zeroc-ice 3.7.9.1 → 3.8.0

data/dist/ice/cpp/src/Ice/SSL/SSLConnectorI.cpp

@@ -0,0 +1,92 @@
+// Copyright (c) ZeroC, Inc.
+
+#include "SSLConnectorI.h"
+#include "../TargetCompare.h"
+#include "Ice/SSL/ClientAuthenticationOptions.h"
+#include "SSLEngine.h"
+#include "SSLInstance.h"
+
+#if defined(ICE_USE_SCHANNEL)
+#    include "SchannelEngine.h"
+#    include "SchannelTransceiverI.h"
+using namespace Ice::SSL::Schannel;
+#elif defined(ICE_USE_SECURE_TRANSPORT)
+#    include "SecureTransportTransceiverI.h"
+using namespace Ice::SSL::SecureTransport;
+#elif defined(ICE_USE_OPENSSL)
+#    include "OpenSSLEngine.h"
+#    include "OpenSSLTransceiverI.h"
+using namespace Ice::SSL::OpenSSL;
+#endif
+
+using namespace std;
+using namespace Ice;
+using namespace Ice::SSL;
+
+IceInternal::TransceiverPtr
+Ice::SSL::ConnectorI::connect()
+{
+    optional<Ice::SSL::ClientAuthenticationOptions> clientAuthenticationOptions =
+        _instance->engine()->getInitializationData().clientAuthenticationOptions;
+    if (!clientAuthenticationOptions)
+    {
+        clientAuthenticationOptions = _instance->engine()->createClientAuthenticationOptions(_host);
+    }
+    assert(clientAuthenticationOptions);
+    return make_shared<TransceiverI>(_instance, _delegate->connect(), _host, *clientAuthenticationOptions);
+}
+
+int16_t
+Ice::SSL::ConnectorI::type() const
+{
+    return _delegate->type();
+}
+
+string
+Ice::SSL::ConnectorI::toString() const
+{
+    return _delegate->toString();
+}
+
+bool
+Ice::SSL::ConnectorI::operator==(const IceInternal::Connector& r) const
+{
+    const auto* p = dynamic_cast<const ConnectorI*>(&r);
+    if (!p)
+    {
+        return false;
+    }
+
+    if (this == p)
+    {
+        return true;
+    }
+
+    return Ice::targetEqualTo(_delegate, p->_delegate);
+}
+
+bool
+Ice::SSL::ConnectorI::operator<(const IceInternal::Connector& r) const
+{
+    const auto* p = dynamic_cast<const ConnectorI*>(&r);
+    if (!p)
+    {
+        return type() < r.type();
+    }
+
+    if (this == p)
+    {
+        return false;
+    }
+
+    return Ice::targetLess(_delegate, p->_delegate);
+}
+
+Ice::SSL::ConnectorI::ConnectorI(InstancePtr instance, IceInternal::ConnectorPtr del, string h)
+    : _instance(std::move(instance)),
+      _delegate(std::move(del)),
+      _host(std::move(h))
+{
+}
+
+Ice::SSL::ConnectorI::~ConnectorI() = default;

data/dist/ice/cpp/src/Ice/SSL/SSLConnectorI.h

@@ -0,0 +1,38 @@
+// Copyright (c) ZeroC, Inc.
+
+#ifndef ICE_SSL_CONNECTOR_I_H
+#define ICE_SSL_CONNECTOR_I_H
+
+#include "../Connector.h"
+#include "../Network.h"
+#include "../TransceiverF.h"
+#include "SSLInstanceF.h"
+
+namespace Ice::SSL
+{
+    class EndpointI;
+
+    class ConnectorI final : public IceInternal::Connector
+    {
+    public:
+        ConnectorI(InstancePtr, IceInternal::ConnectorPtr, std::string);
+        ~ConnectorI() override;
+        IceInternal::TransceiverPtr connect() final;
+
+        [[nodiscard]] std::int16_t type() const final;
+        [[nodiscard]] std::string toString() const final;
+
+        bool operator==(const IceInternal::Connector&) const final;
+        bool operator<(const IceInternal::Connector&) const final;
+
+    private:
+        friend class EndpointI;
+
+        const InstancePtr _instance;
+        const IceInternal::ConnectorPtr _delegate;
+        const std::string _host;
+    };
+
+}
+
+#endif

data/dist/ice/cpp/src/Ice/SSL/SSLEndpointI.cpp

@@ -0,0 +1,377 @@
+// Copyright (c) ZeroC, Inc.
+
+#include "SSLEndpointI.h"
+#include "../TargetCompare.h"
+#include "SSLAcceptorI.h"
+#include "SSLConnectorI.h"
+#include "SSLInstance.h"
+
+#include <algorithm>
+
+using namespace std;
+using namespace Ice;
+using namespace Ice::SSL;
+
+namespace
+{
+    const char* const sslPluginName = "IceSSL";
+
+    Plugin* createIceSSL(const CommunicatorPtr& communicator, const string& name, const StringSeq&)
+    {
+        string pluginName{sslPluginName};
+
+        if (name != pluginName)
+        {
+            throw PluginInitializationException{
+                __FILE__,
+                __LINE__,
+                "the SSL plug-in must be named '" + pluginName + "'"};
+        }
+
+        IceInternal::InstancePtr instance = IceInternal::getInstance(communicator);
+        SSLEnginePtr engine = instance->sslEngine();
+        IceInternal::EndpointFactoryManagerPtr endpointFactoryManager = instance->endpointFactoryManager();
+        Ice::SSL::InstancePtr sslInstance = make_shared<Ice::SSL::Instance>(engine, SSLEndpointType, "ssl");
+
+        return new IceInternal::EndpointFactoryPlugin(
+            communicator,
+            make_shared<Ice::SSL::EndpointFactoryI>(sslInstance, TCPEndpointType));
+    }
+}
+
+Ice::PluginFactory
+Ice::sslPluginFactory()
+{
+    return {sslPluginName, createIceSSL};
+}
+
+namespace
+{
+    Ice::IPEndpointInfoPtr getIPEndpointInfo(const Ice::EndpointInfoPtr& info)
+    {
+        for (Ice::EndpointInfoPtr p = info; p; p = p->underlying)
+        {
+            Ice::IPEndpointInfoPtr ipInfo = dynamic_pointer_cast<Ice::IPEndpointInfo>(p);
+            if (ipInfo)
+            {
+                return ipInfo;
+            }
+        }
+        return nullptr;
+    }
+}
+// Implement virtual destructors out of line to avoid weak vtables.
+#if defined(ICE_USE_SCHANNEL)
+Ice::SSL::SchannelConnectionInfo::~SchannelConnectionInfo()
+{
+    if (peerCertificate)
+    {
+        CertFreeCertificateContext(peerCertificate);
+    }
+}
+#elif defined(ICE_USE_SECURE_TRANSPORT)
+Ice::SSL::SecureTransportConnectionInfo::~SecureTransportConnectionInfo()
+{
+    if (peerCertificate)
+    {
+        CFRelease(peerCertificate);
+    }
+}
+#else
+Ice::SSL::OpenSSLConnectionInfo::~OpenSSLConnectionInfo()
+{
+    if (peerCertificate)
+    {
+        X509_free(peerCertificate);
+    }
+}
+#endif
+
+Ice::SSL::EndpointInfo::~EndpointInfo() = default; // Out of line to avoid weak vtable
+
+Ice::SSL::EndpointI::EndpointI(InstancePtr instance, IceInternal::EndpointIPtr del)
+    : _instance(std::move(instance)),
+      _delegate(std::move(del))
+{
+}
+
+void
+Ice::SSL::EndpointI::streamWriteImpl(Ice::OutputStream* stream) const
+{
+    _delegate->streamWriteImpl(stream);
+}
+
+Ice::EndpointInfoPtr
+Ice::SSL::EndpointI::getInfo() const noexcept
+{
+    return make_shared<Ice::SSL::EndpointInfo>(_delegate->getInfo());
+}
+
+int16_t
+Ice::SSL::EndpointI::type() const
+{
+    return _delegate->type();
+}
+
+const std::string&
+Ice::SSL::EndpointI::protocol() const
+{
+    return _delegate->protocol();
+}
+
+int32_t
+Ice::SSL::EndpointI::timeout() const
+{
+    return _delegate->timeout();
+}
+
+IceInternal::EndpointIPtr
+Ice::SSL::EndpointI::timeout(int32_t timeout) const
+{
+    if (timeout == _delegate->timeout())
+    {
+        return const_cast<EndpointI*>(this)->shared_from_this();
+    }
+    else
+    {
+        return make_shared<EndpointI>(_instance, _delegate->timeout(timeout));
+    }
+}
+
+const string&
+Ice::SSL::EndpointI::connectionId() const
+{
+    return _delegate->connectionId();
+}
+
+IceInternal::EndpointIPtr
+Ice::SSL::EndpointI::connectionId(const string& connectionId) const
+{
+    if (connectionId == _delegate->connectionId())
+    {
+        return const_cast<EndpointI*>(this)->shared_from_this();
+    }
+    else
+    {
+        return make_shared<EndpointI>(_instance, _delegate->connectionId(connectionId));
+    }
+}
+
+bool
+Ice::SSL::EndpointI::compress() const
+{
+    return _delegate->compress();
+}
+
+IceInternal::EndpointIPtr
+Ice::SSL::EndpointI::compress(bool compress) const
+{
+    if (compress == _delegate->compress())
+    {
+        return const_cast<EndpointI*>(this)->shared_from_this();
+    }
+    else
+    {
+        return make_shared<EndpointI>(_instance, _delegate->compress(compress));
+    }
+}
+
+bool
+Ice::SSL::EndpointI::datagram() const
+{
+    return _delegate->datagram();
+}
+
+bool
+Ice::SSL::EndpointI::secure() const
+{
+    return _delegate->secure();
+}
+
+IceInternal::TransceiverPtr
+Ice::SSL::EndpointI::transceiver() const
+{
+    return nullptr;
+}
+
+void
+Ice::SSL::EndpointI::connectorsAsync(
+    function<void(vector<IceInternal::ConnectorPtr>)> response,
+    function<void(exception_ptr)> exception) const
+{
+    IPEndpointInfoPtr info = getIPEndpointInfo(_delegate->getInfo());
+    string host = info ? info->host : string();
+
+    _delegate->connectorsAsync(
+        [response, this, host](vector<IceInternal::ConnectorPtr> connectors)
+        {
+            for (auto& connector : connectors)
+            {
+                connector = make_shared<ConnectorI>(_instance, connector, host);
+            }
+            response(std::move(connectors));
+        },
+        exception);
+}
+
+IceInternal::AcceptorPtr
+Ice::SSL::EndpointI::acceptor(
+    const string& adapterName,
+    const optional<Ice::SSL::ServerAuthenticationOptions>& serverAuthenticationOptions) const
+{
+    return make_shared<AcceptorI>(
+        const_cast<EndpointI*>(this)->shared_from_this(),
+        _instance,
+        _delegate->acceptor(adapterName, serverAuthenticationOptions),
+        adapterName,
+        serverAuthenticationOptions);
+}
+
+EndpointIPtr
+Ice::SSL::EndpointI::endpoint(const IceInternal::EndpointIPtr& delEndp) const
+{
+    if (delEndp.get() == _delegate.get())
+    {
+        return dynamic_pointer_cast<EndpointI>(const_cast<EndpointI*>(this)->shared_from_this());
+    }
+    else
+    {
+        return make_shared<EndpointI>(_instance, delEndp);
+    }
+}
+
+vector<IceInternal::EndpointIPtr>
+Ice::SSL::EndpointI::expandHost() const
+{
+    vector<IceInternal::EndpointIPtr> endpoints = _delegate->expandHost();
+
+    transform(
+        endpoints.begin(),
+        endpoints.end(),
+        endpoints.begin(),
+        [this](const IceInternal::EndpointIPtr& p) { return endpoint(p); });
+
+    return endpoints;
+}
+
+bool
+Ice::SSL::EndpointI::isLoopbackOrMulticast() const
+{
+    return _delegate->isLoopbackOrMulticast();
+}
+
+shared_ptr<IceInternal::EndpointI>
+Ice::SSL::EndpointI::toPublishedEndpoint(string publishedHost) const
+{
+    return endpoint(_delegate->toPublishedEndpoint(std::move(publishedHost)));
+}
+
+bool
+Ice::SSL::EndpointI::equivalent(const IceInternal::EndpointIPtr& endpoint) const
+{
+    auto endpointI = dynamic_pointer_cast<EndpointI>(endpoint);
+    if (!endpointI)
+    {
+        return false;
+    }
+    return _delegate->equivalent(endpointI->_delegate);
+}
+
+size_t
+Ice::SSL::EndpointI::hash() const noexcept
+{
+    return _delegate->hash();
+}
+
+string
+Ice::SSL::EndpointI::options() const
+{
+    return _delegate->options();
+}
+
+bool
+Ice::SSL::EndpointI::operator==(const Ice::Endpoint& r) const
+{
+    const auto* p = dynamic_cast<const EndpointI*>(&r);
+    if (!p)
+    {
+        return false;
+    }
+
+    if (this == p)
+    {
+        return true;
+    }
+
+    if (!Ice::targetEqualTo(_delegate, p->_delegate))
+    {
+        return false;
+    }
+
+    return true;
+}
+
+bool
+Ice::SSL::EndpointI::operator<(const Ice::Endpoint& r) const
+{
+    const auto* p = dynamic_cast<const EndpointI*>(&r);
+    if (!p)
+    {
+        const auto* e = dynamic_cast<const IceInternal::EndpointI*>(&r);
+        if (!e)
+        {
+            return false;
+        }
+        return type() < e->type();
+    }
+
+    if (this == p)
+    {
+        return false;
+    }
+
+    if (Ice::targetLess(_delegate, p->_delegate))
+    {
+        return true;
+    }
+    else if (Ice::targetLess(p->_delegate, _delegate))
+    {
+        return false;
+    }
+
+    return false;
+}
+
+bool
+Ice::SSL::EndpointI::checkOption(const string& /*option*/, const string& /*argument*/, const string& /*endpoint*/)
+{
+    return false;
+}
+
+Ice::SSL::EndpointFactoryI::EndpointFactoryI(const InstancePtr& instance, int16_t type)
+    : IceInternal::EndpointFactoryWithUnderlying(instance, type),
+      _sslInstance(instance)
+{
+}
+
+IceInternal::EndpointFactoryPtr
+Ice::SSL::EndpointFactoryI::cloneWithUnderlying(const IceInternal::ProtocolInstancePtr& instance, int16_t underlying)
+    const
+{
+    return make_shared<EndpointFactoryI>(
+        make_shared<Instance>(_sslInstance->engine(), instance->type(), instance->protocol()),
+        underlying);
+}
+
+IceInternal::EndpointIPtr
+Ice::SSL::EndpointFactoryI::createWithUnderlying(const IceInternal::EndpointIPtr& underlying, vector<string>&, bool)
+    const
+{
+    return make_shared<EndpointI>(_sslInstance, underlying);
+}
+
+IceInternal::EndpointIPtr
+Ice::SSL::EndpointFactoryI::readWithUnderlying(const IceInternal::EndpointIPtr& underlying, Ice::InputStream*) const
+{
+    return make_shared<EndpointI>(_sslInstance, underlying);
+}

data/dist/ice/cpp/src/Ice/SSL/SSLEndpointI.h

@@ -0,0 +1,84 @@
+// Copyright (c) ZeroC, Inc.
+
+#ifndef ICESSL_ENDPOINT_I_H
+#define ICESSL_ENDPOINT_I_H
+
+#include "../EndpointFactory.h"
+#include "../EndpointI.h"
+#include "../IPEndpointI.h"
+#include "../Network.h"
+#include "Ice/SSL/EndpointInfo.h"
+#include "SSLEngineF.h"
+#include "SSLInstanceF.h"
+
+namespace Ice::SSL
+{
+    class EndpointI final : public IceInternal::EndpointI, public std::enable_shared_from_this<EndpointI>
+    {
+    public:
+        EndpointI(InstancePtr, IceInternal::EndpointIPtr);
+
+        void streamWriteImpl(Ice::OutputStream*) const final;
+
+        [[nodiscard]] Ice::EndpointInfoPtr getInfo() const noexcept final;
+        [[nodiscard]] std::int16_t type() const final;
+        [[nodiscard]] const std::string& protocol() const final;
+
+        [[nodiscard]] std::int32_t timeout() const final;
+        [[nodiscard]] IceInternal::EndpointIPtr timeout(std::int32_t) const final;
+        [[nodiscard]] const std::string& connectionId() const final;
+        [[nodiscard]] IceInternal::EndpointIPtr connectionId(const std::string&) const final;
+        [[nodiscard]] bool compress() const final;
+        [[nodiscard]] IceInternal::EndpointIPtr compress(bool) const final;
+        [[nodiscard]] bool datagram() const final;
+        [[nodiscard]] bool secure() const final;
+
+        [[nodiscard]] IceInternal::TransceiverPtr transceiver() const final;
+        void connectorsAsync(
+            std::function<void(std::vector<IceInternal::ConnectorPtr>)>,
+            std::function<void(std::exception_ptr)>) const final;
+        [[nodiscard]] IceInternal::AcceptorPtr
+        acceptor(const std::string&, const std::optional<Ice::SSL::ServerAuthenticationOptions>&) const final;
+        [[nodiscard]] std::vector<IceInternal::EndpointIPtr> expandHost() const final;
+        [[nodiscard]] bool isLoopbackOrMulticast() const final;
+        [[nodiscard]] std::shared_ptr<IceInternal::EndpointI>
+        toPublishedEndpoint(std::string publishedHost) const final;
+        [[nodiscard]] bool equivalent(const IceInternal::EndpointIPtr&) const final;
+        [[nodiscard]] std::size_t hash() const noexcept final;
+        [[nodiscard]] std::string options() const final;
+
+        [[nodiscard]] EndpointIPtr endpoint(const IceInternal::EndpointIPtr&) const;
+
+        bool operator==(const Ice::Endpoint&) const final;
+        bool operator<(const Ice::Endpoint&) const final;
+
+    protected:
+        bool checkOption(const std::string&, const std::string&, const std::string&) final;
+
+    private:
+        //
+        // All members are const, because endpoints are immutable.
+        //
+        const InstancePtr _instance;
+        const IceInternal::EndpointIPtr _delegate;
+    };
+
+    class EndpointFactoryI final : public IceInternal::EndpointFactoryWithUnderlying
+    {
+    public:
+        EndpointFactoryI(const InstancePtr&, std::int16_t);
+
+        [[nodiscard]] IceInternal::EndpointFactoryPtr
+        cloneWithUnderlying(const IceInternal::ProtocolInstancePtr&, std::int16_t) const final;
+
+    protected:
+        IceInternal::EndpointIPtr
+        createWithUnderlying(const IceInternal::EndpointIPtr&, std::vector<std::string>&, bool) const final;
+        IceInternal::EndpointIPtr readWithUnderlying(const IceInternal::EndpointIPtr&, Ice::InputStream*) const final;
+
+    private:
+        const InstancePtr _sslInstance;
+    };
+}
+
+#endif

data/dist/ice/cpp/src/Ice/SSL/SSLEngine.cpp

@@ -0,0 +1,115 @@
+// Copyright (c) ZeroC, Inc.
+
+#include "SSLEngine.h"
+#include "../Instance.h"
+#include "Ice/LocalExceptions.h"
+#include "Ice/Logger.h"
+#include "Ice/Properties.h"
+#include "Ice/SSL/ConnectionInfo.h"
+#include "TrustManager.h"
+
+#include <string>
+
+using namespace std;
+using namespace Ice;
+using namespace Ice::SSL;
+
+Ice::SSL::SSLEngine::SSLEngine(const IceInternal::InstancePtr& instance)
+    : _instance(instance),
+      _trustManager(make_shared<TrustManager>(instance))
+{
+}
+
+Ice::SSL::SSLEngine::~SSLEngine() = default;
+
+Ice::LoggerPtr
+Ice::SSL::SSLEngine::getLogger() const
+{
+    return _instance->initializationData().logger;
+}
+
+Ice::PropertiesPtr
+Ice::SSL::SSLEngine::getProperties() const
+{
+    return _instance->initializationData().properties;
+}
+
+Ice::InitializationData
+Ice::SSL::SSLEngine::getInitializationData() const
+{
+    return _instance->initializationData();
+}
+
+void
+Ice::SSL::SSLEngine::initialize()
+{
+    const PropertiesPtr properties = getProperties();
+
+    // CheckCertName determines whether we compare the name in a peer's certificate against its hostname.
+    _checkCertName = properties->getIcePropertyAsInt("IceSSL.CheckCertName") > 0;
+
+    // VerifyPeer determines whether certificate validation failures abort a connection.
+    _verifyPeer = properties->getIcePropertyAsInt("IceSSL.VerifyPeer");
+
+    if (_verifyPeer < 0 || _verifyPeer > 2)
+    {
+        throw InitializationException(__FILE__, __LINE__, "SSL transport: invalid value for IceSSL.VerifyPeer");
+    }
+
+    _securityTraceLevel = properties->getIcePropertyAsInt("IceSSL.Trace.Security");
+    _securityTraceCategory = "Security";
+
+    const_cast<bool&>(_revocationCheckCacheOnly) =
+        properties->getIcePropertyAsInt("IceSSL.RevocationCheckCacheOnly") > 0;
+    const_cast<int&>(_revocationCheck) = properties->getIcePropertyAsInt("IceSSL.RevocationCheck");
+}
+
+void
+Ice::SSL::SSLEngine::verifyPeer(const ConnectionInfoPtr& info) const
+{
+    if (!_trustManager->verify(info))
+    {
+        string msg = string(info->incoming ? "incoming" : "outgoing") + " connection rejected by trust manager";
+        if (_securityTraceLevel >= 1)
+        {
+            getLogger()->trace(_securityTraceCategory, msg);
+        }
+        throw SecurityException(__FILE__, __LINE__, msg);
+    }
+}
+
+bool
+Ice::SSL::SSLEngine::getCheckCertName() const
+{
+    return _checkCertName;
+}
+
+int
+Ice::SSL::SSLEngine::getVerifyPeer() const
+{
+    return _verifyPeer;
+}
+
+int
+Ice::SSL::SSLEngine::securityTraceLevel() const
+{
+    return _securityTraceLevel;
+}
+
+std::string
+Ice::SSL::SSLEngine::securityTraceCategory() const
+{
+    return _securityTraceCategory;
+}
+
+bool
+Ice::SSL::SSLEngine::getRevocationCheckCacheOnly() const
+{
+    return _revocationCheckCacheOnly;
+}
+
+int
+Ice::SSL::SSLEngine::getRevocationCheck() const
+{
+    return _revocationCheck;
+}