LNET v0.66 doesn't support TLS 1.2 and 1.3
lazarus / 38-Networking and Web Programming

----------------------------------------------------------------------
han · 2019-08-25 17:08

It looks like LNET v0.66 is outdated. Default it tries the old
transport layer protocol SSL v2 or SSL v3. This fails with the latest
OpenSSL v1.1.1.

I managed to force the available TLC 1.0 but that is also outdated and
doesn't seem to work for all webpages.  Ideally LNET should be updated
for TLS 1.2 or 1.3.

See: https://en.wikipedia.org/wiki/Transport_Layer_Security

and topic https://forum.lazarus.freepascal.org/index.php/topic,46382.m
sg331613.html#msg331613

Is there anybody who can pick the mayor task of updating LNET v0.66?

----------------------------------------------------------------------
k1ng · 2019-08-25 17:57

Can you post a link to the github page of latest version?

But maybe it's better to update to something which is maintained/more
widely used. If it still doesn't support TLS1.1 and TLS1.2...sounds
kinda dead for a long time!

----------------------------------------------------------------------
han · 2019-08-25 18:50

Here are the links:

https://wiki.lazarus.freepascal.org/lNet
https://lnet.wordpress.com/

https://github.com/almindor/lnet/commits/master

To my surprise the Github version (initial commit 1-1-2019) is
including some new patches for TLS That's new to me. It mentions also
TLS 1.2, so maybe my assumption that it didn't support TLS 1.2 is
wrong. So there is some life in the development . I will try the
patched version still called version 0.66.

----------------------------------------------------------------------
han · 2019-08-26 21:24

LNET with patches no success. Error message in Lubuntu 19.4:

Unable to initialize OpenSSL library, please check your OpenSSL
installation.


I'm using FPC 3.2 downloaded via SVN.

----------------------------------------------------------------------
Tz · 2019-08-27 03:33

check your lnetssl.pp,  call InitSSLInterface;  once

procedure TLSSLSession.CreateSSLContext;
var
  aMethod: PSSL_METHOD;
begin
  if not IsSSLloaded then
    raise Exception.Create('Unable to initialize OpenSSL library,
please check your OpenSSL installation');

  if Assigned(FSSLContext) then
    SSLCTXFree(FSSLContext);
   
  if not FSSLActive then
    Exit;

  case FMethod of
    msSslTLS   : aMethod := SslMethodTLSV1_2; // DEPRECATED
    msSSLv2or3 : aMethod := SslMethodV23;
    msSSLv2    : aMethod := SslMethodV2;
    msSSLv3    : aMethod := SslMethodV3;
    msTLSv1    : aMethod := SslMethodTLSV1;
  end;

try change
    msSslTLS   : aMethod := SslTLSMethod; // New method

----------------------------------------------------------------------
han · 2019-08-27 10:39

I tried but InitSSLInterface doesn't solve the problem. See attached
screenshot. I have raised an issue at Github.

----------------------------------------------------------------------
Tz · 2019-08-27 11:31

Dear Han,

try update openssl.pas

initialization
  InitCriticalSection(SSLCS);
  InitSSLInterface;   // compatibility for version under 1.1.0  try
add this


simple program to check

Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i program
testopenssl;{$mode objfpc}{$h+}uses OpenSSL; begin        WriteLn('is
openssl loaded: ', isSSLLoaded);       
WriteLn(OpenSSL_unavailable_functions);end.

----------------------------------------------------------------------
han · 2019-08-27 16:16

Tz,

Finally it works!!  Thank you !! 

There was some confusion. Initially I thought you provided an updated
of Lopenssl in the Lnet lib directory. However Lnet is using openssl
at  fpc/packages/openssl/src/openssl.pp

By placing the new openssl.pp. zcrypto.pp  in the Lnet lib directory
it uses now this updated openssl.pp. So the problem was solved by only
placing the openssl.pas in the lib directory of Lnet. What is the
difference between the new one and the one provided by FPC 3.2 ??

Han


p.s for the record, attached the openssl.pp and zcrypto.pp provided by
Tz to be placed in the Lnet lib directory. Furthermore download Lnet
with the latest 2019 patches from Github.

----------------------------------------------------------------------
han · 2019-08-28 17:00

Hello Tz,

The author of Lnet is online. Could you give him a hint why your
version of OpenSSL works? See

https://github.com/almindor/lnet/issues/4

Thanks again for your help!

Han

----------------------------------------------------------------------
Tz · 2019-09-02 05:38

Hi Han,

nothing special I just get from svn trunk

https://www.freepascal.org/docs-html/current/user/userse73.html

and add some function for my purpose

just search for comment "// Tz"  which line I added

or just use diff utility for comparison

happy coding