ToolkitUtils.cpp

Go to the documentation of this file.

#include "ToolkitUtils.h"
#include "PKIFAlgorithm.h"


#ifdef _WIN32
#ifdef _DEBUG
#include <crtdbg.h>
#endif
#include "PKIFCAPIRepository2.h"
#include "PKIFCAPIUserRepository2.h"
#include "PKIFCAPITrustStore2.h"
#include "PKIFPathBuildAndValidate.h"
#include "PKIFCAPIRaw.h"
#include "PKIFCNGCAPIRaw.h"
#include "PKIFCNGCAPI.h"
#include "PKIFBCryptGuard.h"
#include "CAPITrustRootCRLRepository2.h"
#include "CAPICRLUpdate2.h"
#include "CAPICertUpdate2.h"
#include "PKIFCAPI2.h"
#endif

#include "PKIFAiaOrSiaRetrieval.h"
#include "PKIFMediators.h"
#include "IPKIFTrustCacheUpdate.h"
#include "IPKIFCryptoKeyManagement.h"
#include "IPKIFCryptoKeyIDOperations.h"
#include "IPKIFDefaultPathManagement.h"
#include "PKIFCacheMediator2.h"
#include "CPKIFPathProcessingMediator2.h"
#include "CPKIFRevocationStatusMediator2.h"
#include "CPKIFCryptoMediator2.h"
#include "SimpleCertCache.h"
#include "SimpleCRLCache.h"
#include "PKIFCRLDPRetrieval.h"
#include "PKIFX509CRLChecker.h"
#include "PKIFCryptUtils.h"
#include "HttpServerBlacklist.h"

#include "PKIFOCSPChecker.h"

#include "CRLDistributionPoints.h"
#include "GeneralSubtree.h"
#include "DistributionPointName.h"
#include "CRLDistributionPoint.h"

#include "ASN1Helper.h"
#include "PKIX1Implicit88.h"
#include "PKIX1Explicit88.h"

#include "PKIFNameMemoryHelper.h"
#include "PKIFErrors.h"

#include "Buffer.h"
#include "OID.h"
#include "GeneralName.h"
#include "AlgorithmIdentifier.h"
#include "Certificate.h"
#include "ExtendedKeyUsage.h"
#include "GottaMatch.h"
#include "KeyUsage.h"

#include "IPKIFCryptoAlgSupport.h"

#include "PKIFNSSRepository.h"
#include "PKIFNSSPasswordStorage.h"
#include "PKIFNSSCertUpdate.h"
#include "PKIFNSSCRLUpdate.h"
#include "PKIFNSSTrustStore.h"
#include "PKIFNSSRaw.h"
#include "PKIFNSS.h"

#include "ASN1HelperLib.h"
#include "ToolkitutilsPrivate.h"
#include "LDAP_URL_Header.h"
#include "CSingletonLDAPConnection.h"

#include "boost/cstdint.hpp"
#include "boost/numeric/conversion/cast.hpp"
#include "boost/asio/io_service.hpp"
#include "boost/asio/ip/address.hpp"
#include "boost/asio/ip/address_v4.hpp"
#include "boost/asio/ip/address_v6.hpp"

using boost::numeric_cast;
using boost::bad_numeric_cast;
using boost::asio::ip::address_v4;
using boost::asio::ip::address_v6;
using boost::asio::ip::address;
using boost::asio::io_service;

using namespace boost;
using namespace boost::asio;
//namespace ip = boost::asio::ip;

#if defined(_WIN32) || defined(WIN32)
#define STRCASECMP stricmp
#else
#define STRCASECMP strcasecmp
#endif

#include <sstream>
#include <cstdio>

// GIB: wininet is not server-safe. Replacing with libcurl
// #include "wininet.h"
#include "curl/curl.h"

#ifdef _NO_GETTICKCOUNT
#include <sys/time.h>
#endif //_NO_GETTICKCOUNT

// these are normally defined in wincrypt.h
#ifndef _WIN32
// Byte[0]
#define CERT_DIGITAL_SIGNATURE_KEY_USAGE     0x80
#define CERT_NON_REPUDIATION_KEY_USAGE       0x40
#define CERT_KEY_ENCIPHERMENT_KEY_USAGE      0x20
#define CERT_DATA_ENCIPHERMENT_KEY_USAGE     0x10
#define CERT_KEY_AGREEMENT_KEY_USAGE         0x08
#define CERT_KEY_CERT_SIGN_KEY_USAGE         0x04
#define CERT_OFFLINE_CRL_SIGN_KEY_USAGE      0x02
#define CERT_CRL_SIGN_KEY_USAGE              0x02
#define CERT_ENCIPHER_ONLY_KEY_USAGE         0x01
// Byte[1]
#define CERT_DECIPHER_ONLY_KEY_USAGE         0x80
#endif 

using namespace std;
//added 11/26/2003 to support VC6

using namespace PKIFLDAP;
CAC_API IPKIFCertRepository* Get_IPKIFCertRepository(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFCertRepository>(); else return NULL;
}
CAC_API IPKIFCertRepositoryUpdate* Get_IPKIFCertRepositoryUpdate(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFCertRepositoryUpdate>(); else return NULL;
}
CAC_API IPKIFCertSearch* Get_IPKIFCertSearch(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFCertSearch>(); else return NULL;
}
CAC_API IPKIFCRLRepository* Get_IPKIFCRLRepository(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFCRLRepository>(); else return NULL;
}
CAC_API IPKIFCRLRepositoryUpdate* Get_IPKIFCRLRepositoryUpdate(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFCRLRepositoryUpdate>(); else return NULL;
}
CAC_API IPKIFTrustCache* Get_IPKIFTrustCache(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFTrustCache>(); else return NULL;
}
CAC_API IPKIFTrustCacheUpdate* Get_IPKIFTrustCacheUpdate(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFTrustCacheUpdate>(); else return NULL;
}

//crypto
CAC_API IPKIFCryptoKeyManagement* Get_IPKIFCryptoKeyManagement(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFCryptoKeyManagement>(); else return NULL;
}
CAC_API IPKIFCryptoKeyIDOperations* Get_IPKIFCryptoKeyIDOperations(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFCryptoKeyIDOperations>(); else return NULL;
}
CAC_API IPKIFCryptoMisc* Get_IPKIFCryptoMisc(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFCryptoMisc>(); else return NULL;
}
CAC_API IPKIFCryptoRawOperations* Get_IPKIFCryptoRawOperations(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFCryptoRawOperations>(); else return NULL;
}
CAC_API IPKIFCryptoAlgSupport* Get_IPKIFCryptoAlgSupport(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFCryptoAlgSupport>(); else return NULL;
}

//path
CAC_API IPKIFDefaultPathManagement* Get_IPKIFDefaultPathManagement(
    IPKIFMediatorPtr& m)
{
    if(m) return m->GetMediator<IPKIFDefaultPathManagement>(); else return NULL;
}
//CAC_API IPKIFPathBuild* Get_IPKIFPathBuild(IPKIFMediatorPtr& m)
//{
//  if(m) return m->GetMediator<IPKIFPathBuild>(); else return NULL;
//}
//CAC_API IPKIFPathValidate* Get_IPKIFPathValidate(IPKIFMediatorPtr& m)
//{
//  if(m) return m->GetMediator<IPKIFPathValidate>(); else return NULL;
//}
//
//CAC_API IPKIFRevocationStatus* Get_IPKIFRevocationStatus(IPKIFMediatorPtr& m)
//{
//  if(m) return m->GetMediator<IPKIFRevocationStatus>(); else return NULL;
//}
CAC_API void AddCacheColleague(
    IPKIFMediatorPtr& m,
    IPKIFColleaguePtr& c)
{
    CPKIFCacheMediator2 * i = m->GetMediator<CPKIFCacheMediator2>();
        if(i)
            i->AddColleague(c);
}

CAC_API IPKIFMediatorPtr MakeDefaultMediator(
    bool isService)
{
    CPKIFOCSPCheckerPtr empty;
    return MakeDefaultMediator(isService, empty, empty);
}

CAC_API IPKIFMediatorPtr MakeDefaultMediator(
    bool isService,
    CPKIFOCSPCheckerPtr& trustedResponder)
{
    CPKIFOCSPCheckerPtr empty;
    return MakeDefaultMediator(isService, trustedResponder, empty);
}

//added aiaColleague parameter to accomodate adding a signer to the AIA-focused responder
CAC_API IPKIFMediatorPtr MakeDefaultMediator(
    bool isService, 
    CPKIFOCSPCheckerPtr& trustedResponder,
    CPKIFOCSPCheckerPtr& aiaColleague)
{
    LOG_STRING_DEBUG("MakeDefaultMediator", TOOLKIT_UTILS_SUBCOMPONENT, 0, NULL);

    //began migration to template free mediators/colleagues 6/30/2004

    //create four mediators
    CPKIFCacheMediator2Ptr cache;       
    CPKIFCryptoMediator2Ptr crypto;                 
    CPKIFRevocationStatusMediator2Ptr revStatus;
    CPKIFPathProcessingMediator2Ptr path;

    try
    {
        //-----------------------------------------------------------------------------
        //  CPKIFCacheMediator2
        //      Not using the defaults, thus false to the constructor
        //-----------------------------------------------------------------------------
        CPKIFCacheMediator2Ptr tmpCache(new CPKIFCacheMediator2(false));        
        cache = tmpCache;
        cache->InitializeMediator(NULL);

#ifdef _WIN32
        if(!isService)
        {
            CPKIFCAPITrustStore2Ptr rootStoreCerts(new CPKIFCAPITrustStore2());
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague, CPKIFCAPITrustStore2>(rootStoreCerts));

            CPKIFCAPITrustRootCRLRepository2Ptr rootStoreCRLs(new CPKIFCAPITrustRootCRLRepository2);
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPITrustRootCRLRepository2>(rootStoreCRLs));
        }
        else
        {
            CPKIFCAPITrustStore2Ptr rootStoreCerts(new CPKIFCAPITrustStore2(CERT_SYSTEM_STORE_LOCAL_MACHINE));
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPITrustStore2>(rootStoreCerts));

            CPKIFCAPITrustRootCRLRepository2Ptr rootStoreCRLs(new CPKIFCAPITrustRootCRLRepository2(CERT_SYSTEM_STORE_LOCAL_MACHINE));
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPITrustRootCRLRepository2>(rootStoreCRLs));
        }

        if(!isService)
        {
            CPKIFCAPIRepository2Ptr caStoreCerts(new CPKIFCAPIRepository2());
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPIRepository2>(caStoreCerts));

            CPKIFCAPICRLUpdate2Ptr crlUpdate(new CPKIFCAPICRLUpdate2());
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPICRLUpdate2>(crlUpdate));

            CPKIFCAPICRLUpdate2Ptr crlUpdate2(new CPKIFCAPICRLUpdate2(CERT_SYSTEM_STORE_CURRENT_USER, g_defCACCAPITrustStore));
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPICRLUpdate2>(crlUpdate2));

            CPKIFCAPICertUpdate2Ptr certUpdate(new CPKIFCAPICertUpdate2());
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPICertUpdate2>(certUpdate));

            //added 11/6/2003
            CPKIFCAPIUserRepository2Ptr userRep(new CPKIFCAPIUserRepository2());
            try
            {
                cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPIUserRepository2>(userRep));
            }
            catch(CPKIFException&)
            {
                //OtherPeople store is not necessarily present
                //if(userRep)
                //  delete userRep;
            }

            CPKIFCAPIUserRepository2Ptr userRep2(new CPKIFCAPIUserRepository2(CERT_SYSTEM_STORE_CURRENT_USER, "My"));
            try
            {
                cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPIUserRepository2>(userRep2));
            }
            catch(CPKIFException&)
            {
                //My store is not necessarily present
                //if(userRep2)
                //  delete userRep2;
            }

            //added 6/4/2004
            CPKIFCAPIUserRepository2Ptr userRepIntermediateCAs(new CPKIFCAPIUserRepository2(CERT_SYSTEM_STORE_CURRENT_USER, g_defCACCAPIStore));
            try
            {
                cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPIUserRepository2>(userRepIntermediateCAs));
            }
            catch(CPKIFException&)
            {
                //if(userRepIntermediateCAs)
                //  delete userRepIntermediateCAs;
            }
            CPKIFCAPIUserRepository2Ptr userRepTAs(new CPKIFCAPIUserRepository2(CERT_SYSTEM_STORE_CURRENT_USER, g_defCACCAPITrustStore));
            try
            {
                cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPIUserRepository2>(userRepTAs));
            }
            catch(CPKIFException&)
            {
                //if(userRepIntermediateCAs)
                //  delete userRepIntermediateCAs;
            }
        }
        else
        {
            CPKIFCAPIRepository2Ptr caStoreCerts(new CPKIFCAPIRepository2(CERT_SYSTEM_STORE_LOCAL_MACHINE));
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPIRepository2>(caStoreCerts));

            CPKIFCAPICRLUpdate2Ptr crlUpdate(new CPKIFCAPICRLUpdate2(CERT_SYSTEM_STORE_LOCAL_MACHINE));
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPICRLUpdate2>(crlUpdate));

            //added 3/6/2004
            CPKIFCAPICRLUpdate2Ptr crlUpdate2(new CPKIFCAPICRLUpdate2(CERT_SYSTEM_STORE_LOCAL_MACHINE, g_defCACCAPITrustStore));
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPICRLUpdate2>(crlUpdate2));

            CPKIFCAPICertUpdate2Ptr certUpdate(new CPKIFCAPICertUpdate2(CERT_SYSTEM_STORE_LOCAL_MACHINE));
            cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPICertUpdate2>(certUpdate));

            //added 11/6/2003
            CPKIFCAPIUserRepository2Ptr userRep(new CPKIFCAPIUserRepository2(CERT_SYSTEM_STORE_LOCAL_MACHINE));
            try
            {
                cache->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPIUserRepository2>(userRep));
            }
            catch(CPKIFException&)
            {
                //OtherPeople store is not necessarily present
                //if(userRep)
                //  delete userRep;
            }

            //no My store for services
        }

#endif

        SimpleCertCachePtr certCache(new SimpleCertCache);
        certCache->Initialize();
        // GCC does not consider the result of dynamic_pointer_cast to be a reference when
        // included in the function call.
        IPKIFColleaguePtr cp = dynamic_pointer_cast<IPKIFColleague,SimpleCertCache>(certCache);
        cache->AddColleague(cp);

        SimpleCRLCachePtr crlCache(new SimpleCRLCache);
        crlCache->Initialize();
        cp = dynamic_pointer_cast<IPKIFColleague,SimpleCRLCache>(crlCache);
        cache->AddColleague(cp);

        //uncommented this (3/6/2004)
        CPKIFCRLDPRetrievalPtr crldpRetrieval(new CPKIFCRLDPRetrieval);
        cp = dynamic_pointer_cast<IPKIFColleague,CPKIFCRLDPRetrieval>(crldpRetrieval);
        cache->AddColleague(cp);

        CPKIFAiaOrSiaRetrievalPtr siaAia(new CPKIFAiaOrSiaRetrieval);
        cp = dynamic_pointer_cast<IPKIFColleague, CPKIFAiaOrSiaRetrieval>(siaAia);
        cache->AddColleague(cp);

        //-----------------------------------------------------------------------------
        //  CPKIFCryptoMediator2
        //      For non-service usage, the defaults are fine.  For services, need non-default
        //  colleagues that target the local machine store.
        //-----------------------------------------------------------------------------
        if(!isService)
        {
            //defaults will be included when true is passed to constructor
            CPKIFCryptoMediator2Ptr tmpCrypto(new CPKIFCryptoMediator2(true));                  
            crypto = tmpCrypto;
            crypto->InitializeMediator(NULL);
        }
        else
        {
            //defaults are not desirable so false is passed (or parameter not specified)
            CPKIFCryptoMediator2Ptr tmpCrypto(new CPKIFCryptoMediator2(false));                 
            crypto = tmpCrypto;
            crypto->InitializeMediator(NULL);
#ifdef _WIN32
            CPKIFBCryptGuard cngGuard;
            if(!cngGuard.IsCNGAvailable())
            {
                CPKIFCAPI2Ptr newCAPI(new CPKIFCAPI2(NULL, 0, CERT_SYSTEM_STORE_LOCAL_MACHINE));
                CPKIFCAPIRawPtr newCAPIRaw(new CPKIFCAPIRaw());

                crypto->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPI2>(newCAPI));
                crypto->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCAPIRaw>(newCAPIRaw));
            } else {
                CPKIFCNGCAPIPtr newCAPI(new CPKIFCNGCAPI(NULL, 0, CERT_SYSTEM_STORE_LOCAL_MACHINE));
                CPKIFCNGCAPIRawPtr newCAPIRaw(new CPKIFCNGCAPIRaw());

                crypto->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCNGCAPI>(newCAPI));
                crypto->AddColleague(dynamic_pointer_cast<IPKIFColleague,CPKIFCNGCAPIRaw>(newCAPIRaw));
            }
#endif
        }

        //-----------------------------------------------------------------------------
        //  CPKIFRevocationStatusMediator2
        //      Do not include the default colleagues in case there was a
        // trusted OCSP reponder specified by the caller.
        //-----------------------------------------------------------------------------
        CPKIFRevocationStatusMediator2Ptr tmpRevStatus(new CPKIFRevocationStatusMediator2(false));
        revStatus = tmpRevStatus;
        revStatus->InitializeMediator(NULL);

        if(trustedResponder)
        {
            // GCC does not consider the result of dynamic_pointer_cast to be a reference when
            // included in the function call.
            IPKIFColleaguePtr trcp = dynamic_pointer_cast<IPKIFColleague,CPKIFOCSPChecker>(trustedResponder);
            revStatus->AddColleague(trcp); //added 12/11/2003
        }

        CPKIFOCSPCheckerPtr ocspChecker(new CPKIFOCSPChecker());
        // GCC does not consider the result of dynamic_pointer_cast to be a reference when
        // included in the function call.
        IPKIFColleaguePtr ocp = dynamic_pointer_cast<IPKIFColleague,CPKIFOCSPChecker>(ocspChecker);
        revStatus->AddColleague(ocp);

        if(aiaColleague != (CPKIFOCSPChecker*)NULL)
        {
            aiaColleague = ocspChecker;
        }

        CPKIFX509CRLCheckerPtr crlChecker(new CPKIFX509CRLChecker());
        // GCC does not consider the result of dynamic_pointer_cast to be a reference when
        // included in the function call.
        IPKIFColleaguePtr crlcp = dynamic_pointer_cast<IPKIFColleague,CPKIFX509CRLChecker>(crlChecker);
        revStatus->AddColleague(crlcp);

        //-----------------------------------------------------------------------------
        //  CPKIFPathProcessingMediator2
        //      - This mediator will include all of the desirable default colleagues
        //  when true is passed to the constructor.
        //-----------------------------------------------------------------------------
        CPKIFPathProcessingMediator2Ptr tmpPath(new CPKIFPathProcessingMediator2(true));
        path = tmpPath;
        path->InitializeMediator(NULL);

        //-----------------------------------------------------------------------------
        // Assemble the collection.   
        //-----------------------------------------------------------------------------
        IPKIFMediatorPtr mp = dynamic_pointer_cast<IPKIFMediator, CPKIFCacheMediator2>(cache);
        path->AddMediator(mp);
        mp = dynamic_pointer_cast<IPKIFMediator, CPKIFCryptoMediator2>(crypto);
        path->AddMediator(mp);
        mp = dynamic_pointer_cast<IPKIFMediator, CPKIFRevocationStatusMediator2>(revStatus);
        path->AddMediator(mp);

        return dynamic_pointer_cast<IPKIFMediator, CPKIFPathProcessingMediator2>(path);
    }
    catch(...)
    {
        throw;
    }
}
void CAC_API FreeDefaultMediator(
    IPKIFMediator* p)
{
    if(p) {
        delete p;
        // this should currently NOP if NSS isn't in use
        ShutdownCrypto();
    }
}

CAC_API IPKIFMediatorPtr MakeDefaultMediatorNSS(const char *db)
{
    CPKIFOCSPCheckerPtr empty;
    return MakeDefaultMediatorNSS(db, empty, empty);
}

CAC_API IPKIFMediatorPtr MakeDefaultMediatorNSS(const char *db, CPKIFOCSPCheckerPtr& trustedResponder)
{
    CPKIFOCSPCheckerPtr empty;
    return MakeDefaultMediatorNSS(db, trustedResponder, empty);
}

//added aiaColleague parameter to accomodate adding a signer to the AIA-focused responder
CAC_API IPKIFMediatorPtr MakeDefaultMediatorNSS(
    const char *dbdir, 
    CPKIFOCSPCheckerPtr& trustedResponder, 
    CPKIFOCSPCheckerPtr& aiaColleague)
{   

    CPKIFCacheMediator2Ptr cache;       
    CPKIFCryptoMediator2Ptr crypto;                 
    CPKIFRevocationStatusMediator2Ptr revStatus;
    CPKIFPathProcessingMediator2Ptr path;
    IPKIFColleaguePtr cp;
    try
    {
        CPKIFCacheMediator2Ptr tmpCache(new CPKIFCacheMediator2(false));        
        cache = tmpCache;
        cache->InitializeMediator(NULL);

        //Setting up SR (Cache)
        SimpleCertCachePtr certCache(new SimpleCertCache);
        certCache->Initialize();
        cp = dynamic_pointer_cast<IPKIFColleague,SimpleCertCache>(certCache);
        cache->AddColleague(cp);

        SimpleCRLCachePtr crlCache(new SimpleCRLCache);
        crlCache->Initialize();
        cp = dynamic_pointer_cast<IPKIFColleague,SimpleCRLCache>(crlCache);
        cache->AddColleague(cp);


        CPKIFNSSRepositoryPtr repo(new CPKIFNSSRepository(dbdir));
        repo->Initialize();
        cp = dynamic_pointer_cast<IPKIFColleague,CPKIFNSSRepository>(repo);
        cache->AddColleague(cp);
        
        CPKIFNSSCertUpdatePtr certup(new CPKIFNSSCertUpdate(dbdir));
        certup->Initialize();
        cp = dynamic_pointer_cast<IPKIFColleague,CPKIFNSSCertUpdate>(certup);
        cache->AddColleague(cp);

        CPKIFNSSCRLUpdatePtr crlup(new CPKIFNSSCRLUpdate(dbdir));
        crlup->Initialize();
        cp = dynamic_pointer_cast<IPKIFColleague,CPKIFNSSCRLUpdate>(crlup);
        cache->AddColleague(cp);

        CPKIFNSSTrustStorePtr trust(new CPKIFNSSTrustStore(dbdir));
        trust->Initialize();
        cp = dynamic_pointer_cast<IPKIFColleague,CPKIFNSSTrustStore>(trust);
        cache->AddColleague(cp);
        
        CPKIFCRLDPRetrievalPtr crldpRetrieval(new CPKIFCRLDPRetrieval);
        cp = dynamic_pointer_cast<IPKIFColleague,CPKIFCRLDPRetrieval>(crldpRetrieval);
        cache->AddColleague(cp);

        CPKIFAiaOrSiaRetrievalPtr siaAia(new CPKIFAiaOrSiaRetrieval);
        cp = dynamic_pointer_cast<IPKIFColleague, CPKIFAiaOrSiaRetrieval>(siaAia);
        cache->AddColleague(cp);
        

        CPKIFCryptoMediator2Ptr tmpCrypto(new CPKIFCryptoMediator2(false));                 
        crypto = tmpCrypto;
        crypto->InitializeMediator(NULL);

        //Setting up Crypto
        CPKIFNSSPtr newNSS(new CPKIFNSS(dbdir));
        newNSS->Initialize();
        cp = dynamic_pointer_cast<IPKIFColleague,CPKIFNSS>(newNSS);
        crypto->AddColleague(cp);

        CPKIFNSSRawPtr newNSSRaw(new CPKIFNSSRaw());
        cp = dynamic_pointer_cast<IPKIFColleague,CPKIFNSSRaw>(newNSSRaw);
        crypto->AddColleague(cp);


        //Setting up revocation
        CPKIFRevocationStatusMediator2Ptr tmpRevStatus(new CPKIFRevocationStatusMediator2(false));
        revStatus = tmpRevStatus;
        revStatus->InitializeMediator(NULL);

        if(trustedResponder)
        {
            cp = dynamic_pointer_cast<IPKIFColleague,CPKIFOCSPChecker>(trustedResponder);
            revStatus->AddColleague(cp); //added 12/11/2003
        }

        CPKIFOCSPCheckerPtr ocspChecker(new CPKIFOCSPChecker());
        cp = dynamic_pointer_cast<IPKIFColleague,CPKIFOCSPChecker>(ocspChecker);
        revStatus->AddColleague(cp);

        if(aiaColleague != (CPKIFOCSPChecker*)NULL)
        {
            aiaColleague = ocspChecker;
        }
        
        CPKIFX509CRLCheckerPtr crlChecker(new CPKIFX509CRLChecker());
        cp = dynamic_pointer_cast<IPKIFColleague,CPKIFX509CRLChecker>(crlChecker);
        revStatus->AddColleague(cp);

        CPKIFPathProcessingMediator2Ptr tmpPath(new CPKIFPathProcessingMediator2(true));
        path = tmpPath;
        path->InitializeMediator(NULL);
        IPKIFMediatorPtr mp = dynamic_pointer_cast<IPKIFMediator, CPKIFCacheMediator2>(cache);
        path->AddMediator(mp);
        mp = dynamic_pointer_cast<IPKIFMediator, CPKIFCryptoMediator2>(crypto);
        path->AddMediator(mp);
        mp = dynamic_pointer_cast<IPKIFMediator, CPKIFRevocationStatusMediator2>(revStatus);
        path->AddMediator(mp);

        return dynamic_pointer_cast<IPKIFMediator, CPKIFPathProcessingMediator2>(path);
    }
    catch(...)
    {
        throw;
    }

}
void CAC_API FreeDefaultMediatorNSS(
    IPKIFMediator* p)
{
    if(p) {
        delete p;
        // this should currently NOP if NSS isn't in use
        ShutdownCrypto();
    }
}


// GIB: These headers shouldn't be CRLF terminated for curl. It does that.
char* g_tspHeaders = "Content-Type: application/timestamp-query";
char* g_scvpHeaders = "Content-Type: application/scvp-cv-request";
char* g_scvpValPolHeaders = "Content-Type: application/scvp-vp-request";
char* g_ocspHeaders = "Content-Type: application/ocsp-request";
size_t WriteCB(
    void * ptr,
    size_t size, 
    size_t count, 
    void * data)
{
    size_t realsize = size * count;
    CPKIFBuffer * buf = (CPKIFBuffer *) data;
    unsigned int oldLen = buf->GetLength();
    unsigned char * oldData = NULL;
    if(oldLen > 0)
    {
        oldData = new unsigned char[oldLen];
        if(NULL == oldData) return 0;
        memcpy(oldData,buf->GetBuffer(),oldLen);
    }

    size_t stOldLen = oldLen;

    int buffsize = 0;
    try 
    {
        buffsize = numeric_cast<int>(realsize + stOldLen);
    }
    catch(bad_numeric_cast &) 
    {
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Size is an impossibly long number.");
    }

    unsigned char * newData = buf->AllocateBuffer(buffsize);
    if(NULL != oldData)
    {
        memcpy(newData,oldData,oldLen);
        delete[] oldData;
    }
    memcpy(newData+oldLen,ptr,realsize);
    //newData[buf->GetLength()] = 0x00;
    return realsize;
}

BOOL CAC_API PostRequestURL(
    CPKIFBufferPtr& encTSR, 
    CPKIFBufferPtr& resp, 
    const char* pstrURL, 
    PKIFServiceType pst)
{
#undef RETURN
#define RETURN(rv) \
{ \
    if (NULL != headers) \
    { curl_slist_free_all(headers); } \
    if (NULL != hCurl) \
    { curl_easy_cleanup(hCurl); } \
    return rv;  \
} 
    CURL * hCurl = NULL;
    CURLcode curlRes = CURLE_OK;
    unsigned char* buf = NULL;
    char * url = NULL;
    curl_slist * headers = NULL;

    // GIB: Should this be an exception instead?
    if(!pstrURL || strlen(pstrURL) == 0)
    {
        std::ostringstream os;
        os << "PostRequestURL() called without a valid URL"; 
        LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
        RETURN(FALSE);
    }

    //commented out pending implementation of proper HTTP blacklist
    std::string pstrURLString = pstrURL;
    if(PKIFHTTP::IsHttpServerBlacklisted(pstrURLString))
    {
        std::ostringstream os;
        os << pstrURL << " has been blacklisted"; 
        LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
        RETURN(FALSE);
    }

    // empty/initialize the buffer for the response. This needs to be done
    // before it gets passed to the callback function
    resp.reset(new CPKIFBuffer());
    
    // add a custom Content-type: header for protocols that want it
    switch(pst)
    {
    case PKIF_TSA:
        headers = curl_slist_append(headers,g_tspHeaders);
        break;
    case PKIF_SCVP:
        headers = curl_slist_append(headers,g_scvpHeaders);
        break;
    case PKIF_SCVP_VAL_POL:
        headers = curl_slist_append(headers,g_scvpValPolHeaders);
        break;
    case PKIF_OCSP:
        headers = curl_slist_append(headers,g_ocspHeaders);
        break;
    case PKIF_NONE: 
        //kill the no-cache pragma
        headers = curl_slist_append(headers,"Pragma: ");
        break;
    default:
        return FALSE;
    };

    // the curl "easy" API should be good enough here.
    // if this becomes a bottleneck use the "multi" api in a pool that's
    // initialized and torn down at startup/shutdown
    hCurl = curl_easy_init();

    if(!hCurl)
    {
        std::ostringstream os;
        os << "curl_easy_init() failed"; 
        LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
        RETURN(FALSE);
    }

    // GIB: The code i'm replacing was setting the HTTP version to 1.0. 
    // The equivalent for curl would be:
    // curl_easy_setopt(hCurl,CURLOPT_HTTP_VERSION,CURL_HTTP_VERSION_1_0);
    // but there's no real reason to do this. the library does the right thing
    
    // make sure libcurl can parse the URL
    curlRes = curl_easy_setopt(hCurl,CURLOPT_URL,pstrURL);
    if(curlRes != CURLE_OK) {
        std::ostringstream os;
        os << "curl_easy_setopt(CURLOPT_URL) failed: " << curl_easy_strerror(curlRes);
        LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
        RETURN(FALSE);
    }

    // tell libcurl not to build and validate paths for SSL servers
    curlRes = curl_easy_setopt(hCurl,CURLOPT_SSL_VERIFYPEER,0L);

    if(curlRes != CURLE_OK) {
        std::ostringstream os;
        os << "curl_easy_setopt(CURLOPT_SSL_VERIFYPEER) failed: " << curl_easy_strerror(curlRes);
        LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
        RETURN(FALSE);
    }

    curlRes = curl_easy_setopt(hCurl,CURLOPT_FOLLOWLOCATION,1L);

    if(curlRes != CURLE_OK) {
        std::ostringstream os;
        os << "curl_easy_setopt(CURLOPT_FOLLOWLOCATION) failed: " << curl_easy_strerror(curlRes);
        LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
        RETURN(FALSE);
    }

    // set up the callback we use to write the response into a buffer
    curlRes = curl_easy_setopt(hCurl,CURLOPT_WRITEFUNCTION,WriteCB);
    if(curlRes != CURLE_OK) {
        std::ostringstream os;
        os << "curl_easy_setopt(CURLOPT_WRITEFUNCTION) failed: " << curl_easy_strerror(curlRes);
        LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
        RETURN(FALSE);
    }

    // give curl a pointer to the buffer
    // the nasty cast is necessary because libcurl wouldn't know what to do
    // with a smart pointer, and when I just tried to cast it and pass opaquely
    // reference counts got confused
    curlRes = curl_easy_setopt(hCurl,CURLOPT_WRITEDATA,(void *)&(*resp));
    if(curlRes != CURLE_OK) {
        std::ostringstream os;
        os << "curl_easy_setopt(CURLOPT_WRITEDATA) failed: " << curl_easy_strerror(curlRes);
        LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
        RETURN(FALSE);
    }
    
    // set up any needed custom headers. if more than one is needed, it should
    // be added to the list (without crlfs) when it's constructed at the beginning
    // of this function
    if(headers != NULL)
    {
        curlRes = curl_easy_setopt(hCurl,CURLOPT_HTTPHEADER,headers);
        if(curlRes != CURLE_OK) {
            std::ostringstream os;
            os << "curl_easy_setopt(CURLOPT_HTTPHEADER) failed: " << curl_easy_strerror(curlRes);
            LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
            RETURN(FALSE);
        }
    }
    
    // give libcurl the data to be posted
    //if we're not POSTing any data, it's a GET
    if(0 != encTSR->GetLength()) {
        curlRes = curl_easy_setopt(hCurl,CURLOPT_POSTFIELDS,encTSR->GetBuffer());
        if(curlRes != CURLE_OK) {
            std::ostringstream os;
            os << "curl_easy_setopt(CURLOPT_POSTFIELDS) failed: " << curl_easy_strerror(curlRes);
            LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
            RETURN(FALSE);
        }

        // we need to tell libcurl the length because (e.g. OCSP requests) this
        // POST data can contain 0x00 and libcurl will use strlen otherwise
        curlRes = curl_easy_setopt(hCurl,CURLOPT_POSTFIELDSIZE,encTSR->GetLength());
        if(curlRes != CURLE_OK) {
            std::ostringstream os;
            os << "curl_easy_setopt(CURLOPT_POSTFIELDSIZE) failed: " << curl_easy_strerror(curlRes);
            LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
            RETURN(FALSE);
        }
    }
    
    // post the request. it'll be written into the response buffer by our callback
    curlRes = curl_easy_perform(hCurl);
    if(curlRes != CURLE_OK) 
    {
        if(CURLE_COULDNT_CONNECT == curlRes)
        {
            PKIFHTTP::AddBlacklistedHttpServer(pstrURLString);
        }

        std::ostringstream os;
        os << "curl_easy_setopt(CURLOPT_POSTFIELDSIZE) failed: " << curl_easy_strerror(curlRes);
        LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
        RETURN(FALSE);
    }

    RETURN(TRUE);
}
BOOL CAC_API PostRequest(
    CPKIFBufferPtr& encTSR,
    CPKIFBufferPtr& resp, 
    const char* pstrServer, 
    int port, 
    const char* pstrObject, 
    PKIFServiceType pst)
{
#undef RETURN
#define RETURN(rv) \
{ \
    if (NULL != url) \
    { free(url); url = NULL; } \
    return rv;  \
} 
    char * url;
    std::ostringstream us;
    // this function assumes it's been passed info for an HTTP URL
    us << "http://" << pstrServer << ":" << port << pstrObject;
    url = strdup(us.str().c_str());
    if(NULL == url)
    {
        std::ostringstream os;
        os << "Unable to allocate buffer for URL"; //<< GetLastError();
        LOG_STRING_ERROR(os.str().c_str(), TOOLKIT_UTILS, COMMON_URL_OPERATION_FAILED, NULL);
        RETURN(FALSE);
    }
    BOOL rv = PostRequestURL(encTSR,resp,url,pst);
    RETURN(rv);
}

//removed export declarations 8/18/2004
BOOL CAC_API GetRequest(
    const char* pstrURL, 
    CPKIFBufferPtr& resp)
{
    CPKIFBufferPtr tmp(new CPKIFBuffer());
    return PostRequestURL(tmp, resp, pstrURL, PKIF_NONE);
}
/*
//----------------------------------------------------------------------------------------------------
// globals OIDs
//----------------------------------------------------------------------------------------------------
//algorithms
CAC_API CPKIFOIDPtr g_md2WithRSAEncryption
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.1.2"))));//md2WithRSA
CAC_API CPKIFOIDPtr g_md5WithRSAEncryption
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.1.4"))));//md5WithRSA
CAC_API CPKIFOIDPtr g_sha1WithRSAEncryption
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.1.5"))));//sha1WithRSA
CAC_API CPKIFOIDPtr g_dsaWithSHA1
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.10040.4.3"))));//dsaWithSHA1
CAC_API CPKIFOIDPtr g_rsa
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.1.1"))));//rsa
CAC_API CPKIFOIDPtr g_dsa
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.10040.4.1"))));//dsa

CAC_API CPKIFOIDPtr g_sha1
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.3.14.3.2.26"))));//sha1
CAC_API CPKIFOIDPtr g_sha256
    (new CPKIFOID(CPKIFStringPtr(new std::string("2.16.840.1.101.3.4.2.1"))));//sha256
CAC_API CPKIFOIDPtr g_sha384
    (new CPKIFOID(CPKIFStringPtr(new std::string("2.16.840.1.101.3.4.2.2"))));//sha384
CAC_API CPKIFOIDPtr g_sha512
    (new CPKIFOID(CPKIFStringPtr(new std::string("2.16.840.1.101.3.4.2.3"))));//sha512
CAC_API CPKIFOIDPtr g_md5
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.2.5"))));//md5

CAC_API CPKIFOIDPtr g_desCBC
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.3.14.3.2.7"))));//desCBC (OIW)
CAC_API CPKIFOIDPtr g_tdesCBC
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.3.7"))));//tdesCBC (RSA)
CAC_API CPKIFOIDPtr g_desECB
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.3.14.3.2.6"))));//desECB (OIW)

//CMS message types
CAC_API CPKIFOIDPtr g_contentInfo
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.9.16.1.6"))));//contentInfo
CAC_API CPKIFOIDPtr g_data
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.7.1"))));//data
CAC_API CPKIFOIDPtr g_signedData
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.7.2"))));//signedData
CAC_API CPKIFOIDPtr g_envelopedData
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.7.3"))));//envelopedData

//CMS attribute types
CAC_API CPKIFOIDPtr g_contentTypeAttribute
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.9.3"))));//contentType attribute
CAC_API CPKIFOIDPtr g_messageDigestAttribute
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.9.4"))));//messageDigest attribute
CAC_API CPKIFOIDPtr g_signingTimeAttribute
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.9.5"))));//signing time attribute
CAC_API CPKIFOIDPtr g_countersignatureAttribute
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.9.6"))));//countersignature attribute
CAC_API CPKIFOIDPtr g_timestampAttribute
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.2.840.113549.1.9.16.2.14"))));//timestamp attribute

//EKU OIDs
CAC_API CPKIFOIDPtr g_timestampingEKU
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.3.6.1.5.5.7.3.8"))));//id-kp-timeStamping
CAC_API CPKIFOIDPtr g_ocspSigningEKU
    (new CPKIFOID(CPKIFStringPtr(new std::string("1.3.6.1.5.5.7.3.9"))));//id-kp-OCSPSigning
CAC_API CPKIFOIDPtr g_anyEKU
    (new CPKIFOID(CPKIFStringPtr(new std::string("2.5.29.37.0"))));//  anyExtendedKeyUsage

CAC_API CPKIFOIDPtr g_anyPolicyOID
    (new CPKIFOID(CPKIFStringPtr(new std::string("2.5.29.32.0"))));

//----------------------------------------------------------------------------------------------------
// globals Alg IDs
//----------------------------------------------------------------------------------------------------
CAC_API CPKIFAlgorithmIdentifierPtr g_md5AI(new CPKIFAlgorithmIdentifier(g_md5));
CAC_API CPKIFAlgorithmIdentifierPtr g_sha1AI(new CPKIFAlgorithmIdentifier(g_sha1));
CAC_API CPKIFAlgorithmIdentifierPtr g_sha256AI(new CPKIFAlgorithmIdentifier(g_sha256));
CAC_API CPKIFAlgorithmIdentifierPtr g_sha384AI(new CPKIFAlgorithmIdentifier(g_sha384));
CAC_API CPKIFAlgorithmIdentifierPtr g_sha512AI(new CPKIFAlgorithmIdentifier(g_sha512));
*/
//----------------------------------------------------------------------------------------------------
// algorithm utils
//----------------------------------------------------------------------------------------------------
CPKIFAlgorithmIdentifierPtr CAC_API GetHashAlgAI(
    PKIFCRYPTO::HASH_ALG hashAlgorithm)
{
    switch(hashAlgorithm)
    {
    case PKIFCRYPTO::MD5:
        return g_md5AI;
    case PKIFCRYPTO::SHA1:
        return g_sha1AI;
    case PKIFCRYPTO::SHA256:
        return g_sha256AI;
    case PKIFCRYPTO::SHA384:
        return g_sha384AI;
    case PKIFCRYPTO::SHA512:
        return g_sha512AI;
    default:
        CPKIFAlgorithmIdentifierPtr tmpAI;
        return tmpAI;
    }
}
AlgClass GetAlgClass(
    const CPKIFAlgorithmIdentifierPtr& alg)
{
    CPKIFOIDPtr sigAlgOID = alg->oid();
    if(*g_md5WithRSAEncryption == *sigAlgOID || *g_rsa == *sigAlgOID || *g_sha1WithRSAEncryption == *sigAlgOID ||
        *g_md2WithRSAEncryption == *sigAlgOID || *g_sha224WithRSAEncryption == *sigAlgOID || 
        *g_sha256WithRSAEncryption == *sigAlgOID || *g_sha384WithRSAEncryption == *sigAlgOID || 
        *g_sha512WithRSAEncryption == *sigAlgOID)
        return RSA_CLASS;
    else if(*g_dsaWithSHA1 == *sigAlgOID || *g_dsa == *sigAlgOID)
        return DSA_CLASS;
    else if(*g_ecc == *sigAlgOID ||
        *g_ecdsa_sha1 == *sigAlgOID || 
        *g_ecdsa_sha224 == *sigAlgOID ||
        *g_ecdsa_sha256 == *sigAlgOID ||
        *g_ecdsa_sha384 == *sigAlgOID ||
        *g_ecdsa_sha512 == *sigAlgOID)
        return ECDSA_CLASS;
    else
        throw CPKIFException(TOOLKIT_UTILS_SUBCOMPONENT, COMMON_UNSUPPORTED_ALG, "Unable to determine algorithm class");
}

//for now we are supporting MD5 and SHA1 only adjust the below code accordingly when and if that changes
bool CAC_API GetCACHashAlg(
    const CPKIFOIDPtr& alg,
    PKIFCRYPTO::HASH_ALG* hashAlg)
{
    CPKIFAlgorithm* a = CPKIFAlgorithm::GetAlg(alg);
    if(a && hashAlg)
    {
        *hashAlg = a->HashAlg();
        return true;
    }
    else
        return false;
}

//----------------------------------------------------------------------------------------------------
// Miscellaneous utility functions
//----------------------------------------------------------------------------------------------------

CPKIFBufferPtr CAC_API EncodeCPKIFNameAsGenName(
    const CPKIFNamePtr& name)
{
    CACX509V3GeneralName* objname = new CACX509V3GeneralName;
    memset(objname, 0, sizeof(CACX509V3GeneralName));

    //objname->u.directoryName = new CACX509V3Name;
    //CACX509V3RelativeDistinguishedName* pCacTmpRDN = new CACX509V3RelativeDistinguishedName;
    //BuildCACX509V3DistinguishedName((unsigned char *)name->ToString(), pCacTmpRDN);
    //objname->u.directoryName->t = T_CACX509V3Name_rdnSequence;
    //objname->u.directoryName->u.rdnSequence = pCacTmpRDN;
    //objname->t = T_CACX509V3GeneralName_directoryName;

    CPKIFBufferPtr encodedName = name->Encoded();
    CACASNWRAPPER_CREATE(CACX509V3Name, rdnPDU);
    objname->u.directoryName = rdnPDU.Decode(encodedName->GetBuffer(), encodedName->GetLength());
    objname->t = T_CACX509V3GeneralName_directoryName;

    CACASNWRAPPER_CREATE(CACX509V3GeneralName, objPDU);
    ASN1OpenType* data1 = objPDU.Encode(objname);
    CPKIFBufferPtr tmpBuf;
    if(data1 != NULL)
    {
        tmpBuf = CPKIFBufferPtr(new CPKIFBuffer(data1->data, data1->numocts));
        delete data1;
    }

    if(objname)
    {
        if(objname->u.directoryName)
            objname->u.directoryName = NULL;
        delete objname;
    }

    return tmpBuf;
}
//added 4/10/03 CWW
//takes a char* to an DN string (e.g. "cn=Joe, ou=Gen Pop, c=US") and returns CPKIFNamePtr
CPKIFNamePtr CAC_API GetPKIFNameFromStr(
    unsigned char* dn)
{
    PKIFNameMemoryHelper mhX509V3Name;
    mhX509V3Name.pCACX509V3Name = new CACX509V3Name;
    memset(mhX509V3Name.pCACX509V3Name, 0, sizeof(CACX509V3Name));

    CACX509V3RelativeDistinguishedName* pCacTmpRDN = new CACX509V3RelativeDistinguishedName; //list of CACX509V3RelativeDistinguishedNames
    
    if(NULL == dn || 3 > strlen((char*)dn))
    {
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "NULL DN string or DN less than three characters passed to GetPKIFNameFromStr");
    }

    BuildCACX509V3DistinguishedName(dn, pCacTmpRDN);
    mhX509V3Name.pCACX509V3Name->t = T_CACX509V3Name_rdnSequence;
    mhX509V3Name.pCACX509V3Name->u.rdnSequence = pCacTmpRDN;

    //create CPKIFName obj & return ptr
    CACASNWRAPPER_CREATE(CACX509V3Name, objPDU2);
    ASN1OpenType* data1 = objPDU2.Encode((mhX509V3Name.pCACX509V3Name));
    CPKIFBufferPtr tmpBuf;
    if(data1 != NULL)
    {
         tmpBuf = CPKIFBufferPtr(new CPKIFBuffer(data1->data, data1->numocts));
        delete data1;
    }

    CPKIFNamePtr pCacName(new CPKIFName(tmpBuf));
    //CPKIFNamePtr pCacName(new CPKIFName(*(mhX509V3Name.pCACX509V3Name)));

    return pCacName;
}


//added 4/10/03 CWW
//takes a char* to an DN string (e.g. "cn=Joe, ou=Gen Pop, c=US") and returns ptr to populated CACX509V3DistinguishedName
void BuildCACX509V3DistinguishedName(
    unsigned char* dn, 
    CACX509V3DistinguishedName* cacx509v3dn)
{
    if(NULL == cacx509v3dn)
    {
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "NULL CACX509V3DistinguishedName* passed to BuildCACX509V3DistinguishedName");
    }
    if(NULL == dn || 3 > strlen((char*)dn))
    {
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "NULL DN string or DN less than three characters passed to BuildCACX509V3DistinguishedName");
    }
    

    cacx509v3dn->count = 0;
    DListNode *rdnNode = NULL;

    enum State 
    {
        START,
        VALUE,   
        ESCAPED,        //looking for AttributeType
        QUOTE_OPEN      //found an open quote
    };

    State eState = START;
    State eStatePrevious = START;
    size_t nStart = 0;
    size_t nIndex = 0;  

    size_t nLen = strlen((char*)dn);
    for( nIndex; nIndex < nLen; nIndex++ ) 
    {
        switch( eState ) 
        {
            case START:
                if(dn[nIndex] != ' ' && dn[nIndex] != ',')
                {
                    nStart = nIndex;
                    eState = VALUE;
                }
                break;
            case VALUE:
                if(dn[nIndex] == ',' ) 
                {
                    unsigned char* rdn = new unsigned char[nIndex - nStart + 1];
                    memcpy(rdn, &dn[nStart], nIndex - nStart);  
                    rdn[nIndex - nStart] = '\0';
                    
                    //Create RDN object and encode
                    PKIFNameMemoryHelper mhCACX509V3RDN; //list of encoded attr type and value pairs
                    mhCACX509V3RDN.pCACX509V3RDN = new CACX509V3RelativeDistinguishedName;
                    memset(mhCACX509V3RDN.pCACX509V3RDN, 0, sizeof(CACX509V3RelativeDistinguishedName));
                    
                    BuildCACX509V3RelativeDistinguishedName(rdn, mhCACX509V3RDN.pCACX509V3RDN);
                    CACASNWRAPPER_CREATE(CACX509V3RelativeDistinguishedName, objPDU);
                    ASN1OpenType* asn1ot = objPDU.Encode(mhCACX509V3RDN.pCACX509V3RDN);

                    if(NULL == rdnNode)
                    {
                        NEW_NODE(rdnNode)
                    }
                    else
                    {
                        NEW_NEXT_AND_ADVANCE(rdnNode)
                    }

                    rdnNode->data = new ASN1OpenType;
                    ((ASN1OpenType*)rdnNode->data)->data = new unsigned char[asn1ot->numocts];
                    memcpy((void*)((ASN1OpenType*)rdnNode->data)->data, asn1ot->data, asn1ot->numocts);
                    ((ASN1OpenType*)rdnNode->data)->numocts = asn1ot->numocts;
                            
                    //add encoded RDN to DN
                    SET_HEAD_TAIL_INCREMENT((*cacx509v3dn), rdnNode)
                    
                    delete rdn;
                    delete asn1ot;
                    eState = START;
                }
                else if(dn[nIndex] == '\"') 
                {
                    eState = QUOTE_OPEN;
                }
                else if(dn[nIndex] == '\\') 
                {
                    eStatePrevious = VALUE;
                    eState = ESCAPED;
                }
                break;
            case ESCAPED:
                eState = eStatePrevious;
                break;
            case QUOTE_OPEN:
                if(dn[nIndex] == '\"' )
                {
                    eState = VALUE;
                } 
                else if(dn[nIndex] == '\\') 
                {
                    eStatePrevious = QUOTE_OPEN;
                    eState = ESCAPED;
                }
                break;
        }
    }
    if(eState == VALUE) 
    {
        unsigned char* rdn = new unsigned char[nLen - nStart + 1];
        memcpy(rdn, &dn[nStart], nLen - nStart);
        
        //trim leading and trailing white spaces
        unsigned char *tmp = rdn;   
        int n = 0;
        while (tmp[n] == ' ') n++;
        tmp = &(tmp[n]);

        int size = 0;
        try 
        {
            size = numeric_cast<int>(nLen - nStart);
        }
        catch(bad_numeric_cast &) 
        {
            throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Size is an impossibly long number.");
        }

        n = size - n - 1;
        while (tmp[n] == ' ') n--;
        tmp[n+1] = '\0';

        //create RDN object and encode
        PKIFNameMemoryHelper mhCACX509V3RDN;
        mhCACX509V3RDN.pCACX509V3RDN = new CACX509V3RelativeDistinguishedName;
        memset(mhCACX509V3RDN.pCACX509V3RDN, 0, sizeof(CACX509V3RelativeDistinguishedName));

        BuildCACX509V3RelativeDistinguishedName(tmp, mhCACX509V3RDN.pCACX509V3RDN);
        CACASNWRAPPER_CREATE(CACX509V3RelativeDistinguishedName, objPDU);
        ASN1OpenType* asn1ot = objPDU.Encode(mhCACX509V3RDN.pCACX509V3RDN);

        if(NULL == rdnNode)
        {
            NEW_NODE(rdnNode)
        }
        else
        {
            NEW_NEXT_AND_ADVANCE(rdnNode)
        }

        rdnNode->data = new ASN1OpenType;
        ((ASN1OpenType*)rdnNode->data)->data = new unsigned char[asn1ot->numocts];
        memcpy((void*)((ASN1OpenType*)rdnNode->data)->data, asn1ot->data, asn1ot->numocts);
        ((ASN1OpenType*)rdnNode->data)->numocts = asn1ot->numocts;
                
        //add encoded RDN to DN
        SET_HEAD_TAIL_INCREMENT((*cacx509v3dn), rdnNode)
        delete rdn;
        delete asn1ot;
    }

    //reverse the rdn list... lest tbe dn be bassackwards
    DListNode* currNode = cacx509v3dn->head;
    for(unsigned int ii = 0; ii < cacx509v3dn->count; ++ii)
    {
        DListNode* tmpNext = currNode->next;
        currNode->next = currNode->prev;
        currNode = currNode->prev = tmpNext;
    }
    DListNode* tail = cacx509v3dn->head;
    cacx509v3dn->head = cacx509v3dn->tail;
    cacx509v3dn->tail = tail;
}

//added 4/10/03 CWW
//takes a char* to an RDN string (e.g. "cn=Joe+serialNumber=123") and returns ptr to populated CACX509V3RelativeDistinguishedName
void BuildCACX509V3RelativeDistinguishedName(
    unsigned char* rdn,
    CACX509V3RelativeDistinguishedName* cacx509v3rdn)
{
    if(NULL == cacx509v3rdn)
    {
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "NULL CACX509V3RelativeDistinguishedName* passed to BuildCACX509V3RelativeDistinguishedName"); 
    }

    if(NULL == rdn || 3 > strlen((char*)rdn))
    {
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "NULL RDN string or RDN less than three characters passed to BuildCACX509V3RelativeDistinguishedName"); 
    }

    cacx509v3rdn->count = 0;
    DListNode *typeAndValNode = NULL;

    enum State 
    {
        START,
        VALUE,   
        ESCAPED,        //looking for AttributeType
        QUOTE_OPEN      //found an open quote
    };

    State eState = START;
    State eStatePrevious = START;
    size_t nStart = 0;
    size_t nIndex = 0;  

    size_t nLen = strlen((char*)rdn);
    for(nIndex; nIndex < nLen; nIndex++) 
    {
        switch(eState) 
        {
            case START:
                if(rdn[nIndex] != ' ' && rdn[nIndex] != '+')
                {
                    nStart = nIndex;
                    eState = VALUE;
                }
                break;
            case VALUE:
                if(rdn[nIndex] == '+') 
                {
                    char* attrTypeAndVal = new char[nIndex - nStart + 1];
                    memcpy(attrTypeAndVal, &rdn[nStart], nIndex - nStart);  
                    
                    //trim leading and trailing white spaces
                    char *tmp = attrTypeAndVal; 
                    int n = 0;
                    while (tmp[n] == ' ') n++;
                    tmp = &(tmp[n]);

                    int size = 0;
                    try 
                    {
                        size = numeric_cast<int>(nIndex - nStart);
                    }
                    catch(bad_numeric_cast &) 
                    {
                        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Size is an impossibly long number.");
                    }

                    n = size - n - 1;
                    while (tmp[n] == ' ') n--;
                    tmp[n+1] = '\0';
                    
                    CACX509V3AttributeTypeAndValue* atadv = new CACX509V3AttributeTypeAndValue;
                    BuildCACX509V3AttributeTypeAndValue(tmp, atadv);
                    if(NULL == typeAndValNode)
                    {
                        NEW_NODE(typeAndValNode)
                    }
                    else
                    {
                        NEW_NEXT_AND_ADVANCE(typeAndValNode)
                    }

                    typeAndValNode->data = atadv;

                    //add encoded directory string to RDN
                    SET_HEAD_TAIL_INCREMENT((*cacx509v3rdn), typeAndValNode)

                    delete attrTypeAndVal;
                    eState = START;
                } 
                else if(rdn[nIndex] == '\"') 
                {
                    eState = QUOTE_OPEN;
                } 
                else if(rdn[nIndex] == '\\') 
                {
                    eStatePrevious = VALUE;
                    eState = ESCAPED;
                }
                break;

            case ESCAPED:
                eState = eStatePrevious;
                break;

            case QUOTE_OPEN:
                if(rdn[nIndex] == '\"') 
                {
                    eState = VALUE;
                }
                else if(rdn[nIndex] == '\\' ) 
                {
                    eStatePrevious = QUOTE_OPEN;
                    eState = ESCAPED;
                }
                break;
        };
    }
    if(eState == VALUE) 
    {
        char* attrTypeAndVal = new char[nLen - nStart + 1];
        memcpy(attrTypeAndVal, &rdn[nStart], nLen - nStart);

        //trim leading and trailing white spaces
        char *tmp = attrTypeAndVal; 
        int n = 0;
        while (tmp[n] == ' ') n++;
        tmp = &(tmp[n]);
        
        int size = 0;
        try 
        {
            size = numeric_cast<int>(nLen - nStart);
        }
        catch(bad_numeric_cast &) 
        {
            throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Size is an impossibly long number.");
        }
        n = size - n - 1;
        while (tmp[n] == ' ') n--;
        tmp[n+1] = '\0';

        CACX509V3AttributeTypeAndValue* atdv;
        atdv = new CACX509V3AttributeTypeAndValue;
        BuildCACX509V3AttributeTypeAndValue(tmp, atdv);
        if(NULL == typeAndValNode)
        {
            NEW_NODE(typeAndValNode)
        }
        else
        {
            NEW_NEXT_AND_ADVANCE(typeAndValNode)
        }

        typeAndValNode->data = atdv;

        //add encoded directory string to RDN
        SET_HEAD_TAIL_INCREMENT((*cacx509v3rdn), typeAndValNode)

        delete attrTypeAndVal;
    }
}

//added 4/10/03 CWW
//takes a char* to an attribute type and value string from an RDN (e.g. "cn=Joe") and returns ptr to populated CACX509V3AttributeTypeAndValue
void BuildCACX509V3AttributeTypeAndValue(
    char* attrTypeAndValue,
    CACX509V3AttributeTypeAndValue* cacx509v3atadv)
{
    if(NULL == cacx509v3atadv)
    {
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "NULL CACX509V3AttributeTypeAndValue* passed to BuildCACX509V3AttributeTypeAndValue");
    }

    if(NULL == attrTypeAndValue || 3 > strlen(attrTypeAndValue))
    {
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "NULL attribute type and value string or atav string less than three characters passed to BuildCACX509V3AttributeTypeAndValue");
    }

    size_t attrTypeAndValLen = strlen(attrTypeAndValue);
    char equalChar[] = "=";
    char* pEqual = strstr(attrTypeAndValue, (const char*)equalChar);
    if(NULL == pEqual)
    {
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Attribute type and distinguished value string passed to BuildCACX509V3AttributeTypeAndValue is missing equal sign");
    }

    //get attrType
    size_t tmpLen = pEqual - attrTypeAndValue;
    char* attrType = new char[tmpLen + 1];
    memcpy(attrType, attrTypeAndValue, tmpLen);
    while(attrType[tmpLen-1] == ' ' && &attrType[tmpLen-1] > attrType)
        --tmpLen;//remove trailing white space
    attrType[tmpLen] = '\0';

    //get attrVal
    tmpLen = &(attrTypeAndValue[attrTypeAndValLen - 1]) - pEqual;
    char* attrVal = new char[tmpLen + 1];
    memcpy(attrVal, pEqual + 1, tmpLen);
    attrVal[tmpLen] = '\0';

    //get attr oid
    //made some minor mods to cover additional attributes
    char oidBuf[MAXOID];
    if(0 == /*stricmp*/STRCASECMP(attrType, "cn"))
        strcpy((char*)oidBuf, "2.5.4.3");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "c"))
        strcpy((char*)oidBuf, "2.5.4.6");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "l") || 0 == /*stricmp*/STRCASECMP(attrType, "locality"))
        strcpy((char*)oidBuf, "2.5.4.7");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "o") || 0 == /*stricmp*/STRCASECMP(attrType, "organization"))
        strcpy((char*)oidBuf, "2.5.4.10");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "ou"))
        strcpy((char*)oidBuf, "2.5.4.11");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "e") || 0 == /*stricmp*/STRCASECMP(attrType, "email"))
        strcpy((char*)oidBuf, "1.2.840.113549.1.9.1");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "surname") || 0 == /*stricmp*/STRCASECMP(attrType, "SN"))
        strcpy((char*)oidBuf, "2.5.4.4");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "serialNumber") || 0 == /*stricmp*/STRCASECMP(attrType, "Serial Number"))
        strcpy((char*)oidBuf, "2.5.4.5");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "stateOrProvinceName") || 0 == /*stricmp*/STRCASECMP(attrType, "S") || 0 == /*stricmp*/STRCASECMP(attrType, "ST"))
        strcpy((char*)oidBuf, "2.5.4.8");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "streetAddress") || 0 == /*stricmp*/STRCASECMP(attrType, "street"))
        strcpy((char*)oidBuf, "2.5.4.9");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "title") || 0 == /*stricmp*/STRCASECMP(attrType, "t"))
        strcpy((char*)oidBuf, "2.5.4.12");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "dnQualifier"))
        strcpy((char*)oidBuf, "2.5.4.46");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "i") || 0 == /*stricmp*/STRCASECMP(attrType, "initials"))
        strcpy((char*)oidBuf, "2.5.4.43");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "givenName") || 0 == /*stricmp*/STRCASECMP(attrType, "g"))
        strcpy((char*)oidBuf, "2.5.4.42");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "generationQualifier"))
        strcpy((char*)oidBuf, "2.5.4.44");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "pseudonym"))
        strcpy((char*)oidBuf, "2.5.4.65");
    else if(0 == /*stricmp*/STRCASECMP(attrType, "dc") || 0 == /*stricmp*/STRCASECMP(attrType, "domainComponent"))
        strcpy((char*)oidBuf, "0.9.2342.19200300.100.1.25");
    else
    {
        //not one of the attr types we were expecting or possibly is already in oid form
        //assume it's alreay in oid form... if it's not the call to *oid->raw() below will except
        strcpy(oidBuf, attrType);
    }
    CPKIFOIDPtr oid(new CPKIFOID(CPKIFStringPtr(new std::string(oidBuf)))); 

    try
    {
        //cacx509v3atadv->type = *oid->raw();
        CPKIFStringPtr str(new std::string(oid->ToString())); 
        ASN1OBJID* tmpOid = ConvertStringToASN1OBJID(str);
        CopyOID(&cacx509v3atadv->type, tmpOid);

        if(NULL != tmpOid)
            delete tmpOid;
        //cacx509v3atadv->type = *tmpOid;
    }
    catch(...)
    {
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Attribute type and distinguished value string passed to BuildCACX509V3AttributeTypeAndValue contains an unexpected attribute type");
    }

    //attr to encoded directory string 
    //treating dc and email as ia5String
    ASN1OpenType* ds = NULL;
    if(0 == /*stricmp*/STRCASECMP(attrType, "dc") || 0 == /*stricmp*/STRCASECMP(attrType, "domainComponent"))
    {
        CACASNWRAPPER_CREATE(CACX509V3CACDirectoryString, objPDU);  
        CACX509V3CACDirectoryString dirStr;
        dirStr.t = T_CACX509V3CACDirectoryString_ia5String;
        dirStr.u.ia5String = attrVal;
        ds = objPDU.Encode(&dirStr);

        cacx509v3atadv->value.data = new unsigned char[ds->numocts + 1];
        memcpy((void*)(cacx509v3atadv->value.data), (void*)ds->data, ds->numocts);
        cacx509v3atadv->value.numocts = ds->numocts;
    }
    else if(0 == /*stricmp*/STRCASECMP(attrType, "e") || 0 == /*stricmp*/STRCASECMP(attrType, "email"))
    {
        CACASNWRAPPER_CREATE(CACX509V3CACDirectoryString, objPDU);  
        CACX509V3CACDirectoryString dirStr;
        dirStr.t = T_CACX509V3CACDirectoryString_ia5String;
        dirStr.u.ia5String = attrVal;
        ds = objPDU.Encode(&dirStr);

        cacx509v3atadv->value.data = new unsigned char[ds->numocts + 1];
        memcpy((void*)(cacx509v3atadv->value.data), (void*)ds->data, ds->numocts);
        cacx509v3atadv->value.numocts = ds->numocts;
    }
    else
    {
        CACASNWRAPPER_CREATE(CACX509V3CACDirectoryString, objPDU);  
        CACX509V3CACDirectoryString dirStr;
        dirStr.t = T_CACX509V3CACDirectoryString_printableString;
        dirStr.u.printableString = attrVal;
        ds = objPDU.Encode(&dirStr);
        
        cacx509v3atadv->value.data = new unsigned char[ds->numocts + 1];
        memcpy((void*)(cacx509v3atadv->value.data), (void*)ds->data, ds->numocts);
        cacx509v3atadv->value.numocts = ds->numocts;
    }

    delete attrVal;
    delete attrType;
    delete ds;
}

void split(const string & text, string & separators, vector<string> & words)
 {
    size_t n = text.length();
    size_t start, stop;

    start = text.find_first_not_of(separators);
    while ((start >= 0) && (start < n)) {
       stop = text.find_first_of(separators, start);
       if ((stop < 0) || (stop > n)) stop = n;
       words.push_back(text.substr(start, stop - start));
       start = text.find_first_not_of(separators, stop+1);
       }
 }
//added 4/14/03 CWW
CPKIFGeneralNamePtr GetPKIFGenNameFromStr(
    unsigned char* name, 
    int nameType)
{
        //added NULL check 8/13/04
    if(name == (unsigned char*)NULL)
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "NULL pointer passed to GetPKIFGenNameFromStr");

    PKIFNameMemoryHelper mhCACX509V3GN;
    mhCACX509V3GN.pCACX509V3GN = new CACX509V3GeneralName;
    memset(mhCACX509V3GN.pCACX509V3GN, 0, sizeof(CACX509V3GeneralName));

    switch(nameType)
    {
    case T_CACX509V3GeneralName_otherName:
        mhCACX509V3GN.pCACX509V3GN->u.otherName = new ASN1OpenType;
        mhCACX509V3GN.pCACX509V3GN->u.otherName->data = new unsigned char[strlen((char*)name) + 1];
        strcpy((char*)mhCACX509V3GN.pCACX509V3GN->u.otherName->data, (char*)name);
        try {
            mhCACX509V3GN.pCACX509V3GN->u.otherName->numocts = boost::numeric_cast<boost::uint32_t,size_t>(strlen((char*)name));
        }catch(boost::numeric::bad_numeric_cast & ){
            throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "invalid character string passed to GetPKIFGenNameFromStr");
        }
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_otherName;
        break;

    case T_CACX509V3GeneralName_rfc822Name:
        mhCACX509V3GN.pCACX509V3GN->u.rfc822Name = new char[strlen((char*)name) + 1];
        strcpy((char*)mhCACX509V3GN.pCACX509V3GN->u.rfc822Name, (char*)name);
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_rfc822Name;
        break;

    case T_CACX509V3GeneralName_dNSName:
        mhCACX509V3GN.pCACX509V3GN->u.dNSName = new char[strlen((char*)name) + 1];
        strcpy((char*)mhCACX509V3GN.pCACX509V3GN->u.dNSName, (char*)name);
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_dNSName;
        break;

    case T_CACX509V3GeneralName_x400Address:
        mhCACX509V3GN.pCACX509V3GN->u.x400Address = new ASN1OpenType;
        mhCACX509V3GN.pCACX509V3GN->u.x400Address->data = new unsigned char[strlen((char*)name) + 1];
        memcpy((void*)(mhCACX509V3GN.pCACX509V3GN->u.x400Address->data), (void*)name, strlen((char*)name));
        try {
            mhCACX509V3GN.pCACX509V3GN->u.x400Address->numocts = boost::numeric_cast<boost::uint32_t,size_t>(strlen((char*)name));
        }catch(boost::numeric::bad_numeric_cast &){
            throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "invalid character string passed to GetPKIFGenNameFromStr");
        }
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_x400Address;
        break;

    case T_CACX509V3GeneralName_directoryName:
        {
            mhCACX509V3GN.pCACX509V3GN->u.directoryName = new CACX509V3Name;
            CACX509V3RelativeDistinguishedName* pCacTmpRDN = new CACX509V3RelativeDistinguishedName;
            BuildCACX509V3DistinguishedName(name, pCacTmpRDN);
            mhCACX509V3GN.pCACX509V3GN->u.directoryName->t = T_CACX509V3Name_rdnSequence;
            mhCACX509V3GN.pCACX509V3GN->u.directoryName->u.rdnSequence = pCacTmpRDN;
            mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_directoryName;
        }
        break;

    case T_CACX509V3GeneralName_ediPartyName:
        //XXX-DEFER implement me
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_ediPartyName;
        break;

    case T_CACX509V3GeneralName_uniformResourceIdentifier:
        mhCACX509V3GN.pCACX509V3GN->u.uniformResourceIdentifier = new char[strlen((char*)name) + 1];
        strcpy((char*)mhCACX509V3GN.pCACX509V3GN->u.uniformResourceIdentifier, (char*)name);
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_uniformResourceIdentifier;
        break;

    case T_CACX509V3GeneralName_iPAddress:
        {
            string  base = (char*)name; 
            vector<string> components;
            vector<string>::iterator iter;
            string tmp = "/";
            split(string((char *)base.c_str()),tmp,components);

            boost::asio::io_service io_service;
            ip::address addr;
            try {
                addr = ip::address::from_string(components[0].c_str());
            }catch(std::exception & ){
                throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "invalid IP address passed to GetPKIFGenNameFromStr");
            }

            if(addr.is_v4())
            {
                ip::address_v4 v4Addr = addr.to_v4();
                mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_iPAddress;
                mhCACX509V3GN.pCACX509V3GN->u.iPAddress = new ASN1DynOctStr;

                ip::address_v4::bytes_type v4Addr_bytes_value = v4Addr.to_bytes();

                
                int v4_len = 4;
                int size = v4_len;
                if(components.size() > 1)
                {
                    ip::address mask;
                    try {
                        mask = ip::address::from_string(components[1].c_str());
                    }catch(std::exception & ){
                        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "invalid mask passed to GetPKIFGenNameFromStr");
                    }
                    ip::address_v4 v4Mask = mask.to_v4();

                    ip::address_v4::bytes_type mask_bytes_value = v4Mask.to_bytes();

                    size += v4_len; 
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->numocts = size;
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data = new unsigned char[size];
                    memcpy((void*)mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data, v4Addr_bytes_value.c_array(),v4_len);
                    memcpy((void*)(mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data + v4_len), mask_bytes_value.c_array(),v4_len);
                }
                else
                { 
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->numocts = size;
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data = new unsigned char[size];
                    memcpy((void*)mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data, v4Addr_bytes_value.c_array(),v4_len);
                }
                
            }
            else if(addr.is_v6())
            {
                ip::address_v6 v6Addr = addr.to_v6();

                mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_iPAddress;
                mhCACX509V3GN.pCACX509V3GN->u.iPAddress = new ASN1DynOctStr;

                ip::address_v6::bytes_type v6Addr_bytes_value = v6Addr.to_bytes();

                int v6_len = 16;
                int size = v6_len;
                if(components.size() > 1)
                {
                    ip::address mask;
                    try {
                        mask = ip::address::from_string(components[1].c_str());
                    }catch(std::exception & ){
                        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "invalid mask passed to GetPKIFGenNameFromStr");
                    }
                    ip::address_v6 v6Mask = mask.to_v6();

                    ip::address_v6::bytes_type mask_bytes_value = v6Mask.to_bytes();

                    size += v6_len; 
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->numocts = size;
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data = new unsigned char[size];
                    memcpy((void *)mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data,v6Addr_bytes_value.c_array(),v6_len);
                    memcpy((void *)(mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data + v6_len),mask_bytes_value.c_array(),v6_len);

                }
                else
                { 
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->numocts = size;
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data = new unsigned char[size];
                    memcpy((void*)mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data, v6Addr_bytes_value.c_array(), v6_len);

                }
            }

        }
        break;

    case T_CACX509V3GeneralName_registeredID:
        { 
            mhCACX509V3GN.pCACX509V3GN->u.registeredID = new ASN1OBJID;
            CPKIFOIDPtr oid(new CPKIFOID(CPKIFStringPtr(new std::string((char*)name)))); 
            try
            {
                CPKIFStringPtr str(new std::string(oid->ToString())); 
                ASN1OBJID* tmpOid = ConvertStringToASN1OBJID(str);
                CopyOID(mhCACX509V3GN.pCACX509V3GN->u.registeredID, tmpOid); 
                if(tmpOid)
                    delete tmpOid;
                //CopyOID(mhCACX509V3GN.pCACX509V3GN->u.registeredID, oid->raw()); 
            }
            catch(...)
            {
                throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Invalid OID passed to BuildCACX509V3AttributeTypeAndValue");
            }
            mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_registeredID;
        }
        break;
    default:
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Unexpected general name type passed to GetPKIFGenNameFromStr");
    }
    
    CACASNWRAPPER_CREATE(CACX509V3GeneralName, objPDU);
    ASN1OpenType* data1 = objPDU.Encode((CACX509V3GeneralName*)mhCACX509V3GN.pCACX509V3GN);
    CPKIFBufferPtr tmpBuf;
    if(data1 != NULL)
    {
         tmpBuf = CPKIFBufferPtr(new CPKIFBuffer(data1->data, data1->numocts));
        delete data1;
    }
    //CPKIFGeneralNamePtr pCacGenName(new CPKIFGeneralName(*(CACX509V3GeneralName*)mhCACX509V3GN.pCACX509V3GN));
    CPKIFGeneralNamePtr pCacGenName(new CPKIFGeneralName(tmpBuf));
        
    return pCacGenName;
}
CPKIFBufferPtr GetEncGenNameFromStr(
    unsigned char* name, 
    int nameType)
{
    //added NULL check 8/13/04
    if(name == (unsigned char*)NULL)
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "NULL pointer passed to GetPKIFGenNameFromStr");

    PKIFNameMemoryHelper mhCACX509V3GN;
    mhCACX509V3GN.pCACX509V3GN = new CACX509V3GeneralName;
    memset(mhCACX509V3GN.pCACX509V3GN, 0, sizeof(CACX509V3GeneralName));

    switch(nameType)
    {
    case T_CACX509V3GeneralName_otherName:
        mhCACX509V3GN.pCACX509V3GN->u.otherName = new ASN1OpenType;
        mhCACX509V3GN.pCACX509V3GN->u.otherName->data = new unsigned char[strlen((char*)name) + 1];
        strcpy((char*)mhCACX509V3GN.pCACX509V3GN->u.otherName->data, (char*)name);
        try {
            mhCACX509V3GN.pCACX509V3GN->u.otherName->numocts = boost::numeric_cast<boost::uint32_t,size_t>(strlen((char*)name));
        }catch(boost::numeric::bad_numeric_cast & ){
            throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "invalid character string passed to GetPKIFGenNameFromStr");
        }
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_otherName;
        break;

    case T_CACX509V3GeneralName_rfc822Name:
        mhCACX509V3GN.pCACX509V3GN->u.rfc822Name = new char[strlen((char*)name) + 1];
        strcpy((char*)mhCACX509V3GN.pCACX509V3GN->u.rfc822Name, (char*)name);
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_rfc822Name;
        break;

    case T_CACX509V3GeneralName_dNSName:
        mhCACX509V3GN.pCACX509V3GN->u.dNSName = new char[strlen((char*)name) + 1];
        strcpy((char*)mhCACX509V3GN.pCACX509V3GN->u.dNSName, (char*)name);
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_dNSName;
        break;

    case T_CACX509V3GeneralName_x400Address:
        mhCACX509V3GN.pCACX509V3GN->u.x400Address = new ASN1OpenType;
        mhCACX509V3GN.pCACX509V3GN->u.x400Address->data = new unsigned char[strlen((char*)name) + 1];
        memcpy((void*)(mhCACX509V3GN.pCACX509V3GN->u.x400Address->data), (void*)name, strlen((char*)name));
        try {
            mhCACX509V3GN.pCACX509V3GN->u.x400Address->numocts = boost::numeric_cast<boost::uint32_t,size_t>(strlen((char*)name));
        }catch(boost::numeric::bad_numeric_cast &){
            throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "invalid character string passed to GetPKIFGenNameFromStr");
        }
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_x400Address;
        break;

    case T_CACX509V3GeneralName_directoryName:
        {
            mhCACX509V3GN.pCACX509V3GN->u.directoryName = new CACX509V3Name;
            CACX509V3RelativeDistinguishedName* pCacTmpRDN = new CACX509V3RelativeDistinguishedName;
            BuildCACX509V3DistinguishedName(name, pCacTmpRDN);
            mhCACX509V3GN.pCACX509V3GN->u.directoryName->t = T_CACX509V3Name_rdnSequence;
            mhCACX509V3GN.pCACX509V3GN->u.directoryName->u.rdnSequence = pCacTmpRDN;
            mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_directoryName;
        }
        break;

    case T_CACX509V3GeneralName_ediPartyName:
        //XXX-DEFER implement me
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_ediPartyName;
        break;

    case T_CACX509V3GeneralName_uniformResourceIdentifier:
        mhCACX509V3GN.pCACX509V3GN->u.uniformResourceIdentifier = new char[strlen((char*)name) + 1];
        strcpy((char*)mhCACX509V3GN.pCACX509V3GN->u.uniformResourceIdentifier, (char*)name);
        mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_uniformResourceIdentifier;
        break;

    case T_CACX509V3GeneralName_iPAddress:
        {
            string  base = (char*)name; 
            vector<string> components;
            vector<string>::iterator iter;
            string tmp = "/";
            split(string((char *)base.c_str()),tmp,components);

            boost::asio::io_service io_service;
            ip::address addr;
            try {
                addr = ip::address::from_string(components[0].c_str());
            }catch(std::exception & ){
                throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "invalid IP address passed to GetPKIFGenNameFromStr");
            }

            if(addr.is_v4())
            {
                ip::address_v4 v4Addr = addr.to_v4();
                mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_iPAddress;
                mhCACX509V3GN.pCACX509V3GN->u.iPAddress = new ASN1DynOctStr;

                ip::address_v4::bytes_type v4Addr_bytes_value = v4Addr.to_bytes();

                
                int v4_len = 4;
                int size = v4_len;
                if(components.size() > 1)
                {
                    ip::address mask;
                    try {
                        mask = ip::address::from_string(components[1].c_str());
                    }catch(std::exception & ){
                        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "invalid mask passed to GetPKIFGenNameFromStr");
                    }
                    ip::address_v4 v4Mask = mask.to_v4();

                    ip::address_v4::bytes_type mask_bytes_value = v4Mask.to_bytes();

                    size += v4_len; 
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->numocts = size;
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data = new unsigned char[size];
                    memcpy((void*)mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data, v4Addr_bytes_value.c_array(),v4_len);
                    memcpy((void*)(mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data + v4_len), mask_bytes_value.c_array(),v4_len);
                }
                else
                { 
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->numocts = size;
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data = new unsigned char[size];
                    memcpy((void*)mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data, v4Addr_bytes_value.c_array(),v4_len);
                }
                
            }
            else if(addr.is_v6())
            {
                ip::address_v6 v6Addr = addr.to_v6();

                mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_iPAddress;
                mhCACX509V3GN.pCACX509V3GN->u.iPAddress = new ASN1DynOctStr;

                ip::address_v6::bytes_type v6Addr_bytes_value = v6Addr.to_bytes();

                int v6_len = 16;
                int size = v6_len;
                if(components.size() > 1)
                {
                    ip::address mask;
                    try {
                        mask = ip::address::from_string(components[1].c_str());
                    }catch(std::exception & ){
                        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "invalid mask passed to GetPKIFGenNameFromStr");
                    }
                    ip::address_v6 v6Mask = mask.to_v6();

                    ip::address_v6::bytes_type mask_bytes_value = v6Mask.to_bytes();

                    size += v6_len; 
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->numocts = size;
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data = new unsigned char[size];
                    memcpy((void *)mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data,v6Addr_bytes_value.c_array(),v6_len);
                    memcpy((void *)(mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data + v6_len),mask_bytes_value.c_array(),v6_len);

                }
                else
                { 
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->numocts = size;
                    mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data = new unsigned char[size];
                    memcpy((void*)mhCACX509V3GN.pCACX509V3GN->u.iPAddress->data, v6Addr_bytes_value.c_array(), v6_len);

                }
            }

        }
        break;

    case T_CACX509V3GeneralName_registeredID:
        { 
            mhCACX509V3GN.pCACX509V3GN->u.registeredID = new ASN1OBJID;
            CPKIFOIDPtr oid(new CPKIFOID(CPKIFStringPtr(new std::string((char*)name)))); 
            try
            {
                CPKIFStringPtr str(new std::string(oid->ToString())); 
                ASN1OBJID* tmpOid = ConvertStringToASN1OBJID(str);
                CopyOID(mhCACX509V3GN.pCACX509V3GN->u.registeredID, tmpOid); 
                if(tmpOid)
                    delete tmpOid;
                //CopyOID(mhCACX509V3GN.pCACX509V3GN->u.registeredID, oid->raw()); 
            }
            catch(...)
            {
                throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Invalid OID passed to BuildCACX509V3AttributeTypeAndValue");
            }
            mhCACX509V3GN.pCACX509V3GN->t = T_CACX509V3GeneralName_registeredID;
        }
        break;
    default:
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "Unexpected general name type passed to GetPKIFGenNameFromStr");
    }
    
    CACASNWRAPPER_CREATE(CACX509V3GeneralName, objPDU);
    ASN1OpenType* data1 = objPDU.Encode((CACX509V3GeneralName*)mhCACX509V3GN.pCACX509V3GN);
    CPKIFBufferPtr tmpBuf;
    if(data1 != NULL)
    {
         tmpBuf = CPKIFBufferPtr(new CPKIFBuffer(data1->data, data1->numocts));
        delete data1;
    }
        
    return tmpBuf;
}


//@b Interface: External
//
//This function frees memory used by OOCTXT structure. These structures are created and used internally. 
//Applications need not invoke this function. The OOCTXT structure is defined as follows.
//
// 
//<pre>
//typedef struct _OOCTXT {   // ASN.1 context block 
//
//  ASN1BUFFER buffer; // data buffer 
//  ASN1BUFSAVE savedInfo; // saved buffer info 
//  ASN1ErrInfo errInfo; // run-time error info 
//  ASN1MemBlk* memBlk_p; // memory block list 
//  OSUINT32 initCode; // code double word to indicate init 
//  OSUINT16 flags; // flag bits 
//  DList fieldList; // PER field list 
//  Asn1SizeCnst* pSizeConstraint; // Size constraint list 
//  const char* pCharSet; // String of permitted characters 
//  Asn1RTStack nameStack; // Element name stack 
//  DList evtHndlrList; // Event handler object list 
//  void* errHndlrCB; // Error handler callback function 
//
//} OOCTXT;
//</pre>
//
//@return None
//*/
//void FreeASN1Context(
//  //![in] A pointer to an OOCTXT structure
//  OOCTXT* ctx)
//{
//  freeEncodeBuffer(ctx);
//  memFreeAll(ctx);
//}
CPKIFBufferPtr CAC_API EncodeGeneralName(
    CPKIFGeneralNamePtr& gn)
{
    //added NULL check 8/13/04
    if(gn == (CPKIFGeneralName*)NULL || CPKIFGeneralName::NOTSET == gn->GetType())
        throw CPKIFException(TOOLKIT_UTILS, COMMON_INVALID_INPUT, "NULL pointer passed to EncodeGeneralName");

    //CACX509V3GeneralName tmpGN; //changed this to use memory helper, 4/22/03 CWW
    PKIFNameMemoryHelper mhCACX509V3GN;
    mhCACX509V3GN.pCACX509V3GN = new CACX509V3GeneralName; 
    memset(mhCACX509V3GN.pCACX509V3GN, 0, sizeof(CACX509V3GeneralName)); 

    //CopyGeneralName(tmpGN, gn); 
    CopyGeneralName(*mhCACX509V3GN.pCACX509V3GN, gn);

    CACASNWRAPPER_CREATE(CACX509V3GeneralName, objPDU);
    //ASN1OpenType* data1 = objPDU.Encode(&tmpGN);
    ASN1OpenType* data1 = objPDU.Encode(mhCACX509V3GN.pCACX509V3GN); 
    
    if (data1 != NULL)
    {
      CPKIFBufferPtr tmp(new CPKIFBuffer(data1->data, data1->numocts));
      delete data1;
      return tmp;
    }
    else
    {
      CPKIFBufferPtr tmp(new CPKIFBuffer());
      delete data1;
      return tmp;
    }
}

void FreeName(
    CACX509V3Name** dest)
{
    if(!dest || ! *dest)
        return;

    DListNode* cur = (*dest)->u.rdnSequence->head, *tmpNext = NULL;
    ASN1OpenType* curAT = NULL;
    while(cur)
    {
        curAT = (ASN1OpenType*)cur->data;

        if(curAT)
        {
            if(curAT->data)
            {
                delete curAT->data;
            }

            delete curAT;
        }

        tmpNext = cur->next;
        delete cur;
        cur = tmpNext;
    }

    delete (*dest)->u.rdnSequence;
    delete *dest; *dest = NULL;
}
void FreeGeneralName(
    CACX509V3GeneralName& objName)
{
    switch(objName.t)
    {
    case 9:
    case 8:
    case 7:
    case 6:
    case 4:
    case 3:
    case 1:
        //nothing was done
        break;
    case 5:
        FreeName(&objName.u.directoryName);
        break;
    case 2:
        if(objName.u.rfc822Name)
        {
            delete[] objName.u.rfc822Name; objName.u.rfc822Name = NULL;
        }
        break;
    }
}

//removed export declarations 8/18/2004
CPKIFStringPtr GetCertInfo(
    CPKIFCertificatePtr& targetCert)
{
    CPKIFStringPtr result(new std::string());
    //std::auto_ptr<std::string> result(new std::string());
    if(targetCert != (CPKIFCertificate*)NULL)
    {
        result->append("Issuer DN: ");
        result->append(targetCert->Issuer()->ToString());
        result->append(".  Serial number: ");
        result->append(targetCert->SerialNumber());
        result->append(".  Subject DN: ");
        result->append(targetCert->Subject()->ToString());
        result->append(".");
    }
    return result;
}

//removed export declarations 8/18/2004
bool CertIsSelfIssued(
    const CPKIFCertificatePtr& cert)
{
    return *cert->Subject() == *cert->Issuer();
}
void CollectNamesFromCRLDP(
    const CPKIFCertificatePtr& cert,
    CPKIFGeneralNameList& namesFromCert)
{
    CPKIFCRLDistributionPointsPtr crldp = cert->GetExtension<CPKIFCRLDistributionPoints>();
    if(crldp == (CPKIFCRLDistributionPoints*)NULL)
        return;

    CPKIFCRLDistributionPointListPtr crlDPs = crldp->DPs();
    CPKIFCRLDistributionPointList::iterator pos;
    CPKIFCRLDistributionPointList::iterator end = crlDPs->end();
    bool issuerAdded = false;
    for(pos = crlDPs->begin(); pos != end; ++pos)
    {
        CPKIFGeneralNameList crlIssuer;
        (*pos)->CRLIssuer(crlIssuer);
        
        //if there are any names in the distribution point field - add those
        CPKIFDistributionPointNamePtr dpName = (*pos)->DistributionPoint();
        if(dpName != (CPKIFDistributionPointName*)NULL)//added 12/2/2003
        {
            CPKIFGeneralNameList dpNames;
            dpName->FullName(dpNames);
            CPKIFGeneralNameList::iterator dpNamesPos;
            CPKIFGeneralNameList::iterator dpNamesEnd = dpNames.end();
            for(dpNamesPos = dpNames.begin(); dpNamesPos != dpNamesEnd; ++dpNamesPos)
            {
                if(CPKIFGeneralName::URI == (*dpNamesPos)->GetType())
                {
                    const char* uri = (*dpNamesPos)->uri();
                    PKIFLDAP::LDAPURLDesc *ldapInfo = NULL;
                    PKIFLDAP::ldap_url_parse(uri, &ldapInfo);
                    if(NULL != ldapInfo && (0 == ldapInfo->lud_host && 0 != ldapInfo->lud_dn))
                    {
                        CPKIFNamePtr dn = GetPKIFNameFromStr((unsigned char*)ldapInfo->lud_dn);
                        PKIFLDAP::ldap_free_urldesc( ldapInfo );
                        ldapInfo = NULL;

                        CPKIFGeneralNamePtr gnp(new CPKIFGeneralName(dn));
                        namesFromCert.push_back(gnp);
                    }
                }
                else
                {
                    namesFromCert.push_back(*dpNamesPos);
                }
            }

            if(dpName->NameRelativeToIssuerPresent())
            {
                CPKIFNamePtr iss = cert->Issuer();
                CPKIFNamePtr relName = dpName->GetRelativeNameAsFullName(iss);
                CPKIFGeneralNamePtr gnp(new CPKIFGeneralName(relName));
                namesFromCert.push_back(gnp);

                if(!crlIssuer.empty())
                {
                    CPKIFGeneralNameList::iterator issuerPos;
                    CPKIFGeneralNameList::iterator issuerEnd = crlIssuer.end();
                    for(issuerPos = crlIssuer.begin(); issuerPos != issuerEnd; ++issuerPos)
                    {
                        if(CPKIFGeneralName::DIRECTORYNAME == (*issuerPos)->GetType())
                        {
                            CPKIFNamePtr dn = (*issuerPos)->directoryName();
                            CPKIFNamePtr relName = dpName->GetRelativeNameAsFullName(dn);
                            CPKIFGeneralNamePtr gnp(new CPKIFGeneralName(relName));
                            namesFromCert.push_back(gnp);
                        }
                    }
                }
            }
        }

        //if there are any names in the crlIssuer field - add those
        CPKIFGeneralNameList::iterator issuerPos;
        CPKIFGeneralNameList::iterator issuerEnd = crlIssuer.end();
        for(issuerPos = crlIssuer.begin(); issuerPos != issuerEnd; ++issuerPos)
        {
            namesFromCert.push_back(*issuerPos);
        }
    }
}

// Lookup table
static const unsigned char binVal[256] =
{/* 0x0 0x1 0x2 0x3 0x4 0x5 0x6 0x7 0x8 0x9 0xA 0xB 0xC 0xD 0xE 0xF */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* 0x .............. */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* 1x .............. */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* 2x  !"#$%&'()*+,-./   */
    0x00,0x01,0x02,0x03,0x04,0x05,0x06,0x07,0x08,0x09,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* 3x 0123456789:;<=>?   */
    0xF0,0x0A,0x0B,0x0C,0x0D,0x0E,0x0F,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* 4x @ABCDEFGHIJKLMNO   */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* 5X PQRSTUVWXYZ[\]^_   */
    0xF0,0x0A,0x0B,0x0C,0x0D,0x0E,0x0F,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* 6x `abcdefghijklmno   */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* 7X PQRSTUVWXYZ[\]^_   */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* 8X PQRSTUVWXYZ[\]^_   */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* 9X PQRSTUVWXYZ[\]^_   */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* AX PQRSTUVWXYZ[\]^_   */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* BX PQRSTUVWXYZ[\]^_   */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* CX PQRSTUVWXYZ[\]^_   */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* DX PQRSTUVWXYZ[\]^_   */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0, /* EX PQRSTUVWXYZ[\]^_   */
    0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0,0xF0  /* FX PQRSTUVWXYZ[\]^_   */
};

// Test ASCII char for validity
#define ACCEPTABLE(a)   ( binVal[a] != 0xF0 )

// define the following for max speed, partial conversion len will NOT be returned
//#define ATOB_ABS_MAX_SPEED
// if not defined, the length until an error was encountered will be returned.
int CAC_API atob(
    char* byteval, 
    char* ascval, 
    unsigned int *alength)
{
    //unsigned char *binstr = (unsigned char*)byteval;

    if( NULL == ascval || NULL == byteval || NULL == alength)
        return -1;

    size_t alen = strlen(ascval);

    unsigned int outlen = 0;

    if( 0 == alen )
    {
        return -2;
    }   


    if( 0 != (alen % 2) )
    {
        // odd length string
        if( ACCEPTABLE( ascval[0] )  )
        {
            *byteval++ = binVal[(int)ascval[0]];
            ascval++;
            alen--;
            outlen++;
        }
        else
        {
            return -3;
        }
    }


    for(unsigned int  XX = 0; XX < alen; XX += 2 )
    {
        if( ACCEPTABLE(ascval[XX]) && ACCEPTABLE(ascval[XX+1])  )
        {
            *byteval++ = ( binVal[ascval[XX]] << 4 ) + ( binVal[ascval[XX+1]] );
            outlen++;
        }
        else
        {
            return -4;
        }
    }

    *alength = outlen;
    return 0;
}

static const char *hex_list = "0123456789abcdef";
void CAC_API btoa(
    const char* byteval, 
    char* ascval, 
    unsigned int blength)
{
    if( 0 == blength || NULL == byteval || NULL == ascval )
        return;

    for( unsigned int XX = 0; XX < blength; XX++ )
    {
            *ascval++ = hex_list[(((unsigned char)(byteval[XX])) >> 4)];
            *ascval++ = hex_list[(byteval[XX] & 15)];
    }

    *ascval = '\0';
}
void FormatErrorMessage(
    std::string& result,
    const char* primaryMessage,
    unsigned int code, 
    const char* file, 
    int lineNum)
{
    result = primaryMessage;
    result += ": ";

    char asciiHexCode[25];
    sprintf(asciiHexCode, "0x%x", code);
    result += asciiHexCode;
    result += ".  ";

    if(NULL != file)
    {
        result += file;
        result += " line #";
        sprintf (asciiHexCode, "%u", lineNum);
        result += asciiHexCode;
                //result += itoa(lineNum, asciiHexCode, 10);
    }
}

//this function checks key usage in terms of CAPI-defined key usage bits (i.e.
//the macros are defined in wincrypt.h
bool keyUsageTest(BYTE keyUse[2], bitset<9>* ku)
{
    if(NULL == ku)
        return true;

    bool matchesAtLeastOne = false;

    if((*ku)[0] && (CERT_DIGITAL_SIGNATURE_KEY_USAGE == (keyUse[0] & CERT_DIGITAL_SIGNATURE_KEY_USAGE)))
        matchesAtLeastOne = true;
    if((*ku)[1] && (CERT_NON_REPUDIATION_KEY_USAGE == (keyUse[0] & CERT_NON_REPUDIATION_KEY_USAGE)))
        matchesAtLeastOne = true;
    if((*ku)[2] && (CERT_KEY_ENCIPHERMENT_KEY_USAGE == (keyUse[0] & CERT_KEY_ENCIPHERMENT_KEY_USAGE)))
        matchesAtLeastOne = true;
    if((*ku)[3] && (CERT_DATA_ENCIPHERMENT_KEY_USAGE == (keyUse[0] & CERT_DATA_ENCIPHERMENT_KEY_USAGE)))
        matchesAtLeastOne = true;
    if((*ku)[4] && (CERT_KEY_AGREEMENT_KEY_USAGE == (keyUse[0] & CERT_KEY_AGREEMENT_KEY_USAGE)))
        matchesAtLeastOne = true;
    if((*ku)[5] && (CERT_KEY_CERT_SIGN_KEY_USAGE == (keyUse[0] & CERT_KEY_CERT_SIGN_KEY_USAGE)))
        matchesAtLeastOne = true;
    if((*ku)[6] && (CERT_OFFLINE_CRL_SIGN_KEY_USAGE != (keyUse[0] & CERT_OFFLINE_CRL_SIGN_KEY_USAGE)))
        matchesAtLeastOne = true;
    if((*ku)[7] && (CERT_ENCIPHER_ONLY_KEY_USAGE == (keyUse[0] & CERT_ENCIPHER_ONLY_KEY_USAGE)))
        matchesAtLeastOne = true;
    if((*ku)[8] && (CERT_DECIPHER_ONLY_KEY_USAGE == (keyUse[1] & CERT_DECIPHER_ONLY_KEY_USAGE)))
        matchesAtLeastOne = true;

    return matchesAtLeastOne;
}

//removed export declarations 8/18/2004
void RemoveParentRelationships(
    std::vector<IPKIFColleaguePtr>& modules, 
    IPKIFMediator* mediator)
{
    vector<IPKIFColleaguePtr>::iterator pos;
    vector<IPKIFColleaguePtr>::iterator end = modules.end();
    for(pos = modules.begin(); pos != end; ++pos)
    {
        try
        {
            (*pos)->RemoveParent(mediator);
        }
        catch(...)
        {
//          _ASSERT(false);
        }
    }
}

//removed export declarations 8/18/2004
void FreeAdditionalModules(
    std::vector<IPKIFColleague*>& modules, 
    IPKIFMediator* mediator)
{
    vector<IPKIFColleague*>::iterator pos;
    vector<IPKIFColleague*>::iterator end = modules.end();
    for(pos = modules.begin(); pos != end; ++pos)
    {
        try
        {
            (*pos)->RemoveParent(mediator);
            delete (*pos);
        }
        catch(...)
        {
//          _ASSERT(false);
        }
    }

    modules.clear();//added 04/21/2003 CRW
}

//removed export declarations 8/18/2004
void FreeAdditionalModules2(
    std::vector<IPKIFColleague*>& modules, 
    IPKIFMediator* mediator, 
    std::vector<void (*)( void * )>& vDeleteFuncs)
{
    vector<IPKIFColleague*>::iterator pos;
    vector<IPKIFColleague*>::iterator end = modules.end();
    std::vector<void (*)( void * )>::iterator dPos;
    std::vector<void (*)( void * )>::iterator dEnd = vDeleteFuncs.end();
    for(pos = modules.begin(), dPos = vDeleteFuncs.begin(); pos != end; ++pos, ++dPos)
    {
        try
        {
            (*pos)->RemoveParent(mediator);
            if(*dPos)
                (*dPos)(*pos);
            else 
                delete *pos;
        }
        catch(...)
        {
//          _ASSERT(false);
        }
    }

    vDeleteFuncs.clear();
    modules.clear();//added 04/21/2003 CRW
}
CAC_API char* GetErrorCodeString(
    int errorCode, 
    char* buf) //buf is assumed to be at least MAX_ERROR_CODE_STRING_SIZE in size
{
    switch(errorCode)
    {
    case 0:
        strcpy(buf, "Success");
        break;

    //errors from ASN1Errors.h
    case ASN1_DECODE_ERROR:
        strcpy(buf, "ASN1_DECODE_ERROR");
        break;
    case ASN1_ENCODE_ERROR:
        strcpy(buf, "ASN1_ENCODE_ERROR");
        break;
    case ASN1_UNRECOGNIZED_TIME_FORMAT:
        strcpy(buf, "ASN1_UNRECOGNIZED_TIME_FORMAT");
        break;
    case ASN1_INVALID_PERIOD:
        strcpy(buf, "ASN1_INVALID_PERIOD");
        break;
    case ASN1_INVALID_TIME:
        strcpy(buf, "ASN1_INVALID_TIME");
        break;

    //errors from PKIFCacheErrors.h
    case CACHE_TRUST_STORE_OPEN_FAILED:
        strcpy(buf, "CACHE_TRUST_STORE_OPEN_FAILED");
        break;
    case CACHE_LDAP_CONNECT_AND_BIND_FAILED:
        strcpy(buf, "CACHE_LDAP_CONNECT_AND_BIND_FAILED");
        break;
    case CACHE_LDAP_ERROR:
        strcpy(buf, "CACHE_LDAP_ERROR");
        break;
    case CACHE_PARSE_ERROR:
        strcpy(buf, "CACHE_PARSE_ERROR");
        break;
    case CACHE_CERT_STORE_OPEN_FAILED:
        strcpy(buf, "CACHE_CERT_STORE_OPEN_FAILED");
        break;
    case CACHE_UPDATE_FAILED:
        strcpy(buf, "CACHE_UPDATE_FAILED");
        break;

    //errors from PKIFCryptoErrors.h
    case CRYPTO_ALG_NOT_SUPPORTED:
        strcpy(buf, "CRYPTO_ALG_NOT_SUPPORTED");
        break;
    case CRYPTO_UNRECOGNIZED_CREDENTIAL:
        strcpy(buf, "CRYPTO_UNRECOGNIZED_CREDENTIAL");
        break;
    case CRYPTO_DEFAULT_KEY_TYPE_UNKNOWN:
        strcpy(buf, "CRYPTO_DEFAULT_KEY_TYPE_UNKNOWN");
        break;
    case CRYPTO_MODE_NOT_SUPPORTED:
        strcpy(buf, "CRYPTO_MODE_NOT_SUPPORTED");
        break;
    case CRYPTO_MISSING_IV:
        strcpy(buf, "CRYPTO_MISSING_IV");
        break;
    case CRYPTO_ENCRYPT_FAILED:
        strcpy(buf, "CRYPTO_ENCRYPT_FAILED");
        break;
    case CRYPTO_DECRYPT_FAILED:
        strcpy(buf, "CRYPTO_DECRYPT_FAILED");
        break;
    case CRYPTO_KEY_USAGE_NOT_COMPATIBLE:
        strcpy(buf, "CRYPTO_KEY_USAGE_NOT_COMPATIBLE");
        break;
    case CRYPTO_SIGN_FAILED:
        strcpy(buf, "CRYPTO_SIGN_FAILED");
        break;
    case CRYPTO_VERIFY_FAILED:
        strcpy(buf, "CRYPTO_VERIFY_FAILED");
        break;

    //errors from PKIFCAPIErrors.h
    case PKIFCAPI_ACQUIRE_CONTEXT_FAILED:
        strcpy(buf, "PKIFCAPI_ACQUIRE_CONTEXT_FAILED");
        break;
    case PKIFCAPI_GEN_RANDOM_FAILED:
        strcpy(buf, "PKIFCAPI_GEN_RANDOM_FAILED");
        break;
    case PKIFCAPI_INCORRECT_HASH_CONTEXT:
        strcpy(buf, "PKIFCAPI_INCORRECT_HASH_CONTEXT");
        break;
    case PKIFCAPI_EMPTY_HASH_CONTEXT:
        strcpy(buf, "PKIFCAPI_EMPTY_HASH_CONTEXT");
        break;
    case PKIFCAPI_KEY_MATERIAL_NOT_SUPPORTED:
        strcpy(buf, "PKIFCAPI_KEY_MATERIAL_NOT_SUPPORTED");
        break;
    case PKIFCAPI_FAILED_TO_OPEN_CERT_STORE:
        strcpy(buf, "PKIFCAPI_FAILED_TO_OPEN_CERT_STORE");
        break;
    case PKIFCAPI_GET_NAME_FAILED:
        strcpy(buf, "PKIFCAPI_GET_NAME_FAILED");
        break;
    case PKIFCAPI_CREATE_HASH_FAILED:
        strcpy(buf, "PKIFCAPI_CREATE_HASH_FAILED");
        break;
    case PKIFCAPI_MISC_HASH_CALL_FAILED:
        strcpy(buf, "PKIFCAPI_MISC_HASH_CALL_FAILED");
        break;
    case PKIFCAPI_SIGN_FAILED:
        strcpy(buf, "PKIFCAPI_SIGN_FAILED");
        break;
    case PKIFCAPI_DECRYPT_FAILED:
        strcpy(buf, "PKIFCAPI_DECRYPT_FAILED");
        break;
    case PKIFCAPI_INVALID_HASH_STATE:
        strcpy(buf, "PKIFCAPI_INVALID_HASH_STATE");
        break;
    case PKIFCAPI_CREATE_CERT_FAILED:
        strcpy(buf, "PKIFCAPI_CREATE_CERT_FAILED");
        break;
    case PKIFCAPI_KEY_IMPORT_FAILED:
        strcpy(buf, "PKIFCAPI_KEY_IMPORT_FAILED");
        break;
    case PKIFCAPI_VERIFY_FAILED:
        strcpy(buf, "PKIFCAPI_VERIFY_FAILED");
        break;
    case PKIFCAPI_SESSION_KEY_ENCRYPT_FAILED:
        strcpy(buf, "PKIFCAPI_SESSION_KEY_ENCRYPT_FAILED");
        break;
    case PKIFCAPI_SET_MODE_FAILED:
        strcpy(buf, "PKIFCAPI_SET_MODE_FAILED");
        break;
    case PKIFCAPI_SET_IV_FAILED:
        strcpy(buf, "PKIFCAPI_SET_IV_FAILED");
        break;

    //credential-related PKIFCAPI errors
    case PKIFCAPI_GET_USER_KEY_FAILED:
        strcpy(buf, "PKIFCAPI_GET_USER_KEY_FAILED");
        break;
    case PKIFCAPI_SET_PASSWORD_FAILED:
        strcpy(buf, "PKIFCAPI_SET_PASSWORD_FAILED");
        break;
    case PKIFCAPI_KEY_PROV_INFO_FAILED:
        strcpy(buf, "PKIFCAPI_KEY_PROV_INFO_FAILED");
        break;
    case PKIFCAPI_NO_KEY_ASSOCIATED:
        strcpy(buf, "PKIFCAPI_NO_KEY_ASSOCIATED");
        break;

#if BUILD_CMS_STUFF // moving CMS into separate DLL...
    //errors from PKIFMessageErrors.h
    case MSG_DECODE_FAILED:
        strcpy(buf, "MSG_DECODE_FAILED");
        break;
    case MSG_INCOMPLETE:
        strcpy(buf, "MSG_INCOMPLETE");
        break;
    case MSG_ENCODE_FAILED:
        strcpy(buf, "MSG_ENCODE_FAILED");
        break;
    case MSG_SYMKEY_DECRYPT_FAILED:
        strcpy(buf, "MSG_SYMKEY_DECRYPT_FAILED");
        break;
    case MSG_MISSING_PARAMS:
        strcpy(buf, "MSG_MISSING_PARAMS");
        break;
    case MSG_INVALID_INDEX:
        strcpy(buf, "MSG_INVALID_INDEX");
        break;
    case MSG_INVALID_CREDENTIAL:
        strcpy(buf, "MSG_INVALID_CREDENTIAL");
        break;
    case MSG_INVALID_RECIP:
        strcpy(buf, "MSG_INVALID_RECIP");
        break;
    case MSG_SIGNATURE_GENERATION_ERROR:
        strcpy(buf, "MSG_SIGNATURE_GENERATION_ERROR");
        break;
    case MSG_INVALID_STATE:
        strcpy(buf, "MSG_INVALID_STATE");
        break;
    case MSG_NO_CERTIFICATE:
        strcpy(buf, "MSG_NO_CERTIFICATE");
        break;
#endif //CMS_MESSAGE_STUFF

    //errors from PKIFOCSPErrors.h
    case OCSP_MISSING_REQUIRED_FIELD:
        strcpy(buf, "OCSP_MISSING_REQUIRED_FIELD");
        break;
    case OCSP_UNRECOGNIZED_CHOICE:
        strcpy(buf, "OCSP_UNRECOGNIZED_CHOICE");
        break;
    case OCSP_FAILED_TO_OBTAIN_RESPONSE:
        strcpy(buf, "OCSP_FAILED_TO_OBTAIN_RESPONSE");
        break;
    case OCSP_RECEIVED_NON_SUCCESSFUL_RESPONSE:
        strcpy(buf, "OCSP_RECEIVED_NON_SUCCESSFUL_RESPONSE");
        break;
    case OCSP_NO_RESPONSE_BODY:
        strcpy(buf, "OCSP_NO_RESPONSE_BODY");
        break;
    case OCSP_UNSUPPORTED_RESPONSE_TYPE:
        strcpy(buf, "OCSP_UNSUPPORTED_RESPONSE_TYPE");
        break;
    case OCSP_RESPONSE_SIG_VERIFICATION_FAILED:
        strcpy(buf, "OCSP_RESPONSE_SIG_VERIFICATION_FAILED");
        break;
    case OCSP_SIGNER_MISMATCH:
        strcpy(buf, "OCSP_SIGNER_MISMATCH");
        break;
    case OCSP_RESPONDER_IS_TARGET:
        strcpy(buf, "OCSP_RESPONDER_IS_TARGET");
        break;
    case OCSP_RESPONDER_NOT_AUTHORIZED:
        strcpy(buf, "OCSP_RESPONDER_NOT_AUTHORIZED");
        break;
    case OCSP_TIME_CHECK_FAILED:
        strcpy(buf, "OCSP_TIME_CHECK_FAILED");
        break;
    case OCSP_UNKNOWN_CERT_STATUS:
        strcpy(buf, "OCSP_UNKNOWN_CERT_STATUS");
        break;
    case OCSP_PATH_BUILDING_FAILED:
        strcpy(buf, "OCSP_PATH_BUILDING_FAILED");
        break;
    case OCSP_PATH_VALIDATION_FAILED:
        strcpy(buf, "OCSP_PATH_VALIDATION_FAILED");
        break;
    case OCSP_AIA_URL_PARSE_FAILED:
        strcpy(buf, "OCSP_AIA_URL_PARSE_FAILED");
        break;
    case OCSP_NONCE_MISMATCH:
        strcpy(buf, "OCSP_NONCE_MISMATCH");
        break;
    case OCSP_NONCE_MISSING:
        strcpy(buf, "OCSP_NONCE_MISSING");
        break;
    case OCSP_PATH_STATUS_NOT_DETERMINED:
        strcpy(buf, "OCSP_PATH_STATUS_NOT_DETERMINED");
        break;
    case OCSP_NEXT_UPDATE_PASSED:
        strcpy(buf, "OCSP_NEXT_UPDATE_PASSED");
        break;
    case OCSP_STATUS_NOT_SUFFICIENTLY_RECENT:
        strcpy(buf, "OCSP_STATUS_NOT_SUFFICIENTLY_RECENT");
        break;
    case OCSP_UNPROCESSED_CRITICAL_EXTENSION:
        strcpy(buf, "OCSP_UNPROCESSED_CRITICAL_EXTENSION");
        break;
    case OCSP_TARGET_RESPONSE_NOT_INCLUDED:
        strcpy(buf, "OCSP_TARGET_RESPONSE_NOT_INCLUDED");
        break;

    //errors from PKIFPathErrors.h
    case PATH_LENGTH_VIOLATION:
        strcpy(buf, "PATH_LENGTH_VIOLATION");
        break;
    case PATH_NAME_CHAINING_VIOLATION:
        strcpy(buf, "PATH_NAME_CHAINING_VIOLATION");
        break;
    case PATH_BASIC_CONSTRAINTS_VIOLATION:
        strcpy(buf, "PATH_BASIC_CONSTRAINTS_VIOLATION");
        break;
    case PATH_VALIDITY_PERIOD_VIOLATION_NOT_YET_VALID:
        strcpy(buf, "PATH_VALIDITY_PERIOD_VIOLATION");
        break;
    case PATH_VALIDITY_PERIOD_VIOLATION_EXPIRED:
        strcpy(buf, "PATH_VALIDITY_PERIOD_VIOLATION");
        break;
    case PATH_KEY_USAGE_VIOLATION:
        strcpy(buf, "PATH_KEY_USAGE_VIOLATION");
        break;
    case PATH_SIGNATURE_VERIFICATION_FAILED:
        strcpy(buf, "PATH_SIGNATURE_VERIFICATION_FAILED");
        break;
    case PATH_CERT_REVOKED:
        strcpy(buf, "PATH_CERT_REVOKED");
        break;
    case PATH_UNPROCESSED_CRITICAL_EXTENSION:
        strcpy(buf, "PATH_UNPROCESSED_CRITICAL_EXTENSION");
        break;
    case PATH_TRUST_ROOT_NOT_SET:
        strcpy(buf, "PATH_TRUST_ROOT_NOT_SET");
        break;
    case PATH_TRUST_ROOT_NO_CERT:
        strcpy(buf, "PATH_TRUST_ROOT_NO_CERT");
        break;
    case PATH_NAME_CONSTRAINTS_VIOLATION:
        strcpy(buf, "PATH_NAME_CONSTRAINTS_VIOLATION");
        break;
    case PATH_APP_DEFINED_CHECK_FAILED:
        strcpy(buf, "PATH_APP_DEFINED_CHECK_FAILED");
        break;
    case PATH_ALG_CHAINING_FAILURE:
        strcpy(buf, "PATH_ALG_CHAINING_FAILURE");
        break;
    case PATH_NULL_USER_POLICY_SET:
        strcpy(buf, "PATH_NULL_USER_POLICY_SET");
        break;
    case PATH_CERT_REVOCATION_STATUS_NOT_DETERMINED:
        strcpy(buf, "PATH_CERT_REVOCATION_STATUS_NOT_DETERMINED");
        break;
    case PATH_NULL_AUTH_POLICY_SET:
        strcpy(buf, "PATH_NULL_AUTH_POLICY_SET");
        break;

#if BUILD_TAPTSP_STUFF // moving TAP/TSP into separate DLL
    //errors from PKIFTAPErrors.h
    case TAP_MISSING_REQUIRED_FIELD:
        strcpy(buf, "TAP_MISSING_REQUIRED_FIELD");
        break;
    case TAP_UNRECOGNIZED_CHOICE:
        strcpy(buf, "TAP_UNRECOGNIZED_CHOICE");
        break;

    //errors from PKIFTSPErrors.h
    case TSP_MISSING_REQUIRED_FIELD:
        strcpy(buf, "TSP_MISSING_REQUIRED_FIELD");
        break;
    case TSP_MISSING_REQUIRED_EKU:
        strcpy(buf, "TSP_MISSING_REQUIRED_EKU");
        break;
    case TSP_HASH_MISMATCH:
        strcpy(buf, "TSP_HASH_MISMATCH");
        break;
    case TSP_NOT_WITHIN_SKEW:
        strcpy(buf, "TSP_NOT_WITHIN_SKEW");
        break;
    case TSP_NOT_WITHIN_VALIDITY_PERIOD:
        strcpy(buf, "TSP_NOT_WITHIN_VALIDITY_PERIOD");
        break;
    case TSP_REVOCATION_DATE_PRECEDES_TIME:
        strcpy(buf, "TSP_REVOCATION_DATE_PRECEDES_TIME");
        break;
    case TSP_VERIFICATION_FAILED:
        strcpy(buf, "TSP_VERIFICATION_FAILED");
        break;
#endif //BUILD_TAPTSP_STUFF

    //errors from CACCommonErrors.h
    case COMMON_NOT_IMPLEMENTED:
        strcpy(buf, "COMMON_NOT_IMPLEMENTED");
        break;
    case COMMON_ALREADY_INITIALIZED:
        strcpy(buf, "COMMON_ALREADY_INITIALIZED");
        break;
    case COMMON_NOT_INITIALIZED:
        strcpy(buf, "COMMON_NOT_INITIALIZED");
        break;
    case COMMON_OPERATION_NOT_HANDLED:
        strcpy(buf, "COMMON_OPERATION_NOT_HANDLED");
        break;
    case COMMON_INVALID_INPUT:
        strcpy(buf, "COMMON_INVALID_INPUT");
        break;
    case COMMON_MEMORY_ALLOC_FAILURE:
        strcpy(buf, "COMMON_MEMORY_ALLOC_FAILURE");
        break;
    case COMMON_UNKNOWN_ERROR:
        strcpy(buf, "COMMON_UNKNOWN_ERROR");
        break;
    case COMMON_MEDIATOR_MISSING:
        strcpy(buf, "COMMON_MEDIATOR_MISSING");
        break;
    case COMMON_UNSUPPORTED_ALG:
        strcpy(buf, "COMMON_UNSUPPORTED_ALG");
        break;
    case COMMON_TERMINATION_ERROR:
        strcpy(buf, "COMMON_TERMINATION_ERROR");
        break;
    case COMMON_OPERATION_NOT_SUCCESSFUL:
        strcpy(buf, "COMMON_OPERATION_NOT_SUCCESSFUL");
        break;
    case COMMON_INITIALIZATION_FAILED:
        strcpy(buf, "COMMON_INITIALIZATION_FAILED");
        break;
    case COMMON_URL_TOO_BIG:
        strcpy(buf, "COMMON_URL_TOO_BIG");
        break;
    case COMMON_URL_OPERATION_FAILED:
        strcpy(buf, "COMMON_URL_OPERATION_FAILED");
        break;
    case COMMON_UNSUPPORTED_VERSION:
        strcpy(buf, "COMMON_UNSUPPORTED_VERSION");
        break;
    case COMMON_UNSUPPORTED_CHOICE:
        strcpy(buf, "COMMON_UNSUPPORTED_CHOICE");
        break;

    default:
        strcpy(buf, "Unrecognized error code");
        break;
    }

    return buf;
}

//@b Interface: External
//
//This function makes a copy of an ASN1OBJID object.
//
//@return None
//*/
//void CopyOID(
//  //![in/out] A pointer to an ASN1OBJID object.                
//  ASN1OBJID* dest, 
//  //![in] A pointer to an ASN1OBJID object.
//  ASN1OBJID* src)
//{
//  dest->numids = src->numids;
//  for(unsigned int ii = 0; ii < src->numids; ++ii)
//      dest->subid[ii] = src->subid[ii];
//}

#ifdef _NO_GETTICKCOUNT

unsigned long GetTickCount(void)
{
    unsigned long rv;
    struct timeval now;
    gettimeofday(&now,NULL);
    rv = now.tv_sec * 1000;
    rv += now.tv_usec / 1000;
    return rv;
}
#endif //_NO_GETTICKCOUNT

/*
bool ExtensionsMatch::operator()(const CPKIFX509ExtensionPtr& lhs)
{
    return *lhs == *m_rhs;
}
void ExtensionsMatch::SetRHS(CPKIFX509ExtensionPtr& rhs) {m_rhs = rhs;}
*/

//removed completely 8/26/2004 - unused class
//bool GenNamesMatch::operator()(const CPKIFGeneralNamePtr& lhs)
//{
//  //added NULL check - 8/13/2004
//  if(lhs == (CPKIFGeneralName*)NULL || CPKIFGeneralName::NOTSET == lhs->GetType())
//      return false;
//  else
//      return *lhs == *m_rhs;
//}
//void GenNamesMatch::SetRHS(CPKIFGeneralNamePtr& rhs) {m_rhs = rhs;}

void CAC_API keyUsageChecker_AnyEE(
    const CPKIFCertificateNodeEntryPtr& certNode, 
    CPKIFPathValidationResults& results,
    CertificateType type)
{
    if(EE == type)
    {
        CPKIFCertificatePtr curCert = certNode->GetCert();
        CPKIFKeyUsagePtr keyUsage = curCert->GetExtension<CPKIFKeyUsage>();
        if(keyUsage != (CPKIFKeyUsage*)NULL)
        {
            CPKIFX509ExtensionPtr keyUsage2 = keyUsage;
            certNode->MarkExtensionAsProcessed(keyUsage2);
        }
    }
}

//added this function - 7/13/2004
void CAC_API EKUChecker_Timestamp(
    const CPKIFCertificateNodeEntryPtr& certNode, 
    CPKIFPathValidationResults& results, 
    CertificateType type)
{
    LOG_STRING_DEBUG("EKUChecker_Timestamp", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, NULL);

    if(EE == type)
    {
        CPKIFCertificatePtr curCert = certNode->GetCert();

        //TO BE RFC 3161 COMPLIANT WE SHOULD NOT PERMIT ANY EKU AND WE SHOULD
        //REQUIRE A SINGLE KEY PURPOSE IF AND SHOULD REQUIRE CRITICALITY.  WE
        //ARE NOT COMPLIANT.

        CPKIFExtendedKeyUsagePtr eku = curCert->GetExtension<CPKIFExtendedKeyUsage>();
        if(eku != (CPKIFExtendedKeyUsage*)NULL)
        {
            vector<CPKIFOIDPtr> keyPurposeIDs;
            eku->KeyPurposeIDs(keyPurposeIDs);

            GottaMatch<CPKIFOIDPtr> gm;
            gm.SetRHS(g_timestampingEKU);

            vector<CPKIFOIDPtr>::iterator end = keyPurposeIDs.end();
            if(end != find_if(keyPurposeIDs.begin(), keyPurposeIDs.end(), gm))
            {
                CPKIFX509ExtensionPtr eku2 = eku;
                certNode->MarkExtensionAsProcessed(eku2);
            }
            else
            {
                gm.SetRHS(g_anyEKU);
                if(end != find_if(keyPurposeIDs.begin(), keyPurposeIDs.end(), gm))
                {
                    CPKIFX509ExtensionPtr eku2 = eku;
                    certNode->MarkExtensionAsProcessed(eku2);
                }
            }
        }
    }
}

//added this function - 7/13/2004
void CAC_API EKUChecker_OcspSigning(
    const CPKIFCertificateNodeEntryPtr& certNode, 
    CPKIFPathValidationResults& results, 
    CertificateType type)
{
    LOG_STRING_DEBUG("EKUChecker_Timestamp", TOOLKIT_TSP_TIMESTAMP_VERIFIER, 0, NULL);

    if(EE == type)
    {
        CPKIFCertificatePtr curCert = certNode->GetCert();

        //TO BE RFC 3161 COMPLIANT WE SHOULD NOT PERMIT ANY EKU AND WE SHOULD
        //REQUIRE A SINGLE KEY PURPOSE IF AND SHOULD REQUIRE CRITICALITY.  WE
        //ARE NOT COMPLIANT.

        CPKIFExtendedKeyUsagePtr eku = curCert->GetExtension<CPKIFExtendedKeyUsage>();
        if(eku != (CPKIFExtendedKeyUsage*)NULL)
        {
            vector<CPKIFOIDPtr> keyPurposeIDs;
            eku->KeyPurposeIDs(keyPurposeIDs);

            GottaMatch<CPKIFOIDPtr> gm;
            gm.SetRHS(g_ocspSigningEKU);

            vector<CPKIFOIDPtr>::iterator end = keyPurposeIDs.end();
            if(end != find_if(keyPurposeIDs.begin(), keyPurposeIDs.end(), gm))
            {
                CPKIFX509ExtensionPtr eku2 = eku;
                certNode->MarkExtensionAsProcessed(eku2);
            }
            else
            {
                gm.SetRHS(g_anyEKU);
                if(end != find_if(keyPurposeIDs.begin(), keyPurposeIDs.end(), gm))
                {
                    CPKIFX509ExtensionPtr eku2 = eku;
                    certNode->MarkExtensionAsProcessed(eku2);
                }
            }
        }
    }
}

std::string DecodeIPAndMask(
    const CPKIFBufferPtr& encodedIP)
{
    string rv = "";
    if(encodedIP->GetLength() == 32)
    {   
        ip::address_v6::bytes_type bytesAddr;
        memcpy(bytesAddr.c_array(), encodedIP->GetBuffer(),encodedIP->GetLength()/2);
        ip::address_v6 addr(bytesAddr);
        rv = addr.to_string();

        rv+="/";

        ip::address_v6::bytes_type bytesMask;
        memcpy(bytesMask.c_array(), encodedIP->GetBuffer()+encodedIP->GetLength()/2,encodedIP->GetLength()/2);
        ip::address_v6 mask(bytesMask);
        string sMask = mask.to_string();

        rv +=sMask;

    }
    else if(encodedIP->GetLength() == 8)
    {
        ip::address_v4::bytes_type bytesAddr;
        memcpy(bytesAddr.c_array(), encodedIP->GetBuffer(),encodedIP->GetLength()/2);
        ip::address_v4 addr(bytesAddr);
        rv = addr.to_string();

        rv+="/";

        ip::address_v4::bytes_type bytesMask;
        memcpy(bytesMask.c_array(), encodedIP->GetBuffer()+encodedIP->GetLength()/2,encodedIP->GetLength()/2);
        ip::address_v4 mask(bytesMask);
        string sMask = mask.to_string();

        rv +=sMask;
    }
    return rv;
}