Hi all,

Does TFpHttpClient support ssl/https?

I see there is a openssl package, but i have no idea if it can be used with the http component. Any hints?

Regards,
Rimmert

PS:
I sent this message twice, as I believe the first one was not delivered. I'm sorry if this is a duplicate.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus.freepascal.org/pipermail/lazarus/attachments/20120403/0112c376/attachment.html>

Rimmert Ooink wrote

Hi all, Does TFpHttpClient support ssl/https?

No.

I see there is a openssl package, but i have no idea if it can be used with the http component. Any hints?

It is not usable, and there are no immediate plans to support this. (although patches would be accepted ;) )

I suggest using synapse.

Michael.

Michael, the Aurawin socket engine uses the attached unit for SSL support.

If you could please "merge" my changes into FPC's SSL - you could enable SSL for fpWeb with these functions. The socket semantics are very easy once you have string keys loaded.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus.freepascal.org/pipermail/lazarus/attachments/20120403/9b606b45/attachment-0001.html> -------------- next part --------------
A non-text attachment was scrubbed...
Name: uSSL.pas
Type: application/octet-stream
Size: 68381 bytes
Desc: not available
URL: <http://lists.lazarus.freepascal.org/pipermail/lazarus/attachments/20120403/9b606b45/attachment-0001.obj>

Andrew Brunner wrote

Michael, the Aurawin socket engine uses the attached unit for SSL support. If you could please "merge" my changes into FPC's SSL - you could enable SSL for fpWeb with these functions.? The socket semantics are very easy once you have string keys loaded.?

I'll have a look at it, thank you.

Can't promise this is done by tomorrow, mind you...

Michael.

Andrew Brunner wrote

Michael, the Aurawin socket engine uses the attached unit for SSL support. If you could please "merge" my changes into FPC's SSL - you could enable SSL for fpWeb with these functions.? The socket semantics are very easy once you have string keys loaded.?

I had a cursory look. The unit is the interface to SSL. We have this interface already (openssl unit).

I searched for aurawin socket, but could not find anything.

Maybe you attached the wrong unit ?

Michael.

2012/4/3 Michael Van Canneyt

security "layer". The missing decs/methods are essential ones.

A sockets engine would need a system like this...

  PSecureInfo=^TSecureInfo;
  TSecureMode=(sslServer,sslClient);
  TSecureInfo=record
    Mode            : TSecureMode;
    keyData         : String;
    keyLen          : Integer;
    certData        : String;
    certLen         : Integer;
  end;
  TSSLInfo=record
    Method          : PSSL_METHOD;
    Context         : PSSL_CTX;
    Handle          : PSSL;
    ctxSessionID    : string;
    ctxSessionIDLen : integer;
  end;
A server thread would do this on Thread.Execute (before all your other
stuff)
var // place these anywhere even private to thread
    FSSLMethod                   : PSSL_METHOD;
    FSSLContext                  : PSSL_CTX;
    FSSLContextID                : String;
    FSSLContextIDLen             : Integer;
    FSSLInfo                   :TSSLInfo // this belongs to your remote
socket class
begin
    FSSLMethod:=SSLv3_server_method();
    FSSLContext:=SSL_ctx_new(FSSLMethod);
    SslCtxSetCipherList(FSSLContext,'DEFAULT');
    SslCtxSetVerify(FSSLContext,SSL_VERIFY_NONE, nil);
    SSLCTXSetMode(FSSLContext,SSL_MODE_ENABLE_PARTIAL_WRITE);
    if Assigned(SSL_CTX_set_session_cache_mode) then
      SSL_CTX_set_session_cache_mode(FSSLContext,SSL_SESS_CACHE_OFF);
    FSSLContextID:=hRSR.Generate_SSL_SessionID;
    FSSLContextIDLen:=System.Length(FSSLContextID);
    EntryPoint:='TRSRManager.Execute.SSL_CTX_set_session_id_context';
    try
SSL_CTX_set_session_id_context(FSSLContext, at FSSLContextID[1],FSSLContextIDLen);
    except
      On E:Exception do OnRSRException(EntryPoint,'Exception',E.Message);
    end;

if
SslCtxUseRSAPrivateKeyASN1(FSSLContext, at FSSLInfoP^.keyData[1],FSSLInfoP^.keyLen)1 then begin

OnRSRException('TRSRServer.Execute.SslCtxUseRSAPrivateKeyASN1','Exception',Concat('Open SSL Error ',IntToStr(uSSL.ERR_get_error())));

    end;
    if SslCtxUseCertificateASN1(FSSLContext,

FSSLInfoP^.certLen, at FSSLInfoP^.certData[1]) 1 then begin

OnRSRException('TRSRServer.Execute.SslCtxUseCertificateASN1','Exception',Concat('Open
SSL Error ',IntToStr(uSSL.ERR_get_error())));
    end;
// There are 2 strings needed that you need can be generated using the
toolkit that comes with openssl et al.

... Somwhere else...

socket=fpAccept()

FSSLInfo.Handle:=SSL_new(FSSLContext);
TaskError:=SSL_get_error(FSSLInfo.Handle, LastCall);   // always inspect
ssl lib calls to empty out error "stack";
SSL_set_fd(.SSL.Handle,socket);
TaskError:=SSL_get_error(SSL.Handle, LastCall);

If you are a server socket do this...

  SSL_accept(SSL.Handle);
  TaskError:=SSL_get_error(SSL.Handle, LastCall);
  // This will do all the socket negotiation for you!!!!

if you are a client socket do this...

  SSL_connect(SSL.Handle);
  TaskError:=SSL_get_error(SSL.Handle, LastCall);
  // This will do all the client socket negotiaon for you!!!

If you wan to send data over SSL enabled socket just bypass fpSend and do this

          LastCall:=SSL_write(SSL.Handle, at FSendBuffer[0],iSend);
          TaskError:=SSL_get_error(SSL.Handle, LastCall);

If you want to recv Data over SSL enabled socket just bypass fpRecv and do this

      LastCall:=SSL_read(SSL.Handle, at FRecvBuffer[0],iRead);
      TaskError:=SSL_get_error(SSL.Handle, LastCall);

When your socket cleanup is about to happend (Socket was closed)

      SSL_clear(SSL.Handle);

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus.freepascal.org/pipermail/lazarus/attachments/20120403/fa7571aa/attachment-0001.html>

On Tue, Apr 3, 2012 at 4:59 PM, Andrew Brunner
wrote:

The changes I made to the existing library were essential because the contributor renamed the library calling methods to messed up ones and when developing ssl sockets - the developers will REALLY REALLY REALLY need to have quick access to OpenSSL documentation (widely available). Otherwise I had to go to the unit and retrieve the corresponding methods. NOT FUN!

Enjoy!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.lazarus.freepascal.org/pipermail/lazarus/attachments/20120403/526f5884/attachment.html>