zeroc-ice 3.6.5 → 3.7.0

data/ext/ice/cpp/src/IceSSL/SChannelEngine.h

@@ -0,0 +1,126 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#ifndef ICESSL_SCHANNEL_ENGINE_H
+#define ICESSL_SCHANNEL_ENGINE_H
+
+#include <IceSSL/SSLEngine.h>
+#include <IceSSL/SChannelEngineF.h>
+
+//
+// SECURITY_WIN32 or SECURITY_KERNEL, must be defined before including security.h
+// indicating who is compiling the code.
+//
+#  ifdef SECURITY_WIN32
+#    undef SECURITY_WIN32
+#  endif
+#  ifdef SECURITY_KERNEL
+#    undef SECURITY_KERNEL
+#  endif
+#  define SECURITY_WIN32 1
+#  include <security.h>
+#  include <sspi.h>
+#  include <schannel.h>
+#  undef SECURITY_WIN32
+
+#if defined(__MINGW32__) || (defined(_MSC_VER) && (_MSC_VER <= 1500))
+
+//
+// Add some definitions missing from MinGW headers.
+//
+
+#   ifndef CERT_TRUST_IS_EXPLICIT_DISTRUST
+#      define CERT_TRUST_IS_EXPLICIT_DISTRUST 0x04000000
+#   endif
+
+#   ifndef CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT
+#      define CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT 0x08000000
+#   endif
+
+#   ifndef SECBUFFER_ALERT
+#      define SECBUFFER_ALERT 17
+#   endif
+
+#   ifndef SCH_SEND_ROOT_CERT
+#      define SCH_SEND_ROOT_CERT 0x00040000
+#   endif
+
+#   ifndef SP_PROT_TLS1_1_SERVER
+#      define SP_PROT_TLS1_1_SERVER 0x00000100
+#   endif
+
+#   ifndef SP_PROT_TLS1_1_CLIENT
+#      define SP_PROT_TLS1_1_CLIENT 0x00000200
+#   endif
+
+#   ifndef SP_PROT_TLS1_2_SERVER
+#      define SP_PROT_TLS1_2_SERVER 0x00000400
+#   endif
+
+#   ifndef SP_PROT_TLS1_2_CLIENT
+#      define SP_PROT_TLS1_2_CLIENT 0x00000800
+#   endif
+
+#endif
+
+namespace IceSSL
+{
+
+namespace SChannel
+{
+
+class SSLEngine : public IceSSL::SSLEngine
+{
+public:
+
+    SSLEngine(const Ice::CommunicatorPtr&);
+
+    //
+    // Setup the engine.
+    //
+    virtual void initialize();
+
+    virtual IceInternal::TransceiverPtr
+    createTransceiver(const InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool);
+
+    //
+    // Destroy the engine.
+    //
+    virtual void destroy();
+
+    virtual void verifyPeer(const std::string&, const ConnectionInfoPtr&, const std::string&);
+
+    std::string getCipherName(ALG_ID) const;
+
+    CredHandle newCredentialsHandle(bool);
+
+    HCERTCHAINENGINE chainEngine() const;
+
+private:
+
+    void parseCiphers(const std::string&);
+
+    std::vector<PCCERT_CONTEXT> _allCerts;
+    std::vector<PCCERT_CONTEXT> _importedCerts;
+    DWORD _protocols;
+
+    std::vector<HCERTSTORE> _stores;
+    HCERTSTORE _rootStore;
+
+    HCERTCHAINENGINE _chainEngine;
+    std::vector<ALG_ID> _ciphers;
+
+    const bool _strongCrypto;
+};
+
+}
+
+}
+
+#endif

data/ext/ice/cpp/src/IceSSL/SChannelEngineF.h

@@ -0,0 +1,32 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#ifndef ICESSL_SCHANNEL_ENGINE_F_H
+#define ICESSL_SCHANNEL_ENGINE_F_H
+
+#include <IceUtil/Shared.h>
+#include <Ice/Handle.h>
+
+#include <IceSSL/SChannel.h>
+
+namespace IceSSL
+{
+
+namespace SChannel
+{
+
+class SSLEngine;
+ICESSL_API IceUtil::Shared* upCast(SSLEngine*);
+typedef IceInternal::Handle<SSLEngine> SSLEnginePtr;
+
+}
+
+}
+
+#endif

data/ext/ice/cpp/src/IceSSL/SChannelPluginI.cpp

@@ -0,0 +1,78 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#include <IceSSL/PluginI.h>
+#include <IceSSL/SChannelEngine.h>
+
+#include <Ice/Initialize.h>
+
+using namespace std;
+
+namespace
+{
+
+class PluginI : public IceSSL::PluginI
+{
+public:
+
+    PluginI(const Ice::CommunicatorPtr&);
+
+    virtual IceSSL::CertificatePtr create(CERT_SIGNED_CONTENT_INFO*) const;
+    virtual IceSSL::CertificatePtr load(const std::string&) const;
+    virtual IceSSL::CertificatePtr decode(const std::string&) const;
+};
+
+} // anonymous namespace end
+
+//
+// Plugin implementation.
+//
+PluginI::PluginI(const Ice::CommunicatorPtr& com) :
+    IceSSL::PluginI(com, new IceSSL::SChannel::SSLEngine(com))
+{
+}
+
+IceSSL::CertificatePtr
+PluginI::create(CERT_SIGNED_CONTENT_INFO* cert) const
+{
+    return IceSSL::SChannel::Certificate::create(cert);
+}
+
+IceSSL::CertificatePtr
+PluginI::load(const std::string& file) const
+{
+    return IceSSL::SChannel::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+PluginI::decode(const std::string& encoding) const
+{
+    return IceSSL::SChannel::Certificate::load(encoding);
+}
+
+//
+// Plug-in factory function.
+//
+extern "C" ICESSL_API Ice::Plugin*
+createIceSSL(const Ice::CommunicatorPtr& communicator, const string& /*name*/, const Ice::StringSeq& /*args*/)
+{
+    return new PluginI(communicator);
+}
+
+IceSSL::CertificatePtr
+IceSSL::Certificate::load(const std::string& file)
+{
+    return IceSSL::SChannel::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+IceSSL::Certificate::decode(const std::string& encoding)
+{
+    return IceSSL::SChannel::Certificate::decode(encoding);
+}

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -13,15 +13,13 @@
 
 #include <IceSSL/ConnectionInfo.h>
 #include <IceSSL/Instance.h>
-#include <IceSSL/SSLEngine.h>
+#include <IceSSL/SChannelEngine.h>
 #include <IceSSL/Util.h>
 #include <Ice/Communicator.h>
 #include <Ice/LoggerUtil.h>
 #include <Ice/Buffer.h>
 #include <Ice/LocalException.h>
 
-#ifdef ICE_USE_SCHANNEL
-
 using namespace std;
 using namespace Ice;
 using namespace IceSSL;
@@ -203,16 +201,22 @@ getSecBufferWithType(const SecBufferDesc& desc, ULONG bufferType)
     return 0;
 }
 
+string
+secStatusToString(SECURITY_STATUS status)
+{
+    return IceUtilInternal::errorToString(status);
+}
+
 }
 
 IceInternal::NativeInfoPtr
-IceSSL::TransceiverI::getNativeInfo()
+SChannel::TransceiverI::getNativeInfo()
 {
-    return _stream;
+    return _delegate->getNativeInfo();
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::sslHandshake()
+SChannel::TransceiverI::sslHandshake()
 {
     DWORD flags = ASC_REQ_SEQUENCE_DETECT | ASC_REQ_REPLAY_DETECT | ASC_REQ_CONFIDENTIALITY | ASC_REQ_ALLOCATE_MEMORY |
         ASC_REQ_STREAM;
@@ -247,8 +251,7 @@ IceSSL::TransceiverI::sslHandshake()
                                             &_ssl, &outBufferDesc, &ctxFlags, 0);
             if(err != SEC_E_OK && err != SEC_I_CONTINUE_NEEDED)
             {
-                throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" +
-                                        IceUtilInternal::lastErrorToString());
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + secStatusToString(err));
             }
             _sslInitialized = true;
 
@@ -312,14 +315,13 @@ IceSSL::TransceiverI::sslHandshake()
             {
                 SecBuffer* missing = getSecBufferWithType(inBufferDesc, SECBUFFER_MISSING);
                 size_t pos = _readBuffer.i - _readBuffer.b.begin();
-                _readBuffer.b.resize((missing && missing->cbBuffer > 0) ? (pos + missing->cbBuffer) : (pos * 2));
+                _readBuffer.b.resize(missing ? (pos + missing->cbBuffer) : (pos * 2));
                 _readBuffer.i = _readBuffer.b.begin() + pos;
                 return IceInternal::SocketOperationRead;
             }
             else if(err != SEC_I_CONTINUE_NEEDED && err != SEC_E_OK)
             {
-                throw SecurityException(__FILE__, __LINE__, "SSL handshake failure:\n" +
-                                        IceUtilInternal::lastErrorToString());
+                throw SecurityException(__FILE__, __LINE__, "SSL handshake failure:\n" + secStatusToString(err));
             }
 
             //
@@ -359,7 +361,7 @@ IceSSL::TransceiverI::sslHandshake()
                 break; // We're done.
             }
 
-	    // Otherwise continue either reading credentials
+            // Otherwise continue either reading credentials
         }
 
         if(_state == StateHandshakeWriteContinue)
@@ -455,7 +457,7 @@ IceSSL::TransceiverI::sslHandshake()
     if(err != SEC_E_OK)
     {
         throw SecurityException(__FILE__, __LINE__, "IceSSL: failure to query stream sizes attributes:\n" +
-                                IceUtilInternal::lastErrorToString());
+                                secStatusToString(err));
     }
 
     size_t pos = _readBuffer.i - _readBuffer.b.begin();
@@ -477,7 +479,7 @@ IceSSL::TransceiverI::sslHandshake()
 // data before it can decrypt the complete message.
 //
 size_t
-IceSSL::TransceiverI::decryptMessage(IceInternal::Buffer& buffer)
+SChannel::TransceiverI::decryptMessage(IceInternal::Buffer& buffer)
 {
     assert(_readBuffer.i != _readBuffer.b.begin() || !_readUnprocessed.b.empty());
 
@@ -538,7 +540,7 @@ IceSSL::TransceiverI::decryptMessage(IceInternal::Buffer& buffer)
         else if(err != SEC_E_OK)
         {
             throw ProtocolException(__FILE__, __LINE__, "IceSSL: protocol error during read:\n" +
-                                    IceUtilInternal::lastErrorToString());
+                                    secStatusToString(err));
         }
 
         SecBuffer* dataBuffer = getSecBufferWithType(inBufferDesc, SECBUFFER_DATA);
@@ -582,7 +584,7 @@ IceSSL::TransceiverI::decryptMessage(IceInternal::Buffer& buffer)
 // number of bytes is less than the message size, the function must be called again.
 //
 size_t
-IceSSL::TransceiverI::encryptMessage(IceInternal::Buffer& buffer)
+SChannel::TransceiverI::encryptMessage(IceInternal::Buffer& buffer)
 {
     //
     // Limit the message size to cbMaximumMessage which is the maximun size data that can be
@@ -611,7 +613,7 @@ IceSSL::TransceiverI::encryptMessage(IceInternal::Buffer& buffer)
     if(err != SEC_E_OK)
     {
         throw ProtocolException(__FILE__, __LINE__, "IceSSL: protocol error encrypting message:\n" +
-                                IceUtilInternal::lastErrorToString());
+                                secStatusToString(err));
     }
 
     // EncryptMessage resizes the buffers, so resize the write buffer as well to reflect this.
@@ -622,15 +624,19 @@ IceSSL::TransceiverI::encryptMessage(IceInternal::Buffer& buffer)
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer, bool& hasMoreData)
+SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer)
 {
-    IceInternal::SocketOperation op = _stream->connect(readBuffer, writeBuffer);
-    if(op != IceInternal::SocketOperationNone)
+    if(_state == StateNotInitialized)
     {
-        return op;
+        IceInternal::SocketOperation op = _delegate->initialize(readBuffer, writeBuffer);
+        if(op != IceInternal::SocketOperationNone)
+        {
+            return op;
+        }
+        _state = StateHandshakeNotStarted;
     }
 
-    op = sslHandshake();
+    IceInternal::SocketOperation op = sslHandshake();
     if(op != IceInternal::SocketOperationNone)
     {
         return op;
@@ -643,8 +649,8 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
     SECURITY_STATUS err = QueryContextAttributes(&_ssl, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &cert);
     if(err && err != SEC_E_NO_CREDENTIALS)
     {
-        throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate verification failure:" +
-                                IceUtilInternal::lastErrorToString());
+        throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate verification failure:\n" +
+                                secStatusToString(err));
     }
 
     if(!cert && ((!_incoming && _engine->getVerifyPeer() > 0) || (_incoming && _engine->getVerifyPeer() == 2)))
@@ -653,8 +659,7 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         // Clients require server certificate if VerifyPeer > 0 and servers require client
         // certificate if VerifyPeer == 2
         //
-        throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate required:" +
-                                IceUtilInternal::lastErrorToString());
+        throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate required");
     }
     else if(cert) // Verify the remote certificate
     {
@@ -682,6 +687,26 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
                 _verified = true;
             }
 
+            CERT_SIMPLE_CHAIN* simpleChain = certChain->rgpChain[0];
+            for(DWORD i = 0; i < simpleChain->cElement; ++i)
+            {
+                PCCERT_CONTEXT c = simpleChain->rgpElement[i]->pCertContext;
+                PCERT_SIGNED_CONTENT_INFO cc;
+
+                DWORD length = 0;
+                if(!CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, X509_CERT, c->pbCertEncoded,
+                                        c->cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, 0, &cc, &length))
+                {
+                    CertFreeCertificateChain(certChain);
+                    CertFreeCertificateContext(cert);
+                    throw SecurityException(__FILE__, __LINE__,
+                                            "IceSSL: error decoding peer certificate chain:\n" +
+                                            IceUtilInternal::lastErrorToString());
+                }
+
+                _certs.push_back(SChannel::Certificate::create(cc));
+            }
+
             CertFreeCertificateChain(certChain);
             CertFreeCertificateContext(cert);
             if(!trustError.empty())
@@ -696,13 +721,13 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
                 if(_instance->traceLevel() >= 1)
                 {
                     _instance->logger()->trace(_instance->traceCategory(),
-                                               "IceSSL: ignoring certificate verification failure\n" + reason);
+                                               "IceSSL: ignoring certificate verification failure:\n" + reason);
                 }
             }
             else
             {
                 ostringstream os;
-                os << "IceSSL: certificate verification failure\n" << reason;
+                os << "IceSSL: certificate verification failure:\n" << reason;
                 string msg = os.str();
                 if(_instance->traceLevel() >= 1)
                 {
@@ -713,7 +738,18 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         }
     }
 
-    _engine->verifyPeer(_stream->fd(), _host, NativeConnectionInfoPtr::dynamicCast(getInfo()));
+    SecPkgContext_ConnectionInfo connInfo;
+    err = QueryContextAttributes(&_ssl, SECPKG_ATTR_CONNECTION_INFO, &connInfo);
+    if(err == SEC_E_OK)
+    {
+        _cipher = _engine->getCipherName(connInfo.aiCipher);
+    }
+    else
+    {
+        throw SecurityException(__FILE__, __LINE__, "IceSSL: error reading cipher info:\n" + secStatusToString(err));
+    }
+
+    _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString());
     _state = StateHandshakeComplete;
 
     if(_instance->engine()->securityTraceLevel() >= 1)
@@ -744,12 +780,13 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         }
         out << toString();
     }
-    hasMoreData = !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin();
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead,
+                                      !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin());
     return IceInternal::SocketOperationNone;
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
+SChannel::TransceiverI::closing(bool initiator, const Ice::LocalException&)
 {
     // If we are initiating the connection closure, wait for the peer
     // to close the TCP/IP connection. Otherwise, close immediately.
@@ -757,7 +794,7 @@ IceSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
 }
 
 void
-IceSSL::TransceiverI::close()
+SChannel::TransceiverI::close()
 {
     if(_sslInitialized)
     {
@@ -771,7 +808,7 @@ IceSSL::TransceiverI::close()
         _credentialsInitialized = false;
     }
 
-    _stream->close();
+    _delegate->close();
 
     //
     // Clear the buffers now instead of waiting for destruction.
@@ -782,11 +819,11 @@ IceSSL::TransceiverI::close()
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
+SChannel::TransceiverI::write(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        return _stream->write(buf);
+        return _delegate->write(buf);
     }
 
     if(buf.i == buf.b.end())
@@ -817,11 +854,11 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
+SChannel::TransceiverI::read(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        return _stream->read(buf);
+        return _delegate->read(buf);
     }
 
     if(buf.i == buf.b.end())
@@ -830,7 +867,7 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
     }
     assert(_state == StateHandshakeComplete);
 
-    hasMoreData = false;
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, false);
     while(buf.i != buf.b.end())
     {
         if(_readUnprocessed.b.empty() && _readBuffer.i == _readBuffer.b.begin() && !readRaw(_readBuffer))
@@ -850,18 +887,19 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
 
         buf.i += decrypted;
     }
-    hasMoreData = !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin();
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead,
+                                      !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin());
     return IceInternal::SocketOperationNone;
 }
 
 #ifdef ICE_USE_IOCP
 
 bool
-IceSSL::TransceiverI::startWrite(IceInternal::Buffer& buffer)
+SChannel::TransceiverI::startWrite(IceInternal::Buffer& buffer)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        return _stream->startWrite(buffer);
+        return _delegate->startWrite(buffer);
     }
 
     if(_state == StateHandshakeComplete && _bufferedW == 0)
@@ -870,19 +908,19 @@ IceSSL::TransceiverI::startWrite(IceInternal::Buffer& buffer)
         _bufferedW = encryptMessage(buffer);
     }
 
-    return _stream->startWrite(_writeBuffer);
+    return _delegate->startWrite(_writeBuffer) && _bufferedW == (buffer.b.end() - buffer.i);
 }
 
 void
-IceSSL::TransceiverI::finishWrite(IceInternal::Buffer& buf)
+SChannel::TransceiverI::finishWrite(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        _stream->finishWrite(buf);
+        _delegate->finishWrite(buf);
         return;
     }
 
-    _stream->finishWrite(_writeBuffer);
+    _delegate->finishWrite(_writeBuffer);
     if(_writeBuffer.i != _writeBuffer.b.end())
     {
         return; // We're not finished yet with writing the write buffer.
@@ -896,99 +934,96 @@ IceSSL::TransceiverI::finishWrite(IceInternal::Buffer& buf)
 }
 
 void
-IceSSL::TransceiverI::startRead(IceInternal::Buffer& buffer)
+SChannel::TransceiverI::startRead(IceInternal::Buffer& buffer)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        _stream->startRead(buffer);
+        _delegate->startRead(buffer);
         return;
     }
-    _stream->startRead(_readBuffer);
+    _delegate->startRead(_readBuffer);
 }
 
 void
-IceSSL::TransceiverI::finishRead(IceInternal::Buffer& buf, bool& hasMoreData)
+SChannel::TransceiverI::finishRead(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        _stream->finishRead(buf);
+        _delegate->finishRead(buf);
         return;
     }
 
-    _stream->finishRead(_readBuffer);
+    _delegate->finishRead(_readBuffer);
     if(_state == StateHandshakeComplete)
     {
         size_t decrypted = decryptMessage(buf);
         if(decrypted > 0)
         {
             buf.i += decrypted;
-            hasMoreData = !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin();
+            _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead,
+                                              !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin());
         }
         else
         {
-            hasMoreData = false;
+            _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, false);
         }
     }
 }
 #endif
 
 string
-IceSSL::TransceiverI::protocol() const
+SChannel::TransceiverI::protocol() const
 {
     return _instance->protocol();
 }
 
 string
-IceSSL::TransceiverI::toString() const
+SChannel::TransceiverI::toString() const
 {
-    return _stream->toString();
+    return _delegate->toString();
 }
 
 string
-IceSSL::TransceiverI::toDetailedString() const
+SChannel::TransceiverI::toDetailedString() const
 {
     return toString();
 }
 
 Ice::ConnectionInfoPtr
-IceSSL::TransceiverI::getInfo() const
-{
-    NativeConnectionInfoPtr info = new NativeConnectionInfo();
-    fillConnectionInfo(info, info->nativeCerts);
-    return info;
-}
-
-Ice::ConnectionInfoPtr
-IceSSL::TransceiverI::getWSInfo(const Ice::HeaderDict& headers) const
+SChannel::TransceiverI::getInfo() const
 {
-    WSSNativeConnectionInfoPtr info = new WSSNativeConnectionInfo();
-    fillConnectionInfo(info, info->nativeCerts);
-    info->headers = headers;
+    ConnectionInfoPtr info = ICE_MAKE_SHARED(ConnectionInfo);
+    info->underlying = _delegate->getInfo();
+    info->incoming = _incoming;
+    info->adapterName = _adapterName;
+    info->cipher = _cipher;
+    info->certs = _certs;
+    info->verified = _verified;
     return info;
 }
 
 void
-IceSSL::TransceiverI::checkSendSize(const IceInternal::Buffer&)
+SChannel::TransceiverI::checkSendSize(const IceInternal::Buffer&)
 {
 }
 
 void
-IceSSL::TransceiverI::setBufferSize(int rcvSize, int sndSize)
+SChannel::TransceiverI::setBufferSize(int rcvSize, int sndSize)
 {
-    _stream->setBufferSize(rcvSize, sndSize);
+    _delegate->setBufferSize(rcvSize, sndSize);
 }
 
-IceSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
-                                   const IceInternal::StreamSocketPtr& stream,
+SChannel::TransceiverI::TransceiverI(const InstancePtr& instance,
+                                   const IceInternal::TransceiverPtr& delegate,
                                    const string& hostOrAdapterName,
                                    bool incoming) :
     _instance(instance),
-    _engine(SChannelEnginePtr::dynamicCast(instance->engine())),
+    _engine(SChannel::SSLEnginePtr::dynamicCast(instance->engine())),
     _host(incoming ? "" : hostOrAdapterName),
     _adapterName(incoming ? hostOrAdapterName : ""),
     _incoming(incoming),
-    _stream(stream),
-    _state(StateHandshakeNotStarted),
+    _delegate(delegate),
+    _state(StateNotInitialized),
     _bufferedW(0),
     _sslInitialized(false),
     _credentialsInitialized(false),
@@ -996,99 +1031,21 @@ IceSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
 {
 }
 
-IceSSL::TransceiverI::~TransceiverI()
+SChannel::TransceiverI::~TransceiverI()
 {
 }
 
-void
-IceSSL::TransceiverI::fillConnectionInfo(const ConnectionInfoPtr& info, vector<CertificatePtr>& nativeCerts) const
-{
-    IceInternal::fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress,
-                                    info->remotePort);
-    if(_stream->fd() != INVALID_SOCKET)
-    {
-        info->rcvSize = IceInternal::getRecvBufferSize(_stream->fd());
-        info->sndSize = IceInternal::getSendBufferSize(_stream->fd());
-    }
-
-    info->verified = _verified;
-
-    if(_sslInitialized)
-    {
-        CtxtHandle* ssl = const_cast<CtxtHandle*>(&_ssl);
-        PCCERT_CONTEXT cert = 0;
-        PCCERT_CHAIN_CONTEXT certChain = 0;
-        SECURITY_STATUS err = QueryContextAttributes(ssl, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &cert);
-        if(err == SEC_E_OK)
-        {
-            assert(cert);
-            CERT_CHAIN_PARA chainP;
-            memset(&chainP, 0, sizeof(chainP));
-            chainP.cbSize = sizeof(chainP);
-
-            if(CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
-                                       CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
-            {
-                CERT_SIMPLE_CHAIN* simpleChain = certChain->rgpChain[0];
-                for(DWORD i = 0; i < simpleChain->cElement; ++i)
-                {
-                    PCCERT_CONTEXT c = simpleChain->rgpElement[i]->pCertContext;
-                    PCERT_SIGNED_CONTENT_INFO cc;
-
-                    DWORD length = 0;
-                    if(!CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, X509_CERT, c->pbCertEncoded,
-                                            c->cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, 0, &cc, &length))
-                    {
-                        CertFreeCertificateChain(certChain);
-                        CertFreeCertificateContext(cert);
-                        throw SecurityException(__FILE__, __LINE__,
-                                                "IceSSL: error decoding peer certificate chain:\n" +
-                                                IceUtilInternal::lastErrorToString());
-                    }
-
-                    CertificatePtr certificate = new Certificate(cc);
-                    nativeCerts.push_back(certificate);
-                    info->certs.push_back(certificate->encode());
-                }
-                CertFreeCertificateChain(certChain);
-            }
-            CertFreeCertificateContext(cert);
-        }
-        else if(err != SEC_E_NO_CREDENTIALS)
-        {
-            throw SecurityException(__FILE__, __LINE__, "IceSSL: error reading peer certificate:" +
-                                    IceUtilInternal::lastErrorToString());
-        }
-
-        SecPkgContext_ConnectionInfo connInfo;
-        if(QueryContextAttributes(ssl, SECPKG_ATTR_CONNECTION_INFO, &connInfo) == SEC_E_OK)
-        {
-            info->cipher = _engine->getCipherName(connInfo.aiCipher);
-        }
-        else
-        {
-            throw SecurityException(__FILE__, __LINE__, "IceSSL: error reading cipher info:" +
-                                    IceUtilInternal::lastErrorToString());
-        }
-    }
-
-    info->adapterName = _adapterName;
-    info->incoming = _incoming;
-}
-
 bool
-IceSSL::TransceiverI::writeRaw(IceInternal::Buffer& buf)
+SChannel::TransceiverI::writeRaw(IceInternal::Buffer& buf)
 {
-    ssize_t ret = _stream->write(reinterpret_cast<const char*>(&*buf.i), buf.b.end() - buf.i);
-    buf.i += ret;
+    _delegate->write(buf);
     return buf.i == buf.b.end();
 }
 
 bool
-IceSSL::TransceiverI::readRaw(IceInternal::Buffer& buf)
+SChannel::TransceiverI::readRaw(IceInternal::Buffer& buf)
 {
-    ssize_t ret = _stream->read(reinterpret_cast<char*>(&*buf.i), buf.b.end() - buf.i);
-    buf.i += ret;
-    return ret > 0;
+    IceInternal::Buffer::Container::iterator p = buf.i;
+    _delegate->read(buf);
+    return buf.i != p;
 }
-#endif