PKIFPathLogger.cpp

Go to the documentation of this file.

#define _DISABLE_LOG4CXX_PATH_LOGGING 1
#include "PKIFPathLogger.h"

#include "ToolkitUtils.h"
#include "components.h"

#include "PKIFCertificateNodeEntry.h"
#include "Certificate.h"
#include "Name.h"
#include "Validity.h"
#include "PolicyInformation.h"
#include "PKIFTime.h"
#include "BuilderStatistics.h"
#include "PKIFCertificatePath.h"
#include "PKIFCertStatus.h"
#include "RevocationSource.h"
#include "PKIFCRLInfo.h"
#include "CRL.h"
#include "CRLEntry.h"
#include "PKIFOCSPInfo.h"
#include "OCSPResponse.h"
#include "ResponseBytes.h"
#include "BasicOCSPResponse.h"
#include "ResponseData.h"
#include "ResponderID.h"
#include "SingleResponse.h"
#include "CertID.h"
#include "PKIFTrustRoot.h"
#include "PKIFPathSettings.h"
#include "CSingletonLDAPConnection.h"
#include "HttpServerBlacklist.h"

#include "Buffer.h"
#include "OID.h"
#include "AlgorithmIdentifier.h"
#include "PathResults.h"

#include "ooasn1.h"
#include "asn1ber.h"
#include "OCSP.h"

#include <iostream>
#include <fstream>
#include <sstream>
#ifndef _DISABLE_LOG4CXX_PATH_LOGGING 
#include "log4cxx/logger.h"
#endif


#include "boost/thread/recursive_mutex.hpp"

using namespace std;
using namespace boost;

boost::recursive_mutex g_me;

CPKIFPathLogger::CPKIFPathLogger(void)
{
    LOG_STRING_DEBUG("CPKIFPathLogger::CPKIFPathLogger()", TOOLKIT_PATH_MISC, 0, this);
}
CPKIFPathLogger::~CPKIFPathLogger()
{
    LOG_STRING_DEBUG("CPKIFPathLogger::~CPKIFPathLogger()", TOOLKIT_PATH_MISC, 0, this);

}

// XXX TODO Clean this logging stuff up.  We probably want something a little more elegant.
//extern std::ofstream* g_pathLogFile; //handled in ToolkitUtils.cpp
//workaround so this compiles for Armen
std::ostringstream g_pathLogFile;

void PrintCertInfo(
    CPKIFCertificatePtr& cert,
    char* token, 
    ostream* o)
{
    *o << token << "Issuer DN\t: " << cert->Issuer()->ToString() << endl;
    *o << token << "Serial Number\t: " << cert->SerialNumber() << endl;
    *o << token << "Subject DN\t: " << cert->Subject()->ToString() << endl;
    *o << token << "Not Before\t: " << cert->Validity()->notBefore()->GetTime() << endl;
    *o << token << "Not After\t: " << cert->Validity()->notAfter()->GetTime() << endl;
}

void PrintCertInfo(
    CPKIFCertificateNodeEntry& certNode,
    char* token, 
    ostream* o)
{
    CPKIFCertificatePtr cert = certNode.GetCert();
    PrintCertInfo(cert, token, o);
}
void DumpPolicyTable(
    const vector<CPKIFPolicyInformationListPtr>& authSet, 
    ostream* o )
{
    vector<CPKIFPolicyInformationListPtr>::const_iterator authSetPos;
    vector<CPKIFPolicyInformationListPtr>::const_iterator authSetEnd = authSet.end();
    int rowCount = 0;
    for(authSetPos = authSet.begin(); authSetPos != authSetEnd; ++authSetPos,++rowCount)
    {
        *o << "\t+ Row: " << rowCount << endl;
        CPKIFPolicyInformationList::const_iterator authSetPolPos;
        CPKIFPolicyInformationList::const_iterator authSetPolEnd = (*authSetPos)->end();
        for(authSetPolPos = (*authSetPos)->begin(); authSetPolPos != authSetPolEnd; ++authSetPolPos)
        {
            *o << "\t\t* " << (*authSetPolPos)->PolicyOID()->ToString() << endl;
        }
    }
    if(authSet.empty())
        *o << "\t+ Empty" << endl;

}
void DumpPolicySet(
    CPKIFPolicyInformationListPtr& polSet, 
    ostream* o )
{
    if(polSet == (CPKIFPolicyInformationList*)NULL)
    {
        *o << "\t+ NULL" << endl;
        return;
    }

    if(polSet->empty())
    {
        *o << "\t+ Empty" << endl;
        return;
    }

    CPKIFPolicyInformationList::const_iterator authSetPolPos;
    CPKIFPolicyInformationList::const_iterator authSetPolEnd = polSet->end();
    for(authSetPolPos = polSet->begin(); authSetPolPos != authSetPolEnd; ++authSetPolPos)
    {
        *o << "\t+ " << (*authSetPolPos)->PolicyOID()->ToString() << endl;
    }
}
void CPKIFPathLogger::LogPath(
    CPKIFCertificatePath& path, 
    const char* appInfo, 
    ostream* out)
{
    LOG_STRING_DEBUG("CPKIFPathLogger::LogPath", TOOLKIT_PATH_MISC, 0, NULL);

    boost::recursive_mutex::scoped_lock lock(g_me);
    ostream* o = out;
    bool bClearGlobal = false;
    // using NULL here generates a warning in GCC. 0 is the official c++ standard way.
    if(0 == o && 0 != g_pathLogFile.tellp())
    {
        //this should not be necessary.  when this function is invoked such that the output
        //lands in the log4cxx goo, o is passed by LogValidationResults.  if this path is ever executed,
        //the string buffer isn't logged or cleared.
        //o = &g_pathLogFile;
    }
    if(0 == o)
        return;

    char errBuf[MAX_ERROR_CODE_STRING_SIZE];

    //----------------------------------------------------------------------------------------------------
    // print info from path
    //----------------------------------------------------------------------------------------------------
    *o << endl;
    *o << "---------------------------------------------------------------------------------------" << endl;
    if(NULL != appInfo)
        *o << appInfo << endl;
    *o << "Printing information from certificate path" << endl;
    *o << "---------------------------------------------------------------------------------------" << endl;
    CPKIFBuilderStatisticsPtr bs;
    path.GetBuilderStats(bs);
    if(bs != (CPKIFBuilderStatistics*)NULL)
    {
        *o << "- Discovered " << bs->m_nTotalPathsDiscovered << " total paths." << endl;
        *o << "- Discovered " << bs->m_nPathsRejectedDueToValidationErrors << " paths that failed basic validation checks." << endl;
        *o << "- Returned " << bs->m_nReturnedPaths << " paths for external inspection." << endl;

        if(0 < bs->m_nPathsRejectedDueToValidationErrors)
        {
            vector<int>::iterator fPos = bs->m_vFailureCodes.begin();
            vector<int>::iterator fEnd = bs->m_vFailureCodes.end();
            *o << "The following diagnostic codes were associated with the validation failures: ";
            for(;fPos != fEnd; ++fPos)
            {
                *o << *fPos;
                if(fPos + 1 == fEnd)
                    *o << "." << endl;
                else
                    *o << ", ";
            }
        }
    }
    else
        *o << "- No builder statistics available" << endl;

    std::vector<std::string> blacklist;
    PKIFLDAP::GetServerBlacklist(blacklist);

    *o << "- Blacklisted LDAP servers: ";
    if(!blacklist.empty())
    {
        std::vector<std::string>::iterator blPos;
        std::vector<std::string>::iterator blEnd = blacklist.end();
        for(blPos = blacklist.begin(); blPos != blEnd; ++blPos)
        {
            if(blPos != blacklist.begin())
                *o << ", ";
            *o << (*blPos).c_str();
        }
        *o << endl;
    }
    else
    {
        *o << "none" << endl;
    }

    blacklist.clear();
    PKIFHTTP::GetHttpServerBlacklist(blacklist);

    *o << "- Blacklisted HTTP servers: ";
    if(!blacklist.empty())
    {
        std::vector<std::string>::iterator blPos;
        std::vector<std::string>::iterator blEnd = blacklist.end();
        for(blPos = blacklist.begin(); blPos != blEnd; ++blPos)
        {
            if(blPos != blacklist.begin())
                *o << ", ";
            *o << (*blPos).c_str();
        }
        *o << endl;
    }
    else
    {
        *o << "none" << endl;
    }

    CPKIFCertificateNodeList certList;
    path.GetPath(certList);

    *o << "- Dumping certificate path and certificate status info" << endl;

    //output trust anchor details
    IPKIFTrustAnchorPtr root;
    path.GetTrustRoot(root);
    if(root)
    {
        *o << "\t+  Trust Anchor" << endl;

        CPKIFCertificatePtr rootCert;
        CPKIFTrustRootPtr taPtr = dynamic_pointer_cast<CPKIFTrustRoot, IPKIFTrustAnchor>(root);
        if(taPtr)
        {
            taPtr->GetCert(rootCert);
        }

        if(rootCert)
        {
            PrintCertInfo(rootCert, "\t\t* ", o);
        }
        else
        {
            *o << "\t\t* " << "Trust Anchor DN\t: " << root->GetSubjectName()->ToString() << endl;
        }
    }

    CPKIFCertificateNodeList::iterator pos;
    CPKIFCertificateNodeList::iterator end = certList.end();
    int ii = 1;
    for(pos = certList.begin(); pos != end; ++pos, ++ii)
    {
        *o << "\t+  Certificate #" << ii << endl;

        PrintCertInfo(*(*pos), "\t\t* ", o);

        PKIInfoSource source = (*pos)->GetSource();
        *o << "\t\t\t+ Source: ";
        switch(source)
        {
        case LOCAL:
            *o << "LOCAL" << endl;
            break;
        case REMOTE:
            *o << "REMOTE" << endl;
            break;
        case ALL:
            *o << "ALL" << endl;
            break;
        default:
            *o << "UNKNOWN" << endl;
            break;
        }

        *o << "\t\t\t+ Builder score: " << (*pos)->GetScore() << endl;

        vector<string> sourceURIs;
        (*pos)->GetSources(sourceURIs);
        if(!sourceURIs.empty())
        {
            *o << "\t\t\t+ Retrieved from: "; 
            vector<string>::iterator uriPos;
            vector<string>::iterator uriEnd = sourceURIs.end();
            for(uriPos = sourceURIs.begin(); uriPos != uriEnd; ++uriPos)
            {
                if(sourceURIs.begin() != uriPos)
                    *o << ", ";
                *o << *uriPos;
            }
            *o << endl;
        }

        CPKIFCertStatusPtr posStatus = (*pos)->GetStatus();
        if(posStatus == (CPKIFCertStatus*)NULL)
        {
            *o << "\t\t\t+ NO CERT STATUS INFO" << endl;
            continue;
        }
        if(posStatus->GetIsTrustAnchor())
            *o << "\t\t\t+ Is a trust anchor" << endl;
        else
            *o << "\t\t\t+ Is not a trust anchor" << endl;

        *o << "\t\t\t+ diagnostic code: " << posStatus->GetDiagnosticCode() << " : " << GetErrorCodeString(posStatus->GetDiagnosticCode(), errBuf) << endl;

        if(posStatus->GetPassedValidationChecks())
            *o << "\t\t\t+ Basic checks successfully performed" << endl;
        else
            *o << "\t\t\t+ Basic checks not successfully performed" << endl;

        if(posStatus->GetSignatureVerified())
            *o << "\t\t\t+ Signature successfully verified" << endl;
        else
            *o << "\t\t\t+ Signature not successfully verified" << endl;

        RevocationStatus rs = posStatus->GetRevocationStatus();
        switch(rs)
        {
        case REVOKED:
            *o << "\t\t\t+ Revocation status: REVOKED" << endl;
            break;
        case NOT_CHECKED:
            *o << "\t\t\t+ Revocation status: NOT CHECKED" << endl;
            break;
        case NOT_REVOKED:
            *o << "\t\t\t+ Revocation status: NOT REVOKED" << endl;
            break;
        case SERVER_CHECKED:
            *o << "\t\t\t+ Revocation status: SERVER CHECKED" << endl;
            break;
        default:
            *o << "\t\t\t+ Revocation status: UNKNOWN" << endl;
        }

        //revocation sources
        RevocationSourceList rsl;
        posStatus->GetRevocationSources(rsl);

        RevocationSourceList::iterator rslPos;
        RevocationSourceList::iterator rslEnd = rsl.end();
        int count = 0;
        for(rslPos = rsl.begin(), count = 1; rslPos != rslEnd; ++rslPos, ++count)
        {
            *o << "\t\t\t+ Revocation source #" << count << endl;
            *o << "\t\t\t\t- Revocation source error code: " << (*rslPos)->m_errorCode << " : " << GetErrorCodeString((*rslPos)->m_errorCode, errBuf) << endl;
            *o << "\t\t\t\t- Revocation source type: " << (*rslPos)->m_sourceType << endl;
            switch((*rslPos)->m_status)
            {
            case REVOKED:
                *o << "\t\t\t\t- Revocation source status: REVOKED" << endl;
                break;
            case NOT_REVOKED:
                *o << "\t\t\t\t- Revocation source status: NOT_REVOKED" << endl;
                break;
            case NOT_CHECKED:
                *o << "\t\t\t\t- Revocation source status: NOT_CHECKED" << endl;
                break;
            case SERVER_CHECKED:
                *o << "\t\t\t\t- Revocation source status: SERVER_CHECKED" << endl;
                break;
            }

            IPKIFRevSourceInfoPtr rsip = (*rslPos)->m_sourceInfo;
            switch((*rslPos)->m_sourceType)
            {
            case REVSOURCE_CRL:
                {
                    
                    CPKIFCRLInfoPtr crlInfo = RevInfoCast<CPKIFCRLInfo>(rsip);
            
                    CPKIFCRLList crls;
                    crlInfo->GetCRLs(crls);
    
                    CPKIFCRLList::iterator crlPos;
                    CPKIFCRLList::iterator crlEnd = crls.end();
                    int crlCount = 1;
                    for(crlPos = crls.begin(); crlPos != crlEnd; ++crlPos, ++crlCount)
                    {
                        *o << "\t\t\t\t- CRL #" << crlCount << endl;
                        *o << "\t\t\t\t\t+ CRL issuer: " << (*crlPos)->Issuer()->ToString() << endl;
                        CPKIFTimePtr thisUpdate = (*crlPos)->ThisUpdate();
                        if(thisUpdate != (CPKIFTime*)NULL)
                        {
                            *o << "\t\t\t\t\t+ thisUpdate: " << thisUpdate->GetTime() << endl;
                        }
                        CPKIFTimePtr nextUpdate = (*crlPos)->NextUpdate();
                        if(nextUpdate != (CPKIFTime*)NULL)
                        {
                            *o << "\t\t\t\t\t+ nextUpdate: " << nextUpdate->GetTime() << endl;
                        }
                    }

                    CPKIFCRLEntryPtr crlEntry = crlInfo->GetCRLEntry();
                    if(/*REVOKED == (*rslPos)->m_status*/crlEntry != (CPKIFCRLEntry*)NULL)
                    {
                        *o << "\t\t\t\t\t+ serial number from CRL entry: " << crlEntry->SerialNumber() << endl;
                        CPKIFTimePtr revDate = crlEntry->RevocationDate();
                        if(revDate != (CPKIFTime*)NULL)
                        {
                            *o << "\t\t\t\t\t+ revocation date from CRL entry: " << revDate->GetTime() << endl;
                        }
                    }
                }
                break;
            case REVSOURCE_OCSP:
                {
                    if(rsip != (IPKIFRevSourceInfo*)NULL)
                    {
                        CPKIFOCSPInfoPtr ocspInfo = RevInfoCast<CPKIFOCSPInfo>(rsip);

                        if(ocspInfo != (CPKIFOCSPInfo*)NULL)
                        {
                            //----------------------------------------------------------------------------------------------------
                            //  general response information
                            //----------------------------------------------------------------------------------------------------
                            CPKIFOCSPResponsePtr ocspResponse = ocspInfo->GetOCSPResponse();
                            if(ocspResponse != (CPKIFOCSPResponse*)NULL)
                            {
                                *o << "\t\t\t\t- OCSP response information:" << endl;
                                char statusString[30];
                                OCSPResponseStatus ors = ocspResponse->GetResponseStatus();
                                switch(ors)
                                {
                                case successful:
                                    //reviewed 4/24
                                    strcpy(statusString, "successful");
                                    break;
                                case malformedRequest:
                                    //reviewed 4/24
                                    strcpy(statusString, "malformedRequest");
                                    break;
                                case internalError:
                                    //reviewed 4/24
                                    strcpy(statusString, "internalError");
                                    break;
                                case tryLater:
                                    //reviewed 4/24
                                    strcpy(statusString, "tryLater");
                                    break;
                                case sigRequired:
                                    //reviewed 4/24
                                    strcpy(statusString, "sigRequired");
                                    break;
                                case unauthorized:
                                    //reviewed 4/24
                                    strcpy(statusString, "unauthorized");
                                    break;
                                }
                                *o << "\t\t\t\t\t+ Response status: " << statusString << endl;

                                if(successful == ors)
                                {
                                    CPKIFResponseBytesPtr rb = ocspResponse->GetResponseBytes();
                                    *o << "\t\t\t\t\t+ Response type: " << rb->GetResponseType()->ToString() << endl;

                                    CPKIFBasicOCSPResponse bor;
                                    bor.Decode(rb->GetResponse());

                                    CPKIFResponseDataPtr rd = bor.GetResponseData();

                                    CPKIFResponderIDPtr rid = rd->GetResponderID();
                                    *o << "\t\t\t\t\t+ Produced at: " << rd->GetProducedAt()->GetTime() << endl;
                                    if(CPKIFResponderID::NAME == rid->GetChoice())  
                                             *o << "\t\t\t\t\t+ Responder name: " << rid->GetName()->ToString() << endl;  
                                    else if(CPKIFResponderID::KEYHASH == rid->GetChoice())  
                                    {  
                                        unsigned char * ascval = new unsigned char[rid->GetHash()->GetLength()*2 + 1];
                                        btoa((const char*)rid->GetHash()->GetBuffer(), (char *)ascval, rid->GetHash()->GetLength());
                                        *o << "\t\t\t\t\t+ Responder key ID: " << ascval << endl;  
                                        delete ascval;
                                    }   
                                }

                                //----------------------------------------------------------------------------------------------------
                                //  single response information pertaining to target cert
                                //----------------------------------------------------------------------------------------------------
                                CPKIFSingleResponsePtr singleResponse = ocspInfo->GetSingleResponse();
                                if(singleResponse != (CPKIFSingleResponse*)NULL)
                                {
                                    *o << "\t\t\t\t\t+ OCSP single response information:" << endl;
                                    CPKIFTimePtr thisUpdate = singleResponse->GetThisUpdate();
                                    if(thisUpdate != NULL)
                                        *o << "\t\t\t\t\t\t* This update: " << thisUpdate->GetTime() << endl;
                                    CPKIFTimePtr nextUpdate = singleResponse->GetNextUpdate();
                                    if(nextUpdate != NULL)
                                        *o << "\t\t\t\t\t\t* Next update: " << nextUpdate->GetTime() << endl;

                                    CPKIFCertIDPtr certID = singleResponse->GetCertID();
                                    *o << "\t\t\t\t\t\t* Cert serial number: " << certID->GetSerialNumber() << endl;
                                }
                                else
                                    *o << "\t\t\t\t\t+ OCSP single response not present" << endl;
                            }
                            else
                                *o << "\t\t\t\t- OCSP basic response not present" << endl;
                        }
                        else
                            *o << "\t\t\t\t- OCSP information not present" << endl;
                    }
                }
                break;
            }
        }
    }

    *o << endl;
}

void CPKIFPathLogger::LogValidationResults(
    CPKIFPathValidationResults& tmpPVR, 
    CPKIFCertificatePath& path, 
    const char* appInfo, 
    ostream* out)
{
    LOG_STRING_DEBUG("CPKIFPathLogger::LogValidationResults", TOOLKIT_PATH_MISC, 0, NULL);

    boost::recursive_mutex::scoped_lock lock(g_me);

    std::ostringstream os;
    //ostream* o = out;
    ostream* o = &os;
    ostream* o2 = out;
    bool bClearGlobal = false;
    if(0 == o2 && 0 != g_pathLogFile.tellp())
    {
        o2 = &g_pathLogFile;
        bClearGlobal = true;
    }
    if(0 == o2)
        return;

    char errBuf[MAX_ERROR_CODE_STRING_SIZE];
    IPKIFTrustAnchorPtr rootObj;
    CPKIFCertificatePtr target, root;
    path.GetTarget(target);
    path.GetTrustRoot(rootObj);
    if(rootObj != (IPKIFTrustAnchor*)NULL)
    {
        root = rootObj->GetCertificate();
    }

    //----------------------------------------------------------------------------------------------------
    // print info from path results
    //----------------------------------------------------------------------------------------------------
    *o << "----------------------------------------------------------------------------------------------------" << endl;
    *o << endl;
    if(NULL != appInfo)
        *o << appInfo << endl;
    *o << "Current time: " << CPKIFTime::CurrentTime()->GetTime() << endl;

    //added following TOI-focused stuff 7/19/2004 - CRW
    CPKIFPathSettingsPtr ps;
    path.GetPathSettings(ps);
    if(ps != NULL)
    {
        *o << "Validation time of interest: " << ps->GetValidationTime()->GetTime() << endl;
    }

    *o << "Root certificate information" << endl;
    if(root != (CPKIFCertificate*)NULL)
    {
        *o << "\tSubject: " << root->Subject()->ToString() << endl;
        *o << "\tIssuer: " << root->Issuer()->ToString() << endl;
        *o << "\tSerial number: " << root->SerialNumber() << endl;
    }
    else if(rootObj != (IPKIFTrustAnchor*)NULL)
    {
        *o << "\tSubject: " << rootObj->GetSubjectName()->ToString() << endl;
    }
    else
        *o << "\tNo root information present" << endl;

    *o << "Target certificate information" << endl;
    if(target != (CPKIFCertificate*)NULL)
    {
        *o << "\tSubject: " << target->Subject()->ToString() << endl;
        *o << "\tIssuer: " << target->Issuer()->ToString() << endl;
        *o << "\tSerial number: " << target->SerialNumber() << endl;
    }
    else
        *o << "\tNo target information present" << endl;
    *o << endl;
    *o << "----------------------------------------------------------------------------------------------------" << endl;

    //ditched this to accomodate pure DPV modes of SCVP
    //if(!rootObj)
    //{
    //  *o << "No path constructed" << endl;
    //  *o2 << os.str().c_str();
    //  return;
    //}


    *o << "---------------------------------------------------------------------------------------" << endl;
    *o << "Printing information from path validation results:" << endl;
    *o << "---------------------------------------------------------------------------------------" << endl;

    if(tmpPVR.PathSuccessfullyValidated())
    {
        *o << "- Path successfully validated" << endl;
    }
    else
    {
        *o << "- Path not successfully validated" << endl;
        *o << "- Diagnostic code: " << tmpPVR.DiagnosticCode() << " -> " << GetErrorCodeString(tmpPVR.DiagnosticCode(), errBuf) << endl;
    }

    if(tmpPVR.GetBasicChecksSuccessfullyPerformed())
        *o << "- Basic checks successfully performed" << endl;
    else
        *o << "- Basic checks not successfully performed" << endl;

    if(tmpPVR.GetCertSignaturesVerified())
        *o << "- Cert signatures successfully verified" << endl;
    else
        *o << "- Cert signatures not successfully verified" << endl;

    RevocationStatus rs = tmpPVR.GetRevocationStatusMostSevere();
    switch(rs)
    {
    case REVOKED:
        *o << "- Most severe revocation status: REVOKED" << endl;
        break;
    case NOT_CHECKED:
        *o << "- Most severe revocation status: NOT CHECKED" << endl;
        break;
    case NOT_REVOKED:
        *o << "- Most severe revocation status: NOT REVOKED" << endl;
        break;
    case SERVER_CHECKED:
        *o << "- Most severe revocation status: SERVER CHECKED" << endl;
        break;
    default:
        *o << "- Most severe revocation status: UNKNOWN" << endl;
    }

    bool explicitPolicyIndicator = tmpPVR.GetExplicitPolicyIndicator();
    if(explicitPolicyIndicator)
        *o << "- Explicit policy indicator: TRUE" << endl;
    else
        *o << "- Explicit policy indicator: FALSE" << endl;

    CPKIFPolicyInformationListPtr authSet, userSet;
    tmpPVR.GetAuthorityConstrainedSet(authSet);
    tmpPVR.GetUserConstrainedSet(userSet);

    const vector<CPKIFPolicyInformationListPtr>* asTable = tmpPVR.GetAuthorityConstrainedSetTable();
    *o << "- Authority constrained policy table" << endl;
    if(NULL != asTable)
        DumpPolicyTable(*asTable, o);
    else
        *o << "\t NULL" << endl;

    *o << "- User constrained policy set" << endl;
    DumpPolicySet(userSet, o);

    *o << "- Authority constrained policy set" << endl;
    DumpPolicySet(authSet, o);

    CPKIFCertStatusPtr cs = tmpPVR.GetCertStatus(); //target cert status

    if(!tmpPVR.PathSuccessfullyValidated())
    {
        //If path validation failed output information about the cert that caused the failure
        CPKIFCertificateNodeEntryPtr certNode = tmpPVR.GetCertificate();
        if(certNode != (CPKIFCertificateNodeEntry*)NULL)
        {
            CPKIFCertStatusPtr certStatus;
            certNode->GetStatus(certStatus);

            *o << "- Certificate with following information failed with diagnostic code " << certStatus->GetDiagnosticCode() << " : " << GetErrorCodeString(certStatus->GetDiagnosticCode(), errBuf) << endl;
            PrintCertInfo(*certNode, "\t+ ", o);
        }
        else
        {
            *o << "Validation failed but no cert was highlighted." << endl;
        }
    }

    LogPath(path, NULL, o);
    *o2 << os.str().c_str();

    std::ostringstream *logOutput = dynamic_cast<std::ostringstream*>(o2);
#ifndef _DISABLE_LOG4CXX_PATH_LOGGING
    if (logOutput) {
        log4cxx::LoggerPtr logger = log4cxx::Logger::getLogger("PKIF");
        LOG4CXX_DEBUG (logger, logOutput->str());
    }
#endif 
    o2->flush();

    if(bClearGlobal)
    {
        logOutput->str("");
        logOutput->clear();
    }
}