void AJ_Net_MCastDown(AJ_MCastSocket* mcastSock)
{
    size_t i;
    AJ_InfoPrintf(("AJ_Net_MCastDown(nexSock=0x%p)\n", mcastSock));

    // shutdown and close all sockets
    for (i = 0; i < NumMcastSocks; ++i) {
        SOCKET sock = McastSocks[i].sock;

        // leave multicast groups
        if ((McastSocks[i].family == AF_INET) && McastSocks[i].has_mcast4) {
            struct ip_mreq mreq;
            inet_pton(AF_INET, AJ_IPV4_MULTICAST_GROUP, &mreq.imr_multiaddr);
            mreq.imr_interface.s_addr = INADDR_ANY;
            setsockopt(sock, IPPROTO_IP, IP_DROP_MEMBERSHIP, (char*) &mreq, sizeof(mreq));
        } else if ((McastSocks[i].family == AF_INET6) && McastSocks[i].has_mcast6) {
            struct ipv6_mreq mreq6;
            inet_pton(AF_INET6, AJ_IPV6_MULTICAST_GROUP, &mreq6.ipv6mr_multiaddr);
            mreq6.ipv6mr_interface = 0;
            setsockopt(sock, IPPROTO_IPV6, IPV6_DROP_MEMBERSHIP, (char*) &mreq6, sizeof(mreq6));
        }

        shutdown(sock, 0);
        closesocket(sock);
    }

    NumMcastSocks = 0;
    free(McastSocks);
    McastSocks = NULL;
    memset(mcastSock, 0, sizeof(AJ_MCastSocket));
}

static AJ_Status AuthAdvance(AJ_SASL_Context* context, AJ_IOBuffer* rxBuf, AJ_IOBuffer* txBuf)
{
    AJ_Status status = AJ_OK;

    AJ_InfoPrintf(("AuthAdvance(context=0x%p, rxBuf=0x%p, txBuf=0x%p)\n", context, rxBuf, txBuf));

    if (context->state != AJ_SASL_SEND_AUTH_REQ) {
        /*
         * All the authentication messages end in a CR/LF so read until we get a newline
         */
        while ((AJ_IO_BUF_AVAIL(rxBuf) == 0) || (*(rxBuf->writePtr - 1) != '\n')) {
            status = rxBuf->recv(rxBuf, AJ_IO_BUF_SPACE(rxBuf), 3500);
            if (status != AJ_OK) {
                break;
            }
        }
    }
    if (status == AJ_OK) {
        uint32_t inLen = AJ_IO_BUF_AVAIL(rxBuf);
        *rxBuf->writePtr = '\0';
        status = AJ_SASL_Advance(context, (char*)rxBuf->readPtr, (char*)txBuf->writePtr, AJ_IO_BUF_SPACE(txBuf));
        if (status == AJ_OK) {
            rxBuf->readPtr += inLen;
            txBuf->writePtr += strlen((char*)txBuf->writePtr);
            status = txBuf->send(txBuf);
        }
    }
    return status;
}

AJ_Status AJS_UnmarshalPropArgs(duk_context* ctx, AJ_Message* msg, uint8_t accessor, duk_idx_t msgIdx)
{
    AJ_Status status;
    const char* iface;
    const char* prop;
    const char* signature;
    uint32_t propId;
    uint8_t secure = FALSE;

    AJ_InfoPrintf(("PushPropArgs\n"));

    if (accessor == AJ_PROP_GET_ALL) {
        status = AJ_UnmarshalArgs(msg, "s", &iface);
        if (status == AJ_OK) {
            duk_push_string(ctx, iface);
            /*
             * Save interface (read-only) so we know how to marshal the reply values
             */
            duk_push_string(ctx, AJS_HIDDEN_PROP("propIface"));
            duk_dup(ctx, -2);
            duk_def_prop(ctx, msgIdx, DUK_DEFPROP_HAVE_VALUE | DUK_DEFPROP_HAVE_WRITABLE);
        }
        /*
         * This call always returns an error status because the interface name we are passing in is
         * invalid but it will indicate if security is required so we can perform the check below
         */
        AJ_IdentifyProperty(msg, iface, "", &propId, &signature, &secure);
    } else {
        status = AJ_UnmarshalArgs(msg, "ss", &iface, &prop);
        if (status == AJ_OK) {
            status = AJ_IdentifyProperty(msg, iface, prop, &propId, &signature, &secure);
            if (status == AJ_OK) {
                duk_push_string(ctx, iface);
                duk_push_string(ctx, prop);
                if (accessor == AJ_PROP_GET) {
                    /*
                     * If we are getting a property save the signature so we know how to marshal the
                     * value in the reply.
                     */
                    duk_push_string(ctx, AJS_HIDDEN_PROP("propSig"));
                    duk_push_string(ctx, signature);
                    duk_def_prop(ctx, msgIdx, DUK_DEFPROP_HAVE_VALUE | DUK_DEFPROP_HAVE_WRITABLE);
                } else {
                    /*
                     * Push the value to set
                     */
                    status = PushArg(ctx, msg);
                }
            }
        }
    }
    /*
     * If the interface is secure check the message is encrypted
     */
    if ((status == AJ_OK) && secure && !(msg->hdr->flags & AJ_FLAG_ENCRYPTED)) {
        status = AJ_ERR_SECURITY;
        AJ_WarnPrintf(("Security violation accessing property\n"));
    }
    return status;
}

static AJ_Status AJ_ARDP_UDP_Send(void* context, uint8_t* buf, size_t len, size_t* sent)
{
    AJ_Status status = AJ_OK;
    DWORD ret;
    NetContext* ctx = (NetContext*) context;
    WSAOVERLAPPED ov;
    DWORD flags = 0;
    WSABUF wsbuf;

    memset(&ov, 0, sizeof(ov));
    ov.hEvent = sendEvent;
    wsbuf.len = len;
    wsbuf.buf = buf;

    AJ_InfoPrintf(("AJ_ARDP_UDP_Send(buf=0x%p, len=%lu)\n", buf, len));

    ret = WSASend(ctx->udpSock, &wsbuf, 1, NULL, flags, &ov, NULL);
    if (ret == SOCKET_ERROR) {
        AJ_ErrPrintf(("AJ_ARDP_UDP_Send(): WSASend() failed. WSAGetLastError()=0x%x, status=AJ_ERR_WRITE\n", WSAGetLastError()));
        *sent = 0;
        return AJ_ERR_WRITE;
    }

    if (!WSAGetOverlappedResult(ctx->udpSock, &ov, sent, TRUE, &flags)) {
        AJ_ErrPrintf(("AJ_ARDP_UDP_Send(): WSAGetOverlappedResult() failed. WSAGetLastError()=0x%x, status=AJ_ERR_WRITE\n", WSAGetLastError()));
        return AJ_ERR_WRITE;
    }

    return status;
}

AJ_Status AJSVC_PropertyStore_LoadAll()
{
    AJ_Status status = AJ_OK;
    void* buf = NULL;
    uint16_t size = 0;
    uint16_t entry;

    int8_t langIndex = AJSVC_PROPERTY_STORE_NO_LANGUAGE_INDEX;
    for (; langIndex < AJSVC_PROPERTY_STORE_NUMBER_OF_LANGUAGES; langIndex++) {
        AJSVC_PropertyStoreFieldIndices fieldIndex = 0;
        for (; fieldIndex < AJSVC_PROPERTY_STORE_NUMBER_OF_RUNTIME_KEYS; fieldIndex++) {
            if (propertyStoreRuntimeValues[fieldIndex].value == NULL ||
                !propertyStoreProperties[fieldIndex].mode0Write ||
                (langIndex != AJSVC_PROPERTY_STORE_NO_LANGUAGE_INDEX && !propertyStoreProperties[fieldIndex].mode2MultiLng)) {
                continue;
            }
            buf = propertyStoreRuntimeValues[fieldIndex].value[langIndex];
            if (buf) {
                size = propertyStoreRuntimeValues[fieldIndex].size;
                entry = (int)fieldIndex + (int)langIndex * (int)AJSVC_PROPERTY_STORE_NUMBER_OF_RUNTIME_KEYS;
                status = PropertyStore_ReadConfig(AJ_PROPERTIES_NV_ID_BEGIN + entry, buf, size);
                AJ_InfoPrintf(("nvram read fieldIndex=%d [%s] langIndex=%d [%s] entry=%d val=%s size=%u status=%s\n", (int)fieldIndex, propertyStoreProperties[fieldIndex].keyName, (int)langIndex, propertyStoreDefaultLanguages[langIndex], (int)entry, propertyStoreRuntimeValues[fieldIndex].value[langIndex], (int)size, AJ_StatusText(status)));
            }
        }
    }

    return status;
}

AJ_Status AJ_Net_Connect(AJ_BusAttachment* bus, const AJ_Service* service)
{
    int ret;
    IPAddress ip(service->ipv4);

    if (!(service->addrTypes & AJ_ADDR_TCP4)) {
        AJ_ErrPrintf(("AJ_Net_Connect(): only IPV4 TCP supported\n", ret));
        return AJ_ERR_CONNECT;
    }


    AJ_InfoPrintf(("AJ_Net_Connect(bus=0x%p, addrType=%d.)\n", bus, service->addrTypes));

    ret = g_client.connect(ip, service->ipv4port);


    if (ret != 1) {
        AJ_ErrPrintf(("AJ_Net_Connect(): connect() failed: %d: status=AJ_ERR_CONNECT\n", ret));
        return AJ_ERR_CONNECT;
    } else {
        AJ_IOBufInit(&bus->sock.rx, rxData, sizeof(rxData), AJ_IO_BUF_RX, (void*)&g_client);
        bus->sock.rx.recv = AJ_Net_Recv;
        AJ_IOBufInit(&bus->sock.tx, txData, sizeof(txData), AJ_IO_BUF_TX, (void*)&g_client);
        bus->sock.tx.send = AJ_Net_Send;
        AJ_ErrPrintf(("AJ_Net_Connect(): connect() success: status=AJ_OK\n"));
        return AJ_OK;
    }
    AJ_ErrPrintf(("AJ_Net_Connect(): connect() failed: %d: status=AJ_ERR_CONNECT\n", ret));
    return AJ_ERR_CONNECT;
}

void AJ_BusSetPasswordCallback(AJ_BusAttachment* bus, AJ_AuthPwdFunc pwdCallback)
{
#ifndef NO_SECURITY
    AJ_InfoPrintf(("AJ_BusSetPasswordCallback(bus=0x%p, pwdCallback=0x%p)\n", bus, pwdCallback));
    bus->pwdCallback = pwdCallback;
#endif
}

static AJ_Status ComposeWhoHas(AJ_IOBuffer* txBuf, const char* prefix)
{
    size_t preLen = strlen(prefix);
    NSHeader* hdr = (NSHeader*)txBuf->writePtr;
    uint8_t* p = txBuf->writePtr + 6;
    size_t outLen = (6 + preLen + 2);

    AJ_InfoPrintf(("ComposeWhoHas(txbuf=0x%p, prefix=\"%s\")\n", txBuf, prefix));

    if (outLen > AJ_IO_BUF_SPACE(txBuf)) {
        AJ_ErrPrintf(("ComposeWhoHas(): AJ_ERR_RESOURCES\n"));
        return AJ_ERR_RESOURCES;
    }
    hdr->version = MSG_V1 | NSV_V1;
    hdr->qCount = 1;
    hdr->aCount = 0;
    hdr->ttl = 0;
    hdr->flags = WHO_HAS_MSG;
    hdr->nameCount = 1;
    *p++ = (uint8_t)(preLen + 1);
    memcpy(p, prefix, preLen);
    /*
     * Tack wild-card onto the end of the name to indicate it's prefix
     */
    p[preLen] = '*';
    txBuf->writePtr += outLen;
    return AJ_OK;
}

AJ_Status AJSVC_PropertyStore_SaveAll()
{
    AJ_Status status = AJ_OK;
    void* buf = NULL;
    uint16_t size = 0;
    uint16_t entry;

    int8_t langIndex = AJSVC_PROPERTY_STORE_NO_LANGUAGE_INDEX;
    for (; langIndex < AJSVC_PROPERTY_STORE_NUMBER_OF_LANGUAGES; langIndex++) {
        AJSVC_PropertyStoreFieldIndices fieldIndex = 0;
        for (; fieldIndex < AJSVC_PROPERTY_STORE_NUMBER_OF_CONFIG_KEYS; fieldIndex++) {
            if (propertyStoreRuntimeValues[fieldIndex].value == NULL ||
                (langIndex != AJSVC_PROPERTY_STORE_NO_LANGUAGE_INDEX && !propertyStoreProperties[fieldIndex].mode2MultiLng)) {
                continue;
            }
            buf = propertyStoreRuntimeValues[fieldIndex].value[langIndex];
            if (buf) {
                size = propertyStoreRuntimeValues[fieldIndex].size;
                entry = (int)fieldIndex + (int)langIndex * (int)AJSVC_PROPERTY_STORE_NUMBER_OF_CONFIG_KEYS;
                status = PropertyStore_WriteConfig(AJ_PROPERTIES_NV_ID_BEGIN + entry, buf, size, "w");
                AJ_InfoPrintf(("nvram write fieldIndex=%d [%s] langIndex=%d [%s] entry=%d val=%s size=%u status=%s\n", (int)fieldIndex, propertyStoreProperties[fieldIndex].keyName, (int)langIndex, propertyStoreDefaultLanguages[langIndex], (int)entry, propertyStoreRuntimeValues[fieldIndex].value[langIndex], (int)size, AJ_StatusText(status)));
            }
        }
    }
    AJ_About_SetShouldAnnounce(TRUE); // Set flag for sending an updated Announcement

    return status;
}

AJ_Status AJ_BusSetSignalRuleSerial(AJ_BusAttachment* bus, const char* ruleString, uint8_t rule, uint8_t flags, uint32_t* serialNum)
{
    AJ_Status status;
    AJ_Message msg;
    uint32_t msgId = (rule == AJ_BUS_SIGNAL_ALLOW) ? AJ_METHOD_ADD_MATCH : AJ_METHOD_REMOVE_MATCH;

    AJ_InfoPrintf(("AJ_BusSetSignalRuleSerial(bus=0x%p, ruleString=\"%s\", rule=%d.)\n", bus, ruleString, rule));

    status = AJ_MarshalMethodCall(bus, &msg, msgId, AJ_DBusDestination, 0, flags, AJ_METHOD_TIMEOUT);
    if (status == AJ_OK) {
        uint32_t sz = 0;
        uint8_t nul = 0;
        if (serialNum) {
            *serialNum = msg.hdr->serialNum;
        }
        sz = (uint32_t)strlen(ruleString);
        status = AJ_DeliverMsgPartial(&msg, sz + 5);
        AJ_MarshalRaw(&msg, &sz, 4);
        AJ_MarshalRaw(&msg, ruleString, strlen(ruleString));
        AJ_MarshalRaw(&msg, &nul, 1);
    }
    if (status == AJ_OK) {
        status = AJ_DeliverMsg(&msg);
    }
    return status;
}

/*
 *  create the WMI request to connect to a socket
 */
AJ_Status AJ_WSL_NET_socket_connect(AJ_WSL_SOCKNUM sock, uint32_t addr, uint16_t port, uint16_t family)
{
    AJ_Status status;
    AJ_BufList* connectV4;
    wsl_work_item* item = NULL;
    connectV4 = AJ_BufListCreate();
    WSL_MarshalPacket(connectV4, WSL_SOCKET, WSL_SOCK_CONNECT, 0x0, AJ_WSL_SOCKET_CONTEXT[sock].targetHandle, port, family, &addr, 0x8);
    WMI_MarshalHeader(connectV4, 1, 1);
    AJ_WSL_WMI_PadPayload(connectV4);

    //AJ_BufListPrintDumpContinuous(connectV4);
    AJ_WSL_WMI_QueueWorkItem(sock, AJ_WSL_WORKITEM(AJ_WSL_WORKITEM_SOCKET, WSL_SOCK_CONNECT), AJ_WSL_HTC_DATA_ENDPOINT1, connectV4);

    do {
        status = AJ_WSL_WMI_WaitForWorkItem(sock, AJ_WSL_WORKITEM(AJ_WSL_WORKITEM_SOCKET, WSL_SOCK_CONNECT), &item, AJ_NET_TIMEOUT);

        if (item && (status == AJ_OK)) {
            if (item->itemType == AJ_WSL_WORKITEM(AJ_WSL_WORKITEM_SOCKET, WSL_SOCK_CONNECT)) {
                AJ_InfoPrintf(("AJ_WSL_NET_socket_connect(): WORK ITEM RECEIVED\n"));
                AJ_WSL_WMI_FreeWorkItem(item);
                break;
            } else {
                AJ_WarnPrintf(("AJ_WSL_NET_socket_connect(): BAD WORK ITEM RECEIVED\n"));
            }
            AJ_WSL_WMI_FreeWorkItem(item);
        }
    } while (1);

    return status;
}

AJ_Status AJ_WSL_NET_SetPassphrase(const char* SSID, const char* passphrase, uint32_t passLen)
{
    AJ_Status status = AJ_OK;
    AJ_BufList* passphraseList;
    passphraseList = AJ_BufListCreate();
    uint8_t* hexPassphrase = NULL;

    if (passLen == 64) {
        hexPassphrase = (uint8_t*)AJ_WSL_Malloc(32);
        status = AJ_HexToRaw(passphrase, 64, hexPassphrase, 32);
        if (status == AJ_OK) {
            WSL_MarshalPacket(passphraseList, WMI_SET_PMK, 0, hexPassphrase, 32);
        }
    } else {
        WSL_MarshalPacket(passphraseList, WSL_SET_PASSPHRASE, 0, SSID, passphrase, strlen(SSID), passLen);
    }
    if (status == AJ_OK) {
        WMI_MarshalHeader(passphraseList, 1, 1);
        AJ_InfoPrintf(("AJ_WSL_NET_SetPassphrase(): SET_PASSPHRASE\n"));
        AJ_WSL_WMI_PadPayload(passphraseList);
        //AJ_BufListPrintDumpContinuous(passphraseList);
        status = AJ_WSL_WMI_QueueWorkItem(0, AJ_WSL_WORKITEM(AJ_WSL_WORKITEM_NETWORK, WSL_SET_PASSPHRASE), AJ_WSL_HTC_DATA_ENDPOINT1, passphraseList);
    }
    if (hexPassphrase != NULL) {
        AJ_MemZeroSecure(hexPassphrase, 32);
        AJ_WSL_Free(hexPassphrase);
    }
    return status;
}

AJ_Status AJ_WSL_NET_set_sock_options(uint32_t socket, uint32_t level, uint32_t optname, uint32_t optlen, uint8_t* optval)
{
    AJ_Status status;
    AJ_InfoPrintf(("AJ_WSL_NET_set_sock_options()\n"));
    wsl_work_item* item;
    AJ_BufList* opts;
    AJ_BufNode* trailer;
    uint32_t total_length;
    opts = AJ_BufListCreate();
    total_length = AJ_SOCK_OPTS_OFFSET + optlen;

    WSL_MarshalPacket(opts, WSL_SOCKET, WSL_SOCK_SETSOCKOPT, total_length, AJ_WSL_SOCKET_CONTEXT[socket].targetHandle, level, optname, optlen);
    if (optname == WSL_JOIN_GROUP) {
        trailer = AJ_BufListCreateNode((optlen / 2) + 2);
        memcpy(opts->tail->buffer + opts->tail->length - 17, optval, (optlen / 2) + 1);
        memcpy(trailer->buffer, optval + 17, 15);
    } else {
        trailer = AJ_BufListCreateNode(optlen + 3);
        memset(trailer->buffer, 0, optlen + 3);
    }
    AJ_BufListPushTail(opts, trailer);


    WMI_MarshalHeader(opts, 1, 1);
    //AJ_BufListPrintDumpContinuous(opts);
    AJ_WSL_WMI_QueueWorkItem(socket, AJ_WSL_WORKITEM(AJ_WSL_WORKITEM_SOCKET, WSL_SOCK_SETSOCKOPT), AJ_WSL_HTC_DATA_ENDPOINT1, opts);
    // wait until the command completes
    status = AJ_WSL_WMI_WaitForWorkItem(socket, AJ_WSL_WORKITEM(AJ_WSL_WORKITEM_SOCKET, WSL_SOCK_SETSOCKOPT), &item, AJ_NET_TIMEOUT);
    if (item && (status == AJ_OK)) {
        AJ_WSL_WMI_FreeWorkItem(item);
    }
    return status;
}

static AJ_Status AnonymousAuthAdvance(AJ_IOBuffer* rxBuf, AJ_IOBuffer* txBuf)
{
    AJ_Status status = AJ_OK;
    AJ_GUID localGuid;
    char buf[40];
    uint32_t ret;
    //initiate the SASL exchange with AUTH ANONYMOUS 
    status = WriteLine(txBuf, "AUTH ANONYMOUS\n");
 //   ResetRead(rxBuf);

    if (status == AJ_OK) 
	{
        // expect server to send back OK GUID 
        status = ReadLine(rxBuf);
        if (status == AJ_OK) 
		{
            if (memcmp(rxBuf->readPtr, "OK", 2) != 0)
			{
                return AJ_ERR_ACCESS_ROUTING_NODE;
            }
        }
    }

    if (status == AJ_OK) 
	{
        status = WriteLine(txBuf, "INFORM_PROTO_VERSION 10\n");
 //       ResetRead(rxBuf);
    }

    if (status == AJ_OK) 
	{
        // expect server to send back INFORM_PROTO_VERSION version# 
        status = ReadLine(rxBuf);
        if (status == AJ_OK)
		{
            if (memcmp(rxBuf->readPtr, "INFORM_PROTO_VERSION", strlen("INFORM_PROTO_VERSION")) != 0) 
			{
                return AJ_ERR_ACCESS_ROUTING_NODE;
            }
            routingProtoVersion = atoi((const char*)(rxBuf->readPtr + strlen("INFORM_PROTO_VERSION") + 1));
            if (routingProtoVersion < AJ_GetMinProtoVersion()) 
			{
                AJ_InfoPrintf(("ERR_OLD_VERSION: Found version %u but minimum %u required", routingProtoVersion, AJ_GetMinProtoVersion()));
                return AJ_ERR_OLD_VERSION;
            }
        }
    }

    if (status == AJ_OK)
	 {
        //send BEGIN LocalGUID to server 
        AJ_GetLocalGUID(&localGuid);
        strcpy(buf, "BEGIN ");
        status = AJ_GUID_ToString(&localGuid, buf + strlen(buf), 33);
        strcat(buf, "\n");
        status = WriteLine(txBuf, buf);
        ResetRead(rxBuf);
    }
    return status;
}

AJ_Status AJCFG_GetConfigurationsHandler(AJ_Message* msg)
{
    AJ_Status status = AJ_OK;
    AJ_Message reply;
    char* language;
    int8_t langIndex = AJSVC_PROPERTY_STORE_ERROR_LANGUAGE_INDEX;
    AJSVC_PropertyStoreCategoryFilter filter;

    AJ_InfoPrintf(("Handling GetConfigurations request\n"));

    memset(&filter, 0, sizeof(AJSVC_PropertyStoreCategoryFilter));
    filter.bit1Config = TRUE;
    status = AJ_UnmarshalArgs(msg, "s", &language);
    if (status != AJ_OK) {
        return status;
    }
    if (AJSVC_IsLanguageSupported(msg, &reply, language, &langIndex)) {
        status = AJ_MarshalReplyMsg(msg, &reply);
        if (status != AJ_OK) {
            return status;
        }
        status = AJSVC_PropertyStore_ReadAll(&reply, filter, langIndex);
        if (status != AJ_OK) {
            return status;
        }
    }
    status = AJ_DeliverMsg(&reply);
    if (status != AJ_OK) {
        return status;
    }

    return status;
}

void AJ_PoolFree(void* mem)
{
    Pool* p = heapPools;
    uint8_t i;

    if (mem) {
        assert((ptrdiff_t)mem >= (ptrdiff_t)heapStart);
        /*
         * Locate the pool from which the released memory was allocated
         */
        for (i = 0; i < numPools; ++i, ++p) {
            if ((ptrdiff_t)mem < (ptrdiff_t)p->endOfPool) {
                MemBlock* block = (MemBlock*)mem;
                block->next = p->freeList;
                p->freeList = block;
                AJ_InfoPrintf(("AJ_PoolFree pool[%d]\n", heapConfig[i].size));
#ifndef NDEBUG
                --p->use;
#endif
                break;
            }
        }
        assert(i < numPools);
    }
}

AJ_Status AJ_X509DecodeCertificateDER(X509Certificate* certificate, DER_Element* der)
{
    AJ_Status status;
    DER_Element seq;
    DER_Element tbs;
    DER_Element tmp;
    DER_Element oid;
    DER_Element sig;
    const uint8_t tags1[] = { ASN_SEQ };
    const uint8_t tags2[] = { ASN_SEQ, ASN_SEQ, ASN_BITS };

    AJ_InfoPrintf(("AJ_X509DecodeCertificateDER(certificate=%p, der=%p)\n", certificate, der));

    if ((NULL == certificate) || (NULL == der)) {
        return AJ_ERR_INVALID;
    }

    status = AJ_ASN1DecodeElements(der, tags1, sizeof (tags1), &seq);
    if (AJ_OK != status) {
        return status;
    }
    status = AJ_ASN1DecodeElements(&seq, tags2, sizeof (tags2), &tbs, &tmp, &sig);
    if (AJ_OK != status) {
        return status;
    }

    /*
     * The signed TBS includes the sequence and length fields.
     */
    certificate->raw.data = tbs.data - 4;
    certificate->raw.size = tbs.size + 4;

    status = DecodeCertificateTBS(&certificate->tbs, &tbs);
    if (AJ_OK != status) {
        return status;
    }

    /*
     * We only accept ECDSA-SHA256 signed certificates at the moment.
     */
    status = AJ_ASN1DecodeElement(&tmp, ASN_OID, &oid);
    if (AJ_OK != status) {
        return status;
    }
    if (!CompareOID(&oid, OID_SIG_ECDSA_SHA256, sizeof (OID_SIG_ECDSA_SHA256))) {
        return AJ_ERR_INVALID;
    }

    /*
     * Remove the byte specifying unused bits, this should always be zero.
     */
    if ((0 == sig.size) || (0 != *sig.data)) {
        return AJ_ERR_INVALID;
    }
    sig.data++;
    sig.size--;
    status = DecodeCertificateSig(&certificate->signature, &sig);

    return status;
}

AJ_Status AJ_BusAddSignalRule(AJ_BusAttachment* bus, const char* signalName, const char* interfaceName, uint8_t rule)
{
    AJ_Status status;
    AJ_Message msg;
    const char* str[5];
    uint32_t msgId = (rule == AJ_BUS_SIGNAL_ALLOW) ? AJ_METHOD_ADD_MATCH : AJ_METHOD_REMOVE_MATCH;

    AJ_InfoPrintf(("AJ_BusAddSignalRule(bus=0x%p, signalName=\"%s\", interfaceName=\"%s\", rule=%d.)\n", bus, signalName, interfaceName, rule));

    str[0] = "type='signal',member='";
    str[1] = signalName;
    str[2] = "'interface='";
    str[3] = interfaceName;
    str[4] = "'";

    status = AJ_MarshalMethodCall(bus, &msg, msgId, AJ_DBusDestination, 0, 0, AJ_METHOD_TIMEOUT);
    if (status == AJ_OK) {
        size_t i;
        uint32_t sz = 0;
        uint8_t nul = 0;
        for (i = 0; i < ArraySize(str); ++i) {
            sz += (uint32_t)strlen(str[i]);
        }
        status = AJ_DeliverMsgPartial(&msg, sz + 5);
        AJ_MarshalRaw(&msg, &sz, 4);
        for (i = 0; i < ArraySize(str); ++i) {
            AJ_MarshalRaw(&msg, str[i], strlen(str[i]));
        }
        AJ_MarshalRaw(&msg, &nul, 1);
    }
    if (status == AJ_OK) {
        status = AJ_DeliverMsg(&msg);
    }
    return status;
}

AJ_Status AJ_X509DecodeCertificatePEM(X509Certificate* certificate, const char* pem, size_t len)
{
    AJ_Status status;

    AJ_InfoPrintf(("AJ_X509DecodeCertificatePEM(certificate=%p, pem=%p, len=%zu)\n", certificate, pem, len));

    certificate->der.size = 3 * len / 4;
    certificate->der.data = AJ_Malloc(certificate->der.size);
    if (NULL == certificate->der.data) {
        return AJ_ERR_RESOURCES;
    }
    status = AJ_B64ToRaw(pem, len, certificate->der.data, certificate->der.size);
    if (AJ_OK != status) {
        AJ_Free(certificate->der.data);
        return status;
    }
    if ('=' == pem[len - 1]) {
        certificate->der.size--;
    }
    if ('=' == pem[len - 2]) {
        certificate->der.size--;
    }

    return AJ_OK;
}

AJ_Status AJ_ASN1DecodeElement(DER_Element* der, uint8_t tag, DER_Element* out)
{
    uint8_t tmp;

    AJ_InfoPrintf(("AJ_ASN1DecodeElement(der=%p, tag=%x, out=%p)\n", der, tag, out));

    if ((NULL == der) || (NULL == out)) {
        return AJ_ERR_INVALID;
    }
    if ((NULL == der->data) || (0 == der->size)) {
        return AJ_ERR_INVALID;
    }

    /*
     * Decode tag and check it is what we expect
     */
    tmp = *(der->data)++;
    der->size--;
    if (ASN_CONTEXT_SPECIFIC != (tmp & ASN_CONTEXT_SPECIFIC)) {
        tmp &= 0x1F;
    }
    if (tmp != tag) {
        return AJ_ERR_INVALID;
    }
    /*
     * Decode size
     */
    if (AJ_OK != DecodeLength(der, out)) {
        return AJ_ERR_INVALID;
    }
    der->data += out->size;
    der->size -= out->size;

    return AJ_OK;
}