zeroc-ice 3.6.5 → 3.7.4

data/ext/ice/cpp/src/IceSSL/SChannelEngine.h

@@ -0,0 +1,123 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#ifndef ICESSL_SCHANNEL_ENGINE_H
+#define ICESSL_SCHANNEL_ENGINE_H
+
+#ifdef _WIN32
+
+#include <IceSSL/SSLEngine.h>
+#include <IceSSL/SChannelEngineF.h>
+
+//
+// SECURITY_WIN32 or SECURITY_KERNEL, must be defined before including security.h
+// indicating who is compiling the code.
+//
+#  ifdef SECURITY_WIN32
+#    undef SECURITY_WIN32
+#  endif
+#  ifdef SECURITY_KERNEL
+#    undef SECURITY_KERNEL
+#  endif
+#  define SECURITY_WIN32 1
+#  include <security.h>
+#  include <sspi.h>
+#  include <schannel.h>
+#  undef SECURITY_WIN32
+
+#if defined(__MINGW32__) || (defined(_MSC_VER) && (_MSC_VER <= 1500))
+
+//
+// Add some definitions missing from MinGW headers.
+//
+
+#   ifndef CERT_TRUST_IS_EXPLICIT_DISTRUST
+#      define CERT_TRUST_IS_EXPLICIT_DISTRUST 0x04000000
+#   endif
+
+#   ifndef CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT
+#      define CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT 0x08000000
+#   endif
+
+#   ifndef SECBUFFER_ALERT
+#      define SECBUFFER_ALERT 17
+#   endif
+
+#   ifndef SCH_SEND_ROOT_CERT
+#      define SCH_SEND_ROOT_CERT 0x00040000
+#   endif
+
+#   ifndef SP_PROT_TLS1_1_SERVER
+#      define SP_PROT_TLS1_1_SERVER 0x00000100
+#   endif
+
+#   ifndef SP_PROT_TLS1_1_CLIENT
+#      define SP_PROT_TLS1_1_CLIENT 0x00000200
+#   endif
+
+#   ifndef SP_PROT_TLS1_2_SERVER
+#      define SP_PROT_TLS1_2_SERVER 0x00000400
+#   endif
+
+#   ifndef SP_PROT_TLS1_2_CLIENT
+#      define SP_PROT_TLS1_2_CLIENT 0x00000800
+#   endif
+
+#endif
+
+namespace IceSSL
+{
+
+namespace SChannel
+{
+
+class SSLEngine : public IceSSL::SSLEngine
+{
+public:
+
+    SSLEngine(const Ice::CommunicatorPtr&);
+
+    //
+    // Setup the engine.
+    //
+    virtual void initialize();
+
+    virtual IceInternal::TransceiverPtr
+    createTransceiver(const InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool);
+
+    //
+    // Destroy the engine.
+    //
+    virtual void destroy();
+
+    std::string getCipherName(ALG_ID) const;
+
+    CredHandle newCredentialsHandle(bool);
+
+    HCERTCHAINENGINE chainEngine() const;
+
+private:
+
+    void parseCiphers(const std::string&);
+
+    std::vector<PCCERT_CONTEXT> _allCerts;
+    std::vector<PCCERT_CONTEXT> _importedCerts;
+    DWORD _protocols;
+
+    std::vector<HCERTSTORE> _stores;
+    HCERTSTORE _rootStore;
+
+    HCERTCHAINENGINE _chainEngine;
+    std::vector<ALG_ID> _ciphers;
+
+    const bool _strongCrypto;
+};
+
+}
+
+}
+
+#endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SChannelEngineF.h

@@ -0,0 +1,31 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#ifndef ICESSL_SCHANNEL_ENGINE_F_H
+#define ICESSL_SCHANNEL_ENGINE_F_H
+
+#ifdef _WIN32
+
+#include <IceUtil/Shared.h>
+#include <Ice/Handle.h>
+
+#include <IceSSL/SChannel.h>
+
+namespace IceSSL
+{
+
+namespace SChannel
+{
+
+class SSLEngine;
+ICESSL_API IceUtil::Shared* upCast(SSLEngine*);
+typedef IceInternal::Handle<SSLEngine> SSLEnginePtr;
+
+}
+
+}
+
+#endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SChannelPluginI.cpp

@@ -0,0 +1,73 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#include <IceSSL/PluginI.h>
+#include <IceSSL/SChannelEngine.h>
+
+#include <Ice/Initialize.h>
+
+using namespace std;
+
+namespace
+{
+
+class PluginI : public IceSSL::PluginI
+{
+public:
+
+    PluginI(const Ice::CommunicatorPtr&);
+
+    virtual IceSSL::CertificatePtr create(CERT_SIGNED_CONTENT_INFO*) const;
+    virtual IceSSL::CertificatePtr load(const std::string&) const;
+    virtual IceSSL::CertificatePtr decode(const std::string&) const;
+};
+
+} // anonymous namespace end
+
+//
+// Plugin implementation.
+//
+PluginI::PluginI(const Ice::CommunicatorPtr& com) :
+    IceSSL::PluginI(com, new IceSSL::SChannel::SSLEngine(com))
+{
+}
+
+IceSSL::CertificatePtr
+PluginI::create(CERT_SIGNED_CONTENT_INFO* cert) const
+{
+    return IceSSL::SChannel::Certificate::create(cert);
+}
+
+IceSSL::CertificatePtr
+PluginI::load(const std::string& file) const
+{
+    return IceSSL::SChannel::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+PluginI::decode(const std::string& encoding) const
+{
+    return IceSSL::SChannel::Certificate::load(encoding);
+}
+
+//
+// Plug-in factory function.
+//
+extern "C" ICESSL_API Ice::Plugin*
+createIceSSL(const Ice::CommunicatorPtr& communicator, const string& /*name*/, const Ice::StringSeq& /*args*/)
+{
+    return new PluginI(communicator);
+}
+
+IceSSL::CertificatePtr
+IceSSL::Certificate::load(const std::string& file)
+{
+    return IceSSL::SChannel::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+IceSSL::Certificate::decode(const std::string& encoding)
+{
+    return IceSSL::SChannel::Certificate::decode(encoding);
+}

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/SChannelTransceiverI.h>
 
@@ -13,15 +8,13 @@
 
 #include <IceSSL/ConnectionInfo.h>
 #include <IceSSL/Instance.h>
-#include <IceSSL/SSLEngine.h>
+#include <IceSSL/SChannelEngine.h>
 #include <IceSSL/Util.h>
 #include <Ice/Communicator.h>
 #include <Ice/LoggerUtil.h>
 #include <Ice/Buffer.h>
 #include <Ice/LocalException.h>
 
-#ifdef ICE_USE_SCHANNEL
-
 using namespace std;
 using namespace Ice;
 using namespace IceSSL;
@@ -203,16 +196,22 @@ getSecBufferWithType(const SecBufferDesc& desc, ULONG bufferType)
     return 0;
 }
 
+string
+secStatusToString(SECURITY_STATUS status)
+{
+    return IceUtilInternal::errorToString(status);
+}
+
 }
 
 IceInternal::NativeInfoPtr
-IceSSL::TransceiverI::getNativeInfo()
+SChannel::TransceiverI::getNativeInfo()
 {
-    return _stream;
+    return _delegate->getNativeInfo();
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::sslHandshake()
+SChannel::TransceiverI::sslHandshake()
 {
     DWORD flags = ASC_REQ_SEQUENCE_DETECT | ASC_REQ_REPLAY_DETECT | ASC_REQ_CONFIDENTIALITY | ASC_REQ_ALLOCATE_MEMORY |
         ASC_REQ_STREAM;
@@ -230,9 +229,9 @@ IceSSL::TransceiverI::sslHandshake()
     }
 
     SECURITY_STATUS err = SEC_E_OK;
-    DWORD ctxFlags = 0;
     if(_state == StateHandshakeNotStarted)
     {
+        _ctxFlags = 0;
         _readBuffer.b.resize(2048);
         _readBuffer.i = _readBuffer.b.begin();
         _credentials = _engine->newCredentialsHandle(_incoming);
@@ -244,11 +243,10 @@ IceSSL::TransceiverI::sslHandshake()
             SecBufferDesc outBufferDesc = { SECBUFFER_VERSION, 1, &outBuffer };
 
             err = InitializeSecurityContext(&_credentials, 0, const_cast<char *>(_host.c_str()), flags, 0, 0, 0, 0,
-                                            &_ssl, &outBufferDesc, &ctxFlags, 0);
+                                            &_ssl, &outBufferDesc, &_ctxFlags, 0);
             if(err != SEC_E_OK && err != SEC_I_CONTINUE_NEEDED)
             {
-                throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" +
-                                        IceUtilInternal::lastErrorToString());
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + secStatusToString(err));
             }
             _sslInitialized = true;
 
@@ -293,7 +291,7 @@ IceSSL::TransceiverI::sslHandshake()
             if(_incoming)
             {
                 err = AcceptSecurityContext(&_credentials, (_sslInitialized ? &_ssl : 0), &inBufferDesc, flags, 0,
-                                            &_ssl, &outBufferDesc, &ctxFlags, 0);
+                                            &_ssl, &outBufferDesc, &_ctxFlags, 0);
                 if(err == SEC_I_CONTINUE_NEEDED || err == SEC_E_OK)
                 {
                     _sslInitialized = true;
@@ -302,7 +300,7 @@ IceSSL::TransceiverI::sslHandshake()
             else
             {
                 err = InitializeSecurityContext(&_credentials, &_ssl, const_cast<char*>(_host.c_str()), flags, 0, 0,
-                                                &inBufferDesc, 0, 0, &outBufferDesc, &ctxFlags, 0);
+                                                &inBufferDesc, 0, 0, &outBufferDesc, &_ctxFlags, 0);
             }
 
             //
@@ -318,8 +316,7 @@ IceSSL::TransceiverI::sslHandshake()
             }
             else if(err != SEC_I_CONTINUE_NEEDED && err != SEC_E_OK)
             {
-                throw SecurityException(__FILE__, __LINE__, "SSL handshake failure:\n" +
-                                        IceUtilInternal::lastErrorToString());
+                throw SecurityException(__FILE__, __LINE__, "SSL handshake failure:\n" + secStatusToString(err));
             }
 
             //
@@ -352,17 +349,24 @@ IceSSL::TransceiverI::sslHandshake()
 
             if(token->cbBuffer)
             {
-                _state = StateHandshakeWriteContinue; // Continue writing if we have a token.
+                if(err == SEC_E_OK)
+                {
+                    _state = StateHandshakeWriteNoContinue; // Write and don't continue.
+                }
+                else
+                {
+                    _state = StateHandshakeWriteContinue; // Continue writing if we have a token.
+                }
             }
             else if(err == SEC_E_OK)
             {
                 break; // We're done.
             }
 
-	    // Otherwise continue either reading credentials
+            // Otherwise continue either reading credentials
         }
 
-        if(_state == StateHandshakeWriteContinue)
+        if(_state == StateHandshakeWriteContinue || _state == StateHandshakeWriteNoContinue)
         {
             //
             // Write any pending data.
@@ -371,80 +375,83 @@ IceSSL::TransceiverI::sslHandshake()
             {
                 return IceInternal::SocketOperationWrite;
             }
-            if(err == SEC_E_OK)
+            if(_state == StateHandshakeWriteNoContinue)
             {
                 break; // Token is written and we weren't told to continue, so we're done!
             }
-            assert(err == SEC_I_CONTINUE_NEEDED);
             _state = StateHandshakeReadContinue;
         }
     }
 
     //
-    // Check if the requested capabilities are met
+    // Check if the requested capabilities are met.
+    //
+    // NOTE: it's important for _ctxFlags to be a data member. The context flags might not be checked immediately
+    // if the last write can't complete without blocking above. In such a case, the context flags are checked here
+    // only once the sslHandshake is called again after the write completes.
     //
-    if(flags != ctxFlags)
+    if(flags != _ctxFlags)
     {
         if(_incoming)
         {
-            if(!(ctxFlags & ASC_REQ_SEQUENCE_DETECT))
+            if(!(_ctxFlags & ASC_REQ_SEQUENCE_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup sequence detect");
             }
 
-            if(!(ctxFlags & ASC_REQ_REPLAY_DETECT))
+            if(!(_ctxFlags & ASC_REQ_REPLAY_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup replay detect");
             }
 
-            if(!(ctxFlags & ASC_REQ_CONFIDENTIALITY))
+            if(!(_ctxFlags & ASC_REQ_CONFIDENTIALITY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup confidentiality");
             }
 
-            if(!(ctxFlags & ASC_REQ_EXTENDED_ERROR))
+            if(!(_ctxFlags & ASC_REQ_EXTENDED_ERROR))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup extended error");
             }
 
-            if(!(ctxFlags & ASC_REQ_ALLOCATE_MEMORY))
+            if(!(_ctxFlags & ASC_REQ_ALLOCATE_MEMORY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup memory allocation");
             }
 
-            if(!(ctxFlags & ASC_REQ_STREAM))
+            if(!(_ctxFlags & ASC_REQ_STREAM))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup stream");
             }
         }
         else
         {
-            if(!(ctxFlags & ISC_REQ_SEQUENCE_DETECT))
+            if(!(_ctxFlags & ISC_REQ_SEQUENCE_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup sequence detect");
             }
 
-            if(!(ctxFlags & ISC_REQ_REPLAY_DETECT))
+            if(!(_ctxFlags & ISC_REQ_REPLAY_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup replay detect");
             }
 
-            if(!(ctxFlags & ISC_REQ_CONFIDENTIALITY))
+            if(!(_ctxFlags & ISC_REQ_CONFIDENTIALITY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup confidentiality");
             }
 
-            if(!(ctxFlags & ISC_REQ_EXTENDED_ERROR))
+            if(!(_ctxFlags & ISC_REQ_EXTENDED_ERROR))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup extended error");
             }
 
-            if(!(ctxFlags & ISC_REQ_ALLOCATE_MEMORY))
+            if(!(_ctxFlags & ISC_REQ_ALLOCATE_MEMORY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup memory allocation");
             }
 
-            if(!(ctxFlags & ISC_REQ_STREAM))
+            if(!(_ctxFlags & ISC_REQ_STREAM))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup stream");
             }
@@ -455,7 +462,7 @@ IceSSL::TransceiverI::sslHandshake()
     if(err != SEC_E_OK)
     {
         throw SecurityException(__FILE__, __LINE__, "IceSSL: failure to query stream sizes attributes:\n" +
-                                IceUtilInternal::lastErrorToString());
+                                secStatusToString(err));
     }
 
     size_t pos = _readBuffer.i - _readBuffer.b.begin();
@@ -477,7 +484,7 @@ IceSSL::TransceiverI::sslHandshake()
 // data before it can decrypt the complete message.
 //
 size_t
-IceSSL::TransceiverI::decryptMessage(IceInternal::Buffer& buffer)
+SChannel::TransceiverI::decryptMessage(IceInternal::Buffer& buffer)
 {
     assert(_readBuffer.i != _readBuffer.b.begin() || !_readUnprocessed.b.empty());
 
@@ -538,7 +545,7 @@ IceSSL::TransceiverI::decryptMessage(IceInternal::Buffer& buffer)
         else if(err != SEC_E_OK)
         {
             throw ProtocolException(__FILE__, __LINE__, "IceSSL: protocol error during read:\n" +
-                                    IceUtilInternal::lastErrorToString());
+                                    secStatusToString(err));
         }
 
         SecBuffer* dataBuffer = getSecBufferWithType(inBufferDesc, SECBUFFER_DATA);
@@ -582,7 +589,7 @@ IceSSL::TransceiverI::decryptMessage(IceInternal::Buffer& buffer)
 // number of bytes is less than the message size, the function must be called again.
 //
 size_t
-IceSSL::TransceiverI::encryptMessage(IceInternal::Buffer& buffer)
+SChannel::TransceiverI::encryptMessage(IceInternal::Buffer& buffer)
 {
     //
     // Limit the message size to cbMaximumMessage which is the maximun size data that can be
@@ -611,7 +618,7 @@ IceSSL::TransceiverI::encryptMessage(IceInternal::Buffer& buffer)
     if(err != SEC_E_OK)
     {
         throw ProtocolException(__FILE__, __LINE__, "IceSSL: protocol error encrypting message:\n" +
-                                IceUtilInternal::lastErrorToString());
+                                secStatusToString(err));
     }
 
     // EncryptMessage resizes the buffers, so resize the write buffer as well to reflect this.
@@ -622,15 +629,19 @@ IceSSL::TransceiverI::encryptMessage(IceInternal::Buffer& buffer)
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer, bool& hasMoreData)
+SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer)
 {
-    IceInternal::SocketOperation op = _stream->connect(readBuffer, writeBuffer);
-    if(op != IceInternal::SocketOperationNone)
+    if(_state == StateNotInitialized)
     {
-        return op;
+        IceInternal::SocketOperation op = _delegate->initialize(readBuffer, writeBuffer);
+        if(op != IceInternal::SocketOperationNone)
+        {
+            return op;
+        }
+        _state = StateHandshakeNotStarted;
     }
 
-    op = sslHandshake();
+    IceInternal::SocketOperation op = sslHandshake();
     if(op != IceInternal::SocketOperationNone)
     {
         return op;
@@ -643,8 +654,8 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
     SECURITY_STATUS err = QueryContextAttributes(&_ssl, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &cert);
     if(err && err != SEC_E_NO_CREDENTIALS)
     {
-        throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate verification failure:" +
-                                IceUtilInternal::lastErrorToString());
+        throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate verification failure:\n" +
+                                secStatusToString(err));
     }
 
     if(!cert && ((!_incoming && _engine->getVerifyPeer() > 0) || (_incoming && _engine->getVerifyPeer() == 2)))
@@ -653,26 +664,24 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         // Clients require server certificate if VerifyPeer > 0 and servers require client
         // certificate if VerifyPeer == 2
         //
-        throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate required:" +
-                                IceUtilInternal::lastErrorToString());
+        throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate required");
     }
     else if(cert) // Verify the remote certificate
     {
-        try
+        CERT_CHAIN_PARA chainP;
+        memset(&chainP, 0, sizeof(chainP));
+        chainP.cbSize = sizeof(chainP);
+
+        string trustError;
+        PCCERT_CHAIN_CONTEXT certChain;
+        if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
+                                    CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
+        {
+            CertFreeCertificateContext(cert);
+            trustError = IceUtilInternal::lastErrorToString();
+        }
+        else
         {
-            CERT_CHAIN_PARA chainP;
-            memset(&chainP, 0, sizeof(chainP));
-            chainP.cbSize = sizeof(chainP);
-
-            PCCERT_CHAIN_CONTEXT certChain;
-            if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
-                                        CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
-            {
-                CertFreeCertificateContext(cert);
-                throw IceUtilInternal::lastErrorToString();
-            }
-
-            string trustError;
             if(certChain->TrustStatus.dwErrorStatus != CERT_TRUST_NO_ERROR)
             {
                 trustError = trustStatusToString(certChain->TrustStatus.dwErrorStatus);
@@ -682,28 +691,41 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
                 _verified = true;
             }
 
-            CertFreeCertificateChain(certChain);
-            CertFreeCertificateContext(cert);
-            if(!trustError.empty())
+            CERT_SIMPLE_CHAIN* simpleChain = certChain->rgpChain[0];
+            for(DWORD i = 0; i < simpleChain->cElement; ++i)
             {
-                throw trustError;
+                PCCERT_CONTEXT c = simpleChain->rgpElement[i]->pCertContext;
+                PCERT_SIGNED_CONTENT_INFO cc;
+
+                DWORD length = 0;
+                if(!CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, X509_CERT, c->pbCertEncoded,
+                                        c->cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, 0, &cc, &length))
+                {
+                    CertFreeCertificateChain(certChain);
+                    CertFreeCertificateContext(cert);
+                    throw SecurityException(__FILE__, __LINE__, "IceSSL: error decoding peer certificate chain:\n" +
+                                            IceUtilInternal::lastErrorToString());
+                }
+                _certs.push_back(SChannel::Certificate::create(cc));
             }
+
+            CertFreeCertificateChain(certChain);
+            CertFreeCertificateContext(cert);
         }
-        catch(const string& reason)
+
+        if(!trustError.empty())
         {
             if(_engine->getVerifyPeer() == 0)
             {
                 if(_instance->traceLevel() >= 1)
                 {
                     _instance->logger()->trace(_instance->traceCategory(),
-                                               "IceSSL: ignoring certificate verification failure\n" + reason);
+                                               "IceSSL: ignoring certificate verification failure:\n" + trustError);
                 }
             }
             else
             {
-                ostringstream os;
-                os << "IceSSL: certificate verification failure\n" << reason;
-                string msg = os.str();
+                string msg = "IceSSL: certificate verification failure:\n" + trustError;
                 if(_instance->traceLevel() >= 1)
                 {
                     _instance->logger()->trace(_instance->traceCategory(), msg);
@@ -713,7 +735,31 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         }
     }
 
-    _engine->verifyPeer(_stream->fd(), _host, NativeConnectionInfoPtr::dynamicCast(getInfo()));
+    SecPkgContext_ConnectionInfo connInfo;
+    err = QueryContextAttributes(&_ssl, SECPKG_ATTR_CONNECTION_INFO, &connInfo);
+    if(err == SEC_E_OK)
+    {
+        _cipher = _engine->getCipherName(connInfo.aiCipher);
+    }
+    else
+    {
+        throw SecurityException(__FILE__, __LINE__, "IceSSL: error reading cipher info:\n" + secStatusToString(err));
+    }
+
+    ConnectionInfoPtr info = ICE_DYNAMIC_CAST(ConnectionInfo, getInfo());
+    try
+    {
+        _engine->verifyPeerCertName(_host, info);
+    }
+    catch(const Ice::SecurityException&)
+    {
+        _verified = false;
+        if(_engine->getVerifyPeer() > 0)
+        {
+            throw;
+        }
+    }
+    _engine->verifyPeer(_host, info, toString());
     _state = StateHandshakeComplete;
 
     if(_instance->engine()->securityTraceLevel() >= 1)
@@ -721,12 +767,11 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         string sslCipherName;
         string sslKeyExchangeAlgorithm;
         string sslProtocolName;
-        SecPkgContext_ConnectionInfo info;
-        if(QueryContextAttributes(&_ssl, SECPKG_ATTR_CONNECTION_INFO, &info) == SEC_E_OK)
+        if(QueryContextAttributes(&_ssl, SECPKG_ATTR_CONNECTION_INFO, &connInfo) == SEC_E_OK)
         {
-            sslCipherName = _engine->getCipherName(info.aiCipher);
-            sslKeyExchangeAlgorithm = _engine->getCipherName(info.aiExch);
-            sslProtocolName = protocolName(info.dwProtocol);
+            sslCipherName = _engine->getCipherName(connInfo.aiCipher);
+            sslKeyExchangeAlgorithm = _engine->getCipherName(connInfo.aiExch);
+            sslProtocolName = protocolName(connInfo.dwProtocol);
         }
 
         Trace out(_instance->logger(), _instance->traceCategory());
@@ -744,12 +789,13 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         }
         out << toString();
     }
-    hasMoreData = !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin();
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead,
+                                      !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin());
     return IceInternal::SocketOperationNone;
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
+SChannel::TransceiverI::closing(bool initiator, const Ice::LocalException&)
 {
     // If we are initiating the connection closure, wait for the peer
     // to close the TCP/IP connection. Otherwise, close immediately.
@@ -757,7 +803,7 @@ IceSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
 }
 
 void
-IceSSL::TransceiverI::close()
+SChannel::TransceiverI::close()
 {
     if(_sslInitialized)
     {
@@ -771,7 +817,7 @@ IceSSL::TransceiverI::close()
         _credentialsInitialized = false;
     }
 
-    _stream->close();
+    _delegate->close();
 
     //
     // Clear the buffers now instead of waiting for destruction.
@@ -782,11 +828,11 @@ IceSSL::TransceiverI::close()
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
+SChannel::TransceiverI::write(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        return _stream->write(buf);
+        return _delegate->write(buf);
     }
 
     if(buf.i == buf.b.end())
@@ -817,11 +863,11 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
+SChannel::TransceiverI::read(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        return _stream->read(buf);
+        return _delegate->read(buf);
     }
 
     if(buf.i == buf.b.end())
@@ -830,7 +876,7 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
     }
     assert(_state == StateHandshakeComplete);
 
-    hasMoreData = false;
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, false);
     while(buf.i != buf.b.end())
     {
         if(_readUnprocessed.b.empty() && _readBuffer.i == _readBuffer.b.begin() && !readRaw(_readBuffer))
@@ -850,18 +896,19 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
 
         buf.i += decrypted;
     }
-    hasMoreData = !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin();
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead,
+                                      !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin());
     return IceInternal::SocketOperationNone;
 }
 
 #ifdef ICE_USE_IOCP
 
 bool
-IceSSL::TransceiverI::startWrite(IceInternal::Buffer& buffer)
+SChannel::TransceiverI::startWrite(IceInternal::Buffer& buffer)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        return _stream->startWrite(buffer);
+        return _delegate->startWrite(buffer);
     }
 
     if(_state == StateHandshakeComplete && _bufferedW == 0)
@@ -870,19 +917,19 @@ IceSSL::TransceiverI::startWrite(IceInternal::Buffer& buffer)
         _bufferedW = encryptMessage(buffer);
     }
 
-    return _stream->startWrite(_writeBuffer);
+    return _delegate->startWrite(_writeBuffer) && _bufferedW == static_cast<size_t>((buffer.b.end() - buffer.i));
 }
 
 void
-IceSSL::TransceiverI::finishWrite(IceInternal::Buffer& buf)
+SChannel::TransceiverI::finishWrite(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        _stream->finishWrite(buf);
+        _delegate->finishWrite(buf);
         return;
     }
 
-    _stream->finishWrite(_writeBuffer);
+    _delegate->finishWrite(_writeBuffer);
     if(_writeBuffer.i != _writeBuffer.b.end())
     {
         return; // We're not finished yet with writing the write buffer.
@@ -896,99 +943,96 @@ IceSSL::TransceiverI::finishWrite(IceInternal::Buffer& buf)
 }
 
 void
-IceSSL::TransceiverI::startRead(IceInternal::Buffer& buffer)
+SChannel::TransceiverI::startRead(IceInternal::Buffer& buffer)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        _stream->startRead(buffer);
+        _delegate->startRead(buffer);
         return;
     }
-    _stream->startRead(_readBuffer);
+    _delegate->startRead(_readBuffer);
 }
 
 void
-IceSSL::TransceiverI::finishRead(IceInternal::Buffer& buf, bool& hasMoreData)
+SChannel::TransceiverI::finishRead(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(_state == StateNotInitialized)
     {
-        _stream->finishRead(buf);
+        _delegate->finishRead(buf);
         return;
     }
 
-    _stream->finishRead(_readBuffer);
+    _delegate->finishRead(_readBuffer);
     if(_state == StateHandshakeComplete)
     {
         size_t decrypted = decryptMessage(buf);
         if(decrypted > 0)
         {
             buf.i += decrypted;
-            hasMoreData = !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin();
+            _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead,
+                                              !_readUnprocessed.b.empty() || _readBuffer.i != _readBuffer.b.begin());
         }
         else
         {
-            hasMoreData = false;
+            _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, false);
         }
     }
 }
 #endif
 
 string
-IceSSL::TransceiverI::protocol() const
+SChannel::TransceiverI::protocol() const
 {
     return _instance->protocol();
 }
 
 string
-IceSSL::TransceiverI::toString() const
+SChannel::TransceiverI::toString() const
 {
-    return _stream->toString();
+    return _delegate->toString();
 }
 
 string
-IceSSL::TransceiverI::toDetailedString() const
+SChannel::TransceiverI::toDetailedString() const
 {
     return toString();
 }
 
 Ice::ConnectionInfoPtr
-IceSSL::TransceiverI::getInfo() const
+SChannel::TransceiverI::getInfo() const
 {
-    NativeConnectionInfoPtr info = new NativeConnectionInfo();
-    fillConnectionInfo(info, info->nativeCerts);
-    return info;
-}
-
-Ice::ConnectionInfoPtr
-IceSSL::TransceiverI::getWSInfo(const Ice::HeaderDict& headers) const
-{
-    WSSNativeConnectionInfoPtr info = new WSSNativeConnectionInfo();
-    fillConnectionInfo(info, info->nativeCerts);
-    info->headers = headers;
+    ConnectionInfoPtr info = ICE_MAKE_SHARED(ConnectionInfo);
+    info->underlying = _delegate->getInfo();
+    info->incoming = _incoming;
+    info->adapterName = _adapterName;
+    info->cipher = _cipher;
+    info->certs = _certs;
+    info->verified = _verified;
     return info;
 }
 
 void
-IceSSL::TransceiverI::checkSendSize(const IceInternal::Buffer&)
+SChannel::TransceiverI::checkSendSize(const IceInternal::Buffer&)
 {
 }
 
 void
-IceSSL::TransceiverI::setBufferSize(int rcvSize, int sndSize)
+SChannel::TransceiverI::setBufferSize(int rcvSize, int sndSize)
 {
-    _stream->setBufferSize(rcvSize, sndSize);
+    _delegate->setBufferSize(rcvSize, sndSize);
 }
 
-IceSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
-                                   const IceInternal::StreamSocketPtr& stream,
+SChannel::TransceiverI::TransceiverI(const InstancePtr& instance,
+                                   const IceInternal::TransceiverPtr& delegate,
                                    const string& hostOrAdapterName,
                                    bool incoming) :
     _instance(instance),
-    _engine(SChannelEnginePtr::dynamicCast(instance->engine())),
+    _engine(SChannel::SSLEnginePtr::dynamicCast(instance->engine())),
     _host(incoming ? "" : hostOrAdapterName),
     _adapterName(incoming ? hostOrAdapterName : ""),
     _incoming(incoming),
-    _stream(stream),
-    _state(StateHandshakeNotStarted),
+    _delegate(delegate),
+    _state(StateNotInitialized),
     _bufferedW(0),
     _sslInitialized(false),
     _credentialsInitialized(false),
@@ -996,99 +1040,21 @@ IceSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
 {
 }
 
-IceSSL::TransceiverI::~TransceiverI()
+SChannel::TransceiverI::~TransceiverI()
 {
 }
 
-void
-IceSSL::TransceiverI::fillConnectionInfo(const ConnectionInfoPtr& info, vector<CertificatePtr>& nativeCerts) const
-{
-    IceInternal::fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress,
-                                    info->remotePort);
-    if(_stream->fd() != INVALID_SOCKET)
-    {
-        info->rcvSize = IceInternal::getRecvBufferSize(_stream->fd());
-        info->sndSize = IceInternal::getSendBufferSize(_stream->fd());
-    }
-
-    info->verified = _verified;
-
-    if(_sslInitialized)
-    {
-        CtxtHandle* ssl = const_cast<CtxtHandle*>(&_ssl);
-        PCCERT_CONTEXT cert = 0;
-        PCCERT_CHAIN_CONTEXT certChain = 0;
-        SECURITY_STATUS err = QueryContextAttributes(ssl, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &cert);
-        if(err == SEC_E_OK)
-        {
-            assert(cert);
-            CERT_CHAIN_PARA chainP;
-            memset(&chainP, 0, sizeof(chainP));
-            chainP.cbSize = sizeof(chainP);
-
-            if(CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
-                                       CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
-            {
-                CERT_SIMPLE_CHAIN* simpleChain = certChain->rgpChain[0];
-                for(DWORD i = 0; i < simpleChain->cElement; ++i)
-                {
-                    PCCERT_CONTEXT c = simpleChain->rgpElement[i]->pCertContext;
-                    PCERT_SIGNED_CONTENT_INFO cc;
-
-                    DWORD length = 0;
-                    if(!CryptDecodeObjectEx(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, X509_CERT, c->pbCertEncoded,
-                                            c->cbCertEncoded, CRYPT_DECODE_ALLOC_FLAG, 0, &cc, &length))
-                    {
-                        CertFreeCertificateChain(certChain);
-                        CertFreeCertificateContext(cert);
-                        throw SecurityException(__FILE__, __LINE__,
-                                                "IceSSL: error decoding peer certificate chain:\n" +
-                                                IceUtilInternal::lastErrorToString());
-                    }
-
-                    CertificatePtr certificate = new Certificate(cc);
-                    nativeCerts.push_back(certificate);
-                    info->certs.push_back(certificate->encode());
-                }
-                CertFreeCertificateChain(certChain);
-            }
-            CertFreeCertificateContext(cert);
-        }
-        else if(err != SEC_E_NO_CREDENTIALS)
-        {
-            throw SecurityException(__FILE__, __LINE__, "IceSSL: error reading peer certificate:" +
-                                    IceUtilInternal::lastErrorToString());
-        }
-
-        SecPkgContext_ConnectionInfo connInfo;
-        if(QueryContextAttributes(ssl, SECPKG_ATTR_CONNECTION_INFO, &connInfo) == SEC_E_OK)
-        {
-            info->cipher = _engine->getCipherName(connInfo.aiCipher);
-        }
-        else
-        {
-            throw SecurityException(__FILE__, __LINE__, "IceSSL: error reading cipher info:" +
-                                    IceUtilInternal::lastErrorToString());
-        }
-    }
-
-    info->adapterName = _adapterName;
-    info->incoming = _incoming;
-}
-
 bool
-IceSSL::TransceiverI::writeRaw(IceInternal::Buffer& buf)
+SChannel::TransceiverI::writeRaw(IceInternal::Buffer& buf)
 {
-    ssize_t ret = _stream->write(reinterpret_cast<const char*>(&*buf.i), buf.b.end() - buf.i);
-    buf.i += ret;
+    _delegate->write(buf);
     return buf.i == buf.b.end();
 }
 
 bool
-IceSSL::TransceiverI::readRaw(IceInternal::Buffer& buf)
+SChannel::TransceiverI::readRaw(IceInternal::Buffer& buf)
 {
-    ssize_t ret = _stream->read(reinterpret_cast<char*>(&*buf.i), buf.b.end() - buf.i);
-    buf.i += ret;
-    return ret > 0;
+    IceInternal::Buffer::Container::iterator p = buf.i;
+    _delegate->read(buf);
+    return buf.i != p;
 }
-#endif