zeroc-ice 3.6.5 → 3.7.4

data/ext/ice/cpp/src/IceSSL/OpenSSLEngine.h

@@ -0,0 +1,59 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#ifndef ICESSL_OPENSSL_ENGINE_H
+#define ICESSL_OPENSSL_ENGINE_H
+
+#include <IceSSL/SSLEngine.h>
+#include <IceSSL/InstanceF.h>
+#include <IceSSL/OpenSSLUtil.h>
+
+#include <Ice/BuiltinSequences.h>
+
+namespace IceSSL
+{
+
+namespace OpenSSL
+{
+
+class SSLEngine : public IceSSL::SSLEngine
+{
+public:
+
+    SSLEngine(const Ice::CommunicatorPtr&);
+    ~SSLEngine();
+
+    virtual void initialize();
+    virtual void destroy();
+    virtual IceInternal::TransceiverPtr
+    createTransceiver(const IceSSL::InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool);
+
+#ifndef OPENSSL_NO_DH
+    DH* dhParams(int);
+#endif
+
+    SSL_CTX* context() const;
+    void context(SSL_CTX*);
+    std::string sslErrors() const;
+
+private:
+
+    void cleanup();
+    SSL_METHOD* getMethod(int);
+    void setOptions(int);
+    enum Protocols { SSLv3 = 1, TLSv1_0 = 2, TLSv1_1 = 4, TLSv1_2 = 8, TLSv1_3 = 16 };
+    int parseProtocols(const Ice::StringSeq&) const;
+
+    SSL_CTX* _ctx;
+
+#ifndef OPENSSL_NO_DH
+    IceSSL::OpenSSL::DHParamsPtr _dhParams;
+#endif
+};
+
+} // OpenSSL namespace end
+
+} // IceSSL namespace endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/OpenSSLEngineF.h

@@ -0,0 +1,27 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#ifndef ICESSL_OPENSSL_ENGINE_F_H
+#define ICESSL_OPENSSL_ENGINE_F_H
+
+#include <IceUtil/Shared.h>
+#include <Ice/Handle.h>
+
+#include <IceSSL/OpenSSL.h>
+
+namespace IceSSL
+{
+
+namespace OpenSSL
+{
+
+class SSLEngine;
+ICESSL_OPENSSL_API IceUtil::Shared* upCast(SSLEngine*);
+typedef IceInternal::Handle<SSLEngine> SSLEnginePtr;
+
+} // OpenSSL namespace end
+
+} // IceSSL namespace end
+
+#endif

data/ext/ice/cpp/src/IceSSL/OpenSSLPluginI.cpp

@@ -0,0 +1,127 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#include <IceSSL/PluginI.h>
+#include <IceSSL/OpenSSL.h>
+#include <IceSSL/OpenSSLEngine.h>
+
+#include <Ice/Initialize.h>
+
+using namespace std;
+
+namespace
+{
+
+class PluginI : public IceSSL::PluginI,
+                public IceSSL::OpenSSL::Plugin
+{
+public:
+
+    PluginI(const Ice::CommunicatorPtr&);
+
+    virtual Ice::Long getOpenSSLVersion() const;
+    virtual IceSSL::CertificatePtr create(x509_st*) const;
+    virtual IceSSL::CertificatePtr load(const std::string&) const;
+    virtual IceSSL::CertificatePtr decode(const std::string&) const;
+    virtual void setContext(SSL_CTX*);
+    virtual SSL_CTX* getContext();
+};
+
+} // anonymous namespace end
+
+//
+// Plugin implementation.
+//
+PluginI::PluginI(const Ice::CommunicatorPtr& com) :
+    IceSSL::PluginI(com, new IceSSL::OpenSSL::SSLEngine(com))
+{
+}
+
+Ice::Long
+PluginI::getOpenSSLVersion() const
+{
+    return SSLeay();
+}
+
+IceSSL::CertificatePtr
+PluginI::create(x509_st* cert) const
+{
+    return IceSSL::OpenSSL::Certificate::create(cert);
+}
+
+IceSSL::CertificatePtr
+PluginI::load(const std::string& file) const
+{
+    return IceSSL::OpenSSL::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+PluginI::decode(const std::string& encoding) const
+{
+    return IceSSL::OpenSSL::Certificate::load(encoding);
+}
+
+void
+PluginI::setContext(SSL_CTX* context)
+{
+    IceSSL::OpenSSL::SSLEngine* engine = dynamic_cast<IceSSL::OpenSSL::SSLEngine*>(_engine.get());
+    assert(engine);
+    engine->context(context);
+}
+
+SSL_CTX*
+PluginI::getContext()
+{
+    IceSSL::OpenSSL::SSLEngine* engine = dynamic_cast<IceSSL::OpenSSL::SSLEngine*>(_engine.get());
+    assert(engine);
+    return engine->context();
+}
+
+#ifdef _WIN32
+//
+// Plug-in factory function.
+//
+extern "C" ICESSL_OPENSSL_API Ice::Plugin*
+createIceSSLOpenSSL(const Ice::CommunicatorPtr& communicator, const string& /*name*/, const Ice::StringSeq& /*args*/)
+{
+    return new PluginI(communicator);
+}
+
+namespace Ice
+{
+
+ICESSL_OPENSSL_API void
+registerIceSSLOpenSSL(bool loadOnInitialize)
+{
+    Ice::registerPluginFactory("IceSSL", createIceSSLOpenSSL, loadOnInitialize);
+}
+
+}
+
+#else
+
+extern "C" ICESSL_API Ice::Plugin*
+createIceSSL(const Ice::CommunicatorPtr& communicator, const string& /*name*/, const Ice::StringSeq& /*args*/)
+{
+    return new PluginI(communicator);
+}
+
+//
+// The following functions are defined only when OpenSSL is the default
+// implementation. In Windows the default implementation is always
+// SChannel.
+//
+IceSSL::CertificatePtr
+IceSSL::Certificate::load(const std::string& file)
+{
+    return IceSSL::OpenSSL::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+IceSSL::Certificate::decode(const std::string& encoding)
+{
+    return IceSSL::OpenSSL::Certificate::decode(encoding);
+}
+
+#endif

data/ext/ice/cpp/src/IceSSL/OpenSSLTransceiverI.cpp

@@ -1,13 +1,9 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/OpenSSLTransceiverI.h>
+#include <IceSSL/OpenSSLEngine.h>
 
 #include <IceUtil/Mutex.h>
 #include <IceUtil/MutexPtrLock.h>
@@ -20,9 +16,9 @@
 #include <Ice/LoggerUtil.h>
 #include <Ice/Buffer.h>
 #include <Ice/LocalException.h>
+#include <Ice/Network.h>
 
-#ifdef ICE_USE_OPENSSL
-
+#include <openssl/ssl.h>
 #include <openssl/err.h>
 #include <openssl/bio.h>
 
@@ -31,7 +27,7 @@ using namespace Ice;
 using namespace IceSSL;
 
 //
-// BUGFIX: an openssl bug that affects OpensSSL < 1.0.0k
+// BUGFIX: an openssl bug that affects OpenSSL < 1.0.0k
 // could cause a deadlock when decoding public keys.
 //
 // See: http://cvs.openssl.org/chngview?cn=22569
@@ -70,47 +66,77 @@ int
 IceSSL_opensslVerifyCallback(int ok, X509_STORE_CTX* ctx)
 {
     SSL* ssl = reinterpret_cast<SSL*>(X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
-    TransceiverI* p = reinterpret_cast<TransceiverI*>(SSL_get_ex_data(ssl, 0));
+    OpenSSL::TransceiverI* p = reinterpret_cast<OpenSSL::TransceiverI*>(SSL_get_ex_data(ssl, 0));
     return p->verifyCallback(ok, ctx);
 }
 
 }
 
 IceInternal::NativeInfoPtr
-IceSSL::TransceiverI::getNativeInfo()
+OpenSSL::TransceiverI::getNativeInfo()
 {
-    return _stream;
+    return _delegate->getNativeInfo();
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer, bool&)
+OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer)
 {
-    IceInternal::SocketOperation status = _stream->connect(readBuffer, writeBuffer);
-    if(status != IceInternal::SocketOperationNone)
+    if(!_connected)
     {
-        return status;
+        IceInternal::SocketOperation status = _delegate->initialize(readBuffer, writeBuffer);
+        if(status != IceInternal::SocketOperationNone)
+        {
+            return status;
+        }
+        _connected = true;
     }
 
     if(!_ssl)
     {
-        //
-        // This static_cast is necessary due to 64bit windows. There SOCKET is a non-int type.
-        //
-        BIO* bio = BIO_new_socket(static_cast<int>(_stream->fd()), 0);
+        SOCKET fd = _delegate->getNativeInfo()->fd();
+        BIO* bio = 0;
+        if(fd == INVALID_SOCKET)
+        {
+            assert(_sentBytes == 0);
+            _maxSendPacketSize = 128 * 1024; // 128KB
+            _maxRecvPacketSize = 128 * 1024; // 128KB
+            if(!BIO_new_bio_pair(&bio, _maxSendPacketSize, &_memBio, _maxRecvPacketSize))
+            {
+                bio = 0;
+                _memBio = 0;
+            }
+        }
+        else
+        {
+#ifdef ICE_USE_IOCP
+            assert(_sentBytes == 0);
+            _maxSendPacketSize = std::max(512, IceInternal::getSendBufferSize(fd));
+            _maxRecvPacketSize = std::max(512, IceInternal::getRecvBufferSize(fd));
+            if(!BIO_new_bio_pair(&bio, _maxSendPacketSize, &_memBio, _maxRecvPacketSize))
+            {
+                bio = 0;
+                _memBio = 0;
+            }
+#else
+            bio = BIO_new_socket(fd, 0);
+#endif
+        }
+
         if(!bio)
         {
-            SecurityException ex(__FILE__, __LINE__);
-            ex.reason = "openssl failure";
-            throw ex;
+            throw SecurityException(__FILE__, __LINE__, "openssl failure");
         }
 
         _ssl = SSL_new(_engine->context());
         if(!_ssl)
         {
             BIO_free(bio);
-            SecurityException ex(__FILE__, __LINE__);
-            ex.reason = "openssl failure";
-            throw ex;
+            if(_memBio)
+            {
+                BIO_free(_memBio);
+                _memBio = 0;
+            }
+            throw SecurityException(__FILE__, __LINE__, "openssl failure");
         }
         SSL_set_bio(_ssl, bio, bio);
 
@@ -140,8 +166,46 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
                     assert(false);
                 }
             }
+
+            //
+            // Hostname verification was included in OpenSSL 1.0.2
+            //
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10002000L
+            if(_engine->getCheckCertName() && !_host.empty())
+            {
+                X509_VERIFY_PARAM* param = SSL_get0_param(_ssl);
+                if(IceInternal::isIpAddress(_host))
+                {
+                    if(!X509_VERIFY_PARAM_set1_ip_asc(param, _host.c_str()))
+                    {
+                        throw SecurityException(__FILE__, __LINE__, "IceSSL: error setting the expected IP address `"
+                                                + _host + "'");
+                    }
+                }
+                else
+                {
+                    if(!X509_VERIFY_PARAM_set1_host(param, _host.c_str(), 0))
+                    {
+                        throw SecurityException(__FILE__, __LINE__, "IceSSL: error setting the expected host name `"
+                                                + _host + "'");
+                    }
+                }
+            }
+#endif
+
             SSL_set_verify(_ssl, sslVerifyMode, IceSSL_opensslVerifyCallback);
         }
+
+        //
+        // Enable SNI
+        //
+        if(!_incoming && _engine->getServerNameIndication() && !_host.empty() && !IceInternal::isIpAddress(_host))
+        {
+            if(!SSL_set_tlsext_host_name(_ssl, _host.c_str()))
+            {
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: setting SNI host failed `" + _host + "'");
+            }
+        }
     }
 
     while(!SSL_is_init_finished(_ssl))
@@ -151,7 +215,7 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         //
 
         //
-        // BUGFIX: an openssl bug that affects OpensSSL < 1.0.0k
+        // BUGFIX: an openssl bug that affects OpenSSL < 1.0.0k
         // could cause a deadlock when decoding public keys.
         //
         // See: http://cvs.openssl.org/chngview?cn=22569
@@ -165,6 +229,16 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
 #if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x100000bfL && !defined(LIBRESSL_VERSION_NUMBER)
         sync.release();
 #endif
+
+        if(_memBio && BIO_ctrl_pending(_memBio))
+        {
+            if(!send())
+            {
+                return IceInternal::SocketOperationWrite;
+            }
+            continue;
+        }
+
         if(ret <= 0)
         {
             switch(SSL_get_error(_ssl, ret))
@@ -176,66 +250,60 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
             }
             case SSL_ERROR_ZERO_RETURN:
             {
-                ConnectionLostException ex(__FILE__, __LINE__);
-                ex.error = IceInternal::getSocketErrno();
-                throw ex;
+                throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
             }
             case SSL_ERROR_WANT_READ:
             {
+                if(_memBio && receive())
+                {
+                    continue;
+                }
                 return IceInternal::SocketOperationRead;
             }
             case SSL_ERROR_WANT_WRITE:
             {
+                if(_memBio && send())
+                {
+                    continue;
+                }
                 return IceInternal::SocketOperationWrite;
             }
             case SSL_ERROR_SYSCALL:
             {
-                if(IceInternal::interrupted())
+                if(!_memBio)
                 {
-                    break;
-                }
-
-                if(IceInternal::wouldBlock())
-                {
-                    if(SSL_want_read(_ssl))
+                    if(IceInternal::interrupted())
                     {
-                        return IceInternal::SocketOperationRead;
+                        break;
                     }
-                    else if(SSL_want_write(_ssl))
+
+                    if(IceInternal::wouldBlock())
                     {
-                        return IceInternal::SocketOperationWrite;
+                        if(SSL_want_read(_ssl))
+                        {
+                            return IceInternal::SocketOperationRead;
+                        }
+                        else if(SSL_want_write(_ssl))
+                        {
+                            return IceInternal::SocketOperationWrite;
+                        }
+
+                        break;
                     }
 
-                    break;
-                }
-
-                if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
-                {
-                    ConnectionLostException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
-                }
-                else
-                {
-                    SocketException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
+                    if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
+                    {
+                        throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
+                    }
                 }
+                throw SocketException(__FILE__, __LINE__, IceInternal::getSocketErrno());
             }
             case SSL_ERROR_SSL:
             {
-                IceInternal::Address remoteAddr;
-                string desc = "<not available>";
-                if(IceInternal::fdToRemoteAddress(_stream->fd(), remoteAddr))
-                {
-                    desc = IceInternal::addrToString(remoteAddr);
-                }
                 ostringstream ostr;
                 ostr << "SSL error occurred for new " << (_incoming ? "incoming" : "outgoing")
-                     << " connection:\nremote address = " << desc << "\n" << _engine->sslErrors();
-                ProtocolException ex(__FILE__, __LINE__);
-                ex.reason = ostr.str();
-                throw ex;
+                     << " connection:\n" << _delegate->toString() << "\n" << _engine->sslErrors();
+                throw ProtocolException(__FILE__, __LINE__, ostr.str());
             }
             }
         }
@@ -257,14 +325,12 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         {
             ostringstream ostr;
             ostr << "IceSSL: certificate verification failed:\n" << X509_verify_cert_error_string(result);
-            string msg = ostr.str();
+            const string msg = ostr.str();
             if(_engine->securityTraceLevel() >= 1)
             {
                 _instance->logger()->trace(_instance->traceCategory(), msg);
             }
-            SecurityException ex(__FILE__, __LINE__);
-            ex.reason = msg;
-            throw ex;
+            throw SecurityException(__FILE__, __LINE__,  msg);
         }
     }
     else
@@ -272,7 +338,26 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         _verified = true;
     }
 
-    _engine->verifyPeer(_stream->fd(), _host, NativeConnectionInfoPtr::dynamicCast(getInfo()));
+    _cipher = SSL_get_cipher_name(_ssl); // Nothing needs to be free'd.
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x10002000L
+    try
+    {
+        //
+        // Peer hostname verification is new in OpenSSL 1.0.2 for older versions
+        // We use IceSSL built-in hostname verification.
+        //
+        _engine->verifyPeerCertName(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()));
+    }
+    catch(const SecurityException&)
+    {
+        _verified = false;
+        if(_engine->getVerifyPeer() > 0)
+        {
+            throw;
+        }
+    }
+#endif
+    _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString());
 
     if(_engine->securityTraceLevel() >= 1)
     {
@@ -294,14 +379,14 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
             out << "bits = " << SSL_CIPHER_get_bits(cipher, 0) << "\n";
             out << "protocol = " << SSL_get_version(_ssl) << "\n";
         }
-        out << IceInternal::fdToString(SSL_get_fd(_ssl));
+        out << toString();
     }
 
     return IceInternal::SocketOperationNone;
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
+OpenSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
 {
     // If we are initiating the connection closure, wait for the peer
     // to close the TCP/IP connection. Otherwise, close immediately.
@@ -309,7 +394,7 @@ IceSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
 }
 
 void
-IceSSL::TransceiverI::close()
+OpenSSL::TransceiverI::close()
 {
     if(_ssl)
     {
@@ -327,15 +412,29 @@ IceSSL::TransceiverI::close()
         _ssl = 0;
     }
 
-    _stream->close();
+    if(_memBio)
+    {
+        BIO_free(_memBio);
+        _memBio = 0;
+    }
+
+    _delegate->close();
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
+OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(!_connected)
     {
-        return _stream->write(buf);
+        return _delegate->write(buf);
+    }
+
+    if(_memBio && _writeBuffer.i != _writeBuffer.b.end())
+    {
+        if(!send())
+        {
+            return IceInternal::SocketOperationWrite;
+        }
     }
 
     if(buf.i == buf.b.end())
@@ -346,11 +445,39 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
     //
     // It's impossible for packetSize to be more than an Int.
     //
-    int packetSize = static_cast<int>(buf.b.end() - buf.i);
+    int packetSize = _memBio ?
+        std::min(static_cast<int>(_maxSendPacketSize), static_cast<int>(buf.b.end() - buf.i)) :
+        static_cast<int>(buf.b.end() - buf.i);
+
     while(buf.i != buf.b.end())
     {
         ERR_clear_error(); // Clear any spurious errors.
-        int ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
+        int ret;
+        if(_memBio)
+        {
+            if(_sentBytes)
+            {
+                ret = _sentBytes;
+                _sentBytes = 0;
+            }
+            else
+            {
+                ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
+                if(ret > 0)
+                {
+                    if(!send())
+                    {
+                        _sentBytes = ret;
+                        return IceInternal::SocketOperationWrite;
+                    }
+                }
+            }
+        }
+        else
+        {
+            ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
+        }
+
         if(ret <= 0)
         {
             switch(SSL_get_error(_ssl, ret))
@@ -360,9 +487,7 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
                 break;
             case SSL_ERROR_ZERO_RETURN:
             {
-                ConnectionLostException ex(__FILE__, __LINE__);
-                ex.error = IceInternal::getSocketErrno();
-                throw ex;
+                throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
             }
             case SSL_ERROR_WANT_READ:
             {
@@ -371,45 +496,47 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
             }
             case SSL_ERROR_WANT_WRITE:
             {
+                if(_memBio && send())
+                {
+                    continue;
+                }
                 return IceInternal::SocketOperationWrite;
             }
             case SSL_ERROR_SYSCALL:
             {
-                if(IceInternal::interrupted())
+                if(!_memBio)
                 {
-                    continue;
-                }
+                    if(IceInternal::interrupted())
+                    {
+                        continue;
+                    }
 
-                if(IceInternal::noBuffers() && packetSize > 1024)
-                {
-                    packetSize /= 2;
-                    continue;
-                }
+                    if(IceInternal::noBuffers() && packetSize > 1024)
+                    {
+                        packetSize /= 2;
+                        continue;
+                    }
 
-                if(IceInternal::wouldBlock())
-                {
-                    assert(SSL_want_write(_ssl));
-                    return IceInternal::SocketOperationWrite;
+                    if(IceInternal::wouldBlock())
+                    {
+                        assert(SSL_want_write(_ssl));
+                        return IceInternal::SocketOperationWrite;
+                    }
                 }
 
                 if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
                 {
-                    ConnectionLostException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
+                    throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
                 }
                 else
                 {
-                    SocketException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
+                    throw SocketException(__FILE__, __LINE__, IceInternal::getSocketErrno());
                 }
             }
             case SSL_ERROR_SSL:
             {
-                ProtocolException ex(__FILE__, __LINE__);
-                ex.reason = "SSL protocol error during write:\n" + _engine->sslErrors();
-                throw ex;
+                throw ProtocolException(__FILE__, __LINE__,
+                                        "SSL protocol error during write:\n" + _engine->sslErrors());
             }
             }
         }
@@ -421,21 +548,27 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
             packetSize = static_cast<int>(buf.b.end() - buf.i);
         }
     }
-
     return IceInternal::SocketOperationNone;
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
+OpenSSL::TransceiverI::read(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(!_connected)
     {
-        return _stream->read(buf);
+        return _delegate->read(buf);
+    }
+
+    if(_memBio && _readBuffer.i != _readBuffer.b.end())
+    {
+        if(!receive())
+        {
+            return IceInternal::SocketOperationRead;
+        }
     }
 
     //
-    // Note: we don't set the hasMoreData flag in this implementation.
-    // We assume that OpenSSL doesn't read more SSL records than
+    // Note: We assume that OpenSSL doesn't read more SSL records than
     // necessary to fill the requested data and that the sender sends
     // Ice messages in individual SSL records.
     //
@@ -445,6 +578,8 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
         return IceInternal::SocketOperationNone;
     }
 
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, false);
+
     //
     // It's impossible for packetSize to be more than an Int.
     //
@@ -464,12 +599,14 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
             }
             case SSL_ERROR_ZERO_RETURN:
             {
-                ConnectionLostException ex(__FILE__, __LINE__);
-                ex.error = 0;
-                throw ex;
+                throw ConnectionLostException(__FILE__, __LINE__, 0);
             }
             case SSL_ERROR_WANT_READ:
             {
+                if(_memBio && receive())
+                {
+                    continue;
+                }
                 return IceInternal::SocketOperationRead;
             }
             case SSL_ERROR_WANT_WRITE:
@@ -479,41 +616,39 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
             }
             case SSL_ERROR_SYSCALL:
             {
-                if(IceInternal::interrupted())
+                if(!_memBio)
                 {
-                    continue;
-                }
+                    if(IceInternal::interrupted())
+                    {
+                        continue;
+                    }
 
-                if(IceInternal::noBuffers() && packetSize > 1024)
-                {
-                    packetSize /= 2;
-                    continue;
-                }
+                    if(IceInternal::noBuffers() && packetSize > 1024)
+                    {
+                        packetSize /= 2;
+                        continue;
+                    }
 
-                if(IceInternal::wouldBlock())
-                {
-                    assert(SSL_want_read(_ssl));
-                    return IceInternal::SocketOperationRead;
+                    if(IceInternal::wouldBlock())
+                    {
+                        assert(SSL_want_read(_ssl));
+                        return IceInternal::SocketOperationRead;
+                    }
                 }
 
                 if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
                 {
-                    ConnectionLostException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
+                    throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
                 }
                 else
                 {
-                    SocketException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
+                    throw SocketException(__FILE__, __LINE__, IceInternal::getSocketErrno());
                 }
             }
             case SSL_ERROR_SSL:
             {
-                ProtocolException ex(__FILE__, __LINE__);
-                ex.reason = "SSL protocol error during read:\n" + _engine->sslErrors();
-                throw ex;
+                throw ProtocolException(__FILE__, __LINE__,
+                                        "SSL protocol error during read:\n" + _engine->sslErrors());
             }
             }
         }
@@ -527,61 +662,190 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
     }
 
     //
-    // Check if there's still buffered data to read. In this case, set hasMoreData to true.
+    // Check if there's still buffered data to read, set the read ready status.
     //
-    hasMoreData = SSL_pending(_ssl) > 0;
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, SSL_pending(_ssl) > 0);
 
     return IceInternal::SocketOperationNone;
 }
 
-string
-IceSSL::TransceiverI::protocol() const
+#ifdef ICE_USE_IOCP
+
+bool
+OpenSSL::TransceiverI::startWrite(IceInternal::Buffer& buffer)
 {
-    return _instance->protocol();
+    if(!_connected)
+    {
+        return _delegate->startWrite(buffer);
+    }
+
+    if(_writeBuffer.i == _writeBuffer.b.end())
+    {
+        assert(_sentBytes == 0);
+        int packetSize = std::min(static_cast<int>(_maxSendPacketSize), static_cast<int>(buffer.b.end() - buffer.i));
+        _sentBytes = SSL_write(_ssl, reinterpret_cast<void*>(&*buffer.i), packetSize);
+
+        assert(BIO_ctrl_pending(_memBio));
+        _writeBuffer.b.resize( BIO_ctrl_pending(_memBio));
+        _writeBuffer.i = _writeBuffer.b.begin();
+        BIO_read(_memBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
+    }
+
+    return _delegate->startWrite(_writeBuffer) && buffer.i == buffer.b.end();
+}
+
+void
+OpenSSL::TransceiverI::finishWrite(IceInternal::Buffer& buffer)
+{
+    if(!_connected)
+    {
+        _delegate->finishWrite(buffer);
+        return;
+    }
+
+    _delegate->finishWrite(_writeBuffer);
+    if(_sentBytes)
+    {
+        buffer.i += _sentBytes;
+        _sentBytes = 0;
+    }
+}
+
+void
+OpenSSL::TransceiverI::startRead(IceInternal::Buffer& buffer)
+{
+    if(!_connected)
+    {
+        _delegate->startRead(buffer);
+        return;
+    }
+
+    if(_readBuffer.i == _readBuffer.b.end())
+    {
+        assert(!buffer.b.empty() && buffer.i != buffer.b.end());
+        ERR_clear_error(); // Clear any spurious errors.
+#ifndef NDEBUG
+        int ret =
+#endif
+            SSL_read(_ssl, reinterpret_cast<void*>(&*buffer.i), static_cast<int>(buffer.b.end() - buffer.i));
+        assert(ret <= 0 && SSL_get_error(_ssl, ret) == SSL_ERROR_WANT_READ);
+
+        assert(BIO_ctrl_get_read_request(_memBio));
+        _readBuffer.b.resize(BIO_ctrl_get_read_request(_memBio));
+        _readBuffer.i = _readBuffer.b.begin();
+    }
+
+    assert(!_readBuffer.b.empty() && _readBuffer.i != _readBuffer.b.end());
+
+    _delegate->startRead(_readBuffer);
+}
+
+void
+OpenSSL::TransceiverI::finishRead(IceInternal::Buffer& buffer)
+{
+    if(!_connected)
+    {
+        _delegate->finishRead(buffer);
+        return;
+    }
+
+    _delegate->finishRead(_readBuffer);
+    if(_readBuffer.i == _readBuffer.b.end())
+    {
+        int n = BIO_write(_memBio, _readBuffer.b.begin(), static_cast<int>(_readBuffer.b.size()));
+        if(n < 0) // Expected if the transceiver was closed.
+        {
+            throw SecurityException(__FILE__, __LINE__, "SSL bio write failed");
+        }
+
+        assert(n == static_cast<int>(_readBuffer.b.size()));
+        ERR_clear_error(); // Clear any spurious errors.
+        int ret = SSL_read(_ssl, reinterpret_cast<void*>(&*buffer.i), static_cast<int>(buffer.b.end() - buffer.i));
+        if(ret <= 0)
+        {
+            switch(SSL_get_error(_ssl, ret))
+            {
+                case SSL_ERROR_NONE:
+                case SSL_ERROR_WANT_WRITE:
+                {
+                    assert(false);
+                    return;
+                }
+                case SSL_ERROR_ZERO_RETURN:
+                {
+                    throw ConnectionLostException(__FILE__, __LINE__, 0);
+                }
+                case SSL_ERROR_WANT_READ:
+                {
+                    return;
+                }
+                case SSL_ERROR_SYSCALL:
+                {
+                    if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
+                    {
+                        throw ConnectionLostException(__FILE__, __LINE__,  IceInternal::getSocketErrno());
+                    }
+                    else
+                    {
+                        throw SocketException(__FILE__, __LINE__, IceInternal::getSocketErrno());
+                    }
+                }
+                case SSL_ERROR_SSL:
+                {
+                    throw ProtocolException(__FILE__, __LINE__,
+                                            "SSL protocol error during read:\n" + _engine->sslErrors());
+                }
+            }
+        }
+        buffer.i += ret;
+    }
 }
+#endif
 
 string
-IceSSL::TransceiverI::toString() const
+OpenSSL::TransceiverI::protocol() const
 {
-    return _stream->toString();
+    return _instance->protocol();
 }
 
 string
-IceSSL::TransceiverI::toDetailedString() const
+OpenSSL::TransceiverI::toString() const
 {
-    return toString();
+    return _delegate->toString();
 }
 
-Ice::ConnectionInfoPtr
-IceSSL::TransceiverI::getInfo() const
+string
+OpenSSL::TransceiverI::toDetailedString() const
 {
-    NativeConnectionInfoPtr info = new NativeConnectionInfo();
-    fillConnectionInfo(info, info->nativeCerts);
-    return info;
+    return toString();
 }
 
 Ice::ConnectionInfoPtr
-IceSSL::TransceiverI::getWSInfo(const Ice::HeaderDict& headers) const
+OpenSSL::TransceiverI::getInfo() const
 {
-    WSSNativeConnectionInfoPtr info = new WSSNativeConnectionInfo();
-    fillConnectionInfo(info, info->nativeCerts);
-    info->headers = headers;
+    ConnectionInfoPtr info = ICE_MAKE_SHARED(ConnectionInfo);
+    info->underlying = _delegate->getInfo();
+    info->incoming = _incoming;
+    info->adapterName = _adapterName;
+    info->cipher = _cipher;
+    info->certs = _certs;
+    info->verified = _verified;
     return info;
 }
 
 void
-IceSSL::TransceiverI::checkSendSize(const IceInternal::Buffer&)
+OpenSSL::TransceiverI::checkSendSize(const IceInternal::Buffer&)
 {
 }
 
 void
-IceSSL::TransceiverI::setBufferSize(int rcvSize, int sndSize)
+OpenSSL::TransceiverI::setBufferSize(int rcvSize, int sndSize)
 {
-    _stream->setBufferSize(rcvSize, sndSize);
+    _delegate->setBufferSize(rcvSize, sndSize);
 }
 
 int
-IceSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
+OpenSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
 {
     if(!ok && _engine->securityTraceLevel() >= 1)
     {
@@ -598,7 +862,7 @@ IceSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
         out << "subject = " << buf << '\n';
         out << "depth = " << X509_STORE_CTX_get_error_depth(c) << '\n';
         out << "error = " << X509_verify_cert_error_string(err) << '\n';
-        out << IceInternal::fdToString(SSL_get_fd(_ssl));
+        out << toString();
     }
 
     //
@@ -608,10 +872,11 @@ IceSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
     STACK_OF(X509)* chain = X509_STORE_CTX_get1_chain(c);
     if(chain != 0)
     {
-        _nativeCerts.clear();
+        _certs.clear();
         for(int i = 0; i < sk_X509_num(chain); ++i)
         {
-            _nativeCerts.push_back(new Certificate(X509_dup(sk_X509_value(chain, i))));
+            CertificatePtr cert = OpenSSL::Certificate::create(X509_dup(sk_X509_value(chain, i)));
+            _certs.push_back(cert);
         }
         sk_X509_pop_free(chain, X509_free);
     }
@@ -625,47 +890,77 @@ IceSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
     return 1;
 }
 
-IceSSL::TransceiverI::TransceiverI(const InstancePtr& instance, const IceInternal::StreamSocketPtr& stream,
-                                   const string& hostOrAdapterName, bool incoming) :
+OpenSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
+                                    const IceInternal::TransceiverPtr& delegate,
+                                    const string& hostOrAdapterName,
+                                    bool incoming) :
     _instance(instance),
-    _engine(OpenSSLEnginePtr::dynamicCast(instance->engine())),
+    _engine(OpenSSL::SSLEnginePtr::dynamicCast(instance->engine())),
     _host(incoming ? "" : hostOrAdapterName),
     _adapterName(incoming ? hostOrAdapterName : ""),
     _incoming(incoming),
-    _stream(stream),
+    _delegate(delegate),
+    _connected(false),
     _verified(false),
-    _ssl(0)
+    _ssl(0),
+    _memBio(0),
+    _sentBytes(0),
+    _maxSendPacketSize(0),
+    _maxRecvPacketSize(0)
 {
 }
 
-IceSSL::TransceiverI::~TransceiverI()
+OpenSSL::TransceiverI::~TransceiverI()
 {
 }
 
-void
-IceSSL::TransceiverI::fillConnectionInfo(const ConnectionInfoPtr& info, std::vector<CertificatePtr>& nativeCerts) const
+bool
+OpenSSL::TransceiverI::receive()
 {
-    IceInternal::fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress,
-                                    info->remotePort);
-    if(_stream->fd() != INVALID_SOCKET)
+    if(_readBuffer.i == _readBuffer.b.end())
     {
-        info->rcvSize = IceInternal::getRecvBufferSize(_stream->fd());
-        info->sndSize = IceInternal::getSendBufferSize(_stream->fd());
+        assert(BIO_ctrl_get_read_request(_memBio));
+        _readBuffer.b.resize(BIO_ctrl_get_read_request(_memBio));
+        _readBuffer.i = _readBuffer.b.begin();
     }
-    info->adapterName = _adapterName;
-    info->incoming = _incoming;
-    info->verified = _verified;
-    nativeCerts = _nativeCerts;
-    for(vector<CertificatePtr>::const_iterator p = _nativeCerts.begin(); p != _nativeCerts.end(); ++p)
+
+    while(_readBuffer.i != _readBuffer.b.end())
+    {
+        if(_delegate->read(_readBuffer) != IceInternal::SocketOperationNone)
+        {
+            return false;
+        }
+    }
+
+    assert(_readBuffer.i == _readBuffer.b.end());
+
+#ifndef NDEBUG
+    int n =
+#endif
+        BIO_write(_memBio, &_readBuffer.b[0], static_cast<int>(_readBuffer.b.end() - _readBuffer.b.begin()));
+
+    assert(n == static_cast<int>(_readBuffer.b.end() - _readBuffer.b.begin()));
+
+    return true;
+}
+
+bool
+OpenSSL::TransceiverI::send()
+{
+    if(_writeBuffer.i == _writeBuffer.b.end())
     {
-        info->certs.push_back((*p)->encode());
+        assert(BIO_ctrl_pending(_memBio));
+        _writeBuffer.b.resize( BIO_ctrl_pending(_memBio));
+        _writeBuffer.i = _writeBuffer.b.begin();
+        BIO_read(_memBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
     }
-    if(_ssl != 0)
+
+    if(_writeBuffer.i != _writeBuffer.b.end())
     {
-        info->cipher = SSL_get_cipher_name(_ssl); // Nothing needs to be free'd.
+        if(_delegate->write(_writeBuffer) != IceInternal::SocketOperationNone)
+        {
+            return false;
+        }
     }
-    info->adapterName = _adapterName;
-    info->incoming = _incoming;
+    return _writeBuffer.i == _writeBuffer.b.end();
 }
-
-#endif