zeroc-ice 3.7.5 → 3.7.8

data/ext/ice/cpp/src/Ice/ServantLocatorF.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -35,7 +35,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif

data/ext/ice/cpp/src/Ice/SliceChecksumDict.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -37,7 +37,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif

data/ext/ice/cpp/src/Ice/Thread.cpp

@@ -714,9 +714,9 @@ IceUtil::Thread::start(size_t stackSize, bool realtimeScheduling, int priority)
     }
     if(stackSize > 0)
     {
-        if(stackSize < PTHREAD_STACK_MIN)
+        if(stackSize < static_cast<size_t>(PTHREAD_STACK_MIN))
         {
-            stackSize = PTHREAD_STACK_MIN;
+            stackSize = static_cast<size_t>(PTHREAD_STACK_MIN);
         }
 #ifdef __APPLE__
         if(stackSize % 4096 > 0)

data/ext/ice/cpp/src/Ice/ThreadPool.cpp

@@ -17,6 +17,10 @@
 #   include <Ice/StringConverter.h>
 #endif
 
+#if defined(__FreeBSD__)
+#   include <sys/sysctl.h>
+#endif
+
 using namespace std;
 using namespace Ice;
 using namespace Ice::Instrumentation;
@@ -303,8 +307,8 @@ IceInternal::ThreadPool::ThreadPool(const InstancePtr& instance, const string& p
     int nProcessors = sysInfo.dwNumberOfProcessors;
 #   elif defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
     static int ncpu[2] = { CTL_HW, HW_NCPU };
-    size_t sz = sizeof(nProcessors);
     int nProcessors;
+    size_t sz = sizeof(nProcessors);
     if(sysctl(ncpu, 2, &nProcessors, &sz, 0, 0) == -1)
     {
         nProcessors = 1;

data/ext/ice/cpp/src/Ice/ValueFactory.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -37,7 +37,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif

data/ext/ice/cpp/src/Ice/Version.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -37,7 +37,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif

data/ext/ice/cpp/src/IceDiscovery/IceDiscovery.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -37,7 +37,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif

data/ext/ice/cpp/src/IceDiscovery/IceDiscovery.h

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -42,7 +42,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif
@@ -1062,6 +1062,12 @@ public:
 
     virtual ~LookupReply();
 
+#ifdef ICE_CPP11_COMPILER
+    LookupReply() = default;
+    LookupReply(const LookupReply&) = default;
+    LookupReply& operator=(const LookupReply&) = default;
+#endif
+
     /**
      * Determines whether this object supports an interface with the given Slice type ID.
      * @param id The fully-scoped Slice type ID.
@@ -1153,6 +1159,12 @@ public:
 
     virtual ~Lookup();
 
+#ifdef ICE_CPP11_COMPILER
+    Lookup() = default;
+    Lookup(const Lookup&) = default;
+    Lookup& operator=(const Lookup&) = default;
+#endif
+
     /**
      * Determines whether this object supports an interface with the given Slice type ID.
      * @param id The fully-scoped Slice type ID.

data/ext/ice/cpp/src/IceLocatorDiscovery/IceLocatorDiscovery.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -38,7 +38,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif

data/ext/ice/cpp/src/IceLocatorDiscovery/IceLocatorDiscovery.h

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -44,7 +44,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif
@@ -705,6 +705,12 @@ public:
 
     virtual ~LookupReply();
 
+#ifdef ICE_CPP11_COMPILER
+    LookupReply() = default;
+    LookupReply(const LookupReply&) = default;
+    LookupReply& operator=(const LookupReply&) = default;
+#endif
+
     /**
      * Determines whether this object supports an interface with the given Slice type ID.
      * @param id The fully-scoped Slice type ID.
@@ -788,6 +794,12 @@ public:
 
     virtual ~Lookup();
 
+#ifdef ICE_CPP11_COMPILER
+    Lookup() = default;
+    Lookup(const Lookup&) = default;
+    Lookup& operator=(const Lookup&) = default;
+#endif
+
     /**
      * Determines whether this object supports an interface with the given Slice type ID.
      * @param id The fully-scoped Slice type ID.

data/ext/ice/cpp/src/IceSSL/CertificateI.cpp

@@ -6,7 +6,7 @@
 #include <IceUtil/Mutex.h>
 #include <IceUtil/MutexPtrLock.h>
 #include <IceUtil/StringUtil.h>
-#include <IceSSL/Plugin.h>
+#include <IceSSL/PluginI.h>
 #include <IceSSL/Util.h>
 #include <IceSSL/RFC2253.h>
 #include <IceSSL/CertificateI.h>
@@ -277,3 +277,25 @@ CertificateI::toString() const
     os << "subject: " << string(getSubjectDN()) << "\n";
     return os.str();
 }
+
+unsigned int
+Certificate::getKeyUsage() const
+{
+    const CertificateExtendedInfo* impl = dynamic_cast<const CertificateExtendedInfo*>(this);
+    if(impl)
+    {
+        return impl->getKeyUsage();
+    }
+    return 0;
+}
+
+unsigned int
+Certificate::getExtendedKeyUsage() const
+{
+    const CertificateExtendedInfo* impl = dynamic_cast<const CertificateExtendedInfo*>(this);
+    if(impl)
+    {
+        return impl->getExtendedKeyUsage();
+    }
+    return 0;
+}

data/ext/ice/cpp/src/IceSSL/ConnectionInfo.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -37,7 +37,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif

data/ext/ice/cpp/src/IceSSL/ConnectionInfoF.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -35,7 +35,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif

data/ext/ice/cpp/src/IceSSL/EndpointInfo.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 //
-// Ice version 3.7.5
+// Ice version 3.7.8
 //
 // <auto-generated>
 //
@@ -37,7 +37,7 @@
 #   if ICE_INT_VERSION % 100 >= 50
 #       error Beta header file detected
 #   endif
-#   if ICE_INT_VERSION % 100 < 5
+#   if ICE_INT_VERSION % 100 < 8
 #       error Ice patch level mismatch!
 #   endif
 #endif

data/ext/ice/cpp/src/IceSSL/OpenSSLCertificateI.cpp

@@ -2,7 +2,7 @@
 // Copyright (c) ZeroC, Inc. All rights reserved.
 //
 
-#include <IceSSL/Plugin.h>
+#include <IceSSL/PluginI.h>
 #include <IceSSL/OpenSSL.h>
 #include <IceSSL/CertificateI.h>
 #include <IceSSL/OpenSSLUtil.h>
@@ -39,6 +39,12 @@ extern "C" typedef void (*FreeFunc)(void*);
 
 #endif
 
+#if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER < 0x10100000L
+#   define X509_get_extension_flags(x) (x->ex_flags)
+#   define X509_get_key_usage(x)  (x->ex_kusage)
+#   define X509_get_extended_key_usage(x)  (x->ex_xkusage)
+#endif
+
 namespace
 {
 
@@ -134,7 +140,10 @@ convertGeneralNames(GENERAL_NAMES* gens)
             break;
         }
         }
-        alt.push_back(p);
+        if (!p.second.empty())
+        {
+            alt.push_back(p);
+        }
     }
     sk_GENERAL_NAME_pop_free(gens, GENERAL_NAME_free);
     return alt;
@@ -254,6 +263,7 @@ private:
 
 class OpenSSLCertificateI : public IceSSL::OpenSSL::Certificate,
                             public CertificateI,
+                            public IceSSL::CertificateExtendedInfo,
                             public IceUtil::Mutex
 {
 public:
@@ -282,6 +292,8 @@ public:
     virtual vector<pair<int, string> > getSubjectAlternativeNames() const;
     virtual int getVersion() const;
     virtual x509_st* getCert() const;
+    virtual unsigned int getKeyUsage() const;
+    virtual unsigned int getExtendedKeyUsage() const;
 
 protected:
 
@@ -539,6 +551,94 @@ OpenSSLCertificateI::loadX509Extensions() const
     }
 }
 
+unsigned int
+OpenSSLCertificateI::getKeyUsage() const
+{
+    unsigned int keyUsage = 0;
+    int flags = X509_get_extension_flags(_cert);
+    if(flags & EXFLAG_KUSAGE)
+    {
+        unsigned int kusage = X509_get_key_usage(_cert);
+        if(kusage & KU_DIGITAL_SIGNATURE)
+        {
+            keyUsage |= KEY_USAGE_DIGITAL_SIGNATURE;
+        }
+        if(kusage & KU_NON_REPUDIATION)
+        {
+            keyUsage |= KEY_USAGE_NON_REPUDIATION;
+        }
+        if(kusage & KU_KEY_ENCIPHERMENT)
+        {
+            keyUsage |= KEY_USAGE_KEY_ENCIPHERMENT;
+        }
+        if(kusage & KU_DATA_ENCIPHERMENT)
+        {
+            keyUsage |= KEY_USAGE_DATA_ENCIPHERMENT;
+        }
+        if(kusage & KU_KEY_AGREEMENT)
+        {
+            keyUsage |= KEY_USAGE_KEY_AGREEMENT;
+        }
+        if(kusage & KU_KEY_CERT_SIGN)
+        {
+            keyUsage |= KEY_USAGE_KEY_CERT_SIGN;
+        }
+        if(kusage & KU_CRL_SIGN)
+        {
+            keyUsage |= KEY_USAGE_CRL_SIGN;
+        }
+        if(kusage & KU_ENCIPHER_ONLY)
+        {
+            keyUsage |= KEY_USAGE_ENCIPHER_ONLY;
+        }
+        if(kusage & KU_DECIPHER_ONLY)
+        {
+            keyUsage |= KEY_USAGE_DECIPHER_ONLY;
+        }
+    }
+    return keyUsage;
+}
+
+unsigned int
+OpenSSLCertificateI::getExtendedKeyUsage() const
+{
+    unsigned int extendedKeyUsage = 0;
+    int flags = X509_get_extension_flags(_cert);
+    if(flags & EXFLAG_XKUSAGE)
+    {
+        unsigned int xkusage = X509_get_extended_key_usage(_cert);
+        if(xkusage & XKU_ANYEKU)
+        {
+            extendedKeyUsage |= EXTENDED_KEY_USAGE_ANY_KEY_USAGE;
+        }
+        if(xkusage & XKU_SSL_SERVER)
+        {
+            extendedKeyUsage |= EXTENDED_KEY_USAGE_SERVER_AUTH;
+        }
+        if(xkusage & XKU_SSL_CLIENT)
+        {
+            extendedKeyUsage |= EXTENDED_KEY_USAGE_CLIENT_AUTH;
+        }
+        if(xkusage & XKU_CODE_SIGN)
+        {
+            extendedKeyUsage |= EXTENDED_KEY_USAGE_CODE_SIGNING;
+        }
+        if(xkusage & XKU_SMIME)
+        {
+            extendedKeyUsage |= EXTENDED_KEY_USAGE_EMAIL_PROTECTION;
+        }
+        if(xkusage & XKU_TIMESTAMP)
+        {
+            extendedKeyUsage |= EXTENDED_KEY_USAGE_TIME_STAMPING;
+        }
+        if(xkusage & XKU_OCSP_SIGN)
+        {
+            extendedKeyUsage |= EXTENDED_KEY_USAGE_OCSP_SIGNING;
+        }
+    }
+    return extendedKeyUsage;
+}
+
 IceSSL::OpenSSL::CertificatePtr
 IceSSL::OpenSSL::Certificate::create(x509_st* cert)
 {
@@ -556,12 +656,16 @@ IceSSL::OpenSSL::Certificate::load(const std::string& file)
     }
 
     x509_st* x = PEM_read_bio_X509(cert, ICE_NULLPTR, ICE_NULLPTR, ICE_NULLPTR);
+    BIO_free(cert);
     if(x == ICE_NULLPTR)
     {
-        BIO_free(cert);
         throw CertificateReadException(__FILE__, __LINE__, "error reading file:\n" + getSslErrors(false));
     }
-    BIO_free(cert);
+    // Calling it with -1 for the side effects, this ensure that the extensions info is loaded
+    if(X509_check_purpose(x, -1, -1) == -1)
+    {
+        throw CertificateReadException(__FILE__, __LINE__, "error loading certificate:\n" + getSslErrors(false));
+    }
     return ICE_MAKE_SHARED(OpenSSLCertificateI, x);
 }
 
@@ -570,11 +674,15 @@ IceSSL::OpenSSL::Certificate::decode(const std::string& encoding)
 {
     BIO *cert = BIO_new_mem_buf(static_cast<void*>(const_cast<char*>(&encoding[0])), static_cast<int>(encoding.size()));
     x509_st* x = PEM_read_bio_X509(cert, ICE_NULLPTR, ICE_NULLPTR, ICE_NULLPTR);
+    BIO_free(cert);
     if(x == ICE_NULLPTR)
     {
-        BIO_free(cert);
         throw CertificateEncodingException(__FILE__, __LINE__, getSslErrors(false));
     }
-    BIO_free(cert);
+    // Calling it with -1 for the side effects, this ensure that the extensions info is loaded
+    if(X509_check_purpose(x, -1, -1) == -1)
+    {
+        throw CertificateReadException(__FILE__, __LINE__, "error loading certificate:\n" + getSslErrors(false));
+    }
     return ICE_MAKE_SHARED(OpenSSLCertificateI, x);
 }

data/ext/ice/cpp/src/IceSSL/OpenSSLEngine.cpp

@@ -28,6 +28,9 @@
 
 #ifdef _MSC_VER
 #   pragma warning(disable:4127) // conditional expression is constant
+#elif defined(__GNUC__)
+#  // Ignore OpenSSL 3.0 deprecation warning
+#  pragma GCC diagnostic ignored "-Wdeprecated-declarations"
 #endif
 
 using namespace std;
@@ -816,7 +819,7 @@ OpenSSL::SSLEngine::initialize()
                             if(!_dhParams->add(keyLength, file))
                             {
                                 throw PluginInitializationException(__FILE__, __LINE__,
-                                                                "IceSSL: unable to read DH parameter file " + file);
+                                                                    "IceSSL: unable to read DH parameter file " + file);
                             }
                         }
                     }
@@ -824,6 +827,62 @@ OpenSSL::SSLEngine::initialize()
                 }
             }
 
+            int revocationCheck = getRevocationCheck();
+            if(revocationCheck > 0)
+            {
+                vector<string> crlFiles =
+                    properties->getPropertyAsList(propPrefix + "CertificateRevocationListFiles");
+                if(crlFiles.empty())
+                {
+                    throw PluginInitializationException(
+                        __FILE__,
+                        __LINE__,
+                        "IceSSL: cannot enable revocation checks without setting certificate revocation list files");
+                }
+
+                X509_STORE* store = SSL_CTX_get_cert_store(_ctx);
+                if(!store)
+                {
+                    throw PluginInitializationException(
+                        __FILE__,
+                        __LINE__,
+                        "IceSSL: unable to obtain the certificate store");
+                }
+
+                X509_LOOKUP* lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
+                if(!lookup)
+                {
+                    throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: add lookup failed");
+                }
+
+                for(vector<string>::const_iterator it = crlFiles.begin(); it != crlFiles.end(); it++)
+                {
+                    string file;
+                    if(!checkPath(*it, defaultDir, false, file))
+                    {
+                        throw PluginInitializationException(
+                            __FILE__,
+                            __LINE__,
+                            "IceSSL: CRL file not found `" + *it + "'");
+                    }
+
+                    if(X509_LOOKUP_load_file(lookup, file.c_str(), X509_FILETYPE_PEM) == 0)
+                    {
+                        throw PluginInitializationException(
+                            __FILE__,
+                            __LINE__,
+                            "IceSSL: CRL load failure `" + *it + "'");
+                    }
+                }
+
+                unsigned long flags = X509_V_FLAG_CRL_CHECK;
+                if(revocationCheck > 1)
+                {
+                    flags |= X509_V_FLAG_CRL_CHECK_ALL;
+                }
+                X509_STORE_set_flags(store, flags);
+            }
+
             SSL_CTX_set_mode(_ctx, SSL_MODE_ENABLE_PARTIAL_WRITE);
         }