zeroc-ice 3.7.1 → 3.7.2

data/ext/ice/cpp/src/IceSSL/OpenSSLTransceiverI.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_OPENSSL_TRANSCEIVER_I_H
 #define ICESSL_OPENSSL_TRANSCEIVER_I_H
@@ -61,10 +56,8 @@ private:
     TransceiverI(const InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool);
     virtual ~TransceiverI();
 
-#ifdef ICE_USE_IOCP
     bool receive();
     bool send();
-#endif
 
     friend class IceSSL::OpenSSL::SSLEngine;
 
@@ -80,14 +73,12 @@ private:
     bool _verified;
 
     SSL* _ssl;
-#ifdef ICE_USE_IOCP
-    BIO* _iocpBio;
+    BIO* _memBio;
     IceInternal::Buffer _writeBuffer;
     IceInternal::Buffer _readBuffer;
     int _sentBytes;
     size_t _maxSendPacketSize;
     size_t _maxRecvPacketSize;
-#endif
 };
 typedef IceUtil::Handle<TransceiverI> TransceiverIPtr;
 

data/ext/ice/cpp/src/IceSSL/OpenSSLUtil.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/OpenSSLUtil.h>
 

data/ext/ice/cpp/src/IceSSL/OpenSSLUtil.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_OPENSSL_UTIL_I_H
 #define ICESSL_OPENSSL_UTIL_I_H

data/ext/ice/cpp/src/IceSSL/PluginI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/PluginI.h>
 #include <IceSSL/Instance.h>

data/ext/ice/cpp/src/IceSSL/PluginI.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_PLUGIN_I_H
 #define ICESSL_PLUGIN_I_H

data/ext/ice/cpp/src/IceSSL/RFC2253.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceUtil/StringUtil.h>
 
@@ -187,7 +182,6 @@ hexToInt(char v)
         return 10 + (v - 'A');
     }
     throw ParseException(__FILE__, __LINE__, "unescape: invalid hex pair");
-    return 0; // To satisfy the compiler.
 }
 
 static char

data/ext/ice/cpp/src/IceSSL/RFC2253.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_RFC_2253_H
 #define ICESSL_RFC_2253_H

data/ext/ice/cpp/src/IceSSL/SChannelCertificateI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/Plugin.h>
 #include <IceSSL/SChannel.h>
@@ -165,17 +160,17 @@ filetimeToTime(FILETIME ftime)
 }
 
 string
-certNameToString(CERT_NAME_BLOB* name)
+certNameToString(CERT_NAME_BLOB* certName)
 {
-    assert(name);
+    assert(certName);
     DWORD length = 0;
-    if(!(length = CertNameToStr(X509_ASN_ENCODING, name, CERT_OID_NAME_STR|CERT_NAME_STR_REVERSE_FLAG, 0, 0)))
+    if((length = CertNameToStr(X509_ASN_ENCODING, certName, CERT_OID_NAME_STR|CERT_NAME_STR_REVERSE_FLAG, 0, 0)) == 0)
     {
         throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
     }
 
     vector<char> buffer(length);
-    if(!CertNameToStr(X509_ASN_ENCODING, name, CERT_OID_NAME_STR|CERT_NAME_STR_REVERSE_FLAG, &buffer[0], length))
+    if(!CertNameToStr(X509_ASN_ENCODING, certName, CERT_OID_NAME_STR|CERT_NAME_STR_REVERSE_FLAG, &buffer[0], length))
     {
         throw CertificateEncodingException(__FILE__, __LINE__,  IceUtilInternal::lastErrorToString());
     }

data/ext/ice/cpp/src/IceSSL/SChannelEngine.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/SChannelEngine.h>
 #include <IceSSL/SChannelTransceiverI.h>
@@ -19,10 +14,20 @@
 
 #include <IceUtil/StringUtil.h>
 #include <IceUtil/FileUtil.h>
+#include <IceUtil/MutexPtrLock.h>
 #include <Ice/UUID.h>
 
 #include <wincrypt.h>
 
+//
+// SP_PROT_TLS1_3 is new in v10.0.15021 SDK
+//
+#ifndef SP_PROT_TLS1_3
+#    define SP_PROT_TLS1_3_SERVER 0x00001000
+#    define SP_PROT_TLS1_3_CLIENT 0x00002000
+#    define SP_PROT_TLS1_3 (SP_PROT_TLS1_3_SERVER | SP_PROT_TLS1_3_CLIENT)
+#endif
+
 //
 // CALG_ECDH_EPHEM algorithm constant is not defined in older version of the SDK headers
 //
@@ -32,7 +37,7 @@
 const int ICESSL_CALG_ECDH_EPHEM = 0x0000AE06;
 
 //
-// COMPILERFIX SCH_USE_STRONG_CRYPTO not defined with VC90
+// COMPILERFIX SCH_USE_STRONG_CRYPTO not defined with v90
 //
 #if defined(_MSC_VER) && (_MSC_VER <= 1600)
 #  ifndef SCH_USE_STRONG_CRYPTO
@@ -54,6 +59,26 @@ Shared* SChannel::upCast(SChannel::SSLEngine* p)
 namespace
 {
 
+IceUtil::Mutex* globalMutex;
+
+class Init
+{
+public:
+
+    Init()
+    {
+        globalMutex = new IceUtil::Mutex;
+    }
+
+    ~Init()
+    {
+        delete globalMutex;
+        globalMutex = 0;
+    }
+};
+
+Init init;
+
 void
 addMatchingCertificates(HCERTSTORE source, HCERTSTORE target, DWORD findType, const void* findParam)
 {
@@ -61,7 +86,7 @@ addMatchingCertificates(HCERTSTORE source, HCERTSTORE target, DWORD findType, co
     do
     {
         if((next = CertFindCertificateInStore(source, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
-                                              findType, findParam, next)))
+                                              findType, findParam, next)) != 0)
         {
             if(!CertAddCertificateContextToStore(target, next, CERT_STORE_ADD_ALWAYS, 0))
             {
@@ -74,7 +99,7 @@ addMatchingCertificates(HCERTSTORE source, HCERTSTORE target, DWORD findType, co
 }
 
 vector<PCCERT_CONTEXT>
-findCertificates(const string& location, const string& name, const string& value, vector<HCERTSTORE>& stores)
+findCertificates(const string& location, const string& storeName, const string& value, vector<HCERTSTORE>& stores)
 {
     DWORD storeLoc;
     if(location == "CurrentUser")
@@ -86,10 +111,10 @@ findCertificates(const string& location, const string& name, const string& value
         storeLoc = CERT_SYSTEM_STORE_LOCAL_MACHINE;
     }
 
-    HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, 0, storeLoc, Ice::stringToWstring(name).c_str());
+    HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, 0, storeLoc, Ice::stringToWstring(storeName).c_str());
     if(!store)
     {
-        throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: failed to open certificate store `" + name +
+        throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: failed to open certificate store `" + storeName +
                                             "':\n" + IceUtilInternal::lastErrorToString());
     }
 
@@ -253,7 +278,7 @@ findCertificates(const string& location, const string& name, const string& value
                     do
                     {
                         if((next = CertFindCertificateInStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0,
-                                                              CERT_FIND_ANY, 0, next)))
+                                                              CERT_FIND_ANY, 0, next)) != 0)
                         {
                             if(CertCompareIntegerBlob(&serial, &next->pCertInfo->SerialNumber))
                             {
@@ -295,7 +320,7 @@ findCertificates(const string& location, const string& name, const string& value
         do
         {
             if((next = CertFindCertificateInStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, CERT_FIND_ANY, 0,
-                                                  next)))
+                                                  next)) != 0)
             {
                 certs.push_back(next);
             }
@@ -399,23 +424,23 @@ parseProtocols(const StringSeq& protocols)
 
         if(prot == "SSL3" || prot == "SSLV3")
         {
-            v |= SP_PROT_SSL3_SERVER;
-            v |= SP_PROT_SSL3_CLIENT;
+            v |= SP_PROT_SSL3;
         }
         else if(prot == "TLS" || prot == "TLS1" || prot == "TLSV1" || prot == "TLS1_0" || prot == "TLSV1_0")
         {
-            v |= SP_PROT_TLS1_SERVER;
-            v |= SP_PROT_TLS1_CLIENT;
+            v |= SP_PROT_TLS1;
         }
         else if(prot == "TLS1_1" || prot == "TLSV1_1")
         {
-            v |= SP_PROT_TLS1_1_SERVER;
-            v |= SP_PROT_TLS1_1_CLIENT;
+            v |= SP_PROT_TLS1_1;
         }
         else if(prot == "TLS1_2" || prot == "TLSV1_2")
         {
-            v |= SP_PROT_TLS1_2_SERVER;
-            v |= SP_PROT_TLS1_2_CLIENT;
+            v |= SP_PROT_TLS1_2;
+        }
+        else if (prot == "TLS1_3" || prot == "TLSV1_2")
+        {
+            v |= SP_PROT_TLS1_3;
         }
         else
         {
@@ -580,6 +605,17 @@ SChannel::SSLEngine::SSLEngine(const CommunicatorPtr& communicator) :
 void
 SChannel::SSLEngine::initialize()
 {
+    //
+    // BUGFIX: we use a global mutex for the initialization of SChannel to
+    // avoid crashes ocurring with last SChannel updates see:
+    // https://github.com/zeroc-ice/ice/issues/242
+    //
+    IceUtilInternal::MutexPtrLock<IceUtil::Mutex> sync(globalMutex);
+
+    //
+    // We still have to acquire the instance mutex because it is used by the base
+    // class to access _initialized data member.
+    //
     Mutex::Lock lock(_mutex);
     if(_initialized)
     {
@@ -751,21 +787,21 @@ SChannel::SSLEngine::initialize()
 
         for(size_t i = 0; i < certFiles.size(); ++i)
         {
-            string certFile = certFiles[i];
+            string cFile = certFiles[i];
             string resolved;
-            if(!checkPath(certFile, defaultDir, false, resolved))
+            if(!checkPath(cFile, defaultDir, false, resolved))
             {
                 throw PluginInitializationException(__FILE__, __LINE__,
-                                                    "IceSSL: certificate file not found:\n" + certFile);
+                                                    "IceSSL: certificate file not found:\n" + cFile);
             }
-            certFile = resolved;
+            cFile = resolved;
 
             vector<char> buffer;
-            readFile(certFile, buffer);
+            readFile(cFile, buffer);
             if(buffer.empty())
             {
                 throw PluginInitializationException(__FILE__, __LINE__,
-                                                    "IceSSL: certificate file is empty:\n" + certFile);
+                                                    "IceSSL: certificate file is empty:\n" + cFile);
             }
 
             CRYPT_DATA_BLOB pfxBlob;
@@ -962,7 +998,7 @@ SChannel::SSLEngine::initialize()
                                                         "store:\n" + lastErrorToString());
                 }
 
-                addCertificatesToStore(certFile, store, &cert);
+                addCertificatesToStore(cFile, store, &cert);
 
                 //
                 // Associate key & certificate
@@ -1098,7 +1134,11 @@ SChannel::SSLEngine::getCipherName(ALG_ID cipher) const
         case CALG_SHA_512:
             return "SHA_512";
         default:
-            return "Unknown";
+        {
+            ostringstream os;
+            os << "Unknown cipher: " << cipher;
+            return os.str();
+        }
     }
 }
 

data/ext/ice/cpp/src/IceSSL/SChannelEngine.h

@@ -1,15 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SCHANNEL_ENGINE_H
 #define ICESSL_SCHANNEL_ENGINE_H
 
+#ifdef _WIN32
+
 #include <IceSSL/SSLEngine.h>
 #include <IceSSL/SChannelEngineF.h>
 
@@ -124,3 +121,5 @@ private:
 }
 
 #endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SChannelEngineF.h

@@ -1,15 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SCHANNEL_ENGINE_F_H
 #define ICESSL_SCHANNEL_ENGINE_F_H
 
+#ifdef _WIN32
+
 #include <IceUtil/Shared.h>
 #include <Ice/Handle.h>
 
@@ -30,3 +27,5 @@ typedef IceInternal::Handle<SSLEngine> SSLEnginePtr;
 }
 
 #endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SChannelPluginI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/PluginI.h>
 #include <IceSSL/SChannelEngine.h>

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/SChannelTransceiverI.h>
 
@@ -234,9 +229,9 @@ SChannel::TransceiverI::sslHandshake()
     }
 
     SECURITY_STATUS err = SEC_E_OK;
-    DWORD ctxFlags = 0;
     if(_state == StateHandshakeNotStarted)
     {
+        _ctxFlags = 0;
         _readBuffer.b.resize(2048);
         _readBuffer.i = _readBuffer.b.begin();
         _credentials = _engine->newCredentialsHandle(_incoming);
@@ -248,7 +243,7 @@ SChannel::TransceiverI::sslHandshake()
             SecBufferDesc outBufferDesc = { SECBUFFER_VERSION, 1, &outBuffer };
 
             err = InitializeSecurityContext(&_credentials, 0, const_cast<char *>(_host.c_str()), flags, 0, 0, 0, 0,
-                                            &_ssl, &outBufferDesc, &ctxFlags, 0);
+                                            &_ssl, &outBufferDesc, &_ctxFlags, 0);
             if(err != SEC_E_OK && err != SEC_I_CONTINUE_NEEDED)
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + secStatusToString(err));
@@ -296,7 +291,7 @@ SChannel::TransceiverI::sslHandshake()
             if(_incoming)
             {
                 err = AcceptSecurityContext(&_credentials, (_sslInitialized ? &_ssl : 0), &inBufferDesc, flags, 0,
-                                            &_ssl, &outBufferDesc, &ctxFlags, 0);
+                                            &_ssl, &outBufferDesc, &_ctxFlags, 0);
                 if(err == SEC_I_CONTINUE_NEEDED || err == SEC_E_OK)
                 {
                     _sslInitialized = true;
@@ -305,7 +300,7 @@ SChannel::TransceiverI::sslHandshake()
             else
             {
                 err = InitializeSecurityContext(&_credentials, &_ssl, const_cast<char*>(_host.c_str()), flags, 0, 0,
-                                                &inBufferDesc, 0, 0, &outBufferDesc, &ctxFlags, 0);
+                                                &inBufferDesc, 0, 0, &outBufferDesc, &_ctxFlags, 0);
             }
 
             //
@@ -315,7 +310,7 @@ SChannel::TransceiverI::sslHandshake()
             {
                 SecBuffer* missing = getSecBufferWithType(inBufferDesc, SECBUFFER_MISSING);
                 size_t pos = _readBuffer.i - _readBuffer.b.begin();
-                _readBuffer.b.resize(missing ? (pos + missing->cbBuffer) : (pos * 2));
+                _readBuffer.b.resize((missing && missing->cbBuffer > 0) ? (pos + missing->cbBuffer) : (pos * 2));
                 _readBuffer.i = _readBuffer.b.begin() + pos;
                 return IceInternal::SocketOperationRead;
             }
@@ -354,7 +349,14 @@ SChannel::TransceiverI::sslHandshake()
 
             if(token->cbBuffer)
             {
-                _state = StateHandshakeWriteContinue; // Continue writing if we have a token.
+                if(err == SEC_E_OK)
+                {
+                    _state = StateHandshakeWriteNoContinue; // Write and don't continue.
+                }
+                else
+                {
+                    _state = StateHandshakeWriteContinue; // Continue writing if we have a token.
+                }
             }
             else if(err == SEC_E_OK)
             {
@@ -364,7 +366,7 @@ SChannel::TransceiverI::sslHandshake()
             // Otherwise continue either reading credentials
         }
 
-        if(_state == StateHandshakeWriteContinue)
+        if(_state == StateHandshakeWriteContinue || _state == StateHandshakeWriteNoContinue)
         {
             //
             // Write any pending data.
@@ -373,80 +375,83 @@ SChannel::TransceiverI::sslHandshake()
             {
                 return IceInternal::SocketOperationWrite;
             }
-            if(err == SEC_E_OK)
+            if(_state == StateHandshakeWriteNoContinue)
             {
                 break; // Token is written and we weren't told to continue, so we're done!
             }
-            assert(err == SEC_I_CONTINUE_NEEDED);
             _state = StateHandshakeReadContinue;
         }
     }
 
     //
-    // Check if the requested capabilities are met
+    // Check if the requested capabilities are met.
+    //
+    // NOTE: it's important for _ctxFlags to be a data member. The context flags might not be checked immediately
+    // if the last write can't complete without blocking above. In such a case, the context flags are checked here
+    // only once the sslHandshake is called again after the write completes.
     //
-    if(flags != ctxFlags)
+    if(flags != _ctxFlags)
     {
         if(_incoming)
         {
-            if(!(ctxFlags & ASC_REQ_SEQUENCE_DETECT))
+            if(!(_ctxFlags & ASC_REQ_SEQUENCE_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup sequence detect");
             }
 
-            if(!(ctxFlags & ASC_REQ_REPLAY_DETECT))
+            if(!(_ctxFlags & ASC_REQ_REPLAY_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup replay detect");
             }
 
-            if(!(ctxFlags & ASC_REQ_CONFIDENTIALITY))
+            if(!(_ctxFlags & ASC_REQ_CONFIDENTIALITY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup confidentiality");
             }
 
-            if(!(ctxFlags & ASC_REQ_EXTENDED_ERROR))
+            if(!(_ctxFlags & ASC_REQ_EXTENDED_ERROR))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup extended error");
             }
 
-            if(!(ctxFlags & ASC_REQ_ALLOCATE_MEMORY))
+            if(!(_ctxFlags & ASC_REQ_ALLOCATE_MEMORY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup memory allocation");
             }
 
-            if(!(ctxFlags & ASC_REQ_STREAM))
+            if(!(_ctxFlags & ASC_REQ_STREAM))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup stream");
             }
         }
         else
         {
-            if(!(ctxFlags & ISC_REQ_SEQUENCE_DETECT))
+            if(!(_ctxFlags & ISC_REQ_SEQUENCE_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup sequence detect");
             }
 
-            if(!(ctxFlags & ISC_REQ_REPLAY_DETECT))
+            if(!(_ctxFlags & ISC_REQ_REPLAY_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup replay detect");
             }
 
-            if(!(ctxFlags & ISC_REQ_CONFIDENTIALITY))
+            if(!(_ctxFlags & ISC_REQ_CONFIDENTIALITY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup confidentiality");
             }
 
-            if(!(ctxFlags & ISC_REQ_EXTENDED_ERROR))
+            if(!(_ctxFlags & ISC_REQ_EXTENDED_ERROR))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup extended error");
             }
 
-            if(!(ctxFlags & ISC_REQ_ALLOCATE_MEMORY))
+            if(!(_ctxFlags & ISC_REQ_ALLOCATE_MEMORY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup memory allocation");
             }
 
-            if(!(ctxFlags & ISC_REQ_STREAM))
+            if(!(_ctxFlags & ISC_REQ_STREAM))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup stream");
             }
@@ -900,7 +905,7 @@ SChannel::TransceiverI::startWrite(IceInternal::Buffer& buffer)
         _bufferedW = encryptMessage(buffer);
     }
 
-    return _delegate->startWrite(_writeBuffer) && _bufferedW == (buffer.b.end() - buffer.i);
+    return _delegate->startWrite(_writeBuffer) && _bufferedW == static_cast<size_t>((buffer.b.end() - buffer.i));
 }
 
 void