examples/CrlExample.c - third_party/libtasn1 - Git at Google

 /*
  * Copyright (C) 2000-2021 Free Software Foundation, Inc.
  *
  * This file is part of LIBTASN1.
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
  * the Free Software Foundation, either version 3 of the License, or
  * (at your option) any later version.
  *
  * This program is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  * GNU General Public License for more details.
  *
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  *
  */

 /*****************************************************/
 /* File: CrlExample.c                                */
 /* Description: An example on how to use the ASN1    */
 /*              parser with the Certificate.txt file */
 /*****************************************************/

 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 #include "libtasn1.h"


 static char *
 my_ltostr (long v, char *str)
 {
   long d, r;
   char temp[20];
   int count, k, start;

   if (v < 0)
     {
       str[0] = '-';
       start = 1;
       v = -v;
     }
   else
     start = 0;

   count = 0;
   do
     {
       d = v / 10;
       r = v - d * 10;
       temp[start + count] = '0' + (char) r;
       count++;
       v = d;
     }
   while (v);

   for (k = 0; k < count; k++)
     str[k + start] = temp[start + count - k - 1];
   str[count + start] = 0;
   return str;
 }


 /******************************************************/
 /* Function : get_name_type                           */
 /* Description: analyze a structure of type Name      */
 /* Parameters:                                        */
 /*   char *root: the structure identifier             */
 /*   char *answer: the string with elements like:     */
 /*                 "C=US O=gov"                       */
 /******************************************************/
 static void
 get_Name_type (asn1_node cert_def, asn1_node cert, const char *root,
 	       unsigned char *ans)
 {
   int k, k2, result, len;
   char name[128], str[1024], str2[1024], name2[128], counter[5], name3[128];
   asn1_node value = NULL;
   char errorDescription[ASN1_MAX_ERROR_DESCRIPTION_SIZE];
   char *answer = (char *) ans;

   answer[0] = 0;
   k = 1;
   do
     {
       strcpy (name, root);
       strcat (name, ".rdnSequence.?");
       my_ltostr (k, counter);
       strcat (name, counter);

       len = sizeof (str) - 1;
       result = asn1_read_value (cert, name, str, &len);
       if (result == ASN1_ELEMENT_NOT_FOUND)
 	break;
       k2 = 1;
       do
 	{
 	  strcpy (name2, name);
 	  strcat (name2, ".?");
 	  my_ltostr (k2, counter);
 	  strcat (name2, counter);

 	  len = sizeof (str) - 1;
 	  result = asn1_read_value (cert, name2, str, &len);
 	  if (result == ASN1_ELEMENT_NOT_FOUND)
 	    break;
 	  strcpy (name3, name2);
 	  strcat (name3, ".type");

 	  len = sizeof (str) - 1;
 	  result = asn1_read_value (cert, name3, str, &len);
 	  strcpy (name3, name2);
 	  strcat (name3, ".value");
 	  if (result == ASN1_SUCCESS)
 	    {
 	      len = sizeof (str2);
 	      result =
 		asn1_read_value (cert_def,
 				 "PKIX1Implicit88.id-at-countryName", str2,
 				 &len);
 	      if (!strcmp (str, str2))
 		{
 		  asn1_create_element (cert_def,
 				       "PKIX1Implicit88.X520OrganizationName",
 				       &value);
 		  len = sizeof (str) - 1;
 		  asn1_read_value (cert, name3, str, &len);
 		  result =
 		    asn1_der_decoding (&value, str, len, errorDescription);

 		  len = sizeof (str) - 1;
 		  asn1_read_value (value, "", str, &len);	/* CHOICE */

 		  strcpy (name3, str);

 		  len = sizeof (str) - 1;
 		  asn1_read_value (value, name3, str, &len);
 		  str[len] = 0;
 		  strcat (answer, " C=");
 		  strcat (answer, str);

 		  asn1_delete_structure (&value);
 		}
 	      else
 		{
 		  len = sizeof (str2);
 		  result =
 		    asn1_read_value (cert_def,
 				     "PKIX1Implicit88.id-at-organizationName",
 				     str2, &len);
 		  if (!strcmp (str, str2))
 		    {
 		      asn1_create_element (cert_def,
 					   "PKIX1Implicit88.X520OrganizationName",
 					   &value);

 		      len = sizeof (str) - 1;
 		      asn1_read_value (cert, name3, str, &len);
 		      asn1_der_decoding (&value, str, len, errorDescription);
 		      len = sizeof (str) - 1;
 		      asn1_read_value (value, "", str, &len);	/* CHOICE */
 		      strcpy (name3, str);
 		      len = sizeof (str) - 1;
 		      asn1_read_value (value, name3, str, &len);
 		      str[len] = 0;
 		      strcat (answer, " O=");
 		      strcat (answer, str);
 		      asn1_delete_structure (&value);
 		    }
 		  else
 		    {
 		      len = sizeof (str2);
 		      result =
 			asn1_read_value (cert_def,
 					 "PKIX1Implicit88.id-at-organizationalUnitName",
 					 str2, &len);
 		      if (!strcmp (str, str2))
 			{
 			  asn1_create_element (cert_def,
 					       "PKIX1Implicit88.X520OrganizationalUnitName",
 					       &value);
 			  len = sizeof (str) - 1;
 			  asn1_read_value (cert, name3, str, &len);
 			  asn1_der_decoding (&value, str, len,
 					     errorDescription);
 			  len = sizeof (str) - 1;
 			  asn1_read_value (value, "", str, &len);	/* CHOICE */
 			  strcpy (name3, str);
 			  len = sizeof (str) - 1;
 			  asn1_read_value (value, name3, str, &len);
 			  str[len] = 0;
 			  strcat (answer, " OU=");
 			  strcat (answer, str);
 			  asn1_delete_structure (&value);
 			}
 		    }
 		}
 	    }
 	  k2++;
 	}
       while (1);
       k++;
     }
   while (1);
 }


 /******************************************************/
 /* Function : create_certificate                      */
 /* Description: creates a certificate named           */
 /*              "certificate1". Values are the same   */
 /*              as in rfc2459 Appendix D.1            */
 /* Parameters:                                        */
 /*   unsigned char *der: contains the der encoding    */
 /*   int *der_len: number of bytes of der string      */
 /******************************************************/
 static void
 create_CRL (asn1_node cert_def, unsigned char *der, int *der_len)
 {
   int result, k, len;
   unsigned char str[1024];
   const unsigned char *str2;
   asn1_node crl = NULL;
   asn1_node value = NULL;
   char errorDescription[ASN1_MAX_ERROR_DESCRIPTION_SIZE];
   int max_len;

   max_len = *der_len;

   result =
     asn1_create_element (cert_def, "PKIX1Implicit88.CertificateList", &crl);

   /* Use the next 3 lines to visit the empty certificate */
   /*  printf("-----------------\n");
      asn1_visit_tree(crl,"");
      printf("-----------------\n"); */


   /* version: v2(1) */
   result = asn1_write_value (crl, "tbsCertList.version", "v2", 0);


   /* signature: dsa-with-sha */
   len = sizeof (str) - 1;
   result =
     asn1_read_value (cert_def, "PKIX1Implicit88.id-dsa-with-sha1", str, &len);
   result = asn1_write_value (crl, "tbsCertList.signature.algorithm", str, 1);
   result =
     asn1_write_value (crl, "tbsCertList.signature.parameters", NULL, 0);


   /* issuer: Country="US" Organization="gov" OrganizationUnit="nist" */
   result = asn1_write_value (crl, "tbsCertList.issuer", "rdnSequence", 1);

   result = asn1_write_value (crl, "tbsCertList.issuer.rdnSequence", "NEW", 1);
   result =
     asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST", "NEW", 1);
   /* C */
   len = sizeof (str) - 1;
   result =
     asn1_read_value (cert_def, "PKIX1Implicit88.id-at-countryName", str,
 		     &len);
   result =
     asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.type",
 		      str, 1);
   result =
     asn1_create_element (cert_def, "PKIX1Implicit88.X520countryName", &value);
   result = asn1_write_value (value, "", "US", 2);
   *der_len = max_len;
   result = asn1_der_coding (value, "", der, der_len, errorDescription);

   asn1_delete_structure (&value);
   result =
     asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.value",
 		      der, *der_len);


   result = asn1_write_value (crl, "tbsCertList.issuer.rdnSequence", "NEW", 4);
   result =
     asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST", "NEW", 4);
   /* O */
   len = sizeof (str) - 1;
   result =
     asn1_read_value (cert_def, "PKIX1Implicit88.id-at-organizationName", str,
 		     &len);
   result =
     asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.type",
 		      str, 8);
   result =
     asn1_create_element (cert_def, "PKIX1Implicit88.X520OrganizationName",
 			 &value);
   result = asn1_write_value (value, "", "printableString", 1);
   result = asn1_write_value (value, "printableString", "gov", 3);
   *der_len = max_len;
   result = asn1_der_coding (value, "", der, der_len, errorDescription);
   asn1_delete_structure (&value);
   result =
     asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.value",
 		      der, *der_len);


   result = asn1_write_value (crl, "tbsCertList.issuer.rdnSequence", "NEW", 1);
   result =
     asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST", "NEW", 1);
   /* OU */
   len = sizeof (str) - 1;
   result =
     asn1_read_value (cert_def, "PKIX1Implicit88.id-at-organizationalUnitName",
 		     str, &len);
   result =
     asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.type",
 		      str, 1);
   result =
     asn1_create_element (cert_def,
 			 "PKIX1Implicit88.X520OrganizationalUnitName",
 			 &value);
   result = asn1_write_value (value, "", "printableString", 1);
   result = asn1_write_value (value, "printableString", "nist", 4);
   *der_len = max_len;
   result = asn1_der_coding (value, "", der, der_len, errorDescription);
   asn1_delete_structure (&value);
   result =
     asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.value",
 		      der, *der_len);


   /* validity */
   result = asn1_write_value (crl, "tbsCertList.thisUpdate", "utcTime", 1);
   result =
     asn1_write_value (crl, "tbsCertList.thisUpdate.utcTime", "970801000000Z",
 		      1);

   result = asn1_write_value (crl, "tbsCertList.nextUpdate", "utcTime", 1);
   result =
     asn1_write_value (crl, "tbsCertList.nextUpdate.utcTime", "970808000000Z",
 		      1);


   /* revokedCertificates */
   result =
     asn1_write_value (crl, "tbsCertList.revokedCertificates", "NEW", 1);
   str[0] = 18;
   result =
     asn1_write_value (crl,
 		      "tbsCertList.revokedCertificates.?LAST.userCertificate",
 		      str, 1);
   result =
     asn1_write_value (crl,
 		      "tbsCertList.revokedCertificates.?LAST.revocationDate",
 		      "utcTime", 1);
   result =
     asn1_write_value (crl,
 		      "tbsCertList.revokedCertificates.?LAST.revocationDate.utcTime",
 		      "970731000000Z", 1);

   result =
     asn1_write_value (crl,
 		      "tbsCertList.revokedCertificates.?LAST.crlEntryExtensions",
 		      "NEW", 1);
   len = sizeof (str) - 1;
   result = asn1_read_value (cert_def, "PKIX1Implicit88.id-ce-cRLReasons",
 			    str, &len);
   result = asn1_write_value (crl, "tbsCertList.revokedCertificates.?LAST.crlEntryExtensions.?LAST.extnID", str, 1);	/* reasonCode */
   result =
     asn1_write_value (crl,
 		      "tbsCertList.revokedCertificates.?LAST.crlEntryExtensions.?LAST.critical",
 		      "FALSE", 1);
   str2 = (const unsigned char *) "\x0a\x01\x01";
   result =
     asn1_write_value (crl,
 		      "tbsCertList.revokedCertificates.?LAST.crlEntryExtensions.?LAST.extnValue",
 		      str2, 3);


   /* crlExtensions */
   result = asn1_write_value (crl, "tbsCertList.crlExtensions", NULL, 0);


   /* signatureAlgorithm: dsa-with-sha  */
   len = sizeof (str) - 1;
   result =
     asn1_read_value (cert_def, "PKIX1Implicit88.id-dsa-with-sha1", str, &len);
   result = asn1_write_value (crl, "signatureAlgorithm.algorithm", str, 1);
   result = asn1_write_value (crl, "signatureAlgorithm.parameters", NULL, 0);	/* NO OPTION */

   /* signature */
   *der_len = max_len;
   result =
     asn1_der_coding (crl, "tbsCertList", der, der_len, errorDescription);
   if (result != ASN1_SUCCESS)
     {
       printf ("\n'tbsCertList' encoding creation: ERROR\n");
       return;
     }

   /* add the lines for the signature on der[0]..der[der_len-1]: result in str2 */
   result = asn1_write_value (crl, "signature", str2, 46 * 8);


   /* Use the next 3 lines to visit the certificate */
   /* printf("-----------------\n");
      asn1_visit_tree(crl,"");
      printf("-----------------\n"); */

   *der_len = max_len;
   result = asn1_der_coding (crl, "", der, der_len, errorDescription);
   if (result != ASN1_SUCCESS)
     {
       printf ("\n'crl1' encoding creation: ERROR\n");
       return;
     }

   /* Print the 'Certificate1' DER encoding */
   printf ("-----------------\nCrl1 Encoding:\nNumber of bytes=%i\n",
 	  *der_len);
   for (k = 0; k < *der_len; k++)
     printf ("%02x ", der[k]);
   printf ("\n-----------------\n");

   /* Clear the "certificate1" structure */
   asn1_delete_structure (&crl);
 }


 /******************************************************/
 /* Function : get_certificate                         */
 /* Description: creates a certificate named           */
 /*              "certificate2" from a der encoding    */
 /*              string                                */
 /* Parameters:                                        */
 /*   unsigned char *der: the encoding string          */
 /*   int der_len: number of bytes of der string      */
 /******************************************************/
 static void
 get_CRL (asn1_node cert_def, unsigned char *der, int der_len)
 {
   int result, len, start, end;
   unsigned char str[1024], str2[1024];
   asn1_node crl2 = NULL;
   char errorDescription[ASN1_MAX_ERROR_DESCRIPTION_SIZE];


   asn1_create_element (cert_def, "PKIX1Implicit88.CertificateList", &crl2);

   result = asn1_der_decoding (&crl2, der, der_len, errorDescription);

   if (result != ASN1_SUCCESS)
     {
       printf ("Problems with DER encoding\n");
       return;
     }


   /* issuer */
   get_Name_type (cert_def, crl2, "tbsCertList.issuer", str);
   printf ("crl2:\nissuer: %s\n", str);


   /* Verify sign */
   len = sizeof (str) - 1;
   result = asn1_read_value (crl2, "signatureAlgorithm.algorithm", str, &len);

   result =
     asn1_read_value (cert_def, "PKIX1Implicit88.id-dsa-with-sha1", str2,
 		     &len);
   if (!strcmp ((char *) str, (char *) str2))
     {				/* dsa-with-sha */

       result = asn1_der_decoding_startEnd (crl2, der, der_len,
 					   "tbsCertList", &start, &end);

       /* add the lines to calculate the sha on der[start]..der[end] */

       result = asn1_read_value (crl2, "signature", str, &len);

       /* compare the previous value to signature ( with issuer public key) */
     }

   /* Use the next 3 lines to visit the certificate */
   /* printf("-----------------\n");
      asn1_visit_tree(crl2,"");
      printf("-----------------\n"); */


   /* Clear the "crl2" structure */
   asn1_delete_structure (&crl2);
 }

 extern const asn1_static_node pkix_asn1_tab[];

 /********************************************************/
 /* Function : main                                      */
 /* Description: reads the certificate description.      */
 /*              Creates a certificate and calculate     */
 /*              the der encoding. After that creates    */
 /*              another certificate from der string     */
 /********************************************************/
 int
 main (int argc, char *argv[])
 {
   int result, der_len;
   unsigned char der[1024];
   asn1_node PKIX1Implicit88 = NULL;
   char errorDescription[ASN1_MAX_ERROR_DESCRIPTION_SIZE];

   if (1)
     result =
       asn1_array2tree (pkix_asn1_tab, &PKIX1Implicit88, errorDescription);
   else
     result =
       asn1_parser2tree ("pkix.asn", &PKIX1Implicit88, errorDescription);

   if (result != ASN1_SUCCESS)
     {
       asn1_perror (result);
       printf ("%s\n", errorDescription);
       exit (1);
     }

   /* Use the following 3 lines to visit the PKIX1Implicit structures */
   /* printf("-----------------\n");
      asn1_visit_tree(cert_def,"PKIX1Implicit88");
      printf("-----------------\n"); */

   der_len = 1024;
   create_CRL (PKIX1Implicit88, der, &der_len);


   get_CRL (PKIX1Implicit88, der, der_len);

   /* Clear the "PKIX1Implicit88" structures */
   asn1_delete_structure (&PKIX1Implicit88);

   return 0;
 }
	/*
	* Copyright (C) 2000-2021 Free Software Foundation, Inc.
	*
	* This file is part of LIBTASN1.
	*
	* This program is free software: you can redistribute it and/or modify
	* it under the terms of the GNU General Public License as published by
	* the Free Software Foundation, either version 3 of the License, or
	* (at your option) any later version.
	*
	* This program is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU General Public License for more details.
	*
	* You should have received a copy of the GNU General Public License
	* along with this program. If not, see <http://www.gnu.org/licenses/>.
	*
	*/

	/*****************************************************/
	/* File: CrlExample.c */
	/* Description: An example on how to use the ASN1 */
	/* parser with the Certificate.txt file */
	/*****************************************************/

	#include <stdio.h>
	#include <string.h>
	#include <stdlib.h>
	#include "libtasn1.h"



	static char *
	my_ltostr (long v, char *str)
	{
	long d, r;
	char temp[20];
	int count, k, start;

	if (v < 0)
	{
	str[0] = '-';
	start = 1;
	v = -v;
	}
	else
	start = 0;

	count = 0;
	do
	{
	d = v / 10;
	r = v - d * 10;
	temp[start + count] = '0' + (char) r;
	count++;
	v = d;
	}
	while (v);

	for (k = 0; k < count; k++)
	str[k + start] = temp[start + count - k - 1];
	str[count + start] = 0;
	return str;
	}


	/******************************************************/
	/* Function : get_name_type */
	/* Description: analyze a structure of type Name */
	/* Parameters: */
	/* char root: the structure identifier /
	/* char answer: the string with elements like: /
	/* "C=US O=gov" */
	/******************************************************/
	static void
	get_Name_type (asn1_node cert_def, asn1_node cert, const char *root,
	unsigned char *ans)
	{
	int k, k2, result, len;
	char name[128], str[1024], str2[1024], name2[128], counter[5], name3[128];
	asn1_node value = NULL;
	char errorDescription[ASN1_MAX_ERROR_DESCRIPTION_SIZE];
	char answer = (char ) ans;

	answer[0] = 0;
	k = 1;
	do
	{
	strcpy (name, root);
	strcat (name, ".rdnSequence.?");
	my_ltostr (k, counter);
	strcat (name, counter);

	len = sizeof (str) - 1;
	result = asn1_read_value (cert, name, str, &len);
	if (result == ASN1_ELEMENT_NOT_FOUND)
	break;
	k2 = 1;
	do
	{
	strcpy (name2, name);
	strcat (name2, ".?");
	my_ltostr (k2, counter);
	strcat (name2, counter);

	len = sizeof (str) - 1;
	result = asn1_read_value (cert, name2, str, &len);
	if (result == ASN1_ELEMENT_NOT_FOUND)
	break;
	strcpy (name3, name2);
	strcat (name3, ".type");

	len = sizeof (str) - 1;
	result = asn1_read_value (cert, name3, str, &len);
	strcpy (name3, name2);
	strcat (name3, ".value");
	if (result == ASN1_SUCCESS)
	{
	len = sizeof (str2);
	result =
	asn1_read_value (cert_def,
	"PKIX1Implicit88.id-at-countryName", str2,
	&len);
	if (!strcmp (str, str2))
	{
	asn1_create_element (cert_def,
	"PKIX1Implicit88.X520OrganizationName",
	&value);
	len = sizeof (str) - 1;
	asn1_read_value (cert, name3, str, &len);
	result =
	asn1_der_decoding (&value, str, len, errorDescription);

	len = sizeof (str) - 1;
	asn1_read_value (value, "", str, &len); /* CHOICE */

	strcpy (name3, str);

	len = sizeof (str) - 1;
	asn1_read_value (value, name3, str, &len);
	str[len] = 0;
	strcat (answer, " C=");
	strcat (answer, str);

	asn1_delete_structure (&value);
	}
	else
	{
	len = sizeof (str2);
	result =
	asn1_read_value (cert_def,
	"PKIX1Implicit88.id-at-organizationName",
	str2, &len);
	if (!strcmp (str, str2))
	{
	asn1_create_element (cert_def,
	"PKIX1Implicit88.X520OrganizationName",
	&value);

	len = sizeof (str) - 1;
	asn1_read_value (cert, name3, str, &len);
	asn1_der_decoding (&value, str, len, errorDescription);
	len = sizeof (str) - 1;
	asn1_read_value (value, "", str, &len); /* CHOICE */
	strcpy (name3, str);
	len = sizeof (str) - 1;
	asn1_read_value (value, name3, str, &len);
	str[len] = 0;
	strcat (answer, " O=");
	strcat (answer, str);
	asn1_delete_structure (&value);
	}
	else
	{
	len = sizeof (str2);
	result =
	asn1_read_value (cert_def,
	"PKIX1Implicit88.id-at-organizationalUnitName",
	str2, &len);
	if (!strcmp (str, str2))
	{
	asn1_create_element (cert_def,
	"PKIX1Implicit88.X520OrganizationalUnitName",
	&value);
	len = sizeof (str) - 1;
	asn1_read_value (cert, name3, str, &len);
	asn1_der_decoding (&value, str, len,
	errorDescription);
	len = sizeof (str) - 1;
	asn1_read_value (value, "", str, &len); /* CHOICE */
	strcpy (name3, str);
	len = sizeof (str) - 1;
	asn1_read_value (value, name3, str, &len);
	str[len] = 0;
	strcat (answer, " OU=");
	strcat (answer, str);
	asn1_delete_structure (&value);
	}
	}
	}
	}
	k2++;
	}
	while (1);
	k++;
	}
	while (1);
	}


	/******************************************************/
	/* Function : create_certificate */
	/* Description: creates a certificate named */
	/* "certificate1". Values are the same */
	/* as in rfc2459 Appendix D.1 */
	/* Parameters: */
	/* unsigned char der: contains the der encoding /
	/* int der_len: number of bytes of der string /
	/******************************************************/
	static void
	create_CRL (asn1_node cert_def, unsigned char der, int der_len)
	{
	int result, k, len;
	unsigned char str[1024];
	const unsigned char *str2;
	asn1_node crl = NULL;
	asn1_node value = NULL;
	char errorDescription[ASN1_MAX_ERROR_DESCRIPTION_SIZE];
	int max_len;

	max_len = *der_len;

	result =
	asn1_create_element (cert_def, "PKIX1Implicit88.CertificateList", &crl);

	/* Use the next 3 lines to visit the empty certificate */
	/* printf("-----------------\n");
	asn1_visit_tree(crl,"");
	printf("-----------------\n"); */


	/* version: v2(1) */
	result = asn1_write_value (crl, "tbsCertList.version", "v2", 0);


	/* signature: dsa-with-sha */
	len = sizeof (str) - 1;
	result =
	asn1_read_value (cert_def, "PKIX1Implicit88.id-dsa-with-sha1", str, &len);
	result = asn1_write_value (crl, "tbsCertList.signature.algorithm", str, 1);
	result =
	asn1_write_value (crl, "tbsCertList.signature.parameters", NULL, 0);


	/* issuer: Country="US" Organization="gov" OrganizationUnit="nist" */
	result = asn1_write_value (crl, "tbsCertList.issuer", "rdnSequence", 1);

	result = asn1_write_value (crl, "tbsCertList.issuer.rdnSequence", "NEW", 1);
	result =
	asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST", "NEW", 1);
	/* C */
	len = sizeof (str) - 1;
	result =
	asn1_read_value (cert_def, "PKIX1Implicit88.id-at-countryName", str,
	&len);
	result =
	asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.type",
	str, 1);
	result =
	asn1_create_element (cert_def, "PKIX1Implicit88.X520countryName", &value);
	result = asn1_write_value (value, "", "US", 2);
	*der_len = max_len;
	result = asn1_der_coding (value, "", der, der_len, errorDescription);

	asn1_delete_structure (&value);
	result =
	asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.value",
	der, *der_len);


	result = asn1_write_value (crl, "tbsCertList.issuer.rdnSequence", "NEW", 4);
	result =
	asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST", "NEW", 4);
	/* O */
	len = sizeof (str) - 1;
	result =
	asn1_read_value (cert_def, "PKIX1Implicit88.id-at-organizationName", str,
	&len);
	result =
	asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.type",
	str, 8);
	result =
	asn1_create_element (cert_def, "PKIX1Implicit88.X520OrganizationName",
	&value);
	result = asn1_write_value (value, "", "printableString", 1);
	result = asn1_write_value (value, "printableString", "gov", 3);
	*der_len = max_len;
	result = asn1_der_coding (value, "", der, der_len, errorDescription);
	asn1_delete_structure (&value);
	result =
	asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.value",
	der, *der_len);


	result = asn1_write_value (crl, "tbsCertList.issuer.rdnSequence", "NEW", 1);
	result =
	asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST", "NEW", 1);
	/* OU */
	len = sizeof (str) - 1;
	result =
	asn1_read_value (cert_def, "PKIX1Implicit88.id-at-organizationalUnitName",
	str, &len);
	result =
	asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.type",
	str, 1);
	result =
	asn1_create_element (cert_def,
	"PKIX1Implicit88.X520OrganizationalUnitName",
	&value);
	result = asn1_write_value (value, "", "printableString", 1);
	result = asn1_write_value (value, "printableString", "nist", 4);
	*der_len = max_len;
	result = asn1_der_coding (value, "", der, der_len, errorDescription);
	asn1_delete_structure (&value);
	result =
	asn1_write_value (crl, "tbsCertList.issuer.rdnSequence.?LAST.?LAST.value",
	der, *der_len);


	/* validity */
	result = asn1_write_value (crl, "tbsCertList.thisUpdate", "utcTime", 1);
	result =
	asn1_write_value (crl, "tbsCertList.thisUpdate.utcTime", "970801000000Z",
	1);

	result = asn1_write_value (crl, "tbsCertList.nextUpdate", "utcTime", 1);
	result =
	asn1_write_value (crl, "tbsCertList.nextUpdate.utcTime", "970808000000Z",
	1);


	/* revokedCertificates */
	result =
	asn1_write_value (crl, "tbsCertList.revokedCertificates", "NEW", 1);
	str[0] = 18;
	result =
	asn1_write_value (crl,
	"tbsCertList.revokedCertificates.?LAST.userCertificate",
	str, 1);
	result =
	asn1_write_value (crl,
	"tbsCertList.revokedCertificates.?LAST.revocationDate",
	"utcTime", 1);
	result =
	asn1_write_value (crl,
	"tbsCertList.revokedCertificates.?LAST.revocationDate.utcTime",
	"970731000000Z", 1);

	result =
	asn1_write_value (crl,
	"tbsCertList.revokedCertificates.?LAST.crlEntryExtensions",
	"NEW", 1);
	len = sizeof (str) - 1;
	result = asn1_read_value (cert_def, "PKIX1Implicit88.id-ce-cRLReasons",
	str, &len);
	result = asn1_write_value (crl, "tbsCertList.revokedCertificates.?LAST.crlEntryExtensions.?LAST.extnID", str, 1); /* reasonCode */
	result =
	asn1_write_value (crl,
	"tbsCertList.revokedCertificates.?LAST.crlEntryExtensions.?LAST.critical",
	"FALSE", 1);
	str2 = (const unsigned char *) "\x0a\x01\x01";
	result =
	asn1_write_value (crl,
	"tbsCertList.revokedCertificates.?LAST.crlEntryExtensions.?LAST.extnValue",
	str2, 3);


	/* crlExtensions */
	result = asn1_write_value (crl, "tbsCertList.crlExtensions", NULL, 0);


	/* signatureAlgorithm: dsa-with-sha */
	len = sizeof (str) - 1;
	result =
	asn1_read_value (cert_def, "PKIX1Implicit88.id-dsa-with-sha1", str, &len);
	result = asn1_write_value (crl, "signatureAlgorithm.algorithm", str, 1);
	result = asn1_write_value (crl, "signatureAlgorithm.parameters", NULL, 0); /* NO OPTION */

	/* signature */
	*der_len = max_len;
	result =
	asn1_der_coding (crl, "tbsCertList", der, der_len, errorDescription);
	if (result != ASN1_SUCCESS)
	{
	printf ("\n'tbsCertList' encoding creation: ERROR\n");
	return;
	}

	/* add the lines for the signature on der[0]..der[der_len-1]: result in str2 */
	result = asn1_write_value (crl, "signature", str2, 46 * 8);


	/* Use the next 3 lines to visit the certificate */
	/* printf("-----------------\n");
	asn1_visit_tree(crl,"");
	printf("-----------------\n"); */

	*der_len = max_len;
	result = asn1_der_coding (crl, "", der, der_len, errorDescription);
	if (result != ASN1_SUCCESS)
	{
	printf ("\n'crl1' encoding creation: ERROR\n");
	return;
	}

	/* Print the 'Certificate1' DER encoding */
	printf ("-----------------\nCrl1 Encoding:\nNumber of bytes=%i\n",
	*der_len);
	for (k = 0; k < *der_len; k++)
	printf ("%02x ", der[k]);
	printf ("\n-----------------\n");

	/* Clear the "certificate1" structure */
	asn1_delete_structure (&crl);
	}



	/******************************************************/
	/* Function : get_certificate */
	/* Description: creates a certificate named */
	/* "certificate2" from a der encoding */
	/* string */
	/* Parameters: */
	/* unsigned char der: the encoding string /
	/* int der_len: number of bytes of der string */
	/******************************************************/
	static void
	get_CRL (asn1_node cert_def, unsigned char *der, int der_len)
	{
	int result, len, start, end;
	unsigned char str[1024], str2[1024];
	asn1_node crl2 = NULL;
	char errorDescription[ASN1_MAX_ERROR_DESCRIPTION_SIZE];


	asn1_create_element (cert_def, "PKIX1Implicit88.CertificateList", &crl2);

	result = asn1_der_decoding (&crl2, der, der_len, errorDescription);

	if (result != ASN1_SUCCESS)
	{
	printf ("Problems with DER encoding\n");
	return;
	}


	/* issuer */
	get_Name_type (cert_def, crl2, "tbsCertList.issuer", str);
	printf ("crl2:\nissuer: %s\n", str);


	/* Verify sign */
	len = sizeof (str) - 1;
	result = asn1_read_value (crl2, "signatureAlgorithm.algorithm", str, &len);

	result =
	asn1_read_value (cert_def, "PKIX1Implicit88.id-dsa-with-sha1", str2,
	&len);
	if (!strcmp ((char ) str, (char ) str2))
	{ /* dsa-with-sha */

	result = asn1_der_decoding_startEnd (crl2, der, der_len,
	"tbsCertList", &start, &end);

	/* add the lines to calculate the sha on der[start]..der[end] */

	result = asn1_read_value (crl2, "signature", str, &len);

	/* compare the previous value to signature ( with issuer public key) */
	}

	/* Use the next 3 lines to visit the certificate */
	/* printf("-----------------\n");
	asn1_visit_tree(crl2,"");
	printf("-----------------\n"); */


	/* Clear the "crl2" structure */
	asn1_delete_structure (&crl2);
	}

	extern const asn1_static_node pkix_asn1_tab[];

	/********************************************************/
	/* Function : main */
	/* Description: reads the certificate description. */
	/* Creates a certificate and calculate */
	/* the der encoding. After that creates */
	/* another certificate from der string */
	/********************************************************/
	int
	main (int argc, char *argv[])
	{
	int result, der_len;
	unsigned char der[1024];
	asn1_node PKIX1Implicit88 = NULL;
	char errorDescription[ASN1_MAX_ERROR_DESCRIPTION_SIZE];

	if (1)
	result =
	asn1_array2tree (pkix_asn1_tab, &PKIX1Implicit88, errorDescription);
	else
	result =
	asn1_parser2tree ("pkix.asn", &PKIX1Implicit88, errorDescription);

	if (result != ASN1_SUCCESS)
	{
	asn1_perror (result);
	printf ("%s\n", errorDescription);
	exit (1);
	}

	/* Use the following 3 lines to visit the PKIX1Implicit structures */
	/* printf("-----------------\n");
	asn1_visit_tree(cert_def,"PKIX1Implicit88");
	printf("-----------------\n"); */

	der_len = 1024;
	create_CRL (PKIX1Implicit88, der, &der_len);


	get_CRL (PKIX1Implicit88, der, der_len);

	/* Clear the "PKIX1Implicit88" structures */
	asn1_delete_structure (&PKIX1Implicit88);

	return 0;
	}