18 files changed, 325 insertions, 105 deletions

diff --git a/src/lib/libcrypto/x509/by_file.c b/src/lib/libcrypto/x509/by_file.c
index b4b04183d0..a5e0d4aefa 100644
--- a/src/lib/libcrypto/x509/by_file.c
+++ b/src/lib/libcrypto/x509/by_file.c
@@ -150,7 +150,7 @@ int X509_load_cert_file(X509_LOOKUP *ctx, const char *file, int type)
                         x=PEM_read_bio_X509_AUX(in,NULL,NULL,NULL);
                         if (x == NULL)
                                 {
-                                if ((ERR_GET_REASON(ERR_peek_error()) ==
+                                if ((ERR_GET_REASON(ERR_peek_last_error()) ==
                                         PEM_R_NO_START_LINE) && (count > 0))
                                         {
                                         ERR_clear_error();
@@ -217,7 +217,7 @@ int X509_load_crl_file(X509_LOOKUP *ctx, const char *file, int type)
                         x=PEM_read_bio_X509_CRL(in,NULL,NULL,NULL);
                         if (x == NULL)
                                 {
-                                if ((ERR_GET_REASON(ERR_peek_error()) ==
+                                if ((ERR_GET_REASON(ERR_peek_last_error()) ==
                                         PEM_R_NO_START_LINE) && (count > 0))
                                         {
                                         ERR_clear_error();
diff --git a/src/lib/libcrypto/x509/x509.h b/src/lib/libcrypto/x509/x509.h
index 8d0c7e2e17..e8c1a59cf2 100644
--- a/src/lib/libcrypto/x509/x509.h
+++ b/src/lib/libcrypto/x509/x509.h
@@ -410,6 +410,7 @@ typedef struct X509_crl_info_st
         ASN1_TIME *nextUpdate;
         STACK_OF(X509_REVOKED) *revoked;
         STACK_OF(X509_EXTENSION) /* [0] */ *extensions;
+        ASN1_ENCODING enc;
         } X509_CRL_INFO;
 
 struct X509_crl_st
@@ -1037,18 +1038,18 @@ int X509_NAME_add_entry_by_OBJ(X509_NAME *name, ASN1_OBJECT *obj, int type,
 int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
                         unsigned char *bytes, int len, int loc, int set);
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
-                char *field, int type, unsigned char *bytes, int len);
+                const char *field, int type, const unsigned char *bytes, int len);
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
                         int type,unsigned char *bytes, int len);
-int X509_NAME_add_entry_by_txt(X509_NAME *name, char *field, int type,
-                        unsigned char *bytes, int len, int loc, int set);
+int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
+                        const unsigned char *bytes, int len, int loc, int set);
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
-                        ASN1_OBJECT *obj, int type,unsigned char *bytes,
+                        ASN1_OBJECT *obj, int type,const unsigned char *bytes,
                         int len);
 int             X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne,
                         ASN1_OBJECT *obj);
 int             X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
-                        unsigned char *bytes, int len);
+                        const unsigned char *bytes, int len);
 ASN1_OBJECT *   X509_NAME_ENTRY_get_object(X509_NAME_ENTRY *ne);
 ASN1_STRING *   X509_NAME_ENTRY_get_data(X509_NAME_ENTRY *ne);
 
diff --git a/src/lib/libcrypto/x509/x509_cmp.c b/src/lib/libcrypto/x509/x509_cmp.c
index f460102f49..030d0966fc 100644
--- a/src/lib/libcrypto/x509/x509_cmp.c
+++ b/src/lib/libcrypto/x509/x509_cmp.c
@@ -254,33 +254,49 @@ static int nocase_spacenorm_cmp(const ASN1_STRING *a, const ASN1_STRING *b)
         return 0;
 }
 
+static int asn1_string_memcmp(ASN1_STRING *a, ASN1_STRING *b)
+        {
+        int j;
+        j = a->length - b->length;
+        if (j)
+                return j;
+        return memcmp(a->data, b->data, a->length);
+        }
+
+#define STR_TYPE_CMP (B_ASN1_PRINTABLESTRING|B_ASN1_T61STRING|B_ASN1_UTF8STRING)
+
 int X509_NAME_cmp(const X509_NAME *a, const X509_NAME *b)
         {
         int i,j;
         X509_NAME_ENTRY *na,*nb;
 
-        if (sk_X509_NAME_ENTRY_num(a->entries)
-            != sk_X509_NAME_ENTRY_num(b->entries))
-                return sk_X509_NAME_ENTRY_num(a->entries)
-                  -sk_X509_NAME_ENTRY_num(b->entries);
+        unsigned long nabit, nbbit;
+
+        j = sk_X509_NAME_ENTRY_num(a->entries)
+                  - sk_X509_NAME_ENTRY_num(b->entries);
+        if (j)
+                return j;
         for (i=sk_X509_NAME_ENTRY_num(a->entries)-1; i>=0; i--)
                 {
                 na=sk_X509_NAME_ENTRY_value(a->entries,i);
                 nb=sk_X509_NAME_ENTRY_value(b->entries,i);
                 j=na->value->type-nb->value->type;
-                if (j) return(j);
-                if (na->value->type == V_ASN1_PRINTABLESTRING)
+                if (j)
+                        {
+                        nabit = ASN1_tag2bit(na->value->type);
+                        nbbit = ASN1_tag2bit(nb->value->type);
+                        if (!(nabit & STR_TYPE_CMP) ||
+                                !(nbbit & STR_TYPE_CMP))
+                                return j;
+                        j = asn1_string_memcmp(na->value, nb->value);
+                        }
+                else if (na->value->type == V_ASN1_PRINTABLESTRING)
                         j=nocase_spacenorm_cmp(na->value, nb->value);
                 else if (na->value->type == V_ASN1_IA5STRING
                         && OBJ_obj2nid(na->object) == NID_pkcs9_emailAddress)
                         j=nocase_cmp(na->value, nb->value);
                 else
-                        {
-                        j=na->value->length-nb->value->length;
-                        if (j) return(j);
-                        j=memcmp(na->value->data,nb->value->data,
-                                na->value->length);
-                        }
+                        j = asn1_string_memcmp(na->value, nb->value);
                 if (j) return(j);
                 j=na->set-nb->set;
                 if (j) return(j);
@@ -306,10 +322,16 @@ unsigned long X509_NAME_hash(X509_NAME *x)
         {
         unsigned long ret=0;
         unsigned char md[16];
+        EVP_MD_CTX md_ctx;
 
         /* Make sure X509_NAME structure contains valid cached encoding */
         i2d_X509_NAME(x,NULL);
-        EVP_Digest(x->bytes->data, x->bytes->length, md, NULL, EVP_md5(), NULL);
+        EVP_MD_CTX_init(&md_ctx);
+        EVP_MD_CTX_set_flags(&md_ctx, EVP_MD_CTX_FLAG_NON_FIPS_ALLOW);
+        EVP_DigestInit_ex(&md_ctx, EVP_md5(), NULL);
+        EVP_DigestUpdate(&md_ctx, x->bytes->data, x->bytes->length);
+        EVP_DigestFinal_ex(&md_ctx,md,NULL);
+        EVP_MD_CTX_cleanup(&md_ctx);
 
         ret=(   ((unsigned long)md[0]     )|((unsigned long)md[1]<<8L)|
                 ((unsigned long)md[2]<<16L)|((unsigned long)md[3]<<24L)
diff --git a/src/lib/libcrypto/x509/x509_r2x.c b/src/lib/libcrypto/x509/x509_r2x.c
index db051033d9..fb8a78dabe 100644
--- a/src/lib/libcrypto/x509/x509_r2x.c
+++ b/src/lib/libcrypto/x509/x509_r2x.c
@@ -92,8 +92,10 @@ X509 *X509_REQ_to_X509(X509_REQ *r, int days, EVP_PKEY *pkey)
         X509_set_subject_name(ret,X509_NAME_dup(xn));
         X509_set_issuer_name(ret,X509_NAME_dup(xn));
 
-        X509_gmtime_adj(xi->validity->notBefore,0);
-        X509_gmtime_adj(xi->validity->notAfter,(long)60*60*24*days);
+        if (X509_gmtime_adj(xi->validity->notBefore,0) == NULL)
+                goto err;
+        if (X509_gmtime_adj(xi->validity->notAfter,(long)60*60*24*days) == NULL)
+                goto err;
 
         X509_set_pubkey(ret,X509_REQ_get_pubkey(r));
 
diff --git a/src/lib/libcrypto/x509/x509_req.c b/src/lib/libcrypto/x509/x509_req.c
index 0affa3bf30..59fc6ca548 100644
--- a/src/lib/libcrypto/x509/x509_req.c
+++ b/src/lib/libcrypto/x509/x509_req.c
@@ -118,7 +118,7 @@ EVP_PKEY *X509_REQ_get_pubkey(X509_REQ *req)
  * used and there may be more: so the list is configurable.
  */
 
-static int ext_nid_list[] = { NID_ms_ext_req, NID_ext_req, NID_undef};
+static int ext_nid_list[] = { NID_ext_req, NID_ms_ext_req, NID_undef};
 
 static int *ext_nids = ext_nid_list;
 
@@ -143,32 +143,33 @@ void X509_REQ_set_extension_nids(int *nids)
 }
 
 STACK_OF(X509_EXTENSION) *X509_REQ_get_extensions(X509_REQ *req)
-{
+        {
         X509_ATTRIBUTE *attr;
-        STACK_OF(X509_ATTRIBUTE) *sk;
         ASN1_TYPE *ext = NULL;
-        int i;
+        int idx, *pnid;
         unsigned char *p;
-        if ((req == NULL) || (req->req_info == NULL))
+
+        if ((req == NULL) || (req->req_info == NULL) || !ext_nids)
                 return(NULL);
-        sk=req->req_info->attributes;
-        if (!sk) return NULL;
-        for(i = 0; i < sk_X509_ATTRIBUTE_num(sk); i++) {
-                attr = sk_X509_ATTRIBUTE_value(sk, i);
-                if(X509_REQ_extension_nid(OBJ_obj2nid(attr->object))) {
-                        if(attr->single) ext = attr->value.single;
-                        else if(sk_ASN1_TYPE_num(attr->value.set))
-                                ext = sk_ASN1_TYPE_value(attr->value.set, 0);
-                        break;
+        for (pnid = ext_nids; *pnid != NID_undef; pnid++)
+                {
+                idx = X509_REQ_get_attr_by_NID(req, *pnid, -1);
+                if (idx == -1)
+                        continue;
+                attr = X509_REQ_get_attr(req, idx);
+                if(attr->single) ext = attr->value.single;
+                else if(sk_ASN1_TYPE_num(attr->value.set))
+                        ext = sk_ASN1_TYPE_value(attr->value.set, 0);
+                break;
                 }
-        }
-        if(!ext || (ext->type != V_ASN1_SEQUENCE)) return NULL;
+        if(!ext || (ext->type != V_ASN1_SEQUENCE))
+                return NULL;
         p = ext->value.sequence->data;
         return d2i_ASN1_SET_OF_X509_EXTENSION(NULL, &p,
                         ext->value.sequence->length,
                         d2i_X509_EXTENSION, X509_EXTENSION_free,
                         V_ASN1_SEQUENCE, V_ASN1_UNIVERSAL);
-}
+        }
 
 /* Add a STACK_OF extensions to a certificate request: allow alternative OIDs
  * in case we want to create a non standard one.
diff --git a/src/lib/libcrypto/x509/x509_txt.c b/src/lib/libcrypto/x509/x509_txt.c
index e31ebc6741..f19e66a238 100644
--- a/src/lib/libcrypto/x509/x509_txt.c
+++ b/src/lib/libcrypto/x509/x509_txt.c
@@ -122,8 +122,14 @@ const char *X509_verify_cert_error_string(long n)
                 return("certificate revoked");
         case X509_V_ERR_INVALID_CA:
                 return ("invalid CA certificate");
+        case X509_V_ERR_INVALID_NON_CA:
+                return ("invalid non-CA certificate (has CA markings)");
         case X509_V_ERR_PATH_LENGTH_EXCEEDED:
                 return ("path length constraint exceeded");
+        case X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED:
+                return("proxy path length constraint exceeded");
+        case X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED:
+                return("proxy cerificates not allowed, please set the appropriate flag");
         case X509_V_ERR_INVALID_PURPOSE:
                 return ("unsupported certificate purpose");
         case X509_V_ERR_CERT_UNTRUSTED:
@@ -140,19 +146,16 @@ const char *X509_verify_cert_error_string(long n)
                 return("authority and issuer serial number mismatch");
         case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
                 return("key usage does not include certificate signing");
-
         case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
                 return("unable to get CRL issuer certificate");
-
         case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
                 return("unhandled critical extension");
-
         case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
                 return("key usage does not include CRL signing");
-
+        case X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE:
+                return("key usage does not include digital signature");
         case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
                 return("unhandled critical CRL extension");
-
         default:
                 BIO_snprintf(buf,sizeof buf,"error number %ld",n);
                 return(buf);
diff --git a/src/lib/libcrypto/x509/x509_vfy.c b/src/lib/libcrypto/x509/x509_vfy.c
index 2e4d0b823a..e43c861ee7 100644
--- a/src/lib/libcrypto/x509/x509_vfy.c
+++ b/src/lib/libcrypto/x509/x509_vfy.c
@@ -73,7 +73,7 @@
 static int null_callback(int ok,X509_STORE_CTX *e);
 static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer);
 static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x);
-static int check_chain_purpose(X509_STORE_CTX *ctx);
+static int check_chain_extensions(X509_STORE_CTX *ctx);
 static int check_trust(X509_STORE_CTX *ctx);
 static int check_revocation(X509_STORE_CTX *ctx);
 static int check_cert(X509_STORE_CTX *ctx);
@@ -281,7 +281,7 @@ int X509_verify_cert(X509_STORE_CTX *ctx)
                 }
 
         /* We have the chain complete: now we need to check its purpose */
-        if (ctx->purpose > 0) ok = check_chain_purpose(ctx);
+        ok = check_chain_extensions(ctx);
 
         if (!ok) goto end;
 
@@ -365,21 +365,39 @@ static int get_issuer_sk(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
         else
                 return 0;
 }
-        
+
 
 /* Check a certificate chains extensions for consistency
  * with the supplied purpose
  */
 
-static int check_chain_purpose(X509_STORE_CTX *ctx)
+static int check_chain_extensions(X509_STORE_CTX *ctx)
 {
 #ifdef OPENSSL_NO_CHAIN_VERIFY
         return 1;
 #else
-        int i, ok=0;
+        int i, ok=0, must_be_ca;
         X509 *x;
         int (*cb)();
+        int proxy_path_length = 0;
+        int allow_proxy_certs = !!(ctx->flags & X509_V_FLAG_ALLOW_PROXY_CERTS);
         cb=ctx->verify_cb;
+
+        /* must_be_ca can have 1 of 3 values:
+           -1: we accept both CA and non-CA certificates, to allow direct
+               use of self-signed certificates (which are marked as CA).
+           0:  we only accept non-CA certificates.  This is currently not
+               used, but the possibility is present for future extensions.
+           1:  we only accept CA certificates.  This is currently used for
+               all certificates in the chain except the leaf certificate.
+        */
+        must_be_ca = -1;
+
+        /* A hack to keep people who don't want to modify their software
+           happy */
+        if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
+                allow_proxy_certs = 1;
+
         /* Check all untrusted certificates */
         for (i = 0; i < ctx->last_untrusted; i++)
                 {
@@ -394,23 +412,73 @@ static int check_chain_purpose(X509_STORE_CTX *ctx)
                         ok=cb(0,ctx);
                         if (!ok) goto end;
                         }
-                ret = X509_check_purpose(x, ctx->purpose, i);
-                if ((ret == 0)
-                         || ((ctx->flags & X509_V_FLAG_X509_STRICT)
-                                && (ret != 1)))
+                if (!allow_proxy_certs && (x->ex_flags & EXFLAG_PROXY))
                         {
-                        if (i)
+                        ctx->error = X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED;
+                        ctx->error_depth = i;
+                        ctx->current_cert = x;
+                        ok=cb(0,ctx);
+                        if (!ok) goto end;
+                        }
+                ret = X509_check_ca(x);
+                switch(must_be_ca)
+                        {
+                case -1:
+                        if ((ctx->flags & X509_V_FLAG_X509_STRICT)
+                                && (ret != 1) && (ret != 0))
+                                {
+                                ret = 0;
                                 ctx->error = X509_V_ERR_INVALID_CA;
+                                }
                         else
-                                ctx->error = X509_V_ERR_INVALID_PURPOSE;
+                                ret = 1;
+                        break;
+                case 0:
+                        if (ret != 0)
+                                {
+                                ret = 0;
+                                ctx->error = X509_V_ERR_INVALID_NON_CA;
+                                }
+                        else
+                                ret = 1;
+                        break;
+                default:
+                        if ((ret == 0)
+                                || ((ctx->flags & X509_V_FLAG_X509_STRICT)
+                                        && (ret != 1)))
+                                {
+                                ret = 0;
+                                ctx->error = X509_V_ERR_INVALID_CA;
+                                }
+                        else
+                                ret = 1;
+                        break;
+                        }
+                if (ret == 0)
+                        {
                         ctx->error_depth = i;
                         ctx->current_cert = x;
                         ok=cb(0,ctx);
                         if (!ok) goto end;
                         }
+                if (ctx->purpose > 0)
+                        {
+                        ret = X509_check_purpose(x, ctx->purpose,
+                                must_be_ca > 0);
+                        if ((ret == 0)
+                                || ((ctx->flags & X509_V_FLAG_X509_STRICT)
+                                        && (ret != 1)))
+                                {
+                                ctx->error = X509_V_ERR_INVALID_PURPOSE;
+                                ctx->error_depth = i;
+                                ctx->current_cert = x;
+                                ok=cb(0,ctx);
+                                if (!ok) goto end;
+                                }
+                        }
                 /* Check pathlen */
                 if ((i > 1) && (x->ex_pathlen != -1)
-                           && (i > (x->ex_pathlen + 1)))
+                           && (i > (x->ex_pathlen + proxy_path_length + 1)))
                         {
                         ctx->error = X509_V_ERR_PATH_LENGTH_EXCEEDED;
                         ctx->error_depth = i;
@@ -418,6 +486,32 @@ static int check_chain_purpose(X509_STORE_CTX *ctx)
                         ok=cb(0,ctx);
                         if (!ok) goto end;
                         }
+                /* If this certificate is a proxy certificate, the next
+                   certificate must be another proxy certificate or a EE
+                   certificate.  If not, the next certificate must be a
+                   CA certificate.  */
+                if (x->ex_flags & EXFLAG_PROXY)
+                        {
+                        PROXY_CERT_INFO_EXTENSION *pci =
+                                X509_get_ext_d2i(x, NID_proxyCertInfo,
+                                        NULL, NULL);
+                        if (pci->pcPathLengthConstraint &&
+                                ASN1_INTEGER_get(pci->pcPathLengthConstraint)
+                                < i)
+                                {
+                                PROXY_CERT_INFO_EXTENSION_free(pci);
+                                ctx->error = X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED;
+                                ctx->error_depth = i;
+                                ctx->current_cert = x;
+                                ok=cb(0,ctx);
+                                if (!ok) goto end;
+                                }
+                        PROXY_CERT_INFO_EXTENSION_free(pci);
+                        proxy_path_length++;
+                        must_be_ca = 0;
+                        }
+                else
+                        must_be_ca = 1;
                 }
         ok = 1;
  end:
@@ -627,6 +721,15 @@ static int cert_crl(X509_STORE_CTX *ctx, X509_CRL *crl, X509 *x)
         X509_EXTENSION *ext;
         /* Look for serial number of certificate in CRL */
         rtmp.serialNumber = X509_get_serialNumber(x);
+        /* Sort revoked into serial number order if not already sorted.
+         * Do this under a lock to avoid race condition.
+         */
+        if (!sk_X509_REVOKED_is_sorted(crl->crl->revoked))
+                {
+                CRYPTO_w_lock(CRYPTO_LOCK_X509_CRL);
+                sk_X509_REVOKED_sort(crl->crl->revoked);
+                CRYPTO_w_unlock(CRYPTO_LOCK_X509_CRL);
+                }
         idx = sk_X509_REVOKED_find(crl->crl->revoked, &rtmp);
         /* If found assume revoked: want something cleverer than
          * this to handle entry extensions in V2 CRLs.
@@ -772,6 +875,7 @@ static int internal_verify(X509_STORE_CTX *ctx)
                         }
 
                 /* The last error (if any) is still in the error value */
+                ctx->current_issuer=xi;
                 ctx->current_cert=xs;
                 ok=(*cb)(1,ctx);
                 if (!ok) goto end;
@@ -851,7 +955,8 @@ int X509_cmp_time(ASN1_TIME *ctm, time_t *cmp_time)
         atm.length=sizeof(buff2);
         atm.data=(unsigned char *)buff2;
 
-        X509_time_adj(&atm,-offset*60, cmp_time);
+        if (X509_time_adj(&atm,-offset*60, cmp_time) == NULL)
+                return 0;
 
         if (ctm->type == V_ASN1_UTCTIME)
                 {
diff --git a/src/lib/libcrypto/x509/x509_vfy.h b/src/lib/libcrypto/x509/x509_vfy.h
index 198495884c..7fd1f0bc4d 100644
--- a/src/lib/libcrypto/x509/x509_vfy.h
+++ b/src/lib/libcrypto/x509/x509_vfy.h
@@ -276,7 +276,7 @@ struct x509_store_ctx_st      /* X509_STORE_CTX */
 #define         X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY   6
 #define         X509_V_ERR_CERT_SIGNATURE_FAILURE               7
 #define         X509_V_ERR_CRL_SIGNATURE_FAILURE                8
-#define         X509_V_ERR_CERT_NOT_YET_VALID                   9       
+#define         X509_V_ERR_CERT_NOT_YET_VALID                   9
 #define         X509_V_ERR_CERT_HAS_EXPIRED                     10
 #define         X509_V_ERR_CRL_NOT_YET_VALID                    11
 #define         X509_V_ERR_CRL_HAS_EXPIRED                      12
@@ -306,6 +306,10 @@ struct x509_store_ctx_st      /* X509_STORE_CTX */
 #define         X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION         34
 #define         X509_V_ERR_KEYUSAGE_NO_CRL_SIGN                 35
 #define         X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION     36
+#define         X509_V_ERR_INVALID_NON_CA                       37
+#define         X509_V_ERR_PROXY_PATH_LENGTH_EXCEEDED           38
+#define         X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE        39
+#define         X509_V_ERR_PROXY_CERTIFICATES_NOT_ALLOWED       40
 
 /* The application is not happy */
 #define         X509_V_ERR_APPLICATION_VERIFICATION             50
@@ -324,6 +328,8 @@ struct x509_store_ctx_st      /* X509_STORE_CTX */
 #define X509_V_FLAG_IGNORE_CRITICAL             0x10
 /* Disable workarounds for broken certificates */
 #define X509_V_FLAG_X509_STRICT                 0x20
+/* Enable proxy certificate validation */
+#define X509_V_FLAG_ALLOW_PROXY_CERTS           0x40
 
 int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
              X509_NAME *name);
diff --git a/src/lib/libcrypto/x509/x509cset.c b/src/lib/libcrypto/x509/x509cset.c
index 6cac440ea9..9d1646d5c8 100644
--- a/src/lib/libcrypto/x509/x509cset.c
+++ b/src/lib/libcrypto/x509/x509cset.c
@@ -129,6 +129,7 @@ int X509_CRL_sort(X509_CRL *c)
                 r=sk_X509_REVOKED_value(c->crl->revoked,i);
                 r->sequence=i;
                 }
+        c->crl->enc.modified = 1;
         return 1;
         }
 
diff --git a/src/lib/libcrypto/x509/x509name.c b/src/lib/libcrypto/x509/x509name.c
index 4c20e03ece..068abfe5f0 100644
--- a/src/lib/libcrypto/x509/x509name.c
+++ b/src/lib/libcrypto/x509/x509name.c
@@ -195,8 +195,8 @@ int X509_NAME_add_entry_by_NID(X509_NAME *name, int nid, int type,
         return ret;
 }
 
-int X509_NAME_add_entry_by_txt(X509_NAME *name, char *field, int type,
-                        unsigned char *bytes, int len, int loc, int set)
+int X509_NAME_add_entry_by_txt(X509_NAME *name, const char *field, int type,
+                        const unsigned char *bytes, int len, int loc, int set)
 {
         X509_NAME_ENTRY *ne;
         int ret;
@@ -273,7 +273,7 @@ err:
         }
 
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_txt(X509_NAME_ENTRY **ne,
-                char *field, int type, unsigned char *bytes, int len)
+                const char *field, int type, const unsigned char *bytes, int len)
         {
         ASN1_OBJECT *obj;
         X509_NAME_ENTRY *nentry;
@@ -309,7 +309,7 @@ X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_NID(X509_NAME_ENTRY **ne, int nid,
         }
 
 X509_NAME_ENTRY *X509_NAME_ENTRY_create_by_OBJ(X509_NAME_ENTRY **ne,
-             ASN1_OBJECT *obj, int type, unsigned char *bytes, int len)
+             ASN1_OBJECT *obj, int type, const unsigned char *bytes, int len)
         {
         X509_NAME_ENTRY *ret;
 
@@ -347,7 +347,7 @@ int X509_NAME_ENTRY_set_object(X509_NAME_ENTRY *ne, ASN1_OBJECT *obj)
         }
 
 int X509_NAME_ENTRY_set_data(X509_NAME_ENTRY *ne, int type,
-             unsigned char *bytes, int len)
+             const unsigned char *bytes, int len)
         {
         int i;
 
diff --git a/src/lib/libcrypto/x509/x_all.c b/src/lib/libcrypto/x509/x_all.c
index fb5015cd4d..ac6dea493a 100644
--- a/src/lib/libcrypto/x509/x_all.c
+++ b/src/lib/libcrypto/x509/x_all.c
@@ -103,6 +103,7 @@ int X509_REQ_sign(X509_REQ *x, EVP_PKEY *pkey, const EVP_MD *md)
 
 int X509_CRL_sign(X509_CRL *x, EVP_PKEY *pkey, const EVP_MD *md)
         {
+        x->crl->enc.modified = 1;
         return(ASN1_item_sign(ASN1_ITEM_rptr(X509_CRL_INFO),x->crl->sig_alg,
                 x->sig_alg, x->signature, x->crl,pkey,md));
         }
diff --git a/src/lib/libcrypto/x509v3/ext_dat.h b/src/lib/libcrypto/x509v3/ext_dat.h
index 5442480595..d8328ac468 100644
--- a/src/lib/libcrypto/x509v3/ext_dat.h
+++ b/src/lib/libcrypto/x509v3/ext_dat.h
@@ -3,7 +3,7 @@
  * project 1999.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -60,10 +60,11 @@
 extern X509V3_EXT_METHOD v3_bcons, v3_nscert, v3_key_usage, v3_ext_ku;
 extern X509V3_EXT_METHOD v3_pkey_usage_period, v3_sxnet, v3_info, v3_sinfo;
 extern X509V3_EXT_METHOD v3_ns_ia5_list[], v3_alt[], v3_skey_id, v3_akey_id;
-extern X509V3_EXT_METHOD v3_crl_num, v3_crl_reason, v3_crl_invdate, v3_cpols, v3_crld;
+extern X509V3_EXT_METHOD v3_crl_num, v3_crl_reason, v3_crl_invdate;
+extern X509V3_EXT_METHOD v3_delta_crl, v3_cpols, v3_crld;
 extern X509V3_EXT_METHOD v3_ocsp_nonce, v3_ocsp_accresp, v3_ocsp_acutoff;
 extern X509V3_EXT_METHOD v3_ocsp_crlid, v3_ocsp_nocheck, v3_ocsp_serviceloc;
-extern X509V3_EXT_METHOD v3_crl_hold;
+extern X509V3_EXT_METHOD v3_crl_hold, v3_pci;
 
 /* This table will be searched using OBJ_bsearch so it *must* kept in
  * order of the ext_nid values.
@@ -89,6 +90,7 @@ static X509V3_EXT_METHOD *standard_exts[] = {
 &v3_akey_id,
 &v3_crld,
 &v3_ext_ku,
+&v3_delta_crl,
 &v3_crl_reason,
 #ifndef OPENSSL_NO_OCSP
 &v3_crl_invdate,
@@ -105,8 +107,9 @@ static X509V3_EXT_METHOD *standard_exts[] = {
 #endif
 &v3_sinfo,
 #ifndef OPENSSL_NO_OCSP
-&v3_crl_hold
+&v3_crl_hold,
 #endif
+&v3_pci,
 };
 
 /* Number of standard extensions */
diff --git a/src/lib/libcrypto/x509v3/v3_bitst.c b/src/lib/libcrypto/x509v3/v3_bitst.c
index 16cf125562..274965306d 100644
--- a/src/lib/libcrypto/x509v3/v3_bitst.c
+++ b/src/lib/libcrypto/x509v3/v3_bitst.c
@@ -124,7 +124,12 @@ static ASN1_BIT_STRING *v2i_ASN1_BIT_STRING(X509V3_EXT_METHOD *method,
                 for(bnam = method->usr_data; bnam->lname; bnam++) {
                         if(!strcmp(bnam->sname, val->name) ||
                                 !strcmp(bnam->lname, val->name) ) {
-                                ASN1_BIT_STRING_set_bit(bs, bnam->bitnum, 1);
+                                if(!ASN1_BIT_STRING_set_bit(bs, bnam->bitnum, 1)) {
+                                        X509V3err(X509V3_F_V2I_ASN1_BIT_STRING,
+                                                ERR_R_MALLOC_FAILURE);
+                                        M_ASN1_BIT_STRING_free(bs);
+                                        return NULL;
+                                }
                                 break;
                         }
                 }
diff --git a/src/lib/libcrypto/x509v3/v3_ia5.c b/src/lib/libcrypto/x509v3/v3_ia5.c
index f9414456de..9683afa47c 100644
--- a/src/lib/libcrypto/x509v3/v3_ia5.c
+++ b/src/lib/libcrypto/x509v3/v3_ia5.c
@@ -82,7 +82,10 @@ static char *i2s_ASN1_IA5STRING(X509V3_EXT_METHOD *method,
 {
         char *tmp;
         if(!ia5 || !ia5->length) return NULL;
-        if (!(tmp = OPENSSL_malloc(ia5->length + 1))) return NULL;
+        if(!(tmp = OPENSSL_malloc(ia5->length + 1))) {
+                X509V3err(X509V3_F_I2S_ASN1_IA5STRING,ERR_R_MALLOC_FAILURE);
+                return NULL;
+        }
         memcpy(tmp, ia5->data, ia5->length);
         tmp[ia5->length] = 0;
         return tmp;
diff --git a/src/lib/libcrypto/x509v3/v3_int.c b/src/lib/libcrypto/x509v3/v3_int.c
index f34cbfb731..7a43b4717b 100644
--- a/src/lib/libcrypto/x509v3/v3_int.c
+++ b/src/lib/libcrypto/x509v3/v3_int.c
@@ -3,7 +3,7 @@
  * project 1999.
  */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2004 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -61,9 +61,16 @@
 #include <openssl/x509v3.h>
 
 X509V3_EXT_METHOD v3_crl_num = { 
-NID_crl_number, 0, ASN1_ITEM_ref(ASN1_INTEGER),
-0,0,0,0,
-(X509V3_EXT_I2S)i2s_ASN1_INTEGER,
-0,
-0,0,0,0, NULL};
+        NID_crl_number, 0, ASN1_ITEM_ref(ASN1_INTEGER),
+        0,0,0,0,
+        (X509V3_EXT_I2S)i2s_ASN1_INTEGER,
+        0,
+        0,0,0,0, NULL};
+
+X509V3_EXT_METHOD v3_delta_crl = { 
+        NID_delta_crl, 0, ASN1_ITEM_ref(ASN1_INTEGER),
+        0,0,0,0,
+        (X509V3_EXT_I2S)i2s_ASN1_INTEGER,
+        0,
+        0,0,0,0, NULL};
 
diff --git a/src/lib/libcrypto/x509v3/v3_purp.c b/src/lib/libcrypto/x509v3/v3_purp.c
index b3d1ae5d1c..bbdf6da493 100644
--- a/src/lib/libcrypto/x509v3/v3_purp.c
+++ b/src/lib/libcrypto/x509v3/v3_purp.c
@@ -63,7 +63,6 @@
 
 static void x509v3_cache_extensions(X509 *x);
 
-static int ca_check(const X509 *x);
 static int check_ssl_ca(const X509 *x);
 static int check_purpose_ssl_client(const X509_PURPOSE *xp, const X509 *x, int ca);
 static int check_purpose_ssl_server(const X509_PURPOSE *xp, const X509 *x, int ca);
@@ -286,7 +285,8 @@ int X509_supported_extension(X509_EXTENSION *ex)
                 NID_key_usage,          /* 83 */
                 NID_subject_alt_name,   /* 85 */
                 NID_basic_constraints,  /* 87 */
-                NID_ext_key_usage       /* 126 */
+                NID_ext_key_usage,      /* 126 */
+                NID_proxyCertInfo       /* 661 */
         };
 
         int ex_nid;
@@ -307,6 +307,7 @@ int X509_supported_extension(X509_EXTENSION *ex)
 static void x509v3_cache_extensions(X509 *x)
 {
         BASIC_CONSTRAINTS *bs;
+        PROXY_CERT_INFO_EXTENSION *pci;
         ASN1_BIT_STRING *usage;
         ASN1_BIT_STRING *ns;
         EXTENDED_KEY_USAGE *extusage;
@@ -335,6 +336,16 @@ static void x509v3_cache_extensions(X509 *x)
                 BASIC_CONSTRAINTS_free(bs);
                 x->ex_flags |= EXFLAG_BCONS;
         }
+        /* Handle proxy certificates */
+        if((pci=X509_get_ext_d2i(x, NID_proxyCertInfo, NULL, NULL))) {
+                if (x->ex_flags & EXFLAG_CA
+                    || X509_get_ext_by_NID(x, NID_subject_alt_name, 0) >= 0
+                    || X509_get_ext_by_NID(x, NID_issuer_alt_name, 0) >= 0) {
+                        x->ex_flags |= EXFLAG_INVALID;
+                }
+                PROXY_CERT_INFO_EXTENSION_free(pci);
+                x->ex_flags |= EXFLAG_PROXY;
+        }
         /* Handle key usage */
         if((usage=X509_get_ext_d2i(x, NID_key_usage, NULL, NULL))) {
                 if(usage->length > 0) {
@@ -426,7 +437,7 @@ static void x509v3_cache_extensions(X509 *x)
 #define ns_reject(x, usage) \
         (((x)->ex_flags & EXFLAG_NSCERT) && !((x)->ex_nscert & (usage)))
 
-static int ca_check(const X509 *x)
+static int check_ca(const X509 *x)
 {
         /* keyUsage if present should allow cert signing */
         if(ku_reject(x, KU_KEY_CERT_SIGN)) return 0;
@@ -435,25 +446,37 @@ static int ca_check(const X509 *x)
                 /* If basicConstraints says not a CA then say so */
                 else return 0;
         } else {
+                /* we support V1 roots for...  uh, I don't really know why. */
                 if((x->ex_flags & V1_ROOT) == V1_ROOT) return 3;
                 /* If key usage present it must have certSign so tolerate it */
                 else if (x->ex_flags & EXFLAG_KUSAGE) return 4;
-                else return 2;
+                /* Older certificates could have Netscape-specific CA types */
+                else if (x->ex_flags & EXFLAG_NSCERT
+                         && x->ex_nscert & NS_ANY_CA) return 5;
+                /* can this still be regarded a CA certificate?  I doubt it */
+                return 0;
         }
 }
 
+int X509_check_ca(X509 *x)
+{
+        if(!(x->ex_flags & EXFLAG_SET)) {
+                CRYPTO_w_lock(CRYPTO_LOCK_X509);
+                x509v3_cache_extensions(x);
+                CRYPTO_w_unlock(CRYPTO_LOCK_X509);
+        }
+
+        return check_ca(x);
+}
+
 /* Check SSL CA: common checks for SSL client and server */
 static int check_ssl_ca(const X509 *x)
 {
         int ca_ret;
-        ca_ret = ca_check(x);
+        ca_ret = check_ca(x);
         if(!ca_ret) return 0;
         /* check nsCertType if present */
-        if(x->ex_flags & EXFLAG_NSCERT) {
-                if(x->ex_nscert & NS_SSL_CA) return ca_ret;
-                return 0;
-        }
-        if(ca_ret != 2) return ca_ret;
+        if(ca_ret != 5 || x->ex_nscert & NS_SSL_CA) return ca_ret;
         else return 0;
 }
 
@@ -498,14 +521,10 @@ static int purpose_smime(const X509 *x, int ca)
         if(xku_reject(x,XKU_SMIME)) return 0;
         if(ca) {
                 int ca_ret;
-                ca_ret = ca_check(x);
+                ca_ret = check_ca(x);
                 if(!ca_ret) return 0;
                 /* check nsCertType if present */
-                if(x->ex_flags & EXFLAG_NSCERT) {
-                        if(x->ex_nscert & NS_SMIME_CA) return ca_ret;
-                        return 0;
-                }
-                if(ca_ret != 2) return ca_ret;
+                if(ca_ret != 5 || x->ex_nscert & NS_SMIME_CA) return ca_ret;
                 else return 0;
         }
         if(x->ex_flags & EXFLAG_NSCERT) {
@@ -539,7 +558,7 @@ static int check_purpose_crl_sign(const X509_PURPOSE *xp, const X509 *x, int ca)
 {
         if(ca) {
                 int ca_ret;
-                if((ca_ret = ca_check(x)) != 2) return ca_ret;
+                if((ca_ret = check_ca(x)) != 2) return ca_ret;
                 else return 0;
         }
         if(ku_reject(x, KU_CRL_SIGN)) return 0;
@@ -552,17 +571,9 @@ static int check_purpose_crl_sign(const X509_PURPOSE *xp, const X509 *x, int ca)
 
 static int ocsp_helper(const X509_PURPOSE *xp, const X509 *x, int ca)
 {
-        /* Must be a valid CA */
-        if(ca) {
-                int ca_ret;
-                ca_ret = ca_check(x);
-                if(ca_ret != 2) return ca_ret;
-                if(x->ex_flags & EXFLAG_NSCERT) {
-                        if(x->ex_nscert & NS_ANY_CA) return ca_ret;
-                        return 0;
-                }
-                return 0;
-        }
+        /* Must be a valid CA.  Should we really support the "I don't know"
+           value (2)? */
+        if(ca) return check_ca(x);
         /* leaf certificate is checked in OCSP_verify() */
         return 1;
 }
@@ -624,7 +635,13 @@ int X509_check_issued(X509 *issuer, X509 *subject)
                                 return X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH;
                 }
         }
-        if(ku_reject(issuer, KU_KEY_CERT_SIGN)) return X509_V_ERR_KEYUSAGE_NO_CERTSIGN;
+        if(subject->ex_flags & EXFLAG_PROXY)
+                {
+                if(ku_reject(issuer, KU_DIGITAL_SIGNATURE))
+                        return X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE;
+                }
+        else if(ku_reject(issuer, KU_KEY_CERT_SIGN))
+                return X509_V_ERR_KEYUSAGE_NO_CERTSIGN;
         return X509_V_OK;
 }
 
diff --git a/src/lib/libcrypto/x509v3/v3err.c b/src/lib/libcrypto/x509v3/v3err.c
index 6458e95bb9..2df0c3ef01 100644
--- a/src/lib/libcrypto/x509v3/v3err.c
+++ b/src/lib/libcrypto/x509v3/v3err.c
@@ -1,6 +1,6 @@
 /* crypto/x509v3/v3err.c */
 /* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
+ * Copyright (c) 1999-2005 The OpenSSL Project.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -72,12 +72,14 @@ static ERR_STRING_DATA X509V3_str_functs[]=
 {ERR_PACK(0,X509V3_F_DO_EXT_I2D,0),     "DO_EXT_I2D"},
 {ERR_PACK(0,X509V3_F_HEX_TO_STRING,0),  "hex_to_string"},
 {ERR_PACK(0,X509V3_F_I2S_ASN1_ENUMERATED,0),    "i2s_ASN1_ENUMERATED"},
+{ERR_PACK(0,X509V3_F_I2S_ASN1_IA5STRING,0),     "I2S_ASN1_IA5STRING"},
 {ERR_PACK(0,X509V3_F_I2S_ASN1_INTEGER,0),       "i2s_ASN1_INTEGER"},
 {ERR_PACK(0,X509V3_F_I2V_AUTHORITY_INFO_ACCESS,0),      "I2V_AUTHORITY_INFO_ACCESS"},
 {ERR_PACK(0,X509V3_F_NOTICE_SECTION,0), "NOTICE_SECTION"},
 {ERR_PACK(0,X509V3_F_NREF_NOS,0),       "NREF_NOS"},
 {ERR_PACK(0,X509V3_F_POLICY_SECTION,0), "POLICY_SECTION"},
 {ERR_PACK(0,X509V3_F_R2I_CERTPOL,0),    "R2I_CERTPOL"},
+{ERR_PACK(0,X509V3_F_R2I_PCI,0),        "R2I_PCI"},
 {ERR_PACK(0,X509V3_F_S2I_ASN1_IA5STRING,0),     "S2I_ASN1_IA5STRING"},
 {ERR_PACK(0,X509V3_F_S2I_ASN1_INTEGER,0),       "s2i_ASN1_INTEGER"},
 {ERR_PACK(0,X509V3_F_S2I_ASN1_OCTET_STRING,0),  "s2i_ASN1_OCTET_STRING"},
@@ -128,6 +130,7 @@ static ERR_STRING_DATA X509V3_str_reasons[]=
 {X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED,"extension setting not supported"},
 {X509V3_R_EXTENSION_VALUE_ERROR          ,"extension value error"},
 {X509V3_R_ILLEGAL_HEX_DIGIT              ,"illegal hex digit"},
+{X509V3_R_INCORRECT_POLICY_SYNTAX_TAG    ,"incorrect policy syntax tag"},
 {X509V3_R_INVALID_BOOLEAN_STRING         ,"invalid boolean string"},
 {X509V3_R_INVALID_EXTENSION_STRING       ,"invalid extension string"},
 {X509V3_R_INVALID_NAME                   ,"invalid name"},
@@ -139,6 +142,8 @@ static ERR_STRING_DATA X509V3_str_reasons[]=
 {X509V3_R_INVALID_OBJECT_IDENTIFIER      ,"invalid object identifier"},
 {X509V3_R_INVALID_OPTION                 ,"invalid option"},
 {X509V3_R_INVALID_POLICY_IDENTIFIER      ,"invalid policy identifier"},
+{X509V3_R_INVALID_PROXY_POLICY_IDENTIFIER,"invalid proxy policy identifier"},
+{X509V3_R_INVALID_PROXY_POLICY_SETTING   ,"invalid proxy policy setting"},
 {X509V3_R_INVALID_PURPOSE                ,"invalid purpose"},
 {X509V3_R_INVALID_SECTION                ,"invalid section"},
 {X509V3_R_INVALID_SYNTAX                 ,"invalid syntax"},
@@ -149,9 +154,16 @@ static ERR_STRING_DATA X509V3_str_reasons[]=
 {X509V3_R_NO_ISSUER_CERTIFICATE          ,"no issuer certificate"},
 {X509V3_R_NO_ISSUER_DETAILS              ,"no issuer details"},
 {X509V3_R_NO_POLICY_IDENTIFIER           ,"no policy identifier"},
+{X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED,"no proxy cert policy language defined"},
 {X509V3_R_NO_PUBLIC_KEY                  ,"no public key"},
 {X509V3_R_NO_SUBJECT_DETAILS             ,"no subject details"},
 {X509V3_R_ODD_NUMBER_OF_DIGITS           ,"odd number of digits"},
+{X509V3_R_POLICY_LANGUAGE_ALREADTY_DEFINED,"policy language alreadty defined"},
+{X509V3_R_POLICY_PATH_LENGTH             ,"policy path length"},
+{X509V3_R_POLICY_PATH_LENGTH_ALREADTY_DEFINED,"policy path length alreadty defined"},
+{X509V3_R_POLICY_SYNTAX_NOT              ,"policy syntax not"},
+{X509V3_R_POLICY_SYNTAX_NOT_CURRENTLY_SUPPORTED,"policy syntax not currently supported"},
+{X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY,"policy when proxy language requires no policy"},
 {X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS   ,"unable to get issuer details"},
 {X509V3_R_UNABLE_TO_GET_ISSUER_KEYID     ,"unable to get issuer keyid"},
 {X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT    ,"unknown bit string argument"},
diff --git a/src/lib/libcrypto/x509v3/x509v3.h b/src/lib/libcrypto/x509v3/x509v3.h
index fb07a19016..e6d91251c2 100644
--- a/src/lib/libcrypto/x509v3/x509v3.h
+++ b/src/lib/libcrypto/x509v3/x509v3.h
@@ -287,6 +287,23 @@ typedef STACK_OF(POLICYINFO) CERTIFICATEPOLICIES;
 DECLARE_STACK_OF(POLICYINFO)
 DECLARE_ASN1_SET_OF(POLICYINFO)
 
+/* Proxy certificate structures, see RFC 3820 */
+typedef struct PROXY_POLICY_st
+        {
+        ASN1_OBJECT *policyLanguage;
+        ASN1_OCTET_STRING *policy;
+        } PROXY_POLICY;
+
+typedef struct PROXY_CERT_INFO_EXTENSION_st
+        {
+        ASN1_INTEGER *pcPathLengthConstraint;
+        PROXY_POLICY *proxyPolicy;
+        } PROXY_CERT_INFO_EXTENSION;
+
+DECLARE_ASN1_FUNCTIONS(PROXY_POLICY)
+DECLARE_ASN1_FUNCTIONS(PROXY_CERT_INFO_EXTENSION)
+
+
 #define X509V3_conf_err(val) ERR_add_error_data(6, "section:", val->section, \
 ",name:", val->name, ",value:", val->value);
 
@@ -325,6 +342,7 @@ DECLARE_ASN1_SET_OF(POLICYINFO)
 #define EXFLAG_INVALID          0x80
 #define EXFLAG_SET              0x100
 #define EXFLAG_CRITICAL         0x200
+#define EXFLAG_PROXY            0x400
 
 #define KU_DIGITAL_SIGNATURE    0x0080
 #define KU_NON_REPUDIATION      0x0040
@@ -527,6 +545,7 @@ int X509V3_EXT_print_fp(FILE *out, X509_EXTENSION *ext, int flag, int indent);
 
 int X509V3_extensions_print(BIO *out, char *title, STACK_OF(X509_EXTENSION) *exts, unsigned long flag, int indent);
 
+int X509_check_ca(X509 *x);
 int X509_check_purpose(X509 *x, int id, int ca);
 int X509_supported_extension(X509_EXTENSION *ex);
 int X509_PURPOSE_set(int *p, int purpose);
@@ -564,12 +583,14 @@ void ERR_load_X509V3_strings(void);
 #define X509V3_F_DO_EXT_I2D                              135
 #define X509V3_F_HEX_TO_STRING                           111
 #define X509V3_F_I2S_ASN1_ENUMERATED                     121
+#define X509V3_F_I2S_ASN1_IA5STRING                      142
 #define X509V3_F_I2S_ASN1_INTEGER                        120
 #define X509V3_F_I2V_AUTHORITY_INFO_ACCESS               138
 #define X509V3_F_NOTICE_SECTION                          132
 #define X509V3_F_NREF_NOS                                133
 #define X509V3_F_POLICY_SECTION                          131
 #define X509V3_F_R2I_CERTPOL                             130
+#define X509V3_F_R2I_PCI                                 142
 #define X509V3_F_S2I_ASN1_IA5STRING                      100
 #define X509V3_F_S2I_ASN1_INTEGER                        108
 #define X509V3_F_S2I_ASN1_OCTET_STRING                   112
@@ -617,6 +638,7 @@ void ERR_load_X509V3_strings(void);
 #define X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED         103
 #define X509V3_R_EXTENSION_VALUE_ERROR                   116
 #define X509V3_R_ILLEGAL_HEX_DIGIT                       113
+#define X509V3_R_INCORRECT_POLICY_SYNTAX_TAG             153
 #define X509V3_R_INVALID_BOOLEAN_STRING                  104
 #define X509V3_R_INVALID_EXTENSION_STRING                105
 #define X509V3_R_INVALID_NAME                            106
@@ -628,6 +650,8 @@ void ERR_load_X509V3_strings(void);
 #define X509V3_R_INVALID_OBJECT_IDENTIFIER               110
 #define X509V3_R_INVALID_OPTION                          138
 #define X509V3_R_INVALID_POLICY_IDENTIFIER               134
+#define X509V3_R_INVALID_PROXY_POLICY_IDENTIFIER         147
+#define X509V3_R_INVALID_PROXY_POLICY_SETTING            151
 #define X509V3_R_INVALID_PURPOSE                         146
 #define X509V3_R_INVALID_SECTION                         135
 #define X509V3_R_INVALID_SYNTAX                          143
@@ -638,9 +662,16 @@ void ERR_load_X509V3_strings(void);
 #define X509V3_R_NO_ISSUER_CERTIFICATE                   121
 #define X509V3_R_NO_ISSUER_DETAILS                       127
 #define X509V3_R_NO_POLICY_IDENTIFIER                    139
+#define X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED   148
 #define X509V3_R_NO_PUBLIC_KEY                           114
 #define X509V3_R_NO_SUBJECT_DETAILS                      125
 #define X509V3_R_ODD_NUMBER_OF_DIGITS                    112
+#define X509V3_R_POLICY_LANGUAGE_ALREADTY_DEFINED        149
+#define X509V3_R_POLICY_PATH_LENGTH                      152
+#define X509V3_R_POLICY_PATH_LENGTH_ALREADTY_DEFINED     150
+#define X509V3_R_POLICY_SYNTAX_NOT                       154
+#define X509V3_R_POLICY_SYNTAX_NOT_CURRENTLY_SUPPORTED   155
+#define X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY 156
 #define X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS            122
 #define X509V3_R_UNABLE_TO_GET_ISSUER_KEYID              123
 #define X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT             111