zeroc-ice 3.7.0 → 3.7.5

data/ext/ice/cpp/src/IceSSL/SSLEngine.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_ENGINE_H
 #define ICESSL_ENGINE_H
@@ -68,6 +63,7 @@ public:
     void setPassword(const std::string& password);
 
     bool getCheckCertName() const;
+    bool getServerNameIndication() const;
     int getVerifyPeer() const;
     int securityTraceLevel() const;
     std::string securityTraceCategory() const;
@@ -88,6 +84,7 @@ private:
     PasswordPromptPtr _prompt;
 
     bool _checkCertName;
+    bool _serverNameIndication;
     int _verifyDepthMax;
     int _verifyPeer;
     int _securityTraceLevel;

data/ext/ice/cpp/src/IceSSL/SSLEngineF.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_ENGINE_F_H
 #define ICESSL_ENGINE_F_H

data/ext/ice/cpp/src/IceSSL/SecureTransportCertificateI.cpp

@@ -1,11 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
+
+//
+// Disable deprecation warnings for SecCertificateCopyNormalizedIssuerContent and
+// SecCertificateCopyNormalizedSubjectContent
 //
-// **********************************************************************
+#include <IceUtil/DisableWarnings.h>
 
 #include <IceSSL/Plugin.h>
 #include <IceSSL/SecureTransport.h>
@@ -82,7 +83,11 @@ class ASN1Parser
 {
 public:
 
-    ASN1Parser(CFDataRef data) : _data(CFDataGetBytePtr(data)), _length(CFDataGetLength(data)), _p(_data), _next(0)
+    ASN1Parser(CFDataRef data) :
+        _data(CFDataGetBytePtr(data)),
+        _length(static_cast<size_t>(CFDataGetLength(data))),
+        _p(_data),
+        _next(0)
     {
     }
 
@@ -169,7 +174,7 @@ public:
     parseUTF8String()
     {
         int length = parseLength(0);
-        string v(reinterpret_cast<const char*>(_p), length);
+        string v(reinterpret_cast<const char*>(_p), static_cast<size_t>(length));
         _p += length;
         return v;
     }
@@ -220,8 +225,8 @@ private:
 
 #endif
 
-class SecureTransportCertificateI : public IceSSL::SecureTransport::Certificate,
-                                    public IceSSL::CertificateI
+class SecureTransportCertificateI ICE_FINAL : public IceSSL::SecureTransport::Certificate,
+                                              public IceSSL::CertificateI
 {
 public:
 
@@ -298,8 +303,8 @@ getX509Name(SecCertificateRef cert, CFTypeRef key)
     if(property)
     {
         CFArrayRef dn = static_cast<CFArrayRef>(CFDictionaryGetValue(property.get(), kSecPropertyKeyValue));
-        int size = CFArrayGetCount(dn);
-        for(int i = 0; i < size; ++i)
+        CFIndex size = CFArrayGetCount(dn);
+        for(CFIndex i = 0; i < size; ++i)
         {
             CFDictionaryRef dict = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(dn, i));
             rdnPairs.push_front(make_pair(
@@ -322,9 +327,9 @@ getX509AltName(SecCertificateRef cert, CFTypeRef key)
     if(property)
     {
         CFArrayRef names = static_cast<CFArrayRef>(CFDictionaryGetValue(property.get(), kSecPropertyKeyValue));
-        int size = CFArrayGetCount(names);
+        CFIndex size = CFArrayGetCount(names);
 
-        for(int i = 0; i < size; ++i)
+        for(CFIndex i = 0; i < size; ++i)
         {
             CFDictionaryRef dict = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(names, i));
 
@@ -346,15 +351,15 @@ getX509AltName(SecCertificateRef cert, CFTypeRef key)
                 {
                     CFArrayRef section = (CFArrayRef)v;
                     ostringstream os;
-                    for(int i = 0, count = CFArrayGetCount(section); i < count;)
+                    for(CFIndex j = 0, count = CFArrayGetCount(section); j < count;)
                     {
-                        CFDictionaryRef d = (CFDictionaryRef)CFArrayGetValueAtIndex(section, i);
+                        CFDictionaryRef d = (CFDictionaryRef)CFArrayGetValueAtIndex(section, j);
 
                         CFStringRef sectionLabel = static_cast<CFStringRef>(CFDictionaryGetValue(d, kSecPropertyKeyLabel));
                         CFStringRef sectionValue = static_cast<CFStringRef>(CFDictionaryGetValue(d, kSecPropertyKeyValue));
 
                         os << certificateOIDAlias(fromCFString(sectionLabel)) << "=" << fromCFString(sectionValue);
-                        if(++i < count)
+                        if(++j < count)
                         {
                             os << ",";
                         }
@@ -439,7 +444,7 @@ SecureTransportCertificateI::getAuthorityKeyIdentifier() const
     if(property)
     {
         CFTypeRef type = 0;
-        CFTypeRef value;
+        CFTypeRef value = 0;
         if(CFDictionaryGetValueIfPresent(property.get(), kSecPropertyKeyType, &type))
         {
             if(CFEqual(type, kSecPropertyTypeSection))
@@ -458,8 +463,8 @@ SecureTransportCertificateI::getAuthorityKeyIdentifier() const
             {
                 CFDataRef data = static_cast<CFDataRef>(
                     CFDictionaryGetValue(static_cast<CFDictionaryRef>(value), kSecPropertyKeyValue));
-                keyid.resize(CFDataGetLength(data));
-                memcpy(&keyid[0], CFDataGetBytePtr(data), CFDataGetLength(data));
+                keyid.resize(static_cast<size_t>(CFDataGetLength(data)));
+                memcpy(&keyid[0], CFDataGetBytePtr(data), static_cast<size_t>(CFDataGetLength(data)));
             }
         }
     }
@@ -478,7 +483,7 @@ SecureTransportCertificateI::getSubjectKeyIdentifier() const
     if(property)
     {
         CFTypeRef type = 0;
-        CFTypeRef value;
+        CFTypeRef value = 0;
         if(CFDictionaryGetValueIfPresent(property.get(), kSecPropertyKeyType, &type))
         {
             if(CFEqual(type, kSecPropertyTypeSection))
@@ -497,8 +502,8 @@ SecureTransportCertificateI::getSubjectKeyIdentifier() const
             {
                 CFDataRef data = static_cast<CFDataRef>(
                     CFDictionaryGetValue(static_cast<CFDictionaryRef>(value), kSecPropertyKeyValue));
-                keyid.resize(CFDataGetLength(data));
-                memcpy(&keyid[0], CFDataGetBytePtr(data), CFDataGetLength(data));
+                keyid.resize(static_cast<size_t>(CFDataGetLength(data)));
+                memcpy(&keyid[0], CFDataGetBytePtr(data), static_cast<size_t>(CFDataGetLength(data)));
             }
         }
     }
@@ -544,7 +549,7 @@ SecureTransportCertificateI::verify(const IceSSL::CertificatePtr& cert) const
         {
             UniqueRef<SecPolicyRef> policy(SecPolicyCreateBasicX509());
             UniqueRef<SecTrustRef> trust;
-            OSStatus err = 0;;
+            OSStatus err = 0;
             if((err = SecTrustCreateWithCertificates(_cert.get(), policy.get(), &trust.get())))
             {
                 throw CertificateEncodingException(__FILE__, __LINE__, sslErrorToString(err));
@@ -579,7 +584,7 @@ SecureTransportCertificateI::encode() const
     ostringstream os;
     os << "-----BEGIN CERTIFICATE-----\n";
     os << IceInternal::Base64::encode(data);
-    os << "-----END CERTIFICATE-----\n";
+    os << "\n-----END CERTIFICATE-----\n";
     return os.str();
 #else // macOS
     UniqueRef<CFDataRef> exported;
@@ -588,7 +593,8 @@ SecureTransportCertificateI::encode() const
     {
         throw CertificateEncodingException(__FILE__, __LINE__, sslErrorToString(err));
     }
-    return string(reinterpret_cast<const char*>(CFDataGetBytePtr(exported.get())), CFDataGetLength(exported.get()));
+    return string(reinterpret_cast<const char*>(CFDataGetBytePtr(exported.get())),
+                  static_cast<size_t>(CFDataGetLength(exported.get())));
 #endif
 }
 
@@ -810,23 +816,23 @@ IceSSL::SecureTransport::CertificatePtr
 IceSSL::SecureTransport::Certificate::decode(const std::string& encoding)
 {
 #ifdef ICE_USE_SECURE_TRANSPORT_IOS
-    string::size_type size, startpos, endpos = 0;
-    startpos = encoding.find("-----BEGIN CERTIFICATE-----", endpos);
+    string::size_type size = 0;
+    string::size_type startpos = 0;
+    startpos = encoding.find("-----BEGIN CERTIFICATE-----", 0);
     if(startpos != string::npos)
     {
         startpos += sizeof("-----BEGIN CERTIFICATE-----");
-        endpos = encoding.find("-----END CERTIFICATE-----", startpos);
+        string::size_type endpos = encoding.find("-----END CERTIFICATE-----", startpos);
         size = endpos - startpos;
     }
     else
     {
         startpos = 0;
-        endpos = string::npos;
         size = encoding.size();
     }
 
     vector<unsigned char> data(IceInternal::Base64::decode(string(&encoding[startpos], size)));
-    UniqueRef<CFDataRef> certdata(CFDataCreate(kCFAllocatorDefault, &data[0], data.size()));
+    UniqueRef<CFDataRef> certdata(CFDataCreate(kCFAllocatorDefault, &data[0], static_cast<CFIndex>(data.size())));
     SecCertificateRef cert = SecCertificateCreateWithData(0, certdata.get());
     if(!cert)
     {
@@ -838,7 +844,7 @@ IceSSL::SecureTransport::Certificate::decode(const std::string& encoding)
     UniqueRef<CFDataRef> data(
         CFDataCreateWithBytesNoCopy(kCFAllocatorDefault,
                                     reinterpret_cast<const UInt8*>(encoding.c_str()),
-                                    encoding.size(), kCFAllocatorNull));
+                                    static_cast<CFIndex>(encoding.size()), kCFAllocatorNull));
 
     SecExternalFormat format = kSecFormatUnknown;
     SecExternalItemType type = kSecItemTypeCertificate;

data/ext/ice/cpp/src/IceSSL/SecureTransportEngine.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/Config.h>
 
@@ -132,7 +127,7 @@ CiphersHelper::initialize()
         _ciphers["RSA_EXPORT_WITH_RC4_40_MD5"] = SSL_RSA_EXPORT_WITH_RC4_40_MD5;
         _ciphers["RSA_WITH_RC4_128_MD5"] = SSL_RSA_WITH_RC4_128_MD5;
         _ciphers["RSA_WITH_RC4_128_SHA"] = SSL_RSA_WITH_RC4_128_SHA;
-        _ciphers["RSA_EXPORT_WITH_RC2_CBC_40_MD5"] =    SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5;
+        _ciphers["RSA_EXPORT_WITH_RC2_CBC_40_MD5"] = SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5;
         _ciphers["RSA_WITH_IDEA_CBC_SHA"] = SSL_RSA_WITH_IDEA_CBC_SHA;
         _ciphers["RSA_EXPORT_WITH_DES40_CBC_SHA"] = SSL_RSA_EXPORT_WITH_DES40_CBC_SHA;
         _ciphers["RSA_WITH_DES_CBC_SHA"] = SSL_RSA_WITH_DES_CBC_SHA;
@@ -344,6 +339,16 @@ CiphersHelper::initialize()
         _ciphers["RSA_WITH_DES_CBC_MD5"] = SSL_RSA_WITH_DES_CBC_MD5;
         _ciphers["RSA_WITH_3DES_EDE_CBC_MD5"] = SSL_RSA_WITH_3DES_EDE_CBC_MD5;
         _ciphers["NO_SUCH_CIPHERSUITE"] = SSL_NO_SUCH_CIPHERSUITE;
+
+        //
+        // TLS 1.3 standard cipher suites
+        //
+        _ciphers["TLS_AES_128_GCM_SHA256"] = TLS_AES_128_GCM_SHA256;
+        _ciphers["TLS_AES_256_GCM_SHA384"] = TLS_AES_256_GCM_SHA384;
+        _ciphers["TLS_CHACHA20_POLY1305_SHA256"] = TLS_CHACHA20_POLY1305_SHA256;
+        _ciphers["TLS_AES_128_CCM_SHA256"] = TLS_AES_128_CCM_SHA256;
+        _ciphers["TLS_AES_128_CCM_8_SHA256"] = TLS_AES_128_CCM_8_SHA256;
+
     }
 }
 
@@ -744,6 +749,21 @@ CiphersHelper::cipherName(SSLCipherSuite cipher)
             return "RSA_WITH_DES_CBC_MD5";
         case SSL_RSA_WITH_3DES_EDE_CBC_MD5:
             return "RSA_WITH_3DES_EDE_CBC_MD5";
+
+        //
+        //TLS 1.3 standard cipher suites
+        //
+        case TLS_AES_128_GCM_SHA256:
+            return "TLS_AES_128_GCM_SHA256";
+        case TLS_AES_256_GCM_SHA384:
+            return "TLS_AES_256_GCM_SHA384";
+        case TLS_CHACHA20_POLY1305_SHA256:
+            return "TLS_CHACHA20_POLY1305_SHA256";
+        case TLS_AES_128_CCM_SHA256:
+            return "TLS_AES_128_CCM_SHA256";
+        case TLS_AES_128_CCM_8_SHA256:
+            return "TLS_AES_128_CCM_8_SHA256";
+
         default:
             return "";
     }
@@ -775,6 +795,10 @@ parseProtocol(const string& p)
     {
         return kTLSProtocol12;
     }
+    else if(prot == "TLS1_3" || prot == "TLSV1_3")
+    {
+        return kTLSProtocol13;
+    }
     else
     {
         throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unrecognized protocol `" + p + "'");
@@ -857,7 +881,6 @@ IceSSL::SecureTransport::SSLEngine::initialize()
     PasswordPromptPtr passwordPrompt = getPasswordPrompt();
 
     string certFile = properties->getProperty("IceSSL.CertFile");
-    string keyFile = properties->getProperty("IceSSL.KeyFile");
     string findCert = properties->getProperty("IceSSL.FindCert");
     string keychain = properties->getProperty("IceSSL.Keychain");
     string keychainPassword = properties->getProperty("IceSSL.KeychainPassword");
@@ -871,21 +894,24 @@ IceSSL::SecureTransport::SSLEngine::initialize()
                                                 "IceSSL: invalid value for IceSSL.CertFile:\n" + certFile);
         }
         vector<string> keyFiles;
-        if(!keyFile.empty())
         {
-            if(!IceUtilInternal::splitString(keyFile, IceUtilInternal::pathsep, keyFiles) || keyFiles.size() > 2)
-            {
-                throw PluginInitializationException(__FILE__, __LINE__,
-                                                    "IceSSL: invalid value for IceSSL.KeyFile:\n" + keyFile);
-            }
-            if(files.size() != keyFiles.size())
+            string keyFile = properties->getProperty("IceSSL.KeyFile");
+            if(!keyFile.empty())
             {
-                throw PluginInitializationException(__FILE__, __LINE__,
-                                                    "IceSSL: IceSSL.KeyFile does not agree with IceSSL.CertFile");
+                if(!IceUtilInternal::splitString(keyFile, IceUtilInternal::pathsep, keyFiles) || keyFiles.size() > 2)
+                {
+                    throw PluginInitializationException(__FILE__, __LINE__,
+                                                        "IceSSL: invalid value for IceSSL.KeyFile:\n" + keyFile);
+                }
+                if(files.size() != keyFiles.size())
+                {
+                    throw PluginInitializationException(__FILE__, __LINE__,
+                                                        "IceSSL: IceSSL.KeyFile does not agree with IceSSL.CertFile");
+                }
             }
         }
 
-        for(int i = 0; i < files.size(); ++i)
+        for(size_t i = 0; i < files.size(); ++i)
         {
             string file = files[i];
             string keyFile = keyFiles.empty() ? "" : keyFiles[i];

data/ext/ice/cpp/src/IceSSL/SecureTransportEngine.h

@@ -1,15 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SECURE_TRANSPORT_ENGINE_H
 #define ICESSL_SECURE_TRANSPORT_ENGINE_H
 
+#ifdef __APPLE__
+
 #include <IceSSL/SSLEngine.h>
 #include <Ice/UniqueRef.h>
 
@@ -58,3 +55,5 @@ private:
 } // IceSSL namespace end
 
 #endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SecureTransportEngineF.h

@@ -1,15 +1,11 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SECURE_TRANSPORT_ENGINE_F_H
 #define ICESSL_SECURE_TRANSPORT_ENGINE_F_H
 
+#ifdef __APPLE__
 #include <IceSSL/Plugin.h>
 #include <IceUtil/Shared.h>
 #include <Ice/Handle.h>
@@ -29,3 +25,5 @@ typedef IceInternal::Handle<SSLEngine> SSLEnginePtr;
 }
 
 #endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SecureTransportPluginI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/PluginI.h>
 #include <IceSSL/SecureTransport.h>

data/ext/ice/cpp/src/IceSSL/SecureTransportTransceiverI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2017 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/SecureTransportTransceiverI.h>
 #include <IceSSL/Instance.h>
@@ -125,7 +120,8 @@ checkTrustResult(SecTrustRef trust,
         //
         if(engine->getCheckCertName() && !host.empty())
         {
-            UniqueRef<SecPolicyRef> policy(SecPolicyCreateSSL(false, toCFString(host)));
+            UniqueRef<CFStringRef> hostref(toCFString(host));
+            UniqueRef<SecPolicyRef> policy(SecPolicyCreateSSL(true, hostref.get()));
             UniqueRef<CFArrayRef> policies;
             if((err = SecTrustCopyPolicies(trust, &policies.get())))
             {
@@ -215,8 +211,18 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
     // Limit the size of packets passed to SSLWrite/SSLRead to avoid
     // blocking and holding too much memory.
     //
-    _maxSendPacketSize = std::max(512, IceInternal::getSendBufferSize(_delegate->getNativeInfo()->fd()));
-    _maxRecvPacketSize = std::max(512, IceInternal::getRecvBufferSize(_delegate->getNativeInfo()->fd()));
+    if(_delegate->getNativeInfo()->fd() != INVALID_SOCKET)
+    {
+        _maxSendPacketSize =
+            static_cast<size_t>(std::max(512, IceInternal::getSendBufferSize(_delegate->getNativeInfo()->fd())));
+        _maxRecvPacketSize =
+            static_cast<size_t>(std::max(512, IceInternal::getRecvBufferSize(_delegate->getNativeInfo()->fd())));
+    }
+    else
+    {
+        _maxSendPacketSize = 128 * 1024; // 128KB
+        _maxRecvPacketSize = 128 * 1024; // 128KB
+    }
 
     OSStatus err = 0;
     if(!_ssl)
@@ -236,6 +242,18 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
             throw SecurityException(__FILE__, __LINE__, "IceSSL: setting SSL connection failed\n" +
                                     sslErrorToString(err));
         }
+
+        //
+        // Enable SNI
+        //
+        if(!_incoming && _engine->getServerNameIndication() && !_host.empty() && !IceInternal::isIpAddress(_host))
+        {
+            if((err = SSLSetPeerDomainName(_ssl.get(), _host.data(), _host.length())))
+            {
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: setting SNI host failed `" + _host + "'\n" +
+                                        sslErrorToString(err));
+            }
+        }
     }
 
     SSLSessionState state;
@@ -253,8 +271,8 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
         }
         else if(err == errSSLWouldBlock)
         {
-            assert(_flags & SSLWantRead || _flags & SSLWantWrite);
-            return _flags & SSLWantRead ? IceInternal::SocketOperationRead : IceInternal::SocketOperationWrite;
+            assert(_tflags & SSLWantRead || _tflags & SSLWantWrite);
+            return _tflags & SSLWantRead ? IceInternal::SocketOperationRead : IceInternal::SocketOperationWrite;
         }
         else if(err == errSSLPeerAuthCompleted)
         {
@@ -286,7 +304,7 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
         throw ProtocolException(__FILE__, __LINE__, os.str());
     }
 
-    for(int i = 0, count = SecTrustGetCertificateCount(_trust.get()); i < count; ++i)
+    for(CFIndex i = 0, count = SecTrustGetCertificateCount(_trust.get()); i < count; ++i)
     {
         SecCertificateRef cert = SecTrustGetCertificateAtIndex(_trust.get(), i);
         CFRetain(cert);
@@ -294,9 +312,11 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
     }
 
     assert(_ssl);
-    SSLCipherSuite cipher;
-    SSLGetNegotiatedCipher(_ssl.get(), &cipher);
-    _cipher = _engine->getCipherName(cipher);
+    {
+        SSLCipherSuite cipher;
+        SSLGetNegotiatedCipher(_ssl.get(), &cipher);
+        _cipher = _engine->getCipherName(cipher);
+    }
 
     _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString());
 
@@ -381,7 +401,7 @@ IceSSL::SecureTransport::TransceiverI::write(IceInternal::Buffer& buf)
                 {
                     _buffered = processed;
                 }
-                assert(_flags & SSLWantWrite);
+                assert(_tflags & SSLWantWrite);
                 return IceInternal::SocketOperationWrite;
             }
 
@@ -420,9 +440,9 @@ IceSSL::SecureTransport::TransceiverI::write(IceInternal::Buffer& buf)
             buf.i += processed;
         }
 
-        if(packetSize > buf.b.end() - buf.i)
+        if(packetSize > static_cast<size_t>(buf.b.end() - buf.i))
         {
-            packetSize = buf.b.end() - buf.i;
+            packetSize = static_cast<size_t>(buf.b.end() - buf.i);
         }
     }
 
@@ -454,7 +474,7 @@ IceSSL::SecureTransport::TransceiverI::read(IceInternal::Buffer& buf)
             if(err == errSSLWouldBlock)
             {
                 buf.i += processed;
-                assert(_flags & SSLWantRead);
+                assert(_tflags & SSLWantRead);
                 return IceInternal::SocketOperationRead;
             }
 
@@ -485,9 +505,9 @@ IceSSL::SecureTransport::TransceiverI::read(IceInternal::Buffer& buf)
 
         buf.i += processed;
 
-        if(packetSize > buf.b.end() - buf.i)
+        if(packetSize > static_cast<size_t>(buf.b.end() - buf.i))
         {
-            packetSize = buf.b.end() - buf.i;
+            packetSize = static_cast<size_t>(buf.b.end() - buf.i);
         }
     }
 
@@ -570,7 +590,7 @@ IceSSL::SecureTransport::TransceiverI::~TransceiverI()
 OSStatus
 IceSSL::SecureTransport::TransceiverI::writeRaw(const char* data, size_t* length) const
 {
-    _flags &= ~SSLWantWrite;
+    _tflags &= ~SSLWantWrite;
 
     try
     {
@@ -578,8 +598,8 @@ IceSSL::SecureTransport::TransceiverI::writeRaw(const char* data, size_t* length
         IceInternal::SocketOperation op = _delegate->write(buf);
         if(op == IceInternal::SocketOperationWrite)
         {
-            *length = buf.i - buf.b.begin();
-            _flags |= SSLWantWrite;
+            *length = static_cast<size_t>(buf.i - buf.b.begin());
+            _tflags |= SSLWantWrite;
             return errSSLWouldBlock;
         }
         assert(op == IceInternal::SocketOperationNone);
@@ -603,7 +623,7 @@ IceSSL::SecureTransport::TransceiverI::writeRaw(const char* data, size_t* length
 OSStatus
 IceSSL::SecureTransport::TransceiverI::readRaw(char* data, size_t* length) const
 {
-    _flags &= ~SSLWantRead;
+    _tflags &= ~SSLWantRead;
 
     try
     {
@@ -611,8 +631,8 @@ IceSSL::SecureTransport::TransceiverI::readRaw(char* data, size_t* length) const
         IceInternal::SocketOperation op = _delegate->read(buf);
         if(op == IceInternal::SocketOperationRead)
         {
-            *length = buf.i - buf.b.begin();
-            _flags |= SSLWantRead;
+            *length = static_cast<size_t>(buf.i - buf.b.begin());
+            _tflags |= SSLWantRead;
             return errSSLWouldBlock;
         }
         assert(op == IceInternal::SocketOperationNone);