diff options
Diffstat (limited to 'cpp')
34 files changed, 668 insertions, 481 deletions
diff --git a/cpp/include/IceSSL/Plugin.h b/cpp/include/IceSSL/Plugin.h index 5a7e7ea86cc..367fd73c5dd 100644 --- a/cpp/include/IceSSL/Plugin.h +++ b/cpp/include/IceSSL/Plugin.h @@ -55,14 +55,14 @@ #ifdef ICE_USE_OPENSSL // -// Pointer to an opaque SSL session context object. ssl_ctx_st is the +// Pointer to an opaque SSL session context object. ssl_ctx_st is the // OpenSSL type that holds configuration settings for all SSL // connections. // typedef struct ssl_ctx_st SSL_CTX; // -// Pointer to an opaque certificate object. X509_st is the OpenSSL +// Pointer to an opaque certificate object. X509_st is the OpenSSL // type that represents a certificate. // typedef struct x509_st* X509CertificateRef; @@ -185,7 +185,7 @@ class ICE_SSL_API PublicKey : public IceUtil::Shared public: ~PublicKey(); - + // // Retrieve the native public key value wrapped by this object. // @@ -202,7 +202,7 @@ private: CertificatePtr _cert; KeyRef _key; - + }; typedef IceUtil::Handle<PublicKey> PublicKeyPtr; @@ -282,7 +282,7 @@ class ICE_SSL_API Certificate : public IceUtil::Shared public: // - // Construct a certificate using a native certificate. + // Construct a certificate using a native certificate. // // The Certificate class assumes ownership of the given native // certificate. @@ -321,7 +321,7 @@ public: // public key. Returns true if signed, false otherwise. // bool verify(const CertificatePtr&) const; - + #ifdef ICE_USE_OPENSSL // // Verify that this certificate was signed by the given public @@ -331,10 +331,10 @@ public: // engines that require a certificate and not just a public key to // verify the certificate signature. // - ICE_DEPRECATED_API("verify(const PublicKeyPtr&) is deprecated, use verify(const CertificatePtr&) instead") + ICE_DEPRECATED_API("verify(const PublicKeyPtr&) is deprecated, use verify(const CertificatePtr&) instead") bool verify(const PublicKeyPtr&) const; #endif - + // // Return a string encoding of the certificate in PEM format. // Raises CertificateEncodingException if an error occurs. @@ -433,7 +433,7 @@ public: // // Retrieve the native X509 certificate value wrapped by this - // object. + // object. // // The returned reference is only valid for the lifetime of this // object. With SecureTransport you can increment the reference @@ -470,6 +470,23 @@ public: typedef IceUtil::Handle<NativeConnectionInfo> NativeConnectionInfoPtr; // +// WSSNativeConnectionInfo is an extension of IceSSL::WSSConnectionInfo +// that provides access to native certificates. +// +class ICE_SSL_API WSSNativeConnectionInfo : public WSSConnectionInfo +{ +public: + + // + // The certificate chain. This may be empty if the peer did not + // supply a certificate. The peer's certificate (if any) is the + // first one in the chain. + // + std::vector<CertificatePtr> nativeCerts; +}; +typedef IceUtil::Handle<WSSNativeConnectionInfo> WSSNativeConnectionInfoPtr; + +// // An application can customize the certificate verification process // by implementing the CertificateVerifier interface. // @@ -528,7 +545,7 @@ public: // the plug-in is initialized. // virtual void setPasswordPrompt(const PasswordPromptPtr&) = 0; - + #ifdef ICE_USE_OPENSSL // // Establish the OpenSSL context. This must be done before the @@ -539,7 +556,7 @@ public: // When the application supplies its own OpenSSL context, the // plug-in ignores configuration properties related to certificates, // keys, and passwords. - // + // // Note that the plugin assumes ownership of the given context. // virtual void setContext(SSL_CTX*) = 0; @@ -548,7 +565,7 @@ public: // Obtain the SSL context. Use caution when modifying this value. // Changes made to this value have no effect on existing connections. // - virtual SSL_CTX* getContext() = 0; + virtual SSL_CTX* getContext() = 0; #endif }; typedef IceUtil::Handle<Plugin> PluginPtr; diff --git a/cpp/src/Ice/EndpointI.h b/cpp/src/Ice/EndpointI.h index 8c9eb5fa055..df41372bd82 100644 --- a/cpp/src/Ice/EndpointI.h +++ b/cpp/src/Ice/EndpointI.h @@ -160,6 +160,38 @@ inline bool operator<(const EndpointI& l, const EndpointI& r) return static_cast<const ::Ice::LocalObject&>(l) < static_cast<const ::Ice::LocalObject&>(r); } +template<typename T> class InfoI : public T +{ +public: + + InfoI(const EndpointIPtr& endpoint) : _endpoint(endpoint) + { + } + + virtual Ice::Short + type() const + { + return _endpoint->type(); + } + + virtual bool + datagram() const + { + return _endpoint->datagram(); + } + + virtual bool + secure() const + { + return _endpoint->secure(); + } + +private: + + const EndpointIPtr _endpoint; +}; + + } #endif diff --git a/cpp/src/Ice/OpaqueEndpointI.cpp b/cpp/src/Ice/OpaqueEndpointI.cpp index e2f478c7231..c061eb0acfa 100644 --- a/cpp/src/Ice/OpaqueEndpointI.cpp +++ b/cpp/src/Ice/OpaqueEndpointI.cpp @@ -56,11 +56,11 @@ IceInternal::OpaqueEndpointI::OpaqueEndpointI(Short type, BasicStream* s) : _typ namespace { -class InfoI : public Ice::OpaqueEndpointInfo +class OpaqueEndpointInfoI : public Ice::OpaqueEndpointInfo { public: - InfoI(Ice::Short type, const Ice::EncodingVersion& rawEncoding, const Ice::ByteSeq& rawByes); + OpaqueEndpointInfoI(Ice::Short type, const Ice::EncodingVersion& rawEncoding, const Ice::ByteSeq& rawByes); virtual Ice::Short type() const @@ -89,7 +89,8 @@ private: // // COMPILERFIX: inlining this constructor causes crashes with gcc 4.0.1. // -InfoI::InfoI(Ice::Short type, const Ice::EncodingVersion& rawEncoding, const Ice::ByteSeq& rawBytes) : +OpaqueEndpointInfoI::OpaqueEndpointInfoI(Ice::Short type, const Ice::EncodingVersion& rawEncoding, + const Ice::ByteSeq& rawBytes) : Ice::OpaqueEndpointInfo(-1, false, rawEncoding, rawBytes), _type(type) { @@ -106,7 +107,7 @@ IceInternal::OpaqueEndpointI::streamWrite(BasicStream* s) const Ice::EndpointInfoPtr IceInternal::OpaqueEndpointI::getInfo() const { - return new InfoI(_type, _rawEncoding, _rawBytes); + return new OpaqueEndpointInfoI(_type, _rawEncoding, _rawBytes); } Short diff --git a/cpp/src/Ice/PropertyNames.cpp b/cpp/src/Ice/PropertyNames.cpp index 95cf61169a8..11b035d47df 100644 --- a/cpp/src/Ice/PropertyNames.cpp +++ b/cpp/src/Ice/PropertyNames.cpp @@ -6,7 +6,7 @@ // ICE_LICENSE file included in this distribution. // // ********************************************************************** -// Generated by makeprops.py from file ./config/PropertyNames.xml, Thu Mar 19 17:54:51 2015 +// Generated by makeprops.py from file ./config/PropertyNames.xml, Tue Apr 28 17:34:50 2015 // IMPORTANT: Do not edit this file -- any edits made here will be lost! @@ -998,8 +998,9 @@ const IceInternal::PropertyArray const IceInternal::Property IceSSLPropsData[] = { IceInternal::Property("IceSSL.Alias", false, 0), - IceInternal::Property("IceSSL.CertAuthDir", false, 0), - IceInternal::Property("IceSSL.CertAuthFile", false, 0), + IceInternal::Property("IceSSL.CAs", false, 0), + IceInternal::Property("IceSSL.CertAuthDir", true, 0), + IceInternal::Property("IceSSL.CertAuthFile", true, 0), IceInternal::Property("IceSSL.CertStore", false, 0), IceInternal::Property("IceSSL.CertFile", false, 0), IceInternal::Property("IceSSL.CertVerifier", false, 0), @@ -1011,10 +1012,10 @@ const IceInternal::Property IceSSLPropsData[] = IceInternal::Property("IceSSL.DHParams", false, 0), IceInternal::Property("IceSSL.EntropyDaemon", false, 0), IceInternal::Property("IceSSL.FindCert", false, 0), - IceInternal::Property("IceSSL.FindCert.*", false, 0), + IceInternal::Property("IceSSL.FindCert.*", true, 0), IceInternal::Property("IceSSL.ImportCert.*", true, 0), IceInternal::Property("IceSSL.InitOpenSSL", false, 0), - IceInternal::Property("IceSSL.KeyFile", false, 0), + IceInternal::Property("IceSSL.KeyFile", true, 0), IceInternal::Property("IceSSL.KeySet", false, 0), IceInternal::Property("IceSSL.Keychain", false, 0), IceInternal::Property("IceSSL.KeychainPassword", false, 0), @@ -1037,6 +1038,7 @@ const IceInternal::Property IceSSLPropsData[] = IceInternal::Property("IceSSL.Truststore", false, 0), IceInternal::Property("IceSSL.TruststorePassword", false, 0), IceInternal::Property("IceSSL.TruststoreType", false, 0), + IceInternal::Property("IceSSL.UsePlatformCAs", false, 0), IceInternal::Property("IceSSL.VerifyDepthMax", false, 0), IceInternal::Property("IceSSL.VerifyPeer", false, 0), }; diff --git a/cpp/src/Ice/PropertyNames.h b/cpp/src/Ice/PropertyNames.h index 28b47265af6..cf92a38d43f 100644 --- a/cpp/src/Ice/PropertyNames.h +++ b/cpp/src/Ice/PropertyNames.h @@ -6,7 +6,7 @@ // ICE_LICENSE file included in this distribution. // // ********************************************************************** -// Generated by makeprops.py from file ./config/PropertyNames.xml, Thu Mar 19 17:54:51 2015 +// Generated by makeprops.py from file ./config/PropertyNames.xml, Tue Apr 28 17:34:50 2015 // IMPORTANT: Do not edit this file -- any edits made here will be lost! diff --git a/cpp/src/Ice/TcpEndpointI.cpp b/cpp/src/Ice/TcpEndpointI.cpp index 606a442e94a..5e744c394bb 100644 --- a/cpp/src/Ice/TcpEndpointI.cpp +++ b/cpp/src/Ice/TcpEndpointI.cpp @@ -62,39 +62,17 @@ IceInternal::TcpEndpointI::TcpEndpointI(const ProtocolInstancePtr& instance, Bas EndpointInfoPtr IceInternal::TcpEndpointI::getInfo() const { - class InfoI : public Ice::TCPEndpointInfo - { - public: - - InfoI(const EndpointIPtr& endpoint) : _endpoint(endpoint) - { - } - - virtual Ice::Short - type() const - { - return _endpoint->type(); - } - - virtual bool - datagram() const - { - return _endpoint->datagram(); - } - - virtual bool - secure() const - { - return _endpoint->secure(); - } - - private: - - const EndpointIPtr _endpoint; - }; + TCPEndpointInfoPtr info = new InfoI<Ice::TCPEndpointInfo>(const_cast<TcpEndpointI*>(this)); + fillEndpointInfo(info.get()); + return info; +} - TCPEndpointInfoPtr info = new InfoI(const_cast<TcpEndpointI*>(this)); +EndpointInfoPtr +IceInternal::TcpEndpointI::getWSInfo(const string& resource) const +{ + WSEndpointInfoPtr info = new InfoI<Ice::WSEndpointInfo>(const_cast<TcpEndpointI*>(this)); fillEndpointInfo(info.get()); + info->resource = resource; return info; } diff --git a/cpp/src/Ice/TcpEndpointI.h b/cpp/src/Ice/TcpEndpointI.h index 2525d940168..d29498fc181 100644 --- a/cpp/src/Ice/TcpEndpointI.h +++ b/cpp/src/Ice/TcpEndpointI.h @@ -14,11 +14,12 @@ #include <Ice/IPEndpointI.h> #include <Ice/EndpointFactory.h> #include <Ice/Network.h> // for IceIternal::Address +#include <Ice/WSEndpoint.h> namespace IceInternal { -class TcpEndpointI : public IPEndpointI +class TcpEndpointI : public IPEndpointI, public WSEndpointDelegate { public: @@ -28,6 +29,7 @@ public: TcpEndpointI(const ProtocolInstancePtr&, BasicStream*); virtual Ice::EndpointInfoPtr getInfo() const; + virtual Ice::EndpointInfoPtr getWSInfo(const std::string&) const; virtual Ice::Int timeout() const; virtual EndpointIPtr timeout(Ice::Int) const; diff --git a/cpp/src/Ice/TcpTransceiver.cpp b/cpp/src/Ice/TcpTransceiver.cpp index ee022c639e9..4fa6d0bce2d 100644 --- a/cpp/src/Ice/TcpTransceiver.cpp +++ b/cpp/src/Ice/TcpTransceiver.cpp @@ -105,13 +105,17 @@ IceInternal::TcpTransceiver::toDetailedString() const Ice::ConnectionInfoPtr IceInternal::TcpTransceiver::getInfo() const { - Ice::TCPConnectionInfoPtr info = new Ice::TCPConnectionInfo(); - fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress, info->remotePort); - if(_stream->fd() != INVALID_SOCKET) - { - info->rcvSize = getRecvBufferSize(_stream->fd()); - info->sndSize = getSendBufferSize(_stream->fd()); - } + TCPConnectionInfoPtr info = new TCPConnectionInfo(); + fillConnectionInfo(info); + return info; +} + +Ice::ConnectionInfoPtr +IceInternal::TcpTransceiver::getWSInfo(const Ice::HeaderDict& headers) const +{ + WSConnectionInfoPtr info = new WSConnectionInfo(); + fillConnectionInfo(info); + info->headers = headers; return info; } @@ -136,3 +140,13 @@ IceInternal::TcpTransceiver::~TcpTransceiver() { } +void +IceInternal::TcpTransceiver::fillConnectionInfo(const TCPConnectionInfoPtr& info) const +{ + fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress, info->remotePort); + if(_stream->fd() != INVALID_SOCKET) + { + info->rcvSize = getRecvBufferSize(_stream->fd()); + info->sndSize = getSendBufferSize(_stream->fd()); + } +} diff --git a/cpp/src/Ice/TcpTransceiver.h b/cpp/src/Ice/TcpTransceiver.h index ee6c57214d9..16845238ae4 100644 --- a/cpp/src/Ice/TcpTransceiver.h +++ b/cpp/src/Ice/TcpTransceiver.h @@ -14,6 +14,7 @@ #include <Ice/Transceiver.h> #include <Ice/Network.h> #include <Ice/StreamSocket.h> +#include <Ice/WSTransceiver.h> namespace IceInternal { @@ -21,7 +22,7 @@ namespace IceInternal class TcpConnector; class TcpAcceptor; -class TcpTransceiver : public Transceiver +class TcpTransceiver : public Transceiver, public WSTransceiverDelegate { public: @@ -42,6 +43,7 @@ public: virtual std::string toString() const; virtual std::string toDetailedString() const; virtual Ice::ConnectionInfoPtr getInfo() const; + virtual Ice::ConnectionInfoPtr getWSInfo(const Ice::HeaderDict&) const; virtual void checkSendSize(const Buffer&); virtual void setBufferSize(int rcvSize, int sndSize); @@ -50,6 +52,8 @@ private: TcpTransceiver(const ProtocolInstancePtr&, const StreamSocketPtr&); virtual ~TcpTransceiver(); + void fillConnectionInfo(const Ice::TCPConnectionInfoPtr&) const; + friend class TcpConnector; friend class TcpAcceptor; diff --git a/cpp/src/Ice/UdpEndpointI.cpp b/cpp/src/Ice/UdpEndpointI.cpp index 6b0584fb2ba..019ff02a368 100644 --- a/cpp/src/Ice/UdpEndpointI.cpp +++ b/cpp/src/Ice/UdpEndpointI.cpp @@ -76,38 +76,7 @@ IceInternal::UdpEndpointI::UdpEndpointI(const ProtocolInstancePtr& instance, Bas EndpointInfoPtr IceInternal::UdpEndpointI::getInfo() const { - class InfoI : public Ice::UDPEndpointInfo - { - public: - - InfoI(const EndpointIPtr& endpoint) : _endpoint(endpoint) - { - } - - virtual Ice::Short - type() const - { - return _endpoint->type(); - } - - virtual bool - datagram() const - { - return _endpoint->datagram(); - } - - virtual bool - secure() const - { - return _endpoint->secure(); - } - - private: - - const EndpointIPtr _endpoint; - }; - - Ice::UDPEndpointInfoPtr info = new InfoI(const_cast<UdpEndpointI*>(this)); + Ice::UDPEndpointInfoPtr info = new InfoI<Ice::UDPEndpointInfo>(const_cast<UdpEndpointI*>(this)); fillEndpointInfo(info.get()); return info; } diff --git a/cpp/src/Ice/WSEndpoint.cpp b/cpp/src/Ice/WSEndpoint.cpp index 54acdef77c4..d23b952b6b5 100644 --- a/cpp/src/Ice/WSEndpoint.cpp +++ b/cpp/src/Ice/WSEndpoint.cpp @@ -47,41 +47,8 @@ IceInternal::WSEndpoint::WSEndpoint(const ProtocolInstancePtr& instance, const E Ice::EndpointInfoPtr IceInternal::WSEndpoint::getInfo() const { - class InfoI : public WSEndpointInfo - { - public: - - InfoI(const EndpointIPtr& e) : _endpoint(e) - { - } - - virtual Short - type() const - { - return _endpoint->type(); - } - - virtual bool - datagram() const - { - return _endpoint->datagram(); - } - - virtual bool - secure() const - { - return _endpoint->secure(); - } - - private: - - const EndpointIPtr _endpoint; - }; - - WSEndpointInfoPtr info = new InfoI(const_cast<WSEndpoint*>(this)); - _delegate->fillEndpointInfo(info.get()); - info->resource = _resource; - return info; + assert(dynamic_cast<WSEndpointDelegate*>(_delegate.get())); + return dynamic_cast<WSEndpointDelegate*>(_delegate.get())->getWSInfo(_resource); } Ice::Short diff --git a/cpp/src/Ice/WSEndpoint.h b/cpp/src/Ice/WSEndpoint.h index 255bcf6cc1b..6fb08211a84 100644 --- a/cpp/src/Ice/WSEndpoint.h +++ b/cpp/src/Ice/WSEndpoint.h @@ -20,6 +20,17 @@ namespace IceInternal { +// +// Delegate interface implemented by TcpEndpoint or IceSSL::Endpoint or any endpoint that WS can +// delegate to. +// +class ICE_API WSEndpointDelegate : virtual public IceUtil::Shared +{ +public: + + virtual Ice::EndpointInfoPtr getWSInfo(const std::string&) const = 0; +}; + class WSEndpoint : public EndpointI { public: diff --git a/cpp/src/Ice/WSTransceiver.cpp b/cpp/src/Ice/WSTransceiver.cpp index d476b52a67e..08764fbc267 100644 --- a/cpp/src/Ice/WSTransceiver.cpp +++ b/cpp/src/Ice/WSTransceiver.cpp @@ -803,17 +803,8 @@ IceInternal::WSTransceiver::toDetailedString() const Ice::ConnectionInfoPtr IceInternal::WSTransceiver::getInfo() const { - IPConnectionInfoPtr di = IPConnectionInfoPtr::dynamicCast(_delegate->getInfo()); - assert(di); - WSConnectionInfoPtr info = new WSConnectionInfo(); - info->localAddress = di->localAddress; - info->localPort = di->localPort; - info->remoteAddress = di->remoteAddress; - info->remotePort = di->remotePort; - info->rcvSize = di->rcvSize; - info->sndSize = di->sndSize; - info->headers = _parser->getHeaders(); - return info; + assert(dynamic_cast<WSTransceiverDelegate*>(_delegate.get())); + return dynamic_cast<WSTransceiverDelegate*>(_delegate.get())->getWSInfo(_parser->getHeaders()); } void diff --git a/cpp/src/Ice/WSTransceiver.h b/cpp/src/Ice/WSTransceiver.h index 2273f51a683..c3d8d760e22 100644 --- a/cpp/src/Ice/WSTransceiver.h +++ b/cpp/src/Ice/WSTransceiver.h @@ -24,6 +24,17 @@ namespace IceInternal class ConnectorI; class AcceptorI; +// +// Delegate interface implemented by TcpTransceiver or IceSSL::Transceiver or any transport that WS can +// delegate to. +// +class ICE_API WSTransceiverDelegate : virtual public IceUtil::Shared +{ +public: + + virtual Ice::ConnectionInfoPtr getWSInfo(const Ice::HeaderDict&) const = 0; +}; + class WSTransceiver : public Transceiver { public: diff --git a/cpp/src/Ice/winrt/StreamEndpointI.cpp b/cpp/src/Ice/winrt/StreamEndpointI.cpp index 60aca535bdd..bdd3dc0295d 100644 --- a/cpp/src/Ice/winrt/StreamEndpointI.cpp +++ b/cpp/src/Ice/winrt/StreamEndpointI.cpp @@ -44,43 +44,6 @@ createIceSSL(const CommunicatorPtr& com, const string&, const StringSeq&) } -namespace -{ - -template<class T> class InfoI : public T -{ -public: - - InfoI(const ProtocolInstancePtr& instance, Ice::Int to, bool comp, const string& host, Ice::Int port) : - T(to, comp, host, port, ""), _instance(instance) - { - } - - virtual Ice::Short - type() const - { - return _instance->type(); - } - - virtual bool - datagram() const - { - return false; - } - - virtual bool - secure() const - { - return _instance->secure(); - } - -private: - - ProtocolInstancePtr _instance; -}; - -} - IceUtil::Shared* IceInternal::upCast(StreamEndpointI* p) { return p; } IceInternal::StreamEndpointI::StreamEndpointI(const ProtocolInstancePtr& instance, const string& ho, Int po, Int ti, @@ -110,14 +73,37 @@ IceInternal::StreamEndpointI::StreamEndpointI(const ProtocolInstancePtr& instanc EndpointInfoPtr IceInternal::StreamEndpointI::getInfo() const { + IPEndpointInfoPtr info; + if(_instance->secure()) + { + info = new InfoI<IceSSL::EndpointInfo>(const_cast<StreamEndpointI*>(this)); + } + else + { + info = new InfoI<Ice::TCPEndpointInfo>(const_cast<StreamEndpointI*>(this)); + } + fillEndpointInfo(info.get()); + return info; +} + +EndpointInfoPtr +IceInternal::StreamEndpointI::getWSInfo(const string& resource) const +{ + IPEndpointInfoPtr info; if(_instance->secure()) { - return new InfoI<IceSSL::EndpointInfo>(_instance, _timeout, _compress, _host, _port); + IceSSL::WSSEndpointInfoPtr i = new InfoI<IceSSL::WSSEndpointInfo>(const_cast<StreamEndpointI*>(this)); + i->resource = resource; + info = i; } else { - return new InfoI<Ice::TCPEndpointInfo>(_instance, _timeout, _compress, _host, _port); + Ice::WSEndpointInfoPtr i = new InfoI<Ice::WSEndpointInfo>(const_cast<StreamEndpointI*>(this)); + i->resource = resource; + info = i; } + fillEndpointInfo(info.get()); + return info; } Int @@ -180,8 +166,7 @@ IceInternal::StreamEndpointI::datagram() const bool IceInternal::StreamEndpointI::secure() const { - return _instance->type() == IceSSL::EndpointType || - _instance->type() == WSSEndpointType; + return _instance->type() == IceSSL::EndpointType || _instance->type() == WSSEndpointType; } TransceiverPtr diff --git a/cpp/src/Ice/winrt/StreamEndpointI.h b/cpp/src/Ice/winrt/StreamEndpointI.h index 8e77b2d1397..d3f9f1bbe66 100644 --- a/cpp/src/Ice/winrt/StreamEndpointI.h +++ b/cpp/src/Ice/winrt/StreamEndpointI.h @@ -13,13 +13,14 @@ #include <IceUtil/Config.h> #include <Ice/IPEndpointI.h> #include <Ice/EndpointFactory.h> +#include <Ice/WSEndpoint.h> #include <Ice/Network.h> // for IceIternal::Address #include <Ice/winrt/StreamF.h> namespace IceInternal { -class StreamEndpointI : public IPEndpointI +class StreamEndpointI : public IPEndpointI, WSEndpointDelegate { public: @@ -28,6 +29,7 @@ public: StreamEndpointI(const ProtocolInstancePtr&, BasicStream*); virtual Ice::EndpointInfoPtr getInfo() const; + virtual Ice::EndpointInfoPtr getWSInfo(const std::string&) const; virtual Ice::Int timeout() const; virtual EndpointIPtr timeout(Ice::Int) const; diff --git a/cpp/src/Ice/winrt/StreamTransceiver.cpp b/cpp/src/Ice/winrt/StreamTransceiver.cpp index 3c4a30f8cc6..7cf9946ed9c 100644 --- a/cpp/src/Ice/winrt/StreamTransceiver.cpp +++ b/cpp/src/Ice/winrt/StreamTransceiver.cpp @@ -302,12 +302,29 @@ IceInternal::StreamTransceiver::getInfo() const { info = new Ice::TCPConnectionInfo(); } - fdToAddressAndPort(_fd, info->localAddress, info->localPort, info->remoteAddress, info->remotePort); - info->rcvSize = getRecvBufferSize(_fd); - info->sndSize = getSendBufferSize(_fd); + fillConnectionInfo(info); return info; } +Ice::ConnectionInfoPtr +IceInternal::StreamTransceiver::getWSInfo(const Ice::HeaderDict& headers) const +{ + if(_instance->secure()) + { + IceSSL::WSSConnectionInfoPtr info = new IceSSL::WSSConnectionInfo(); + fillConnectionInfo(info); + info->headers = headers; + return info; + } + else + { + Ice::WSConnectionInfoPtr info = new Ice::WSConnectionInfo(); + fillConnectionInfo(info); + info->headers = headers; + return info; + } +} + void IceInternal::StreamTransceiver::checkSendSize(const Buffer&) { @@ -387,3 +404,12 @@ IceInternal::StreamTransceiver::checkIfErrorOrCompleted(SocketOperation op, IAsy return true; // Prevent compiler warning. } } + +void +IceInternal::StreamTransceiver::fillConnectionInfo(const Ice::IPConnectionInfoPtr& info) const +{ + fdToAddressAndPort(_fd, info->localAddress, info->localPort, info->remoteAddress, info->remotePort); + info->rcvSize = getRecvBufferSize(_fd); + info->sndSize = getSendBufferSize(_fd); +} + diff --git a/cpp/src/Ice/winrt/StreamTransceiver.h b/cpp/src/Ice/winrt/StreamTransceiver.h index 4a32cfd10e8..6d7effd8e49 100644 --- a/cpp/src/Ice/winrt/StreamTransceiver.h +++ b/cpp/src/Ice/winrt/StreamTransceiver.h @@ -13,6 +13,7 @@ #include <Ice/ProtocolInstanceF.h> #include <Ice/Transceiver.h> #include <Ice/Network.h> +#include <Ice/WSTransceiver.h> namespace IceInternal { @@ -20,7 +21,7 @@ namespace IceInternal class StreamConnector; class StreamAcceptor; -class StreamTransceiver : public Transceiver, public NativeInfo +class StreamTransceiver : public Transceiver, public NativeInfo, public WSTransceiverDelegate { enum State { @@ -49,6 +50,7 @@ public: virtual std::string toString() const; virtual std::string toDetailedString() const; virtual Ice::ConnectionInfoPtr getInfo() const; + virtual Ice::ConnectionInfoPtr getWSInfo(const Ice::HeaderDict&) const; virtual void checkSendSize(const Buffer&); virtual void setBufferSize(int rcvSize, int sndSize); @@ -58,8 +60,8 @@ private: virtual ~StreamTransceiver(); void connect(const Address&); - bool checkIfErrorOrCompleted(SocketOperation, Windows::Foundation::IAsyncInfo^, int = 0); + void fillConnectionInfo(const Ice::IPConnectionInfoPtr&) const; friend class StreamConnector; friend class StreamAcceptor; diff --git a/cpp/src/IceSSL/EndpointI.cpp b/cpp/src/IceSSL/EndpointI.cpp index 124c63dc645..6893db0e117 100644 --- a/cpp/src/IceSSL/EndpointI.cpp +++ b/cpp/src/IceSSL/EndpointI.cpp @@ -53,39 +53,17 @@ IceSSL::EndpointI::EndpointI(const InstancePtr& instance, IceInternal::BasicStre Ice::EndpointInfoPtr IceSSL::EndpointI::getInfo() const { - class InfoI : public EndpointInfo - { - public: - - InfoI(const IceInternal::EndpointIPtr& endpoint) : _endpoint(endpoint) - { - } - - virtual Ice::Short - type() const - { - return _endpoint->type(); - } - - virtual bool - datagram() const - { - return _endpoint->datagram(); - } - - virtual bool - secure() const - { - return _endpoint->secure(); - } - - private: - - const IceInternal::EndpointIPtr _endpoint; - }; + EndpointInfoPtr info = new IceInternal::InfoI<EndpointInfo>(const_cast<EndpointI*>(this)); + fillEndpointInfo(info.get()); + return info; +} - IPEndpointInfoPtr info = new InfoI(const_cast<EndpointI*>(this)); +Ice::EndpointInfoPtr +IceSSL::EndpointI::getWSInfo(const string& resource) const +{ + WSSEndpointInfoPtr info = new IceInternal::InfoI<WSSEndpointInfo>(const_cast<EndpointI*>(this)); fillEndpointInfo(info.get()); + info->resource = resource; return info; } diff --git a/cpp/src/IceSSL/EndpointI.h b/cpp/src/IceSSL/EndpointI.h index b3a154a6ad4..74f04d1665a 100644 --- a/cpp/src/IceSSL/EndpointI.h +++ b/cpp/src/IceSSL/EndpointI.h @@ -12,6 +12,7 @@ #include <Ice/IPEndpointI.h> #include <Ice/EndpointFactory.h> +#include <Ice/WSEndpoint.h> #include <IceSSL/InstanceF.h> #include <IceSSL/EndpointInfo.h> #include <Ice/Network.h> @@ -19,7 +20,7 @@ namespace IceSSL { -class EndpointI : public IceInternal::IPEndpointI +class EndpointI : public IceInternal::IPEndpointI, public IceInternal::WSEndpointDelegate { public: @@ -29,6 +30,7 @@ public: EndpointI(const InstancePtr&, IceInternal::BasicStream*); virtual Ice::EndpointInfoPtr getInfo() const; + virtual Ice::EndpointInfoPtr getWSInfo(const std::string&) const; virtual Ice::Int timeout() const; virtual IceInternal::EndpointIPtr timeout(Ice::Int) const; diff --git a/cpp/src/IceSSL/OpenSSLEngine.cpp b/cpp/src/IceSSL/OpenSSLEngine.cpp index c47e19eb99f..cc617008547 100644 --- a/cpp/src/IceSSL/OpenSSLEngine.cpp +++ b/cpp/src/IceSSL/OpenSSLEngine.cpp @@ -395,8 +395,22 @@ OpenSSLEngine::initialize() // Establish the location of CA certificates. // { - string caFile = properties->getProperty(propPrefix + "CertAuthFile"); - string caDir = properties->getPropertyWithDefault(propPrefix + "CertAuthDir", defaultDir); + string caFile = properties->getProperty(propPrefix + "CAs"); + string caDir; + if(!caFile.empty()) + { + if(!checkPath(caFile, defaultDir, false) && checkPath(caFile, defaultDir, true)) + { + caDir = caFile; + caFile = ""; + } + } + else + { + // Deprecated properties + caFile = properties->getProperty(propPrefix + "CertAuthFile"); + caDir = properties->getProperty(propPrefix + "CertAuthDir"); + } const char* file = 0; const char* dir = 0; if(!caFile.empty()) @@ -452,6 +466,10 @@ OpenSSLEngine::initialize() throw PluginInitializationException(__FILE__, __LINE__, msg); } } + else if(properties->getPropertyAsInt("IceSSL.UsePlatformCAs") > 0) + { + SSL_CTX_set_default_verify_paths(_ctx); + } } // diff --git a/cpp/src/IceSSL/OpenSSLTransceiverI.cpp b/cpp/src/IceSSL/OpenSSLTransceiverI.cpp index bed46b3b8b4..2b40c62a4b6 100644 --- a/cpp/src/IceSSL/OpenSSLTransceiverI.cpp +++ b/cpp/src/IceSSL/OpenSSLTransceiverI.cpp @@ -276,11 +276,12 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B throw ex; } } - else if(_info) + else { - _info->verified = true; + _verified = true; } - _engine->verifyPeer(_stream->fd(), _host, getNativeConnectionInfo()); + + _engine->verifyPeer(_stream->fd(), _host, NativeConnectionInfoPtr::dynamicCast(getInfo())); if(_engine->securityTraceLevel() >= 1) { @@ -573,7 +574,18 @@ IceSSL::TransceiverI::toDetailedString() const Ice::ConnectionInfoPtr IceSSL::TransceiverI::getInfo() const { - return getNativeConnectionInfo(); + NativeConnectionInfoPtr info = new NativeConnectionInfo(); + fillConnectionInfo(info, info->nativeCerts); + return info; +} + +Ice::ConnectionInfoPtr +IceSSL::TransceiverI::getWSInfo(const Ice::HeaderDict& headers) const +{ + WSSNativeConnectionInfoPtr info = new WSSNativeConnectionInfo(); + fillConnectionInfo(info, info->nativeCerts); + info->headers = headers; + return info; } void @@ -609,17 +621,18 @@ IceSSL::TransceiverI::verifyCallback(int ok, X509_STORE_CTX* c) } // - // Initialize the native connection info with the verified - // certificate chain. SSL_get_peer_cert_chain doesn't return the - // verified chain, it returns the chain sent by the peer. + // Initialize the native certs with the verified certificate chain. SSL_get_peer_cert_chain + // doesn't return the verified chain, it returns the chain sent by the peer. // - try - { - _info = initNativeConnectionInfo(c); - } - catch(const Ice::Exception&) + STACK_OF(X509)* chain = X509_STORE_CTX_get1_chain(c); + if(chain != 0) { - // Ignore + _nativeCerts.clear(); + for(int i = 0; i < sk_X509_num(chain); ++i) + { + _nativeCerts.push_back(new Certificate(X509_dup(sk_X509_value(chain, i)))); + } + sk_X509_pop_free(chain, X509_free); } // @@ -639,6 +652,7 @@ IceSSL::TransceiverI::TransceiverI(const InstancePtr& instance, const IceInterna _adapterName(incoming ? hostOrAdapterName : ""), _incoming(incoming), _stream(stream), + _verified(false), _ssl(0) { } @@ -647,20 +661,9 @@ IceSSL::TransceiverI::~TransceiverI() { } -NativeConnectionInfoPtr -IceSSL::TransceiverI::getNativeConnectionInfo() const -{ - if(!_info) - { - return initNativeConnectionInfo(0); - } - return _info; -} - -NativeConnectionInfoPtr -IceSSL::TransceiverI::initNativeConnectionInfo(X509_STORE_CTX* ctx) const +void +IceSSL::TransceiverI::fillConnectionInfo(const ConnectionInfoPtr& info, std::vector<CertificatePtr>& nativeCerts) const { - NativeConnectionInfoPtr info = new NativeConnectionInfo(); IceInternal::fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress, info->remotePort); if(_stream->fd() != INVALID_SOCKET) @@ -670,57 +673,11 @@ IceSSL::TransceiverI::initNativeConnectionInfo(X509_STORE_CTX* ctx) const } info->adapterName = _adapterName; info->incoming = _incoming; - info->verified = false; - - STACK_OF(X509)* chain = 0; - if(ctx) - { - // - // This is called from the verify callback where OpenSSL provides the verified - // certificate chain. - // - chain = X509_STORE_CTX_get1_chain(ctx); - } - - if(chain == 0 && _ssl != 0) - { - // - // On the client side, SSL_get_peer_cert_chain returns the entire chain of certs. - // On the server side, the peer certificate must be obtained separately. - // - // Since we have no clear idea whether the connection is server or client side, - // the peer certificate is obtained separately and compared against the first - // certificate in the chain. If they are not the same, it is added to the chain. - // - X509* cert = SSL_get_peer_certificate(_ssl); - chain = SSL_get_peer_cert_chain(_ssl); - if(cert != 0 && (chain == 0 || sk_X509_num(chain) == 0 || cert != sk_X509_value(chain, 0))) - { - CertificatePtr certificate = new Certificate(cert); - info->nativeCerts.push_back(certificate); - info->certs.push_back(certificate->encode()); - } - else - { - X509_free(cert); - } - } - - if(chain != 0) + info->verified = _verified; + nativeCerts = _nativeCerts; + for(vector<CertificatePtr>::const_iterator p = _nativeCerts.begin(); p != _nativeCerts.end(); ++p) { - for(int i = 0; i < sk_X509_num(chain); ++i) - { - // - // Duplicate the certificate since the stack comes straight from the SSL connection. - // - CertificatePtr certificate = new Certificate(X509_dup(sk_X509_value(chain, i))); - info->nativeCerts.push_back(certificate); - info->certs.push_back(certificate->encode()); - } - if(ctx) - { - sk_X509_pop_free(chain, X509_free); - } + info->certs.push_back((*p)->encode()); } if(_ssl != 0) { @@ -728,7 +685,6 @@ IceSSL::TransceiverI::initNativeConnectionInfo(X509_STORE_CTX* ctx) const } info->adapterName = _adapterName; info->incoming = _incoming; - return info; } #endif diff --git a/cpp/src/IceSSL/OpenSSLTransceiverI.h b/cpp/src/IceSSL/OpenSSLTransceiverI.h index 85fa55d4548..a64e932a0f5 100644 --- a/cpp/src/IceSSL/OpenSSLTransceiverI.h +++ b/cpp/src/IceSSL/OpenSSLTransceiverI.h @@ -19,6 +19,7 @@ #include <Ice/Transceiver.h> #include <Ice/Network.h> #include <Ice/StreamSocket.h> +#include <Ice/WSTransceiver.h> #ifdef ICE_USE_OPENSSL @@ -31,7 +32,7 @@ namespace IceSSL class ConnectorI; class AcceptorI; -class TransceiverI : public IceInternal::Transceiver +class TransceiverI : public IceInternal::Transceiver, public IceInternal::WSTransceiverDelegate { public: @@ -46,6 +47,7 @@ public: virtual std::string toString() const; virtual std::string toDetailedString() const; virtual Ice::ConnectionInfoPtr getInfo() const; + virtual Ice::ConnectionInfoPtr getWSInfo(const Ice::HeaderDict&) const; virtual void checkSendSize(const IceInternal::Buffer&); virtual void setBufferSize(int rcvSize, int sndSize); @@ -56,8 +58,7 @@ private: TransceiverI(const InstancePtr&, const IceInternal::StreamSocketPtr&, const std::string&, bool); virtual ~TransceiverI(); - virtual NativeConnectionInfoPtr getNativeConnectionInfo() const; - NativeConnectionInfoPtr initNativeConnectionInfo(X509_STORE_CTX*) const; + void fillConnectionInfo(const ConnectionInfoPtr&, std::vector<CertificatePtr>&) const; friend class ConnectorI; friend class AcceptorI; @@ -68,7 +69,8 @@ private: const std::string _adapterName; const bool _incoming; const IceInternal::StreamSocketPtr _stream; - NativeConnectionInfoPtr _info; + bool _verified; + std::vector<CertificatePtr> _nativeCerts; SSL* _ssl; }; diff --git a/cpp/src/IceSSL/SChannelEngine.cpp b/cpp/src/IceSSL/SChannelEngine.cpp index efb3b099ce3..ddc47619373 100644 --- a/cpp/src/IceSSL/SChannelEngine.cpp +++ b/cpp/src/IceSSL/SChannelEngine.cpp @@ -56,7 +56,7 @@ struct CertChainEngineConfig # endif void -addCertificateToStore(const string& file, HCERTSTORE store, PCCERT_CONTEXT* cert = 0) +addCertificatesToStore(const string& file, HCERTSTORE store, PCCERT_CONTEXT* cert = 0) { vector<char> buffer; readFile(file, buffer); @@ -65,29 +65,50 @@ addCertificateToStore(const string& file, HCERTSTORE store, PCCERT_CONTEXT* cert throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: certificate file is empty:\n" + file); } - vector<BYTE> outBuffer; - outBuffer.resize(buffer.size()); - DWORD outLength = static_cast<DWORD>(outBuffer.size()); - - if(!CryptStringToBinary(&buffer[0], static_cast<DWORD>(buffer.size()), CRYPT_STRING_BASE64HEADER, - &outBuffer[0], &outLength, 0, 0)) + string strbuf(buffer.begin(), buffer.end()); + string::size_type size, startpos, endpos = 0; + bool first = true; + while(true) { - // - // Base64 data should always be bigger than binary - // - assert(GetLastError() != ERROR_MORE_DATA); - throw PluginInitializationException(__FILE__, __LINE__, - "IceSSL: error decoding certificate:\n" + lastErrorToString()); - } + startpos = strbuf.find("-----BEGIN CERTIFICATE-----", endpos); + if(startpos != string::npos) + { + endpos = strbuf.find("-----END CERTIFICATE-----", startpos); + size = endpos - startpos + sizeof("-----END CERTIFICATE-----"); + } + else if(first) + { + startpos = 0; + endpos = string::npos; + size = strbuf.size(); + } + else + { + break; + } - if(!CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &outBuffer[0], - outLength, CERT_STORE_ADD_NEW, cert)) - { - if(GetLastError() != static_cast<DWORD>(CRYPT_E_EXISTS)) + vector<BYTE> outBuffer; + outBuffer.resize(size); + DWORD outLength = static_cast<DWORD>(outBuffer.size()); + if(!CryptStringToBinary(&buffer[startpos], static_cast<DWORD>(size), CRYPT_STRING_ANY, &outBuffer[0], + &outLength, 0, 0)) { + assert(GetLastError() != ERROR_MORE_DATA); // Base64 data should always be bigger than binary throw PluginInitializationException(__FILE__, __LINE__, - "IceSSL: error decoding certificate:\n" + lastErrorToString()); + "IceSSL: error decoding certificate:\n" + lastErrorToString()); + } + + if(!CertAddEncodedCertificateToStore(store, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, &outBuffer[0], + outLength, CERT_STORE_ADD_NEW, first ? cert : 0)) + { + if(GetLastError() != static_cast<DWORD>(CRYPT_E_EXISTS)) + { + throw PluginInitializationException(__FILE__, __LINE__, + "IceSSL: error decoding certificate:\n" + lastErrorToString()); + } } + + first = false; } } @@ -244,8 +265,12 @@ SChannelEngine::initialize() // // Create trusted CA store with contents of CertAuthFile // - string caFile = properties->getProperty(prefix + "CertAuthFile"); - if(!caFile.empty()) + string caFile = properties->getProperty(prefix + "CAs"); + if(caFile.empty()) + { + caFile = properties->getProperty(prefix + "CertAuthFile"); + } + if(!caFile.empty() || properties->getPropertyAsInt("IceSSL.UsePlatformCAs") <= 0) { _rootStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, 0, 0); if(!_rootStore) @@ -253,15 +278,20 @@ SChannelEngine::initialize() throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: error creating in memory certificate store:\n" + lastErrorToString()); } - + } + if(!caFile.empty()) + { if(!checkPath(caFile, defaultDir, false)) { throw PluginInitializationException(__FILE__, __LINE__, "IceSSL: CA certificate file not found:\n" + caFile); } - addCertificateToStore(caFile, _rootStore); + addCertificatesToStore(caFile, _rootStore); + } + if(_rootStore) + { // // Create a chain engine that uses our Trusted Root Store // @@ -410,26 +440,8 @@ SChannelEngine::initialize() "IceSSL: certificate error:\n" + lastErrorToString()); } - // - // If we found a certificate, add it to a new memory store. We - // can't use directly the certificate context from the PFX - // store: while it works for certificates without - // intermediates, it doesn't if the certificate has - // intermediates, the intermediates certificates aren't being - // sent. - // - HCERTSTORE newStore = CertOpenStore(CERT_STORE_PROV_MEMORY, 0, 0, 0, 0); - PCCERT_CONTEXT newCert; - if(!CertAddCertificateContextToStore(newStore, cert, CERT_STORE_ADD_ALWAYS, &newCert)) - { - CertCloseStore(newStore, 0); - throw PluginInitializationException(__FILE__, __LINE__, - "IceSSL: certificate error:\n" + lastErrorToString()); - } - _certs.push_back(newCert); - _stores.push_back(newStore); - CertFreeCertificateContext(cert); - CertCloseStore(store, 0); + _certs.push_back(cert); + _stores.push_back(store); continue; } @@ -560,7 +572,7 @@ SChannelEngine::initialize() "store:\n" + lastErrorToString()); } - addCertificateToStore(certFile, store, &cert); + addCertificatesToStore(certFile, store, &cert); // // Associate key & certificate @@ -705,6 +717,17 @@ SChannelEngine::newCredentialsHandle(bool incoming) // the root certificate either way. // cred.dwFlags = SCH_CRED_NO_SYSTEM_MAPPER; + + // + // There's no way to prevent SChannel from sending "CA names" to the + // client. Recent Windows versions don't CA names but older ones do + // send all the trusted root CA names. We provide the root store to + // ensure that for these older Windows versions, we also include the + // CA names of your trusted roots. IceSSL for Java will only send a + // client certificate if the client certificate CA matches one of the + // CA names sent by the server. + // + cred.hRootStore = _rootStore; } else { diff --git a/cpp/src/IceSSL/SChannelTransceiverI.cpp b/cpp/src/IceSSL/SChannelTransceiverI.cpp index 74d9d840ed2..126a966f6b3 100644 --- a/cpp/src/IceSSL/SChannelTransceiverI.cpp +++ b/cpp/src/IceSSL/SChannelTransceiverI.cpp @@ -715,7 +715,7 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B } } - _engine->verifyPeer(_stream->fd(), _host, getNativeConnectionInfo()); + _engine->verifyPeer(_stream->fd(), _host, NativeConnectionInfoPtr::dynamicCast(getInfo())); _state = StateHandshakeComplete; if(_instance->engine()->securityTraceLevel() >= 1) @@ -948,7 +948,18 @@ IceSSL::TransceiverI::toDetailedString() const Ice::ConnectionInfoPtr IceSSL::TransceiverI::getInfo() const { - return getNativeConnectionInfo(); + NativeConnectionInfoPtr info = new NativeConnectionInfo(); + fillConnectionInfo(info, info->nativeCerts); + return info; +} + +Ice::ConnectionInfoPtr +IceSSL::TransceiverI::getWSInfo(const Ice::HeaderDict& headers) const +{ + WSSNativeConnectionInfoPtr info = new WSSNativeConnectionInfo(); + fillConnectionInfo(info, info->nativeCerts); + info->headers = headers; + return info; } void @@ -984,10 +995,9 @@ IceSSL::TransceiverI::~TransceiverI() { } -NativeConnectionInfoPtr -IceSSL::TransceiverI::getNativeConnectionInfo() const +void +IceSSL::TransceiverI::fillConnectionInfo(const ConnectionInfoPtr& info, vector<CertificatePtr>& nativeCerts) const { - NativeConnectionInfoPtr info = new NativeConnectionInfo(); IceInternal::fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress, info->remotePort); if(_stream->fd() != INVALID_SOCKET) @@ -1032,7 +1042,7 @@ IceSSL::TransceiverI::getNativeConnectionInfo() const } CertificatePtr certificate = new Certificate(cc); - info->nativeCerts.push_back(certificate); + nativeCerts.push_back(certificate); info->certs.push_back(certificate->encode()); } CertFreeCertificateChain(certChain); @@ -1059,7 +1069,6 @@ IceSSL::TransceiverI::getNativeConnectionInfo() const info->adapterName = _adapterName; info->incoming = _incoming; - return info; } bool diff --git a/cpp/src/IceSSL/SChannelTransceiverI.h b/cpp/src/IceSSL/SChannelTransceiverI.h index a029cf596bf..f60d54ff6d6 100644 --- a/cpp/src/IceSSL/SChannelTransceiverI.h +++ b/cpp/src/IceSSL/SChannelTransceiverI.h @@ -19,6 +19,7 @@ #include <Ice/Network.h> #include <Ice/Buffer.h> #include <Ice/StreamSocket.h> +#include <Ice/WSTransceiver.h> #ifdef ICE_USE_SCHANNEL @@ -42,7 +43,7 @@ namespace IceSSL class ConnectorI; class AcceptorI; -class TransceiverI : public IceInternal::Transceiver +class TransceiverI : public IceInternal::Transceiver, public IceInternal::WSTransceiverDelegate { public: @@ -63,6 +64,7 @@ public: virtual std::string toString() const; virtual std::string toDetailedString() const; virtual Ice::ConnectionInfoPtr getInfo() const; + virtual Ice::ConnectionInfoPtr getWSInfo(const Ice::HeaderDict&) const; virtual void checkSendSize(const IceInternal::Buffer&); virtual void setBufferSize(int rcvSize, int sndSize); @@ -71,7 +73,7 @@ private: TransceiverI(const InstancePtr&, const IceInternal::StreamSocketPtr&, const std::string&, bool); virtual ~TransceiverI(); - virtual NativeConnectionInfoPtr getNativeConnectionInfo() const; + void fillConnectionInfo(const ConnectionInfoPtr&, std::vector<CertificatePtr>&) const; IceInternal::SocketOperation sslHandshake(); diff --git a/cpp/src/IceSSL/SecureTransportEngine.cpp b/cpp/src/IceSSL/SecureTransportEngine.cpp index 9264bf252aa..a7102f64279 100644 --- a/cpp/src/IceSSL/SecureTransportEngine.cpp +++ b/cpp/src/IceSSL/SecureTransportEngine.cpp @@ -905,7 +905,11 @@ IceSSL::SecureTransportEngine::initialize() // try { - string caFile = properties->getProperty("IceSSL.CertAuthFile"); + string caFile = properties->getProperty("IceSSL.CAs"); + if(caFile.empty()) + { + caFile = properties->getProperty("IceSSL.CertAuthFile"); + } if(!caFile.empty()) { if(!checkPath(caFile, defaultDir, false)) @@ -915,6 +919,11 @@ IceSSL::SecureTransportEngine::initialize() } _certificateAuthorities = loadCACertificates(caFile); } + else if(properties->getPropertyAsInt("IceSSL.UsePlatformCAs") <= 0) + { + // Setup an empty list of Root CAs to not use the system root CAs. + _certificateAuthorities = CFArrayCreate(0, 0, 0, 0); + } } catch(const CertificateReadException& ce) { diff --git a/cpp/src/IceSSL/SecureTransportTransceiverI.cpp b/cpp/src/IceSSL/SecureTransportTransceiverI.cpp index 3ff588cd9e2..211a4ca3fe8 100644 --- a/cpp/src/IceSSL/SecureTransportTransceiverI.cpp +++ b/cpp/src/IceSSL/SecureTransportTransceiverI.cpp @@ -258,7 +258,7 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B << "remote address = " << desc << "\n" << errorToString(err); throw ProtocolException(__FILE__, __LINE__, os.str()); } - _engine->verifyPeer(_stream->fd(), _host, getNativeConnectionInfo()); + _engine->verifyPeer(_stream->fd(), _host, NativeConnectionInfoPtr::dynamicCast(getInfo())); if(_instance->engine()->securityTraceLevel() >= 1) { @@ -485,7 +485,18 @@ IceSSL::TransceiverI::toDetailedString() const Ice::ConnectionInfoPtr IceSSL::TransceiverI::getInfo() const { - return getNativeConnectionInfo(); + NativeConnectionInfoPtr info = new NativeConnectionInfo(); + fillConnectionInfo(info, info->nativeCerts); + return info; +} + +Ice::ConnectionInfoPtr +IceSSL::TransceiverI::getWSInfo(const Ice::HeaderDict& headers) const +{ + WSSNativeConnectionInfoPtr info = new WSSNativeConnectionInfo(); + fillConnectionInfo(info, info->nativeCerts); + info->headers = headers; + return info; } void @@ -526,10 +537,9 @@ IceSSL::TransceiverI::~TransceiverI() { } -NativeConnectionInfoPtr -IceSSL::TransceiverI::getNativeConnectionInfo() const +void +IceSSL::TransceiverI::fillConnectionInfo(const ConnectionInfoPtr& info, std::vector<CertificatePtr>& nativeCerts) const { - NativeConnectionInfoPtr info = new NativeConnectionInfo(); IceInternal::fdToAddressAndPort(_stream->fd(), info->localAddress, info->localPort, info->remoteAddress, info->remotePort); if(_stream->fd() != INVALID_SOCKET) @@ -546,7 +556,7 @@ IceSSL::TransceiverI::getNativeConnectionInfo() const CFRetain(cert); CertificatePtr certificate = new Certificate(cert); - info->nativeCerts.push_back(certificate); + nativeCerts.push_back(certificate); info->certs.push_back(certificate->encode()); } @@ -562,7 +572,6 @@ IceSSL::TransceiverI::getNativeConnectionInfo() const info->adapterName = _adapterName; info->incoming = _incoming; - return info; } OSStatus diff --git a/cpp/src/IceSSL/SecureTransportTransceiverI.h b/cpp/src/IceSSL/SecureTransportTransceiverI.h index aaf232c4032..c81ee7aaef1 100644 --- a/cpp/src/IceSSL/SecureTransportTransceiverI.h +++ b/cpp/src/IceSSL/SecureTransportTransceiverI.h @@ -18,6 +18,7 @@ #include <Ice/Transceiver.h> #include <Ice/Network.h> #include <Ice/StreamSocket.h> +#include <Ice/WSTransceiver.h> #ifdef ICE_USE_SECURE_TRANSPORT @@ -30,7 +31,7 @@ namespace IceSSL class ConnectorI; class AcceptorI; -class TransceiverI : public IceInternal::Transceiver +class TransceiverI : public IceInternal::Transceiver, public IceInternal::WSTransceiverDelegate { public: @@ -46,6 +47,7 @@ public: virtual std::string toString() const; virtual std::string toDetailedString() const; virtual Ice::ConnectionInfoPtr getInfo() const; + virtual Ice::ConnectionInfoPtr getWSInfo(const Ice::HeaderDict&) const; virtual void checkSendSize(const IceInternal::Buffer&); virtual void setBufferSize(int rcvSize, int sndSize); @@ -57,7 +59,7 @@ private: TransceiverI(const InstancePtr&, const IceInternal::StreamSocketPtr&, const std::string&, bool); virtual ~TransceiverI(); - virtual NativeConnectionInfoPtr getNativeConnectionInfo() const; + void fillConnectionInfo(const ConnectionInfoPtr&, std::vector<CertificatePtr>&) const; friend class ConnectorI; friend class AcceptorI; diff --git a/cpp/test/Ice/info/AllTests.cpp b/cpp/test/Ice/info/AllTests.cpp index 80a3bd258de..f8094effbae 100644 --- a/cpp/test/Ice/info/AllTests.cpp +++ b/cpp/test/Ice/info/AllTests.cpp @@ -44,7 +44,7 @@ allTests(const Ice::CommunicatorPtr& communicator) test((ipEndpoint->type() == Ice::TCPEndpointType && Ice::TCPEndpointInfoPtr::dynamicCast(ipEndpoint)) || (ipEndpoint->type() == IceSSL::EndpointType && IceSSL::EndpointInfoPtr::dynamicCast(ipEndpoint)) || (ipEndpoint->type() == Ice::WSEndpointType && Ice::WSEndpointInfoPtr::dynamicCast(ipEndpoint)) || - (ipEndpoint->type() == Ice::WSSEndpointType && Ice::WSEndpointInfoPtr::dynamicCast(ipEndpoint))); + (ipEndpoint->type() == Ice::WSSEndpointType && IceSSL::WSSEndpointInfoPtr::dynamicCast(ipEndpoint))); Ice::UDPEndpointInfoPtr udpEndpoint = Ice::UDPEndpointInfoPtr::dynamicCast(endps[1]->getInfo()); test(udpEndpoint); @@ -184,13 +184,26 @@ allTests(const Ice::CommunicatorPtr& communicator) if(base->ice_getConnection()->type() == "ws" || base->ice_getConnection()->type() == "wss") { - Ice::WSConnectionInfoPtr wsinfo = Ice::WSConnectionInfoPtr::dynamicCast(info); - test(wsinfo); + Ice::HeaderDict headers; - test(wsinfo->headers["Upgrade"] == "websocket"); - test(wsinfo->headers["Connection"] == "Upgrade"); - test(wsinfo->headers["Sec-WebSocket-Protocol"] == "ice.zeroc.com"); - test(wsinfo->headers.find("Sec-WebSocket-Accept") != wsinfo->headers.end()); + Ice::WSConnectionInfoPtr wsinfo = Ice::WSConnectionInfoPtr::dynamicCast(info); + if(wsinfo) + { + headers = wsinfo->headers; + } + + IceSSL::WSSConnectionInfoPtr wssinfo = IceSSL::WSSConnectionInfoPtr::dynamicCast(info); + if(wssinfo) + { + headers = wssinfo->headers; + test(wssinfo->verified); + test(!wssinfo->certs.empty()); + } + + test(headers["Upgrade"] == "websocket"); + test(headers["Connection"] == "Upgrade"); + test(headers["Sec-WebSocket-Protocol"] == "ice.zeroc.com"); + test(headers.find("Sec-WebSocket-Accept") != headers.end()); test(ctx["ws.Upgrade"] == "websocket"); test(ctx["ws.Connection"] == "Upgrade"); diff --git a/cpp/test/Ice/info/TestI.cpp b/cpp/test/Ice/info/TestI.cpp index ba63bf96744..11588b29294 100644 --- a/cpp/test/Ice/info/TestI.cpp +++ b/cpp/test/Ice/info/TestI.cpp @@ -84,5 +84,14 @@ TestI::getConnectionInfoAsContext(const Ice::Current& c) } } + IceSSL::WSSConnectionInfoPtr wssinfo = IceSSL::WSSConnectionInfoPtr::dynamicCast(info); + if(wssinfo) + { + for(Ice::HeaderDict::const_iterator p = wssinfo->headers.begin(); p != wssinfo->headers.end(); ++p) + { + ctx["ws." + p->first] = p->second; + } + } + return ctx; } diff --git a/cpp/test/IceSSL/certs/makecerts.py b/cpp/test/IceSSL/certs/makecerts.py index 3c241767a1c..57bfdfcfeba 100755 --- a/cpp/test/IceSSL/certs/makecerts.py +++ b/cpp/test/IceSSL/certs/makecerts.py @@ -74,6 +74,12 @@ dsaca = IceCertUtils.OpenSSLCertificateFactory(home=ca1.home, keyalg="dsa", keys # if force or not os.path.exists("cacert1.pem"): ca1.getCA().save("cacert1.pem") if force or not os.path.exists("cacert2.pem"): ca2.getCA().save("cacert2.pem") +if force or not os.path.exists("cacert1.der"): ca1.getCA().save("cacert1.der") +if force or not os.path.exists("cacerts.pem"): + pem = "" + with open("cacert1.pem", "r") as f: pem += f.read() + with open("cacert2.pem", "r") as f: pem += f.read() + with open("cacerts.pem", "w") as f: f.write(pem); # Also export the ca2 self-signed certificate, it's used by the tests to test self-signed certificates if force or not os.path.exists("cacert2_pub.pem"): ca2.getCA().save("cacert2_pub.pem") diff --git a/cpp/test/IceSSL/configuration/AllTests.cpp b/cpp/test/IceSSL/configuration/AllTests.cpp index 448eb075a0f..4a51b3416f1 100644 --- a/cpp/test/IceSSL/configuration/AllTests.cpp +++ b/cpp/test/IceSSL/configuration/AllTests.cpp @@ -39,43 +39,113 @@ readFile(const string& file, vector<char>& buffer) } #ifdef ICE_USE_SCHANNEL -void -findCertsCleanup(HCERTSTORE store, const vector<HCERTSTORE>& stores, const vector<PCCERT_CONTEXT>& certs) +class ImportCerts { - for(vector<PCCERT_CONTEXT>::const_iterator i = certs.begin(); i != certs.end(); ++i) - { - PCCERT_CONTEXT cert = *i; - +public: - DWORD size = 0; + ImportCerts(const string& defaultDir, const char* certificates[]) + { // - // Retrieve the certificate CERT_KEY_PROV_INFO_PROP_ID property, we use the CRYPT_KEY_PROV_INFO - // data to then remove the key set associated with the certificate. + // First we need to import some certificates in the user store. // - if(CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0, &size)) + _store = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, 0, CERT_SYSTEM_STORE_CURRENT_USER, L"MY"); + test(_store); + + for(int i = 0; certificates[i] != 0; ++i) { - vector<char> buf(size); - if(CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, &buf[0], &size)) + vector<char> buffer; + readFile(defaultDir + certificates[i], buffer); + + CRYPT_DATA_BLOB p12Blob; + p12Blob.cbData = static_cast<DWORD>(buffer.size()); + p12Blob.pbData = reinterpret_cast<BYTE*>(&buffer[0]); + + HCERTSTORE p12 = PFXImportCertStore(&p12Blob, L"password", CRYPT_USER_KEYSET); + _stores.push_back(p12); + + PCCERT_CONTEXT next = 0; + PCCERT_CONTEXT newCert = 0; + do { - CRYPT_KEY_PROV_INFO* keyProvInfo = reinterpret_cast<CRYPT_KEY_PROV_INFO*>(&buf[0]); - HCRYPTPROV cryptProv = 0; - if(CryptAcquireContextW(&cryptProv, keyProvInfo->pwszContainerName, keyProvInfo->pwszProvName, - keyProvInfo->dwProvType, 0)) + if((next = CertFindCertificateInStore(p12, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, + CERT_FIND_ANY, 0, next))) { - CryptAcquireContextW(&cryptProv, keyProvInfo->pwszContainerName, keyProvInfo->pwszProvName, - keyProvInfo->dwProvType, CRYPT_DELETEKEYSET); + if(CertAddCertificateContextToStore(_store, next, CERT_STORE_ADD_ALWAYS, &newCert)) + { + _certs.push_back(newCert); + } + } + } + while(next); + } + } + + ~ImportCerts() + { + cleanup(); + } + + void cleanup() + { + for(vector<PCCERT_CONTEXT>::const_iterator i = _certs.begin(); i != _certs.end(); ++i) + { + PCCERT_CONTEXT cert = *i; + + // Retrieve the certificate CERT_KEY_PROV_INFO_PROP_ID property, we use the CRYPT_KEY_PROV_INFO + // data to then remove the key set associated with the certificate. + // + DWORD size = 0; + if(CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, 0, &size)) + { + vector<char> buf(size); + if(CertGetCertificateContextProperty(cert, CERT_KEY_PROV_INFO_PROP_ID, &buf[0], &size)) + { + CRYPT_KEY_PROV_INFO* keyProvInfo = reinterpret_cast<CRYPT_KEY_PROV_INFO*>(&buf[0]); + HCRYPTPROV cryptProv = 0; + if(CryptAcquireContextW(&cryptProv, keyProvInfo->pwszContainerName, keyProvInfo->pwszProvName, + keyProvInfo->dwProvType, 0)) + { + CryptAcquireContextW(&cryptProv, keyProvInfo->pwszContainerName, keyProvInfo->pwszProvName, + keyProvInfo->dwProvType, CRYPT_DELETEKEYSET); + } } } CertDeleteCertificateFromStore(cert); } + _certs.clear(); + for(vector<HCERTSTORE>::const_iterator i = _stores.begin(); i != _stores.end(); ++i) + { + CertCloseStore(*i, 0); + } + _stores.clear(); + if(_store) + { + CertCloseStore(_store, 0); + _store = 0; + } + } + +private: + + HCERTSTORE _store; + vector<HCERTSTORE> _stores; + vector<PCCERT_CONTEXT> _certs; +}; +#else +class ImportCerts +{ +public: + ImportCerts(const string& defaultDir, const char* certificates[]) + { + // Nothing to do. } - for(vector<HCERTSTORE>::const_iterator i = stores.begin(); i != stores.end(); ++i) + + void cleanup() { - CertCloseStore(*i, 0); } -} +}; #endif class PasswordPromptI : public IceSSL::PasswordPrompt @@ -240,7 +310,10 @@ createServerProps(const Ice::PropertiesPtr& defaultProps, const string& defaultD { Test::Properties result; result["Ice.Plugin.IceSSL"] = "IceSSL:createIceSSL"; - result["IceSSL.DefaultDir"] = defaultDir; + if(!defaultDir.empty()) + { + result["IceSSL.DefaultDir"] = defaultDir; + } if(!defaultProps->getProperty("Ice.IPv6").empty()) { result["Ice.IPv6"] = defaultProps->getProperty("Ice.IPv6"); @@ -273,28 +346,22 @@ createServerProps(const Ice::PropertiesPtr& defaultProps, const string& defaultD // If no CA is specified, we don't set IceSSL.DefaultDir since // with OpenSSL the CAs might still be found. // - string pfx; - if(ca.empty()) - { - d = createServerProps(defaultProps, "", defaultHost, p12); - pfx = defaultDir + "/"; - } - else + d = createServerProps(defaultProps, defaultDir, defaultHost, p12); + if(!ca.empty()) { - d = createServerProps(defaultProps, defaultDir, defaultHost, p12); - d["IceSSL.CertAuthFile"] = ca + ".pem"; + d["IceSSL.CAs"] = ca + ".pem"; } if(!cert.empty()) { if(p12) { - d["IceSSL.CertFile"] = pfx + cert + ".p12"; + d["IceSSL.CertFile"] = cert + ".p12"; } else { - d["IceSSL.CertFile"] = pfx + cert + "_pub.pem"; - d["IceSSL.KeyFile"] = pfx + cert + "_priv.pem"; + d["IceSSL.CertFile"] = cert + "_pub.pem"; + d["IceSSL.KeyFile"] = cert + "_priv.pem"; } } return d; @@ -306,32 +373,22 @@ createClientProps(const Ice::PropertiesPtr& defaultProps, const string& defaultD { Ice::PropertiesPtr properties; - // - // If no CA is specified, we don't set IceSSL.DefaultDir since - // with OpenSSL the CAs might still be found. - // - string pfx; - if(ca.empty()) + properties = createClientProps(defaultProps, defaultDir, defaultHost, p12); + if(!ca.empty()) { - properties = createClientProps(defaultProps, "", defaultHost, p12); - pfx = defaultDir + "/"; - } - else - { - properties = createClientProps(defaultProps, defaultDir, defaultHost, p12); - properties->setProperty("IceSSL.CertAuthFile", ca + ".pem"); + properties->setProperty("IceSSL.CAs", ca + ".pem"); } if(!cert.empty()) { if(p12) { - properties->setProperty("IceSSL.CertFile", pfx + cert + ".p12"); + properties->setProperty("IceSSL.CertFile", cert + ".p12"); } else { - properties->setProperty("IceSSL.CertFile", pfx + cert + "_pub.pem"); - properties->setProperty("IceSSL.KeyFile", pfx + cert + "_priv.pem"); + properties->setProperty("IceSSL.CertFile", cert + "_pub.pem"); + properties->setProperty("IceSSL.KeyFile", cert + "_priv.pem"); } } return properties; @@ -456,8 +513,9 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b server->noCert(); test(!IceSSL::ConnectionInfoPtr::dynamicCast(server->ice_getConnection()->getInfo())->verified); } - catch(const LocalException&) + catch(const LocalException& ex) { + cerr << ex << endl; test(false); } fact->destroyServer(server); @@ -821,6 +879,9 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b cout << "testing certificate chains... " << flush; { + const char* certificates[] = {"/s_rsa_cai2.p12", 0}; + ImportCerts import(defaultDir, certificates); + InitializationData initData; initData.properties = createClientProps(defaultProps, defaultDir, defaultHost, p12, "", ""); initData.properties->setProperty("IceSSL.VerifyPeer", "0"); @@ -843,9 +904,9 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b test(info->nativeCerts.size() == 1); test(!info->verified); } - catch(const Ice::LocalException& ex) + catch(const Ice::LocalException&) { - cerr << ex << endl; + import.cleanup(); test(false); } fact->destroyServer(server); @@ -870,6 +931,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b catch(const Ice::LocalException& ex) { cerr << ex << endl; + import.cleanup(); test(false); } fact->destroyServer(server); @@ -897,6 +959,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b catch(const Ice::LocalException& ex) { cerr << ex << endl; + import.cleanup(); test(false); } fact->destroyServer(server); @@ -926,6 +989,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b catch(const Ice::LocalException& ex) { cerr << ex << endl; + import.cleanup(); test(false); } fact->destroyServer(server); @@ -950,6 +1014,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b try { IceSSL::NativeConnectionInfoPtr::dynamicCast(server->ice_getConnection()->getInfo()); + import.cleanup(); test(false); } catch(const Ice::SecurityException&) @@ -959,6 +1024,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b catch(const Ice::LocalException& ex) { cerr << ex << endl; + import.cleanup(); test(false); } fact->destroyServer(server); @@ -988,6 +1054,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b } catch(const Ice::LocalException&) { + import.cleanup(); test(false); } fact->destroyServer(server); @@ -1000,6 +1067,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b try { IceSSL::NativeConnectionInfoPtr::dynamicCast(server->ice_getConnection()->getInfo()); + import.cleanup(); test(false); } catch(const Ice::SecurityException&) @@ -1033,6 +1101,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b } catch(const Ice::LocalException&) { + import.cleanup(); test(false); } fact->destroyServer(server); @@ -1058,6 +1127,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b try { server->ice_getConnection(); + import.cleanup(); test(false); } catch(const Ice::ProtocolException&) @@ -1070,6 +1140,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b } catch(const Ice::LocalException&) { + import.cleanup(); test(false); } fact->destroyServer(server); @@ -1086,12 +1157,14 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b } catch(const Ice::LocalException&) { + import.cleanup(); test(false); } fact->destroyServer(server); } comm->destroy(); + import.cleanup(); } cout << "ok" << endl; @@ -1538,17 +1611,17 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b cout << "testing CA certificate directory... " << flush; { // - // Don't specify CertAuthFile explicitly; we let OpenSSL find the CA + // Don't specify CAs explicitly; we let OpenSSL find the CA // certificate in the default directory. // InitializationData initData; initData.properties = createClientProps(defaultProps, defaultDir, defaultHost, p12, "c_rsa_ca1", ""); - initData.properties->setProperty("IceSSL.DefaultDir", defaultDir); + initData.properties->setProperty("IceSSL.CAs", defaultDir); CommunicatorPtr comm = initialize(initData); Test::ServerFactoryPrx fact = Test::ServerFactoryPrx::checkedCast(comm->stringToProxy(factoryRef)); test(fact); Test::Properties d = createServerProps(defaultProps, defaultDir, defaultHost, p12, "s_rsa_ca1", ""); - d["IceSSL.DefaultDir"] = defaultDir; + d["IceSSL.CAs"] = defaultDir; Test::ServerPrx server = fact->createServer(d); try { @@ -1565,6 +1638,56 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b cout << "ok" << endl; #endif + cout << "testing multiple CA certificates... " << flush; + { + InitializationData initData; + initData.properties = createClientProps(defaultProps, defaultDir, defaultHost, p12, "c_rsa_ca1", "cacerts"); + CommunicatorPtr comm = initialize(initData); + Test::ServerFactoryPrx fact = Test::ServerFactoryPrx::checkedCast(comm->stringToProxy(factoryRef)); + test(fact); + Test::Properties d = createServerProps(defaultProps, defaultDir, defaultHost, p12, "s_rsa_ca2", "cacerts"); + d["IceSSL.VerifyPeer"] = "2"; + Test::ServerPrx server = fact->createServer(d); + try + { + server->ice_ping(); + } + catch(const Ice::LocalException&) + { + test(false); + } + fact->destroyServer(server); + comm->destroy(); + } + cout << "ok" << endl; + +#ifndef ICE_USE_OPENSSL + cout << "testing DER CA certificate... " << flush; + { + InitializationData initData; + initData.properties = createClientProps(defaultProps, defaultDir, defaultHost, p12, "c_rsa_ca1", ""); + initData.properties->setProperty("IceSSL.CAs", "cacert1.der"); + CommunicatorPtr comm = initialize(initData); + Test::ServerFactoryPrx fact = Test::ServerFactoryPrx::checkedCast(comm->stringToProxy(factoryRef)); + test(fact); + Test::Properties d = createServerProps(defaultProps, defaultDir, defaultHost, p12, "s_rsa_ca1", ""); + d["IceSSL.VerifyPeer"] = "2"; + d["IceSSL.CAs"] = "cacert1.der"; + Test::ServerPrx server = fact->createServer(d); + try + { + server->ice_ping(); + } + catch(const Ice::LocalException&) + { + test(false); + } + fact->destroyServer(server); + comm->destroy(); + } + cout << "ok" << endl; +#endif + // // SChannel doesn't support PEM Password protected certificates certificates // @@ -2806,7 +2929,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b { #if defined(ICE_USE_SCHANNEL) - cerr << "testing IceSSL.FindCert... " << flush; + cout << "testing IceSSL.FindCert... " << flush; const char* clientFindCertProperties[] = { "SUBJECTDN:'CN=Client, OU=Ice, O=\"ZeroC, Inc.\", L=Jupiter, S=Florida, C=US, E=info@zeroc.com'", @@ -2842,50 +2965,13 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b }; const char* certificates[] = {"/s_rsa_ca1.p12", "/c_rsa_ca1.p12", 0}; - - // - // First we need to import some certificates in the user store. - // - HCERTSTORE store = CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, 0, CERT_SYSTEM_STORE_CURRENT_USER, L"MY"); - test(store); - - vector<HCERTSTORE> stores; - vector<PCCERT_CONTEXT> certs; - - for(int i = 0; certificates[i] != 0; ++i) - { - vector<char> buffer; - readFile(defaultDir + certificates[i], buffer); - - CRYPT_DATA_BLOB p12Blob; - p12Blob.cbData = static_cast<DWORD>(buffer.size()); - p12Blob.pbData = reinterpret_cast<BYTE*>(&buffer[0]); - - HCERTSTORE p12 = PFXImportCertStore(&p12Blob, L"password", CRYPT_USER_KEYSET); - - PCCERT_CONTEXT next = 0; - PCCERT_CONTEXT newCert = 0; - do - { - if((next = CertFindCertificateInStore(p12, X509_ASN_ENCODING | PKCS_7_ASN_ENCODING, 0, - CERT_FIND_ANY, 0, next))) - { - if(CertAddCertificateContextToStore(store, next, CERT_STORE_ADD_ALWAYS, &newCert)) - { - certs.push_back(newCert); - } - } - } - while(next); - - stores.push_back(p12); - } + ImportCerts import(defaultDir, certificates); for(int i = 0; clientFindCertProperties[i] != 0; i++) { InitializationData initData; initData.properties = createClientProps(defaultProps, defaultDir, defaultHost, p12); - initData.properties->setProperty("IceSSL.CertAuthFile", "cacert1.pem"); + initData.properties->setProperty("IceSSL.CAs", "cacert1.pem"); initData.properties->setProperty("IceSSL.FindCert.CurrentUser.My", clientFindCertProperties[i]); // // Use TrustOnly to ensure the peer has pick the expected certificate. @@ -2897,7 +2983,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b Test::ServerFactoryPrx fact = Test::ServerFactoryPrx::checkedCast(comm->stringToProxy(factoryRef)); test(fact); Test::Properties d = createServerProps(defaultProps, defaultDir, defaultHost, p12, "s_rsa_ca1", "cacert1"); - d["IceSSL.CertAuthFile"] = "cacert1.pem"; + d["IceSSL.CAs"] = "cacert1.pem"; d["IceSSL.FindCert.CurrentUser.My"] = serverFindCertProperties[i]; // // Use TrustOnly to ensure the peer has pick the expected certificate. @@ -2912,7 +2998,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b catch(const LocalException& ex) { cerr << ex << endl; - findCertsCleanup(store, stores, certs); + import.cleanup(); test(false); } fact->destroyServer(server); @@ -2926,12 +3012,12 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b { InitializationData initData; initData.properties = createClientProps(defaultProps, defaultDir, defaultHost, p12); - initData.properties->setProperty("IceSSL.CertAuthFile", "cacert1.pem"); + initData.properties->setProperty("IceSSL.CAs", "cacert1.pem"); initData.properties->setProperty("IceSSL.FindCert.CurrentUser.My", failFindCertProperties[i]); try { CommunicatorPtr comm = initialize(initData); - findCertsCleanup(store, stores, certs); + import.cleanup(); test(false); } catch(const PluginInitializationException&) @@ -2941,12 +3027,12 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b catch(const Ice::LocalException& ex) { cerr << ex << endl; - findCertsCleanup(store, stores, certs); + import.cleanup(); test(false); } } - findCertsCleanup(store, stores, certs); + import.cleanup(); // // These must fail because we have already remove the certificates. @@ -2955,7 +3041,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b { InitializationData initData; initData.properties = createClientProps(defaultProps, defaultDir, defaultHost, p12); - initData.properties->setProperty("IceSSL.CertAuthFile", "cacert1.pem"); + initData.properties->setProperty("IceSSL.CAs", "cacert1.pem"); initData.properties->setProperty("IceSSL.FindCert.CurrentUser.My", clientFindCertProperties[i]); try { @@ -2972,9 +3058,9 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b test(false); } } - cerr << "ok" << endl; + cout << "ok" << endl; #elif defined(ICE_USE_SECURE_TRANSPORT) - cerr << "testing IceSSL.FindCert... " << flush; + cout << "testing IceSSL.FindCert... " << flush; const char* clientFindCertProperties[] = { "SUBJECT:Client", @@ -3012,7 +3098,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b { InitializationData initData; initData.properties = createClientProps(defaultProps, defaultDir, defaultHost, p12); - initData.properties->setProperty("IceSSL.CertAuthFile", "cacert1.pem"); + initData.properties->setProperty("IceSSL.CAs", "cacert1.pem"); initData.properties->setProperty("IceSSL.Keychain", "../certs/Find.keychain"); initData.properties->setProperty("IceSSL.KeychainPassword", "password"); initData.properties->setProperty("IceSSL.FindCert", clientFindCertProperties[i]); @@ -3026,7 +3112,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b Test::ServerFactoryPrx fact = Test::ServerFactoryPrx::checkedCast(comm->stringToProxy(factoryRef)); test(fact); Test::Properties d = createServerProps(defaultProps, defaultDir, defaultHost, p12); - d["IceSSL.CertAuthFile"] = "cacert1.pem"; + d["IceSSL.CAs"] = "cacert1.pem"; d["IceSSL.Keychain"] = "../certs/Find.keychain"; d["IceSSL.KeychainPassword"] = "password"; d["IceSSL.FindCert"] = serverFindCertProperties[i]; @@ -3071,10 +3157,55 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool p12, b test(false); } } - cerr << "ok" << endl; + cout << "ok" << endl; #endif } + cout << "testing system CAs... " << flush; + { + InitializationData initData; + initData.properties = createClientProps(defaultProps, "", defaultHost, false); + initData.properties->setProperty("IceSSL.VerifyDepthMax", "4"); + initData.properties->setProperty("Ice.Override.Timeout", "5000"); // 5s timeout + CommunicatorPtr comm = initialize(initData); + Ice::ObjectPrx p = comm->stringToProxy("dummy:wss -h demo.zeroc.com -p 5064"); + try + { + p->ice_ping(); + test(false); + } + catch(const Ice::SecurityException&) + { + // Expected, by default we don't check for system CAs. + } + catch(const Ice::LocalException& ex) + { + cerr << "warning: unable to connect to demo.zeroc.com to check system CA:\n" << ex << endl; + } + comm->destroy(); + + initData.properties = createClientProps(defaultProps, "", defaultHost, false); + initData.properties->setProperty("IceSSL.VerifyDepthMax", "4"); + initData.properties->setProperty("Ice.Override.Timeout", "5000"); // 5s timeout + initData.properties->setProperty("IceSSL.UsePlatformCAs", "1"); + comm = initialize(initData); + p = comm->stringToProxy("dummy:wss -h demo.zeroc.com -p 5064"); + + IceSSL::WSSConnectionInfoPtr info; + try + { + info = IceSSL::WSSConnectionInfoPtr::dynamicCast(p->ice_getConnection()->getInfo()); + test(info->verified); + } + catch(const Ice::LocalException& ex) + { + cerr << ex << endl; + test(false); + } + comm->destroy(); + } + cout << "ok" << endl; + if(shutdown) { factory->shutdown(); diff --git a/cpp/test/IceSSL/configuration/run.py b/cpp/test/IceSSL/configuration/run.py index 58c6b79a9e6..e877d3bf802 100755 --- a/cpp/test/IceSSL/configuration/run.py +++ b/cpp/test/IceSSL/configuration/run.py @@ -8,7 +8,7 @@ # # ********************************************************************** -import os, sys, atexit +import os, sys, atexit, re path = [ ".", "..", "../..", "../../..", "../../../.." ] head = os.path.dirname(sys.argv[0]) @@ -20,6 +20,10 @@ if len(path) == 0: sys.path.append(os.path.join(path[0], "scripts")) import TestUtil +# Filter-out the deprecated property warnings +TestUtil.clientTraceFilters = [ lambda x: re.sub("-! .* warning: deprecated property: IceSSL.KeyFile\n", "", x) ] +TestUtil.serverTraceFilters = [ lambda x: re.sub("-! .* warning: deprecated property: IceSSL.KeyFile\n", "", x) ] + certsPath = os.path.abspath(os.path.join(os.getcwd(), "..", "certs")) keychainPath = os.path.abspath(os.path.join(certsPath, "Find.keychain")) |