zeroc-ice 3.6.5 → 3.7.4

data/ext/ice/cpp/include/Ice/ValueF.h

@@ -0,0 +1,21 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#ifndef ICE_VALUE_F_H
+#define ICE_VALUE_F_H
+
+#ifdef ICE_CPP11_MAPPING
+#include <Ice/Config.h>
+
+namespace Ice
+{
+
+class Value;
+/// \cond INTERNAL
+using ValuePtr = ::std::shared_ptr<Value>;
+/// \endcond
+
+}
+#endif
+#endif

data/ext/ice/cpp/include/IceSSL/Config.h

@@ -1,41 +1,21 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
-#ifndef ICE_SSL_CONFIG_H
-#define ICE_SSL_CONFIG_H
+#ifndef ICESSL_CONFIG_H
+#define ICESSL_CONFIG_H
 
 #include <Ice/Config.h>
 
 //
-// Automatically link IceSSL[D].lib with Visual C++
+// Automatically link IceSSL[D|++11|++11D].lib with Visual C++
 //
-
-#if !defined(ICE_BUILDING_ICE_SSL) && defined(ICE_SSL_API_EXPORTS)
-#   define ICE_BUILDING_ICE_SSL
-#endif
-
-#if defined(_MSC_VER)
-#   if !defined(ICE_BUILDING_ICE_SSL)
-#      if defined(_DEBUG) && !defined(ICE_OS_WINRT)
-#          pragma comment(lib, "IceSSLD.lib")
-#      else
-#          pragma comment(lib, "IceSSL.lib")
-#      endif
-#   endif
+#if !defined(ICE_BUILDING_ICESSL) && defined(ICESSL_API_EXPORTS)
+#  define ICE_BUILDING_ICESSL
 #endif
 
-#if defined(__APPLE__)
-#  define ICE_USE_SECURE_TRANSPORT 1
-#elif defined(_WIN32)
-#  define ICE_USE_SCHANNEL 1
-#else
-#  define ICE_USE_OPENSSL 1
+#if defined(_MSC_VER) && !defined(ICE_BUILDING_ICESSL)
+#  pragma comment(lib, ICE_LIBNAME("IceSSL"))
 #endif
 
 #endif

data/ext/ice/cpp/include/IceSSL/IceSSL.h

@@ -1,20 +1,26 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
-#ifndef ICE_SSL_ICE_SSL_H
-#define ICE_SSL_ICE_SSL_H
+#ifndef ICESSL_ICESSL_H
+#define ICESSL_ICESSL_H
 
 #include <IceUtil/PushDisableWarnings.h>
-#include <IceUtil/Config.h>
-#if !defined(ICE_OS_WINRT) && (!defined(__APPLE__) || TARGET_OS_IPHONE == 0)
-#   include <IceSSL/Plugin.h>
+#include <Ice/Config.h>
+#include <IceSSL/Plugin.h>
+
+#if defined(_WIN32)
+#  if defined(ICE_OS_UWP)
+#    include <IceSSL/UWP.h>
+#  else
+#    include <IceSSL/SChannel.h>
+#  endif
+#elif defined(__APPLE__)
+#  include <IceSSL/SecureTransport.h>
+#else
+#  include <IceSSL/OpenSSL.h>
 #endif
+
 #include <IceSSL/EndpointInfo.h>
 #include <IceSSL/ConnectionInfo.h>
 #include <IceUtil/PopDisableWarnings.h>

data/ext/ice/cpp/include/IceSSL/OpenSSL.h

@@ -0,0 +1,147 @@
+//
+// Copyright (c) ZeroC, Inc. All rights reserved.
+//
+
+#ifndef ICESSL_OPENSSL_H
+#define ICESSL_OPENSSL_H
+
+#include <IceSSL/Plugin.h>
+
+#include <openssl/x509v3.h>
+#include <openssl/pem.h>
+
+//
+// Automatically link IceSSLOpenSSL[D|++11|++11D].lib with Visual C++
+//
+#if defined(_MSC_VER)
+#  if !defined(ICE_BUILDING_ICESSL_OPENSSL) && defined(ICESSL_OPENSSL_API_EXPORTS)
+#    define ICE_BUILDING_ICESSL_OPENSSL
+#  endif
+
+#  if !defined(ICE_BUILDING_ICESSL_OPENSSL)
+#    pragma comment(lib, ICE_LIBNAME("IceSSLOpenSSL"))
+#  endif
+#endif
+
+#ifndef ICESSL_OPENSSL_API
+#   if defined(ICE_STATIC_LIBS)
+#       define ICESSL_OPENSSL_API /**/
+#   elif defined(ICESSL_OPENSSL_API_EXPORTS)
+#       define ICESSL_OPENSSL_API ICE_DECLSPEC_EXPORT
+#   else
+#       define ICESSL_OPENSSL_API ICE_DECLSPEC_IMPORT
+#   endif
+#endif
+
+#if defined(_WIN32) && !defined(ICESSL_OPENSSL_API_EXPORTS)
+
+namespace Ice
+{
+
+/**
+ * When using static libraries, calling this function ensures the OpenSSL version of the IceSSL plug-in is
+ * linked with the application.
+ * @param loadOnInitialize If true, the plug-in is loaded (created) during communicator initialization.
+ * If false, the plug-in is only loaded during communicator initialization if its corresponding plug-in
+ * property is set to 1.
+ */
+ICE_PLUGIN_REGISTER_DECLSPEC_IMPORT void registerIceSSLOpenSSL(bool loadOnInitialize = true);
+
+}
+#endif
+
+namespace IceSSL
+{
+
+namespace OpenSSL
+{
+
+class Certificate;
+ICE_DEFINE_PTR(CertificatePtr, Certificate);
+
+/**
+ * Encapsulates an OpenSSL X.509 certificate.
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_OPENSSL_API Certificate : public virtual IceSSL::Certificate
+{
+public:
+
+    /**
+     * Construct a certificate using a native certificate.
+     * The Certificate class assumes ownership of the given native
+     * certificate.
+     * @param cert The native certificate.
+     * @return A new certificate object.
+     */
+    static CertificatePtr create(x509_st* cert);
+
+    /**
+     * Load the certificate from a file. The certificate must use the
+     * PEM encoding format.
+     * @param file The certificate file.
+     * @return A new certificate object.
+     * @throws CertificateReadException if the file cannot be read.
+     */
+    static CertificatePtr load(const std::string& file);
+
+    /**
+     * Decode a certificate from a string that uses the PEM encoding format.
+     * @param cert A string containing the PEM-encoded certificate.
+     * @return A new certificate object.
+     * @throws CertificateEncodingException if an error occurs.
+     */
+    static CertificatePtr decode(const std::string& cert);
+
+    /**
+     * Retrieve the native X509 certificate value wrapped by this object.
+     * @return The native certificate. The returned reference is only valid for the lifetime of this
+     * object. You can increment it with X509_dup.
+     */
+    virtual x509_st* getCert() const = 0;
+};
+
+/**
+ * Represents the IceSSL plug-in object.
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_OPENSSL_API Plugin : public virtual IceSSL::Plugin
+{
+public:
+
+    /**
+     * Obtains the OpenSSL version number.
+     * @return The version.
+     */
+    virtual Ice::Long getOpenSSLVersion() const = 0;
+
+    /**
+     * Establishes the OpenSSL context. This must be done before the
+     * plug-in is initialized, therefore the application must define
+     * the property Ice.InitPlugins=0, set the context, and finally
+     * invoke Ice::PluginManager::initializePlugins.
+     *
+     * When the application supplies its own OpenSSL context, the
+     * plug-in ignores configuration properties related to certificates,
+     * keys, and passwords.
+     *
+     * Note that the plug-in assumes ownership of the given context.
+     *
+     * @param ctx The OpenSSL context.
+     */
+    virtual void setContext(SSL_CTX* ctx) = 0;
+
+    /**
+     * Obtains the SSL context. Use caution when modifying this value.
+     * Changes made to this value have no effect on existing connections.
+     * @return The OpenSSL context.
+     */
+    virtual SSL_CTX* getContext() = 0;
+};
+ICE_DEFINE_PTR(PluginPtr, Plugin);
+
+} // OpenSSL namespace end
+
+} // IceSSL namespace end
+
+#endif

data/ext/ice/cpp/include/IceSSL/Plugin.h

@@ -1,108 +1,61 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
-#ifndef ICE_SSL_PLUGIN_H
-#define ICE_SSL_PLUGIN_H
+#ifndef ICESSL_PLUGIN_H
+#define ICESSL_PLUGIN_H
 
-#include <IceUtil/Time.h>
 #include <Ice/Plugin.h>
 #include <IceSSL/Config.h>
-#include <IceSSL/ConnectionInfo.h>
+#include <IceSSL/ConnectionInfoF.h>
+
+#ifdef ICE_CPP11_MAPPING
+#   include <chrono>
+#else
+#   include <IceUtil/Time.h>
+#endif
 
 #include <vector>
 #include <list>
 
-#if defined(ICE_USE_SECURE_TRANSPORT)
-#   include <CoreFoundation/CFError.h>
-#elif defined(ICE_USE_SCHANNEL)
-#   include <wincrypt.h>
-#endif
-
-#ifndef ICE_SSL_API
-#   ifdef ICE_SSL_API_EXPORTS
-#       define ICE_SSL_API ICE_DECLSPEC_EXPORT
-#   elif defined(ICE_STATIC_LIBS)
-#       define ICE_SSL_API /**/
+#ifndef ICESSL_API
+#   if defined(ICE_STATIC_LIBS)
+#       define ICESSL_API /**/
+#   elif defined(ICESSL_API_EXPORTS)
+#       define ICESSL_API ICE_DECLSPEC_EXPORT
 #   else
-#       define ICE_SSL_API ICE_DECLSPEC_IMPORT
+#       define ICESSL_API ICE_DECLSPEC_IMPORT
 #   endif
 #endif
 
-#ifdef ICE_USE_OPENSSL
-
-//
-// Pointer to an opaque SSL session context object. ssl_ctx_st is the
-// OpenSSL type that holds configuration settings for all SSL
-// connections.
-//
-typedef struct ssl_ctx_st SSL_CTX;
-
-//
-// Pointer to an opaque certificate object. X509_st is the OpenSSL
-// type that represents a certificate.
-//
-typedef struct x509_st* X509CertificateRef;
-
-//
-// EVP_PKEY is the OpenSSL type that represents a public key.
-//
-typedef struct evp_pkey_st* KeyRef;
-
-//
-// Type that represents an X509 distinguished name
-//
-typedef struct X509_name_st X509NAME;
-
-#elif defined(ICE_USE_SECURE_TRANSPORT)
-
-//
-// Pointer to an opaque certificate object.
-//
-struct OpaqueSecCertificateRef;
-typedef struct OpaqueSecCertificateRef* X509CertificateRef;
-
-//
-// Pointer to an opaque key object.
-//
-struct OpaqueSecKeyRef;
-typedef struct OpaqueSecKeyRef* KeyRef;
-
-#elif defined(ICE_USE_SCHANNEL)
-
-//
-// Pointer to an opaque certificate object.
-//
-typedef CERT_SIGNED_CONTENT_INFO* X509CertificateRef;
-
-//
-// Pointer to an opaque key object.
-//
-typedef CERT_PUBLIC_KEY_INFO* KeyRef;
-
-#endif
-
 namespace IceSSL
 {
 
-//
-// This exception is thrown if the certificate cannot be read.
-//
-class ICE_SSL_API CertificateReadException : public IceUtil::Exception
+/**
+ * Thrown if the certificate cannot be read.
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_API CertificateReadException : public IceUtil::ExceptionHelper<CertificateReadException>
 {
 public:
 
     CertificateReadException(const char*, int, const std::string&);
+
+#ifndef ICE_CPP11_COMPILER
     virtual ~CertificateReadException() throw();
-    virtual std::string ice_name() const;
+#endif
+
+    virtual std::string ice_id() const;
+
+#ifndef ICE_CPP11_MAPPING
+    /**
+     * Creates a shallow copy of this exception.
+     * @return The new exception instance.
+     */
     virtual CertificateReadException* ice_clone() const;
-    virtual void ice_throw() const;
+#endif
 
+    /** The reason for the exception. */
     std::string reason;
 
 private:
@@ -110,22 +63,31 @@ private:
     static const char* _name;
 };
 
-//
-// This exception is thrown if the certificate cannot be encoded.
-//
-class ICE_SSL_API CertificateEncodingException : public IceUtil::Exception
+/**
+ * Thrown if the certificate cannot be encoded.
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_API CertificateEncodingException : public IceUtil::ExceptionHelper<CertificateEncodingException>
 {
 public:
 
     CertificateEncodingException(const char*, int, const std::string&);
-#ifdef ICE_USE_SECURE_TRANSPORT
-    CertificateEncodingException(const char*, int, CFErrorRef);
-#endif
+
+#ifndef ICE_CPP11_COMPILER
     virtual ~CertificateEncodingException() throw();
-    virtual std::string ice_name() const;
+#endif
+
+    virtual std::string ice_id() const;
+
+#ifndef ICE_CPP11_MAPPING
+    /**
+     * Creates a shallow copy of this exception.
+     * @return The new exception instance.
+     */
     virtual CertificateEncodingException* ice_clone() const;
-    virtual void ice_throw() const;
+#endif
 
+    /** The reason for the exception. */
     std::string reason;
 
 private:
@@ -133,19 +95,31 @@ private:
     static const char* _name;
 };
 
-//
-// This exception is thrown if a distinguished name cannot be parsed.
-//
-class ICE_SSL_API ParseException : public IceUtil::Exception
+/**
+ * This exception is thrown if a distinguished name cannot be parsed.
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_API ParseException : public IceUtil::ExceptionHelper<ParseException>
 {
 public:
 
     ParseException(const char*, int, const std::string&);
+
+#ifndef ICE_CPP11_COMPILER
     virtual ~ParseException() throw();
-    virtual std::string ice_name() const;
+#endif
+
+    virtual std::string ice_id() const;
+
+#ifndef ICE_CPP11_MAPPING
+    /**
+     * Creates a shallow copy of this exception.
+     * @return The new exception instance.
+     */
     virtual ParseException* ice_clone() const;
-    virtual void ice_throw() const;
+#endif
 
+    /** The reason for the exception. */
     std::string reason;
 
 private:
@@ -153,404 +127,443 @@ private:
     static const char* _name;
 };
 
-//
-// Forward declaration.
-//
-class Certificate;
-typedef IceUtil::Handle<Certificate> CertificatePtr;
-
-//
-// A representation of a PublicKey.
-//
-class ICE_SSL_API PublicKey : public IceUtil::Shared
-{
-public:
-
-    ~PublicKey();
-
-    //
-    // Retrieve the native public key value wrapped by this object.
-    //
-    // The returned reference is only valid for the lifetime of this
-    // object. With SecureTransport you can increment the reference
-    // count of the returned object with CFRetain.
-    //
-    KeyRef key() const;
-
-private:
-
-    PublicKey(const CertificatePtr&, KeyRef);
-    friend class Certificate;
-
-    CertificatePtr _cert;
-    KeyRef _key;
-
-};
-typedef IceUtil::Handle<PublicKey> PublicKeyPtr;
-
-//
-// This class represents a DistinguishedName, similar to the Java
-// type X500Principal and the .NET type X500DistinguishedName.
-//
-// For comparison purposes, the value of a relative distinguished
-// name (RDN) component is always unescaped before matching,
-// therefore "ZeroC, Inc." will match ZeroC\, Inc.
-//
-// toString() always returns exactly the same information as was
-// provided in the constructor (i.e., "ZeroC, Inc." will not turn
-// into ZeroC\, Inc.).
-//
-class ICE_SSL_API DistinguishedName
+/**
+ * This class represents a DistinguishedName, similar to the Java
+ * type X500Principal and the .NET type X500DistinguishedName.
+ *
+ * For comparison purposes, the value of a relative distinguished
+ * name (RDN) component is always unescaped before matching,
+ * therefore "ZeroC, Inc." will match ZeroC\, Inc.
+ *
+ * toString() always returns exactly the same information as was
+ * provided in the constructor (i.e., "ZeroC, Inc." will not turn
+ * into ZeroC\, Inc.).
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_API DistinguishedName
 {
 public:
 
-#ifdef ICE_USE_OPENSSL
-    //
-    // Create a DistinguishedName using an OpenSSL value.
-    //
-    DistinguishedName(X509NAME*);
-#endif
-
-    //
-    // Create a DistinguishedName from a string encoded using
-    // the rules in RFC2253.
-    //
-    // Throws ParseException if parsing fails.
-    //
-    DistinguishedName(const std::string&);
-
-    //
-    // Create a DistinguishedName from a list of RDN pairs,
-    // where each pair consists of the RDN's type and value.
-    // For example, the RDN "O=ZeroC" is represented by the
-    // pair ("O", "ZeroC").
-    //
-    DistinguishedName(const std::list<std::pair<std::string, std::string> >&);
-
-    //
-    // This is an exact match. The order of the RDN components is
-    // important.
-    //
-    bool operator==(const DistinguishedName&) const;
-    bool operator!=(const DistinguishedName&) const;
-    bool operator<(const DistinguishedName&) const;
-
-    //
-    // Perform a partial match with another DistinguishedName. The function
-    // returns true if all of the RDNs in the argument are present in this
-    // DistinguishedName and they have the same values.
-    //
-    bool match(const DistinguishedName&) const;
-
-    //
-    // Encode the DN in RFC2253 format.
-    //
+    /**
+     * Creates a DistinguishedName from a string encoded using the rules in RFC2253.
+     * @param name The encoded distinguished name.
+     * @throws ParseException if parsing fails.
+     */
+    explicit DistinguishedName(const std::string& name);
+
+    /**
+     * Creates a DistinguishedName from a list of RDN pairs,
+     * where each pair consists of the RDN's type and value.
+     * For example, the RDN "O=ZeroC" is represented by the
+     * pair ("O", "ZeroC").
+     * @throws ParseException if parsing fails.
+     */
+    explicit DistinguishedName(const std::list<std::pair<std::string, std::string> >&);
+
+    /**
+     * Performs an exact match. The order of the RDN components is important.
+     */
+    friend ICESSL_API bool operator==(const DistinguishedName&, const DistinguishedName&);
+
+    /**
+     * Performs an exact match. The order of the RDN components is important.
+     */
+    friend ICESSL_API bool operator<(const DistinguishedName&, const DistinguishedName&);
+
+    /**
+     * Performs a partial match with another DistinguishedName.
+     * @param dn The name to be matched.
+     * @return True if all of the RDNs in the argument are present in this
+     * DistinguishedName and they have the same values.
+     */
+    bool match(const DistinguishedName& dn) const;
+
+    /**
+     * Performs a partial match with another DistinguishedName.
+     * @param dn The name to be matched.
+     * @return True if all of the RDNs in the argument are present in this
+     * DistinguishedName and they have the same values.
+     */
+    bool match(const std::string& dn) const;
+
+    /**
+     * Encodes the DN in RFC2253 format.
+     * @return An encoded string.
+     */
     operator std::string() const;
 
-private:
+protected:
 
+    /// \cond INTERNAL
     void unescape();
+    /// \endcond
+
+private:
 
     std::list<std::pair<std::string, std::string> > _rdns;
     std::list<std::pair<std::string, std::string> > _unescaped;
 };
 
-//
-// This convenience class is a wrapper around a native certificate.
-// The interface is inspired by java.security.cert.X509Certificate.
-//
-class ICE_SSL_API Certificate : public IceUtil::Shared
+/**
+ * Performs an exact match. The order of the RDN components is important.
+ */
+inline bool
+operator>(const DistinguishedName& lhs, const DistinguishedName& rhs)
 {
-public:
-
-    //
-    // Construct a certificate using a native certificate.
-    //
-    // The Certificate class assumes ownership of the given native
-    // certificate.
-    //
-    Certificate(X509CertificateRef);
-    ~Certificate();
-
-    //
-    // Load the certificate from a file. The certificate must use the
-    // PEM encoding format. Raises CertificateReadException if the
-    // file cannot be read.
-    //
-    static CertificatePtr load(const std::string&);
-
-    //
-    // Decode a certificate from a string that uses the PEM encoding
-    // format.  Raises CertificateEncodingException if an error
-    // occurs.
-    //
-    static CertificatePtr decode(const std::string&);
-
-    //
-    // Those operators compare the certificates for equality using the
-    // native certificate comparison method.
-    //
-    bool operator==(const Certificate&) const;
-    bool operator!=(const Certificate&) const;
-
-    //
-    // Get the certificate's public key.
-    //
-    PublicKeyPtr getPublicKey() const;
-
-    //
-    // Verify that this certificate was signed by the given certificate
-    // public key. Returns true if signed, false otherwise.
-    //
-    bool verify(const CertificatePtr&) const;
-
-#ifdef ICE_USE_OPENSSL
-    //
-    // Verify that this certificate was signed by the given public
-    // key. Returns true if signed, false otherwise.
-    //
-    // This method was deprecated for consistency with some SSL
-    // engines that require a certificate and not just a public key to
-    // verify the certificate signature.
-    //
-    ICE_DEPRECATED_API("verify(const PublicKeyPtr&) is deprecated, use verify(const CertificatePtr&) instead")
-    bool verify(const PublicKeyPtr&) const;
-#endif
+    return rhs < lhs;
+}
 
-    //
-    // Return a string encoding of the certificate in PEM format.
-    // Raises CertificateEncodingException if an error occurs.
-    //
-    std::string encode() const;
-
-    //
-    // Checks that the certificate is currently valid, that is, the current
-    // date falls between the validity period given in the certificate.
-    //
-    bool checkValidity() const;
-
-    //
-    // Checks that the certificate is valid at the given time.
-    //
-    bool checkValidity(const IceUtil::Time&) const;
-
-    //
-    // Get the not-after validity time.
-    //
-    IceUtil::Time getNotAfter() const;
-
-    //
-    // Get the not-before validity time.
-    //
-    IceUtil::Time getNotBefore() const;
-
-    //
-    // Get the serial number. This is an arbitrarily large number.
-    //
-    std::string getSerialNumber() const;
-
-    //
-    // Get the signature algorithm name used to sign the certificate.
-    //
-    //std::string getSigAlgName() const;
-
-    //
-    // Get the signature algorithm OID string from the certificate.
-    //
-    //std::string getSigAlgOID() const;
-
-    //
-    // Get the issuer's distinguished name (DN).
-    //
-    DistinguishedName getIssuerDN() const;
-
-    //
-    // Get the values in the issuer's alternative names extension.
-    //
-    // The returned list contains a pair of int, string.
-    //
-    // otherName                       [0]     OtherName
-    // rfc822Name                      [1]     IA5String
-    // dNSName                         [2]     IA5String
-    // x400Address                     [3]     ORAddress
-    // directoryName                   [4]     Name
-    // ediPartyName                    [5]     EDIPartyName
-    // uniformResourceIdentifier       [6]     IA5String
-    // iPAddress                       [7]     OCTET STRING
-    // registeredID                    [8]     OBJECT IDENTIFIER
-    //
-    // rfc822Name, dNSName, directoryName and
-    // uniformResourceIdentifier data is returned as a string.
-    //
-    // iPAddress is returned in dotted quad notation. IPv6 is not
-    // currently supported.
-    //
-    // All distinguished names are encoded in RFC2253 format.
-    //
-    // The remainder of the data will result in an empty string. Use the raw
-    // X509* certificate to obtain these values.
-    //
-    std::vector<std::pair<int, std::string> > getIssuerAlternativeNames();
-
-    //
-    // Get the subject's distinguished name (DN).
-    //
-    DistinguishedName getSubjectDN() const;
-
-    //
-    // See the comment for getIssuerAlternativeNames.
-    //
-    std::vector<std::pair<int, std::string> > getSubjectAlternativeNames();
-
-    //
-    // Retrieve the certificate version number.
-    //
-    int getVersion() const;
-
-    //
-    // Stringify the certificate. This is a human readable version of
-    // the certificate, not a DER or PEM encoding.
-    //
-    std::string toString() const;
-
-    //
-    // Retrieve the native X509 certificate value wrapped by this
-    // object.
-    //
-    // The returned reference is only valid for the lifetime of this
-    // object. With SecureTransport you can increment the reference
-    // count of the returned object with CFRetain. With OpenSSL, you
-    // can increment it with X509_dup. With SChannel, the returned
-    // reference is a pointer to a struct.
-    //
-    X509CertificateRef getCert() const;
+/**
+ * Performs an exact match. The order of the RDN components is important.
+ */
+inline bool
+operator<=(const DistinguishedName& lhs, const DistinguishedName& rhs)
+{
+    return !(lhs > rhs);
+}
 
-private:
+/**
+ * Performs an exact match. The order of the RDN components is important.
+ */
+inline bool
+operator>=(const DistinguishedName& lhs, const DistinguishedName& rhs)
+{
+    return !(lhs < rhs);
+}
 
-    X509CertificateRef _cert;
+/**
+ * Performs an exact match. The order of the RDN components is important.
+ */
+inline bool
+operator!=(const DistinguishedName& lhs, const DistinguishedName& rhs)
+{
+    return !(lhs == rhs);
+}
 
-#ifdef ICE_USE_SCHANNEL
-    CERT_INFO* _certInfo;
+/**
+ * Represents an X509 Certificate extension.
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_API X509Extension
+#ifndef ICE_CPP11_MAPPING
+    : public virtual IceUtil::Shared
 #endif
-};
-
-//
-// NativeConnectionInfo is an extension of IceSSL::ConnectionInfo that
-// provides access to native certificates.
-//
-class ICE_SSL_API NativeConnectionInfo : public ConnectionInfo
 {
 public:
 
-    //
-    // The certificate chain. This may be empty if the peer did not
-    // supply a certificate. The peer's certificate (if any) is the
-    // first one in the chain.
-    //
-    std::vector<CertificatePtr> nativeCerts;
+    /**
+     * Determines whether the information in this extension is important.
+     * @return True if if information is important, false otherwise.
+     */
+    virtual bool isCritical() const = 0;
+
+    /**
+     * Obtains the object ID of this extension.
+     * @return The object ID.
+     */
+    virtual std::string getOID() const = 0;
+
+    /**
+     * Obtains the data associated with this extension.
+     * @return The extension data.
+     */
+    virtual std::vector<Ice::Byte> getData() const = 0;
 };
-typedef IceUtil::Handle<NativeConnectionInfo> NativeConnectionInfoPtr;
+ICE_DEFINE_PTR(X509ExtensionPtr, X509Extension);
 
-//
-// WSSNativeConnectionInfo is an extension of IceSSL::WSSConnectionInfo
-// that provides access to native certificates.
-//
-class ICE_SSL_API WSSNativeConnectionInfo : public WSSConnectionInfo
+class Certificate;
+ICE_DEFINE_PTR(CertificatePtr, Certificate);
+
+/**
+ * This convenience class is a wrapper around a native certificate.
+ * The interface is inspired by java.security.cert.X509Certificate.
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_API Certificate :
+#ifdef ICE_CPP11_MAPPING
+    public std::enable_shared_from_this<Certificate>
+#else
+    public virtual IceUtil::Shared
+#endif
 {
 public:
 
-    //
-    // The certificate chain. This may be empty if the peer did not
-    // supply a certificate. The peer's certificate (if any) is the
-    // first one in the chain.
-    //
-    std::vector<CertificatePtr> nativeCerts;
+    /**
+     * Compares the certificates for equality using the native certificate comparison method.
+     */
+    virtual bool operator==(const Certificate&) const = 0;
+
+    /**
+     * Compares the certificates for equality using the native certificate comparison method.
+     */
+    virtual bool operator!=(const Certificate&) const = 0;
+
+    /**
+     * Obtains the authority key identifier.
+     * @return The identifier.
+     */
+    virtual std::vector<Ice::Byte> getAuthorityKeyIdentifier() const = 0;
+
+    /**
+     * Obtains the subject key identifier.
+     * @return The identifier.
+     */
+    virtual std::vector<Ice::Byte> getSubjectKeyIdentifier() const = 0;
+
+    /**
+     * Verifies that this certificate was signed by the given certificate
+     * public key.
+     * @param cert A certificate containing the public key.
+     * @return True if signed, false otherwise.
+     */
+    virtual bool verify(const CertificatePtr& cert) const = 0;
+
+    /**
+     * Obtains a string encoding of the certificate in PEM format.
+     * @return The encoded certificate.
+     * @throws CertificateEncodingException if an error occurs.
+     */
+    virtual std::string encode() const = 0;
+
+    /**
+     * Checks that the certificate is currently valid, that is, the current
+     * date falls between the validity period given in the certificate.
+     * @return True if the certificate is valid, false otherwise.
+     */
+    virtual bool checkValidity() const = 0;
+
+    /**
+     * Checks that the certificate is valid at the given time.
+     * @param t The target time.
+     * @return True if the certificate is valid, false otherwise.
+     */
+#ifdef ICE_CPP11_MAPPING
+    virtual bool checkValidity(const std::chrono::system_clock::time_point& t) const = 0;
+#else
+    virtual bool checkValidity(const IceUtil::Time& t) const = 0;
+#endif
+
+    /**
+     * Obtains the not-after validity time.
+     * @return The time after which this certificate is invalid.
+     */
+#ifdef ICE_CPP11_MAPPING
+    virtual std::chrono::system_clock::time_point getNotAfter() const = 0;
+#else
+    virtual IceUtil::Time getNotAfter() const = 0;
+#endif
+
+    /**
+     * Obtains the not-before validity time.
+     * @return The time at which this certificate is valid.
+     */
+#ifdef ICE_CPP11_MAPPING
+    virtual std::chrono::system_clock::time_point getNotBefore() const = 0;
+#else
+    virtual IceUtil::Time getNotBefore() const = 0;
+#endif
+
+    /**
+     * Obtains the serial number. This is an arbitrarily large number.
+     * @return The certificate's serial number.
+     */
+    virtual std::string getSerialNumber() const = 0;
+
+    /**
+     * Obtains the issuer's distinguished name (DN).
+     * @return The distinguished name.
+     */
+    virtual DistinguishedName getIssuerDN() const = 0;
+
+    /**
+     * Obtains the values in the issuer's alternative names extension.
+     *
+     * The returned list contains a pair of int, string.
+     *
+     * otherName                       [0]     OtherName
+     * rfc822Name                      [1]     IA5String
+     * dNSName                         [2]     IA5String
+     * x400Address                     [3]     ORAddress
+     * directoryName                   [4]     Name
+     * ediPartyName                    [5]     EDIPartyName
+     * uniformResourceIdentifier       [6]     IA5String
+     * iPAddress                       [7]     OCTET STRING
+     * registeredID                    [8]     OBJECT IDENTIFIER
+     *
+     * rfc822Name, dNSName, directoryName and
+     * uniformResourceIdentifier data is returned as a string.
+     *
+     * iPAddress is returned in dotted quad notation. IPv6 is not
+     * currently supported.
+     *
+     * All distinguished names are encoded in RFC2253 format.
+     *
+     * The remainder of the data will result in an empty string. Use the raw
+     * X509* certificate to obtain these values.
+     *
+     * @return The issuer's alternative names.
+     */
+    virtual std::vector<std::pair<int, std::string> > getIssuerAlternativeNames() const = 0;
+
+    /**
+     * Obtains the subject's distinguished name (DN).
+     * @return The distinguished name.
+     */
+    virtual DistinguishedName getSubjectDN() const = 0;
+
+    /**
+     * See the comment for Plugin::getIssuerAlternativeNames.
+     * @return The subject's alternative names.
+     */
+    virtual std::vector<std::pair<int, std::string> > getSubjectAlternativeNames() const = 0;
+
+    /**
+     * Obtains the certificate version number.
+     * @return The version number.
+     */
+    virtual int getVersion() const = 0;
+
+    /**
+     * Stringifies the certificate. This is a human readable version of
+     * the certificate, not a DER or PEM encoding.
+     * @return A string version of the certificate.
+     */
+    virtual std::string toString() const = 0;
+
+    /**
+     * Obtains a list of the X509v3 extensions contained in the certificate.
+     * @return The extensions.
+     */
+    virtual std::vector<X509ExtensionPtr> getX509Extensions() const = 0;
+
+    /**
+     * Obtains the extension with the given OID.
+     * @return The extension, or null if the certificate
+     * does not contain a extension with the given OID.
+     */
+    virtual X509ExtensionPtr getX509Extension(const std::string& oid) const = 0;
+
+    /**
+     * Loads the certificate from a file. The certificate must use the
+     * PEM encoding format.
+     * @param file The certificate file.
+     * @return The new certificate instance.
+     * @throws CertificateReadException if the file cannot be read.
+     */
+    static CertificatePtr load(const std::string& file);
+
+    /**
+     * Decodes a certificate from a string that uses the PEM encoding format.
+     * @param str A string containing the encoded certificate.
+     * @throws CertificateEncodingException if an error occurs.
+     */
+    static CertificatePtr decode(const std::string& str);
 };
-typedef IceUtil::Handle<WSSNativeConnectionInfo> WSSNativeConnectionInfoPtr;
 
-//
-// An application can customize the certificate verification process
-// by implementing the CertificateVerifier interface.
-//
-class ICE_SSL_API CertificateVerifier : public IceUtil::Shared
+#ifndef ICE_CPP11_MAPPING // C++98 mapping
+
+/**
+ * An application can customize the certificate verification process
+ * by implementing the CertificateVerifier interface.
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_API CertificateVerifier : public IceUtil::Shared
 {
 public:
 
-    //
-    // Return false if the connection should be rejected, or true to
-    // allow it.
-    //
-    virtual bool verify(const NativeConnectionInfoPtr&) = 0;
+    virtual ~CertificateVerifier();
+
+    /**
+     * Determines whether to accept a certificate.
+     * @param info Information about the connection.
+     * @return False if the connection should be rejected, or true to allow it.
+     */
+    virtual bool verify(const ConnectionInfoPtr& info) = 0;
 };
 typedef IceUtil::Handle<CertificateVerifier> CertificateVerifierPtr;
 
-//
-// In order to read an encrypted file, such as one containing a
-// private key, OpenSSL requests a password from IceSSL. The password
-// can be defined using an IceSSL configuration property, but a
-// plain-text password is a security risk. If a password is not
-// supplied via configuration, IceSSL allows OpenSSL to prompt the
-// user interactively.  This may not be desirable (or even possible),
-// so the application can supply an implementation of PasswordPrompt
-// to take responsibility for obtaining the password.
-//
-// Note that the password is needed during plug-in initialization, so
-// in general you will need to delay initialization (by defining
-// IceSSL.DelayInit=1), configure the PasswordPrompt, then manually
-// initialize the plug-in.
-//
-class ICE_SSL_API PasswordPrompt : public IceUtil::Shared
+/**
+ * In order to read an encrypted file, such as one containing a
+ * private key, OpenSSL requests a password from IceSSL. The password
+ * can be defined using an IceSSL configuration property, but a
+ * plain-text password is a security risk. If a password is not
+ * supplied via configuration, IceSSL allows OpenSSL to prompt the
+ * user interactively. This may not be desirable (or even possible),
+ * so the application can supply an implementation of PasswordPrompt
+ * to take responsibility for obtaining the password.
+ *
+ * Note that the password is needed during plug-in initialization, so
+ * in general you will need to delay initialization (by defining
+ * IceSSL.DelayInit=1), configure the PasswordPrompt, then manually
+ * initialize the plug-in.
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_API PasswordPrompt : public IceUtil::Shared
 {
 public:
 
-    //
-    // The getPassword method may be invoked repeatedly, such as when
-    // several encrypted files are opened, or when multiple password
-    // attempts are allowed.
-    //
+    virtual ~PasswordPrompt();
+
+    /**
+     * Obtains the password. This method may be invoked repeatedly, such as when
+     * several encrypted files are opened, or when multiple password
+     * attempts are allowed.
+     * @return The clear-text password.
+     */
     virtual std::string getPassword() = 0;
 };
 typedef IceUtil::Handle<PasswordPrompt> PasswordPromptPtr;
+#endif
 
-class ICE_SSL_API Plugin : public Ice::Plugin
+/**
+ * Represents the IceSSL plug-in object.
+ * \headerfile IceSSL/IceSSL.h
+ */
+class ICESSL_API Plugin : public Ice::Plugin
 {
 public:
 
-    //
-    // Establish the certificate verifier object. This should be done
-    // before any connections are established.
-    //
-    virtual void setCertificateVerifier(const CertificateVerifierPtr&) = 0;
-
-    //
-    // Establish the password prompt object. This must be done before
-    // the plug-in is initialized.
-    //
-    virtual void setPasswordPrompt(const PasswordPromptPtr&) = 0;
-
-#ifdef ICE_USE_OPENSSL
-    //
-    // Establish the OpenSSL context. This must be done before the
-    // plug-in is initialized, therefore the application must define
-    // the property Ice.InitPlugins=0, set the context, and finally
-    // invoke initializePlugins on the PluginManager.
-    //
-    // When the application supplies its own OpenSSL context, the
-    // plug-in ignores configuration properties related to certificates,
-    // keys, and passwords.
-    //
-    // Note that the plugin assumes ownership of the given context.
-    //
-    virtual void setContext(SSL_CTX*) = 0;
-
-    //
-    // Obtain the SSL context. Use caution when modifying this value.
-    // Changes made to this value have no effect on existing connections.
-    //
-    virtual SSL_CTX* getContext() = 0;
+    virtual ~Plugin();
+
+    /**
+     * Establish the certificate verifier object. This should be done
+     * before any connections are established.
+     * @param v The verifier.
+     */
+#ifdef ICE_CPP11_MAPPING
+    virtual void setCertificateVerifier(std::function<bool(const std::shared_ptr<ConnectionInfo>&)> v) = 0;
+#else
+    virtual void setCertificateVerifier(const CertificateVerifierPtr& v) = 0;
 #endif
+
+    /**
+     * Establish the password prompt object. This must be done before
+     * the plug-in is initialized.
+     * @param p The password prompt.
+     */
+#ifdef ICE_CPP11_MAPPING
+    virtual void setPasswordPrompt(std::function<std::string()> p) = 0;
+#else
+    virtual void setPasswordPrompt(const PasswordPromptPtr& p) = 0;
+#endif
+
+    /**
+     * Load the certificate from a file. The certificate must use the
+     * PEM encoding format.
+     * @param file The certificate file.
+     * @throws CertificateReadException if the file cannot be read.
+     */
+    virtual CertificatePtr load(const std::string& file) const = 0;
+
+    /**
+     * Decode a certificate from a string that uses the PEM encoding
+     * format.
+     * @param str A string containing the encoded certificate.
+     * @throws CertificateEncodingException if an error occurs.
+     */
+    virtual CertificatePtr decode(const std::string& str) const = 0;
 };
-typedef IceUtil::Handle<Plugin> PluginPtr;
+ICE_DEFINE_PTR(PluginPtr, Plugin);
 
 }