SimpleCertCache.cpp

Go to the documentation of this file.

#include "SimpleCertCache.h"
#include "PKIFCacheErrors.h"
#include "ToolkitUtils.h" 
#include "Certificate.h"
#include "Name.h"
#include "PKIFCertificateNodeEntry.h"
#include "GottaMatch.h"
#include "Buffer.h"
#include "PKIFCacheException.h"

#include "IPKIFSearchCriteria.h"
#include "KeyIDBasedSearch.h"
#include "NameBasedSearch.h"
#include "IssuerNameAndSerialNumberBasedSearch.h"
#include "SubjectKeyIdentifier.h"

#include "boost/filesystem/operations.hpp"
#include "boost/filesystem/path.hpp"
#include "boost/thread/recursive_mutex.hpp"

#include "boost/numeric/conversion/cast.hpp"
#include "boost/numeric/conversion/bounds.hpp"
#include "boost/limits.hpp"

using boost::numeric_cast;
using boost::bad_numeric_cast;
using boost::dynamic_pointer_cast;

namespace fs = boost::filesystem;
#include <deque>
#include <sstream>

#ifdef _DEBUG
#include <iostream>
#endif

using namespace std;

struct SimpleCertCacheImpl
{
    SimpleCertCacheImpl ():m_me() 
    {
    };
    void _GetCertificates(const CPKIFNamePtr& subDN, CPKIFCertificateNodeList& certNodeList, PKIInfoSource source = ALL, PathBuildingDirection pbd = PBD_FORWARD);

    deque<CPKIFCertificateNodeEntryPtr> m_certList;
    //CACMonitorDataPtr m_md;
    boost::recursive_mutex m_me;

    //IPKIFCertSearch support
    void GetAllCertificates(IPKIFNameAndKeyList& keyList);
    void GetCertificatesBySubjectName(CPKIFNamePtr& n, IPKIFNameAndKeyList& keyList);
    void GetCertificatesByIssuerName(CPKIFNamePtr& n, IPKIFNameAndKeyList& keyList);
    void GetCertificatesByIssuerAndSerial(CPKIFNamePtr& n, const char* serial, IPKIFNameAndKeyList& keyList);
    void GetCertificatesByKeyIdentifier(CPKIFBufferPtr& keyId, IPKIFNameAndKeyList& keyList);
};

void SimpleCertCacheImpl::GetAllCertificates(IPKIFNameAndKeyList& keyList)
{
    if(!m_certList.empty())
    {
        deque<CPKIFCertificateNodeEntryPtr>::iterator pos;
        deque<CPKIFCertificateNodeEntryPtr>::iterator end = m_certList.end();
        for(pos = m_certList.begin(); pos != end; ++pos)
        {
            CPKIFCertificatePtr cert = (*pos)->GetCert();
            IPKIFNameAndKeyPtr inak = dynamic_pointer_cast<IPKIFNameAndKey, CPKIFCertificate>(cert);
            keyList.push_back(inak);
        }
    }
}
void SimpleCertCacheImpl::GetCertificatesBySubjectName(CPKIFNamePtr& n, IPKIFNameAndKeyList& keyList)
{
    if(!m_certList.empty())
    {
        deque<CPKIFCertificateNodeEntryPtr>::iterator pos;
        deque<CPKIFCertificateNodeEntryPtr>::iterator end = m_certList.end();
        for(pos = m_certList.begin(); pos != end; ++pos)
        {
            CPKIFCertificatePtr cert = (*pos)->GetCert();
            if(cert && *n == *cert->Subject())
            {               
                IPKIFNameAndKeyPtr inak = dynamic_pointer_cast<IPKIFNameAndKey, CPKIFCertificate>(cert);

                keyList.push_back(inak);
            }
        }
    }
}
void SimpleCertCacheImpl::GetCertificatesByIssuerName(CPKIFNamePtr& n, IPKIFNameAndKeyList& keyList)
{
    if(!m_certList.empty())
    {
        deque<CPKIFCertificateNodeEntryPtr>::iterator pos;
        deque<CPKIFCertificateNodeEntryPtr>::iterator end = m_certList.end();
        for(pos = m_certList.begin(); pos != end; ++pos)
        {
            CPKIFCertificatePtr cert = (*pos)->GetCert();
            if(cert && *n == *cert->Issuer())
            {               
                IPKIFNameAndKeyPtr inak = dynamic_pointer_cast<IPKIFNameAndKey, CPKIFCertificate>(cert);

                keyList.push_back(inak);
            }
        }
    }
}
void SimpleCertCacheImpl::GetCertificatesByIssuerAndSerial(CPKIFNamePtr& n, const char* serial, IPKIFNameAndKeyList& keyList)
{
    if(!m_certList.empty())
    {
        deque<CPKIFCertificateNodeEntryPtr>::iterator pos;
        deque<CPKIFCertificateNodeEntryPtr>::iterator end = m_certList.end();
        for(pos = m_certList.begin(); pos != end; ++pos)
        {
            CPKIFCertificatePtr cert = (*pos)->GetCert();
            if(cert && ((*n == *cert->GetIssuerName()) && 0 == stricmp(serial, cert->SerialNumber())))
            {
                IPKIFNameAndKeyPtr inak = dynamic_pointer_cast<IPKIFNameAndKey, CPKIFCertificate>(cert);
                keyList.push_back(inak);
            }
        }
    }
}
void SimpleCertCacheImpl::GetCertificatesByKeyIdentifier(CPKIFBufferPtr& keyId, IPKIFNameAndKeyList& keyList)
{
    if(!m_certList.empty())
    {
        deque<CPKIFCertificateNodeEntryPtr>::iterator pos;
        deque<CPKIFCertificateNodeEntryPtr>::iterator end = m_certList.end();
        for(pos = m_certList.begin(); pos != end; ++pos)
        {
            CPKIFCertificatePtr cert = (*pos)->GetCert();
            CPKIFBufferPtr kidFromCert;
            if(cert)
            {
                CPKIFSubjectKeyIdentifierPtr skid = cert->GetExtension<CPKIFSubjectKeyIdentifier>();
                if(skid)
                    kidFromCert = skid->KeyIdentifier();
            }

            if(kidFromCert && (*keyId == *kidFromCert))
            {
                IPKIFNameAndKeyPtr inak = dynamic_pointer_cast<IPKIFNameAndKey, CPKIFCertificate>(cert);
                keyList.push_back(inak);
            }
        }
    }
}
void SimpleCertCacheImpl::_GetCertificates(
    const CPKIFNamePtr& subDN,
    CPKIFCertificateNodeList& certNodeList,
    PKIInfoSource source,
    PathBuildingDirection pbd)
{
    LOG_STRING_DEBUG("SimpleCertCache::_GetCertificates(const CPKIFNamePtr& subDN, CPKIFCertificateNodeList& certNodeList, PKIInfoSource source)", TOOLKIT_SR_SIMPLECERTCACHE, 0, this);

#ifdef _DEBUG
    //cout << "SimpleCertCache size: " << m_impl->m_certList.size() << " fetching " << subDN->string() << endl;
#endif

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_me);
    //ignore requests for remote certificates
    if(REMOTE == source)
    {
        LOG_STRING_DEBUG("Skipping SimpleCertCache colleague - searching REMOTE sources only", TOOLKIT_SR_SIMPLECERTCACHE, 0, this);
        return;
    }

    const size_t origSize = certNodeList.size();

#ifdef _DEBUG
    const char* subDNStr = NULL;
    if(subDN)
        subDNStr = subDN->ToString();
#endif

    std::string strSource = "ImMemoryCertStore";
    deque<CPKIFCertificateNodeEntryPtr>::iterator pos;
    deque<CPKIFCertificateNodeEntryPtr>::iterator end = m_certList.end();
    for(pos = m_certList.begin(); pos != end; ++pos)
    {
        if(!subDN)
        {
            //cert nodes contain a mix of persistent info and info that should
            //not persist - create a new node object and populate it with 
            //the persistent information
            //throw bad_alloc; nothing to clean up in this function
            CPKIFCertificateNodeEntryPtr certNode(new CPKIFCertificateNodeEntry);
            certNode->SetCert((*pos)->GetCert());
            certNode->SetSource((*pos)->GetSource());

            certNode->AddSource(strSource);
            certNodeList.push_back(certNode);
        }
        else if(PBD_FORWARD == pbd && *subDN == *(*pos)->GetCert()->Subject())
        {
            //cert nodes contain a mix of persistent info and info that should
            //not persist - create a new node object and populate it with 
            //the persistent information
            //throw bad_alloc; nothing to clean up in this function
            CPKIFCertificateNodeEntryPtr certNode(new CPKIFCertificateNodeEntry);
            certNode->SetCert((*pos)->GetCert());
            certNode->SetSource((*pos)->GetSource());

            GottaMatch<CPKIFCertificateNodeEntryPtr> gm;
            gm.SetRHS(certNode);
            if(certNodeList.end() == find_if(certNodeList.begin(), certNodeList.end(), gm))
            {
                certNode->AddSource(strSource);
                certNodeList.push_back(certNode);
            }
        }
        else if(PBD_REVERSE == pbd && *subDN == *(*pos)->GetCert()->Issuer())
        {
            //cert nodes contain a mix of persistent info and info that should
            //not persist - create a new node object and populate it with 
            //the persistent information
            //throw bad_alloc; nothing to clean up in this function
            CPKIFCertificateNodeEntryPtr certNode(new CPKIFCertificateNodeEntry);
            certNode->SetCert((*pos)->GetCert());
            certNode->SetSource((*pos)->GetSource());

            GottaMatch<CPKIFCertificateNodeEntryPtr> gm;
            gm.SetRHS(certNode);
            if(certNodeList.end() == find_if(certNodeList.begin(), certNodeList.end(), gm))
            {
                certNode->AddSource(strSource);
                certNodeList.push_back(certNode);
            }
        }
    }

    if(origSize != certNodeList.size())
    {
        std::string logStr = "Found one or more certificates for subject ";
        if(subDN)
            logStr.append(subDN->ToString());
        else
            logStr.append("empty");
        LOG_STRING_DEBUG(logStr.c_str(), TOOLKIT_SR_SIMPLECERTCACHE, 0, this);
    }
    else
    {
        std::string logStr = "Failed to find a certificate for subject ";
        if(subDN)
            logStr.append(subDN->ToString());
        else
            logStr.append("empty");
        LOG_STRING_DEBUG(logStr.c_str(), TOOLKIT_SR_SIMPLECERTCACHE, 0, this);
    }
}


CAC_API SimpleCertCache* MakeSimpleCertCache()
{
    return new SimpleCertCache();
}
CAC_API void FreeSimpleCertCache(
    SimpleCertCache* s)
{
    if(s)
    {
        delete s;
    }
}

SimpleCertCache::SimpleCertCache(void)
    :m_impl (new SimpleCertCacheImpl)
{
    LOG_STRING_DEBUG("SimpleCertCache::SimpleCertCache(void)", TOOLKIT_SR_SIMPLECERTCACHE, 0, this);
}
SimpleCertCache::~SimpleCertCache(void)
{
    LOG_STRING_DEBUG("SimpleCertCache::~SimpleCertCache(void)", TOOLKIT_SR_SIMPLECERTCACHE, 0, this);

    delete m_impl;
    m_impl = NULL;
}

//IPKIFColleague functions
void SimpleCertCache::Initialize(void)
{
    LOG_STRING_DEBUG("SimpleCertCache::Initialize(void)", TOOLKIT_SR_SIMPLECERTCACHE, 0, this);
}
void SimpleCertCache::Clear()
{
    LOG_STRING_DEBUG("SimpleCertCache::Clear()", TOOLKIT_SR_SIMPLECERTCACHE, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    LOG_STRING_DEBUG("Emptying SimpleCertCache instance", thisComponent, 0, this);
    m_impl->m_certList.clear();
}
int SimpleCertCache::size()
{
    int len = 0;

    try 
    {
        len = numeric_cast<int>(m_impl->m_certList.size());
        return len;
    }
    catch(bad_numeric_cast &) 
    {
        throw CPKIFException(TOOLKIT_CACHE, COMMON_INVALID_INPUT, "Cache size is larger than maximum integer size.");
    }
}

void SimpleCertCache::GetCertificates(
    const CPKIFNamePtr& subDN, 
    CPKIFCertificateList& certList, 
    PKIInfoSource source)
{
    LOG_STRING_DEBUG("SimpleCertCache::GetCertificates(const CPKIFNamePtr& subDN, CPKIFCertificateList& certList, PKIInfoSource source)", TOOLKIT_SR_SIMPLECERTCACHE, 0, this);
    CPKIFCertificateNodeList nodeList;
    m_impl->_GetCertificates(subDN, nodeList, source, PBD_FORWARD);

    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);

    const size_t origSize = certList.size();

#ifdef _DEBUG
    const char* subDNStr = NULL;
    if(subDNStr)
        subDNStr = subDN->ToString();
#endif
    
    CPKIFCertificateNodeList::iterator pos;
    CPKIFCertificateNodeList::iterator end = nodeList.end();
    for(pos = nodeList.begin(); pos != end; ++pos)
    {
        CPKIFCertificatePtr posCert = (*pos)->GetCert();
        if(!subDN)
        {
            GottaMatch<CPKIFCertificatePtr> gm;
            gm.SetRHS(posCert);
            if(certList.end() == find_if(certList.begin(), certList.end(), gm))
                certList.push_back(posCert);
        }
        else if(*subDN == *(posCert->Subject()))
        {
            GottaMatch<CPKIFCertificatePtr> gm;
            gm.SetRHS(posCert);
            if(certList.end() == find_if(certList.begin(), certList.end(), gm))
                certList.push_back(posCert);
        }
    }

    if(origSize != certList.size())
    {
        std::string logStr = "Found one or more certificates for subject ";
        if(subDN)
            logStr.append(subDN->ToString());
        else
            logStr.append("empty");
        LOG_STRING_DEBUG(logStr.c_str(), thisComponent, 0, this);
    }
    else
    {
        std::string logStr = "Failed to find a certificate for subject ";
        if(subDN)
            logStr.append(subDN->ToString());
        else
            logStr.append("empty");
        LOG_STRING_DEBUG(logStr.c_str(), thisComponent, 0, this);
    }
}

void SimpleCertCache::GetCertificates(
    const CPKIFCertificatePtr& cert, 
    CPKIFCertificateList& certList, 
    PKIInfoSource source, 
    PathBuildingDirection pbd)
{
    if(PBD_FORWARD == pbd)
    {
        //CPKIFNamePtr subName = cert->Subject();
        CPKIFNamePtr subName = cert->Issuer();
        GetCertificates(subName, certList, source);
    }
    else
    {
        //CPKIFNamePtr issName = cert->Issuer();
        CPKIFNamePtr issName = cert->Subject();
        CPKIFCertificateNodeList nodeList;

        m_impl->_GetCertificates(issName, nodeList, source, PBD_REVERSE);

        CPKIFCertificateNodeList::iterator pos;
        CPKIFCertificateNodeList::iterator end = nodeList.end();
        for(pos = nodeList.begin(); pos != end; ++pos)
        {
            CPKIFCertificatePtr posCert = (*pos)->GetCert();
            if(*issName == *(posCert->Issuer()))
            {
                GottaMatch<CPKIFCertificatePtr> gm;
                gm.SetRHS(posCert);
                if(certList.end() == find_if(certList.begin(), certList.end(), gm))
                    certList.push_back(posCert);
            }
        }
    }
}
void SimpleCertCache::GetCertificates(
    const CPKIFCertificatePtr& cert, 
    CPKIFCertificateNodeList& certNodeList, 
    PKIInfoSource source, 
    PathBuildingDirection pbd)
{
    //if(PBD_FORWARD == pbd)
    //  m_impl->_GetCertificates(cert->Subject(), certNodeList, source, PBD_FORWARD);
    //else
    //  m_impl->_GetCertificates(cert->Issuer(), certNodeList, source, PBD_REVERSE);

    if(PBD_FORWARD == pbd)
        m_impl->_GetCertificates(cert->Issuer(), certNodeList, source, PBD_FORWARD);
    else
        m_impl->_GetCertificates(cert->Subject(), certNodeList, source, PBD_REVERSE);
}

void SimpleCertCache::AddCertificate(
    CertType certType,
    const CPKIFCertificatePtr& cert)
{
    LOG_STRING_DEBUG("SimpleCertCache::AddCertificate(CertType certType, const CPKIFCertificatePtr& cert)", TOOLKIT_SR_SIMPLECERTCACHE, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);
    CPKIFCertificatePtr* certPtrPtr = const_cast<CPKIFCertificatePtr*>(&cert);
    
    //throw bad_alloc; nothing to clean up in this function
    CPKIFCertificateNodeEntryPtr certNode(new CPKIFCertificateNodeEntry);
    certNode->SetCert(*certPtrPtr);
    AddCertificate(certType, certNode);
    LOG_STRING_DEBUG("Successfully added certificate to SimpleCertCache store", thisComponent, 0, this);
}
void SimpleCertCache::AddCertificate(
    CertType certType,
    const CPKIFCertificateNodeEntryPtr& certNode)
{
    LOG_STRING_DEBUG("SimpleCertCache::AddCertificate(CertType certType, const CPKIFCertificateNodeEntryPtr& certNode)", TOOLKIT_SR_SIMPLECERTCACHE, 0, this);

    //CCACSynchronizedObject so(m_impl->m_md);
    boost::recursive_mutex::scoped_lock lock(m_impl->m_me);

    //don't add self-signed certs to the intermediate CA cache 7/28/2005
    if(certNode->GetCert()->IsSelfSigned())
        return;

    GottaMatch<CPKIFCertificateNodeEntryPtr> gm;
    gm.SetRHS(certNode);

    //avoid growing the cache with duplicates
    if(m_impl->m_certList.end() == find_if(m_impl->m_certList.begin(), m_impl->m_certList.end(), gm))
    {
        //don't store a reference to the actual node passed in.
        //extract the stuff we want and store a new node that is 
        //populated with that info.
        //throw bad_alloc; nothing to clean up in this function
        CPKIFCertificateNodeEntryPtr newCertNode(new CPKIFCertificateNodeEntry);
        newCertNode->SetCert(certNode->GetCert());
        newCertNode->SetSource(certNode->GetSource());

        m_impl->m_certList.push_back(newCertNode);

        std::ostringstream os;
        os << "Successfully added certificate to SimpleCertCache store.  Size =  " << m_impl->m_certList.size() << " after addition.";
        LOG_STRING_DEBUG(os.str().c_str(), thisComponent, 0, this)
    }
}

void SimpleCertCache::GetCertificates(
    const CPKIFNamePtr& subDN,
    CPKIFCertificateNodeList& certNodeList,
    PKIInfoSource source)
{
    m_impl->_GetCertificates(subDN, certNodeList, source, PBD_FORWARD);
}

void SimpleCertCache::WriteCertsToDirectory(
    const char * path)
{
    try
    {
        std::string CertdirPath  = path;
        deque<CPKIFCertificateNodeEntryPtr>::iterator pos;
        deque<CPKIFCertificateNodeEntryPtr>::iterator end = m_impl->m_certList.end();
        for(pos = m_impl->m_certList.begin(); pos != end; ++pos)
        {
            CPKIFCertificatePtr cert = (*pos)->GetCert();
            string tmpCertName = cert->Subject()->ToString();           
            string tmpCertSerial = cert->SerialNumber();
            string tmpPath = CertdirPath;
            if(tmpPath[tmpPath.size() -1] != '\\')
                tmpPath.append("\\");
            tmpPath.append(tmpCertName);
            tmpPath.append("_");
            tmpPath.append(tmpCertSerial);
            tmpPath.append(".cer");

            FILE* f = fopen(tmpPath.c_str(), "wb");
            fwrite(cert->Encoded()->GetBuffer(), 1, cert->Encoded()->GetLength(), f);
            fclose(f);

        }
    

    
    }catch( const std::exception&)
    {
            RAISE_CACHE_EXCEPTION("Error Writing files to a directory", thisComponent, COMMON_UNKNOWN_ERROR, this)
     }
}

void SimpleCertCache::ReadCertsFromDirectory(
    const char * path)
{
    fs::path full_path( fs::initial_path() );

    if(NULL != path)
        full_path = fs::system_complete( fs::path( path, fs::native ) );
    else
        RAISE_CACHE_EXCEPTION("NULL Pointer passed as a parameter", thisComponent, COMMON_INVALID_INPUT, this)

    if ( !fs::exists( full_path ) )
    {
        RAISE_CACHE_EXCEPTION("Invalid Path", thisComponent, COMMON_INVALID_INPUT, this)
    }   

   fs::directory_iterator end_iter;
   for ( fs::directory_iterator dir_itr( full_path ); dir_itr != end_iter; ++dir_itr )
   {
       try
       {
           if ( !fs::is_directory( *dir_itr ) )
           {
                FILE* f = fopen(dir_itr->string().c_str(), "rb");

                unsigned char *certraw = NULL;
                boost::intmax_t certrawlen = fs::file_size( *dir_itr );

                if(certrawlen > boost::numeric::bounds<int>::highest())
                {
                    throw CPKIFCacheException(TOOLKIT_SR_SIMPLECERTCACHE, COMMON_INVALID_INPUT, "Certificate too big.");
                }

                int tmpST = 0;
                try 
                {
                    tmpST = numeric_cast<int>(certrawlen);
                }
                catch(bad_numeric_cast &) 
                {
                    throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Certificate size too big.");
                }

                certraw = new unsigned char[tmpST];
                size_t bytesread = fread(certraw, 1, tmpST, f);
            
                CPKIFCertificatePtr cert(new CPKIFCertificate);
                cert->Decode(certraw, tmpST);
            
                
                AddCertificate(CA ,cert);
                
                fclose(f);
                delete[] certraw;
           }
       }
       catch( const std::exception & )
       {
            RAISE_CACHE_EXCEPTION("Unable to open file", thisComponent, COMMON_UNKNOWN_ERROR, this)
       }

   }
    
}
void SimpleCertCache::GetCertificates(
    std::vector<CPKIFCertificatePtr>& v)
{
    deque<CPKIFCertificateNodeEntryPtr>::iterator pos; 
    deque<CPKIFCertificateNodeEntryPtr>::iterator end = m_impl->m_certList.end();
    for(pos = m_impl->m_certList.begin(); pos != end; ++pos)
    {
        v.push_back((*pos)->GetCert());
    }
}

void SimpleCertCache::FindCertificates(IPKIFSearchCriteria* searchCriteria, CPKIFCertificateList& certList, PKIInfoSource source)
{
    if(!searchCriteria)
        return;

    IPKIFNameAndKeyList keyList;
    FindKeys(searchCriteria, keyList, source);

    IPKIFNameAndKeyList::iterator pos;
    IPKIFNameAndKeyList::iterator end = keyList.end();
    for(pos = keyList.begin(); pos != end; ++pos)
    {
        CPKIFCertificatePtr cert = dynamic_pointer_cast<CPKIFCertificate, IPKIFNameAndKey>(*pos);
        if(cert)
            certList.push_back(cert);
    }
}

void SimpleCertCache::FindKeys(IPKIFSearchCriteria* searchCriteria, IPKIFNameAndKeyList& keyList, PKIInfoSource source)
{
    if(!searchCriteria)
        return;

    switch(searchCriteria->GetSearchType())
    {
    case ALLCERTS:
        m_impl->GetAllCertificates(keyList);
        break;
    case ISSUERNAME:
        {
            CPKIFNameBasedSearch* nbs = dynamic_cast<CPKIFNameBasedSearch*>(searchCriteria);

            CPKIFNamePtr tmpName = nbs->GetName();
            m_impl->GetCertificatesBySubjectName(tmpName, keyList);
        }
        break;
    case SUBJECTNAME:
        {
            CPKIFNameBasedSearch* nbs = dynamic_cast<CPKIFNameBasedSearch*>(searchCriteria);

            CPKIFNamePtr tmpName = nbs->GetName();
            m_impl->GetCertificatesByIssuerName(tmpName, keyList);
        }
        break;
    case ISSUERSERIAL:
        {
            CPKIFIssuerNameAndSerialNumberBasedSearch* inasnbs = dynamic_cast<CPKIFIssuerNameAndSerialNumberBasedSearch*>(searchCriteria);

            CPKIFNamePtr tmpName = inasnbs->GetIssuerName();
            m_impl->GetCertificatesByIssuerAndSerial(tmpName, inasnbs->GetSerialNumber(), keyList);
            break;
        }
    case KEYID:
        {
            CPKIFKeyIDBasedSearch* kidbs = dynamic_cast<CPKIFKeyIDBasedSearch*>(searchCriteria);
            if(!kidbs)
                return;

            CPKIFBufferPtr kid = kidbs->GetKeyID();
            m_impl->GetCertificatesByKeyIdentifier(kid, keyList);
            break;
        }
    default:
        return;
    };
}