mORMot Open Source

Hi ab,

i must access some informations from the certificate from the peer for a connect client (THttpClientSocket).
Via the TNetTlsContext there is allready access to some Information (PeerIssuer,PeerSubject)
and if TNetTlsContext.WithPeerInfo = true also the full information (PeerInfo) in a text represantation.

Is it possible to append "CertInfo: TX509Parsed;" to the TNetTlsContext-Record and assign it to the NetTlsContext?

With the addition to the TNetTlsContext and a change in mormot.net.sock.windows.inc / TSChannelNetTls.AfterConnection line 2100

if Context.WithPeerInfo then
   WinInfoToParse(nfo,Context.CertInfo);

the infos are accessible for the client. For this to work i must also put the definition of WinInfoToParse in the inferface part.

{$ifdef OSWINDOWS}
procedure WinInfoToParse(const c: TWinCertInfo; out Info: TX509Parsed);
{$endif}

not perfect and also only working for win/schannel at the moment.

Other option would be to fill the TX509Parsed via the PeerInfo-Text, but i didn't find a function in your great framework to interpret the text (opposite of ParsedToText). And maybe the PeerInfo text key-names are not a defacto-standard?

Maybe it is also possible to implement something that is already there for openssl (GetPeerCertFromUrl(const url: RawUtf8): PX509DynArray;) for the other clients (socket/schannel,...)

Be aware that there seems to be a breaktion change with the certificate-chain order in some windows-versions. Found this on curl implemention:

https://github.com/curl/curl/issues/9706

One use case would be:

Request the external wan-ip via a service (for example: https://ipv4.seeip.org). Make a connect with (IgnoreCert and WithPeerInfo) to find the webserver - hostname/common-name and maybe the alt.names from a service inside the lan, that don't know the public dns-names. After that the service can check if the "websites, https" is running via a second request. -> "Self Monitoring" https-endpoint from inside without the info from  a config what url to monitor.

Thanks.

Best regards,
Tobias

Hi ab,
i try to decode a X509-certificate from a pem. The certificate is from a TSE (Technische Sicherheits Einrichtung) that is needed for the german law to sign cashregister transactions.
The TX509Parse give me a "false". In "TXTbsCertificate.FromDer" and in "TX509.LoadFromDer" there is a big If-Check - sadly with out the reason for the "false".

After many steps in the debugger i see that the false comes from:

OidToXsa - '1.2.840.10045.4.3.3' is not in the ASN1_OID_SIGNATURE - definition. (OID 1.2.840.10045.4.3.3 ecdsa-with-SHA384) so is this a reason to give a false result?
sorry wrong ...
OID: '1.2.840.10045.2.1' OID2: '1.3.36.3.3.2.8.1.1.11' in OidToXka is not valid result = xkaNone  - OID 1.3.36.3.3.2.8.1.1.11 seems to be "brainpoolP384r1" (https://learn.microsoft.com/en-us/windo … tic-curves)

FYI. this a hardware modul no software

If you whant do debug it youself here is the cert:
(string is without -----BEGIN CERTIFICATE-----#10 ... #10 -----END CERTIFICATE----- and linebreaks)

A Quick test via Online-Decode (https://www.sslshopper.com/certificate-decoder.html) gives me a valid result.

Certificate Information:
Common Name: 74024ea9846d8d438cb8c974af51602d0647403b723e7175f015fc0a38d601f0
Subject Alternative Names:
Organization: Swissbit AG
Organization Unit:
Locality:
State:
Country: DE
Valid From: September 13, 2022
Valid To: August 13, 2028
Issuer: TSE CA 1, T-Systems International GmbH
Serial Number: 2efc649c9776636526782db14e2646f9

Thank you again!

Hi,

i give the generator a quick try againt a "PostgREST (https://postgrest.org/)" api. Generation works. But i must some changes in the client to support the the login on the api (AuthBearer)

The Login route looks like this in the automatic generated openapi (v1) from the PostgREST-Service:

  "/rpc/login": {
      "get": {
        "parameters": [
          {
            "format": "text",
            "in": "query",
            "name": "email",
            "required": true,
            "type": "string"
          },
          {
            "format": "text",
            "in": "query",
            "name": "pass",
            "required": true,
            "type": "string"
          }
        ],
        "produces": [
          "application/json",
          "application/vnd.pgrst.object+json;nulls=stripped",
          "application/vnd.pgrst.object+json"
        ],
        "responses": {
          "200": {
            "description": "OK"
          }
        },
        "tags": [
          "(rpc) login"
        ]
      },

the via mopenapi.exe generated procedure for this route is:

procedure TAPIClient.GetRpcLogin(const Email: RawUtf8; const Pass: RawUtf8);

After i have change it to parse and return variant. It get the result token via json.

Is "produces": ["application/json"] not supported? - what is the right way to get the result from the ApiClient/IJsonClient?

But with the mod i got it working:

  
  c := TJsonClient.Create('https://postgrest.domain.tld','');
  api := TAPIClient.Create(c);
  v := api.GetRpcLogin('user@domain.tdl','SomePassword');
  d := DocDictFrom(v);
  s := d.U['token'];
  c.Http.Options.Auth.Scheme := wraBearer;
  c.Http.Options.Auth.Token := s;
  //next calls with token
  artArr := api.GetArticle;

Also it would be nice to give the generator or created object (TAPIClient/TJsonClient) the some hints and params so that the login results in a prefilled auth infos after login.

It was just a quick test for me, so no not critical for me, just a hint and maybe feature improvement for you ab.

Maybe it is also a lack of none standard generation of openapi-spec from PostgREST.

Many thanks for your work on this module of the framework @Andreas and @ab

Hi Arnaud,

today i tried agl.exe / mormot.app.agl.pas. It works perfectly for my use case. But i have a problem with a process that has a URI in the params.

For example "powershell" -command "$l = New-Object System.Net.HttpListener ; $l.Prefixes.Add('http://127.0.0.1:8080/'); $l.Start(); ..."

Problem detected in mormot.app.agl.Exec. "NormalizeFileName" is also done on the params. So "http://127.0.0.1:8080/" under Windows becomes "http:\\127.0.0.1:8080\". Under Unix, the same probably happens with backslashes in the parameters.

Thanks ab, for this great framwork!

Kind regards,
Tobias

Hi,

if i want to update the pivot-table with new entries i call "PivotTable.ManyAdd" with NoDuplicates=true. But the result is false if the record allready exists.

So the is no difference between ignore insert and a false result because of the false result from Client.Add or UseBatch.Add.

Maybe set the result to true if InternalIDFromSourceDest<>0 is better?

  if NoDuplicates and
     (InternalIDFromSourceDest(aClient, aSourceID, aDestID) <> 0) then
    begin
    result := true;
    exit; // this TRecordReference pair already exists
    end;

best regards,
Tobias