zeroc-ice 3.7.0 → 3.7.5

data/ext/ice/cpp/src/IceSSL/SChannelPluginI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/PluginI.h>
 #include <IceSSL/SChannelEngine.h>

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/SChannelTransceiverI.h>
 
@@ -234,9 +229,9 @@ SChannel::TransceiverI::sslHandshake()
     }
 
     SECURITY_STATUS err = SEC_E_OK;
-    DWORD ctxFlags = 0;
     if(_state == StateHandshakeNotStarted)
     {
+        _ctxFlags = 0;
         _readBuffer.b.resize(2048);
         _readBuffer.i = _readBuffer.b.begin();
         _credentials = _engine->newCredentialsHandle(_incoming);
@@ -248,7 +243,7 @@ SChannel::TransceiverI::sslHandshake()
             SecBufferDesc outBufferDesc = { SECBUFFER_VERSION, 1, &outBuffer };
 
             err = InitializeSecurityContext(&_credentials, 0, const_cast<char *>(_host.c_str()), flags, 0, 0, 0, 0,
-                                            &_ssl, &outBufferDesc, &ctxFlags, 0);
+                                            &_ssl, &outBufferDesc, &_ctxFlags, 0);
             if(err != SEC_E_OK && err != SEC_I_CONTINUE_NEEDED)
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + secStatusToString(err));
@@ -296,7 +291,7 @@ SChannel::TransceiverI::sslHandshake()
             if(_incoming)
             {
                 err = AcceptSecurityContext(&_credentials, (_sslInitialized ? &_ssl : 0), &inBufferDesc, flags, 0,
-                                            &_ssl, &outBufferDesc, &ctxFlags, 0);
+                                            &_ssl, &outBufferDesc, &_ctxFlags, 0);
                 if(err == SEC_I_CONTINUE_NEEDED || err == SEC_E_OK)
                 {
                     _sslInitialized = true;
@@ -305,7 +300,7 @@ SChannel::TransceiverI::sslHandshake()
             else
             {
                 err = InitializeSecurityContext(&_credentials, &_ssl, const_cast<char*>(_host.c_str()), flags, 0, 0,
-                                                &inBufferDesc, 0, 0, &outBufferDesc, &ctxFlags, 0);
+                                                &inBufferDesc, 0, 0, &outBufferDesc, &_ctxFlags, 0);
             }
 
             //
@@ -315,7 +310,7 @@ SChannel::TransceiverI::sslHandshake()
             {
                 SecBuffer* missing = getSecBufferWithType(inBufferDesc, SECBUFFER_MISSING);
                 size_t pos = _readBuffer.i - _readBuffer.b.begin();
-                _readBuffer.b.resize(missing ? (pos + missing->cbBuffer) : (pos * 2));
+                _readBuffer.b.resize((missing && missing->cbBuffer > 0) ? (pos + missing->cbBuffer) : (pos * 2));
                 _readBuffer.i = _readBuffer.b.begin() + pos;
                 return IceInternal::SocketOperationRead;
             }
@@ -354,7 +349,14 @@ SChannel::TransceiverI::sslHandshake()
 
             if(token->cbBuffer)
             {
-                _state = StateHandshakeWriteContinue; // Continue writing if we have a token.
+                if(err == SEC_E_OK)
+                {
+                    _state = StateHandshakeWriteNoContinue; // Write and don't continue.
+                }
+                else
+                {
+                    _state = StateHandshakeWriteContinue; // Continue writing if we have a token.
+                }
             }
             else if(err == SEC_E_OK)
             {
@@ -364,7 +366,7 @@ SChannel::TransceiverI::sslHandshake()
             // Otherwise continue either reading credentials
         }
 
-        if(_state == StateHandshakeWriteContinue)
+        if(_state == StateHandshakeWriteContinue || _state == StateHandshakeWriteNoContinue)
         {
             //
             // Write any pending data.
@@ -373,80 +375,83 @@ SChannel::TransceiverI::sslHandshake()
             {
                 return IceInternal::SocketOperationWrite;
             }
-            if(err == SEC_E_OK)
+            if(_state == StateHandshakeWriteNoContinue)
             {
                 break; // Token is written and we weren't told to continue, so we're done!
             }
-            assert(err == SEC_I_CONTINUE_NEEDED);
             _state = StateHandshakeReadContinue;
         }
     }
 
     //
-    // Check if the requested capabilities are met
+    // Check if the requested capabilities are met.
+    //
+    // NOTE: it's important for _ctxFlags to be a data member. The context flags might not be checked immediately
+    // if the last write can't complete without blocking above. In such a case, the context flags are checked here
+    // only once the sslHandshake is called again after the write completes.
     //
-    if(flags != ctxFlags)
+    if(flags != _ctxFlags)
     {
         if(_incoming)
         {
-            if(!(ctxFlags & ASC_REQ_SEQUENCE_DETECT))
+            if(!(_ctxFlags & ASC_REQ_SEQUENCE_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup sequence detect");
             }
 
-            if(!(ctxFlags & ASC_REQ_REPLAY_DETECT))
+            if(!(_ctxFlags & ASC_REQ_REPLAY_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup replay detect");
             }
 
-            if(!(ctxFlags & ASC_REQ_CONFIDENTIALITY))
+            if(!(_ctxFlags & ASC_REQ_CONFIDENTIALITY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup confidentiality");
             }
 
-            if(!(ctxFlags & ASC_REQ_EXTENDED_ERROR))
+            if(!(_ctxFlags & ASC_REQ_EXTENDED_ERROR))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup extended error");
             }
 
-            if(!(ctxFlags & ASC_REQ_ALLOCATE_MEMORY))
+            if(!(_ctxFlags & ASC_REQ_ALLOCATE_MEMORY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup memory allocation");
             }
 
-            if(!(ctxFlags & ASC_REQ_STREAM))
+            if(!(_ctxFlags & ASC_REQ_STREAM))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup stream");
             }
         }
         else
         {
-            if(!(ctxFlags & ISC_REQ_SEQUENCE_DETECT))
+            if(!(_ctxFlags & ISC_REQ_SEQUENCE_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup sequence detect");
             }
 
-            if(!(ctxFlags & ISC_REQ_REPLAY_DETECT))
+            if(!(_ctxFlags & ISC_REQ_REPLAY_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup replay detect");
             }
 
-            if(!(ctxFlags & ISC_REQ_CONFIDENTIALITY))
+            if(!(_ctxFlags & ISC_REQ_CONFIDENTIALITY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup confidentiality");
             }
 
-            if(!(ctxFlags & ISC_REQ_EXTENDED_ERROR))
+            if(!(_ctxFlags & ISC_REQ_EXTENDED_ERROR))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup extended error");
             }
 
-            if(!(ctxFlags & ISC_REQ_ALLOCATE_MEMORY))
+            if(!(_ctxFlags & ISC_REQ_ALLOCATE_MEMORY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup memory allocation");
             }
 
-            if(!(ctxFlags & ISC_REQ_STREAM))
+            if(!(_ctxFlags & ISC_REQ_STREAM))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup stream");
             }
@@ -663,21 +668,20 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
     }
     else if(cert) // Verify the remote certificate
     {
-        try
+        CERT_CHAIN_PARA chainP;
+        memset(&chainP, 0, sizeof(chainP));
+        chainP.cbSize = sizeof(chainP);
+
+        string trustError;
+        PCCERT_CHAIN_CONTEXT certChain;
+        if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
+                                    CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
+        {
+            CertFreeCertificateContext(cert);
+            trustError = IceUtilInternal::lastErrorToString();
+        }
+        else
         {
-            CERT_CHAIN_PARA chainP;
-            memset(&chainP, 0, sizeof(chainP));
-            chainP.cbSize = sizeof(chainP);
-
-            PCCERT_CHAIN_CONTEXT certChain;
-            if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
-                                        CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
-            {
-                CertFreeCertificateContext(cert);
-                throw IceUtilInternal::lastErrorToString();
-            }
-
-            string trustError;
             if(certChain->TrustStatus.dwErrorStatus != CERT_TRUST_NO_ERROR)
             {
                 trustError = trustStatusToString(certChain->TrustStatus.dwErrorStatus);
@@ -699,36 +703,29 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
                 {
                     CertFreeCertificateChain(certChain);
                     CertFreeCertificateContext(cert);
-                    throw SecurityException(__FILE__, __LINE__,
-                                            "IceSSL: error decoding peer certificate chain:\n" +
+                    throw SecurityException(__FILE__, __LINE__, "IceSSL: error decoding peer certificate chain:\n" +
                                             IceUtilInternal::lastErrorToString());
                 }
-
                 _certs.push_back(SChannel::Certificate::create(cc));
             }
 
             CertFreeCertificateChain(certChain);
             CertFreeCertificateContext(cert);
-            if(!trustError.empty())
-            {
-                throw trustError;
-            }
         }
-        catch(const string& reason)
+
+        if(!trustError.empty())
         {
             if(_engine->getVerifyPeer() == 0)
             {
                 if(_instance->traceLevel() >= 1)
                 {
                     _instance->logger()->trace(_instance->traceCategory(),
-                                               "IceSSL: ignoring certificate verification failure:\n" + reason);
+                                               "IceSSL: ignoring certificate verification failure:\n" + trustError);
                 }
             }
             else
             {
-                ostringstream os;
-                os << "IceSSL: certificate verification failure:\n" << reason;
-                string msg = os.str();
+                string msg = "IceSSL: certificate verification failure:\n" + trustError;
                 if(_instance->traceLevel() >= 1)
                 {
                     _instance->logger()->trace(_instance->traceCategory(), msg);
@@ -749,7 +746,20 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
         throw SecurityException(__FILE__, __LINE__, "IceSSL: error reading cipher info:\n" + secStatusToString(err));
     }
 
-    _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString());
+    ConnectionInfoPtr info = ICE_DYNAMIC_CAST(ConnectionInfo, getInfo());
+    try
+    {
+        _engine->verifyPeerCertName(_host, info);
+    }
+    catch(const Ice::SecurityException&)
+    {
+        _verified = false;
+        if(_engine->getVerifyPeer() > 0)
+        {
+            throw;
+        }
+    }
+    _engine->verifyPeer(_host, info, toString());
     _state = StateHandshakeComplete;
 
     if(_instance->engine()->securityTraceLevel() >= 1)
@@ -757,12 +767,11 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
         string sslCipherName;
         string sslKeyExchangeAlgorithm;
         string sslProtocolName;
-        SecPkgContext_ConnectionInfo info;
-        if(QueryContextAttributes(&_ssl, SECPKG_ATTR_CONNECTION_INFO, &info) == SEC_E_OK)
+        if(QueryContextAttributes(&_ssl, SECPKG_ATTR_CONNECTION_INFO, &connInfo) == SEC_E_OK)
         {
-            sslCipherName = _engine->getCipherName(info.aiCipher);
-            sslKeyExchangeAlgorithm = _engine->getCipherName(info.aiExch);
-            sslProtocolName = protocolName(info.dwProtocol);
+            sslCipherName = _engine->getCipherName(connInfo.aiCipher);
+            sslKeyExchangeAlgorithm = _engine->getCipherName(connInfo.aiExch);
+            sslProtocolName = protocolName(connInfo.dwProtocol);
         }
 
         Trace out(_instance->logger(), _instance->traceCategory());
@@ -908,7 +917,7 @@ SChannel::TransceiverI::startWrite(IceInternal::Buffer& buffer)
         _bufferedW = encryptMessage(buffer);
     }
 
-    return _delegate->startWrite(_writeBuffer) && _bufferedW == (buffer.b.end() - buffer.i);
+    return _delegate->startWrite(_writeBuffer) && _bufferedW == static_cast<size_t>((buffer.b.end() - buffer.i));
 }
 
 void

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.h

@@ -1,15 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SCHANNELTRANSCEIVER_I_H
 #define ICESSL_SCHANNELTRANSCEIVER_I_H
 
+#ifdef _WIN32
+
 #include <IceSSL/Config.h>
 #include <IceSSL/InstanceF.h>
 #include <IceSSL/Plugin.h>
@@ -86,6 +83,7 @@ private:
         StateHandshakeNotStarted,
         StateHandshakeReadContinue,
         StateHandshakeWriteContinue,
+        StateHandshakeWriteNoContinue,
         StateHandshakeComplete
     };
 
@@ -96,6 +94,7 @@ private:
     const bool _incoming;
     const IceInternal::TransceiverPtr _delegate;
     State _state;
+    DWORD _ctxFlags;
 
     //
     // Buffered encrypted data that has not been written.
@@ -129,3 +128,5 @@ typedef IceUtil::Handle<TransceiverI> TransceiverIPtr;
 } // IceSSL namespace end
 
 #endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SSLEngine.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/SSLEngine.h>
 #include <IceSSL/TrustManager.h>
@@ -114,6 +109,12 @@ IceSSL::SSLEngine::initialize()
     //
     _checkCertName = properties->getPropertyAsIntWithDefault(propPrefix + "CheckCertName", 0) > 0;
 
+    //
+    // CheckCertName > 1 enables SNI, the SNI extension applies to client connections,
+    // indicating the hostname to the server (must be DNS hostname, not an IP address).
+    //
+    _serverNameIndication = properties->getPropertyAsIntWithDefault(propPrefix + "CheckCertName", 0) > 1;
+
     //
     // VerifyDepthMax establishes the maximum length of a peer's certificate
     // chain, including the peer's certificate. A value of 0 means there is
@@ -128,9 +129,8 @@ IceSSL::SSLEngine::initialize()
 
     if(_verifyPeer < 0 || _verifyPeer > 2)
     {
-        PluginInitializationException ex(__FILE__, __LINE__);
-        ex.reason = "IceSSL: invalid value for " + propPrefix + "VerifyPeer";
-        throw ex;
+        throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: invalid value for " + propPrefix +
+                                            "VerifyPeer");
     }
 
     _securityTraceLevel = properties->getPropertyAsInt("IceSSL.Trace.Security");
@@ -207,27 +207,25 @@ IceSSL::SSLEngine::verifyPeerCertName(const string& address, const ConnectionInf
         if(!certNameOK)
         {
             ostringstream ostr;
-            ostr << "IceSSL: certificate validation failure: "
-                 << (isIpAddress ? "IP address mismatch" : "Hostname mismatch");
+            ostr << "IceSSL: ";
+            if(_verifyPeer > 0)
+            {
+                ostr << "ignoring ";
+            }
+            ostr << "certificate verification failure " << (isIpAddress ? "IP address mismatch" : "Hostname mismatch");
             string msg = ostr.str();
             if(_securityTraceLevel >= 1)
             {
                 Trace out(_logger, _securityTraceCategory);
                 out << msg;
             }
-
-            if(_verifyPeer > 0)
-            {
-                SecurityException ex(__FILE__, __LINE__);
-                ex.reason = msg;
-                throw ex;
-            }
+            throw SecurityException(__FILE__, __LINE__, msg);
         }
     }
 }
 
 void
-IceSSL::SSLEngine::verifyPeer(const string& address, const ConnectionInfoPtr& info, const string& desc)
+IceSSL::SSLEngine::verifyPeer(const string& /*address*/, const ConnectionInfoPtr& info, const string& desc)
 {
     const CertificateVerifierPtr verifier = getCertificateVerifier();
     if(_verifyDepthMax > 0 && static_cast<int>(info->certs.size()) > _verifyDepthMax)
@@ -241,9 +239,7 @@ IceSSL::SSLEngine::verifyPeer(const string& address, const ConnectionInfoPtr& in
         {
             _logger->trace(_securityTraceCategory, msg + "\n" + desc);
         }
-        SecurityException ex(__FILE__, __LINE__);
-        ex.reason = msg;
-        throw ex;
+        throw SecurityException(__FILE__, __LINE__, msg);
     }
 
     if(!_trustManager->verify(info, desc))
@@ -253,9 +249,7 @@ IceSSL::SSLEngine::verifyPeer(const string& address, const ConnectionInfoPtr& in
         {
             _logger->trace(_securityTraceCategory, msg + "\n" + desc);
         }
-        SecurityException ex(__FILE__, __LINE__);
-        ex.reason = msg;
-        throw ex;
+        throw SecurityException(__FILE__, __LINE__, msg);
     }
 
     if(verifier && !verifier->verify(info))
@@ -265,9 +259,7 @@ IceSSL::SSLEngine::verifyPeer(const string& address, const ConnectionInfoPtr& in
         {
             _logger->trace(_securityTraceCategory, msg + "\n" + desc);
         }
-        SecurityException ex(__FILE__, __LINE__);
-        ex.reason = msg;
-        throw ex;
+        throw SecurityException(__FILE__, __LINE__, msg);
     }
 }
 
@@ -277,6 +269,12 @@ IceSSL::SSLEngine::getCheckCertName() const
     return _checkCertName;
 }
 
+bool
+IceSSL::SSLEngine::getServerNameIndication() const
+{
+    return _serverNameIndication;
+}
+
 int
 IceSSL::SSLEngine::getVerifyPeer() const
 {