@blamejs/pki 0.1.12 → 0.1.14

package/lib/schema-attrcert.js

@@ -0,0 +1,383 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (c) blamejs contributors
+"use strict";
+/**
+ * @module     pki.schema.attrcert
+ * @nav        Schema
+ * @title      Attribute Cert
+ * @order      175
+ * @slug       attrcert
+ *
+ * @intro
+ *   X.509 Attribute Certificate handling per RFC 5755. An attribute certificate
+ *   binds a holder to a set of privilege attributes (role, group, clearance)
+ *   without carrying a public key — the authorization counterpart to an identity
+ *   certificate. `parse` decodes a v2 `AttributeCertificate` into its holder,
+ *   issuer, validity window (real `Date`s), attributes, and extensions, reusing
+ *   the shared signed-envelope so the raw `tbsBytes` (the exact signed region) and
+ *   the `signatureValue` are surfaced for a downstream verifier.
+ *
+ *   The holder and issuer identities are `GeneralName`s, validated on the way in
+ *   (each alternative's form and content per RFC 5280 §4.2.1.6) and surfaced with
+ *   their raw bytes; the profile MUSTs above structural scope (a single
+ *   non-empty `directoryName` issuer, the holder-to-PKC binding, targeting and
+ *   revocation) are verification-layer concerns. The obsolete X.509-1997
+ *   `AttributeCertificateV1` is recognized and deferred, not parsed. DER-only,
+ *   fail-closed.
+ *
+ * @card
+ *   Parse DER / PEM RFC 5755 attribute certificates into holder, issuer,
+ *   validity, attributes, and extensions — validated GeneralNames, raw verifier
+ *   inputs, legacy v1 recognize-and-defer, fail-closed.
+ */
+
+var asn1 = require("./asn1-der");
+var schema = require("./schema-engine");
+var pkix = require("./schema-pkix");
+var oid = require("./oid");
+var frameworkError = require("./framework-error");
+
+var AttrCertError = frameworkError.AttrCertError;
+var PemError = frameworkError.PemError;
+
+var NS = pkix.makeNS("attrcert", AttrCertError, oid);
+
+var TAGS = asn1.TAGS;
+
+var ALGORITHM_IDENTIFIER = pkix.algorithmIdentifier(NS);
+var EXTENSIONS = pkix.extensions(NS);
+
+// AttCertVersion ::= INTEGER { v2(1) } — a bare, mandatory INTEGER (not the x509
+// [0] EXPLICIT DEFAULT shape). The only legal value is v2, surfaced as 2.
+var VERSION = pkix.versionReader(NS, { "1": 2 });
+
+// ---- shared leaves ---------------------------------------------------
+
+// AttCertValidityPeriod times are GeneralizedTime (RFC 5755 §4.2.6) — a UTCTime is
+// rejected. Non-fractional YYYYMMDDHHMMSSZ is enforced by the codec.
+var GENERALIZED_TIME = schema.decode(function (n, ctx) {
+  if (n.tagClass !== "universal" || n.tagNumber !== TAGS.GENERALIZED_TIME) {
+    throw ctx.E("attrcert/bad-time", "AttCertValidityPeriod times must be GeneralizedTime (RFC 5755 §4.2.6)");
+  }
+  return asn1.read.time(n);
+});
+
+// digestedObjectType ::= ENUMERATED { publicKey(0), publicKeyCert(1),
+// otherObjectTypes(2) } (RFC 5755 §4.1) — an undefined value is rejected; a
+// non-ENUMERATED tag fails at the codec (asn1/*).
+var ODT_NAMES = { "0": "publicKey", "1": "publicKeyCert", "2": "otherObjectTypes" };
+var DIGESTED_OBJECT_TYPE = schema.decode(function (n, ctx) {
+  var v = asn1.read.enumerated(n);
+  var k = v.toString();
+  if (!Object.prototype.hasOwnProperty.call(ODT_NAMES, k)) {
+    throw ctx.E("attrcert/bad-digested-object-type", "digestedObjectType " + k + " is not a defined value (RFC 5755 §4.1)");
+  }
+  // RFC 5755 §7.3 — a conformant AC MUST NOT use otherObjectTypes(2); the digested
+  // object is limited to a public key or a public-key certificate, so reject it
+  // fail-closed rather than parse a digest whose object type is unidentifiable.
+  if (k === "2") {
+    throw ctx.E("attrcert/bad-digested-object-type", "otherObjectTypes(2) MUST NOT be used (RFC 5755 §7.3)");
+  }
+  return { code: Number(v), name: ODT_NAMES[k] };
+});
+
+// ---- IssuerSerial / ObjectDigestInfo ---------------------------------
+
+// IssuerSerial ::= SEQUENCE { issuer GeneralNames, serial CertificateSerialNumber,
+// issuerUID UniqueIdentifier OPTIONAL } (RFC 5755 §4.1). Reached as an IMPLICIT
+// [n] node (Holder [0] / V2Form [0]) whose tag replaces the SEQUENCE tag, so the
+// shape assertion is "constructed" (the tag is pinned by the enclosing trailing);
+// a context [n] PRIMITIVE node has no children and fails closed here.
+var ISSUER_SERIAL = schema.seq([
+  schema.field("issuer", pkix.generalNames(NS, { code: "attrcert/bad-issuer-serial" })),
+  schema.field("serial", schema.integerLeaf()),
+  schema.optional("issuerUID", schema.bitString(), { whenUniversal: [TAGS.BIT_STRING] }),
+], {
+  assert: "constructed", code: "attrcert/bad-issuer-serial", what: "IssuerSerial",
+  build: function (m) {
+    return {
+      issuer: m.fields.issuer.value.result,
+      serial: m.fields.serial.value,
+      serialHex: m.fields.serial.node.content.toString("hex"),
+      issuerUID: m.fields.issuerUID.present ? m.fields.issuerUID.value : null,
+    };
+  },
+});
+
+// ObjectDigestInfo ::= SEQUENCE { digestedObjectType ENUMERATED, otherObjectTypeID
+// OBJECT IDENTIFIER OPTIONAL, digestAlgorithm AlgorithmIdentifier, objectDigest BIT
+// STRING } (RFC 5755 §4.1). otherObjectTypeID is present only for otherObjectTypes(2).
+var OBJECT_DIGEST_INFO = schema.seq([
+  schema.field("digestedObjectType", DIGESTED_OBJECT_TYPE),
+  schema.optional("otherObjectTypeID", schema.oidLeaf(), { whenUniversal: [TAGS.OBJECT_IDENTIFIER] }),
+  schema.field("digestAlgorithm", ALGORITHM_IDENTIFIER),
+  schema.field("objectDigest", schema.bitString()),
+], {
+  assert: "constructed", code: "attrcert/bad-object-digest-info", what: "ObjectDigestInfo",
+  build: function (m, ctx) {
+    var t = m.fields.digestedObjectType.value;
+    // otherObjectTypeID identifies a non-certificate object type, meaningful only with
+    // otherObjectTypes(2) — which RFC 5755 §7.3 forbids (rejected at the leaf above) —
+    // so a present otherObjectTypeID is never valid here and is rejected fail-closed.
+    if (m.fields.otherObjectTypeID.present) {
+      throw ctx.E("attrcert/bad-object-digest-info", "otherObjectTypeID is only valid with otherObjectTypes(2), which RFC 5755 §7.3 forbids");
+    }
+    return {
+      digestedObjectType: t,
+      otherObjectTypeID: null,
+      digestAlgorithm: m.fields.digestAlgorithm.value.result,
+      objectDigest: m.fields.objectDigest.value,
+    };
+  },
+});
+
+// ---- Holder / AttCertIssuer / V2Form ---------------------------------
+
+// Holder ::= SEQUENCE { baseCertificateID [0] IMPLICIT IssuerSerial OPTIONAL,
+// entityName [1] IMPLICIT GeneralNames OPTIONAL, objectDigestInfo [2] IMPLICIT
+// ObjectDigestInfo OPTIONAL } (RFC 5755 §4.1). All three are IMPLICIT + OPTIONAL;
+// the profile RECOMMENDS exactly one, but the parser surfaces all three (null when
+// absent) and does not enforce the cardinality.
+var HOLDER = schema.seq([
+  schema.trailing([
+    { tag: 0, name: "baseCertificateID", schema: ISSUER_SERIAL },
+    { tag: 1, name: "entityName", schema: pkix.generalNames(NS, { implicitTag: 1, code: "attrcert/bad-entity-name" }) },
+    { tag: 2, name: "objectDigestInfo", schema: OBJECT_DIGEST_INFO },
+  ], { minTag: 0, maxTag: 2, unexpectedCode: "attrcert/bad-holder", orderCode: "attrcert/bad-holder" }),
+], {
+  assert: "sequence", code: "attrcert/bad-holder", what: "Holder",
+  build: function (m) {
+    return {
+      baseCertificateID: m.fields.baseCertificateID.present ? m.fields.baseCertificateID.value.result : null,
+      entityName: m.fields.entityName.present ? m.fields.entityName.value.result : null,
+      objectDigestInfo: m.fields.objectDigestInfo.present ? m.fields.objectDigestInfo.value.result : null,
+    };
+  },
+});
+
+// V2Form ::= SEQUENCE { issuerName GeneralNames OPTIONAL, baseCertificateID [0]
+// IMPLICIT IssuerSerial OPTIONAL, objectDigestInfo [1] IMPLICIT ObjectDigestInfo
+// OPTIONAL } (RFC 5755 §4.1). Reached via the AttCertIssuer CHOICE on a context [0]
+// node, so the shape is "constructed".
+var V2_FORM = schema.seq([
+  schema.optional("issuerName", pkix.generalNames(NS, { code: "attrcert/bad-issuer-name" }), { whenUniversal: [TAGS.SEQUENCE] }),
+  schema.trailing([
+    { tag: 0, name: "baseCertificateID", schema: ISSUER_SERIAL },
+    { tag: 1, name: "objectDigestInfo", schema: OBJECT_DIGEST_INFO },
+  ], { minTag: 0, maxTag: 1, unexpectedCode: "attrcert/bad-v2form", orderCode: "attrcert/bad-v2form" }),
+], {
+  assert: "constructed", code: "attrcert/bad-v2form", what: "V2Form",
+  build: function (m) {
+    return {
+      issuerName: m.fields.issuerName.present ? m.fields.issuerName.value.result : null,
+      baseCertificateID: m.fields.baseCertificateID.present ? m.fields.baseCertificateID.value.result : null,
+      objectDigestInfo: m.fields.objectDigestInfo.present ? m.fields.objectDigestInfo.value.result : null,
+    };
+  },
+});
+
+// AttCertIssuer ::= CHOICE { v1Form GeneralNames, v2Form [0] IMPLICIT V2Form } (RFC
+// 5755 §4.1). A universal SEQUENCE is the (obsolete but structurally legal) v1Form;
+// a context [0] is v2Form. A conforming AC uses v2Form; the parser surfaces which.
+var ATT_CERT_ISSUER = schema.choice([
+  { when: { tagClass: "universal", tagNumber: TAGS.SEQUENCE }, schema: pkix.generalNames(NS, { code: "attrcert/bad-issuer" }) },
+  { when: { tagClass: "context", tagNumber: 0 }, schema: V2_FORM },
+], { code: "attrcert/bad-issuer" });
+
+// ---- validity + attributes -------------------------------------------
+
+// AttCertValidityPeriod ::= SEQUENCE { notBeforeTime GeneralizedTime, notAfterTime
+// GeneralizedTime } (RFC 5755 §4.2.6).
+var VALIDITY = schema.seq([
+  schema.field("notBeforeTime", GENERALIZED_TIME),
+  schema.field("notAfterTime", GENERALIZED_TIME),
+], {
+  assert: "sequence", arity: { exact: 2 }, code: "attrcert/bad-validity", what: "AttCertValidityPeriod",
+  build: function (m) { return { notBeforeTime: m.fields.notBeforeTime.value, notAfterTime: m.fields.notAfterTime.value }; },
+});
+
+// attributes ::= SEQUENCE OF Attribute (RFC 5755 §4.2.7) — MUST be non-empty and
+// each AttributeType OID unique. Order-preserving (SEQUENCE OF, not SET OF).
+var ATTRIBUTES = schema.seqOf(pkix.attribute(NS), {
+  assert: "sequence", min: 1, code: "attrcert/bad-attributes", what: "attributes",
+  unique: function (it) { return it.value.result.type; }, dupCode: "attrcert/duplicate-attribute",
+  build: function (m) { return m.items.map(function (it) { return it.value.result; }); },
+});
+
+// ---- AttributeCertificateInfo / AttributeCertificate -----------------
+
+// AttributeCertificateInfo ::= SEQUENCE { version, holder, issuer, signature
+// AlgorithmIdentifier, serialNumber, attrCertValidityPeriod, attributes,
+// issuerUniqueID OPTIONAL, extensions OPTIONAL } (RFC 5755 §4.1). The tbs body the
+// signed envelope wraps; the cross-field invariants live in the envelope build.
+var ACINFO = schema.seq([
+  schema.field("version", VERSION),
+  schema.field("holder", HOLDER),
+  schema.field("issuer", ATT_CERT_ISSUER),
+  schema.field("signature", ALGORITHM_IDENTIFIER),
+  schema.field("serialNumber", schema.integerLeaf()),
+  schema.field("attrCertValidityPeriod", VALIDITY),
+  schema.field("attributes", ATTRIBUTES),
+  schema.optional("issuerUniqueID", schema.bitString(), { whenUniversal: [TAGS.BIT_STRING] }),
+  schema.optional("extensions", EXTENSIONS, { whenUniversal: [TAGS.SEQUENCE] }),
+], { assert: "sequence", code: "attrcert/bad-acinfo", what: "AttributeCertificateInfo" });
+
+// AttributeCertificate ::= SEQUENCE { acinfo, signatureAlgorithm, signatureValue
+// BIT STRING } — the shared SIGNED envelope (RFC 5755 §4.1). The AC-specific
+// invariants (§4.2.4 sig-alg agreement, §4.2.5 positive-and-<=20-octet serialNumber)
+// run in the build; the envelope owns the SEQUENCE-of-3 shape + signature extraction.
+var ATTRIBUTE_CERTIFICATE = pkix.signedEnvelope(NS, ACINFO, {
+  code: "attrcert/not-an-attribute-certificate", what: "AttributeCertificate",
+  build: function (e, ctx) {
+    var acinfo = e.tbsMatch;
+
+    // RFC 5755 §4.2.4 — the outer signatureAlgorithm MUST equal acinfo.signature.
+    if (!e.outerSignatureAlgorithmBytes.equals(acinfo.fields.signature.node.bytes)) {
+      throw ctx.E("attrcert/bad-signature-algorithm", "signatureAlgorithm must match AttributeCertificateInfo.signature (RFC 5755 §4.2.4)");
+    }
+
+    // RFC 5755 §4.2.5 — serialNumber MUST be a positive INTEGER of at most 20 content
+    // octets. Positive excludes both a negative (DER sign bit set) and zero (a minimal
+    // INTEGER 0 is a single 0x00 octet — the codec already rejected any non-minimal
+    // zero). Surface it lossless (BigInt) + as hex.
+    var serialNode = acinfo.fields.serialNumber.node;
+    var sc = serialNode.content;
+    if (sc.length === 0 || (sc[0] & 0x80) !== 0 || (sc.length === 1 && sc[0] === 0)) {
+      throw ctx.E("attrcert/bad-serial-number", "serialNumber must be a positive INTEGER (RFC 5755 §4.2.5)");
+    }
+    if (sc.length > 20) {
+      throw ctx.E("attrcert/bad-serial-number", "serialNumber must not exceed 20 content octets (RFC 5755 §4.2.5)");
+    }
+
+    // AttCertIssuer is a CHOICE — the chosen arm is read off the issuer node's tag
+    // (a universal SEQUENCE is v1Form; a context [0] is v2Form).
+    var issuerNode = acinfo.fields.issuer.node;
+    var issuerVal = acinfo.fields.issuer.value;
+    var issuer = issuerNode.tagClass === "context"
+      ? { form: "v2Form", v2Form: issuerVal.result, v1Form: null }
+      : { form: "v1Form", v1Form: issuerVal.result, v2Form: null };
+
+    var extField = acinfo.fields.extensions;
+    return {
+      version:               acinfo.fields.version.value,     // 2
+      holder:                acinfo.fields.holder.value.result,
+      issuer:                issuer,
+      signatureAlgorithm:    e.signatureAlgorithm,
+      tbsSignatureAlgorithm: acinfo.fields.signature.value.result,
+      serialNumber:          acinfo.fields.serialNumber.value,
+      serialNumberHex:       sc.toString("hex"),
+      validity:              acinfo.fields.attrCertValidityPeriod.value.result,
+      attributes:            acinfo.fields.attributes.value.result,
+      issuerUniqueID:        acinfo.fields.issuerUniqueID.present ? acinfo.fields.issuerUniqueID.value : null,
+      extensions:            (extField && extField.present) ? extField.value.result : [],
+      tbsBytes:              e.tbsBytes,
+      signatureValue:        e.signatureValue,
+    };
+  },
+});
+
+// ---- parse -----------------------------------------------------------
+
+/**
+ * @primitive  pki.schema.attrcert.parse
+ * @signature  pki.schema.attrcert.parse(input) -> attributeCertificate
+ * @since      0.1.14
+ * @status     experimental
+ * @spec       RFC 5755, X.509
+ * @related    pki.schema.parse, pki.schema.x509.parse
+ *
+ * Parse a DER `Buffer` or a PEM string/Buffer into a structured v2 attribute
+ * certificate: `{ version, holder, issuer, signatureAlgorithm, serialNumber,
+ * serialNumberHex, validity, attributes, issuerUniqueID, extensions, tbsBytes,
+ * signatureValue }`. The holder / issuer identities come back as validated
+ * `GeneralName`s (each element `{ bytes, tagClass, tagNumber }`); the validity
+ * window is real `Date`s; `tbsBytes` is the exact signed byte range for a verifier.
+ *
+ * Throws `AttrCertError` when the bytes are not a well-formed attribute certificate
+ * (an obsolete `AttributeCertificateV1` throws `attrcert/legacy-v1-not-supported`)
+ * and `Asn1Error` when the underlying DER is malformed.
+ *
+ * @example
+ *   var ac = pki.schema.attrcert.parse(der);
+ *   ac.attributes[0].name;   // "role"
+ *   ac.validity.notAfterTime;// Date
+ */
+var PARSE_OPTS = { pemLabel: null, PemError: PemError, ErrorClass: AttrCertError, prefix: "attrcert", what: "attribute certificate" };
+
+function _legacyV1Error() {
+  return new AttrCertError("attrcert/legacy-v1-not-supported", "AttributeCertificateV1 (X.509-1997) is obsolete and not parsed by this build (RFC 5755 §1)");
+}
+
+function parse(input) {
+  var root = pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
+  // A well-formed legacy AttributeCertificateV1 gets the advertised, stable
+  // attrcert/legacy-v1-not-supported on the DIRECT path too — not a low-level asn1/*
+  // tag error from attempting the v2 walk — so a direct caller of this entry sees the
+  // same error family for the recognized-but-deferred form as the orchestrator does.
+  if (matchesV1(root)) throw _legacyV1Error();
+  return schema.walk(ATTRIBUTE_CERTIFICATE, root, NS).result;
+}
+
+// The obsolete X.509-1997 AttributeCertificateV1 (RFC 5652 §10.2) is recognized and
+// deferred: decode the envelope (so a malformed input still fails as bad DER), then
+// throw the precise diagnostic rather than routing it to a wrong format.
+function parseV1(input) {
+  pkix.decodeRoot(pkix.coerceToDer(input, PARSE_OPTS), PARSE_OPTS);
+  throw _legacyV1Error();
+}
+
+/**
+ * @primitive  pki.schema.attrcert.pemDecode
+ * @signature  pki.schema.attrcert.pemDecode(text, label?) -> Buffer
+ * @since      0.1.14
+ * @status     experimental
+ * @spec       RFC 7468, RFC 5755
+ * @related    pki.schema.attrcert.parse
+ *
+ * Extract the DER bytes from a PEM block (OpenSSL emits
+ * `-----BEGIN ATTRIBUTE CERTIFICATE-----`; the first block is taken unless `label`
+ * is given). Throws `PemError` on a missing envelope or a non-base64 body.
+ *
+ * @example
+ *   var der = pki.schema.attrcert.pemDecode(pemText);
+ */
+function pemDecode(text, label) { return pkix.pemDecode(text, label || null, PemError); }
+
+// matches(root): a v2 AttributeCertificate is the signed-envelope trio whose acinfo
+// LEADS WITH a bare universal INTEGER version (== v2 = 1, NOT the x509 [0] EXPLICIT
+// wrapper) and whose attrCertValidityPeriod at children[5] is a SEQUENCE of exactly
+// two GeneralizedTime (RFC 5755 §4.2.6 forbids UTCTime) — a marker no cert / CRL /
+// CSR presents at that position. Disjoint from matchesV1 by the children[0] tag class.
+function matches(root) {
+  var acinfo = pkix.signedEnvelopeTbs(root);
+  if (!acinfo) return false;
+  var k = acinfo.children;
+  if (!k || k.length < 7) return false;
+  if (!(k[0].tagClass === "universal" && k[0].tagNumber === TAGS.INTEGER)) return false;
+  if (!(k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE && k[1].children)) return false;
+  var v = k[5];
+  if (!(v && v.tagClass === "universal" && v.tagNumber === TAGS.SEQUENCE && v.children && v.children.length === 2)) return false;
+  return v.children.every(function (t) { return t.tagClass === "universal" && t.tagNumber === TAGS.GENERALIZED_TIME; });
+}
+
+// matchesV1(root): the obsolete AttributeCertificateV1 — its acInfo (version DEFAULT
+// v1 OMITTED) LEADS WITH the subject CHOICE (a context [0]/[1]), and its children[1]
+// is the issuer GeneralNames (a universal SEQUENCE). The children[1] == SEQUENCE test
+// keeps it disjoint from a v3 certificate (whose [0] EXPLICIT version is followed by
+// an INTEGER serialNumber), so v1-vs-cert dispatch is order-independent.
+function matchesV1(root) {
+  var acinfo = pkix.signedEnvelopeTbs(root);
+  if (!acinfo) return false;
+  var k = acinfo.children;
+  if (!k || k.length < 6) return false;
+  if (!(k[0].tagClass === "context" && (k[0].tagNumber === 0 || k[0].tagNumber === 1) && k[0].children)) return false;
+  return !!k[1] && k[1].tagClass === "universal" && k[1].tagNumber === TAGS.SEQUENCE;
+}
+
+module.exports = {
+  parse: parse,
+  parseV1: parseV1,
+  pemDecode: pemDecode,
+  matches: matches,
+  matchesV1: matchesV1,
+};

package/lib/schema-engine.js

@@ -109,6 +109,11 @@ function implicitOctetString(tag) { return { kind: "leaf", read: function (n) {
 // unknown [2] arms (RFC 6960 §4.2.1). Yields null; rejects a constructed or
 // non-empty [tag] node fail-closed.
 function implicitNull(tag) { return { kind: "leaf", read: function (n) { return asn1.read.nullImplicit(n, tag); } }; }
+// A [tag] IMPLICIT INTEGER leaf (context-class primitive) — the integer sibling of
+// implicitBitString, for the RFC 3161 Accuracy millis [0] / micros [1] fields
+// (context-tagged primitive INTEGERs). Yields a BigInt; a constructed or wrong-tag
+// node fails asn1/* at the codec.
+function implicitInteger(tag) { return { kind: "leaf", read: function (n) { return asn1.read.integerImplicit(n, tag); } }; }
 function any()            { return { kind: "any" }; }
 function decode(fn)       { return { kind: "decode", fn: fn }; }
 
@@ -196,6 +201,15 @@ function implicitSetOf(tag, item, opts) {
   return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, derSetOrder: true, code: opts.code, what: opts.what,
            min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
 }
+// [tag] IMPLICIT SEQUENCE OF item — the context tag REPLACES the universal SEQUENCE
+// tag, so the node is a context-class constructed [tag] whose direct children are the
+// items. Order-preserving: the SEQUENCE-OF sibling of implicitSetOf WITHOUT the SET
+// ascending-DER-order rule (RFC 3161 extensions [1] IMPLICIT Extensions).
+function implicitSeqOf(tag, item, opts) {
+  opts = opts || {};
+  return { kind: "repeat", item: item, assert: "implicit", implicitTag: tag, code: opts.code, what: opts.what,
+           min: opts.min, unique: opts.unique, dupCode: opts.dupCode, build: opts.build };
+}
 
 // ---- the walk engine -------------------------------------------------
 
@@ -377,11 +391,11 @@ function _consumeTrailing(fld, kids, start, fields, ctx) {
 module.exports = {
   // structural
   seq: seq, field: field, optional: optional, explicit: explicit, trailing: trailing,
-  seqOf: seqOf, setOf: setOf, setOfUnique: setOfUnique, implicitSetOf: implicitSetOf, choice: choice,
+  seqOf: seqOf, setOf: setOf, setOfUnique: setOfUnique, implicitSetOf: implicitSetOf, implicitSeqOf: implicitSeqOf, choice: choice,
   // leaves
   oidLeaf: oidLeaf, integerLeaf: integerLeaf, boolean: boolean, octetString: octetString,
   bitString: bitString, implicitBitString: implicitBitString, implicitOctetString: implicitOctetString,
-  implicitNull: implicitNull,
+  implicitNull: implicitNull, implicitInteger: implicitInteger,
   any: any, decode: decode, time: time,
   // engine
   walk: walk,

package/lib/schema-ocsp.js

@@ -105,59 +105,10 @@ function certificateBytes() {
   });
 }
 
-// requestorName [1] EXPLICIT GeneralName — GeneralName ::= CHOICE (RFC 5280
-// §4.2.1.6). We keep the value RAW (no pkix.generalName factory yet), but validate
-// the chosen alternative's tag AND form/content so a malformed GeneralName fails
-// closed rather than passing the signed-request requestorName guard: the constructed
-// alternatives (otherName [0], x400Address [3], directoryName [4], ediPartyName [5])
-// must be constructed; rfc822Name [1] / dNSName [2] / uniformResourceIdentifier [6]
-// are primitive IA5String (7-bit); iPAddress [7] is a 4- or 16-octet OCTET STRING;
-// registeredID [8] is a primitive OBJECT IDENTIFIER.
-var GN_CONSTRUCTED = { 0: 1, 3: 1, 4: 1, 5: 1 };
-var GN_IA5 = { 1: 1, 2: 1, 6: 1 };
-function _validateGeneralName(n, ctx) {
-  if (n.tagClass !== "context" || n.tagNumber < 0 || n.tagNumber > 8) {
-    throw ctx.E("ocsp/bad-requestor-name", "requestorName must be a GeneralName (context tag [0]..[8]) (RFC 6960 §4.1.1)");
-  }
-  var t = n.tagNumber;
-  var constructed = !!n.children;
-  if (GN_CONSTRUCTED[t]) {
-    if (!constructed || n.children.length < 1) throw ctx.E("ocsp/bad-requestor-name", "GeneralName [" + t + "] must be a non-empty constructed value (RFC 5280 §4.2.1.6)");
-    if (t === 0) {
-      // otherName ::= SEQUENCE { type-id OBJECT IDENTIFIER, value [0] EXPLICIT ANY } —
-      // both fields mandatory: exactly two children, a type-id OID and a [0] EXPLICIT
-      // value wrapper carrying exactly one inner value.
-      if (n.children.length !== 2) throw ctx.E("ocsp/bad-requestor-name", "GeneralName otherName [0] must be a SEQUENCE { type-id, value [0] } (RFC 5280 §4.2.1.6)");
-      try { asn1.read.oid(n.children[0]); }
-      catch (e) { throw ctx.E("ocsp/bad-requestor-name", "GeneralName otherName [0] must lead with a type-id OBJECT IDENTIFIER", e); }
-      var v = n.children[1];
-      if (!(v.tagClass === "context" && v.tagNumber === 0 && v.children && v.children.length === 1)) {
-        throw ctx.E("ocsp/bad-requestor-name", "GeneralName otherName [0] value must be a [0] EXPLICIT wrapper carrying exactly one value");
-      }
-    } else if (t === 4) {
-      // directoryName [4] EXPLICIT Name — validate the wrapped RDNSequence.
-      if (n.children.length !== 1) throw ctx.E("ocsp/bad-requestor-name", "GeneralName directoryName [4] must wrap exactly one Name (RFC 5280 §4.2.1.6)");
-      schema.walk(NAME, n.children[0], ctx);
-    }
-    // x400Address [3] / ediPartyName [5]: validated to non-empty constructed form
-    // (their full ORAddress / EDIPartyName bodies are above the requestorName altitude).
-  } else {
-    if (constructed) throw ctx.E("ocsp/bad-requestor-name", "GeneralName [" + t + "] must be primitive (RFC 5280 §4.2.1.6)");
-    if (GN_IA5[t]) {
-      if (n.content.length === 0) throw ctx.E("ocsp/bad-requestor-name", "GeneralName [" + t + "] must be a non-empty IA5String");
-      for (var i = 0; i < n.content.length; i++) {
-        if (n.content[i] > 0x7f) throw ctx.E("ocsp/bad-requestor-name", "GeneralName [" + t + "] must be an IA5String (7-bit)");
-      }
-    } else if (t === 7) {
-      if (n.content.length !== 4 && n.content.length !== 16) throw ctx.E("ocsp/bad-requestor-name", "GeneralName iPAddress [7] must be a 4- or 16-octet address");
-    } else if (t === 8) {
-      try { asn1.decodeOidContent(n.content); }
-      catch (e) { throw ctx.E("ocsp/bad-requestor-name", "GeneralName registeredID [8] must be a valid OBJECT IDENTIFIER", e); }
-    }
-  }
-  return { bytes: n.bytes, tagClass: n.tagClass, tagNumber: n.tagNumber };
-}
-var GENERAL_NAME_RAW = schema.decode(_validateGeneralName);
+// requestorName [1] EXPLICIT GeneralName (RFC 6960 §4.1.1) — validated + surfaced raw
+// via the shared pkix.generalName primitive (RFC 5280 §4.2.1.6), so a malformed
+// GeneralName fails closed and the OCSP + TSP parsers cannot drift on this grammar.
+var GENERAL_NAME_RAW = pkix.generalName(NS, { code: "ocsp/bad-requestor-name" });
 
 // An OCSP signature BIT STRING is a byte string handed to a cryptographic verifier,
 // so it MUST be octet-aligned (0 unused bits); a non-octet-aligned signature is

package/lib/schema-pkix.js

@@ -208,6 +208,82 @@ function name(ns) {
   });
 }
 
+// GeneralName ::= CHOICE (RFC 5280 §4.2.1.6). A validate-and-surface-raw leaf for a
+// caller that keeps the value RAW but needs it to be a well-formed GeneralName: it
+// checks the chosen alternative's tag, form (constructed vs primitive per X.690
+// §10.2), and content — otherName [0] is a SEQUENCE { type-id OID, value [0] EXPLICIT
+// }; x400Address [3] / ediPartyName [5] are non-empty constructed; directoryName [4]
+// EXPLICIT wraps a valid Name; rfc822Name [1] / dNSName [2] / uniformResourceIdentifier
+// [6] are primitive non-empty IA5String (7-bit); iPAddress [7] is a 4- or 16-octet
+// OCTET STRING; registeredID [8] is a primitive OBJECT IDENTIFIER — then surfaces the
+// value RAW ({ bytes, tagClass, tagNumber }). `opts.code` is the caller's error code
+// (e.g. ocsp/bad-requestor-name, tsp/bad-tsa). Shared so the two parsers cannot drift.
+var GN_CONSTRUCTED = { 0: 1, 3: 1, 4: 1, 5: 1 };
+var GN_IA5 = { 1: 1, 2: 1, 6: 1 };
+function generalName(ns, opts) {
+  opts = opts || {};
+  var code = opts.code || (ns.prefix + "/bad-general-name");
+  var NAME = name(ns);
+  return schema.decode(function (n, ctx) {
+    if (n.tagClass !== "context" || n.tagNumber < 0 || n.tagNumber > 8) {
+      throw ctx.E(code, "value must be a GeneralName (context tag [0]..[8]) (RFC 5280 §4.2.1.6)");
+    }
+    var t = n.tagNumber;
+    var constructed = !!n.children;
+    if (GN_CONSTRUCTED[t]) {
+      if (!constructed || n.children.length < 1) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty constructed value (RFC 5280 §4.2.1.6)");
+      if (t === 0) {
+        // otherName ::= SEQUENCE { type-id OBJECT IDENTIFIER, value [0] EXPLICIT ANY }.
+        if (n.children.length !== 2) throw ctx.E(code, "GeneralName otherName [0] must be a SEQUENCE { type-id, value [0] }");
+        try { asn1.read.oid(n.children[0]); }
+        catch (e) { throw ctx.E(code, "GeneralName otherName [0] must lead with a type-id OBJECT IDENTIFIER", e); }
+        var v = n.children[1];
+        if (!(v.tagClass === "context" && v.tagNumber === 0 && v.children && v.children.length === 1)) {
+          throw ctx.E(code, "GeneralName otherName [0] value must be a [0] EXPLICIT wrapper carrying exactly one value");
+        }
+      } else if (t === 4) {
+        // directoryName [4] EXPLICIT Name — validate the wrapped RDNSequence.
+        if (n.children.length !== 1) throw ctx.E(code, "GeneralName directoryName [4] must wrap exactly one Name");
+        schema.walk(NAME, n.children[0], ctx);
+      }
+    } else {
+      if (constructed) throw ctx.E(code, "GeneralName [" + t + "] must be primitive (X.690 §10.2)");
+      if (GN_IA5[t]) {
+        if (n.content.length === 0) throw ctx.E(code, "GeneralName [" + t + "] must be a non-empty IA5String");
+        for (var i = 0; i < n.content.length; i++) {
+          if (n.content[i] > 0x7f) throw ctx.E(code, "GeneralName [" + t + "] must be an IA5String (7-bit)");
+        }
+      } else if (t === 7) {
+        if (n.content.length !== 4 && n.content.length !== 16) throw ctx.E(code, "GeneralName iPAddress [7] must be a 4- or 16-octet address");
+      } else if (t === 8) {
+        try { asn1.decodeOidContent(n.content); }
+        catch (e) { throw ctx.E(code, "GeneralName registeredID [8] must be a valid OBJECT IDENTIFIER", e); }
+      }
+    }
+    return { bytes: n.bytes, tagClass: n.tagClass, tagNumber: n.tagNumber };
+  });
+}
+
+// GeneralNames ::= SEQUENCE OF GeneralName (RFC 5280 §4.2.1.6), SIZE (1..MAX). Every
+// element is validated by generalName (its CHOICE alternative's form + content) and
+// surfaced raw, so a caller carrying a GeneralNames field cannot accept a malformed
+// element by treating the whole sequence as opaque bytes. Returns { names: [{ bytes,
+// tagClass, tagNumber }], bytes } (the decoded element list + the raw outer DER).
+// `opts.implicitTag` handles a [tag] IMPLICIT GeneralNames — the context tag REPLACES
+// the universal SEQUENCE tag (RFC 5755 Holder.entityName [1]); otherwise it is a bare
+// universal SEQUENCE OF. `opts.code` is the caller's error code. Shared so the x509 /
+// attribute-certificate / (future) CRMF parsers validate a GeneralNames identically.
+function generalNames(ns, opts) {
+  opts = opts || {};
+  var code = opts.code || (ns.prefix + "/bad-general-names");
+  var gn = generalName(ns, { code: code });
+  function build(m) { return { names: m.items.map(function (it) { return it.value; }), bytes: m.node.bytes }; }
+  if (opts.implicitTag != null) {
+    return schema.implicitSeqOf(opts.implicitTag, gn, { min: 1, code: code, what: opts.what || "GeneralNames", build: build });
+  }
+  return schema.seqOf(gn, { assert: "sequence", min: 1, code: code, what: opts.what || "GeneralNames", build: build });
+}
+
 // Extension ::= SEQUENCE { extnID OID, critical BOOLEAN DEFAULT FALSE,
 // extnValue OCTET STRING }. `critical` is a universal BOOLEAN present-by-count
 // (not context-tagged), so the per-extension decode handles the 2-vs-3-child
@@ -362,6 +438,8 @@ module.exports = {
   attributeTypeAndValue: attributeTypeAndValue,
   relativeDistinguishedName: relativeDistinguishedName,
   name: name,
+  generalName: generalName,
+  generalNames: generalNames,
   attribute: attribute,
   extension: extension,
   extensions: extensions,