-- %CopyrightBegin%
--
-- SPDX-License-Identifier: BSD-3-Clause
--
-- Copyright (c) 2010 IETF Trust and the persons identified as the document authors.  All rights reserved.
-- Copyright Ericsson AB 2025. All Rights Reserved.
--
-- Redistribution and use in source and binary forms, with or without
-- modification, are permitted provided that the following conditions are met:
--
-- 1. Redistributions of source code must retain the above copyright notice,
--    this list of conditions and the following disclaimer.
--
-- 2. Redistributions in binary form must reproduce the above copyright notice,
--    this list of conditions and the following disclaimer in the documentation
--    and/or other materials provided with the distribution.
--
-- 3. Neither the name of the copyright holder nor the names of its contributors
--    may be used to endorse or promote products derived from this software
--    without specific prior written permission.
--
-- THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS”
-- AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-- IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-- ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
-- LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
-- CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
-- SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
-- INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
-- CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
-- ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
-- POSSIBILITY OF SUCH DAMAGE.
--
-- %CopyrightEnd%

  PKIX-CommonTypes-2009
      {iso(1) identified-organization(3) dod(6) internet(1) security(5)
      mechanisms(5) pkix(7) id-mod(0) id-mod-pkixCommon-02(57)}

  DEFINITIONS EXPLICIT TAGS ::=
  BEGIN

  --  ATTRIBUTE
  --
  --  Describe the set of data associated with an attribute of some type
  --
  --  &id is an OID identifying the attribute
  --  &Type is the ASN.1 type structure for the attribute; not all
  --      attributes have a data structure, so this field is optional
  --  &minCount contains the minimum number of times the attribute can
  --      occur in an AttributeSet
  --  &maxCount contains the maximum number of times the attribute can
  --      appear in an AttributeSet
  --      Note: this cannot be automatically enforced as the field
  --      cannot be defaulted to MAX.
  --  &equality-match contains information about how matching should be
  --      done
  --
  --  Currently we are using two different prefixes for attributes.
  --
  --  at- for certificate attributes
  --  aa- for CMS attributes
  --

  ATTRIBUTE ::= CLASS {
      &id             OBJECT IDENTIFIER UNIQUE,
      &Type           OPTIONAL,
      &equality-match MATCHING-RULE OPTIONAL,
      &minCount       INTEGER DEFAULT 1,
      &maxCount       INTEGER OPTIONAL
  } WITH SYNTAX {
      [TYPE &Type]
      [EQUALITY MATCHING RULE &equality-match]
      [COUNTS [MIN &minCount] [MAX &maxCount]]
      IDENTIFIED BY &id
  }

  -- Specification of MATCHING-RULE information object class
  --

  MATCHING-RULE ::= CLASS {
    &ParentMatchingRules   MATCHING-RULE OPTIONAL,
    &AssertionType         OPTIONAL,
    &uniqueMatchIndicator  ATTRIBUTE OPTIONAL,
    &id                    OBJECT IDENTIFIER UNIQUE
  }
  WITH SYNTAX {
    [PARENT &ParentMatchingRules]
    [SYNTAX &AssertionType]
    [UNIQUE-MATCH-INDICATOR &uniqueMatchIndicator]
    ID &id
  }

  --  AttributeSet
  --
  --  Used when a set of attributes is to occur.
  --
  --  type contains the identifier of the attribute
  --  values contains a set of values where the structure of the ASN.1
  --      is defined by the attribute
  --
  --  The parameter contains the set of objects describing
  --      those attributes that can occur in this location.
  --

  AttributeSet{ATTRIBUTE:AttrSet} ::= SEQUENCE {
      type      ATTRIBUTE.&id({AttrSet}),
      values    SET SIZE (1..MAX) OF ATTRIBUTE.
                    &Type({AttrSet}{@type})
  }

  --  SingleAttribute
  --
  --  Used for a single valued attribute
  --
  --  The parameter contains the set of objects describing the
  --      attributes that can occur in this location
  --

  SingleAttribute{ATTRIBUTE:AttrSet} ::= SEQUENCE {
      type      ATTRIBUTE.&id({AttrSet}),
      value     ATTRIBUTE.&Type({AttrSet}{@type})
  }

  --  EXTENSION
  --
  --  This class definition is used to describe the association of
  --      object identifier and ASN.1 type structure for extensions
  --
  --  All extensions are prefixed with ext-
  --
  --  &id contains the object identifier for the extension
  --  &ExtnType specifies the ASN.1 type structure for the extension
  --  &Critical contains the set of legal values for the critical field.
  --      This is normally {TRUE|FALSE} but in some instances may be
  --      restricted to just one of these values.
  --

  EXTENSION ::= CLASS {
      &id  OBJECT IDENTIFIER UNIQUE,
      &ExtnType,
      &Critical    BOOLEAN DEFAULT {TRUE | FALSE }
  } WITH SYNTAX {
      SYNTAX &ExtnType IDENTIFIED BY &id
      [CRITICALITY &Critical]
  }

  --  Extensions
  --
  --  Used for a sequence of extensions.
  --
  --  The parameter contains the set of legal extensions that can
  --  occur in this sequence.
  --

  Extensions{EXTENSION:ExtensionSet} ::=
      SEQUENCE SIZE (1..MAX) OF Extension{{ExtensionSet}}

  --  Extension
  --
  --  Used for a single extension
  --
  --  The parameter contains the set of legal extensions that can
  --      occur in this extension.
  --
  --  The restriction on the critical field has been commented out
  --  the authors are not completely sure it is correct.
  --  The restriction could be done using custom code rather than
  --  compiler-generated code, however.
  --

  Extension{EXTENSION:ExtensionSet} ::= SEQUENCE {
      extnID      EXTENSION.&id({ExtensionSet}),
      critical    BOOLEAN
  --                     (EXTENSION.&Critical({ExtensionSet}{@extnID}))
                       DEFAULT FALSE,
      extnValue   OCTET STRING (CONTAINING
                  EXTENSION.&ExtnType({ExtensionSet}{@extnID}))
                  --  contains the DER encoding of the ASN.1 value
                  --  corresponding to the extension type identified
                  --  by extnID
  }

  --  Security Category
  --
  --  Security categories are used both for specifying clearances and
  --  for labeling objects.  We move this here from RFC 3281 so that
  --  they will use a common single object class to express this
  --  information.
  --

  SECURITY-CATEGORY ::= TYPE-IDENTIFIER

  SecurityCategory{SECURITY-CATEGORY:Supported} ::= SEQUENCE {
      type      [0]  IMPLICIT SECURITY-CATEGORY.
              &id({Supported}),
      value     [1]  EXPLICIT SECURITY-CATEGORY.
              &Type({Supported}{@type})
  }

  END
