zeroc-ice 3.7.1 → 3.7.6

data/ext/ice/cpp/src/IceSSL/SSLEngine.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/SSLEngine.h>
 #include <IceSSL/TrustManager.h>
@@ -114,6 +109,12 @@ IceSSL::SSLEngine::initialize()
     //
     _checkCertName = properties->getPropertyAsIntWithDefault(propPrefix + "CheckCertName", 0) > 0;
 
+    //
+    // CheckCertName > 1 enables SNI, the SNI extension applies to client connections,
+    // indicating the hostname to the server (must be DNS hostname, not an IP address).
+    //
+    _serverNameIndication = properties->getPropertyAsIntWithDefault(propPrefix + "CheckCertName", 0) > 1;
+
     //
     // VerifyDepthMax establishes the maximum length of a peer's certificate
     // chain, including the peer's certificate. A value of 0 means there is
@@ -206,25 +207,25 @@ IceSSL::SSLEngine::verifyPeerCertName(const string& address, const ConnectionInf
         if(!certNameOK)
         {
             ostringstream ostr;
-            ostr << "IceSSL: certificate validation failure: "
-                 << (isIpAddress ? "IP address mismatch" : "Hostname mismatch");
+            ostr << "IceSSL: ";
+            if(_verifyPeer > 0)
+            {
+                ostr << "ignoring ";
+            }
+            ostr << "certificate verification failure " << (isIpAddress ? "IP address mismatch" : "Hostname mismatch");
             string msg = ostr.str();
             if(_securityTraceLevel >= 1)
             {
                 Trace out(_logger, _securityTraceCategory);
                 out << msg;
             }
-
-            if(_verifyPeer > 0)
-            {
-                throw SecurityException(__FILE__, __LINE__, msg);
-            }
+            throw SecurityException(__FILE__, __LINE__, msg);
         }
     }
 }
 
 void
-IceSSL::SSLEngine::verifyPeer(const string& address, const ConnectionInfoPtr& info, const string& desc)
+IceSSL::SSLEngine::verifyPeer(const string& /*address*/, const ConnectionInfoPtr& info, const string& desc)
 {
     const CertificateVerifierPtr verifier = getCertificateVerifier();
     if(_verifyDepthMax > 0 && static_cast<int>(info->certs.size()) > _verifyDepthMax)
@@ -268,6 +269,12 @@ IceSSL::SSLEngine::getCheckCertName() const
     return _checkCertName;
 }
 
+bool
+IceSSL::SSLEngine::getServerNameIndication() const
+{
+    return _serverNameIndication;
+}
+
 int
 IceSSL::SSLEngine::getVerifyPeer() const
 {

data/ext/ice/cpp/src/IceSSL/SSLEngine.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_ENGINE_H
 #define ICESSL_ENGINE_H
@@ -68,6 +63,7 @@ public:
     void setPassword(const std::string& password);
 
     bool getCheckCertName() const;
+    bool getServerNameIndication() const;
     int getVerifyPeer() const;
     int securityTraceLevel() const;
     std::string securityTraceCategory() const;
@@ -88,6 +84,7 @@ private:
     PasswordPromptPtr _prompt;
 
     bool _checkCertName;
+    bool _serverNameIndication;
     int _verifyDepthMax;
     int _verifyPeer;
     int _securityTraceLevel;

data/ext/ice/cpp/src/IceSSL/SSLEngineF.h

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_ENGINE_F_H
 #define ICESSL_ENGINE_F_H

data/ext/ice/cpp/src/IceSSL/SecureTransportCertificateI.cpp

@@ -1,11 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
+
+//
+// Disable deprecation warnings for SecCertificateCopyNormalizedIssuerContent and
+// SecCertificateCopyNormalizedSubjectContent
 //
-// **********************************************************************
+#include <IceUtil/DisableWarnings.h>
 
 #include <IceSSL/Plugin.h>
 #include <IceSSL/SecureTransport.h>
@@ -82,7 +83,11 @@ class ASN1Parser
 {
 public:
 
-    ASN1Parser(CFDataRef data) : _data(CFDataGetBytePtr(data)), _length(CFDataGetLength(data)), _p(_data), _next(0)
+    ASN1Parser(CFDataRef data) :
+        _data(CFDataGetBytePtr(data)),
+        _length(static_cast<size_t>(CFDataGetLength(data))),
+        _p(_data),
+        _next(0)
     {
     }
 
@@ -169,7 +174,7 @@ public:
     parseUTF8String()
     {
         int length = parseLength(0);
-        string v(reinterpret_cast<const char*>(_p), length);
+        string v(reinterpret_cast<const char*>(_p), static_cast<size_t>(length));
         _p += length;
         return v;
     }
@@ -220,8 +225,8 @@ private:
 
 #endif
 
-class SecureTransportCertificateI : public IceSSL::SecureTransport::Certificate,
-                                    public IceSSL::CertificateI
+class SecureTransportCertificateI ICE_FINAL : public IceSSL::SecureTransport::Certificate,
+                                              public IceSSL::CertificateI
 {
 public:
 
@@ -298,8 +303,8 @@ getX509Name(SecCertificateRef cert, CFTypeRef key)
     if(property)
     {
         CFArrayRef dn = static_cast<CFArrayRef>(CFDictionaryGetValue(property.get(), kSecPropertyKeyValue));
-        int size = CFArrayGetCount(dn);
-        for(int i = 0; i < size; ++i)
+        CFIndex size = CFArrayGetCount(dn);
+        for(CFIndex i = 0; i < size; ++i)
         {
             CFDictionaryRef dict = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(dn, i));
             rdnPairs.push_front(make_pair(
@@ -322,9 +327,9 @@ getX509AltName(SecCertificateRef cert, CFTypeRef key)
     if(property)
     {
         CFArrayRef names = static_cast<CFArrayRef>(CFDictionaryGetValue(property.get(), kSecPropertyKeyValue));
-        int size = CFArrayGetCount(names);
+        CFIndex size = CFArrayGetCount(names);
 
-        for(int i = 0; i < size; ++i)
+        for(CFIndex i = 0; i < size; ++i)
         {
             CFDictionaryRef dict = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(names, i));
 
@@ -346,15 +351,15 @@ getX509AltName(SecCertificateRef cert, CFTypeRef key)
                 {
                     CFArrayRef section = (CFArrayRef)v;
                     ostringstream os;
-                    for(int i = 0, count = CFArrayGetCount(section); i < count;)
+                    for(CFIndex j = 0, count = CFArrayGetCount(section); j < count;)
                     {
-                        CFDictionaryRef d = (CFDictionaryRef)CFArrayGetValueAtIndex(section, i);
+                        CFDictionaryRef d = (CFDictionaryRef)CFArrayGetValueAtIndex(section, j);
 
                         CFStringRef sectionLabel = static_cast<CFStringRef>(CFDictionaryGetValue(d, kSecPropertyKeyLabel));
                         CFStringRef sectionValue = static_cast<CFStringRef>(CFDictionaryGetValue(d, kSecPropertyKeyValue));
 
                         os << certificateOIDAlias(fromCFString(sectionLabel)) << "=" << fromCFString(sectionValue);
-                        if(++i < count)
+                        if(++j < count)
                         {
                             os << ",";
                         }
@@ -439,7 +444,7 @@ SecureTransportCertificateI::getAuthorityKeyIdentifier() const
     if(property)
     {
         CFTypeRef type = 0;
-        CFTypeRef value;
+        CFTypeRef value = 0;
         if(CFDictionaryGetValueIfPresent(property.get(), kSecPropertyKeyType, &type))
         {
             if(CFEqual(type, kSecPropertyTypeSection))
@@ -458,8 +463,8 @@ SecureTransportCertificateI::getAuthorityKeyIdentifier() const
             {
                 CFDataRef data = static_cast<CFDataRef>(
                     CFDictionaryGetValue(static_cast<CFDictionaryRef>(value), kSecPropertyKeyValue));
-                keyid.resize(CFDataGetLength(data));
-                memcpy(&keyid[0], CFDataGetBytePtr(data), CFDataGetLength(data));
+                keyid.resize(static_cast<size_t>(CFDataGetLength(data)));
+                memcpy(&keyid[0], CFDataGetBytePtr(data), static_cast<size_t>(CFDataGetLength(data)));
             }
         }
     }
@@ -478,7 +483,7 @@ SecureTransportCertificateI::getSubjectKeyIdentifier() const
     if(property)
     {
         CFTypeRef type = 0;
-        CFTypeRef value;
+        CFTypeRef value = 0;
         if(CFDictionaryGetValueIfPresent(property.get(), kSecPropertyKeyType, &type))
         {
             if(CFEqual(type, kSecPropertyTypeSection))
@@ -497,8 +502,8 @@ SecureTransportCertificateI::getSubjectKeyIdentifier() const
             {
                 CFDataRef data = static_cast<CFDataRef>(
                     CFDictionaryGetValue(static_cast<CFDictionaryRef>(value), kSecPropertyKeyValue));
-                keyid.resize(CFDataGetLength(data));
-                memcpy(&keyid[0], CFDataGetBytePtr(data), CFDataGetLength(data));
+                keyid.resize(static_cast<size_t>(CFDataGetLength(data)));
+                memcpy(&keyid[0], CFDataGetBytePtr(data), static_cast<size_t>(CFDataGetLength(data)));
             }
         }
     }
@@ -544,7 +549,7 @@ SecureTransportCertificateI::verify(const IceSSL::CertificatePtr& cert) const
         {
             UniqueRef<SecPolicyRef> policy(SecPolicyCreateBasicX509());
             UniqueRef<SecTrustRef> trust;
-            OSStatus err = 0;;
+            OSStatus err = 0;
             if((err = SecTrustCreateWithCertificates(_cert.get(), policy.get(), &trust.get())))
             {
                 throw CertificateEncodingException(__FILE__, __LINE__, sslErrorToString(err));
@@ -579,7 +584,7 @@ SecureTransportCertificateI::encode() const
     ostringstream os;
     os << "-----BEGIN CERTIFICATE-----\n";
     os << IceInternal::Base64::encode(data);
-    os << "-----END CERTIFICATE-----\n";
+    os << "\n-----END CERTIFICATE-----\n";
     return os.str();
 #else // macOS
     UniqueRef<CFDataRef> exported;
@@ -588,7 +593,8 @@ SecureTransportCertificateI::encode() const
     {
         throw CertificateEncodingException(__FILE__, __LINE__, sslErrorToString(err));
     }
-    return string(reinterpret_cast<const char*>(CFDataGetBytePtr(exported.get())), CFDataGetLength(exported.get()));
+    return string(reinterpret_cast<const char*>(CFDataGetBytePtr(exported.get())),
+                  static_cast<size_t>(CFDataGetLength(exported.get())));
 #endif
 }
 
@@ -810,23 +816,23 @@ IceSSL::SecureTransport::CertificatePtr
 IceSSL::SecureTransport::Certificate::decode(const std::string& encoding)
 {
 #ifdef ICE_USE_SECURE_TRANSPORT_IOS
-    string::size_type size, startpos, endpos = 0;
-    startpos = encoding.find("-----BEGIN CERTIFICATE-----", endpos);
+    string::size_type size = 0;
+    string::size_type startpos = 0;
+    startpos = encoding.find("-----BEGIN CERTIFICATE-----", 0);
     if(startpos != string::npos)
     {
         startpos += sizeof("-----BEGIN CERTIFICATE-----");
-        endpos = encoding.find("-----END CERTIFICATE-----", startpos);
+        string::size_type endpos = encoding.find("-----END CERTIFICATE-----", startpos);
         size = endpos - startpos;
     }
     else
     {
         startpos = 0;
-        endpos = string::npos;
         size = encoding.size();
     }
 
     vector<unsigned char> data(IceInternal::Base64::decode(string(&encoding[startpos], size)));
-    UniqueRef<CFDataRef> certdata(CFDataCreate(kCFAllocatorDefault, &data[0], data.size()));
+    UniqueRef<CFDataRef> certdata(CFDataCreate(kCFAllocatorDefault, &data[0], static_cast<CFIndex>(data.size())));
     SecCertificateRef cert = SecCertificateCreateWithData(0, certdata.get());
     if(!cert)
     {
@@ -838,7 +844,7 @@ IceSSL::SecureTransport::Certificate::decode(const std::string& encoding)
     UniqueRef<CFDataRef> data(
         CFDataCreateWithBytesNoCopy(kCFAllocatorDefault,
                                     reinterpret_cast<const UInt8*>(encoding.c_str()),
-                                    encoding.size(), kCFAllocatorNull));
+                                    static_cast<CFIndex>(encoding.size()), kCFAllocatorNull));
 
     SecExternalFormat format = kSecFormatUnknown;
     SecExternalItemType type = kSecItemTypeCertificate;

data/ext/ice/cpp/src/IceSSL/SecureTransportEngine.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/Config.h>
 
@@ -132,7 +127,7 @@ CiphersHelper::initialize()
         _ciphers["RSA_EXPORT_WITH_RC4_40_MD5"] = SSL_RSA_EXPORT_WITH_RC4_40_MD5;
         _ciphers["RSA_WITH_RC4_128_MD5"] = SSL_RSA_WITH_RC4_128_MD5;
         _ciphers["RSA_WITH_RC4_128_SHA"] = SSL_RSA_WITH_RC4_128_SHA;
-        _ciphers["RSA_EXPORT_WITH_RC2_CBC_40_MD5"] =    SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5;
+        _ciphers["RSA_EXPORT_WITH_RC2_CBC_40_MD5"] = SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5;
         _ciphers["RSA_WITH_IDEA_CBC_SHA"] = SSL_RSA_WITH_IDEA_CBC_SHA;
         _ciphers["RSA_EXPORT_WITH_DES40_CBC_SHA"] = SSL_RSA_EXPORT_WITH_DES40_CBC_SHA;
         _ciphers["RSA_WITH_DES_CBC_SHA"] = SSL_RSA_WITH_DES_CBC_SHA;
@@ -344,6 +339,16 @@ CiphersHelper::initialize()
         _ciphers["RSA_WITH_DES_CBC_MD5"] = SSL_RSA_WITH_DES_CBC_MD5;
         _ciphers["RSA_WITH_3DES_EDE_CBC_MD5"] = SSL_RSA_WITH_3DES_EDE_CBC_MD5;
         _ciphers["NO_SUCH_CIPHERSUITE"] = SSL_NO_SUCH_CIPHERSUITE;
+
+        //
+        // TLS 1.3 standard cipher suites
+        //
+        _ciphers["TLS_AES_128_GCM_SHA256"] = TLS_AES_128_GCM_SHA256;
+        _ciphers["TLS_AES_256_GCM_SHA384"] = TLS_AES_256_GCM_SHA384;
+        _ciphers["TLS_CHACHA20_POLY1305_SHA256"] = TLS_CHACHA20_POLY1305_SHA256;
+        _ciphers["TLS_AES_128_CCM_SHA256"] = TLS_AES_128_CCM_SHA256;
+        _ciphers["TLS_AES_128_CCM_8_SHA256"] = TLS_AES_128_CCM_8_SHA256;
+
     }
 }
 
@@ -744,6 +749,21 @@ CiphersHelper::cipherName(SSLCipherSuite cipher)
             return "RSA_WITH_DES_CBC_MD5";
         case SSL_RSA_WITH_3DES_EDE_CBC_MD5:
             return "RSA_WITH_3DES_EDE_CBC_MD5";
+
+        //
+        //TLS 1.3 standard cipher suites
+        //
+        case TLS_AES_128_GCM_SHA256:
+            return "TLS_AES_128_GCM_SHA256";
+        case TLS_AES_256_GCM_SHA384:
+            return "TLS_AES_256_GCM_SHA384";
+        case TLS_CHACHA20_POLY1305_SHA256:
+            return "TLS_CHACHA20_POLY1305_SHA256";
+        case TLS_AES_128_CCM_SHA256:
+            return "TLS_AES_128_CCM_SHA256";
+        case TLS_AES_128_CCM_8_SHA256:
+            return "TLS_AES_128_CCM_8_SHA256";
+
         default:
             return "";
     }
@@ -775,6 +795,10 @@ parseProtocol(const string& p)
     {
         return kTLSProtocol12;
     }
+    else if(prot == "TLS1_3" || prot == "TLSV1_3")
+    {
+        return kTLSProtocol13;
+    }
     else
     {
         throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: unrecognized protocol `" + p + "'");
@@ -857,7 +881,6 @@ IceSSL::SecureTransport::SSLEngine::initialize()
     PasswordPromptPtr passwordPrompt = getPasswordPrompt();
 
     string certFile = properties->getProperty("IceSSL.CertFile");
-    string keyFile = properties->getProperty("IceSSL.KeyFile");
     string findCert = properties->getProperty("IceSSL.FindCert");
     string keychain = properties->getProperty("IceSSL.Keychain");
     string keychainPassword = properties->getProperty("IceSSL.KeychainPassword");
@@ -871,21 +894,24 @@ IceSSL::SecureTransport::SSLEngine::initialize()
                                                 "IceSSL: invalid value for IceSSL.CertFile:\n" + certFile);
         }
         vector<string> keyFiles;
-        if(!keyFile.empty())
         {
-            if(!IceUtilInternal::splitString(keyFile, IceUtilInternal::pathsep, keyFiles) || keyFiles.size() > 2)
-            {
-                throw PluginInitializationException(__FILE__, __LINE__,
-                                                    "IceSSL: invalid value for IceSSL.KeyFile:\n" + keyFile);
-            }
-            if(files.size() != keyFiles.size())
+            string keyFile = properties->getProperty("IceSSL.KeyFile");
+            if(!keyFile.empty())
             {
-                throw PluginInitializationException(__FILE__, __LINE__,
-                                                    "IceSSL: IceSSL.KeyFile does not agree with IceSSL.CertFile");
+                if(!IceUtilInternal::splitString(keyFile, IceUtilInternal::pathsep, keyFiles) || keyFiles.size() > 2)
+                {
+                    throw PluginInitializationException(__FILE__, __LINE__,
+                                                        "IceSSL: invalid value for IceSSL.KeyFile:\n" + keyFile);
+                }
+                if(files.size() != keyFiles.size())
+                {
+                    throw PluginInitializationException(__FILE__, __LINE__,
+                                                        "IceSSL: IceSSL.KeyFile does not agree with IceSSL.CertFile");
+                }
             }
         }
 
-        for(int i = 0; i < files.size(); ++i)
+        for(size_t i = 0; i < files.size(); ++i)
         {
             string file = files[i];
             string keyFile = keyFiles.empty() ? "" : keyFiles[i];

data/ext/ice/cpp/src/IceSSL/SecureTransportEngine.h

@@ -1,15 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SECURE_TRANSPORT_ENGINE_H
 #define ICESSL_SECURE_TRANSPORT_ENGINE_H
 
+#ifdef __APPLE__
+
 #include <IceSSL/SSLEngine.h>
 #include <Ice/UniqueRef.h>
 
@@ -58,3 +55,5 @@ private:
 } // IceSSL namespace end
 
 #endif
+
+#endif

data/ext/ice/cpp/src/IceSSL/SecureTransportEngineF.h

@@ -1,15 +1,11 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SECURE_TRANSPORT_ENGINE_F_H
 #define ICESSL_SECURE_TRANSPORT_ENGINE_F_H
 
+#ifdef __APPLE__
 #include <IceSSL/Plugin.h>
 #include <IceUtil/Shared.h>
 #include <Ice/Handle.h>
@@ -29,3 +25,5 @@ typedef IceInternal::Handle<SSLEngine> SSLEnginePtr;
 }
 
 #endif
+
+#endif