cddl 0.8.8 → 0.9.3

data/test-data/lint1.cddl

@@ -0,0 +1,9 @@
+$instance-value-choice = (
+  comid.mac-addr => mac-addr-type //
+  comid.ip-addr => ip-addr-type //
+  comid.serial-number => serial-number-type //
+  comid.ueid => ueid //
+  comid.uuid => uuid
+)
+
+; this populates a type socket with a group choice

data/test-data/mdl-ble.cddl

@@ -0,0 +1,9 @@
+BLEIdentification = {
+    ? 0 : bool,
+    ? 1 : bool,
+    ? 10 : bstr,
+; Indicates support for Peripheral server mode
+; Indicates support for Central client mode
+; Optional UUID for peripheral server mode
+    ? 11 : bstr ; Optional MAC address for peripheral server mode 
+}

data/test-data/mdl-deve.cddl

@@ -0,0 +1,54 @@
+deviceEngagement = [
+    uint,
+    security,
+    transferMethods,
+    options,
+    ? proprietary
+]
+security = [
+    bstr,
+uint, uint
+]
+transferMethods = [
+    * transferMethod
+]
+options = {
+    ?"WebAPI" : WebAPI,
+    ?"OIDC" : OIDC,
+    ?"compact" : bool
+}
+proprietary = {
+    * tstr => any
+}
+transferMethod = [
+    uint,
+uint, * any
+]
+OIDC = [
+  uint,
+  tstr,
+  tstr
+]
+WebAPI = [
+  uint,
+  tstr, tstr
+]
+; Version of device engagement structure, currently 1
+; Security structure
+; Transfer methods
+; Optional elements
+; Proprietary elements
+; mDL public ephemeral key, mDL.EPub
+; curve identifier, see Table 23
+; cipher suite identifier, see Table 22
+; details for transfer methods
+; any number of elements
+; type
+; version
+; specific option(s) to the type
+; version
+; url
+; token
+; version
+; url
+; token

data/test-data/mdl-dp.cddl

@@ -0,0 +1,11 @@
+driving_privileges = [
+    * driving_privilege
+]
+driving_privilege  = {
+    vehicle_category_code: tstr
+    ?issue_date: #6.0(tstr)
+    ?expiry_date: #6.0(tstr)
+    ?code: tstr
+    ?sign: tstr
+    ?value: int
+}

data/test-data/mdl-mso.cddl

@@ -0,0 +1,20 @@
+MobileSecurityObject = {
+   "DigestAlgorithm" : tstr,
+   "ValueDigests" : ValueDigests,
+   "DeviceKey" : COSE_Key,
+   "DocType" : tstr
+}
+ValueDigests = {
+    "NameSpaces" : NameSpaces
+}
+NameSpaces = {
+    + NameSpace => DigestIDs
+}
+DigestIDs = {
+    + DigestID => Digest
+}
+NameSpace = tstr
+DigestID = uint
+Digest = bstr
+
+COSE_Key = "COSE_Key"

data/test-data/mdl-request.cddl

@@ -0,0 +1,26 @@
+Request = {
+    "Version" : tstr,
+    "DocRequests" : [+ DocRequest]
+}
+DocRequest = {
+    "ItemsRequest" : ItemsRequest,
+    ? "ReaderAuth" : COSE_Sign1
+}
+ItemsRequest = {
+    ? "DocType" : DocType,
+    "NameSpaces" : NameSpaces,
+    ? "RequestInfo" : {* tstr => any}
+}
+NameSpaces = {
+    + NameSpace => DataItemNames
+}
+DocType = tstr
+NameSpace = tstr
+DataItemNames = [ + tstr ]
+; Additional info the reader wants to provide
+; Requested data elements for each NameSpace
+; See 7.3.2
+; See 7.3.3
+; See Table 2
+
+COSE_Sign1 = "COSE_Sign1"

data/test-data/mdl-response.cddl

@@ -0,0 +1,66 @@
+Response = {
+    "Version" : tstr,
+    ? "Documents" : Documents,
+    ? "Error" : int
+}
+Documents = {
+    + DocType => ResponseData
+}
+; Version of the structure, currently 1.0
+; Returned documents, may be absent if Error is present
+; Error codes according to Table 8
+ResponseData = {
+    "IssuerSigned" : IssuerSigned,  ; Responded data elements signed by the issuer
+    "DeviceSigned" : DeviceSigned,  ; Responded data elements signed by the mDL
+    "Errors" : Errors
+}
+IssuerSigned = {
+    "NameSpaces" : IssuerNameSpaces,
+    "IssuerAuth" : COSE_Sign1       ; The payload is the MobileSecurityObject, see 9.2.1.4
+}
+IssuerNameSpaces = {
+    + NameSpace => [ + IssuerSignedItem ]
+}
+IssuerSignedItem = [
+    uint,
+    bstr,
+    tstr,
+    any
+]
+DeviceSigned = {
+    "NameSpaces" : DeviceNameSpaces,  ; Currently only online token and URL are defined as DeviceSignedItems
+    "DeviceAuth" : DeviceAuth
+}
+DeviceNameSpaces = {
+    * NameSpace => DeviceSignedItems
+}
+DeviceSignedItems = {
+    + DataItemName => DataItemValue
+}
+DeviceAuth = {
+    "Signature" : COSE_Sign1, //
+                                      ; Use a nil value for the payload, the detached content is the DeviceAuthentication structure, see 9.2.2.4
+    "MAC" : COSE_Mac0
+}
+Errors = {
+    * NameSpace => [ + ErrorItem ]
+}
+ErrorItem = {
+    DataItemName => ErrorCode
+}
+DocType = tstr
+NameSpace = tstr
+DataItemName = tstr
+DataItemValue = any
+ErrorCode = int
+; See table 9
+; See 7.3.2
+; See 7.3.3
+; See Table 2
+; See Table 2
+; Error codes according to Table 9
+; Structures used for DeviceAuth signature or MAC generation, see 9.2.2.4
+; Structures used for MobileSecurityObject, see 9.2.1.4
+
+COSE_Sign1 = "COSE_Sign1"
+COSE_Mac0 = "COSE_Mac0"

data/test-data/mdl.cddl

@@ -0,0 +1,11 @@
+driving_privileges = [
+    * driving_privilege
+]
+driving_privilege  = {
+    vehicle_category_code: tstr
+    ?issue_date: #6.0(tstr)
+    ?expiry_date: #6.0(tstr)
+    ?code: tstr
+    ?sign: tstr
+    ?value: int
+}

data/test-data/mon-val.cddl

@@ -0,0 +1 @@
+decimal-monetary-value = text .regexp "-?[0-9]+(\\.[0-9]+)?"

data/test-data/multipart-ct.cddl

@@ -0,0 +1,2 @@
+multipart-core = [* multipart-part]
+multipart-part = (type: uint .size 2, part: bytes / null)

data/test-data/named-group.cddl

@@ -0,0 +1,7 @@
+foo = { + $$elements }
+
+$$elements //= element1
+$$elements //= element2
+
+element1 = (1: "a")
+element2 = (2: "b")

data/test-data/non-empty.cddl

@@ -0,0 +1,5 @@
+distinguishedName = non-empty<{
+   ? country: text
+ }>
+
+ non-empty<M> = (M) .and ({ + any => any })

data/test-data/oid.cddl

@@ -0,0 +1,8 @@
+oid = bytes .abnfb ("oid" .cat cbor-tags-oid)
+
+cbor-tags-oid = '
+oid = 1*arc
+roid = *arc
+arc = [nlsb] %x00-7f
+nlsb = %x81-ff *%x80-ff
+'

data/test-data/oidbat.cddl

@@ -0,0 +1,8 @@
+oid = bytes .abnfb ("oid" .bat cbor-tags-oid)
+
+cbor-tags-oid = '
+  oid = 1*arc
+  roid = *arc
+  arc = [nlsb] %x00-7f
+  nlsb = %x81-ff *%x80-ff
+'

data/test-data/plus.cddl

@@ -0,0 +1,3 @@
+a = {
++ any => any
+}

data/test-data/sasl.cddl

@@ -0,0 +1,24 @@
+message = text .abnfb ("message" .cat rfc4505)
+
+rfc4505 = '
+message     = [ email / token ]
+              ;; to be prepared in accordance with Section 3
+
+UTF1        = %x00-3F / %x41-7F ;; less "@" (U+0040)
+UTF2        = %xC2-DF UTF0
+UTF3        = %xE0 %xA0-BF UTF0 / %xE1-EC 2(UTF0) /
+              %xED %x80-9F UTF0 / %xEE-EF 2(UTF0)
+UTF4        = %xF0 %x90-BF 2(UTF0) / %xF1-F3 3(UTF0) /
+              %xF4 %x80-8F 2(UTF0)
+UTF0        = %x80-BF
+
+TCHAR       = UTF1 / UTF2 / UTF3 / UTF4
+              ;; any UTF-8 encoded Unicode character
+              ;; except "@" (U+0040)
+
+email        = "too@much.work"; for this example
+;email       = addr-spec
+              ;; as defined in [IMAIL]
+
+token       = 1*255TCHAR
+'

data/test-data/sequence.cddl

@@ -0,0 +1 @@
+a = [tstr, tstr, tstr]

data/test-data/sipos.cddl

@@ -0,0 +1,8 @@
+; start = {*$$socket}
+; $$socket //= (4: bstr)
+; $ cddl works.cddl generate 
+; {4: h'6F7267616E69736D'}
+; $ cat fails.cddl
+start = {*$$socket}
+$$socket //= (some,)
+some = (4: bstr)

data/test-data/star-edited.cddl

@@ -0,0 +1,98 @@
+csr-template-schema = {
+  keyTypes: [ 1* $keyType ]
+  ? subject: distinguishedName
+  extensions: extensions
+}
+
+mandatory-wildcard = "**"
+optional-wildcard = "*"
+wildcard = mandatory-wildcard / optional-wildcard
+
+; non-empty = { + any => any }
+non-empty<M> = (M) .and ({ + any => any })
+
+; regtext matches all text strings but "*" and "**"
+regtext = text .regexp "([^\*].*)|([\*][^\*].*)|([\*][\*].+)"
+
+regtext-or-wildcard = regtext / wildcard
+
+distinguishedName = non-empty<{
+  ? country: regtext-or-wildcard
+  ? stateOrProvince: regtext-or-wildcard
+  ? locality: regtext-or-wildcard
+  ? organization: regtext-or-wildcard
+  ? organizationalUnit: regtext-or-wildcard
+  ? emailAddress: regtext-or-wildcard
+  ? commonName: regtext-or-wildcard
+}>
+
+$keyType /= rsaKeyType
+$keyType /= ecdsaKeyType
+
+rsaKeyType = {
+  PublicKeyType: "rsaEncryption" ; OID: 1.2.840.113549.1.1.1
+  PublicKeyLength: rsaKeySize
+  SignatureType: $rsaSignatureType
+}
+
+rsaKeySize = int .ge 2048
+
+; RSASSA-PKCS1-v1_5 with SHA-256
+$rsaSignatureType /= "sha256WithRSAEncryption"
+; RSASSA-PCKS1-v1_5 with SHA-384
+$rsaSignatureType /= "sha384WithRSAEncryption"
+; RSASSA-PCKS1-v1_5 with SHA-512
+$rsaSignatureType /= "sha512WithRSAEncryption"
+; RSASSA-PSS with SHA-256, MGF-1 with SHA-256, and a 32 byte salt
+$rsaSignatureType /= "sha256WithRSAandMGF1"
+; RSASSA-PSS with SHA-384, MGF-1 with SHA-384, and a 48 byte salt
+$rsaSignatureType /= "sha384WithRSAandMGF1"
+; RSASSA-PSS with SHA-512, MGF-1 with SHA-512, and a 64 byte salt
+$rsaSignatureType /= "sha512WithRSAandMGF1"
+
+ecdsaKeyType = {
+  PublicKeyType: "id-ecPublicKey" ; OID: 1.2.840.10045.2.1
+  namedCurve: $ecdsaCurve
+  SignatureType: $ecdsaSignatureType
+}
+
+$ecdsaCurve /= "secp256r1" ; OID: 1.2.840.10045.3.1.7
+$ecdsaCurve /= "secp384r1" ; OID: 1.3.132.0.34
+$ecdsaCurve /= "secp521r1" ; OID: 1.3.132.0.3
+
+$ecdsaSignatureType /= "ecdsa-with-SHA256" ; paired with secp256r1
+$ecdsaSignatureType /= "ecdsa-with-SHA384" ; paired with secp384r1
+$ecdsaSignatureType /= "ecdsa-with-SHA512" ; paired with secp521r1
+
+subjectaltname = {
+  ? DNS: [ 1* regtext-or-wildcard ]
+  ? Email: [ 1* regtext ]
+  ? URI: [ 1* regtext ]
+  * $$subjectaltname-extension
+}
+
+extensions = {
+  ? keyUsage: [ 1* keyUsageType ]
+  ? extendedKeyUsage: [ 1* extendedKeyUsageType ]
+  subjectAltName: subjectaltname
+}
+
+keyUsageType /= "digitalSignature"
+keyUsageType /= "nonRepudiation"
+keyUsageType /= "keyEncipherment"
+keyUsageType /= "dataEncipherment"
+keyUsageType /= "keyAgreement"
+keyUsageType /= "keyCertSign"
+keyUsageType /= "cRLSign"
+keyUsageType /= "encipherOnly"
+keyUsageType /= "decipherOnly"
+
+extendedKeyUsageType /= "serverAuth"
+extendedKeyUsageType /= "clientAuth"
+extendedKeyUsageType /= "codeSigning"
+extendedKeyUsageType /= "emailProtection"
+extendedKeyUsageType /= "timeStamping"
+extendedKeyUsageType /= "OCSPSigning"
+extendedKeyUsageType /= oid
+
+oid = text .regexp "[0-9]+(\\.[0-9]+)*"

data/test-data/star.cddl

@@ -0,0 +1,95 @@
+csr-template-schema = {
+  keyTypes: [ 1* $keyType ]
+  ? subject: distinguishedName
+  extensions: extensions
+}
+
+mandatory-wildcard = "**"
+optional-wildcard = "*"
+wildcard = mandatory-wildcard / optional-wildcard
+
+; regtext matches all text strings but "*" and "**"
+regtext = text .regexp "([^\*].*)|([\*][^\*].*)|([\*][\*].+)"
+
+regtext-or-wildcard = regtext / wildcard
+
+distinguishedName = {
+  ? country: regtext-or-wildcard
+  ? stateOrProvince: regtext-or-wildcard
+  ? locality: regtext-or-wildcard
+  ? organization: regtext-or-wildcard
+  ? organizationalUnit: regtext-or-wildcard
+  ? emailAddress: regtext-or-wildcard
+  ? commonName: regtext-or-wildcard
+}
+
+$keyType /= rsaKeyType
+$keyType /= ecdsaKeyType
+
+rsaKeyType = {
+  PublicKeyType: "rsaEncryption" ; OID: 1.2.840.113549.1.1.1
+  PublicKeyLength: rsaKeySize
+  SignatureType: $rsaSignatureType
+}
+
+rsaKeySize = int .ge 2048
+
+; RSASSA-PKCS1-v1_5 with SHA-256
+$rsaSignatureType /= "sha256WithRSAEncryption"
+; RSASSA-PCKS1-v1_5 with SHA-384
+$rsaSignatureType /= "sha384WithRSAEncryption"
+; RSASSA-PCKS1-v1_5 with SHA-512
+$rsaSignatureType /= "sha512WithRSAEncryption"
+; RSASSA-PSS with SHA-256, MGF-1 with SHA-256, and a 32 byte salt
+$rsaSignatureType /= "sha256WithRSAandMGF1"
+; RSASSA-PSS with SHA-384, MGF-1 with SHA-384, and a 48 byte salt
+$rsaSignatureType /= "sha384WithRSAandMGF1"
+; RSASSA-PSS with SHA-512, MGF-1 with SHA-512, and a 64 byte salt
+$rsaSignatureType /= "sha512WithRSAandMGF1"
+
+ecdsaKeyType = {
+  PublicKeyType: "id-ecPublicKey" ; OID: 1.2.840.10045.2.1
+  namedCurve: $ecdsaCurve
+  SignatureType: $ecdsaSignatureType
+}
+
+$ecdsaCurve /= "secp256r1" ; OID: 1.2.840.10045.3.1.7
+$ecdsaCurve /= "secp384r1" ; OID: 1.3.132.0.34
+$ecdsaCurve /= "secp521r1" ; OID: 1.3.132.0.3
+
+$ecdsaSignatureType /= "ecdsa-with-SHA256" ; paired with secp256r1
+$ecdsaSignatureType /= "ecdsa-with-SHA384" ; paired with secp384r1
+$ecdsaSignatureType /= "ecdsa-with-SHA512" ; paired with secp521r1
+
+subjectaltname = {
+  ? DNS: [ 1* regtext-or-wildcard ]
+  ? Email: [ 1* regtext ]
+  ? URI: [ 1* regtext ]
+  * $$subjectaltname-extension
+}
+
+extensions = {
+  ? keyUsage: [ 1* keyUsageType ]
+  ? extendedKeyUsage: [ 1* extendedKeyUsageType ]
+  subjectAltName: subjectaltname
+}
+
+keyUsageType /= "digitalSignature"
+keyUsageType /= "nonRepudiation"
+keyUsageType /= "keyEncipherment"
+keyUsageType /= "dataEncipherment"
+keyUsageType /= "keyAgreement"
+keyUsageType /= "keyCertSign"
+keyUsageType /= "cRLSign"
+keyUsageType /= "encipherOnly"
+keyUsageType /= "decipherOnly"
+
+extendedKeyUsageType /= "serverAuth"
+extendedKeyUsageType /= "clientAuth"
+extendedKeyUsageType /= "codeSigning"
+extendedKeyUsageType /= "emailProtection"
+extendedKeyUsageType /= "timeStamping"
+extendedKeyUsageType /= "OCSPSigning"
+extendedKeyUsageType /= oid
+
+oid = text .regexp "[0-9]+(\\.[0-9]+)*"

data/test-data/test-gen.cddl

@@ -0,0 +1,3 @@
+foo = arr<mapa<arr<int>, arr<text>>>
+arr<X> = [* X]
+mapa<X, Y> = {a: X, b: Y}

data/test-data/time.cddl

@@ -0,0 +1,11 @@
+etime = #6.1001({
+  1: int,
+  ? (
+    -3: uint .lt 1000 //
+    -6: uint .lt 1000000 //
+    -9: uint .lt 1000000000 //
+    -12: uint .lt 1000000000000 //
+    -15: uint .lt 1000000000000000 //
+    -18: uint .lt 1000000000000000000
+  )
+})

data/test-data/yangid.cddl

@@ -0,0 +1 @@
+a = text .regexp "[a-z][a-z0-9]*(-[a-z0-9]+)*"

data/test-data/yaron1.cddl

@@ -0,0 +1,95 @@
+csr-template-schema = {
+  keyTypes: [ 1* $keyType ]
+  ? subject: distinguishedName
+  extensions: extensions
+}
+
+mandatory-wildcard = "**"
+optional-wildcard = "*"
+wildcard = mandatory-wildcard / optional-wildcard
+
+; regtext matches all text strings but "*" and "**"
+regtext = text .regexp "([^\*].*)|([\*][^\*].*)|([\*][\*].+)"
+
+regtext-or-wildcard = regtext / wildcard
+
+distinguishedName = {
+  ? country: regtext-or-wildcard
+  ? stateOrProvince: regtext-or-wildcard
+  ? locality: regtext-or-wildcard
+  ? organization: regtext-or-wildcard
+  ? organizationalUnit: regtext-or-wildcard
+  ? emailAddress: regtext-or-wildcard
+  ? commonName: regtext-or-wildcard
+}
+
+$keyType /= rsaKeyType
+$keyType /= ecdsaKeyType
+
+rsaKeyType = {
+  PublicKeyType: "rsaEncryption" ; OID: 1.2.840.113549.1.1.1
+  PublicKeyLength: rsaKeySize
+  SignatureType: $rsaSignatureType
+}
+
+rsaKeySize = int .ge 2048
+
+; RSASSA-PKCS1-v1_5 with SHA-256
+$rsaSignatureType /= "sha256WithRSAEncryption"
+; RSASSA-PCKS1-v1_5 with SHA-384
+$rsaSignatureType /= "sha384WithRSAEncryption"
+; RSASSA-PCKS1-v1_5 with SHA-512
+$rsaSignatureType /= "sha512WithRSAEncryption"
+; RSASSA-PSS with SHA-256, MGF-1 with SHA-256, and a 32 byte salt
+$rsaSignatureType /= "sha256WithRSAandMGF1"
+; RSASSA-PSS with SHA-384, MGF-1 with SHA-384, and a 48 byte salt
+$rsaSignatureType /= "sha384WithRSAandMGF1"
+; RSASSA-PSS with SHA-512, MGF-1 with SHA-512, and a 64 byte salt
+$rsaSignatureType /= "sha512WithRSAandMGF1"
+
+ecdsaKeyType = {
+  PublicKeyType: "id-ecPublicKey" ; OID: 1.2.840.10045.2.1
+  namedCurve: $ecdsaCurve
+  SignatureType: $ecdsaSignatureType
+}
+
+$ecdsaCurve /= "secp256r1" ; OID: 1.2.840.10045.3.1.7
+$ecdsaCurve /= "secp384r1" ; OID: 1.3.132.0.34
+$ecdsaCurve /= "secp521r1" ; OID: 1.3.132.0.3
+
+$ecdsaSignatureType /= "ecdsa-with-SHA256" ; paired with secp256r1
+$ecdsaSignatureType /= "ecdsa-with-SHA384" ; paired with secp384r1
+$ecdsaSignatureType /= "ecdsa-with-SHA512" ; paired with secp521r1
+
+subjectaltname = {
+  ? DNS: [ 1* regtext-or-wildcard ]
+  ? Email: [ 1* regtext ]
+  ? URI: [ 1* regtext ]
+  * $$subjectaltname-extension
+}
+
+extensions = {
+  ? keyUsage: [ 1* keyUsageType ]
+  ? extendedKeyUsage: [ 1* extendedKeyUsageType ]
+  subjectAltName: subjectaltname
+}
+
+keyUsageType /= "digitalSignature"
+keyUsageType /= "nonRepudiation"
+keyUsageType /= "keyEncipherment"
+keyUsageType /= "dataEncipherment"
+keyUsageType /= "keyAgreement"
+keyUsageType /= "keyCertSign"
+keyUsageType /= "cRLSign"
+keyUsageType /= "encipherOnly"
+keyUsageType /= "decipherOnly"
+
+extendedKeyUsageType /= "serverAuth"
+extendedKeyUsageType /= "clientAuth"
+extendedKeyUsageType /= "codeSigning"
+extendedKeyUsageType /= "emailProtection"
+extendedKeyUsageType /= "timeStamping"
+extendedKeyUsageType /= "OCSPSigning"
+extendedKeyUsageType /= oid
+
+oid = text .regexp "[0-9]+(\\.[0-9]+)*"