zeroc-ice 3.6.5 → 3.7.4

data/ext/ice/cpp/src/IceSSL/SecureTransportEngine.h

@@ -0,0 +1,59 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#ifndef ICESSL_SECURE_TRANSPORT_ENGINE_H
+#define ICESSL_SECURE_TRANSPORT_ENGINE_H
+
+#ifdef __APPLE__
+
+#include <IceSSL/SSLEngine.h>
+#include <Ice/UniqueRef.h>
+
+#include <Security/Security.h>
+#include <Security/SecureTransport.h>
+
+namespace IceSSL
+{
+
+namespace SecureTransport
+{
+
+class SSLEngine : public IceSSL::SSLEngine
+{
+public:
+
+    SSLEngine(const Ice::CommunicatorPtr&);
+
+    virtual void initialize();
+    virtual void destroy();
+    virtual IceInternal::TransceiverPtr
+    createTransceiver(const InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool);
+
+    SSLContextRef newContext(bool);
+    CFArrayRef getCertificateAuthorities() const;
+    std::string getCipherName(SSLCipherSuite) const;
+
+private:
+
+    void parseCiphers(const std::string&);
+
+    IceInternal::UniqueRef<CFArrayRef> _certificateAuthorities;
+    IceInternal::UniqueRef<CFArrayRef> _chain;
+
+    SSLProtocol _protocolVersionMax;
+    SSLProtocol _protocolVersionMin;
+
+#if TARGET_OS_IPHONE==0
+    std::vector<char> _dhParams;
+#endif
+    std::vector<SSLCipherSuite> _ciphers;
+};
+
+} // SecureTransport namespace end
+
+} // IceSSL namespace end
+
+#endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SecureTransportEngineF.h

@@ -0,0 +1,29 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#ifndef ICESSL_SECURE_TRANSPORT_ENGINE_F_H
+#define ICESSL_SECURE_TRANSPORT_ENGINE_F_H
+
+#ifdef __APPLE__
+#include <IceSSL/Plugin.h>
+#include <IceUtil/Shared.h>
+#include <Ice/Handle.h>
+
+namespace IceSSL
+{
+
+namespace SecureTransport
+{
+
+class SSLEngine;
+ICESSL_API IceUtil::Shared* upCast(SSLEngine*);
+typedef IceInternal::Handle<SSLEngine> SSLEnginePtr;
+
+}
+
+}
+
+#endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SecureTransportPluginI.cpp

@@ -0,0 +1,75 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#include <IceSSL/PluginI.h>
+#include <IceSSL/SecureTransport.h>
+#include <IceSSL/SecureTransportEngine.h>
+
+#include <Ice/Initialize.h>
+
+using namespace Ice;
+using namespace std;
+
+namespace
+{
+
+class PluginI : public IceSSL::PluginI
+{
+public:
+
+    PluginI(const Ice::CommunicatorPtr&);
+
+    virtual IceSSL::CertificatePtr create(SecCertificateRef) const;
+    virtual IceSSL::CertificatePtr load(const std::string&) const;
+    virtual IceSSL::CertificatePtr decode(const std::string&) const;
+};
+
+} // anonymous namespace end
+
+//
+// Plugin implementation.
+//
+PluginI::PluginI(const Ice::CommunicatorPtr& com) :
+    IceSSL::PluginI(com, new IceSSL::SecureTransport::SSLEngine(com))
+{
+}
+
+IceSSL::CertificatePtr
+PluginI::create(SecCertificateRef cert) const
+{
+    return IceSSL::SecureTransport::Certificate::create(cert);
+}
+
+IceSSL::CertificatePtr
+PluginI::load(const std::string& file) const
+{
+    return IceSSL::SecureTransport::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+PluginI::decode(const std::string& encoding) const
+{
+    return IceSSL::SecureTransport::Certificate::load(encoding);
+}
+
+//
+// Plug-in factory function.
+//
+extern "C" ICESSL_API Ice::Plugin*
+createIceSSL(const Ice::CommunicatorPtr& communicator, const string& /*name*/, const Ice::StringSeq& /*args*/)
+{
+    return new PluginI(communicator);
+}
+
+IceSSL::CertificatePtr
+IceSSL::Certificate::load(const std::string& file)
+{
+    return IceSSL::SecureTransport::Certificate::load(file);
+}
+
+IceSSL::CertificatePtr
+IceSSL::Certificate::decode(const std::string& encoding)
+{
+    return IceSSL::SecureTransport::Certificate::decode(encoding);
+}

data/ext/ice/cpp/src/IceSSL/SecureTransportTransceiverI.cpp

@@ -1,24 +1,21 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/SecureTransportTransceiverI.h>
 #include <IceSSL/Instance.h>
-#include <IceSSL/SSLEngine.h>
+#include <IceSSL/SecureTransportEngine.h>
+#include <IceSSL/SecureTransportUtil.h>
+#include <IceSSL/ConnectionInfo.h>
 
 #include <Ice/LoggerUtil.h>
 #include <Ice/LocalException.h>
 
-#ifdef ICE_USE_SECURE_TRANSPORT
-
 using namespace std;
 using namespace Ice;
+using namespace IceInternal;
 using namespace IceSSL;
+using namespace IceSSL::SecureTransport;
 
 namespace
 {
@@ -96,7 +93,10 @@ socketRead(SSLConnectionRef connection, void* data, size_t* length)
 }
 
 bool
-checkTrustResult(SecTrustRef trust, const SecureTransportEnginePtr& engine, const InstancePtr& instance)
+checkTrustResult(SecTrustRef trust,
+                 const IceSSL::SecureTransport::SSLEnginePtr& engine,
+                 const IceSSL::InstancePtr& instance,
+                 const string& host)
 {
     OSStatus err = noErr;
     SecTrustResultType trustResult = kSecTrustResultOtherError;
@@ -104,7 +104,7 @@ checkTrustResult(SecTrustRef trust, const SecureTransportEnginePtr& engine, cons
     {
         if((err = SecTrustSetAnchorCertificates(trust, engine->getCertificateAuthorities())))
         {
-            throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + errorToString(err));
+            throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
         }
 
         //
@@ -112,7 +112,27 @@ checkTrustResult(SecTrustRef trust, const SecureTransportEnginePtr& engine, cons
         //
         if((err = SecTrustSetNetworkFetchAllowed(trust, false)))
         {
-            throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + errorToString(err));
+            throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
+        }
+
+        //
+        // Add SSL trust policy if we need to check the certificate name.
+        //
+        if(engine->getCheckCertName() && !host.empty())
+        {
+            UniqueRef<CFStringRef> hostref(toCFString(host));
+            UniqueRef<SecPolicyRef> policy(SecPolicyCreateSSL(true, hostref.get()));
+            UniqueRef<CFArrayRef> policies;
+            if((err = SecTrustCopyPolicies(trust, &policies.get())))
+            {
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
+            }
+            UniqueRef<CFMutableArrayRef> newPolicies(CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, policies.get()));
+            CFArrayAppendValue(newPolicies.get(), policy.get());
+            if((err = SecTrustSetPolicies(trust, newPolicies.get())))
+            {
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
+            }
         }
 
         //
@@ -120,7 +140,7 @@ checkTrustResult(SecTrustRef trust, const SecureTransportEnginePtr& engine, cons
         //
         if((err = SecTrustEvaluate(trust, &trustResult)))
         {
-            throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + errorToString(err));
+            throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
         }
     }
 
@@ -147,7 +167,7 @@ checkTrustResult(SecTrustRef trust, const SecureTransportEnginePtr& engine, cons
             if(instance->traceLevel() >= 1)
             {
                 ostringstream os;
-                os << "IceSSL: ignoring certificate verification failure\n" << trustResultDescription(trustResult);
+                os << "IceSSL: ignoring certificate verification failure:\n" << trustResultDescription(trustResult);
                 instance->logger()->trace(instance->traceCategory(), os.str());
             }
             return false;
@@ -155,7 +175,7 @@ checkTrustResult(SecTrustRef trust, const SecureTransportEnginePtr& engine, cons
         else
         {
             ostringstream os;
-            os << "IceSSL: certificate verification failure\n" << trustResultDescription(trustResult);
+            os << "IceSSL: certificate verification failure:\n" << trustResultDescription(trustResult);
             string msg = os.str();
             if(instance->traceLevel() >= 1)
             {
@@ -169,18 +189,39 @@ checkTrustResult(SecTrustRef trust, const SecureTransportEnginePtr& engine, cons
 }
 
 IceInternal::NativeInfoPtr
-IceSSL::TransceiverI::getNativeInfo()
+IceSSL::SecureTransport::TransceiverI::getNativeInfo()
 {
-    return _stream;
+    return _delegate->getNativeInfo();
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer, bool&)
+IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::Buffer& writeBuffer)
 {
-    IceInternal::SocketOperation status = _stream->connect(readBuffer, writeBuffer);
-    if(status != IceInternal::SocketOperationNone)
+    if(!_connected)
+    {
+        IceInternal::SocketOperation status = _delegate->initialize(readBuffer, writeBuffer);
+        if(status != IceInternal::SocketOperationNone)
+        {
+            return status;
+        }
+        _connected = true;
+    }
+
+    //
+    // Limit the size of packets passed to SSLWrite/SSLRead to avoid
+    // blocking and holding too much memory.
+    //
+    if(_delegate->getNativeInfo()->fd() != INVALID_SOCKET)
     {
-        return status;
+        _maxSendPacketSize =
+            static_cast<size_t>(std::max(512, IceInternal::getSendBufferSize(_delegate->getNativeInfo()->fd())));
+        _maxRecvPacketSize =
+            static_cast<size_t>(std::max(512, IceInternal::getRecvBufferSize(_delegate->getNativeInfo()->fd())));
+    }
+    else
+    {
+        _maxSendPacketSize = 128 * 1024; // 128KB
+        _maxRecvPacketSize = 128 * 1024; // 128KB
     }
 
     OSStatus err = 0;
@@ -189,43 +230,56 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         //
         // Initialize SSL context
         //
-        _ssl = _engine->newContext(_incoming);
-        if((err = SSLSetIOFuncs(_ssl, socketRead, socketWrite)))
+        _ssl.reset(_engine->newContext(_incoming));
+        if((err = SSLSetIOFuncs(_ssl.get(), socketRead, socketWrite)))
         {
             throw SecurityException(__FILE__, __LINE__, "IceSSL: setting IO functions failed\n" +
-                                    errorToString(err));
+                                    sslErrorToString(err));
         }
 
-        if((err = SSLSetConnection(_ssl, reinterpret_cast<SSLConnectionRef>(this))))
+        if((err = SSLSetConnection(_ssl.get(), reinterpret_cast<SSLConnectionRef>(this))))
         {
             throw SecurityException(__FILE__, __LINE__, "IceSSL: setting SSL connection failed\n" +
-                                    errorToString(err));
+                                    sslErrorToString(err));
+        }
+
+        //
+        // Enable SNI
+        //
+        if(!_incoming && _engine->getServerNameIndication() && !_host.empty() && !IceInternal::isIpAddress(_host))
+        {
+            if((err = SSLSetPeerDomainName(_ssl.get(), _host.data(), _host.length())))
+            {
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: setting SNI host failed `" + _host + "'\n" +
+                                        sslErrorToString(err));
+            }
         }
     }
 
     SSLSessionState state;
-    SSLGetSessionState(_ssl, &state);
+    SSLGetSessionState(_ssl.get(), &state);
 
     //
     // SSL Handshake
     //
     while(state == kSSLHandshake || state == kSSLIdle)
     {
-        err = SSLHandshake(_ssl);
+        err = SSLHandshake(_ssl.get());
         if(err == noErr)
         {
             break; // We're done!
         }
         else if(err == errSSLWouldBlock)
         {
-            assert(_flags & SSLWantRead || _flags & SSLWantWrite);
-            return _flags & SSLWantRead ? IceInternal::SocketOperationRead : IceInternal::SocketOperationWrite;
+            assert(_tflags & SSLWantRead || _tflags & SSLWantWrite);
+            return _tflags & SSLWantRead ? IceInternal::SocketOperationRead : IceInternal::SocketOperationWrite;
         }
         else if(err == errSSLPeerAuthCompleted)
         {
             assert(!_trust);
-            err = SSLCopyPeerTrust(_ssl, &_trust);
-            if(_incoming && _engine->getVerifyPeer() == 1 && (err == errSSLBadCert || _trust == 0))
+            err = SSLCopyPeerTrust(_ssl.get(), &_trust.get());
+
+            if(_incoming && _engine->getVerifyPeer() == 1 && (err == errSSLBadCert || !_trust))
             {
                 // This is expected if the client doesn't provide a certificate. With 10.10 and 10.11 errSSLBadCert
                 // is expected, the server is configured to verify but not require the client
@@ -234,7 +288,7 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
             }
             if(err == noErr)
             {
-                _verified = checkTrustResult(_trust, _engine, _instance);
+                _verified = checkTrustResult(_trust.get(), _engine, _instance, _host);
                 continue; // Call SSLHandshake to resume the handsake.
             }
             // Let it fall through, this will raise a SecurityException with the SSLCopyPeerTrust error.
@@ -244,31 +298,40 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
             throw ConnectionLostException(__FILE__, __LINE__, 0);
         }
 
-        IceInternal::Address remoteAddr;
-        string desc = "<not available>";
-        if(IceInternal::fdToRemoteAddress(_stream->fd(), remoteAddr))
-        {
-            desc = IceInternal::addrToString(remoteAddr);
-        }
         ostringstream os;
         os << "IceSSL: ssl error occurred for new " << (_incoming ? "incoming" : "outgoing") << " connection:\n"
-           << "remote address = " << desc << "\n" << errorToString(err);
+           << _delegate->toString() << "\n" << sslErrorToString(err);
         throw ProtocolException(__FILE__, __LINE__, os.str());
     }
-    _engine->verifyPeer(_stream->fd(), _host, NativeConnectionInfoPtr::dynamicCast(getInfo()));
+
+    for(CFIndex i = 0, count = SecTrustGetCertificateCount(_trust.get()); i < count; ++i)
+    {
+        SecCertificateRef cert = SecTrustGetCertificateAtIndex(_trust.get(), i);
+        CFRetain(cert);
+        _certs.push_back(IceSSL::SecureTransport::Certificate::create(cert));
+    }
+
+    assert(_ssl);
+    {
+        SSLCipherSuite cipher;
+        SSLGetNegotiatedCipher(_ssl.get(), &cipher);
+        _cipher = _engine->getCipherName(cipher);
+    }
+
+    _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString());
 
     if(_instance->engine()->securityTraceLevel() >= 1)
     {
-        assert(_ssl);
+
         Trace out(_instance->logger(), _instance->traceCategory());
         out << "SSL summary for " << (_incoming ? "incoming" : "outgoing") << " connection\n";
 
         SSLProtocol protocol;
-        SSLGetNegotiatedProtocolVersion(_ssl, &protocol);
+        SSLGetNegotiatedProtocolVersion(_ssl.get(), &protocol);
         const string sslProtocolName = protocolName(protocol);
 
         SSLCipherSuite cipher;
-        SSLGetNegotiatedCipher(_ssl, &cipher);
+        SSLGetNegotiatedCipher(_ssl.get(), &cipher);
         const string sslCipherName = _engine->getCipherName(cipher);
 
         if(sslCipherName.empty())
@@ -287,7 +350,7 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
+IceSSL::SecureTransport::TransceiverI::closing(bool initiator, const Ice::LocalException&)
 {
     // If we are initiating the connection closure, wait for the peer
     // to close the TCP/IP connection. Otherwise, close immediately.
@@ -295,30 +358,24 @@ IceSSL::TransceiverI::closing(bool initiator, const Ice::LocalException&)
 }
 
 void
-IceSSL::TransceiverI::close()
+IceSSL::SecureTransport::TransceiverI::close()
 {
-    if(_trust)
-    {
-        CFRelease(_trust);
-        _trust = 0;
-    }
-
+    _trust.reset(0);
     if(_ssl)
     {
-        SSLClose(_ssl);
-        CFRelease(_ssl);
-        _ssl = 0;
+        SSLClose(_ssl.get());
     }
+    _ssl.reset(0);
 
-    _stream->close();
+    _delegate->close();
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
+IceSSL::SecureTransport::TransceiverI::write(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(!_connected)
     {
-        return _stream->write(buf);
+        return _delegate->write(buf);
     }
 
     if(buf.i == buf.b.end())
@@ -333,8 +390,8 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
     while(buf.i != buf.b.end())
     {
         size_t processed = 0;
-        OSStatus err = _buffered ? SSLWrite(_ssl, 0, 0, &processed) :
-                                   SSLWrite(_ssl, reinterpret_cast<const void*>(buf.i), packetSize, &processed);
+        OSStatus err = _buffered ? SSLWrite(_ssl.get(), 0, 0, &processed) :
+                                   SSLWrite(_ssl.get(), reinterpret_cast<const void*>(buf.i), packetSize, &processed);
 
         if(err)
         {
@@ -344,7 +401,7 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
                 {
                     _buffered = processed;
                 }
-                assert(_flags & SSLWantWrite);
+                assert(_tflags & SSLWantWrite);
                 return IceInternal::SocketOperationWrite;
             }
 
@@ -359,7 +416,7 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
             //
             if(err <= -9800 && err >= -9849)
             {
-                throw ProtocolException(__FILE__, __LINE__, "IceSSL: error during write:\n" + errorToString(err));
+                throw ProtocolException(__FILE__, __LINE__, "IceSSL: error during write:\n" + sslErrorToString(err));
             }
 
             errno = err;
@@ -383,9 +440,9 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
             buf.i += processed;
         }
 
-        if(packetSize > buf.b.end() - buf.i)
+        if(packetSize > static_cast<size_t>(buf.b.end() - buf.i))
         {
-            packetSize = buf.b.end() - buf.i;
+            packetSize = static_cast<size_t>(buf.b.end() - buf.i);
         }
     }
 
@@ -393,11 +450,11 @@ IceSSL::TransceiverI::write(IceInternal::Buffer& buf)
 }
 
 IceInternal::SocketOperation
-IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
+IceSSL::SecureTransport::TransceiverI::read(IceInternal::Buffer& buf)
 {
-    if(!_stream->isConnected())
+    if(!_connected)
     {
-        return _stream->read(buf);
+        return _delegate->read(buf);
     }
 
     if(buf.i == buf.b.end())
@@ -405,17 +462,19 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
         return  IceInternal::SocketOperationNone;
     }
 
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, false);
+
     size_t packetSize = std::min(static_cast<size_t>(buf.b.end() - buf.i), _maxRecvPacketSize);
     while(buf.i != buf.b.end())
     {
         size_t processed = 0;
-        OSStatus err = SSLRead(_ssl, reinterpret_cast<void*>(buf.i), packetSize, &processed);
+        OSStatus err = SSLRead(_ssl.get(), reinterpret_cast<void*>(buf.i), packetSize, &processed);
         if(err)
         {
             if(err == errSSLWouldBlock)
             {
                 buf.i += processed;
-                assert(_flags & SSLWantRead);
+                assert(_tflags & SSLWantRead);
                 return IceInternal::SocketOperationRead;
             }
 
@@ -430,7 +489,7 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
             //
             if(err <= -9800 && err >= -9849)
             {
-                throw ProtocolException(__FILE__, __LINE__, "IceSSL: error during read:\n" + errorToString(err));
+                throw ProtocolException(__FILE__, __LINE__, "IceSSL: error during read:\n" + sslErrorToString(err));
             }
 
             errno = err;
@@ -446,150 +505,104 @@ IceSSL::TransceiverI::read(IceInternal::Buffer& buf, bool& hasMoreData)
 
         buf.i += processed;
 
-        if(packetSize > buf.b.end() - buf.i)
+        if(packetSize > static_cast<size_t>(buf.b.end() - buf.i))
         {
-            packetSize = buf.b.end() - buf.i;
+            packetSize = static_cast<size_t>(buf.b.end() - buf.i);
         }
     }
 
     //
-    // Check if there's still buffered data to read. In this case, set hasMoreData to true.
+    // Check if there's still buffered data to read. In this case, set the read ready status.
     //
     size_t buffered = 0;
-    OSStatus err = SSLGetBufferedReadSize(_ssl, &buffered);
+    OSStatus err = SSLGetBufferedReadSize(_ssl.get(), &buffered);
     if(err)
     {
         errno = err;
         throw SocketException(__FILE__, __LINE__, IceInternal::getSocketErrno());
     }
-    hasMoreData = buffered > 0;
+    _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, buffered > 0);
     return IceInternal::SocketOperationNone;
 }
 
 string
-IceSSL::TransceiverI::protocol() const
+IceSSL::SecureTransport::TransceiverI::protocol() const
 {
     return _instance->protocol();
 }
 
 string
-IceSSL::TransceiverI::toString() const
+IceSSL::SecureTransport::TransceiverI::toString() const
 {
-    return _stream->toString();
+    return _delegate->toString();
 }
 
 string
-IceSSL::TransceiverI::toDetailedString() const
+IceSSL::SecureTransport::TransceiverI::toDetailedString() const
 {
     return toString();
 }
 
 Ice::ConnectionInfoPtr
-IceSSL::TransceiverI::getInfo() const
-{
-    NativeConnectionInfoPtr info = new NativeConnectionInfo();
-    fillConnectionInfo(info, info->nativeCerts);
-    return info;
-}
-
-Ice::ConnectionInfoPtr
-IceSSL::TransceiverI::getWSInfo(const Ice::HeaderDict& headers) const
+IceSSL::SecureTransport::TransceiverI::getInfo() const
 {
-    WSSNativeConnectionInfoPtr info = new WSSNativeConnectionInfo();
-    fillConnectionInfo(info, info->nativeCerts);
-    info->headers = headers;
+    IceSSL::ConnectionInfoPtr info = ICE_MAKE_SHARED(IceSSL::ConnectionInfo);
+    info->underlying = _delegate->getInfo();
+    info->incoming = _incoming;
+    info->adapterName = _adapterName;
+    info->cipher = _cipher;
+    info->certs = _certs;
+    info->verified = _verified;
     return info;
 }
 
 void
-IceSSL::TransceiverI::checkSendSize(const IceInternal::Buffer&)
+IceSSL::SecureTransport::TransceiverI::checkSendSize(const IceInternal::Buffer&)
 {
 }
 
 void
-IceSSL::TransceiverI::setBufferSize(int rcvSize, int sndSize)
+IceSSL::SecureTransport::TransceiverI::setBufferSize(int rcvSize, int sndSize)
 {
-    _stream->setBufferSize(rcvSize, sndSize);
+    _delegate->setBufferSize(rcvSize, sndSize);
 }
 
-IceSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
-                                   const IceInternal::StreamSocketPtr& stream,
-                                   const string& hostOrAdapterName,
-                                   bool incoming) :
+IceSSL::SecureTransport::TransceiverI::TransceiverI(const IceSSL::InstancePtr& instance,
+                                                    const IceInternal::TransceiverPtr& delegate,
+                                                    const string& hostOrAdapterName,
+                                                    bool incoming) :
     _instance(instance),
-    _engine(SecureTransportEnginePtr::dynamicCast(instance->engine())),
+    _engine(IceSSL::SecureTransport::SSLEnginePtr::dynamicCast(instance->engine())),
     _host(incoming ? "" : hostOrAdapterName),
     _adapterName(incoming ? hostOrAdapterName : ""),
     _incoming(incoming),
-    _stream(stream),
-    _ssl(0),
-    _trust(0),
+    _delegate(delegate),
+    _connected(false),
     _verified(false),
     _buffered(0)
 {
-    //
-    // Limit the size of packets passed to SSLWrite/SSLRead to avoid
-    // blocking and holding too much memory.
-    //
-    _maxSendPacketSize = std::max(512, IceInternal::getSendBufferSize(_stream->fd()));
-    _maxRecvPacketSize = std::max(512, IceInternal::getRecvBufferSize(_stream->fd()));
 }
 
-IceSSL::TransceiverI::~TransceiverI()
+IceSSL::SecureTransport::TransceiverI::~TransceiverI()
 {
 }
 
-void
-IceSSL::TransceiverI::fillConnectionInfo(const ConnectionInfoPtr& info, std::vector<CertificatePtr>& nativeCerts) const
-{
-    IceInternal::fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress,
-                                    info->remotePort);
-    if(_stream->fd() != INVALID_SOCKET)
-    {
-        info->rcvSize = IceInternal::getRecvBufferSize(_stream->fd());
-        info->sndSize = IceInternal::getSendBufferSize(_stream->fd());
-    }
-
-    if(_ssl)
-    {
-        for(int i = 0, count = SecTrustGetCertificateCount(_trust); i < count; ++i)
-        {
-            SecCertificateRef cert = SecTrustGetCertificateAtIndex(_trust, i);
-            CFRetain(cert);
-
-            CertificatePtr certificate = new Certificate(cert);
-            nativeCerts.push_back(certificate);
-            info->certs.push_back(certificate->encode());
-        }
-
-        SSLCipherSuite cipher;
-        SSLGetNegotiatedCipher(_ssl, &cipher);
-        info->cipher = _engine->getCipherName(cipher);
-        info->verified = _verified;
-    }
-    else
-    {
-        info->verified = false;
-    }
-
-    info->adapterName = _adapterName;
-    info->incoming = _incoming;
-}
-
 OSStatus
-IceSSL::TransceiverI::writeRaw(const char* data, size_t* length) const
+IceSSL::SecureTransport::TransceiverI::writeRaw(const char* data, size_t* length) const
 {
-    _flags &= ~SSLWantWrite;
+    _tflags &= ~SSLWantWrite;
 
     try
     {
-        ssize_t ret = _stream->write(data, *length);
-        if(ret < *length)
+        IceInternal::Buffer buf(reinterpret_cast<const Ice::Byte*>(data), reinterpret_cast<const Ice::Byte*>(data) + *length);
+        IceInternal::SocketOperation op = _delegate->write(buf);
+        if(op == IceInternal::SocketOperationWrite)
         {
-            *length = static_cast<size_t>(ret);
-            _flags |= SSLWantWrite;
+            *length = static_cast<size_t>(buf.i - buf.b.begin());
+            _tflags |= SSLWantWrite;
             return errSSLWouldBlock;
         }
+        assert(op == IceInternal::SocketOperationNone);
     }
     catch(const Ice::ConnectionLostException&)
     {
@@ -608,19 +621,21 @@ IceSSL::TransceiverI::writeRaw(const char* data, size_t* length) const
 }
 
 OSStatus
-IceSSL::TransceiverI::readRaw(char* data, size_t* length) const
+IceSSL::SecureTransport::TransceiverI::readRaw(char* data, size_t* length) const
 {
-    _flags &= ~SSLWantRead;
+    _tflags &= ~SSLWantRead;
 
     try
     {
-        ssize_t ret = _stream->read(data, *length);
-        if(ret < *length)
+        IceInternal::Buffer buf(reinterpret_cast<Ice::Byte*>(data), reinterpret_cast<Ice::Byte*>(data) + *length);
+        IceInternal::SocketOperation op = _delegate->read(buf);
+        if(op == IceInternal::SocketOperationRead)
         {
-            *length = static_cast<size_t>(ret);
-            _flags |= SSLWantRead;
+            *length = static_cast<size_t>(buf.i - buf.b.begin());
+            _tflags |= SSLWantRead;
             return errSSLWouldBlock;
         }
+        assert(op == IceInternal::SocketOperationNone);
     }
     catch(const Ice::ConnectionLostException&)
     {
@@ -637,5 +652,3 @@ IceSSL::TransceiverI::readRaw(char* data, size_t* length) const
     }
     return noErr;
 }
-
-#endif