zeroc-ice 3.6.5 → 3.7.0

data/ext/ice/cpp/src/IceSSL/OpenSSLEngine.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -9,7 +9,9 @@
 
 #include <IceSSL/Config.h>
 
-#include <IceSSL/SSLEngine.h>
+#include <IceSSL/OpenSSLEngineF.h>
+#include <IceSSL/OpenSSLEngine.h>
+#include <IceSSL/OpenSSLTransceiverI.h>
 #include <IceSSL/Util.h>
 #include <IceSSL/TrustManager.h>
 
@@ -19,14 +21,11 @@
 #include <Ice/LoggerUtil.h>
 #include <Ice/Properties.h>
 
-#include <IceUtil/StringConverter.h>
 #include <IceUtil/StringUtil.h>
 #include <IceUtil/Mutex.h>
 #include <IceUtil/MutexPtrLock.h>
 #include <IceUtil/FileUtil.h>
 
-#ifdef ICE_USE_OPENSSL
-
 #include <openssl/rand.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
@@ -47,39 +46,7 @@ bool initOpenSSL = false;
 IceUtil::Mutex* locks = 0;
 #endif
 
-class Init
-{
-public:
-
-    Init()
-    {
-        staticMutex = new IceUtil::Mutex;
-    }
-
-    ~Init()
-    {
-        //
-        // OpenSSL 1.1.0 introduces a new thread API and removes
-        // the need to use a custom thread callback.
-        //
-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
-        CRYPTO_set_locking_callback(0);
-        CRYPTO_set_id_callback(0);
-
-        if(locks)
-        {
-            delete[] locks;
-            locks = 0;
-        }
-#endif
-        delete staticMutex;
-        staticMutex = 0;
-    }
-};
-
-Init init;
 }
-
 extern "C"
 {
 
@@ -118,7 +85,7 @@ IceSSL_opensslThreadIdCallback()
     // On some platforms, pthread_t is a pointer to a per-thread structure.
     //
     return reinterpret_cast<unsigned long>(pthread_self());
-#  elif defined(__linux__) || defined(__sun) || defined(__hpux) || defined(_AIX) || defined(__GLIBC__)
+#  elif defined(__linux) || defined(__sun) || defined(__hpux) || defined(_AIX) || defined(__GLIBC__)
     //
     // On Linux, Solaris, HP-UX and AIX, pthread_t is an integer.
     //
@@ -127,23 +94,25 @@ IceSSL_opensslThreadIdCallback()
 #    error "Unknown platform"
 #  endif
 }
+
 #endif
 
 int
 IceSSL_opensslPasswordCallback(char* buf, int size, int flag, void* userData)
 {
-    OpenSSLEngine* p = reinterpret_cast<OpenSSLEngine*>(userData);
+    OpenSSL::SSLEngine* p = reinterpret_cast<OpenSSL::SSLEngine*>(userData);
+    assert(p);
     string passwd = p->password(flag == 1);
     int sz = static_cast<int>(passwd.size());
     if(sz > size)
     {
         sz = size - 1;
     }
-#  if defined(_WIN32)
+#if defined(_WIN32)
     strncpy_s(buf, size, passwd.c_str(), sz);
-#  else
+#else
     strncpy(buf, passwd.c_str(), sz);
-#  endif
+#endif
     buf[sz] = '\0';
 
     for(string::iterator i = passwd.begin(); i != passwd.end(); ++i)
@@ -154,7 +123,7 @@ IceSSL_opensslPasswordCallback(char* buf, int size, int flag, void* userData)
     return sz;
 }
 
-#  ifndef OPENSSL_NO_DH
+#ifndef OPENSSL_NO_DH
 DH*
 IceSSL_opensslDHCallback(SSL* ssl, int /*isExport*/, int keyLength)
 {
@@ -163,15 +132,52 @@ IceSSL_opensslDHCallback(SSL* ssl, int /*isExport*/, int keyLength)
 #  else
     SSL_CTX* ctx = ssl->ctx;
 #  endif
-    OpenSSLEngine* p = reinterpret_cast<OpenSSLEngine*>(SSL_CTX_get_ex_data(ctx, 0));
+    OpenSSL::SSLEngine* p = reinterpret_cast<OpenSSL::SSLEngine*>(SSL_CTX_get_ex_data(ctx, 0));
     return p->dhParams(keyLength);
 }
-#  endif
+#endif
 
 }
 
 namespace
 {
+
+class Init
+{
+public:
+
+    Init()
+    {
+        staticMutex = new IceUtil::Mutex;
+    }
+
+    ~Init()
+    {
+        //
+        // OpenSSL 1.1.0 introduces a new thread API and removes
+        // the need to use a custom thread callback.
+        //
+#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+        if(CRYPTO_get_locking_callback() == IceSSL_opensslLockCallback)
+        {
+            assert(locks);
+            CRYPTO_set_locking_callback(0);
+            delete[] locks;
+            locks = 0;
+        }
+
+        if(CRYPTO_get_id_callback() == IceSSL_opensslThreadIdCallback)
+        {
+            CRYPTO_set_id_callback(0);
+        }
+#endif
+        delete staticMutex;
+        staticMutex = 0;
+    }
+};
+
+Init init;
+
 bool
 passwordError()
 {
@@ -185,11 +191,14 @@ passwordError()
 
 }
 
-IceUtil::Shared* IceSSL::upCast(IceSSL::OpenSSLEngine* p) { return p; }
+IceUtil::Shared*
+OpenSSL::upCast(OpenSSL::SSLEngine* p)
+{
+    return p;
+}
 
-OpenSSLEngine::OpenSSLEngine(const CommunicatorPtr& communicator) :
-    SSLEngine(communicator),
-    _initialized(false),
+OpenSSL::SSLEngine::SSLEngine(const CommunicatorPtr& communicator) :
+    IceSSL::SSLEngine(communicator),
     _ctx(0)
 {
     __setNoDelete(true);
@@ -220,14 +229,19 @@ OpenSSLEngine::OpenSSLEngine(const CommunicatorPtr& communicator) :
             // OpenSSL 1.1.0 remove the need for library initialization and cleanup.
             //
 #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+            if(!CRYPTO_get_id_callback())
+            {
+                CRYPTO_set_id_callback(IceSSL_opensslThreadIdCallback);
+            }
+
             //
             // Create the mutexes and set the callbacks.
             //
-            if(!locks)
+            if(!CRYPTO_get_locking_callback())
             {
+                assert(!locks);
                 locks = new IceUtil::Mutex[CRYPTO_num_locks()];
                 CRYPTO_set_locking_callback(IceSSL_opensslLockCallback);
-                CRYPTO_set_id_callback(IceSSL_opensslThreadIdCallback);
             }
 
             //
@@ -284,7 +298,7 @@ OpenSSLEngine::OpenSSLEngine(const CommunicatorPtr& communicator) :
                     }
                 }
             }
-#  if !defined (_WIN32) && !defined (OPENSSL_NO_EGD)
+#if !defined (_WIN32) && !defined (OPENSSL_NO_EGD)
             //
             // The Entropy Gathering Daemon (EGD) is not available on Windows.
             // The file should be a Unix domain socket for the daemon.
@@ -298,7 +312,7 @@ OpenSSLEngine::OpenSSLEngine(const CommunicatorPtr& communicator) :
                                                         "IceSSL: EGD failure using file " + entropyDaemon);
                 }
             }
-#  endif
+#endif
             if(!RAND_status())
             {
                 getLogger()->warning("IceSSL: insufficient data to initialize PRNG");
@@ -310,18 +324,18 @@ OpenSSLEngine::OpenSSLEngine(const CommunicatorPtr& communicator) :
             {
                 getLogger()->warning("IceSSL: ignoring IceSSL.Random because OpenSSL initialization is disabled");
             }
-#  ifndef _WIN32
+#ifndef _WIN32
             else if(!properties->getProperty("IceSSL.EntropyDaemon").empty())
             {
                 getLogger()->warning("IceSSL: ignoring IceSSL.EntropyDaemon because OpenSSL initialization is disabled");
             }
-#  endif
+#endif
         }
     }
     __setNoDelete(false);
 }
 
-OpenSSLEngine::~OpenSSLEngine()
+OpenSSL::SSLEngine::~SSLEngine()
 {
 //
 // OpenSSL 1.1.0 remove the need for library initialization and cleanup.
@@ -352,15 +366,8 @@ OpenSSLEngine::~OpenSSLEngine()
 #endif
 }
 
-bool
-OpenSSLEngine::initialized() const
-{
-    IceUtil::Mutex::Lock lock(_mutex);
-    return _initialized;
-}
-
 void
-OpenSSLEngine::initialize()
+OpenSSL::SSLEngine::initialize()
 {
     IceUtil::Mutex::Lock lock(_mutex);
     if(_initialized)
@@ -370,7 +377,7 @@ OpenSSLEngine::initialize()
 
     try
     {
-        SSLEngine::initialize();
+        IceSSL::SSLEngine::initialize();
 
         const string propPrefix = "IceSSL.";
         PropertiesPtr properties = communicator()->getProperties();
@@ -380,21 +387,9 @@ OpenSSLEngine::initialize()
         // TLS1.1 and TLS1.2 to avoid security issues with SSLv3
         //
         vector<string> defaultProtocols;
-#if defined(TLS1_VERSION) && !defined(OPENSSL_NO_TLS1_METHOD)
         defaultProtocols.push_back("tls1_0");
-#endif
-
-#if defined(TLS1_1_VERSION) && !defined(OPENSSL_NO_TLS1_1_METHOD)
         defaultProtocols.push_back("tls1_1");
-#endif
-
-#if defined(TLS1_2_VERSION) && !defined(OPENSSL_NO_TLS1_2_METHOD)
         defaultProtocols.push_back("tls1_2");
-#endif
-
-#if defined(TLS1_3_VERSION) && !defined(OPENSSL_NO_TLS1_3_METHOD)
-        defaultProtocols.push_back("tls1_3");
-#endif
 
         const int protocols =
                 parseProtocols(properties->getPropertyAsListWithDefault(propPrefix + "Protocols", defaultProtocols));
@@ -534,9 +529,8 @@ OpenSSLEngine::initialize()
                 vector<string> files;
                 if(!IceUtilInternal::splitString(certFile, IceUtilInternal::pathsep, files) || files.size() > 2)
                 {
-                    throw PluginInitializationException(__FILE__, __LINE__,
-                                                        "IceSSL: invalid value for " + propPrefix + "CertFile:\n" +
-                                                        certFile);
+                    PluginInitializationException ex(__FILE__, __LINE__,
+                                            "IceSSL: invalid value for " + propPrefix + "CertFile:\n" + certFile);
                 }
                 numCerts = files.size();
                 for(vector<string>::iterator p = files.begin(); p != files.end(); ++p)
@@ -545,8 +539,8 @@ OpenSSLEngine::initialize()
                     string resolved;
                     if(!checkPath(file, defaultDir, false, resolved))
                     {
-                        throw PluginInitializationException(__FILE__, __LINE__,
-                                                            "IceSSL: certificate file not found:\n" + file);
+                        PluginInitializationException ex(__FILE__, __LINE__,
+                                                         "IceSSL: certificate file not found:\n" + file);
                     }
                     file = resolved;
 
@@ -554,18 +548,12 @@ OpenSSLEngine::initialize()
                     // First we try to load the certificate using PKCS12 format if that fails
                     // we fallback to PEM format.
                     //
-                    FILE* f = fopen(file.c_str(), "rb");
-                    if(!f)
-                    {
-                        throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: unable to load certificate chain from file " + file + "\n" +
-                                                IceUtilInternal::lastErrorToString());
-                    }
-
+                    vector<char> buffer;
+                    readFile(file, buffer);
                     int success = 0;
 
-                    PKCS12* p12 = d2i_PKCS12_fp(f, 0);
-                    fclose(f);
+                    const unsigned char* b = const_cast<const unsigned char*>(reinterpret_cast<unsigned char*>(&buffer[0]));
+                    PKCS12* p12 = d2i_PKCS12(0, &b, static_cast<long>(buffer.size()));
                     if(p12)
                     {
                         EVP_PKEY* key = 0;
@@ -771,11 +759,11 @@ OpenSSLEngine::initialize()
             // Diffie Hellman configuration.
             //
             {
-#  ifndef OPENSSL_NO_DH
+#ifndef OPENSSL_NO_DH
                 _dhParams = new DHParams;
                 SSL_CTX_set_options(_ctx, SSL_OP_SINGLE_DH_USE);
                 SSL_CTX_set_tmp_dh_callback(_ctx, IceSSL_opensslDHCallback);
-#  endif
+#endif
                 //
                 // Properties have the following form:
                 //
@@ -785,9 +773,9 @@ OpenSSLEngine::initialize()
                 PropertyDict d = properties->getPropertiesForPrefix(dhPrefix);
                 if(!d.empty())
                 {
-#  ifdef OPENSSL_NO_DH
+#ifdef OPENSSL_NO_DH
                     getLogger()->warning("IceSSL: OpenSSL is not configured for Diffie Hellman");
-#  else
+#else
                     for(PropertyDict::iterator p = d.begin(); p != d.end(); ++p)
                     {
                         string s = p->first.substr(dhPrefix.size());
@@ -809,7 +797,7 @@ OpenSSLEngine::initialize()
                             }
                         }
                     }
-#  endif
+#endif
                 }
             }
 
@@ -891,7 +879,7 @@ OpenSSLEngine::initialize()
 }
 
 void
-OpenSSLEngine::context(SSL_CTX* context)
+OpenSSL::SSLEngine::context(SSL_CTX* context)
 {
     if(initialized())
     {
@@ -903,19 +891,19 @@ OpenSSLEngine::context(SSL_CTX* context)
 }
 
 SSL_CTX*
-OpenSSLEngine::context() const
+OpenSSL::SSLEngine::context() const
 {
     return _ctx;
 }
 
 string
-OpenSSLEngine::sslErrors() const
+OpenSSL::SSLEngine::sslErrors() const
 {
     return getSslErrors(securityTraceLevel() >= 1);
 }
 
 void
-OpenSSLEngine::destroy()
+OpenSSL::SSLEngine::destroy()
 {
     if(_ctx)
     {
@@ -923,16 +911,38 @@ OpenSSLEngine::destroy()
     }
 }
 
-#  ifndef OPENSSL_NO_DH
+void
+OpenSSL::SSLEngine::verifyPeer(const string& address, const IceSSL::ConnectionInfoPtr& info, const string& desc)
+{
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x10002000L
+    //
+    // Peer hostname verification is new in OpenSSL 1.0.2 for older versions
+    //  we use IceSSL build in hostname verification.
+    //
+    verifyPeerCertName(address, info);
+#endif
+    IceSSL::SSLEngine::verifyPeer(address, info, desc);
+}
+
+IceInternal::TransceiverPtr
+OpenSSL::SSLEngine::createTransceiver(const InstancePtr& instance,
+                                      const IceInternal::TransceiverPtr& delegate,
+                                      const string& hostOrAdapterName,
+                                      bool incoming)
+{
+    return new OpenSSL::TransceiverI(instance, delegate, hostOrAdapterName, incoming);
+}
+
+#ifndef OPENSSL_NO_DH
 DH*
-OpenSSLEngine::dhParams(int keyLength)
+OpenSSL::SSLEngine::dhParams(int keyLength)
 {
     return _dhParams->get(keyLength);
 }
-#  endif
+#endif
 
 int
-OpenSSLEngine::parseProtocols(const StringSeq& protocols) const
+OpenSSL::SSLEngine::parseProtocols(const StringSeq& protocols) const
 {
     int v = 0;
 
@@ -941,48 +951,19 @@ OpenSSLEngine::parseProtocols(const StringSeq& protocols) const
         string prot = IceUtilInternal::toUpper(*p);
         if(prot == "SSL3" || prot == "SSLV3")
         {
-#if defined(OPENSSL_NO_SSL3_METHOD) || !defined(SSL3_VERSION)
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: OpenSSL was build without SSLv3 support");
-#else
             v |= SSLv3;
-#endif
         }
         else if(prot == "TLS" || prot == "TLS1" || prot == "TLSV1" || prot == "TLS1_0" || prot == "TLSV1_0")
         {
-#if defined(OPENSSL_NO_TLS1_METHOD) || !defined(TLS1_VERSION)
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: OpenSSL was build without TLS 1.0 support");
-#else
             v |= TLSv1_0;
-#endif
         }
         else if(prot == "TLS1_1" || prot == "TLSV1_1")
         {
-#if defined(OPENSSL_NO_TLS1_1_METHOD) || !defined(TLS1_1_VERSION)
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: OpenSSL was build without TLS 1.1 support");
-#else
             v |= TLSv1_1;
-#endif
         }
         else if(prot == "TLS1_2" || prot == "TLSV1_2")
         {
-#if defined(OPENSSL_NO_TLS1_2_METHOD) || !defined(TLS1_2_VERSION)
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: OpenSSL was build without TLS 1.2 support");
-#else
             v |= TLSv1_2;
-#endif
-        }
-        else if(prot == "TLS1_3" || prot == "TLSV1_3")
-        {
-#if defined(OPENSSL_NO_TLS1_3_METHOD) || !defined(TLS1_3_VERSION)
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: OpenSSL was build without TLS 1.3 support");
-#else
-            v |= TLSv1_3;
-#endif
         }
         else
         {
@@ -994,7 +975,7 @@ OpenSSLEngine::parseProtocols(const StringSeq& protocols) const
 }
 
 SSL_METHOD*
-OpenSSLEngine::getMethod(int /*protocols*/)
+OpenSSL::SSLEngine::getMethod(int /*protocols*/)
 {
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
     SSL_METHOD* meth = const_cast<SSL_METHOD*>(TLS_method());
@@ -1018,23 +999,17 @@ OpenSSLEngine::getMethod(int /*protocols*/)
 }
 
 void
-OpenSSLEngine::setOptions(int protocols)
+OpenSSL::SSLEngine::setOptions(int protocols)
 {
     long opts = SSL_OP_NO_SSLv2; // SSLv2 is not supported.
-#ifdef SSL_OP_NO_SSLv3
     if(!(protocols & SSLv3))
     {
         opts |= SSL_OP_NO_SSLv3;
     }
-#endif
-
-#ifdef SSL_OP_NO_TLSv1
     if(!(protocols & TLSv1_0))
     {
         opts |= SSL_OP_NO_TLSv1;
     }
-#endif
-
 #ifdef SSL_OP_NO_TLSv1_1
     if(!(protocols & TLSv1_1))
     {
@@ -1055,15 +1030,5 @@ OpenSSLEngine::setOptions(int protocols)
         opts |= SSL_OP_NO_TLSv1_2;
     }
 #endif
-
-#ifdef SSL_OP_NO_TLSv1_3
-    if(!(protocols & TLSv1_3))
-    {
-        opts |= SSL_OP_NO_TLSv1_3;
-    }
-#endif
-
     SSL_CTX_set_options(_ctx, opts);
 }
-
-#endif // ICESSL_USE_OPENSSL