zeroc-ice 3.6b1

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.h

@@ -0,0 +1,130 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#ifndef ICE_SSL_SCHANNELTRANSCEIVER_I_H
+#define ICE_SSL_SCHANNELTRANSCEIVER_I_H
+
+#include <IceSSL/Config.h>
+#include <IceSSL/InstanceF.h>
+#include <IceSSL/Plugin.h>
+#include <IceSSL/SSLEngineF.h>
+
+#include <Ice/Transceiver.h>
+#include <Ice/Network.h>
+#include <Ice/Buffer.h>
+#include <Ice/StreamSocket.h>
+
+#ifdef ICE_USE_SCHANNEL
+
+#ifdef SECURITY_WIN32
+#  undef SECURITY_WIN32
+#endif
+
+#ifdef SECURITY_KERNEL
+#  undef SECURITY_KERNEL
+#endif
+
+#define SECURITY_WIN32 1
+#include <security.h>
+#include <sspi.h>
+#include <schannel.h>
+#undef SECURITY_WIN32
+
+namespace IceSSL
+{
+
+class ConnectorI;
+class AcceptorI;
+
+class TransceiverI : public IceInternal::Transceiver
+{
+public:
+
+    virtual IceInternal::NativeInfoPtr getNativeInfo();
+
+    virtual IceInternal::SocketOperation initialize(IceInternal::Buffer&, IceInternal::Buffer&, bool&);
+    virtual IceInternal::SocketOperation closing(bool, const Ice::LocalException&);
+    virtual void close();
+    virtual IceInternal::SocketOperation write(IceInternal::Buffer&);
+    virtual IceInternal::SocketOperation read(IceInternal::Buffer&, bool&);
+#ifdef ICE_USE_IOCP
+    virtual bool startWrite(IceInternal::Buffer&);
+    virtual void finishWrite(IceInternal::Buffer&);
+    virtual void startRead(IceInternal::Buffer&);
+    virtual void finishRead(IceInternal::Buffer&, bool&);
+#endif
+    virtual std::string protocol() const;
+    virtual std::string toString() const;
+    virtual std::string toDetailedString() const;
+    virtual Ice::ConnectionInfoPtr getInfo() const;
+    virtual void checkSendSize(const IceInternal::Buffer&);
+
+private:
+
+    TransceiverI(const InstancePtr&, const IceInternal::StreamSocketPtr&, const std::string&, bool);
+    virtual ~TransceiverI();
+
+    virtual NativeConnectionInfoPtr getNativeConnectionInfo() const;
+
+    IceInternal::SocketOperation sslHandshake();
+
+    size_t decryptMessage(IceInternal::Buffer&);
+    size_t encryptMessage(IceInternal::Buffer&);
+
+    bool writeRaw(IceInternal::Buffer&);
+    bool readRaw(IceInternal::Buffer&);
+
+    friend class ConnectorI;
+    friend class AcceptorI;
+
+    enum State
+    {
+        StateHandshakeNotStarted,
+        StateHandshakeReadContinue,
+        StateHandshakeWriteContinue,
+        StateHandshakeComplete
+    };
+
+    const InstancePtr _instance;
+    const SChannelEnginePtr _engine;
+    const std::string _host;
+    const std::string _adapterName;
+    const bool _incoming;
+    const IceInternal::StreamSocketPtr _stream;
+    State _state;
+
+    //
+    // Buffered encrypted data that has not been written.
+    //
+    IceInternal::Buffer _writeBuffer;
+    size_t _bufferedW;
+
+    //
+    // Buffered data that has not been decrypted.
+    //
+    IceInternal::Buffer _readBuffer;
+
+    //
+    // Buffered data that was decrypted but not yet processed.
+    //
+    IceInternal::Buffer _readUnprocessed;
+
+    CtxtHandle _ssl;
+    bool _sslInitialized;
+    CredHandle _credentials;
+    bool _credentialsInitialized;
+    SecPkgContext_StreamSizes _sizes;
+};
+typedef IceUtil::Handle<TransceiverI> TransceiverIPtr;
+
+}
+
+#endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SSLEngine.cpp

@@ -0,0 +1,291 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#include <IceSSL/SSLEngine.h>
+#include <IceSSL/TrustManager.h>
+
+#include <IceUtil/StringUtil.h>
+
+#include <Ice/Communicator.h>
+#include <Ice/Properties.h>
+#include <Ice/Logger.h>
+#include <Ice/LoggerUtil.h>
+#include <Ice/LocalException.h>
+
+#include <string>
+
+using namespace std;
+using namespace Ice;
+using namespace IceSSL;
+
+IceUtil::Shared* IceSSL::upCast(IceSSL::SSLEngine* p) { return p; }
+
+IceSSL::SSLEngine::SSLEngine(const Ice::CommunicatorPtr& communicator) :
+    _communicator(communicator),
+    _logger(communicator->getLogger()),
+    _trustManager(new TrustManager(communicator))
+{
+}
+
+IceSSL::CertificateVerifierPtr
+IceSSL::SSLEngine::getCertificateVerifier() const
+{
+    return _verifier;
+}
+
+void
+IceSSL::SSLEngine::setCertificateVerifier(const IceSSL::CertificateVerifierPtr& verifier)
+{
+    _verifier = verifier;
+}
+
+IceSSL::PasswordPromptPtr
+IceSSL::SSLEngine::getPasswordPrompt() const
+{
+    return _prompt;
+}
+
+void
+IceSSL::SSLEngine::setPasswordPrompt(const IceSSL::PasswordPromptPtr& prompt)
+{
+    _prompt = prompt;
+}
+
+string
+IceSSL::SSLEngine::password(bool /*encrypting*/)
+{
+    if(_prompt)
+    {
+        try
+        {
+            return _prompt->getPassword();
+        }
+        catch(...)
+        {
+            //
+            // Don't allow exceptions to cross an OpenSSL boundary.
+            //
+            return string();
+        }
+    }
+    else
+    {
+        return _password;
+    }
+}
+
+string
+IceSSL::SSLEngine::getPassword() const
+{
+    return _password;
+}
+
+void
+IceSSL::SSLEngine::setPassword(const std::string& password)
+{
+    _password = password;
+}
+
+void
+IceSSL::SSLEngine::initialize()
+{
+    const string propPrefix = "IceSSL.";
+    const PropertiesPtr properties = communicator()->getProperties();
+
+    //
+    // CheckCertName determines whether we compare the name in a peer's
+    // certificate against its hostname.
+    //
+    _checkCertName = properties->getPropertyAsIntWithDefault(propPrefix + "CheckCertName", 0) > 0;
+
+    //
+    // VerifyDepthMax establishes the maximum length of a peer's certificate
+    // chain, including the peer's certificate. A value of 0 means there is
+    // no maximum.
+    //
+    _verifyDepthMax = properties->getPropertyAsIntWithDefault(propPrefix + "VerifyDepthMax", 2);
+
+    //
+    // VerifyPeer determines whether certificate validation failures abort a connection.
+    //
+    _verifyPeer = properties->getPropertyAsIntWithDefault(propPrefix + "VerifyPeer", 2);
+    
+    if(_verifyPeer < 0 || _verifyPeer > 2)
+    {
+        PluginInitializationException ex(__FILE__, __LINE__);
+        ex.reason = "IceSSL: invalid value for " + propPrefix + "VerifyPeer";
+        throw ex;
+    }
+    
+    _securityTraceLevel = properties->getPropertyAsInt("IceSSL.Trace.Security");
+    _securityTraceCategory = "Security";
+}
+
+void
+IceSSL::SSLEngine::verifyPeer(SOCKET fd, const string& address, const NativeConnectionInfoPtr& info)
+{
+    const CertificateVerifierPtr verifier = getCertificateVerifier();
+    
+    //
+    // For an outgoing connection, we compare the proxy address (if any) against
+    // fields in the server's certificate (if any).
+    //
+    if(!info->nativeCerts.empty() && !address.empty())
+    {
+        const CertificatePtr cert = info->nativeCerts[0];
+        //
+        // Extract the IP addresses and the DNS names from the subject
+        // alternative names.
+        //
+        vector<pair<int, string> > subjectAltNames = cert->getSubjectAlternativeNames();
+        vector<string> ipAddresses;
+        vector<string> dnsNames;
+        for(vector<pair<int, string> >::const_iterator p = subjectAltNames.begin(); p != subjectAltNames.end(); ++p)
+        {
+            if(p->first == AltNAmeIP)
+            {
+                ipAddresses.push_back(IceUtilInternal::toLower(p->second));
+            }
+            else if(p->first == AltNameDNS)
+            {
+                dnsNames.push_back(IceUtilInternal::toLower(p->second));
+            }
+        }
+
+        //
+        // Compare the peer's address against the common name.
+        //
+        bool certNameOK = false;
+        string dn;
+        string addrLower = IceUtilInternal::toLower(address);
+        {
+            DistinguishedName d = cert->getSubjectDN();
+            dn = IceUtilInternal::toLower(string(d));
+            string cn = "cn=" + addrLower;
+            string::size_type pos = dn.find(cn);
+            if(pos != string::npos)
+            {
+                //
+                // Ensure we match the entire common name.
+                //
+                certNameOK = (pos + cn.size() == dn.size()) || (dn[pos + cn.size()] == ',');
+            }
+        }
+
+        //
+        // Compare the peer's address against the dnsName and ipAddress
+        // values in the subject alternative name.
+        //
+        if(!certNameOK)
+        {
+            certNameOK = find(ipAddresses.begin(), ipAddresses.end(), addrLower) != ipAddresses.end();
+        }
+        if(!certNameOK)
+        {
+            certNameOK = find(dnsNames.begin(), dnsNames.end(), addrLower) != dnsNames.end();
+        }
+
+        //
+        // Log a message if the name comparison fails. If CheckCertName is defined,
+        // we also raise an exception to abort the connection. Don't log a message if
+        // CheckCertName is not defined and a verifier is present.
+        //
+        if(!certNameOK && (_checkCertName || (_securityTraceLevel >= 1 && !verifier)))
+        {
+            ostringstream ostr;
+            ostr << "IceSSL: ";
+            if(!_checkCertName)
+            {
+                ostr << "ignoring ";
+            }
+            ostr << "certificate validation failure:\npeer certificate does not have `" << address
+                    << "' as its commonName or in its subjectAltName extension";
+            if(!dn.empty())
+            {
+                ostr << "\nSubject DN: " << dn;
+            }
+            if(!dnsNames.empty())
+            {
+                ostr << "\nDNS names found in certificate: ";
+                for(vector<string>::const_iterator p = dnsNames.begin(); p != dnsNames.end(); ++p)
+                {
+                    if(p != dnsNames.begin())
+                    {
+                        ostr << ", ";
+                    }
+                    ostr << *p;
+                }
+            }
+            if(!ipAddresses.empty())
+            {
+                ostr << "\nIP addresses found in certificate: ";
+                for(vector<string>::const_iterator p = ipAddresses.begin(); p != ipAddresses.end(); ++p)
+                {
+                    if(p != ipAddresses.begin())
+                    {
+                        ostr << ", ";
+                    }
+                    ostr << *p;
+                }
+            }
+            string msg = ostr.str();
+            if(_securityTraceLevel >= 1)
+            {
+                Trace out(_logger, _securityTraceCategory);
+                out << msg;
+            }
+            if(_checkCertName)
+            {
+                SecurityException ex(__FILE__, __LINE__);
+                ex.reason = msg;
+                throw ex;
+            }
+        }
+    }
+
+    if(_verifyDepthMax > 0 && static_cast<int>(info->certs.size()) > _verifyDepthMax)
+    {
+        ostringstream ostr;
+        ostr << (info->incoming ? "incoming" : "outgoing") << " connection rejected:\n"
+                << "length of peer's certificate chain (" << info->certs.size() << ") exceeds maximum of "
+                << _verifyDepthMax;
+        string msg = ostr.str();
+        if(_securityTraceLevel >= 1)
+        {
+            _logger->trace(_securityTraceCategory, msg + "\n" + IceInternal::fdToString(fd));
+        }
+        SecurityException ex(__FILE__, __LINE__);
+        ex.reason = msg;
+        throw ex;
+    }
+
+    if(!_trustManager->verify(info))
+    {
+        string msg = string(info->incoming ? "incoming" : "outgoing") + " connection rejected by trust manager";
+        if(_securityTraceLevel >= 1)
+        {
+            _logger->trace(_securityTraceCategory, msg + "\n" + IceInternal::fdToString(fd));
+        }
+        SecurityException ex(__FILE__, __LINE__);
+        ex.reason = msg;
+        throw ex;
+    }
+
+    if(verifier && !verifier->verify(info))
+    {
+        string msg = string(info->incoming ? "incoming" : "outgoing") + " connection rejected by certificate verifier";
+        if(_securityTraceLevel >= 1)
+        {
+            _logger->trace(_securityTraceCategory, msg + "\n" + IceInternal::fdToString(fd));
+        }
+        SecurityException ex(__FILE__, __LINE__);
+        ex.reason = msg;
+        throw ex;
+    }
+}

data/ext/ice/cpp/src/IceSSL/SSLEngine.h

@@ -0,0 +1,264 @@
+// **********************************************************************
+//
+// Copyright (c) 2003-2014 ZeroC, Inc. All rights reserved.
+//
+// This copy of Ice is licensed to you under the terms described in the
+// ICE_LICENSE file included in this distribution.
+//
+// **********************************************************************
+
+#ifndef ICE_SSL_ENGINE_H
+#define ICE_SSL_ENGINE_H
+
+#include <IceSSL/Plugin.h>
+#include <IceSSL/Util.h>
+#include <IceSSL/SSLEngineF.h>
+#include <IceSSL/TrustManagerF.h>
+
+#include <IceUtil/Shared.h>
+#include <IceUtil/Mutex.h>
+#include <Ice/CommunicatorF.h>
+#include <Ice/Network.h>
+
+#if defined(ICE_USE_SECURE_TRANSPORT)
+#   include <Security/Security.h>
+#elif defined(ICE_USE_SCHANNEL)
+
+//
+// SECURITY_WIN32 or SECURITY_KERNEL, must be defined before including security.h
+// indicating who is compiling the code.
+//
+#  ifdef SECURITY_WIN32
+#    undef SECURITY_WIN32
+#  endif
+#  ifdef SECURITY_KERNEL
+#    undef SECURITY_KERNEL
+#  endif
+#  define SECURITY_WIN32 1
+#  include <security.h>
+#  include <sspi.h>
+#  include <schannel.h>
+#  undef SECURITY_WIN32
+#endif
+
+namespace IceSSL
+{
+
+class SSLEngine : public IceUtil::Shared
+{
+public:
+
+    SSLEngine(const Ice::CommunicatorPtr&);
+
+    Ice::CommunicatorPtr communicator() const { return _communicator; }
+    Ice::LoggerPtr getLogger() const { return _logger; };
+
+    void setCertificateVerifier(const CertificateVerifierPtr&);
+    void setPasswordPrompt(const PasswordPromptPtr&);
+    std::string password(bool);
+
+    //
+    // Setup the engine.
+    //
+    virtual void initialize() = 0;
+    
+    virtual bool initialized() const = 0;
+
+    //
+    // Destroy the engine.
+    //
+    virtual void destroy() = 0;
+    
+    //
+    // Verify peer certificate
+    //
+    void verifyPeer(SOCKET, const std::string&, const NativeConnectionInfoPtr&);
+
+    CertificateVerifierPtr getCertificateVerifier() const;
+    PasswordPromptPtr getPasswordPrompt() const;
+
+    std::string getPassword() const;
+    void setPassword(const std::string& password);
+    
+    int getVerifyPeer() const { return _verifyPeer; }
+    int securityTraceLevel() const { return _securityTraceLevel; }
+    std::string securityTraceCategory() const { return _securityTraceCategory; }
+    
+private:
+    
+    const Ice::CommunicatorPtr _communicator;
+    const Ice::LoggerPtr _logger;
+    const TrustManagerPtr _trustManager;
+    
+    std::string _password;
+    CertificateVerifierPtr _verifier;
+    PasswordPromptPtr _prompt;
+    
+    bool _checkCertName;
+    int _verifyDepthMax;
+    int _verifyPeer;
+    int _securityTraceLevel;
+    std::string _securityTraceCategory;
+};
+
+#if defined(ICE_USE_SECURE_TRANSPORT)
+
+class SecureTransportEngine : public SSLEngine
+{
+public:
+    
+    SecureTransportEngine(const Ice::CommunicatorPtr&);
+    
+    virtual void initialize();
+    virtual bool initialized() const;
+    virtual void destroy();
+    
+    SSLContextRef newContext(bool);
+    CFArrayRef getCertificateAuthorities() const;
+    std::string getCipherName(SSLCipherSuite) const;
+    
+private:
+    
+    void parseCiphers(const std::string&);
+    
+    bool _initialized;
+    CFArrayRef _certificateAuthorities;    
+    CFMutableArrayRef _chain;
+    
+    SSLProtocol _protocolVersionMax;
+    SSLProtocol _protocolVersionMin;
+    
+    std::string _defaultDir;
+       
+    std::vector<char> _dhParams;
+    
+    std::vector<SSLCipherSuite> _ciphers;
+    IceUtil::Mutex _mutex;
+};
+
+#elif defined(ICE_USE_SCHANNEL)
+
+
+#ifdef __MINGW32__
+
+//
+// Add some definitions missing from MinGW headers.
+//
+
+#   ifndef CERT_TRUST_IS_EXPLICIT_DISTRUST
+#      define CERT_TRUST_IS_EXPLICIT_DISTRUST 0x04000000
+#   endif
+
+#   ifndef CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT
+#      define CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT 0x08000000
+#   endif
+
+#   ifndef SECBUFFER_ALERT
+#      define SECBUFFER_ALERT 17
+#   endif
+
+#   ifndef SCH_SEND_ROOT_CERT
+#      define SCH_SEND_ROOT_CERT 0x00040000
+#   endif
+
+#   ifndef SP_PROT_TLS1_1_SERVER
+#      define SP_PROT_TLS1_1_SERVER 0x00000100
+#   endif
+
+#   ifndef SP_PROT_TLS1_1_CLIENT
+#      define SP_PROT_TLS1_1_CLIENT 0x00000200
+#   endif
+
+#   ifndef SP_PROT_TLS1_2_SERVER
+#      define SP_PROT_TLS1_2_SERVER 0x00000400
+#   endif
+
+#   ifndef SP_PROT_TLS1_2_CLIENT
+#      define SP_PROT_TLS1_2_CLIENT 0x00000800
+#   endif
+
+#endif
+class SChannelEngine : public SSLEngine
+{
+public:
+    
+    SChannelEngine(const Ice::CommunicatorPtr&);
+    
+    //
+    // Setup the engine.
+    //
+    virtual void initialize();
+    
+    virtual bool initialized() const;
+
+    //
+    // Destroy the engine.
+    //
+    virtual void destroy();
+    
+    std::string getCipherName(ALG_ID) const;
+
+    CredHandle newCredentialsHandle(bool);
+
+    HCERTCHAINENGINE chainEngine() const;
+
+private:
+
+    void parseCiphers(const std::string&);
+    
+    bool _initialized;
+    std::vector<PCCERT_CONTEXT> _allCerts;
+    std::vector<PCCERT_CONTEXT> _certs;
+    DWORD _protocols;
+    IceUtil::Mutex _mutex;
+
+    std::vector<HCERTSTORE> _stores;
+
+    HCERTSTORE _rootStore;
+
+    HCERTCHAINENGINE _chainEngine;
+    std::vector<ALG_ID> _ciphers;
+};
+#else // OpenSSL
+class OpenSSLEngine : public SSLEngine
+{
+public:
+    
+    OpenSSLEngine(const Ice::CommunicatorPtr&);
+    ~OpenSSLEngine();
+    
+    virtual void initialize();
+    virtual bool initialized() const;
+    virtual void destroy();
+    
+    int verifyCallback(int , SSL*, X509_STORE_CTX*);
+#   ifndef OPENSSL_NO_DH
+    DH* dhParams(int);
+#   endif
+    SSL_CTX* context() const;
+    void context(SSL_CTX*);
+    std::string sslErrors() const;
+    
+private:
+    
+    SSL_METHOD* getMethod(int);
+    void setOptions(int);
+    enum Protocols { SSLv3 = 0x01, TLSv1_0 = 0x02, TLSv1_1 = 0x04, TLSv1_2 = 0x08 };
+    int parseProtocols(const Ice::StringSeq&) const;
+
+
+    bool _initOpenSSL;
+    bool _initialized;
+    SSL_CTX* _ctx;
+    std::string _defaultDir;
+
+#   ifndef OPENSSL_NO_DH
+    DHParamsPtr _dhParams;
+#   endif
+    IceUtil::Mutex _mutex;
+};
+#endif
+
+}
+
+#endif