zeroc-ice 3.7.5 → 3.7.8

data/ext/ice/cpp/src/IceSSL/SecureTransportTransceiverI.cpp

@@ -4,6 +4,7 @@
 
 #include <IceSSL/SecureTransportTransceiverI.h>
 #include <IceSSL/Instance.h>
+#include <IceSSL/PluginI.h>
 #include <IceSSL/SecureTransportEngine.h>
 #include <IceSSL/SecureTransportUtil.h>
 #include <IceSSL/ConnectionInfo.h>
@@ -20,36 +21,6 @@ using namespace IceSSL::SecureTransport;
 namespace
 {
 
-string
-trustResultDescription(SecTrustResultType result)
-{
-    switch(result)
-    {
-        case kSecTrustResultInvalid:
-        {
-            return "Invalid setting or result";
-        }
-        case kSecTrustResultDeny:
-        {
-            return "The user specified that the certificate should not be trusted";
-        }
-        case kSecTrustResultRecoverableTrustFailure:
-        case kSecTrustResultFatalTrustFailure:
-        {
-            return "Trust denied";
-        }
-        case kSecTrustResultOtherError:
-        {
-            return "Other error internal error";
-        }
-        default:
-        {
-            assert(false);
-            return "";
-        }
-    }
-}
-
 string
 protocolName(SSLProtocol protocol)
 {
@@ -92,99 +63,187 @@ socketRead(SSLConnectionRef connection, void* data, size_t* length)
     return transceiver->readRaw(reinterpret_cast<char*>(data), length);
 }
 
-bool
+TrustError errorToTrustError(CFErrorRef err)
+{
+    long errorCode = CFErrorGetCode(err);
+    switch (errorCode)
+    {
+        case errSecPathLengthConstraintExceeded:
+        {
+            return IceSSL::ICE_ENUM(TrustError, ChainTooLong);
+        }
+        case errSecUnknownCRLExtension:
+        case errSecUnknownCriticalExtensionFlag:
+        {
+            return IceSSL::ICE_ENUM(TrustError, HasNonSupportedCriticalExtension);
+        }
+        case errSecHostNameMismatch:
+        {
+            return IceSSL::ICE_ENUM(TrustError, HostNameMismatch);
+        }
+        case errSecCodeSigningNoBasicConstraints:
+        case errSecNoBasicConstraints:
+        case errSecNoBasicConstraintsCA:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidBasicConstraints);
+        }
+        case errSecMissingRequiredExtension:
+        case errSecUnknownCertExtension:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidExtension);
+        }
+        case errSecCertificateNameNotAllowed:
+        case errSecInvalidName:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidNameConstraints);
+        }
+        case errSecCertificatePolicyNotAllowed:
+        case errSecInvalidPolicyIdentifiers:
+        case errSecInvalidCertificateRef:
+        case errSecInvalidDigestAlgorithm:
+        case errSecUnsupportedKeySize:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidPolicyConstraints);
+        }
+        case errSecInvalidExtendedKeyUsage:
+        case errSecInvalidKeyUsageForPolicy:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidPurpose);
+        }
+        case errSecInvalidSignature:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidSignature);
+        }
+        case errSecCertificateExpired:
+        case errSecCertificateNotValidYet:
+        case errSecCertificateValidityPeriodTooLong:
+        {
+            return IceSSL::ICE_ENUM(TrustError, InvalidTime);
+        }
+        case errSecCreateChainFailed:
+        {
+            return IceSSL::ICE_ENUM(TrustError, PartialChain);
+        }
+        case errSecCertificateRevoked:
+        {
+            return IceSSL::ICE_ENUM(TrustError, Revoked);
+        }
+        case errSecIncompleteCertRevocationCheck:
+        case errSecOCSPNotTrustedToAnchor:
+        {
+            return IceSSL::ICE_ENUM(TrustError, RevocationStatusUnknown);
+        }
+        case errSecNotTrusted:
+        case errSecVerifyActionFailed:
+        {
+            return IceSSL::ICE_ENUM(TrustError, UntrustedRoot);
+        }
+        default:
+        {
+            return IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
+        }
+    }
+}
+
+TrustError
 checkTrustResult(SecTrustRef trust,
                  const IceSSL::SecureTransport::SSLEnginePtr& engine,
                  const IceSSL::InstancePtr& instance,
                  const string& host)
 {
     OSStatus err = noErr;
-    SecTrustResultType trustResult = kSecTrustResultOtherError;
+    UniqueRef<CFErrorRef> trustErr;
     if(trust)
     {
-        if((err = SecTrustSetAnchorCertificates(trust, engine->getCertificateAuthorities())))
-        {
-            throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
-        }
-
-        //
-        // Disable network fetch, we don't want this to block.
-        //
+        // Do not allow to fetch missing intermediate certificates from the network.
         if((err = SecTrustSetNetworkFetchAllowed(trust, false)))
         {
             throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
         }
 
-        //
-        // Add SSL trust policy if we need to check the certificate name.
-        //
+        UniqueRef<CFMutableArrayRef> policies(CFArrayCreateMutable(kCFAllocatorDefault, 0,  &kCFTypeArrayCallBacks));
+        // Add SSL trust policy if we need to check the certificate name, otherwise use basic x509 policy.
         if(engine->getCheckCertName() && !host.empty())
         {
             UniqueRef<CFStringRef> hostref(toCFString(host));
             UniqueRef<SecPolicyRef> policy(SecPolicyCreateSSL(true, hostref.get()));
-            UniqueRef<CFArrayRef> policies;
-            if((err = SecTrustCopyPolicies(trust, &policies.get())))
+            CFArrayAppendValue(policies.get(), policy.get());
+        }
+        else
+        {
+            UniqueRef<SecPolicyRef> policy(SecPolicyCreateBasicX509());
+            CFArrayAppendValue(policies.get(), policy.get());
+        }
+
+        int revocationCheck = engine->getRevocationCheck();
+        if(revocationCheck > 0)
+        {
+            CFOptionFlags revocationFlags = kSecRevocationUseAnyAvailableMethod | kSecRevocationRequirePositiveResponse;
+            if(engine->getRevocationCheckCacheOnly())
             {
-                throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
+                revocationFlags |= kSecRevocationNetworkAccessDisabled;
             }
-            UniqueRef<CFMutableArrayRef> newPolicies(CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, policies.get()));
-            CFArrayAppendValue(newPolicies.get(), policy.get());
-            if((err = SecTrustSetPolicies(trust, newPolicies.get())))
+
+            UniqueRef<SecPolicyRef> revocationPolicy(SecPolicyCreateRevocation(revocationFlags));
+            if(!revocationPolicy)
             {
-                throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
+                throw SecurityException(__FILE__,
+                                        __LINE__,
+                                        "IceSSL: handshake failure: error creating revocation policy");
             }
+            CFArrayAppendValue(policies.get(), revocationPolicy.get());
         }
 
-        //
-        // Evaluate the trust
-        //
-        if((err = SecTrustEvaluate(trust, &trustResult)))
+        if((err = SecTrustSetPolicies(trust, policies.get())))
         {
             throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
         }
-    }
 
-    switch(trustResult)
-    {
-    case kSecTrustResultUnspecified:
-    case kSecTrustResultProceed:
-    {
-        //
-        // Trust verify success.
-        //
-        return true;
-    }
-    default:
-    // case kSecTrustResultInvalid:
-    // case kSecTrustResultConfirm: // Used in old macOS versions
-    // case kSecTrustResultDeny:
-    // case kSecTrustResultRecoverableTrustFailure:
-    // case kSecTrustResultFatalTrustFailure:
-    // case kSecTrustResultOtherError:
-    {
-        if(engine->getVerifyPeer() == 0)
+        CFArrayRef certificateAuthorities = engine->getCertificateAuthorities();
+        if(certificateAuthorities != 0)
         {
-            if(instance->traceLevel() >= 1)
+            if((err = SecTrustSetAnchorCertificates(trust, certificateAuthorities)))
             {
-                ostringstream os;
-                os << "IceSSL: ignoring certificate verification failure:\n" << trustResultDescription(trustResult);
-                instance->logger()->trace(instance->traceCategory(), os.str());
+                throw SecurityException(__FILE__, __LINE__, "IceSSL: handshake failure:\n" + sslErrorToString(err));
             }
-            return false;
+            SecTrustSetAnchorCertificatesOnly(trust, true);
+        }
+
+        //
+        // Evaluate the trust
+        //
+        if(SecTrustEvaluateWithError(trust, &trustErr.get()))
+        {
+            return IceSSL::ICE_ENUM(TrustError, NoError);
         }
         else
         {
-            ostringstream os;
-            os << "IceSSL: certificate verification failure:\n" << trustResultDescription(trustResult);
-            string msg = os.str();
-            if(instance->traceLevel() >= 1)
+            TrustError trustError = errorToTrustError(trustErr.get());
+            if(engine->getVerifyPeer() == 0)
+            {
+                if(instance->traceLevel() >= 1)
+                {
+                    ostringstream os;
+                    os << "IceSSL: ignoring certificate verification failure:\n"
+                       << getTrustErrorDescription(trustError);
+                    instance->logger()->trace(instance->traceCategory(), os.str());
+                }
+                return trustError;
+            }
+            else
             {
-                instance->logger()->trace(instance->traceCategory(), msg);
+                ostringstream os;
+                os << "IceSSL: certificate verification failure:\n" << getTrustErrorDescription(trustError);
+                string msg = os.str();
+                if(instance->traceLevel() >= 1)
+                {
+                    instance->logger()->trace(instance->traceCategory(), msg);
+                }
+                throw SecurityException(__FILE__, __LINE__, msg);
             }
-            throw SecurityException(__FILE__, __LINE__, msg);
         }
     }
-    }
+    return IceSSL::ICE_ENUM(TrustError, UnknownTrustFailure);
 }
 }
 
@@ -288,7 +347,8 @@ IceSSL::SecureTransport::TransceiverI::initialize(IceInternal::Buffer& readBuffe
             }
             if(err == noErr)
             {
-                _verified = checkTrustResult(_trust.get(), _engine, _instance, _host);
+                _trustError = checkTrustResult(_trust.get(), _engine, _instance, _host);
+                _verified = _trustError == IceSSL::ICE_ENUM(TrustError, NoError);
                 continue; // Call SSLHandshake to resume the handsake.
             }
             // Let it fall through, this will raise a SecurityException with the SSLCopyPeerTrust error.
@@ -546,13 +606,15 @@ IceSSL::SecureTransport::TransceiverI::toDetailedString() const
 Ice::ConnectionInfoPtr
 IceSSL::SecureTransport::TransceiverI::getInfo() const
 {
-    IceSSL::ConnectionInfoPtr info = ICE_MAKE_SHARED(IceSSL::ConnectionInfo);
+    IceSSL::ExtendedConnectionInfoPtr info = ICE_MAKE_SHARED(IceSSL::ExtendedConnectionInfo);
     info->underlying = _delegate->getInfo();
     info->incoming = _incoming;
     info->adapterName = _adapterName;
     info->cipher = _cipher;
     info->certs = _certs;
     info->verified = _verified;
+    info->errorCode = _trustError;
+    info->host = _incoming ? "" : _host;
     return info;
 }
 

data/ext/ice/cpp/src/IceSSL/SecureTransportTransceiverI.h

@@ -77,6 +77,7 @@ private:
     size_t _maxRecvPacketSize;
     std::string _cipher;
     std::vector<CertificatePtr> _certs;
+    TrustError _trustError;
     bool _verified;
     size_t _buffered;
 };

data/ext/ice/cpp/src/IceUtil/OutputUtil.cpp

@@ -34,10 +34,15 @@ IceUtilInternal::int64ToString(Int64 val)
 
 #if defined(_WIN32)
     sprintf_s(buf, sizeof(buf), "%I64d", val);
-#elif defined(ICE_64)
-    sprintf(buf, "%ld", val); // Avoids a format warning from GCC.
+#elif defined(__APPLE__)
+    // sprintf is deprecated with macOS Ventura
+    snprintf(buf, sizeof(buf), "%ld", val); // Avoids a format warning from GCC.
 #else
+#   if defined(ICE_64)
+    sprintf(buf, "%ld", val); // Avoids a format warning from GCC.
+#   else
     sprintf(buf, "%lld", val);
+#   endif
 #endif
     return string(buf);
 }

data/ext/ice/cpp/src/IceUtil/StringConverter.cpp

@@ -2,6 +2,12 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 
+#if defined(_MSC_VER) && (_MSVC_LANG >= 201703L)
+    // TODO codecvt was deprecated in C++17 and cause build failures with VC++ compiler
+    // we should replace this code with MultiByteToWideChar() and WideCharToMultiByte()
+#   define  _SILENCE_CXX17_CODECVT_HEADER_DEPRECATION_WARNING
+#endif
+
 #include <IceUtil/StringConverter.h>
 #include <IceUtil/MutexPtrLock.h>
 #include <IceUtil/Mutex.h>

data/ext/ice/cpp/src/IceUtil/Time.cpp

@@ -246,7 +246,7 @@ IceUtil::Time::toDateTime() const
     os << toString("%x %H:%M:%S") << ".";
     os.fill('0');
     os.width(3);
-    os << static_cast<long>(_usec % 1000000 / 1000);
+    os << static_cast<Int64>(_usec % 1000000 / 1000);
     return os.str();
 }
 
@@ -278,7 +278,7 @@ IceUtil::Time::toDuration() const
 std::string
 IceUtil::Time::toString(const std::string& format) const
 {
-    time_t time = static_cast<long>(_usec / 1000000);
+    time_t time = static_cast<time_t>(_usec / 1000000);
 
     struct tm tr;
 #ifdef _MSC_VER

data/ext/ice/cpp/src/Slice/CPlusPlusUtil.cpp

@@ -1191,13 +1191,13 @@ lookupKwd(const string& name)
     //
     static const string keywordList[] =
     {
-        "alignas", "alignof", "and", "and_eq", "asm", "auto", "bit_and", "bit_or", "bool", "break",
-        "case", "catch", "char", "char16_t", "char32_t", "class", "compl", "const", "const_exptr", "const_cast", "continue",
+        "alignas", "alignof", "and", "and_eq", "asm", "auto", "bitand", "bitor", "bool", "break",
+        "case", "catch", "char", "char16_t", "char32_t", "class", "compl", "const", "const_cast", "constexpr", "continue",
         "decltype", "default", "delete", "do", "double", "dynamic_cast",
         "else", "enum", "explicit", "export", "extern", "false", "float", "for", "friend",
-        "goto", "if", "inline", "int", "long", "mutable", "namespace", "new", "noexcept", "not", "not_eq",
-        "operator", "or", "or_eq", "private", "protected", "public", "register", "reinterpret_cast", "return",
-        "short", "signed", "sizeof", "static", "static_assert", "static_cast", "struct", "switch",
+        "goto", "if", "inline", "int", "long", "mutable", "namespace", "new", "noexcept", "not", "not_eq", "nullptr",
+        "operator", "or", "or_eq", "private", "protected", "public", "register", "reinterpret_cast", "requires",
+        "return", "short", "signed", "sizeof", "static", "static_assert", "static_cast", "struct", "switch",
         "template", "this", "thread_local", "throw", "true", "try", "typedef", "typeid", "typename",
         "union", "unsigned", "using", "virtual", "void", "volatile", "wchar_t", "while", "xor", "xor_eq"
     };
@@ -1257,7 +1257,11 @@ Slice::fixKwd(const string& name)
         return lookupKwd(name);
     }
     StringList ids = splitScopedName(name);
+#ifdef ICE_CPP11_COMPILER
+    transform(ids.begin(), ids.end(), ids.begin(), [](const string& id) -> string { return lookupKwd(id); });
+#else
     transform(ids.begin(), ids.end(), ids.begin(), ptr_fun(lookupKwd));
+#endif
     stringstream result;
     for(StringList::const_iterator i = ids.begin(); i != ids.end(); ++i)
     {

data/ext/ice/cpp/src/Slice/JavaUtil.cpp

@@ -868,7 +868,11 @@ Slice::JavaCompatGenerator::fixKwd(const string& name) const
         return lookupKwd(name);
     }
     StringList ids = splitScopedName(name);
+#ifdef ICE_CPP11_COMPILER
+    transform(ids.begin(), ids.end(), ids.begin(), [](const string& id) -> string { return lookupKwd(id); });
+#else
     transform(ids.begin(), ids.end(), ids.begin(), ptr_fun(lookupKwd));
+#endif
     stringstream result;
     for(StringList::const_iterator i = ids.begin(); i != ids.end(); ++i)
     {
@@ -3348,7 +3352,11 @@ Slice::JavaGenerator::fixKwd(const string& name) const
         return lookupKwd(name);
     }
     StringList ids = splitScopedName(name);
+#ifdef ICE_CPP11_COMPILER
+    transform(ids.begin(), ids.end(), ids.begin(), [](const string& id) -> string { return lookupKwd(id); });
+#else
     transform(ids.begin(), ids.end(), ids.begin(), ptr_fun(lookupKwd));
+#endif
     stringstream result;
     for(StringList::const_iterator i = ids.begin(); i != ids.end(); ++i)
     {

data/ext/ice/cpp/src/Slice/MD5I.cpp

@@ -52,6 +52,7 @@
  */
 
 #include <Slice/MD5I.h>
+#include <stdint.h>
 #include <string.h>
 
 #ifdef __GNUC__
@@ -172,7 +173,7 @@ md5_process(md5_state_t *pms, const md5_byte_t *data /*[64]*/)
              * On little-endian machines, we can process properly aligned
              * data without copying it.
              */
-            if (!((data - (const md5_byte_t *)0) & 3)) {
+            if (!((reinterpret_cast<uintptr_t>(data)) & 3)) {
                 /* data are properly aligned */
                 X = (const md5_word_t *)data;
             } else {

data/ext/ice/cpp/src/Slice/PHPUtil.cpp

@@ -128,7 +128,11 @@ Slice::PHP::fixIdent(const string& ident)
         return lookupKwd(ident);
     }
     vector<string> ids = splitScopedName(ident);
+#ifdef ICE_CPP11_COMPILER
+    transform(ids.begin(), ids.end(), ids.begin(), [](const string& id) -> string { return lookupKwd(id); });
+#else
     transform(ids.begin(), ids.end(), ids.begin(), ptr_fun(lookupKwd));
+#endif
     stringstream result;
     for(vector<string>::const_iterator i = ids.begin(); i != ids.end(); ++i)
     {

data/ext/ice/cpp/src/Slice/Parser.cpp

@@ -1107,7 +1107,11 @@ Slice::Contained::Contained(const ContainerPtr& container, const string& name) :
 void
 Slice::Container::destroy()
 {
+#ifdef ICE_CPP11_COMPILER
+    for_each(_contents.begin(), _contents.end(), [](const SyntaxTreeBasePtr& it) { it->destroy();  });
+#else
     for_each(_contents.begin(), _contents.end(), ::IceUtil::voidMemFun(&SyntaxTreeBase::destroy));
+#endif
     _contents.clear();
     _introducedMap.clear();
     SyntaxTreeBase::destroy();

data/ext/ice/cpp/src/Slice/Parser.h

@@ -181,7 +181,7 @@ struct OptionalDef
 // CICompare -- function object to do case-insensitive string comparison.
 // ----------------------------------------------------------------------
 
-class CICompare : public std::binary_function<std::string, std::string, bool>
+class CICompare
 {
 public:
 
@@ -197,7 +197,7 @@ bool cICompare(const std::string&, const std::string&);
 // most-derived to least-derived order.
 // ----------------------------------------------------------------------
 
-class DerivedToBaseCompare : public std::binary_function<std::string, std::string, bool>
+class DerivedToBaseCompare
 {
 public:
 

data/ext/ice/cpp/src/Slice/PythonUtil.cpp

@@ -805,7 +805,20 @@ Slice::Python::CodeVisitor::visitClassDefStart(const ClassDefPtr& p)
             TypePtr ret = (*oli)->returnType();
             ParamDeclList paramList = (*oli)->parameters();
             string inParams;
+            string inParamsDecl;
 
+            // Find the last required parameter, all optional parameters after the last required parameter will use
+            // Ice.Unset as the default.
+            ParamDeclPtr lastRequiredParameter;
+            for(ParamDeclList::const_iterator q = paramList.begin(); q != paramList.end(); ++q)
+            {
+                if(!(*q)->isOutParam() && !(*q)->optional())
+                {
+                    lastRequiredParameter = *q;
+                }
+            }
+
+            bool afterLastRequiredParameter = lastRequiredParameter == ICE_NULLPTR;
             for(ParamDeclList::const_iterator q = paramList.begin(); q != paramList.end(); ++q)
             {
                 if(!(*q)->isOutParam())
@@ -813,17 +826,29 @@ Slice::Python::CodeVisitor::visitClassDefStart(const ClassDefPtr& p)
                     if(!inParams.empty())
                     {
                         inParams.append(", ");
+                        inParamsDecl.append(", ");
+                    }
+                    string param = fixIdent((*q)->name());
+                    inParams.append(param);
+                    if(afterLastRequiredParameter)
+                    {
+                        param += "=Ice.Unset";
+                    }
+                    inParamsDecl.append(param);
+
+                    if(*q == lastRequiredParameter)
+                    {
+                        afterLastRequiredParameter = true;
                     }
-                    inParams.append(fixIdent((*q)->name()));
                 }
             }
 
             _out << sp;
             writeDocstring(*oli, DocSync, false);
             _out << nl << "def " << fixedOpName << "(self";
-            if(!inParams.empty())
+            if(!inParamsDecl.empty())
             {
-                _out << ", " << inParams;
+                _out << ", " << inParamsDecl;
             }
             const string contextParamName = getEscapedParamName(*oli, "context");
             _out << ", " << contextParamName << "=None):";
@@ -949,7 +974,15 @@ Slice::Python::CodeVisitor::visitClassDefStart(const ClassDefPtr& p)
         //
         ClassList allBases = p->allBases();
         StringList ids;
+#ifdef ICE_CPP11_COMPILER
+        transform(allBases.begin(), allBases.end(), back_inserter(ids),
+                  [](const ContainedPtr& it)
+                  {
+                      return it->scoped();
+                  });
+#else
         transform(allBases.begin(), allBases.end(), back_inserter(ids), IceUtil::constMemFun(&Contained::scoped));
+#endif
         StringList other;
         other.push_back(scoped);
         other.push_back("::Ice::Object");
@@ -2999,7 +3032,11 @@ Slice::Python::fixIdent(const string& ident)
         return lookupKwd(ident);
     }
     vector<string> ids = splitScopedName(ident);
+#ifdef ICE_CPP11_COMPILER
+    transform(ids.begin(), ids.end(), ids.begin(), [](const string& id) -> string { return lookupKwd(id); });
+#else
     transform(ids.begin(), ids.end(), ids.begin(), ptr_fun(lookupKwd));
+#endif
     stringstream result;
     for(vector<string>::const_iterator i = ids.begin(); i != ids.end(); ++i)
     {