zeroc-ice 3.6.5 → 3.7.0

data/ext/ice/cpp/src/IceSSL/OpenSSLEngine.h

@@ -0,0 +1,64 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#ifndef ICESSL_OPENSSL_ENGINE_H
+#define ICESSL_OPENSSL_ENGINE_H
+
+#include <IceSSL/SSLEngine.h>
+#include <IceSSL/InstanceF.h>
+#include <IceSSL/OpenSSLUtil.h>
+
+#include <Ice/BuiltinSequences.h>
+
+namespace IceSSL
+{
+
+namespace OpenSSL
+{
+
+class SSLEngine : public IceSSL::SSLEngine
+{
+public:
+
+    SSLEngine(const Ice::CommunicatorPtr&);
+    ~SSLEngine();
+
+    virtual void initialize();
+    virtual void destroy();
+    virtual void verifyPeer(const std::string&, const IceSSL::ConnectionInfoPtr&, const std::string&);
+    virtual IceInternal::TransceiverPtr
+    createTransceiver(const IceSSL::InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool);
+
+#ifndef OPENSSL_NO_DH
+    DH* dhParams(int);
+#endif
+
+    SSL_CTX* context() const;
+    void context(SSL_CTX*);
+    std::string sslErrors() const;
+
+private:
+
+    SSL_METHOD* getMethod(int);
+    void setOptions(int);
+    enum Protocols { SSLv3 = 0x01, TLSv1_0 = 0x02, TLSv1_1 = 0x04, TLSv1_2 = 0x08 };
+    int parseProtocols(const Ice::StringSeq&) const;
+
+    SSL_CTX* _ctx;
+
+#ifndef OPENSSL_NO_DH
+    IceSSL::OpenSSL::DHParamsPtr _dhParams;
+#endif
+};
+
+} // OpenSSL namespace end
+
+} // IceSSL namespace endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/OpenSSLEngineF.h

@@ -0,0 +1,32 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#ifndef ICESSL_OPENSSL_ENGINE_F_H
+#define ICESSL_OPENSSL_ENGINE_F_H
+
+#include <IceUtil/Shared.h>
+#include <Ice/Handle.h>
+
+#include <IceSSL/OpenSSL.h>
+
+namespace IceSSL
+{
+
+namespace OpenSSL
+{
+
+class SSLEngine;
+ICESSL_OPENSSL_API IceUtil::Shared* upCast(SSLEngine*);
+typedef IceInternal::Handle<SSLEngine> SSLEnginePtr;
+
+} // OpenSSL namespace end
+
+} // IceSSL namespace end
+
+#endif

data/ext/ice/cpp/src/IceSSL/OpenSSLPluginI.cpp

@@ -0,0 +1,132 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#include <IceSSL/PluginI.h>
+#include <IceSSL/OpenSSL.h>
+#include <IceSSL/OpenSSLEngine.h>
+
+#include <Ice/Initialize.h>
+
+using namespace std;
+
+namespace
+{
+
+class PluginI : public IceSSL::PluginI,
+                public IceSSL::OpenSSL::Plugin
+{
+public:
+
+    PluginI(const Ice::CommunicatorPtr&);
+
+    virtual Ice::Long getOpenSSLVersion() const;
+    virtual IceSSL::CertificatePtr create(x509_st*) const;
+    virtual IceSSL::CertificatePtr load(const std::string&) const;
+    virtual IceSSL::CertificatePtr decode(const std::string&) const;
+    virtual void setContext(SSL_CTX*);
+    virtual SSL_CTX* getContext();
+};
+
+} // anonymous namespace end
+
+//
+// Plugin implementation.
+//
+PluginI::PluginI(const Ice::CommunicatorPtr& com) :
+    IceSSL::PluginI(com, new IceSSL::OpenSSL::SSLEngine(com))
+{
+}
+
+Ice::Long
+PluginI::getOpenSSLVersion() const
+{
+    return SSLeay();
+}
+
+IceSSL::CertificatePtr
+PluginI::create(x509_st* cert) const
+{
+    return IceSSL::OpenSSL::Certificate::create(cert);
+}
+
+IceSSL::CertificatePtr
+PluginI::load(const std::string& file) const
+{
+    return IceSSL::OpenSSL::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+PluginI::decode(const std::string& encoding) const
+{
+    return IceSSL::OpenSSL::Certificate::load(encoding);
+}
+
+void
+PluginI::setContext(SSL_CTX* context)
+{
+    IceSSL::OpenSSL::SSLEngine* engine = dynamic_cast<IceSSL::OpenSSL::SSLEngine*>(_engine.get());
+    assert(engine);
+    engine->context(context);
+}
+
+SSL_CTX*
+PluginI::getContext()
+{
+    IceSSL::OpenSSL::SSLEngine* engine = dynamic_cast<IceSSL::OpenSSL::SSLEngine*>(_engine.get());
+    assert(engine);
+    return engine->context();
+}
+
+#ifdef _WIN32
+//
+// Plug-in factory function.
+//
+extern "C" ICESSL_OPENSSL_API Ice::Plugin*
+createIceSSLOpenSSL(const Ice::CommunicatorPtr& communicator, const string& /*name*/, const Ice::StringSeq& /*args*/)
+{
+    return new PluginI(communicator);
+}
+
+namespace Ice
+{
+
+ICESSL_OPENSSL_API void
+registerIceSSLOpenSSL(bool loadOnInitialize)
+{
+    Ice::registerPluginFactory("IceSSL", createIceSSLOpenSSL, loadOnInitialize);
+}
+
+}
+
+#else
+
+extern "C" ICESSL_API Ice::Plugin*
+createIceSSL(const Ice::CommunicatorPtr& communicator, const string& /*name*/, const Ice::StringSeq& /*args*/)
+{
+    return new PluginI(communicator);
+}
+
+//
+// The following functions are defined only when OpenSSL is the default
+// implementation. In Windows the default implementation is always
+// SChannel.
+//
+IceSSL::CertificatePtr
+IceSSL::Certificate::load(const std::string& file)
+{
+    return IceSSL::OpenSSL::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+IceSSL::Certificate::decode(const std::string& encoding)
+{
+    return IceSSL::OpenSSL::Certificate::decode(encoding);
+}
+
+#endif

data/ext/ice/cpp/src/IceSSL/OpenSSLTransceiverI.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -8,6 +8,7 @@
 // **********************************************************************
 
 #include <IceSSL/OpenSSLTransceiverI.h>
+#include <IceSSL/OpenSSLEngine.h>
 
 #include <IceUtil/Mutex.h>
 #include <IceUtil/MutexPtrLock.h>
@@ -20,9 +21,9 @@
 #include <Ice/LoggerUtil.h>
 #include <Ice/Buffer.h>
 #include <Ice/LocalException.h>
+#include <Ice/Network.h>
 
-#ifdef ICE_USE_OPENSSL
-
+#include <openssl/ssl.h>
 #include <openssl/err.h>
 #include <openssl/bio.h>
 
@@ -31,7 +32,7 @@ using namespace Ice;
 using namespace IceSSL;
 
 //
-// BUGFIX: an openssl bug that affects OpensSSL < 1.0.0k
+// BUGFIX: an openssl bug that affects OpenSSL < 1.0.0k
 // could cause a deadlock when decoding public keys.
 //
 // See: http://cvs.openssl.org/chngview?cn=22569
@@ -70,33 +71,60 @@ int
 IceSSL_opensslVerifyCallback(int ok, X509_STORE_CTX* ctx)
 {
     SSL* ssl = reinterpret_cast<SSL*>(X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
-    TransceiverI* p = reinterpret_cast<TransceiverI*>(SSL_get_ex_data(ssl, 0));
+    OpenSSL::TransceiverI* p = reinterpret_cast<OpenSSL::TransceiverI*>(SSL_get_ex_data(ssl, 0));
     return p->verifyCallback(ok, ctx);
 }
 
 }
 
 IceInternal::NativeInfoPtr
-IceSSL::TransceiverI::getNativeInfo()
+OpenSSL::TransceiverI::getNativeInfo()
 {
-    return _stream;
+    return _delegate->getNativeInfo();
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer, bool&)
+OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer)
 {
-    IceInternal::SocketOperation status = _stream->connect(readBuffer, writeBuffer);
-    if(status != IceInternal::SocketOperationNone)
+    if(!_connected)
     {
-        return status;
+        IceInternal::SocketOperation status = _delegate->initialize(readBuffer, writeBuffer);
+        if(status != IceInternal::SocketOperationNone)
+        {
+            return status;
+        }
+        _connected = true;
     }
 
     if(!_ssl)
     {
+        SOCKET fd = _delegate->getNativeInfo()->fd();
+        if(fd == INVALID_SOCKET)
+        {
+            //
+            // The delegate has finished its initialization but may not have a file descriptor yet (e.g., Bluetooth).
+            // The underlying transport must (eventually) be socket-based.
+            //
+            return IceInternal::SocketOperationRead;
+        }
+
+#ifdef ICE_USE_IOCP
+        _maxSendPacketSize = std::max(512, IceInternal::getSendBufferSize(fd));
+        _maxRecvPacketSize = std::max(512, IceInternal::getRecvBufferSize(fd));
+        BIO* bio;
+        _sentBytes = 0;
+        if(!BIO_new_bio_pair(&bio, _maxSendPacketSize, &_iocpBio, _maxRecvPacketSize))
+        {
+            bio = 0;
+            _iocpBio = 0;
+        }
+#else
         //
         // This static_cast is necessary due to 64bit windows. There SOCKET is a non-int type.
         //
-        BIO* bio = BIO_new_socket(static_cast<int>(_stream->fd()), 0);
+        BIO* bio = BIO_new_socket(static_cast<int>(fd), 0);
+#endif
+
         if(!bio)
         {
             SecurityException ex(__FILE__, __LINE__);
@@ -108,6 +136,10 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         if(!_ssl)
         {
             BIO_free(bio);
+#ifdef ICE_USE_IOCP
+            BIO_free(_iocpBio);
+            _iocpBio = 0;
+#endif
             SecurityException ex(__FILE__, __LINE__);
             ex.reason = "openssl failure";
             throw ex;
@@ -140,6 +172,25 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
                     assert(false);
                 }
             }
+
+            //
+            // Hostname verification was included in OpenSSL 1.0.2
+            //
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10002000L
+            if(_engine->getCheckCertName() && !_host.empty() && (sslVerifyMode & SSL_VERIFY_PEER))
+            {
+                X509_VERIFY_PARAM* param = SSL_get0_param(_ssl);
+                if(IceInternal::isIpAddress(_host))
+                {
+                    X509_VERIFY_PARAM_set1_ip_asc(param, _host.c_str());
+                }
+                else
+                {
+                    X509_VERIFY_PARAM_set1_host(param, _host.c_str(), 0);
+                }
+            }
+#endif
+
             SSL_set_verify(_ssl, sslVerifyMode, IceSSL_opensslVerifyCallback);
         }
     }
@@ -151,7 +202,7 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         //
 
         //
-        // BUGFIX: an openssl bug that affects OpensSSL < 1.0.0k
+        // BUGFIX: an openssl bug that affects OpenSSL < 1.0.0k
         // could cause a deadlock when decoding public keys.
         //
         // See: http://cvs.openssl.org/chngview?cn=22569
@@ -165,6 +216,18 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
 #if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x100000bfL && !defined(LIBRESSL_VERSION_NUMBER)
         sync.release();
 #endif
+
+#ifdef ICE_USE_IOCP
+        if(BIO_ctrl_pending(_iocpBio))
+        {
+            if(!send())
+            {
+                return IceInternal::SocketOperationWrite;
+            }
+            continue;
+        }
+#endif
+
         if(ret <= 0)
         {
             switch(SSL_get_error(_ssl, ret))
@@ -182,14 +245,27 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
             }
             case SSL_ERROR_WANT_READ:
             {
+#ifdef ICE_USE_IOCP
+                if(receive())
+                {
+                    continue;
+                }
+#endif
                 return IceInternal::SocketOperationRead;
             }
             case SSL_ERROR_WANT_WRITE:
             {
+#ifdef ICE_USE_IOCP
+                if(send())
+                {
+                    continue;
+                }
+#endif
                 return IceInternal::SocketOperationWrite;
             }
             case SSL_ERROR_SYSCALL:
             {
+#ifndef ICE_USE_IOCP
                 if(IceInternal::interrupted())
                 {
                     break;
@@ -215,24 +291,16 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
                     ex.error = IceInternal::getSocketErrno();
                     throw ex;
                 }
-                else
-                {
-                    SocketException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
-                }
+#endif
+                SocketException ex(__FILE__, __LINE__);
+                ex.error = IceInternal::getSocketErrno();
+                throw ex;
             }
             case SSL_ERROR_SSL:
             {
-                IceInternal::Address remoteAddr;
-                string desc = "<not available>";
-                if(IceInternal::fdToRemoteAddress(_stream->fd(), remoteAddr))
-                {
-                    desc = IceInternal::addrToString(remoteAddr);
-                }
                 ostringstream ostr;
                 ostr << "SSL error occurred for new " << (_incoming ? "incoming" : "outgoing")
-                     << " connection:\nremote address = " << desc << "\n" << _engine->sslErrors();
+                     << " connection:\nremote address = " << _delegate->toString() << "\n" << _engine->sslErrors();
                 ProtocolException ex(__FILE__, __LINE__);
                 ex.reason = ostr.str();
                 throw ex;
@@ -272,7 +340,8 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         _verified = true;
     }
 
-    _engine->verifyPeer(_stream->fd(), _host, NativeConnectionInfoPtr::dynamicCast(getInfo()));
+    _cipher = SSL_get_cipher_name(_ssl); // Nothing needs to be free'd.
+    _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString());
 
     if(_engine->securityTraceLevel() >= 1)
     {
@@ -301,7 +370,7 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
+OpenSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
 {
     // If we are initiating the connection closure, wait for the peer
     // to close the TCP/IP connection. Otherwise, close immediately.
@@ -309,7 +378,7 @@ IceSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
 }
 
 void
-IceSSL::TransceiverI::close()
+OpenSSL::TransceiverI::close()
 {
     if(_ssl)
     {
@@ -327,17 +396,35 @@ IceSSL::TransceiverI::close()
         _ssl = 0;
     }
 
-    _stream->close();
+#ifdef ICE_USE_IOCP
+    if(_iocpBio)
+    {
+        BIO_free(_iocpBio);
+        _iocpBio = 0;
+    }
+#endif
+
+    _delegate->close();
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
+OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(!_connected)
     {
-        return _stream->write(buf);
+        return _delegate->write(buf);
     }
 
+#ifdef ICE_USE_IOCP
+    if(_writeBuffer.i != _writeBuffer.b.end())
+    {
+        if(!send())
+        {
+            return IceInternal::SocketOperationWrite;
+        }
+    }
+#endif
+
     if(buf.i == buf.b.end())
     {
         return IceInternal::SocketOperationNone;
@@ -346,11 +433,37 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
     //
     // It's impossible for packetSize to be more than an Int.
     //
-    int packetSize = static_cast<int>(buf.b.end() - buf.i);
+    int packetSize =
+#ifdef ICE_USE_IOCP
+        std::min(static_cast<int>(_maxSendPacketSize), static_cast<int>(buf.b.end() - buf.i));
+#else
+        static_cast<int>(buf.b.end() - buf.i);
+#endif
     while(buf.i != buf.b.end())
     {
         ERR_clear_error(); // Clear any spurious errors.
+#ifdef ICE_USE_IOCP
+        int ret;
+        if(_sentBytes)
+        {
+            ret = _sentBytes;
+            _sentBytes = 0;
+        }
+        else
+        {
+            ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
+            if(ret > 0)
+            {
+                if(!send())
+                {
+                    _sentBytes = ret;
+                    return IceInternal::SocketOperationWrite;
+                }
+            }
+        }
+#else
         int ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
+#endif
         if(ret <= 0)
         {
             switch(SSL_get_error(_ssl, ret))
@@ -371,10 +484,18 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
             }
             case SSL_ERROR_WANT_WRITE:
             {
+#ifdef ICE_USE_IOCP
+                if(send())
+                {
+                    continue;
+                }
+#endif
                 return IceInternal::SocketOperationWrite;
             }
             case SSL_ERROR_SYSCALL:
             {
+#ifndef ICE_USE_IOCP
+
                 if(IceInternal::interrupted())
                 {
                     continue;
@@ -391,7 +512,7 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
                     assert(SSL_want_write(_ssl));
                     return IceInternal::SocketOperationWrite;
                 }
-
+#endif
                 if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
                 {
                     ConnectionLostException ex(__FILE__, __LINE__);
@@ -421,21 +542,29 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
             packetSize = static_cast<int>(buf.b.end() - buf.i);
         }
     }
-
     return IceInternal::SocketOperationNone;
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
+OpenSSL::TransceiverI::read(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(!_connected)
+    {
+        return _delegate->read(buf);
+    }
+
+#ifdef ICE_USE_IOCP
+    if(_readBuffer.i != _readBuffer.b.end())
     {
-        return _stream->read(buf);
+        if(!receive())
+        {
+            return IceInternal::SocketOperationRead;
+        }
     }
+#endif
 
     //
-    // Note: we don't set the hasMoreData flag in this implementation.
-    // We assume that OpenSSL doesn't read more SSL records than
+    // Note: We assume that OpenSSL doesn't read more SSL records than
     // necessary to fill the requested data and that the sender sends
     // Ice messages in individual SSL records.
     //
@@ -445,6 +574,8 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
         return IceInternal::SocketOperationNone;
     }
 
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, false);
+
     //
     // It's impossible for packetSize to be more than an Int.
     //
@@ -470,6 +601,12 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
             }
             case SSL_ERROR_WANT_READ:
             {
+#ifdef ICE_USE_IOCP
+                if(receive())
+                {
+                    continue;
+                }
+#endif
                 return IceInternal::SocketOperationRead;
             }
             case SSL_ERROR_WANT_WRITE:
@@ -479,6 +616,7 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
             }
             case SSL_ERROR_SYSCALL:
             {
+#ifndef ICE_USE_IOCP
                 if(IceInternal::interrupted())
                 {
                     continue;
@@ -495,7 +633,7 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
                     assert(SSL_want_read(_ssl));
                     return IceInternal::SocketOperationRead;
                 }
-
+#endif
                 if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
                 {
                     ConnectionLostException ex(__FILE__, __LINE__);
@@ -527,61 +665,199 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
     }
 
     //
-    // Check if there's still buffered data to read. In this case, set hasMoreData to true.
+    // Check if there's still buffered data to read, set the read ready status.
     //
-    hasMoreData = SSL_pending(_ssl) > 0;
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, SSL_pending(_ssl) > 0);
 
     return IceInternal::SocketOperationNone;
 }
 
-string
-IceSSL::TransceiverI::protocol() const
+#ifdef ICE_USE_IOCP
+
+bool
+OpenSSL::TransceiverI::startWrite(IceInternal::Buffer& buffer)
 {
-    return _instance->protocol();
+    if(!_connected)
+    {
+        return _delegate->startWrite(buffer);
+    }
+
+    if(_writeBuffer.i == _writeBuffer.b.end())
+    {
+        assert(_sentBytes == 0);
+        int packetSize = std::min(static_cast<int>(_maxSendPacketSize), static_cast<int>(buffer.b.end() - buffer.i));
+        _sentBytes = SSL_write(_ssl, reinterpret_cast<void*>(&*buffer.i), packetSize);
+
+        assert(BIO_ctrl_pending(_iocpBio));
+        _writeBuffer.b.resize( BIO_ctrl_pending(_iocpBio));
+        _writeBuffer.i = _writeBuffer.b.begin();
+        BIO_read(_iocpBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
+    }
+
+    return _delegate->startWrite(_writeBuffer) && buffer.i == buffer.b.end();
+}
+
+void
+OpenSSL::TransceiverI::finishWrite(IceInternal::Buffer& buffer)
+{
+    if(!_connected)
+    {
+        _delegate->finishWrite(buffer);
+        return;
+    }
+
+    _delegate->finishWrite(_writeBuffer);
+    if(_sentBytes)
+    {
+        buffer.i += _sentBytes;
+        _sentBytes = 0;
+    }
+}
+
+void
+OpenSSL::TransceiverI::startRead(IceInternal::Buffer& buffer)
+{
+    if(!_connected)
+    {
+        _delegate->startRead(buffer);
+        return;
+    }
+
+    if(_readBuffer.i == _readBuffer.b.end())
+    {
+        assert(!buffer.b.empty() && buffer.i != buffer.b.end());
+        ERR_clear_error(); // Clear any spurious errors.
+#ifndef NDEBUG
+        int ret =
+#endif
+            SSL_read(_ssl, reinterpret_cast<void*>(&*buffer.i), static_cast<int>(buffer.b.end() - buffer.i));
+        assert(ret <= 0 && SSL_get_error(_ssl, ret) == SSL_ERROR_WANT_READ);
+
+        assert(BIO_ctrl_get_read_request(_iocpBio));
+        _readBuffer.b.resize(BIO_ctrl_get_read_request(_iocpBio));
+        _readBuffer.i = _readBuffer.b.begin();
+    }
+
+    assert(!_readBuffer.b.empty() && _readBuffer.i != _readBuffer.b.end());
+
+    _delegate->startRead(_readBuffer);
+}
+
+void
+OpenSSL::TransceiverI::finishRead(IceInternal::Buffer& buffer)
+{
+    if(!_connected)
+    {
+        _delegate->finishRead(buffer);
+        return;
+    }
+
+    _delegate->finishRead(_readBuffer);
+    if(_readBuffer.i == _readBuffer.b.end())
+    {
+        int n = BIO_write(_iocpBio, _readBuffer.b.begin(), static_cast<int>(_readBuffer.b.size()));
+        if(n < 0) // Expected if the transceiver was closed.
+        {
+            SecurityException ex(__FILE__, __LINE__);
+            ex.reason = "SSL bio write failed";
+            throw ex;
+        }
+
+        assert(n == static_cast<int>(_readBuffer.b.size()));
+        ERR_clear_error(); // Clear any spurious errors.
+        int ret = SSL_read(_ssl, reinterpret_cast<void*>(&*buffer.i), static_cast<int>(buffer.b.end() - buffer.i));
+        if(ret <= 0)
+        {
+            switch(SSL_get_error(_ssl, ret))
+            {
+                case SSL_ERROR_NONE:
+                case SSL_ERROR_WANT_WRITE:
+                {
+                    assert(false);
+                    return;
+                }
+                case SSL_ERROR_ZERO_RETURN:
+                {
+                    ConnectionLostException ex(__FILE__, __LINE__);
+                    ex.error = 0;
+                    throw ex;
+                }
+                case SSL_ERROR_WANT_READ:
+                {
+                    return;
+                }
+                case SSL_ERROR_SYSCALL:
+                {
+                    if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
+                    {
+                        ConnectionLostException ex(__FILE__, __LINE__);
+                        ex.error = IceInternal::getSocketErrno();
+                        throw ex;
+                    }
+                    else
+                    {
+                        SocketException ex(__FILE__, __LINE__);
+                        ex.error = IceInternal::getSocketErrno();
+                        throw ex;
+                    }
+                }
+                case SSL_ERROR_SSL:
+                {
+                    ProtocolException ex(__FILE__, __LINE__);
+                    ex.reason = "SSL protocol error during read:\n" + _engine->sslErrors();
+                    throw ex;
+                }
+            }
+        }
+        buffer.i += ret;
+    }
 }
+#endif
 
 string
-IceSSL::TransceiverI::toString() const
+OpenSSL::TransceiverI::protocol() const
 {
-    return _stream->toString();
+    return _instance->protocol();
 }
 
 string
-IceSSL::TransceiverI::toDetailedString() const
+OpenSSL::TransceiverI::toString() const
 {
-    return toString();
+    return _delegate->toString();
 }
 
-Ice::ConnectionInfoPtr
-IceSSL::TransceiverI::getInfo() const
+string
+OpenSSL::TransceiverI::toDetailedString() const
 {
-    NativeConnectionInfoPtr info = new NativeConnectionInfo();
-    fillConnectionInfo(info, info->nativeCerts);
-    return info;
+    return toString();
 }
 
 Ice::ConnectionInfoPtr
-IceSSL::TransceiverI::getWSInfo(const Ice::HeaderDict& headers) const
+OpenSSL::TransceiverI::getInfo() const
 {
-    WSSNativeConnectionInfoPtr info = new WSSNativeConnectionInfo();
-    fillConnectionInfo(info, info->nativeCerts);
-    info->headers = headers;
+    ConnectionInfoPtr info = ICE_MAKE_SHARED(ConnectionInfo);
+    info->underlying = _delegate->getInfo();
+    info->incoming = _incoming;
+    info->adapterName = _adapterName;
+    info->cipher = _cipher;
+    info->certs = _certs;
+    info->verified = _verified;
     return info;
 }
 
 void
-IceSSL::TransceiverI::checkSendSize(const IceInternal::Buffer&)
+OpenSSL::TransceiverI::checkSendSize(const IceInternal::Buffer&)
 {
 }
 
 void
-IceSSL::TransceiverI::setBufferSize(int rcvSize, int sndSize)
+OpenSSL::TransceiverI::setBufferSize(int rcvSize, int sndSize)
 {
-    _stream->setBufferSize(rcvSize, sndSize);
+    _delegate->setBufferSize(rcvSize, sndSize);
 }
 
 int
-IceSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
+OpenSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
 {
     if(!ok && _engine->securityTraceLevel() >= 1)
     {
@@ -608,10 +884,11 @@ IceSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
     STACK_OF(X509)* chain = X509_STORE_CTX_get1_chain(c);
     if(chain != 0)
     {
-        _nativeCerts.clear();
+        _certs.clear();
         for(int i = 0; i < sk_X509_num(chain); ++i)
         {
-            _nativeCerts.push_back(new Certificate(X509_dup(sk_X509_value(chain, i))));
+            CertificatePtr cert = OpenSSL::Certificate::create(X509_dup(sk_X509_value(chain, i)));
+            _certs.push_back(cert);
         }
         sk_X509_pop_free(chain, X509_free);
     }
@@ -625,47 +902,81 @@ IceSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
     return 1;
 }
 
-IceSSL::TransceiverI::TransceiverI(const InstancePtr& instance, const IceInternal::StreamSocketPtr& stream,
-                                   const string& hostOrAdapterName, bool incoming) :
+OpenSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
+                                    const IceInternal::TransceiverPtr& delegate,
+                                    const string& hostOrAdapterName,
+                                    bool incoming) :
     _instance(instance),
-    _engine(OpenSSLEnginePtr::dynamicCast(instance->engine())),
+    _engine(OpenSSL::SSLEnginePtr::dynamicCast(instance->engine())),
     _host(incoming ? "" : hostOrAdapterName),
     _adapterName(incoming ? hostOrAdapterName : ""),
     _incoming(incoming),
-    _stream(stream),
+    _delegate(delegate),
+    _connected(false),
     _verified(false),
     _ssl(0)
+#ifdef ICE_USE_IOCP
+    , _iocpBio(0),
+    _sentBytes(0),
+    _maxSendPacketSize(0),
+    _maxRecvPacketSize(0)
+#endif
 {
 }
 
-IceSSL::TransceiverI::~TransceiverI()
+OpenSSL::TransceiverI::~TransceiverI()
 {
 }
 
-void
-IceSSL::TransceiverI::fillConnectionInfo(const ConnectionInfoPtr& info, std::vector<CertificatePtr>& nativeCerts) const
+#ifdef ICE_USE_IOCP
+bool
+OpenSSL::TransceiverI::receive()
 {
-    IceInternal::fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress,
-                                    info->remotePort);
-    if(_stream->fd() != INVALID_SOCKET)
+    if(_readBuffer.i == _readBuffer.b.end())
     {
-        info->rcvSize = IceInternal::getRecvBufferSize(_stream->fd());
-        info->sndSize = IceInternal::getSendBufferSize(_stream->fd());
+        assert(BIO_ctrl_get_read_request(_iocpBio));
+        _readBuffer.b.resize(BIO_ctrl_get_read_request(_iocpBio));
+        _readBuffer.i = _readBuffer.b.begin();
     }
-    info->adapterName = _adapterName;
-    info->incoming = _incoming;
-    info->verified = _verified;
-    nativeCerts = _nativeCerts;
-    for(vector<CertificatePtr>::const_iterator p = _nativeCerts.begin(); p != _nativeCerts.end(); ++p)
+
+    while(_readBuffer.i != _readBuffer.b.end())
+    {
+        if(_delegate->read(_readBuffer) != IceInternal::SocketOperationNone)
+        {
+            return false;
+        }
+    }
+
+    assert(_readBuffer.i == _readBuffer.b.end());
+
+#ifndef NDEBUG
+    int n =
+#endif
+        BIO_write(_iocpBio, &_readBuffer.b[0], static_cast<int>(_readBuffer.b.end() - _readBuffer.b.begin()));
+
+    assert(n == static_cast<int>(_readBuffer.b.end() - _readBuffer.b.begin()));
+
+    return true;
+}
+
+bool
+OpenSSL::TransceiverI::send()
+{
+    if(_writeBuffer.i == _writeBuffer.b.end())
     {
-        info->certs.push_back((*p)->encode());
+        assert(BIO_ctrl_pending(_iocpBio));
+        _writeBuffer.b.resize( BIO_ctrl_pending(_iocpBio));
+        _writeBuffer.i = _writeBuffer.b.begin();
+        BIO_read(_iocpBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
     }
-    if(_ssl != 0)
+
+    if(_writeBuffer.i != _writeBuffer.b.end())
     {
-        info->cipher = SSL_get_cipher_name(_ssl); // Nothing needs to be free'd.
+        if(_delegate->write(_writeBuffer) != IceInternal::SocketOperationNone)
+        {
+            return false;
+        }
     }
-    info->adapterName = _adapterName;
-    info->incoming = _incoming;
+    return _writeBuffer.i == _writeBuffer.b.end();
 }
-
 #endif