zeroc-ice 3.7.3 → 3.7.7

data/ext/ice/cpp/src/IceSSL/PluginI.cpp

@@ -130,3 +130,117 @@ ICEregisterIceSSL(bool loadOnInitialize)
 {
     Ice::registerIceSSL(loadOnInitialize);
 }
+
+IceSSL::TrustError
+IceSSL::getTrustError(const IceSSL::ConnectionInfoPtr& info)
+{
+    ExtendedConnectionInfoPtr extendedInfo = ICE_DYNAMIC_CAST(ExtendedConnectionInfo, info);
+    if (extendedInfo)
+    {
+        return extendedInfo->errorCode;
+    }
+    return info->verified ? IceSSL::ICE_ENUM(TrustError, NoError) : IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
+}
+
+std::string
+IceSSL::getTrustErrorDescription(TrustError error)
+{
+    switch(error)
+    {
+        case  IceSSL::ICE_ENUM(TrustError, NoError):
+        {
+            return "no error";
+        }
+        case IceSSL::ICE_ENUM(TrustError, ChainTooLong):
+        {
+            return "the certificate chain length is greater than the specified maximum depth";
+        }
+        case IceSSL::ICE_ENUM(TrustError, HasExcludedNameConstraint):
+        {
+            return "the X509 chain is invalid because a certificate has excluded a name constraint";
+        }
+        case IceSSL::ICE_ENUM(TrustError, HasNonDefinedNameConstraint):
+        {
+            return "the certificate has an undefined name constraint";
+        }
+        case IceSSL::ICE_ENUM(TrustError, HasNonPermittedNameConstraint):
+        {
+            return "the certificate has a non permitted name constrain";
+        }
+        case IceSSL::ICE_ENUM(TrustError, HasNonSupportedCriticalExtension):
+        {
+            return "the certificate does not support a critical extension";
+        }
+        case IceSSL::ICE_ENUM(TrustError, HasNonSupportedNameConstraint):
+        {
+            return "the certificate does not have a supported name constraint or has a name constraint that "
+                   "is unsupported";
+        }
+        case IceSSL::ICE_ENUM(TrustError, HostNameMismatch):
+        {
+            return "a host name mismatch has occurred";
+        }
+        case IceSSL::ICE_ENUM(TrustError, InvalidBasicConstraints):
+        {
+            return "the X509 chain is invalid due to invalid basic constraints";
+        }
+        case IceSSL::ICE_ENUM(TrustError, InvalidExtension):
+        {
+            return "the X509 chain is invalid due to an invalid extension";
+        }
+        case IceSSL::ICE_ENUM(TrustError, InvalidNameConstraints):
+        {
+            return "the X509 chain is invalid due to invalid name constraints";
+        }
+        case IceSSL::ICE_ENUM(TrustError, InvalidPolicyConstraints):
+        {
+            return "the X509 chain is invalid due to invalid policy constraints";
+        }
+        case IceSSL::ICE_ENUM(TrustError, InvalidPurpose):
+        {
+            return "the supplied certificate cannot be used for the specified purpose";
+        }
+        case IceSSL::ICE_ENUM(TrustError, InvalidSignature):
+        {
+            return "the X509 chain is invalid due to an invalid certificate signature";
+        }
+        case IceSSL::ICE_ENUM(TrustError, InvalidTime):
+        {
+            return "the X509 chain is not valid due to an invalid time value, such as a value that indicates an "
+                   "expired certificate";
+        }
+        case IceSSL::ICE_ENUM(TrustError, NotTrusted):
+        {
+            return "the certificate is explicitly distrusted";
+        }
+        case IceSSL::ICE_ENUM(TrustError, PartialChain):
+        {
+            return "the X509 chain could not be built up to the root certificate";
+        }
+        case IceSSL::ICE_ENUM(TrustError, RevocationStatusUnknown):
+        {
+            return "it is not possible to determine whether the certificate has been revoked";
+        }
+        case IceSSL::ICE_ENUM(TrustError, Revoked):
+        {
+            return "the X509 chain is invalid due to a revoked certificate";
+        }
+        case IceSSL::ICE_ENUM(TrustError, UntrustedRoot):
+        {
+            return "the X509 chain is invalid due to an untrusted root certificate";
+        }
+        case IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure):
+        {
+            return "unknown failure";
+        }
+    }
+    assert(false);
+    return "unknown failure";
+}
+
+std::string
+IceSSL::getHost(const IceSSL::ConnectionInfoPtr& info)
+{
+    ExtendedConnectionInfoPtr extendedInfo = ICE_DYNAMIC_CAST(ExtendedConnectionInfo, info);
+    return extendedInfo ? extendedInfo->host : "";
+}

data/ext/ice/cpp/src/IceSSL/PluginI.h

@@ -7,11 +7,32 @@
 
 #include <IceSSL/Plugin.h>
 #include <IceSSL/SSLEngineF.h>
+#include <IceSSL/ConnectionInfo.h>
 #include <Ice/CommunicatorF.h>
 
 namespace IceSSL
 {
 
+class ExtendedConnectionInfo : public ConnectionInfo
+{
+public:
+
+    TrustError errorCode;
+    std::string host;
+};
+ICE_DEFINE_PTR(ExtendedConnectionInfoPtr, ExtendedConnectionInfo);
+
+// TODO: This class provides new certificate virtual methods that canot be added directly to the certificate class
+// without breaking binary compatibility. The class can be removed once the relevant methods can be marked as virtual in
+// the certificate class in the next major release (3.8.x).
+class ICESSL_API CertificateExtendedInfo
+{
+public:
+
+    virtual unsigned int getKeyUsage() const = 0;
+    virtual unsigned int getExtendedKeyUsage() const = 0;
+};
+
 class ICESSL_API PluginI : public virtual IceSSL::Plugin
 {
 public:

data/ext/ice/cpp/src/IceSSL/SChannelCertificateI.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 
-#include <IceSSL/Plugin.h>
+#include <IceSSL/PluginI.h>
 #include <IceSSL/SChannel.h>
 #include <IceSSL/CertificateI.h>
 #include <IceSSL/Util.h>
@@ -59,6 +59,7 @@ private:
 
 class SChannelCertificateI : public SChannel::Certificate,
                              public CertificateI,
+                             public IceSSL::CertificateExtendedInfo,
                              public IceUtil::Mutex
 {
 public:
@@ -94,6 +95,9 @@ protected:
 
 private:
 
+    virtual unsigned int getKeyUsage() const;
+    virtual unsigned int getExtendedKeyUsage() const;
+
     CERT_SIGNED_CONTENT_INFO* _cert;
     CERT_INFO* _certInfo;
     CertInfoHolderPtr _certInfoHolder;
@@ -557,6 +561,143 @@ SChannelCertificateI::loadX509Extensions() const
     }
 }
 
+unsigned int
+SChannelCertificateI::getKeyUsage() const
+{
+    unsigned int keyUsage = 0;
+    BYTE usage[2];
+    if(CertGetIntendedKeyUsage(X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, _certInfo, usage, 2))
+    {
+        if (usage[0] & CERT_DIGITAL_SIGNATURE_KEY_USAGE)
+        {
+            keyUsage |= KEY_USAGE_DIGITAL_SIGNATURE;
+        }
+        if (usage[0] & CERT_NON_REPUDIATION_KEY_USAGE)
+        {
+            keyUsage |= KEY_USAGE_NON_REPUDIATION;
+        }
+        if (usage[0] & CERT_KEY_ENCIPHERMENT_KEY_USAGE)
+        {
+            keyUsage |= KEY_USAGE_KEY_ENCIPHERMENT;
+        }
+        if (usage[0] & CERT_DATA_ENCIPHERMENT_KEY_USAGE)
+        {
+            keyUsage |= KEY_USAGE_DATA_ENCIPHERMENT;
+        }
+        if (usage[0] & CERT_KEY_AGREEMENT_KEY_USAGE)
+        {
+            keyUsage |= KEY_USAGE_KEY_AGREEMENT;
+        }
+        if (usage[0] & CERT_KEY_CERT_SIGN_KEY_USAGE)
+        {
+            keyUsage |= KEY_USAGE_KEY_CERT_SIGN;
+        }
+        if(usage[0] & CERT_CRL_SIGN_KEY_USAGE)
+        {
+            keyUsage |= KEY_USAGE_CRL_SIGN;
+        }
+        if(usage[0] & CERT_ENCIPHER_ONLY_KEY_USAGE)
+        {
+            keyUsage |= KEY_USAGE_ENCIPHER_ONLY;
+        }
+        if(usage[1] & CERT_DECIPHER_ONLY_KEY_USAGE)
+        {
+            keyUsage |= KEY_USAGE_DECIPHER_ONLY;
+        }
+    }
+    else if(GetLastError())
+    {
+        throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+    }
+    return keyUsage;
+}
+
+unsigned int
+SChannelCertificateI::getExtendedKeyUsage() const
+{
+    unsigned int extendedKeyUsage = 0;
+    const CERT_CONTEXT* certContext = CertCreateCertificateContext(X509_ASN_ENCODING,
+                                                                   _cert->ToBeSigned.pbData,
+                                                                   _cert->ToBeSigned.cbData);
+    if(certContext == 0)
+    {
+        throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+    }
+    try
+    {
+        DWORD cbUsage;
+        if(!CertGetEnhancedKeyUsage(certContext, 0, 0, &cbUsage))
+        {
+            if(GetLastError() == CRYPT_E_NOT_FOUND)
+            {
+                return 0;
+            }
+            else
+            {
+                throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+            }
+        }
+
+        if (cbUsage > 0)
+        {
+            vector<unsigned char> pUsage;
+            pUsage.resize(cbUsage);
+            if(!CertGetEnhancedKeyUsage(certContext, 0, reinterpret_cast<CERT_ENHKEY_USAGE*>(&pUsage[0]), &cbUsage))
+            {
+                if(GetLastError() == CRYPT_E_NOT_FOUND)
+                {
+                    return 0;
+                }
+                else
+                {
+                    throw CertificateEncodingException(__FILE__, __LINE__, IceUtilInternal::lastErrorToString());
+                }
+            }
+
+            CERT_ENHKEY_USAGE* enkeyUsage = reinterpret_cast<CERT_ENHKEY_USAGE*>(&pUsage[0]);
+            for(DWORD i = 0; i < enkeyUsage->cUsageIdentifier; i++)
+            {
+                LPSTR oid = enkeyUsage->rgpszUsageIdentifier[i];
+                if(strcmp(oid, szOID_ANY_ENHANCED_KEY_USAGE) == 0)
+                {
+                    extendedKeyUsage |= EXTENDED_KEY_USAGE_ANY_KEY_USAGE;
+                }
+                if(strcmp(oid, szOID_PKIX_KP_SERVER_AUTH) == 0)
+                {
+                    extendedKeyUsage |= EXTENDED_KEY_USAGE_SERVER_AUTH;
+                }
+                if(strcmp(oid, szOID_PKIX_KP_CLIENT_AUTH) == 0)
+                {
+                    extendedKeyUsage |= EXTENDED_KEY_USAGE_CLIENT_AUTH;
+                }
+                if(strcmp(oid, szOID_PKIX_KP_CODE_SIGNING) == 0)
+                {
+                    extendedKeyUsage |= EXTENDED_KEY_USAGE_CODE_SIGNING;
+                }
+                if(strcmp(oid, szOID_PKIX_KP_EMAIL_PROTECTION) == 0)
+                {
+                    extendedKeyUsage |= EXTENDED_KEY_USAGE_EMAIL_PROTECTION;
+                }
+                if(strcmp(oid, szOID_PKIX_KP_TIMESTAMP_SIGNING) == 0)
+                {
+                    extendedKeyUsage |= EXTENDED_KEY_USAGE_TIME_STAMPING;
+                }
+                if(strcmp(oid, szOID_PKIX_KP_OCSP_SIGNING) == 0)
+                {
+                    extendedKeyUsage |= EXTENDED_KEY_USAGE_OCSP_SIGNING;
+                }
+            }
+        }
+        CertFreeCertificateContext(certContext);
+    }
+    catch(...)
+    {
+        CertFreeCertificateContext(certContext);
+        throw;
+    }
+    return extendedKeyUsage;
+}
+
 SChannel::CertificatePtr
 SChannel::Certificate::create(CERT_SIGNED_CONTENT_INFO* cert)
 {

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.cpp

@@ -9,6 +9,7 @@
 #include <IceSSL/ConnectionInfo.h>
 #include <IceSSL/Instance.h>
 #include <IceSSL/SChannelEngine.h>
+#include <IceSSL/PluginI.h>
 #include <IceSSL/Util.h>
 #include <Ice/Communicator.h>
 #include <Ice/LoggerUtil.h>
@@ -19,6 +20,10 @@ using namespace std;
 using namespace Ice;
 using namespace IceSSL;
 
+#ifndef CERT_CHAIN_DISABLE_AIA
+#   define CERT_CHAIN_DISABLE_AIA 0x00002000
+#endif
+
 namespace
 {
 
@@ -47,6 +52,93 @@ protocolName(DWORD protocol)
     }
 }
 
+TrustError
+trustStatusToTrustError(DWORD status)
+{
+    if (status & CERT_TRUST_NO_ERROR)
+    {
+        return IceSSL::ICE_ENUM(TrustError, NoError);
+    }
+    if ((status & CERT_TRUST_IS_UNTRUSTED_ROOT) ||
+        (status & CERT_TRUST_IS_CYCLIC) ||
+        (status & CERT_TRUST_CTL_IS_NOT_TIME_VALID) ||
+        (status & CERT_TRUST_CTL_IS_NOT_SIGNATURE_VALID) ||
+        (status & CERT_TRUST_CTL_IS_NOT_VALID_FOR_USAGE))
+    {
+        return IceSSL::ICE_ENUM(TrustError, UntrustedRoot);
+    }
+    if (status & CERT_TRUST_IS_EXPLICIT_DISTRUST)
+    {
+        return IceSSL::ICE_ENUM(TrustError, NotTrusted);
+    }
+    if (status & CERT_TRUST_IS_PARTIAL_CHAIN)
+    {
+        return IceSSL::ICE_ENUM(TrustError, PartialChain);
+    }
+    if (status & CERT_TRUST_INVALID_BASIC_CONSTRAINTS)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidBasicConstraints);
+    }
+    if (status & CERT_TRUST_IS_NOT_SIGNATURE_VALID)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidSignature);
+    }
+    if (status & CERT_TRUST_IS_NOT_VALID_FOR_USAGE)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidPurpose);
+    }
+    if (status & CERT_TRUST_IS_REVOKED)
+    {
+        return IceSSL::ICE_ENUM(TrustError, Revoked);
+    }
+    if (status & CERT_TRUST_INVALID_EXTENSION)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidExtension);
+    }
+    if (status & CERT_TRUST_INVALID_POLICY_CONSTRAINTS)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidPolicyConstraints);
+    }
+    if (status & CERT_TRUST_INVALID_NAME_CONSTRAINTS)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidNameConstraints);
+    }
+    if (status & CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonSupportedNameConstraint);
+    }
+    if (status & CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonDefinedNameConstraint);
+    }
+    if (status & CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonPermittedNameConstraint);
+    }
+    if (status & CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasExcludedNameConstraint);
+    }
+    if (status & CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidPolicyConstraints);
+    }
+    if (status & CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonSupportedCriticalExtension);
+    }
+    if (status & CERT_TRUST_IS_OFFLINE_REVOCATION ||
+        status & CERT_TRUST_REVOCATION_STATUS_UNKNOWN)
+    {
+        return IceSSL::ICE_ENUM(TrustError, RevocationStatusUnknown);
+    }
+    if (status & CERT_TRUST_IS_NOT_TIME_VALID)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidTime);
+    }
+    return IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
+}
+
 string
 trustStatusToString(DWORD status)
 {
@@ -674,21 +766,38 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
 
         string trustError;
         PCCERT_CHAIN_CONTEXT certChain;
-        if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
-                                    CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
+        DWORD dwFlags = 0;
+        int revocationCheck = _engine->getRevocationCheck();
+        if(revocationCheck > 0)
+        {
+            if(_engine->getRevocationCheckCacheOnly())
+            {
+                // Disable network I/O for revocation checks.
+                dwFlags = CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY | CERT_CHAIN_DISABLE_AIA;
+            }
+
+            dwFlags |= (revocationCheck == 1 ?
+                        CERT_CHAIN_REVOCATION_CHECK_END_CERT :
+                        CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT);
+        }
+
+        if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, cert->hCertStore, &chainP, dwFlags, 0, &certChain))
         {
             CertFreeCertificateContext(cert);
             trustError = IceUtilInternal::lastErrorToString();
+            _trustError = IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
         }
         else
         {
             if(certChain->TrustStatus.dwErrorStatus != CERT_TRUST_NO_ERROR)
             {
                 trustError = trustStatusToString(certChain->TrustStatus.dwErrorStatus);
+                _trustError = trustStatusToTrustError(certChain->TrustStatus.dwErrorStatus);
             }
             else
             {
                 _verified = true;
+                _trustError = IceSSL::ICE_ENUM(TrustError, NoError);
             }
 
             CERT_SIMPLE_CHAIN* simpleChain = certChain->rgpChain[0];
@@ -753,7 +862,10 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
     }
     catch(const Ice::SecurityException&)
     {
+        _trustError = IceSSL::ICE_ENUM(TrustError, HostNameMismatch);
         _verified = false;
+        ICE_DYNAMIC_CAST(ExtendedConnectionInfo, info)->errorCode = IceSSL::ICE_ENUM(TrustError, HostNameMismatch);
+        info->verified = false;
         if(_engine->getVerifyPeer() > 0)
         {
             throw;
@@ -1001,13 +1113,15 @@ SChannel::TransceiverI::toDetailedString() const
 Ice::ConnectionInfoPtr
 SChannel::TransceiverI::getInfo() const
 {
-    ConnectionInfoPtr info = ICE_MAKE_SHARED(ConnectionInfo);
+    ExtendedConnectionInfoPtr info = ICE_MAKE_SHARED(ExtendedConnectionInfo);
     info->underlying = _delegate->getInfo();
     info->incoming = _incoming;
     info->adapterName = _adapterName;
     info->cipher = _cipher;
     info->certs = _certs;
     info->verified = _verified;
+    info->errorCode = _trustError;
+    info->host = _incoming ? "" : _host;
     return info;
 }
 

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.h

@@ -120,6 +120,7 @@ private:
     std::string _cipher;
     std::vector<IceSSL::CertificatePtr> _certs;
     bool _verified;
+    TrustError _trustError;
 };
 typedef IceUtil::Handle<TransceiverI> TransceiverIPtr;
 

data/ext/ice/cpp/src/IceSSL/SSLEngine.cpp

@@ -27,7 +27,9 @@ IceSSL::SSLEngine::SSLEngine(const Ice::CommunicatorPtr& communicator) :
     _initialized(false),
     _communicator(communicator),
     _logger(communicator->getLogger()),
-    _trustManager(new TrustManager(communicator))
+    _trustManager(new TrustManager(communicator)),
+    _revocationCheckCacheOnly(false),
+    _revocationCheck(0)
 {
 }
 
@@ -135,6 +137,11 @@ IceSSL::SSLEngine::initialize()
 
     _securityTraceLevel = properties->getPropertyAsInt("IceSSL.Trace.Security");
     _securityTraceCategory = "Security";
+
+    const_cast<bool&>(_revocationCheckCacheOnly) =
+        properties->getPropertyAsIntWithDefault("IceSSL.RevocationCheckCacheOnly", 1) > 0;
+    const_cast<int&>(_revocationCheck) =
+        properties->getPropertyAsIntWithDefault("IceSSL.RevocationCheck", 0);
 }
 
 void
@@ -292,3 +299,15 @@ IceSSL::SSLEngine::securityTraceCategory() const
 {
     return _securityTraceCategory;
 }
+
+bool
+IceSSL::SSLEngine::getRevocationCheckCacheOnly() const
+{
+    return _revocationCheckCacheOnly;
+}
+
+int
+IceSSL::SSLEngine::getRevocationCheck() const
+{
+    return _revocationCheck;
+}

data/ext/ice/cpp/src/IceSSL/SSLEngine.h

@@ -66,6 +66,8 @@ public:
     bool getServerNameIndication() const;
     int getVerifyPeer() const;
     int securityTraceLevel() const;
+    bool getRevocationCheckCacheOnly() const;
+    int getRevocationCheck() const;
     std::string securityTraceCategory() const;
 
 protected:
@@ -89,6 +91,8 @@ private:
     int _verifyPeer;
     int _securityTraceLevel;
     std::string _securityTraceCategory;
+    const bool _revocationCheckCacheOnly;
+    const int _revocationCheck;
 };
 
 }