📄 ext_def.c
字号:
/* netscape-ca-revocation-url:
OID = 2 16 840 1 113730 11 7
IA5String */
{ MKOID( "\x06\x09\x60\x86\x48\x01\x86\xF8\x42\x01\x07" ), CRYPT_CERTINFO_NS_CERTRENEWALURL,
MKDESC( "netscape-ca-revocation-url" )
ENCODING( BER_STRING_IA5 ),
FL_LEVEL_STANDARD | FL_VALID_CERT, CHECK_HTTP },
/* netscape-ca-policy-url:
OID = 2 16 840 1 113730 1 8
IA5String */
{ MKOID( "\x06\x09\x60\x86\x48\x01\x86\xF8\x42\x01\x08" ), CRYPT_CERTINFO_NS_CAPOLICYURL,
MKDESC( "netscape-ca-policy-url" )
ENCODING( BER_STRING_IA5 ),
FL_LEVEL_STANDARD | FL_VALID_CERT, CHECK_HTTP },
/* netscape-ssl-server-name:
OID = 2 16 840 1 113730 1 12
IA5String */
{ MKOID( "\x06\x09\x60\x86\x48\x01\x86\xF8\x42\x01\x0C" ), CRYPT_CERTINFO_NS_SSLSERVERNAME,
MKDESC( "netscape-ssl-server-name" )
ENCODING( BER_STRING_IA5 ),
FL_LEVEL_STANDARD | FL_VALID_CERTREQ | FL_VALID_CERT, CHECK_DNS },
/* netscape-comment:
OID = 2 16 840 1 113730 1 13
IA5String */
{ MKOID( "\x06\x09\x60\x86\x48\x01\x86\xF8\x42\x01\x0D" ), CRYPT_CERTINFO_NS_COMMENT,
MKDESC( "netscape-comment" )
ENCODING( BER_STRING_IA5 ),
FL_LEVEL_STANDARD | FL_VALID_CERTREQ | FL_VALID_CERT, RANGE_ATTRIBUTEBLOB },
/* hashedRootKey:
OID = 2 23 42 7 0
critical = TRUE
SEQUENCE {
rootKeyThumbprint DigestedData -- PKCS #7-type wrapper
} */
{ MKOID( "\x06\x04\x67\x2A\x07\x00" ), CRYPT_CERTINFO_SET_HASHEDROOTKEY,
MKDESC( "hashedRootKey" )
ENCODING( BER_SEQUENCE ),
FL_MORE | FL_CRITICAL | FL_LEVEL_PKIX_FULL | FL_VALID_CERT, RANGE_NONE },
{ NULL, 0,
MKDESC( "hashedRootKey.rootKeyThumbprint" )
ENCODING( FIELDTYPE_BLOB ), /* PKCS #7-type wrapper */
FL_MORE | FL_NONENCODING, 0, 0, 25,
"\x30\x2D\x02\x01\x00\x30\x09\x06\x05\x2B\x0E\x03\x02\x1A\x05\x00\x30\x07\x06\x05\x67\x2A\x03\x00\x00" },
{ NULL, CRYPT_CERTINFO_SET_ROOTKEYTHUMBPRINT,
MKDESC( "hashedRootKey.rootKeyThumbprint.hashData" )
ENCODING( BER_OCTETSTRING ),
FL_SEQEND /*NONE*/, RANGE( 20, 20 ) },
/* certificateType:
OID = 2 23 42 7 1
critical = TRUE
BIT STRING */
{ MKOID( "\x06\x04\x67\x2A\x07\x01" ), CRYPT_CERTINFO_SET_CERTIFICATETYPE,
MKDESC( "certificateType" )
ENCODING( BER_BITSTRING ),
FL_CRITICAL | FL_LEVEL_PKIX_FULL | FL_VALID_CERT | FL_VALID_CERTREQ, RANGE( 0, CRYPT_SET_CERTTYPE_LAST ) },
/* merchantData:
OID = 2 23 42 7 2
SEQUENCE {
merID SETString SIZE(1..30),
merAcquirerBIN NumericString SIZE(6),
merNameSeq SEQUENCE OF MerNames,
merCountry INTEGER (1..999),
merAuthFlag BOOLEAN DEFAULT TRUE
}
MerNames ::= SEQUENCE {
language [ 0 ] VisibleString SIZE(1..35),
name [ 1 ] EXPLICIT SETString SIZE(1..50),
city [ 2 ] EXPLICIT SETString SIZE(1..50),
stateProvince [ 3 ] EXPLICIT SETString SIZE(1..50) OPTIONAL,
postalCode [ 4 ] EXPLICIT SETString SIZE(1..14) OPTIONAL,
countryName [ 5 ] EXPLICIT SETString SIZE(1..50)
} */
{ MKOID( "\x06\x04\x67\x2A\x07\x02" ), CRYPT_CERTINFO_SET_MERCHANTDATA,
MKDESC( "merchantData" )
ENCODING( BER_SEQUENCE ),
FL_MORE | FL_LEVEL_PKIX_FULL | FL_VALID_CERT, RANGE_NONE },
{ NULL, CRYPT_CERTINFO_SET_MERID,
MKDESC( "merchantData.merID" )
ENCODING( BER_STRING_ISO646 ),
FL_MORE, RANGE( 1, 30 ) },
{ NULL, CRYPT_CERTINFO_SET_MERACQUIRERBIN,
MKDESC( "merchantData.merAcquirerBIN" )
ENCODING( BER_STRING_NUMERIC ),
FL_MORE, RANGE( 6, 6 ) },
{ NULL, 0,
MKDESC( "merchantData.merNameSeq" )
ENCODING( BER_SEQUENCE ),
FL_MORE | FL_SETOF, RANGE_NONE },
{ NULL, 0,
MKDESC( "merchantData.merNameSeq.merNames" )
ENCODING( BER_SEQUENCE ),
FL_MORE, RANGE_NONE },
{ NULL, CRYPT_CERTINFO_SET_MERCHANTLANGUAGE,
MKDESC( "merchantData.merNameSeq.merNames.language" )
ENCODING_TAGGED( BER_STRING_ISO646, 0 ),
FL_MORE | FL_MULTIVALUED, RANGE( 1, 35 ) },
{ NULL, CRYPT_CERTINFO_SET_MERCHANTNAME,
MKDESC( "merchantData.merNameSeq.merNames.name" )
ENCODING_TAGGED( BER_STRING_ISO646, 1 ),
FL_MORE | FL_MULTIVALUED | FL_EXPLICIT, RANGE( 1, 50 ) },
{ NULL, CRYPT_CERTINFO_SET_MERCHANTCITY,
MKDESC( "merchantData.merNameSeq.merNames.city" )
ENCODING_TAGGED( BER_STRING_ISO646, 2 ),
FL_MORE | FL_MULTIVALUED | FL_EXPLICIT, RANGE( 1, 50 ) },
{ NULL, CRYPT_CERTINFO_SET_MERCHANTSTATEPROVINCE,
MKDESC( "merchantData.merNameSeq.merNames.stateProvince" )
ENCODING_TAGGED( BER_STRING_ISO646, 3 ),
FL_MORE | FL_MULTIVALUED | FL_EXPLICIT | FL_OPTIONAL, RANGE( 1, 50 ) },
{ NULL, CRYPT_CERTINFO_SET_MERCHANTPOSTALCODE,
MKDESC( "merchantData.merNameSeq.merNames.postalCode" )
ENCODING_TAGGED( BER_STRING_ISO646, 4 ),
FL_MORE | FL_MULTIVALUED | FL_EXPLICIT | FL_OPTIONAL, RANGE( 1, 50 ) },
{ NULL, CRYPT_CERTINFO_SET_MERCHANTCOUNTRYNAME,
MKDESC( "merchantData.merNameSeq.merNames.countryName" )
ENCODING_TAGGED( BER_STRING_ISO646, 5 ),
FL_MORE | FL_MULTIVALUED | FL_EXPLICIT | FL_SEQEND_2, RANGE( 1, 50 ) },
{ NULL, CRYPT_CERTINFO_SET_MERCOUNTRY,
MKDESC( "merchantData.merCountry" )
ENCODING( BER_INTEGER ),
FL_MORE, RANGE( 1, 999 ) },
{ NULL, CRYPT_CERTINFO_SET_MERAUTHFLAG,
MKDESC( "merchantData.merAuthFlag" )
ENCODING( BER_BOOLEAN ),
FL_OPTIONAL | FL_DEFAULT | FL_SEQEND /*NONE*/, RANGE_BOOLEAN },
/* certCardRequired
OID = 2 23 42 7 3
BOOLEAN */
{ MKOID( "\x06\x04\x67\x2A\x07\x03" ), CRYPT_CERTINFO_SET_CERTCARDREQUIRED,
MKDESC( "certCardRequired" )
ENCODING( BER_BOOLEAN ),
FL_LEVEL_PKIX_FULL | FL_VALID_CERT, RANGE_BOOLEAN },
/* tunneling:
OID = 2 23 42 7 4
SEQUENCE {
tunneling DEFAULT TRUE,
tunnelAlgIDs SEQUENCE OF OBJECT IDENTIFIER
} */
{ MKOID( "\x06\x04\x67\x2A\x07\x04" ), CRYPT_CERTINFO_SET_TUNNELING,
MKDESC( "tunneling" )
ENCODING( BER_SEQUENCE ),
FL_MORE | FL_LEVEL_PKIX_FULL | FL_VALID_CERT | FL_VALID_CERTREQ, RANGE_NONE },
{ NULL, CRYPT_CERTINFO_SET_TUNNELINGFLAG,
MKDESC( "tunneling.tunneling" )
ENCODING( BER_BOOLEAN ),
FL_MORE | FL_OPTIONAL | FL_DEFAULT, FALSE, TRUE, TRUE, NULL },
{ NULL, 0,
MKDESC( "tunneling.tunnelingAlgIDs" )
ENCODING( BER_SEQUENCE ),
FL_MORE | FL_SETOF, RANGE_NONE },
{ NULL, CRYPT_CERTINFO_SET_TUNNELINGALGID,
MKDESC( "tunneling.tunnelingAlgIDs.tunnelingAlgID" )
ENCODING( BER_OBJECT_IDENTIFIER ),
FL_MULTIVALUED | FL_SEQEND, RANGE_OID },
{ NULL, CRYPT_ERROR }, { NULL, CRYPT_ERROR }
};
/* Subtable for encoding the holdInstructionCode */
STATIC_DATA const ATTRIBUTE_INFO FAR_BSS holdInstructionInfo[] = {
{ MKOID( "\x06\x07\x2A\x86\x48\xCE\x38\x02\x01" ), CRYPT_HOLDINSTRUCTION_NONE,
MKDESC( "holdInstructionCode.holdinstruction-none (1 2 840 10040 2 1)" )
ENCODING( FIELDTYPE_IDENTIFIER ),
FL_MORE | FL_OPTIONAL, RANGE_NONE },
{ MKOID( "\x06\x07\x2A\x86\x48\xCE\x38\x02\x02" ), CRYPT_HOLDINSTRUCTION_CALLISSUER,
MKDESC( "holdInstructionCode.holdinstruction-callissuer (1 2 840 10040 2 2)" )
ENCODING( FIELDTYPE_IDENTIFIER ),
FL_MORE | FL_OPTIONAL, RANGE_NONE },
{ MKOID( "\x06\x07\x2A\x86\x48\xCE\x38\x02\x03" ), CRYPT_HOLDINSTRUCTION_REJECT,
MKDESC( "holdInstructionCode.holdinstruction-reject (1 2 840 10040 2 3)" )
ENCODING( FIELDTYPE_IDENTIFIER ),
FL_MORE | FL_OPTIONAL, RANGE_NONE },
{ MKOID( "\x06\x07\x2A\x86\x48\xCE\x38\x02\x04" ), CRYPT_HOLDINSTRUCTION_PICKUPTOKEN,
MKDESC( "holdInstructionCode.holdinstruction-pickupToken (1 2 840 10040 2 4)" )
ENCODING( FIELDTYPE_IDENTIFIER ),
FL_OPTIONAL, RANGE_NONE },
{ NULL, CRYPT_ERROR }, { NULL, CRYPT_ERROR }
};
/****************************************************************************
* *
* GeneralName Definition *
* *
****************************************************************************/
/* Encoding and decoding of GeneralNames is performed with the following
subtable:
otherName [ 0 ] SEQUENCE {
type-id OBJECT IDENTIFIER,
value [ 0 ] EXPLICIT ANY DEFINED BY type-id
} OPTIONAL,
rfc822Name [ 1 ] IA5String OPTIONAL,
dNSName [ 2 ] IA5String OPTIONAL,
x400Address [ 3 ] ITU-BrainDamage OPTIONAL
directoryName [ 4 ] EXPLICIT Name OPTIONAL,
ediPartyName [ 5 ] SEQUENCE {
nameAssigner [ 0 ] EXPLICIT DirectoryString OPTIONAL,
partyName [ 1 ] EXPLICIT DirectoryString
} OPTIONAL,
uniformResourceIdentifier
[ 6 ] IA5String OPTIONAL,
iPAddress [ 7 ] OCTET STRING OPTIONAL,
registeredID [ 8 ] OBJECT IDENTIFIER OPTIONAL
ITU-Braindamge ::= SEQUENCE {
built-in-standard-attributes SEQUENCE {
country-name [ APPLICATION 1 ] CHOICE {
x121-dcc-code NumericString,
iso-3166-alpha2-code PrintableString
},
administration-domain-name
[ APPLICATION 2 ] CHOICE {
numeric NumericString,
printable PrintableString
},
network-address [ 0 ] NumericString OPTIONAL,
terminal-identifier [ 1 ] PrintableString OPTIONAL,
private-domain-name [ 2 ] CHOICE {
numeric NumericString,
printable PrintableString
} OPTIONAL,
organization-name [ 3 ] PrintableString OPTIONAL,
numeric-use-identifier [ 4 ] NumericString OPTIONAL,
personal-name [ 5 ] SET {
surname [ 0 ] PrintableString,
given-name [ 1 ] PrintableString,
initials [ 2 ] PrintableString,
generation-qualifier [ 3 ] PrintableString
} OPTIONAL,
organizational-unit-name [ 6 ] PrintableString OPTIONAL,
}
built-in-domain-defined-attributes SEQUENCE OF {
type PrintableString SIZE(1..64),
value PrintableString SIZE(1..64)
} OPTIONAL
extensionAttributes SET OF SEQUENCE {
extension-attribute-type [ 0 ] INTEGER,
extension-attribute-value [ 1 ] ANY DEFINED BY extension-attribute-type
} OPTIONAL
}
Needless to say, X.400 addresses aren't supported (for readers who've
never seen one before, now you know why they've been so enormously
successful).
Note the special-case encoding of the DirectoryName and EDIPartyName.
This is required because (for the DirectoryName) a Name is actually a
CHOICE { RDNSequence } and if the tagging were implicit then there'd be
no way to tell which of the CHOICE options was being used:
directoryName [ 4 ] Name OPTIONAL
becomes:
directoryName [ 4 ] CHOICE { RDNSequence } OPTIONAL
which, if implicit tagging is used, would replace the RDNSequence tag with
the [4] tag, making it impossible to determine which of the Name choices
was used (actually there's only one possibility and it's unlikely that
there'll ever be more but that's what the encoding rules require - X.208,
section 26.7c).
The same applies to the EDIPartyName, this is a DirectoryString which is
a CHOICE of several possible string types. The end result is that:
[ 0 ] DirectoryString
ends up looking like:
[ 0 ] SEQUENCE {
option1 PrintableString OPTIONAL,
option2 T61String OPTIONAL,
option3 UTF8String OPTIONAL,
option4 BMPString OPTIONAL
}
Newer versions of the PKIX core RFC allow the use of 8- and 32-byte CIDR
forms for 4- and 16-byte IP addresses in some instances when they're
being used as constraints. We'll add support for this if anyone ever
asks for it */
STATIC_DATA const ATTRIBUTE_INFO FAR_BSS generalNameInfo[] = {
/* otherName */
{ NULL, 0,
MKDESC( "generalName.otherName" )
ENCODING_TAGGED( BER_SEQUENCE, 0 ),
FL_MORE | FL_OPTIONAL, RANGE_NONE },
{ NULL, CRYPT_CERTINFO_OTHERNAME_TYPEID,
MKDESC( "generalName.otherName.type-id" )
ENCODING( BER_OBJECT_IDENTIFIER ),
FL_MORE | FL_OPTIONAL, RANGE_OID },
{ NULL, CRYPT_CERTINFO_OTHERNAME_VALUE,
MKDESC( "generalName.otherName.value" )
ENCODING_TAGGED( FIELDTYPE_BLOB, 0 ),
FL_MORE | FL_OPTIONAL | FL_EXPLICIT | FL_SEQEND, RANGE( 3, MAX_ATTRIBUTE_SIZE ) },
/* rfc822Name */
{ NULL, CRYPT_CERTINFO_RFC822NAME,
MKDESC( "generalName.rfc822Name" )
ENCODING_⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -