Move /asn1 to /epan/dissectors

Change-Id: I1208fe3c2ba428995526f561e8f792b8d871e9a9
Reviewed-on: https://code.wireshark.org/review/14388
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: João Valverde <j@v6e.pt>

9 files changed, 1330 insertions, 0 deletions

diff --git a/epan/dissectors/asn1/x509ce/CMakeLists.txt b/epan/dissectors/asn1/x509ce/CMakeLists.txt
new file mode 100644
index 0000000000..dc04f53c2c
--- /dev/null
+++ b/epan/dissectors/asn1/x509ce/CMakeLists.txt
@@ -0,0 +1,64 @@
+# CMakeLists.txt
+#
+# Wireshark - Network traffic analyzer
+# By Gerald Combs <gerald@wireshark.org>
+# Copyright 1998 Gerald Combs
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+
+set( PROTOCOL_NAME x509ce )
+
+set( PROTO_OPT )
+
+set( EXPORT_FILES
+	${PROTOCOL_NAME}-exp.cnf
+)
+
+set( EXT_ASN_FILE_LIST
+)
+
+set( ASN_FILE_LIST
+	CertificateExtensions.asn
+	CertificateExtensionsCiplus.asn
+)
+
+set( EXTRA_DIST
+	${ASN_FILE_LIST}
+	packet-${PROTOCOL_NAME}-template.c
+	packet-${PROTOCOL_NAME}-template.h
+	${PROTOCOL_NAME}.cnf
+)
+
+set( SRC_FILES
+	${EXTRA_DIST}
+	${EXT_ASN_FILE_LIST}
+)
+
+set( A2W_FLAGS -b )
+
+set( EXTRA_CNF
+	"${CMAKE_CURRENT_BINARY_DIR}/../p1/p1-exp.cnf"
+	"${CMAKE_CURRENT_BINARY_DIR}/../x509af/x509af-exp.cnf"
+	"${CMAKE_CURRENT_BINARY_DIR}/../x509if/x509if-exp.cnf"
+	"${CMAKE_CURRENT_BINARY_DIR}/../x509sat/x509sat-exp.cnf"
+)
+
+set( EXPORT_DEPENDS
+	"${CMAKE_CURRENT_BINARY_DIR}/../x509af/x509af-exp.cnf"
+)
+
+ASN2WRS()
+
diff --git a/epan/dissectors/asn1/x509ce/CertificateExtensions.asn b/epan/dissectors/asn1/x509ce/CertificateExtensions.asn
new file mode 100644
index 0000000000..78fd06f7b4
--- /dev/null
+++ b/epan/dissectors/asn1/x509ce/CertificateExtensions.asn
@@ -0,0 +1,744 @@
+-- Module CertificateExtensions (X.509:08/2005)
+CertificateExtensions {joint-iso-itu-t ds(5) module(1)
+  certificateExtensions(26) 5} DEFINITIONS IMPLICIT TAGS ::=
+BEGIN
+
+-- EXPORTS ALL 
+IMPORTS
+  id-at, id-ce, id-mr, informationFramework, authenticationFramework,
+    selectedAttributeTypes, upperBounds
+    FROM UsefulDefinitions {joint-iso-itu-t ds(5) module(1)
+      usefulDefinitions(0) 5}
+  Name, RelativeDistinguishedName, ATTRIBUTE, Attribute, MATCHING-RULE
+    FROM InformationFramework informationFramework
+  CertificateSerialNumber, CertificateList, AlgorithmIdentifier, EXTENSION,
+    Time, PolicyID
+    FROM AuthenticationFramework authenticationFramework
+  DirectoryString{}
+    FROM SelectedAttributeTypes selectedAttributeTypes
+  ub-name
+    FROM UpperBounds upperBounds
+  ORAddress
+    FROM MTSAbstractService {joint-iso-itu-t mhs(6) mts(3) modules(0)
+      mts-abstract-service(1) version-1999(1)};
+
+-- Unless explicitly noted otherwise, there is no significance to the ordering
+-- of components of a SEQUENCE OF construct in this Specification.
+-- public-key certificate and CRL extensions 
+authorityKeyIdentifier EXTENSION ::= {
+  SYNTAX         AuthorityKeyIdentifier
+  IDENTIFIED BY  id-ce-authorityKeyIdentifier
+}
+
+AuthorityKeyIdentifier ::= SEQUENCE {
+  keyIdentifier              [0]  KeyIdentifier OPTIONAL,
+  authorityCertIssuer        [1]  GeneralNames OPTIONAL,
+  authorityCertSerialNumber  [2]  CertificateSerialNumber OPTIONAL
+}
+(WITH COMPONENTS {
+   ...,
+   authorityCertIssuer        PRESENT,
+   authorityCertSerialNumber  PRESENT
+ } |
+ WITH COMPONENTS {
+   ...,
+   authorityCertIssuer        ABSENT,
+   authorityCertSerialNumber  ABSENT
+ })
+
+KeyIdentifier ::= OCTET STRING
+
+subjectKeyIdentifier EXTENSION ::= {
+  SYNTAX         SubjectKeyIdentifier
+  IDENTIFIED BY  id-ce-subjectKeyIdentifier
+}
+
+SubjectKeyIdentifier ::= KeyIdentifier
+
+keyUsage EXTENSION ::= {SYNTAX         KeyUsage
+                        IDENTIFIED BY  id-ce-keyUsage
+}
+
+KeyUsage ::= BIT STRING {
+  digitalSignature(0), contentCommitment(1), keyEncipherment(2),
+  dataEncipherment(3), keyAgreement(4), keyCertSign(5), cRLSign(6),
+  encipherOnly(7), decipherOnly(8)}
+
+extKeyUsage EXTENSION ::= {
+  SYNTAX         SEQUENCE SIZE (1..MAX) OF KeyPurposeId
+  IDENTIFIED BY  id-ce-extKeyUsage
+}
+
+KeyPurposeId ::= OBJECT IDENTIFIER
+
+KeyPurposeIDs ::= SEQUENCE OF KeyPurposeId
+
+privateKeyUsagePeriod EXTENSION ::= {
+  SYNTAX         PrivateKeyUsagePeriod
+  IDENTIFIED BY  id-ce-privateKeyUsagePeriod
+}
+
+PrivateKeyUsagePeriod ::= SEQUENCE {
+  notBefore  [0]  GeneralizedTime OPTIONAL,
+  notAfter   [1]  GeneralizedTime OPTIONAL
+}
+(WITH COMPONENTS {
+   ...,
+   notBefore  PRESENT
+ } | WITH COMPONENTS {
+       ...,
+       notAfter  PRESENT
+     })
+
+certificatePolicies EXTENSION ::= {
+  SYNTAX         CertificatePoliciesSyntax
+  IDENTIFIED BY  id-ce-certificatePolicies
+}
+
+CertificatePoliciesSyntax ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
+
+PolicyInformation ::= SEQUENCE {
+  policyIdentifier  CertPolicyId,
+  policyQualifiers  SEQUENCE SIZE (1..MAX) OF PolicyQualifierInfo OPTIONAL
+}
+
+CertPolicyId ::= OBJECT IDENTIFIER
+
+PolicyQualifierInfo ::= SEQUENCE {
+  policyQualifierId  CERT-POLICY-QUALIFIER.&id({SupportedPolicyQualifiers}),
+  qualifier
+    CERT-POLICY-QUALIFIER.&Qualifier
+      ({SupportedPolicyQualifiers}{@policyQualifierId}) OPTIONAL
+}
+
+SupportedPolicyQualifiers CERT-POLICY-QUALIFIER ::=
+  {...}
+
+anyPolicy OBJECT IDENTIFIER ::= {2 5 29 32 0}
+
+CERT-POLICY-QUALIFIER ::= CLASS {
+  &id         OBJECT IDENTIFIER UNIQUE,
+  &Qualifier  OPTIONAL
+}WITH SYNTAX {POLICY-QUALIFIER-ID &id
+              [QUALIFIER-TYPE &Qualifier]
+}
+
+policyMappings EXTENSION ::= {
+  SYNTAX         PolicyMappingsSyntax
+  IDENTIFIED BY  id-ce-policyMappings
+}
+
+PolicyMappingsSyntax ::=
+  SEQUENCE SIZE (1..MAX) OF
+    SEQUENCE {issuerDomainPolicy   CertPolicyId,
+              subjectDomainPolicy  CertPolicyId}
+
+subjectAltName EXTENSION ::= {
+  SYNTAX         GeneralNames
+  IDENTIFIED BY  id-ce-subjectAltName
+}
+
+GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
+
+GeneralName ::= CHOICE {
+  otherName                  [0]  -- INSTANCE OF OTHER-NAME-- OtherName,
+  rfc822Name                 [1]  IA5String,
+  dNSName                    [2]  IA5String,
+  x400Address                [3]  ORAddress,
+  directoryName              [4]  Name,
+  ediPartyName               [5]  EDIPartyName,
+  uniformResourceIdentifier  [6]  IA5String,
+  iPAddress                  [7]  OCTET STRING,
+  registeredID               [8]  OBJECT IDENTIFIER
+}
+
+-- OTHER-NAME ::= TYPE-IDENTIFIER
+
+OtherName ::= SEQUENCE {
+  type-id	OtherNameType,
+  value		[0] EXPLICIT OtherNameValue
+}
+
+OtherNameType ::= OBJECT IDENTIFIER
+OtherNameValue ::= ANY
+
+EDIPartyName ::= SEQUENCE {
+  nameAssigner  [0]  DirectoryString{ub-name} OPTIONAL,
+  partyName     [1]  DirectoryString{ub-name}
+}
+
+issuerAltName EXTENSION ::= {
+  SYNTAX         GeneralNames
+  IDENTIFIED BY  id-ce-issuerAltName
+}
+
+subjectDirectoryAttributes EXTENSION ::= {
+  SYNTAX         AttributesSyntax
+  IDENTIFIED BY  id-ce-subjectDirectoryAttributes
+}
+
+AttributesSyntax ::= SEQUENCE SIZE (1..MAX) OF Attribute
+
+basicConstraints EXTENSION ::= {
+  SYNTAX         BasicConstraintsSyntax
+  IDENTIFIED BY  id-ce-basicConstraints
+}
+
+BasicConstraintsSyntax ::= SEQUENCE {
+  cA                 BOOLEAN DEFAULT FALSE,
+  pathLenConstraint  INTEGER(0..MAX) OPTIONAL
+}
+
+nameConstraints EXTENSION ::= {
+  SYNTAX         NameConstraintsSyntax
+  IDENTIFIED BY  id-ce-nameConstraints
+}
+
+NameConstraintsSyntax ::= SEQUENCE {
+  permittedSubtrees  [0]  GeneralSubtrees OPTIONAL,
+  excludedSubtrees   [1]  GeneralSubtrees OPTIONAL
+}(-- ALL EXCEPT -- ({ --none; at least one component shall be present--}))
+
+GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
+
+GeneralSubtree ::= SEQUENCE {
+  base     GeneralName,
+  minimum  [0]  BaseDistance DEFAULT 0,
+  maximum  [1]  BaseDistance OPTIONAL
+}
+
+BaseDistance ::= INTEGER(0..MAX)
+
+policyConstraints EXTENSION ::= {
+  SYNTAX         PolicyConstraintsSyntax
+  IDENTIFIED BY  id-ce-policyConstraints
+}
+
+PolicyConstraintsSyntax ::= SEQUENCE {
+  requireExplicitPolicy  [0]  SkipCerts OPTIONAL,
+  inhibitPolicyMapping   [1]  SkipCerts OPTIONAL
+}
+
+SkipCerts ::= INTEGER(0..MAX)
+
+cRLNumber EXTENSION ::= {
+  SYNTAX         CRLNumber
+  IDENTIFIED BY  id-ce-cRLNumber
+}
+
+CRLNumber ::= INTEGER(0..MAX)
+
+reasonCode EXTENSION ::= {
+  SYNTAX         CRLReason
+  IDENTIFIED BY  id-ce-reasonCode
+}
+
+CRLReason ::= ENUMERATED {
+  unspecified(0), keyCompromise(1), cACompromise(2), affiliationChanged(3),
+  superseded(4), cessationOfOperation(5), certificateHold(6), removeFromCRL(8),
+  privilegeWithdrawn(9), aaCompromise(10)}
+
+holdInstructionCode EXTENSION ::= {
+  SYNTAX         HoldInstruction
+  IDENTIFIED BY  id-ce-instructionCode
+}
+
+HoldInstruction ::= OBJECT IDENTIFIER
+
+invalidityDate EXTENSION ::= {
+  SYNTAX         GeneralizedTime
+  IDENTIFIED BY  id-ce-invalidityDate
+}
+
+crlScope EXTENSION ::= {
+  SYNTAX         CRLScopeSyntax
+  IDENTIFIED BY  id-ce-cRLScope
+}
+
+CRLScopeSyntax ::= SEQUENCE SIZE (1..MAX) OF PerAuthorityScope
+
+PerAuthorityScope ::= SEQUENCE {
+  authorityName       [0]  GeneralName OPTIONAL,
+  distributionPoint   [1]  DistributionPointName OPTIONAL,
+  onlyContains        [2]  OnlyCertificateTypes OPTIONAL,
+  onlySomeReasons     [4]  ReasonFlags OPTIONAL,
+  serialNumberRange   [5]  NumberRange OPTIONAL,
+  subjectKeyIdRange   [6]  NumberRange OPTIONAL,
+  nameSubtrees        [7]  GeneralNames OPTIONAL,
+  baseRevocationInfo  [9]  BaseRevocationInfo OPTIONAL
+}
+
+OnlyCertificateTypes ::= BIT STRING {user(0), authority(1), attribute(2)}
+
+NumberRange ::= SEQUENCE {
+  startingNumber  [0]  INTEGER OPTIONAL,
+  endingNumber    [1]  INTEGER OPTIONAL,
+  modulus         INTEGER OPTIONAL
+}
+
+BaseRevocationInfo ::= SEQUENCE {
+  cRLStreamIdentifier  [0]  CRLStreamIdentifier OPTIONAL,
+  cRLNumber            [1]  CRLNumber,
+  baseThisUpdate       [2]  GeneralizedTime
+}
+
+statusReferrals EXTENSION ::= {
+  SYNTAX         StatusReferrals
+  IDENTIFIED BY  id-ce-statusReferrals
+}
+
+StatusReferrals ::= SEQUENCE SIZE (1..MAX) OF StatusReferral
+
+StatusReferral ::= CHOICE {
+  cRLReferral    [0]  CRLReferral
+--  otherReferral  [1]  INSTANCE OF OTHER-REFERRAL
+}
+
+CRLReferral ::= SEQUENCE {
+  issuer          [0]  GeneralName OPTIONAL,
+  location        [1]  GeneralName OPTIONAL,
+  deltaRefInfo    [2]  DeltaRefInfo OPTIONAL,
+  cRLScope        CRLScopeSyntax,
+  lastUpdate      [3]  GeneralizedTime OPTIONAL,
+  lastChangedCRL  [4]  GeneralizedTime OPTIONAL
+}
+
+DeltaRefInfo ::= SEQUENCE {
+  deltaLocation  GeneralName,
+  lastDelta      GeneralizedTime OPTIONAL
+}
+
+--OTHER-REFERRAL ::= TYPE-IDENTIFIER
+--
+cRLStreamIdentifier EXTENSION ::= {
+  SYNTAX         CRLStreamIdentifier
+  IDENTIFIED BY  id-ce-cRLStreamIdentifier
+}
+
+CRLStreamIdentifier ::= INTEGER(0..MAX)
+
+orderedList EXTENSION ::= {
+  SYNTAX         OrderedListSyntax
+  IDENTIFIED BY  id-ce-orderedList
+}
+
+OrderedListSyntax ::= ENUMERATED {ascSerialNum(0), ascRevDate(1)}
+
+deltaInfo EXTENSION ::= {
+  SYNTAX         DeltaInformation
+  IDENTIFIED BY  id-ce-deltaInfo
+}
+
+DeltaInformation ::= SEQUENCE {
+  deltaLocation  GeneralName,
+  nextDelta      GeneralizedTime OPTIONAL
+}
+
+cRLDistributionPoints EXTENSION ::= {
+  SYNTAX         CRLDistPointsSyntax
+  IDENTIFIED BY  id-ce-cRLDistributionPoints
+}
+
+CRLDistPointsSyntax ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint
+
+DistributionPoint ::= SEQUENCE {
+  distributionPoint  [0]  DistributionPointName OPTIONAL,
+  reasons            [1]  ReasonFlags OPTIONAL,
+  cRLIssuer          [2]  GeneralNames OPTIONAL
+}
+
+DistributionPointName ::= CHOICE {
+  fullName                 [0]  GeneralNames,
+  nameRelativeToCRLIssuer  [1]  RelativeDistinguishedName
+}
+
+ReasonFlags ::= BIT STRING {
+  unused(0), keyCompromise(1), cACompromise(2), affiliationChanged(3),
+  superseded(4), cessationOfOperation(5), certificateHold(6),
+  privilegeWithdrawn(7), aACompromise(8)}
+
+issuingDistributionPoint EXTENSION ::= {
+  SYNTAX         IssuingDistPointSyntax
+  IDENTIFIED BY  id-ce-issuingDistributionPoint
+}
+
+IssuingDistPointSyntax ::= SEQUENCE {
+  -- If onlyContainsUserPublicKeyCerts and onlyContainsCACerts are both FALSE,
+  -- the CRL covers both certificate types
+  distributionPoint               [0]  DistributionPointName OPTIONAL,
+  onlyContainsUserPublicKeyCerts  [1]  BOOLEAN DEFAULT FALSE,
+  onlyContainsCACerts             [2]  BOOLEAN DEFAULT FALSE,
+  onlySomeReasons                 [3]  ReasonFlags OPTIONAL,
+  indirectCRL                     [4]  BOOLEAN DEFAULT FALSE
+}
+
+certificateIssuer EXTENSION ::= {
+  SYNTAX         GeneralNames
+  IDENTIFIED BY  id-ce-certificateIssuer
+}
+
+deltaCRLIndicator EXTENSION ::= {
+  SYNTAX         BaseCRLNumber
+  IDENTIFIED BY  id-ce-deltaCRLIndicator
+}
+
+BaseCRLNumber ::= CRLNumber
+
+toBeRevoked EXTENSION ::= {
+  SYNTAX         ToBeRevokedSyntax
+  IDENTIFIED BY  id-ce-toBeRevoked
+}
+
+ToBeRevokedSyntax ::= SEQUENCE SIZE (1..MAX) OF ToBeRevokedGroup
+
+ToBeRevokedGroup ::= SEQUENCE {
+  certificateIssuer  [0]  GeneralName OPTIONAL,
+  reasonInfo         [1]  ReasonInfo OPTIONAL,
+  revocationTime     GeneralizedTime,
+  certificateGroup   CertificateGroup
+}
+
+ReasonInfo ::= SEQUENCE {
+  reasonCode           CRLReason,
+  holdInstructionCode  HoldInstruction OPTIONAL
+}
+
+CertificateGroup ::= CHOICE {
+  serialNumbers      [0]  CertificateSerialNumbers,
+  serialNumberRange  [1]  CertificateGroupNumberRange,
+  nameSubtree        [2]  GeneralName
+}
+
+CertificateGroupNumberRange ::= SEQUENCE {
+  startingNumber  [0]  INTEGER,
+  endingNumber    [1]  INTEGER
+}
+
+CertificateSerialNumbers ::= SEQUENCE SIZE (1..MAX) OF CertificateSerialNumber
+
+revokedGroups EXTENSION ::= {
+  SYNTAX         RevokedGroupsSyntax
+  IDENTIFIED BY  id-ce-RevokedGroups
+}
+
+RevokedGroupsSyntax ::= SEQUENCE SIZE (1..MAX) OF RevokedGroup
+
+RevokedGroup ::= SEQUENCE {
+  certificateIssuer        [0]  GeneralName OPTIONAL,
+  reasonInfo               [1]  ReasonInfo OPTIONAL,
+  invalidityDate           [2]  GeneralizedTime OPTIONAL,
+  revokedcertificateGroup  [3]  RevokedCertificateGroup
+}
+
+RevokedCertificateGroup ::= CHOICE {
+  serialNumberRange  NumberRange,
+  nameSubtree        GeneralName
+}
+
+expiredCertsOnCRL EXTENSION ::= {
+  SYNTAX         ExpiredCertsOnCRL
+  IDENTIFIED BY  id-ce-expiredCertsOnCRL
+}
+
+ExpiredCertsOnCRL ::= GeneralizedTime
+
+baseUpdateTime EXTENSION ::= {
+  SYNTAX         GeneralizedTime
+  IDENTIFIED BY  id-ce-baseUpdateTime
+}
+
+freshestCRL EXTENSION ::= {
+  SYNTAX         CRLDistPointsSyntax
+  IDENTIFIED BY  id-ce-freshestCRL
+}
+
+aAissuingDistributionPoint EXTENSION ::= {
+  SYNTAX         AAIssuingDistPointSyntax
+  IDENTIFIED BY  id-ce-aAissuingDistributionPoint
+}
+
+AAIssuingDistPointSyntax ::= SEQUENCE {
+  distributionPoint           [0]  DistributionPointName OPTIONAL,
+  onlySomeReasons             [1]  ReasonFlags OPTIONAL,
+  indirectCRL                 [2]  BOOLEAN DEFAULT FALSE,
+  containsUserAttributeCerts  [3]  BOOLEAN DEFAULT TRUE,
+  containsAACerts             [4]  BOOLEAN DEFAULT TRUE,
+  containsSOAPublicKeyCerts   [5]  BOOLEAN DEFAULT TRUE
+}
+
+inhibitAnyPolicy EXTENSION ::= {
+  SYNTAX         SkipCerts
+  IDENTIFIED BY  id-ce-inhibitAnyPolicy
+}
+
+-- PKI matching rules 
+certificateExactMatch MATCHING-RULE ::= {
+  SYNTAX  CertificateExactAssertion
+  ID      id-mr-certificateExactMatch
+}
+
+CertificateExactAssertion ::= SEQUENCE {
+  serialNumber  CertificateSerialNumber,
+  issuer        Name
+}
+
+certificateMatch MATCHING-RULE ::= {
+  SYNTAX  CertificateAssertion
+  ID      id-mr-certificateMatch
+}
+
+CertificateAssertion ::= SEQUENCE {
+  serialNumber            [0]  CertificateSerialNumber OPTIONAL,
+  issuer                  [1]  Name OPTIONAL,
+  subjectKeyIdentifier    [2]  SubjectKeyIdentifier OPTIONAL,
+  authorityKeyIdentifier  [3]  AuthorityKeyIdentifier OPTIONAL,
+  certificateValid        [4]  Time OPTIONAL,
+  privateKeyValid         [5]  GeneralizedTime OPTIONAL,
+  subjectPublicKeyAlgID   [6]  OBJECT IDENTIFIER OPTIONAL,
+  keyUsage                [7]  KeyUsage OPTIONAL,
+  subjectAltName          [8]  AltNameType OPTIONAL,
+  policy                  [9]  CertPolicySet OPTIONAL,
+  pathToName              [10]  Name OPTIONAL,
+  subject                 [11]  Name OPTIONAL,
+  nameConstraints         [12]  NameConstraintsSyntax OPTIONAL
+}
+
+AltNameType ::= CHOICE {
+  builtinNameForm
+    ENUMERATED {rfc822Name(1), dNSName(2), x400Address(3), directoryName(4),
+                ediPartyName(5), uniformResourceIdentifier(6), iPAddress(7),
+                registeredId(8)},
+  otherNameForm    OBJECT IDENTIFIER
+}
+
+CertPolicySet ::= SEQUENCE SIZE (1..MAX) OF CertPolicyId
+
+certificatePairExactMatch MATCHING-RULE ::= {
+  SYNTAX  CertificatePairExactAssertion
+  ID      id-mr-certificatePairExactMatch
+}
+
+CertificatePairExactAssertion ::= SEQUENCE {
+  issuedToThisCAAssertion  [0]  CertificateExactAssertion OPTIONAL,
+  issuedByThisCAAssertion  [1]  CertificateExactAssertion OPTIONAL
+}
+(WITH COMPONENTS {
+   ...,
+   issuedToThisCAAssertion  PRESENT
+ } | WITH COMPONENTS {
+       ...,
+       issuedByThisCAAssertion  PRESENT
+     })
+
+certificatePairMatch MATCHING-RULE ::= {
+  SYNTAX  CertificatePairAssertion
+  ID      id-mr-certificatePairMatch
+}
+
+CertificatePairAssertion ::= SEQUENCE {
+  issuedToThisCAAssertion  [0]  CertificateAssertion OPTIONAL,
+  issuedByThisCAAssertion  [1]  CertificateAssertion OPTIONAL
+}
+(WITH COMPONENTS {
+   ...,
+   issuedToThisCAAssertion  PRESENT
+ } | WITH COMPONENTS {
+       ...,
+       issuedByThisCAAssertion  PRESENT
+     })
+
+certificateListExactMatch MATCHING-RULE ::= {
+  SYNTAX  CertificateListExactAssertion
+  ID      id-mr-certificateListExactMatch
+}
+
+CertificateListExactAssertion ::= SEQUENCE {
+  issuer             Name,
+  thisUpdate         Time,
+  distributionPoint  DistributionPointName OPTIONAL
+}
+
+certificateListMatch MATCHING-RULE ::= {
+  SYNTAX  CertificateListAssertion
+  ID      id-mr-certificateListMatch
+}
+
+CertificateListAssertion ::= SEQUENCE {
+  issuer                  Name OPTIONAL,
+  minCRLNumber            [0]  CRLNumber OPTIONAL,
+  maxCRLNumber            [1]  CRLNumber OPTIONAL,
+  reasonFlags             ReasonFlags OPTIONAL,
+  dateAndTime             Time OPTIONAL,
+  distributionPoint       [2]  DistributionPointName OPTIONAL,
+  authorityKeyIdentifier  [3]  AuthorityKeyIdentifier OPTIONAL
+}
+
+algorithmIdentifierMatch MATCHING-RULE ::= {
+  SYNTAX  AlgorithmIdentifier
+  ID      id-mr-algorithmIdentifierMatch
+}
+
+policyMatch MATCHING-RULE ::= {SYNTAX  PolicyID
+                               ID      id-mr-policyMatch
+}
+
+pkiPathMatch MATCHING-RULE ::= {
+  SYNTAX  PkiPathMatchSyntax
+  ID      id-mr-pkiPathMatch
+}
+
+PkiPathMatchSyntax ::= SEQUENCE {firstIssuer  Name,
+                                 lastSubject  Name
+}
+
+enhancedCertificateMatch MATCHING-RULE ::= {
+  SYNTAX  EnhancedCertificateAssertion
+  ID      id-mr-enhancedCertificateMatch
+}
+
+EnhancedCertificateAssertion ::= SEQUENCE {
+  serialNumber            [0]  CertificateSerialNumber OPTIONAL,
+  issuer                  [1]  Name OPTIONAL,
+  subjectKeyIdentifier    [2]  SubjectKeyIdentifier OPTIONAL,
+  authorityKeyIdentifier  [3]  AuthorityKeyIdentifier OPTIONAL,
+  certificateValid        [4]  Time OPTIONAL,
+  privateKeyValid         [5]  GeneralizedTime OPTIONAL,
+  subjectPublicKeyAlgID   [6]  OBJECT IDENTIFIER OPTIONAL,
+  keyUsage                [7]  KeyUsage OPTIONAL,
+  subjectAltName          [8]  AltName OPTIONAL,
+  policy                  [9]  CertPolicySet OPTIONAL,
+  pathToName              [10]  GeneralNames OPTIONAL,
+  subject                 [11]  Name OPTIONAL,
+  nameConstraints         [12]  NameConstraintsSyntax OPTIONAL
+}(--ALL EXCEPT-- ({ -- none; at least one component shall be present --}))
+
+AltName ::= SEQUENCE {
+  altnameType   AltNameType,
+  altNameValue  GeneralName OPTIONAL
+}
+
+-- Object identifier assignments 
+id-ce-subjectDirectoryAttributes OBJECT IDENTIFIER ::=
+  {id-ce 9}
+
+id-ce-subjectKeyIdentifier OBJECT IDENTIFIER ::= {id-ce 14}
+
+id-ce-keyUsage OBJECT IDENTIFIER ::= {id-ce 15}
+
+id-ce-privateKeyUsagePeriod OBJECT IDENTIFIER ::= {id-ce 16}
+
+id-ce-subjectAltName OBJECT IDENTIFIER ::= {id-ce 17}
+
+id-ce-issuerAltName OBJECT IDENTIFIER ::= {id-ce 18}
+
+id-ce-basicConstraints OBJECT IDENTIFIER ::= {id-ce 19}
+
+id-ce-cRLNumber OBJECT IDENTIFIER ::= {id-ce 20}
+
+id-ce-reasonCode OBJECT IDENTIFIER ::= {id-ce 21}
+
+id-ce-instructionCode OBJECT IDENTIFIER ::= {id-ce 23}
+
+id-ce-invalidityDate OBJECT IDENTIFIER ::= {id-ce 24}
+
+id-ce-deltaCRLIndicator OBJECT IDENTIFIER ::= {id-ce 27}
+
+id-ce-issuingDistributionPoint OBJECT IDENTIFIER ::= {id-ce 28}
+
+id-ce-certificateIssuer OBJECT IDENTIFIER ::= {id-ce 29}
+
+id-ce-nameConstraints OBJECT IDENTIFIER ::= {id-ce 30}
+
+id-ce-cRLDistributionPoints OBJECT IDENTIFIER ::= {id-ce 31}
+
+id-ce-certificatePolicies OBJECT IDENTIFIER ::= {id-ce 32}
+
+id-ce-policyMappings OBJECT IDENTIFIER ::= {id-ce 33}
+
+-- deprecated							OBJECT IDENTIFIER	::=	{id-ce 34}
+id-ce-authorityKeyIdentifier OBJECT IDENTIFIER ::=
+  {id-ce 35}
+
+id-ce-policyConstraints OBJECT IDENTIFIER ::= {id-ce 36}
+
+id-ce-extKeyUsage OBJECT IDENTIFIER ::= {id-ce 37}
+
+id-ce-cRLStreamIdentifier OBJECT IDENTIFIER ::= {id-ce 40}
+
+id-ce-cRLScope OBJECT IDENTIFIER ::= {id-ce 44}
+
+id-ce-statusReferrals OBJECT IDENTIFIER ::= {id-ce 45}
+
+id-ce-freshestCRL OBJECT IDENTIFIER ::= {id-ce 46}
+
+id-ce-orderedList OBJECT IDENTIFIER ::= {id-ce 47}
+
+id-ce-baseUpdateTime OBJECT IDENTIFIER ::= {id-ce 51}
+
+id-ce-deltaInfo OBJECT IDENTIFIER ::= {id-ce 53}
+
+id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::= {id-ce 54}
+
+id-ce-toBeRevoked OBJECT IDENTIFIER ::= {id-ce 58}
+
+id-ce-RevokedGroups OBJECT IDENTIFIER ::= {id-ce 59}
+
+id-ce-expiredCertsOnCRL OBJECT IDENTIFIER ::= {id-ce 60}
+
+id-ce-aAissuingDistributionPoint OBJECT IDENTIFIER ::= {id-ce 63}
+
+-- matching rule OIDs 
+id-mr-certificateExactMatch OBJECT IDENTIFIER ::=
+  {id-mr 34}
+
+id-mr-certificateMatch OBJECT IDENTIFIER ::= {id-mr 35}
+
+id-mr-certificatePairExactMatch OBJECT IDENTIFIER ::= {id-mr 36}
+
+id-mr-certificatePairMatch OBJECT IDENTIFIER ::= {id-mr 37}
+
+id-mr-certificateListExactMatch OBJECT IDENTIFIER ::= {id-mr 38}
+
+id-mr-certificateListMatch OBJECT IDENTIFIER ::= {id-mr 39}
+
+id-mr-algorithmIdentifierMatch OBJECT IDENTIFIER ::= {id-mr 40}
+
+id-mr-policyMatch OBJECT IDENTIFIER ::= {id-mr 60}
+
+id-mr-pkiPathMatch OBJECT IDENTIFIER ::= {id-mr 62}
+
+id-mr-enhancedCertificateMatch OBJECT IDENTIFIER ::= {id-mr 65}
+
+-- The following OBJECT IDENTIFIERS are not used by this Specification:
+-- {id-ce 2}, {id-ce 3}, {id-ce 4}, {id-ce 5}, {id-ce 6}, {id-ce 7},
+-- {id-ce 8}, {id-ce 10}, {id-ce 11}, {id-ce 12}, {id-ce 13}, 
+-- {id-ce 22}, {id-ce 25}, {id-ce 26}
+
+-- Microsoft Certificate Extension
+
+CertificateTemplate ::= SEQUENCE {
+  templateID           OBJECT IDENTIFIER,
+  templateMajorVersion INTEGER,
+  templateMinorVersion INTEGER OPTIONAL
+}
+
+-- Entrust Certificate Extension
+
+EntrustVersionInfo ::= SEQUENCE {
+ entrustVers GeneralString,
+ entrustVersInfoFlags EntrustInfoFlags OPTIONAL
+}
+
+EntrustInfoFlags ::=  BIT STRING {
+  keyUpdateAllowed(0), 
+  newExtensions(1),
+  pKIXCertificate(2),
+  enterpriseCategory(3),
+  webCategory(4),
+  sETCategory(5)
+}
+
+END
+
+-- Generated by Asnp, the ASN.1 pretty-printer of France Telecom R&D
+
diff --git a/epan/dissectors/asn1/x509ce/CertificateExtensionsCiplus.asn b/epan/dissectors/asn1/x509ce/CertificateExtensionsCiplus.asn
new file mode 100644
index 0000000000..00c024b5d6
--- /dev/null
+++ b/epan/dissectors/asn1/x509ce/CertificateExtensionsCiplus.asn
@@ -0,0 +1,46 @@
+-- Module CertificateExtensionsCiplus
+--  X.509 certificate extensions defined by CI+ (www.ci-plus.com)
+CertificateExtensionsCiplus DEFINITIONS IMPLICIT TAGS ::=
+BEGIN
+
+-- EXPORTS ALL 
+IMPORTS
+  id-pkix
+  FROM PKIX1Explicit93 {iso(1) identified-organization(3) dod(6) internet(1)
+   security(5) mechanisms(5) pkix(7) id-mod(0) id-pkix1-explicit-93(3)}
+  EXTENSION
+  FROM AuthenticationFramework { joint-iso-itu-t ds(5)
+                      module(1) authenticationFramework(7) 3 };
+
+scramblerCapabilities EXTENSION ::= {
+   SYNTAX         ScramblerCapabilities
+   IDENTIFIED BY  id-pe-scramblerCapabilities
+}
+
+ScramblerCapabilities ::= SEQUENCE {
+   capability INTEGER (0..MAX),
+   version    INTEGER (0..MAX)
+}
+
+
+ciplusInfo EXTENSION ::= {
+   SYNTAX    CiplusInfo
+   IDENTIFIED BY  id-pe-ciplusInfo
+}
+
+CiplusInfo ::= BIT STRING
+
+
+cicamBrandId EXTENSION ::= {
+   SYNTAX    CicamBrandId
+   IDENTIFIED BY  id-pe-cicamBrandId
+}
+
+CicamBrandId ::= INTEGER(1..65535)
+
+-- Object identifier assignments 
+id-pe-scramblerCapabilities OBJECT IDENTIFIER ::= { id-pkix id-pe(1) 25 }
+id-pe-ciplusInfo OBJECT IDENTIFIER ::= { id-pkix id-pe(1) 26 }
+id-pe-cicamBrandId OBJECT IDENTIFIER ::= { id-pkix id-pe(1) 27 }
+
+END
diff --git a/epan/dissectors/asn1/x509ce/Makefile.am b/epan/dissectors/asn1/x509ce/Makefile.am
new file mode 100644
index 0000000000..72d28e600b
--- /dev/null
+++ b/epan/dissectors/asn1/x509ce/Makefile.am
@@ -0,0 +1,23 @@
+# Wireshark - Network traffic analyzer
+# By Gerald Combs <gerald@wireshark.org>
+# Copyright 1998 Gerald Combs
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+
+include ../Makefile.preinc
+include Makefile.common
+include ../Makefile.inc
+
diff --git a/epan/dissectors/asn1/x509ce/Makefile.common b/epan/dissectors/asn1/x509ce/Makefile.common
new file mode 100644
index 0000000000..df7c3581b5
--- /dev/null
+++ b/epan/dissectors/asn1/x509ce/Makefile.common
@@ -0,0 +1,65 @@
+# Wireshark - Network traffic analyzer
+# By Gerald Combs <gerald@wireshark.org>
+# Copyright 1998 Gerald Combs
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+
+PROTOCOL_NAME=x509ce
+
+EXPORT_FILES = $(PROTOCOL_NAME)-exp.cnf
+
+EXT_ASN_FILE_LIST =
+
+ASN_FILE_LIST = \
+	CertificateExtensions.asn \
+	CertificateExtensionsCiplus.asn
+
+# The packet-$(PROTOCOL_NAME)-template.h and $(PROTOCOL_NAME).asn
+# files do not exist for all protocols: Please add/remove as required.
+EXTRA_DIST = \
+	$(EXTRA_DIST_COMMON) \
+	$(ASN_FILE_LIST) \
+	packet-$(PROTOCOL_NAME)-template.c \
+	packet-$(PROTOCOL_NAME)-template.h \
+	$(PROTOCOL_NAME).cnf
+
+SRC_FILES = \
+	$(EXTRA_DIST) \
+	$(EXT_ASN_FILE_LIST)
+
+A2W_FLAGS = -b
+
+EXTRA_CNF = \
+	$(builddir)/../p1/p1-exp.cnf \
+	$(builddir)/../x509af/x509af-exp.cnf \
+	$(builddir)/../x509if/x509if-exp.cnf \
+	$(builddir)/../x509sat/x509sat-exp.cnf
+
+EXPORT_DEPENDS = \
+	$(builddir)/../x509af/x509af-exp.cnf
+
+$(builddir)/../p1/p1-exp.cnf:
+	(cd $(builddir)/../p1 && $(MAKE_CNF_EXPORT))
+
+$(builddir)/../x509af/x509af-exp.cnf:
+	(cd $(builddir)/../x509af && $(MAKE_CNF_EXPORT))
+
+$(builddir)/../x509if/x509if-exp.cnf:
+	(cd $(builddir)/../x509if && $(MAKE_CNF_EXPORT))
+
+$(builddir)/../x509sat/x509sat-exp.cnf:
+	(cd $(builddir)/../x509sat && $(MAKE_CNF_EXPORT))
+
diff --git a/epan/dissectors/asn1/x509ce/Makefile.nmake b/epan/dissectors/asn1/x509ce/Makefile.nmake
new file mode 100644
index 0000000000..d296638ddd
--- /dev/null
+++ b/epan/dissectors/asn1/x509ce/Makefile.nmake
@@ -0,0 +1,26 @@
+## Use: $(MAKE) /$(MAKEFLAGS) -f makefile.nmake
+#
+# Wireshark - Network traffic analyzer
+# By Gerald Combs <gerald@wireshark.org>
+# Copyright 1998 Gerald Combs
+#
+# This program is free software; you can redistribute it and/or
+# modify it under the terms of the GNU General Public License
+# as published by the Free Software Foundation; either version 2
+# of the License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+
+include ../../../../config.nmake
+include ../Makefile.preinc.nmake
+include Makefile.common
+include ../Makefile.inc.nmake
+
diff --git a/epan/dissectors/asn1/x509ce/packet-x509ce-template.c b/epan/dissectors/asn1/x509ce/packet-x509ce-template.c
new file mode 100644
index 0000000000..006d9de471
--- /dev/null
+++ b/epan/dissectors/asn1/x509ce/packet-x509ce-template.c
@@ -0,0 +1,142 @@
+/* packet-x509ce.c
+ * Routines for X.509 Certificate Extensions packet dissection
+ *  Ronnie Sahlberg 2004
+ *
+ * Wireshark - Network traffic analyzer
+ * By Gerald Combs <gerald@wireshark.org>
+ * Copyright 1998 Gerald Combs
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#include "config.h"
+
+#include <epan/packet.h>
+#include <epan/asn1.h>
+
+#include "packet-ber.h"
+#include "packet-x509ce.h"
+#include "packet-x509af.h"
+#include "packet-x509if.h"
+#include "packet-x509sat.h"
+#include "packet-p1.h"
+
+#define PNAME  "X.509 Certificate Extensions"
+#define PSNAME "X509CE"
+#define PFNAME "x509ce"
+
+void proto_register_x509ce(void);
+void proto_reg_handoff_x509ce(void);
+
+/* Initialize the protocol and registered fields */
+static int proto_x509ce = -1;
+static int hf_x509ce_id_ce_invalidityDate = -1;
+static int hf_x509ce_id_ce_baseUpdateTime = -1;
+static int hf_x509ce_object_identifier_id = -1;
+static int hf_x509ce_IPAddress = -1;
+#include "packet-x509ce-hf.c"
+
+/* Initialize the subtree pointers */
+#include "packet-x509ce-ett.c"
+#include "packet-x509ce-fn.c"
+
+/* CI+ (www.ci-plus.com) defines some X.509 certificate extensions
+    that use OIDs which are not officially assigned
+   dissection of these extensions can be enabled temporarily using the
+    functions below */
+void
+x509ce_enable_ciplus(void)
+{
+	dissector_handle_t dh25, dh26, dh27;
+
+	dh25 = create_dissector_handle(dissect_ScramblerCapabilities_PDU, proto_x509ce);
+	dissector_change_string("ber.oid", "1.3.6.1.5.5.7.1.25", dh25);
+	dh26 = create_dissector_handle(dissect_CiplusInfo_PDU, proto_x509ce);
+	dissector_change_string("ber.oid", "1.3.6.1.5.5.7.1.26", dh26);
+	dh27 = create_dissector_handle(dissect_CicamBrandId_PDU, proto_x509ce);
+	dissector_change_string("ber.oid", "1.3.6.1.5.5.7.1.27", dh27);
+}
+
+void
+x509ce_disable_ciplus(void)
+{
+	dissector_reset_string("ber.oid", "1.3.6.1.5.5.7.1.25");
+	dissector_reset_string("ber.oid", "1.3.6.1.5.5.7.1.26");
+	dissector_reset_string("ber.oid", "1.3.6.1.5.5.7.1.27");
+}
+
+
+static int
+dissect_x509ce_invalidityDate_callback(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
+{
+	asn1_ctx_t asn1_ctx;
+	asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, TRUE, pinfo);
+
+	return dissect_x509ce_GeneralizedTime(FALSE, tvb, 0, &asn1_ctx, tree, hf_x509ce_id_ce_invalidityDate);
+}
+
+static int
+dissect_x509ce_baseUpdateTime_callback(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, void* data _U_)
+{
+	asn1_ctx_t asn1_ctx;
+	asn1_ctx_init(&asn1_ctx, ASN1_ENC_BER, TRUE, pinfo);
+	return dissect_x509ce_GeneralizedTime(FALSE, tvb, 0, &asn1_ctx, tree, hf_x509ce_id_ce_baseUpdateTime);
+}
+
+/*--- proto_register_x509ce ----------------------------------------------*/
+void proto_register_x509ce(void) {
+
+  /* List of fields */
+  static hf_register_info hf[] = {
+    { &hf_x509ce_id_ce_baseUpdateTime,
+      { "baseUpdateTime", "x509ce.id_ce_baseUpdateTime",
+        FT_STRING, BASE_NONE, NULL, 0,
+        NULL, HFILL }},
+    { &hf_x509ce_id_ce_invalidityDate,
+      { "invalidityDate", "x509ce.id_ce_invalidityDate",
+        FT_STRING, BASE_NONE, NULL, 0,
+        NULL, HFILL }},
+    { &hf_x509ce_object_identifier_id,
+      { "Id", "x509ce.id", FT_OID, BASE_NONE, NULL, 0,
+	"Object identifier Id", HFILL }},
+    { &hf_x509ce_IPAddress,
+      { "iPAddress", "x509ce.IPAddress", FT_IPv4, BASE_NONE, NULL, 0,
+        "IP Address", HFILL }},
+
+#include "packet-x509ce-hfarr.c"
+  };
+
+  /* List of subtrees */
+  static gint *ett[] = {
+#include "packet-x509ce-ettarr.c"
+  };
+
+  /* Register protocol */
+  proto_x509ce = proto_register_protocol(PNAME, PSNAME, PFNAME);
+
+  /* Register fields and subtrees */
+  proto_register_field_array(proto_x509ce, hf, array_length(hf));
+  proto_register_subtree_array(ett, array_length(ett));
+
+}
+
+
+/*--- proto_reg_handoff_x509ce -------------------------------------------*/
+void proto_reg_handoff_x509ce(void) {
+#include "packet-x509ce-dis-tab.c"
+	register_ber_oid_dissector("2.5.29.24", dissect_x509ce_invalidityDate_callback, proto_x509ce, "id-ce-invalidityDate");
+	register_ber_oid_dissector("2.5.29.51", dissect_x509ce_baseUpdateTime_callback, proto_x509ce, "id-ce-baseUpdateTime");
+}
+
diff --git a/epan/dissectors/asn1/x509ce/packet-x509ce-template.h b/epan/dissectors/asn1/x509ce/packet-x509ce-template.h
new file mode 100644
index 0000000000..eebaf71265
--- /dev/null
+++ b/epan/dissectors/asn1/x509ce/packet-x509ce-template.h
@@ -0,0 +1,33 @@
+/* packet-x509ce.h
+ * Routines for X.509 Certificate Extensions packet dissection
+ *  Ronnie Sahlberg 2004
+ *
+ * Wireshark - Network traffic analyzer
+ * By Gerald Combs <gerald@wireshark.org>
+ * Copyright 1998 Gerald Combs
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+ */
+
+#ifndef PACKET_X509CE_H
+#define PACKET_X509CE_H
+
+#include "packet-x509ce-exp.h"
+
+void x509ce_enable_ciplus(void);
+void x509ce_disable_ciplus(void);
+
+#endif  /* PACKET_X509CE_H */
+
diff --git a/epan/dissectors/asn1/x509ce/x509ce.cnf b/epan/dissectors/asn1/x509ce/x509ce.cnf
new file mode 100644
index 0000000000..454ea8958e
--- /dev/null
+++ b/epan/dissectors/asn1/x509ce/x509ce.cnf
@@ -0,0 +1,187 @@
+# x509ce.cnf
+# X509CE conformation file
+
+#.IMPORT ../x509if/x509if-exp.cnf
+#.IMPORT ../x509af/x509af-exp.cnf
+#.IMPORT ../x509sat/x509sat-exp.cnf
+#.IMPORT ../p1/p1-exp.cnf
+
+# Forward declaration
+#.CLASS CERT-POLICY-QUALIFIER
+&id         ObjectIdentifierType
+&Qualifier
+#.END
+
+# InformationFramework classes
+##.CLASS ATTRIBUTE
+#&derivation            ClassReference ATTRIBUTE
+#&Type
+#&equality-match        ClassReference MATCHING-RULE
+#&ordering-match        ClassReference MATCHING-RULE
+#&substrings-match      ClassReference MATCHING-RULE
+#&single-valued         BooleanType
+#&collective            BooleanType
+#&no-user-modification  BooleanType
+#&usage
+#&id                    ObjectIdentifierType
+##.END
+
+#.CLASS MATCHING-RULE
+&ParentMatchingRules   ClassReference MATCHING-RULE
+&AssertionType
+&uniqueMatchIndicator  ClassReference ATTRIBUTE
+&id                    ObjectIdentifierType
+#.END
+#.EXPORTS
+AltNameType
+AttributesSyntax
+AuthorityKeyIdentifier
+BaseCRLNumber
+BaseDistance
+BaseRevocationInfo
+BasicConstraintsSyntax
+CertificateAssertion
+CertificateExactAssertion
+CertificateListAssertion
+CertificateListExactAssertion
+CertificatePairAssertion
+CertificatePairExactAssertion
+CertificatePoliciesSyntax
+CertPolicySet
+CRLDistPointsSyntax
+CRLNumber
+CRLReason
+CRLReferral
+CRLScopeSyntax
+CRLStreamIdentifier
+DeltaInformation
+DeltaRefInfo
+DistributionPoint
+DistributionPointName
+EDIPartyName
+GeneralName
+GeneralNames
+GeneralSubtree
+GeneralSubtrees
+HoldInstruction
+IssuingDistPointSyntax
+KeyIdentifier
+KeyPurposeId
+KeyPurposeIDs
+KeyUsage
+NameConstraintsSyntax
+NumberRange
+OnlyCertificateTypes
+OrderedListSyntax
+PerAuthorityScope
+PkiPathMatchSyntax
+PolicyConstraintsSyntax
+PolicyInformation
+PolicyMappingsSyntax
+PolicyQualifierInfo
+PrivateKeyUsagePeriod
+ReasonFlags
+SkipCerts
+StatusReferral
+StatusReferrals
+SubjectKeyIdentifier
+ScramblerCapabilities
+CiplusInfo
+CicamBrandId
+
+#.PDU
+ScramblerCapabilities
+CiplusInfo
+CicamBrandId
+
+
+#.REGISTER
+CertificatePoliciesSyntax B "2.5.29.3"  "id-ce-certificatePolicies"
+AttributesSyntax          B "2.5.29.9"  "id-ce-subjectDirectoryAttributes"
+SubjectKeyIdentifier      B "2.5.29.14" "id-ce-subjectKeyIdentifier"
+KeyUsage                  B "2.5.29.15" "id-ce-keyUsage"
+PrivateKeyUsagePeriod     B "2.5.29.16" "id-ce-privateKeyUsagePeriod"
+GeneralNames              B "2.5.29.17" "id-ce-subjectAltName"
+GeneralNames              B "2.5.29.18" "id-ce-issuerAltName"
+BasicConstraintsSyntax    B "2.5.29.19" "id-ce-basicConstraints"
+CRLNumber                 B "2.5.29.20" "id-ce-cRLNumber"
+CRLReason                 B "2.5.29.21" "id-ce-reasonCode"
+HoldInstruction           B "2.5.29.23" "id-ce-instructionCode"
+BaseCRLNumber             B "2.5.29.27" "id-ce-deltaCRLIndicator"
+IssuingDistPointSyntax    B "2.5.29.28" "id-ce-issuingDistributionPoint"
+GeneralNames              B "2.5.29.29" "id-ce-certificateIssuer"
+NameConstraintsSyntax     B "2.5.29.30" "id-ce-nameConstraints"
+CRLDistPointsSyntax       B "2.5.29.31" "id-ce-cRLDistributionPoints"
+CertificatePoliciesSyntax B "2.5.29.32" "id-ce-certificatePolicies"
+PolicyMappingsSyntax      B "2.5.29.33" "id-ce-policyMappings"
+AuthorityKeyIdentifier    B "2.5.29.35" "id-ce-authorityKeyIdentifier"
+PolicyConstraintsSyntax   B "2.5.29.36" "id-ce-policyConstraints"
+KeyPurposeIDs             B "2.5.29.37" "id-ce-extKeyUsage"
+CRLStreamIdentifier       B "2.5.29.40" "id-ce-cRLStreamIdentifier"
+CRLScopeSyntax            B "2.5.29.44" "id-ce-cRLScope"
+StatusReferrals           B "2.5.29.45" "id-ce-statusReferrals"
+CRLDistPointsSyntax       B "2.5.29.46" "id-ce-freshestCRL"
+OrderedListSyntax         B "2.5.29.47" "id-ce-orderedList"
+DeltaInformation          B "2.5.29.53" "id-ce-deltaInfo"
+SkipCerts                 B "2.5.29.54" "id-ce-inhibitAnyPolicy"
+ToBeRevokedSyntax		  B "2.5.29.58" "id-ce-toBeRevoked"
+RevokedGroupsSyntax		  B "2.5.29.59" "id-ce-RevokedGroups"
+ExpiredCertsOnCRL		  B "2.5.29.60" "id-ce-expiredCertsOnCRL"
+AAIssuingDistPointSyntax  B "2.5.29.61" "id-ce-aAissuingDistributionPoint"
+
+CertificateAssertion			B "2.5.13.35" "id-mr-certificateMatch"
+CertificatePairExactAssertion	B "2.5.13.36" "id-mr-certificatePairExactMatch"
+CertificatePairAssertion		B "2.5.13.37" "id-mr-certificatePairMatch"
+CertificateListExactAssertion	B "2.5.13.38" "id-mr-certificateListExactMatch"
+CertificateListAssertion		B "2.5.13.39" "id-mr-certificateListMatch"
+PkiPathMatchSyntax				B "2.5.13.62" "id-mr-pkiPathMatch"
+EnhancedCertificateAssertion	B "2.5.13.65" "id-mr-enhancedCertificateMatch"
+
+# These are obsolete???
+# The following OBJECT IDENTIFIERS are not used by this Specification:
+# {id-ce 2}, {id-ce 3}, {id-ce 4}, {id-ce 5}, {id-ce 6}, {id-ce 7},
+# {id-ce 8}, {id-ce 10}, {id-ce 11}, {id-ce 12}, {id-ce 13},
+# {id-ce 22}, {id-ce 25}, {id-ce 26}
+
+# Microsoft extensions
+CertificateTemplate		B "1.3.6.1.4.1.311.21.7"  "id-ms-certificate-template"
+CertificatePoliciesSyntax	B "1.3.6.1.4.1.311.21.10" "id-ms-application-certificate-policies"
+
+# Entrust extensions
+EntrustVersionInfo	B "1.2.840.113533.7.65.0" "id-ce-entrustVersionInfo"
+
+#.NO_EMIT
+
+#.TYPE_RENAME
+
+#.FIELD_RENAME
+CRLReferral/issuer	crlr_issuer
+CertificatePairExactAssertion/issuedToThisCAAssertion	cpea_issuedToThisCAAssertion
+CertificatePairExactAssertion/issuedByThisCAAssertion	cpea_issuedByThisCAAssertion
+CertificateGroup/serialNumberRange			certificateGroupNumberRange
+CertificateAssertion/subjectAltName			subjectAltNameType
+EnhancedCertificateAssertion/pathToName			enhancedPathToName
+
+#.FN_PARS PolicyQualifierInfo/policyQualifierId
+  FN_VARIANT = _str  HF_INDEX = hf_x509ce_object_identifier_id  VAL_PTR = &actx->external.direct_reference
+
+#.FN_BODY PolicyQualifierInfo/qualifier
+  offset=call_ber_oid_callback(actx->external.direct_reference, tvb, offset, actx->pinfo, tree, NULL);
+
+#.FN_BODY GeneralName/iPAddress
+	proto_tree_add_item(tree, hf_x509ce_IPAddress, tvb, offset, 4, ENC_BIG_ENDIAN);
+	offset+=4;
+
+#.FN_PARS OtherNameType
+  FN_VARIANT = _str  VAL_PTR = &actx->external.direct_reference
+
+#.FN_BODY OtherNameValue
+  offset=call_ber_oid_callback(actx->external.direct_reference, tvb, offset, actx->pinfo, tree, NULL);
+
+#.FN_FTR GeneralName/uniformResourceIdentifier
+
+	PROTO_ITEM_SET_URL(actx->created_item);
+
+#.END
+
+