zeroc-ice 3.7.1 → 3.7.6

data/ext/ice/cpp/src/IceSSL/OpenSSLEngine.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_OPENSSL_ENGINE_H
 #define ICESSL_OPENSSL_ENGINE_H
@@ -31,7 +26,6 @@ public:
 
     virtual void initialize();
     virtual void destroy();
-    virtual void verifyPeer(const std::string&, const IceSSL::ConnectionInfoPtr&, const std::string&);
     virtual IceInternal::TransceiverPtr
     createTransceiver(const IceSSL::InstancePtr&, const IceInternal::TransceiverPtr&, const std::string&, bool);
 
@@ -45,9 +39,10 @@ public:
 
 private:
 
+    void cleanup();
     SSL_METHOD* getMethod(int);
     void setOptions(int);
-    enum Protocols { SSLv3 = 0x01, TLSv1_0 = 0x02, TLSv1_1 = 0x04, TLSv1_2 = 0x08 };
+    enum Protocols { SSLv3 = 1, TLSv1_0 = 2, TLSv1_1 = 4, TLSv1_2 = 8, TLSv1_3 = 16 };
     int parseProtocols(const Ice::StringSeq&) const;
 
     SSL_CTX* _ctx;

data/ext/ice/cpp/src/IceSSL/OpenSSLEngineF.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_OPENSSL_ENGINE_F_H
 #define ICESSL_OPENSSL_ENGINE_F_H

data/ext/ice/cpp/src/IceSSL/OpenSSLPluginI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/PluginI.h>
 #include <IceSSL/OpenSSL.h>

data/ext/ice/cpp/src/IceSSL/OpenSSLTransceiverI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/OpenSSLTransceiverI.h>
 #include <IceSSL/OpenSSLEngine.h>
@@ -15,8 +10,10 @@
 
 #include <IceSSL/ConnectionInfo.h>
 #include <IceSSL/Instance.h>
+#include <IceSSL/PluginI.h>
 #include <IceSSL/SSLEngine.h>
 #include <IceSSL/Util.h>
+
 #include <Ice/Communicator.h>
 #include <Ice/LoggerUtil.h>
 #include <Ice/Buffer.h>
@@ -77,6 +74,103 @@ IceSSL_opensslVerifyCallback(int ok, X509_STORE_CTX* ctx)
 
 }
 
+namespace
+{
+
+TrustError trustStatusToTrustError(long status)
+{
+    switch (status)
+    {
+    case X509_V_OK:
+        return IceSSL::ICE_ENUM(TrustError, NoError);
+
+    case X509_V_ERR_CERT_CHAIN_TOO_LONG:
+        return IceSSL::ICE_ENUM(TrustError, ChainTooLong);
+
+    case X509_V_ERR_EXCLUDED_VIOLATION:
+        return IceSSL::ICE_ENUM(TrustError, HasExcludedNameConstraint);
+
+    case X509_V_ERR_PERMITTED_VIOLATION:
+        return IceSSL::ICE_ENUM(TrustError, HasNonPermittedNameConstraint);
+
+    case X509_V_ERR_UNHANDLED_CRITICAL_EXTENSION:
+        return IceSSL::ICE_ENUM(TrustError, HasNonSupportedCriticalExtension);
+
+    case X509_V_ERR_UNSUPPORTED_CONSTRAINT_TYPE:
+    case X509_V_ERR_SUBTREE_MINMAX:
+        return IceSSL::ICE_ENUM(TrustError, HasNonSupportedNameConstraint);
+
+    case X509_V_ERR_HOSTNAME_MISMATCH:
+    case X509_V_ERR_IP_ADDRESS_MISMATCH:
+        return IceSSL::ICE_ENUM(TrustError, HostNameMismatch);
+
+    case X509_V_ERR_INVALID_CA:
+    case X509_V_ERR_INVALID_NON_CA:
+    case X509_V_ERR_PATH_LENGTH_EXCEEDED:
+    case X509_V_ERR_KEYUSAGE_NO_CERTSIGN:
+    case X509_V_ERR_KEYUSAGE_NO_DIGITAL_SIGNATURE:
+        return IceSSL::ICE_ENUM(TrustError, InvalidBasicConstraints);
+
+    case X509_V_ERR_INVALID_EXTENSION:
+        return IceSSL::ICE_ENUM(TrustError, InvalidExtension);
+
+    case X509_V_ERR_UNSUPPORTED_NAME_SYNTAX:
+        return IceSSL::ICE_ENUM(TrustError, InvalidNameConstraints);
+
+    case X509_V_ERR_INVALID_POLICY_EXTENSION:
+    case X509_V_ERR_NO_EXPLICIT_POLICY:
+        return IceSSL::ICE_ENUM(TrustError, InvalidPolicyConstraints);
+
+    case X509_V_ERR_INVALID_PURPOSE:
+        return IceSSL::ICE_ENUM(TrustError, InvalidPurpose);
+
+    case X509_V_ERR_UNABLE_TO_DECRYPT_CERT_SIGNATURE:
+    case X509_V_ERR_UNABLE_TO_DECODE_ISSUER_PUBLIC_KEY:
+    case X509_V_ERR_CERT_SIGNATURE_FAILURE:
+        return IceSSL::ICE_ENUM(TrustError, InvalidSignature);
+
+    case X509_V_ERR_CERT_NOT_YET_VALID:
+    case X509_V_ERR_CERT_HAS_EXPIRED:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_BEFORE_FIELD:
+    case X509_V_ERR_ERROR_IN_CERT_NOT_AFTER_FIELD:
+        return IceSSL::ICE_ENUM(TrustError, InvalidTime);
+
+    case X509_V_ERR_CERT_REJECTED:
+        return IceSSL::ICE_ENUM(TrustError, NotTrusted);
+
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT:
+    case X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY:
+    case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE:
+        return IceSSL::ICE_ENUM(TrustError, PartialChain);
+
+    case X509_V_ERR_CRL_HAS_EXPIRED:
+    case X509_V_ERR_CRL_NOT_YET_VALID:
+    case X509_V_ERR_CRL_SIGNATURE_FAILURE:
+    case X509_V_ERR_ERROR_IN_CRL_LAST_UPDATE_FIELD:
+    case X509_V_ERR_ERROR_IN_CRL_NEXT_UPDATE_FIELD:
+    case X509_V_ERR_KEYUSAGE_NO_CRL_SIGN:
+    case X509_V_ERR_UNABLE_TO_DECRYPT_CRL_SIGNATURE:
+    case X509_V_ERR_UNABLE_TO_GET_CRL:
+    case X509_V_ERR_UNABLE_TO_GET_CRL_ISSUER:
+    case X509_V_ERR_UNHANDLED_CRITICAL_CRL_EXTENSION:
+    case X509_V_ERR_CRL_PATH_VALIDATION_ERROR:
+        return IceSSL::ICE_ENUM(TrustError, RevocationStatusUnknown);
+
+    case X509_V_ERR_CERT_REVOKED:
+        return IceSSL::ICE_ENUM(TrustError, Revoked);
+
+    case X509_V_ERR_CERT_UNTRUSTED:
+    case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
+    case X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN:
+        return IceSSL::ICE_ENUM(TrustError, UntrustedRoot);
+
+    default:
+        return IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
+    }
+}
+
+}
+
 IceInternal::NativeInfoPtr
 OpenSSL::TransceiverI::getNativeInfo()
 {
@@ -99,31 +193,33 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
     if(!_ssl)
     {
         SOCKET fd = _delegate->getNativeInfo()->fd();
+        BIO* bio = 0;
         if(fd == INVALID_SOCKET)
         {
-            //
-            // The delegate has finished its initialization but may not have a file descriptor yet (e.g., Bluetooth).
-            // The underlying transport must (eventually) be socket-based.
-            //
-            return IceInternal::SocketOperationRead;
+            assert(_sentBytes == 0);
+            _maxSendPacketSize = 128 * 1024; // 128KB
+            _maxRecvPacketSize = 128 * 1024; // 128KB
+            if(!BIO_new_bio_pair(&bio, _maxSendPacketSize, &_memBio, _maxRecvPacketSize))
+            {
+                bio = 0;
+                _memBio = 0;
+            }
         }
-
-#ifdef ICE_USE_IOCP
-        _maxSendPacketSize = std::max(512, IceInternal::getSendBufferSize(fd));
-        _maxRecvPacketSize = std::max(512, IceInternal::getRecvBufferSize(fd));
-        BIO* bio;
-        _sentBytes = 0;
-        if(!BIO_new_bio_pair(&bio, _maxSendPacketSize, &_iocpBio, _maxRecvPacketSize))
+        else
         {
-            bio = 0;
-            _iocpBio = 0;
-        }
+#ifdef ICE_USE_IOCP
+            assert(_sentBytes == 0);
+            _maxSendPacketSize = std::max(512, IceInternal::getSendBufferSize(fd));
+            _maxRecvPacketSize = std::max(512, IceInternal::getRecvBufferSize(fd));
+            if(!BIO_new_bio_pair(&bio, _maxSendPacketSize, &_memBio, _maxRecvPacketSize))
+            {
+                bio = 0;
+                _memBio = 0;
+            }
 #else
-        //
-        // This static_cast is necessary due to 64bit windows. There SOCKET is a non-int type.
-        //
-        BIO* bio = BIO_new_socket(static_cast<int>(fd), 0);
+            bio = BIO_new_socket(fd, 0);
 #endif
+        }
 
         if(!bio)
         {
@@ -134,10 +230,11 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
         if(!_ssl)
         {
             BIO_free(bio);
-#ifdef ICE_USE_IOCP
-            BIO_free(_iocpBio);
-            _iocpBio = 0;
-#endif
+            if(_memBio)
+            {
+                BIO_free(_memBio);
+                _memBio = 0;
+            }
             throw SecurityException(__FILE__, __LINE__, "openssl failure");
         }
         SSL_set_bio(_ssl, bio, bio);
@@ -173,22 +270,41 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
             // Hostname verification was included in OpenSSL 1.0.2
             //
 #if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10002000L
-            if(_engine->getCheckCertName() && !_host.empty() && (sslVerifyMode & SSL_VERIFY_PEER))
+            if(_engine->getCheckCertName() && !_host.empty())
             {
                 X509_VERIFY_PARAM* param = SSL_get0_param(_ssl);
                 if(IceInternal::isIpAddress(_host))
                 {
-                    X509_VERIFY_PARAM_set1_ip_asc(param, _host.c_str());
+                    if(!X509_VERIFY_PARAM_set1_ip_asc(param, _host.c_str()))
+                    {
+                        throw SecurityException(__FILE__, __LINE__, "IceSSL: error setting the expected IP address `"
+                                                + _host + "'");
+                    }
                 }
                 else
                 {
-                    X509_VERIFY_PARAM_set1_host(param, _host.c_str(), 0);
+                    if(!X509_VERIFY_PARAM_set1_host(param, _host.c_str(), 0))
+                    {
+                        throw SecurityException(__FILE__, __LINE__, "IceSSL: error setting the expected host name `"
+                                                + _host + "'");
+                    }
                 }
             }
 #endif
 
             SSL_set_verify(_ssl, sslVerifyMode, IceSSL_opensslVerifyCallback);
         }
+
+        //
+        // Enable SNI
+        //
+        if(!_incoming && _engine->getServerNameIndication() && !_host.empty() && !IceInternal::isIpAddress(_host))
+        {
+            if(!SSL_set_tlsext_host_name(_ssl, _host.c_str()))
+            {
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: setting SNI host failed `" + _host + "'");
+            }
+        }
     }
 
     while(!SSL_is_init_finished(_ssl))
@@ -213,8 +329,7 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
         sync.release();
 #endif
 
-#ifdef ICE_USE_IOCP
-        if(BIO_ctrl_pending(_iocpBio))
+        if(_memBio && BIO_ctrl_pending(_memBio))
         {
             if(!send())
             {
@@ -222,7 +337,6 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
             }
             continue;
         }
-#endif
 
         if(ret <= 0)
         {
@@ -239,58 +353,55 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
             }
             case SSL_ERROR_WANT_READ:
             {
-#ifdef ICE_USE_IOCP
-                if(receive())
+                if(_memBio && receive())
                 {
                     continue;
                 }
-#endif
                 return IceInternal::SocketOperationRead;
             }
             case SSL_ERROR_WANT_WRITE:
             {
-#ifdef ICE_USE_IOCP
-                if(send())
+                if(_memBio && send())
                 {
                     continue;
                 }
-#endif
                 return IceInternal::SocketOperationWrite;
             }
             case SSL_ERROR_SYSCALL:
             {
-#ifndef ICE_USE_IOCP
-                if(IceInternal::interrupted())
+                if(!_memBio)
                 {
-                    break;
-                }
-
-                if(IceInternal::wouldBlock())
-                {
-                    if(SSL_want_read(_ssl))
+                    if(IceInternal::interrupted())
                     {
-                        return IceInternal::SocketOperationRead;
+                        break;
                     }
-                    else if(SSL_want_write(_ssl))
+
+                    if(IceInternal::wouldBlock())
                     {
-                        return IceInternal::SocketOperationWrite;
+                        if(SSL_want_read(_ssl))
+                        {
+                            return IceInternal::SocketOperationRead;
+                        }
+                        else if(SSL_want_write(_ssl))
+                        {
+                            return IceInternal::SocketOperationWrite;
+                        }
+
+                        break;
                     }
 
-                    break;
-                }
-
-                if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
-                {
-                    throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
+                    if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
+                    {
+                        throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
+                    }
                 }
-#endif
                 throw SocketException(__FILE__, __LINE__, IceInternal::getSocketErrno());
             }
             case SSL_ERROR_SSL:
             {
                 ostringstream ostr;
                 ostr << "SSL error occurred for new " << (_incoming ? "incoming" : "outgoing")
-                     << " connection:\nremote address = " << _delegate->toString() << "\n" << _engine->sslErrors();
+                     << " connection:\n" << _delegate->toString() << "\n" << _engine->sslErrors();
                 throw ProtocolException(__FILE__, __LINE__, ostr.str());
             }
             }
@@ -298,6 +409,7 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
     }
 
     long result = SSL_get_verify_result(_ssl);
+    _trustError = trustStatusToTrustError(result);
     if(result != X509_V_OK)
     {
         if(_engine->getVerifyPeer() == 0)
@@ -327,6 +439,25 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
     }
 
     _cipher = SSL_get_cipher_name(_ssl); // Nothing needs to be free'd.
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x10002000L
+    try
+    {
+        //
+        // Peer hostname verification is new in OpenSSL 1.0.2 for older versions
+        // We use IceSSL built-in hostname verification.
+        //
+        _engine->verifyPeerCertName(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()));
+    }
+    catch(const SecurityException&)
+    {
+        _trustError = IceSSL::ICE_ENUM(TrustError, HostNameMismatch);
+        _verified = false;
+        if(_engine->getVerifyPeer() > 0)
+        {
+            throw;
+        }
+    }
+#endif
     _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString());
 
     if(_engine->securityTraceLevel() >= 1)
@@ -349,7 +480,7 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
             out << "bits = " << SSL_CIPHER_get_bits(cipher, 0) << "\n";
             out << "protocol = " << SSL_get_version(_ssl) << "\n";
         }
-        out << IceInternal::fdToString(SSL_get_fd(_ssl));
+        out << toString();
     }
 
     return IceInternal::SocketOperationNone;
@@ -382,13 +513,11 @@ OpenSSL::TransceiverI::close()
         _ssl = 0;
     }
 
-#ifdef ICE_USE_IOCP
-    if(_iocpBio)
+    if(_memBio)
     {
-        BIO_free(_iocpBio);
-        _iocpBio = 0;
+        BIO_free(_memBio);
+        _memBio = 0;
     }
-#endif
 
     _delegate->close();
 }
@@ -401,15 +530,13 @@ OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
         return _delegate->write(buf);
     }
 
-#ifdef ICE_USE_IOCP
-    if(_writeBuffer.i != _writeBuffer.b.end())
+    if(_memBio && _writeBuffer.i != _writeBuffer.b.end())
     {
         if(!send())
         {
             return IceInternal::SocketOperationWrite;
         }
     }
-#endif
 
     if(buf.i == buf.b.end())
     {
@@ -419,37 +546,39 @@ OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
     //
     // It's impossible for packetSize to be more than an Int.
     //
-    int packetSize =
-#ifdef ICE_USE_IOCP
-        std::min(static_cast<int>(_maxSendPacketSize), static_cast<int>(buf.b.end() - buf.i));
-#else
+    int packetSize = _memBio ?
+        std::min(static_cast<int>(_maxSendPacketSize), static_cast<int>(buf.b.end() - buf.i)) :
         static_cast<int>(buf.b.end() - buf.i);
-#endif
+
     while(buf.i != buf.b.end())
     {
         ERR_clear_error(); // Clear any spurious errors.
-#ifdef ICE_USE_IOCP
         int ret;
-        if(_sentBytes)
+        if(_memBio)
         {
-            ret = _sentBytes;
-            _sentBytes = 0;
-        }
-        else
-        {
-            ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
-            if(ret > 0)
+            if(_sentBytes)
             {
-                if(!send())
+                ret = _sentBytes;
+                _sentBytes = 0;
+            }
+            else
+            {
+                ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
+                if(ret > 0)
                 {
-                    _sentBytes = ret;
-                    return IceInternal::SocketOperationWrite;
+                    if(!send())
+                    {
+                        _sentBytes = ret;
+                        return IceInternal::SocketOperationWrite;
+                    }
                 }
             }
         }
-#else
-        int ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
-#endif
+        else
+        {
+            ret = SSL_write(_ssl, reinterpret_cast<const void*>(&*buf.i), packetSize);
+        }
+
         if(ret <= 0)
         {
             switch(SSL_get_error(_ssl, ret))
@@ -468,35 +597,34 @@ OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
             }
             case SSL_ERROR_WANT_WRITE:
             {
-#ifdef ICE_USE_IOCP
-                if(send())
+                if(_memBio && send())
                 {
                     continue;
                 }
-#endif
                 return IceInternal::SocketOperationWrite;
             }
             case SSL_ERROR_SYSCALL:
             {
-#ifndef ICE_USE_IOCP
-
-                if(IceInternal::interrupted())
+                if(!_memBio)
                 {
-                    continue;
-                }
+                    if(IceInternal::interrupted())
+                    {
+                        continue;
+                    }
 
-                if(IceInternal::noBuffers() && packetSize > 1024)
-                {
-                    packetSize /= 2;
-                    continue;
-                }
+                    if(IceInternal::noBuffers() && packetSize > 1024)
+                    {
+                        packetSize /= 2;
+                        continue;
+                    }
 
-                if(IceInternal::wouldBlock())
-                {
-                    assert(SSL_want_write(_ssl));
-                    return IceInternal::SocketOperationWrite;
+                    if(IceInternal::wouldBlock())
+                    {
+                        assert(SSL_want_write(_ssl));
+                        return IceInternal::SocketOperationWrite;
+                    }
                 }
-#endif
+
                 if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
                 {
                     throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
@@ -532,15 +660,13 @@ OpenSSL::TransceiverI::read(IceInternal::Buffer& buf)
         return _delegate->read(buf);
     }
 
-#ifdef ICE_USE_IOCP
-    if(_readBuffer.i != _readBuffer.b.end())
+    if(_memBio && _readBuffer.i != _readBuffer.b.end())
     {
         if(!receive())
         {
             return IceInternal::SocketOperationRead;
         }
     }
-#endif
 
     //
     // Note: We assume that OpenSSL doesn't read more SSL records than
@@ -578,12 +704,10 @@ OpenSSL::TransceiverI::read(IceInternal::Buffer& buf)
             }
             case SSL_ERROR_WANT_READ:
             {
-#ifdef ICE_USE_IOCP
-                if(receive())
+                if(_memBio && receive())
                 {
                     continue;
                 }
-#endif
                 return IceInternal::SocketOperationRead;
             }
             case SSL_ERROR_WANT_WRITE:
@@ -593,24 +717,26 @@ OpenSSL::TransceiverI::read(IceInternal::Buffer& buf)
             }
             case SSL_ERROR_SYSCALL:
             {
-#ifndef ICE_USE_IOCP
-                if(IceInternal::interrupted())
+                if(!_memBio)
                 {
-                    continue;
-                }
+                    if(IceInternal::interrupted())
+                    {
+                        continue;
+                    }
 
-                if(IceInternal::noBuffers() && packetSize > 1024)
-                {
-                    packetSize /= 2;
-                    continue;
-                }
+                    if(IceInternal::noBuffers() && packetSize > 1024)
+                    {
+                        packetSize /= 2;
+                        continue;
+                    }
 
-                if(IceInternal::wouldBlock())
-                {
-                    assert(SSL_want_read(_ssl));
-                    return IceInternal::SocketOperationRead;
+                    if(IceInternal::wouldBlock())
+                    {
+                        assert(SSL_want_read(_ssl));
+                        return IceInternal::SocketOperationRead;
+                    }
                 }
-#endif
+
                 if(IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
                 {
                     throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
@@ -660,10 +786,10 @@ OpenSSL::TransceiverI::startWrite(IceInternal::Buffer& buffer)
         int packetSize = std::min(static_cast<int>(_maxSendPacketSize), static_cast<int>(buffer.b.end() - buffer.i));
         _sentBytes = SSL_write(_ssl, reinterpret_cast<void*>(&*buffer.i), packetSize);
 
-        assert(BIO_ctrl_pending(_iocpBio));
-        _writeBuffer.b.resize( BIO_ctrl_pending(_iocpBio));
+        assert(BIO_ctrl_pending(_memBio));
+        _writeBuffer.b.resize( BIO_ctrl_pending(_memBio));
         _writeBuffer.i = _writeBuffer.b.begin();
-        BIO_read(_iocpBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
+        BIO_read(_memBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
     }
 
     return _delegate->startWrite(_writeBuffer) && buffer.i == buffer.b.end();
@@ -705,8 +831,8 @@ OpenSSL::TransceiverI::startRead(IceInternal::Buffer& buffer)
             SSL_read(_ssl, reinterpret_cast<void*>(&*buffer.i), static_cast<int>(buffer.b.end() - buffer.i));
         assert(ret <= 0 && SSL_get_error(_ssl, ret) == SSL_ERROR_WANT_READ);
 
-        assert(BIO_ctrl_get_read_request(_iocpBio));
-        _readBuffer.b.resize(BIO_ctrl_get_read_request(_iocpBio));
+        assert(BIO_ctrl_get_read_request(_memBio));
+        _readBuffer.b.resize(BIO_ctrl_get_read_request(_memBio));
         _readBuffer.i = _readBuffer.b.begin();
     }
 
@@ -727,7 +853,7 @@ OpenSSL::TransceiverI::finishRead(IceInternal::Buffer& buffer)
     _delegate->finishRead(_readBuffer);
     if(_readBuffer.i == _readBuffer.b.end())
     {
-        int n = BIO_write(_iocpBio, _readBuffer.b.begin(), static_cast<int>(_readBuffer.b.size()));
+        int n = BIO_write(_memBio, _readBuffer.b.begin(), static_cast<int>(_readBuffer.b.size()));
         if(n < 0) // Expected if the transceiver was closed.
         {
             throw SecurityException(__FILE__, __LINE__, "SSL bio write failed");
@@ -798,13 +924,15 @@ OpenSSL::TransceiverI::toDetailedString() const
 Ice::ConnectionInfoPtr
 OpenSSL::TransceiverI::getInfo() const
 {
-    ConnectionInfoPtr info = ICE_MAKE_SHARED(ConnectionInfo);
+    ExtendedConnectionInfoPtr info = ICE_MAKE_SHARED(ExtendedConnectionInfo);
     info->underlying = _delegate->getInfo();
     info->incoming = _incoming;
     info->adapterName = _adapterName;
     info->cipher = _cipher;
     info->certs = _certs;
     info->verified = _verified;
+    info->errorCode = _trustError;
+    info->host = _incoming ? "" : _host;
     return info;
 }
 
@@ -837,7 +965,7 @@ OpenSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c)
         out << "subject = " << buf << '\n';
         out << "depth = " << X509_STORE_CTX_get_error_depth(c) << '\n';
         out << "error = " << X509_verify_cert_error_string(err) << '\n';
-        out << IceInternal::fdToString(SSL_get_fd(_ssl));
+        out << toString();
     }
 
     //
@@ -877,13 +1005,11 @@ OpenSSL::TransceiverI::TransceiverI(const InstancePtr& instance,
     _delegate(delegate),
     _connected(false),
     _verified(false),
-    _ssl(0)
-#ifdef ICE_USE_IOCP
-    , _iocpBio(0),
+    _ssl(0),
+    _memBio(0),
     _sentBytes(0),
     _maxSendPacketSize(0),
     _maxRecvPacketSize(0)
-#endif
 {
 }
 
@@ -891,14 +1017,13 @@ OpenSSL::TransceiverI::~TransceiverI()
 {
 }
 
-#ifdef ICE_USE_IOCP
 bool
 OpenSSL::TransceiverI::receive()
 {
     if(_readBuffer.i == _readBuffer.b.end())
     {
-        assert(BIO_ctrl_get_read_request(_iocpBio));
-        _readBuffer.b.resize(BIO_ctrl_get_read_request(_iocpBio));
+        assert(BIO_ctrl_get_read_request(_memBio));
+        _readBuffer.b.resize(BIO_ctrl_get_read_request(_memBio));
         _readBuffer.i = _readBuffer.b.begin();
     }
 
@@ -915,7 +1040,7 @@ OpenSSL::TransceiverI::receive()
 #ifndef NDEBUG
     int n =
 #endif
-        BIO_write(_iocpBio, &_readBuffer.b[0], static_cast<int>(_readBuffer.b.end() - _readBuffer.b.begin()));
+        BIO_write(_memBio, &_readBuffer.b[0], static_cast<int>(_readBuffer.b.end() - _readBuffer.b.begin()));
 
     assert(n == static_cast<int>(_readBuffer.b.end() - _readBuffer.b.begin()));
 
@@ -927,10 +1052,10 @@ OpenSSL::TransceiverI::send()
 {
     if(_writeBuffer.i == _writeBuffer.b.end())
     {
-        assert(BIO_ctrl_pending(_iocpBio));
-        _writeBuffer.b.resize( BIO_ctrl_pending(_iocpBio));
+        assert(BIO_ctrl_pending(_memBio));
+        _writeBuffer.b.resize( BIO_ctrl_pending(_memBio));
         _writeBuffer.i = _writeBuffer.b.begin();
-        BIO_read(_iocpBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
+        BIO_read(_memBio, _writeBuffer.i, static_cast<int>(_writeBuffer.b.size()));
     }
 
     if(_writeBuffer.i != _writeBuffer.b.end())
@@ -942,4 +1067,3 @@ OpenSSL::TransceiverI::send()
     }
     return _writeBuffer.i == _writeBuffer.b.end();
 }
-#endif