summaryrefslogtreecommitdiff
path: root/cpp
diff options
context:
space:
mode:
Diffstat (limited to 'cpp')
-rw-r--r--cpp/src/IceSSL/SecureTransportEngine.cpp7
-rw-r--r--cpp/src/IceSSL/SecureTransportTransceiverI.cpp7
-rw-r--r--cpp/test/IceSSL/configuration/AllTests.cpp43
-rw-r--r--cpp/test/IceSSL/configuration/TestI.cpp4
-rw-r--r--cpp/test/IceSSL/configuration/Util.h53
-rwxr-xr-xcpp/test/IceSSL/configuration/run.py19
6 files changed, 44 insertions, 89 deletions
diff --git a/cpp/src/IceSSL/SecureTransportEngine.cpp b/cpp/src/IceSSL/SecureTransportEngine.cpp
index 7a4d16d7c5e..743347feb67 100644
--- a/cpp/src/IceSSL/SecureTransportEngine.cpp
+++ b/cpp/src/IceSSL/SecureTransportEngine.cpp
@@ -1499,5 +1499,12 @@ IceSSL::SecureTransportEngine::parseCiphers(const string& ciphers)
}
}
_ciphers = enabled;
+
+ if(_ciphers.empty())
+ {
+ throw PluginInitializationException(__FILE__, __LINE__,
+ "IceSSL: invalid value for IceSSL.Ciphers:\n" + ciphers +
+ "\nThe result cipher list does not contain any entries");
+ }
}
#endif
diff --git a/cpp/src/IceSSL/SecureTransportTransceiverI.cpp b/cpp/src/IceSSL/SecureTransportTransceiverI.cpp
index 38f9e4cc70a..a8f491db570 100644
--- a/cpp/src/IceSSL/SecureTransportTransceiverI.cpp
+++ b/cpp/src/IceSSL/SecureTransportTransceiverI.cpp
@@ -224,6 +224,13 @@ IceSSL::TransceiverI::initialize(IceInternal::Buffer& readBuffer, IceInternal::B
{
assert(!_trust);
err = SSLCopyPeerTrust(_ssl, &_trust);
+ if(_incoming && err == errSSLBadCert && _engine->getVerifyPeer() == 1)
+ {
+ // This happens in 10.10 when the client doesn't provide
+ // a certificate and the server is configured to try
+ // authenticate
+ continue;
+ }
if(err == noErr)
{
checkTrustResult(_trust, _engine, _instance);
diff --git a/cpp/test/IceSSL/configuration/AllTests.cpp b/cpp/test/IceSSL/configuration/AllTests.cpp
index a62699b1c3d..2a6f922d385 100644
--- a/cpp/test/IceSSL/configuration/AllTests.cpp
+++ b/cpp/test/IceSSL/configuration/AllTests.cpp
@@ -202,8 +202,10 @@ private:
};
typedef IceUtil::Handle<CertificateVerifierI> CertificateVerifierIPtr;
+int keychainN = 0;
+
static PropertiesPtr
-createClientProps(const Ice::PropertiesPtr& defaultProperties, const string& defaultDir,
+createClientProps(const Ice::PropertiesPtr& defaultProperties, const string& defaultDir,
const string& defaultHost, bool password)
{
PropertiesPtr result = createProperties();
@@ -223,10 +225,10 @@ createClientProps(const Ice::PropertiesPtr& defaultProperties, const string& def
}
//result->setProperty("IceSSL.Trace.Security", "1");
#ifdef ICE_USE_SECURE_TRANSPORT
- const string keychainName = "client.keychain";
+ ostringstream keychainName;
+ keychainName << "../certs/keychain/client" << keychainN++ << ".keychain";
const string keychainPassword = "password";
- removeKeychain(keychainName, keychainPassword);
- result->setProperty("IceSSL.Keychain", keychainName);
+ result->setProperty("IceSSL.Keychain", keychainName.str());
result->setProperty("IceSSL.KeychainPassword", keychainPassword);
#endif
return result;
@@ -253,7 +255,9 @@ createServerProps(const Ice::PropertiesPtr& defaultProperties, const string& def
}
//result["IceSSL.Trace.Security"] = "1";
#ifdef ICE_USE_SECURE_TRANSPORT
- result["IceSSL.Keychain"] = "server.keychain";
+ ostringstream keychainName;
+ keychainName << "../certs/keychain//server" << keychainN << ".keychain";
+ result["IceSSL.Keychain"] = keychainName.str();
result["IceSSL.KeychainPassword"] = "password";
#endif
return result;
@@ -1572,7 +1576,14 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool pfx, b
}
catch(const LocalException&)
{
+//
+// OS X 10.10 bug the handshake fails attempting client auth
+// with anon cipher.
+//
+# ifndef ICE_USE_SECURE_TRANSPORT
+ cerr << ex << endl;
test(false);
+# endif
}
fact->destroyServer(server);
comm->destroy();
@@ -1588,7 +1599,7 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool pfx, b
# ifdef ICE_USE_OPENSSL
initData.properties->setProperty("IceSSL.Ciphers", "ALL:!ADH");
# else
- initData.properties->setProperty("IceSSL.Ciphers", "!(DH_anon*)");
+ initData.properties->setProperty("IceSSL.Ciphers", "ALL !(DH_anon*)");
# endif
CommunicatorPtr comm = initialize(initData);
Test::ServerFactoryPrx fact = Test::ServerFactoryPrx::checkedCast(comm->stringToProxy(factoryRef));
@@ -1631,30 +1642,20 @@ allTests(const CommunicatorPtr& communicator, const string& testDir, bool pfx, b
initData.properties->setProperty("IceSSL.CertFile", "c_rsa_nopass_ca1_pub.pem");
initData.properties->setProperty("IceSSL.KeyFile", "c_rsa_nopass_ca1_priv.pem");
initData.properties->setProperty("IceSSL.Ciphers", "NONE");
- CommunicatorPtr comm = initialize(initData);
-
- Test::ServerFactoryPrx fact = Test::ServerFactoryPrx::checkedCast(comm->stringToProxy(factoryRef));
- test(fact);
- Test::Properties d = createServerProps(defaultProperties, defaultDir, defaultHost, pfx);
- d["IceSSL.CertAuthFile"] = "cacert1.pem";
- d["IceSSL.CertFile"] = "s_rsa_nopass_ca1_pub.pem";
- d["IceSSL.KeyFile"] = "s_rsa_nopass_ca1_priv.pem";
- d["IceSSL.Ciphers"] = "ALL";
- Test::ServerPrx server = fact->createServer(d);
try
{
- server->ice_ping();
+ CommunicatorPtr comm = initialize(initData);
test(false);
}
- catch(const ConnectionLostException&)
+ catch(const Ice::PluginInitializationException&)
{
+ //Expected when disabled all cipher suites.
}
- catch(const LocalException&)
+ catch(const Ice::LocalException& ex)
{
+ cerr << ex << endl;
test(false);
}
- fact->destroyServer(server);
- comm->destroy();
}
{
//
diff --git a/cpp/test/IceSSL/configuration/TestI.cpp b/cpp/test/IceSSL/configuration/TestI.cpp
index e4f192bf3ae..6d3a7a14ff0 100644
--- a/cpp/test/IceSSL/configuration/TestI.cpp
+++ b/cpp/test/IceSSL/configuration/TestI.cpp
@@ -12,7 +12,6 @@
#include <TestI.h>
#include <TestCommon.h>
#include <IceSSL/Plugin.h>
-#include <Util.h>
using namespace std;
using namespace Ice;
@@ -72,9 +71,6 @@ ServerI::destroy()
{
string defaultDir = _communicator->getProperties()->getProperty("IceSSL.DefaultDir");
_communicator->destroy();
-#ifdef ICE_USE_SECURE_TRANSPORT
- removeKeychain("server.keychain", "password");
-#endif
}
Test::ServerPrx
diff --git a/cpp/test/IceSSL/configuration/Util.h b/cpp/test/IceSSL/configuration/Util.h
deleted file mode 100644
index e34fa3c4e86..00000000000
--- a/cpp/test/IceSSL/configuration/Util.h
+++ /dev/null
@@ -1,53 +0,0 @@
-
-#include <IceSSL/IceSSL.h>
-
-#ifdef ICE_USE_SECURE_TRANSPORT
-
-#include <Security/Security.h>
-
-namespace Test
-{
-
-int
-getcwd(std::string& cwd)
-{
- char cwdbuf[PATH_MAX];
- if(::getcwd(cwdbuf, PATH_MAX) == NULL)
- {
- return -1;
- }
- cwd = cwdbuf;
- return 0;
-}
-
-}
-
-void
-removeKeychain(const std::string& keychainPath, const std::string& password)
-{
- //
- // KeyChain path is relative to the current working directory.
- //
- std::string path = keychainPath;
- if(path.find("/") != 0)
- {
- std::string cwd;
- if(Test::getcwd(cwd) == 0)
- {
- path = std::string(cwd) + '/' + path;
- }
- }
-
- SecKeychainRef keychain;
- OSStatus err = SecKeychainOpen(path.c_str(), &keychain);
- if(err == noErr)
- {
- err = SecKeychainUnlock(keychain, password.size(), password.c_str(), true);
- if(err == noErr)
- {
- err = SecKeychainDelete(keychain);
- }
- CFRelease(keychain);
- }
-}
-#endif \ No newline at end of file
diff --git a/cpp/test/IceSSL/configuration/run.py b/cpp/test/IceSSL/configuration/run.py
index 44891d3bbe6..61da2e86b04 100755
--- a/cpp/test/IceSSL/configuration/run.py
+++ b/cpp/test/IceSSL/configuration/run.py
@@ -8,7 +8,7 @@
#
# **********************************************************************
-import os, sys
+import os, sys, atexit
path = [ ".", "..", "../..", "../../..", "../../../.." ]
head = os.path.dirname(sys.argv[0])
@@ -23,20 +23,17 @@ import TestUtil
certsPath = os.path.abspath(os.path.join(os.getcwd(), "..", "certs"))
keychainPath = os.path.abspath(os.path.join(certsPath, "Find.keychain"))
+
+def keychainCleanup():
+ os.system("rm -rf %s ../certs/keychain" % keychainPath)
+
+atexit.register(keychainCleanup)
if TestUtil.isDarwin():
- try:
- os.remove(keychainPath)
- except OSError:
- pass
+ keychainCleanup()
+ os.system("mkdir -p ../certs/keychain")
os.system("security create-keychain -p password %s" % keychainPath)
for cert in ["s_rsa_ca1.pfx", "c_rsa_ca1.pfx"]:
os.system("security import %s -f pkcs12 -A -P password -k %s" % (os.path.join(certsPath, cert), keychainPath))
TestUtil.clientServerTest(additionalClientOptions = '"%s"' % os.getcwd())
-
-if TestUtil.isDarwin():
- try:
- os.remove(keychainPath)
- except OSError:
- pass
generated by cgit v1.2.3 (git 2.46.0) at 2025-08-03 19:38:46 +0000