zeroc-ice 3.6.5 → 3.7.0

data/ext/ice/cpp/src/IceSSL/PluginI.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -15,93 +15,123 @@
 #include <Ice/ProtocolPluginFacade.h>
 #include <Ice/ProtocolInstance.h>
 #include <Ice/LocalException.h>
+#include <Ice/RegisterPlugins.h>
 
 using namespace std;
 using namespace Ice;
 using namespace IceSSL;
 
-//
-// Plug-in factory function.
-//
-extern "C"
+#ifndef ICE_CPP11_MAPPING
+CertificateVerifier::~CertificateVerifier()
 {
-
-ICE_SSL_API Ice::Plugin*
-createIceSSL(const CommunicatorPtr& communicator, const string& /*name*/, const StringSeq& /*args*/)
-{
-    return new PluginI(communicator);
+    // Out of line to avoid weak vtable
 }
 
-}
-
-namespace Ice
-{
-
-ICE_SSL_API void
-registerIceSSL(bool loadOnInitialize)
+PasswordPrompt::~PasswordPrompt()
 {
-    Ice::registerPluginFactory("IceSSL", createIceSSL, loadOnInitialize);
+    // Out of line to avoid weak vtable
 }
+#endif
 
+IceSSL::Plugin::~Plugin()
+{
+    // Out of line to avoid weak vtable
 }
 
 //
 // Plugin implementation.
 //
-IceSSL::PluginI::PluginI(const Ice::CommunicatorPtr& com)
+PluginI::PluginI(const Ice::CommunicatorPtr& com, const SSLEnginePtr& engine) :
+    _engine(engine)
 {
-#if defined(ICE_USE_SECURE_TRANSPORT)
-    _engine = new SecureTransportEngine(com);
-#elif defined(ICE_USE_SCHANNEL)
-    _engine = new SChannelEngine(com);
-#else
-    _engine = new OpenSSLEngine(com);
-#endif
-
     //
     // Register the endpoint factory. We have to do this now, rather
     // than in initialize, because the communicator may need to
     // interpret proxies before the plug-in is fully initialized.
     //
-    IceInternal::EndpointFactoryPtr sslFactory = new EndpointFactoryI(new Instance(_engine, EndpointType, "ssl"));
-    IceInternal::getProtocolPluginFacade(com)->addEndpointFactory(sslFactory);
+    InstancePtr instance = new Instance(_engine, SSLEndpointType, "ssl"); // SSL based on TCP
+    IceInternal::getProtocolPluginFacade(com)->addEndpointFactory(new EndpointFactoryI(instance, TCPEndpointType));
 }
 
 void
-IceSSL::PluginI::initialize()
+PluginI::initialize()
 {
     _engine->initialize();
 }
 
 void
-IceSSL::PluginI::destroy()
+PluginI::destroy()
 {
     _engine->destroy();
     _engine = 0;
 }
 
+#ifdef ICE_CPP11_MAPPING
 void
-IceSSL::PluginI::setCertificateVerifier(const CertificateVerifierPtr& verifier)
+PluginI::setCertificateVerifier(std::function<bool(const std::shared_ptr<IceSSL::ConnectionInfo>&)> verifier)
+{
+    if(verifier)
+    {
+        _engine->setCertificateVerifier(make_shared<CertificateVerifier>(std::move(verifier)));
+    }
+    else
+    {
+        _engine->setCertificateVerifier(nullptr);
+    }
+}
+#else
+void
+PluginI::setCertificateVerifier(const CertificateVerifierPtr& verifier)
 {
     _engine->setCertificateVerifier(verifier);
 }
+#endif
 
+#ifdef ICE_CPP11_MAPPING
 void
-IceSSL::PluginI::setPasswordPrompt(const PasswordPromptPtr& prompt)
+PluginI::setPasswordPrompt(std::function<std::string()> prompt)
+{
+     if(prompt)
+     {
+         _engine->setPasswordPrompt(make_shared<PasswordPrompt>(std::move(prompt)));
+     }
+     else
+     {
+         _engine->setPasswordPrompt(nullptr);
+     }
+}
+#else
+void
+PluginI::setPasswordPrompt(const PasswordPromptPtr& prompt)
 {
     _engine->setPasswordPrompt(prompt);
 }
+#endif
 
-#ifdef ICE_USE_OPENSSL
-void
-IceSSL::PluginI::setContext(SSL_CTX* context)
+extern "C"
+{
+
+ICESSL_API Ice::Plugin*
+createIceSSL(const CommunicatorPtr&, const string&, const StringSeq&);
+
+}
+
+namespace Ice
+{
+
+ICESSL_API void
+registerIceSSL(bool loadOnInitialize)
 {
-    _engine->context(context);
+    Ice::registerPluginFactory("IceSSL", createIceSSL, loadOnInitialize);
 }
 
-SSL_CTX*
-IceSSL::PluginI::getContext()
+}
+
+//
+// Objective-C function to allow Objective-C programs to register plugin.
+//
+extern "C" ICESSL_API void
+ICEregisterIceSSL(bool loadOnInitialize)
 {
-    return _engine->context();
+    Ice::registerIceSSL(loadOnInitialize);
 }
-#endif

data/ext/ice/cpp/src/IceSSL/PluginI.h

@@ -1,14 +1,14 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#ifndef ICE_SSL_PLUGIN_I_H
-#define ICE_SSL_PLUGIN_I_H
+#ifndef ICESSL_PLUGIN_I_H
+#define ICESSL_PLUGIN_I_H
 
 #include <IceSSL/Plugin.h>
 #include <IceSSL/SSLEngineF.h>
@@ -17,12 +17,11 @@
 namespace IceSSL
 {
 
-class PluginI : public IceSSL::Plugin
+class ICESSL_API PluginI : public virtual IceSSL::Plugin
 {
 public:
 
-    PluginI(const Ice::CommunicatorPtr&);
-
+    PluginI(const Ice::CommunicatorPtr&, const IceSSL::SSLEnginePtr&);
     //
     // From Ice::Plugin.
     //
@@ -32,23 +31,19 @@ public:
     //
     // From IceSSL::Plugin.
     //
+#ifdef ICE_CPP11_MAPPING
+    virtual void setCertificateVerifier(std::function<bool(const std::shared_ptr<ConnectionInfo>&)>);
+    virtual void setPasswordPrompt(std::function<std::string()>);
+#else
     virtual void setCertificateVerifier(const CertificateVerifierPtr&);
     virtual void setPasswordPrompt(const PasswordPromptPtr&);
-
-#ifdef ICE_USE_OPENSSL
-    virtual void setContext(SSL_CTX*);
-    virtual SSL_CTX* getContext();
 #endif
 
-private:
+    virtual CertificatePtr load(const std::string&) const = 0;
+    virtual CertificatePtr decode(const std::string&) const = 0;
+protected:
 
-#if defined(ICE_USE_SECURE_TRANSPORT)
-    SecureTransportEnginePtr _engine;
-#elif defined(ICE_USE_SCHANNEL)
-    SChannelEnginePtr _engine;
-#else
-    OpenSSLEnginePtr _engine;
-#endif
+    SSLEnginePtr _engine;
 };
 
 }

data/ext/ice/cpp/src/IceSSL/RFC2253.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -37,8 +37,8 @@ static string parsePair(const string&, size_t&);
 static string parseHexPair(const string&, size_t&, bool);
 static void eatWhite(const string&, size_t&);
 
-IceSSL::RFC2253::RDNEntrySeq
-IceSSL::RFC2253::parse(const string& data)
+RFC2253::RDNEntrySeq
+RFC2253::parse(const string& data)
 {
     RDNEntrySeq results;
     RDNEntry current;
@@ -82,8 +82,8 @@ IceSSL::RFC2253::parse(const string& data)
     return results;
 }
 
-IceSSL::RFC2253::RDNSeq
-IceSSL::RFC2253::parseStrict(const string& data)
+RFC2253::RDNSeq
+RFC2253::parseStrict(const string& data)
 {
     RDNSeq results;
     size_t pos = 0;
@@ -104,7 +104,7 @@ IceSSL::RFC2253::parseStrict(const string& data)
 }
 
 string
-IceSSL::RFC2253::unescape(const string& data)
+RFC2253::unescape(const string& data)
 {
     if(data.size() == 0)
     {
@@ -271,7 +271,7 @@ parseAttributeType(const string& data, size_t& pos)
     //
     // Here we must also check for "oid." and "OID." before parsing
     // according to the ALPHA KEYCHAR* rule.
-    // 
+    //
     // First the OID case.
     //
     if(IceUtilInternal::isDigit(data[pos]) ||
@@ -318,7 +318,7 @@ parseAttributeType(const string& data, size_t& pos)
         result += data[pos];
         ++pos;
         // 1* KEYCHAR
-        while(pos < data.size() && 
+        while(pos < data.size() &&
               (IceUtilInternal::isAlpha(data[pos]) || IceUtilInternal::isDigit(data[pos]) || data[pos] == '-'))
         {
             result += data[pos];
@@ -448,7 +448,7 @@ parsePair(const string& data, size_t& pos)
     }
     return parseHexPair(data, pos, false);
 }
-    
+
 //
 // RFC 2253
 // hexpair    = hexchar hexchar
@@ -494,48 +494,3 @@ eatWhite(const string& data, size_t& pos)
         ++pos;
     }
 }
-
-#ifdef never
-void
-print(const list< list<pair<string, string> > >& r)
-{
-    if(r.size() > 1)
-    {
-        cout << "result: " << r.size() << " DNs" << endl;
-    }
-    for(list< list<pair<string, string> > >::const_iterator q = r.begin(); q != r.end(); ++q)
-    {
-        list<pair<string, string> > l = *q;
-        cout << "result: " << l.size() << " RDNs" << endl;
-        for(list<pair<string, string> >::const_iterator p = l.begin(); p != l.end(); ++p)
-        {
-            cout << "\t\"" << p->first << "\"=\"" << p->second << "\"" << endl;
-        }
-    }
-}
-
-int
-main()
-{
-    string examples[] = {
-        "CN=Steve Kille,O=Isode Limited,C=GB",
-        "OU=Sales+CN=J. Smith,O=Widget Inc.,C=US",
-        "CN=L. Eagle,O=Sue\\, Grabbit and Runn,C=GB",
-        "CN=Before\\0DAfter,O=Test,C=GB",
-        "1.3.6.1.4.1.1466.0=#04024869,O=Test,C=GB",
-        "SN=Lu\\C4\\8Di\\C4\\87",
-    };
-    try
-    {
-        for(int i = 0; i < sizeof(examples)/sizeof(examples[0]); ++i)
-        {
-            cout << "string: " << examples[i] << endl;
-            print(RFC2253::parse(examples[i]));
-        }
-    }
-    catch(const RFC2253::ParseException& e)
-    {
-        cout << "error: " << e.reason << endl;
-    }
-}
-#endif

data/ext/ice/cpp/src/IceSSL/RFC2253.h

@@ -1,14 +1,14 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#ifndef ICE_SSL_RFC_2253_H
-#define ICE_SSL_RFC_2253_H
+#ifndef ICESSL_RFC_2253_H
+#define ICESSL_RFC_2253_H
 
 #include <IceUtil/Config.h>
 #include <list>
@@ -33,7 +33,7 @@ namespace RFC2253
 
 typedef std::list< std::pair<std::string, std::string> > RDNSeq;
 
-struct RDNEntry
+struct ICESSL_API RDNEntry
 {
     RDNSeq rdn;
     bool negate;
@@ -46,7 +46,7 @@ typedef std::list<RDNEntry> RDNEntrySeq;
 // The function returns a list of RDNEntry structures. Any failure in
 // parsing results in a ParseException being thrown.
 //
-RDNEntrySeq parse(const std::string&);
+ICESSL_API RDNEntrySeq parse(const std::string&);
 
 //
 // RDNs are separated with ',' and ';'.
@@ -54,12 +54,12 @@ RDNEntrySeq parse(const std::string&);
 // This function returns a list of RDN pairs. Any failure in parsing
 // results in a ParseException being thrown.
 //
-RDNSeq parseStrict(const std::string&);
+ICESSL_API RDNSeq parseStrict(const std::string&);
 
 //
 // Unescape the string.
 //
-std::string unescape(const std::string&);
+ICESSL_API std::string unescape(const std::string&);
 
 }
 }

data/ext/ice/cpp/src/IceSSL/SChannelCertificateI.cpp

@@ -0,0 +1,585 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#include <IceSSL/Plugin.h>
+#include <IceSSL/SChannel.h>
+#include <IceSSL/CertificateI.h>
+#include <IceSSL/Util.h>
+#include <Ice/StringUtil.h>
+#include <Ice/StringConverter.h>
+
+#include <wincrypt.h>
+
+#include <string>
+#include <vector>
+
+using namespace std;
+using namespace Ice;
+using namespace IceSSL;
+
+namespace
+{
+
+class CertInfoHolder : public IceUtil::Shared
+{
+public:
+
+    CertInfoHolder(CERT_INFO* v) : _certInfo(v)
+    {
+    }
+
+    virtual ~CertInfoHolder()
+    {
+        LocalFree(_certInfo);
+    }
+
+private:
+
+    CERT_INFO* _certInfo;
+};
+typedef IceUtil::Handle<CertInfoHolder> CertInfoHolderPtr;
+
+class SCHannelX509ExtensionI : public X509Extension
+{
+
+public:
+
+    SCHannelX509ExtensionI(CERT_EXTENSION , const string&, const CertInfoHolderPtr&);
+    virtual bool isCritical() const;
+    virtual string getOID() const;
+    virtual vector<Ice::Byte> getData() const;
+
+private:
+
+    CERT_EXTENSION _extension;
+    string _oid;
+    CertInfoHolderPtr _certInfo; // Keep a reference on the CERT_INFO struct that holds the extension
+};
+
+class SChannelCertificateI : public SChannel::Certificate,
+                             public CertificateI,
+                             public IceUtil::Mutex
+{
+public:
+
+    SChannelCertificateI(CERT_SIGNED_CONTENT_INFO*);
+    ~SChannelCertificateI();
+
+    virtual bool operator==(const IceSSL::Certificate&) const;
+
+    virtual vector<Ice::Byte> getAuthorityKeyIdentifier() const;
+    virtual vector<Ice::Byte> getSubjectKeyIdentifier() const;
+    virtual bool verify(const CertificatePtr&) const;
+    virtual string encode() const;
+
+#ifdef ICE_CPP11_MAPPING
+    virtual chrono::system_clock::time_point getNotAfter() const;
+    virtual chrono::system_clock::time_point getNotBefore() const;
+#else
+    virtual IceUtil::Time getNotAfter() const;
+    virtual IceUtil::Time getNotBefore() const;
+#endif
+    virtual string getSerialNumber() const;
+    virtual DistinguishedName getIssuerDN() const;
+    virtual vector<pair<int, string> > getIssuerAlternativeNames() const;
+    virtual DistinguishedName getSubjectDN() const;
+    virtual vector<pair<int, string> > getSubjectAlternativeNames() const;
+    virtual int getVersion() const;
+    virtual CERT_SIGNED_CONTENT_INFO* getCert() const;
+
+protected:
+
+    virtual void loadX509Extensions() const;
+
+private:
+
+    CERT_SIGNED_CONTENT_INFO* _cert;
+    CERT_INFO* _certInfo;
+    CertInfoHolderPtr _certInfoHolder;
+};
+
+const Ice::Long TICKS_PER_MSECOND = 10000LL;
+const Ice::Long MSECS_TO_EPOCH = 11644473600000LL;
+
+void
+loadCertificate(PCERT_SIGNED_CONTENT_INFO* cert, const char* buffer, DWORD length)
+{
+    DWORD outLength = length;
+    vector<BYTE> outBuffer;
+    outBuffer.resize(outLength);
+
+    if(!CryptStringToBinary(buffer, length, CRYPT_STRING_BASE64HEADER, &outBuffer[0], &outLength, 0, 0))
+    {
+        //
+        // Base64 data should always be bigger than binary
+        //
+        assert(GetLastError() != ERROR_MORE_DATA);
+        throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+    }
+
+    DWORD decodedLeng = 0;
+    if(!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_CERT, &outBuffer[0], outLength, CRYPT_DECODE_ALLOC_FLAG, 0,
+                            cert, &decodedLeng))
+    {
+        throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+    }
+}
+
+void
+loadCertificate(PCERT_SIGNED_CONTENT_INFO* cert, const string& file)
+{
+    vector<char> buffer;
+    readFile(file, buffer);
+    if(buffer.empty())
+    {
+        throw CertificateReadException(__FILE__, __LINE__, "certificate file " + file + " is empty");
+    }
+    loadCertificate(cert, &buffer[0], static_cast<DWORD>(buffer.size()));
+}
+
+#  ifdef ICE_CPP11_MAPPING
+chrono::system_clock::time_point
+#  else
+IceUtil::Time
+#  endif
+filetimeToTime(FILETIME ftime)
+{
+    Ice::Long value = 0;
+    DWORD* dest = reinterpret_cast<DWORD*>(&value);
+    *dest++ = ftime.dwLowDateTime;
+    *dest = ftime.dwHighDateTime;
+
+    IceUtil::Time time = IceUtil::Time::milliSeconds((value / TICKS_PER_MSECOND) - MSECS_TO_EPOCH);
+
+#  ifdef ICE_CPP11_MAPPING
+    return chrono::system_clock::time_point(chrono::microseconds(time.toMicroSeconds()));
+#  else
+    return time;
+#  endif
+}
+
+string
+certNameToString(CERT_NAME_BLOB* name)
+{
+    assert(name);
+    DWORD length = 0;
+    if(!(length = CertNameToStr(X509_ASN_ENCODING, name, CERT_OID_NAME_STR|CERT_NAME_STR_REVERSE_FLAG, 0, 0)))
+    {
+        throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+    }
+
+    vector<char> buffer(length);
+    if(!CertNameToStr(X509_ASN_ENCODING, name, CERT_OID_NAME_STR|CERT_NAME_STR_REVERSE_FLAG, &buffer[0], length))
+    {
+        throw CertificateEncodingException(__FILE__, __LINE__,  IceUtilInternal::lastErrorToString());
+    }
+
+    string s(&buffer[0]);
+    for(int i = 0; i < certificateOIDSSize; ++i)
+    {
+        const CertificateOID* certificateOID = &certificateOIDS[i];
+        assert(certificateOID);
+        const string name = string(certificateOID->name) + "=";
+        const string alias = string(certificateOID->alias) + "=";
+        size_t pos = 0;
+        while((pos = s.find(name, pos)) != string::npos)
+        {
+            s.replace(pos, name.size(), alias);
+        }
+    }
+    return s;
+}
+
+vector<pair<int, string> >
+certificateAltNames(CERT_INFO* certInfo, LPCSTR altNameOID)
+{
+    vector<pair<int, string> > altNames;
+
+    PCERT_EXTENSION extension = CertFindExtension(altNameOID, certInfo->cExtension, certInfo->rgExtension);
+    if(extension)
+    {
+        CERT_ALT_NAME_INFO* altName;
+        DWORD length = 0;
+        if(!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_ALTERNATE_NAME, extension->Value.pbData,
+                                extension->Value.cbData, CRYPT_DECODE_ALLOC_FLAG, 0, &altName, &length))
+        {
+            throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+        }
+
+        for(DWORD i = 0; i < altName->cAltEntry; ++i)
+        {
+            CERT_ALT_NAME_ENTRY* entry = &altName->rgAltEntry[i];
+
+            switch(entry->dwAltNameChoice)
+            {
+                case CERT_ALT_NAME_RFC822_NAME:
+                {
+                    altNames.push_back(make_pair(AltNameEmail, Ice::wstringToString(entry->pwszRfc822Name)));
+                    break;
+                }
+                case CERT_ALT_NAME_DNS_NAME:
+                {
+                    altNames.push_back(make_pair(AltNameDNS, Ice::wstringToString(entry->pwszDNSName)));
+                    break;
+                }
+                case CERT_ALT_NAME_DIRECTORY_NAME:
+                {
+                    altNames.push_back(make_pair(AltNameDirectory, certNameToString(&entry->DirectoryName)));
+                    break;
+                }
+                case CERT_ALT_NAME_URL:
+                {
+                    altNames.push_back(make_pair(AltNameURL, Ice::wstringToString(entry->pwszURL)));
+                    break;
+                }
+                case CERT_ALT_NAME_IP_ADDRESS:
+                {
+                    if(entry->IPAddress.cbData == 4)
+                    {
+                        //
+                        // IPv4 address
+                        //
+                        ostringstream os;
+                        Byte* src = reinterpret_cast<Byte*>(entry->IPAddress.pbData);
+                        for(int j = 0; j < 4;)
+                        {
+                            int value = 0;
+                            Byte* dest = reinterpret_cast<Byte*>(&value);
+                            *dest = *src++;
+                            os << value;
+                            if(++j < 4)
+                            {
+                                os << ".";
+                            }
+                        }
+                        altNames.push_back(make_pair(AltNAmeIP, os.str()));
+                    }
+                    //
+                    // TODO IPv6 Address support.
+                    //
+                    break;
+                }
+                default:
+                {
+                    // Not supported
+                    break;
+                }
+            }
+        }
+        LocalFree(altName);
+    }
+    return altNames;
+}
+
+} // End anonymous namespace
+
+SCHannelX509ExtensionI::SCHannelX509ExtensionI(CERT_EXTENSION extension, const string& oid, const CertInfoHolderPtr& ci) :
+    _extension(extension),
+    _oid(oid),
+    _certInfo(ci)
+{
+}
+
+bool
+SCHannelX509ExtensionI::isCritical() const
+{
+    return _extension.fCritical != 0;
+}
+
+string
+SCHannelX509ExtensionI::getOID() const
+{
+    return _oid;
+}
+
+vector<Ice::Byte>
+SCHannelX509ExtensionI::getData() const
+{
+    vector<Ice::Byte> data;
+    data.resize(_extension.Value.cbData);
+    memcpy(&data[0], _extension.Value.pbData, _extension.Value.cbData);
+    return data;
+}
+
+SChannelCertificateI::SChannelCertificateI(CERT_SIGNED_CONTENT_INFO* cert) :
+    _cert(cert)
+{
+    if(!_cert)
+    {
+#ifdef ICE_CPP11_MAPPING
+        throw invalid_argument("Invalid certificate reference");
+#else
+        throw IceUtil::IllegalArgumentException(__FILE__, __LINE__, "Invalid certificate reference");
+#endif
+    }
+
+    try
+    {
+        //
+        // Decode certificate info
+        //
+        DWORD length = 0;
+        if(!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_CERT_TO_BE_SIGNED, _cert->ToBeSigned.pbData,
+                                _cert->ToBeSigned.cbData, CRYPT_DECODE_ALLOC_FLAG, 0, &_certInfo, &length))
+        {
+            throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+        }
+        _certInfoHolder = new CertInfoHolder(_certInfo);
+    }
+    catch(...)
+    {
+        LocalFree(_cert);
+        _cert = 0;
+        throw;
+    }
+}
+
+SChannelCertificateI::~SChannelCertificateI()
+{
+    if(_cert)
+    {
+        LocalFree(_cert);
+    }
+}
+
+bool
+SChannelCertificateI::operator==(const IceSSL::Certificate& r) const
+{
+    const SChannelCertificateI* p = dynamic_cast<const SChannelCertificateI*>(&r);
+    if(!p)
+    {
+        return false;
+    }
+
+    return CertCompareCertificate(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, _certInfo, p->_certInfo) != 0;
+}
+
+vector<Ice::Byte>
+SChannelCertificateI::getAuthorityKeyIdentifier() const
+{
+    vector<Ice::Byte> keyid;
+    PCERT_EXTENSION extension = CertFindExtension(szOID_AUTHORITY_KEY_IDENTIFIER2, _certInfo->cExtension,
+                                                  _certInfo->rgExtension);
+    if(extension)
+    {
+        CERT_AUTHORITY_KEY_ID2_INFO* decoded;
+        DWORD length = 0;
+        if(!CryptDecodeObjectEx(X509_ASN_ENCODING, X509_AUTHORITY_KEY_ID2, extension->Value.pbData,
+                                extension->Value.cbData, CRYPT_DECODE_ALLOC_FLAG, 0, &decoded, &length))
+        {
+            throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+        }
+
+        if(decoded->KeyId.pbData && decoded->KeyId.cbData)
+        {
+            keyid.resize(decoded->KeyId.cbData);
+            memcpy(&keyid[0], decoded->KeyId.pbData, decoded->KeyId.cbData);
+            LocalFree(decoded);
+        }
+    }
+    return keyid;
+}
+
+vector<Ice::Byte>
+SChannelCertificateI::getSubjectKeyIdentifier() const
+{
+    vector<Ice::Byte> keyid;
+    PCERT_EXTENSION extension = CertFindExtension(szOID_SUBJECT_KEY_IDENTIFIER, _certInfo->cExtension,
+                                                  _certInfo->rgExtension);
+    if(extension)
+    {
+        CRYPT_DATA_BLOB* decoded;
+        DWORD length = 0;
+        if(!CryptDecodeObjectEx(X509_ASN_ENCODING, szOID_SUBJECT_KEY_IDENTIFIER, extension->Value.pbData,
+                                extension->Value.cbData, CRYPT_DECODE_ALLOC_FLAG, 0, &decoded, &length))
+        {
+            throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+        }
+
+        if(decoded->pbData && decoded->cbData)
+        {
+            keyid.resize(decoded->cbData);
+            memcpy(&keyid[0], decoded->pbData, decoded->cbData);
+            LocalFree(decoded);
+        }
+    }
+    return keyid;
+}
+
+bool
+SChannelCertificateI::verify(const CertificatePtr& cert) const
+{
+    bool result = false;
+    SChannelCertificateI* c = dynamic_cast<SChannelCertificateI*>(cert.get());
+    if(c)
+    {
+        BYTE* buffer = 0;
+        DWORD length = 0;
+        if(!CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT, _cert, CRYPT_ENCODE_ALLOC_FLAG , 0, &buffer, &length))
+        {
+            throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+        }
+        result = CryptVerifyCertificateSignature(0, X509_ASN_ENCODING, buffer, length, &c->_certInfo->SubjectPublicKeyInfo) != 0;
+        LocalFree(buffer);
+    }
+    return result;
+}
+
+string
+SChannelCertificateI::encode() const
+{
+    string s;
+    DWORD length = 0;
+    BYTE* buffer = 0;
+    try
+    {
+        if(!CryptEncodeObjectEx(X509_ASN_ENCODING, X509_CERT, _cert, CRYPT_ENCODE_ALLOC_FLAG , 0, &buffer, &length))
+        {
+            throw CertificateEncodingException(__FILE__, __LINE__,  IceUtilInternal::lastErrorToString());
+        }
+
+        DWORD encodedLength = 0;
+        if(!CryptBinaryToString(buffer, length, CRYPT_STRING_BASE64HEADER | CRYPT_STRING_NOCR, 0, &encodedLength))
+        {
+            throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+        }
+
+        std::vector<char> encoded;
+        encoded.resize(encodedLength);
+        if(!CryptBinaryToString(buffer, length, CRYPT_STRING_BASE64HEADER | CRYPT_STRING_NOCR, &encoded[0],
+                                &encodedLength))
+        {
+            throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+        }
+        LocalFree(buffer);
+        buffer = 0;
+        s.assign(&encoded[0]);
+    }
+    catch(...)
+    {
+        if(buffer)
+        {
+            LocalFree(buffer);
+        }
+        throw;
+    }
+    return s;
+}
+
+#  ifdef ICE_CPP11_MAPPING
+chrono::system_clock::time_point
+#  else
+IceUtil::Time
+#  endif
+SChannelCertificateI::getNotAfter() const
+{
+    return filetimeToTime(_certInfo->NotAfter);
+}
+
+#  ifdef ICE_CPP11_MAPPING
+chrono::system_clock::time_point
+#  else
+IceUtil::Time
+#  endif
+SChannelCertificateI::getNotBefore() const
+{
+    return filetimeToTime(_certInfo->NotBefore);
+}
+
+string
+SChannelCertificateI::getSerialNumber() const
+{
+    ostringstream os;
+    for(int i = _certInfo->SerialNumber.cbData - 1; i >= 0; --i)
+    {
+        unsigned char c = _certInfo->SerialNumber.pbData[i];
+        os.fill('0');
+        os.width(2);
+        os << hex << static_cast<int>(c);
+        if(i)
+        {
+            os << ' ';
+        }
+    }
+    return IceUtilInternal::toUpper(os.str());
+}
+
+DistinguishedName
+SChannelCertificateI::getIssuerDN() const
+{
+    return DistinguishedName(certNameToString(&_certInfo->Issuer));
+}
+
+vector<pair<int, string> >
+SChannelCertificateI::getIssuerAlternativeNames() const
+{
+    return certificateAltNames(_certInfo, szOID_ISSUER_ALT_NAME2);
+}
+
+DistinguishedName
+SChannelCertificateI::getSubjectDN() const
+{
+    return DistinguishedName(certNameToString(&_certInfo->Subject));
+}
+
+vector<pair<int, string> >
+SChannelCertificateI::getSubjectAlternativeNames() const
+{
+    return certificateAltNames(_certInfo, szOID_SUBJECT_ALT_NAME2);
+}
+
+int
+SChannelCertificateI::getVersion() const
+{
+    return _certInfo->dwVersion;
+}
+
+CERT_SIGNED_CONTENT_INFO*
+SChannelCertificateI::getCert() const
+{
+    return _cert;
+}
+
+void
+SChannelCertificateI::loadX509Extensions() const
+{
+    IceUtil::Mutex::Lock sync(*this);
+    if(_extensions.empty())
+    {
+        for(size_t i = 0; i < _certInfo->cExtension; ++i)
+        {
+            CERT_EXTENSION ext = _certInfo->rgExtension[i];
+            _extensions.push_back(ICE_DYNAMIC_CAST(X509Extension,
+                ICE_MAKE_SHARED(SCHannelX509ExtensionI, ext, ext.pszObjId,
+                _certInfoHolder)));
+        }
+    }
+}
+
+SChannel::CertificatePtr
+SChannel::Certificate::create(CERT_SIGNED_CONTENT_INFO* cert)
+{
+    return ICE_MAKE_SHARED(SChannelCertificateI, cert);
+}
+
+SChannel::CertificatePtr
+SChannel::Certificate::load(const std::string& file)
+{
+    CERT_SIGNED_CONTENT_INFO* cert;
+    loadCertificate(&cert, file);
+    return ICE_MAKE_SHARED(SChannelCertificateI, cert);
+}
+
+SChannel::CertificatePtr
+SChannel::Certificate::decode(const std::string& encoding)
+{
+    CERT_SIGNED_CONTENT_INFO* cert;
+    loadCertificate(&cert, encoding.c_str(), static_cast<DWORD>(encoding.size()));
+    return ICE_MAKE_SHARED(SChannelCertificateI, cert);
+}