--- old/usr/src/lib/krb5/plugins/preauth/pkinit/pkinit_crypto_openssl.c	Sat Jul 29 23:19:46 2017
+++ new/usr/src/lib/krb5/plugins/preauth/pkinit/pkinit_crypto_openssl.c	Sat Jul 29 23:19:46 2017
@@ -31,6 +31,7 @@
 /*
  * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
  * Copyright (c) 2012, OmniTI Computer Consulting, Inc. All rights reserved.
+ * Copyright 2015 RackTop Systems.
  */
 
 #include <errno.h>
@@ -369,10 +370,6 @@
     0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF
 };
 
-/* Solaris Kerberos */
-static k5_mutex_t oids_mutex = K5_MUTEX_PARTIAL_INITIALIZER;
-static int pkinit_oids_refs = 0;
-
 krb5_error_code
 pkinit_init_plg_crypto(pkinit_plg_crypto_context *cryptoctx) {
 
@@ -507,73 +504,43 @@
 static krb5_error_code
 pkinit_init_pkinit_oids(pkinit_plg_crypto_context ctx)
 {
-    krb5_error_code retval = ENOMEM;
-    int nid = 0;
+    ctx->id_pkinit_san = OBJ_txt2obj("1.3.6.1.5.2.2", 1);
+    if (ctx->id_pkinit_san == NULL)
+        return ENOMEM;
 
-    /*
-     * If OpenSSL already knows about the OID, use the
-     * existing definition. Otherwise, create an OID object.
-     */
-    #define CREATE_OBJ_IF_NEEDED(oid, vn, sn, ln) \
-	nid = OBJ_txt2nid(oid); \
-	if (nid == NID_undef) { \
-	    nid = OBJ_create(oid, sn, ln); \
-	    if (nid == NID_undef) { \
-		pkiDebug("Error creating oid object for '%s'\n", oid); \
-		goto out; \
-	    } \
-	} \
-	ctx->vn = OBJ_nid2obj(nid);
-    
-    /* Solaris Kerberos */
-    retval = k5_mutex_lock(&oids_mutex);
-    if (retval != 0)
-	goto out;
+    ctx->id_pkinit_authData = OBJ_txt2obj("1.3.6.1.5.2.3.1", 1);
+    if (ctx->id_pkinit_authData == NULL)
+        return ENOMEM;
 
-    CREATE_OBJ_IF_NEEDED("1.3.6.1.5.2.2", id_pkinit_san,
-			 "id-pkinit-san", "KRB5PrincipalName");
+    ctx->id_pkinit_DHKeyData = OBJ_txt2obj("1.3.6.1.5.2.3.2", 1);
+    if (ctx->id_pkinit_DHKeyData == NULL)
+        return ENOMEM;
 
-    CREATE_OBJ_IF_NEEDED("1.3.6.1.5.2.3.1", id_pkinit_authData,
-			 "id-pkinit-authdata", "PKINIT signedAuthPack");
+    ctx->id_pkinit_rkeyData = OBJ_txt2obj("1.3.6.1.5.2.3.3", 1);
+    if (ctx->id_pkinit_rkeyData == NULL)
+        return ENOMEM;
 
-    CREATE_OBJ_IF_NEEDED("1.3.6.1.5.2.3.2", id_pkinit_DHKeyData,
-			 "id-pkinit-DHKeyData", "PKINIT dhSignedData");
+    ctx->id_pkinit_KPClientAuth = OBJ_txt2obj("1.3.6.1.5.2.3.4", 1);
+    if (ctx->id_pkinit_KPClientAuth == NULL)
+        return ENOMEM;
 
-    CREATE_OBJ_IF_NEEDED("1.3.6.1.5.2.3.3", id_pkinit_rkeyData,
-			 "id-pkinit-rkeyData", "PKINIT encKeyPack");
+    ctx->id_pkinit_KPKdc = OBJ_txt2obj("1.3.6.1.5.2.3.5", 1);
+    if (ctx->id_pkinit_KPKdc == NULL)
+        return ENOMEM;
 
-    CREATE_OBJ_IF_NEEDED("1.3.6.1.5.2.3.4", id_pkinit_KPClientAuth,
-			 "id-pkinit-KPClientAuth", "PKINIT Client EKU");
+    ctx->id_ms_kp_sc_logon = OBJ_txt2obj("1.3.6.1.4.1.311.20.2.2", 1);
+    if (ctx->id_ms_kp_sc_logon == NULL)
+        return ENOMEM;
 
-    CREATE_OBJ_IF_NEEDED("1.3.6.1.5.2.3.5", id_pkinit_KPKdc,
-			 "id-pkinit-KPKdc", "KDC EKU");
+    ctx->id_ms_san_upn = OBJ_txt2obj("1.3.6.1.4.1.311.20.2.3", 1);
+    if (ctx->id_ms_san_upn == NULL)
+        return ENOMEM;
 
-#if 0
-    CREATE_OBJ_IF_NEEDED("1.2.840.113549.1.7.1", id_pkinit_authData9,
-			 "id-pkcs7-data", "PKCS7 data");
-#else
-    /* See note in pkinit_pkcs7type2oid() */
-    ctx->id_pkinit_authData9 = NULL;
-#endif
+    ctx->id_kp_serverAuth = OBJ_txt2obj("1.3.6.1.5.5.7.3.1", 1);
+    if (ctx->id_kp_serverAuth == NULL)
+        return ENOMEM;
 
-    CREATE_OBJ_IF_NEEDED("1.3.6.1.4.1.311.20.2.2", id_ms_kp_sc_logon,
-			 "id-ms-kp-sc-logon EKU", "Microsoft SmartCard Login EKU");
-
-    CREATE_OBJ_IF_NEEDED("1.3.6.1.4.1.311.20.2.3", id_ms_san_upn,
-			 "id-ms-san-upn", "Microsoft Universal Principal Name");
-
-    CREATE_OBJ_IF_NEEDED("1.3.6.1.5.5.7.3.1", id_kp_serverAuth,
-			 "id-kp-serverAuth EKU", "Server Authentication EKU");
-
-    /* Success */
-    retval = 0;
-    
-    pkinit_oids_refs++;
-    /* Solaris Kerberos */
-    k5_mutex_unlock(&oids_mutex);
-
-out:
-    return retval;
+    return 0;
 }
 
 static krb5_error_code
@@ -652,13 +619,15 @@
 {
     if (ctx == NULL)
 	return;
-
-    /* Only call OBJ_cleanup once! */
-    /* Solaris Kerberos: locking */
-    k5_mutex_lock(&oids_mutex);
-    if (--pkinit_oids_refs == 0)
-	OBJ_cleanup();
-    k5_mutex_unlock(&oids_mutex);
+    ASN1_OBJECT_free(ctx->id_pkinit_san);
+    ASN1_OBJECT_free(ctx->id_pkinit_authData);
+    ASN1_OBJECT_free(ctx->id_pkinit_DHKeyData);
+    ASN1_OBJECT_free(ctx->id_pkinit_rkeyData);
+    ASN1_OBJECT_free(ctx->id_pkinit_KPClientAuth);
+    ASN1_OBJECT_free(ctx->id_pkinit_KPKdc);
+    ASN1_OBJECT_free(ctx->id_ms_kp_sc_logon);
+    ASN1_OBJECT_free(ctx->id_ms_san_upn);
+    ASN1_OBJECT_free(ctx->id_kp_serverAuth);
 }
 
 static krb5_error_code
@@ -871,7 +840,7 @@
     unsigned int alg_len = 0, digest_len = 0;
     unsigned char *y = NULL, *alg_buf = NULL, *digest_buf = NULL;
     X509 *cert = NULL;
-    ASN1_OBJECT *oid = NULL;
+    ASN1_OBJECT *oid = NULL, *oid_copy;
 
     /* Solaris Kerberos */
     if (signed_data == NULL)
@@ -996,8 +965,11 @@
 				   V_ASN1_OCTET_STRING, (char *) digest_attr);
 
 	/* create a content-type attr */
+	oid_copy = OBJ_dup(oid);
+	if (oid_copy == NULL)
+		goto cleanup2;
 	PKCS7_add_signed_attribute(p7si, NID_pkcs9_contentType, 
-				   V_ASN1_OBJECT, oid);
+				   V_ASN1_OBJECT, oid_copy);
 
 	/* create the signature over signed attributes. get DER encoded value */
 	/* This is the place where smartcard signature needs to be calculated */
@@ -3127,31 +3099,11 @@
 static ASN1_OBJECT *
 pkinit_pkcs7type2oid(pkinit_plg_crypto_context cryptoctx, int pkcs7_type)
 {
-    int nid;
-
     switch (pkcs7_type) {
 	case CMS_SIGN_CLIENT:
 	    return cryptoctx->id_pkinit_authData;
 	case CMS_SIGN_DRAFT9:
-	    /*
-	     * Delay creating this OID until we know we need it.
-	     * It shadows an existing OpenSSL oid.  If it
-	     * is created too early, it breaks things like
-	     * the use of pkcs12 (which uses pkcs7 structures).
-	     * We need this shadow version because our code
-	     * depends on the "other" type to be unknown to the
-	     * OpenSSL code.
-	     */ 
-	    if (cryptoctx->id_pkinit_authData9 == NULL) {
-		pkiDebug("%s: Creating shadow instance of pkcs7-data oid\n",
-			 __FUNCTION__);
-		nid = OBJ_create("1.2.840.113549.1.7.1", "id-pkcs7-data",
-				 "PKCS7 data");
-		if (nid == NID_undef)
-		    return NULL;
-		cryptoctx->id_pkinit_authData9 = OBJ_nid2obj(nid);
-	    }
-	    return cryptoctx->id_pkinit_authData9;
+	    return OBJ_nid2obj(NID_pkcs7_data);
 	case CMS_SIGN_SERVER:
 	    return cryptoctx->id_pkinit_DHKeyData;
 	case CMS_ENVEL_SERVER:
