zeroc-ice 3.6b1 → 3.6.0

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -636,82 +636,86 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
         return op;
     }
 
-    if(!_incoming || _engine->getVerifyPeer() > 0)
+    //
+    // Build the peer certificate chain and verify it.
+    //
+    PCCERT_CONTEXT cert = 0;
+    SECURITY_STATUS err = QueryContextAttributes(&_ssl, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &cert);
+    if(err && err != SEC_E_NO_CREDENTIALS)
+    {
+        throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate verification failure:" +
+                                IceUtilInternal::lastErrorToString());
+    }
+
+    if(!cert && ((!_incoming && _engine->getVerifyPeer() > 0) || (_incoming && _engine->getVerifyPeer() == 2)))
     {
         //
-        // Build the peer certificate chain and verify it.
+        // Clients require server certificate if VerifyPeer > 0 and servers require client
+        // certificate if VerifyPeer == 2
         //
-        PCCERT_CONTEXT cert = 0;
-        SECURITY_STATUS err = QueryContextAttributes(&_ssl, SECPKG_ATTR_REMOTE_CERT_CONTEXT, &cert);
-        if(err && err != SEC_E_NO_CREDENTIALS)
+        throw SecurityException(__FILE__, __LINE__, "IceSSL: certificate required:" +
+                                IceUtilInternal::lastErrorToString());
+    }
+    else if(cert) // Verify the remote certificate
+    {
+        try
         {
-            throw ProtocolException(__FILE__, __LINE__, "IceSSL: certificate verification failure:" +
-                                    IceUtilInternal::lastErrorToString());
-        }
+            CERT_CHAIN_PARA chainP;
+            memset(&chainP, 0, sizeof(chainP));
+            chainP.cbSize = sizeof(chainP);
 
-        if(!cert && (!_incoming || _engine->getVerifyPeer() == 2))
-        {
-            // Clients require server certificate if VerifyPeer > 0
-            // and servers require client certificate if VerifyPeer == 2
-            throw ProtocolException(__FILE__, __LINE__, "IceSSL: certificate required:" +
-                                    IceUtilInternal::lastErrorToString());
-        }
-        else if(cert) // Verify the remote certificate
-        {
-            try
+            PCCERT_CHAIN_CONTEXT certChain;
+            if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
+                                        CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
             {
-                CERT_CHAIN_PARA chainP;
-                memset(&chainP, 0, sizeof(chainP));
-                chainP.cbSize = sizeof(chainP);
-
-                PCCERT_CHAIN_CONTEXT certChain;
-                if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
-                                            CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
-                {
-                    CertFreeCertificateContext(cert);
-                    throw IceUtilInternal::lastErrorToString();
-                }
+                CertFreeCertificateContext(cert);
+                throw IceUtilInternal::lastErrorToString();
+            }
 
-                CERT_SIMPLE_CHAIN* simpleChain = certChain->rgpChain[0];
+            CERT_SIMPLE_CHAIN* simpleChain = certChain->rgpChain[0];
 
-                string trustError;
-                if(simpleChain->TrustStatus.dwErrorStatus != CERT_TRUST_NO_ERROR)
-                {
-                    trustError = trustStatusToString(certChain->TrustStatus.dwErrorStatus);
-                }
+            string trustError;
+            if(simpleChain->TrustStatus.dwErrorStatus != CERT_TRUST_NO_ERROR)
+            {
+                trustError = trustStatusToString(certChain->TrustStatus.dwErrorStatus);
+            }
+            else
+            {
+                _verified = true;
+            }
 
-                CertFreeCertificateChain(certChain);
-                CertFreeCertificateContext(cert);
-                if(!trustError.empty())
-                {
-                    throw trustError;
-                }
+            CertFreeCertificateChain(certChain);
+            CertFreeCertificateContext(cert);
+            if(!trustError.empty())
+            {
+                throw trustError;
             }
-            catch(const string& reason)
+        }
+        catch(const string& reason)
+        {
+            if(_engine->getVerifyPeer() == 0)
             {
-                if(_engine->getVerifyPeer() == 0)
+                if(_instance->traceLevel() >= 1)
                 {
-                    if(_instance->traceLevel() >= 1)
-                    {
-                        _instance->logger()->trace(_instance->traceCategory(),
-                                                   "IceSSL: ignoring certificate verification failure\n" + reason);
-                    }
+                    _instance->logger()->trace(_instance->traceCategory(),
+                                               "IceSSL: ignoring certificate verification failure\n" + reason);
                 }
-                else
+            }
+            else
+            {
+                ostringstream os;
+                os << "IceSSL: certificate verification failure\n" << reason;
+                string msg = os.str();
+                if(_instance->traceLevel() >= 1)
                 {
-                    ostringstream os;
-                    os << "IceSSL: certificate verification failure\n" << reason;
-                    string msg = os.str();
-                    if(_instance->traceLevel() >= 1)
-                    {
-                        _instance->logger()->trace(_instance->traceCategory(), msg);
-                    }
-                    throw ProtocolException(__FILE__, __LINE__, msg);
+                    _instance->logger()->trace(_instance->traceCategory(), msg);
                 }
+                throw SecurityException(__FILE__, __LINE__, msg);
             }
         }
     }
-    _engine->verifyPeer(_stream->fd(), _host, getNativeConnectionInfo());
+
+    _engine->verifyPeer(_stream->fd(), _host, NativeConnectionInfoPtr::dynamicCast(getInfo()));
     _state = StateHandshakeComplete;
 
     if(_instance->engine()->securityTraceLevel() >= 1)
@@ -944,7 +948,18 @@ IceSSL::TransceiverI::toDetailedString() const
 Ice::ConnectionInfoPtr
 IceSSL::TransceiverI::getInfo() const
 {
-    return getNativeConnectionInfo();
+    NativeConnectionInfoPtr info = new NativeConnectionInfo();
+    fillConnectionInfo(info, info->nativeCerts);
+    return info;
+}
+
+Ice::ConnectionInfoPtr
+IceSSL::TransceiverI::getWSInfo(const Ice::HeaderDict& headers) const
+{
+    WSSNativeConnectionInfoPtr info = new WSSNativeConnectionInfo();
+    fillConnectionInfo(info, info->nativeCerts);
+    info->headers = headers;
+    return info;
 }
 
 void
@@ -952,6 +967,12 @@ IceSSL::TransceiverI::checkSendSize(const IceInternal::Buffer&)
 {
 }
 
+void
+IceSSL::TransceiverI::setBufferSize(int rcvSize, int sndSize)
+{
+    _stream->setBufferSize(rcvSize, sndSize);
+}
+
 IceSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
                                    const IceInternal::StreamSocketPtr& stream,
                                    const string& hostOrAdapterName,
@@ -965,7 +986,8 @@ IceSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
     _state(StateHandshakeNotStarted),
     _bufferedW(0),
     _sslInitialized(false),
-    _credentialsInitialized(false)
+    _credentialsInitialized(false),
+    _verified(false)
 {
 }
 
@@ -973,12 +995,18 @@ IceSSL::TransceiverI::~TransceiverI()
 {
 }
 
-NativeConnectionInfoPtr
-IceSSL::TransceiverI::getNativeConnectionInfo() const
+void
+IceSSL::TransceiverI::fillConnectionInfo(const ConnectionInfoPtr& info, vector<CertificatePtr>& nativeCerts) const
 {
-    NativeConnectionInfoPtr info = new NativeConnectionInfo();
     IceInternal::fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress,
                                     info->remotePort);
+    if(_stream->fd() != INVALID_SOCKET)
+    {
+        info->rcvSize = IceInternal::getRecvBufferSize(_stream->fd());
+        info->sndSize = IceInternal::getSendBufferSize(_stream->fd());
+    }
+
+    info->verified = _verified;
 
     if(_sslInitialized)
     {
@@ -1014,7 +1042,7 @@ IceSSL::TransceiverI::getNativeConnectionInfo() const
                     }
 
                     CertificatePtr certificate = new Certificate(cc);
-                    info->nativeCerts.push_back(certificate);
+                    nativeCerts.push_back(certificate);
                     info->certs.push_back(certificate->encode());
                 }
                 CertFreeCertificateChain(certChain);
@@ -1041,7 +1069,6 @@ IceSSL::TransceiverI::getNativeConnectionInfo() const
 
     info->adapterName = _adapterName;
     info->incoming = _incoming;
-    return info;
 }
 
 bool

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.h

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -19,6 +19,7 @@
 #include <Ice/Network.h>
 #include <Ice/Buffer.h>
 #include <Ice/StreamSocket.h>
+#include <Ice/WSTransceiver.h>
 
 #ifdef ICE_USE_SCHANNEL
 
@@ -42,7 +43,7 @@ namespace IceSSL
 class ConnectorI;
 class AcceptorI;
 
-class TransceiverI : public IceInternal::Transceiver
+class TransceiverI : public IceInternal::Transceiver, public IceInternal::WSTransceiverDelegate
 {
 public:
 
@@ -63,14 +64,16 @@ public:
     virtual std::string toString() const;
     virtual std::string toDetailedString() const;
     virtual Ice::ConnectionInfoPtr getInfo() const;
+    virtual Ice::ConnectionInfoPtr getWSInfo(const Ice::HeaderDict&) const;
     virtual void checkSendSize(const IceInternal::Buffer&);
+    virtual void setBufferSize(int rcvSize, int sndSize);
 
 private:
 
     TransceiverI(const InstancePtr&, const IceInternal::StreamSocketPtr&, const std::string&, bool);
     virtual ~TransceiverI();
 
-    virtual NativeConnectionInfoPtr getNativeConnectionInfo() const;
+    void fillConnectionInfo(const ConnectionInfoPtr&, std::vector<CertificatePtr>&) const;
 
     IceInternal::SocketOperation sslHandshake();
 
@@ -120,6 +123,7 @@ private:
     CredHandle _credentials;
     bool _credentialsInitialized;
     SecPkgContext_StreamSizes _sizes;
+    bool _verified;
 };
 typedef IceUtil::Handle<TransceiverI> TransceiverIPtr;
 

data/ext/ice/cpp/src/IceSSL/SSLEngine.cpp

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -109,7 +109,7 @@ IceSSL::SSLEngine::initialize()
     // chain, including the peer's certificate. A value of 0 means there is
     // no maximum.
     //
-    _verifyDepthMax = properties->getPropertyAsIntWithDefault(propPrefix + "VerifyDepthMax", 2);
+    _verifyDepthMax = properties->getPropertyAsIntWithDefault(propPrefix + "VerifyDepthMax", 3);
 
     //
     // VerifyPeer determines whether certificate validation failures abort a connection.

data/ext/ice/cpp/src/IceSSL/SSLEngine.h

@@ -1,6 +1,6 @@
 // **********************************************************************
 //
-// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+// Copyright (c) 2003-2015 ZeroC, Inc. All rights reserved.
 //
 // This copy of Ice is licensed to you under the terms described in the
 // ICE_LICENSE file included in this distribution.
@@ -61,14 +61,14 @@ public:
     // Setup the engine.
     //
     virtual void initialize() = 0;
-    
+
     virtual bool initialized() const = 0;
 
     //
     // Destroy the engine.
     //
     virtual void destroy() = 0;
-    
+
     //
     // Verify peer certificate
     //
@@ -79,21 +79,21 @@ public:
 
     std::string getPassword() const;
     void setPassword(const std::string& password);
-    
+
     int getVerifyPeer() const { return _verifyPeer; }
     int securityTraceLevel() const { return _securityTraceLevel; }
     std::string securityTraceCategory() const { return _securityTraceCategory; }
-    
+
 private:
-    
+
     const Ice::CommunicatorPtr _communicator;
     const Ice::LoggerPtr _logger;
     const TrustManagerPtr _trustManager;
-    
+
     std::string _password;
     CertificateVerifierPtr _verifier;
     PasswordPromptPtr _prompt;
-    
+
     bool _checkCertName;
     int _verifyDepthMax;
     int _verifyPeer;
@@ -106,32 +106,32 @@ private:
 class SecureTransportEngine : public SSLEngine
 {
 public:
-    
+
     SecureTransportEngine(const Ice::CommunicatorPtr&);
-    
+
     virtual void initialize();
     virtual bool initialized() const;
     virtual void destroy();
-    
+
     SSLContextRef newContext(bool);
     CFArrayRef getCertificateAuthorities() const;
     std::string getCipherName(SSLCipherSuite) const;
-    
+
 private:
-    
+
     void parseCiphers(const std::string&);
-    
+
     bool _initialized;
-    CFArrayRef _certificateAuthorities;    
-    CFMutableArrayRef _chain;
-    
+    UniqueRef<CFArrayRef> _certificateAuthorities;
+    UniqueRef<CFArrayRef> _chain;
+
     SSLProtocol _protocolVersionMax;
     SSLProtocol _protocolVersionMin;
-    
+
     std::string _defaultDir;
-       
+
     std::vector<char> _dhParams;
-    
+
     std::vector<SSLCipherSuite> _ciphers;
     IceUtil::Mutex _mutex;
 };
@@ -139,7 +139,7 @@ private:
 #elif defined(ICE_USE_SCHANNEL)
 
 
-#ifdef __MINGW32__
+#if defined(__MINGW32__) || (defined(_MSC_VER) && (_MSC_VER <= 1500))
 
 //
 // Add some definitions missing from MinGW headers.
@@ -181,21 +181,21 @@ private:
 class SChannelEngine : public SSLEngine
 {
 public:
-    
+
     SChannelEngine(const Ice::CommunicatorPtr&);
-    
+
     //
     // Setup the engine.
     //
     virtual void initialize();
-    
+
     virtual bool initialized() const;
 
     //
     // Destroy the engine.
     //
     virtual void destroy();
-    
+
     std::string getCipherName(ALG_ID) const;
 
     CredHandle newCredentialsHandle(bool);
@@ -205,15 +205,14 @@ public:
 private:
 
     void parseCiphers(const std::string&);
-    
+
     bool _initialized;
     std::vector<PCCERT_CONTEXT> _allCerts;
-    std::vector<PCCERT_CONTEXT> _certs;
+    std::vector<PCCERT_CONTEXT> _importedCerts;
     DWORD _protocols;
     IceUtil::Mutex _mutex;
 
     std::vector<HCERTSTORE> _stores;
-
     HCERTSTORE _rootStore;
 
     HCERTCHAINENGINE _chainEngine;
@@ -223,31 +222,29 @@ private:
 class OpenSSLEngine : public SSLEngine
 {
 public:
-    
+
     OpenSSLEngine(const Ice::CommunicatorPtr&);
     ~OpenSSLEngine();
-    
+
     virtual void initialize();
     virtual bool initialized() const;
     virtual void destroy();
-    
-    int verifyCallback(int , SSL*, X509_STORE_CTX*);
+
 #   ifndef OPENSSL_NO_DH
     DH* dhParams(int);
 #   endif
     SSL_CTX* context() const;
     void context(SSL_CTX*);
     std::string sslErrors() const;
-    
+
 private:
-    
+
     SSL_METHOD* getMethod(int);
     void setOptions(int);
     enum Protocols { SSLv3 = 0x01, TLSv1_0 = 0x02, TLSv1_1 = 0x04, TLSv1_2 = 0x08 };
     int parseProtocols(const Ice::StringSeq&) const;
 
 
-    bool _initOpenSSL;
     bool _initialized;
     SSL_CTX* _ctx;
     std::string _defaultDir;