zeroc-ice 3.6b1 → 3.6.0

data/ext/ice/cpp/src/IceSSL/ConnectorI.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.

data/ext/ice/cpp/src/IceSSL/ConnectorI.h

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.

data/ext/ice/cpp/src/IceSSL/EndpointI.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -53,39 +53,17 @@ IceSSL::EndpointI::EndpointI(const InstancePtr& instance, IceInternal::BasicStre
 Ice::EndpointInfoPtr
 IceSSL::EndpointI::getInfo() const
 {
-    class InfoI : public EndpointInfo
-    {
-    public:
-
-        InfoI(const IceInternal::EndpointIPtr& endpoint) : _endpoint(endpoint)
-        {
-        }
-
-        virtual Ice::Short
-        type() const
-        {
-            return _endpoint->type();
-        }
-
-        virtual bool
-        datagram() const
-        {
-            return _endpoint->datagram();
-        }
-
-        virtual bool
-        secure() const
-        {
-            return _endpoint->secure();
-        }
-
-    private:
-
-        const IceInternal::EndpointIPtr _endpoint;
-    };
+    EndpointInfoPtr info = new IceInternal::InfoI<EndpointInfo>(const_cast<EndpointI*>(this));
+    fillEndpointInfo(info.get());
+    return info;
+}
 
-    IPEndpointInfoPtr info = new InfoI(const_cast<EndpointI*>(this));
+Ice::EndpointInfoPtr
+IceSSL::EndpointI::getWSInfo(const string& resource) const
+{
+    WSSEndpointInfoPtr info = new IceInternal::InfoI<WSSEndpointInfo>(const_cast<EndpointI*>(this));
     fillEndpointInfo(info.get());
+    info->resource = resource;
     return info;
 }
 
@@ -133,12 +111,6 @@ IceSSL::EndpointI::datagram() const
     return false;
 }
 
-bool
-IceSSL::EndpointI::secure() const
-{
-    return true;
-}
-
 IceInternal::TransceiverPtr
 IceSSL::EndpointI::transceiver() const
 {

data/ext/ice/cpp/src/IceSSL/EndpointI.h

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -12,6 +12,7 @@
 
 #include <Ice/IPEndpointI.h>
 #include <Ice/EndpointFactory.h>
+#include <Ice/WSEndpoint.h>
 #include <IceSSL/InstanceF.h>
 #include <IceSSL/EndpointInfo.h>
 #include <Ice/Network.h>
@@ -19,7 +20,7 @@
 namespace IceSSL
 {
 
-class EndpointI : public IceInternal::IPEndpointI
+class EndpointI : public IceInternal::IPEndpointI, public IceInternal::WSEndpointDelegate
 {
 public:
 
@@ -29,13 +30,13 @@ public:
     EndpointI(const InstancePtr&, IceInternal::BasicStream*);
 
     virtual Ice::EndpointInfoPtr getInfo() const;
+    virtual Ice::EndpointInfoPtr getWSInfo(const std::string&) const;
 
     virtual Ice::Int timeout() const;
     virtual IceInternal::EndpointIPtr timeout(Ice::Int) const;
     virtual bool compress() const;
     virtual IceInternal::EndpointIPtr compress(bool) const;
     virtual bool datagram() const;
-    virtual bool secure() const;
 
     virtual IceInternal::TransceiverPtr transceiver() const;
     virtual IceInternal::AcceptorPtr acceptor(const std::string&) const;

data/ext/ice/cpp/src/IceSSL/EndpointInfo.cpp

@@ -1,13 +1,13 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
 //
 // **********************************************************************
 //
-// Ice version 3.6b
+// Ice version 3.6.0
 //
 // <auto-generated>
 //
@@ -28,8 +28,14 @@
 #include <IceUtil/PopDisableWarnings.h>
 
 #ifndef ICE_IGNORE_VERSION
-#   if ICE_INT_VERSION  != 30651
-#       error Ice version mismatch: an exact match is required for beta generated code
+#   if ICE_INT_VERSION / 100 != 306
+#       error Ice version mismatch!
+#   endif
+#   if ICE_INT_VERSION % 100 > 50
+#       error Beta header file detected
+#   endif
+#   if ICE_INT_VERSION % 100 < 0
+#       error Ice patch level mismatch!
 #   endif
 #endif
 
@@ -38,4 +44,6 @@ namespace
 
 }
 
-ICE_DECLSPEC_EXPORT ::Ice::LocalObject* IceSSL::upCast(::IceSSL::EndpointInfo* p) { return p; }
+ICE_SSL_API ::Ice::LocalObject* IceSSL::upCast(::IceSSL::EndpointInfo* p) { return p; }
+
+ICE_SSL_API ::Ice::LocalObject* IceSSL::upCast(::IceSSL::WSSEndpointInfo* p) { return p; }

data/ext/ice/cpp/src/IceSSL/Instance.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -22,7 +22,7 @@ using namespace IceSSL;
 IceUtil::Shared* IceSSL::upCast(IceSSL::Instance* p) { return p; }
 
 IceSSL::Instance::Instance(const SSLEnginePtr& engine, Short type, const string& protocol) :
-    ProtocolInstance(engine->communicator(), type, protocol),
+    ProtocolInstance(engine->communicator(), type, protocol, true),
     _engine(engine)
 {
 }

data/ext/ice/cpp/src/IceSSL/Instance.h

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.

data/ext/ice/cpp/src/IceSSL/InstanceF.h

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.

data/ext/ice/cpp/src/IceSSL/OpenSSLEngine.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -41,6 +41,7 @@ namespace
 
 IceUtil::Mutex* staticMutex = 0;
 int instanceCount = 0;
+bool initOpenSSL = false;
 IceUtil::Mutex* locks = 0;
 
 class Init
@@ -131,7 +132,7 @@ IceSSL_opensslPasswordCallback(char* buf, int size, int flag, void* userData)
     for(string::iterator i = passwd.begin(); i != passwd.end(); ++i)
     {
         *i = '\0';
-    } 
+    }
 
     return sz;
 }
@@ -145,14 +146,6 @@ IceSSL_opensslDHCallback(SSL* ssl, int /*isExport*/, int keyLength)
 }
 #  endif
 
-int
-IceSSL_opensslVerifyCallback(int ok, X509_STORE_CTX* ctx)
-{
-    SSL* ssl = reinterpret_cast<SSL*>(X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx()));
-    OpenSSLEngine* p = reinterpret_cast<OpenSSLEngine*>(SSL_CTX_get_ex_data(ssl->ctx, 0));
-    return p->verifyCallback(ok, ssl, ctx);
-}
-
 }
 
 namespace
@@ -197,8 +190,8 @@ OpenSSLEngine::OpenSSLEngine(const CommunicatorPtr& communicator) :
         // application should disable OpenSSL initialization in those components and
         // perform the initialization itself.
         //
-        _initOpenSSL = properties->getPropertyAsIntWithDefault("IceSSL.InitOpenSSL", 1) > 0;
-        if(_initOpenSSL)
+        initOpenSSL = properties->getPropertyAsIntWithDefault("IceSSL.InitOpenSSL", 1) > 0;
+        if(initOpenSSL)
         {
             //
             // Create the mutexes and set the callbacks.
@@ -243,7 +236,7 @@ OpenSSLEngine::OpenSSLEngine(const CommunicatorPtr& communicator) :
             if(!randFiles.empty())
             {
                 vector<string> files;
-                string defaultDir = properties->getProperty("IceSSL.DefaultDir");
+                const string defaultDir = properties->getProperty("IceSSL.DefaultDir");
 
                 if(!IceUtilInternal::splitString(randFiles, IceUtilInternal::pathsep, files))
                 {
@@ -253,15 +246,16 @@ OpenSSLEngine::OpenSSLEngine(const CommunicatorPtr& communicator) :
                 for(vector<string>::iterator p = files.begin(); p != files.end(); ++p)
                 {
                     string file = *p;
-                    if(!checkPath(file, defaultDir, false))
+                    string resolved;
+                    if(!checkPath(file, defaultDir, false, resolved))
                     {
                         throw PluginInitializationException(__FILE__, __LINE__,
                                                             "IceSSL: entropy data file not found:\n" + file);
                     }
-                    if(!RAND_load_file(file.c_str(), 1024))
+                    if(!RAND_load_file(resolved.c_str(), 1024))
                     {
                         throw PluginInitializationException(__FILE__, __LINE__,
-                                                            "IceSSL: unable to load entropy data from " + file);
+                                                            "IceSSL: unable to load entropy data from " + resolved);
                     }
                 }
             }
@@ -275,7 +269,7 @@ OpenSSLEngine::OpenSSLEngine(const CommunicatorPtr& communicator) :
             {
                 if(RAND_egd(entropyDaemon.c_str()) <= 0)
                 {
-                    throw PluginInitializationException(__FILE__, __LINE__, 
+                    throw PluginInitializationException(__FILE__, __LINE__,
                                                         "IceSSL: EGD failure using file " + entropyDaemon);
                 }
             }
@@ -309,11 +303,11 @@ OpenSSLEngine::~OpenSSLEngine()
     //
     IceUtilInternal::MutexPtrLock<IceUtil::Mutex> sync(staticMutex);
 
-    if(--instanceCount == 0 && _initOpenSSL)
+    if(--instanceCount == 0 && initOpenSSL)
     {
         //
         // NOTE: We can't destroy the locks here: threads which might have called openssl methods
-        // might access openssl locks upon termination (from DllMain/THREAD_DETACHED). Instead, 
+        // might access openssl locks upon termination (from DllMain/THREAD_DETACHED). Instead,
         // we release the locks in the ~Init() static destructor. See bug #4156.
         //
         //CRYPTO_set_locking_callback(0);
@@ -347,7 +341,7 @@ OpenSSLEngine::initialize()
     try
     {
         SSLEngine::initialize();
-        
+
         const string propPrefix = "IceSSL.";
         PropertiesPtr properties = communicator()->getProperties();
 
@@ -360,7 +354,7 @@ OpenSSLEngine::initialize()
         defaultProtocols.push_back("tls1_1");
         defaultProtocols.push_back("tls1_2");
 
-        const int protocols = 
+        const int protocols =
                 parseProtocols(properties->getPropertyAsListWithDefault(propPrefix + "Protocols", defaultProtocols));
 
         //
@@ -379,7 +373,7 @@ OpenSSLEngine::initialize()
             // Check for a default directory. We look in this directory for
             // files mentioned in the configuration.
             //
-            string defaultDir = properties->getProperty(propPrefix + "DefaultDir");
+            const string defaultDir = properties->getProperty(propPrefix + "DefaultDir");
 
             //
             // If the configuration defines a password, or the application has supplied
@@ -403,28 +397,65 @@ OpenSSLEngine::initialize()
             // Establish the location of CA certificates.
             //
             {
-                string caFile = properties->getProperty(propPrefix + "CertAuthFile");
-                string caDir = properties->getPropertyWithDefault(propPrefix + "CertAuthDir", defaultDir);
+                string path = properties->getProperty(propPrefix + "CAs");
+                string resolved;
                 const char* file = 0;
                 const char* dir = 0;
-                if(!caFile.empty())
+                if(!path.empty())
                 {
-                    if(!checkPath(caFile, defaultDir, false))
+                    if(checkPath(path, defaultDir, false, resolved))
+                    {
+                        path = resolved;
+                        file = path.c_str();
+                    }
+
+                    if(!file)
+                    {
+                        if(checkPath(path, defaultDir, true, resolved))
+                        {
+                            path = resolved;
+                            dir = path.c_str();
+                        }
+                    }
+
+                    if(!file && !dir)
                     {
                         throw PluginInitializationException(__FILE__, __LINE__,
-                                                            "IceSSL: CA certificate file not found:\n" + caFile);
+                                                            "IceSSL: CA certificate path not found:\n" + path);
                     }
-                    file = caFile.c_str();
                 }
-                if(!caDir.empty())
+
+                if(!file && !dir)
                 {
-                    if(!checkPath(caDir, defaultDir, true))
+                    // Deprecated properties
+                    path = properties->getProperty(propPrefix + "CertAuthFile");
+                    if(!path.empty())
                     {
-                        throw PluginInitializationException(__FILE__, __LINE__,
-                                                            "IceSSL: CA certificate directory not found:\n" + caDir);
+                        if(!checkPath(path, defaultDir, false, resolved))
+                        {
+                            throw PluginInitializationException(__FILE__, __LINE__,
+                                                                "IceSSL: CA certificate file not found:\n" + path);
+                        }
+                        path = resolved;
+                        file = path.c_str();
+                    }
+                    else
+                    {
+                        path = properties->getProperty(propPrefix + "CertAuthDir");
+                        if(!path.empty())
+                        {
+                            if(!checkPath(path, defaultDir, true, resolved))
+                            {
+                                throw PluginInitializationException(__FILE__, __LINE__,
+                                                                    "IceSSL: CA certificate directory not found:\n" +
+                                                                    path);
+                            }
+                            path = resolved;
+                            dir = path.c_str();
+                        }
                     }
-                    dir = caDir.c_str();
                 }
+
                 if(file || dir)
                 {
                     //
@@ -436,7 +467,7 @@ OpenSSLEngine::initialize()
                     while(count < passwordRetryMax)
                     {
                         ERR_clear_error();
-                        if((success = SSL_CTX_load_verify_locations(_ctx, file, dir))|| !passwordError())
+                        if((success = SSL_CTX_load_verify_locations(_ctx, file, dir)) || !passwordError())
                         {
                             break;
                         }
@@ -460,6 +491,10 @@ OpenSSLEngine::initialize()
                         throw PluginInitializationException(__FILE__, __LINE__, msg);
                     }
                 }
+                else if(properties->getPropertyAsInt("IceSSL.UsePlatformCAs") > 0)
+                {
+                    SSL_CTX_set_default_verify_paths(_ctx);
+                }
             }
 
             //
@@ -469,39 +504,41 @@ OpenSSLEngine::initialize()
             string certFile = properties->getProperty(propPrefix + "CertFile");
             string keyFile = properties->getProperty(propPrefix + "KeyFile");
             bool keyLoaded = false;
-            
+
             vector<string>::size_type numCerts = 0;
             if(!certFile.empty())
             {
                 vector<string> files;
                 if(!IceUtilInternal::splitString(certFile, IceUtilInternal::pathsep, files) || files.size() > 2)
                 {
-                    PluginInitializationException ex(__FILE__, __LINE__, 
+                    PluginInitializationException ex(__FILE__, __LINE__,
                                             "IceSSL: invalid value for " + propPrefix + "CertFile:\n" + certFile);
                 }
                 numCerts = files.size();
                 for(vector<string>::iterator p = files.begin(); p != files.end(); ++p)
                 {
                     string file = *p;
-                    if(!checkPath(file, defaultDir, false))
+                    string resolved;
+                    if(!checkPath(file, defaultDir, false, resolved))
                     {
                         PluginInitializationException ex(__FILE__, __LINE__,
                                                          "IceSSL: certificate file not found:\n" + file);
                     }
+                    file = resolved;
                     //
                     // First we try to load the certificate using PKCS12 format if that fails
                     // we fallback to PEM format.
                     //
                     FILE* f = fopen(file.c_str(), "rb");
                     if(!f)
-                    {                          
+                    {
                         throw PluginInitializationException(__FILE__, __LINE__,
                                                 "IceSSL: unable to load certificate chain from file " + file + "\n" +
                                                 IceUtilInternal::lastErrorToString());
                     }
-                    
+
                     int success = 0;
-                    
+
                     PKCS12* p12 = d2i_PKCS12_fp(f, 0);
                     fclose(f);
                     if(p12)
@@ -509,7 +546,7 @@ OpenSSLEngine::initialize()
                         EVP_PKEY* key = 0;
                         X509* cert = 0;
                         STACK_OF(X509)* chain = 0;
-                        
+
                         int count = 0;
                         try
                         {
@@ -532,37 +569,41 @@ OpenSSLEngine::initialize()
                                     }
                                     break;
                                 }
-                                
+
                                 if(!cert || !SSL_CTX_use_certificate(_ctx, cert))
                                 {
                                     throw PluginInitializationException(__FILE__, __LINE__,
                                                                 "IceSSL: unable to establish SSL certificate:\n" +
                                                                 (cert ? sslErrors() : "certificate not found"));
                                 }
-                                
+
                                 if(!key || !SSL_CTX_use_PrivateKey(_ctx, key))
                                 {
                                     throw PluginInitializationException(__FILE__, __LINE__,
-                                                                "IceSSL: unable to establish SSL private key:\n" + 
+                                                                "IceSSL: unable to establish SSL private key:\n" +
                                                                 (key ? sslErrors() : "key not found"));
                                 }
                                 keyLoaded = true;
-                                
+
                                 if(chain && sk_X509_num(chain))
                                 {
-                                    for(int i = 0; i < sk_X509_num(chain); i++)
+                                    // Pop each cert from the stack so we can free the stack later.
+                                    // The CTX destruction will take care of the certificates
+                                    X509 *c = 0;
+                                    while((c = sk_X509_pop(chain)) != 0)
                                     {
-                                        if(!SSL_CTX_add_extra_chain_cert(_ctx, sk_X509_value(chain, i)))
+                                        if(!SSL_CTX_add_extra_chain_cert(_ctx, c))
                                         {
                                             throw PluginInitializationException(__FILE__, __LINE__,
                                                     "IceSSL: unable to add extra SSL certificate:\n" + sslErrors());
                                         }
                                     }
                                 }
-                                
+
                                 if(chain)
                                 {
-                                    sk_X509_pop_free(chain, X509_free);
+                                    // This chain should now be empty. No need to call sk_X509_pop_free()
+                                    sk_X509_free(chain);
                                 }
                                 assert(key && cert);
                                 EVP_PKEY_free(key);
@@ -578,12 +619,12 @@ OpenSSLEngine::initialize()
                             {
                                 sk_X509_pop_free(chain, X509_free);
                             }
-                            
+
                             if(key)
                             {
                                 EVP_PKEY_free(key);
                             }
-                            
+
                             if(cert)
                             {
                                 X509_free(cert);
@@ -612,7 +653,7 @@ OpenSSLEngine::initialize()
                             count++;
                         }
                     }
-                    
+
                     if(!success)
                     {
                         string msg = "IceSSL: unable to load certificate chain from file " + file;
@@ -632,7 +673,7 @@ OpenSSLEngine::initialize()
                     }
                 }
             }
-            
+
             if(keyFile.empty())
             {
                 keyFile = certFile; // Assume the certificate file also contains the private key.
@@ -653,14 +694,14 @@ OpenSSLEngine::initialize()
                 for(vector<string>::iterator p = files.begin(); p != files.end(); ++p)
                 {
                     string file = *p;
-                    if(!checkPath(file, defaultDir, false))
+                    string resolved;
+                    if(!checkPath(file, defaultDir, false, resolved))
                     {
-                        throw PluginInitializationException(__FILE__, __LINE__, 
-                                                            "IceSSL: key file not found:\n" + file);
+                        throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: key file not found:\n" + file);
                     }
+                    file = resolved;
                     //
-                    // The private key may be stored in an encrypted file, so handle
-                    // password retries.
+                    // The private key may be stored in an encrypted file, so handle password retries.
                     //
                     int count = 0;
                     int err = 0;
@@ -694,7 +735,7 @@ OpenSSLEngine::initialize()
                 }
                 keyLoaded = true;
             }
-            
+
             if(keyLoaded && !SSL_CTX_check_private_key(_ctx))
             {
                 throw PluginInitializationException(__FILE__, __LINE__,
@@ -729,14 +770,16 @@ OpenSSLEngine::initialize()
                         if(keyLength > 0)
                         {
                             string file = p->second;
-                            if(!checkPath(file, defaultDir, false))
+                            string resolved;
+                            if(!checkPath(file, defaultDir, false, resolved))
                             {
                                 throw PluginInitializationException(__FILE__, __LINE__,
                                                                     "IceSSL: DH parameter file not found:\n" + file);
                             }
+                            file = resolved;
                             if(!_dhParams->add(keyLength, file))
                             {
-                                throw PluginInitializationException(__FILE__, __LINE__, 
+                                throw PluginInitializationException(__FILE__, __LINE__,
                                                                 "IceSSL: unable to read DH parameter file " + file);
                             }
                         }
@@ -744,7 +787,7 @@ OpenSSLEngine::initialize()
 #  endif
                 }
             }
-            
+
             SSL_CTX_set_mode(_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
         }
 
@@ -794,7 +837,7 @@ OpenSSLEngine::initialize()
         {
             ostringstream os;
             os << "enabling SSL ciphersuites:";
-            
+
             SSL* ssl = SSL_new(_ctx);
             STACK_OF(SSL_CIPHER)* ciphers =  SSL_get_ciphers(ssl);
             if(ciphers)
@@ -807,30 +850,6 @@ OpenSSLEngine::initialize()
             SSL_free(ssl);
             getLogger()->trace(securityTraceCategory(), os.str());
         }
-
-        //
-        // Determine whether a certificate is required from the peer.
-        //
-        {
-            int sslVerifyMode = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT;;
-            switch(getVerifyPeer())
-            {
-                case 0:
-                    sslVerifyMode = SSL_VERIFY_NONE;
-                    break;
-                case 1:
-                    sslVerifyMode = SSL_VERIFY_PEER;
-                    break;
-                case 2:
-                    sslVerifyMode = SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
-                    break;
-                default:
-                {
-                    assert(false);
-                }
-            }
-            SSL_CTX_set_verify(_ctx, sslVerifyMode, IceSSL_opensslVerifyCallback);
-        }
     }
     catch(...)
     {
@@ -879,29 +898,6 @@ OpenSSLEngine::destroy()
     }
 }
 
-int
-OpenSSLEngine::verifyCallback(int ok, SSL* ssl, X509_STORE_CTX* c)
-{
-    if(!ok && securityTraceLevel() >= 1)
-    {
-        X509* cert = X509_STORE_CTX_get_current_cert(c);
-        int err = X509_STORE_CTX_get_error(c);
-        char buf[256];
-
-        Trace out(getLogger(), securityTraceCategory());
-        out << "certificate verification failure\n";
-
-        X509_NAME_oneline(X509_get_issuer_name(cert), buf, static_cast<int>(sizeof(buf)));
-        out << "issuer = " << buf << '\n';
-        X509_NAME_oneline(X509_get_subject_name(cert), buf, static_cast<int>(sizeof(buf)));
-        out << "subject = " << buf << '\n';
-        out << "depth = " << X509_STORE_CTX_get_error_depth(c) << '\n';
-        out << "error = " << X509_verify_cert_error_string(err) << '\n';
-        out << IceInternal::fdToString(SSL_get_fd(ssl));
-    }
-    return ok;
-}
-
 #  ifndef OPENSSL_NO_DH
 DH*
 OpenSSLEngine::dhParams(int keyLength)
@@ -943,7 +939,7 @@ OpenSSLEngine::parseProtocols(const StringSeq& protocols) const
     return v;
 }
 
-SSL_METHOD* 
+SSL_METHOD*
 OpenSSLEngine::getMethod(int /*protocols*/)
 {
     //