Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merge IceSSL into the Ice core #1575

Closed
bernardnormier opened this issue Dec 2, 2023 · 1 comment
Closed

Merge IceSSL into the Ice core #1575

bernardnormier opened this issue Dec 2, 2023 · 1 comment
Assignees
Milestone

Comments

@bernardnormier
Copy link
Member

Having IceSSL as a plugin introduces complexity and makes configuration difficult.

I propose to:

a) Merge IceSSL into the Ice core

This way, the IceSSL layer becomes built-in and always available.

We would nevertheless keep the existing IceSSL configuration for backwards compatibility.
See https://doc.zeroc.com/ice/3.7/property-reference/icessl

b) Give full access to the underlying SSL/TLS library in InitializationData

See https://doc.zeroc.com/ice/3.7/communicator-and-other-core-local-features/communicator-initialization#id-.CommunicatorInitializationv3.7-InitializationData

The updated InitializationData must provide functions / entry points that allows the application to configure SSL/TLS for :

  • the client-side (the outgoing connections created by the communicator), and
  • the server-side, on a per-OA basis, keyed by the OA name

These functions must in particular be sufficient to update/reload the certificates, assuming the underlying SSL/TLS library provides this feature (which is likely). See #334.

c) Drop most of (or all) the public API of IceSSL

See https://doc.zeroc.com/ice/3.7/ice-plugins/icessl/programming-icessl

The only way to "program" IceSSL is through the native API exposed via InitializationData.

d) Drop the OpenSSL support on Windows.

We could build the Ice core on Windows for both OpenSSL and SChannel, but it's obviously more work and we don't really need this additional SSL option.

@pepone
Copy link
Member

pepone commented Jun 27, 2024

Fixed in several PRs

#2119
#2063

@pepone pepone closed this as completed Jun 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants