zeroc-ice 3.6.5 → 3.7.0

data/{slice/Freeze/ConnectionF.ice → ext/ice/cpp/include/Ice/ValueF.h}

@@ -1,20 +1,24 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#pragma once
+#ifndef ICE_VALUE_F_H
+#define ICE_VALUE_F_H
 
-[["cpp:header-ext:h", "objc:header-dir:objc"]]
+#ifdef ICE_CPP11_MAPPING
+#include <Ice/Config.h>
 
-module Freeze
+namespace Ice
 {
 
-local interface Connection;
-
-};
+class Value;
+using ValuePtr = ::std::shared_ptr<Value>;
 
+}
+#endif
+#endif

data/ext/ice/cpp/include/IceSSL/Config.h

@@ -1,41 +1,26 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#ifndef ICE_SSL_CONFIG_H
-#define ICE_SSL_CONFIG_H
+#ifndef ICESSL_CONFIG_H
+#define ICESSL_CONFIG_H
 
 #include <Ice/Config.h>
 
 //
-// Automatically link IceSSL[D].lib with Visual C++
+// Automatically link IceSSL[D|++11|++11D].lib with Visual C++
 //
-
-#if !defined(ICE_BUILDING_ICE_SSL) && defined(ICE_SSL_API_EXPORTS)
-#   define ICE_BUILDING_ICE_SSL
-#endif
-
-#if defined(_MSC_VER)
-#   if !defined(ICE_BUILDING_ICE_SSL)
-#      if defined(_DEBUG) && !defined(ICE_OS_WINRT)
-#          pragma comment(lib, "IceSSLD.lib")
-#      else
-#          pragma comment(lib, "IceSSL.lib")
-#      endif
-#   endif
+#if !defined(ICE_BUILDING_ICESSL) && defined(ICESSL_API_EXPORTS)
+#  define ICE_BUILDING_ICESSL
 #endif
 
-#if defined(__APPLE__)
-#  define ICE_USE_SECURE_TRANSPORT 1
-#elif defined(_WIN32)
-#  define ICE_USE_SCHANNEL 1
-#else
-#  define ICE_USE_OPENSSL 1
+#if defined(_MSC_VER) && !defined(ICE_BUILDING_ICESSL)
+#  pragma comment(lib, ICE_LIBNAME("IceSSL"))
 #endif
 
 #endif

data/ext/ice/cpp/include/IceSSL/IceSSL.h

@@ -1,20 +1,31 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#ifndef ICE_SSL_ICE_SSL_H
-#define ICE_SSL_ICE_SSL_H
+#ifndef ICESSL_ICESSL_H
+#define ICESSL_ICESSL_H
 
 #include <IceUtil/PushDisableWarnings.h>
-#include <IceUtil/Config.h>
-#if !defined(ICE_OS_WINRT) && (!defined(__APPLE__) || TARGET_OS_IPHONE == 0)
-#   include <IceSSL/Plugin.h>
+#include <Ice/Config.h>
+#include <IceSSL/Plugin.h>
+
+#if defined(_WIN32)
+#  if defined(ICE_OS_UWP)
+#    include <IceSSL/UWP.h>
+#  else
+#    include <IceSSL/SChannel.h>
+#  endif
+#elif defined(__APPLE__)
+#  include <IceSSL/SecureTransport.h>
+#else
+#  include <IceSSL/OpenSSL.h>
 #endif
+
 #include <IceSSL/EndpointInfo.h>
 #include <IceSSL/ConnectionInfo.h>
 #include <IceUtil/PopDisableWarnings.h>

data/ext/ice/cpp/include/IceSSL/OpenSSL.h

@@ -0,0 +1,130 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#ifndef ICESSL_OPENSSL_H
+#define ICESSL_OPENSSL_H
+
+#include <IceSSL/Plugin.h>
+
+#include <openssl/x509v3.h>
+#include <openssl/pem.h>
+
+//
+// Automatically link IceSSLOpenSSL[D|++11|++11D].lib with Visual C++
+//
+#if defined(_MSC_VER)
+#  if !defined(ICE_BUILDING_ICESSL_OPENSSL) && defined(ICESSL_OPENSSL_API_EXPORTS)
+#    define ICE_BUILDING_ICESSL_OPENSSL
+#  endif
+
+#  if !defined(ICE_BUILDING_ICESSL_OPENSSL)
+#    pragma comment(lib, ICE_LIBNAME("IceSSLOpenSSL"))
+#  endif
+#endif
+
+#ifndef ICESSL_OPENSSL_API
+#   if defined(ICE_STATIC_LIBS)
+#       define ICESSL_OPENSSL_API /**/
+#   elif defined(ICESSL_OPENSSL_API_EXPORTS)
+#       define ICESSL_OPENSSL_API ICE_DECLSPEC_EXPORT
+#   else
+#       define ICESSL_OPENSSL_API ICE_DECLSPEC_IMPORT
+#   endif
+#endif
+
+#if defined(_WIN32) && !defined(ICESSL_OPENSSL_API_EXPORTS)
+
+namespace Ice
+{
+
+ICE_PLUGIN_REGISTER_DECLSPEC_IMPORT void registerIceSSLOpenSSL(bool = true);
+
+}
+#endif
+
+namespace IceSSL
+{
+
+namespace OpenSSL
+{
+
+class Certificate;
+ICE_DEFINE_PTR(CertificatePtr, Certificate);
+
+class ICESSL_OPENSSL_API Certificate : public virtual IceSSL::Certificate
+{
+public:
+
+    //
+    // Construct a certificate using a native certificate.
+    //
+    // The Certificate class assumes ownership of the given native
+    // certificate.
+    //
+    static CertificatePtr create(x509_st*);
+
+    //
+    // Load the certificate from a file. The certificate must use the
+    // PEM encoding format. Raises CertificateReadException if the
+    // file cannot be read.
+    //
+    static CertificatePtr load(const std::string&);
+
+    //
+    // Decode a certificate from a string that uses the PEM encoding
+    // format. Raises CertificateEncodingException if an error
+    // occurs.
+    //
+    static CertificatePtr decode(const std::string&);
+
+    //
+    // Retrieve the native X509 certificate value wrapped by this
+    // object.
+    //
+    // The returned reference is only valid for the lifetime of this
+    // object. you can increment it with X509_dup.
+    //
+    virtual x509_st* getCert() const = 0;
+};
+
+class ICESSL_OPENSSL_API Plugin : public virtual IceSSL::Plugin
+{
+public:
+    //
+    // returns OpenSSL version number.
+    //
+    virtual Ice::Long getOpenSSLVersion() const = 0;
+    //
+    // Establish the OpenSSL context. This must be done before the
+    // plug-in is initialized, therefore the application must define
+    // the property Ice.InitPlugins=0, set the context, and finally
+    // invoke initializePlugins on the PluginManager.
+    //
+    // When the application supplies its own OpenSSL context, the
+    // plug-in ignores configuration properties related to certificates,
+    // keys, and passwords.
+    //
+    // Note that the plugin assumes ownership of the given context.
+    //
+    virtual void setContext(SSL_CTX*) = 0;
+
+    //
+    // Obtain the SSL context. Use caution when modifying this value.
+    // Changes made to this value have no effect on existing connections.
+    //
+    virtual SSL_CTX* getContext() = 0;
+
+};
+ICE_DEFINE_PTR(PluginPtr, Plugin);
+
+} // OpenSSL namespace end
+
+} // IceSSL namespace end
+
+#endif

data/ext/ice/cpp/include/IceSSL/Plugin.h

@@ -1,107 +1,56 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 
-#ifndef ICE_SSL_PLUGIN_H
-#define ICE_SSL_PLUGIN_H
+#ifndef ICESSL_PLUGIN_H
+#define ICESSL_PLUGIN_H
 
-#include <IceUtil/Time.h>
 #include <Ice/Plugin.h>
 #include <IceSSL/Config.h>
-#include <IceSSL/ConnectionInfo.h>
+#include <IceSSL/ConnectionInfoF.h>
+
+#ifdef ICE_CPP11_MAPPING
+#   include <chrono>
+#else
+#   include <IceUtil/Time.h>
+#endif
 
 #include <vector>
 #include <list>
 
-#if defined(ICE_USE_SECURE_TRANSPORT)
-#   include <CoreFoundation/CFError.h>
-#elif defined(ICE_USE_SCHANNEL)
-#   include <wincrypt.h>
-#endif
-
-#ifndef ICE_SSL_API
-#   ifdef ICE_SSL_API_EXPORTS
-#       define ICE_SSL_API ICE_DECLSPEC_EXPORT
-#   elif defined(ICE_STATIC_LIBS)
-#       define ICE_SSL_API /**/
+#ifndef ICESSL_API
+#   if defined(ICE_STATIC_LIBS)
+#       define ICESSL_API /**/
+#   elif defined(ICESSL_API_EXPORTS)
+#       define ICESSL_API ICE_DECLSPEC_EXPORT
 #   else
-#       define ICE_SSL_API ICE_DECLSPEC_IMPORT
+#       define ICESSL_API ICE_DECLSPEC_IMPORT
 #   endif
 #endif
 
-#ifdef ICE_USE_OPENSSL
-
-//
-// Pointer to an opaque SSL session context object. ssl_ctx_st is the
-// OpenSSL type that holds configuration settings for all SSL
-// connections.
-//
-typedef struct ssl_ctx_st SSL_CTX;
-
-//
-// Pointer to an opaque certificate object. X509_st is the OpenSSL
-// type that represents a certificate.
-//
-typedef struct x509_st* X509CertificateRef;
-
-//
-// EVP_PKEY is the OpenSSL type that represents a public key.
-//
-typedef struct evp_pkey_st* KeyRef;
-
-//
-// Type that represents an X509 distinguished name
-//
-typedef struct X509_name_st X509NAME;
-
-#elif defined(ICE_USE_SECURE_TRANSPORT)
-
-//
-// Pointer to an opaque certificate object.
-//
-struct OpaqueSecCertificateRef;
-typedef struct OpaqueSecCertificateRef* X509CertificateRef;
-
-//
-// Pointer to an opaque key object.
-//
-struct OpaqueSecKeyRef;
-typedef struct OpaqueSecKeyRef* KeyRef;
-
-#elif defined(ICE_USE_SCHANNEL)
-
-//
-// Pointer to an opaque certificate object.
-//
-typedef CERT_SIGNED_CONTENT_INFO* X509CertificateRef;
-
-//
-// Pointer to an opaque key object.
-//
-typedef CERT_PUBLIC_KEY_INFO* KeyRef;
-
-#endif
-
 namespace IceSSL
 {
 
 //
 // This exception is thrown if the certificate cannot be read.
 //
-class ICE_SSL_API CertificateReadException : public IceUtil::Exception
+class ICESSL_API CertificateReadException : public IceUtil::ExceptionHelper<CertificateReadException>
 {
 public:
 
     CertificateReadException(const char*, int, const std::string&);
+#ifndef ICE_CPP11_COMPILER
     virtual ~CertificateReadException() throw();
-    virtual std::string ice_name() const;
+#endif
+    virtual std::string ice_id() const;
+#ifndef ICE_CPP11_MAPPING
     virtual CertificateReadException* ice_clone() const;
-    virtual void ice_throw() const;
+#endif
 
     std::string reason;
 
@@ -113,18 +62,18 @@ private:
 //
 // This exception is thrown if the certificate cannot be encoded.
 //
-class ICE_SSL_API CertificateEncodingException : public IceUtil::Exception
+class ICESSL_API CertificateEncodingException : public IceUtil::ExceptionHelper<CertificateEncodingException>
 {
 public:
 
     CertificateEncodingException(const char*, int, const std::string&);
-#ifdef ICE_USE_SECURE_TRANSPORT
-    CertificateEncodingException(const char*, int, CFErrorRef);
-#endif
+#ifndef ICE_CPP11_COMPILER
     virtual ~CertificateEncodingException() throw();
-    virtual std::string ice_name() const;
+#endif
+    virtual std::string ice_id() const;
+#ifndef ICE_CPP11_MAPPING
     virtual CertificateEncodingException* ice_clone() const;
-    virtual void ice_throw() const;
+#endif
 
     std::string reason;
 
@@ -136,15 +85,18 @@ private:
 //
 // This exception is thrown if a distinguished name cannot be parsed.
 //
-class ICE_SSL_API ParseException : public IceUtil::Exception
+class ICESSL_API ParseException : public IceUtil::ExceptionHelper<ParseException>
 {
 public:
 
     ParseException(const char*, int, const std::string&);
+#ifndef ICE_CPP11_COMPILER
     virtual ~ParseException() throw();
-    virtual std::string ice_name() const;
+#endif
+    virtual std::string ice_id() const;
+#ifndef ICE_CPP11_MAPPING
     virtual ParseException* ice_clone() const;
-    virtual void ice_throw() const;
+#endif
 
     std::string reason;
 
@@ -153,41 +105,6 @@ private:
     static const char* _name;
 };
 
-//
-// Forward declaration.
-//
-class Certificate;
-typedef IceUtil::Handle<Certificate> CertificatePtr;
-
-//
-// A representation of a PublicKey.
-//
-class ICE_SSL_API PublicKey : public IceUtil::Shared
-{
-public:
-
-    ~PublicKey();
-
-    //
-    // Retrieve the native public key value wrapped by this object.
-    //
-    // The returned reference is only valid for the lifetime of this
-    // object. With SecureTransport you can increment the reference
-    // count of the returned object with CFRetain.
-    //
-    KeyRef key() const;
-
-private:
-
-    PublicKey(const CertificatePtr&, KeyRef);
-    friend class Certificate;
-
-    CertificatePtr _cert;
-    KeyRef _key;
-
-};
-typedef IceUtil::Handle<PublicKey> PublicKeyPtr;
-
 //
 // This class represents a DistinguishedName, similar to the Java
 // type X500Principal and the .NET type X500DistinguishedName.
@@ -200,24 +117,17 @@ typedef IceUtil::Handle<PublicKey> PublicKeyPtr;
 // provided in the constructor (i.e., "ZeroC, Inc." will not turn
 // into ZeroC\, Inc.).
 //
-class ICE_SSL_API DistinguishedName
+class ICESSL_API DistinguishedName
 {
 public:
 
-#ifdef ICE_USE_OPENSSL
-    //
-    // Create a DistinguishedName using an OpenSSL value.
-    //
-    DistinguishedName(X509NAME*);
-#endif
-
     //
     // Create a DistinguishedName from a string encoded using
     // the rules in RFC2253.
     //
     // Throws ParseException if parsing fails.
     //
-    DistinguishedName(const std::string&);
+    explicit DistinguishedName(const std::string&);
 
     //
     // Create a DistinguishedName from a list of RDN pairs,
@@ -225,15 +135,14 @@ public:
     // For example, the RDN "O=ZeroC" is represented by the
     // pair ("O", "ZeroC").
     //
-    DistinguishedName(const std::list<std::pair<std::string, std::string> >&);
+    explicit DistinguishedName(const std::list<std::pair<std::string, std::string> >&);
 
     //
     // This is an exact match. The order of the RDN components is
     // important.
     //
-    bool operator==(const DistinguishedName&) const;
-    bool operator!=(const DistinguishedName&) const;
-    bool operator<(const DistinguishedName&) const;
+    friend ICESSL_API bool operator==(const DistinguishedName&, const DistinguishedName&);
+    friend ICESSL_API bool operator<(const DistinguishedName&, const DistinguishedName&);
 
     //
     // Perform a partial match with another DistinguishedName. The function
@@ -241,128 +150,151 @@ public:
     // DistinguishedName and they have the same values.
     //
     bool match(const DistinguishedName&) const;
+    bool match(const std::string&) const;
 
     //
     // Encode the DN in RFC2253 format.
     //
     operator std::string() const;
 
-private:
+protected:
 
     void unescape();
 
+private:
+
     std::list<std::pair<std::string, std::string> > _rdns;
     std::list<std::pair<std::string, std::string> > _unescaped;
 };
 
+inline bool
+operator>(const DistinguishedName& lhs, const DistinguishedName& rhs)
+{
+    return rhs < lhs;
+}
+
+inline bool
+operator<=(const DistinguishedName& lhs, const DistinguishedName& rhs)
+{
+    return !(lhs > rhs);
+}
+
+inline bool
+operator>=(const DistinguishedName& lhs, const DistinguishedName& rhs)
+{
+    return !(lhs < rhs);
+}
+
+inline bool
+operator!=(const DistinguishedName& lhs, const DistinguishedName& rhs)
+{
+    return !(lhs == rhs);
+}
+
 //
-// This convenience class is a wrapper around a native certificate.
-// The interface is inspired by java.security.cert.X509Certificate.
+// This class represents an X509 Certificate extension.
 //
-class ICE_SSL_API Certificate : public IceUtil::Shared
+class ICESSL_API X509Extension
+#ifndef ICE_CPP11_MAPPING
+    : public virtual IceUtil::Shared
+#endif
 {
 public:
 
-    //
-    // Construct a certificate using a native certificate.
-    //
-    // The Certificate class assumes ownership of the given native
-    // certificate.
-    //
-    Certificate(X509CertificateRef);
-    ~Certificate();
+    virtual bool isCritical() const = 0;
+    virtual std::string getOID() const = 0;
+    virtual std::vector<Ice::Byte> getData() const = 0;
+};
+ICE_DEFINE_PTR(X509ExtensionPtr, X509Extension);
 
-    //
-    // Load the certificate from a file. The certificate must use the
-    // PEM encoding format. Raises CertificateReadException if the
-    // file cannot be read.
-    //
-    static CertificatePtr load(const std::string&);
+//
+// This convenience class is a wrapper around a native certificate.
+// The interface is inspired by java.security.cert.X509Certificate.
+//
 
-    //
-    // Decode a certificate from a string that uses the PEM encoding
-    // format.  Raises CertificateEncodingException if an error
-    // occurs.
-    //
-    static CertificatePtr decode(const std::string&);
+class Certificate;
+ICE_DEFINE_PTR(CertificatePtr, Certificate);
+
+class ICESSL_API Certificate :
+#ifdef ICE_CPP11_MAPPING
+        public std::enable_shared_from_this<Certificate>
+#else
+        public virtual IceUtil::Shared
+#endif
+{
+public:
 
     //
-    // Those operators compare the certificates for equality using the
+    // Compare the certificates for equality using the
     // native certificate comparison method.
     //
-    bool operator==(const Certificate&) const;
-    bool operator!=(const Certificate&) const;
+    virtual bool operator==(const Certificate&) const = 0;
+    virtual bool operator!=(const Certificate&) const = 0;
 
     //
-    // Get the certificate's public key.
+    // Authority key identifier
     //
-    PublicKeyPtr getPublicKey() const;
+    virtual std::vector<Ice::Byte> getAuthorityKeyIdentifier() const = 0;
 
     //
-    // Verify that this certificate was signed by the given certificate
-    // public key. Returns true if signed, false otherwise.
+    // Subject key identifier
     //
-    bool verify(const CertificatePtr&) const;
+    virtual std::vector<Ice::Byte> getSubjectKeyIdentifier() const = 0;
 
-#ifdef ICE_USE_OPENSSL
-    //
-    // Verify that this certificate was signed by the given public
-    // key. Returns true if signed, false otherwise.
     //
-    // This method was deprecated for consistency with some SSL
-    // engines that require a certificate and not just a public key to
-    // verify the certificate signature.
+    // Verify that this certificate was signed by the given certificate
+    // public key. Returns true if signed, false otherwise.
     //
-    ICE_DEPRECATED_API("verify(const PublicKeyPtr&) is deprecated, use verify(const CertificatePtr&) instead")
-    bool verify(const PublicKeyPtr&) const;
-#endif
+    virtual bool verify(const CertificatePtr&) const = 0;
 
     //
     // Return a string encoding of the certificate in PEM format.
     // Raises CertificateEncodingException if an error occurs.
     //
-    std::string encode() const;
+    virtual std::string encode() const = 0;
 
     //
     // Checks that the certificate is currently valid, that is, the current
     // date falls between the validity period given in the certificate.
     //
-    bool checkValidity() const;
+    virtual bool checkValidity() const = 0;
 
     //
     // Checks that the certificate is valid at the given time.
     //
-    bool checkValidity(const IceUtil::Time&) const;
+#ifdef ICE_CPP11_MAPPING
+    virtual bool checkValidity(const std::chrono::system_clock::time_point&) const = 0;
+#else
+    virtual bool checkValidity(const IceUtil::Time&) const = 0;
+#endif
 
     //
     // Get the not-after validity time.
     //
-    IceUtil::Time getNotAfter() const;
+#ifdef ICE_CPP11_MAPPING
+    virtual std::chrono::system_clock::time_point getNotAfter() const = 0;
+#else
+    virtual IceUtil::Time getNotAfter() const = 0;
+#endif
 
     //
     // Get the not-before validity time.
     //
-    IceUtil::Time getNotBefore() const;
+#ifdef ICE_CPP11_MAPPING
+    virtual std::chrono::system_clock::time_point getNotBefore() const = 0;
+#else
+    virtual IceUtil::Time getNotBefore() const = 0;
+#endif
 
     //
     // Get the serial number. This is an arbitrarily large number.
     //
-    std::string getSerialNumber() const;
-
-    //
-    // Get the signature algorithm name used to sign the certificate.
-    //
-    //std::string getSigAlgName() const;
-
-    //
-    // Get the signature algorithm OID string from the certificate.
-    //
-    //std::string getSigAlgOID() const;
+    virtual std::string getSerialNumber() const = 0;
 
     //
     // Get the issuer's distinguished name (DN).
     //
-    DistinguishedName getIssuerDN() const;
+    virtual DistinguishedName getIssuerDN() const = 0;
 
     //
     // Get the values in the issuer's alternative names extension.
@@ -390,97 +322,73 @@ public:
     // The remainder of the data will result in an empty string. Use the raw
     // X509* certificate to obtain these values.
     //
-    std::vector<std::pair<int, std::string> > getIssuerAlternativeNames();
+    virtual std::vector<std::pair<int, std::string> > getIssuerAlternativeNames() const = 0;
 
     //
     // Get the subject's distinguished name (DN).
     //
-    DistinguishedName getSubjectDN() const;
+    virtual DistinguishedName getSubjectDN() const = 0;
 
     //
     // See the comment for getIssuerAlternativeNames.
     //
-    std::vector<std::pair<int, std::string> > getSubjectAlternativeNames();
+    virtual std::vector<std::pair<int, std::string> > getSubjectAlternativeNames() const = 0;
 
     //
     // Retrieve the certificate version number.
     //
-    int getVersion() const;
+    virtual int getVersion() const = 0;
 
     //
     // Stringify the certificate. This is a human readable version of
     // the certificate, not a DER or PEM encoding.
     //
-    std::string toString() const;
+    virtual std::string toString() const = 0;
 
     //
-    // Retrieve the native X509 certificate value wrapped by this
-    // object.
-    //
-    // The returned reference is only valid for the lifetime of this
-    // object. With SecureTransport you can increment the reference
-    // count of the returned object with CFRetain. With OpenSSL, you
-    // can increment it with X509_dup. With SChannel, the returned
-    // reference is a pointer to a struct.
+    // Return a list with the X509v3 extensions contained in the
+    // certificate.
     //
-    X509CertificateRef getCert() const;
-
-private:
-
-    X509CertificateRef _cert;
-
-#ifdef ICE_USE_SCHANNEL
-    CERT_INFO* _certInfo;
-#endif
-};
-
-//
-// NativeConnectionInfo is an extension of IceSSL::ConnectionInfo that
-// provides access to native certificates.
-//
-class ICE_SSL_API NativeConnectionInfo : public ConnectionInfo
-{
-public:
+    virtual std::vector<X509ExtensionPtr> getX509Extensions() const = 0;
 
     //
-    // The certificate chain. This may be empty if the peer did not
-    // supply a certificate. The peer's certificate (if any) is the
-    // first one in the chain.
+    // Return the extension with the given OID or null if the certificate
+    // does not contain a extension with the given OID.
     //
-    std::vector<CertificatePtr> nativeCerts;
-};
-typedef IceUtil::Handle<NativeConnectionInfo> NativeConnectionInfoPtr;
+    virtual X509ExtensionPtr getX509Extension(const std::string&) const = 0;
 
-//
-// WSSNativeConnectionInfo is an extension of IceSSL::WSSConnectionInfo
-// that provides access to native certificates.
-//
-class ICE_SSL_API WSSNativeConnectionInfo : public WSSConnectionInfo
-{
-public:
+    //
+    // Load the certificate from a file. The certificate must use the
+    // PEM encoding format. Raises CertificateReadException if the
+    // file cannot be read.
+    //
+    static CertificatePtr load(const std::string&);
 
     //
-    // The certificate chain. This may be empty if the peer did not
-    // supply a certificate. The peer's certificate (if any) is the
-    // first one in the chain.
+    // Decode a certificate from a string that uses the PEM encoding
+    // format. Raises CertificateEncodingException if an error
+    // occurs.
     //
-    std::vector<CertificatePtr> nativeCerts;
+    static CertificatePtr decode(const std::string&);
 };
-typedef IceUtil::Handle<WSSNativeConnectionInfo> WSSNativeConnectionInfoPtr;
 
+#ifndef ICE_CPP11_MAPPING // C++98 mapping
 //
 // An application can customize the certificate verification process
 // by implementing the CertificateVerifier interface.
 //
-class ICE_SSL_API CertificateVerifier : public IceUtil::Shared
+
+class ICESSL_API CertificateVerifier : public IceUtil::Shared
 {
 public:
 
+    virtual ~CertificateVerifier();
+
     //
     // Return false if the connection should be rejected, or true to
     // allow it.
     //
-    virtual bool verify(const NativeConnectionInfoPtr&) = 0;
+    virtual bool verify(const ConnectionInfoPtr&) = 0;
 };
 typedef IceUtil::Handle<CertificateVerifier> CertificateVerifierPtr;
 
@@ -499,10 +407,12 @@ typedef IceUtil::Handle<CertificateVerifier> CertificateVerifierPtr;
 // IceSSL.DelayInit=1), configure the PasswordPrompt, then manually
 // initialize the plug-in.
 //
-class ICE_SSL_API PasswordPrompt : public IceUtil::Shared
+class ICESSL_API PasswordPrompt : public IceUtil::Shared
 {
 public:
 
+    virtual ~PasswordPrompt();
+
     //
     // The getPassword method may be invoked repeatedly, such as when
     // several encrypted files are opened, or when multiple password
@@ -511,46 +421,49 @@ public:
     virtual std::string getPassword() = 0;
 };
 typedef IceUtil::Handle<PasswordPrompt> PasswordPromptPtr;
+#endif
 
-class ICE_SSL_API Plugin : public Ice::Plugin
+class ICESSL_API Plugin : public Ice::Plugin
 {
 public:
 
+    virtual ~Plugin();
+
     //
     // Establish the certificate verifier object. This should be done
     // before any connections are established.
     //
+#ifdef ICE_CPP11_MAPPING
+    virtual void setCertificateVerifier(std::function<bool(const std::shared_ptr<ConnectionInfo>&)>) = 0;
+#else
     virtual void setCertificateVerifier(const CertificateVerifierPtr&) = 0;
+#endif
 
     //
     // Establish the password prompt object. This must be done before
     // the plug-in is initialized.
     //
+#ifdef ICE_CPP11_MAPPING
+    virtual void setPasswordPrompt(std::function<std::string()>) = 0;
+#else
     virtual void setPasswordPrompt(const PasswordPromptPtr&) = 0;
+#endif
 
-#ifdef ICE_USE_OPENSSL
-    //
-    // Establish the OpenSSL context. This must be done before the
-    // plug-in is initialized, therefore the application must define
-    // the property Ice.InitPlugins=0, set the context, and finally
-    // invoke initializePlugins on the PluginManager.
     //
-    // When the application supplies its own OpenSSL context, the
-    // plug-in ignores configuration properties related to certificates,
-    // keys, and passwords.
-    //
-    // Note that the plugin assumes ownership of the given context.
+    // Load the certificate from a file. The certificate must use the
+    // PEM encoding format. Raises CertificateReadException if the
+    // file cannot be read.
     //
-    virtual void setContext(SSL_CTX*) = 0;
+    virtual CertificatePtr load(const std::string&) const = 0;
 
     //
-    // Obtain the SSL context. Use caution when modifying this value.
-    // Changes made to this value have no effect on existing connections.
+    // Decode a certificate from a string that uses the PEM encoding
+    // format. Raises CertificateEncodingException if an error
+    // occurs.
     //
-    virtual SSL_CTX* getContext() = 0;
-#endif
+    virtual CertificatePtr decode(const std::string&) const = 0;
 };
-typedef IceUtil::Handle<Plugin> PluginPtr;
+ICE_DEFINE_PTR(PluginPtr, Plugin);
 
 }