PKIFCAPIRepository2.cpp

Go to the documentation of this file.

#include "PKIFCAPIRepository2.h"
#include "CAPIUtils.h" //added here 7/29/2004

#include "PKIFCacheErrors.h"
#include "PKIFCacheException.h"
#include "ToolkitUtils.h"

#include "Certificate.h"
#include "Buffer.h"
#include "CRL.h"
#include "CapiCRL.h"
#include "GottaMatch.h"
#include "PKIFCRLNodeEntry.h"
#include "PKIFLocalCertNode.h"
#include "PKIFLocalCrlNode.h"
#include "IssuingDistributionPoint.h"

#include "IPKIFSearchCriteria.h"
#include "KeyIDBasedSearch.h"
#include "NameBasedSearch.h"
#include "IssuerNameAndSerialNumberBasedSearch.h"

#include "boost/numeric/conversion/cast.hpp"
#include "boost/numeric/conversion/bounds.hpp"
#include "boost/limits.hpp"

using boost::numeric_cast;
using boost::bad_numeric_cast;

#include <atlbase.h>
#include <sstream>

using namespace boost;
using namespace std;

bool CharIsSpace(char c);
//added this interface stuff 8/21/2004

struct CPKIFCAPIRepository2Impl
{
    HCERTSTORE m_hSto;
    int m_nSysStoRegLoc;
    char* m_szStore;
    
    CPKIFCAPIRepository2 *m_parent;
    CPKIFCAPIRepository2Impl () 
    {
        m_parent = NULL;
    }
    CPKIFCAPIRepository2Impl (CPKIFCAPIRepository2  *p) 
    {
        m_parent = p;
    }

    //added 8/12/2004
    DWORD m_ticksCerts;
    DWORD m_ticksCRLs;

    //added 05/12/2003 CRW
    void OpenCertStore();
    void CloseCertStore();

};

CPKIFCAPIRepository2::CPKIFCAPIRepository2(
    int sysStoRegLoc,
    const char* store)
    :m_impl (new CPKIFCAPIRepository2Impl), IPKIFCAPISource(sysStoRegLoc, store)
{
    LOG_STRING_DEBUG("CPKIFCAPIRepository2::CPKIFCAPIRepository2(void)", TOOLKIT_SR_CAPIREPOSITORY, 0, this);

    m_impl->m_parent = this;
    m_impl->m_hSto = NULL;

    m_impl->m_nSysStoRegLoc = sysStoRegLoc;

    //Added 8/12/2004
    m_impl->m_ticksCerts = 0;
    m_impl->m_ticksCRLs = 0;

    m_impl->m_szStore = NULL;
    size_t len = 0;
    if(store)
    {
        len = strlen(store);
        m_impl->m_szStore = new char[len + 1];

        //reviewed 4/24
        strcpy(m_impl->m_szStore, store);
    }
}
CPKIFCAPIRepository2::~CPKIFCAPIRepository2(void)
{
    LOG_STRING_DEBUG("CPKIFCAPIRepository2::~CPKIFCAPIRepository2(void)", TOOLKIT_SR_CAPIREPOSITORY, 0, this);

    if(m_impl->m_szStore)
        delete[] m_impl->m_szStore;

    m_impl->CloseCertStore();

    delete m_impl;
    m_impl = NULL;
}
void CPKIFCAPIRepository2Impl::OpenCertStore()
{
    LOG_STRING_DEBUG("CPKIFCAPIRepository2::OpenCertStore", TOOLKIT_SR_CAPIREPOSITORY, 0, this);

    USES_CONVERSION;
    //read only access - 8/26/2004
    m_hSto =  CertOpenStore(CERT_STORE_PROV_SYSTEM, X509_ASN_ENCODING, NULL, 
                                CERT_STORE_OPEN_EXISTING_FLAG | CERT_STORE_READONLY_FLAG | m_nSysStoRegLoc , T2OLE(m_szStore));
    if(NULL == m_hSto)
    {
        std::ostringstream os;
        os << "CertOpenStore failed: " << GetLastError();
        RAISE_CACHE_EXCEPTION(os.str().c_str(), m_parent->thisComponent, CACHE_CERT_STORE_OPEN_FAILED, this)
    }
}
void CPKIFCAPIRepository2Impl::CloseCertStore()
{
    LOG_STRING_DEBUG("CPKIFCAPIRepository2::CloseCertStore()", TOOLKIT_SR_CAPIREPOSITORY, 0, this);
    if(NULL != m_hSto)
    {
        CertCloseStore(m_hSto, 0); m_hSto = NULL;
    }
}
void CPKIFCAPIRepository2::Initialize(void)
{
    LOG_STRING_DEBUG("CPKIFCAPIRepository2::Initialize(void)", TOOLKIT_SR_CAPIREPOSITORY, 0, this);

    if(NULL != m_impl->m_hSto)
    {
        LOG_STRING_WARN("Skipping initialization - CPKIFCAPIRepository2 instance already initialized", TOOLKIT_SR_CAPIREPOSITORY, COMMON_ALREADY_INITIALIZED, this);
        return; //already initialized - just log it, return and don't bother with exception
    }

    //generate any store open exceptions during initialization
    m_impl->OpenCertStore();
    m_impl->m_ticksCerts = GetTickCount();
    m_impl->m_ticksCRLs = GetTickCount();
}
void CPKIFCAPIRepository2::GetCertificates(
    const CPKIFNamePtr& subDN, 
    CPKIFCertificateList& certList,
    PKIInfoSource source)
{
    LOG_STRING_DEBUG("CPKIFCAPIRepository2::GetCertificates(const CPKIFNamePtr& subDN, CPKIFCertificateList& certList, PKIInfoSource source)", TOOLKIT_SR_CAPIREPOSITORY, 0, this);

    //ignore requests for remote certificates
    if(REMOTE == source)
    {
        LOG_STRING_DEBUG("Skipping CPKIFCAPIRepository2 - searching REMOTE sources only", thisComponent, 0, this);
        return;
    }

    DWORD curr = GetTickCount();
    if(curr - m_impl->m_ticksCerts > 120000)
    {
        m_impl->CloseCertStore();
        m_impl->OpenCertStore();
        m_impl->m_ticksCerts = curr;
    }
    const size_t origSize = certList.size();

    if(subDN)
    {
        PCCERT_CONTEXT cert = NULL;
        CERT_NAME_BLOB nameBlob; 
        nameBlob.cbData = 0; 
        nameBlob.pbData = NULL;

        //replaced reliance on CAPI DN encoder with Objective encoder
        CPKIFBufferPtr encName = subDN->Encoded();
        nameBlob.pbData = (BYTE*)encName->GetBuffer();
        nameBlob.cbData = encName->GetLength();

        //CACX509V3Name* raw = subDN->rawName();
        //CACASNWRAPPER_CREATE(CACX509V3Name, objPDU);
        //ASN1OpenType* data1 = objPDU.Encode(raw);
        //nameBlob.pbData = (BYTE*)data1->data;
        //nameBlob.cbData = data1->numocts;

        do
        {
            cert = CertFindCertificateInStore(m_impl->m_hSto, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 
                0, CERT_FIND_SUBJECT_NAME, &nameBlob, cert);
            if(NULL == cert)
                break;

            //create a CCACCert and stuff it into the list
            CPKIFCertificatePtr tmpCert(new CPKIFCertificate);
            try
            {
                tmpCert->Decode(cert->pbCertEncoded, cert->cbCertEncoded);
            }
            catch(CPKIFException& )
            {
                //EXCEPTION DELETION
                //don't fail due to parse errors - log the failure and continue searching
                //if nothing is found that actually parses then an error will be generated
                //delete e;

                #ifndef DISABLE_LOGGING_MACROS
                std::ostringstream os;
                os << "Failed to parse certificate from CAPI store searching for certificates issued to: " << subDN->ToString();
                #endif
                LOG_STRING_ERROR(os.str().c_str(), thisComponent, CACHE_PARSE_ERROR, this)
            }
            
            GottaMatch<CPKIFCertificatePtr> gm;
            gm.SetRHS(tmpCert);
            if(certList.end() == find_if(certList.begin(), certList.end(), gm))
                certList.push_back(tmpCert);

        }while(NULL != cert);
    }
    else
    {
        PCCERT_CONTEXT pPrevCertContext = NULL;

        try
        {
            pPrevCertContext = CertEnumCertificatesInStore(m_impl->m_hSto, pPrevCertContext);
            while(NULL != pPrevCertContext)
            {
                try
                {
                    CPKIFCertificatePtr tmpCert(new CPKIFCertificate);
                    tmpCert->Decode(pPrevCertContext->pbCertEncoded, pPrevCertContext->cbCertEncoded);

                    GottaMatch<CPKIFCertificatePtr> gm;
                    gm.SetRHS(tmpCert);
                    if(certList.end() == find_if(certList.begin(), certList.end(), gm))
                        certList.push_back(tmpCert);
                }
                catch(...)
                {
                    //ignore decoding errors
                }
                pPrevCertContext = CertEnumCertificatesInStore(m_impl->m_hSto, pPrevCertContext);
            }
        }
        catch(...)
        {
            if(NULL != pPrevCertContext)
            {
                //if we threw before freeing cert context, clean up
                CertFreeCertificateContext(pPrevCertContext); pPrevCertContext = NULL;
            }

            std::ostringstream os;
            os << "Unknown failure in GetCertificates while enumerating all trust anchors in the certificate store.  GetLastError returns: " << GetLastError();
            RAISE_CACHE_EXCEPTION(os.str().c_str(), thisComponent, COMMON_UNKNOWN_ERROR, this);
        }
    }

    //free the memory allocated in call to StrToName
    //if(NULL != nameBlob.pbData)
    //  PKIFDelete(nameBlob.pbData); //changed to PKIFDelete 12/7/2003

    if(origSize != certList.size())
    {
        #ifndef DISABLE_LOGGING_MACROS
        std::ostringstream os;
        os << "Found one or more certificates for subject: ";
        if(subDN)
            os << subDN->ToString();
        else
            os << "empty";
        #endif
        LOG_STRING_DEBUG(os.str().c_str(), thisComponent, 0, this);
    }
    else
    {
        #ifndef DISABLE_LOGGING_MACROS
        std::ostringstream os;
        os << "Failed to find a certificate for subject: ";
        if(subDN)
            os << subDN->ToString();
        else
            os << "empty";
        #endif
        LOG_STRING_INFO(os.str().c_str(), thisComponent, 0, this);
    }
}
void CPKIFCAPIRepository2::GetCRLs(
    const CPKIFCertificatePtr& cert, 
    CPKIFCRLList& crlList, 
    PKIInfoSource source)
{
    LOG_STRING_DEBUG("CPKIFCAPIRepository2::GetCRLs(const CPKIFCertificatePtr& cert, CPKIFCRLList& crlList, PKIInfoSource source)", TOOLKIT_SR_CAPIREPOSITORY, 0, this);

    //ignore requests for remote certificates
    if(REMOTE == source)
    {
        LOG_STRING_DEBUG("Skipping CPKIFCAPIRepository2 - searching REMOTE sources only", thisComponent, 0, this);
        return;
    }

    DWORD curr = GetTickCount();
    if(curr - m_impl->m_ticksCRLs > 120000)
    {
        m_impl->CloseCertStore();
        m_impl->OpenCertStore();
        m_impl->m_ticksCRLs = curr;
    }

    const size_t origSize = crlList.size();

    PCCRL_CONTEXT crl = NULL;
    PCCERT_CONTEXT certCtx = NULL;
    PCCERT_CONTEXT issuerCtx = NULL;

    if(cert == (CPKIFCertificate*)NULL)
    {
        RAISE_CACHE_EXCEPTION("NULL certificate passed to GetCRLs.", thisComponent, COMMON_INVALID_INPUT, this)
    }

    certCtx = CertCreateCertificateContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, cert->Encoded()->GetBuffer(), cert->Encoded()->GetLength());
    if(NULL == certCtx)
    {
        std::ostringstream os;
        os << "Failed to parse certificate passed to GetCRLs.  CertCreateCertificateContext failed: " << GetLastError();
        RAISE_CACHE_EXCEPTION(os.str().c_str(), thisComponent, CACHE_PARSE_ERROR, this)
    }

    issuerCtx = CertFindCertificateInStore(m_impl->m_hSto, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_SUBJECT_NAME, &certCtx->pCertInfo->Issuer, NULL);
    CertFreeCertificateContext(certCtx); certCtx = NULL;
    
    if(NULL == issuerCtx)
    {
        #ifndef DISABLE_LOGGING_MACROS
        std::ostringstream os;
        os << "Failed to find a CRL issued by: " << cert->Issuer()->ToString();
        #endif
        LOG_STRING_INFO(os.str().c_str(), thisComponent, 0, this);
        return;
    }

    do
    {   
        
        crl = CertFindCRLInStore(m_impl->m_hSto, 0, 0, CRL_FIND_ISSUED_BY, issuerCtx, crl);
        if(NULL == crl)
            break;

        //create a CPKIFCRL and stuff it into the list
        CPKIFCapiCRLPtr tmpCapiCRL(new CPKIFCapiCRL());
        tmpCapiCRL->SetCRL(CertDuplicateCRLContext(crl));
        CPKIFCRLPtr tmpCRL;
        CPKIFIssuingDistributionPointPtr idp = tmpCapiCRL->GetExtension<CPKIFIssuingDistributionPoint>();
        if(idp == (CPKIFIssuingDistributionPoint*)NULL || !idp->IndirectCRL())
        {
            //not indirect, use MSFT goo
            tmpCRL = dynamic_pointer_cast<CPKIFCRL, CPKIFCapiCRL>(tmpCapiCRL);
        }
        else
        {
            CPKIFCRLPtr tmpNonCapiCRL(new CPKIFCRL);
            tmpNonCapiCRL->Decode(crl->pbCrlEncoded, crl->cbCrlEncoded);
            tmpCRL = tmpNonCapiCRL;
        }

        GottaMatch<CPKIFCRLPtr> gm;
        gm.SetRHS(tmpCRL);
        if(crlList.end() == find_if(crlList.begin(), crlList.end(), gm))
            crlList.push_back(tmpCRL);

    }while(NULL != crl);

    CertFreeCertificateContext(issuerCtx);
    

    if(origSize != crlList.size())
    {
        #ifndef DISABLE_LOGGING_MACROS
        std::ostringstream os;
        os << "Found one or more CRLs issued by: " << cert->Issuer()->ToString();
        #endif
        LOG_STRING_DEBUG(os.str().c_str(), thisComponent, 0, this);
    }
    else
    {
        #ifndef DISABLE_LOGGING_MACROS
        std::ostringstream os;
        os << "Failed to find a CRL issued by: " << cert->Issuer()->ToString();
        #endif
        LOG_STRING_INFO(os.str().c_str(), thisComponent, 0, this);
    }
}
void CPKIFCAPIRepository2::GetCRLSources(
    const CPKIFCertificatePtr& cert,
    CPKIFCrlSourceList& crlSourceList,
    PKIInfoSource source)
{
    LOG_STRING_DEBUG("CPKIFCAPIRepository2::GetCRLs(const CPKIFCertificatePtr& cert, CPKIFCRLList& crlList, PKIInfoSource source)", TOOLKIT_SR_CAPIREPOSITORY, 0, this);

    //ignore requests for remote certificates
    if(REMOTE == source)
    {
        LOG_STRING_DEBUG("Skipping CPKIFCAPIRepository2 - searching REMOTE sources only", thisComponent, 0, this);
        return;
    }

    DWORD curr = GetTickCount();
    if(curr - m_impl->m_ticksCRLs > 120000)
    {
        m_impl->CloseCertStore();
        m_impl->OpenCertStore();
        m_impl->m_ticksCRLs = curr;
    }

    const size_t origSize = crlSourceList.size();

    PCCRL_CONTEXT crl = NULL;
    PCCERT_CONTEXT certCtx = NULL;
    PCCERT_CONTEXT issuerCtx = NULL;

    if(cert == (CPKIFCertificate*)NULL)
    {
        RAISE_CACHE_EXCEPTION("NULL certificate passed to GetCRLSources.", thisComponent, COMMON_INVALID_INPUT, this)
    }

    certCtx = CertCreateCertificateContext(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, cert->Encoded()->GetBuffer(), cert->Encoded()->GetLength());
    if(NULL == certCtx)
    {
        std::ostringstream os;
        os << "Failed to parse certificate passed to GetCRLs.  CertCreateCertificateContext failed: " << GetLastError();
        RAISE_CACHE_EXCEPTION(os.str().c_str(), thisComponent, CACHE_PARSE_ERROR, this)
    }

    issuerCtx = CertFindCertificateInStore(m_impl->m_hSto, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_SUBJECT_NAME, &certCtx->pCertInfo->Issuer, NULL);
    CertFreeCertificateContext(certCtx); certCtx = NULL;
    
    if(NULL == issuerCtx)
    {
        #ifndef DISABLE_LOGGING_MACROS
        std::ostringstream os;
        os << "Failed to find a CRL issued by: " << cert->Issuer()->ToString();
        #endif
        LOG_STRING_INFO(os.str().c_str(), thisComponent, 0, this);
        return;
    }

    do
    {   
        crl = CertFindCRLInStore(m_impl->m_hSto, 0, 0, CRL_FIND_ISSUED_BY, issuerCtx, crl);
        if(NULL == crl)
            break;

        CPKIFCRLNodeEntryPtr crlNode(new CPKIFCRLNodeEntry);

        //create a CPKIFCapiCRL and stuff it into the list
        CPKIFCapiCRLPtr tmpCapiCRL(new CPKIFCapiCRL());
        try
        {
            tmpCapiCRL->SetCRL(CertDuplicateCRLContext(crl));

            CPKIFIssuingDistributionPointPtr idp = tmpCapiCRL->GetExtension<CPKIFIssuingDistributionPoint>();
            if(idp == (CPKIFIssuingDistributionPoint*)NULL || !idp->IndirectCRL())
            {
                //not indirect, use MSFT goo
                CPKIFCRLPtr tmpCRL = dynamic_pointer_cast<CPKIFCRL, CPKIFCapiCRL>(tmpCapiCRL);
                crlNode->SetCRL(tmpCRL);
            }
            else
            {
                CPKIFCRLPtr tmpCRL(new CPKIFCRL);
                tmpCRL->Decode(crl->pbCrlEncoded, crl->cbCrlEncoded);
                crlNode->SetCRL(tmpCRL);
            }
            ostringstream ostr;
            ostr << "CAPI://";
            switch(m_impl->m_nSysStoRegLoc)
            {
            case CERT_SYSTEM_STORE_CURRENT_USER:
                ostr << "CERT_SYSTEM_STORE_CURRENT_USER";
                break;
            case CERT_SYSTEM_STORE_LOCAL_MACHINE:
                ostr << "CERT_SYSTEM_STORE_LOCAL_MACHINE";
                break;
            default:
                ostr << m_impl->m_nSysStoRegLoc;
                break;
            }
            ostr << "/" << m_impl->m_szStore << "/" << cert->GetIssuerName()->ToString() << ends;

            CPKIFLocalCrlNodePtr lcn(new CPKIFLocalCrlNode());
            lcn->SetState(PAS_AVAILABLE);

            std::string capiURI = ostr.str();
            crlNode->AddSource(capiURI);
            lcn->AddCrl(crlNode);
            crlSourceList.push_back(lcn);
        }
        catch(CPKIFException& )
        {
            //EXCEPTION DELETION
            //don't fail due to parse errors - log the failure and continue searching
            //if nothing is found that actually parses then an error will be generated
            //delete e;

            #ifndef DISABLE_LOGGING_MACROS
            std::ostringstream os;
            os << "Failed to parse CRL from CAPI store searching for certificates CRLs issued by: " << cert->Issuer()->ToString();
            #endif
            LOG_STRING_ERROR(os.str().c_str(), thisComponent, CACHE_PARSE_ERROR, this)
        }
    }while(NULL != crl);

    CertFreeCertificateContext(issuerCtx);
    
    if(origSize != crlSourceList.size())
    {
        #ifndef DISABLE_LOGGING_MACROS
        std::ostringstream os;
        os << "Found one or more CRLs issued by: " << cert->Issuer()->ToString();
        #endif
        LOG_STRING_DEBUG(os.str().c_str(), thisComponent, 0, this);
    }
    else
    {
        #ifndef DISABLE_LOGGING_MACROS
        std::ostringstream os;
        os << "Failed to find a CRL issued by: " << cert->Issuer()->ToString();
        #endif
        LOG_STRING_INFO(os.str().c_str(), thisComponent, 0, this);
    }
}
void CPKIFCAPIRepository2::GetCertificates(
    const CPKIFCertificatePtr& certOfInterest, 
    CPKIFCertificateList& certList,     
    PKIInfoSource source, 
    PathBuildingDirection pbd)
{
    LOG_STRING_DEBUG("CPKIFCAPIRepository2::GetCertificates(const CPKIFCertificatePtr& cert, CPKIFCertificateList& certList, PKIInfoSource source = ALL, PathBuildingDirection pbd = PBD_FORWARD)", TOOLKIT_SR_CAPIREPOSITORY, 0, this);

    //ignore requests for remote certificates
    if(REMOTE == source)
    {
        LOG_STRING_DEBUG("Skipping CPKIFCAPIRepository2 - searching REMOTE sources only", thisComponent, 0, this);
        return;
    }

    DWORD curr = GetTickCount();
    if(curr - m_impl->m_ticksCerts > 120000)
    {
        m_impl->CloseCertStore();
        m_impl->OpenCertStore();
        m_impl->m_ticksCerts = curr;
    }
    const size_t origSize = certList.size();

    PCCERT_CONTEXT cert = NULL;
    CERT_NAME_BLOB nameBlob; 
    nameBlob.cbData = 0; 
    nameBlob.pbData = NULL;

    //replaced reliance on CAPI DN encoder with Objective encoder
    CPKIFNamePtr issDN = certOfInterest->Issuer();
    CPKIFBufferPtr encName = issDN->Encoded();
    nameBlob.pbData = (BYTE*)encName->GetBuffer();
    nameBlob.cbData = encName->GetLength();

    do
    {
        if(PBD_FORWARD == pbd)
            cert = CertFindCertificateInStore(m_impl->m_hSto, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 
                0, CERT_FIND_SUBJECT_NAME, &nameBlob, cert);
        else
            cert = CertFindCertificateInStore(m_impl->m_hSto, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 
                0, CERT_FIND_ISSUER_NAME, &nameBlob, cert);
        if(NULL == cert)
            break;

        //create a CCACCert and stuff it into the list
        CPKIFCertificatePtr tmpCert(new CPKIFCertificate);
        try
        {
            tmpCert->Decode(cert->pbCertEncoded, cert->cbCertEncoded);
        }
        catch(CPKIFException& )
        {
            //EXCEPTION DELETION
            //don't fail due to parse errors - log the failure and continue searching
            //if nothing is found that actually parses then an error will be generated
            //delete e;

            #ifndef DISABLE_LOGGING_MACROS
            std::ostringstream os;
            os << "Failed to parse certificate from CAPI store searching for certificates issued by: " << issDN->ToString();
            #endif
            LOG_STRING_ERROR(os.str().c_str(), thisComponent, CACHE_PARSE_ERROR, this)
        }
        
        GottaMatch<CPKIFCertificatePtr> gm;
        gm.SetRHS(tmpCert);
        if(certList.end() == find_if(certList.begin(), certList.end(), gm))
            certList.push_back(tmpCert);

    }while(NULL != cert);

    //free the memory allocated in call to StrToName
    //if(NULL != nameBlob.pbData)
    //  PKIFDelete(nameBlob.pbData); //changed to PKIFDelete 12/7/2003

    if(origSize != certList.size())
    {
        #ifndef DISABLE_LOGGING_MACROS
        std::ostringstream os;
        os << "Found one or more certificates issued by: " << issDN->ToString();
        #endif
        LOG_STRING_DEBUG(os.str().c_str(), thisComponent, 0, this);
    }
    else
    {
        #ifndef DISABLE_LOGGING_MACROS
        std::ostringstream os;
        os << "Failed to find a certificate issued by: " << issDN->ToString();
        #endif
        LOG_STRING_INFO(os.str().c_str(), thisComponent, 0, this);
    }
}
void CPKIFCAPIRepository2::GetCertificateSources(
    const CPKIFCertificatePtr& cert, 
    CPKIFCertificateSourceList& certs, 
    PathBuildingDirection pbd)
{
    CPKIFCertificateList certList;
    GetCertificates(cert, certList, LOCAL);

    //only collect this as a source if the list is not empty - else just return
    if(!certList.empty())
    {
        CPKIFLocalCertNodePtr lcn(new CPKIFLocalCertNode(pbd));
        lcn->SetState(PAS_AVAILABLE);

        CPKIFCertificateList::iterator pos;
        CPKIFCertificateList::iterator end = certList.end();
        for(pos = certList.begin(); pos != end; ++pos)
        {
            CPKIFCertificateNodeEntryPtr certNode(new CPKIFCertificateNodeEntry);
            certNode->SetCert(*pos);

            ostringstream ostr;
            ostr << "CAPI://";
            switch(m_impl->m_nSysStoRegLoc)
            {
            case CERT_SYSTEM_STORE_CURRENT_USER:
                ostr << "CERT_SYSTEM_STORE_CURRENT_USER";
                break;
            case CERT_SYSTEM_STORE_LOCAL_MACHINE:
                ostr << "CERT_SYSTEM_STORE_LOCAL_MACHINE";
                break;
            default:
                ostr << m_impl->m_nSysStoRegLoc;
                break;
            }
            ostr << "/" << m_impl->m_szStore << "/" << cert->Issuer()->ToString() << "/" << cert->SerialNumber() << ends;

            std::string capiURI = ostr.str();
            certNode->AddSource(capiURI);   
            certNode->SetState(PAS_AVAILABLE);

            lcn->AddSource(capiURI);        
            lcn->AddCertificate(certNode);
        }

        certs.push_back(lcn);
    }
}

void CPKIFCAPIRepository2::FindCertificates(
    IPKIFSearchCriteria* searchCriteria,
    CPKIFCertificateList& certList,
    PKIInfoSource source)
{
    LOG_STRING_DEBUG("CPKIFCAPIUserRepository2::FindCertificates", TOOLKIT_SR_CAPIUSERREPOSITORY, 0, this);

    //ignore requests for remote certificates
    if(REMOTE == source || NULL == searchCriteria)
    {
        LOG_STRING_DEBUG("Skipping CPKIFCAPIUserRepository2 - searching REMOTE sources only or NULL search criteria", thisComponent, 0, this);
        return;
    }

    void* ptrToSearchCriteria = NULL;
    DWORD findType = 0;

    //possible structures
    PCCERT_CONTEXT cert = NULL;
    CERT_NAME_BLOB nameBlob; 
    nameBlob.cbData = 0; 
    nameBlob.pbData = NULL;

    CERT_ID certID;
    certID.IssuerSerialNumber.Issuer.pbData = NULL;
    certID.IssuerSerialNumber.SerialNumber.pbData = NULL;

    switch(searchCriteria->GetSearchType())
    {
    case ALLCERTS:
        findType = CERT_FIND_ANY;
        break;
    case ISSUERNAME:
        {
            CPKIFNameBasedSearch* nbs = dynamic_cast<CPKIFNameBasedSearch*>(searchCriteria);
            StrToName(nbs->GetStringName(), &nameBlob.pbData, &nameBlob.cbData);
            if(0 != nameBlob.cbData)
            {
                ptrToSearchCriteria = &nameBlob;
                findType = CERT_FIND_ISSUER_NAME;
            }
            else
                return;
        }
        break;
    case SUBJECTNAME:
        {
            CPKIFNameBasedSearch* nbs = dynamic_cast<CPKIFNameBasedSearch*>(searchCriteria);
            StrToName(nbs->GetStringName(), &nameBlob.pbData, &nameBlob.cbData);
            if(0 != nameBlob.cbData)
            {
                ptrToSearchCriteria = &nameBlob;
                findType = CERT_FIND_SUBJECT_NAME;
            }
            else
                return;
        }
        break;
    case ISSUERSERIAL:
        {
            CPKIFIssuerNameAndSerialNumberBasedSearch* inasnbs = dynamic_cast<CPKIFIssuerNameAndSerialNumberBasedSearch*>(searchCriteria);
            CPKIFNamePtr issuerName = inasnbs->GetIssuerName();
            certID.dwIdChoice = CERT_ID_ISSUER_SERIAL_NUMBER;
            StrToName(issuerName->ToString(), &certID.IssuerSerialNumber.Issuer.pbData, &certID.IssuerSerialNumber.Issuer.cbData);
            const char* sn = inasnbs->GetSerialNumber();

            size_t len = strlen(sn) - 2;
            unsigned int iLen = 0;
            if(len > boost::numeric::bounds<unsigned int>::highest())
            {
                throw CPKIFCacheException(TOOLKIT_SR_CAPIUSERREPOSITORY, COMMON_INVALID_INPUT, "Serial number too big.");
            }
            else
                iLen = numeric_cast<unsigned int>(len);

            unsigned char* binSN = new unsigned char[iLen];
            atob((char*)binSN, (char*)sn+2, &iLen);
            ReverseBytes(binSN, iLen);
            certID.IssuerSerialNumber.SerialNumber.cbData = iLen;
            certID.IssuerSerialNumber.SerialNumber.pbData = binSN;
            ptrToSearchCriteria = &certID;
            findType = CERT_FIND_CERT_ID;
            break;
        }
    case KEYID:
        {
            CPKIFKeyIDBasedSearch* kidbs = dynamic_cast<CPKIFKeyIDBasedSearch*>(searchCriteria);
            if(!kidbs)
                return;

            CPKIFBufferPtr kid = kidbs->GetKeyID();

            CRYPT_HASH_BLOB chb;
            chb.cbData = kid->GetLength();
            chb.pbData = (BYTE*)kid->GetBuffer();

            ptrToSearchCriteria = &chb;
            findType = CERT_FIND_KEY_IDENTIFIER;
            break;
        }
    default:
        return;
    };

    do
    {
        cert = CertFindCertificateInStore(m_impl->m_hSto, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 
            0, findType, ptrToSearchCriteria, cert);
        if(NULL == cert)
            break;

        //create a CCACCert and stuff it into the list
        CPKIFCertificatePtr tmpCert(new CPKIFCertificate);
        try
        {
            tmpCert->Decode(cert->pbCertEncoded, cert->cbCertEncoded);

            GottaMatch<CPKIFCertificatePtr> gm;
            gm.SetRHS(tmpCert);
            if(certList.end() == find_if(certList.begin(), certList.end(), gm))
                certList.push_back(tmpCert);

//          certList.push_back(tmpCert); //moved this here from below catch block
                                        //else non-parsed certs end up in the list
        }
        catch(CPKIFException&)
        {
            //EXCEPTION DELETION
            //don't fail due to parse errors - log the failure and continue searching
            //if nothing is found that actually parses then an error will be generated
            //delete e;

            LOG_STRING_ERROR("Failed to parse certificate from CAPI store." , thisComponent, CACHE_PARSE_ERROR, this)
        }
    }while(NULL != cert);

    //free the memory allocated in call to StrToName
    if(NULL != nameBlob.pbData)
        PKIFDelete(nameBlob.pbData); //changed to PKIFDelete 12/7/2003
    if(NULL != certID.IssuerSerialNumber.Issuer.pbData)
        PKIFDelete(certID.IssuerSerialNumber.Issuer.pbData); //changed to PKIFDelete 12/7/2003
    if(NULL != certID.IssuerSerialNumber.SerialNumber.pbData)
        PKIFDelete(certID.IssuerSerialNumber.SerialNumber.pbData); //changed to PKIFDelete 12/7/2003
}