zeroc-ice 3.7.5 → 3.7.8

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.cpp

@@ -9,6 +9,7 @@
 #include <IceSSL/ConnectionInfo.h>
 #include <IceSSL/Instance.h>
 #include <IceSSL/SChannelEngine.h>
+#include <IceSSL/PluginI.h>
 #include <IceSSL/Util.h>
 #include <Ice/Communicator.h>
 #include <Ice/LoggerUtil.h>
@@ -19,6 +20,10 @@ using namespace std;
 using namespace Ice;
 using namespace IceSSL;
 
+#ifndef CERT_CHAIN_DISABLE_AIA
+#   define CERT_CHAIN_DISABLE_AIA 0x00002000
+#endif
+
 namespace
 {
 
@@ -47,6 +52,93 @@ protocolName(DWORD protocol)
     }
 }
 
+TrustError
+trustStatusToTrustError(DWORD status)
+{
+    if (status & CERT_TRUST_NO_ERROR)
+    {
+        return IceSSL::ICE_ENUM(TrustError, NoError);
+    }
+    if ((status & CERT_TRUST_IS_UNTRUSTED_ROOT) ||
+        (status & CERT_TRUST_IS_CYCLIC) ||
+        (status & CERT_TRUST_CTL_IS_NOT_TIME_VALID) ||
+        (status & CERT_TRUST_CTL_IS_NOT_SIGNATURE_VALID) ||
+        (status & CERT_TRUST_CTL_IS_NOT_VALID_FOR_USAGE))
+    {
+        return IceSSL::ICE_ENUM(TrustError, UntrustedRoot);
+    }
+    if (status & CERT_TRUST_IS_EXPLICIT_DISTRUST)
+    {
+        return IceSSL::ICE_ENUM(TrustError, NotTrusted);
+    }
+    if (status & CERT_TRUST_IS_PARTIAL_CHAIN)
+    {
+        return IceSSL::ICE_ENUM(TrustError, PartialChain);
+    }
+    if (status & CERT_TRUST_INVALID_BASIC_CONSTRAINTS)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidBasicConstraints);
+    }
+    if (status & CERT_TRUST_IS_NOT_SIGNATURE_VALID)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidSignature);
+    }
+    if (status & CERT_TRUST_IS_NOT_VALID_FOR_USAGE)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidPurpose);
+    }
+    if (status & CERT_TRUST_IS_REVOKED)
+    {
+        return IceSSL::ICE_ENUM(TrustError, Revoked);
+    }
+    if (status & CERT_TRUST_INVALID_EXTENSION)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidExtension);
+    }
+    if (status & CERT_TRUST_INVALID_POLICY_CONSTRAINTS)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidPolicyConstraints);
+    }
+    if (status & CERT_TRUST_INVALID_NAME_CONSTRAINTS)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidNameConstraints);
+    }
+    if (status & CERT_TRUST_HAS_NOT_SUPPORTED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonSupportedNameConstraint);
+    }
+    if (status & CERT_TRUST_HAS_NOT_DEFINED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonDefinedNameConstraint);
+    }
+    if (status & CERT_TRUST_HAS_NOT_PERMITTED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonPermittedNameConstraint);
+    }
+    if (status & CERT_TRUST_HAS_EXCLUDED_NAME_CONSTRAINT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasExcludedNameConstraint);
+    }
+    if (status & CERT_TRUST_NO_ISSUANCE_CHAIN_POLICY)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidPolicyConstraints);
+    }
+    if (status & CERT_TRUST_HAS_NOT_SUPPORTED_CRITICAL_EXT)
+    {
+        return IceSSL::ICE_ENUM(TrustError, HasNonSupportedCriticalExtension);
+    }
+    if (status & CERT_TRUST_IS_OFFLINE_REVOCATION ||
+        status & CERT_TRUST_REVOCATION_STATUS_UNKNOWN)
+    {
+        return IceSSL::ICE_ENUM(TrustError, RevocationStatusUnknown);
+    }
+    if (status & CERT_TRUST_IS_NOT_TIME_VALID)
+    {
+        return IceSSL::ICE_ENUM(TrustError, InvalidTime);
+    }
+    return IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
+}
+
 string
 trustStatusToString(DWORD status)
 {
@@ -674,21 +766,38 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
 
         string trustError;
         PCCERT_CHAIN_CONTEXT certChain;
-        if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, 0, &chainP,
-                                    CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY, 0, &certChain))
+        DWORD dwFlags = 0;
+        int revocationCheck = _engine->getRevocationCheck();
+        if(revocationCheck > 0)
+        {
+            if(_engine->getRevocationCheckCacheOnly())
+            {
+                // Disable network I/O for revocation checks.
+                dwFlags = CERT_CHAIN_REVOCATION_CHECK_CACHE_ONLY | CERT_CHAIN_DISABLE_AIA;
+            }
+
+            dwFlags |= (revocationCheck == 1 ?
+                        CERT_CHAIN_REVOCATION_CHECK_END_CERT :
+                        CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT);
+        }
+
+        if(!CertGetCertificateChain(_engine->chainEngine(), cert, 0, cert->hCertStore, &chainP, dwFlags, 0, &certChain))
         {
             CertFreeCertificateContext(cert);
             trustError = IceUtilInternal::lastErrorToString();
+            _trustError = IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
         }
         else
         {
             if(certChain->TrustStatus.dwErrorStatus != CERT_TRUST_NO_ERROR)
             {
                 trustError = trustStatusToString(certChain->TrustStatus.dwErrorStatus);
+                _trustError = trustStatusToTrustError(certChain->TrustStatus.dwErrorStatus);
             }
             else
             {
                 _verified = true;
+                _trustError = IceSSL::ICE_ENUM(TrustError, NoError);
             }
 
             CERT_SIMPLE_CHAIN* simpleChain = certChain->rgpChain[0];
@@ -753,7 +862,10 @@ SChannel::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal:
     }
     catch(const Ice::SecurityException&)
     {
+        _trustError = IceSSL::ICE_ENUM(TrustError, HostNameMismatch);
         _verified = false;
+        ICE_DYNAMIC_CAST(ExtendedConnectionInfo, info)->errorCode = IceSSL::ICE_ENUM(TrustError, HostNameMismatch);
+        info->verified = false;
         if(_engine->getVerifyPeer() > 0)
         {
             throw;
@@ -1001,13 +1113,15 @@ SChannel::TransceiverI::toDetailedString() const
 Ice::ConnectionInfoPtr
 SChannel::TransceiverI::getInfo() const
 {
-    ConnectionInfoPtr info = ICE_MAKE_SHARED(ConnectionInfo);
+    ExtendedConnectionInfoPtr info = ICE_MAKE_SHARED(ExtendedConnectionInfo);
     info->underlying = _delegate->getInfo();
     info->incoming = _incoming;
     info->adapterName = _adapterName;
     info->cipher = _cipher;
     info->certs = _certs;
     info->verified = _verified;
+    info->errorCode = _trustError;
+    info->host = _incoming ? "" : _host;
     return info;
 }
 

data/ext/ice/cpp/src/IceSSL/SChannelTransceiverI.h

@@ -120,6 +120,7 @@ private:
     std::string _cipher;
     std::vector<IceSSL::CertificatePtr> _certs;
     bool _verified;
+    TrustError _trustError;
 };
 typedef IceUtil::Handle<TransceiverI> TransceiverIPtr;
 

data/ext/ice/cpp/src/IceSSL/SSLEngine.cpp

@@ -27,7 +27,9 @@ IceSSL::SSLEngine::SSLEngine(const Ice::CommunicatorPtr& communicator) :
     _initialized(false),
     _communicator(communicator),
     _logger(communicator->getLogger()),
-    _trustManager(new TrustManager(communicator))
+    _trustManager(new TrustManager(communicator)),
+    _revocationCheckCacheOnly(false),
+    _revocationCheck(0)
 {
 }
 
@@ -135,6 +137,11 @@ IceSSL::SSLEngine::initialize()
 
     _securityTraceLevel = properties->getPropertyAsInt("IceSSL.Trace.Security");
     _securityTraceCategory = "Security";
+
+    const_cast<bool&>(_revocationCheckCacheOnly) =
+        properties->getPropertyAsIntWithDefault("IceSSL.RevocationCheckCacheOnly", 1) > 0;
+    const_cast<int&>(_revocationCheck) =
+        properties->getPropertyAsIntWithDefault("IceSSL.RevocationCheck", 0);
 }
 
 void
@@ -292,3 +299,15 @@ IceSSL::SSLEngine::securityTraceCategory() const
 {
     return _securityTraceCategory;
 }
+
+bool
+IceSSL::SSLEngine::getRevocationCheckCacheOnly() const
+{
+    return _revocationCheckCacheOnly;
+}
+
+int
+IceSSL::SSLEngine::getRevocationCheck() const
+{
+    return _revocationCheck;
+}

data/ext/ice/cpp/src/IceSSL/SSLEngine.h

@@ -66,6 +66,8 @@ public:
     bool getServerNameIndication() const;
     int getVerifyPeer() const;
     int securityTraceLevel() const;
+    bool getRevocationCheckCacheOnly() const;
+    int getRevocationCheck() const;
     std::string securityTraceCategory() const;
 
 protected:
@@ -89,6 +91,8 @@ private:
     int _verifyPeer;
     int _securityTraceLevel;
     std::string _securityTraceCategory;
+    const bool _revocationCheckCacheOnly;
+    const int _revocationCheck;
 };
 
 }

data/ext/ice/cpp/src/IceSSL/SecureTransportCertificateI.cpp

@@ -8,7 +8,7 @@
 //
 #include <IceUtil/DisableWarnings.h>
 
-#include <IceSSL/Plugin.h>
+#include <IceSSL/PluginI.h>
 #include <IceSSL/SecureTransport.h>
 #include <IceSSL/CertificateI.h>
 #include <IceSSL/SecureTransportUtil.h>
@@ -32,6 +32,29 @@ using namespace std;
 namespace
 {
 
+static unsigned char _ekuAnyKeyUsage[4] = {0x55, 0x1d, 0x25, 0x00};
+static unsigned char _ekuServerAuthentication[8] = {0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x01};
+static unsigned char _ekuClientAuthentication[8] = {0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x02};
+static unsigned char _ekuCodeSigning[8] = {0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x03};
+static unsigned char _ekuEmailProtection[8] = {0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x04};
+static unsigned char _ekuTimeStamping[8] = {0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x08};
+static unsigned char _ekuOCSPSigning[8] = {0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03, 0x09};
+
+static CFDataRef ekuAnyKeyUsage =
+    CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, _ekuAnyKeyUsage, 4, kCFAllocatorNull);
+static CFDataRef ekuServerAuthentication =
+    CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, _ekuServerAuthentication, 8, kCFAllocatorNull);
+static CFDataRef ekuClientAuthentication =
+    CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, _ekuClientAuthentication, 8, kCFAllocatorNull);
+static CFDataRef ekuCodeSigning =
+    CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, _ekuCodeSigning, 8, kCFAllocatorNull);
+static CFDataRef ekuEmailProtection =
+    CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, _ekuEmailProtection, 8, kCFAllocatorNull);
+static CFDataRef ekuTimeStamping =
+    CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, _ekuTimeStamping, 8, kCFAllocatorNull);
+static CFDataRef ekuOCSPSigning =
+    CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, _ekuOCSPSigning, 8, kCFAllocatorNull);
+
 string
 certificateOIDAlias(const string& name)
 {
@@ -226,7 +249,8 @@ private:
 #endif
 
 class SecureTransportCertificateI ICE_FINAL : public IceSSL::SecureTransport::Certificate,
-                                              public IceSSL::CertificateI
+                                              public IceSSL::CertificateI,
+                                              public IceSSL::CertificateExtendedInfo
 {
 public:
 
@@ -254,6 +278,8 @@ public:
     virtual vector<pair<int, string> > getSubjectAlternativeNames() const;
     virtual int getVersion() const;
     virtual SecCertificateRef getCert() const;
+    virtual unsigned int getKeyUsage() const;
+    virtual unsigned int getExtendedKeyUsage() const;
 
 private:
 
@@ -792,6 +818,111 @@ SecureTransportCertificateI::initializeAttributes() const
 }
 #endif
 
+unsigned int
+SecureTransportCertificateI::getKeyUsage() const
+{
+#ifdef ICE_USE_SECURE_TRANSPORT_IOS
+    throw Ice::FeatureNotSupportedException(__FILE__, __LINE__);
+#else
+    unsigned int keyUsage = 0;
+    UniqueRef<CFDictionaryRef> property(getCertificateProperty(_cert.get(), kSecOIDKeyUsage));
+    if(property)
+    {
+        CFNumberRef value = static_cast<CFNumberRef>(CFDictionaryGetValue(property.get(), kSecPropertyKeyValue));
+        if(value)
+        {
+            unsigned int usageBits = 0;
+            CFNumberGetValue(value, kCFNumberSInt32Type, &usageBits);
+            if(usageBits & kSecKeyUsageDigitalSignature)
+            {
+                keyUsage |= KEY_USAGE_DIGITAL_SIGNATURE;
+            }
+            if(usageBits & kSecKeyUsageNonRepudiation)
+            {
+                keyUsage |= KEY_USAGE_NON_REPUDIATION;
+            }
+            if(usageBits & kSecKeyUsageKeyEncipherment)
+            {
+                keyUsage |= KEY_USAGE_KEY_ENCIPHERMENT;
+            }
+            if(usageBits & kSecKeyUsageDataEncipherment)
+            {
+                keyUsage |= KEY_USAGE_DATA_ENCIPHERMENT;
+            }
+            if(usageBits & kSecKeyUsageKeyAgreement)
+            {
+                keyUsage |= KEY_USAGE_KEY_AGREEMENT;
+            }
+            if(usageBits & kSecKeyUsageKeyCertSign)
+            {
+                keyUsage |= KEY_USAGE_KEY_CERT_SIGN;
+            }
+            if(usageBits & kSecKeyUsageCRLSign)
+            {
+                keyUsage |= KEY_USAGE_CRL_SIGN;
+            }
+            if(usageBits & kSecKeyUsageEncipherOnly)
+            {
+                keyUsage |= KEY_USAGE_ENCIPHER_ONLY;
+            }
+            if(usageBits & kSecKeyUsageDecipherOnly)
+            {
+                keyUsage |= KEY_USAGE_DECIPHER_ONLY;
+            }
+        }
+    }
+    return keyUsage;
+#endif
+}
+
+unsigned int
+SecureTransportCertificateI::getExtendedKeyUsage() const
+{
+#ifdef ICE_USE_SECURE_TRANSPORT_IOS
+    throw Ice::FeatureNotSupportedException(__FILE__, __LINE__);
+#else
+    unsigned int extendedKeyUsage = 0;
+    UniqueRef<CFDictionaryRef> property(getCertificateProperty(_cert.get(), kSecOIDExtendedKeyUsage));
+    if(property)
+    {
+        CFArrayRef usages = static_cast<CFArrayRef>(CFDictionaryGetValue(property.get(), kSecPropertyKeyValue));
+        if(usages)
+        {
+            long size = CFArrayGetCount(usages);
+            if (CFArrayContainsValue(usages, CFRangeMake(0, size), ekuAnyKeyUsage))
+            {
+                extendedKeyUsage |= EXTENDED_KEY_USAGE_ANY_KEY_USAGE;
+            }
+            if (CFArrayContainsValue(usages, CFRangeMake(0, size), ekuServerAuthentication))
+            {
+                extendedKeyUsage |= EXTENDED_KEY_USAGE_SERVER_AUTH;
+            }
+            if (CFArrayContainsValue(usages, CFRangeMake(0, size), ekuClientAuthentication))
+            {
+                extendedKeyUsage |= EXTENDED_KEY_USAGE_CLIENT_AUTH;
+            }
+            if (CFArrayContainsValue(usages, CFRangeMake(0, size), ekuCodeSigning))
+            {
+                extendedKeyUsage |= EXTENDED_KEY_USAGE_CODE_SIGNING;
+            }
+            if (CFArrayContainsValue(usages, CFRangeMake(0, size), ekuEmailProtection))
+            {
+                extendedKeyUsage |= EXTENDED_KEY_USAGE_EMAIL_PROTECTION;
+            }
+            if (CFArrayContainsValue(usages, CFRangeMake(0, size), ekuTimeStamping))
+            {
+                extendedKeyUsage |= EXTENDED_KEY_USAGE_TIME_STAMPING;
+            }
+            if (CFArrayContainsValue(usages, CFRangeMake(0, size), ekuOCSPSigning))
+            {
+                extendedKeyUsage |= EXTENDED_KEY_USAGE_OCSP_SIGNING;
+            }
+        }
+    }
+    return extendedKeyUsage;
+#endif
+}
+
 IceSSL::SecureTransport::CertificatePtr
 IceSSL::SecureTransport::Certificate::create(SecCertificateRef cert)
 {