[SOLVED] OpenSSL, fphttpclient, and Windows
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
edvard · 2017-07-20 08:22

Hello good folks, I have a bit of a problem. 
A while ago, I wrote a Pastebin app.  Simple really, nothing to get
excited about.  Lately, Pastebin.com has announced that by August 1st,
all calls to the API will be HTTPS-only, and calls to the API over
HTTP will be rejected.  No problem in the application, because
fphttpclient supports HTTPS, so I simply convert all the "http" in my
code to "https".  Voila!  It works for Linux and Mac, because most (if
not all) Linux distributions have OpenSSL installed by default, and
Mac users can find it a simple install step away.  Windows users... 

I did some testing in a Windows 10 VM, and the app works just fine as
long as OpenSSL binaries matching the application's architecture are
either present in the application directory, or copied to
C:\windows\system32.  So that means my Windows users have to search
for a binary, download one that matches the architecture of my
Pastebin app, unzip the archive, and finally place the .dll files in
the appropriate place.  I'd rather spare them that bit of pain.  "But
edvard," you might say, "your users downloaded and used your
application just fine, this should be trivial."  I'd like to say so,
but I'd rather be safe than sorry and make it as painless as
possible. 

Some things I've thought up (in order of difficulty):
1- Post a simple README on my SourceForge page that warns people of
the situation before downloading, and maybe some instructions.
2- Do a check if SSL is installed on the machine at app startup, and
popping up a warning (with instructions) if it is not found.
3- Use a network library other than fphttpclient that contains an SSL
implementation, so installing 3rd-party libraries is not necessary. 

There is a 4th option, bundling the DLLs in the package for Windows
users, but I am not interested in being a distributor of someone
else's binaries and keeping up to speed on all the licensing
requirements. 
I'd like to do #2, but I have no idea how to do such a simple check
(Google was no help). #3 could be elegant, or it could be a total
kluge, and I have no idea either way, SO:
- Do you think #1 should be enough? (I'm thinking it's the least I
should do, really)
- I like #2, but how would I implement it?
- Is #3 even possible? (using Indy, I suppose... dunno really)
- Is there another way to go about this that I am totally missing?

----------------------------------------------------------------------
balazsszekely · 2017-07-20 09:11

@edvard
Quote2- Do a check if SSL is installed on the machine at app startup,
and popping up a warning (with instructions) if it is not found
Lazarus already implemented this feature for you  :
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i uses
zipper, fphttpclient; function TForm1.IsOpenSSLAvailable:
Boolean;const  {$IFDEF WIN64}    cOpenSSLURL =
'http://packages.lazarus-ide.org/openssl-1.0.2j-x64_86-win64.zip'; 
{$ENDIF}  {$IFDEF WIN32}    cOpenSSLURL = 'http://packages.lazarus-
ide.org/openssl-1.0.2j-i386-win32.zip';  {$ENDIF}var  {$IFDEF
MSWINDOWS}  UnZipper: TUnZipper;  FHTTPClient: TFPHTTPClient; 
ParamPath, LibeayDLL, SsleayDLL, ZipFile: String;  {$EndIf}begin 
{$IFDEF MSWINDOWS}  ParamPath := ExtractFilePath(ParamStr(0)); 
LibeayDLL := ParamPath + 'libeay32.dll';  SsleayDLL := ParamPath +
'ssleay32.dll';  Result := FileExists(Libeaydll) and
FileExists(Ssleaydll);  if not Result then  begin    ZipFile :=
ParamPath + ExtractFileName(cOpenSSLURL);    FHTTPClient :=
TFPHTTPClient.Create(nil);    try      try       
FHTTPClient.Get(cOpenSSLURL, ZipFile);       except       end;   
finally      FHTTPClient.Free;    end;    if FileExists(ZipFile) then 
  begin      UnZipper := TUnZipper.Create;      try        try       
 UnZipper.FileName := ZipFile;          UnZipper.Examine;         
UnZipper.UnZipAllFiles;        except        end;      finally       
UnZipper.Free;      end;      DeleteFile(ZipFile);      Result :=
FileExists(Libeaydll) and FileExists(Ssleaydll);    end;  end; 
{$ELSE}  FOpenSSLAvailable := True;  {$ENDIF}end; procedure
TForm1.FormCreate(Sender: TObject);begin  if not IsOpenSSLAvailable
then    MessageDlg('OpenSSL dll''s are not available', mtInformation,
[mbOk], 0);end;

----------------------------------------------------------------------
edvard · 2017-07-20 09:13

I love this place.

----------------------------------------------------------------------
Phil · 2017-07-20 13:06

Quote from: edvard on July 20, 2017, 10:22:37 amand Mac users can find
it a simple install step away.  Windows users... 

All Macs include old version of OpenSLL libraries that have been
deprecated for many years:

https://developer.apple.com/library/content/documentation/Security/Con
ceptual/cryptoservices/SecureNetworkCommunicationAPIs/SecureNetworkCom
municationAPIs.html#//apple_ref/doc/uid/TP40011172-CH13-SW3

On Mac, instead of fphttpclient, use the ns_url_request unit here:

https://macpgmr.github.io/ObjP/nsunits-src.zip

It uses Apple's Secure Transport API.