File Coverage

blib/lib/Crypt/X509/CRL.pm

Criterion	Covered	Total	%
statement	73	284	25.7
branch	14	100	14.0
condition	4	6	66.6
subroutine	16	40	40.0
pod	30	30	100.0
total	137	460	29.7

package Crypt::X509::CRL;

use 5.006;
use Carp;
use strict;
use warnings;
use Convert::ASN1 qw(:io :debug);

require Exporter;

our @ISA = qw(Exporter);
our %EXPORT_TAGS = ( 'all' => [qw()] );
our @EXPORT_OK = ( @{ $EXPORT_TAGS{'all'} } );
our @EXPORT = qw( error new this_update next_update );
our $VERSION = '0.4';

my $parser = undef;
my $asn = undef;
my $error = undef;

my %oid2enchash= (
	'1.2.840.113549.1.1.1' => {'enc' => 'RSA'},
	'1.2.840.113549.1.1.2' => {'enc' => 'RSA', 'hash' => 'MD2'},
	'1.2.840.113549.1.1.3' => {'enc' => 'RSA', 'hash' => 'MD4'},
	'1.2.840.113549.1.1.4' => {'enc' => 'RSA', 'hash' => 'MD5'},
	'1.2.840.113549.1.1.5' => {'enc' => 'RSA', 'hash' => 'SHA1'},
	'1.2.840.113549.1.1.6' => {'enc' => 'OAEP'}
);

my %oid2attr = (
                "2.5.4.3" => "CN",
                "2.5.4.6" => "C",
                "2.5.4.7" => "l",
                "2.5.4.8" => "S",
                "2.5.4.10" => "O",
                "2.5.4.11" => "OU",
                "1.2.840.113549.1.9.1" => "E",
                "0.9.2342.19200300.100.1.1" => "UID",
                "0.9.2342.19200300.100.1.25" => "DC"
               );




sub new {
	my ( $class , %args ) = @_;

	if ( !defined ( $parser ) || $parser->error ) {
		$parser = _init();
	}

	my $self = $parser->decode( $args{'crl'} );

	$self->{'_error'} = $parser->error;
	bless ( $self , $class );

	return $self;
}


sub error {
	my $self = shift;
	return $self->{'_error'};
}


sub version {
	my $self = shift;

	return undef if not exists $self->{'tbsCertList'}{'version'};

	return $self->{'tbsCertList'}{'version'};
}


sub version_string {
	my $self = shift;

	return undef if not exists $self->{'tbsCertList'}{'version'};

	my $v = $self->{'tbsCertList'}{'version'};
	return "v1" if $v == 0;
	return "v2" if $v == 1;
	return "v3" if $v == 2;
}


sub this_update {
	my $self = shift;
	if ( exists $self->{'tbsCertList'}{'thisUpdate'}{'utcTime'} ) {
		return $self->{'tbsCertList'}{'thisUpdate'}{'utcTime'};
	} elsif ( exists $self->{'tbsCertList'}{'thisUpdate'}{'generalTime'} ) {
		return $self->{'tbsCertList'}{'thisUpdate'}{'generalTime'};
	} else {
		return undef;
	}
}


sub next_update {
	my $self = shift;
	if ( exists $self->{'tbsCertList'}{'nextUpdate'}{'utcTime'} ) {
		return $self->{'tbsCertList'}{'nextUpdate'}{'utcTime'};
	} elsif ( $self->{'tbsCertList'}{'nextUpdate'}{'generalTime'} ) {
		return $self->{'tbsCertList'}{'nextUpdate'}{'generalTime'};
	} else {
		return undef;
	}
}


sub signature {
	my $self = shift;
	return $self->{'signatureValue'}[0];
}


sub signature_length {
	my $self = shift;
	return $self->{'signatureValue'}[1];
}


sub signature_algorithm {
	my $self = shift;
	return $self->{'tbsCertList'}{'signature'}{'algorithm'};
}


sub SigEncAlg {
	my $self = shift;
	return $oid2enchash{ $self->{'tbsCertList'}{'signature'}->{'algorithm'} }->{'enc'};
}

sub SigHashAlg {
	my $self = shift;
	return $oid2enchash{ $self->{'tbsCertList'}{'signature'}->{'algorithm'} }->{'hash'};
}


#########################################################################
# accessors - issuer
#########################################################################

sub Issuer {
	my $self = shift;
	my ( $i , $type );
	my $issuerdn = $self->{'tbsCertList'}->{'issuer'}->{'rdnSequence'};

	$self->{'tbsCertList'}->{'issuer'}->{'dn'} = [];

	my $issuedn = $self->{'tbsCertList'}->{'issuer'}->{'dn'};

	for my $issue ( @{ $issuerdn } ) {
		$i = @{ $issue }[0];
		if ( $oid2attr{ $i->{'type'} } ) {
			$type = $oid2attr{ $i->{'type'} };
		} else {
			$type = $i->{'type'};
        	}
		my @key = keys ( %{ $i->{'value'} } );
		push @{ $issuedn } , $type . "=" . $i->{'value'}->{ $key[0] };
	}
	return $issuedn;
}

sub _issuer_part {
	my $self = shift;
	my $oid = shift;
	my $issuerrdn = $self->{'tbsCertList'}->{'issuer'}->{'rdnSequence'};
	for my $issue ( @{ $issuerrdn } ) {
		my $i = @{ $issue }[0];
		if ( $i->{'type'} eq $oid ) {
			my @key = keys ( %{ $i->{'value'} } );
			return $i->{'value'}->{ $key[0] };
		 }
	}
	return undef;
}


sub issuer_cn {
	my $self = shift;
	return _issuer_part( $self , '2.5.4.3' );
}



sub issuer_country {
	my $self = shift;
	return _issuer_part( $self , '2.5.4.6' );
}


sub issuer_state {
	my $self = shift;
	return _issuer_part( $self , '2.5.4.8' );
}


sub issuer_locality {
	my $self = shift;
	return _issuer_part( $self , '2.5.4.7' );
}


sub issuer_org {
	my $self = shift;
	return _issuer_part( $self , '2.5.4.10' );
}


sub issuer_email {
	my $self = shift;
	return _issuer_part( $self , '1.2.840.113549.1.9.1' );
}


#########################################################################
#
# ------- EXTENSIONS -------
#
# valid RFC 3280 extensions:
#	Authority Key Identifier (implemented)
#	CRL Number (implemented)
#	Issuing Distribution Point (implemented)
#	Issuer Alternative Name
#	Delta CRL Indicator
#	Freshest CRL (a.k.a. Delta CRL Distribution Point)
#
#########################################################################


sub key_identifier {
	my $self = shift;
	if ( defined $self->_AuthorityKeyIdentifier ) { return ( $self->_AuthorityKeyIdentifier )->{keyIdentifier}; }
	return undef;
}

# _AuthorityKeyIdentifier
sub _AuthorityKeyIdentifier {
    my $self = shift;
    my $extensions = $self->{'tbsCertList'}->{'crlExtensions'};

    if ( not defined $extensions ) { return undef; } # no extensions in certificate

    if ( defined $self->{'tbsCertList'}{'AuthorityKeyIdentifier'} ) {
        return ( $self->{'tbsCertList'}{'AuthorityKeyIdentifier'} );
    }

    for my $extension ( @{ $extensions } ) {
        if ( $extension->{'extnID'} eq '2.5.29.35' ) { # OID for AuthorityKeyIdentifier
            my $parser = _init('AuthorityKeyIdentifier');
            $self->{'tbsCertList'}{'AuthorityKeyIdentifier'} = $parser->decode( $extension->{'extnValue'} );
            if ( $parser->error ) {
                $self->{"_error"} = $parser->error;
                return undef;
            }
            return $self->{'tbsCertList'}{'AuthorityKeyIdentifier'};
        }
    }
    return undef;
}


sub authorityCertIssuer {
	my $self = shift;
	my ( $i , $type );
	my $rdn = _AuthorityKeyIdentifier( $self );
	if ( not defined ( $rdn ) ) {
		return (undef); # we do not have that extension
	} else {
		$rdn = $rdn->{'authorityCertIssuer'}[0]->{'directoryName'};
	}
	$rdn->{'dn'} = [];
        my $dn = $rdn->{'dn'};
	$rdn = $rdn->{'rdnSequence'};
	for my $r ( @{ $rdn } ) {
		$i = @{ $r }[0];
		if ( $oid2attr{ $i->{'type'} } ) {
			$type = $oid2attr{ $i->{'type'} };
		} else {
			$type = $i->{'type'};
		}
		my @key = keys ( %{ $i->{'value'} } );
		push @{ $dn } , $type . "=" . $i->{'value'}->{ $key[0] };
	}
	return $dn;
}

sub _authcert_part {
	my $self = shift;
	my $oid = shift;
	my $rdn = _AuthorityKeyIdentifier( $self );
	if ( not defined ( $rdn ) ) {
		return (undef); # we do not have that extension
	} else {
		$rdn = $rdn->{'authorityCertIssuer'}[0]->{'directoryName'}->{'rdnSequence'};
	}
	for my $r ( @{ $rdn } ) {
		my $i = @{ $r }[0];
		if ( $i->{'type'} eq $oid ) {
			my @key = keys ( %{ $i->{'value'} } );
			return $i->{'value'}->{ $key[0] };
		 }
	}
	return undef;
}


sub authority_serial {
	my $self = shift;
    return ( $self->_AuthorityKeyIdentifier )->{authorityCertSerialNumber};
}


sub authority_cn {
	my $self = shift;
	return _authcert_part( $self , '2.5.4.3' );
}


sub authority_country {
	my $self = shift;
	return _authcert_part( $self , '2.5.4.6' );
}


sub authority_state {
	my $self = shift;
	return _authcert_part( $self , '2.5.4.8' );

}


sub authority_locality {
	my $self = shift;
	return _authcert_part( $self , '2.5.4.7' );
}


sub authority_org {
	my $self = shift;
	return _authcert_part( $self , '2.5.4.10' );
}


sub authority_email {
	my $self = shift;
	return _authcert_part( $self , '1.2.840.113549.1.9.1' );
}


# crl_number (another extension)
sub crl_number {
    my $self = shift;
    my $extension;
    my $extensions = $self->{'tbsCertList'}->{'crlExtensions'};

    if ( defined $self->{'tbsCertList'}{'cRLNumber'} ) {
        return ( $self->{'tbsCertList'}{'cRLNumber'} );
    }

    if ( not defined $extensions ) { return undef; } # no extensions in certificate

    for $extension ( @{ $extensions } ) {
        if ( $extension->{'extnID'} eq '2.5.29.20' ) { # OID for CRLNumber
            my $parser = _init('cRLNumber'); # get a parser for this
            $self->{'tbsCertList'}{'cRLNumber'} = $parser->decode( $extension->{'extnValue'} ); # decode the value
            if ( $parser->error ) {
                $self->{"_error"} = $parser->error;
                return undef;
            }
            return $self->{'tbsCertList'}{'cRLNumber'};
        }
    }
    return undef;
}


# IDPs
sub IDPs {
    my $self = shift;
    my $extension;
    my $extensions = $self->{'tbsCertList'}->{'crlExtensions'};

    if ( defined $self->{'tbsCertList'}{'idp'} ) {
        return ( $self->{'tbsCertList'}{'idp'} );
    }

    if ( not defined $extensions ) { return undef; } # no extensions in certificate

    for $extension ( @{ $extensions } ) {
        if ( $extension->{'extnID'} eq '2.5.29.28' ) { # OID for issuingDistributionPoint
            my $parser = _init('issuingDistributionPoint'); # get a parser for this
            my $idps = $parser->decode( $extension->{'extnValue'} ); # decode the value
            if ( $parser->error ) {
                $self->{"_error"} = $parser->error;
                return undef;
            }

	    # set the critical flag
            if ( exists $extension->{'critical'} ) {
		$self->{'tbsCertList'}{'idp'}{'critical'} = $extension->{'critical'};
	    } else {
	    	$self->{'tbsCertList'}{'idp'}{'critical'} = 0;
	    }

	    # set the onlyContainsUserCerts flag
            if ( exists $idps->{'onlyContainsUserCerts'} ) {
		$self->{'tbsCertList'}{'idp'}{'onlyUserCerts'} = $idps->{'onlyContainsUserCerts'};
	    } else {
	    	$self->{'tbsCertList'}{'idp'}{'onlyUserCerts'} = 0;
	    }

	    # set the onlyContainsCACerts flag
            if ( exists $idps->{'onlyContainsCACerts'} ) {
		$self->{'tbsCertList'}{'idp'}{'onlyCaCerts'} = $idps->{'onlyContainsCACerts'};
	    } else {
	    	$self->{'tbsCertList'}{'idp'}{'onlyCaCerts'} = 0;
	    }

	    # set the onlyContainsAttributeCerts flag
            if ( exists $idps->{'onlyContainsAttributeCerts'} ) {
            	$self->{'tbsCertList'}{'idp'}{'onlyAttribCerts'} = $idps->{'onlyContainsAttributeCerts'}
	    } else {
	    	$self->{'tbsCertList'}{'idp'}{'onlyAttribCerts'} = 0;
	    }

	    # set the indirectCRL flag
	    if ( exists $idps->{'indirectCRL'} ) {
		$self->{'tbsCertList'}{'idp'}{'indirectCRL'} = $idps->{'indirectCRL'}
	    } else {
	    	$self->{'tbsCertList'}{'idp'}{'indirectCRL'} = 0
	    }

	    # set the defaults for directory_addr and url
	    $self->{'tbsCertList'}{'idp'}{'directory_addr'} = undef;
	    $self->{'tbsCertList'}{'idp'}{'url'} = undef;

	    # set the directory_addr and/or URL values
            for my $each_fullName ( @{ $idps->{'distributionPoint'}->{'fullName'} } ) { # this loops through multiple "fullName" values
	        if ( exists $each_fullName->{directoryName} ) {
	    	    # found a rdnSequence
		    $self->{'tbsCertList'}{'idp'}{'directory_addr'} =
		    join( ', ' , reverse @{ _IDP_rdn( $each_fullName->{directoryName}->{rdnSequence} ) } );
	        } elsif ( exists $each_fullName->{uniformResourceIdentifier} ) {
		    # found a URI
		    $self->{'tbsCertList'}{'idp'}{'url'} = $each_fullName->{uniformResourceIdentifier};
	        } else {
		    # found some other type of IDP value
		    # return undef;
	        }
	    }

	    # set the reason flags BIT STRING
	    if ( exists $idps->{'onlySomeReasons'} ) {
	    	$self->{'tbsCertList'}{'idp'}{'reasonFlags'} = $idps->{'onlySomeReasons'};
	    } else {
	    	$self->{'tbsCertList'}{'idp'}{'reasonFlags'} = undef;
	    }

            return $self->{'tbsCertList'}{'idp'};
        }
    }
    return undef;
}

# internal function for parsing the rdn sequence parts
sub _IDP_rdn {
	my $crl_rdn = shift; # this should be the passed in 'rdnSequence' array
	my ( $i ,$type );
	my $crl_dn = [];
	for my $part ( @{$crl_rdn} ) {
		$i = @{$part}[0];
		if ( $oid2attr{ $i->{'type'} } ) {
			$type = $oid2attr{ $i->{'type'} };
		 } else {
            		$type = $i->{'type'};
        	 }
		my @key = keys ( %{ $i->{'value'} } );
		push @{ $crl_dn } , $type . "=" . $i->{'value'}->{ $key[0] };
	}
	return $crl_dn;
}

#########################################################################
#
# ------- CRL ENTRY EXTENSIONS -------
#
# valid RFC 3280 CRL Entry Extensions:
#	Reason Code
#	Hold Instruction Code
#	Invalidity Date
#	Certificate Issuer
#
#########################################################################


# revocation_list
sub revocation_list {
    my $self = shift;
    my @crl_reason = qw(unspecified keyCompromise cACompromise affiliationChanged superseded
    			cessationOfOperation certificateHold removeFromCRL privilegeWithdrawn
    			aACompromise);
    my %hold_codes = (
	    '1.2.840.10040.2.1' => 'holdinstruction-none',
	    '1.2.840.10040.2.2' => 'holdinstruction-callissuer',
	    '1.2.840.10040.2.3' => 'holdinstruction-reject',
	    );

    if ( defined $self->{'tbsCertList'}{'rl'} ) {
        return ( $self->{'tbsCertList'}{'rl'} );
    }

    my $rls = $self->{'tbsCertList'}->{'revokedCertificates'};
    if ( not defined $rls ) { # no revoked certs in this CRL
        $self->{'tbsCertList'}{'rl'} = undef;
        return $self->{'tbsCertList'}{'rl'};
    }

    for my $rl ( @{ $rls } ) {
        # the below assignment of 'utcTime' is based on the RFC of dates through the
        # year 2049, after which the RFC calls for dates to be listed as
        # 'GeneralizedTime' or in the ASN1 below for Time as 'generalTime'.
        if ( exists $rl->{'revocationDate'}{'utcTime'} ) {
            $self->{'tbsCertList'}{'rl'}{ $rl->{'userCertificate'} }{'revocationDate'} =
                                                        $rl->{'revocationDate'}{'utcTime'};
        } elsif ( exists $rl->{'revocationDate'}{'generalTime'} ) {
            $self->{'tbsCertList'}{'rl'}{ $rl->{'userCertificate'} }{'revocationDate'} =
                                                    $rl->{'revocationDate'}{'generalTime'};
	} else {
            $self->{'tbsCertList'}{'rl'}{ $rl->{'userCertificate'} }{'revocationDate'} = undef;
	}

        for my $extension ( @{ $rl->{'crlEntryExtensions'} } ) {
            if ( $extension->{'extnID'} eq '2.5.29.21' ) { # OID for crlReason
                my $parser = _init('CRLReason'); # get a parser for this
                my $reason = $parser->decode( $extension->{'extnValue'} ); # decode the value
                if ( $parser->error ) {
                    $self->{"_error"} = $parser->error;
                    return undef;
                }
                $self->{'tbsCertList'}{'rl'}{ $rl->{'userCertificate'} }{'crlReason'} =
                                                        $crl_reason[ $reason ];

            } elsif ( $extension->{'extnID'} eq '2.5.29.24' ) { # OID for invalidityDate
                my $parser = _init('invalidityDate');
                my $invalid_date = $parser->decode( $extension->{'extnValue'} );
                if ( $parser->error ) {
                    $self->{"_error"} = $parser->error;
                    return undef;
                }
                $self->{'tbsCertList'}{'rl'}{ $rl->{'userCertificate'} }{'invalidityDate'} =
                                                                              $invalid_date;

            } elsif ( $extension->{'extnID'} eq '2.5.29.23' ) { # OID for holdInstructionCode
                my $parser = _init('holdInstructionCode');
                my $hold_code = $parser->decode( $extension->{'extnValue'} );
                if ( $parser->error ) {
                    $self->{"_error"} = $parser->error;
                    return undef;
                }
                $self->{'tbsCertList'}{'rl'}{ $rl->{'userCertificate'} }{'holdInstructionCode'} =
                                                        $hold_codes{ $hold_code };

            } else {
                # unimplemented OID(s) found
                $self->{'tbsCertList'}{'rl'}{ $rl->{'userCertificate'} }{ $extension->{'extnID'} } =
                					$extension->{'extnValue'};
            }
        }
    }
    return $self->{'tbsCertList'}{'rl'};
}


#######################################################################
# internal function
#######################################################################

# _init is the initialzation function and is also used for subsequent
# decoding of the inner parts of the object.
sub _init {
        my $what  = shift;
        if ( ( not defined $what ) or ( '' eq $what ) ) { $what = 'CertificateList' }
	if ( not defined $asn) {
		$asn = Convert::ASN1->new;
		$asn->prepare(<
-- ASN.1 from RFC 3280 and X509 (April 2002)
-- Adapted for use with Convert::ASN1


-- attribute data types --

   Attribute ::= SEQUENCE {
	type			AttributeType,
	values			SET OF AttributeValue
		-- at least one value is required --
	}

   AttributeType ::= OBJECT IDENTIFIER

   AttributeValue ::= DirectoryString  --ANY

   AttributeTypeAndValue ::= SEQUENCE {
	type			AttributeType,
	value			AttributeValue
	}


-- naming data types --

   Name ::= CHOICE { -- only one possibility for now
	rdnSequence		RDNSequence
	}

   RDNSequence ::= SEQUENCE OF RelativeDistinguishedName

   RelativeDistinguishedName ::=
	SET OF AttributeTypeAndValue  --SET SIZE (1 .. MAX) OF


-- Directory string type --

   DirectoryString ::= CHOICE {
	teletexString		TeletexString,  --(SIZE (1..MAX)),
	printableString		PrintableString,  --(SIZE (1..MAX)),
	bmpString		BMPString,  --(SIZE (1..MAX)),
	universalString		UniversalString,  --(SIZE (1..MAX)),
	utf8String		UTF8String,  --(SIZE (1..MAX)),
	ia5String		IA5String,  --added for EmailAddress,
	integer			INTEGER
	}


-- CRL specific structures begin here

   CertificateList ::= SEQUENCE  {
        tbsCertList          TBSCertList,
        signatureAlgorithm   AlgorithmIdentifier,
        signatureValue       BIT STRING
        }


   TBSCertList ::= SEQUENCE  {
        version                 Version OPTIONAL,  -- if present, MUST be v2
        signature               AlgorithmIdentifier,
        issuer                  Name,
        thisUpdate              Time,
        nextUpdate              Time OPTIONAL,

        revokedCertificates     RevokedCertificates OPTIONAL,
        crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
	}

   RevokedCertificates ::= SEQUENCE OF RevokedCerts

   RevokedCerts ::= SEQUENCE  {
	userCertificate         CertificateSerialNumber,
	revocationDate          Time,
	crlEntryExtensions      Extensions OPTIONAL
	}

   -- Version, Time, CertificateSerialNumber, and Extensions
   -- are all defined in the ASN.1 in section 4.1

   -- AlgorithmIdentifier is defined in section 4.1.1.2

   Version ::= INTEGER  --{  v1(0), v2(1), v3(2)  }

   CertificateSerialNumber ::= INTEGER

   AlgorithmIdentifier ::= SEQUENCE {
	algorithm		OBJECT IDENTIFIER,
	parameters		ANY
	}


   Name ::= CHOICE { -- only one possibility for now
	rdnSequence		RDNSequence
	}


   Time ::= CHOICE {
	utcTime			UTCTime,
	generalTime		GeneralizedTime
	}

--extensions

   Extensions ::= SEQUENCE OF Extension  --SIZE (1..MAX) OF Extension

   Extension ::= SEQUENCE {
	extnID			OBJECT IDENTIFIER,
	critical		BOOLEAN OPTIONAL,  --DEFAULT FALSE,
	extnValue		OCTET STRING
	}

   AuthorityKeyIdentifier ::= SEQUENCE {
      keyIdentifier             [0] KeyIdentifier            OPTIONAL,
      authorityCertIssuer       [1] GeneralNames             OPTIONAL,
      authorityCertSerialNumber [2] CertificateSerialNumber  OPTIONAL }
    -- authorityCertIssuer and authorityCertSerialNumber shall both
    -- be present or both be absent

   KeyIdentifier ::= OCTET STRING

   GeneralNames ::= SEQUENCE OF GeneralName

   GeneralName ::= CHOICE {
     otherName                       [0]     AnotherName,
     rfc822Name                      [1]     IA5String,
     dNSName                         [2]     IA5String,
     x400Address                     [3]     ANY, --ORAddress,
     directoryName                   [4]     Name,
     ediPartyName                    [5]     EDIPartyName,
     uniformResourceIdentifier       [6]     IA5String,
     iPAddress                       [7]     OCTET STRING,
     registeredID                    [8]     OBJECT IDENTIFIER }

-- AnotherName replaces OTHER-NAME ::= TYPE-IDENTIFIER, as
-- TYPE-IDENTIFIER is not supported in the 88 ASN.1 syntax

   AnotherName ::= SEQUENCE {
     type    OBJECT IDENTIFIER,
     value      [0] EXPLICIT ANY } --DEFINED BY type-id }

   EDIPartyName ::= SEQUENCE {
     nameAssigner            [0]     DirectoryString OPTIONAL,
     partyName               [1]     DirectoryString }

-- id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= { id-ce 28 }

   issuingDistributionPoint ::= SEQUENCE {
        distributionPoint          [0] DistributionPointName OPTIONAL,
        onlyContainsUserCerts      [1] BOOLEAN OPTIONAL,  --DEFAULT FALSE,
        onlyContainsCACerts        [2] BOOLEAN OPTIONAL,  --DEFAULT FALSE,
        onlySomeReasons            [3] ReasonFlags OPTIONAL,
        indirectCRL                [4] BOOLEAN OPTIONAL,  --DEFAULT FALSE,
        onlyContainsAttributeCerts [5] BOOLEAN OPTIONAL   --DEFAULT FALSE
        }

   DistributionPointName ::= CHOICE {
     fullName                [0]     GeneralNames,
     nameRelativeToCRLIssuer [1]     RelativeDistinguishedName }

   ReasonFlags ::= BIT STRING --{
   --     unused                  (0),
   --     keyCompromise           (1),
   --     cACompromise            (2),
   --     affiliationChanged      (3),
   --     superseded              (4),
   --     cessationOfOperation    (5),
   --     certificateHold         (6),
   --     privilegeWithdrawn      (7),
   --     aACompromise            (8) }

-- id-ce-cRLNumber OBJECT IDENTIFIER ::= { id-ce 20 }

   cRLNumber ::= INTEGER --(0..MAX)

-- id-ce-cRLReason OBJECT IDENTIFIER ::= { id-ce 21 }

   -- reasonCode ::= { CRLReason }

   CRLReason ::= ENUMERATED {
        unspecified             (0),
        keyCompromise           (1),
        cACompromise            (2),
        affiliationChanged      (3),
        superseded              (4),
        cessationOfOperation    (5),
        certificateHold         (6),
        removeFromCRL           (8),
        privilegeWithdrawn      (9),
        aACompromise           (10) }

-- id-ce-holdInstructionCode OBJECT IDENTIFIER ::= { id-ce 23 }

   holdInstructionCode ::= OBJECT IDENTIFIER

-- holdInstruction    OBJECT IDENTIFIER ::=
--                  { iso(1) member-body(2) us(840) x9-57(10040) 2 }
--
-- id-holdinstruction-none   OBJECT IDENTIFIER ::= {holdInstruction 1}
-- id-holdinstruction-callissuer
--                           OBJECT IDENTIFIER ::= {holdInstruction 2}
-- id-holdinstruction-reject OBJECT IDENTIFIER ::= {holdInstruction 3}

-- id-ce-invalidityDate OBJECT IDENTIFIER ::= { id-ce 24 }

   invalidityDate ::=  GeneralizedTime

-- id-ce-certificateIssuer   OBJECT IDENTIFIER ::= { id-ce 29 }

   certificateIssuer ::=     GeneralNames

ASN1
        }
        my $self = $asn->find( $what );
        return $self;
}



1;

__DATA__