PKIFSynonymousSourceStore.cpp

Go to the documentation of this file.

#include "PKIFSynonymousSourceStore.h"
#include "PKIFCRLNodeEntry.h"
#include "PKIFCertificateNodeEntry.h"
#include "Name.h"
#include "CRL.h"
#include "Certificate.h"
#include "CRLDistributionPoints.h"
#include "CRLDistributionPoint.h"
#include "DistributionPointName.h"
#include "GottaMatch.h"
#include "IssuingDistributionPoint.h"
#include "Duration.h"
#include "PKIFTime.h"
#include "GeneralName.h"
#include "ToolkitUtils.h"
#include "PKIFCacheException.h"
#include "PKIFCacheErrors.h"

#include <map>
#include <string>
#include <vector>
#include <iostream>
#include <iterator>

#include "boost/numeric/conversion/cast.hpp"

using boost::numeric_cast;
using boost::bad_numeric_cast;
using namespace std;

//#define _DEBUG_CACHE 1
#ifdef _DEBUG_CACHE
#include <fstream>
#endif

//#define _DEBUG_URI_DUMP 1
#ifdef _DEBUG_URI_DUMP
#include <fstream>
ofstream g_cacheLogFile;
#endif

//----------------------------------------------------------------------------------------------------
// Impl details
//----------------------------------------------------------------------------------------------------

template <class T>
class GottaMatchCRLNodePair
{
public:
    bool operator()(std::pair<T, CPKIFCRLNodeEntryPtr> t);
    void SetRHS(const T& rhs) {m_rhs = rhs;}
private:
    T m_rhs;
};
template <class T>
bool GottaMatchCRLNodePair<T>::operator()(std::pair<T, CPKIFCRLNodeEntryPtr> t)
{
    return *t.first == *m_rhs;      
}

class CPKIFSynonymousSourceStoreImpl
{
public:
    CPKIFSynonymousSourceStoreImpl()
    {
        m_lastClean = 0;
#ifdef _DEBUG_CACHE
        m_maxTimeBetweenCleaning = 240000; //4 minute

        CPKIFDurationPtr tmp(new CPKIFDuration());
        tmp->setSeconds(480); //8 minutes
        m_maxAge = tmp;
#else
        m_maxTimeBetweenCleaning = 3600000; //one hour

        CPKIFDurationPtr tmp(new CPKIFDuration());
        tmp->setDays(1);
        m_maxAge = tmp;
#endif
    }

    //Functions related to nodes in PAS_PENDING state
    void AddPendingCrl(CPKIFCRLNodeEntryPtr& crl);
    void AddPendingCert(CPKIFCertificateNodeEntryPtr& cert);

    //Functions to add CRLs to the store
    void AddUriEntry(std::string& uri, CPKIFCRLNodeEntryPtr& crlNode);
    CPKIFCRLNodeEntryPtr AddDPEntry(std::string& uri, CPKIFCRLNodeEntryPtr& crlNode);
    CPKIFCRLNodeEntryPtr AddIssuerNameEntry(std::string& uri, CPKIFCRLNodeEntryPtr& crlNode);

    //Functions to add CRLs to the store
    void AddUriEntry(std::string& uri, CPKIFCertificateNodeEntryPtr& crlNode);

    //Functions to retrieve CRLs from the store
    CPKIFCRLNodeEntryPtr GetCachedCrlByIssuerOrDp(const CPKIFCertificatePtr& cert);
    CPKIFCRLNodeEntryPtr GetCachedCrlByIssuer(const CPKIFNamePtr& issuerName);
    CPKIFCRLNodeEntryPtr GetCachedCrlByDp(const CPKIFDistributionPointNamePtr& dp);
    CPKIFCRLNodeEntryPtr GetCachedCrlByUri(const std::string& uri);

    //Functions to retrieve certs from the store
    void GetCachedCertByUri(const std::string& uri, CPKIFCertificateNodeList& nodeList);

    //Debugging functions to output a textual listing store contents
    void WriteCacheContentsToConsole(std::ostream& out);
    void CleanIfNecessary();

private:
    //the primary index is URI, since this is driven by the GetCRLSources interface
    std::map<std::string, CPKIFCRLNodeEntryPtr> m_crlMap;
    std::map<std::string, std::vector<CPKIFCertificateNodeEntryPtr> > m_certMap;

    std::vector<std::string> m_unavailableUris;

    //secondary indices are also maintained for CRLs over issuerDN and distribution point
    //the issuer name map is only used to store full CRLs
    std::map<CPKIFNamePtr, CPKIFCRLNodeEntryPtr> m_crlMapIssuerName;
    std::map<CPKIFDistributionPointNamePtr, CPKIFCRLNodeEntryPtr> m_crlMapDP;

    //safe keeping for pending nodes
    std::vector<CPKIFCRLNodeEntryPtr> m_pendingCRLs;
    std::vector<CPKIFCertificateNodeEntryPtr> m_pendingCerts;

    unsigned long m_lastClean;
    unsigned long m_maxTimeBetweenCleaning;
    CPKIFDurationPtr m_maxAge;
};
class IsOldCacheEntry
{
public:
    bool operator()(const std::pair<std::string, CPKIFCRLNodeEntryPtr>& t);
    bool operator()(const CPKIFCertificateNodeEntryPtr& t);
    void SetTimeOfInterest(CPKIFTimePtr& toi) {m_toi = toi;}
private:
    CPKIFTimePtr m_toi;
};
bool IsOldCacheEntry::operator()(const std::pair<std::string, CPKIFCRLNodeEntryPtr>& t)
{
    CPKIFTimePtr retrievalTime = t.second->GetLatestRetrievalTime();
    return *m_toi > *retrievalTime;
}
bool IsOldCacheEntry::operator()(const CPKIFCertificateNodeEntryPtr& t)
{
    CPKIFTimePtr retrievalTime = t->GetLatestRetrievalTime();
    return *m_toi > *retrievalTime;
}
class IsCertCacheEntryEmpty
{
public:
    bool operator()(const std::pair<std::string, std::vector<CPKIFCertificateNodeEntryPtr> >& t);
};

bool IsCertCacheEntryEmpty::operator()(const std::pair<std::string, std::vector<CPKIFCertificateNodeEntryPtr> >& t)
{
    return t.second.empty();
}
void CPKIFSynonymousSourceStoreImpl::CleanIfNecessary()
{
    if(0 == m_lastClean)
    {
        m_lastClean = GetTickCount();
        return;
    }

    unsigned long curTicks = GetTickCount();
    if((curTicks - m_lastClean) > m_maxTimeBetweenCleaning)
    {
#ifdef _DEBUG_CACHE
    CPKIFTimePtr t1 = CPKIFTime::CurrentTime();
    ofstream f1;
    std::string s1 = t1->GetTime();
    s1.append("preClean.txt");
    f1.open(s1.c_str(), ios::out);
    WriteCacheContentsToConsole(f1);
    f1.close();
#endif

        m_lastClean = curTicks;
        CPKIFTimePtr timeOfInterest = CPKIFTime::CurrentTime();
        *timeOfInterest -= *m_maxAge;

        IsOldCacheEntry ioce;
        ioce.SetTimeOfInterest(timeOfInterest);

        std::map<std::string, std::vector<CPKIFCertificateNodeEntryPtr> >::iterator certPos;
        std::map<std::string, std::vector<CPKIFCertificateNodeEntryPtr> >::iterator certEnd = m_certMap.end();
        for(certPos = m_certMap.begin(); certPos != certEnd; )
        {
            std::vector<CPKIFCertificateNodeEntryPtr>::iterator newEnd = 
                remove_if((*certPos).second.begin(), (*certPos).second.end(), ioce);
            (*certPos).second.erase(newEnd, (*certPos).second.end());

            if((*certPos).second.empty())
            {
                m_certMap.erase(certPos++);
            }
            else
            {
                ++certPos;
            }
        }

        std::map<std::string, CPKIFCRLNodeEntryPtr>::iterator crlPos;
        std::map<std::string, CPKIFCRLNodeEntryPtr>::iterator crlEnd = m_crlMap.end();
        for(crlPos = m_crlMap.begin(); crlPos != crlEnd; )
        {
            if(timeOfInterest < (*crlPos).second->GetLatestRetrievalTime())
            {
                CPKIFCRLPtr crl = (*crlPos).second->GetCRL();
                CPKIFNamePtr issuerName = crl->Issuer();

                m_crlMapIssuerName.erase(issuerName);

                CPKIFIssuingDistributionPointPtr idp = crl->GetExtension<CPKIFIssuingDistributionPoint>();
                if(idp != (CPKIFIssuingDistributionPoint*)NULL)
                {
                    GottaMatchCRLNodePair<CPKIFDistributionPointNamePtr> gm;
                    CPKIFDistributionPointNamePtr dp = idp->DistributionPoint();
                    if(dp != (CPKIFDistributionPointName*)NULL)
                    {
                        m_crlMapDP.erase(dp);
                    }
                }

                m_crlMap.erase(crlPos++);
            }
            else
            {
                ++crlPos;
            }
        }
#ifdef _DEBUG_CACHE
    CPKIFTimePtr t2 = CPKIFTime::CurrentTime();
    ofstream f2;
    std::string s2 = t2->GetTime();
    s2.append("postClean.txt");
    f2.open(s2.c_str(), ios::out);
    WriteCacheContentsToConsole(f2);
    f2.close();
#endif
    }
}

void CPKIFSynonymousSourceStoreImpl::AddPendingCrl(
    CPKIFCRLNodeEntryPtr& crl)
{
    m_pendingCRLs.push_back(crl);
}
void CPKIFSynonymousSourceStoreImpl::AddPendingCert(
    CPKIFCertificateNodeEntryPtr& cert)
{
    m_pendingCerts.push_back(cert);
}
void CPKIFSynonymousSourceStoreImpl::WriteCacheContentsToConsole(
    std::ostream& out)
{
    out << "Listing CRLs..." << endl;
    int index = 0;
    std::map<std::string, CPKIFCRLNodeEntryPtr>::iterator pos;
    std::map<std::string, CPKIFCRLNodeEntryPtr>::iterator end = m_crlMap.end();
    for(pos = m_crlMap.begin(); pos != end; ++pos, ++index)
    {
        out << "Node[" << index << "]: " << (*pos).first << endl;
        if((*pos).second != (CPKIFCRLNodeEntry*)NULL)
        {
            switch((*pos).second->GetState())
            {
            case PAS_PENDING:
                out << "State: PAS_PENDING" << endl;
                break;
            case PAS_AVAILABLE:
                out << "State: PAS_AVAILABLE" << endl;
                out << "CRL issued by: " << (*pos).second->GetCRL()->Issuer()->ToString() << endl;
                break;
            case PAS_UNAVAILABLE:
                out << "State: PAS_UNAVAILABLE" << endl;
                break;
            }

            vector<string> sources;
            (*pos).second->GetSources(sources);

            int sourceIndex = 0;
            vector<string>::iterator sourcePos;
            vector<string>::iterator sourceEnd = sources.end();
            for(sourcePos = sources.begin(); sourcePos != sourceEnd; ++sourcePos, ++sourceIndex)
            {
                out << "Source[" << sourceIndex << "]: " << (*sourcePos) << endl;
            }
        }
        out << endl;
    }

    out << "Listing CRLs from issuer map..." << endl;
    index = 0;
    std::map<CPKIFNamePtr, CPKIFCRLNodeEntryPtr>::iterator ipos;
    std::map<CPKIFNamePtr, CPKIFCRLNodeEntryPtr>::iterator iend = m_crlMapIssuerName.end();
    for(ipos = m_crlMapIssuerName.begin(); ipos != iend; ++ipos, ++index)
    {
        out << "Node[" << index << "]: " << (*ipos).first->ToString() << endl;
        if((*ipos).second != (CPKIFCRLNodeEntry*)NULL)
        {
            switch((*ipos).second->GetState())
            {
            case PAS_PENDING:
                out << "State: PAS_PENDING" << endl;
                break;
            case PAS_AVAILABLE:
                out << "State: PAS_AVAILABLE" << endl;
                out << "CRL issued by: " << (*ipos).second->GetCRL()->Issuer()->ToString() << endl;
                break;
            case PAS_UNAVAILABLE:
                out << "State: PAS_UNAVAILABLE" << endl;
                break;
            }

            vector<string> sources;
            (*ipos).second->GetSources(sources);

            int sourceIndex = 0;
            vector<string>::iterator sourcePos;
            vector<string>::iterator sourceEnd = sources.end();
            for(sourcePos = sources.begin(); sourcePos != sourceEnd; ++sourcePos, ++sourceIndex)
            {
                out << "Source[" << sourceIndex << "]: " << (*sourcePos) << endl;
            }
        }
        out << endl;
    }

    out << "Listing CRLs from DP map..." << endl;
    index = 0;
    std::map<CPKIFDistributionPointNamePtr, CPKIFCRLNodeEntryPtr>::iterator dppos;
    std::map<CPKIFDistributionPointNamePtr, CPKIFCRLNodeEntryPtr>::iterator dpend = m_crlMapDP.end();
    for(dppos = m_crlMapDP.begin(); dppos != dpend; ++dppos, ++index)
    {
        std::string dpName;
        CPKIFDistributionPointNamePtr dp = (*dppos).first;
        if(!dp->NameRelativeToIssuerPresent())
        {
            CPKIFGeneralNameList gns;
            dp->FullName(gns);

            CPKIFGeneralNameList::iterator gnPos;
            CPKIFGeneralNameList::iterator gnEnd = gns.end();
            for(gnPos = gns.begin(); gnPos != gnEnd; ++gnPos)
            {
                switch((*gnPos)->GetType())
                {
                case CPKIFGeneralName::OTHERNAME:
                    break;
                case CPKIFGeneralName::RFC822:
                    dpName = (*gnPos)->rfc822Name();
                    break;
                case CPKIFGeneralName::DNSNAME:
                    dpName = (*gnPos)->dnsName();
                    break;
                case CPKIFGeneralName::X400ADDRESS:
                    break;
                case CPKIFGeneralName::DIRECTORYNAME:
                    {
                    CPKIFNamePtr dpDN = (*gnPos)->directoryName();
                    if(dpDN)
                        dpName = dpDN->ToString();
                    }
                    break;
                case CPKIFGeneralName::EDIPARTYNAME:
                    break;
                case CPKIFGeneralName::URI:
                    dpName = (*gnPos)->uri();
                    break;
                case CPKIFGeneralName::IPADDRESS:
                    break;
                case CPKIFGeneralName::OID:
                    break;
                }

                //don't worry about each DP - just output one and move on
                if(!dpName.empty())
                    break;
            }

        }
        else
        {
            CPKIFCRLPtr c = (*dppos).second->GetCRL();
            if(c)
            {
                CPKIFNamePtr tmpIssuer = c->Issuer();
                CPKIFNamePtr n = dp->GetRelativeNameAsFullName(tmpIssuer);
                if(n)
                {
                    dpName = n->ToString();
                }
            }
        }

        if(dpName.empty())
            dpName = "Undetermined DP value";

        out << "Node[" << index << "]: " << dpName.c_str() << endl;
        if((*dppos).second != (CPKIFCRLNodeEntry*)NULL)
        {
            switch((*dppos).second->GetState())
            {
            case PAS_PENDING:
                out << "State: PAS_PENDING" << endl;
                break;
            case PAS_AVAILABLE:
                out << "State: PAS_AVAILABLE" << endl;
                out << "CRL issued by: " << (*dppos).second->GetCRL()->Issuer()->ToString() << endl;
                break;
            case PAS_UNAVAILABLE:
                out << "State: PAS_UNAVAILABLE" << endl;
                break;
            }

            vector<string> sources;
            (*dppos).second->GetSources(sources);

            int sourceIndex = 0;
            vector<string>::iterator sourcePos;
            vector<string>::iterator sourceEnd = sources.end();
            for(sourcePos = sources.begin(); sourcePos != sourceEnd; ++sourcePos, ++sourceIndex)
            {
                out << "Source[" << sourceIndex << "]: " << (*sourcePos) << endl;
            }
        }
        out << endl;
    }

    out << "Listing Certs..." << endl;
    index = 0;
    std::map<std::string, std::vector<CPKIFCertificateNodeEntryPtr> >::iterator certPos;
    std::map<std::string, std::vector<CPKIFCertificateNodeEntryPtr> >::iterator certEnd = m_certMap.end();
    for(certPos = m_certMap.begin(); certPos != certEnd; ++certPos, ++index)
    {
        out << "Node[" << index << "]: " << (*certPos).first << endl;
        if(!(*certPos).second.empty())
        {
            std::vector<CPKIFCertificateNodeEntryPtr>::iterator certNodePos;
            std::vector<CPKIFCertificateNodeEntryPtr>::iterator certNodeEnd = (*certPos).second.end();
            for(certNodePos = (*certPos).second.begin(); certNodePos != certNodeEnd; ++certNodePos)
            {
                switch((*certNodePos)->GetState())
                {
                case PAS_PENDING:
                    out << "State: PAS_PENDING" << endl;
                    break;
                case PAS_AVAILABLE:
                    out << "State: PAS_AVAILABLE" << endl;
                    out << "Cert issued by: " << (*certNodePos)->GetCert()->Issuer()->ToString() << endl;
                    out << "Cert issued to: " << (*certNodePos)->GetCert()->Subject()->ToString() << endl;
                    break;
                case PAS_UNAVAILABLE:
                    out << "State: PAS_UNAVAILABLE" << endl;
                    break;
                }

                vector<string> sources;
                (*certNodePos)->GetSources(sources);

                int sourceIndex = 0;
                vector<string>::iterator sourcePos;
                vector<string>::iterator sourceEnd = sources.end();
                for(sourcePos = sources.begin(); sourcePos != sourceEnd; ++sourcePos, ++sourceIndex)
                {
                    out << "Source[" << sourceIndex << "]: " << (*sourcePos) << endl;
                }
            }
        }
        out << endl;
    }
}
void CPKIFSynonymousSourceStoreImpl::GetCachedCertByUri(
    const std::string& uri,
    CPKIFCertificateNodeList& certNodeList)
{
#ifdef _DEBUG_URI_DUMP
    if(!g_cacheLogFile.is_open())
    {
        g_cacheLogFile.open("_DEBUG_URI_DUMP_CacheLog.txt", ios::out);
    }
#endif
    if(m_certMap.count(uri))
    {
#ifdef _DEBUG_URI_DUMP
    g_cacheLogFile << "CACHE HIT - " << uri << endl;
#endif

        GottaMatch<CPKIFCertificateNodeEntryPtr> gm;

        std::vector<CPKIFCertificateNodeEntryPtr>::iterator pos;
        std::vector<CPKIFCertificateNodeEntryPtr>::iterator end = m_certMap[uri].end();
        for(pos = m_certMap[uri].begin(); pos != end; ++pos)
        {
            gm.SetRHS(*pos);
            if(certNodeList.end() == find_if(certNodeList.begin(), certNodeList.end(), gm))
            {
                if(PAS_AVAILABLE == (*pos)->GetState())
                {
                    CPKIFCertificateNodeEntryPtr newEntry(new CPKIFCertificateNodeEntry);
                    CPKIFCertificatePtr certFromList = (*pos)->GetCert();
                    newEntry->SetCert(certFromList);
                    newEntry->SetSource((*pos)->GetSource());
                    certNodeList.push_back(newEntry);
                }
                else
                {
                    //no need to copy if not available
                    certNodeList.push_back(*pos);
                }
            }
        }
    }
    else
    {
#ifdef _DEBUG_URI_DUMP
    g_cacheLogFile << "CACHE MISS - " << uri << endl;
#endif
    }
}
CPKIFCRLNodeEntryPtr CPKIFSynonymousSourceStoreImpl::GetCachedCrlByUri(
    const std::string& uri)
{
#ifdef _DEBUG_URI_DUMP
    if(!g_cacheLogFile.is_open())
    {
        g_cacheLogFile.open("_DEBUG_URI_DUMP_CacheLog.txt", ios::out);
    }
#endif

    if(m_crlMap.count(uri))
    {
#ifdef _DEBUG_URI_DUMP
    g_cacheLogFile << "CACHE HIT - " << uri << endl;
#endif
        return m_crlMap[uri];
    }
    else
    {
#ifdef _DEBUG_URI_DUMP
    g_cacheLogFile << "CACHE MISS - " << uri << endl;
#endif
        CPKIFCRLNodeEntryPtr empty;
        return empty;
    }
}
CPKIFCRLNodeEntryPtr CPKIFSynonymousSourceStoreImpl::GetCachedCrlByIssuer(
    const CPKIFNamePtr& issuerName)
{
    CPKIFCRLNodeEntryPtr cachedEntry;

    if(issuerName == (CPKIFName*)NULL)
        return cachedEntry;

    GottaMatchCRLNodePair<CPKIFNamePtr> gm;
    gm.SetRHS(issuerName);

    std::map<CPKIFNamePtr, CPKIFCRLNodeEntryPtr>::iterator end = m_crlMapIssuerName.end();
    std::map<CPKIFNamePtr, CPKIFCRLNodeEntryPtr>::iterator match = find_if(m_crlMapIssuerName.begin(), m_crlMapIssuerName.end(), gm);

    if(end != match)
        return (*match).second;
    else
        return cachedEntry;
}
CPKIFCRLNodeEntryPtr CPKIFSynonymousSourceStoreImpl::GetCachedCrlByDp(
    const CPKIFDistributionPointNamePtr& dp)
{
    CPKIFCRLNodeEntryPtr cachedEntry;

    if(dp == (CPKIFDistributionPointName*)NULL)
        return cachedEntry;

    GottaMatchCRLNodePair<CPKIFDistributionPointNamePtr> gm;
    gm.SetRHS(dp);

    std::map<CPKIFDistributionPointNamePtr, CPKIFCRLNodeEntryPtr>::iterator end = m_crlMapDP.end();
    std::map<CPKIFDistributionPointNamePtr, CPKIFCRLNodeEntryPtr>::iterator match = find_if(m_crlMapDP.begin(), m_crlMapDP.end(), gm);

    if(end != match)
        return (*match).second;
    else
        return cachedEntry;
}
CPKIFCRLNodeEntryPtr CPKIFSynonymousSourceStoreImpl::GetCachedCrlByIssuerOrDp(
    const CPKIFCertificatePtr& cert)
{
    CPKIFCRLNodeEntryPtr cachedEntry;

    if(cert == (CPKIFCertificate*)NULL)
        return cachedEntry;

    //look for DP CRLs first, since these may be smaller
    CPKIFCRLDistributionPointsPtr crlDPs = cert->GetExtension<CPKIFCRLDistributionPoints>();
    if(crlDPs != (CPKIFCRLDistributionPoints*)NULL)
    {
        CPKIFCRLDistributionPointListPtr dps = crlDPs->DPs();

        CPKIFCRLDistributionPointList::iterator pos;
        CPKIFCRLDistributionPointList::iterator end = dps->end();
        for(pos = dps->begin(); pos != end; ++pos)
        {
            cachedEntry = GetCachedCrlByDp((*pos)->DistributionPoint());
            if(cachedEntry != (CPKIFCRLNodeEntry*)NULL)
                return cachedEntry;
        }
    }

    //then look for a full CRL if no DP CRL is found
    CPKIFNamePtr issuerName = cert->Issuer();
    cachedEntry = GetCachedCrlByIssuer(issuerName);
    if(cachedEntry != (CPKIFCRLNodeEntry*)NULL)
        return cachedEntry;

    return cachedEntry;
}
void CPKIFSynonymousSourceStoreImpl::AddUriEntry(
    std::string& uri, 
    CPKIFCertificateNodeEntryPtr& certNode)
{
    if(0 == m_certMap.count(uri))
        m_certMap[uri].push_back(certNode);
    else
    {
        if(PAS_AVAILABLE == certNode->GetState())
        {
            GottaMatch<CPKIFCertificateNodeEntryPtr> gm;
            gm.SetRHS(certNode);
            if(m_certMap[uri].end() == find_if(m_certMap[uri].begin(), m_certMap[uri].end(), gm))
                m_certMap[uri].push_back(certNode);
        }
    }
}

void CPKIFSynonymousSourceStoreImpl::AddUriEntry(
    std::string& uri,
    CPKIFCRLNodeEntryPtr& crlNode)
{
    CPKIFCRLNodeEntryPtr cachedEntry = AddDPEntry(uri, crlNode);
    if(cachedEntry != (CPKIFCRLNodeEntry*)NULL)
        crlNode = cachedEntry;

    cachedEntry = AddIssuerNameEntry(uri, crlNode);
    if(cachedEntry != (CPKIFCRLNodeEntry*)NULL)
        crlNode = cachedEntry;

    m_crlMap[uri] = crlNode;
}

CPKIFCRLNodeEntryPtr CPKIFSynonymousSourceStoreImpl::AddDPEntry(
    std::string& uri,
    CPKIFCRLNodeEntryPtr& crlNode)
{
    CPKIFCRLNodeEntryPtr cachedEntry;
    if(PAS_AVAILABLE == crlNode->GetState())
    {
        CPKIFCRLPtr crl = crlNode->GetCRL();

        CPKIFIssuingDistributionPointPtr idp = crl->GetExtension<CPKIFIssuingDistributionPoint>();
        if(idp != (CPKIFIssuingDistributionPoint*)NULL)
        {
            GottaMatchCRLNodePair<CPKIFDistributionPointNamePtr> gm;
            CPKIFDistributionPointNamePtr dp = idp->DistributionPoint();
            if(dp != (CPKIFDistributionPointName*)NULL)
            {
                gm.SetRHS(dp);

                std::map<CPKIFDistributionPointNamePtr, CPKIFCRLNodeEntryPtr>::iterator end = m_crlMapDP.end();
                std::map<CPKIFDistributionPointNamePtr, CPKIFCRLNodeEntryPtr>::iterator match = find_if(m_crlMapDP.begin(), m_crlMapDP.end(), gm);

                if(end != match)
                {
                    (*match).second->AddSource(uri);
                    return (*match).second;
                }
                else
                {
                    m_crlMapDP[dp] = crlNode;
                    return cachedEntry;
                }
            }
        }
    }

    return cachedEntry;
}

CPKIFCRLNodeEntryPtr CPKIFSynonymousSourceStoreImpl::AddIssuerNameEntry(
    std::string& uri, 
    CPKIFCRLNodeEntryPtr& crlNode)
{
    CPKIFCRLNodeEntryPtr emptyNode;
    if(PAS_AVAILABLE == crlNode->GetState())
    {
        CPKIFCRLPtr crl = crlNode->GetCRL();

        //if it is not a full CRL, then drop it (it'll be in the DP index)
        CPKIFIssuingDistributionPointPtr idp = crl->GetExtension<CPKIFIssuingDistributionPoint>();
        if(idp != (CPKIFIssuingDistributionPoint*)NULL)
            return emptyNode;

        CPKIFNamePtr issuerName = crl->Issuer();
        GottaMatchCRLNodePair<CPKIFNamePtr> gm;
        gm.SetRHS(issuerName);

        std::map<CPKIFNamePtr, CPKIFCRLNodeEntryPtr>::iterator end = m_crlMapIssuerName.end();
        std::map<CPKIFNamePtr, CPKIFCRLNodeEntryPtr>::iterator match = find_if(m_crlMapIssuerName.begin(), m_crlMapIssuerName.end(), gm);

        if(end != match)
        {
            //we found a node in the cache, return it so the new node falls out of use and dies
            (*match).second->AddSource(uri);
            return (*match).second;
        }
        else
        {
            m_crlMapIssuerName[issuerName] = crlNode;
            return emptyNode;
        }
    }

    return emptyNode;
}

//----------------------------------------------------------------------------------------------------
// Class details
//----------------------------------------------------------------------------------------------------
CPKIFSynonymousSourceStore::CPKIFSynonymousSourceStore(void) : m_impl(new CPKIFSynonymousSourceStoreImpl)
{
}

CPKIFSynonymousSourceStore::~CPKIFSynonymousSourceStore(void)
{
    if(m_impl) delete m_impl;
}

void CPKIFSynonymousSourceStore::Initialize()
{
    //There's nothing to do here for now, but future serialization efforts may utilize this function.
}

void CPKIFSynonymousSourceStore::GetCRLs(
    const CPKIFCertificatePtr& cert, 
    CPKIFCrlSourceList& crlSourceList, 
    CPKIFCRLNodeList& crlNodeList)
{
    m_impl->CleanIfNecessary();

    CPKIFCRLNodeList rv;

    //First, iterate over the nodes in the inbound node list and see if we can fulfill any
    //pending nodes (while adding any new nodes to the store)
    CPKIFCrlSourceList::iterator pos;
    CPKIFCrlSourceList::iterator end = crlSourceList.end();
    for(pos = crlSourceList.begin(); pos != end; ++pos)
    {
        //get the list of sources from the node
        vector<string> sources;
        (*pos)->GetSources(sources);

        vector<string>::iterator sourcePos;
        vector<string>::iterator sourceEnd = sources.end();
        for(sourcePos = sources.begin(); sourcePos != sourceEnd; ++sourcePos)
        {
            //for each source, see if it's in the cache
            CPKIFCRLNodeEntryPtr cachedEntry = m_impl->GetCachedCrlByUri(*sourcePos);
            if(cachedEntry != (CPKIFCRLNodeEntry*)NULL)
            {
/*              //if it is and the inbound node is not available but the cached node is, then update the inbound node
                if(PAS_PENDING == (*pos)->GetState() && PAS_AVAILABLE == cachedEntry->GetState())
                {
                    (*pos)->SetCRL(cachedEntry->GetCRL());
                    (*pos)->SetState(PAS_AVAILABLE);
                }
                else if(PAS_PENDING == (*pos)->GetState() && PAS_UNAVAILABLE == cachedEntry->GetState())
                {
                    (*pos)->SetState(PAS_UNAVAILABLE);
                }*/

                GottaMatch<CPKIFCRLNodeEntryPtr> gm;
                gm.SetRHS(cachedEntry);
                if(rv.end() == find_if(rv.begin(), rv.end(), gm))
                    rv.push_back(cachedEntry);
            }
/*          else
            {
                //if it's not in our cache then add it provided it is not in a pending state
                if(PAS_PENDING != (*pos)->GetState())
                    m_impl->AddUriEntry(*sourcePos, *pos);

                rv.push_back(*pos);
            }*/
        }
    }

    //next, use information from the certificate to see if we have anything in the store 
    //that would be useful in determining its revocation status.  This call will return
    //a DP CRL, if available, else a full CRL, if available.
    CPKIFCRLNodeEntryPtr cachedEntry = m_impl->GetCachedCrlByIssuerOrDp(cert);
    if(cachedEntry != (CPKIFCRLNodeEntry*)NULL)
    {
        GottaMatch<CPKIFCRLNodeEntryPtr> gm;
        gm.SetRHS(cachedEntry);
        if(rv.end() == find_if(rv.begin(), rv.end(), gm))
            rv.push_back(cachedEntry);
    }

    crlNodeList.clear();
    copy(rv.begin(), rv.end(), back_inserter(crlNodeList));
}
void CPKIFSynonymousSourceStore::GetCerts(
    CPKIFCertificateSourceList& certSources, 
    CPKIFCertificateNodeList& certNodeList, 
    PathBuildingDirection pbd)
{
    m_impl->CleanIfNecessary();

    GottaMatch<CPKIFCertificateNodeEntryPtr> gm;

    CPKIFCertificateSourceList::iterator pos;
    CPKIFCertificateSourceList::iterator end = certSources.end();
    for(pos = certSources.begin(); pos != end; ++pos)
    {
        vector<string> sources;
        (*pos)->GetSources(sources);

        CPKIFCertificateNodeList alreadyAvailNodeList;
        if(PAS_AVAILABLE == (*pos)->GetState())
        {
            (*pos)->GetCertificates(alreadyAvailNodeList, pbd);
        }

        vector<string>::iterator sourcePos;
        vector<string>::iterator sourceEnd = sources.end();
        for(sourcePos = sources.begin(); sourcePos != sourceEnd; ++sourcePos)
        {
            if(PAS_PENDING == (*pos)->GetState())
            {
                CPKIFCertificateNodeList tempList;
                m_impl->GetCachedCertByUri(*sourcePos, tempList);
                if(!tempList.empty())
                {
                    int sizeBefore = 0;
                    try {
                        sizeBefore = boost::numeric_cast<int,size_t>(certNodeList.size());
                    }catch(std::exception &e){
                        throw CPKIFCacheException(TOOLKIT_SR_MISC, COMMON_INVALID_INPUT, e.what());
                    }
                    CPKIFCertificateNodeList::iterator tempListPos;
                    CPKIFCertificateNodeList::iterator tempListEnd = tempList.end();
                    for(tempListPos = tempList.begin(); tempListPos != tempListEnd; ++tempListPos)
                    {
                        gm.SetRHS(*tempListPos);
                        if(PAS_UNAVAILABLE != (*tempListPos)->GetState() && certNodeList.end() == find_if(certNodeList.begin(), certNodeList.end(), gm))
                            certNodeList.push_back(*tempListPos);
                    }

                    if(sizeBefore != certNodeList.size())
                        (*pos)->SetState(PAS_AVAILABLE);
                    else
                        (*pos)->SetState(PAS_UNAVAILABLE);
                }
            }
            if(PAS_AVAILABLE == (*pos)->GetState())
            {
                CPKIFCertificateNodeList::iterator availListPos;
                CPKIFCertificateNodeList::iterator availListEnd = alreadyAvailNodeList.end();
                for(availListPos = alreadyAvailNodeList.begin(); availListPos != availListEnd; ++availListPos)
                    m_impl->AddUriEntry(*sourcePos, *availListPos);
            }
        }
    }
}

void CPKIFSynonymousSourceStore::AddCRL(
    CPKIFCRLNodeEntryPtr& crl)
{
    if(crl == (CPKIFCRLNodeEntry*)NULL)
        return;

    if(PAS_PENDING == crl->GetState())
    {
        m_impl->AddPendingCrl(crl);
        return;
    }

    vector<string> sources;
    crl->GetSources(sources);

    vector<string>::iterator pos;
    vector<string>::iterator end = sources.end();
    for(pos = sources.begin(); pos != end; ++pos)
    {
        m_impl->AddUriEntry(*pos, crl);
    }
}
void CPKIFSynonymousSourceStore::AddCert(
    CPKIFCertificateNodeEntryPtr& cert)
{
    if(cert == (CPKIFCertificateNodeEntry*)NULL)
        return;

    vector<string> sources;
    cert->GetSources(sources);

    vector<string>::iterator pos;
    vector<string>::iterator end = sources.end();
    for(pos = sources.begin(); pos != end; ++pos)
    {
        m_impl->AddUriEntry(*pos, cert);
    }
}

void CPKIFSynonymousSourceStore::WriteCacheContentsToConsole(
    std::ostream& out)
{
    m_impl->WriteCacheContentsToConsole(out);
}

//XXX***The CRL name list could be problematic is multiple CAs with the same name are encountered.
//XXX***The CRL DP retrieval function always returns the first matching CRL (there may be other inaccessible ones)