IndySecOpenSSL is now available on OPM

[tonyw]

I tried with OpenSSL 4.0.1, and 3.5.7 with TaurusTLS and IndySec (all updated).

All work good.

Only issue (not blocking) is that with IndySec tha SSLTEST reports this issse (while TaurusTLS is good), see images. The orange text ('Chain issues    Contains anchor') indicate the issue.

The code is exactly the same, except for use of "Context" derived for proper SSLContext and other assigned path.

P.S.: in the code there is (in the SSLOptions)

Code: Pascal  [Select][+][-]

1. UseSystemRootCertificateStore := false;

Not sure what is going on here. Your images appear to be displaying two different certificate files. The first contains 2 certs and the second contains 3 certs. So you are not comparing like with like.

However, your post did make me look at the code in this area and I noticed a regression from IndySecOpenSSL version 1.0 in the current version. That is UseSystemRootCertificateStore is bring ignored and it will hence always load the System Root Cert Store. That I will fix.

[Thaddy]

The anchor is probably a #13. It should not be there.

[TheMouseAUS]

Is there someone who could give me an example of the correct usage of IndySecOpenSSL with IdTCPServer and IdTCPClient to send/receiving data, all the examples are for https and they have helped but the use case is different and i want to be able to check what I am doing is correct (esp error handling).

While I believe I do have a OpenSSL bug I dont think thats all that is wrong. My server has been running now for 24 hrs and seems stable enough, I sent a  lot of time making sure that there are thread locks for memory safety etc so I feel fairly confident there and I do not seem to get any access violations.

I do see error  error:00000000:lib(0)::reason(0) at the server when the client initiates connection (with OpenSSL 3.6.2). the Client log shows :-

before SSL initialization
before SSL initialization
SSLv3/TLS write client hello
SSLv3/TLS write client hello
SSLv3/TLS read server hello
TLSv1.3 read encrypted extensions
SSLv3/TLS read server certificate
TLSv1.3 read server certificate verify
SSLv3/TLS read finished
SSLv3/TLS write change cipher spec
SSLv3/TLS write finished
SSL negotiation finished successfully
SSL negotiation finished successfully
before SSL initialization
before SSL initialization
SSLv3/TLS write client hello
unexpected message
error
before SSL initialization
before SSL initialization
SSLv3/TLS write client hello
SSLv3/TLS write client hello
SSLv3/TLS read server hello
TLSv1.3 read encrypted extensions
SSLv3/TLS read server certificate
TLSv1.3 read server certificate verify
SSLv3/TLS read finished
SSLv3/TLS write change cipher spec
SSLv3/TLS write finished
SSL negotiation finished successfully
SSL negotiation finished successfully
SSL negotiation finished successfully
SSL negotiation finished successfully
SSLv3/TLS read server session ticket
SSL negotiation finished successfully
SSL negotiation finished successfully
SSL negotiation finished successfully
SSLv3/TLS read server session ticket
SSL negotiation finished successfully

[LeP]

BAD ANSWER .... I REDO ....

Not sure what is going on here. Your images appear to be displaying two different certificate files. The first contains 2 certs and the second contains 3 certs. So you are not comparing like with like.

The chain sent by server is always 2 certificate, 1 of site and 1 intermediate (R13), the root (ISGROOTX1 is taken by client form it's root secure store.

The anchor is probably a #13. It should not be there.

I don't know where is this, but I think is something sent like an "link" may be the "ISGROOTX1"

This anomaly does not cause any problem, it is just a formal issue.

[LeP]

Is there someone who could give me an example of the correct usage of IndySecOpenSSL with IdTCPServer and IdTCPClient to send/receiving data, all the examples are for https and they have helped but the use case is different and i want to be able to check what I am doing is correct (esp error handling).

While I believe I do have a OpenSSL bug I dont think thats all that is wrong. My server has been running now for 24 hrs and seems stable enough, I sent a  lot of time making sure that there are thread locks for memory safety etc so I feel fairly confident there and I do not seem to get any access violations.

Is better that you post a minimal version of your code (server+client) that show the issue and we give a try.

[TheMouseAUS]

Here is a scaled down version with just the relevant bits :-

I dont know how to cleanly disconnect the clients and close the server for a restart if required. At the moment the clients do not like it at all.

Code: Pascal  [Select][+][-]

1. procedure ProgramCreate;
2. begin
3.   memoLock := TCriticalSection.create;
4.   IdTCPServer1 := TIdTCPServer.Create(nil);
5.   IdTCPServer1.DefaultPort:= 5326;
6.   IdTCPServer1.OnExecute:= @idTCPServer1Execute;
7.   IdTCPServer1.OnDisconnect:= @TCPClientDisconnect;
8.   IdTCPServer1.OnException:= @IdTCPServer1Exception;
9.   IdTCPServer1.OnConnect:= @IdTCPServer1Connect;
10.  
11.   IdTCPSSL := TIdSecServerIOHandlerSSLOpenSSL.Create(nil);
12.   IdTCPSSL.SSLOptions.CertFile:= 'server_cert.crt';
13.   IdTCPSSL.SSLOptions.KeyFile:= 'server_key.key';
14.   IdTCPSSL.SSLOptions.Method:= sslvTLSv1_3;
15.   IdTCPSSL.SSLOptions.SSLVersions:= [sslvTLSv1_2, sslvTLSv1_3];
16.   IdTCPSSL.SSLOptions.VerifyMode:= [];
17.   IdTCPSSL.SSLOptions.Mode:= sslmServer;
18.   IdTCPServer1.IOHandler := IdTCPSSL;
19.   IdTCPServer1.Active := true;
20. end;    
21.  
22. procedure IdTCPServer1Connect(AContext: TIdContext);
23. begin
24.   TIdSSLIOHandlerSocketBase(AContext.Connection.IOHandler).PassThrough := False;
25. end;
26.  
27. procedure IdTCPServer1Exception(AContext: TIdContext;
28.   AException: Exception);
29. begin
30.   MemoLock.Enter;
31.   try
32.     Memo1.Add('TCP Exception Message - ' + AException.Message);
33.   finally
34.     memoLock.Leave;
35.   end;
36. end;
37.  
38. procedure TPLCServer.IdTCPServer1Execute(AContext: TIdContext);
39. var SendBuffer : TStringList;
40.     ms : TMemoryStream;
41.     s : string;
42. begin
43.  
44. With AContext.Connection.IOHandler do
45.   begin
46.  
47.  
48.   SendBuffer := TStringList.Create;
49.   SendBuffer.clear;
50.   ms := TMemoryStream.Create;
51.  
52.   try
53.  
54.     s:= ReadLn;
55.  
56.     SendBuffer.Add(s); // add lines as required to send to client
57.    
58.     SendBuffer.SaveToStream(ms);
59.     ms.position := 0;
60.     Write(ms, ms.size, true)
61.  
62.   finally
63.   Sendbuffer.free;
64.   ms.free;
65.   end;
66.  
67. end;
68.  
69. end;
70.  
71. procedure ProgramClose;
72. begin
73.   IdTCPServer1.Active := false;
74.   IdTCPServer.free;
75.   IdTCPSSL.free;
76.   memoLock.free;
77. end;
78.  
79.  

[LeP]

Hope you don't do this in real code:

Code: Pascal  [Select][+][-]

1. s:= ReadLn;

I don't know how ReadLn works internally, but it lock the thread ... not the full works, but the specific connection thread.

And, when you connect more clients concurrently , readLn have reacts ?

Remember that the Execute method is calling form context of connection (that is a thread), so if you have 10 connection ..  you have 10 Execute distinct methods running and every of this is calling continuosly.

After that I will try your code

[TheMouseAUS]

opps I missed that var

Code: Pascal  [Select][+][-]

1. procedure TPLCServer.IdTCPServer1Execute(AContext: TIdContext);
2. var SendBuffer : TStringList;
3.     ms : TMemoryStream;
4.     s : String;
5. begin
6.  

[TheMouseAUS]

The issues seem to be around adding SSL.

1) When I was trying to get the client to connect, I was trying different settings, a few times the client caused the server to crash. If client is ok, server is OK, this is not a good situation I need to be able to handle any exceptions cleanly so the server stays running that is not the case right now.

2) Restarting the server causes the client to crash with an SSL general protect fault. How to close connections cleanly?

I have 10 clients connected and overall it is working well, I need to improve on what I have done, just not sure how.

[LeP]

Stay tunned, I'll give you a full code working ...

[LeP]

Try this demo (this is one of my server): https://cloud.dyn-o-saur.com/TCPS Demo.7z

There are some OpenSLL libs (1.0.2u, 3.6.3, 4.0.1). Rename those you don't want to use. [EDIT] If anyone doesn't agree with binary dll in this download, than can donwload the DLL from this (there are binaries compiled and sources): https://github.com/TaurusTLS-Developers/OpenSSL-Distribution [END EDIT]

Inside the source there are a DEFINE that let you choose what engine to use: Bundle Indy, IndySec or TauruTLS.

Try to mix Server / Clients.

There is also example cert ....

Hope this helps.

[LeP]

Not sure what is going on here. Your images appear to be displaying two different certificate files. The first contains 2 certs and the second contains 3 certs. So you are not comparing like with like.
However, your post did make me look at the code in this area and I noticed a regression from IndySecOpenSSL version 1.0 in the current version. That is UseSystemRootCertificateStore is bring ignored and it will hence always load the System Root Cert Store. That I will fix.

I can confirm that with last commit (restore the use of UseSystemRootCertificateStore with True/False), the issue are gone.
Now all is perfect OK.

[TheMouseAUS]

Thanks for your example, for some reason

Code: Pascal  [Select][+][-]

1.  
2. procedure TForm1.IdTCPServer1AfterBind(Sender: TObject);
3. begin
4.   {$IFDEF TAURUS_SSL}
5.     FSSLContext1 := TMyIdSSLContext(OpenSSL1.SSLContext);
6.     SSL_CTX_set_options(FSSLContext1.Context, SSL_OP_CIPHER_SERVER_PREFERENCE);
7.   {$ELSE}
8.     {$IFDEF INDYSEC_SSL}
9.       FSSLContext1 := TMyIdSSLContext(OpenSSL1.SSLContext);
10.       //UNCOMMENT THE NEXT LINE WHEN "OpenSSL_ssl" is addded to uses !!!
11.       //SSL_CTX_set_options(FSSLContext1.fContext, SSL_OP_CIPHER_SERVER_PREFERENCE);
12.     {$ELSE}
13.         FSSLContext1 := TMyIdSSLContext(OpenSSL1.SSLContext);
14.         SSL_CTX_set_ecdh_auto(FSSLContext1.fContext, 1);
15.         SSL_CTX_set_options(FSSLContext1.fContext, SSL_OP_CIPHER_SERVER_PREFERENCE);
16.     {$ENDIF}
17.   {$ENDIF}
18. end;
19.  
20.  

When the application starts (fine compiling) this throws an Invalid Typecast

Try this demo (this is one of my server): https://cloud.dyn-o-saur.com/TCPS Demo.7z

There are some OpenSLL libs (1.0.2u, 3.6.3, 4.0.1). Rename those you don't want to use. [EDIT] If anyone doesn't agree with binary dll in this download, than can donwload the DLL from this (there are binaries compiled and sources): https://github.com/TaurusTLS-Developers/OpenSSL-Distribution [END EDIT]

Inside the source there are a DEFINE that let you choose what engine to use: Bundle Indy, IndySec or TauruTLS.

Try to mix Server / Clients.

There is also example cert ....

Hope this helps.

[LeP]

Thanks for your example, for some reason

Code: Pascal  [Select][+][-]

1.  
2. procedure TForm1.IdTCPServer1AfterBind(Sender: TObject);
3. begin
4.   {$IFDEF TAURUS_SSL}
5.     FSSLContext1 := TMyIdSSLContext(OpenSSL1.SSLContext);
6.     SSL_CTX_set_options(FSSLContext1.Context, SSL_OP_CIPHER_SERVER_PREFERENCE);
7.   {$ELSE}
8.     {$IFDEF INDYSEC_SSL}
9.       FSSLContext1 := TMyIdSSLContext(OpenSSL1.SSLContext);
10.       //UNCOMMENT THE NEXT LINE WHEN "OpenSSL_ssl" is addded to uses !!!
11.       //SSL_CTX_set_options(FSSLContext1.fContext, SSL_OP_CIPHER_SERVER_PREFERENCE);
12.     {$ELSE}
13.         FSSLContext1 := TMyIdSSLContext(OpenSSL1.SSLContext);
14.         SSL_CTX_set_ecdh_auto(FSSLContext1.fContext, 1);
15.         SSL_CTX_set_options(FSSLContext1.fContext, SSL_OP_CIPHER_SERVER_PREFERENCE);
16.     {$ENDIF}
17.   {$ENDIF}
18. end;
19.  
20.  

When the application starts (fine compiling) this throws an Invalid Typecast

I'm trying now, and I don't have any error. Using OPM packages and Lazarus satble 4.6 or 4.8 with FPC 3.2.2 tested with all "engines". With IndySec ti use the OpenSSL 3.6.3, Win11 25H2

If the error is in that part of code you can simply comment all. This part is to force the server to impose its preference chipers to client. And with old release of OpenSSL to permit the use of ECHD chipers.


P.S.: Have you tried with all ?

[TheMouseAUS]

Yes I did comment that section out to get it to run. I also made the server send to clients that its terminating so they can close their connections before it closes the sockets. It all seems to be running much better other than the Debian version of OpenSSL now.

I'm trying now, and I don't have any error. Using OPM packages and Lazarus satble 4.6 or 4.8 with FPC 3.2.2 tested with all "engines". With IndySec ti use the OpenSSL 3.6.3, Win11 25H2

If the error is in that part of code you can simply comment all. This part is to force the server to impose its preference chipers to client. And with old release of OpenSSL to permit the use of ECHD chipers.


P.S.: Have you tried with all ?