grpc 1.15.0 → 1.30.0

data/third_party/boringssl/crypto/x509v3/v3_lib.c

@@ -1,370 +0,0 @@
-/* v3_lib.c */
-/*
- * Written by Dr Stephen N Henson (steve@openssl.org) for the OpenSSL project
- * 1999.
- */
-/* ====================================================================
- * Copyright (c) 1999 The OpenSSL Project.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in
- *    the documentation and/or other materials provided with the
- *    distribution.
- *
- * 3. All advertising materials mentioning features or use of this
- *    software must display the following acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
- *
- * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
- *    endorse or promote products derived from this software without
- *    prior written permission. For written permission, please contact
- *    licensing@OpenSSL.org.
- *
- * 5. Products derived from this software may not be called "OpenSSL"
- *    nor may "OpenSSL" appear in their names without prior written
- *    permission of the OpenSSL Project.
- *
- * 6. Redistributions of any form whatsoever must retain the following
- *    acknowledgment:
- *    "This product includes software developed by the OpenSSL Project
- *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
- *
- * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
- * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR
- * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- * ====================================================================
- *
- * This product includes cryptographic software written by Eric Young
- * (eay@cryptsoft.com).  This product includes software written by Tim
- * Hudson (tjh@cryptsoft.com).
- *
- */
-/* X509 v3 extension utilities */
-
-#include <stdio.h>
-
-#include <openssl/conf.h>
-#include <openssl/err.h>
-#include <openssl/mem.h>
-#include <openssl/obj.h>
-#include <openssl/x509v3.h>
-
-#include "ext_dat.h"
-static STACK_OF(X509V3_EXT_METHOD) *ext_list = NULL;
-
-static void ext_list_free(X509V3_EXT_METHOD *ext);
-
-static int ext_stack_cmp(const X509V3_EXT_METHOD **a,
-                         const X509V3_EXT_METHOD **b)
-{
-    return ((*a)->ext_nid - (*b)->ext_nid);
-}
-
-int X509V3_EXT_add(X509V3_EXT_METHOD *ext)
-{
-    if (!ext_list && !(ext_list = sk_X509V3_EXT_METHOD_new(ext_stack_cmp))) {
-        OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
-        ext_list_free(ext);
-        return 0;
-    }
-    if (!sk_X509V3_EXT_METHOD_push(ext_list, ext)) {
-        OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
-        ext_list_free(ext);
-        return 0;
-    }
-    return 1;
-}
-
-static int ext_cmp(const void *void_a, const void *void_b)
-{
-    const X509V3_EXT_METHOD **a = (const X509V3_EXT_METHOD **)void_a;
-    const X509V3_EXT_METHOD **b = (const X509V3_EXT_METHOD **)void_b;
-    return ext_stack_cmp(a, b);
-}
-
-const X509V3_EXT_METHOD *X509V3_EXT_get_nid(int nid)
-{
-    X509V3_EXT_METHOD tmp;
-    const X509V3_EXT_METHOD *t = &tmp, *const *ret;
-    size_t idx;
-
-    if (nid < 0)
-        return NULL;
-    tmp.ext_nid = nid;
-    ret =
-        bsearch(&t, standard_exts, STANDARD_EXTENSION_COUNT,
-                sizeof(X509V3_EXT_METHOD *), ext_cmp);
-    if (ret)
-        return *ret;
-    if (!ext_list)
-        return NULL;
-
-    if (!sk_X509V3_EXT_METHOD_find(ext_list, &idx, &tmp))
-        return NULL;
-    return sk_X509V3_EXT_METHOD_value(ext_list, idx);
-}
-
-const X509V3_EXT_METHOD *X509V3_EXT_get(X509_EXTENSION *ext)
-{
-    int nid;
-    if ((nid = OBJ_obj2nid(ext->object)) == NID_undef)
-        return NULL;
-    return X509V3_EXT_get_nid(nid);
-}
-
-int X509V3_EXT_free(int nid, void *ext_data)
-{
-    const X509V3_EXT_METHOD *ext_method = X509V3_EXT_get_nid(nid);
-    if (ext_method == NULL) {
-        OPENSSL_PUT_ERROR(X509V3, X509V3_R_CANNOT_FIND_FREE_FUNCTION);
-        return 0;
-    }
-
-    if (ext_method->it != NULL)
-        ASN1_item_free(ext_data, ASN1_ITEM_ptr(ext_method->it));
-    else if (ext_method->ext_free != NULL)
-        ext_method->ext_free(ext_data);
-    else {
-        OPENSSL_PUT_ERROR(X509V3, X509V3_R_CANNOT_FIND_FREE_FUNCTION);
-        return 0;
-    }
-
-    return 1;
-}
-
-int X509V3_EXT_add_list(X509V3_EXT_METHOD *extlist)
-{
-    for (; extlist->ext_nid != -1; extlist++)
-        if (!X509V3_EXT_add(extlist))
-            return 0;
-    return 1;
-}
-
-int X509V3_EXT_add_alias(int nid_to, int nid_from)
-{
-    const X509V3_EXT_METHOD *ext;
-    X509V3_EXT_METHOD *tmpext;
-
-    if (!(ext = X509V3_EXT_get_nid(nid_from))) {
-        OPENSSL_PUT_ERROR(X509V3, X509V3_R_EXTENSION_NOT_FOUND);
-        return 0;
-    }
-    if (!
-        (tmpext =
-         (X509V3_EXT_METHOD *)OPENSSL_malloc(sizeof(X509V3_EXT_METHOD)))) {
-        OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
-        return 0;
-    }
-    *tmpext = *ext;
-    tmpext->ext_nid = nid_to;
-    tmpext->ext_flags |= X509V3_EXT_DYNAMIC;
-    return X509V3_EXT_add(tmpext);
-}
-
-void X509V3_EXT_cleanup(void)
-{
-    sk_X509V3_EXT_METHOD_pop_free(ext_list, ext_list_free);
-    ext_list = NULL;
-}
-
-static void ext_list_free(X509V3_EXT_METHOD *ext)
-{
-    if (ext->ext_flags & X509V3_EXT_DYNAMIC)
-        OPENSSL_free(ext);
-}
-
-/*
- * Legacy function: we don't need to add standard extensions any more because
- * they are now kept in ext_dat.h.
- */
-
-int X509V3_add_standard_extensions(void)
-{
-    return 1;
-}
-
-/* Return an extension internal structure */
-
-void *X509V3_EXT_d2i(X509_EXTENSION *ext)
-{
-    const X509V3_EXT_METHOD *method;
-    const unsigned char *p;
-
-    if (!(method = X509V3_EXT_get(ext)))
-        return NULL;
-    p = ext->value->data;
-    if (method->it)
-        return ASN1_item_d2i(NULL, &p, ext->value->length,
-                             ASN1_ITEM_ptr(method->it));
-    return method->d2i(NULL, &p, ext->value->length);
-}
-
-/*
- * Get critical flag and decoded version of extension from a NID. The "idx"
- * variable returns the last found extension and can be used to retrieve
- * multiple extensions of the same NID. However multiple extensions with the
- * same NID is usually due to a badly encoded certificate so if idx is NULL
- * we choke if multiple extensions exist. The "crit" variable is set to the
- * critical value. The return value is the decoded extension or NULL on
- * error. The actual error can have several different causes, the value of
- * *crit reflects the cause: >= 0, extension found but not decoded (reflects
- * critical value). -1 extension not found. -2 extension occurs more than
- * once.
- */
-
-void *X509V3_get_d2i(STACK_OF(X509_EXTENSION) *x, int nid, int *crit,
-                     int *idx)
-{
-    int lastpos;
-    size_t i;
-    X509_EXTENSION *ex, *found_ex = NULL;
-    if (!x) {
-        if (idx)
-            *idx = -1;
-        if (crit)
-            *crit = -1;
-        return NULL;
-    }
-    if (idx)
-        lastpos = *idx + 1;
-    else
-        lastpos = 0;
-    if (lastpos < 0)
-        lastpos = 0;
-    for (i = lastpos; i < sk_X509_EXTENSION_num(x); i++) {
-        ex = sk_X509_EXTENSION_value(x, i);
-        if (OBJ_obj2nid(ex->object) == nid) {
-            if (idx) {
-                *idx = i;
-                found_ex = ex;
-                break;
-            } else if (found_ex) {
-                /* Found more than one */
-                if (crit)
-                    *crit = -2;
-                return NULL;
-            }
-            found_ex = ex;
-        }
-    }
-    if (found_ex) {
-        /* Found it */
-        if (crit)
-            *crit = X509_EXTENSION_get_critical(found_ex);
-        return X509V3_EXT_d2i(found_ex);
-    }
-
-    /* Extension not found */
-    if (idx)
-        *idx = -1;
-    if (crit)
-        *crit = -1;
-    return NULL;
-}
-
-/*
- * This function is a general extension append, replace and delete utility.
- * The precise operation is governed by the 'flags' value. The 'crit' and
- * 'value' arguments (if relevant) are the extensions internal structure.
- */
-
-int X509V3_add1_i2d(STACK_OF(X509_EXTENSION) **x, int nid, void *value,
-                    int crit, unsigned long flags)
-{
-    int errcode, extidx = -1;
-    X509_EXTENSION *ext = NULL, *extmp;
-    STACK_OF(X509_EXTENSION) *ret = NULL;
-    unsigned long ext_op = flags & X509V3_ADD_OP_MASK;
-
-    /*
-     * If appending we don't care if it exists, otherwise look for existing
-     * extension.
-     */
-    if (ext_op != X509V3_ADD_APPEND)
-        extidx = X509v3_get_ext_by_NID(*x, nid, -1);
-
-    /* See if extension exists */
-    if (extidx >= 0) {
-        /* If keep existing, nothing to do */
-        if (ext_op == X509V3_ADD_KEEP_EXISTING)
-            return 1;
-        /* If default then its an error */
-        if (ext_op == X509V3_ADD_DEFAULT) {
-            errcode = X509V3_R_EXTENSION_EXISTS;
-            goto err;
-        }
-        /* If delete, just delete it */
-        if (ext_op == X509V3_ADD_DELETE) {
-            if (!sk_X509_EXTENSION_delete(*x, extidx))
-                return -1;
-            return 1;
-        }
-    } else {
-        /*
-         * If replace existing or delete, error since extension must exist
-         */
-        if ((ext_op == X509V3_ADD_REPLACE_EXISTING) ||
-            (ext_op == X509V3_ADD_DELETE)) {
-            errcode = X509V3_R_EXTENSION_NOT_FOUND;
-            goto err;
-        }
-    }
-
-    /*
-     * If we get this far then we have to create an extension: could have
-     * some flags for alternative encoding schemes...
-     */
-
-    ext = X509V3_EXT_i2d(nid, crit, value);
-
-    if (!ext) {
-        OPENSSL_PUT_ERROR(X509V3, X509V3_R_ERROR_CREATING_EXTENSION);
-        return 0;
-    }
-
-    /* If extension exists replace it.. */
-    if (extidx >= 0) {
-        extmp = sk_X509_EXTENSION_value(*x, extidx);
-        X509_EXTENSION_free(extmp);
-        if (!sk_X509_EXTENSION_set(*x, extidx, ext))
-            return -1;
-        return 1;
-    }
-
-    if ((ret = *x) == NULL
-         && (ret = sk_X509_EXTENSION_new_null()) == NULL)
-        goto m_fail;
-    if (!sk_X509_EXTENSION_push(ret, ext))
-        goto m_fail;
-
-    *x = ret;
-    return 1;
-
- m_fail:
-    if (ret != *x)
-        sk_X509_EXTENSION_free(ret);
-    X509_EXTENSION_free(ext);
-    return -1;
-
- err:
-    if (!(flags & X509V3_ADD_SILENT))
-        OPENSSL_PUT_ERROR(X509V3, errcode);
-    return 0;
-}

data/third_party/boringssl/crypto/x509v3/v3_pci.c

@@ -1,287 +0,0 @@
-/* v3_pci.c -*- mode:C; c-file-style: "eay" -*- */
-/*
- * Contributed to the OpenSSL Project 2004 by Richard Levitte
- * (richard@levitte.org)
- */
-/* Copyright (c) 2004 Kungliga Tekniska Högskolan
- * (Royal Institute of Technology, Stockholm, Sweden).
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- *
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * 3. Neither the name of the Institute nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#include <string.h>
-
-#include <openssl/conf.h>
-#include <openssl/err.h>
-#include <openssl/mem.h>
-#include <openssl/obj.h>
-#include <openssl/x509v3.h>
-
-#include "../internal.h"
-
-
-static int i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *ext,
-                   BIO *out, int indent);
-static PROXY_CERT_INFO_EXTENSION *r2i_pci(X509V3_EXT_METHOD *method,
-                                          X509V3_CTX *ctx, char *str);
-
-const X509V3_EXT_METHOD v3_pci =
-    { NID_proxyCertInfo, 0, ASN1_ITEM_ref(PROXY_CERT_INFO_EXTENSION),
-    0, 0, 0, 0,
-    0, 0,
-    NULL, NULL,
-    (X509V3_EXT_I2R)i2r_pci,
-    (X509V3_EXT_R2I)r2i_pci,
-    NULL,
-};
-
-static int i2r_pci(X509V3_EXT_METHOD *method, PROXY_CERT_INFO_EXTENSION *pci,
-                   BIO *out, int indent)
-{
-    BIO_printf(out, "%*sPath Length Constraint: ", indent, "");
-    if (pci->pcPathLengthConstraint)
-        i2a_ASN1_INTEGER(out, pci->pcPathLengthConstraint);
-    else
-        BIO_printf(out, "infinite");
-    BIO_puts(out, "\n");
-    BIO_printf(out, "%*sPolicy Language: ", indent, "");
-    i2a_ASN1_OBJECT(out, pci->proxyPolicy->policyLanguage);
-    BIO_puts(out, "\n");
-    if (pci->proxyPolicy->policy && pci->proxyPolicy->policy->data)
-        BIO_printf(out, "%*sPolicy Text: %s\n", indent, "",
-                   pci->proxyPolicy->policy->data);
-    return 1;
-}
-
-static int process_pci_value(CONF_VALUE *val,
-                             ASN1_OBJECT **language, ASN1_INTEGER **pathlen,
-                             ASN1_OCTET_STRING **policy)
-{
-    int free_policy = 0;
-
-    if (strcmp(val->name, "language") == 0) {
-        if (*language) {
-            OPENSSL_PUT_ERROR(X509V3,
-                              X509V3_R_POLICY_LANGUAGE_ALREADY_DEFINED);
-            X509V3_conf_err(val);
-            return 0;
-        }
-        if (!(*language = OBJ_txt2obj(val->value, 0))) {
-            OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_OBJECT_IDENTIFIER);
-            X509V3_conf_err(val);
-            return 0;
-        }
-    } else if (strcmp(val->name, "pathlen") == 0) {
-        if (*pathlen) {
-            OPENSSL_PUT_ERROR(X509V3,
-                              X509V3_R_POLICY_PATH_LENGTH_ALREADY_DEFINED);
-            X509V3_conf_err(val);
-            return 0;
-        }
-        if (!X509V3_get_value_int(val, pathlen)) {
-            OPENSSL_PUT_ERROR(X509V3, X509V3_R_POLICY_PATH_LENGTH);
-            X509V3_conf_err(val);
-            return 0;
-        }
-    } else if (strcmp(val->name, "policy") == 0) {
-        unsigned char *tmp_data = NULL;
-        long val_len;
-        if (!*policy) {
-            *policy = ASN1_OCTET_STRING_new();
-            if (!*policy) {
-                OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
-                X509V3_conf_err(val);
-                return 0;
-            }
-            free_policy = 1;
-        }
-        if (strncmp(val->value, "hex:", 4) == 0) {
-            unsigned char *tmp_data2 =
-                string_to_hex(val->value + 4, &val_len);
-
-            if (!tmp_data2) {
-                OPENSSL_PUT_ERROR(X509V3, X509V3_R_ILLEGAL_HEX_DIGIT);
-                X509V3_conf_err(val);
-                goto err;
-            }
-
-            tmp_data = OPENSSL_realloc((*policy)->data,
-                                       (*policy)->length + val_len + 1);
-            if (tmp_data) {
-                (*policy)->data = tmp_data;
-                OPENSSL_memcpy(&(*policy)->data[(*policy)->length],
-                       tmp_data2, val_len);
-                (*policy)->length += val_len;
-                (*policy)->data[(*policy)->length] = '\0';
-            } else {
-                OPENSSL_free(tmp_data2);
-                /*
-                 * realloc failure implies the original data space is b0rked
-                 * too!
-                 */
-                (*policy)->data = NULL;
-                (*policy)->length = 0;
-                OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
-                X509V3_conf_err(val);
-                goto err;
-            }
-            OPENSSL_free(tmp_data2);
-        } else if (strncmp(val->value, "text:", 5) == 0) {
-            val_len = strlen(val->value + 5);
-            tmp_data = OPENSSL_realloc((*policy)->data,
-                                       (*policy)->length + val_len + 1);
-            if (tmp_data) {
-                (*policy)->data = tmp_data;
-                OPENSSL_memcpy(&(*policy)->data[(*policy)->length],
-                       val->value + 5, val_len);
-                (*policy)->length += val_len;
-                (*policy)->data[(*policy)->length] = '\0';
-            } else {
-                /*
-                 * realloc failure implies the original data space is b0rked
-                 * too!
-                 */
-                (*policy)->data = NULL;
-                (*policy)->length = 0;
-                OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
-                X509V3_conf_err(val);
-                goto err;
-            }
-        } else {
-            OPENSSL_PUT_ERROR(X509V3, X509V3_R_INCORRECT_POLICY_SYNTAX_TAG);
-            X509V3_conf_err(val);
-            goto err;
-        }
-        if (!tmp_data) {
-            OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
-            X509V3_conf_err(val);
-            goto err;
-        }
-    }
-    return 1;
- err:
-    if (free_policy) {
-        ASN1_OCTET_STRING_free(*policy);
-        *policy = NULL;
-    }
-    return 0;
-}
-
-static PROXY_CERT_INFO_EXTENSION *r2i_pci(X509V3_EXT_METHOD *method,
-                                          X509V3_CTX *ctx, char *value)
-{
-    PROXY_CERT_INFO_EXTENSION *pci = NULL;
-    STACK_OF(CONF_VALUE) *vals;
-    ASN1_OBJECT *language = NULL;
-    ASN1_INTEGER *pathlen = NULL;
-    ASN1_OCTET_STRING *policy = NULL;
-    size_t i, j;
-    int nid;
-
-    vals = X509V3_parse_list(value);
-    for (i = 0; i < sk_CONF_VALUE_num(vals); i++) {
-        CONF_VALUE *cnf = sk_CONF_VALUE_value(vals, i);
-        if (!cnf->name || (*cnf->name != '@' && !cnf->value)) {
-            OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_PROXY_POLICY_SETTING);
-            X509V3_conf_err(cnf);
-            goto err;
-        }
-        if (*cnf->name == '@') {
-            STACK_OF(CONF_VALUE) *sect;
-            int success_p = 1;
-
-            sect = X509V3_get_section(ctx, cnf->name + 1);
-            if (!sect) {
-                OPENSSL_PUT_ERROR(X509V3, X509V3_R_INVALID_SECTION);
-                X509V3_conf_err(cnf);
-                goto err;
-            }
-            for (j = 0; success_p && j < sk_CONF_VALUE_num(sect); j++) {
-                success_p =
-                    process_pci_value(sk_CONF_VALUE_value(sect, j),
-                                      &language, &pathlen, &policy);
-            }
-            X509V3_section_free(ctx, sect);
-            if (!success_p)
-                goto err;
-        } else {
-            if (!process_pci_value(cnf, &language, &pathlen, &policy)) {
-                X509V3_conf_err(cnf);
-                goto err;
-            }
-        }
-    }
-
-    /* Language is mandatory */
-    if (!language) {
-        OPENSSL_PUT_ERROR(X509V3,
-                          X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED);
-        goto err;
-    }
-    nid = OBJ_obj2nid(language);
-    if ((nid == NID_Independent || nid == NID_id_ppl_inheritAll) && policy) {
-        OPENSSL_PUT_ERROR(X509V3,
-                          X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY);
-        goto err;
-    }
-
-    pci = PROXY_CERT_INFO_EXTENSION_new();
-    if (!pci) {
-        OPENSSL_PUT_ERROR(X509V3, ERR_R_MALLOC_FAILURE);
-        goto err;
-    }
-
-    pci->proxyPolicy->policyLanguage = language;
-    language = NULL;
-    pci->proxyPolicy->policy = policy;
-    policy = NULL;
-    pci->pcPathLengthConstraint = pathlen;
-    pathlen = NULL;
-    goto end;
- err:
-    if (language) {
-        ASN1_OBJECT_free(language);
-        language = NULL;
-    }
-    if (pathlen) {
-        ASN1_INTEGER_free(pathlen);
-        pathlen = NULL;
-    }
-    if (policy) {
-        ASN1_OCTET_STRING_free(policy);
-        policy = NULL;
-    }
-    if (pci) {
-        PROXY_CERT_INFO_EXTENSION_free(pci);
-        pci = NULL;
-    }
- end:
-    sk_CONF_VALUE_pop_free(vals, X509V3_conf_free);
-    return pci;
-}