passenger 5.0.30 → 5.1.0

data/src/cxx_supportlib/Crypto.h

@@ -0,0 +1,147 @@
+/*
+ *  Phusion Passenger - https://www.phusionpassenger.com/
+ *  Copyright (c) 2010-2016 Phusion Holding B.V.
+ *
+ *  "Passenger", "Phusion Passenger" and "Union Station" are registered
+ *  trademarks of Phusion Holding B.V.
+ *
+ *  Permission is hereby granted, free of charge, to any person obtaining a copy
+ *  of this software and associated documentation files (the "Software"), to deal
+ *  in the Software without restriction, including without limitation the rights
+ *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ *  copies of the Software, and to permit persons to whom the Software is
+ *  furnished to do so, subject to the following conditions:
+ *
+ *  The above copyright notice and this permission notice shall be included in
+ *  all copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ *  THE SOFTWARE.
+ */
+#ifndef _PASSENGER_CRYPTO_H_
+#define _PASSENGER_CRYPTO_H_
+
+#include <boost/function.hpp>
+#include <boost/thread.hpp>
+#include <modp_b64.h>
+
+#if BOOST_OS_MACOS
+#include <CoreFoundation/CoreFoundation.h>
+#include <Security/Security.h>
+#else
+#include <openssl/pem.h>
+#include <openssl/rand.h>
+#include <openssl/err.h>
+#endif
+
+#include <StaticString.h>
+
+namespace Passenger {
+
+#if BOOST_OS_MACOS
+typedef SecKeyRef PUBKEY_TYPE;
+#else
+typedef RSA* PUBKEY_TYPE;
+#endif
+
+using namespace std;
+using namespace boost;
+using namespace oxt;
+
+struct AESEncResult {
+	unsigned char *encrypted;
+	size_t encryptedLen;
+	unsigned char *key;
+	size_t keyLen;
+	unsigned char *iv;
+	size_t ivLen;
+};
+
+class Crypto {
+private:
+	/**
+	 * @returns new PUBKEY_TYPE; user is responsible for free (with freePubKey)
+	 */
+	PUBKEY_TYPE loadPubKey(const char *filename);
+
+	/**
+	 * free a PUBKEY_TYPE (loaded with loadPubKey); may be NULL
+	 */
+	void freePubKey(PUBKEY_TYPE);
+
+	void logError(const StaticString &error);
+
+	/**
+	 * log prefix using P_ERROR, and (library-specific) detail from either additional or global query
+	 */
+#if BOOST_OS_MACOS
+	// (additional needs to be defined as a CFErrorRef, void * won't work)
+	void logFreeErrorExtended(const StaticString &prefix, CFErrorRef &additional);
+	CFDictionaryRef createQueryDict(const char *label);
+	SecAccessRef createAccess(const char *cLabel);
+	OSStatus lookupKeychainItem(const char *label, SecIdentityRef *oIdentity);
+	OSStatus copyIdentityFromPKCS12File(const char *cPath, const char *cPassword, const char *cLabel);
+	CFDataRef genIV(size_t iv_size);
+	bool getKeyBytes(SecKeyRef cryptokey, void **target, size_t &len);
+	bool generateRandomChars(unsigned char *rndChars, int rndLen);
+	bool memoryBridge(CFDataRef input, void **target, size_t &len);
+	bool innerMemoryBridge(void *input, void **target, size_t len);
+#else
+	void logErrorExtended(const StaticString &prefix);
+#endif
+
+public:
+	Crypto();
+	~Crypto();
+
+	/**
+	 * Generates a nonce consisting of a timestamp (usec) and a random (base64) part.
+	 */
+	bool generateAndAppendNonce(string &nonce);
+
+#if BOOST_OS_MACOS
+	/**
+	 * sets the permissions on the certificate so that curl doesn't prompt
+	 */
+	bool preAuthKey(const char *path, const char *passwd, const char *cLabel);
+	void killKey(const char *cLabel);
+#endif
+
+	/**
+	 * Generate an AES key and encrypt dataChars with it. The resulting encrypted characters, together with the AES key
+	 * and iv that were used appears in AESEncrypted. Memory is allocated for it, and it must be freed with freeAESEncrypted().
+	 *
+	 * N.B. only used in Enterprise (to enable additional services), but open sourced for transparency.
+	 */
+	bool encryptAES256(char *dataChars, size_t dataLen, AESEncResult &aesEnc);
+
+	/**
+	 * Releases resources returned by encryptAES256().
+	 */
+	void freeAESEncrypted(AESEncResult &aesEnc);
+
+	/**
+	 * Encrypt a (short) bit of date with specified public key. Memory is allocated for the result encryptedCharsPtr, which
+	 * must be free()d manually.
+	 *
+	 * N.B. only used in Enterprise (to enable additional services), but open sourced for transparency.
+	 */
+	bool encryptRSA(unsigned char *dataChars, size_t dataLen,
+			string encryptPubKeyPath, unsigned char **encryptedCharsPtr, size_t &encryptedLen);
+
+	/**
+	 * @returns true if specified signature is from the entity known by its (public) key at signaturePubKeyPath,
+	 * and valid for speficied data.
+	 */
+	bool verifySignature(string signaturePubKeyPath, char *signatureChars, int signatureLen, string data);
+
+};
+
+} // namespace Passenger
+
+#endif /* _PASSENGER_CRYPTO_H_ */

data/src/cxx_supportlib/InstanceDirectory.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2014 Phusion Holding B.V.
+ *  Copyright (c) 2014-2016 Phusion Holding B.V.
  *
  *  "Passenger", "Phusion Passenger" and "Union Station" are registered
  *  trademarks of Phusion Holding B.V.
@@ -26,6 +26,10 @@
 #ifndef _PASSENGER_INSTANCE_DIRECTORY_H_
 #define _PASSENGER_INSTANCE_DIRECTORY_H_
 
+#ifdef USE_SELINUX
+	#include <selinux/selinux.h>
+#endif
+
 #include <boost/shared_ptr.hpp>
 #include <sys/types.h>
 #include <sys/stat.h>
@@ -111,6 +115,7 @@ private:
 
 	void initializeInstanceDirectory(const CreationOptions &options) {
 		createPropertyFile(options);
+		createWebServerInfoSubdir(options);
 		createAgentSocketsSubdir(options);
 		createAppSocketsSubdir(options);
 		createLockFile();
@@ -120,6 +125,54 @@ private:
 		return options.originalUid == 0;
 	}
 
+	#ifdef USE_SELINUX
+		void selinuxRelabel(const string &path, const char *newLabel) {
+			security_context_t currentCon;
+			string newCon;
+			int e;
+
+			if (getfilecon(path.c_str(), &currentCon) == -1) {
+				e = errno;
+				P_DEBUG("Unable to obtain SELinux context for file " <<
+					path <<": " << strerror(e) << " (errno=" << e << ")");
+				return;
+			}
+
+			P_DEBUG("SELinux context for " << path << ": " << currentCon);
+
+			if (strstr(currentCon, ":object_r:passenger_instance_content_t:") == NULL) {
+				goto cleanup;
+			}
+
+			newCon = replaceString(currentCon,
+				":object_r:passenger_instance_content_t:",
+				StaticString(":object_r:") + newLabel + ":");
+			P_DEBUG("Relabeling " << path << " to: " << newCon);
+			if (setfilecon(path.c_str(), (security_context_t) newCon.c_str()) == -1) {
+				e = errno;
+				P_WARN("Cannot set SELinux context for " << path <<
+					" to " << newCon << ": " << strerror(e) <<
+					" (errno=" << e << ")");
+				goto cleanup;
+			}
+
+			cleanup:
+			freecon(currentCon);
+		}
+	#endif
+
+	void createWebServerInfoSubdir(const CreationOptions &options) {
+		makeDirTree(path + "/web_server_info", "u=rwx,g=rx,o=rx");
+		#ifdef USE_SELINUX
+			// We relabel the directory here instead of using setfscreatecon()
+			// for thread-safety. It isn't specified whether InstanceDirectory
+			// should be thread-safe, but let's do it this way to prevent
+			// future problems.
+			selinuxRelabel(path + "/web_server_info",
+				"passenger_instance_httpd_dir_t");
+		#endif
+	}
+
 	void createAgentSocketsSubdir(const CreationOptions &options) {
 		if (runningAsRoot(options)) {
 			/* The server socket must be accessible by the web server
@@ -166,7 +219,7 @@ private:
 
 		props["instance_dir"]["major_version"] = SERVER_INSTANCE_DIR_STRUCTURE_MAJOR_VERSION;
 		props["instance_dir"]["minor_version"] = SERVER_INSTANCE_DIR_STRUCTURE_MINOR_VERSION;
-		props["instance_dir"]["created_at"] = (long long) time(NULL);
+		props["instance_dir"]["created_at"] = (Json::Int64) time(NULL);
 		props["passenger_version"] = PASSENGER_VERSION;
 		props["watchdog_pid"] = (Json::UInt64) getpid();
 

data/src/cxx_supportlib/Utils/Curl.h

@@ -70,21 +70,24 @@ struct CurlProxyInfo {
 	long type;
 	bool none;
 	bool httpTunnel;
+	bool valid; // false if an error occurred during address parsing
 
-	CurlProxyInfo()
+	CurlProxyInfo(bool valid = false)
 		: type(0),
 		  none(false),
-		  httpTunnel(false)
+		  httpTunnel(false),
+		  valid(valid)
 		{ }
 };
 
 inline const CurlProxyInfo
 prepareCurlProxy(const string &address) {
 	if (address.empty()) {
-		return CurlProxyInfo();
+		return CurlProxyInfo(true);
 	} else if (address == "none") {
 		CurlProxyInfo result;
 		result.none = true;
+		result.valid = true;
 		return result;
 	} else {
 		CurlProxyInfo result;
@@ -164,23 +167,34 @@ prepareCurlProxy(const string &address) {
 			}
 		}
 
+		result.valid = true;
 		return result;
 	}
 }
 
-inline void
+inline CURLcode
 setCurlProxy(CURL *curl, const CurlProxyInfo &proxyInfo) {
 	if (proxyInfo.hostAndPort.empty()) {
-		return;
+		return CURLE_OK;
 	} else if (proxyInfo.none) {
-		curl_easy_setopt(curl, CURLOPT_PROXY, "");
+		return curl_easy_setopt(curl, CURLOPT_PROXY, "");
 	} else {
-		curl_easy_setopt(curl, CURLOPT_PROXY, proxyInfo.hostAndPort.c_str());
-		curl_easy_setopt(curl, CURLOPT_PROXYTYPE, proxyInfo.type);
-		curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, proxyInfo.credentials.c_str());
+		CURLcode code;
+		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_PROXY, proxyInfo.hostAndPort.c_str()))) {
+			return code;
+		}
+		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_PROXYTYPE, proxyInfo.type))) {
+			return code;
+		}
+		if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_PROXYUSERPWD, proxyInfo.credentials.c_str()))) {
+			return code;
+		}
 		if (proxyInfo.httpTunnel) {
-			curl_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1);
+			if (CURLE_OK != (code = curl_easy_setopt(curl, CURLOPT_HTTPPROXYTUNNEL, 1))) {
+				return code;
+			}
 		}
+		return CURLE_OK;
 	}
 }
 

data/src/cxx_supportlib/Utils/JsonUtils.h

@@ -241,7 +241,7 @@ durationToJson(unsigned long long duration) {
 	Json::Value doc;
 	char buf[64];
 
-	doc["microseconds"] = duration;
+	doc["microseconds"] = (Json::UInt64) duration;
 	if (duration >= 10 * 1000000) {
 		snprintf(buf, sizeof(buf), "%.1fs", duration / 1000000.0);
 	} else {

data/src/cxx_supportlib/oxt/detail/spin_lock_darwin.hpp

@@ -23,6 +23,8 @@
  * THE SOFTWARE.
  */
 
+#define OSSPINLOCK_DEPRECATED 0
+
 #include <libkern/OSAtomic.h>
 #include <boost/noncopyable.hpp>
 

data/src/cxx_supportlib/vendor-modified/boost/system/error_code.hpp

@@ -218,9 +218,9 @@ namespace boost
     inline const error_category &  get_system_category() { return system_category(); }
     inline const error_category &  get_generic_category() { return generic_category(); }
     inline const error_category &  get_posix_category() { return generic_category(); }
-    static const error_category &  posix_category = generic_category();
-    static const error_category &  errno_ecat     = generic_category();
-    static const error_category &  native_ecat    = system_category();
+    //static const error_category &  posix_category = generic_category();
+    //static const error_category &  errno_ecat     = generic_category();
+    //static const error_category &  native_ecat    = system_category();
 # endif
 
     //  class error_condition  -----------------------------------------------//

data/src/cxx_supportlib/vendor-modified/jsoncpp/json-forwards.h

@@ -1,5 +1,5 @@
 /// Json-cpp amalgated forward header (http://jsoncpp.sourceforge.net/).
-/// It is intented to be used with #include <json/json-forwards.h>
+/// It is intended to be used with #include "json/json-forwards.h"
 /// This header provides forward declaration for all JsonCpp types.
 
 // //////////////////////////////////////////////////////////////////////
@@ -77,7 +77,7 @@ license you like.
 # define JSON_FORWARD_AMALGATED_H_INCLUDED
 /// If defined, indicates that the source file is amalgated
 /// to prevent private header inclusion.
-#define JSON_IS_AMALGATED
+#define JSON_IS_AMALGAMATION
 
 // //////////////////////////////////////////////////////////////////////
 // Beginning of content of file: include/json/config.h
@@ -89,95 +89,177 @@ license you like.
 // See file LICENSE for detail or copy at http://jsoncpp.sourceforge.net/LICENSE
 
 #ifndef JSON_CONFIG_H_INCLUDED
-# define JSON_CONFIG_H_INCLUDED
+#define JSON_CONFIG_H_INCLUDED
+#include <stddef.h>
+#include <string> //typedef String
+#include <stdint.h> //typedef int64_t, uint64_t
 
 /// If defined, indicates that json library is embedded in CppTL library.
 //# define JSON_IN_CPPTL 1
 
 /// If defined, indicates that json may leverage CppTL library
 //#  define JSON_USE_CPPTL 1
-/// If defined, indicates that cpptl vector based map should be used instead of std::map
+/// If defined, indicates that cpptl vector based map should be used instead of
+/// std::map
 /// as Value container.
 //#  define JSON_USE_CPPTL_SMALLMAP 1
-/// If defined, indicates that Json specific container should be used
-/// (hash table & simple deque container with customizable allocator).
-/// THIS FEATURE IS STILL EXPERIMENTAL! There is know bugs: See #3177332
-//#  define JSON_VALUE_USE_INTERNAL_MAP 1
-/// Force usage of standard new/malloc based allocator instead of memory pool based allocator.
-/// The memory pools allocator used optimization (initializing Value and ValueInternalLink
-/// as if it was a POD) that may cause some validation tool to report errors.
-/// Only has effects if JSON_VALUE_USE_INTERNAL_MAP is defined.
-//#  define JSON_USE_SIMPLE_INTERNAL_ALLOCATOR 1
-
-/// If defined, indicates that Json use exception to report invalid type manipulation
-/// instead of C assert macro.
-# define JSON_USE_EXCEPTION 1
+
+// If non-zero, the library uses exceptions to report bad input instead of C
+// assertion macros. The default is to use exceptions.
+#ifndef JSON_USE_EXCEPTION
+#define JSON_USE_EXCEPTION 1
+#endif
 
 /// If defined, indicates that the source file is amalgated
 /// to prevent private header inclusion.
 /// Remarks: it is automatically defined in the generated amalgated header.
-#define JSON_IS_AMALGAMATION
-
+// #define JSON_IS_AMALGAMATION
 
-# ifdef JSON_IN_CPPTL
-#  include <cpptl/config.h>
-#  ifndef JSON_USE_CPPTL
-#   define JSON_USE_CPPTL 1
-#  endif
-# endif
+#ifdef JSON_IN_CPPTL
+#include <cpptl/config.h>
+#ifndef JSON_USE_CPPTL
+#define JSON_USE_CPPTL 1
+#endif
+#endif
 
-# ifdef JSON_IN_CPPTL
-#  define JSON_API CPPTL_API
-# elif defined(JSON_DLL_BUILD)
-#  define JSON_API __declspec(dllexport)
-# elif defined(JSON_DLL)
-#  define JSON_API __declspec(dllimport)
-# else
-#  define JSON_API
-# endif
+#ifdef JSON_IN_CPPTL
+#define JSON_API CPPTL_API
+#elif defined(JSON_DLL_BUILD)
+#if defined(_MSC_VER) || defined(__MINGW32__)
+#define JSON_API __declspec(dllexport)
+#define JSONCPP_DISABLE_DLL_INTERFACE_WARNING
+#endif // if defined(_MSC_VER)
+#elif defined(JSON_DLL)
+#if defined(_MSC_VER) || defined(__MINGW32__)
+#define JSON_API __declspec(dllimport)
+#define JSONCPP_DISABLE_DLL_INTERFACE_WARNING
+#endif // if defined(_MSC_VER)
+#endif // ifdef JSON_IN_CPPTL
+#if !defined(JSON_API)
+#define JSON_API
+#endif
 
-// If JSON_NO_INT64 is defined, then Json only support C++ "int" type for integer
+// If JSON_NO_INT64 is defined, then Json only support C++ "int" type for
+// integer
 // Storages, and 64 bits integer support is disabled.
 // #define JSON_NO_INT64 1
 
-#if defined(_MSC_VER)  &&  _MSC_VER <= 1200 // MSVC 6
-// Microsoft Visual Studio 6 only support conversion from __int64 to double
-// (no conversion from unsigned __int64).
-#define JSON_USE_INT64_DOUBLE_CONVERSION 1
-#endif // if defined(_MSC_VER)  &&  _MSC_VER < 1200 // MSVC 6
+#if defined(_MSC_VER) // MSVC
+#  if _MSC_VER <= 1200 // MSVC 6
+    // Microsoft Visual Studio 6 only support conversion from __int64 to double
+    // (no conversion from unsigned __int64).
+#    define JSON_USE_INT64_DOUBLE_CONVERSION 1
+    // Disable warning 4786 for VS6 caused by STL (identifier was truncated to '255'
+    // characters in the debug information)
+    // All projects I've ever seen with VS6 were using this globally (not bothering
+    // with pragma push/pop).
+#    pragma warning(disable : 4786)
+#  endif // MSVC 6
+
+#  if _MSC_VER >= 1500 // MSVC 2008
+    /// Indicates that the following function is deprecated.
+#    define JSONCPP_DEPRECATED(message) __declspec(deprecated(message))
+#  endif
 
-#if defined(_MSC_VER)  &&  _MSC_VER >= 1500 // MSVC 2008
-/// Indicates that the following function is deprecated.
-# define JSONCPP_DEPRECATED(message) __declspec(deprecated(message))
+#endif // defined(_MSC_VER)
+
+// In c++11 the override keyword allows you to explicity define that a function
+// is intended to override the base-class version.  This makes the code more
+// managable and fixes a set of common hard-to-find bugs.
+#if __cplusplus >= 201103L
+# define JSONCPP_OVERRIDE override
+#elif defined(_MSC_VER) && _MSC_VER > 1600
+# define JSONCPP_OVERRIDE override
+#else
+# define JSONCPP_OVERRIDE
 #endif
 
+#ifndef JSON_HAS_RVALUE_REFERENCES
+
+#if defined(_MSC_VER) && _MSC_VER >= 1600 // MSVC >= 2010
+#define JSON_HAS_RVALUE_REFERENCES 1
+#endif // MSVC >= 2010
+
+#ifdef __clang__
+#if __has_feature(cxx_rvalue_references)
+#define JSON_HAS_RVALUE_REFERENCES 1
+#endif  // has_feature
+
+#elif defined __GNUC__ // not clang (gcc comes later since clang emulates gcc)
+#if defined(__GXX_EXPERIMENTAL_CXX0X__) || (__cplusplus >= 201103L)
+#define JSON_HAS_RVALUE_REFERENCES 1
+#endif  // GXX_EXPERIMENTAL
+
+#endif // __clang__ || __GNUC__
+
+#endif // not defined JSON_HAS_RVALUE_REFERENCES
+
+#ifndef JSON_HAS_RVALUE_REFERENCES
+#define JSON_HAS_RVALUE_REFERENCES 0
+#endif
+
+#ifdef __clang__
+#elif defined __GNUC__ // not clang (gcc comes later since clang emulates gcc)
+#  if (__GNUC__ > 4 || (__GNUC__ == 4 && __GNUC_MINOR__ >= 5))
+#    define JSONCPP_DEPRECATED(message)  __attribute__ ((deprecated(message)))
+#  elif (__GNUC__ > 3 || (__GNUC__ == 3 && __GNUC_MINOR__ >= 1))
+#    define JSONCPP_DEPRECATED(message)  __attribute__((__deprecated__))
+#  endif  // GNUC version
+#endif // __clang__ || __GNUC__
+
 #if !defined(JSONCPP_DEPRECATED)
-# define JSONCPP_DEPRECATED(message)
+#define JSONCPP_DEPRECATED(message)
 #endif // if !defined(JSONCPP_DEPRECATED)
 
+#if __GNUC__ >= 6
+#  define JSON_USE_INT64_DOUBLE_CONVERSION 1
+#endif
+
+#if !defined(JSON_IS_AMALGAMATION)
+
+# include "version.h"
+
+# if JSONCPP_USING_SECURE_MEMORY
+#  include "allocator.h" //typedef Allocator
+# endif
+
+#endif // if !defined(JSON_IS_AMALGAMATION)
+
 namespace Json {
-   typedef int Int;
-   typedef unsigned int UInt;
-# if defined(JSON_NO_INT64)
-   typedef int LargestInt;
-   typedef unsigned int LargestUInt;
-#  undef JSON_HAS_INT64
-# else // if defined(JSON_NO_INT64)
-   // For Microsoft Visual use specific types as long long is not supported
-#  if defined(_MSC_VER) // Microsoft Visual Studio
-   typedef __int64 Int64;
-   typedef unsigned __int64 UInt64;
-#  else // if defined(_MSC_VER) // Other platforms, use long long
-   typedef long long int Int64;
-   typedef unsigned long long int UInt64;
-#  endif // if defined(_MSC_VER)
-   typedef Int64 LargestInt;
-   typedef UInt64 LargestUInt;
-#  define JSON_HAS_INT64
-# endif // if defined(JSON_NO_INT64)
+typedef int Int;
+typedef unsigned int UInt;
+#if defined(JSON_NO_INT64)
+typedef int LargestInt;
+typedef unsigned int LargestUInt;
+#undef JSON_HAS_INT64
+#else                 // if defined(JSON_NO_INT64)
+// For Microsoft Visual use specific types as long long is not supported
+#if defined(_MSC_VER) // Microsoft Visual Studio
+typedef __int64 Int64;
+typedef unsigned __int64 UInt64;
+#else                 // if defined(_MSC_VER) // Other platforms, use long long
+typedef int64_t Int64;
+typedef uint64_t UInt64;
+#endif // if defined(_MSC_VER)
+typedef Int64 LargestInt;
+typedef UInt64 LargestUInt;
+#define JSON_HAS_INT64
+#endif // if defined(JSON_NO_INT64)
+#if JSONCPP_USING_SECURE_MEMORY
+#define JSONCPP_STRING        std::basic_string<char, std::char_traits<char>, Json::SecureAllocator<char> >
+#define JSONCPP_OSTRINGSTREAM std::basic_ostringstream<char, std::char_traits<char>, Json::SecureAllocator<char> >
+#define JSONCPP_OSTREAM       std::basic_ostream<char, std::char_traits<char>>
+#define JSONCPP_ISTRINGSTREAM std::basic_istringstream<char, std::char_traits<char>, Json::SecureAllocator<char> >
+#define JSONCPP_ISTREAM       std::istream
+#else
+#define JSONCPP_STRING        std::string
+#define JSONCPP_OSTRINGSTREAM std::ostringstream
+#define JSONCPP_OSTREAM       std::ostream
+#define JSONCPP_ISTRINGSTREAM std::istringstream
+#define JSONCPP_ISTREAM       std::istream
+#endif // if JSONCPP_USING_SECURE_MEMORY
 } // end namespace Json
 
-
 #endif // JSON_CONFIG_H_INCLUDED
 
 // //////////////////////////////////////////////////////////////////////
@@ -199,42 +281,35 @@ namespace Json {
 // See file LICENSE for detail or copy at http://jsoncpp.sourceforge.net/LICENSE
 
 #ifndef JSON_FORWARDS_H_INCLUDED
-# define JSON_FORWARDS_H_INCLUDED
+#define JSON_FORWARDS_H_INCLUDED
 
 #if !defined(JSON_IS_AMALGAMATION)
-# include "config.h"
+#include "config.h"
 #endif // if !defined(JSON_IS_AMALGAMATION)
 
 namespace Json {
 
-   // writer.h
-   class FastWriter;
-   class StyledWriter;
-
-   // reader.h
-   class Reader;
-
-   // features.h
-   class Features;
-
-   // value.h
-   typedef unsigned int ArrayIndex;
-   class StaticString;
-   class Path;
-   class PathArgument;
-   class Value;
-   class ValueIteratorBase;
-   class ValueIterator;
-   class ValueConstIterator;
-#ifdef JSON_VALUE_USE_INTERNAL_MAP
-   class ValueMapAllocator;
-   class ValueInternalLink;
-   class ValueInternalArray;
-   class ValueInternalMap;
-#endif // #ifdef JSON_VALUE_USE_INTERNAL_MAP
+// writer.h
+class FastWriter;
+class StyledWriter;
 
-} // namespace Json
+// reader.h
+class Reader;
+
+// features.h
+class Features;
 
+// value.h
+typedef unsigned int ArrayIndex;
+class StaticString;
+class Path;
+class PathArgument;
+class Value;
+class ValueIteratorBase;
+class ValueIterator;
+class ValueConstIterator;
+
+} // namespace Json
 
 #endif // JSON_FORWARDS_H_INCLUDED