zeroc-ice 3.6.5 → 3.7.4

data/ext/ice/cpp/src/IceSSL/SChannelEngine.cpp

@@ -1,30 +1,21 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
-#include <IceSSL/SSLEngine.h>
+#include <IceSSL/SChannelEngine.h>
+#include <IceSSL/SChannelTransceiverI.h>
 #include <IceSSL/Plugin.h>
+#include <IceSSL/Util.h>
 
 #include <Ice/LocalException.h>
 #include <Ice/Logger.h>
 #include <Ice/Communicator.h>
+#include <Ice/StringConverter.h>
 
 #include <IceUtil/StringUtil.h>
 #include <IceUtil/FileUtil.h>
-#include <IceUtil/UUID.h>
-
-using namespace std;
-using namespace Ice;
-using namespace IceUtil;
-using namespace IceUtilInternal;
-using namespace IceSSL;
-
-#ifdef ICE_USE_SCHANNEL
+#include <IceUtil/MutexPtrLock.h>
+#include <Ice/UUID.h>
 
 #include <wincrypt.h>
 
@@ -37,23 +28,309 @@ using namespace IceSSL;
 #    define SP_PROT_TLS1_3 (SP_PROT_TLS1_3_SERVER | SP_PROT_TLS1_3_CLIENT)
 #endif
 
-Shared* IceSSL::upCast(IceSSL::SChannelEngine* p) { return p; }
+//
+// CALG_ECDH_EPHEM algorithm constant is not defined in older version of the SDK headers
+//
+// https://msdn.microsoft.com/en-us/library/windows/desktop/aa375549(v=vs.85).aspx
+//
+
+const int ICESSL_CALG_ECDH_EPHEM = 0x0000AE06;
 
 //
-// This macros are not defined with old SDKs, like the one used with Python2.7
-// wheel builds
+// COMPILERFIX SCH_USE_STRONG_CRYPTO not defined with v90
 //
-#ifndef SP_PROT_TLS1_1
-#   define SP_PROT_TLS1_1 (SP_PROT_TLS1_1_SERVER | SP_PROT_TLS1_1_CLIENT)
+#if defined(_MSC_VER) && (_MSC_VER <= 1600)
+#  ifndef SCH_USE_STRONG_CRYPTO
+#    define SCH_USE_STRONG_CRYPTO 0x00400000
+#  endif
 #endif
 
-#ifndef SP_PROT_TLS1_2
-#   define SP_PROT_TLS1_2 (SP_PROT_TLS1_2_SERVER | SP_PROT_TLS1_2_CLIENT)
-#endif
+using namespace std;
+using namespace Ice;
+using namespace IceUtil;
+using namespace IceUtilInternal;
+using namespace IceSSL;
+
+Shared* SChannel::upCast(SChannel::SSLEngine* p)
+{
+    return p;
+}
 
 namespace
 {
 
+IceUtil::Mutex* globalMutex;
+
+class Init
+{
+public:
+
+    Init()
+    {
+        globalMutex = new IceUtil::Mutex;
+    }
+
+    ~Init()
+    {
+        delete globalMutex;
+        globalMutex = 0;
+    }
+};
+
+Init init;
+
+void
+addMatchingCertificates(HCERTSTORE source, HCERTSTORE target, DWORD findType, const void* findParam)
+{
+    PCCERT_CONTEXT next = 0;
+    do
+    {
+        if((next = CertFindCertificateInStore(source, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
+                                              findType, findParam, next)) != 0)
+        {
+            if(!CertAddCertificateContextToStore(target, next, CERT_STORE_ADD_ALWAYS, 0))
+            {
+                throw PluginInitializationException(__FILE__, __LINE__,
+                    "IceSSL: error adding certificate to store:\n" + IceUtilInternal::lastErrorToString());
+            }
+        }
+    }
+    while(next);
+}
+
+vector<PCCERT_CONTEXT>
+findCertificates(const string& location, const string& storeName, const string& value, vector<HCERTSTORE>& stores)
+{
+    DWORD storeLoc;
+    if(location == "CurrentUser")
+    {
+        storeLoc = CERT_SYSTEM_STORE_CURRENT_USER;
+    }
+    else
+    {
+        storeLoc = CERT_SYSTEM_STORE_LOCAL_MACHINE;
+    }
+
+    HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, 0, storeLoc, Ice::stringToWstring(storeName).c_str());
+    if(!store)
+    {
+        throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: failed to open certificate store `" + storeName +
+                                            "':\n" + IceUtilInternal::lastErrorToString());
+    }
+
+    //
+    // Start with all of the certificates in the collection and filter as necessary.
+    //
+    // - If the value is "*", return all certificates.
+    // - Otherwise, search using key:value pairs. The following keys are supported:
+    //
+    //   Issuer
+    //   IssuerDN
+    //   Serial
+    //   Subject
+    //   SubjectDN
+    //   SubjectKeyId
+    //   Thumbprint
+    //
+    //   A value must be enclosed in single or double quotes if it contains whitespace.
+    //
+    HCERTSTORE tmpStore = 0;
+    try
+    {
+        if(value != "*")
+        {
+            if(value.find(':', 0) == string::npos)
+            {
+                throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: no key in `" + value + "'");
+            }
+            size_t start = 0;
+            size_t pos;
+            while((pos = value.find(':', start)) != string::npos)
+            {
+                string field = IceUtilInternal::toUpper(IceUtilInternal::trim(value.substr(start, pos - start)));
+                if(field != "SUBJECT" && field != "SUBJECTDN" && field != "ISSUER" && field != "ISSUERDN" &&
+                   field != "THUMBPRINT" && field != "SUBJECTKEYID" && field != "SERIAL")
+                {
+                    throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unknown key in `" + value + "'");
+                }
+
+                start = pos + 1;
+                while(start < value.size() && (value[start] == ' ' || value[start] == '\t'))
+                {
+                    ++start;
+                }
+
+                if(start == value.size())
+                {
+                    throw PluginInitializationException(__FILE__, __LINE__,
+                                                        "IceSSL: missing argument in `" + value + "'");
+                }
+
+                string arg;
+                if(value[start] == '"' || value[start] == '\'')
+                {
+                    size_t end = start;
+                    ++end;
+                    while(end < value.size())
+                    {
+                        if(value[end] == value[start] && value[end - 1] != '\\')
+                        {
+                            break;
+                        }
+                        ++end;
+                    }
+                    if(end == value.size() || value[end] != value[start])
+                    {
+                        throw PluginInitializationException(__FILE__, __LINE__,
+                                                            "IceSSL: unmatched quote in `" + value + "'");
+                    }
+                    ++start;
+                    arg = value.substr(start, end - start);
+                    start = end + 1;
+                }
+                else
+                {
+                    size_t end = value.find_first_of(" \t", start);
+                    if(end == string::npos)
+                    {
+                        arg = value.substr(start);
+                        start = value.size();
+                    }
+                    else
+                    {
+                        arg = value.substr(start, end - start);
+                        start = end + 1;
+                    }
+                }
+
+                tmpStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, 0, 0);
+                if(!tmpStore)
+                {
+                    throw PluginInitializationException(__FILE__, __LINE__,
+                                "IceSSL: error adding certificate to store:\n" + IceUtilInternal::lastErrorToString());
+                }
+
+                if(field == "SUBJECT" || field == "ISSUER")
+                {
+                    const wstring argW = Ice::stringToWstring(arg);
+                    DWORD findType = field == "SUBJECT" ? CERT_FIND_SUBJECT_STR : CERT_FIND_ISSUER_STR;
+                    addMatchingCertificates(store, tmpStore, findType, argW.c_str());
+                }
+                else if(field == "SUBJECTDN" || field == "ISSUERDN")
+                {
+                    const wstring argW = Ice::stringToWstring(arg);
+                    DWORD flags[] = {
+                        CERT_OID_NAME_STR,
+                        CERT_OID_NAME_STR | CERT_NAME_STR_REVERSE_FLAG,
+                        CERT_OID_NAME_STR | CERT_NAME_STR_FORCE_UTF8_DIR_STR_FLAG,
+                        CERT_OID_NAME_STR | CERT_NAME_STR_FORCE_UTF8_DIR_STR_FLAG | CERT_NAME_STR_REVERSE_FLAG
+                    };
+                    for(size_t i = 0; i < sizeof(flags) / sizeof(DWORD); ++i)
+                    {
+                        DWORD length = 0;
+                        if(!CertStrToNameW(X509_ASN_ENCODING, argW.c_str(), flags[i], 0, 0, &length, 0))
+                        {
+                            throw PluginInitializationException(
+                                __FILE__, __LINE__,
+                                "IceSSL: invalid value `" + value + "' for `IceSSL.FindCert' property:\n" +
+                                IceUtilInternal::lastErrorToString());
+                        }
+
+                        vector<BYTE> buffer(length);
+                        if(!CertStrToNameW(X509_ASN_ENCODING, argW.c_str(), flags[i], 0, &buffer[0], &length, 0))
+                        {
+                            throw PluginInitializationException(
+                                __FILE__, __LINE__,
+                                "IceSSL: invalid value `" + value + "' for `IceSSL.FindCert' property:\n" +
+                                IceUtilInternal::lastErrorToString());
+                        }
+
+                        CERT_NAME_BLOB name = { length, &buffer[0] };
+
+                        DWORD findType = field == "SUBJECTDN" ? CERT_FIND_SUBJECT_NAME : CERT_FIND_ISSUER_NAME;
+                        addMatchingCertificates(store, tmpStore, findType, &name);
+                    }
+                }
+                else if(field == "THUMBPRINT" || field == "SUBJECTKEYID")
+                {
+                    vector<BYTE> buffer;
+                    if(!parseBytes(arg, buffer))
+                    {
+                        throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: invalid `IceSSL.FindCert' property: can't decode the value");
+                    }
+
+                    CRYPT_HASH_BLOB hash = { static_cast<DWORD>(buffer.size()), &buffer[0] };
+                    DWORD findType = field == "THUMBPRINT" ? CERT_FIND_HASH : CERT_FIND_KEY_IDENTIFIER;
+                    addMatchingCertificates(store, tmpStore, findType, &hash);
+                }
+                else if(field == "SERIAL")
+                {
+                    vector<BYTE> buffer;
+                    if(!parseBytes(arg, buffer))
+                    {
+                        throw PluginInitializationException(__FILE__, __LINE__,
+                                                "IceSSL: invalid value `" + value + "' for `IceSSL.FindCert' property");
+                    }
+
+                    CRYPT_INTEGER_BLOB serial = { static_cast<DWORD>(buffer.size()), &buffer[0] };
+                    PCCERT_CONTEXT next = 0;
+                    do
+                    {
+                        if((next = CertFindCertificateInStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
+                                                              CERT_FIND_ANY, 0, next)) != 0)
+                        {
+                            if(CertCompareIntegerBlob(&serial, &next->pCertInfo->SerialNumber))
+                            {
+                                if(!CertAddCertificateContextToStore(tmpStore, next, CERT_STORE_ADD_ALWAYS, 0))
+                                {
+                                    throw PluginInitializationException(__FILE__, __LINE__,
+                                                                    "IceSSL: error adding certificate to store:\n" +
+                                                                    IceUtilInternal::lastErrorToString());
+                                }
+                            }
+                        }
+                    }
+                    while(next);
+                }
+                CertCloseStore(store, 0);
+                store = tmpStore;
+            }
+        }
+    }
+    catch(...)
+    {
+        if(store && store != tmpStore)
+        {
+            CertCloseStore(store, 0);
+        }
+
+        if(tmpStore)
+        {
+            CertCloseStore(tmpStore, 0);
+            tmpStore = 0;
+        }
+        throw;
+    }
+
+    vector<PCCERT_CONTEXT> certs;
+    if(store)
+    {
+        PCCERT_CONTEXT next = 0;
+        do
+        {
+            if((next = CertFindCertificateInStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_ANY, 0,
+                                                  next)) != 0)
+            {
+                certs.push_back(next);
+            }
+        }
+        while(next);
+        stores.push_back(store);
+    }
+    return certs;
+}
+
 #if defined(__MINGW32__) || (defined(_MSC_VER) && (_MSC_VER <= 1500))
 //
 // CERT_CHAIN_ENGINE_CONFIG struct in mingw headers doesn't include
@@ -184,49 +461,168 @@ algorithmId(const string& name)
     {
         return CALG_3DES;
     }
-    if(name == "AES_128")
+    else if(name == "3DES_112")
+    {
+        return CALG_3DES_112;
+    }
+    else if(name == "AES")
+    {
+        return CALG_AES;
+    }
+    else if(name == "AES_128")
     {
         return CALG_AES_128;
     }
-    if(name == "AES_256")
+    else if(name == "AES_192")
+    {
+        return CALG_AES_192;
+    }
+    else if(name == "AES_256")
     {
         return CALG_AES_256;
     }
-    if(name == "DES")
+    else if(name == "AGREEDKEY_ANY")
+    {
+        return CALG_AGREEDKEY_ANY;
+    }
+    else if(name == "CYLINK_MEK")
+    {
+        return CALG_CYLINK_MEK;
+    }
+    else if(name == "DES")
     {
         return CALG_DES;
     }
-    if(name == "RC2")
+    else if(name == "DESX")
+    {
+        return CALG_DESX;
+    }
+    else if(name == "DH_EPHEM")
+    {
+        return CALG_DH_EPHEM;
+    }
+    else if(name == "DH_SF")
+    {
+        return CALG_DH_SF;
+    }
+    else if(name == "DSS_SIGN")
+    {
+        return CALG_DSS_SIGN;
+    }
+    else if(name == "ECDH")
+    {
+        return CALG_ECDH;
+    }
+    else if(name == "ECDH_EPHEM")
+    {
+        return ICESSL_CALG_ECDH_EPHEM;
+    }
+    else if(name == "ECDSA")
+    {
+        return CALG_ECDSA;
+    }
+    else if(name == "HASH_REPLACE_OWF")
+    {
+        return CALG_HASH_REPLACE_OWF;
+    }
+    else if(name == "HUGHES_MD5")
+    {
+        return CALG_HUGHES_MD5;
+    }
+    else if(name == "HMAC")
+    {
+        return CALG_HMAC;
+    }
+    else if(name == "MAC")
+    {
+        return CALG_MAC;
+    }
+    else if(name == "MD2")
+    {
+        return CALG_MD2;
+    }
+    else if(name == "MD4")
+    {
+        return CALG_MD4;
+    }
+    else if(name == "MD5")
+    {
+        return CALG_MD5;
+    }
+    else if(name == "NO_SIGN")
+    {
+        return CALG_NO_SIGN;
+    }
+    else if(name == "RC2")
     {
         return CALG_RC2;
     }
-    if(name == "RC4")
+    else if(name == "RC4")
     {
         return CALG_RC4;
     }
+    else if(name == "RC5")
+    {
+        return CALG_RC5;
+    }
+    else if(name == "RSA_KEYX")
+    {
+        return CALG_RSA_KEYX;
+    }
+    else if(name == "RSA_SIGN")
+    {
+        return CALG_RSA_SIGN;
+    }
+    else if(name == "SHA1")
+    {
+        return CALG_SHA1;
+    }
+    else if(name == "SHA_256")
+    {
+        return CALG_SHA_256;
+    }
+    else if(name == "SHA_384")
+    {
+        return CALG_SHA_384;
+    }
+    else if(name == "SHA_512")
+    {
+        return CALG_SHA_512;
+    }
     return 0;
 }
 
 }
 
-SChannelEngine::SChannelEngine(const CommunicatorPtr& communicator) :
-    SSLEngine(communicator),
-    _initialized(false),
+SChannel::SSLEngine::SSLEngine(const CommunicatorPtr& communicator) :
+    IceSSL::SSLEngine(communicator),
     _rootStore(0),
-    _chainEngine(0)
+    _chainEngine(0),
+    _strongCrypto(false)
 {
 }
 
 void
-SChannelEngine::initialize()
+SChannel::SSLEngine::initialize()
 {
+    //
+    // BUGFIX: we use a global mutex for the initialization of SChannel to
+    // avoid crashes ocurring with last SChannel updates see:
+    // https://github.com/zeroc-ice/ice/issues/242
+    //
+    IceUtilInternal::MutexPtrLock<IceUtil::Mutex> sync(globalMutex);
+
+    //
+    // We still have to acquire the instance mutex because it is used by the base
+    // class to access _initialized data member.
+    //
     Mutex::Lock lock(_mutex);
     if(_initialized)
     {
         return;
     }
 
-    SSLEngine::initialize();
+    IceSSL::SSLEngine::initialize();
 
     const string prefix = "IceSSL.";
     const PropertiesPtr properties = communicator()->getProperties();
@@ -242,6 +638,8 @@ SChannelEngine::initialize()
     const_cast<DWORD&>(_protocols) =
         parseProtocols(properties->getPropertyAsListWithDefault(prefix + "Protocols", defaultProtocols));
 
+    const_cast<bool&>(_strongCrypto) = properties->getPropertyAsIntWithDefault(prefix + "SchannelStrongCrypto", 0) > 0;
+
     //
     // Check for a default directory. We look in this directory for
     // files mentioned in the configuration.
@@ -389,21 +787,21 @@ SChannelEngine::initialize()
 
         for(size_t i = 0; i < certFiles.size(); ++i)
         {
-            string certFile = certFiles[i];
+            string cFile = certFiles[i];
             string resolved;
-            if(!checkPath(certFile, defaultDir, false, resolved))
+            if(!checkPath(cFile, defaultDir, false, resolved))
             {
                 throw PluginInitializationException(__FILE__, __LINE__,
-                                                    "IceSSL: certificate file not found:\n" + certFile);
+                                                    "IceSSL: certificate file not found:\n" + cFile);
             }
-            certFile = resolved;
+            cFile = resolved;
 
             vector<char> buffer;
-            readFile(certFile, buffer);
+            readFile(cFile, buffer);
             if(buffer.empty())
             {
                 throw PluginInitializationException(__FILE__, __LINE__,
-                                                    "IceSSL: certificate file is empty:\n" + certFile);
+                                                    "IceSSL: certificate file is empty:\n" + cFile);
             }
 
             CRYPT_DATA_BLOB pfxBlob;
@@ -418,7 +816,7 @@ SChannelEngine::initialize()
             do
             {
                 string s = password(false);
-                store = PFXImportCertStore(&pfxBlob, stringToWstring(s).c_str(), importFlags);
+                store = PFXImportCertStore(&pfxBlob, Ice::stringToWstring(s).c_str(), importFlags);
                 err = store ? 0 : GetLastError();
             }
             while(err == ERROR_INVALID_PASSWORD && passwordPrompt && ++count < passwordRetryMax);
@@ -560,7 +958,7 @@ SChannelEngine::initialize()
                 //
                 // Create a new RSA key set to store our key
                 //
-                const wstring keySetName = stringToWstring(generateUUID());
+                const wstring keySetName = Ice::stringToWstring(generateUUID());
                 HCRYPTPROV cryptProv = 0;
 
                 DWORD contextFlags = CRYPT_NEWKEYSET;
@@ -600,7 +998,7 @@ SChannelEngine::initialize()
                                                         "store:\n" + lastErrorToString());
                 }
 
-                addCertificatesToStore(certFile, store, &cert);
+                addCertificatesToStore(cFile, store, &cert);
 
                 //
                 // Associate key & certificate
@@ -665,50 +1063,87 @@ SChannelEngine::initialize()
 }
 
 string
-SChannelEngine::getCipherName(ALG_ID cipher) const
+SChannel::SSLEngine::getCipherName(ALG_ID cipher) const
 {
     switch(cipher)
     {
-        case CALG_RSA_KEYX:
-            return "RSA_KEYX";
-        case CALG_RSA_SIGN:
-            return "RSA_SIGN";
-        case CALG_DSS_SIGN:
-            return "DSS_SIGN";
-        case CALG_KEA_KEYX:
-            return "KEA_KEYX";
-        case CALG_DH_EPHEM:
-            return "DH_EPHEM";
-        case CALG_ECDH:
-            return "ECDH";
-        case CALG_ECDSA:
-            return "ECDSA";
         case CALG_3DES:
             return "3DES";
+        case CALG_3DES_112:
+            return "3DES_112";
+        case CALG_AES:
+            return "AES";
         case CALG_AES_128:
             return "AES_128";
+        case CALG_AES_192:
+            return "AES_192";
         case CALG_AES_256:
             return "AES_256";
+        case CALG_AGREEDKEY_ANY:
+            return "AGREEDKEY_ANY";
+        case CALG_CYLINK_MEK:
+            return "CYLINK_MEK";
         case CALG_DES:
             return "DES";
+        case CALG_DESX:
+            return "DESX";
+        case CALG_DH_EPHEM:
+            return "DH_EPHEM";
+        case CALG_DH_SF:
+            return "DH_SF";
+        case CALG_DSS_SIGN:
+            return "DSS_SIGN";
+        case CALG_ECDH:
+            return "ECDH";
+        case ICESSL_CALG_ECDH_EPHEM:
+            return "ECDH_EPHEM";
+        case CALG_ECDSA:
+            return "ECDSA";
+        case CALG_HASH_REPLACE_OWF:
+            return "HASH_REPLACE_OWF";
+        case CALG_HUGHES_MD5:
+            return "HUGHES_MD5";
+        case CALG_HMAC:
+            return "HMAC";
+        case CALG_MAC:
+            return "MAC";
+        case CALG_MD2:
+            return "MD2";
+        case CALG_MD4:
+            return "MD4";
+        case CALG_MD5:
+            return "MD5";
+        case CALG_NO_SIGN:
+            return "NO_SIGN";
         case CALG_RC2:
             return "RC2";
         case CALG_RC4:
             return "RC4";
+        case CALG_RC5:
+            return "RC5";
+        case CALG_RSA_KEYX:
+            return "RSA_KEYX";
+        case CALG_RSA_SIGN:
+            return "RSA_SIGN";
+        case CALG_SHA1:
+            return "SHA1";
+        case CALG_SHA_256:
+            return "SHA_256";
+        case CALG_SHA_384:
+            return "SHA_384";
+        case CALG_SHA_512:
+            return "SHA_512";
         default:
-            return "Unknown";
+        {
+            ostringstream os;
+            os << "Unknown cipher: " << cipher;
+            return os.str();
+        }
     }
 }
 
-bool
-SChannelEngine::initialized() const
-{
-    Mutex::Lock lock(_mutex);
-    return _initialized;
-}
-
 CredHandle
-SChannelEngine::newCredentialsHandle(bool incoming)
+SChannel::SSLEngine::newCredentialsHandle(bool incoming)
 {
     SCHANNEL_CRED cred;
     memset(&cred, 0, sizeof(cred));
@@ -745,6 +1180,11 @@ SChannelEngine::newCredentialsHandle(bool incoming)
         cred.dwFlags = SCH_CRED_MANUAL_CRED_VALIDATION | SCH_CRED_NO_SERVERNAME_CHECK | SCH_CRED_NO_DEFAULT_CREDS;
     }
 
+    if(_strongCrypto)
+    {
+        cred.dwFlags |= SCH_USE_STRONG_CRYPTO;
+    }
+
     if(!_ciphers.empty())
     {
         cred.cSupportedAlgs = static_cast<DWORD>(_ciphers.size());
@@ -767,28 +1207,29 @@ SChannelEngine::newCredentialsHandle(bool incoming)
 }
 
 HCERTCHAINENGINE
-SChannelEngine::chainEngine() const
+SChannel::SSLEngine::chainEngine() const
 {
     return _chainEngine;
 }
 
 void
-SChannelEngine::parseCiphers(const std::string& ciphers)
+SChannel::SSLEngine::parseCiphers(const std::string& ciphers)
 {
     vector<string> tokens;
     splitString(ciphers, " \t", tokens);
     for(vector<string>::const_iterator i = tokens.begin(); i != tokens.end(); ++i)
     {
         ALG_ID id = algorithmId(*i);
-        if(id)
+        if(id == 0)
         {
-            _ciphers.push_back(id);
+            throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: no such cipher " + *i);
         }
+        _ciphers.push_back(id);
     }
 }
 
 void
-SChannelEngine::destroy()
+SChannel::SSLEngine::destroy()
 {
     if(_chainEngine && _chainEngine != HCCE_CURRENT_USER && _chainEngine != HCCE_LOCAL_MACHINE)
     {
@@ -831,4 +1272,12 @@ SChannelEngine::destroy()
         CertCloseStore(*i, 0);
     }
 }
-#endif
+
+IceInternal::TransceiverPtr
+SChannel::SSLEngine::createTransceiver(const InstancePtr& instance,
+                                       const IceInternal::TransceiverPtr& delegate,
+                                       const string& hostOrAdapterName,
+                                       bool incoming)
+{
+    return new SChannel::TransceiverI(instance, delegate, hostOrAdapterName, incoming);
+}