Angus Robertson

Further to the announcement of RAD Studio 12.0 Athens today, ICS V9.,0 already has packages to install on Delphi 12, and is available now from GetIt. If installing VCL only manually, the overnight zip has a new D12InstallVcl.groupproj that replaces the old D12Install.groupproj, or use the existing combined D12InstallVclFmx.groupproj and just don't install the FMX packages (which is exactly what the new group does). This change will be made for all compilers for V9.1 and will remove a lot of VCL only packages that are a pain to maintain. Angus

The server can enumerate the parameters sequentially, rather than by accessing them by name, I just added a function to ICS to do exactly that, for diagnostic purposes. But comma separated values could be used as an array. It all depends on what the server expects, and it may not follow normal standards. Angus

You could look at https://github.com/mtrojnar/osslsigncode OpenSSL based Authenticode signing for PE/MSI/Java CAB files, There must be some code in there to add the certificate to the exe, or maybe the whole tool is what you are looking for, an alternate to signcode that does not have horrible pop-ups, builds on any platform. If you can build it, I'd like to play with it. Angus

I would recommend you upgrade to the latest ICS V9.0, there were a number of fixes relating to objects not being freed after exceptions, lots of clean-up, particularly for Win64 servers. There is no general problem with the ICS web server crashing, the following is from the status page of one of my public ICS web servers, doing SQL queries, REST requests and standard web pages, it just keeps running, until time for Windows Update or a new version: WSocket: TWSocket (c) 1996-2023 Francois Piette V9.1 Server: THttpServer (c) 1999-2023 F. Piette V9.0 Windows Boot Time: 10-Oct-2023 21:54:24 WebAppTelecom Start Time: 10-Oct-2023 22:54:27 Server OS: Windows Server 2019 Standard 1809 Win64 10.0.17763 Compiler: Delphi 11.3 Win64 OpenSSL Version: Static OpenSSL 3.0.11 19 Sep 2023, Legacy Provider Loaded OK SQL Requests: 49,572 Total Requests: 104,933 Total Connections: 117,470 Max Simultaneous Connections: 60 Total Data Received: 73.7M Total Data Transmitted: 3.03G Angus

Look at the new OverbyteNetTools sample, the LAN Devices tab scans the LAN for devices in various ways and shows the MAC vendor, often useful for identifying all those IoT devices that our LAN seem to accumulate, often announcing themselves as Amazon or Google, NEST, Tuya, Espressif, and others, just on my LAN. For reasons unknown, they sometimes change MAC address to something random and back again. Angus

ICS has a simple functon IcsGetMacVendor that loads the tab separated https://linuxnet.ca/ieee/oui/nmap-mac-prefixes list into a simple TStringList, sorts it, then accesses by partial Find, very quick, simple and efficient. It also checks for randomly generated MACs that fail look-up and report that. Angus

I can not trace route ptbtime1.ptb.de (192.53.103.108) from the UK, no response to any hops beyond my ISP. The time client does seem unhappy with IPv6 time servers, it's failing on all the Google IPv6 addresses before trying the IPv4 ones and working. Ditto Cloudfare, will check later in the week. I mostly use time.cloudflare.com now, well distributed around the world, but not Google. But Facebook and Apple also have distributed servers, all are better than the random addresses that come back for ?.ntp.org. Angus

Sorry, I don't have the time to debug end user applications, only fix proven reproducible problems in the ICS components. Angus

Has anyone looked at the Google RBM (Rich Business Messaging) APIs, used for the SMS replacement RCS Chats that seems to be appearing on all our phones? Personally, I'd missed it, just use Whatsapp. Not sure if RBM is the same as RCS, don't really follow mobile trends... But receiving and sending RCS from my desktop without needing to forward SMS would seem useful. Angus

No-one has ever sent me a Telegram message, but I don't have it installed either. WhatsApp is however widely used, but does not have an official API for the consumer version. But RCS is being installed automatically, although perhaps not enabled by default, and will fall back to SMS, which is universal. Angus

Sorry, no simple answer, something your own code is doing is corrupting memory, so the client can not be freed correctly. Or a function being called from the client. No easy way to find the problem. Perhaps comment out various parts of the code until the problem disappears to narrow it down. Angus

If you get an exception in that function, your application has probably already freed the client, although the exception should have happened a few lines higher. But it could also be memory corruption. If you have recently converted your application from Delphi 7 AnsiStrings to Unicode, I would look very carefully at all your string handling for received data. Angus

Thanks for the information, but you have not explained what the clients are doing. And I'm still confused as to why you think clients being disconnected when idle is a bad thing, that is the design. If you want idle clients to remain connected, set long KeepAlive timeouts, several hours. Zero for no disconnect is not documented as a design feature., The ICS web server is well tested over 20 years, in use on many public web servers, including my own. Angus

I'd like to know for what purpose you are using the ICS web server, what application, and why you are trying to disable server timeouts with WebServerSSL.KeepAliveTimeSec := 0; WebServerSSL.KeepAliveTimeXferSec := 0; Web servers are not supposed to keep idle connections opens unless keep-alive is requested. The Heartbeat timer should ignore zero timeouts, but I've never tested it, since no-one needs that feature. Also, you sometimes mention the connection being closed, sometimes the web server, which seems highly unlikely. Angus

You have shown an extract from a long function, if there was an error the connection will be disconnected anyway. The handshake event is called merely to allow the application to know there was a failure and report it to the end user. Angus

Permissions, always, they are complex to set-up in Azure and use in code. In particular, consumer and business accounts are different, the latter need a Microsoft User Authority to be passed and enabled, And the scopes specified when you got the bearer token must match those set-up for the account. Angus

I had to remove a lot of TNT components during my conversions. I would start your conversion in Delphi 7, made sure all your forms are saved as text, then use a text editor to globally replace TNT components one form at a time in PAS and DFM, with standard VCL versions, so it builds, but won't run properly. Then open in a modern compiler. Maybe change WideString to UnicodeString, or perhaps you have an alias already. Angus

Widestring and Unicodestring are not the same thing, despite both being 16-bit. You really need to change Widestring to Strimg sooner or later. And beware of ansistring as I said before. Angus

ICS V8.67 has been released at: http://wiki.overbyte.eu/wiki/index.php/ICS_Download ICS is a free internet component library for Delphi 7, 2006 to 2010, XE to XE8, 10 Seattle, 10.1 Berlin, 10.2 Tokyo, 10.3 Rio, 10.4 Sydney and 11.0 and C++ Builder 2006 to XE3, 10.2 Tokyo, 10.3 Rio, 10.4 Sydney and 11.0. ICS supports VCL and FMX, Win32, Win64 and MacOS 32-bit targets. The distribution zip includes the latest OpenSSL 1.1.1i win32, with OpenSSL 3.0 and Win64 versions of OpenSSL being available from the download page. Changes in ICS V8.67 include: 1 - Added support and packages for RAD Studio 11.0. Updated SSL/TLS root certificate bundles, old certificates gone, new ones added, nothing major. 2 - Added support for OpenSSL 3.0 which is a major new release, primarily a lot of internal changes to ease long term support. There is an optional FIPS module with 3.0 but not available here since our DLLs are not built to the standards required for certification. The old engines for special extensions are replaced by new more versatile providers of which the FIPS module is one, a provider legacy.dll has obsolete ciphers and hash digests, including MD2, MD4, Blowfish, DES, IDEA, RC2, RC4, SEED, that most applications no longer need and which needs to loaded by the application by setting global variable GSSLEAY_LOAD_LEGACY to true before loading OpenSSL. 3 - OpenSSL 3.0 does not offer any specific new features of benefit to ICS at present, although HTTP/3 support is planned for 3.1 or later, so the main ICS distribution retains OpenSSL 1.1.1i which is fully supported until September 2023. OpenSSL 3.0 may be downloaded from the download page. There are two global variables to restrict which OpenSSL version is loaded, GSSLEAY_DLL_IgnoreNew set true will ignore 3.0, while GSSLEAY_DLL_IgnoreOld will ignore 1.1.1, if both sets of DLLs are available in the same directory. The main SSL samples all set these globals, which can be changed for testing one version or the other, or set by the application, but must be before OpenSSL is initialised. 4 - The main implication for ICS with OpenSSL 3.0 is for SSL/TLS certificate private keys saved with password protection, which is required for PKCS12 certificates for importing into the Windows certificate store. The new PKCS12 default password encryption AES256 is not recognised until Windows Server 2016 v1709 and Windows 10 v1709, so Server 2012, Windows 10 RTM and earlier won't load AES passworded keys, only 3DES, for which the legacy.dll must be loaded. 5 - The TX509Base class has various improvements. The ValidateCertChain method reports CA roots for multiple certificate verification paths with two or more intermediate certificates, rather than only the last. The CertMainInfo method provides a single line with the main certificate information. 6 - There are two new classes to write and read SSL/TLS certificates to and from the Windows Certificate Store, including private keys. This is primarily so Let's Encrypt certificates can be installed automatically for use with the IIS web server. TMsX509List descends from TX509List adding a method LoadFromStore to load the list from a Windows certificate store by store name TMsCertStore and location MsCertLocation. For My/Personal store, attempts to load private keys if they are allowed to be exported unencrypted. TMsCertTools descends from TSslCertTools adding methods SaveToStorePfx and LoadFromMyStore to access Windows certificate stores. Note access to the Local Machine Store for web server certificates requires administrator rights. 7 - Various improvements for the OverbyteIcsPemTool sample. It includes new buttons to list the contents of Windows certificate and private key stores and allow old items to be deleted. This may be useful for cleaning up old certificates and private keys from the Windows stores. Added ResavePrivateKey and Resave Private Key menu option which prompt for a PFX or PEM file containing an encrypted private key with a new cipher, renaming old file to .oldpem/pfx. Specifically for files saved with old ciphers than OpenSSL 3.0 does not support as standard if required for older versions of Windows. Displaying certificates and bundles is no longer a new modal window, but updates the existing log window. Improved import certificates from Windows certificate store to use TMsX509List instead of Windows API calls, and to access all Windows store locations instead of just user, specifically the Local Machine store where server certificates are located. 8 - For the TX509Certs component, the default cipher for encrypting PFX/P12 files is now PrivKeyEncAES256 with 3.0 unless the legacy DLL is loaded when still PrivKeyEncTripleDES so older versions of Windows can load them. Changed extraction of download PEM bundle so that main certificate does not need to be first in file, log them all, and ignore any self signed root certificates. If testing dns-01 challenge fails, rotate to next public server and three retries (previously only happened on timeout). When saving files with private keys, log encryption type used. Added more certificate output formats, OutFmtPwPem and OutFmtPwP12 specify whether to password PEM and P12/PFX private keys. Note Windows always needs passworded P12/PRX files, while Apache web server only accepts PEM files without a password. Allow automatic installation of new certificates to the Windows Certificate Store so they can be used by IIS web sites, by setting output format to OutFmtWinStore. Note application must have administrator rights to do this. 9 - Fixed two problems in the FTP client, support option ftpFixPasvLanIP for PUT/APPE uploads as well as downloads, and support IPv6 for PUT/APPE uploads as well as downloads. 10 - Fixed a problem in TIcsMailQueue with sequential number generation to avoid file locking errors and unicode BOM corrupting file, generate large random number for errors instead of reverting to 1. Don't save BOM withunicode compilers. 11 - In the Application Web Server TSslHttpAppSrv, added an optional LastModified parameter to the AnswerStream, AnswerPage, and AnswerString methods to avoid adding a custom header line with the date. Added NO_CACHE_EX and NO_STORE_EX literals. Added PUT and DELETE verb handlers, similar to GET and POST. 12 - For the HTTP client TSslHttpCli, fixed a relocation problem where the Location: header included a path with a space, encode the space. Fixed another relocation problem where HEAD sometimes stalled. Remove # fragment or anchor from URL in relocation, only used by browsers and not by servers. 13 - In the TIcsBlackList component, Internally use BlockedFlag instead of setting attempts to 9999 once the actual maximum failed attempts is reached, so we can keep counting attempts. 14 - Added a new SSL sample, OverbyteIcsDDWebService.dpr which is very similar to OverbyteIcsSslMultiWebServ.dpr, but designed as a Windows service, although it will also run as a GUI for debugging. It requires DDService service framework to be installed from https://www.magsys.co.uk/delphi/ddservice. asp. It also includes a REST server with simple lookup responses from a SQL database, which optionally requires DISQLite3 5.36.5 or later to be installed from http://www.yunqa.de. Note this sample in not in the project groups due to these pre-requisites. 15 - Moved TRestParams from the OverbyteIcsSslHttpRest unit to OverbyteIcsUrl to ease circular references. Added a new method AddItemNULL to add a null, in Json this will be unquoted. Added a new TRestParamsSrv component which provides methods for creating REST server Json responses from a SQL database resultset, one or more rows, also error responses. Note this is only compiled if DATABASE is defined in OverbyteIcsDefs.inc to avoid bringing in database units that are not available on all Delphi editions. There is a REST server sample OverbyteIcsDDWebService.dpr that illustrates SQL lookups. 16 - In the proxy component TIcsHttpProxy, don't send an HTTP request header until after HTTP body has been processed in case the body length changes. HTTP Forward Proxy using HTTP works again, broken in V8.65. Using HTTP Forward Proxy, convert absolute URL to path only since some servers can not process an absolute URL and sulk. 17 - In the Jose unit, rewrote the functions converting private keys to and from Json Web Keys with new OpenSSL 3.0 provider functions. Use AnsiStrings and functions when dealing with binary data to avoid possible issues with string conversions and nulls. Json now created with TRestParams. 18 - Added two new sample project groups, OtherDemos64 and SslDemos64 which include Win64 versions of all the main active samples with 64 added to the project name, so they can be regularly built alongside the Win32 versions without changing platforms and overwriting executables.

Over the last two years, I've converting Delphi 2007 applications to modern compilers. Not finished yet. Apart from all the other comments made, a couple of my own. Avoid the simple solution of using AnsiString, you will end up with thousands of compiler cast warning and have trouble with functions that use UnicodeString. Use TBytes for non-string data, there are lots of ways of converting TB to other formats Look at file handling carefully, loading a text file into a TStringList will result in Chinese as it assumes it's reading unicode, unless it finds a BOM or is told otherwise, ditto saving files. Angus

You are looking at a low level component where you'd need to code all that stuff yourself. Please use TIcsFtpMulti instead, which reads directories automatically and downloads or uploads multiple files with a single function call. The main sample is OverbyteIcsXferTst, but there also is a very simple sample in OverbyteIcsSnippets where you can press a button to download sample files. Angus

Can you please answer the several questions I have previously asked, rather than just repeating one of the symptoms of your problem? Angus

Simple XOR encryption with a numeric key will make it much harder to search the EXE for client ID and passwords, AES if you don't care about the size overhead. Angus

> ICS can not start, because some necessary SSL DLLs are missing. Because you failed to distribute all the required files with your prorgram. > ICS is trying to download those DLLs from a non-SSL server via http://... , but can not !!! Because you told the ICS application you designed to do an impossible download. Bad program design. Before distributing applications to hundreds of PCs, I find a little testing helps. Angus

You don't download OpenSSL using ICS, you use a normal browser. But you already have OpenSSL, it is also distributed as part of ICS, in the openssl folder, and the DLLs are also in the sslsamples folder so all the ICS samples work. You just have to make sure the DLLs are in the same folder as your exe, unless you specify a different folder in code. Angus