Angus Robertson

These are the pertinent arguments from my successful login this morning:

&redirect_uri=http%3A%2F%2Flocalhost%3A8080%2Fmicrosoft%2F&state=ICS-232524578&scope=offline_access%20https%3A%2F%2Foutlook.office.com%2FSMTP.Send%20https%3A%2F%2Foutlook.office.com%2FPOP.AccessAsUser.All&prompt=select_account&access_type=offline

You could try removing the URL and just use SMTP.Send.

Angus

You got a scope error, so that is the parameter to adjust until it works.  Try a single scope without any spaces. 

The scopes need to match the settings in the Azure account, but you only need those for the current task.

Angus

Just signed into my live.com account ok, try using the scope:

offline_access https://outlook.office.com/SMTP.Send https://outlook.office.com/POP.AccessAsUser.All

Note no escaped spaces, they probably got double encoded.

Angus

From your description, I'm not sure how anything is set-up here, or why you are using an OpenSSL tool for testing.

The proxy server needs it's own SSL/TLS certificate matching the host name localhost which you seem to have created, but this will fail validation by clients unless those clients have the root certificate installed, Personal Root CA  in your case.

But this is unrelated to the client certificate which should be installed in the Firefox certificate store, and then validated by the proxy server.  Your openssl c_client command line does not have a client certificate which is the reason for the errors.

Angus

Thanks, always useful to know new ICS components have been tested in wider environments than my own servers. 

The final release is planned for May, once one more new sample is finished.

Angus

Quote

Applications should use the WM_POWERBROADCAST message.

The important word there is 'should', many Windows APIs are considered historic and obsolete but are widely used and supported.

Angus

Check the WM_POWER message as well.

Angus

The new ProxyURL property is currently only for simple proxy servers in the HTTP client component, for SOCKS you set the SocksServer, SocksPort, SocksLevel, SocksAuthentication, SocksUserCode and SocksPassword properties, as shown in OverbyteIcsHttpsTst.dpr sample.

As the source comment suggests, the single ProxyURL property could be updated to support more proxy options like SOCKS, but no-one has asked about it before.

Angus

Your changes are now in SVN and the overnight zip, with several other DNS query improvements, including support for trying lists of DNS servers where one or more don't respond.  It is also easier to access the arrays of different DNS answers.   These have all simplified DNS lookups in the Mail Queue and X509 certificate ordering components. 

Angus

TX509Base has dozens of methods for loading, saving, and examining certificates, but was never properly documented. 

However, virtually all these properties and methods are used in the OverbyteIcsPemtool,dpr sample, also the TSslCertTools derivative that allows creation and signing of certificates.

Angus

The SslCertX509 property is type TX509Base and has methods to load, save and examine the content of the certificate and private key, IsCertLoaded, IsPKeyLoaded and IsInterLoaded say what has been loaded, so in your case nothing because you have not yet called InitContext, only created it in your code snippet.   

If you just want to examine a certificate text, load it into a TX509Base object instead with the LoadFromTextEx method which will return any errors. 

Angus

SslContext.SslCertX509,ValidNotAfter returns certificate expiry as TDateTime

Angus

Well it seems ICS and FileZilla are both trying to compensate for the misconfigured server, the other difference in the logs is FileZilla has set binary mode, but you did not in ICS, perhaps the FTP server is giving a misleading error and does not like ASCII mode. 

You could also try the better FTP sample OverbyteIcsXferTst.dpr, it will probably set binary automatically.

Angus

Sorry, I can not see what host name or IP address either client connected with, only the LAN 10.xx.xx.xx address the passive connection is trying to use, and I assume the FTP server is not on your LAN so is incorrect. 

The FileZilla log may make some comment after the passive mode line, but not in a language I understand.

A public FTP server should never offer a private 10.xx or 192.168.xx address for a passive connection, it is incorrectly configured.  There may be an issue with the ftpFixPasvLanIP FOptions which is attempting to fix this problem, but without more logging or testing there is little I can do.

Angus

Are you talking about Filezilla server or client?  Both are quite clever in handling poorly implemented NAT routers provided they are configured correctly.

ICS knows there is a problem, thus the suspicious comment, but I can not advise you with the partial redacted log you supplied. Look at the FileZilla log and see what is different. 

Angus

Thanks, will check it and add to ICS next week.  I bodge sync MX look-up in the mail queue unit, would be good to have a cleaner option.

Angus

Thanks, will be fixed next week.

Angus

Look at the IP addresses, totally different for control and data channels.  Perhaps you are accessing FTP via a NAT router that can cause problems. 

Angus

If you allow an HTTPS request to be made, you must load OpenSSL before that happens. 

Or use the modern component TSslHttpRest which handles all the SSL stuff for you.

Angus

I assume you are talking about a websocket client component, there is such a new component in ICS V8.71 not released yet but can be downloaded from the overnight zip or SVN. 

The new client is in OverbyteIcsWebSocketCli.pas with a sample in OverbyteIcsHttpRestTst.dpr (because it descends from the HTTP REST component). 

It's been tested against a couple of public websocket servers, and both of the ICS server implementations, one is new and built into the multi web server sample.  It's also running on one of my public web sites, which the sample tests against.

Angus

Much of my code is similar to yours, except it uses different methods that do vastly more complicated things than the simple methods in the older component.  Just build it and run it, with a log window, and it will just download a file.  Or you can run the OverbyteIcsXferTst.dpr sample that does the same thing.

It will be in SVN in a few days when I've done more snippets.

Angus

Uses   OverbyteIcsWsocket, OverbyteIcsFtpcli, OverbyteIcsFileCopy, OverbyteIcsFtpMulti;

procedure TSnippets.AddLogText(const Line: String);
begin
    LogWin.Lines.Add(Line);
end;

procedure TSnippets.onXferEvent (LogLevel: TIcsCopyLogLevel ; Info: string ; var Cancel: boolean) ;
begin
    if (LogLevel = LogLevelInfo) or (LogLevel = LogLevelFile) then
    begin
        AddLogText (Info) ;
        LabelProgress.Caption := Info ;
    end ;
    if (LogLevel = LogLevelProg) then
    begin
        if Info <> '' then
            LabelProgress.Caption := 'Progress: ' + Info
        else
            LabelProgress.Caption := '' ;
    end ;
    if (LogLevel = LogLevelDiag) and ShowDiags.Checked  then
        AddLogText (Info) ;
    if AbortFlag then
        Cancel := true ;
end;


procedure TSnippets.doFtpDownOneFileClick(Sender: TObject);
var
    FtpMultiClient: TIcsFtpMulti ;
    taskres: TIcsTaskResult ;
    myftppath, myftpfile, myfiletarget: String;
    myftphost, myftpusername, myftppassword: String;
    myftptype: TFtpType;
    myfilereplace: TIcsFileCopyRepl;
begin

// parameters for the single FTP download operation
    myftppath := '/testing' ;        // FTP server path for file
    myftpfile := 'speed50meg.zip';   // FTP file to download
    myfiletarget := IncludeTrailingPathDelimiter(DirTemp.Text) + myftpfile;  // where we download to
    myftphost := 'ics.ftptest.org' ;   // supports IPv4 and IPv6
    myftpusername := 'anonymous' ;     // no uploads
    myftppassword := 'icssnippets' ;
    myftptype := FtpTypeAuthSslBoth;  // or FtpTypeNone, FtpTypeConnSslBoth  (no SSL or only SSL)
    myfilereplace := FCReplAlways;    // or FCReplNever, FCReplNewer

// create component and events to see progress
    FtpMultiClient := TIcsFtpMulti.Create (self) ;
    FtpMultiClient.CopyEvent := onXferEvent ;
    doFtpDownOneFile.Enabled := false ;
    AbortFlag := false ;
    LabelProgress.Caption := '' ;
    try
        try
         // essential FTP parameters
            FtpMultiClient.SocketFamily := sfIPv4;  // or sfIPv6 or sfAny
            FtpMultiClient.HostName1 := myftphost ;
            FtpMultiClient.FtpType := myftptype ;
            FtpMultiClient.UserName := myftpusername ;
            FtpMultiClient.PassWord := myftppassword ;
            FtpMultiClient.MaxAttempts := 2 ;  // logon attempts, may try IPv6 then IPv4
            FtpMultiClient.FailRepeat := 2 ;   // retries for failed xfers
            FtpMultiClient.PassiveX := True ;  // must be after connection type
            FtpMultiClient.FtpSslVerMethod := ftpSslVerBundle;  // or ftpSslVerNone to skip checking certificates
            FtpMultiClient.FtpSslReportChain := False;  // true to list SSL certificates
            FtpMultiClient.SrcDir := '/' ;   // required
            FtpMultiClient.BulkMode := BulkModeDownload ;   // required

          // connect, login, get features
            taskres := FtpMultiClient.FtpLogon ;
            if taskres = TaskResOKNew then
            begin
                taskres := FtpMultiClient.FtpDownOneFile (myftppath, myftpfile, myfiletarget, myfilereplace) ;
            end ;
            AddLogText ('Task Result: ' + IcsGetTaskResName (taskres)) ;
            AddLogText (FtpMultiClient.ReqResponse) ;
        except
            AddLogText ('FTP Error - ' + IcsGetExceptMess (ExceptObject)) ;
        end ;
    finally
        FtpMultiClient.FtpLogoff ;
        FreeAndNil (FtpMultiClient) ;
        LabelProgress.Caption := 'FTP Completed' ;
        doFtpDownOneFile.Enabled := true ;
    end ;
end;

This code is from a new ICS snippets application that has simple examples of many common ICS tasks, this one downloads a single file using SSL from one of my public FTP servers, using the modern TIcsFtpMulti component.  It only needs a couple more properties and it will download multiple directories of files.

Angus

Most ICS high level protocol components provide both sync and async methods, the former are often easier to work with for many applications. 

Impossible to say why the presented code is not working, since there are no given parameters or any logging of what the component actually does. 

It is also the old way to create FTP applications.  You should build the sample OverbyteIcsXferTst.dpr which uses the modern TIcsFtpMulti component.  Look at the Single FTP tab and the

doFtpDown1Click method which shows how to download a single file, although it is just as easy to tell it to download a complete directory structure of thousands of files,

I appreciate OverbyteIcsXferTst.dpr is a complex sample illustrating several different components, I'll do a simple FTP snippet later today. 

Angus

LocaleCharsFromUnicode was available in XE2 so is now used from that version.  A lot of conditional code has now gone. 

Angus

OpenSSL has released a new version 3.1.0, Windows binaries are available in SVN and the overnight zip file and separately from

http://wiki.overbyte.eu/wiki/index.php/ICS_Download or https://www.magsys.co.uk/delphi/magics.asp

This is a minor release that does not require a new version of ICS, the main improvement is a FIPS 140-3 compliant FIPS Provider, 3.0 was FIPS 140-2.  Note the ICS Windows build can not be FIPS approved.  There have been numerous performance improvements implemented compared to the OpenSSL 3.0 release.
 
Plans for future OpenSSL releases are at: https://www.openssl.org/roadmap.html

Angus