@blamejs/pki 0.8.10 → 0.8.12

package/lib/schema-pkix.js

@@ -28,6 +28,8 @@ var _charAt = intrinsic.uncurry(String.prototype.charAt);
 var _charCodeAt = intrinsic.uncurry(String.prototype.charCodeAt);
 var _split = intrinsic.uncurry(String.prototype.split);
 var _create = intrinsic.create;
+var _Number = intrinsic.Number;
+var _append = guard.list.append;
 var _isUint8Array = intrinsic.types.isUint8Array;
 var _bigIntToString = intrinsic.bigIntToString;
 var _weakGet = intrinsic.weakGet;
@@ -911,16 +913,39 @@ var CERT_FIXED_CRITICALITY_ROWS = [
   ["freshestCRL", false, "RFC 5280 sec. 4.2.1.15"], ["authorityInfoAccess", false, "RFC 5280 sec. 4.2.2.1"],
   ["subjectInfoAccess", false, "RFC 5280 sec. 4.2.2.2"],
   ["precertificatePoison", true, "RFC 6962 sec. 3.1"],
+  ["ipAddrBlocks", true, "RFC 3779 sec. 2.2.2"], ["autonomousSysIds", true, "RFC 3779 sec. 3.2.2"],
+  ["ipAddrBlocksV2", true, "RFC 8360 sec. 4.2.2, RFC 3779 sec. 2.2.2"],
+  ["autonomousSysIdsV2", true, "RFC 8360 sec. 4.2.2, RFC 3779 sec. 3.2.2"],
 ];
-/** @internal The table keyed by dotted OID through the registry the caller passes, since this
- *  module takes its registry as a parameter rather than requiring it. */
-function certFixedCriticality(oidRegistry) {
+/** @internal The criticality RFC 5280 sec. 5.2 fixes for a CRL extension. issuerAltName is absent:
+ *  sec. 5.2.2 states its criticality as a SHOULD, and carrying it in a table of MUSTs would promote
+ *  the requirement level the clause states. */
+var CRL_FIXED_CRITICALITY_ROWS = [
+  ["authorityKeyIdentifier", false, "RFC 5280 sec. 5.2.1"], ["cRLNumber", false, "RFC 5280 sec. 5.2.3"],
+  ["deltaCRLIndicator", true, "RFC 5280 sec. 5.2.4"], ["issuingDistributionPoint", true, "RFC 5280 sec. 5.2.5"],
+  ["freshestCRL", false, "RFC 5280 sec. 5.2.6"], ["authorityInfoAccess", false, "RFC 5280 sec. 5.2.7"],
+];
+
+/** @internal The criticality RFC 5280 sec. 5.3 fixes for a CRL ENTRY extension. Three consumers read
+ *  this one table: the CRL signer, the linter, and the OCSP signer, since RFC 6960 sec. 4.4.5
+ *  carries the same extensions into a SingleResponse. */
+var CRL_ENTRY_FIXED_CRITICALITY_ROWS = [
+  ["reasonCode", false, "RFC 5280 sec. 5.3.1"], ["invalidityDate", false, "RFC 5280 sec. 5.3.2"],
+  ["certificateIssuer", true, "RFC 5280 sec. 5.3.3"],
+];
+
+/** @internal A criticality table keyed by dotted OID through the registry the caller passes, since
+ *  this module takes its registry as a parameter rather than requiring it. */
+function _criticalityTable(rows, oidRegistry) {
   var table = _create(null);
-  _forEach(CERT_FIXED_CRITICALITY_ROWS, function (r) {
+  _forEach(rows, function (r) {
     table[oidRegistry.byName(r[0])] = { critical: r[1], citation: r[2] };
   });
   return table;
 }
+function certFixedCriticality(oidRegistry) { return _criticalityTable(CERT_FIXED_CRITICALITY_ROWS, oidRegistry); }
+function crlFixedCriticality(oidRegistry) { return _criticalityTable(CRL_FIXED_CRITICALITY_ROWS, oidRegistry); }
+function crlEntryFixedCriticality(oidRegistry) { return _criticalityTable(CRL_ENTRY_FIXED_CRITICALITY_ROWS, oidRegistry); }
 
 var GN_CONSTRUCTED = _assign(_create(null), { 0: 1, 3: 1, 4: 1, 5: 1 });
 var GN_IA5 = _assign(_create(null), { 1: 1, 2: 1, 6: 1 });
@@ -1259,6 +1284,358 @@ function _decodeHelpers(ns) {
   return { decodeTop: decodeTop, seqChildren: seqChildren, readInt: readInt, O: O };
 }
 
+/** @internal The extensions a CRL profiles, keyed by the scope that profiles them. RFC 5280
+ * sec. 5.2 defines the extensions of the list and sec. 5.3 those of an entry, and the two sets are
+ * disjoint: a `cRLNumber` sitting on an entry and a `reasonCode` sitting on the list are each an
+ * OID nothing profiles THERE, so neither is decoded and neither is a fault. Reading one table at
+ * both scopes is what made `lib/lint.js` apply the CERTIFICATE table at CRL scope.
+ *
+ * A caller that names no scope gets both tables, which is what an OCSP singleExtension needs:
+ * RFC 6960 sec. 4.4.5 carries a CRL-entry extension in a response, where neither scope is the
+ * whole answer. That agnostic reading is the shipped default and is why the tables are returned
+ * separately rather than merged.
+ *
+ * Each decoder takes the extnValue and the parse context and returns the decoded value, throwing a
+ * plain Error whose message the caller wraps in its own typed code, so a module keeps its own
+ * `<prefix>/bad-extension-value` rather than inheriting one from here. */
+function crlExtensionDecoders(ns) {
+  var _h = _decodeHelpers(ns), O = _h.O;
+  var byScope = _create(null);
+  byScope.crl = _create(null);
+  byScope.entry = _create(null);
+
+  /** @internal RFC 5280 sec. 5.2.4 defines BaseCRLNumber AS a CRLNumber, so the two read alike and
+   * the sec. 5.2.3 type's `INTEGER (0..MAX)` binds both. The width ceiling that section also
+   * states is a PROFILE rule rather than a shape rule and stays with the linter, which could not
+   * report on a CRL a parse had already refused. */
+  function crlNumberValue(what) {
+    return function (buf, ctx) {
+      var v = asn1.read.integer(decodeNested(buf, ctx, "a " + what + " extension value"));
+      if (v < 0n) throw new Error(what + " must be non-negative (INTEGER 0..MAX)");
+      return v;
+    };
+  }
+  byScope.crl[O("cRLNumber")] = crlNumberValue("cRLNumber");
+  byScope.entry[O("reasonCode")] = function (buf, ctx) {
+    var reason = asn1.read.enumerated(decodeNested(buf, ctx, "a reasonCode extension value"));
+    /** @internal The decoded value is a BigInt and the table is keyed by its decimal text, so the
+     * conversion is the captured one: a replaced `BigInt.prototype.toString` would otherwise
+     * decide which reason codes this reader calls defined. */
+    var key = _bigIntToString(reason);
+    if (!_hasOwn(CRL_REASON_NAMES, key)) throw new Error("undefined CRLReason " + key);
+    return _Number(reason);
+  };
+  byScope.entry[O("invalidityDate")] = function (buf, ctx) {
+    var n = decodeNested(buf, ctx, "an invalidityDate extension value");
+    if (n.tagClass !== "universal" || n.tagNumber !== asn1.TAGS.GENERALIZED_TIME) {
+      throw new Error("invalidityDate must be a GeneralizedTime");
+    }
+    return asn1.read.time(n);
+  };
+
+  /** @internal The decoder for one OID at one scope, or null. `scope` of `undefined` means both,
+   * in the order the list is read before its entries, which is the order the shipped agnostic
+   * reading already resolved them in. */
+  function at(extOid, scope) {
+    if (scope !== "entry" && _hasOwn(byScope.crl, extOid)) return byScope.crl[extOid];
+    if (scope !== "crl" && _hasOwn(byScope.entry, extOid)) return byScope.entry[extOid];
+    return null;
+  }
+
+  /** @internal The wider tables the extension door reads: every extension RFC 5280 sec. 5.2 and
+   * sec. 5.3 profile, including the ones whose syntax is a certificate extension's. They are NOT
+   * `byScope`, because `byScope` is what the parse decodes in place and the linter can only report
+   * a malformed extension the parse left opaque. */
+  var doorScope = _create(null);
+  doorScope.crl = _assign(_create(null), byScope.crl);
+  doorScope.entry = _assign(_create(null), byScope.entry);
+  _forEach(["authorityKeyIdentifier", "issuerAltName", "authorityInfoAccess", "freshestCRL"], function (n) {
+    doorScope.crl[O(n)] = scopedCertDecoder(ns, n);
+  });
+  doorScope.entry[O("certificateIssuer")] = _generalNamesDecoder(ns);
+  /** @internal RFC 5280 sec. 5.2.4 defines BaseCRLNumber AS a CRLNumber, so the sec. 5.2.3 type
+   * binds it and the non-negative rule is the same one. It is registered for the door and NOT in
+   * `byScope`, because a parse that decoded it could no longer open a CRL whose delta indicator is
+   * malformed, which is the object the linter's value-syntax rule exists to report on. */
+  doorScope.crl[O("deltaCRLIndicator")] = crlNumberValue("baseCRLNumber");
+  doorScope.crl[O("issuingDistributionPoint")] = _issuingDistributionPointDecoder(ns);
+
+  return { byScope: byScope, at: at, doorScope: doorScope };
+}
+
+/** @internal The door's reading of an IssuingDistributionPoint. The shared structural read reports a
+ *  fault rather than throwing, because path validation and linting both survey hostile input; the
+ *  door needs a decoder, so this is the throwing form over the same read. */
+function _issuingDistributionPointDecoder(ns) {
+  var code = ns.prefix + "/bad-extension-value";
+  return function (buf, ctx) {
+    var read = decodeIssuingDistributionPointValue(ctx || ns, buf, code);
+    if (read.malformed) {
+      throw new Error("value is not a well-formed IssuingDistributionPoint (RFC 5280 sec. 5.2.5)");
+    }
+    return {
+      distributionPoint: read.distributionPoint,
+      onlyContainsUserCerts: read.onlyUser,
+      onlyContainsCACerts: read.onlyCa,
+      onlySomeReasons: read.onlySomeReasonsPresent ? read.onlySomeReasonsValue : null,
+      indirectCRL: read.indirect,
+      onlyContainsAttributeCerts: read.onlyAttr,
+    };
+  };
+}
+
+/** @internal A certificate extension's decoder, reached from another format's table. The
+ *  certificate decoders close over the namespace they were built with, so a call that named caps
+ *  gets its own table and every decode below reads the caller's figure. A caller outside a parse
+ *  passes no context and reuses the module's table. */
+function scopedCertDecoder(ns, name) {
+  var key = ns.oid.byName(name);
+  var fixed = null;
+  return function (buf, ctx) {
+    if (ctx && (ctx.caps != null || ctx.budget != null)) {
+      return certExtensionDecoders(schema.withResources(ns, ctx)).byOid[key](buf);
+    }
+    if (fixed === null) fixed = certExtensionDecoders(ns).byOid;
+    return fixed[key](buf);
+  };
+}
+
+/** @internal certificateIssuer is a GeneralNames, which the CRL profile leaves raw at parse time
+ *  and the door reads. */
+function _generalNamesDecoder(ns) {
+  var NAMES = generalNames(ns, { code: ns.prefix + "/bad-extension-value" });
+  return function (buf, ctx) {
+    return schema.walk(NAMES, decodeNested(buf, ctx || ns, "a certificateIssuer extension value"), ctx || ns).result;
+  };
+}
+
+/** @internal One decoded extension, as the public door hands it back. Eleven own properties, every
+ * one always present, so a caller reads the same shape whatever happened to the value.
+ *
+ * `state` is the discriminator and is read first: `"decoded"` when the decoder produced a value,
+ * `"unrecognized"` when no decoder is registered for that OID at that scope, `"undecodable"` when
+ * one is and the value did not read as the structure its identifier names. `decoded` carries the
+ * value only in the first arm and is `null` in the other two, and nothing may test `decoded` for
+ * truthiness to tell them apart: `ocspNoCheck` decodes VALIDLY to null.
+ *
+ * `value` is the raw extnValue octets in every arm, byte-identical to the certificate's, because a
+ * caller that has to recompute a hash or compare an encoding needs the bytes and not a rendering
+ * of them. `code` is the typed error the decoder threw in the undecodable arm and `null`
+ * otherwise. `profile` carries the criticality the scope's RFC fixes for that OID, with the clause
+ * that fixes it and whether the encoded flag deviates, and is `null` for an extension whose
+ * criticality the issuer chooses.
+ *
+ * `index` is the position in the SEQUENCE the row came from and `containerIndex` the position of
+ * that SEQUENCE's container within the object: the revoked-certificate entry at `crl-entry` scope,
+ * the `extensionRequest` attribute at `csr-requested` scope, and `null` for a list the object
+ * carries directly. `scope` names which of the two it is, so one field serves both. */
+function _extensionRow(ext, opts, index, state, decoded, code, profile) {
+  var row = _create(null);
+  row.oid = ext.oid;
+  row.name = ext.name === undefined ? null : ext.name;
+  row.critical = ext.critical === true;
+  row.value = ext.value;
+  row.scope = opts.scope;
+  row.index = index;
+  row.containerIndex = opts.containerIndex === undefined ? null : opts.containerIndex;
+  row.state = state;
+  row.decoded = decoded;
+  row.code = code;
+  row.profile = profile;
+  return row;
+}
+
+/** @internal The door itself, parameterized by the scope it reads at and the table that scope
+ * profiles, so each format module wires its own rather than this file reaching into theirs. The
+ * attribute-certificate table lives in `schema-attrcert.js`, and a registry here that reached for
+ * it would invert the dependency.
+ *
+ * `opts.decoders` is the OID-keyed table, `opts.scope` the key each row carries, `opts.criticality`
+ * the fixed-criticality table or null, and `opts.strict` turns the undecodable arm into a throw.
+ * An unrecognized OID is never a throw, in any mode, at any scope: refusing one would make it
+ * impossible to READ a certificate carrying a private critical extension, which is what
+ * `pki.inspect` and `pki.lint` are for. RFC 5280 sec. 4.2's reject-on-critical rule is the
+ * caller's to apply, and the two facts it needs, `critical` and `state`, are on the row. */
+function decodeExtensionList(list, opts) {
+  var out = [];
+  for (var i = 0; i < list.length; i++) _append(out, decodeOneExtension(list[i], i, opts));
+  return out;
+}
+
+/** @internal One row, so the single-extension verb and the table verb answer from one reader. */
+function decodeOneExtension(ext, index, opts) {
+  var decoders = opts.decoders || _create(null);
+  var criticality = opts.criticality || null;
+  var profile = null;
+  if (criticality !== null && _hasOwn(criticality, ext.oid)) {
+    var fixed = criticality[ext.oid];
+    profile = _create(null);
+    profile.criticalExpected = fixed.critical;
+    profile.citation = fixed.citation;
+    profile.deviates = (ext.critical === true) !== fixed.critical;
+  }
+  if (!_hasOwn(decoders, ext.oid)) {
+    return _extensionRow(ext, opts, index, "unrecognized", null, null, profile);
+  }
+  /** @internal `failed` rather than a test on the caught value: a decoder that threw something
+   * falsy would otherwise read as a decode that produced `undefined`, and the row would say
+   * `decoded` for a value nothing decoded. */
+  var decoded, thrown = null, failed = false;
+  try { decoded = decoders[ext.oid](ext.value, opts.ctx); }
+  catch (e) { thrown = e; failed = true; }
+  if (failed) {
+    /** @internal A table's decoders do not all throw typed errors: the ones a parse composes throw
+     * a plain Error so the parse can wrap them in its own code. The row carries a code in every
+     * arm, so an untyped throw becomes the format's own `bad-extension-value` here. */
+    var carriesCode = thrown !== null && thrown !== undefined && typeof thrown.code === "string";
+    var typed = carriesCode ? thrown : opts.wrap(ext, thrown);
+    if (opts.strict === true) throw typed;
+    return _extensionRow(ext, opts, index, "undecodable", null, typed.code, profile);
+  }
+  return _extensionRow(ext, opts, index, "decoded", decoded, null, profile);
+}
+
+/** @internal The caps a caller may tighten on an extension door, and the two flags it takes
+ *  besides. `groups` is offered only by the door that has more than one list to group. */
+var EXTENSION_DOOR_OPTS = _assign(_create(null), { maxBytes: 1, maxDepth: 1, maxItems: 1, strict: 1 });
+var EXTENSION_DOOR_GROUP_OPTS = _assign(_create(null), _assign(_create(null), EXTENSION_DOOR_OPTS), { groups: 1 });
+var EXTENSION_CAP_KEYS = ["maxBytes", "maxDepth", "maxItems"];
+
+/** @internal The public door onto one object's decoded extensions, built once here and wired by each
+ * format module with its own scopes, so the option handling, the caps, the budget latch and the row
+ * shape are stated in one place and no format can answer differently from another.
+ *
+ * `spec.scopes` maps each scope key this format reads to `{ decoders, criticality }`.
+ * The attribute-certificate table lives in `schema-attrcert.js` and is passed in rather than
+ * reached for, or the dependency inverts. `spec.segments(parsed, read)` names the lists to read and
+ * the scope and container index of each; `spec.defaultScope` is the scope the single-extension verb
+ * reads at, and a format with more than one scope leaves it out and requires `opts.scope`.
+ *
+ * Caps bound the decoding THIS call performs. Handed bytes the door parses under them; handed a
+ * parse result it reads that result, whose own caps the caller chose when they parsed. */
+function extensionDoor(spec) {
+  var ns = spec.ns;
+  var prefix = ns.prefix;
+  var badInput = prefix + "/bad-input";
+  var knownOpts = spec.groups === true ? EXTENSION_DOOR_GROUP_OPTS : EXTENSION_DOOR_OPTS;
+  var capOpts = parseOpts({ ErrorClass: spec.ErrorClass, prefix: prefix, what: spec.what });
+  var scopeNames = intrinsic.keys(spec.scopes);
+  function E(code, message, cause) { return new spec.ErrorClass(code, message, cause); }
+
+  function readOpts(callerOpts, verb, wantsScope) {
+    var checked = guard.identifier.optionsObject(callerOpts, E, badInput, verb + ": opts");
+    var known = wantsScope ? _assign(_create(null), _assign(_create(null), knownOpts), { scope: 1 }) : knownOpts;
+    guard.identifier.assertKnownKeys(checked, known, E, badInput,
+      "pki.schema." + spec.key + "." + verb + " does not take the option ");
+    var asked = _create(null);
+    for (var i = 0; i < EXTENSION_CAP_KEYS.length; i++) {
+      var k = EXTENSION_CAP_KEYS[i];
+      if (checked[k] !== undefined) asked[k] = checked[k];
+    }
+    var read = _create(null);
+    read.caps = parseCaps(asked, capOpts);
+    read.strict = checked.strict === true;
+    read.groups = checked.groups === true;
+    read.scope = checked.scope;
+    read.tables = _create(null);
+    return read;
+  }
+
+  /** @internal The scope's tables plus this call's walk context, as one options object the row
+   *  reader takes. A fresh context per call, so one call's budget cannot latch another's.
+   *
+   * `table.decoders` is a FUNCTION of the call's namespace rather than a table, because a decoder
+   * built against the module's namespace carries the module's caps: the certificate decoders take
+   * the value alone and reach their bounds through the namespace they were built with, so a table
+   * held at module load would decode a caller's value under the built-in ceilings whatever caps
+   * that caller named. Built once per call and reused across every segment, so a CRL's entries do
+   * not rebuild it per entry. */
+  function scopeOpts(key, read, containerIndex) {
+    var table = spec.scopes[key];
+    var out = _create(null);
+    if (!_hasOwn(read.tables, key)) read.tables[key] = table.decoders(read.ctx.ns);
+    out.decoders = read.tables[key];
+    out.criticality = table.criticality === undefined ? null : table.criticality;
+    out.scope = key;
+    out.containerIndex = containerIndex;
+    out.strict = read.strict;
+    out.ctx = read.ctx.ns;
+    out.wrap = wrapValueFault;
+    return out;
+  }
+
+  var badValueCode = prefix + "/bad-extension-value";
+  function wrapValueFault(ext, thrown) {
+    return E(badValueCode, "malformed " + (ext.name || ext.oid) + " extension value: " +
+      guard.text.describeThrown(thrown), thrown);
+  }
+
+  function decodeExtensions(input, callerOpts) {
+    var read = readOpts(callerOpts, "decodeExtensions", false);
+    /** @internal A parse result is re-derived from the bytes it recorded, to prove it is the
+     * unmodified output of this format's parser. That re-derivation is not work this call asked
+     * for, so the caps do not bound it: they bound the decoding, and a caller naming a cap smaller
+     * than the whole object would otherwise be refused an extension value that fits inside it.
+     * Caps DO bound the parse of bytes the caller handed in, which is work this call performs. */
+    var fromBytes = typeof input === "string" || guard.bytes.isByteSource(input);
+    var parsed = guard.parsed.acceptDerived(input, spec.kind, function (bytes) {
+      return fromBytes ? spec.parse(bytes, read.caps) : spec.parse(bytes);
+    }, E, badInput, spec.what);
+    read.ctx = nestedContext(ns, read.caps);
+    var segments = spec.segments(parsed, read);
+    var out = [];
+    for (var s = 0; s < segments.length; s++) {
+      var seg = segments[s];
+      var rows = decodeExtensionList(seg.list, scopeOpts(seg.scope, read, seg.containerIndex));
+      for (var r = 0; r < rows.length; r++) _append(out, rows[r]);
+    }
+    if (read.ctx.budget.exhausted()) {
+      throw E(prefix + "/too-large", spec.what + " exceeds the decode budget for this call");
+    }
+    return read.groups ? spec.group(out, segments) : out;
+  }
+
+  function decodeExtension(ext, callerOpts) {
+    var read = readOpts(callerOpts, "decodeExtension", spec.defaultScope === undefined);
+    var key = read.scope === undefined ? spec.defaultScope : read.scope;
+    if (typeof key !== "string" || !_hasOwn(spec.scopes, key)) {
+      throw E(badInput, "pki.schema." + spec.key + ".decodeExtension needs opts.scope naming which " +
+        "scope to read at, one of " + _join(scopeNames, ", ") + "; got " + _String(key));
+    }
+    var record = _acceptExtensionRecord(ext, E, badInput, spec.key);
+    read.ctx = nestedContext(ns, read.caps);
+    var row = decodeOneExtension(record, 0, scopeOpts(key, read, undefined));
+    if (read.ctx.budget.exhausted()) {
+      throw E(prefix + "/too-large", "the extension value exceeds the decode budget for this call");
+    }
+    return row;
+  }
+
+  return { decodeExtensions: decodeExtensions, decodeExtension: decodeExtension };
+}
+
+/** @internal The single-extension verbs take the record `parse` puts in an object's extension list.
+ *  The three fields the row is built from are read off a snapshot, so a caller object cannot answer
+ *  one value to the check and another to the decode. */
+function _acceptExtensionRecord(ext, E, code, key) {
+  var checked = guard.identifier.optionsObject(ext, E, code,
+    "pki.schema." + key + ".decodeExtension: the extension");
+  if (typeof checked.oid !== "string" || checked.oid.length === 0) {
+    throw E(code, "pki.schema." + key + ".decodeExtension takes one extension record from a parse " +
+      "result, as { oid, name, critical, value }; its oid must be a dotted string");
+  }
+  if (!guard.bytes.isByteSource(checked.value)) {
+    throw E(code, "pki.schema." + key + ".decodeExtension: the extension's value must be the raw " +
+      "extnValue octets");
+  }
+  var record = _create(null);
+  record.oid = checked.oid;
+  record.name = typeof checked.name === "string" ? checked.name : null;
+  record.critical = checked.critical === true;
+  record.value = guard.bytes.snapshot(checked.value, E, code, "the extension value");
+  return record;
+}
+
 function certExtensionDecoders(ns) {
   var GN_SUBTREE = generalName(ns, { decodeValue: true, subtreeBase: true, code: ns.prefix + "/bad-name-constraints" });
   var _h = _decodeHelpers(ns), decodeTop = _h.decodeTop, seqChildren = _h.seqChildren, readInt = _h.readInt, O = _h.O;
@@ -1686,7 +2063,114 @@ function certExtensionDecoders(ns) {
     return hash;
   }
 
+  /** @internal RFC 7633 sec. 4: Features ::= SEQUENCE OF INTEGER, each an entry of the TLS
+   *  ExtensionType registry. The type carries no range, so a feature is read as the INTEGER it is
+   *  and a number outside the registry's 16-bit width is the caller's to judge. */
+  function tlsFeature(buf) {
+    var C = ns.prefix + "/bad-tls-feature";
+    var kids = seqChildren(buf, C, "Features");
+    return { features: _map(kids, function (n) {
+      if (n.tagClass !== "universal" || n.tagNumber !== _T.INTEGER) throw ns.E(C, "a Features element must be an INTEGER (RFC 7633 sec. 4)");
+      return readInt(n, C, "a feature");
+    }) };
+  }
+
+  /** @internal RFC 3779 sec. 2.2.3. An IPAddress is a BIT STRING whose bits are the leading bits of
+   *  the address, so a prefix is its length in bits and a range is a pair of them. The address
+   *  family is the two-octet IANA AFI, with an optional third octet naming the SAFI. */
+  function _ipAddress(n, C, what) {
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.BIT_STRING) throw ns.E(C, what + " must be a BIT STRING (RFC 3779 sec. 2.1.1)");
+    var bs;
+    try { bs = asn1.read.bitString(n); }
+    catch (e) { throw ns.E(C, what + " must be a well-formed BIT STRING", e); }
+    return { unusedBits: bs.unusedBits, bytes: bs.bytes, prefixLength: bs.bytes.length * 8 - bs.unusedBits };
+  }
+  function ipAddrBlocks(buf) {
+    var C = ns.prefix + "/bad-ip-addr-blocks";
+    var families = seqChildren(buf, C, "IPAddrBlocks");
+    return { families: _map(families, function (f) {
+      if (f.tagClass !== "universal" || f.tagNumber !== _T.SEQUENCE || !f.children || f.children.length !== 2) {
+        throw ns.E(C, "an IPAddressFamily must be a SEQUENCE { addressFamily, ipAddressChoice } (RFC 3779 sec. 2.2.3)");
+      }
+      var afi;
+      try { afi = _bufferConcat([asn1.read.octetString(f.children[0])]); }
+      catch (e) { throw ns.E(C, "an IPAddressFamily addressFamily must be an OCTET STRING", e); }
+      if (afi.length < 2 || afi.length > 3) throw ns.E(C, "an IPAddressFamily addressFamily must be 2 or 3 octets (RFC 3779 sec. 2.2.3.3)");
+      var choice = f.children[1];
+      var inherit = choice.tagClass === "universal" && choice.tagNumber === _T.NULL;
+      if (inherit) {
+        try { asn1.read.nullValue(choice); }
+        catch (e) { throw ns.E(C, "an inherit IPAddressChoice must be a NULL carrying no content", e); }
+      } else if (choice.tagClass !== "universal" || choice.tagNumber !== _T.SEQUENCE || !choice.children) {
+        throw ns.E(C, "an IPAddressChoice must be an inherit NULL or a SEQUENCE OF IPAddressOrRange (RFC 3779 sec. 2.2.3.7)");
+      }
+      return {
+        addressFamily: afi, afi: (afi[0] << 8) | afi[1], safi: afi.length === 3 ? afi[2] : null,
+        inherit: inherit,
+        addressesOrRanges: inherit ? null : _map(choice.children, function (r) {
+          if (r.tagClass === "universal" && r.tagNumber === _T.BIT_STRING) {
+            return { kind: "addressPrefix", addressPrefix: _ipAddress(r, C, "an addressPrefix") };
+          }
+          if (r.tagClass !== "universal" || r.tagNumber !== _T.SEQUENCE || !r.children || r.children.length !== 2) {
+            throw ns.E(C, "an IPAddressOrRange must be an addressPrefix BIT STRING or an addressRange SEQUENCE { min, max } (RFC 3779 sec. 2.2.3.7)");
+          }
+          return { kind: "addressRange", min: _ipAddress(r.children[0], C, "an addressRange min"),
+            max: _ipAddress(r.children[1], C, "an addressRange max") };
+        }),
+      };
+    }) };
+  }
+
+  /** @internal RFC 3779 sec. 3.2.3. `ASId ::= INTEGER` carries no range, so an AS number is read as
+   *  the INTEGER it is and one outside the 32 bits RFC 6793 sec. 2 gives the registry is the
+   *  caller's to judge. Both arms of the SEQUENCE are EXPLICIT because ASIdentifierChoice is a
+   *  CHOICE. */
+  function _asIdChoice(wrap, C, what) {
+    if (!wrap.children || wrap.children.length !== 1) throw ns.E(C, "an " + what + " [n] must wrap exactly one ASIdentifierChoice (RFC 3779 sec. 3.2.3)");
+    var n = wrap.children[0];
+    if (n.tagClass === "universal" && n.tagNumber === _T.NULL) {
+      try { asn1.read.nullValue(n); }
+      catch (e) { throw ns.E(C, "an inherit ASIdentifierChoice must be a NULL carrying no content", e); }
+      return { inherit: true, asIdsOrRanges: null };
+    }
+    if (n.tagClass !== "universal" || n.tagNumber !== _T.SEQUENCE || !n.children) {
+      throw ns.E(C, "an ASIdentifierChoice must be an inherit NULL or a SEQUENCE OF ASIdOrRange (RFC 3779 sec. 3.2.3)");
+    }
+    function asId(node, label) {
+      if (node.tagClass !== "universal" || node.tagNumber !== _T.INTEGER) throw ns.E(C, label + " must be an INTEGER (RFC 3779 sec. 3.2.3)");
+      return readInt(node, C, label);
+    }
+    return { inherit: false, asIdsOrRanges: _map(n.children, function (r) {
+      if (r.tagClass === "universal" && r.tagNumber === _T.INTEGER) return { kind: "id", id: asId(r, "an ASId") };
+      if (r.tagClass !== "universal" || r.tagNumber !== _T.SEQUENCE || !r.children || r.children.length !== 2) {
+        throw ns.E(C, "an ASIdOrRange must be an ASId INTEGER or an ASRange SEQUENCE { min, max } (RFC 3779 sec. 3.2.3)");
+      }
+      return { kind: "range", min: asId(r.children[0], "an ASRange min"), max: asId(r.children[1], "an ASRange max") };
+    }) };
+  }
+  function autonomousSysIds(buf) {
+    var C = ns.prefix + "/bad-autonomous-sys-ids";
+    var kids = seqChildren(buf, C, "ASIdentifiers");
+    var asnum = null, rdi = null, seen = -1;
+    for (var i = 0; i < kids.length; i++) {
+      var k = kids[i];
+      if (k.tagClass !== "context" || (k.tagNumber !== 0 && k.tagNumber !== 1)) {
+        throw ns.E(C, "ASIdentifiers carries only asnum [0] and rdi [1] (RFC 3779 sec. 3.2.3)");
+      }
+      if (k.tagNumber <= seen) throw ns.E(C, "ASIdentifiers components must appear in tag order and at most once (RFC 3779 sec. 3.2.3)");
+      seen = k.tagNumber;
+      if (k.tagNumber === 0) asnum = _asIdChoice(k, C, "asnum");
+      else rdi = _asIdChoice(k, C, "rdi");
+    }
+    return { asnum: asnum, rdi: rdi };
+  }
+
   var byOid = _create(null);
+  byOid[O("tlsFeature")] = tlsFeature;
+  byOid[O("ipAddrBlocks")] = ipAddrBlocks;
+  byOid[O("ipAddrBlocksV2")] = ipAddrBlocks;
+  byOid[O("autonomousSysIds")] = autonomousSysIds;
+  byOid[O("autonomousSysIdsV2")] = autonomousSysIds;
   byOid[O("qcStatements")] = qcStatements;
   byOid[O("basicConstraints")] = basicConstraints;
   byOid[O("keyUsage")] = keyUsage;
@@ -1919,7 +2403,13 @@ module.exports = {
   rawNonEmptySequence: rawNonEmptySequence,
   CRL_REASON_NAMES: CRL_REASON_NAMES,
   certFixedCriticality: certFixedCriticality,
+  crlFixedCriticality: crlFixedCriticality,
+  crlEntryFixedCriticality: crlEntryFixedCriticality,
   certExtensionDecoders: certExtensionDecoders,
+  scopedCertDecoder: scopedCertDecoder,
+  crlExtensionDecoders: crlExtensionDecoders,
+  decodeExtensionList: decodeExtensionList,
+  extensionDoor: extensionDoor,
   _decodeHelpers: _decodeHelpers,
   attribute: attribute,
   extension: extension,