CACDefaultScoring.cpp

Go to the documentation of this file.

#include "PKIFDefaultScoring.h"
#include "ToolkitUtils.h"
#include "PKIFCryptUtils.h"
#include "components.h"
#include "GottaMatch.h"
#include "IPKIFCryptoRaw.h"
#include "IPKIFTrustCache.h"
#include "PKIFNameAndKeyWithScore.h"

#include "BasicConstraintsViolation.h"

#include "Certificate.h"
#include "PKIFCertificateNodeEntry.h"
#include "GeneralName.h"
#include "Name.h"
#include "Buffer.h"
#include "SubjectPublicKeyInfo.h"
#include "Validity.h"
#include "PolicyInformation.h"
#include "CertificateNodeListWithSourceInfo.h"
#include "PKIFTime.h"
#include "OID.h"

#include "AuthorityKeyIdentifier.h"
#include "SubjectKeyIdentifier.h"
#include "PolicyInformationSet.h"
#include "PolicyMappings.h"
#include "PolicyMapping.h"
#include "PKIFTrustRoot.h"
#include "PKIFPathSettings.h"

#include "BasicConstraints.h"
#include "KeyUsage.h"

#include <vector>
#include <cstring>

using namespace std;
using namespace boost;

#ifdef _DEBUG_PATH
#include <iostream>
#endif

CPKIFDefaultScoring::CPKIFDefaultScoring()
{
    LOG_STRING_DEBUG("CPKIFRevocationStatusMediator<DefaultColleagues, DefaultMediators>::~CPKIFRevocationStatusMediator(void)", TOOLKIT_PATH_MISC, 0, this);
}
CPKIFDefaultScoring::~CPKIFDefaultScoring()
{
    LOG_STRING_DEBUG("CPKIFRevocationStatusMediator<DefaultColleagues, DefaultMediators>::~CPKIFRevocationStatusMediator(void)", TOOLKIT_PATH_MISC, 0, this);
}

#define ISSUED_BY_TRUST_ROOT                5000
#define ISSUED_BY_CERT_IN_CACHE             500
#define BASIC_CONSTRAINTS_PRESENT_AND_SET   75
#define VAL_PERIOD_OK                       75
#define ALGS_MATCH                          100
#define KEY_IDS_MATCH                       6000 //changed from 500 to 6000 7/18 to bump preference
#define NOT_SELF_ISSUED                     50
#define NOT_SELF_SIGNED                     50

//added the following - 7/21/2005
#define HAS_AT_ONE_POLICY                   25
#define MATCH_POLICY_WITH_PREV_CERT         25
#define MATCH_POLICY_WITH_SETTINGS          25

bool scoreCompare(
    const CPKIFCertificateNodeEntryPtr& lhs, 
    const CPKIFCertificateNodeEntryPtr& rhs)
{
    LOG_STRING_DEBUG("scoreCompare(const CPKIFCertificateNodeEntryPtr& lhs, const CPKIFCertificateNodeEntryPtr& rhs)", TOOLKIT_PATH_MISC, 0, NULL);

    int rhsScore = rhs->GetScore();
    int lhsScore = lhs->GetScore();
    return lhsScore > rhsScore;
}
bool scoreCompareNK(
    const CPKIFNameAndKeyWithScorePtr& lhs, 
    const CPKIFNameAndKeyWithScorePtr& rhs)
{
    LOG_STRING_DEBUG("scoreCompare(const CPKIFCertificateNodeEntryPtr& lhs, const CPKIFCertificateNodeEntryPtr& rhs)", TOOLKIT_PATH_MISC, 0, NULL);

    int rhsScore = rhs->GetScore();
    int lhsScore = lhs->GetScore();
    return lhsScore > rhsScore;
}
bool KeyIDsMatch(
    CPKIFAuthorityKeyIdentifierPtr& akid, 
    CPKIFCertificatePtr& curCert)
{
    LOG_STRING_DEBUG("KeyIDsMatch(CPKIFAuthorityKeyIdentifierPtr& akid, CPKIFCertificatePtr& curCert)", TOOLKIT_PATH_MISC, 0, NULL);

    if(akid == (CPKIFAuthorityKeyIdentifier*)NULL)
        return false;

    //we'll only compare one - try key ID first
    if(akid->KeyIDPresent())
    {
        CPKIFSubjectKeyIdentifierPtr skid = curCert->GetExtension<CPKIFSubjectKeyIdentifier>();
        if(skid != (CPKIFSubjectKeyIdentifier*)NULL)
        {
            CPKIFBufferPtr akidKeyID = akid->KeyIdentifier();
            CPKIFBufferPtr skidKeyID = skid->KeyIdentifier();
            if(akidKeyID != (CPKIFBuffer*)NULL && skidKeyID != (CPKIFBuffer*)NULL)
            {
                if(*akidKeyID == *skidKeyID)
                    return true;
            }
        }
    }
    else if(akid->IssDNAndSerialNumberPresent())
    {
        const char* lhsSN = akid->SerialNumber();
        const char* rhsSN = curCert->SerialNumber();
        
        //reviewed 4/23 - added strlen
        if(strlen(lhsSN) != strlen(rhsSN) || 0 != stricmp(lhsSN, rhsSN))
            return false;
        else
        {
            CPKIFGeneralNameList gns;
            akid->Issuer(gns);

            CPKIFGeneralNameList::iterator gnPos;
            CPKIFGeneralNameList::iterator gnEnd = gns.end();
            
            //spin through them all and if we find a match - good
            //if not - big deal - this is just for scoring
            //not going to bother comparing curCert issAltNames for this purpose
            for(gnPos = gns.begin(); gnPos != gnEnd; ++gnPos)
            {
                if(CPKIFGeneralName::DIRECTORYNAME == (*gnPos)->GetType())
                {
                    if(*(*gnPos)->directoryName() == *curCert->Issuer())
                        return true;
                }
            }
        }
    }

    return false;
}


bool KeyIDsMatch(
    CPKIFAuthorityKeyIdentifierPtr& akid, 
    const IPKIFTrustAnchorPtr& curTA)
{
    LOG_STRING_DEBUG("KeyIDsMatch(CPKIFAuthorityKeyIdentifierPtr& akid, CPKIFCertificatePtr& curCert)", TOOLKIT_PATH_MISC, 0, NULL);

    if(akid == (CPKIFAuthorityKeyIdentifier*)NULL)
        return false;

    IPKIFHasExtensionsPtr extsInterface;
    extsInterface = dynamic_pointer_cast<IPKIFHasExtensions, IPKIFTrustAnchor>(curTA);

    //we'll only compare one - try key ID first
    if(akid->KeyIDPresent())
    {
        CPKIFSubjectKeyIdentifierPtr skid = extsInterface->GetExtension<CPKIFSubjectKeyIdentifier>();
        if(skid != (CPKIFSubjectKeyIdentifier*)NULL)
        {
            CPKIFBufferPtr akidKeyID = akid->KeyIdentifier();
            CPKIFBufferPtr skidKeyID = skid->KeyIdentifier();
            if(akidKeyID != (CPKIFBuffer*)NULL && skidKeyID != (CPKIFBuffer*)NULL)
            {
                if(*akidKeyID == *skidKeyID)
                    return true;
            }
        }
        else
        {       
            CPKIFCertificatePtr curCert;
            CPKIFTrustRootPtr tr2 = dynamic_pointer_cast<CPKIFTrustRoot, IPKIFTrustAnchor>(curTA);
            if(tr2) 
                tr2->GetCert(curCert);

            if(curCert)
            {
                if(KeyIDsMatch(akid, curCert))
                    return true;
            }
        }
    }
    else if(akid->IssDNAndSerialNumberPresent())
    {
        CPKIFCertificatePtr curCert;
        CPKIFTrustRootPtr tr2 = dynamic_pointer_cast<CPKIFTrustRoot, IPKIFTrustAnchor>(curTA);
        if(tr2) 
            tr2->GetCert(curCert);

        if(curCert)
        {
            const char* lhsSN = akid->SerialNumber();
            const char* rhsSN = curCert->SerialNumber();
            
            //reviewed 4/23 - added strlen
            if(strlen(lhsSN) != strlen(rhsSN) || 0 != stricmp(lhsSN, rhsSN))
                return false;
            else
            {
                CPKIFGeneralNameList gns;
                akid->Issuer(gns);

                CPKIFGeneralNameList::iterator gnPos;
                CPKIFGeneralNameList::iterator gnEnd = gns.end();
                
                //spin through them all and if we find a match - good
                //if not - big deal - this is just for scoring
                //not going to bother comparing curCert issAltNames for this purpose
                for(gnPos = gns.begin(); gnPos != gnEnd; ++gnPos)
                {
                    if(CPKIFGeneralName::DIRECTORYNAME == (*gnPos)->GetType())
                    {
                        if(*(*gnPos)->directoryName() == *curCert->Issuer())
                            return true;
                    }
                }
            }
        }
    }

    return false;
}



//class NegativeScore
//{
//public:
//  NegativeScore() {}
//  bool operator()(const CPKIFCertificateNodeEntryPtr& entry);
//
//private:
//  NegativeScore& operator=(const NegativeScore& rhs); //added 4/6/2004
//};
//
//bool NegativeScore::operator()(const CPKIFCertificateNodeEntryPtr& entry)
//{
//  if(entry->GetScore() < 0) return true; else return false;
//} 
bool SomeMatch(
    CPKIFPolicyInformationSetPtr& fromCert, 
    CPKIFPolicyInformationListPtr& polsFromPrevCert, 
    CPKIFPolicyMappingsPtr& policyMappings)
{
    const CPKIFPolicyInformationListPtr& polsFromCert = fromCert->GetPolicySet();
    CPKIFPolicyInformationList::iterator prevEnd = polsFromPrevCert->end();

    {
    CPKIFPolicyInformationList::iterator pos;
    CPKIFPolicyInformationList::iterator end = polsFromCert->end();
    for(pos = polsFromCert->begin(); pos != end; ++pos)
    {
        if(*g_anyPolicy == *(*pos))
            return true;
    }
    }

    {
    CPKIFPolicyInformationList::iterator pos;
    CPKIFPolicyInformationList::iterator end = polsFromPrevCert->end();
    for(pos = polsFromPrevCert->begin(); pos != end; ++pos)
    {
        if(*g_anyPolicy == *(*pos))
            return true;
    }
    }

    {
    CPKIFPolicyInformationList::iterator pos;
    CPKIFPolicyInformationList::iterator end = polsFromCert->end();
    for(pos = polsFromCert->begin(); pos != end; ++pos)
    {
        GottaMatch<CPKIFPolicyInformationPtr> gm;
        gm.SetRHS(*pos);
        if(prevEnd != find_if(polsFromPrevCert->begin(), prevEnd, gm))
            return true;
    }
    }

    {
        if(policyMappings != (CPKIFPolicyMappings*)NULL)
        {
            vector<CPKIFOIDPtr> subDomainOIDs;
            if(policyMappings != (CPKIFPolicyMappings*)NULL)
            {
                CPKIFPolicyMappingListPtr policyMappingsList = policyMappings->PolicyMappings();
                CPKIFPolicyMappingList::iterator pmPos;
                CPKIFPolicyMappingList::iterator pmEnd = policyMappingsList->end();
                for(pmPos = policyMappingsList->begin(); pmPos != pmEnd; ++pmPos)
                    subDomainOIDs.push_back((*pmPos)->SubjectDomain());
            }
            CPKIFPolicyInformationList::iterator pos;
            CPKIFPolicyInformationList::iterator end = polsFromPrevCert->end();
            for(pos = polsFromPrevCert->begin(); pos != end; ++pos)
            {
                CPKIFOIDPtr policyOID = (*pos)->PolicyOID();
                vector<CPKIFOIDPtr>::iterator oidPos;
                vector<CPKIFOIDPtr>::iterator oidEnd = subDomainOIDs.end();
                for(oidPos = subDomainOIDs.begin(); oidPos != oidEnd; ++oidPos)
                    if(*(*oidPos) == *policyOID)
                        return true;
            }
        }
    }

    return false;
}
bool SomeMatch(
    CPKIFPolicyInformationSetPtr& fromCert, 
    CPKIFPolicyInformationSetPtr& fromPrevCert, 
    CPKIFPolicyMappingsPtr& policyMappings)
{
    if(fromCert == (CPKIFPolicyInformationSet*)NULL  || fromPrevCert == (CPKIFPolicyInformationSet*)NULL)
        return false;
    CPKIFPolicyInformationListPtr tmpPrevPolicy = fromPrevCert->GetPolicySet();
    return SomeMatch(fromCert, tmpPrevPolicy/*fromPrevCert->GetPolicySet()*/, policyMappings);
}
void CPKIFDefaultScoring::ScoreAndSortNodes(
    CPKIFCertificateNodeListWithSourceInfoPtr& nodeList, 
    CPKIFCertificatePtr& prevCert, 
    CPKIFPathSettingsPtr& settings, 
    IPKIFTrustCache* trustCache,
    int numOfCAsBelowCurInPath, 
    IPKIFCertRepository* iCert)
{
    LOG_STRING_DEBUG("CPKIFDefaultScoring::ScoreAndSortNodes", TOOLKIT_PATH_MISC, 0, this);

    IPKIFTrustAnchorList rootList;
    CPKIFCertificateList certList;

    //score each node entry
    CPKIFCertificateNodeListWithSourceInfo::iterator pos;
    CPKIFCertificateNodeListWithSourceInfo::iterator end = nodeList->end();     

    CPKIFPolicyInformationListPtr initPolSet;
    settings->GetInitialPolicySet(initPolSet);

    IPKIFCryptoRaw * raw = GetPlatformCryptoRaw();
    for(pos = nodeList->begin(); pos != end; ++pos)
    {
        (*pos)->ClearScore();
        CPKIFCertificatePtr curCert = (*pos)->GetCert();
        CPKIFNamePtr curIssuer = curCert->Issuer();

#ifdef _DEBUG_PATH
        const char* curSubStr = curCert->Subject()->ToString();
#endif

        //see if cert is issued by someone in the trust store
        rootList.clear();
        trustCache->GetTrustRoots(curIssuer, rootList);     
        if(!rootList.empty())
            (*pos)->AddToScore(ISSUED_BY_TRUST_ROOT);

        //see if cert is issued by someone in the local cache
        //avoid picking up certs that we are currently operating on
        if(!CertIsSelfIssued((*pos)->GetCert()))
        {
            //cert not self issued
            (*pos)->AddToScore(NOT_SELF_ISSUED);

            certList.clear();
            //iCert->GetCertificates(curIssuer, certList, LOCAL);
            //if(!certList.empty())
            //  (*pos)->AddToScore(ISSUED_BY_CERT_IN_CACHE);
        }

        if(!curCert->IsSelfSigned())
        {
            (*pos)->AddToScore(NOT_SELF_SIGNED);
        }

        //see if basic constraints is present and ca set
        CPKIFBasicConstraintsPtr basicConstraints;
        try {
        basicConstraints = curCert->GetExtension<CPKIFBasicConstraints>();
        }catch(...){}
        bool isCA = false;
        if(basicConstraints != (CPKIFBasicConstraints*)NULL)
        {
            if(basicConstraints->isCA())
                (*pos)->AddToScore(BASIC_CONSTRAINTS_PRESENT_AND_SET);
            else
            {
                (*pos)->ClearScore();
                continue;
            }
            if(basicConstraints->pathLengthPresent())
            {
                if(numOfCAsBelowCurInPath >= 0 && basicConstraints->pathLength() < numOfCAsBelowCurInPath)
                {
                    (*pos)->ClearScore();
                    continue;
                }
            }
        }

        //----------------------------------------------------------------------------------------------------
        // added code to bump priority of certificates containing policies
        // and/or containing policies in the prev cert and/or in the 
        // settings object and/or deprioritize those that yield empty
        // intersection - 7/21/2005
        CPKIFPolicyInformationSetPtr cpsFromCert;
        try {
        cpsFromCert = curCert->GetExtension<CPKIFPolicyInformationSet>();
        }catch(...){}
        if(cpsFromCert != (CPKIFPolicyInformationSet*)NULL)
        {
            //give points for simply having a policy
            (*pos)->AddToScore(HAS_AT_ONE_POLICY);

            CPKIFPolicyMappingsPtr policyMappings;
            if(SomeMatch(cpsFromCert, initPolSet, policyMappings))
                (*pos)->AddToScore(MATCH_POLICY_WITH_SETTINGS);

            if(prevCert != (CPKIFCertificate*)NULL)
            {
                try {
                policyMappings = curCert->GetExtension<CPKIFPolicyMappings>();
                }catch(...) {}
                CPKIFPolicyInformationSetPtr cpsFromPrevCert = prevCert->GetExtension<CPKIFPolicyInformationSet>();
                if(SomeMatch(cpsFromCert, cpsFromPrevCert,policyMappings))
                {
                    (*pos)->AddToScore(MATCH_POLICY_WITH_PREV_CERT);                    
                }
                //else if(!initPolSet->empty())
                //{
                //  (*pos)->ClearScore();
                //  (*pos)->SetPolicyIgnore();
                //  continue;
                //}
            }
        }

        //----------------------------------------------------------------------------------------------------

        //perform validity period check
        //changed from current time to settings based time - 7/19/2004
        CPKIFTimePtr curTime = settings->GetValidationTime();
        CPKIFValidityPtr val = curCert->Validity();
        CPKIFTimePtr startTime = val->notBefore();
        CPKIFTimePtr endTime = val->notAfter();
        if(*curTime > *startTime && *curTime < *endTime)
        {
            (*pos)->AddToScore(VAL_PERIOD_OK);
        }
        else
        {
            (*pos)->ClearScore();
            continue;
        }

        //see if algs chain properly
        if(prevCert != (CPKIFCertificate*)NULL)
        {
    #ifdef _DEBUG_PATH
        const char* prevSubStr = prevCert->Subject()->ToString();
    #endif
            CPKIFAlgorithmIdentifierPtr prevCertSigAlg = prevCert->SignatureAlgorithm();
            CPKIFAlgorithmIdentifierPtr curCertSigAlg = curCert->SubjectPublicKeyInfo()->alg();
            if(GetAlgClass(prevCertSigAlg) != GetAlgClass(curCertSigAlg))
            {
                (*pos)->ClearScore();
                continue;
            }
            else
            {
                (*pos)->AddToScore(ALGS_MATCH);
            }

            //check AKID/SKID chaining
            CPKIFAuthorityKeyIdentifierPtr akid;
            try {
            akid = prevCert->GetExtension<CPKIFAuthorityKeyIdentifier>();
            }catch(...) {}
            if(akid != (CPKIFAuthorityKeyIdentifier*)NULL)
            {
                if(KeyIDsMatch(akid, curCert))
                {
                    (*pos)->AddToScore(KEY_IDS_MATCH);
                }
                else
                {
                    //if present but no match - clear the score 7/27/2005
//                  (*pos)->ClearScore();
                    try
                    {
                        if(/*CertIsSelfIssued(prevCert) && */!raw->VerifyCertificate(*curCert, *prevCert))
                        {
                            (*pos)->ClearScore();
                            continue;
                        }
                    }
                    catch(...)
                    {
                    }
                }
            }
        }
    }

    //before sorting remove any offending nodes
//  BasicConstraintsViolation bcv;
//  bcv.SetCACount(numOfCAsBelowCurInPath);
//  CPKIFCertificateNodeListWithSourceInfo::iterator newEnd = remove_if(nodeList->begin(), nodeList->end(), bcv);
//  nodeList->erase(newEnd, nodeList->end());
//  if(nodeList->empty())
//      return;

    //or instead - just set the score on the offending nodes to 0
//  for(;newEnd != nodeList->end(); ++newEnd)
//      (*newEnd)->ClearScore();

    //NegativeScore ns;
    //newEnd = remove_if(nodeList->begin(), nodeList->end(), ns);
    //nodeList->erase(newEnd, nodeList->end());
    //if(nodeList->empty())
    //  return;

#ifdef _DEBUG_PATH
    const char* frontSerialNum = nodeList->front()->GetCert()->SerialNumber();
#endif

    //reorder the list based on the scoring
    sort(nodeList->begin(), nodeList->end(), scoreCompare);

#ifdef _DEBUG_PATH
    const char* frontSerialNum2 = nodeList->front()->GetCert()->SerialNumber();

    CPKIFCertificateNodeListWithSourceInfo::iterator pos2;
    CPKIFCertificateNodeListWithSourceInfo::iterator end2 = nodeList->end();        
    cout << endl << "Dumping scoring info for subject" << endl;
    for(pos2 = nodeList->begin(); pos2 != end2; ++pos2)
    {
        const char* tmpSerialNum = (*pos2)->GetCert()->SerialNumber();
        const char* tmpIssName = (*pos2)->GetCert()->Issuer()->ToString();
        cout << "Issuer: " << tmpIssName << " serial: " << tmpSerialNum << " score: " << (*pos2)->GetScore() << endl;
    }

#endif
}

void CPKIFDefaultScoring::ScoreAndSortNodes(
    CPKIFNameAndKeyWithScoreListPtr& nodeList, 
    CPKIFCertificatePtr& prevCert, 
    CPKIFPathSettingsPtr& settings, 
    IPKIFTrustCache* trustCache,
    int numOfCAsBelowCurInPath, 
    IPKIFCertRepository* iCert)
{
    LOG_STRING_DEBUG("CPKIFDefaultScoring::ScoreAndSortNodes", TOOLKIT_PATH_MISC, 0, this);

    IPKIFTrustAnchorList rootList;
    CPKIFCertificateList certList;

    //score each node entry
    CPKIFNameAndKeyWithScoreList::iterator pos;
    CPKIFNameAndKeyWithScoreList::iterator end = nodeList->end();       

    CPKIFPolicyInformationListPtr initPolSet;
    settings->GetInitialPolicySet(initPolSet);

    IPKIFCryptoRaw * raw = GetPlatformCryptoRaw();
    for(pos = nodeList->begin(); pos != end; ++pos)
    {
        (*pos)->ClearScore();
        IPKIFNameAndKeyPtr curNK = (*pos)->GetNameAndKey();
        CPKIFCertificatePtr curCert = boost::dynamic_pointer_cast<CPKIFCertificate, IPKIFNameAndKey>(curNK);
        if(curCert == (CPKIFCertificate*)NULL)
            continue;
        CPKIFNamePtr curIssuer = curCert->Issuer();

#ifdef _DEBUG_PATH
        const char* curSubStr = curCert->Subject()->ToString();
#endif

        //see if cert is issued by someone in the trust store
        rootList.clear();
        trustCache->GetTrustRoots(curIssuer, rootList);     
        if(!rootList.empty())
            (*pos)->AddToScore(ISSUED_BY_TRUST_ROOT);

        //see if cert is issued by someone in the local cache
        //avoid picking up certs that we are currently operating on
        if(!CertIsSelfIssued(curCert))
        {
            //cert not self issued
            (*pos)->AddToScore(NOT_SELF_ISSUED);

            certList.clear();
            //iCert->GetCertificates(curIssuer, certList, LOCAL);
            //if(!certList.empty())
            //  (*pos)->AddToScore(ISSUED_BY_CERT_IN_CACHE);
        }

        if(!curCert->IsSelfSigned())
        {
            (*pos)->AddToScore(NOT_SELF_SIGNED);
        }

        //see if basic constraints is present and ca set
        CPKIFBasicConstraintsPtr basicConstraints;
        try {
        basicConstraints = curCert->GetExtension<CPKIFBasicConstraints>();
        } catch(...){}
        bool isCA = false;
        if(basicConstraints != (CPKIFBasicConstraints*)NULL)
        {
            if(basicConstraints->isCA())
                (*pos)->AddToScore(BASIC_CONSTRAINTS_PRESENT_AND_SET);
            else
            {
                (*pos)->ClearScore();
                continue;
            }
        }

        //----------------------------------------------------------------------------------------------------
        // added code to bump priority of certificates containing policies
        // and/or containing policies in the prev cert and/or in the 
        // settings object and/or deprioritize those that yield empty
        // intersection - 7/21/2005
        CPKIFPolicyInformationSetPtr cpsFromCert;
        try {
        cpsFromCert = curCert->GetExtension<CPKIFPolicyInformationSet>();
        }catch(...){}
        if(cpsFromCert != (CPKIFPolicyInformationSet*)NULL)
        {
            //give points for simply having a policy
            (*pos)->AddToScore(HAS_AT_ONE_POLICY);

            CPKIFPolicyMappingsPtr policyMappings;
            if(SomeMatch(cpsFromCert, initPolSet, policyMappings))
                (*pos)->AddToScore(MATCH_POLICY_WITH_SETTINGS);

            if(prevCert != (CPKIFCertificate*)NULL)
            {
                try {
                policyMappings = curCert->GetExtension<CPKIFPolicyMappings>();
                }catch(...){}
                CPKIFPolicyInformationSetPtr cpsFromPrevCert = prevCert->GetExtension<CPKIFPolicyInformationSet>();
                if(SomeMatch(cpsFromCert, cpsFromPrevCert,policyMappings))
                {
                    (*pos)->AddToScore(MATCH_POLICY_WITH_PREV_CERT);                    
                }
                //else if(!initPolSet->empty())
                //{
                //  (*pos)->ClearScore();
                //  (*pos)->SetPolicyIgnore();
                //  continue;
                //}
            }
        }

        //----------------------------------------------------------------------------------------------------

        //perform validity period check
        //changed from current time to settings based time - 7/19/2004
        CPKIFTimePtr curTime = settings->GetValidationTime();
        CPKIFValidityPtr val = curCert->Validity();
        CPKIFTimePtr startTime = val->notBefore();
        CPKIFTimePtr endTime = val->notAfter();
        if(*curTime > *startTime && *curTime < *endTime)
        {
            (*pos)->AddToScore(VAL_PERIOD_OK);
        }
        else
        {
            (*pos)->ClearScore();
            continue;
        }

        //see if algs chain properly
        if(prevCert != (CPKIFCertificate*)NULL)
        {
    #ifdef _DEBUG_PATH
        const char* prevSubStr = prevCert->Subject()->ToString();
    #endif
            CPKIFAlgorithmIdentifierPtr prevCertSigAlg = prevCert->SignatureAlgorithm();
            CPKIFAlgorithmIdentifierPtr curCertSigAlg = curCert->SubjectPublicKeyInfo()->alg();
            if(GetAlgClass(prevCertSigAlg) != GetAlgClass(curCertSigAlg))
            {
                (*pos)->ClearScore();
                continue;
            }
            else
            {
                (*pos)->AddToScore(ALGS_MATCH);
            }

            //check AKID/SKID chaining
            CPKIFAuthorityKeyIdentifierPtr akid;
            try {
            akid = prevCert->GetExtension<CPKIFAuthorityKeyIdentifier>();
            } catch(...){}
            if(akid != (CPKIFAuthorityKeyIdentifier*)NULL)
            {
                if(KeyIDsMatch(akid, curCert))
                {
                    (*pos)->AddToScore(KEY_IDS_MATCH);
                }
                else
                {
                    //if present but no match - clear the score 7/27/2005
//                  (*pos)->ClearScore();
                    try
                    {
                        if(/*CertIsSelfIssued(prevCert) && */!raw->VerifyCertificate(*curCert, *prevCert))
                        {
                            (*pos)->ClearScore();
                            continue;
                        }
                    }
                    catch(...)
                    {
                    }
                }
            }
        }
    }

    /*
    //before sorting remove any offending nodes
    BasicConstraintsViolation bcv;
    bcv.SetCACount(numOfCAsBelowCurInPath);
    CPKIFNameAndKeyWithScoreList::iterator newEnd = remove_if(nodeList->begin(), nodeList->end(), bcv);

    //or instead - just set the score on the offending nodes to 0
    for(;newEnd != nodeList->end(); ++newEnd)
        (*newEnd)->ClearScore();
        */

    //NegativeScore ns;
    //newEnd = remove_if(nodeList->begin(), nodeList->end(), ns);
    //nodeList->erase(newEnd, nodeList->end());
    //if(nodeList->empty())
    //  return;

#ifdef _DEBUG_PATH
    //const char* frontSerialNum = nodeList->front()->GetCert()->SerialNumber();
#endif

    //reorder the list based on the scoring
    sort(nodeList->begin(), nodeList->end(), scoreCompareNK);

#ifdef _DEBUG_PATH
    //const char* frontSerialNum2 = nodeList->front()->GetCert()->SerialNumber();

    CPKIFNameAndKeyWithScoreList::iterator pos2;
    CPKIFNameAndKeyWithScoreList::iterator end2 = nodeList->end();      
    cout << endl << "Dumping scoring info for subject" << endl;
    for(pos2 = nodeList->begin(); pos2 != end2; ++pos2)
    {
        //const char* tmpSerialNum = (*pos2)->GetCert()->SerialNumber();
        const char* tmpIssName = (*pos2)->GetNameAndKey()->GetIssuerName()->ToString();
        cout << "Issuer: " << tmpIssName << " score: " << (*pos2)->GetScore() << endl;
    }

#endif
}