Angus Robertson

The main problem with the PUT handler in the application server was a complete lack of content upload handling, it was just ignored, now fixed, will be in SVN today. Angus

Look at where that code came from in the X509Certs unit, it loops through a few different public DNS servers until one gives the expected result. Angus

Beware DNS caches are not very clever with new TXT records, I found it may take a couple of requests before a newly added TXT records was found, should not matter for email since that rarely changes. Angus

DNS TXT records are undefined, the content varies according to the application. The ICS unit for ordering wildcard SSL certificates simply checks the entire TXT record against the value given: FDnsQuery.QueryAnySync(Item.CPage, DnsQueryTXT) ; if FDnsQuery.TXTRecordCount > 0 then begin for I := 0 to FDnsQuery.TXTRecordCount - 1 do begin if (FDnsQuery.TXTRecord = Item.CDNSValue) then begin LogEvent('Successfully tested DNS challenge for: ' + Item.CPage + ', Data=' + Item.CDNSValue); Result := True; Exit; end; end; For email SPF records, you might search the record for v=spf1 and look at the rest afterwards. Angus

I will test PUT finally works this week, but not for a couple of days. Angus

TDnsQuery in V9.0 added TXTRecordCount and TXTRecord[n] methods, since there are often multiple TXT records. Also sync mode to make it easier to use. Look at the latest OverbyteIcsNsLookup sample. Angus

Thanks, that will explain why a PUT test upload failed recently, it was still on my list to test, fix will be in SVN this week. Angus

The second option to avoid distributing OpenSSL DLLs was added last week, embedding the DLLs in the application and extracting them when the application is first run to a common directory, this was discussed in the last OpenSSL update message. Other related changes will happen this week. I always saw the major downside of SChannel that Microsoft is slow to add new features, and they are only added to new Windows versions, even TLS/1.2 took several years to be added to Windows 8/Server 2012 and did not support EC certificates properly. So exactly the same update policy as OpenSSL, except you have to upgrade the entire OS instead of a couple of DLLs. Angus

The fix was in SVN weeks ago. If you work with ICS from SVN, you need to keep it up to date and accept things may get broken, and you may need to wait a few days for bug fixes, I try to make sure SVN always has a buildable version, but it does not always work, currently SVN is waiting for two Posix fixes from the last update, but I've changed dozens of units since then which need a lot of testing. Angus

That would be a massive amount of work, OpenSSL functions are buried in a lot of ICS functions at low level. I looked at your SChannel implementation for ICS when you initially wrote it. At the time the USP was no DLLs, but there are now two separate solutions that avoid distributing separate OpenSSL DLLs, so what do you now see as the benefit of SChannel? Angus

The output folders should be created when the DCU are built. If not the batch lines you copied earlier create both folders. It is not necessary to distribute lots of empty folders, except for ancient versions that did not create them. Angus

Looking at the D2010 package, there is typo, you need to correct the post-build command to change a win64 to win32, since D2010 does not have Win64 so the directory will not exist, Sorry, these package changes are done manually, and I have to edit hundreds of files by hand. Angus

Don't worry about the compile errors with Android, I've just installed Android support for Delphi 12 and get a load of errors when building ICS 9.1 for Android (and a couple of Linux) which I will fix or suppress in the near future. For ICS V10, just comment out the offending functions like IcsIsValidAnsiCodePage which uses ICON and IcsGetFreeDiskSpace, which are fine for Posix not seemingly not Android, doubt any of this stuff is needed to get basic sockets working on Android. And avoid changes like using generics that are unnecessary to make ICS work on Android. Angus

Those build command in the package copy DFM forms from the source directory to compiled Lib, but you can do it manually if it fails and remove the build lines from the package. Angus

Thanks, I'll attempt to reproduce those conditions to see if I can reproduce the error, then fix it, for the next release. Zipping did get changed recently to support the native component, and I don't use zipping myself much nowadays. Angus

Please don't post large chunks of code in this topic, few people need to look at it. Either attach to a short message as a text file or send it by private message to whoever has requested it. Angus

The TsslWebSocketCli is a very new component, not heard of any using it yet (I use the websocket server for dynamic web pages). What are you using it for? It will need the HTTPRest component, but that will be one of the first to be converted. Adding SSL to V10 is likely to be the hardest part due to the low level changes. Angus

ICS V9.0 will be very difficult to convert to Android, it should work on MacOS but has not been tested for a few years due to lack of hardware and volunteers. ICS V10 is currently a very small number of units that does work on Linux for simple sockets, no SSL. Over the next year or so I will be migrating the V9 code to V10, it's a massive job. I strongly recommend that initially you concentrate on adding Android support to V10 and making the two FMX samples work on Android. You will see results far faster than working with V9. Angus

I saw the auto suffix is available in a drop down list, but you have to click a button to find it, I would have designed it with a tick box, so it is obvious. Angus

OpenSSL has released new versions of the two active branches. These releases fix a medium severity bug with symmetric cipher key and initialisation vector (IV) length that can result in non-uniqueness, which could result in loss of confidentiality for some cipher modes. This does not effect SSL/TLS, only encryption using EVP_EncryptInit_ex2(). Windows binaries are available in SVN and the overnight zip file and separately from https://wiki.overbyte.eu/wiki/index.php/ICS_Download or https://www.magsys.co.uk/delphi/magics.asp Separately, YuOpenSSL has released 3.0.12 as commercial DCUs allowing applications to be used with OpenSSL without needing separate DLLs. In addition to the three DLL files, the zip includes a compiled RES resource file that contains the same DLLs, text files and version information, see the RC file. The RES file may be linked into application EXE files and code then used to extract the DLLs from the resource to a temporary directory to avoid distributing them separately. ICS V9.1 and later optionally support loading the resource file, currently in SVN and the overnight zip. The OpenSSL extract directory is shell path CSIDL_COMMON_APPDATA which in recent Windows versions is "C:\Users\All Users\" aliased as "C:\ProgramData\", in sub-directory "ICS-OpenSSl" with a sub-directory for each different OpenSSL major/minor version, ie "3012" for 3.0.12, ie "C:\ProgramData\ICS-OpenSSl\3012\libcrypto-3.dll". OverbyteIcsDefs.inc has a new define OpenSSL_Resource_Files which causes the resource file to be linked, the major/minor version being defined as OpenSSL_30, OpenSSL_31 or OpenSSL_32 (not supported yet), the actual resource files are LibV3xOpenSSL32.RES and LibV3xOpenSSL64.RES where x is the minor version. Note ICS supports linking specific major/minor versions of OpenSSL, but only one per application, but not multiple patch versions which don't have new features, only security and bug fixes. The RES files are distributed in the zip files with the DLLs from the ICS wiki site, with the latest versions in the source directory. If the new resource can not be found or there is a problem extracting the DLLs, ICS falls back to looking for OpenSSL DLLs as previous releases. The OverbyteIcsDefs.inc in SVN has define OpenSSL_Resource_Files enabled, so if copied will mean projects rebuilt will automatically have the OpenSSL resources linked without any other changes. A decision will be taken before the final release as to whether this is best behaviour, it does resolve a long term problem of DLL hell or keeping OpenSSL DLLs updated in potentially dozens of different directories, particularly if applications build to Win32 and Win64 directories, now a single set of any version is needed in "C:\ProgramData\ICS-OpenSSL". The only downside is larger EXE files, particularly if an application has multiple EXEs. ICS has a global variable GSSL_DLL_DIR that defines where to look for the OpenSSL files, defaulting to blank but set in all samples to the program directory so a known version of OpenSSL is loaded. Perhaps ICS should set this to "C:\ProgramData\ICS-OpenSSL" by default so only a single set of DLLs are needed. Only snag is automating a means of getting files to this directory if the resource files are not used. Angus

Thanks, did not know that, there should really be an Auto Suffix tick box, so it's self documenting. Angus

Indeed, I thought I'd changed the package suffix to 29, but somehow the change got lost, and so D12 packages were built with suffix 28 which D11 then found due to so many different paths searched, and crashed the IDE on start-up. The risk of updating old components to use new compilers before the original developers have done so, if they are still around. Parnassus is now installed in both D11 and D12, but calls itself Yukon instead of Athens, one reason I've stopped using these names for ICS, gets very confusing. Angus

Not sure if my problem with D11.3 relates to Parnassus. It seems Delphi has taken a dislike to dclframviewer280.bpl built months ago, which is HtmlViewer, I added that to D12 and probably got some packages wrong. Angus

I had Delphi 11.3 and 12.0 installed together for a week, Parnassus only installed in 11.3, no problems. But when I updated the license key for 12.0 yesterday, 11,3 stopped working. So I guess Parnassus has screwed me as well. Parnassus only works with a subscription license key, not beta keys, which is why the problem did not show up earlier. Annoying. Angus

The ICS TSslHttpRest component now has proper support for multipart/form-data parameters, using TRestParams, available in SVN and the overnight zip. There is a new content type for FormData and a new method AddItemFile that allows one or more files to be added as parameters. The OverbyteIcsSnippets sample has two new HTTP file uploads buttons, one doing a simple file upload, the second a form-data upload, which set-ups the parameters as follows: MyJsonParams := TRestParams.Create(self); MyJsonParams.PContent := PContJson; MyJsonParams.AddItem('FileTitle', mytitle); MyJsonParams.AddItem('FileName', myfile); SslHttpRest.RestParams.PContent := PContFormData; SslHttpRest.RestParams.AddItem('FileTitle', mytitle); SslHttpRest.RestParams.AddItemA('JsonBlock', MyJsonParams.GetParameters, true); SslHttpRest.RestParams.AddItemFile('FileName', mysrcfile, 0); SslHttpRest.RestParams.AddItem('Submit', 'SubmitFile'); SslHttpRest.HttpUploadStrat := HttpUploadNone; StatCode := SslHttpRest.RestRequest(httpPOST, myurl, False, ''); This part was relatively straight forward, but testing proved interesting, particularly with an 8Gbyte file. The ICS application web server read uploaded data in a memory buffer, so that was changed for file stream above a certain size, likewise TRestParams needed a file stream for size. Then our form handling code needed updating for character sets as recommended by the latest RFC with a new parameter display web page in the ICS web server samples for testing. So a long process, but much improved REST functionality. Angus