zeroc-ice 3.6.5 → 3.7.0

data/ext/ice/cpp/src/IceSSL/UWPEngine.h

@@ -0,0 +1,46 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#ifndef ICESSL_UWP_ENGINE_H
+#define ICESSL_UWP_ENGINE_H
+
+#include <IceSSL/SSLEngine.h>
+#include <IceSSL/UWP.h>
+
+#include <mutex>
+
+namespace IceSSL
+{
+
+namespace UWP
+{
+
+class SSLEngine : public IceSSL::SSLEngine
+{
+public:
+
+    SSLEngine(const Ice::CommunicatorPtr&);
+
+    virtual void initialize();
+    virtual bool initialized() const;
+    virtual void destroy();
+    virtual IceInternal::TransceiverPtr
+    createTransceiver(const InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool);
+    virtual std::shared_ptr<IceSSL::UWP::Certificate> certificate();
+
+private:
+
+    std::shared_ptr<IceSSL::UWP::Certificate> _certificate;
+};
+
+} // UWP namespace end
+
+} // IceSSL namespace end
+
+#endif

data/ext/ice/cpp/{include/Ice/ObjectFactoryManagerF.h → src/IceSSL/UWPEngineF.h}

@@ -1,25 +1,30 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#ifndef ICE_OBJECT_FACTORY_MANAGER_F_H
-#define ICE_OBJECT_FACTORY_MANAGER_F_H
+#ifndef ICESSL_UWP_ENGINE_F_H
+#define ICESSL_UWP_ENGINE_F_H
 
 #include <IceUtil/Shared.h>
-
 #include <Ice/Handle.h>
+#include <IceSSL/UWP.h>
+
+namespace IceSSL
+{
 
-namespace IceInternal
+namespace UWP
 {
 
-class ObjectFactoryManager;
-IceUtil::Shared* upCast(ObjectFactoryManager*);
-typedef Handle<ObjectFactoryManager> ObjectFactoryManagerPtr;
+class SSLEngine;
+ICESSL_API IceUtil::Shared* upCast(SSLEngine*);
+typedef IceInternal::Handle<SSLEngine> SSLEnginePtr;
+
+}
 
 }
 

data/ext/ice/cpp/src/IceSSL/UWPPluginI.cpp

@@ -0,0 +1,94 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#include <IceSSL/PluginI.h>
+#include <IceSSL/UWPEngine.h>
+
+#include <Ice/Initialize.h>
+
+using namespace std;
+
+namespace
+{
+
+class PluginI : public IceSSL::PluginI
+{
+public:
+
+    PluginI(const Ice::CommunicatorPtr&);
+    //
+    // Construct a certificate using a native certificate.
+    //
+    virtual string getEngineName() const;
+    virtual Ice::Long getEngineVersion() const;
+    virtual IceSSL::CertificatePtr create(Windows::Security::Cryptography::Certificates::Certificate^) const;
+    virtual IceSSL::CertificatePtr load(const std::string&) const;
+    virtual IceSSL::CertificatePtr decode(const std::string&) const;
+};
+
+} // anonymous namespace end
+
+//
+// Plugin implementation.
+//
+PluginI::PluginI(const Ice::CommunicatorPtr& com) :
+    IceSSL::PluginI(com, new IceSSL::UWP::SSLEngine(com))
+{
+}
+
+IceSSL::CertificatePtr
+PluginI::create(Windows::Security::Cryptography::Certificates::Certificate^ cert) const
+{
+    return IceSSL::UWP::Certificate::create(cert);
+}
+
+IceSSL::CertificatePtr
+PluginI::load(const std::string& file) const
+{
+    return IceSSL::UWP::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+PluginI::decode(const std::string& encoding) const
+{
+    return IceSSL::UWP::Certificate::decode(encoding);
+}
+
+string
+PluginI::getEngineName() const
+{
+    return "UWPEngine";
+}
+
+Ice::Long
+PluginI::getEngineVersion() const
+{
+    return 0;
+}
+
+//
+// Plug-in factory function.
+//
+extern "C" ICESSL_API Ice::Plugin*
+createIceSSL(const Ice::CommunicatorPtr& communicator, const string& /*name*/, const Ice::StringSeq& /*args*/)
+{
+    return new PluginI(communicator);
+}
+
+IceSSL::CertificatePtr
+IceSSL::Certificate::load(const std::string& file)
+{
+    return IceSSL::UWP::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+IceSSL::Certificate::decode(const std::string& encoding)
+{
+    return IceSSL::UWP::Certificate::decode(encoding);
+}

data/ext/ice/cpp/src/IceSSL/UWPTransceiverI.cpp

@@ -0,0 +1,388 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#include <IceSSL/Config.h>
+#include <IceSSL/UWPTransceiverI.h>
+#include <IceSSL/Instance.h>
+#include <IceSSL/UWPEngine.h>
+#include <IceSSL/ConnectionInfo.h>
+#include <Ice/Logger.h>
+#include <ppltasks.h>
+
+using namespace std;
+using namespace Ice;
+using namespace IceSSL;
+
+using namespace concurrency;
+using namespace Platform;
+using namespace Windows::Networking;
+using namespace Windows::Networking::Sockets;
+using namespace Windows::Foundation::Collections;
+using namespace Windows::Security::Cryptography::Certificates;
+
+namespace
+{
+
+std::string
+validationResultToString(ChainValidationResult result)
+{
+    switch (result)
+    {
+        case ChainValidationResult::Success:
+        {
+            return "The certificate chain was verified.";
+        }
+        case ChainValidationResult::Untrusted:
+        {
+            return "A certificate in the chain is not trusted.";
+        }
+        case ChainValidationResult::Revoked:
+        {
+            return "A certificate in the chain has been revoked.";
+        }
+        case ChainValidationResult::Expired:
+        {
+            return "A certificate in the chain has expired.";
+        }
+        case ChainValidationResult::IncompleteChain:
+        {
+            return "The certificate chain is missing one or more certificates.";
+        }
+        case ChainValidationResult::InvalidSignature:
+        {
+            return "The signature of a certificate in the chain cannot be verified.";
+        }
+        case ChainValidationResult::WrongUsage:
+        {
+            return "A certificate in the chain is being used for a purpose other than one specified by its CA.";
+        }
+        case ChainValidationResult::InvalidName:
+        {
+            return "A certificate in the chain has a name that is not valid. The name is either not included in "
+                   "the permitted list or is explicitly excluded.";
+        }
+        case ChainValidationResult::InvalidCertificateAuthorityPolicy:
+        {
+            return "A certificate in the chain has a policy that is not valid.";
+        }
+        case ChainValidationResult::BasicConstraintsError:
+        {
+            return "The basic constraint extension of a certificate in the chain has not been observed.";
+        }
+        case ChainValidationResult::UnknownCriticalExtension:
+        {
+            return "A certificate in the chain contains an unknown extension that is marked \"critical\".";
+        }
+        case ChainValidationResult::RevocationInformationMissing:
+        {
+            return "No installed or registered DLL was found to verify revocation.";
+        }
+        case ChainValidationResult::RevocationFailure:
+        {
+            return "Unable to connect to the revocation server.";
+        }
+        case ChainValidationResult::OtherErrors:
+        {
+            return "An unexpected error occurred while validating the certificate chain.";
+        }
+        default:
+        {
+            assert(false);
+            return "";
+        }
+    }
+}
+
+}
+
+IceInternal::NativeInfoPtr
+UWP::TransceiverI::getNativeInfo()
+{
+    return _delegate->getNativeInfo();
+}
+
+IceInternal::SocketOperation
+UWP::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer)
+{
+    if(!_connected)
+    {
+        IceInternal::SocketOperation status = _delegate->initialize(readBuffer, writeBuffer);
+        if(status != IceInternal::SocketOperationNone)
+        {
+            return status;
+        }
+        _connected = true;
+
+        //
+        // Continue connecting, this will call startWrite/finishWrite to upgrade the stream
+        // to SSL.
+        //
+        return IceInternal::SocketOperationConnect;
+    }
+    else if(!_upgraded)
+    {
+        _upgraded = true;
+        try
+        {
+            auto fd = safe_cast<StreamSocket^>(_delegate->getNativeInfo()->fd());
+            if(fd->Information->ServerCertificate)
+            {
+                //
+                // Build the certificate chain
+                //
+                auto params = ref new ChainBuildingParameters();
+                params->AuthorityInformationAccessEnabled = false;
+                params->CurrentTimeValidationEnabled = true;
+                params->NetworkRetrievalEnabled = false;
+                params->RevocationCheckEnabled = false;
+
+                //
+                // BUGFIX: It is currently not possible to set ExclusiveTrustRoots programatically
+                // it is causing a read access exception see:https://goo.gl/B6OaNx
+                //
+                //if(_engine->ca())
+                //{
+                // params->ExclusiveTrustRoots->Append(_engine->ca()->getCert());
+                //}
+                try
+                {
+                    _chain = create_task(fd->Information->ServerCertificate->BuildChainAsync(
+                                         fd->Information->ServerIntermediateCertificates, params)).get();
+                }
+                catch(Platform::Exception^ ex)
+                {
+                    throw SyscallException(__FILE__, __LINE__, ex->HResult);
+                }
+
+                ChainValidationResult result = _chain->Validate();
+                if(result != ChainValidationResult::Success)
+                {
+                    if(_engine->getVerifyPeer() == 0)
+                    {
+                        if(_instance->traceLevel() >= 1)
+                        {
+                            _instance->logger()->trace(_instance->traceCategory(),
+                                "IceSSL: ignoring certificate verification failure\n" +
+                                validationResultToString(result));
+                        }
+                    }
+                    else
+                    {
+                        throw SecurityException(__FILE__, __LINE__,
+                            "IceSSL: certificate validation error:\n" + validationResultToString(result));
+                    }
+                }
+                else
+                {
+                    _verified = true;
+                }
+            }
+            else if((!_incoming && _engine->getVerifyPeer() > 0) || (_incoming && _engine->getVerifyPeer() == 2))
+            {
+                //
+                // Clients require server certificate if VerifyPeer > 0 and servers require client
+                // certificate if VerifyPeer == 2
+                //
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate required");
+            }
+
+            if(_chain)
+            {
+                auto certs = _chain->GetCertificates(true);
+                for(auto iter = certs->First(); iter->HasCurrent; iter->MoveNext())
+                {
+                    auto cert = UWP::Certificate::create(iter->Current);
+                    _certs.push_back(cert);
+                }
+            }
+
+            _engine->verifyPeer(_host, dynamic_pointer_cast<IceSSL::ConnectionInfo>(getInfo()), toString());
+        }
+        catch(Platform::Exception^ ex)
+        {
+            ostringstream os;
+            os << "IceSSL: certificate verification failure:\n" << wstringToString(ex->Message->Data());
+            throw SecurityException(__FILE__, __LINE__, os.str());
+        }
+    }
+    return IceInternal::SocketOperationNone;
+}
+
+IceInternal::SocketOperation
+UWP::TransceiverI::closing(bool initiator, const Ice::LocalException& ex)
+{
+    return _delegate->closing(initiator, ex);
+}
+
+void
+UWP::TransceiverI::close()
+{
+    _delegate->close();
+}
+
+IceInternal::SocketOperation
+UWP::TransceiverI::write(IceInternal::Buffer& buf)
+{
+    return _delegate->write(buf);
+}
+
+IceInternal::SocketOperation
+UWP::TransceiverI::read(IceInternal::Buffer& buf)
+{
+    return _delegate->read(buf);
+}
+
+bool
+UWP::TransceiverI::startWrite(IceInternal::Buffer& buf)
+{
+    if(_connected && !_upgraded)
+    {
+        StreamSocket^ stream = safe_cast<StreamSocket^>(_delegate->getNativeInfo()->fd());
+        HostName^ host = ref new HostName(ref new String(IceUtil::stringToWstring(_host).c_str()));
+
+        //
+        // We ignore SSL Certificate errors at this point, the certificate chain will be validated
+        // when the chain is constructed in Transceiver::initialize
+        //
+        stream->Control->IgnorableServerCertificateErrors->Append(ChainValidationResult::Expired);
+        stream->Control->IgnorableServerCertificateErrors->Append(ChainValidationResult::IncompleteChain);
+        //
+        // Check if we need to enable host name verification
+        //
+        if(!_engine->getCheckCertName() || _host.empty() || _engine->getVerifyPeer() == 0)
+        {
+            stream->Control->IgnorableServerCertificateErrors->Append(ChainValidationResult::InvalidName);
+        }
+        stream->Control->IgnorableServerCertificateErrors->Append(ChainValidationResult::RevocationFailure);
+        stream->Control->IgnorableServerCertificateErrors->Append(ChainValidationResult::RevocationInformationMissing);
+        stream->Control->IgnorableServerCertificateErrors->Append(ChainValidationResult::Untrusted);
+        stream->Control->IgnorableServerCertificateErrors->Append(ChainValidationResult::WrongUsage);
+
+        if(_engine->certificate())
+        {
+            stream->Control->ClientCertificate = _engine->certificate()->getCert();
+        }
+
+        try
+        {
+            Windows::Foundation::IAsyncAction^ action = stream->UpgradeToSslAsync(SocketProtectionLevel::Tls12, host);
+            getNativeInfo()->queueAction(IceInternal::SocketOperationWrite, action);
+        }
+        catch(Platform::Exception^ ex)
+        {
+            IceInternal::checkErrorCode(__FILE__, __LINE__, ex->HResult);
+        }
+        return true;
+    }
+    return _delegate->startWrite(buf);
+}
+
+void
+UWP::TransceiverI::finishWrite(IceInternal::Buffer& buf)
+{
+    if(_connected && !_upgraded)
+    {
+        IceInternal::AsyncInfo* asyncInfo = getNativeInfo()->getAsyncInfo(IceInternal::SocketOperationWrite);
+        if(asyncInfo->count == SOCKET_ERROR)
+        {
+            if(CERT_E_CN_NO_MATCH == asyncInfo->error)
+            {
+                ostringstream ostr;
+                ostr << "IceSSL: certificate validation failure: "
+                     << (IceInternal::isIpAddress(_host) ? "IP address mismatch" : "Hostname mismatch");
+                string msg = ostr.str();
+                if(_engine->securityTraceLevel() >= 1)
+                {
+                    _instance->logger()->trace(_instance->traceCategory(), msg);
+                }
+
+                throw SecurityException(__FILE__, __LINE__, msg);
+            }
+            else
+            {
+                IceInternal::checkErrorCode(__FILE__, __LINE__, asyncInfo->error);
+            }
+        }
+        return;
+    }
+    _delegate->finishWrite(buf);
+}
+
+void
+UWP::TransceiverI::startRead(IceInternal::Buffer& buf)
+{
+    _delegate->startRead(buf);
+}
+
+void
+UWP::TransceiverI::finishRead(IceInternal::Buffer& buf)
+{
+    _delegate->finishRead(buf);
+}
+
+string
+UWP::TransceiverI::protocol() const
+{
+    return _instance->protocol();
+}
+
+string
+UWP::TransceiverI::toString() const
+{
+    return _delegate->toString();
+}
+
+string
+UWP::TransceiverI::toDetailedString() const
+{
+    return toString();
+}
+
+Ice::ConnectionInfoPtr
+UWP::TransceiverI::getInfo() const
+{
+    ConnectionInfoPtr info = ICE_MAKE_SHARED(ConnectionInfo);
+    info->verified = _verified;
+    info->adapterName = _adapterName;
+    info->incoming = _incoming;
+    info->underlying = _delegate->getInfo();
+    info->certs = _certs;
+    return info;
+}
+
+void
+UWP::TransceiverI::checkSendSize(const IceInternal::Buffer&)
+{
+}
+
+void
+UWP::TransceiverI::setBufferSize(int rcvSize, int sndSize)
+{
+    _delegate->setBufferSize(rcvSize, sndSize);
+}
+
+UWP::TransceiverI::TransceiverI(const InstancePtr& instance,
+                                   const IceInternal::TransceiverPtr& delegate,
+                                   const string& hostOrAdapterName,
+                                   bool incoming) :
+    _instance(instance),
+    _engine(UWP::SSLEnginePtr::dynamicCast(instance->engine())),
+    _host(incoming ? "" : hostOrAdapterName),
+    _adapterName(incoming ? hostOrAdapterName : ""),
+    _incoming(incoming),
+    _delegate(delegate),
+    _connected(false),
+    _upgraded(false),
+    _verified(false)
+{
+}
+
+UWP::TransceiverI::~TransceiverI()
+{
+}