zeroc-ice 3.8.2 → 3.8.3

data/dist/ice/cpp/src/Ice/SSL/OpenSSLTransceiverI.cpp

@@ -83,6 +83,7 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
         _sslCtx = _localSSLContextSelectionCallback(_incoming ? _adapterName : _host);
         if (!_sslCtx)
         {
+            BIO_free(bio);
             throw SecurityException(__FILE__, __LINE__, "SSL error: the SSL context selection callback returned null");
         }
         _ssl = SSL_new(_sslCtx);
@@ -123,7 +124,8 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
 
         if (ret <= 0)
         {
-            switch (SSL_get_error(_ssl, ret))
+            int sslError = SSL_get_error(_ssl, ret);
+            switch (sslError)
             {
                 case SSL_ERROR_NONE:
                 {
@@ -163,7 +165,9 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
                         break;
                     }
 
-                    if (IceInternal::connectionLost() || IceInternal::getSocketErrno() == 0)
+                    // A handshake I/O failure after the delegate lost its fd is a connection loss.
+                    if (_delegate->getNativeInfo()->fd() == INVALID_SOCKET || IceInternal::connectionLost() ||
+                        IceInternal::getSocketErrno() == 0)
                     {
                         throw ConnectionLostException(__FILE__, __LINE__, IceInternal::getSocketErrno());
                     }
@@ -191,6 +195,18 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
                     }
 #endif
                 }
+                default:
+                {
+                    // Any other result (e.g. SSL_ERROR_WANT_X509_LOOKUP, SSL_ERROR_WANT_ASYNC or
+                    // SSL_ERROR_WANT_RETRY_VERIFY, reachable with a user-supplied SSL_CTX) is not driven by
+                    // this event loop. Throw instead of falling through and busy-spinning on the while loop.
+                    ostringstream os;
+                    os << "SSL error occurred for new " << (_incoming ? "incoming" : "outgoing") << " connection:\n"
+                       << _delegate->toString() << "\n"
+                       << "SSL_get_error returned " << sslError << " (ret=" << ret << ")\n"
+                       << _engine->sslErrors();
+                    throw ProtocolException(__FILE__, __LINE__, os.str());
+                }
             }
         }
     }
@@ -200,7 +216,7 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
         rethrow_exception(_verificationException);
     }
 
-    // Retrieve the certificate chain if the verification callback has not already fill it.
+    // Retrieve the certificate chain if the verification callback has not already filled it.
     if (!_peerCertificate)
     {
         // When calling on the server side the peer certificate is not included in SSL_get_peer_cert_chain and must be
@@ -224,6 +240,12 @@ OpenSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::
         }
     }
 
+    if (!_peerCertificate)
+    {
+        _engine->verifyPeer(dynamic_pointer_cast<ConnectionInfo>(getInfo(_incoming, _adapterName, "")));
+    }
+    // else verifyPeer is called from the configured OpenSSL verify callback.
+
     if (_engine->securityTraceLevel() >= 1)
     {
         Trace out(_instance->logger(), _engine->securityTraceCategory());
@@ -259,14 +281,19 @@ OpenSSL::TransceiverI::close()
 {
     if (_ssl)
     {
-        int err = SSL_shutdown(_ssl);
-
-        //
-        // Call it one more time if it returned 0.
-        //
-        if (err == 0)
+        // The socket BIO installed in _ssl during initialization caches the fd number. Skip the shutdown
+        // notification when the delegate no longer holds this fd.
+        if (_delegate->getNativeInfo()->fd() != INVALID_SOCKET)
         {
-            SSL_shutdown(_ssl);
+            int err = SSL_shutdown(_ssl);
+
+            //
+            // Call it one more time if it returned 0.
+            //
+            if (err == 0)
+            {
+                SSL_shutdown(_ssl);
+            }
         }
 
         SSL_free(_ssl);
@@ -301,6 +328,12 @@ OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
         return IceInternal::SocketOperationNone;
     }
 
+    // The socket BIO installed in _ssl caches the fd number; fail instead of letting OpenSSL use a stale number.
+    if (_delegate->getNativeInfo()->fd() == INVALID_SOCKET)
+    {
+        throw ConnectionLostException(__FILE__, __LINE__);
+    }
+
     //
     // It's impossible for packetSize to be more than an Int.
     //
@@ -337,12 +370,6 @@ OpenSSL::TransceiverI::write(IceInternal::Buffer& buf)
                         continue;
                     }
 
-                    if (IceInternal::noBuffers() && packetSize > 1024)
-                    {
-                        packetSize /= 2;
-                        continue;
-                    }
-
                     if (IceInternal::wouldBlock())
                     {
                         assert(SSL_want_write(_ssl));
@@ -393,6 +420,12 @@ OpenSSL::TransceiverI::read(IceInternal::Buffer& buf)
         return IceInternal::SocketOperationNone;
     }
 
+    // The socket BIO installed in _ssl caches the fd number; fail instead of letting OpenSSL use a stale number.
+    if (_delegate->getNativeInfo()->fd() == INVALID_SOCKET)
+    {
+        throw ConnectionLostException(__FILE__, __LINE__);
+    }
+
     _delegate->getNativeInfo()->ready(IceInternal::SocketOperationRead, false);
 
     // It's impossible for packetSize to be more than an Int.
@@ -430,12 +463,6 @@ OpenSSL::TransceiverI::read(IceInternal::Buffer& buf)
                         continue;
                     }
 
-                    if (IceInternal::noBuffers() && packetSize > 1024)
-                    {
-                        packetSize /= 2;
-                        continue;
-                    }
-
                     if (IceInternal::wouldBlock())
                     {
                         assert(SSL_want_read(_ssl));
@@ -514,15 +541,15 @@ OpenSSL::TransceiverI::getInfo(bool incoming, string adapterName, string connect
     // adapterName is the name of the object adapter currently associated with this connection, while _adapterName
     // represents the name of the object adapter that created this connection (incoming only).
 
+    Ice::ConnectionInfoPtr delegateInfo = _delegate->getInfo(incoming, std::move(adapterName), std::move(connectionId));
+
     X509* peerCertificate = nullptr;
     if (_peerCertificate)
     {
         peerCertificate = X509_dup(_peerCertificate);
     }
 
-    return make_shared<ConnectionInfo>(
-        _delegate->getInfo(incoming, std::move(adapterName), std::move(connectionId)),
-        peerCertificate);
+    return make_shared<ConnectionInfo>(std::move(delegateInfo), peerCertificate);
 }
 
 void
@@ -533,7 +560,27 @@ OpenSSL::TransceiverI::checkSendSize(const IceInternal::Buffer&)
 void
 OpenSSL::TransceiverI::setBufferSize(int rcvSize, int sndSize)
 {
-    _delegate->setBufferSize(rcvSize, sndSize);
+    try
+    {
+        _delegate->setBufferSize(rcvSize, sndSize);
+    }
+    catch (...)
+    {
+        invalidateBIOFd();
+        throw;
+    }
+}
+
+void
+OpenSSL::TransceiverI::invalidateBIOFd() const
+{
+    if (_ssl && _delegate->getNativeInfo()->fd() == INVALID_SOCKET)
+    {
+        // The socket BIO installed in _ssl caches the fd number. The delegate no longer holds this fd, so invalidate
+        // the BIO's copy: later TLS I/O — including handshake records written from inside SSL_accept/SSL_connect —
+        // fails with EBADF instead of touching a reused descriptor.
+        BIO_set_fd(SSL_get_wbio(_ssl), INVALID_SOCKET, BIO_NOCLOSE);
+    }
 }
 
 int
@@ -558,7 +605,10 @@ OpenSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* ctx)
             dynamic_pointer_cast<ConnectionInfo>(getInfo(_incoming, _adapterName, "")));
         if (!verified)
         {
-            long result = SSL_get_verify_result(_ssl);
+            // Read the failure reason from the current verification context rather than from
+            // SSL_get_verify_result(_ssl), which is only finalized at the end of chain verification and is
+            // stale/generic inside this per-certificate callback.
+            int result = X509_STORE_CTX_get_error(ctx);
             if (result == X509_V_OK)
             {
                 throw SecurityException(

data/dist/ice/cpp/src/Ice/SSL/OpenSSLTransceiverI.h

@@ -55,6 +55,8 @@ namespace Ice::SSL::OpenSSL
     private:
         friend class Ice::SSL::OpenSSL::SSLEngine;
 
+        void invalidateBIOFd() const;
+
         const InstancePtr _instance;
         const Ice::SSL::OpenSSL::SSLEnginePtr _engine;
         const std::string _host;
@@ -62,7 +64,6 @@ namespace Ice::SSL::OpenSSL
         const bool _incoming;
         const IceInternal::TransceiverPtr _delegate;
         bool _connected;
-        std::string _cipher;
         X509* _peerCertificate;
         ::SSL* _ssl;
         SSL_CTX* _sslCtx;

data/dist/ice/cpp/src/Ice/SSL/RFC2253.cpp

@@ -242,7 +242,7 @@ parseAttributeType(const string& data, size_t& pos)
     eatWhite(data, pos);
     if (pos >= data.size())
     {
-        throw Ice::ParseException(__FILE__, __LINE__, "invalid attribute type (expected end of data)");
+        throw Ice::ParseException(__FILE__, __LINE__, "invalid attribute type (unexpected end of data)");
     }
 
     string result;
@@ -290,7 +290,7 @@ parseAttributeType(const string& data, size_t& pos)
                 // 1*DIGIT must follow "."
                 if (pos < data.size() && !IceInternal::isDigit(data[pos]))
                 {
-                    throw Ice::ParseException(__FILE__, __LINE__, "invalid attribute type (expected end of data)");
+                    throw Ice::ParseException(__FILE__, __LINE__, "invalid attribute type (missing digit after '.')");
                 }
             }
             else

data/dist/ice/cpp/src/Ice/SSL/SSLUtil.cpp

@@ -6,7 +6,6 @@
 #define OPENSSL_NO_DEPRECATED
 
 #include "SSLUtil.h"
-#include "../Base64.h"
 #include "../FileUtil.h"
 #include "../Network.h"
 #include "../UniqueRef.h"
@@ -35,8 +34,8 @@ Ice::SSL::fromCFString(CFStringRef v)
         CFIndex size = CFStringGetMaximumSizeForEncoding(CFStringGetLength(v), kCFStringEncodingUTF8);
         vector<char> buffer;
         buffer.resize(static_cast<size_t>(size + 1));
-        CFStringGetCString(v, &buffer[0], static_cast<CFIndex>(buffer.size()), kCFStringEncodingUTF8);
-        s.assign(&buffer[0]);
+        CFStringGetCString(v, buffer.data(), static_cast<CFIndex>(buffer.size()), kCFStringEncodingUTF8);
+        s.assign(buffer.data());
     }
     return s;
 }
@@ -102,7 +101,7 @@ Ice::SSL::readFile(const string& file, vector<char>& buffer)
 
     if (!buffer.empty())
     {
-        is.read(&buffer[0], static_cast<streamsize>(buffer.size()));
+        is.read(buffer.data(), static_cast<streamsize>(buffer.size()));
         if (!is.good())
         {
             throw CertificateReadException(__FILE__, __LINE__, "error reading file " + file);
@@ -251,13 +250,13 @@ namespace
                 X509_ASN_ENCODING,
                 certName,
                 CERT_OID_NAME_STR | CERT_NAME_STR_REVERSE_FLAG,
-                &buffer[0],
+                buffer.data(),
                 length))
         {
             throw CertificateEncodingException(__FILE__, __LINE__, IceInternal::lastErrorToString());
         }
 
-        string s(&buffer[0]);
+        string s(buffer.data());
         for (const auto& certificateOID : certificateOIDS)
         {
             const string name = string(certificateOID.first) + "=";
@@ -396,12 +395,12 @@ Ice::SSL::encodeCertificate(PCCERT_CONTEXT cert)
             cert->pbCertEncoded,
             cert->cbCertEncoded,
             CRYPT_STRING_BASE64HEADER | CRYPT_STRING_NOCR,
-            &encoded[0],
+            encoded.data(),
             &encodedLength))
     {
         throw CertificateEncodingException(__FILE__, __LINE__, IceInternal::lastErrorToString());
     }
-    s.assign(&encoded[0]);
+    s.assign(encoded.data());
     return s;
 }
 
@@ -414,10 +413,10 @@ Ice::SSL::decodeCertificate(const string& data)
     derBuffer.resize(derLength);
 
     if (!CryptStringToBinary(
-            &data.c_str()[0],
+            data.c_str(),
             static_cast<DWORD>(data.size()),
             CRYPT_STRING_BASE64HEADER,
-            &derBuffer[0],
+            derBuffer.data(),
             &derLength,
             nullptr,
             nullptr))
@@ -431,7 +430,7 @@ Ice::SSL::decodeCertificate(const string& data)
     if (!CryptDecodeObjectEx(
             X509_ASN_ENCODING,
             X509_CERT,
-            &derBuffer[0],
+            derBuffer.data(),
             derLength,
             CRYPT_DECODE_ALLOC_FLAG,
             nullptr,
@@ -496,6 +495,19 @@ namespace
         return result;
     }
 
+    string convertIA5StringToString(ASN1_IA5STRING* str)
+    {
+        if (str && ASN1_STRING_type(str) == V_ASN1_IA5STRING && ASN1_STRING_length(str) > 0)
+        {
+            const unsigned char* data = ASN1_STRING_get0_data(str);
+            if (data)
+            {
+                return {reinterpret_cast<const char*>(data), static_cast<size_t>(ASN1_STRING_length(str))};
+            }
+        }
+        return {};
+    }
+
     vector<pair<int, string>> convertGeneralNames(GENERAL_NAMES* gens)
     {
         vector<pair<int, string>> alt;
@@ -512,20 +524,12 @@ namespace
             {
                 case GEN_EMAIL:
                 {
-                    ASN1_IA5STRING* str = gen->d.rfc822Name;
-                    if (str && str->type == V_ASN1_IA5STRING && str->data && str->length > 0)
-                    {
-                        p.second = string(reinterpret_cast<const char*>(str->data), str->length);
-                    }
+                    p.second = convertIA5StringToString(gen->d.rfc822Name);
                     break;
                 }
                 case GEN_DNS:
                 {
-                    ASN1_IA5STRING* str = gen->d.dNSName;
-                    if (str && str->type == V_ASN1_IA5STRING && str->data && str->length > 0)
-                    {
-                        p.second = string(reinterpret_cast<const char*>(str->data), str->length);
-                    }
+                    p.second = convertIA5StringToString(gen->d.dNSName);
                     break;
                 }
                 case GEN_DIRNAME:
@@ -535,29 +539,29 @@ namespace
                 }
                 case GEN_URI:
                 {
-                    ASN1_IA5STRING* str = gen->d.uniformResourceIdentifier;
-                    if (str && str->type == V_ASN1_IA5STRING && str->data && str->length > 0)
-                    {
-                        p.second = string(reinterpret_cast<const char*>(str->data), str->length);
-                    }
+                    p.second = convertIA5StringToString(gen->d.uniformResourceIdentifier);
                     break;
                 }
                 case GEN_IPADD:
                 {
                     ASN1_OCTET_STRING* addr = gen->d.iPAddress;
                     // TODO: Support IPv6 someday.
-                    if (addr && addr->type == V_ASN1_OCTET_STRING && addr->data && addr->length == 4)
+                    if (addr && ASN1_STRING_type(addr) == V_ASN1_OCTET_STRING && ASN1_STRING_length(addr) == 4)
                     {
-                        ostringstream ostr;
-                        for (int j = 0; j < 4; ++j)
+                        const unsigned char* data = ASN1_STRING_get0_data(addr);
+                        if (data)
                         {
-                            if (j > 0)
+                            ostringstream ostr;
+                            for (int j = 0; j < 4; ++j)
                             {
-                                ostr << '.';
+                                if (j > 0)
+                                {
+                                    ostr << '.';
+                                }
+                                ostr << static_cast<int>(data[j]);
                             }
-                            ostr << static_cast<int>(addr->data[j]);
+                            p.second = ostr.str();
                         }
-                        p.second = ostr.str();
                     }
                     break;
                 }
@@ -656,7 +660,7 @@ Ice::SSL::encodeCertificate(X509* certificate)
 X509*
 Ice::SSL::decodeCertificate(const string& data)
 {
-    BIO* cert = BIO_new_mem_buf(static_cast<void*>(const_cast<char*>(&data[0])), static_cast<int>(data.size()));
+    BIO* cert = BIO_new_mem_buf(static_cast<void*>(const_cast<char*>(data.data())), static_cast<int>(data.size()));
     x509_st* x = PEM_read_bio_X509(cert, nullptr, nullptr, nullptr);
     BIO_free(cert);
     if (x == nullptr)
@@ -666,6 +670,7 @@ Ice::SSL::decodeCertificate(const string& data)
     // Calling it with -1 for the side effects, this ensure that the extensions info is loaded
     if (X509_check_purpose(x, -1, -1) == -1)
     {
+        X509_free(x);
         throw CertificateReadException(__FILE__, __LINE__, "error loading certificate:\n" + getErrors());
     }
     return x;