Angus Robertson

ICS v9.0 has been tested on Delphi 7, and future versions may still work on Delphi 7 but will not be tested or supported, I can not justify my unpaid time to support 20 year old tools that lack language features in Delphi 2007. From the ICS readme file about client samples: OverbyteIcsXferTst - File copying, FTP upload and download, HTTP download, using TIcsFileCopy, TIcsFtpMulti and TIcsHttpMulti This sample downloads multiple HTTP files with progress display and logging, I wrote it almost 20 years ago. There is also a very simple example in the new OverbyteIcsSnippets sample, function doHttpDownListClick that downloads three files with progress information, only 50 lines of code with a single function call HttpMultiClient.Download. Angus

Assuming you don't want to upload a file, you should change the code you showed to remove TMultiPartFileReader, just build a single MIME block from your header and footer, change capture.jpg to your full file name in s. and use the string as raw parameters in the REST call, which will automatically create the SendStream for the request. RestRequest(httpPost, URL, False, MyMimeHeaders); Angus

Can any other ICS C++ users reproduce this Win64 issue? If no-one is willing to help us support C++, I'll have to remove C++ support from ICS. Angus

The TMultiPartFileReader class you have used opens and converts file content to MIME base64, for a file upload. Earlier, you said you didn't want to upload the file. But I'm still waiting for you to show an actual example of the data you are trying to POST. Angus

We are providing component libraries for others to built SSL capable applications, and avoiding DLLs does come up regularly, it should be an option that other developers can use or ignore. The best solution is YuOpenSSL which is OpenSSL compiled into a DCU so no DLLs. It does increase application size, probably the same as using resources, but generally applications using OpenSSL distribute their favourite version of the DLLs in their application directory, so you end up with numerous similar DLLs all over the place. But YuOpenSSL is a lot of effort to maintain and is therefore a commercial product not everyone wants to buy. In theory, the OpenSSL resources only need to be written to files once, but making sure those files are the latest or oldest versions may be challenging. Angus

Thanks, effectively this site seems to be requiring the same parameters as a web browser submit form, rather than the more normal content used by REST APIs. The ICS TRestParam class can already generate seven different content types, Json, UrlEnc, XML, CSV etc, so I need to add FormData as an eighth content type, I'll look at it next week. Effectively this will be a more generalised version of the file uploading code I already recommended, but without actually uploading a file which it seems was a red herring. Angus

I don't know anything about Postman. If you are not sending a binary file, there is no point in using MIME. It's just a simple REST request. I need to see what HTTP data Postman creates, not what the GUI says, to make any sensible suggestions. Angus

The TSslHttpRest file upload feature is designed to replicate a web browser uploading a file from a web page using a Submit command. You can see how the MIME content is built in the TSslHttpRest.RestRequest function at line 2910 in OverbyteIcsSslHttpRest.pas, you'll need to build a similar post stream before calling the component with your own Json requirements. However, your description of needing a 'full local path to the image' seems strange, unless your REST request is to a server on the same PC, normally you'd expect to send JPG image data or something, not a file name, Angus

Uploading files is built into the TSslHttpRest component. The main OverbyteIcsHttpRestTst sample has a menu option Upload File, select MIME Multipart, specify the Upload File Name, POST or PUT, and any REST parameters needed, it just works. The OverbyteIcsSnippets sample has a much simpler demo where you click a single button 'HTTP POST Upload File' which runs a single function to upload a file to one of my servers. Angus

The latest ICS offers OAuth2 with embedded Edge or MSIE browsers or external browser and a private web server. Pre-built samples at https://wiki.overbyte.eu/arch/icsdemos-clients.zip Angus

Look-up base64 conversion in the help, then break the lines to 64 long and add the --- header and footer you see in a PEM certificate file. Angus

OpenSSL has released new versions of the three active branches. These releases fix a low severity issue with the Win64 POLY1305 MAC implementation corrupting XMM registers ([CVE-2023-4807]) which applies only to processors released in the last two or three years supporting AVX512-IFMA instructions. Windows binaries are available in SVN and the overnight zip file (tomorrow) and separately from https://wiki.overbyte.eu/wiki/index.php/ICS_Download or https://www.magsys.co.uk/delphi/magics.asp Separately, YuOpenSSL has released 3.0.11 and 1.1.1w as commercial DCUs allowing applications to be used with OpenSSL without needing separate DLLs. Note that 1.1.1w is the last release of that version, it is now out of support unless you have an OpenSSL Premium Level Support contract for $50,000/year. Angus

ICS will now build again with the OpenSSL DLLs. Angus

Sorry about that, new function added this week, tested with YuOpenSSL, but obviously need to update the DLL imports as well, will be done today. Just use the old wsocket unit until it's done. Angus

A PEM certificate is base64 encoded lines of the binary DER, with a header and trailer added, although ICS often adds comments to the files for identification purposes. So could just strip off the headers, remove line endings and do a comparison of the base64 text. Is your server also ICS? So it could be updated for Raw Public Key TLS support? Angus

There are several global variables used to determine how OpenSSL is loaded, this chunk of code is from the OverbyteIcsHttpRestTst1 unit, but most ICS samples have something similar. // Avoid dynamical loading and unloading the SSL DLLs plenty of times // GSSLEAY_DLL_IgnoreNew := True; { ignore OpenSSL 3.0 and later } // GSSLEAY_DLL_IgnoreOld := True; { ignore OpenSSL 1.1 } // note both not allowed true GSSL_DLL_DIR := FProgDir; { only from our directory } GSSL_SignTest_Check := True; { check digitally signed } GSSL_SignTest_Certificate := True; { check digital certificate } OverbyteIcsWSocket.LoadSsl; if NOT GSSLStaticLinked then begin if NOT FileExists (GLIBEAY_DLL_FileName) then LogWin.Lines.Add('SSL/TLS DLL not found: ' + GLIBEAY_DLL_FileName) else LogWin.Lines.Add('SSL/TLS DLL: ' + GLIBEAY_DLL_FileName + ', Version: ' + OpenSslVersion); end else LogWin.Lines.Add('SSL/TLS Static Linked, Version: ' + OpenSslVersion); This version ensures the DLLs are only loaded from our own directory using GSSL_DLL_DIR, since Windows may have dozens of different versions of the DLLs scattered around the drive from different applications. The code loads OpenSSL once and tells you what version it found and where, and whether YuOpenmSSL is being used which avoids all DLL problems. Might have to revisit the IgnoreNew/Old stuff since 1.1 is now out of support. Angus

This fix is now in SVN and the overnight zip, property X509PubKeyTB in TX509Base will get the certificate public in DER binary format as TBytes, from where it may be converted to hex or base64, and used for Raw Public Key certificate validation. At least assuming the raw key distributed is the DER format. It seems comparing a SHA256 digest is common, rather than a long string. Angus

This improvement is now in SVN and the overnight zip, there is a new TOAOption of OAopAuthBasic that causes Basic Authentication to be used instead of sending the client ID and secret as parameters, Microsoft accepts both methods. Angus

I explained how in the third line: nStatCode := RestRequest(httpPOST, 'https://xx', False, astrJSON.Text); You can also look at the new OverbyteIcsSnippets sample in ICS v9 which has working examples of many ICS functions, just click a button and watch it happen, although you are almost there already. But do use the debugs options, you'd then have seen the modified Json being sent, and the problem should have been glaringly obvious. Angus

Are you intending to nest Json here, using a parameter like this will create a new Json item named raw with your Json as the value. Except when adding raw parameters like Json, you need a third parameter True so that the item is not escape encoded. If your Json is complete, you can ignore RestParams and just add it as RawParameters which is the last argument in RestRequest. The component has built in logging, set DebugLevel to DebugBody, assign the onHttpRestProg event, and write everything that arrives to your memo, Angus

Sorry, single line Windows errors in isolation are no-use. I asked you to reproduce the error in the new IcsSslMultiWebServ sample and send me the log it generates. Note that both KeepAliveTimeSec and KeepAliveTimeXferSec close the remote client connection, the latter after five minutes by default. If you want to keep an idle remote client open for more than five minutes, you have to set both to zero. Neither will stop the server. Angus

ICS v9 has a lot of low level stability changes, many for Win64 applications, in particular errors during close and within finally statements, where inherited functions were sometimes skipped. I only built my own public servers as Win64 about a year ago, which means that is when Win64 got a lot of extra live testing. And I'm still uncertain about the OpenSSL DLLs in some very rare circumstances with Win64. Angus

It seems the industry has come up with RFC7250 Raw Public Key to allow authentication of TLS connections without using X509 certificates and trusted certificate chains, which seems aimed at your type of LAN application. You are really doing the same thing, but still sending a self signed certificate you ignore. RPK uses TLS extensions, which are supported by the next OpenSSL release 3.2 currently in alpha testing. I'll look at supporting RPK when it arrives. Meanwhile, I'll add a TX509Base method to get a public key this week. Angus

KeepAliveTimeSec only effects remote clients not the server itself. Are you saying a remote client connection was closed after five minutes, or the web server itself stopped after that time? There is no server timeout or close down. Please private email me the complete log file from the ICS sample showing this activity, not just little extracts. Angus

Stopping and disabling the Windows Update service worked in the past, but Microsoft may have other apps that monitor it being stopped. Angus