zeroc-ice 3.7.1 → 3.7.6

data/ext/ice/cpp/src/IceSSL/SChannelEngine.h

@@ -1,15 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SCHANNEL_ENGINE_H
 #define ICESSL_SCHANNEL_ENGINE_H
 
+#ifdef _WIN32
+
 #include <IceSSL/SSLEngine.h>
 #include <IceSSL/SChannelEngineF.h>
 
@@ -94,8 +91,6 @@ public:
     //
     virtual void destroy();
 
-    virtual void verifyPeer(const std::string&, const ConnectionInfoPtr&, const std::string&);
-
     std::string getCipherName(ALG_ID) const;
 
     CredHandle newCredentialsHandle(bool);
@@ -124,3 +119,5 @@ private:
 }
 
 #endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SChannelEngineF.h

@@ -1,15 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SCHANNEL_ENGINE_F_H
 #define ICESSL_SCHANNEL_ENGINE_F_H
 
+#ifdef _WIN32
+
 #include <IceUtil/Shared.h>
 #include <Ice/Handle.h>
 
@@ -30,3 +27,5 @@ typedef IceInternal::Handle<SSLEngine> SSLEnginePtr;
 }
 
 #endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SChannelPluginI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/PluginI.h>
 #include <IceSSL/SChannelEngine.h>

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/SChannelTransceiverI.h>
 
@@ -14,6 +9,7 @@
 #include <IceSSL/ConnectionInfo.h>
 #include <IceSSL/Instance.h>
 #include <IceSSL/SChannelEngine.h>
+#include <IceSSL/PluginI.h>
 #include <IceSSL/Util.h>
 #include <Ice/Communicator.h>
 #include <Ice/LoggerUtil.h>
@@ -52,6 +48,96 @@ protocolName(DWORD protocol)
     }
 }
 
+TrustError
+trustStatusToTrustError(DWORD status)
+{
+    if (status & CERT_TRUST_NO_ERROR)
+    {
+        return IceSSL::ICE_ENUM(TrustError, NoError);
+    }
+    if (status & CERT_TRUST_IS_NOT_TIME_VALID)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidTime);
+    }
+    if (status & CERT_TRUST_IS_REVOKED)
+    {
+        return IceSSL::ICE_ENUM(TrustError, Revoked);
+    }
+    if (status & CERT_TRUST_IS_NOT_SIGNATURE_VALID)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidSignature);
+    }
+    if (status & CERT_TRUST_IS_NOT_VALID_FOR_USAGE)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidPurpose);
+    }
+    if ((status & CERT_TRUST_IS_UNTRUSTED_ROOT) ||
+        (status & CERT_TRUST_IS_CYCLIC) ||
+        (status & CERT_TRUST_CTL_IS_NOT_TIME_VALID) ||
+        (status & CERT_TRUST_CTL_IS_NOT_SIGNATURE_VALID) ||
+        (status & CERT_TRUST_CTL_IS_NOT_VALID_FOR_USAGE))
+    {
+        return IceSSL::ICE_ENUM(TrustError, UntrustedRoot);
+    }
+    if (status & CERT_TRUST_REVOCATION_STATUS_UNKNOWN)
+    {
+        return IceSSL::ICE_ENUM(TrustError, RevocationStatusUnknown);
+    }
+    if (status & CERT_TRUST_INVALID_EXTENSION)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidExtension);
+    }
+    if (status & CERT_TRUST_INVALID_POLICY_CONSTRAINTS)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidPolicyConstraints);
+    }
+    if (status & CERT_TRUST_INVALID_BASIC_CONSTRAINTS)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidBasicConstraints);
+    }
+    if (status & CERT_TRUST_INVALID_NAME_CONSTRAINTS)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidNameConstraints);
+    }
+    if (status & CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonSupportedNameConstraint);
+    }
+    if (status & CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonDefinedNameConstraint);
+    }
+    if (status & CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonPermittedNameConstraint);
+    }
+    if (status & CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasExcludedNameConstraint);
+    }
+    if (status & CERT_TRUST_IS_OFFLINE_REVOCATION)
+    {
+        return IceSSL::ICE_ENUM(TrustError, RevocationStatusUnknown);
+    }
+    if (status & CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidPolicyConstraints);
+    }
+    if (status & CERT_TRUST_IS_EXPLICIT_DISTRUST)
+    {
+        return IceSSL::ICE_ENUM(TrustError, NotTrusted);
+    }
+    if (status & CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonSupportedCriticalExtension);
+    }
+    if (status & CERT_TRUST_IS_PARTIAL_CHAIN)
+    {
+        return IceSSL::ICE_ENUM(TrustError, PartialChain);
+    }
+    return IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
+}
+
 string
 trustStatusToString(DWORD status)
 {
@@ -234,9 +320,9 @@ SChannel::TransceiverI::sslHandshake()
     }
 
     SECURITY_STATUS err = SEC_E_OK;
-    DWORD ctxFlags = 0;
     if(_state == StateHandshakeNotStarted)
     {
+        _ctxFlags = 0;
         _readBuffer.b.resize(2048);
         _readBuffer.i = _readBuffer.b.begin();
         _credentials = _engine->newCredentialsHandle(_incoming);
@@ -248,7 +334,7 @@ SChannel::TransceiverI::sslHandshake()
             SecBufferDesc outBufferDesc = { SECBUFFER_VERSION, 1, &outBuffer };
 
             err = InitializeSecurityContext(&_credentials, 0, const_cast<char *>(_host.c_str()), flags, 0, 0, 0, 0,
-                                            &_ssl, &outBufferDesc, &ctxFlags, 0);
+                                            &_ssl, &outBufferDesc, &_ctxFlags, 0);
             if(err != SEC_E_OK && err != SEC_I_CONTINUE_NEEDED)
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + secStatusToString(err));
@@ -296,7 +382,7 @@ SChannel::TransceiverI::sslHandshake()
             if(_incoming)
             {
                 err = AcceptSecurityContext(&_credentials, (_sslInitialized ? &_ssl : 0), &inBufferDesc, flags, 0,
-                                            &_ssl, &outBufferDesc, &ctxFlags, 0);
+                                            &_ssl, &outBufferDesc, &_ctxFlags, 0);
                 if(err == SEC_I_CONTINUE_NEEDED || err == SEC_E_OK)
                 {
                     _sslInitialized = true;
@@ -305,7 +391,7 @@ SChannel::TransceiverI::sslHandshake()
             else
             {
                 err = InitializeSecurityContext(&_credentials, &_ssl, const_cast<char*>(_host.c_str()), flags, 0, 0,
-                                                &inBufferDesc, 0, 0, &outBufferDesc, &ctxFlags, 0);
+                                                &inBufferDesc, 0, 0, &outBufferDesc, &_ctxFlags, 0);
             }
 
             //
@@ -315,7 +401,7 @@ SChannel::TransceiverI::sslHandshake()
             {
                 SecBuffer* missing = getSecBufferWithType(inBufferDesc, SECBUFFER_MISSING);
                 size_t pos = _readBuffer.i - _readBuffer.b.begin();
-                _readBuffer.b.resize(missing ? (pos + missing->cbBuffer) : (pos * 2));
+                _readBuffer.b.resize((missing && missing->cbBuffer > 0) ? (pos + missing->cbBuffer) : (pos * 2));
                 _readBuffer.i = _readBuffer.b.begin() + pos;
                 return IceInternal::SocketOperationRead;
             }
@@ -354,7 +440,14 @@ SChannel::TransceiverI::sslHandshake()
 
             if(token->cbBuffer)
             {
-                _state = StateHandshakeWriteContinue; // Continue writing if we have a token.
+                if(err == SEC_E_OK)
+                {
+                    _state = StateHandshakeWriteNoContinue; // Write and don't continue.
+                }
+                else
+                {
+                    _state = StateHandshakeWriteContinue; // Continue writing if we have a token.
+                }
             }
             else if(err == SEC_E_OK)
             {
@@ -364,7 +457,7 @@ SChannel::TransceiverI::sslHandshake()
             // Otherwise continue either reading credentials
         }
 
-        if(_state == StateHandshakeWriteContinue)
+        if(_state == StateHandshakeWriteContinue || _state == StateHandshakeWriteNoContinue)
         {
             //
             // Write any pending data.
@@ -373,80 +466,83 @@ SChannel::TransceiverI::sslHandshake()
             {
                 return IceInternal::SocketOperationWrite;
             }
-            if(err == SEC_E_OK)
+            if(_state == StateHandshakeWriteNoContinue)
             {
                 break; // Token is written and we weren't told to continue, so we're done!
             }
-            assert(err == SEC_I_CONTINUE_NEEDED);
             _state = StateHandshakeReadContinue;
         }
     }
 
     //
-    // Check if the requested capabilities are met
+    // Check if the requested capabilities are met.
+    //
+    // NOTE: it's important for _ctxFlags to be a data member. The context flags might not be checked immediately
+    // if the last write can't complete without blocking above. In such a case, the context flags are checked here
+    // only once the sslHandshake is called again after the write completes.
     //
-    if(flags != ctxFlags)
+    if(flags != _ctxFlags)
     {
         if(_incoming)
         {
-            if(!(ctxFlags & ASC_REQ_SEQUENCE_DETECT))
+            if(!(_ctxFlags & ASC_REQ_SEQUENCE_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup sequence detect");
             }
 
-            if(!(ctxFlags & ASC_REQ_REPLAY_DETECT))
+            if(!(_ctxFlags & ASC_REQ_REPLAY_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup replay detect");
             }
 
-            if(!(ctxFlags & ASC_REQ_CONFIDENTIALITY))
+            if(!(_ctxFlags & ASC_REQ_CONFIDENTIALITY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup confidentiality");
             }
 
-            if(!(ctxFlags & ASC_REQ_EXTENDED_ERROR))
+            if(!(_ctxFlags & ASC_REQ_EXTENDED_ERROR))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup extended error");
             }
 
-            if(!(ctxFlags & ASC_REQ_ALLOCATE_MEMORY))
+            if(!(_ctxFlags & ASC_REQ_ALLOCATE_MEMORY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup memory allocation");
             }
 
-            if(!(ctxFlags & ASC_REQ_STREAM))
+            if(!(_ctxFlags & ASC_REQ_STREAM))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup stream");
             }
         }
         else
         {
-            if(!(ctxFlags & ISC_REQ_SEQUENCE_DETECT))
+            if(!(_ctxFlags & ISC_REQ_SEQUENCE_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup sequence detect");
             }
 
-            if(!(ctxFlags & ISC_REQ_REPLAY_DETECT))
+            if(!(_ctxFlags & ISC_REQ_REPLAY_DETECT))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup replay detect");
             }
 
-            if(!(ctxFlags & ISC_REQ_CONFIDENTIALITY))
+            if(!(_ctxFlags & ISC_REQ_CONFIDENTIALITY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup confidentiality");
             }
 
-            if(!(ctxFlags & ISC_REQ_EXTENDED_ERROR))
+            if(!(_ctxFlags & ISC_REQ_EXTENDED_ERROR))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup extended error");
             }
 
-            if(!(ctxFlags & ISC_REQ_ALLOCATE_MEMORY))
+            if(!(_ctxFlags & ISC_REQ_ALLOCATE_MEMORY))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup memory allocation");
             }
 
-            if(!(ctxFlags & ISC_REQ_STREAM))
+            if(!(_ctxFlags & ISC_REQ_STREAM))
             {
                 throw SecurityException(__FILE__, __LINE__, "IceSSL: SChannel failed to setup stream");
             }
@@ -669,21 +765,24 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
 
         string trustError;
         PCCERT_CHAIN_CONTEXT certChain;
-        if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
+        if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, cert->hCertStore, &chainP,
                                     CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
         {
             CertFreeCertificateContext(cert);
             trustError = IceUtilInternal::lastErrorToString();
+            _trustError = IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
         }
         else
         {
             if(certChain->TrustStatus.dwErrorStatus != CERT_TRUST_NO_ERROR)
             {
                 trustError = trustStatusToString(certChain->TrustStatus.dwErrorStatus);
+                _trustError = trustStatusToTrustError(certChain->TrustStatus.dwErrorStatus);
             }
             else
             {
                 _verified = true;
+                _trustError = IceSSL::ICE_ENUM(TrustError, NoError);
             }
 
             CERT_SIMPLE_CHAIN* simpleChain = certChain->rgpChain[0];
@@ -741,7 +840,23 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
         throw SecurityException(__FILE__, __LINE__, "IceSSL: error reading cipher info:\n" + secStatusToString(err));
     }
 
-    _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString());
+    ConnectionInfoPtr info = ICE_DYNAMIC_CAST(ConnectionInfo, getInfo());
+    try
+    {
+        _engine->verifyPeerCertName(_host, info);
+    }
+    catch(const Ice::SecurityException&)
+    {
+        _trustError = IceSSL::ICE_ENUM(TrustError, HostNameMismatch);
+        _verified = false;
+        ICE_DYNAMIC_CAST(ExtendedConnectionInfo, info)->errorCode = IceSSL::ICE_ENUM(TrustError, HostNameMismatch);
+        info->verified = false;
+        if(_engine->getVerifyPeer() > 0)
+        {
+            throw;
+        }
+    }
+    _engine->verifyPeer(_host, info, toString());
     _state = StateHandshakeComplete;
 
     if(_instance->engine()->securityTraceLevel() >= 1)
@@ -749,12 +864,11 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
         string sslCipherName;
         string sslKeyExchangeAlgorithm;
         string sslProtocolName;
-        SecPkgContext_ConnectionInfo info;
-        if(QueryContextAttributes(&_ssl, SECPKG_ATTR_CONNECTION_INFO, &info) == SEC_E_OK)
+        if(QueryContextAttributes(&_ssl, SECPKG_ATTR_CONNECTION_INFO, &connInfo) == SEC_E_OK)
         {
-            sslCipherName = _engine->getCipherName(info.aiCipher);
-            sslKeyExchangeAlgorithm = _engine->getCipherName(info.aiExch);
-            sslProtocolName = protocolName(info.dwProtocol);
+            sslCipherName = _engine->getCipherName(connInfo.aiCipher);
+            sslKeyExchangeAlgorithm = _engine->getCipherName(connInfo.aiExch);
+            sslProtocolName = protocolName(connInfo.dwProtocol);
         }
 
         Trace out(_instance->logger(), _instance->traceCategory());
@@ -900,7 +1014,7 @@ SChannel::TransceiverI::startWrite(IceInternal::Buffer& buffer)
         _bufferedW = encryptMessage(buffer);
     }
 
-    return _delegate->startWrite(_writeBuffer) && _bufferedW == (buffer.b.end() - buffer.i);
+    return _delegate->startWrite(_writeBuffer) && _bufferedW == static_cast<size_t>((buffer.b.end() - buffer.i));
 }
 
 void
@@ -984,13 +1098,15 @@ SChannel::TransceiverI::toDetailedString() const
 Ice::ConnectionInfoPtr
 SChannel::TransceiverI::getInfo() const
 {
-    ConnectionInfoPtr info = ICE_MAKE_SHARED(ConnectionInfo);
+    ExtendedConnectionInfoPtr info = ICE_MAKE_SHARED(ExtendedConnectionInfo);
     info->underlying = _delegate->getInfo();
     info->incoming = _incoming;
     info->adapterName = _adapterName;
     info->cipher = _cipher;
     info->certs = _certs;
     info->verified = _verified;
+    info->errorCode = _trustError;
+    info->host = _incoming ? "" : _host;
     return info;
 }
 

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.h

@@ -1,15 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SCHANNELTRANSCEIVER_I_H
 #define ICESSL_SCHANNELTRANSCEIVER_I_H
 
+#ifdef _WIN32
+
 #include <IceSSL/Config.h>
 #include <IceSSL/InstanceF.h>
 #include <IceSSL/Plugin.h>
@@ -86,6 +83,7 @@ private:
         StateHandshakeNotStarted,
         StateHandshakeReadContinue,
         StateHandshakeWriteContinue,
+        StateHandshakeWriteNoContinue,
         StateHandshakeComplete
     };
 
@@ -96,6 +94,7 @@ private:
     const bool _incoming;
     const IceInternal::TransceiverPtr _delegate;
     State _state;
+    DWORD _ctxFlags;
 
     //
     // Buffered encrypted data that has not been written.
@@ -121,6 +120,7 @@ private:
     std::string _cipher;
     std::vector<IceSSL::CertificatePtr> _certs;
     bool _verified;
+    TrustError _trustError;
 };
 typedef IceUtil::Handle<TransceiverI> TransceiverIPtr;
 
@@ -129,3 +129,5 @@ typedef IceUtil::Handle<TransceiverI> TransceiverIPtr;
 } // IceSSL namespace end
 
 #endif
+
+#endif