias, i2d_ASN1_UTF8STRING);
+        M_ASN1_I2D_put(a->keyid, i2d_ASN1_OCTET_STRING);
+        M_ASN1_I2D_put_IMP_SEQUENCE_opt_type(X509_ALGOR, a->other, i2d_X509_ALGOR, 1);
+        M_ASN1_I2D_finish();
+}
+static X509_CERT_AUX *aux_get(X509 *x)
+{
+        if(!x) return NULL;
+        if(!x->aux && !(x->aux = X509_CERT_AUX_new())) return NULL;
+        return x->aux;
+}
+int X509_alias_set1(X509 *x, unsigned char *name, int len)
+{
+        X509_CERT_AUX *aux;
+        if(!(aux = aux_get(x))) return 0;
+        if(!aux->alias && !(aux->alias = ASN1_UTF8STRING_new())) return 0;
+        return ASN1_STRING_set(aux->alias, name, len);
+}
+unsigned char *X509_alias_get0(X509 *x, int *len)
+{
+        if(!x->aux || !x->aux->alias) return NULL;
+        if(len) *len = x->aux->alias->length;
+        return x->aux->alias->data;
+}
+int X509_add1_trust_object(X509 *x, ASN1_OBJECT *obj)
+{
+        X509_CERT_AUX *aux;
+        ASN1_OBJECT *objtmp;
+        if(!(objtmp = OBJ_dup(obj))) return 0;
+        if(!(aux = aux_get(x))) return 0;
+        if(!aux->trust
+                && !(aux->trust = sk_ASN1_OBJECT_new_null())) return 0;
+        return sk_ASN1_OBJECT_push(aux->trust, objtmp);
+}
+int X509_add1_reject_object(X509 *x, ASN1_OBJECT *obj)
+{
+        X509_CERT_AUX *aux;
+        ASN1_OBJECT *objtmp;
+        if(!(objtmp = OBJ_dup(obj))) return 0;
+        if(!(aux = aux_get(x))) return 0;
+        if(!aux->reject
+                && !(aux->reject = sk_ASN1_OBJECT_new_null())) return 0;
+        return sk_ASN1_OBJECT_push(aux->reject, objtmp);
+}
+void X509_trust_clear(X509 *x)
+{
+        if(x->aux && x->aux->trust) {
+                sk_ASN1_OBJECT_pop_free(x->aux->trust, ASN1_OBJECT_free);
+                x->aux->trust = NULL;
+        }
+}
+void X509_reject_clear(X509 *x)
+{
+        if(x->aux && x->aux->reject) {
+                sk_ASN1_OBJECT_pop_free(x->aux->reject, ASN1_OBJECT_free);
+                x->aux->reject = NULL;
+        }
+}
author	beck <>	2000-03-19 11:13:58 +0000
committer	beck <>	2000-03-19 11:13:58 +0000
commit	796d609550df3a33fc11468741c5d2f6d3df4c11 (patch)
tree	6c6d539061caa20372dad0ac4ddb1dfae2fbe7fe /src/lib/libcrypto/asn1
parent	5be3114c1fd7e0dfea1e38d3abb4cbba75244419 (diff)
download	openbsd-796d609550df3a33fc11468741c5d2f6d3df4c11.tar.gz openbsd-796d609550df3a33fc11468741c5d2f6d3df4c11.tar.bz2 openbsd-796d609550df3a33fc11468741c5d2f6d3df4c11.zip