zeroc-ice 3.7.0 → 3.7.5

data/ext/ice/cpp/src/IceSSL/OpenSSLEngine.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_OPENSSL_ENGINE_H
 #define ICESSL_OPENSSL_ENGINE_H
@@ -31,7 +26,6 @@ public:
 
     virtual void initialize();
     virtual void destroy();
-    virtual void verifyPeer(const std::string&, const IceSSL::ConnectionInfoPtr&, const std::string&);
     virtual IceInternal::TransceiverPtr
     createTransceiver(const IceSSL::InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool);
 
@@ -45,9 +39,10 @@ public:
 
 private:
 
+    void cleanup();
     SSL_METHOD* getMethod(int);
     void setOptions(int);
-    enum Protocols { SSLv3 = 0x01, TLSv1_0 = 0x02, TLSv1_1 = 0x04, TLSv1_2 = 0x08 };
+    enum Protocols { SSLv3 = 1, TLSv1_0 = 2, TLSv1_1 = 4, TLSv1_2 = 8, TLSv1_3 = 16 };
     int parseProtocols(const Ice::StringSeq&) const;
 
     SSL_CTX* _ctx;

data/ext/ice/cpp/src/IceSSL/OpenSSLEngineF.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_OPENSSL_ENGINE_F_H
 #define ICESSL_OPENSSL_ENGINE_F_H

data/ext/ice/cpp/src/IceSSL/OpenSSLPluginI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/PluginI.h>
 #include <IceSSL/OpenSSL.h>

data/ext/ice/cpp/src/IceSSL/OpenSSLTransceiverI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/OpenSSLTransceiverI.h>
 #include <IceSSL/OpenSSLEngine.h>
@@ -99,50 +94,49 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
     if(!_ssl)
     {
         SOCKET fd = _delegate->getNativeInfo()->fd();
+        BIO* bio = 0;
         if(fd == INVALID_SOCKET)
         {
-            //
-            // The delegate has finished its initialization but may not have a file descriptor yet (e.g., Bluetooth).
-            // The underlying transport must (eventually) be socket-based.
-            //
-            return IceInternal::SocketOperationRead;
+            assert(_sentBytes == 0);
+            _maxSendPacketSize = 128 * 1024; // 128KB
+            _maxRecvPacketSize = 128 * 1024; // 128KB
+            if(!BIO_new_bio_pair(&bio, _maxSendPacketSize, &_memBio, _maxRecvPacketSize))
+            {
+                bio = 0;
+                _memBio = 0;
+            }
         }
-
-#ifdef ICE_USE_IOCP
-        _maxSendPacketSize = std::max(512, IceInternal::getSendBufferSize(fd));
-        _maxRecvPacketSize = std::max(512, IceInternal::getRecvBufferSize(fd));
-        BIO* bio;
-        _sentBytes = 0;
-        if(!BIO_new_bio_pair(&bio, _maxSendPacketSize, &_iocpBio, _maxRecvPacketSize))
+        else
         {
-            bio = 0;
-            _iocpBio = 0;
-        }
+#ifdef ICE_USE_IOCP
+            assert(_sentBytes == 0);
+            _maxSendPacketSize = std::max(512, IceInternal::getSendBufferSize(fd));
+            _maxRecvPacketSize = std::max(512, IceInternal::getRecvBufferSize(fd));
+            if(!BIO_new_bio_pair(&bio, _maxSendPacketSize, &_memBio, _maxRecvPacketSize))
+            {
+                bio = 0;
+                _memBio = 0;
+            }
 #else
-        //
-        // This static_cast is necessary due to 64bit windows. There SOCKET is a non-int type.
-        //
-        BIO* bio = BIO_new_socket(static_cast<int>(fd), 0);
+            bio = BIO_new_socket(fd, 0);
 #endif
+        }
 
         if(!bio)
         {
-            SecurityException ex(__FILE__, __LINE__);
-            ex.reason = "openssl failure";
-            throw ex;
+            throw SecurityException(__FILE__, __LINE__, "openssl failure");
         }
 
         _ssl = SSL_new(_engine->context());
         if(!_ssl)
         {
             BIO_free(bio);
-#ifdef ICE_USE_IOCP
-            BIO_free(_iocpBio);
-            _iocpBio = 0;
-#endif
-            SecurityException ex(__FILE__, __LINE__);
-            ex.reason = "openssl failure";
-            throw ex;
+            if(_memBio)
+            {
+                BIO_free(_memBio);
+                _memBio = 0;
+            }
+            throw SecurityException(__FILE__, __LINE__, "openssl failure");
         }
         SSL_set_bio(_ssl, bio, bio);
 
@@ -177,22 +171,41 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
             // Hostname verification was included in OpenSSL 1.0.2
             //
 #if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10002000L
-            if(_engine->getCheckCertName() && !_host.empty() && (sslVerifyMode & SSL_VERIFY_PEER))
+            if(_engine->getCheckCertName() && !_host.empty())
             {
                 X509_VERIFY_PARAM* param = SSL_get0_param(_ssl);
                 if(IceInternal::isIpAddress(_host))
                 {
-                    X509_VERIFY_PARAM_set1_ip_asc(param, _host.c_str());
+                    if(!X509_VERIFY_PARAM_set1_ip_asc(param, _host.c_str()))
+                    {
+                        throw SecurityException(__FILE__, __LINE__, "IceSSL: error setting the expected IP address `"
+                                                + _host + "'");
+                    }
                 }
                 else
                 {
-                    X509_VERIFY_PARAM_set1_host(param, _host.c_str(), 0);
+                    if(!X509_VERIFY_PARAM_set1_host(param, _host.c_str(), 0))
+                    {
+                        throw SecurityException(__FILE__, __LINE__, "IceSSL: error setting the expected host name `"
+                                                + _host + "'");
+                    }
                 }
             }
 #endif
 
             SSL_set_verify(_ssl, sslVerifyMode, IceSSL_opensslVerifyCallback);
         }
+
+        //
+        // Enable SNI
+        //
+        if(!_incoming && _engine->getServerNameIndication() && !_host.empty() && !IceInternal::isIpAddress(_host))
+        {
+            if(!SSL_set_tlsext_host_name(_ssl, _host.c_str()))
+            {
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: setting SNI host failed `" + _host + "'");
+            }
+        }
     }
 
     while(!SSL_is_init_finished(_ssl))
@@ -217,8 +230,7 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
         sync.release();
 #endif
 
-#ifdef ICE_USE_IOCP
-        if(BIO_ctrl_pending(_iocpBio))
+        if(_memBio && BIO_ctrl_pending(_memBio))
         {
             if(!send())
             {
@@ -226,7 +238,6 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
             }
             continue;
         }
-#endif
 
         if(ret <= 0)
         {
@@ -239,71 +250,60 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
             }
             case SSL_ERROR_ZERO_RETURN:
             {
-                ConnectionLostException ex(__FILE__, __LINE__);
-                ex.error = IceInternal::getSocketErrno();
-                throw ex;
+                throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
             }
             case SSL_ERROR_WANT_READ:
             {
-#ifdef ICE_USE_IOCP
-                if(receive())
+                if(_memBio && receive())
                 {
                     continue;
                 }
-#endif
                 return IceInternal::SocketOperationRead;
             }
             case SSL_ERROR_WANT_WRITE:
             {
-#ifdef ICE_USE_IOCP
-                if(send())
+                if(_memBio && send())
                 {
                     continue;
                 }
-#endif
                 return IceInternal::SocketOperationWrite;
             }
             case SSL_ERROR_SYSCALL:
             {
-#ifndef ICE_USE_IOCP
-                if(IceInternal::interrupted())
-                {
-                    break;
-                }
-
-                if(IceInternal::wouldBlock())
+                if(!_memBio)
                 {
-                    if(SSL_want_read(_ssl))
+                    if(IceInternal::interrupted())
                     {
-                        return IceInternal::SocketOperationRead;
+                        break;
                     }
-                    else if(SSL_want_write(_ssl))
+
+                    if(IceInternal::wouldBlock())
                     {
-                        return IceInternal::SocketOperationWrite;
+                        if(SSL_want_read(_ssl))
+                        {
+                            return IceInternal::SocketOperationRead;
+                        }
+                        else if(SSL_want_write(_ssl))
+                        {
+                            return IceInternal::SocketOperationWrite;
+                        }
+
+                        break;
                     }
 
-                    break;
-                }
-
-                if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
-                {
-                    ConnectionLostException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
+                    if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
+                    {
+                        throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
+                    }
                 }
-#endif
-                SocketException ex(__FILE__, __LINE__);
-                ex.error = IceInternal::getSocketErrno();
-                throw ex;
+                throw SocketException(__FILE__, __LINE__, IceInternal::getSocketErrno());
             }
             case SSL_ERROR_SSL:
             {
                 ostringstream ostr;
                 ostr << "SSL error occurred for new " << (_incoming ? "incoming" : "outgoing")
-                     << " connection:\nremote address = " << _delegate->toString() << "\n" << _engine->sslErrors();
-                ProtocolException ex(__FILE__, __LINE__);
-                ex.reason = ostr.str();
-                throw ex;
+                     << " connection:\n" << _delegate->toString() << "\n" << _engine->sslErrors();
+                throw ProtocolException(__FILE__, __LINE__, ostr.str());
             }
             }
         }
@@ -325,14 +325,12 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
         {
             ostringstream ostr;
             ostr << "IceSSL: certificate verification failed:\n" << X509_verify_cert_error_string(result);
-            string msg = ostr.str();
+            const string msg = ostr.str();
             if(_engine->securityTraceLevel() >= 1)
             {
                 _instance->logger()->trace(_instance->traceCategory(), msg);
             }
-            SecurityException ex(__FILE__, __LINE__);
-            ex.reason = msg;
-            throw ex;
+            throw SecurityException(__FILE__, __LINE__,  msg);
         }
     }
     else
@@ -341,6 +339,24 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
     }
 
     _cipher = SSL_get_cipher_name(_ssl); // Nothing needs to be free'd.
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x10002000L
+    try
+    {
+        //
+        // Peer hostname verification is new in OpenSSL 1.0.2 for older versions
+        // We use IceSSL built-in hostname verification.
+        //
+        _engine->verifyPeerCertName(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()));
+    }
+    catch(const SecurityException&)
+    {
+        _verified = false;
+        if(_engine->getVerifyPeer() > 0)
+        {
+            throw;
+        }
+    }
+#endif
     _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString());
 
     if(_engine->securityTraceLevel() >= 1)
@@ -363,7 +379,7 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
             out << "bits = " << SSL_CIPHER_get_bits(cipher, 0) << "\n";
             out << "protocol = " << SSL_get_version(_ssl) << "\n";
         }
-        out << IceInternal::fdToString(SSL_get_fd(_ssl));
+        out << toString();
     }
 
     return IceInternal::SocketOperationNone;
@@ -396,13 +412,11 @@ OpenSSL::TransceiverI::close()
         _ssl = 0;
     }
 
-#ifdef ICE_USE_IOCP
-    if(_iocpBio)
+    if(_memBio)
     {
-        BIO_free(_iocpBio);
-        _iocpBio = 0;
+        BIO_free(_memBio);
+        _memBio = 0;
     }
-#endif
 
     _delegate->close();
 }
@@ -415,15 +429,13 @@ OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
         return _delegate->write(buf);
     }
 
-#ifdef ICE_USE_IOCP
-    if(_writeBuffer.i != _writeBuffer.b.end())
+    if(_memBio && _writeBuffer.i != _writeBuffer.b.end())
     {
         if(!send())
         {
             return IceInternal::SocketOperationWrite;
         }
     }
-#endif
 
     if(buf.i == buf.b.end())
     {
@@ -433,37 +445,39 @@ OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
     //
     // It's impossible for packetSize to be more than an Int.
     //
-    int packetSize =
-#ifdef ICE_USE_IOCP
-        std::min(static_cast<int>(_maxSendPacketSize), static_cast<int>(buf.b.end() - buf.i));
-#else
+    int packetSize = _memBio ?
+        std::min(static_cast<int>(_maxSendPacketSize), static_cast<int>(buf.b.end() - buf.i)) :
         static_cast<int>(buf.b.end() - buf.i);
-#endif
+
     while(buf.i != buf.b.end())
     {
         ERR_clear_error(); // Clear any spurious errors.
-#ifdef ICE_USE_IOCP
         int ret;
-        if(_sentBytes)
+        if(_memBio)
         {
-            ret = _sentBytes;
-            _sentBytes = 0;
-        }
-        else
-        {
-            ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
-            if(ret > 0)
+            if(_sentBytes)
+            {
+                ret = _sentBytes;
+                _sentBytes = 0;
+            }
+            else
             {
-                if(!send())
+                ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
+                if(ret > 0)
                 {
-                    _sentBytes = ret;
-                    return IceInternal::SocketOperationWrite;
+                    if(!send())
+                    {
+                        _sentBytes = ret;
+                        return IceInternal::SocketOperationWrite;
+                    }
                 }
             }
         }
-#else
-        int ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
-#endif
+        else
+        {
+            ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
+        }
+
         if(ret <= 0)
         {
             switch(SSL_get_error(_ssl, ret))
@@ -473,9 +487,7 @@ OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
                 break;
             case SSL_ERROR_ZERO_RETURN:
             {
-                ConnectionLostException ex(__FILE__, __LINE__);
-                ex.error = IceInternal::getSocketErrno();
-                throw ex;
+                throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
             }
             case SSL_ERROR_WANT_READ:
             {
@@ -484,53 +496,47 @@ OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
             }
             case SSL_ERROR_WANT_WRITE:
             {
-#ifdef ICE_USE_IOCP
-                if(send())
+                if(_memBio && send())
                 {
                     continue;
                 }
-#endif
                 return IceInternal::SocketOperationWrite;
             }
             case SSL_ERROR_SYSCALL:
             {
-#ifndef ICE_USE_IOCP
-
-                if(IceInternal::interrupted())
+                if(!_memBio)
                 {
-                    continue;
-                }
+                    if(IceInternal::interrupted())
+                    {
+                        continue;
+                    }
 
-                if(IceInternal::noBuffers() && packetSize > 1024)
-                {
-                    packetSize /= 2;
-                    continue;
-                }
+                    if(IceInternal::noBuffers() && packetSize > 1024)
+                    {
+                        packetSize /= 2;
+                        continue;
+                    }
 
-                if(IceInternal::wouldBlock())
-                {
-                    assert(SSL_want_write(_ssl));
-                    return IceInternal::SocketOperationWrite;
+                    if(IceInternal::wouldBlock())
+                    {
+                        assert(SSL_want_write(_ssl));
+                        return IceInternal::SocketOperationWrite;
+                    }
                 }
-#endif
+
                 if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
                 {
-                    ConnectionLostException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
+                    throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
                 }
                 else
                 {
-                    SocketException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
+                    throw SocketException(__FILE__, __LINE__, IceInternal::getSocketErrno());
                 }
             }
             case SSL_ERROR_SSL:
             {
-                ProtocolException ex(__FILE__, __LINE__);
-                ex.reason = "SSL protocol error during write:\n" + _engine->sslErrors();
-                throw ex;
+                throw ProtocolException(__FILE__, __LINE__,
+                                        "SSL protocol error during write:\n" + _engine->sslErrors());
             }
             }
         }
@@ -553,15 +559,13 @@ OpenSSL::TransceiverI::read(IceInternal::Buffer& buf)
         return _delegate->read(buf);
     }
 
-#ifdef ICE_USE_IOCP
-    if(_readBuffer.i != _readBuffer.b.end())
+    if(_memBio && _readBuffer.i != _readBuffer.b.end())
     {
         if(!receive())
         {
             return IceInternal::SocketOperationRead;
         }
     }
-#endif
 
     //
     // Note: We assume that OpenSSL doesn't read more SSL records than
@@ -595,18 +599,14 @@ OpenSSL::TransceiverI::read(IceInternal::Buffer& buf)
             }
             case SSL_ERROR_ZERO_RETURN:
             {
-                ConnectionLostException ex(__FILE__, __LINE__);
-                ex.error = 0;
-                throw ex;
+                throw ConnectionLostException(__FILE__, __LINE__, 0);
             }
             case SSL_ERROR_WANT_READ:
             {
-#ifdef ICE_USE_IOCP
-                if(receive())
+                if(_memBio && receive())
                 {
                     continue;
                 }
-#endif
                 return IceInternal::SocketOperationRead;
             }
             case SSL_ERROR_WANT_WRITE:
@@ -616,42 +616,39 @@ OpenSSL::TransceiverI::read(IceInternal::Buffer& buf)
             }
             case SSL_ERROR_SYSCALL:
             {
-#ifndef ICE_USE_IOCP
-                if(IceInternal::interrupted())
+                if(!_memBio)
                 {
-                    continue;
-                }
+                    if(IceInternal::interrupted())
+                    {
+                        continue;
+                    }
 
-                if(IceInternal::noBuffers() && packetSize > 1024)
-                {
-                    packetSize /= 2;
-                    continue;
-                }
+                    if(IceInternal::noBuffers() && packetSize > 1024)
+                    {
+                        packetSize /= 2;
+                        continue;
+                    }
 
-                if(IceInternal::wouldBlock())
-                {
-                    assert(SSL_want_read(_ssl));
-                    return IceInternal::SocketOperationRead;
+                    if(IceInternal::wouldBlock())
+                    {
+                        assert(SSL_want_read(_ssl));
+                        return IceInternal::SocketOperationRead;
+                    }
                 }
-#endif
+
                 if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
                 {
-                    ConnectionLostException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
+                    throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
                 }
                 else
                 {
-                    SocketException ex(__FILE__, __LINE__);
-                    ex.error = IceInternal::getSocketErrno();
-                    throw ex;
+                    throw SocketException(__FILE__, __LINE__, IceInternal::getSocketErrno());
                 }
             }
             case SSL_ERROR_SSL:
             {
-                ProtocolException ex(__FILE__, __LINE__);
-                ex.reason = "SSL protocol error during read:\n" + _engine->sslErrors();
-                throw ex;
+                throw ProtocolException(__FILE__, __LINE__,
+                                        "SSL protocol error during read:\n" + _engine->sslErrors());
             }
             }
         }
@@ -688,10 +685,10 @@ OpenSSL::TransceiverI::startWrite(IceInternal::Buffer& buffer)
         int packetSize = std::min(static_cast<int>(_maxSendPacketSize), static_cast<int>(buffer.b.end() - buffer.i));
         _sentBytes = SSL_write(_ssl, reinterpret_cast<void*>(&*buffer.i), packetSize);
 
-        assert(BIO_ctrl_pending(_iocpBio));
-        _writeBuffer.b.resize( BIO_ctrl_pending(_iocpBio));
+        assert(BIO_ctrl_pending(_memBio));
+        _writeBuffer.b.resize( BIO_ctrl_pending(_memBio));
         _writeBuffer.i = _writeBuffer.b.begin();
-        BIO_read(_iocpBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
+        BIO_read(_memBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
     }
 
     return _delegate->startWrite(_writeBuffer) && buffer.i == buffer.b.end();
@@ -733,8 +730,8 @@ OpenSSL::TransceiverI::startRead(IceInternal::Buffer& buffer)
             SSL_read(_ssl, reinterpret_cast<void*>(&*buffer.i), static_cast<int>(buffer.b.end() - buffer.i));
         assert(ret <= 0 && SSL_get_error(_ssl, ret) == SSL_ERROR_WANT_READ);
 
-        assert(BIO_ctrl_get_read_request(_iocpBio));
-        _readBuffer.b.resize(BIO_ctrl_get_read_request(_iocpBio));
+        assert(BIO_ctrl_get_read_request(_memBio));
+        _readBuffer.b.resize(BIO_ctrl_get_read_request(_memBio));
         _readBuffer.i = _readBuffer.b.begin();
     }
 
@@ -755,12 +752,10 @@ OpenSSL::TransceiverI::finishRead(IceInternal::Buffer& buffer)
     _delegate->finishRead(_readBuffer);
     if(_readBuffer.i == _readBuffer.b.end())
     {
-        int n = BIO_write(_iocpBio, _readBuffer.b.begin(), static_cast<int>(_readBuffer.b.size()));
+        int n = BIO_write(_memBio, _readBuffer.b.begin(), static_cast<int>(_readBuffer.b.size()));
         if(n < 0) // Expected if the transceiver was closed.
         {
-            SecurityException ex(__FILE__, __LINE__);
-            ex.reason = "SSL bio write failed";
-            throw ex;
+            throw SecurityException(__FILE__, __LINE__, "SSL bio write failed");
         }
 
         assert(n == static_cast<int>(_readBuffer.b.size()));
@@ -778,9 +773,7 @@ OpenSSL::TransceiverI::finishRead(IceInternal::Buffer& buffer)
                 }
                 case SSL_ERROR_ZERO_RETURN:
                 {
-                    ConnectionLostException ex(__FILE__, __LINE__);
-                    ex.error = 0;
-                    throw ex;
+                    throw ConnectionLostException(__FILE__, __LINE__, 0);
                 }
                 case SSL_ERROR_WANT_READ:
                 {
@@ -790,22 +783,17 @@ OpenSSL::TransceiverI::finishRead(IceInternal::Buffer& buffer)
                 {
                     if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
                     {
-                        ConnectionLostException ex(__FILE__, __LINE__);
-                        ex.error = IceInternal::getSocketErrno();
-                        throw ex;
+                        throw ConnectionLostException(__FILE__, __LINE__,  IceInternal::getSocketErrno());
                     }
                     else
                     {
-                        SocketException ex(__FILE__, __LINE__);
-                        ex.error = IceInternal::getSocketErrno();
-                        throw ex;
+                        throw SocketException(__FILE__, __LINE__, IceInternal::getSocketErrno());
                     }
                 }
                 case SSL_ERROR_SSL:
                 {
-                    ProtocolException ex(__FILE__, __LINE__);
-                    ex.reason = "SSL protocol error during read:\n" + _engine->sslErrors();
-                    throw ex;
+                    throw ProtocolException(__FILE__, __LINE__,
+                                            "SSL protocol error during read:\n" + _engine->sslErrors());
                 }
             }
         }
@@ -874,7 +862,7 @@ OpenSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
         out << "subject = " << buf << '\n';
         out << "depth = " << X509_STORE_CTX_get_error_depth(c) << '\n';
         out << "error = " << X509_verify_cert_error_string(err) << '\n';
-        out << IceInternal::fdToString(SSL_get_fd(_ssl));
+        out << toString();
     }
 
     //
@@ -914,13 +902,11 @@ OpenSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
     _delegate(delegate),
     _connected(false),
     _verified(false),
-    _ssl(0)
-#ifdef ICE_USE_IOCP
-    , _iocpBio(0),
+    _ssl(0),
+    _memBio(0),
     _sentBytes(0),
     _maxSendPacketSize(0),
     _maxRecvPacketSize(0)
-#endif
 {
 }
 
@@ -928,14 +914,13 @@ OpenSSL::TransceiverI::~TransceiverI()
 {
 }
 
-#ifdef ICE_USE_IOCP
 bool
 OpenSSL::TransceiverI::receive()
 {
     if(_readBuffer.i == _readBuffer.b.end())
     {
-        assert(BIO_ctrl_get_read_request(_iocpBio));
-        _readBuffer.b.resize(BIO_ctrl_get_read_request(_iocpBio));
+        assert(BIO_ctrl_get_read_request(_memBio));
+        _readBuffer.b.resize(BIO_ctrl_get_read_request(_memBio));
         _readBuffer.i = _readBuffer.b.begin();
     }
 
@@ -952,7 +937,7 @@ OpenSSL::TransceiverI::receive()
 #ifndef NDEBUG
     int n =
 #endif
-        BIO_write(_iocpBio, &_readBuffer.b[0], static_cast<int>(_readBuffer.b.end() - _readBuffer.b.begin()));
+        BIO_write(_memBio, &_readBuffer.b[0], static_cast<int>(_readBuffer.b.end() - _readBuffer.b.begin()));
 
     assert(n == static_cast<int>(_readBuffer.b.end() - _readBuffer.b.begin()));
 
@@ -964,10 +949,10 @@ OpenSSL::TransceiverI::send()
 {
     if(_writeBuffer.i == _writeBuffer.b.end())
     {
-        assert(BIO_ctrl_pending(_iocpBio));
-        _writeBuffer.b.resize( BIO_ctrl_pending(_iocpBio));
+        assert(BIO_ctrl_pending(_memBio));
+        _writeBuffer.b.resize( BIO_ctrl_pending(_memBio));
         _writeBuffer.i = _writeBuffer.b.begin();
-        BIO_read(_iocpBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
+        BIO_read(_memBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
     }
 
     if(_writeBuffer.i != _writeBuffer.b.end())
@@ -979,4 +964,3 @@ OpenSSL::TransceiverI::send()
     }
     return _writeBuffer.i == _writeBuffer.b.end();
 }
-#endif