8 files changed, 399 insertions, 108 deletions

diff --git a/src/lib/libcrypto/x509v3/pcy_cache.c b/src/lib/libcrypto/x509v3/pcy_cache.c
index 1030931b71..172b7e7ee4 100644
--- a/src/lib/libcrypto/x509v3/pcy_cache.c
+++ b/src/lib/libcrypto/x509v3/pcy_cache.c
@@ -139,7 +139,6 @@ static int policy_cache_new(X509 *x)
                 return 0;
         cache->anyPolicy = NULL;
         cache->data = NULL;
-        cache->maps = NULL;
         cache->any_skip = -1;
         cache->explicit_skip = -1;
         cache->map_skip = -1;
diff --git a/src/lib/libcrypto/x509v3/pcy_int.h b/src/lib/libcrypto/x509v3/pcy_int.h
index 3780de4fcd..ccff92846e 100644
--- a/src/lib/libcrypto/x509v3/pcy_int.h
+++ b/src/lib/libcrypto/x509v3/pcy_int.h
@@ -56,12 +56,10 @@
  *
  */
 
-DECLARE_STACK_OF(X509_POLICY_DATA)
-DECLARE_STACK_OF(X509_POLICY_REF)
-DECLARE_STACK_OF(X509_POLICY_NODE)
 
 typedef struct X509_POLICY_DATA_st X509_POLICY_DATA;
-typedef struct X509_POLICY_REF_st X509_POLICY_REF;
+
+DECLARE_STACK_OF(X509_POLICY_DATA)
 
 /* Internal structures */
 
@@ -110,16 +108,6 @@ struct X509_POLICY_DATA_st
 
 #define POLICY_DATA_FLAG_CRITICAL               0x10
 
-/* This structure is an entry from a table of mapped policies which
- * cross reference the policy it refers to.
- */
-
-struct X509_POLICY_REF_st
-        {
-        ASN1_OBJECT *subjectDomainPolicy;
-        const X509_POLICY_DATA *data;
-        };
-
 /* This structure is cached with a certificate */
 
 struct X509_POLICY_CACHE_st {
@@ -127,8 +115,6 @@ struct X509_POLICY_CACHE_st {
         X509_POLICY_DATA *anyPolicy;
         /* other policy data */
         STACK_OF(X509_POLICY_DATA) *data;
-        /* If policyMappings extension present a table of mapped policies */
-        STACK_OF(X509_POLICY_REF) *maps;
         /* If InhibitAnyPolicy present this is its value or -1 if absent. */
         long any_skip;
         /* If policyConstraints and requireExplicitPolicy present this is its
@@ -193,7 +179,7 @@ struct X509_POLICY_TREE_st
 
 /* Internal functions */
 
-X509_POLICY_DATA *policy_data_new(POLICYINFO *policy, ASN1_OBJECT *id,
+X509_POLICY_DATA *policy_data_new(POLICYINFO *policy, const ASN1_OBJECT *id,
                                                                 int crit);
 void policy_data_free(X509_POLICY_DATA *data);
 
@@ -209,15 +195,18 @@ void policy_cache_init(void);
 void policy_cache_free(X509_POLICY_CACHE *cache);
 
 X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
+                                        const X509_POLICY_NODE *parent, 
                                         const ASN1_OBJECT *id);
 
 X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *sk,
                                                 const ASN1_OBJECT *id);
 
 X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
-                        X509_POLICY_DATA *data,
+                        const X509_POLICY_DATA *data,
                         X509_POLICY_NODE *parent,
                         X509_POLICY_TREE *tree);
 void policy_node_free(X509_POLICY_NODE *node);
+int policy_node_match(const X509_POLICY_LEVEL *lvl,
+                      const X509_POLICY_NODE *node, const ASN1_OBJECT *oid);
 
 const X509_POLICY_CACHE *policy_cache_set(X509 *x);
diff --git a/src/lib/libcrypto/x509v3/pcy_map.c b/src/lib/libcrypto/x509v3/pcy_map.c
index f28796e6d4..21163b529d 100644
--- a/src/lib/libcrypto/x509v3/pcy_map.c
+++ b/src/lib/libcrypto/x509v3/pcy_map.c
@@ -62,31 +62,6 @@
 
 #include "pcy_int.h"
 
-static int ref_cmp(const X509_POLICY_REF * const *a,
-                        const X509_POLICY_REF * const *b)
-        {
-        return OBJ_cmp((*a)->subjectDomainPolicy, (*b)->subjectDomainPolicy);
-        }
-
-static void policy_map_free(X509_POLICY_REF *map)
-        {
-        if (map->subjectDomainPolicy)
-                ASN1_OBJECT_free(map->subjectDomainPolicy);
-        OPENSSL_free(map);
-        }
-
-static X509_POLICY_REF *policy_map_find(X509_POLICY_CACHE *cache, ASN1_OBJECT *id)
-        {
-        X509_POLICY_REF tmp;
-        int idx;
-        tmp.subjectDomainPolicy = id;
-
-        idx = sk_X509_POLICY_REF_find(cache->maps, &tmp);
-        if (idx == -1)
-                return NULL;
-        return sk_X509_POLICY_REF_value(cache->maps, idx);
-        }
-
 /* Set policy mapping entries in cache.
  * Note: this modifies the passed POLICY_MAPPINGS structure
  */
@@ -94,7 +69,6 @@ static X509_POLICY_REF *policy_map_find(X509_POLICY_CACHE *cache, ASN1_OBJECT *i
 int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
         {
         POLICY_MAPPING *map;
-        X509_POLICY_REF *ref = NULL;
         X509_POLICY_DATA *data;
         X509_POLICY_CACHE *cache = x->policy_cache;
         int i;
@@ -104,7 +78,6 @@ int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
                 ret = -1;
                 goto bad_mapping;
                 }
-        cache->maps = sk_X509_POLICY_REF_new(ref_cmp);
         for (i = 0; i < sk_POLICY_MAPPING_num(maps); i++)
                 {
                 map = sk_POLICY_MAPPING_value(maps, i);
@@ -116,13 +89,6 @@ int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
                         goto bad_mapping;
                         }
 
-                /* If we've already mapped from this OID bad mapping */
-                if (policy_map_find(cache, map->subjectDomainPolicy) != NULL)
-                        {
-                        ret = -1;
-                        goto bad_mapping;
-                        }
-
                 /* Attempt to find matching policy data */
                 data = policy_cache_find_data(cache, map->issuerDomainPolicy);
                 /* If we don't have anyPolicy can't map */
@@ -138,7 +104,7 @@ int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
                         if (!data)
                                 goto bad_mapping;
                         data->qualifier_set = cache->anyPolicy->qualifier_set;
-                        map->issuerDomainPolicy = NULL;
+                        /*map->issuerDomainPolicy = NULL;*/
                         data->flags |= POLICY_DATA_FLAG_MAPPED_ANY;
                         data->flags |= POLICY_DATA_FLAG_SHARED_QUALIFIERS;
                         if (!sk_X509_POLICY_DATA_push(cache->data, data))
@@ -149,23 +115,10 @@ int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
                         }
                 else
                         data->flags |= POLICY_DATA_FLAG_MAPPED;
-
                 if (!sk_ASN1_OBJECT_push(data->expected_policy_set, 
                                                 map->subjectDomainPolicy))
                         goto bad_mapping;
-                
-                ref = OPENSSL_malloc(sizeof(X509_POLICY_REF));
-                if (!ref)
-                        goto bad_mapping;
-
-                ref->subjectDomainPolicy = map->subjectDomainPolicy;
                 map->subjectDomainPolicy = NULL;
-                ref->data = data;
-
-                if (!sk_X509_POLICY_REF_push(cache->maps, ref))
-                        goto bad_mapping;
-
-                ref = NULL;
 
                 }
 
@@ -173,13 +126,6 @@ int policy_cache_set_mapping(X509 *x, POLICY_MAPPINGS *maps)
         bad_mapping:
         if (ret == -1)
                 x->ex_flags |= EXFLAG_INVALID_POLICY;
-        if (ref)
-                policy_map_free(ref);
-        if (ret <= 0)
-                {
-                sk_X509_POLICY_REF_pop_free(cache->maps, policy_map_free);
-                cache->maps = NULL;
-                }
         sk_POLICY_MAPPING_pop_free(maps, POLICY_MAPPING_free);
         return ret;
 
diff --git a/src/lib/libcrypto/x509v3/pcy_node.c b/src/lib/libcrypto/x509v3/pcy_node.c
index 6587cb05ab..bd1e7f1ae8 100644
--- a/src/lib/libcrypto/x509v3/pcy_node.c
+++ b/src/lib/libcrypto/x509v3/pcy_node.c
@@ -92,13 +92,25 @@ X509_POLICY_NODE *tree_find_sk(STACK_OF(X509_POLICY_NODE) *nodes,
         }
 
 X509_POLICY_NODE *level_find_node(const X509_POLICY_LEVEL *level,
+                                        const X509_POLICY_NODE *parent, 
                                         const ASN1_OBJECT *id)
         {
-        return tree_find_sk(level->nodes, id);
+        X509_POLICY_NODE *node;
+        int i;
+        for (i = 0; i < sk_X509_POLICY_NODE_num(level->nodes); i++)
+                {
+                node = sk_X509_POLICY_NODE_value(level->nodes, i);
+                if (node->parent == parent)
+                        {
+                        if (!OBJ_cmp(node->data->valid_policy, id))
+                                return node;
+                        }
+                }
+        return NULL;
         }
 
 X509_POLICY_NODE *level_add_node(X509_POLICY_LEVEL *level,
-                        X509_POLICY_DATA *data,
+                        const X509_POLICY_DATA *data,
                         X509_POLICY_NODE *parent,
                         X509_POLICY_TREE *tree)
         {
@@ -155,4 +167,31 @@ void policy_node_free(X509_POLICY_NODE *node)
         OPENSSL_free(node);
         }
 
+/* See if a policy node matches a policy OID. If mapping enabled look through
+ * expected policy set otherwise just valid policy.
+ */
+
+int policy_node_match(const X509_POLICY_LEVEL *lvl,
+                      const X509_POLICY_NODE *node, const ASN1_OBJECT *oid)
+        {
+        int i;
+        ASN1_OBJECT *policy_oid;
+        const X509_POLICY_DATA *x = node->data;
+
+        if (        (lvl->flags & X509_V_FLAG_INHIBIT_MAP)
+                || !(x->flags & POLICY_DATA_FLAG_MAP_MASK))
+                {
+                if (!OBJ_cmp(x->valid_policy, oid))
+                        return 1;
+                return 0;
+                }
+
+        for (i = 0; i < sk_ASN1_OBJECT_num(x->expected_policy_set); i++)
+                {
+                policy_oid = sk_ASN1_OBJECT_value(x->expected_policy_set, i);
+                if (!OBJ_cmp(policy_oid, oid))
+                        return 1;
+                }
+        return 0;
 
+        }
diff --git a/src/lib/libcrypto/x509v3/v3_ncons.c b/src/lib/libcrypto/x509v3/v3_ncons.c
index 4e706be3e1..689df46acd 100644
--- a/src/lib/libcrypto/x509v3/v3_ncons.c
+++ b/src/lib/libcrypto/x509v3/v3_ncons.c
@@ -63,15 +63,22 @@
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
-static void *v2i_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method,
-                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
-static int i2r_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method, 
+static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method,
+                                  X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
+static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, 
                                 void *a, BIO *bp, int ind);
-static int do_i2r_name_constraints(X509V3_EXT_METHOD *method,
-                                STACK_OF(GENERAL_SUBTREE) *trees,
-                                        BIO *bp, int ind, char *name);
+static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method,
+                                   STACK_OF(GENERAL_SUBTREE) *trees,
+                                   BIO *bp, int ind, char *name);
 static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip);
 
+static int nc_match(GENERAL_NAME *gen, NAME_CONSTRAINTS *nc);
+static int nc_match_single(GENERAL_NAME *sub, GENERAL_NAME *gen);
+static int nc_dn(X509_NAME *sub, X509_NAME *nm);
+static int nc_dns(ASN1_IA5STRING *sub, ASN1_IA5STRING *dns);
+static int nc_email(ASN1_IA5STRING *sub, ASN1_IA5STRING *eml);
+static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base);
+
 const X509V3_EXT_METHOD v3_name_constraints = {
         NID_name_constraints, 0,
         ASN1_ITEM_ref(NAME_CONSTRAINTS),
@@ -99,8 +106,8 @@ ASN1_SEQUENCE(NAME_CONSTRAINTS) = {
 IMPLEMENT_ASN1_ALLOC_FUNCTIONS(GENERAL_SUBTREE)
 IMPLEMENT_ASN1_ALLOC_FUNCTIONS(NAME_CONSTRAINTS)
 
-static void *v2i_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method,
-                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
+static void *v2i_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method,
+                                  X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
         {
         int i;
         CONF_VALUE tval, *val;
@@ -155,8 +162,8 @@ static void *v2i_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method,
 
         
 
-static int i2r_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method,
-                                void *a, BIO *bp, int ind)
+static int i2r_NAME_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a,
+                                BIO *bp, int ind)
         {
         NAME_CONSTRAINTS *ncons = a;
         do_i2r_name_constraints(method, ncons->permittedSubtrees,
@@ -166,9 +173,9 @@ static int i2r_NAME_CONSTRAINTS(X509V3_EXT_METHOD *method,
         return 1;
         }
 
-static int do_i2r_name_constraints(X509V3_EXT_METHOD *method,
-                                STACK_OF(GENERAL_SUBTREE) *trees,
-                                        BIO *bp, int ind, char *name)
+static int do_i2r_name_constraints(const X509V3_EXT_METHOD *method,
+                                   STACK_OF(GENERAL_SUBTREE) *trees,
+                                   BIO *bp, int ind, char *name)
         {
         GENERAL_SUBTREE *tree;
         int i;
@@ -218,3 +225,282 @@ static int print_nc_ipadd(BIO *bp, ASN1_OCTET_STRING *ip)
         return 1;
         }
 
+/* Check a certificate conforms to a specified set of constraints.
+ * Return values:
+ *  X509_V_OK: All constraints obeyed.
+ *  X509_V_ERR_PERMITTED_VIOLATION: Permitted subtree violation.
+ *  X509_V_ERR_EXCLUDED_VIOLATION: Excluded subtree violation.
+ *  X509_V_ERR_SUBTREE_MINMAX: Min or max values present and matching type.
+ *  X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE:  Unsupported constraint type.
+ *  X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX: bad unsupported constraint syntax.
+ *  X509_V_ERR_UNSUPPORTED_NAME_SYNTAX: bad or unsupported syntax of name
+
+ */
+
+int NAME_CONSTRAINTS_check(X509 *x, NAME_CONSTRAINTS *nc)
+        {
+        int r, i;
+        X509_NAME *nm;
+
+        nm = X509_get_subject_name(x);
+
+        if (X509_NAME_entry_count(nm) > 0)
+                {
+                GENERAL_NAME gntmp;
+                gntmp.type = GEN_DIRNAME;
+                gntmp.d.directoryName = nm;
+
+                r = nc_match(&gntmp, nc);
+
+                if (r != X509_V_OK)
+                        return r;
+
+                gntmp.type = GEN_EMAIL;
+
+
+                /* Process any email address attributes in subject name */
+
+                for (i = -1;;)
+                        {
+                        X509_NAME_ENTRY *ne;
+                        i = X509_NAME_get_index_by_NID(nm,
+                                                       NID_pkcs9_emailAddress,
+                                                       i);
+                        if (i == -1)
+                                break;
+                        ne = X509_NAME_get_entry(nm, i);
+                        gntmp.d.rfc822Name = X509_NAME_ENTRY_get_data(ne);
+                        if (gntmp.d.rfc822Name->type != V_ASN1_IA5STRING)
+                                return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
+
+                        r = nc_match(&gntmp, nc);
+
+                        if (r != X509_V_OK)
+                                return r;
+                        }
+                
+                }
+
+        for (i = 0; i < sk_GENERAL_NAME_num(x->altname); i++)
+                {
+                GENERAL_NAME *gen = sk_GENERAL_NAME_value(x->altname, i);
+                r = nc_match(gen, nc);
+                if (r != X509_V_OK)
+                        return r;
+                }
+
+        return X509_V_OK;
+
+        }
+
+static int nc_match(GENERAL_NAME *gen, NAME_CONSTRAINTS *nc)
+        {
+        GENERAL_SUBTREE *sub;
+        int i, r, match = 0;
+
+        /* Permitted subtrees: if any subtrees exist of matching the type
+         * at least one subtree must match.
+         */
+
+        for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->permittedSubtrees); i++)
+                {
+                sub = sk_GENERAL_SUBTREE_value(nc->permittedSubtrees, i);
+                if (gen->type != sub->base->type)
+                        continue;
+                if (sub->minimum || sub->maximum)
+                        return X509_V_ERR_SUBTREE_MINMAX;
+                /* If we already have a match don't bother trying any more */
+                if (match == 2)
+                        continue;
+                if (match == 0)
+                        match = 1;
+                r = nc_match_single(gen, sub->base);
+                if (r == X509_V_OK)
+                        match = 2;
+                else if (r != X509_V_ERR_PERMITTED_VIOLATION)
+                        return r;
+                }
+
+        if (match == 1)
+                return X509_V_ERR_PERMITTED_VIOLATION;
+
+        /* Excluded subtrees: must not match any of these */
+
+        for (i = 0; i < sk_GENERAL_SUBTREE_num(nc->excludedSubtrees); i++)
+                {
+                sub = sk_GENERAL_SUBTREE_value(nc->excludedSubtrees, i);
+                if (gen->type != sub->base->type)
+                        continue;
+                if (sub->minimum || sub->maximum)
+                        return X509_V_ERR_SUBTREE_MINMAX;
+
+                r = nc_match_single(gen, sub->base);
+                if (r == X509_V_OK)
+                        return X509_V_ERR_EXCLUDED_VIOLATION;
+                else if (r != X509_V_ERR_PERMITTED_VIOLATION)
+                        return r;
+
+                }
+
+        return X509_V_OK;
+
+        }
+
+static int nc_match_single(GENERAL_NAME *gen, GENERAL_NAME *base)
+        {
+        switch(base->type)
+                {
+                case GEN_DIRNAME:
+                return nc_dn(gen->d.directoryName, base->d.directoryName);
+
+                case GEN_DNS:
+                return nc_dns(gen->d.dNSName, base->d.dNSName);
+
+                case GEN_EMAIL:
+                return nc_email(gen->d.rfc822Name, base->d.rfc822Name);
+
+                case GEN_URI:
+                return nc_uri(gen->d.uniformResourceIdentifier,
+                                        base->d.uniformResourceIdentifier);
+
+                default:
+                return X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE;
+                }
+
+        }
+
+/* directoryName name constraint matching.
+ * The canonical encoding of X509_NAME makes this comparison easy. It is
+ * matched if the subtree is a subset of the name.
+ */
+
+static int nc_dn(X509_NAME *nm, X509_NAME *base)
+        {
+        /* Ensure canonical encodings are up to date.  */
+        if (nm->modified && i2d_X509_NAME(nm, NULL) < 0)
+                return X509_V_ERR_OUT_OF_MEM;
+        if (base->modified && i2d_X509_NAME(base, NULL) < 0)
+                return X509_V_ERR_OUT_OF_MEM;
+        if (base->canon_enclen > nm->canon_enclen)
+                return X509_V_ERR_PERMITTED_VIOLATION;
+        if (memcmp(base->canon_enc, nm->canon_enc, base->canon_enclen))
+                return X509_V_ERR_PERMITTED_VIOLATION;
+        return X509_V_OK;
+        }
+
+static int nc_dns(ASN1_IA5STRING *dns, ASN1_IA5STRING *base)
+        {
+        char *baseptr = (char *)base->data;
+        char *dnsptr = (char *)dns->data;
+        /* Empty matches everything */
+        if (!*baseptr)
+                return X509_V_OK;
+        /* Otherwise can add zero or more components on the left so
+         * compare RHS and if dns is longer and expect '.' as preceding
+         * character.
+         */
+        if (dns->length > base->length)
+                {
+                dnsptr += dns->length - base->length;
+                if (dnsptr[-1] != '.')
+                        return X509_V_ERR_PERMITTED_VIOLATION;
+                }
+
+        if (strcasecmp(baseptr, dnsptr))
+                        return X509_V_ERR_PERMITTED_VIOLATION;
+
+        return X509_V_OK;
+
+        }
+
+static int nc_email(ASN1_IA5STRING *eml, ASN1_IA5STRING *base)
+        {
+        const char *baseptr = (char *)base->data;
+        const char *emlptr = (char *)eml->data;
+
+        const char *baseat = strchr(baseptr, '@');
+        const char *emlat = strchr(emlptr, '@');
+        if (!emlat)
+                return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
+        /* Special case: inital '.' is RHS match */
+        if (!baseat && (*baseptr == '.'))
+                {
+                if (eml->length > base->length)
+                        {
+                        emlptr += eml->length - base->length;
+                        if (!strcasecmp(baseptr, emlptr))
+                                return X509_V_OK;
+                        }
+                return X509_V_ERR_PERMITTED_VIOLATION;
+                }
+
+        /* If we have anything before '@' match local part */
+
+        if (baseat)
+                {
+                if (baseat != baseptr)
+                        {
+                        if ((baseat - baseptr) != (emlat - emlptr))
+                                return X509_V_ERR_PERMITTED_VIOLATION;
+                        /* Case sensitive match of local part */
+                        if (strncmp(baseptr, emlptr, emlat - emlptr))
+                                return X509_V_ERR_PERMITTED_VIOLATION;
+                        }
+                /* Position base after '@' */
+                baseptr = baseat + 1;
+                }
+        emlptr = emlat + 1;
+        /* Just have hostname left to match: case insensitive */
+        if (strcasecmp(baseptr, emlptr))
+                return X509_V_ERR_PERMITTED_VIOLATION;
+
+        return X509_V_OK;
+
+        }
+
+static int nc_uri(ASN1_IA5STRING *uri, ASN1_IA5STRING *base)
+        {
+        const char *baseptr = (char *)base->data;
+        const char *hostptr = (char *)uri->data;
+        const char *p = strchr(hostptr, ':');
+        int hostlen;
+        /* Check for foo:// and skip past it */
+        if (!p || (p[1] != '/') || (p[2] != '/'))
+                return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
+        hostptr = p + 3;
+
+        /* Determine length of hostname part of URI */
+
+        /* Look for a port indicator as end of hostname first */
+
+        p = strchr(hostptr, ':');
+        /* Otherwise look for trailing slash */
+        if (!p)
+                p = strchr(hostptr, '/');
+
+        if (!p)
+                hostlen = strlen(hostptr);
+        else
+                hostlen = p - hostptr;
+
+        if (hostlen == 0)
+                return X509_V_ERR_UNSUPPORTED_NAME_SYNTAX;
+
+        /* Special case: inital '.' is RHS match */
+        if (*baseptr == '.')
+                {
+                if (hostlen > base->length)
+                        {
+                        p = hostptr + hostlen - base->length;
+                        if (!strncasecmp(p, baseptr, base->length))
+                                return X509_V_OK;
+                        }
+                return X509_V_ERR_PERMITTED_VIOLATION;
+                }
+
+        if ((base->length != (int)hostlen) || strncasecmp(hostptr, baseptr, hostlen))
+                return X509_V_ERR_PERMITTED_VIOLATION;
+
+        return X509_V_OK;
+
+        }
diff --git a/src/lib/libcrypto/x509v3/v3_pci.c b/src/lib/libcrypto/x509v3/v3_pci.c
index 601211f416..0dcfa004fe 100644
--- a/src/lib/libcrypto/x509v3/v3_pci.c
+++ b/src/lib/libcrypto/x509v3/v3_pci.c
@@ -82,7 +82,7 @@ static int process_pci_value(CONF_VALUE *val,
                 {
                 if (*language)
                         {
-                        X509V3err(X509V3_F_PROCESS_PCI_VALUE,X509V3_R_POLICY_LANGUAGE_ALREADTY_DEFINED);
+                        X509V3err(X509V3_F_PROCESS_PCI_VALUE,X509V3_R_POLICY_LANGUAGE_ALREADY_DEFINED);
                         X509V3_conf_err(val);
                         return 0;
                         }
@@ -97,7 +97,7 @@ static int process_pci_value(CONF_VALUE *val,
                 {
                 if (*pathlen)
                         {
-                        X509V3err(X509V3_F_PROCESS_PCI_VALUE,X509V3_R_POLICY_PATH_LENGTH_ALREADTY_DEFINED);
+                        X509V3err(X509V3_F_PROCESS_PCI_VALUE,X509V3_R_POLICY_PATH_LENGTH_ALREADY_DEFINED);
                         X509V3_conf_err(val);
                         return 0;
                         }
@@ -128,7 +128,12 @@ static int process_pci_value(CONF_VALUE *val,
                         unsigned char *tmp_data2 =
                                 string_to_hex(val->value + 4, &val_len);
 
-                        if (!tmp_data2) goto err;
+                        if (!tmp_data2) 
+                                {
+                                X509V3err(X509V3_F_PROCESS_PCI_VALUE,X509V3_R_ILLEGAL_HEX_DIGIT);
+                                X509V3_conf_err(val);
+                                goto err;
+                                }
 
                         tmp_data = OPENSSL_realloc((*policy)->data,
                                 (*policy)->length + val_len + 1);
@@ -140,6 +145,17 @@ static int process_pci_value(CONF_VALUE *val,
                                 (*policy)->length += val_len;
                                 (*policy)->data[(*policy)->length] = '\0';
                                 }
+                        else
+                                {
+                                OPENSSL_free(tmp_data2);
+                                /* realloc failure implies the original data space is b0rked too! */
+                                (*policy)->data = NULL;
+                                (*policy)->length = 0;
+                                X509V3err(X509V3_F_PROCESS_PCI_VALUE,ERR_R_MALLOC_FAILURE);
+                                X509V3_conf_err(val);
+                                goto err;
+                                }
+                        OPENSSL_free(tmp_data2);
                         }
                 else if (strncmp(val->value, "file:", 5) == 0)
                         {
@@ -169,6 +185,7 @@ static int process_pci_value(CONF_VALUE *val,
                                 (*policy)->length += n;
                                 (*policy)->data[(*policy)->length] = '\0';
                                 }
+                        BIO_free_all(b);
 
                         if (n < 0)
                                 {
@@ -190,6 +207,15 @@ static int process_pci_value(CONF_VALUE *val,
                                 (*policy)->length += val_len;
                                 (*policy)->data[(*policy)->length] = '\0';
                                 }
+                        else
+                                {
+                                /* realloc failure implies the original data space is b0rked too! */
+                                (*policy)->data = NULL;
+                                (*policy)->length = 0;
+                                X509V3err(X509V3_F_PROCESS_PCI_VALUE,ERR_R_MALLOC_FAILURE);
+                                X509V3_conf_err(val);
+                                goto err;
+                                }
                         }
                 else
                         {
diff --git a/src/lib/libcrypto/x509v3/v3_pcons.c b/src/lib/libcrypto/x509v3/v3_pcons.c
index 86c0ff70e6..30ca652351 100644
--- a/src/lib/libcrypto/x509v3/v3_pcons.c
+++ b/src/lib/libcrypto/x509v3/v3_pcons.c
@@ -64,10 +64,12 @@
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
-static STACK_OF(CONF_VALUE) *i2v_POLICY_CONSTRAINTS(X509V3_EXT_METHOD *method,
-                                void *bcons, STACK_OF(CONF_VALUE) *extlist);
-static void *v2i_POLICY_CONSTRAINTS(X509V3_EXT_METHOD *method,
-                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values);
+static STACK_OF(CONF_VALUE) *
+i2v_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *bcons,
+                       STACK_OF(CONF_VALUE) *extlist);
+static void *v2i_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method,
+                                    X509V3_CTX *ctx,
+                                    STACK_OF(CONF_VALUE) *values);
 
 const X509V3_EXT_METHOD v3_policy_constraints = {
 NID_policy_constraints, 0,
@@ -88,8 +90,9 @@ ASN1_SEQUENCE(POLICY_CONSTRAINTS) = {
 IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICY_CONSTRAINTS)
 
 
-static STACK_OF(CONF_VALUE) *i2v_POLICY_CONSTRAINTS(X509V3_EXT_METHOD *method,
-             void *a, STACK_OF(CONF_VALUE) *extlist)
+static STACK_OF(CONF_VALUE) *
+i2v_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method, void *a,
+                       STACK_OF(CONF_VALUE) *extlist)
 {
         POLICY_CONSTRAINTS *pcons = a;
         X509V3_add_value_int("Require Explicit Policy",
@@ -99,8 +102,9 @@ static STACK_OF(CONF_VALUE) *i2v_POLICY_CONSTRAINTS(X509V3_EXT_METHOD *method,
         return extlist;
 }
 
-static void *v2i_POLICY_CONSTRAINTS(X509V3_EXT_METHOD *method,
-             X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *values)
+static void *v2i_POLICY_CONSTRAINTS(const X509V3_EXT_METHOD *method,
+                                    X509V3_CTX *ctx,
+                                    STACK_OF(CONF_VALUE) *values)
 {
         POLICY_CONSTRAINTS *pcons=NULL;
         CONF_VALUE *val;
diff --git a/src/lib/libcrypto/x509v3/v3_pmaps.c b/src/lib/libcrypto/x509v3/v3_pmaps.c
index da03bbc35d..865bcd3980 100644
--- a/src/lib/libcrypto/x509v3/v3_pmaps.c
+++ b/src/lib/libcrypto/x509v3/v3_pmaps.c
@@ -63,10 +63,11 @@
 #include <openssl/conf.h>
 #include <openssl/x509v3.h>
 
-static void *v2i_POLICY_MAPPINGS(X509V3_EXT_METHOD *method,
-                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
-static STACK_OF(CONF_VALUE) *i2v_POLICY_MAPPINGS(X509V3_EXT_METHOD *method,
-                                void *pmps, STACK_OF(CONF_VALUE) *extlist);
+static void *v2i_POLICY_MAPPINGS(const X509V3_EXT_METHOD *method,
+                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval);
+static STACK_OF(CONF_VALUE) *
+i2v_POLICY_MAPPINGS(const X509V3_EXT_METHOD *method, void *pmps,
+                    STACK_OF(CONF_VALUE) *extlist);
 
 const X509V3_EXT_METHOD v3_policy_mappings = {
         NID_policy_mappings, 0,
@@ -92,8 +93,9 @@ ASN1_ITEM_TEMPLATE_END(POLICY_MAPPINGS)
 IMPLEMENT_ASN1_ALLOC_FUNCTIONS(POLICY_MAPPING)
 
 
-static STACK_OF(CONF_VALUE) *i2v_POLICY_MAPPINGS(X509V3_EXT_METHOD *method,
-                void *a, STACK_OF(CONF_VALUE) *ext_list)
+static STACK_OF(CONF_VALUE) *
+i2v_POLICY_MAPPINGS(const X509V3_EXT_METHOD *method, void *a,
+                    STACK_OF(CONF_VALUE) *ext_list)
 {
         POLICY_MAPPINGS *pmaps = a;
         POLICY_MAPPING *pmap;
@@ -109,8 +111,8 @@ static STACK_OF(CONF_VALUE) *i2v_POLICY_MAPPINGS(X509V3_EXT_METHOD *method,
         return ext_list;
 }
 
-static void *v2i_POLICY_MAPPINGS(X509V3_EXT_METHOD *method,
-                                X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
+static void *v2i_POLICY_MAPPINGS(const X509V3_EXT_METHOD *method,
+                                 X509V3_CTX *ctx, STACK_OF(CONF_VALUE) *nval)
 {
         POLICY_MAPPINGS *pmaps;
         POLICY_MAPPING *pmap;