Add IETFAttrSyntax type support

The IETFAtrrSyntax type is used for the values of several attributes
defined in RFC 5755 for use with attribute certificates.
Specifically this type is used with the "Charging Identity" and
"Group" attributes.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/15857)

10 files changed, 441 insertions, 1 deletions

diff --git a/crypto/x509/build.info b/crypto/x509/build.info
index 873a9838b5..6cebadea77 100644
--- a/crypto/x509/build.info
+++ b/crypto/x509/build.info
@@ -16,7 +16,7 @@ SOURCE[../../libcrypto]=\
         pcy_cache.c pcy_node.c pcy_data.c pcy_map.c pcy_tree.c pcy_lib.c \
         v3_asid.c v3_addr.c v3_tlsf.c v3_admis.c v3_no_rev_avail.c \
         v3_soa_id.c v3_no_ass.c v3_group_ac.c v3_single_use.c v3_ind_iss.c \
-        x509_acert.c x509aset.c t_acert.c
+        x509_acert.c x509aset.c t_acert.c x_ietfatt.c
 
 IF[{- !$disabled{'deprecated-3.0'} -}]
   SOURCE[../../libcrypto]=x509type.c
diff --git a/crypto/x509/x_ietfatt.c b/crypto/x509/x_ietfatt.c
new file mode 100644
index 0000000000..08db0bafc7
--- /dev/null
+++ b/crypto/x509/x_ietfatt.c
@@ -0,0 +1,240 @@
+/*
+ * Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include <openssl/err.h>
+#include <openssl/asn1t.h>
+#include <openssl/x509_acert.h>
+
+/*-
+ * Definition of IetfAttrSyntax from RFC 5755 4.4
+ *
+ * IetfAttrSyntax ::= SEQUENCE {
+ *   policyAuthority [0] GeneralNames    OPTIONAL,
+ *   values          SEQUENCE OF CHOICE {
+ *                     octets    OCTET STRING,
+ *                     oid       OBJECT IDENTIFIER,
+ *                     string    UTF8String
+ *                   }
+ * }
+ *
+ * Section 4.4.2 states that all values in the sequence MUST use the
+ * same choice of value (octet, oid or string).
+ */
+
+struct OSSL_IETF_ATTR_SYNTAX_VALUE_st {
+    int type;
+    union {
+        ASN1_OCTET_STRING *octets;
+        ASN1_OBJECT *oid;
+        ASN1_UTF8STRING *string;
+    } u;
+};
+
+struct OSSL_IETF_ATTR_SYNTAX_st {
+    GENERAL_NAMES *policyAuthority;
+    int type;
+    STACK_OF(OSSL_IETF_ATTR_SYNTAX_VALUE) *values;
+};
+
+ASN1_CHOICE(OSSL_IETF_ATTR_SYNTAX_VALUE) = {
+    ASN1_SIMPLE(OSSL_IETF_ATTR_SYNTAX_VALUE, u.octets, ASN1_OCTET_STRING),
+    ASN1_SIMPLE(OSSL_IETF_ATTR_SYNTAX_VALUE, u.oid, ASN1_OBJECT),
+    ASN1_SIMPLE(OSSL_IETF_ATTR_SYNTAX_VALUE, u.string, ASN1_UTF8STRING),
+} ASN1_CHOICE_END(OSSL_IETF_ATTR_SYNTAX_VALUE)
+
+ASN1_SEQUENCE(OSSL_IETF_ATTR_SYNTAX) = {
+    ASN1_IMP_SEQUENCE_OF_OPT(OSSL_IETF_ATTR_SYNTAX, policyAuthority, GENERAL_NAME, 0),
+    ASN1_SEQUENCE_OF(OSSL_IETF_ATTR_SYNTAX, values, OSSL_IETF_ATTR_SYNTAX_VALUE),
+} ASN1_SEQUENCE_END(OSSL_IETF_ATTR_SYNTAX)
+
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(OSSL_IETF_ATTR_SYNTAX)
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(OSSL_IETF_ATTR_SYNTAX_VALUE)
+
+OSSL_IETF_ATTR_SYNTAX *d2i_OSSL_IETF_ATTR_SYNTAX (OSSL_IETF_ATTR_SYNTAX **a,
+                                                  const unsigned char **in,
+                                                  long len)
+{
+    OSSL_IETF_ATTR_SYNTAX *ias;
+    int i;
+
+    ias = (OSSL_IETF_ATTR_SYNTAX *) ASN1_item_d2i((ASN1_VALUE **)a, in, len,
+                                                  OSSL_IETF_ATTR_SYNTAX_it());
+    if (ias == NULL)
+        return ias;
+
+    for (i = 0; i < sk_OSSL_IETF_ATTR_SYNTAX_VALUE_num(ias->values); i++)
+    {
+        OSSL_IETF_ATTR_SYNTAX_VALUE *val;
+
+        val = sk_OSSL_IETF_ATTR_SYNTAX_VALUE_value(ias->values, i);
+        if (i == 0)
+            ias->type = val->type;
+        else if (val->type != ias->type)
+            goto invalid_types;
+    }
+
+    return ias;
+
+invalid_types:
+    OSSL_IETF_ATTR_SYNTAX_free(ias);
+    if (a)
+        *a = NULL;
+    ERR_raise(ERR_LIB_X509V3, ERR_R_PASSED_INVALID_ARGUMENT);
+    return NULL;
+}
+
+int i2d_OSSL_IETF_ATTR_SYNTAX (const OSSL_IETF_ATTR_SYNTAX *a,
+                               unsigned char **out)
+{
+    return ASN1_item_i2d((const ASN1_VALUE *)a, out, OSSL_IETF_ATTR_SYNTAX_it());
+}
+
+int OSSL_IETF_ATTR_SYNTAX_get_value_num(const OSSL_IETF_ATTR_SYNTAX *a)
+{
+    if (a->values == NULL)
+        return 0;
+
+    return sk_OSSL_IETF_ATTR_SYNTAX_VALUE_num(a->values);
+}
+
+const GENERAL_NAMES *
+OSSL_IETF_ATTR_SYNTAX_get0_policyAuthority(const OSSL_IETF_ATTR_SYNTAX *a)
+{
+    return a->policyAuthority;
+}
+
+void OSSL_IETF_ATTR_SYNTAX_set0_policyAuthority(OSSL_IETF_ATTR_SYNTAX *a,
+                                                GENERAL_NAMES *names)
+{
+    GENERAL_NAMES_free(a->policyAuthority);
+    a->policyAuthority = names;
+}
+
+void *OSSL_IETF_ATTR_SYNTAX_get0_value(const OSSL_IETF_ATTR_SYNTAX *a,
+                                       int ind, int *type)
+{
+    OSSL_IETF_ATTR_SYNTAX_VALUE *val;
+
+    val = sk_OSSL_IETF_ATTR_SYNTAX_VALUE_value(a->values, ind);
+    if (val == NULL)
+        return NULL;
+
+    if (type != NULL)
+        *type = val->type;
+
+    switch (val->type) {
+    case OSSL_IETFAS_OCTETS:
+        return val->u.octets;
+    case OSSL_IETFAS_OID:
+        return val->u.oid;
+    case OSSL_IETFAS_STRING:
+        return val->u.string;
+    }
+
+    return NULL;
+}
+
+int OSSL_IETF_ATTR_SYNTAX_add1_value(OSSL_IETF_ATTR_SYNTAX *a, int type,
+                                     void *data)
+{
+    OSSL_IETF_ATTR_SYNTAX_VALUE *val;
+
+    if (data == NULL)
+        return 0;
+
+    if (a->values == NULL) {
+        if ((a->values = sk_OSSL_IETF_ATTR_SYNTAX_VALUE_new_null()) == NULL)
+            goto err;
+        a->type = type;
+    }
+
+    if (type != a->type) {
+        ERR_raise(ERR_LIB_X509V3, ERR_R_PASSED_INVALID_ARGUMENT);
+        return 0;
+    }
+
+    if ((val = OSSL_IETF_ATTR_SYNTAX_VALUE_new()) == NULL)
+        goto err;
+
+    val->type = type;
+    switch (type) {
+    case OSSL_IETFAS_OCTETS:
+        val->u.octets = data;
+        break;
+    case OSSL_IETFAS_OID:
+        val->u.oid = data;
+        break;
+    case OSSL_IETFAS_STRING:
+        val->u.string = data;
+        break;
+    default:
+        ERR_raise(ERR_LIB_X509V3, ERR_R_PASSED_INVALID_ARGUMENT);
+        return 0;
+    }
+
+    if (sk_OSSL_IETF_ATTR_SYNTAX_VALUE_push(a->values, val) <= 0) {
+        OSSL_IETF_ATTR_SYNTAX_VALUE_free(val);
+        return 0;
+    }
+
+    return 1;
+
+err:
+    ERR_raise(ERR_LIB_X509V3, ERR_R_CRYPTO_LIB);
+    return 0;
+}
+
+int OSSL_IETF_ATTR_SYNTAX_print(BIO *bp, OSSL_IETF_ATTR_SYNTAX *a, int indent)
+{
+    int i;
+
+    if (a->policyAuthority != NULL) {
+        for (i = 0; i < sk_GENERAL_NAME_num(a->policyAuthority); i++) {
+            if (BIO_printf(bp, "%*s", indent, "") <= 0)
+                goto err;
+
+            if (GENERAL_NAME_print(bp, sk_GENERAL_NAME_value(a->policyAuthority,
+                                                             i)) <= 0)
+                goto err;
+
+            if (BIO_printf(bp, "\n") <= 0)
+                goto err;
+        }
+    }
+
+    for (i = 0; i < OSSL_IETF_ATTR_SYNTAX_get_value_num(a); i++) {
+        char oidstr[80];
+        int ietf_type;
+        void *attr_value = OSSL_IETF_ATTR_SYNTAX_get0_value(a, i, &ietf_type);
+
+        if (attr_value == NULL)
+            goto err;
+
+        if (BIO_printf(bp, "%*s", indent, "") <= 0)
+            goto err;
+
+        switch (ietf_type) {
+        case OSSL_IETFAS_OID:
+            OBJ_obj2txt(oidstr, sizeof(oidstr), attr_value, 0);
+            BIO_printf(bp, "%.*s", (int) sizeof(oidstr), oidstr);
+            break;
+        case OSSL_IETFAS_OCTETS:
+        case OSSL_IETFAS_STRING:
+            ASN1_STRING_print(bp, attr_value);
+            break;
+        }
+    }
+    if (BIO_printf(bp, "\n") <= 0)
+        goto err;
+
+    return 1;
+
+err:
+    return 0;
+}
diff --git a/doc/build.info b/doc/build.info
index cc8bdef61d..373f61476e 100644
--- a/doc/build.info
+++ b/doc/build.info
@@ -1719,6 +1719,14 @@ DEPEND[html/man3/OSSL_HTTP_transfer.html]=man3/OSSL_HTTP_transfer.pod
 GENERATE[html/man3/OSSL_HTTP_transfer.html]=man3/OSSL_HTTP_transfer.pod
 DEPEND[man/man3/OSSL_HTTP_transfer.3]=man3/OSSL_HTTP_transfer.pod
 GENERATE[man/man3/OSSL_HTTP_transfer.3]=man3/OSSL_HTTP_transfer.pod
+DEPEND[html/man3/OSSL_IETF_ATTR_SYNTAX.html]=man3/OSSL_IETF_ATTR_SYNTAX.pod
+GENERATE[html/man3/OSSL_IETF_ATTR_SYNTAX.html]=man3/OSSL_IETF_ATTR_SYNTAX.pod
+DEPEND[man/man3/OSSL_IETF_ATTR_SYNTAX.3]=man3/OSSL_IETF_ATTR_SYNTAX.pod
+GENERATE[man/man3/OSSL_IETF_ATTR_SYNTAX.3]=man3/OSSL_IETF_ATTR_SYNTAX.pod
+DEPEND[html/man3/OSSL_IETF_ATTR_SYNTAX_print.html]=man3/OSSL_IETF_ATTR_SYNTAX_print.pod
+GENERATE[html/man3/OSSL_IETF_ATTR_SYNTAX_print.html]=man3/OSSL_IETF_ATTR_SYNTAX_print.pod
+DEPEND[man/man3/OSSL_IETF_ATTR_SYNTAX_print.3]=man3/OSSL_IETF_ATTR_SYNTAX_print.pod
+GENERATE[man/man3/OSSL_IETF_ATTR_SYNTAX_print.3]=man3/OSSL_IETF_ATTR_SYNTAX_print.pod
 DEPEND[html/man3/OSSL_ITEM.html]=man3/OSSL_ITEM.pod
 GENERATE[html/man3/OSSL_ITEM.html]=man3/OSSL_ITEM.pod
 DEPEND[man/man3/OSSL_ITEM.3]=man3/OSSL_ITEM.pod
@@ -3377,6 +3385,8 @@ html/man3/OSSL_HPKE_CTX_new.html \
 html/man3/OSSL_HTTP_REQ_CTX.html \
 html/man3/OSSL_HTTP_parse_url.html \
 html/man3/OSSL_HTTP_transfer.html \
+html/man3/OSSL_IETF_ATTR_SYNTAX.html \
+html/man3/OSSL_IETF_ATTR_SYNTAX_print.html \
 html/man3/OSSL_ITEM.html \
 html/man3/OSSL_LIB_CTX.html \
 html/man3/OSSL_PARAM.html \
@@ -4026,6 +4036,8 @@ man/man3/OSSL_HPKE_CTX_new.3 \
 man/man3/OSSL_HTTP_REQ_CTX.3 \
 man/man3/OSSL_HTTP_parse_url.3 \
 man/man3/OSSL_HTTP_transfer.3 \
+man/man3/OSSL_IETF_ATTR_SYNTAX.3 \
+man/man3/OSSL_IETF_ATTR_SYNTAX_print.3 \
 man/man3/OSSL_ITEM.3 \
 man/man3/OSSL_LIB_CTX.3 \
 man/man3/OSSL_PARAM.3 \
diff --git a/doc/man3/OSSL_IETF_ATTR_SYNTAX.pod b/doc/man3/OSSL_IETF_ATTR_SYNTAX.pod
new file mode 100644
index 0000000000..816ad799b0
--- /dev/null
+++ b/doc/man3/OSSL_IETF_ATTR_SYNTAX.pod
@@ -0,0 +1,97 @@
+=pod
+
+=head1 NAME
+
+OSSL_IETF_ATTR_SYNTAX,
+OSSL_IETF_ATTR_SYNTAX_get0_policyAuthority,
+OSSL_IETF_ATTR_SYNTAX_set0_policyAuthority,
+OSSL_IETF_ATTR_SYNTAX_get_value_num,
+OSSL_IETF_ATTR_SYNTAX_get0_value,
+OSSL_IETF_ATTR_SYNTAX_add1_value
+- Accessors and setters for OSSL_IETF_ATTR_SYNTAX
+
+=head1 SYNOPSIS
+
+ #include <openssl/x509_acert.h>
+
+ typedef struct OSSL_IETF_ATTR_SYNTAX_st OSSL_IETF_ATTR_SYNTAX;
+
+ const GENERAL_NAMES *
+ OSSL_IETF_ATTR_SYNTAX_get0_policyAuthority(const OSSL_IETF_ATTR_SYNTAX *a);
+ void OSSL_IETF_ATTR_SYNTAX_set0_policyAuthority(OSSL_IETF_ATTR_SYNTAX *a,
+                                                 GENERAL_NAMES *names);
+
+ int OSSL_IETF_ATTR_SYNTAX_get_value_num(const OSSL_IETF_ATTR_SYNTAX *a);
+ void *OSSL_IETF_ATTR_SYNTAX_get0_value(const OSSL_IETF_ATTR_SYNTAX *a,
+                                        int ind, int *type);
+ int OSSL_IETF_ATTR_SYNTAX_add1_value(OSSL_IETF_ATTR_SYNTAX *a, int type,
+                                      void *data);
+
+=head1 DESCRIPTION
+
+B<OSSL_IETF_ATTR_SYNTAX> is an opaque structure that represents the
+IetfAttrSyntax type defined in RFC 5755 (Section 4.4) for use
+as an AttributeValue.
+
+OSSL_IETF_ATTR_SYNTAX_get0_policyAuthority() and OSSL_IETF_ATTR_SYNTAX_set0_policyAuthority()
+get and set the policyAuthority field of the structure. Both routines act on
+internal pointers of the structure and must not be freed by the application.
+
+An B<OSSL_IETF_ATTR_SYNTAX> object also holds a sequence of values.
+OSSL_IETF_ATTR_SYNTAX_get_value_num() returns the number of values in the
+sequence.  OSSL_IETF_ATTR_SYNTAX_add1_value(), adds a copy of I<data> of a specified
+I<type> to the sequence.  The caller should free the I<data> after use.
+
+OSSL_IETF_ATTR_SYNTAX_get0_value() will return the value and a specific index I<ind>
+in the sequence or NULL on error.  If I<type> is not NULL, the type of the
+value will be written to this location.
+
+The I<type> of the values stored in the B<OSSL_IETF_ATTR_SYNTAX> value sequence is
+one of the following:
+
+=over 4
+
+=item OSSL_IETFAS_OCTETS
+
+A pointer to an ASN1_OCTET_STRING
+
+=item OSSL_IETFAS_OID
+
+A pointer to an ASN1_OBJECT
+
+=item OSSL_IETFAS_STRING
+
+A pointer to an ASN1_UTF8STRING
+
+=back
+
+=head1 RETURN VALUES
+
+OSSL_IETF_ATTR_SYNTAX_get0_policyAuthority() returns an pointer to a
+B<GENERAL_NAMES> structure or B<NULL> if the policy authority has not been
+set.
+
+OSSL_IETF_ATTR_SYNTAX_get_value_num() returns the number of entries in the value
+sequence or -1 on error.
+
+OSSL_IETF_ATTR_SYNTAX_get0_value() returns a pointer to the value at the given index
+or NULL if the index is out of range.
+
+OSSL_IETF_ATTR_SYNTAX_add1_value() returns 1 on success and 0 on failure.
+
+=head1 HISTORY
+
+OSSL_IETF_ATTR_SYNTAX_get0_policyAuthority(), OSSL_IETF_ATTR_SYNTAX_set0_policyAuthority(),
+OSSL_IETF_ATTR_SYNTAX_get_value_num(), OSSL_IETF_ATTR_SYNTAX_get0_value(), and
+OSSL_IETF_ATTR_SYNTAX_add1_value() were added in OpenSSL 3.4.
+
+=head1 COPYRIGHT
+
+Copyright 2021 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff --git a/doc/man3/OSSL_IETF_ATTR_SYNTAX_print.pod b/doc/man3/OSSL_IETF_ATTR_SYNTAX_print.pod
new file mode 100644
index 0000000000..6fa0ddae5e
--- /dev/null
+++ b/doc/man3/OSSL_IETF_ATTR_SYNTAX_print.pod
@@ -0,0 +1,41 @@
+=pod
+
+=head1 NAME
+
+OSSL_IETF_ATTR_SYNTAX_print - OSSL_IETF_ATTR_SYNTAX printing
+
+=head1 SYNOPSIS
+
+ #include <openssl/x509_acert.h>
+
+ int OSSL_IETF_ATTR_SYNTAX_print(BIO *bp, OSSL_IETF_ATTR_SYNTAX *a,
+                                 int indent);
+
+=head1 DESCRIPTION
+
+OSSL_IETF_ATTR_SYNTAX_print() prints a human readable version of I<a> to
+BIO I<bp>.
+Each line of the output is indented by I<indent> spaces.
+
+=head1 RETURN VALUES
+
+OSSL_IETF_ATTR_SYNTAX_print() return 1 on success or 0 on failure.
+
+=head1 SEE ALSO
+
+L<ASN1_STRING_print_ex(3)>
+
+=head1 HISTORY
+
+OSSL_IETF_ATTR_SYNTAX_print() was added in OpenSSL 3.4.
+
+=head1 COPYRIGHT
+
+Copyright 2021-2022 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut
diff --git a/doc/man3/X509_dup.pod b/doc/man3/X509_dup.pod
index 621427e3fb..4ecd5c0830 100644
--- a/doc/man3/X509_dup.pod
+++ b/doc/man3/X509_dup.pod
@@ -79,6 +79,9 @@ GENERAL_NAME_free,
 GENERAL_NAME_new,
 GENERAL_SUBTREE_free,
 GENERAL_SUBTREE_new,
+OSSL_IETF_ATTR_SYNTAX_free,
+OSSL_IETF_ATTR_SYNTAX_it,
+OSSL_IETF_ATTR_SYNTAX_new,
 IPAddressChoice_free,
 IPAddressChoice_new,
 IPAddressFamily_free,
@@ -171,6 +174,9 @@ OSSL_CRMF_PKIPUBLICATIONINFO_new,
 OSSL_CRMF_SINGLEPUBINFO_free,
 OSSL_CRMF_SINGLEPUBINFO_it,
 OSSL_CRMF_SINGLEPUBINFO_new,
+OSSL_IETF_ATTR_SYNTAX_VALUE_free,
+OSSL_IETF_ATTR_SYNTAX_VALUE_it,
+OSSL_IETF_ATTR_SYNTAX_VALUE_new,
 OSSL_ISSUER_SERIAL_free,
 OSSL_ISSUER_SERIAL_new,
 OSSL_OBJECT_DIGEST_INFO_free,
diff --git a/doc/man3/d2i_X509.pod b/doc/man3/d2i_X509.pod
index 6c4464deb4..06f764ef8b 100644
--- a/doc/man3/d2i_X509.pod
+++ b/doc/man3/d2i_X509.pod
@@ -100,6 +100,7 @@ d2i_OSSL_CRMF_MSGS,
 d2i_OSSL_CRMF_PBMPARAMETER,
 d2i_OSSL_CRMF_PKIPUBLICATIONINFO,
 d2i_OSSL_CRMF_SINGLEPUBINFO,
+d2i_OSSL_IETF_ATTR_SYNTAX,
 d2i_OTHERNAME,
 d2i_PBE2PARAM,
 d2i_PBEPARAM,
@@ -274,6 +275,7 @@ i2d_OSSL_CRMF_MSGS,
 i2d_OSSL_CRMF_PBMPARAMETER,
 i2d_OSSL_CRMF_PKIPUBLICATIONINFO,
 i2d_OSSL_CRMF_SINGLEPUBINFO,
+i2d_OSSL_IETF_ATTR_SYNTAX,
 i2d_OTHERNAME,
 i2d_PBE2PARAM,
 i2d_PBEPARAM,
diff --git a/include/openssl/x509_acert.h.in b/include/openssl/x509_acert.h.in
index 6a56169325..a1e6704c0d 100644
--- a/include/openssl/x509_acert.h.in
+++ b/include/openssl/x509_acert.h.in
@@ -124,4 +124,31 @@ int OSSL_ISSUER_SERIAL_set1_serial(OSSL_ISSUER_SERIAL *isss,
                                    const ASN1_INTEGER *serial);
 int OSSL_ISSUER_SERIAL_set1_issuerUID(OSSL_ISSUER_SERIAL *isss,
                                    const ASN1_BIT_STRING *uid);
+
+# define OSSL_IETFAS_OCTETS     0
+# define OSSL_IETFAS_OID        1
+# define OSSL_IETFAS_STRING     2
+
+typedef struct OSSL_IETF_ATTR_SYNTAX_VALUE_st OSSL_IETF_ATTR_SYNTAX_VALUE;
+typedef struct OSSL_IETF_ATTR_SYNTAX_st OSSL_IETF_ATTR_SYNTAX;
+{-
+    generate_stack_macros("OSSL_IETF_ATTR_SYNTAX_VALUE");
+-}
+
+DECLARE_ASN1_ITEM(OSSL_IETF_ATTR_SYNTAX_VALUE)
+DECLARE_ASN1_ALLOC_FUNCTIONS(OSSL_IETF_ATTR_SYNTAX_VALUE)
+DECLARE_ASN1_FUNCTIONS(OSSL_IETF_ATTR_SYNTAX)
+
+const GENERAL_NAMES *
+OSSL_IETF_ATTR_SYNTAX_get0_policyAuthority(const OSSL_IETF_ATTR_SYNTAX *a);
+void OSSL_IETF_ATTR_SYNTAX_set0_policyAuthority(OSSL_IETF_ATTR_SYNTAX *a,
+		                                        GENERAL_NAMES *names);
+
+int OSSL_IETF_ATTR_SYNTAX_get_value_num(const OSSL_IETF_ATTR_SYNTAX *a);
+void *OSSL_IETF_ATTR_SYNTAX_get0_value(const OSSL_IETF_ATTR_SYNTAX *a,
+		                               int ind, int *type);
+int OSSL_IETF_ATTR_SYNTAX_add1_value(OSSL_IETF_ATTR_SYNTAX *a, int type,
+		                             void *data);
+int OSSL_IETF_ATTR_SYNTAX_print(BIO *bp, OSSL_IETF_ATTR_SYNTAX *a, int indent);
+
 #endif
diff --git a/util/libcrypto.num b/util/libcrypto.num
index f9ff950f21..70e5871fb5 100644
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -5618,3 +5618,17 @@ X509_ACERT_verify                       ?	3_4_0	EXIST::FUNCTION:
 X509_ACERT_get_ext_d2i                  ?	3_4_0	EXIST::FUNCTION:
 X509_ACERT_add1_ext_i2d                 ?	3_4_0	EXIST::FUNCTION:
 X509_ACERT_get0_extensions              ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_VALUE_it          ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_VALUE_free        ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_VALUE_new         ?	3_4_0	EXIST::FUNCTION:
+d2i_OSSL_IETF_ATTR_SYNTAX               ?	3_4_0	EXIST::FUNCTION:
+i2d_OSSL_IETF_ATTR_SYNTAX               ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_free              ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_new               ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_it                ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_get0_policyAuthority ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_set0_policyAuthority ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_get_value_num     ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_get0_value        ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_add1_value        ?	3_4_0	EXIST::FUNCTION:
+OSSL_IETF_ATTR_SYNTAX_print             ?	3_4_0	EXIST::FUNCTION:
diff --git a/util/other.syms b/util/other.syms
index 4793ca357f..bf6ae33d5a 100644
--- a/util/other.syms
+++ b/util/other.syms
@@ -70,6 +70,7 @@ OSSL_ENCODER_CLEANUP                    datatype
 OSSL_ENCODER_INSTANCE                   datatype
 OSSL_HTTP_bio_cb_t                      datatype
 OSSL_HTTP_REQ_CTX                       datatype
+OSSL_IETF_ATTR_SYNTAX                   datatype
 OSSL_ITEM                               datatype
 OSSL_LIB_CTX                            datatype
 OSSL_PARAM                              datatype