zeroc-ice 3.6.5 → 3.7.0

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.h

@@ -1,19 +1,19 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#ifndef ICE_SSL_SCHANNELTRANSCEIVER_I_H
-#define ICE_SSL_SCHANNELTRANSCEIVER_I_H
+#ifndef ICESSL_SCHANNELTRANSCEIVER_I_H
+#define ICESSL_SCHANNELTRANSCEIVER_I_H
 
 #include <IceSSL/Config.h>
 #include <IceSSL/InstanceF.h>
 #include <IceSSL/Plugin.h>
-#include <IceSSL/SSLEngineF.h>
+#include <IceSSL/SChannelEngineF.h>
 
 #include <Ice/Transceiver.h>
 #include <Ice/Network.h>
@@ -21,8 +21,6 @@
 #include <Ice/StreamSocket.h>
 #include <Ice/WSTransceiver.h>
 
-#ifdef ICE_USE_SCHANNEL
-
 #ifdef SECURITY_WIN32
 #  undef SECURITY_WIN32
 #endif
@@ -40,41 +38,38 @@
 namespace IceSSL
 {
 
-class ConnectorI;
-class AcceptorI;
+namespace SChannel
+{
 
-class TransceiverI : public IceInternal::Transceiver, public IceInternal::WSTransceiverDelegate
+class TransceiverI : public IceInternal::Transceiver
 {
 public:
 
     virtual IceInternal::NativeInfoPtr getNativeInfo();
 
-    virtual IceInternal::SocketOperation initialize(IceInternal::Buffer&, IceInternal::Buffer&, bool&);
+    virtual IceInternal::SocketOperation initialize(IceInternal::Buffer&, IceInternal::Buffer&);
     virtual IceInternal::SocketOperation closing(bool, const Ice::LocalException&);
     virtual void close();
     virtual IceInternal::SocketOperation write(IceInternal::Buffer&);
-    virtual IceInternal::SocketOperation read(IceInternal::Buffer&, bool&);
+    virtual IceInternal::SocketOperation read(IceInternal::Buffer&);
 #ifdef ICE_USE_IOCP
     virtual bool startWrite(IceInternal::Buffer&);
     virtual void finishWrite(IceInternal::Buffer&);
     virtual void startRead(IceInternal::Buffer&);
-    virtual void finishRead(IceInternal::Buffer&, bool&);
+    virtual void finishRead(IceInternal::Buffer&);
 #endif
     virtual std::string protocol() const;
     virtual std::string toString() const;
     virtual std::string toDetailedString() const;
     virtual Ice::ConnectionInfoPtr getInfo() const;
-    virtual Ice::ConnectionInfoPtr getWSInfo(const Ice::HeaderDict&) const;
     virtual void checkSendSize(const IceInternal::Buffer&);
     virtual void setBufferSize(int rcvSize, int sndSize);
 
 private:
 
-    TransceiverI(const InstancePtr&, const IceInternal::StreamSocketPtr&, const std::string&, bool);
+    TransceiverI(const InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool);
     virtual ~TransceiverI();
 
-    void fillConnectionInfo(const ConnectionInfoPtr&, std::vector<CertificatePtr>&) const;
-
     IceInternal::SocketOperation sslHandshake();
 
     size_t decryptMessage(IceInternal::Buffer&);
@@ -83,11 +78,11 @@ private:
     bool writeRaw(IceInternal::Buffer&);
     bool readRaw(IceInternal::Buffer&);
 
-    friend class ConnectorI;
-    friend class AcceptorI;
+    friend class IceSSL::SChannel::SSLEngine;
 
     enum State
     {
+        StateNotInitialized,
         StateHandshakeNotStarted,
         StateHandshakeReadContinue,
         StateHandshakeWriteContinue,
@@ -95,11 +90,11 @@ private:
     };
 
     const InstancePtr _instance;
-    const SChannelEnginePtr _engine;
+    const IceSSL::SChannel::SSLEnginePtr _engine;
     const std::string _host;
     const std::string _adapterName;
     const bool _incoming;
-    const IceInternal::StreamSocketPtr _stream;
+    const IceInternal::TransceiverPtr _delegate;
     State _state;
 
     //
@@ -123,12 +118,14 @@ private:
     CredHandle _credentials;
     bool _credentialsInitialized;
     SecPkgContext_StreamSizes _sizes;
+    std::string _cipher;
+    std::vector<IceSSL::CertificatePtr> _certs;
     bool _verified;
 };
 typedef IceUtil::Handle<TransceiverI> TransceiverIPtr;
 
-}
+} // SChannel namespace end
 
-#endif
+} // IceSSL namespace end
 
 #endif

data/ext/ice/cpp/src/IceSSL/SSLEngine.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -9,6 +9,7 @@
 
 #include <IceSSL/SSLEngine.h>
 #include <IceSSL/TrustManager.h>
+#include <IceSSL/ConnectionInfo.h>
 
 #include <IceUtil/StringUtil.h>
 
@@ -22,11 +23,13 @@
 
 using namespace std;
 using namespace Ice;
+using namespace IceUtil;
 using namespace IceSSL;
 
 IceUtil::Shared* IceSSL::upCast(IceSSL::SSLEngine* p) { return p; }
 
 IceSSL::SSLEngine::SSLEngine(const Ice::CommunicatorPtr& communicator) :
+    _initialized(false),
     _communicator(communicator),
     _logger(communicator->getLogger()),
     _trustManager(new TrustManager(communicator))
@@ -80,6 +83,13 @@ IceSSL::SSLEngine::password(bool /*encrypting*/)
     }
 }
 
+bool
+IceSSL::SSLEngine::initialized() const
+{
+    Mutex::Lock lock(_mutex);
+    return _initialized;
+}
+
 string
 IceSSL::SSLEngine::getPassword() const
 {
@@ -115,30 +125,29 @@ IceSSL::SSLEngine::initialize()
     // VerifyPeer determines whether certificate validation failures abort a connection.
     //
     _verifyPeer = properties->getPropertyAsIntWithDefault(propPrefix + "VerifyPeer", 2);
-    
+
     if(_verifyPeer < 0 || _verifyPeer > 2)
     {
         PluginInitializationException ex(__FILE__, __LINE__);
         ex.reason = "IceSSL: invalid value for " + propPrefix + "VerifyPeer";
         throw ex;
     }
-    
+
     _securityTraceLevel = properties->getPropertyAsInt("IceSSL.Trace.Security");
     _securityTraceCategory = "Security";
 }
 
 void
-IceSSL::SSLEngine::verifyPeer(SOCKET fd, const string& address, const NativeConnectionInfoPtr& info)
+IceSSL::SSLEngine::verifyPeerCertName(const string& address, const ConnectionInfoPtr& info)
 {
-    const CertificateVerifierPtr verifier = getCertificateVerifier();
-    
     //
     // For an outgoing connection, we compare the proxy address (if any) against
     // fields in the server's certificate (if any).
     //
-    if(!info->nativeCerts.empty() && !address.empty())
+    if(_checkCertName && !info->certs.empty() && !address.empty())
     {
-        const CertificatePtr cert = info->nativeCerts[0];
+        const CertificatePtr cert = info->certs[0];
+
         //
         // Extract the IP addresses and the DNS names from the subject
         // alternative names.
@@ -158,89 +167,56 @@ IceSSL::SSLEngine::verifyPeer(SOCKET fd, const string& address, const NativeConn
             }
         }
 
-        //
-        // Compare the peer's address against the common name.
-        //
         bool certNameOK = false;
-        string dn;
         string addrLower = IceUtilInternal::toLower(address);
-        {
-            DistinguishedName d = cert->getSubjectDN();
-            dn = IceUtilInternal::toLower(string(d));
-            string cn = "cn=" + addrLower;
-            string::size_type pos = dn.find(cn);
-            if(pos != string::npos)
-            {
-                //
-                // Ensure we match the entire common name.
-                //
-                certNameOK = (pos + cn.size() == dn.size()) || (dn[pos + cn.size()] == ',');
-            }
-        }
+        bool isIpAddress = IceInternal::isIpAddress(address);
 
         //
-        // Compare the peer's address against the dnsName and ipAddress
-        // values in the subject alternative name.
+        // If address is an IP address, compare it to the subject alternative names IP adddress
         //
-        if(!certNameOK)
+        if(isIpAddress)
         {
             certNameOK = find(ipAddresses.begin(), ipAddresses.end(), addrLower) != ipAddresses.end();
         }
-        if(!certNameOK)
-        {
-            certNameOK = find(dnsNames.begin(), dnsNames.end(), addrLower) != dnsNames.end();
-        }
-
-        //
-        // Log a message if the name comparison fails. If CheckCertName is defined,
-        // we also raise an exception to abort the connection. Don't log a message if
-        // CheckCertName is not defined and a verifier is present.
-        //
-        if(!certNameOK && (_checkCertName || (_securityTraceLevel >= 1 && !verifier)))
+        else
         {
-            ostringstream ostr;
-            ostr << "IceSSL: ";
-            if(!_checkCertName)
-            {
-                ostr << "ignoring ";
-            }
-            ostr << "certificate validation failure:\npeer certificate does not have `" << address
-                    << "' as its commonName or in its subjectAltName extension";
-            if(!dn.empty())
-            {
-                ostr << "\nSubject DN: " << dn;
-            }
-            if(!dnsNames.empty())
+            //
+            // If subjectAlt is empty compare it ot the subject CN, othewise
+            // compare it to the to the subject alt name dnsNames
+            //
+            if(dnsNames.empty())
             {
-                ostr << "\nDNS names found in certificate: ";
-                for(vector<string>::const_iterator p = dnsNames.begin(); p != dnsNames.end(); ++p)
+                DistinguishedName d = cert->getSubjectDN();
+                string dn = IceUtilInternal::toLower(string(d));
+                string cn = "cn=" + addrLower;
+                string::size_type pos = dn.find(cn);
+                if(pos != string::npos)
                 {
-                    if(p != dnsNames.begin())
-                    {
-                        ostr << ", ";
-                    }
-                    ostr << *p;
+                    //
+                    // Ensure we match the entire common name.
+                    //
+                    certNameOK = (pos + cn.size() == dn.size()) || (dn[pos + cn.size()] == ',');
                 }
             }
-            if(!ipAddresses.empty())
+            else
             {
-                ostr << "\nIP addresses found in certificate: ";
-                for(vector<string>::const_iterator p = ipAddresses.begin(); p != ipAddresses.end(); ++p)
-                {
-                    if(p != ipAddresses.begin())
-                    {
-                        ostr << ", ";
-                    }
-                    ostr << *p;
-                }
+                certNameOK = find(dnsNames.begin(), dnsNames.end(), addrLower) != dnsNames.end();
             }
+        }
+
+        if(!certNameOK)
+        {
+            ostringstream ostr;
+            ostr << "IceSSL: certificate validation failure: "
+                 << (isIpAddress ? "IP address mismatch" : "Hostname mismatch");
             string msg = ostr.str();
             if(_securityTraceLevel >= 1)
             {
                 Trace out(_logger, _securityTraceCategory);
                 out << msg;
             }
-            if(_checkCertName)
+
+            if(_verifyPeer > 0)
             {
                 SecurityException ex(__FILE__, __LINE__);
                 ex.reason = msg;
@@ -248,7 +224,12 @@ IceSSL::SSLEngine::verifyPeer(SOCKET fd, const string& address, const NativeConn
             }
         }
     }
+}
 
+void
+IceSSL::SSLEngine::verifyPeer(const string& address, const ConnectionInfoPtr& info, const string& desc)
+{
+    const CertificateVerifierPtr verifier = getCertificateVerifier();
     if(_verifyDepthMax > 0 && static_cast<int>(info->certs.size()) > _verifyDepthMax)
     {
         ostringstream ostr;
@@ -258,19 +239,19 @@ IceSSL::SSLEngine::verifyPeer(SOCKET fd, const string& address, const NativeConn
         string msg = ostr.str();
         if(_securityTraceLevel >= 1)
         {
-            _logger->trace(_securityTraceCategory, msg + "\n" + IceInternal::fdToString(fd));
+            _logger->trace(_securityTraceCategory, msg + "\n" + desc);
         }
         SecurityException ex(__FILE__, __LINE__);
         ex.reason = msg;
         throw ex;
     }
 
-    if(!_trustManager->verify(info))
+    if(!_trustManager->verify(info, desc))
     {
         string msg = string(info->incoming ? "incoming" : "outgoing") + " connection rejected by trust manager";
         if(_securityTraceLevel >= 1)
         {
-            _logger->trace(_securityTraceCategory, msg + "\n" + IceInternal::fdToString(fd));
+            _logger->trace(_securityTraceCategory, msg + "\n" + desc);
         }
         SecurityException ex(__FILE__, __LINE__);
         ex.reason = msg;
@@ -282,10 +263,34 @@ IceSSL::SSLEngine::verifyPeer(SOCKET fd, const string& address, const NativeConn
         string msg = string(info->incoming ? "incoming" : "outgoing") + " connection rejected by certificate verifier";
         if(_securityTraceLevel >= 1)
         {
-            _logger->trace(_securityTraceCategory, msg + "\n" + IceInternal::fdToString(fd));
+            _logger->trace(_securityTraceCategory, msg + "\n" + desc);
         }
         SecurityException ex(__FILE__, __LINE__);
         ex.reason = msg;
         throw ex;
     }
 }
+
+bool
+IceSSL::SSLEngine::getCheckCertName() const
+{
+    return _checkCertName;
+}
+
+int
+IceSSL::SSLEngine::getVerifyPeer() const
+{
+    return _verifyPeer;
+}
+
+int
+IceSSL::SSLEngine::securityTraceLevel() const
+{
+    return _securityTraceLevel;
+}
+
+std::string
+IceSSL::SSLEngine::securityTraceCategory() const
+{
+    return _securityTraceCategory;
+}

data/ext/ice/cpp/src/IceSSL/SSLEngine.h

@@ -1,50 +1,30 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#ifndef ICE_SSL_ENGINE_H
-#define ICE_SSL_ENGINE_H
+#ifndef ICESSL_ENGINE_H
+#define ICESSL_ENGINE_H
 
 #include <IceSSL/Plugin.h>
 #include <IceSSL/Util.h>
 #include <IceSSL/SSLEngineF.h>
 #include <IceSSL/TrustManagerF.h>
+#include <IceSSL/InstanceF.h>
 
 #include <IceUtil/Shared.h>
-#include <IceUtil/Mutex.h>
 #include <Ice/CommunicatorF.h>
 #include <Ice/Network.h>
-
-#if defined(ICE_USE_SECURE_TRANSPORT)
-#   include <Security/Security.h>
-#elif defined(ICE_USE_SCHANNEL)
-
-//
-// SECURITY_WIN32 or SECURITY_KERNEL, must be defined before including security.h
-// indicating who is compiling the code.
-//
-#  ifdef SECURITY_WIN32
-#    undef SECURITY_WIN32
-#  endif
-#  ifdef SECURITY_KERNEL
-#    undef SECURITY_KERNEL
-#  endif
-#  define SECURITY_WIN32 1
-#  include <security.h>
-#  include <sspi.h>
-#  include <schannel.h>
-#  undef SECURITY_WIN32
-#endif
+#include <Ice/TransceiverF.h>
 
 namespace IceSSL
 {
 
-class SSLEngine : public IceUtil::Shared
+class ICESSL_API SSLEngine : public IceUtil::Shared
 {
 public:
 
@@ -62,17 +42,24 @@ public:
     //
     virtual void initialize() = 0;
 
-    virtual bool initialized() const = 0;
+    virtual bool initialized() const;
 
     //
     // Destroy the engine.
     //
     virtual void destroy() = 0;
 
+    //
+    // Create a transceiver using the engine specific implementation
+    //
+    virtual IceInternal::TransceiverPtr
+    createTransceiver(const InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool) = 0;
+
     //
     // Verify peer certificate
     //
-    void verifyPeer(SOCKET, const std::string&, const NativeConnectionInfoPtr&);
+    virtual void verifyPeer(const std::string&, const ConnectionInfoPtr&, const std::string&);
+    void verifyPeerCertName(const std::string&, const ConnectionInfoPtr&);
 
     CertificateVerifierPtr getCertificateVerifier() const;
     PasswordPromptPtr getPasswordPrompt() const;
@@ -80,9 +67,15 @@ public:
     std::string getPassword() const;
     void setPassword(const std::string& password);
 
-    int getVerifyPeer() const { return _verifyPeer; }
-    int securityTraceLevel() const { return _securityTraceLevel; }
-    std::string securityTraceCategory() const { return _securityTraceCategory; }
+    bool getCheckCertName() const;
+    int getVerifyPeer() const;
+    int securityTraceLevel() const;
+    std::string securityTraceCategory() const;
+
+protected:
+
+    bool _initialized;
+    IceUtil::Mutex _mutex;
 
 private:
 
@@ -101,162 +94,6 @@ private:
     std::string _securityTraceCategory;
 };
 
-#if defined(ICE_USE_SECURE_TRANSPORT)
-
-class SecureTransportEngine : public SSLEngine
-{
-public:
-
-    SecureTransportEngine(const Ice::CommunicatorPtr&);
-
-    virtual void initialize();
-    virtual bool initialized() const;
-    virtual void destroy();
-
-    SSLContextRef newContext(bool);
-    CFArrayRef getCertificateAuthorities() const;
-    std::string getCipherName(SSLCipherSuite) const;
-
-private:
-
-    void parseCiphers(const std::string&);
-    SecKeychainRef openKeychain();
-
-    bool _initialized;
-    UniqueRef<CFArrayRef> _certificateAuthorities;
-    UniqueRef<CFArrayRef> _chain;
-
-    SSLProtocol _protocolVersionMax;
-    SSLProtocol _protocolVersionMin;
-
-    std::string _defaultDir;
-
-    std::vector<char> _dhParams;
-
-    std::vector<SSLCipherSuite> _ciphers;
-    IceUtil::Mutex _mutex;
-};
-
-#elif defined(ICE_USE_SCHANNEL)
-
-
-#if defined(__MINGW32__) || (defined(_MSC_VER) && (_MSC_VER <= 1500))
-
-//
-// Add some definitions missing from MinGW headers.
-//
-
-#   ifndef CERT_TRUST_IS_EXPLICIT_DISTRUST
-#      define CERT_TRUST_IS_EXPLICIT_DISTRUST 0x04000000
-#   endif
-
-#   ifndef CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT
-#      define CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT 0x08000000
-#   endif
-
-#   ifndef SECBUFFER_ALERT
-#      define SECBUFFER_ALERT 17
-#   endif
-
-#   ifndef SCH_SEND_ROOT_CERT
-#      define SCH_SEND_ROOT_CERT 0x00040000
-#   endif
-
-#   ifndef SP_PROT_TLS1_1_SERVER
-#      define SP_PROT_TLS1_1_SERVER 0x00000100
-#   endif
-
-#   ifndef SP_PROT_TLS1_1_CLIENT
-#      define SP_PROT_TLS1_1_CLIENT 0x00000200
-#   endif
-
-#   ifndef SP_PROT_TLS1_2_SERVER
-#      define SP_PROT_TLS1_2_SERVER 0x00000400
-#   endif
-
-#   ifndef SP_PROT_TLS1_2_CLIENT
-#      define SP_PROT_TLS1_2_CLIENT 0x00000800
-#   endif
-
-#endif
-class SChannelEngine : public SSLEngine
-{
-public:
-
-    SChannelEngine(const Ice::CommunicatorPtr&);
-
-    //
-    // Setup the engine.
-    //
-    virtual void initialize();
-
-    virtual bool initialized() const;
-
-    //
-    // Destroy the engine.
-    //
-    virtual void destroy();
-
-    std::string getCipherName(ALG_ID) const;
-
-    CredHandle newCredentialsHandle(bool);
-
-    HCERTCHAINENGINE chainEngine() const;
-
-private:
-
-    void parseCiphers(const std::string&);
-
-    bool _initialized;
-    std::vector<PCCERT_CONTEXT> _allCerts;
-    std::vector<PCCERT_CONTEXT> _importedCerts;
-    DWORD _protocols;
-    IceUtil::Mutex _mutex;
-
-    std::vector<HCERTSTORE> _stores;
-    HCERTSTORE _rootStore;
-
-    HCERTCHAINENGINE _chainEngine;
-    std::vector<ALG_ID> _ciphers;
-};
-#else // OpenSSL
-class OpenSSLEngine : public SSLEngine
-{
-public:
-
-    OpenSSLEngine(const Ice::CommunicatorPtr&);
-    ~OpenSSLEngine();
-
-    virtual void initialize();
-    virtual bool initialized() const;
-    virtual void destroy();
-
-#   ifndef OPENSSL_NO_DH
-    DH* dhParams(int);
-#   endif
-    SSL_CTX* context() const;
-    void context(SSL_CTX*);
-    std::string sslErrors() const;
-
-private:
-
-    SSL_METHOD* getMethod(int);
-    void setOptions(int);
-    enum Protocols { SSLv3 = 1, TLSv1_0 = 2, TLSv1_1 = 4, TLSv1_2 = 8, TLSv1_3 = 16 };
-    int parseProtocols(const Ice::StringSeq&) const;
-
-
-    bool _initialized;
-    SSL_CTX* _ctx;
-    std::string _defaultDir;
-
-#   ifndef OPENSSL_NO_DH
-    DHParamsPtr _dhParams;
-#   endif
-    IceUtil::Mutex _mutex;
-};
-#endif
-
 }
 
 #endif