zeroc-ice 3.7.1 → 3.7.6

data/ext/ice/cpp/src/IceSSL/SecureTransportPluginI.cpp

@@ -1,11 +1,6 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/PluginI.h>
 #include <IceSSL/SecureTransport.h>

data/ext/ice/cpp/src/IceSSL/SecureTransportTransceiverI.cpp

@@ -1,14 +1,10 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #include <IceSSL/SecureTransportTransceiverI.h>
 #include <IceSSL/Instance.h>
+#include <IceSSL/PluginI.h>
 #include <IceSSL/SecureTransportEngine.h>
 #include <IceSSL/SecureTransportUtil.h>
 #include <IceSSL/ConnectionInfo.h>
@@ -25,36 +21,6 @@ using namespace IceSSL::SecureTransport;
 namespace
 {
 
-string
-trustResultDescription(SecTrustResultType result)
-{
-    switch(result)
-    {
-        case kSecTrustResultInvalid:
-        {
-            return "Invalid setting or result";
-        }
-        case kSecTrustResultDeny:
-        {
-            return "The user specified that the certificate should not be trusted";
-        }
-        case kSecTrustResultRecoverableTrustFailure:
-        case kSecTrustResultFatalTrustFailure:
-        {
-            return "Trust denied";
-        }
-        case kSecTrustResultOtherError:
-        {
-            return "Other error internal error";
-        }
-        default:
-        {
-            assert(false);
-            return "";
-        }
-    }
-}
-
 string
 protocolName(SSLProtocol protocol)
 {
@@ -97,14 +63,96 @@ socketRead(SSLConnectionRef connection, void* data, size_t* length)
     return transceiver->readRaw(reinterpret_cast<char*>(data), length);
 }
 
-bool
+TrustError errorToTrustError(CFErrorRef err)
+{
+    long errorCode = CFErrorGetCode(err);
+    switch (errorCode)
+    {
+        case errSecPathLengthConstraintExceeded:
+        {
+            return IceSSL::ICE_ENUM(TrustError, ChainTooLong);
+        }
+        case errSecUnknownCRLExtension:
+        case errSecUnknownCriticalExtensionFlag:
+        {
+            return IceSSL::ICE_ENUM(TrustError, HasNonSupportedCriticalExtension);
+        }
+        case errSecHostNameMismatch:
+        {
+            return IceSSL::ICE_ENUM(TrustError, HostNameMismatch);
+        }
+        case errSecCodeSigningNoBasicConstraints:
+        case errSecNoBasicConstraints:
+        case errSecNoBasicConstraintsCA:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidBasicConstraints);
+        }
+        case errSecMissingRequiredExtension:
+        case errSecUnknownCertExtension:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidExtension);
+        }
+        case errSecCertificateNameNotAllowed:
+        case errSecInvalidName:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidNameConstraints);
+        }
+        case errSecCertificatePolicyNotAllowed:
+        case errSecInvalidPolicyIdentifiers:
+        case errSecInvalidCertificateRef:
+        case errSecInvalidDigestAlgorithm:
+        case errSecUnsupportedKeySize:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidPolicyConstraints);
+        }
+        case errSecInvalidExtendedKeyUsage:
+        case errSecInvalidKeyUsageForPolicy:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidPurpose);
+        }
+        case errSecInvalidSignature:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidSignature);
+        }
+        case errSecCertificateExpired:
+        case errSecCertificateNotValidYet:
+        case errSecCertificateValidityPeriodTooLong:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidTime);
+        }
+        case errSecCreateChainFailed:
+        {
+            return IceSSL::ICE_ENUM(TrustError, PartialChain);
+        }
+        case errSecCertificateRevoked:
+        {
+            return IceSSL::ICE_ENUM(TrustError, Revoked);
+        }
+        case errSecIncompleteCertRevocationCheck:
+        case errSecOCSPNotTrustedToAnchor:
+        {
+            return IceSSL::ICE_ENUM(TrustError, RevocationStatusUnknown);
+        }
+        case errSecNotTrusted:
+        case errSecVerifyActionFailed:
+        {
+            return IceSSL::ICE_ENUM(TrustError, UntrustedRoot);
+        }
+        default:
+        {
+            return IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
+        }
+    }
+}
+
+TrustError
 checkTrustResult(SecTrustRef trust,
                  const IceSSL::SecureTransport::SSLEnginePtr& engine,
                  const IceSSL::InstancePtr& instance,
                  const string& host)
 {
     OSStatus err = noErr;
-    SecTrustResultType trustResult = kSecTrustResultOtherError;
+    UniqueRef<CFErrorRef> trustErr;
     if(trust)
     {
         if((err = SecTrustSetAnchorCertificates(trust, engine->getCertificateAuthorities())))
@@ -125,7 +173,8 @@ checkTrustResult(SecTrustRef trust,
         //
         if(engine->getCheckCertName() && !host.empty())
         {
-            UniqueRef<SecPolicyRef> policy(SecPolicyCreateSSL(false, toCFString(host)));
+            UniqueRef<CFStringRef> hostref(toCFString(host));
+            UniqueRef<SecPolicyRef> policy(SecPolicyCreateSSL(true, hostref.get()));
             UniqueRef<CFArrayRef> policies;
             if((err = SecTrustCopyPolicies(trust, &policies.get())))
             {
@@ -142,53 +191,38 @@ checkTrustResult(SecTrustRef trust,
         //
         // Evaluate the trust
         //
-        if((err = SecTrustEvaluate(trust, &trustResult)))
+        if(SecTrustEvaluateWithError(trust, &trustErr.get()))
         {
-            throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
+            return IceSSL::ICE_ENUM(TrustError, NoError);
         }
-    }
-
-    switch(trustResult)
-    {
-    case kSecTrustResultUnspecified:
-    case kSecTrustResultProceed:
-    {
-        //
-        // Trust verify success.
-        //
-        return true;
-    }
-    default:
-    // case kSecTrustResultInvalid:
-    // case kSecTrustResultConfirm: // Used in old macOS versions
-    // case kSecTrustResultDeny:
-    // case kSecTrustResultRecoverableTrustFailure:
-    // case kSecTrustResultFatalTrustFailure:
-    // case kSecTrustResultOtherError:
-    {
-        if(engine->getVerifyPeer() == 0)
+        else
         {
-            if(instance->traceLevel() >= 1)
+            TrustError trustError = errorToTrustError(trustErr.get());
+            if(engine->getVerifyPeer() == 0)
             {
-                ostringstream os;
-                os << "IceSSL: ignoring certificate verification failure:\n" << trustResultDescription(trustResult);
-                instance->logger()->trace(instance->traceCategory(), os.str());
+                if(instance->traceLevel() >= 1)
+                {
+                    ostringstream os;
+                    os << "IceSSL: ignoring certificate verification failure:\n"
+                       << getTrustErrorDescription(trustError);
+                    instance->logger()->trace(instance->traceCategory(), os.str());
+                }
+                return trustError;
             }
-            return false;
-        }
-        else
-        {
-            ostringstream os;
-            os << "IceSSL: certificate verification failure:\n" << trustResultDescription(trustResult);
-            string msg = os.str();
-            if(instance->traceLevel() >= 1)
+            else
             {
-                instance->logger()->trace(instance->traceCategory(), msg);
+                ostringstream os;
+                os << "IceSSL: certificate verification failure:\n" << getTrustErrorDescription(trustError);
+                string msg = os.str();
+                if(instance->traceLevel() >= 1)
+                {
+                    instance->logger()->trace(instance->traceCategory(), msg);
+                }
+                throw SecurityException(__FILE__, __LINE__, msg);
             }
-            throw SecurityException(__FILE__, __LINE__, msg);
         }
     }
-    }
+    return IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
 }
 }
 
@@ -215,8 +249,18 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
     // Limit the size of packets passed to SSLWrite/SSLRead to avoid
     // blocking and holding too much memory.
     //
-    _maxSendPacketSize = std::max(512, IceInternal::getSendBufferSize(_delegate->getNativeInfo()->fd()));
-    _maxRecvPacketSize = std::max(512, IceInternal::getRecvBufferSize(_delegate->getNativeInfo()->fd()));
+    if(_delegate->getNativeInfo()->fd() != INVALID_SOCKET)
+    {
+        _maxSendPacketSize =
+            static_cast<size_t>(std::max(512, IceInternal::getSendBufferSize(_delegate->getNativeInfo()->fd())));
+        _maxRecvPacketSize =
+            static_cast<size_t>(std::max(512, IceInternal::getRecvBufferSize(_delegate->getNativeInfo()->fd())));
+    }
+    else
+    {
+        _maxSendPacketSize = 128 * 1024; // 128KB
+        _maxRecvPacketSize = 128 * 1024; // 128KB
+    }
 
     OSStatus err = 0;
     if(!_ssl)
@@ -236,6 +280,18 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
             throw SecurityException(__FILE__, __LINE__, "IceSSL: setting SSL connection failed\n" +
                                     sslErrorToString(err));
         }
+
+        //
+        // Enable SNI
+        //
+        if(!_incoming && _engine->getServerNameIndication() && !_host.empty() && !IceInternal::isIpAddress(_host))
+        {
+            if((err = SSLSetPeerDomainName(_ssl.get(), _host.data(), _host.length())))
+            {
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: setting SNI host failed `" + _host + "'\n" +
+                                        sslErrorToString(err));
+            }
+        }
     }
 
     SSLSessionState state;
@@ -253,8 +309,8 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
         }
         else if(err == errSSLWouldBlock)
         {
-            assert(_flags & SSLWantRead || _flags & SSLWantWrite);
-            return _flags & SSLWantRead ? IceInternal::SocketOperationRead : IceInternal::SocketOperationWrite;
+            assert(_tflags & SSLWantRead || _tflags & SSLWantWrite);
+            return _tflags & SSLWantRead ? IceInternal::SocketOperationRead : IceInternal::SocketOperationWrite;
         }
         else if(err == errSSLPeerAuthCompleted)
         {
@@ -270,7 +326,8 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
             }
             if(err == noErr)
             {
-                _verified = checkTrustResult(_trust.get(), _engine, _instance, _host);
+                _trustError = checkTrustResult(_trust.get(), _engine, _instance, _host);
+                _verified = _trustError == IceSSL::ICE_ENUM(TrustError, NoError);
                 continue; // Call SSLHandshake to resume the handsake.
             }
             // Let it fall through, this will raise a SecurityException with the SSLCopyPeerTrust error.
@@ -286,7 +343,7 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
         throw ProtocolException(__FILE__, __LINE__, os.str());
     }
 
-    for(int i = 0, count = SecTrustGetCertificateCount(_trust.get()); i < count; ++i)
+    for(CFIndex i = 0, count = SecTrustGetCertificateCount(_trust.get()); i < count; ++i)
     {
         SecCertificateRef cert = SecTrustGetCertificateAtIndex(_trust.get(), i);
         CFRetain(cert);
@@ -294,9 +351,11 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
     }
 
     assert(_ssl);
-    SSLCipherSuite cipher;
-    SSLGetNegotiatedCipher(_ssl.get(), &cipher);
-    _cipher = _engine->getCipherName(cipher);
+    {
+        SSLCipherSuite cipher;
+        SSLGetNegotiatedCipher(_ssl.get(), &cipher);
+        _cipher = _engine->getCipherName(cipher);
+    }
 
     _engine->verifyPeer(_host, ICE_DYNAMIC_CAST(ConnectionInfo, getInfo()), toString());
 
@@ -381,7 +440,7 @@ IceSSL::SecureTransport::TransceiverI::write(IceInternal::Buffer& buf)
                 {
                     _buffered = processed;
                 }
-                assert(_flags & SSLWantWrite);
+                assert(_tflags & SSLWantWrite);
                 return IceInternal::SocketOperationWrite;
             }
 
@@ -420,9 +479,9 @@ IceSSL::SecureTransport::TransceiverI::write(IceInternal::Buffer& buf)
             buf.i += processed;
         }
 
-        if(packetSize > buf.b.end() - buf.i)
+        if(packetSize > static_cast<size_t>(buf.b.end() - buf.i))
         {
-            packetSize = buf.b.end() - buf.i;
+            packetSize = static_cast<size_t>(buf.b.end() - buf.i);
         }
     }
 
@@ -454,7 +513,7 @@ IceSSL::SecureTransport::TransceiverI::read(IceInternal::Buffer& buf)
             if(err == errSSLWouldBlock)
             {
                 buf.i += processed;
-                assert(_flags & SSLWantRead);
+                assert(_tflags & SSLWantRead);
                 return IceInternal::SocketOperationRead;
             }
 
@@ -485,9 +544,9 @@ IceSSL::SecureTransport::TransceiverI::read(IceInternal::Buffer& buf)
 
         buf.i += processed;
 
-        if(packetSize > buf.b.end() - buf.i)
+        if(packetSize > static_cast<size_t>(buf.b.end() - buf.i))
         {
-            packetSize = buf.b.end() - buf.i;
+            packetSize = static_cast<size_t>(buf.b.end() - buf.i);
         }
     }
 
@@ -526,13 +585,15 @@ IceSSL::SecureTransport::TransceiverI::toDetailedString() const
 Ice::ConnectionInfoPtr
 IceSSL::SecureTransport::TransceiverI::getInfo() const
 {
-    IceSSL::ConnectionInfoPtr info = ICE_MAKE_SHARED(IceSSL::ConnectionInfo);
+    IceSSL::ExtendedConnectionInfoPtr info = ICE_MAKE_SHARED(IceSSL::ExtendedConnectionInfo);
     info->underlying = _delegate->getInfo();
     info->incoming = _incoming;
     info->adapterName = _adapterName;
     info->cipher = _cipher;
     info->certs = _certs;
     info->verified = _verified;
+    info->errorCode = _trustError;
+    info->host = _incoming ? "" : _host;
     return info;
 }
 
@@ -570,7 +631,7 @@ IceSSL::SecureTransport::TransceiverI::~TransceiverI()
 OSStatus
 IceSSL::SecureTransport::TransceiverI::writeRaw(const char* data, size_t* length) const
 {
-    _flags &= ~SSLWantWrite;
+    _tflags &= ~SSLWantWrite;
 
     try
     {
@@ -578,8 +639,8 @@ IceSSL::SecureTransport::TransceiverI::writeRaw(const char* data, size_t* length
         IceInternal::SocketOperation op = _delegate->write(buf);
         if(op == IceInternal::SocketOperationWrite)
         {
-            *length = buf.i - buf.b.begin();
-            _flags |= SSLWantWrite;
+            *length = static_cast<size_t>(buf.i - buf.b.begin());
+            _tflags |= SSLWantWrite;
             return errSSLWouldBlock;
         }
         assert(op == IceInternal::SocketOperationNone);
@@ -603,7 +664,7 @@ IceSSL::SecureTransport::TransceiverI::writeRaw(const char* data, size_t* length
 OSStatus
 IceSSL::SecureTransport::TransceiverI::readRaw(char* data, size_t* length) const
 {
-    _flags &= ~SSLWantRead;
+    _tflags &= ~SSLWantRead;
 
     try
     {
@@ -611,8 +672,8 @@ IceSSL::SecureTransport::TransceiverI::readRaw(char* data, size_t* length) const
         IceInternal::SocketOperation op = _delegate->read(buf);
         if(op == IceInternal::SocketOperationRead)
         {
-            *length = buf.i - buf.b.begin();
-            _flags |= SSLWantRead;
+            *length = static_cast<size_t>(buf.i - buf.b.begin());
+            _tflags |= SSLWantRead;
             return errSSLWouldBlock;
         }
         assert(op == IceInternal::SocketOperationNone);

data/ext/ice/cpp/src/IceSSL/SecureTransportTransceiverI.h

@@ -1,15 +1,12 @@
-// **********************************************************************
 //
-// Copyright (c) 2003-2018 ZeroC, Inc. All rights reserved.
+// Copyright (c) ZeroC, Inc. All rights reserved.
 //
-// This copy of Ice is licensed to you under the terms described in the
-// ICE_LICENSE file included in this distribution.
-//
-// **********************************************************************
 
 #ifndef ICESSL_SECURE_TRANSPORT_TRANSCEIVER_I_H
 #define ICESSL_SECURE_TRANSPORT_TRANSCEIVER_I_H
 
+#ifdef __APPLE__
+
 #include <IceSSL/Config.h>
 #include <IceSSL/InstanceF.h>
 #include <IceSSL/SecureTransportEngineF.h>
@@ -75,11 +72,12 @@ private:
         SSLWantWrite = 0x2
     };
 
-    mutable Ice::Byte _flags;
+    mutable Ice::Byte _tflags;
     size_t _maxSendPacketSize;
     size_t _maxRecvPacketSize;
     std::string _cipher;
     std::vector<CertificatePtr> _certs;
+    TrustError _trustError;
     bool _verified;
     size_t _buffered;
 };
@@ -90,3 +88,5 @@ typedef IceUtil::Handle<TransceiverI> TransceiverIPtr;
 } // IceSSL namespace end
 
 #endif
+
+#endif