zeroc-ice 3.6.5 → 3.7.0

data/ext/ice/cpp/src/IceSSL/SecureTransportEngine.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -9,8 +9,12 @@
 
 #include <IceSSL/Config.h>
 
+#include <IceSSL/SecureTransportEngineF.h>
+#include <IceSSL/SecureTransportEngine.h>
+
 #include <IceUtil/FileUtil.h>
 #include <IceUtil/StringUtil.h>
+#include <IceUtil/MutexPtrLock.h>
 
 #include <Ice/LocalException.h>
 #include <Ice/Properties.h>
@@ -19,18 +23,19 @@
 #include <Ice/LoggerUtil.h>
 
 #include <IceSSL/SecureTransportTransceiverI.h>
+#include <IceSSL/SecureTransportUtil.h>
 #include <IceSSL/Plugin.h>
 #include <IceSSL/SSLEngine.h>
 #include <IceSSL/Util.h>
 
-#ifdef ICE_USE_SECURE_TRANSPORT
-
 #include <regex.h>
 
 using namespace std;
 using namespace IceUtil;
 using namespace Ice;
+using namespace IceInternal;
 using namespace IceSSL;
+using namespace IceSSL::SecureTransport;
 
 namespace
 {
@@ -127,7 +132,7 @@ CiphersHelper::initialize()
         _ciphers["RSA_EXPORT_WITH_RC4_40_MD5"] = SSL_RSA_EXPORT_WITH_RC4_40_MD5;
         _ciphers["RSA_WITH_RC4_128_MD5"] = SSL_RSA_WITH_RC4_128_MD5;
         _ciphers["RSA_WITH_RC4_128_SHA"] = SSL_RSA_WITH_RC4_128_SHA;
-        _ciphers["RSA_EXPORT_WITH_RC2_CBC_40_MD5"] = SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5;
+        _ciphers["RSA_EXPORT_WITH_RC2_CBC_40_MD5"] =    SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5;
         _ciphers["RSA_WITH_IDEA_CBC_SHA"] = SSL_RSA_WITH_IDEA_CBC_SHA;
         _ciphers["RSA_EXPORT_WITH_DES40_CBC_SHA"] = SSL_RSA_EXPORT_WITH_DES40_CBC_SHA;
         _ciphers["RSA_WITH_DES_CBC_SHA"] = SSL_RSA_WITH_DES_CBC_SHA;
@@ -339,15 +344,6 @@ CiphersHelper::initialize()
         _ciphers["RSA_WITH_DES_CBC_MD5"] = SSL_RSA_WITH_DES_CBC_MD5;
         _ciphers["RSA_WITH_3DES_EDE_CBC_MD5"] = SSL_RSA_WITH_3DES_EDE_CBC_MD5;
         _ciphers["NO_SUCH_CIPHERSUITE"] = SSL_NO_SUCH_CIPHERSUITE;
-
-        //
-        // TLS 1.3 standard cipher suites
-        //
-        _ciphers["TLS_AES_128_GCM_SHA256"] = TLS_AES_128_GCM_SHA256;
-        _ciphers["TLS_AES_256_GCM_SHA384"] = TLS_AES_256_GCM_SHA384;
-        _ciphers["TLS_CHACHA20_POLY1305_SHA256"] = TLS_CHACHA20_POLY1305_SHA256;
-        _ciphers["TLS_AES_128_CCM_SHA256"] = TLS_AES_128_CCM_SHA256;
-        _ciphers["TLS_AES_128_CCM_8_SHA256"] = TLS_AES_128_CCM_8_SHA256;
     }
 }
 
@@ -748,21 +744,6 @@ CiphersHelper::cipherName(SSLCipherSuite cipher)
             return "RSA_WITH_DES_CBC_MD5";
         case SSL_RSA_WITH_3DES_EDE_CBC_MD5:
             return "RSA_WITH_3DES_EDE_CBC_MD5";
-
-        //
-        //TLS 1.3 standard cipher suites
-        //
-        case TLS_AES_128_GCM_SHA256:
-            return "TLS_AES_128_GCM_SHA256";
-        case TLS_AES_256_GCM_SHA384:
-            return "TLS_AES_256_GCM_SHA384";
-        case TLS_CHACHA20_POLY1305_SHA256:
-            return "TLS_CHACHA20_POLY1305_SHA256";
-        case TLS_AES_128_CCM_SHA256:
-            return "TLS_AES_128_CCM_SHA256";
-        case TLS_AES_128_CCM_8_SHA256:
-            return "TLS_AES_128_CCM_8_SHA256";
-
         default:
             return "";
     }
@@ -794,10 +775,6 @@ parseProtocol(const string& p)
     {
         return kTLSProtocol12;
     }
-    else if(prot == "TLS1_3" || prot == "TLSV1_3")
-    {
-        return kTLSProtocol13;
-    }
     else
     {
         throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unrecognized protocol `" + p + "'");
@@ -806,11 +783,14 @@ parseProtocol(const string& p)
 
 }
 
-IceUtil::Shared* IceSSL::upCast(IceSSL::SecureTransportEngine* p) { return p; }
+IceUtil::Shared*
+IceSSL::SecureTransport::upCast(IceSSL::SecureTransport::SSLEngine* p)
+{
+    return p;
+}
 
-IceSSL::SecureTransportEngine::SecureTransportEngine(const Ice::CommunicatorPtr& communicator) :
-    SSLEngine(communicator),
-    _initialized(false),
+IceSSL::SecureTransport::SSLEngine::SSLEngine(const Ice::CommunicatorPtr& communicator) :
+    IceSSL::SSLEngine(communicator),
     _certificateAuthorities(0),
     _chain(0),
     _protocolVersionMax(kSSLProtocolUnknown),
@@ -818,18 +798,11 @@ IceSSL::SecureTransportEngine::SecureTransportEngine(const Ice::CommunicatorPtr&
 {
 }
 
-bool
-IceSSL::SecureTransportEngine::initialized() const
-{
-    IceUtil::Mutex::Lock lock(_mutex);
-    return _initialized;
-}
-
 //
 // Setup the engine.
 //
 void
-IceSSL::SecureTransportEngine::initialize()
+IceSSL::SecureTransport::SSLEngine::initialize()
 {
     IceUtil::Mutex::Lock lock(_mutex);
     if(_initialized)
@@ -837,7 +810,7 @@ IceSSL::SecureTransportEngine::initialize()
         return;
     }
 
-    SSLEngine::initialize();
+    IceSSL::SSLEngine::initialize();
 
     const PropertiesPtr properties = communicator()->getProperties();
 
@@ -886,6 +859,9 @@ IceSSL::SecureTransportEngine::initialize()
     string certFile = properties->getProperty("IceSSL.CertFile");
     string keyFile = properties->getProperty("IceSSL.KeyFile");
     string findCert = properties->getProperty("IceSSL.FindCert");
+    string keychain = properties->getProperty("IceSSL.Keychain");
+    string keychainPassword = properties->getProperty("IceSSL.KeychainPassword");
+
     if(!certFile.empty())
     {
         vector<string> files;
@@ -931,10 +907,10 @@ IceSSL::SecureTransportEngine::initialize()
                 keyFile = resolved;
             }
 
-            UniqueRef<SecKeychainRef> kc(openKeychain());
             try
             {
-                _chain.reset(loadCertificateChain(file, keyFile, kc.get(), password, passwordPrompt, passwordRetryMax));
+                _chain.reset(loadCertificateChain(file, keyFile, keychain, keychainPassword, password, passwordPrompt,
+                                                  passwordRetryMax));
                 break;
             }
             catch(const CertificateReadException& ce)
@@ -952,57 +928,13 @@ IceSSL::SecureTransportEngine::initialize()
     }
     else if(!findCert.empty())
     {
-        UniqueRef<SecKeychainRef> kc(openKeychain());
-        UniqueRef<SecCertificateRef> cert(findCertificate(kc.get(), findCert));
-
-        //
-        // Retrieve the certificate chain
-        //
-        UniqueRef<SecPolicyRef> policy(SecPolicyCreateSSL(true, 0));
-        SecTrustRef trust = 0;
-        OSStatus err = SecTrustCreateWithCertificates((CFArrayRef)cert.get(), policy.get(), &trust);
-        if(err || !trust)
-        {
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: error creating trust object" +
-                                                (err ? ":\n" + errorToString(err) : ""));
-        }
-        UniqueRef<SecTrustRef> v(trust);
-
-        SecTrustResultType trustResult;
-        if((err = SecTrustEvaluate(trust, &trustResult)))
-        {
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: error evaluating trust:\n" + errorToString(err));
-        }
-
-        int chainLength = SecTrustGetCertificateCount(trust);
-        CFMutableArrayRef items = CFArrayCreateMutable(kCFAllocatorDefault, chainLength, &kCFTypeArrayCallBacks);
-        for(int i = 0; i < chainLength; ++i)
-        {
-            CFArrayAppendValue(items, SecTrustGetCertificateAtIndex(trust, i));
-        }
-
-        //
-        // Replace the first certificate in the chain with the
-        // identity.
-        //
-        SecIdentityRef identity;
-        err = SecIdentityCreateWithCertificate(kc.get(), cert.get(), &identity);
-        if(err != noErr)
-        {
-            ostringstream os;
-            os << "IceSSL: couldn't create identity for certificate found in the keychain:\n" << errorToString(err);
-            throw PluginInitializationException(__FILE__, __LINE__, os.str());
-        }
-        CFArraySetValueAtIndex(items, 0, identity);
-        CFRelease(identity);
-        _chain.reset(items);
+        _chain.reset(findCertificateChain(keychain, keychainPassword, findCert));
     }
 
     //
     // DiffieHellmanParams in DER format.
     //
+#if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
     string dhFile = properties->getProperty("IceSSL.DHParams");
     if(!dhFile.empty())
     {
@@ -1014,6 +946,7 @@ IceSSL::SecureTransportEngine::initialize()
 
         readFile(resolved, _dhParams);
     }
+#endif
 
     //
     // Establish the cipher list.
@@ -1073,12 +1006,21 @@ IceSSL::SecureTransportEngine::initialize()
 // Destroy the engine.
 //
 void
-IceSSL::SecureTransportEngine::destroy()
+IceSSL::SecureTransport::SSLEngine::destroy()
+{
+}
+
+IceInternal::TransceiverPtr
+IceSSL::SecureTransport::SSLEngine::createTransceiver(const InstancePtr& instance,
+                                                      const IceInternal::TransceiverPtr& delegate,
+                                                      const string& hostOrAdapterName,
+                                                      bool incoming)
 {
+    return new IceSSL::SecureTransport::TransceiverI(instance, delegate, hostOrAdapterName, incoming);
 }
 
 SSLContextRef
-IceSSL::SecureTransportEngine::newContext(bool incoming)
+IceSSL::SecureTransport::SSLEngine::newContext(bool incoming)
 {
     SSLContextRef ssl = SSLCreateContext(kCFAllocatorDefault, incoming ? kSSLServerSide : kSSLClientSide,
                                          kSSLStreamType);
@@ -1114,27 +1056,29 @@ IceSSL::SecureTransportEngine::newContext(bool incoming)
             }
         }
 
+#if defined(ICE_USE_SECURE_TRANSPORT_MACOS)
         if(!_dhParams.empty())
         {
             if((err = SSLSetDiffieHellmanParams(ssl, &_dhParams[0], _dhParams.size())))
             {
                 throw SecurityException(__FILE__, __LINE__,
-                                        "IceSSL: unable to create the trust object:\n" + errorToString(err));
+                                        "IceSSL: unable to create the trust object:\n" + sslErrorToString(err));
             }
         }
+#endif
     }
 
     if(_chain && (err = SSLSetCertificate(ssl, _chain.get())))
     {
         throw SecurityException(__FILE__, __LINE__,
-                                "IceSSL: error while setting the SSL context certificate:\n" + errorToString(err));
+                                "IceSSL: error while setting the SSL context certificate:\n" + sslErrorToString(err));
     }
 
     if(!_ciphers.empty())
     {
         if((err = SSLSetEnabledCiphers(ssl, &_ciphers[0], _ciphers.size())))
         {
-            throw SecurityException(__FILE__, __LINE__, "IceSSL: error while setting ciphers:\n" + errorToString(err));
+            throw SecurityException(__FILE__, __LINE__, "IceSSL: error while setting ciphers:\n" + sslErrorToString(err));
         }
     }
 
@@ -1142,7 +1086,7 @@ IceSSL::SecureTransportEngine::newContext(bool incoming)
                                                   kSSLSessionOptionBreakOnServerAuth,
                                   true)))
     {
-        throw SecurityException(__FILE__, __LINE__, "IceSSL: error while setting SSL option:\n" + errorToString(err));
+        throw SecurityException(__FILE__, __LINE__, "IceSSL: error while setting SSL option:\n" + sslErrorToString(err));
     }
 
     if(_protocolVersionMax != kSSLProtocolUnknown)
@@ -1150,7 +1094,7 @@ IceSSL::SecureTransportEngine::newContext(bool incoming)
         if((err = SSLSetProtocolVersionMax(ssl, _protocolVersionMax)))
         {
             throw SecurityException(__FILE__, __LINE__,
-                                    "IceSSL: error while setting SSL protocol version max:\n" + errorToString(err));
+                                    "IceSSL: error while setting SSL protocol version max:\n" + sslErrorToString(err));
         }
     }
 
@@ -1159,7 +1103,7 @@ IceSSL::SecureTransportEngine::newContext(bool incoming)
         if((err = SSLSetProtocolVersionMin(ssl, _protocolVersionMin)))
         {
             throw SecurityException(__FILE__, __LINE__,
-                                    "IceSSL: error while setting SSL protocol version min:\n" + errorToString(err));
+                                    "IceSSL: error while setting SSL protocol version min:\n" + sslErrorToString(err));
         }
     }
 
@@ -1167,19 +1111,19 @@ IceSSL::SecureTransportEngine::newContext(bool incoming)
 }
 
 CFArrayRef
-IceSSL::SecureTransportEngine::getCertificateAuthorities() const
+IceSSL::SecureTransport::SSLEngine::getCertificateAuthorities() const
 {
     return _certificateAuthorities.get();
 }
 
 string
-IceSSL::SecureTransportEngine::getCipherName(SSLCipherSuite cipher) const
+IceSSL::SecureTransport::SSLEngine::getCipherName(SSLCipherSuite cipher) const
 {
     return CiphersHelper::cipherName(cipher);
 }
 
 void
-IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
+IceSSL::SecureTransport::SSLEngine::parseCiphers(const string& ciphers)
 {
     vector<string> tokens;
     vector<CipherExpression> cipherExpressions;
@@ -1257,19 +1201,18 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
     //
     // Context used to get the cipher list
     //
-    SSLContextRef ctx = SSLCreateContext(kCFAllocatorDefault, kSSLServerSide, kSSLStreamType);
+    UniqueRef<SSLContextRef> ctx(SSLCreateContext(kCFAllocatorDefault, kSSLServerSide, kSSLStreamType));
     size_t numSupportedCiphers = 0;
-    SSLGetNumberSupportedCiphers(ctx, &numSupportedCiphers);
+    SSLGetNumberSupportedCiphers(ctx.get(), &numSupportedCiphers);
 
     vector<SSLCipherSuite> supported;
     supported.resize(numSupportedCiphers);
 
-    OSStatus err = SSLGetSupportedCiphers(ctx, &supported[0], &numSupportedCiphers);
-    CFRelease(ctx);
+    OSStatus err = SSLGetSupportedCiphers(ctx.get(), &supported[0], &numSupportedCiphers);
     if(err)
     {
         throw PluginInitializationException(__FILE__, __LINE__,
-                                            "IceSSL: unable to get supported ciphers list:\n" + errorToString(err));
+                                            "IceSSL: unable to get supported ciphers list:\n" + sslErrorToString(err));
     }
 
     vector<SSLCipherSuite> enabled;
@@ -1285,26 +1228,15 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
         {
             for(vector<SSLCipherSuite>::iterator j = enabled.begin(); j != enabled.end();)
             {
-                SSLCipherSuite cipher = *j;
-                string name = CiphersHelper::cipherName(cipher);
-
-                if(ce.cipher.empty())
+                string name = CiphersHelper::cipherName(*j);
+                if((ce.cipher.empty() && ce.re->match(name)) || ce.cipher == name)
                 {
-                    if(ce.re->match(name))
-                    {
-                        j = enabled.erase(j);
-                        continue;
-                    }
+                    j = enabled.erase(j);
                 }
                 else
                 {
-                    if(ce.cipher == name)
-                    {
-                        j = enabled.erase(j);
-                        continue;
-                    }
+                    ++j;
                 }
-                j++;
             }
         }
         else
@@ -1345,93 +1277,3 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
                                             "\nThe result cipher list does not contain any entries");
     }
 }
-
-SecKeychainRef
-SecureTransportEngine::openKeychain()
-{
-    const PropertiesPtr properties = communicator()->getProperties();
-
-    //
-    // Open the application KeyChain or create it if the keychain doesn't exists
-    //
-    string keychainPath = properties->getProperty("IceSSL.Keychain");
-    string keychainPassword = properties->getProperty("IceSSL.KeychainPassword");
-
-    SecKeychainRef keychain = 0;
-    OSStatus err = 0;
-    if(keychainPath.empty())
-    {
-        if((err = SecKeychainCopyDefault(&keychain)))
-        {
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: unable to retrieve default keychain:\n" + errorToString(err));
-        }
-    }
-    else
-    {
-        //
-        // KeyChain path is relative to the current working directory.
-        //
-        if(!IceUtilInternal::isAbsolutePath(keychainPath))
-        {
-            string cwd;
-            if(IceUtilInternal::getcwd(cwd) == 0)
-            {
-                keychainPath = string(cwd) + '/' + keychainPath;
-            }
-        }
-
-        if((err = SecKeychainOpen(keychainPath.c_str(), &keychain)))
-        {
-            throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unable to open keychain: `" +
-                                                keychainPath + "'\n" + errorToString(err));
-        }
-    }
-
-    UniqueRef<SecKeychainRef> k(keychain);
-
-    SecKeychainStatus status;
-    err = SecKeychainGetStatus(keychain, &status);
-    if(err == noErr)
-    {
-        const char* pass = keychainPassword.empty() ? 0 : keychainPassword.c_str();
-        if((err = SecKeychainUnlock(keychain, keychainPassword.size(), pass, pass != 0)))
-        {
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: unable to unlock keychain:\n" + errorToString(err));
-        }
-    }
-    else if(err == errSecNoSuchKeychain)
-    {
-        const char* pass = keychainPassword.empty() ? 0 : keychainPassword.c_str();
-        if((err = SecKeychainCreate(keychainPath.c_str(), keychainPassword.size(), pass, pass == 0, 0, &keychain)))
-        {
-            throw PluginInitializationException(__FILE__, __LINE__,
-                                                "IceSSL: unable to create keychain:\n" + errorToString(err));
-        }
-        k.reset(keychain);
-    }
-    else
-    {
-        throw PluginInitializationException(__FILE__, __LINE__,
-                                            "IceSSL: unable to open keychain:\n" + errorToString(err));
-    }
-
-    //
-    // Set keychain settings to avoid keychain lock.
-    //
-    SecKeychainSettings settings;
-    settings.version = SEC_KEYCHAIN_SETTINGS_VERS1;
-    settings.lockOnSleep = FALSE;
-    settings.useLockInterval = FALSE;
-    settings.lockInterval = INT_MAX;
-    if((err = SecKeychainSetSettings(keychain, &settings)))
-    {
-        throw PluginInitializationException(__FILE__, __LINE__,
-                                            "IceSSL: error setting keychain settings:\n" + errorToString(err));
-    }
-
-    return k.release();
-}
-
-#endif