mORMot Open Source

There are two options, choose the appropriate one:

1. Include mormot.crypt.openssl and mormot.lib.openssl11, define USE_OPENSSL and FORCE_OPENSSL in project options and call RegisterOpenSsl. Then use CryptCertOpenSsl[caaRS256].

2. Include mormot.crypt.x509, call RegisterX509 and then use CryptCert[caaRS256].

For DNS challenge we need to change DNS server configuration, and provide DNS record with Key:

_acme-challenge.www.example.org. 300 IN TXT "gfj9Xq...Rg85nM"

You can change in TAcmeClient.CreateOrder line from "if v2[0].Idem('HTTP-01') then" to "if v2[0].Idem('DNS-01') then" and use OnChallenges callback.

In callback modify your DNS server configuration to provide DNS record.

If this works for you, we can in mORMot add TAcmeClient.ChallengeType property (or change TAcmeChallenge record and add DnsUrl, DnsToken and DnsKey fields).

You need to override abstract methods of TOrmPropInfo. I did not provide my solution because it contains some specific application logic.

For example see TOrmPropInfoRttiVariant.

Main methods is SetValue and GetValue.

For example:

procedure TOrmPropInfoVariantArray.SetValue(Instance: TObject; Value: PUtf8Char;
    ValueLen: PtrInt; wasString: boolean);
var
    V: PVariant;
    tmp: TSynTempBuffer;
begin
    V := GetFieldAddr(Instance);
    if ValueLen > 0 then
    begin
        tmp.Init(Value, ValueLen);
        try
            GetVariantFromJsonField(tmp.buf, wasString, V^, nil);
        finally
            tmp.Done;
        end;
    end
    else
        VarClear(V^);
end;

procedure TOrmPropInfoVariantArray.GetValueVar(Instance: TObject; ToSql:
    boolean; var result: RawUtf8; wasSqlString: PBoolean);
var
    wasString: Boolean;
    V: PVariant;
begin
    V:= GetFieldAddr(Instance);
    VariantToUTF8(V^, result, wasString);
    if wasSQLString <> nil then
        wasSQLString^ := not VarIsEmptyOrNull(V^);
end;

Also, you need override NormalizeValue (do nothing), GetBinary and SetBinary (see TOrmPropInfoRttiVariant).

Yes. Then, in SQL queries, you can use database functions to work with JSON, like json_extract and etc.

But there is more complex way, if you need separate fields in database.

Create TOrmPropInfoCustom descendant that can store your fields in any way. And override InternalRegisterCustomProperties to add your props.

class procedure TOrmMyEntity.InternalRegisterCustomProperties(Props: TOrmProperties);
var
    i: Integer;
begin
    inherited InternalRegisterCustomProperties(Props);
    for i := 0 to Length(FMyProps) - 1 do
        Props.Fields.Add(TOrmPropInfoMyField.Create(..., {aProperty=}@TOrmMyEntity(nil).FMyValues[i]));
end;

It's a bug in mormot.lib.sspi.pas.

CertOpenStore does not have CertOpenStoreA and CertOpenStoreW variants.

Ansi or Unicode usage depends on first parameter, for example CERT_STORE_PROV_SYSTEM_A or CERT_STORE_PROV_SYSTEM_W.

P.S.

And first parameter is PAnsiChar, so:

var LProvider: AnsiChar := #10; // CERT_STORE_PROV_SYSTEM_W
var LMy: UnicodeString := 'MY';

This code works for me:

function SendTgDoc(const Token, Chat, Text: RawUtf8;
    const Doc: RawByteString): boolean;
var
    LMultiPart: THttpMultiPartStream;
    LContentType, LData: RawUtf8;
    LClient: THttpClientSocket;
begin
    LMultiPart := THttpMultiPartStream.Create();
    try
        LMultiPart.AddContent('chat_id', Chat, 'text/plain');
        LMultiPart.AddContent('caption', Text, 'text/plain');
        LMultiPart.AddFileContent('document', 'attach.pdf', Doc, 'application/pdf', 'binary');
        LMultiPart.Flush();
        LClient := THttpClientSocket.Open('api.telegram.org', '443', nlTcp, 5000, True);
        try
            LClient.Post('/bot' + Token + '/sendDocument',
                LMultiPart, LMultiPart.MultipartContentType);
        finally
            LClient.Free();
        end;
    finally
        LMultiPart.Free();
    end;
end;

For example, this works:

{{#Equals Category,"Admin"}}Welcome, Mister Administrator!{{/Equals}}

But this doesn't work:

{{#Equals "Admin",Category}}Welcome, Mister Administrator!{{/Equals}}

I think problem at line 705 in mormot.core.mustache.pas.
In case when value starts from digit, '"', '[' or '{' it is being interpreted as single JSON value.

Please try the following changes:

--- a/src/net/mormot.net.acme.pas
+++ b/src/net/mormot.net.acme.pas
@@ -868,8 +868,8 @@ var
 begin
   try
     // Generate a new PKCS#10 Certificate Signing Request
-    csr := fHttpClient.fCert.CertAlgo.CreateSelfSignedCsr(
-      fSubjects, aPrivateKeyPassword, pk);
+    csr := PemToDer(fHttpClient.fCert.CertAlgo.CreateSelfSignedCsr(
+      fSubjects, aPrivateKeyPassword, pk));
     // Before sending a POST request to the server, an ACME client needs to
     // have a fresh anti-replay nonce to put in the "nonce" header of the JWS
     fHttpClient.Head(fNewNonce);

Note, there is added PemToDer conversion.

Also, in TRestStorageExternal methods like EngineList or EngineRetrieve and so on, exceptions are supressed in try..except block, without being stored anywhere.

In 64-bit Linux type THandle cannot be used in resource management functions, because it's 32-bit file handle, but HInstance handles are 64-bit. This leads to Access Violation error. We must use PtrUInt (or TLibHandle) instead.

I see problems in:
ResourceToRawByteString, ResourceSynLZToRawByteString, TExecutableResource, TSynTimeZone, TZipRead.

Can we make PostgreSQL pipelining optional (in mormot.db.raw.postgres.pas)?

My problem: I create Windows 32-bit application, and use 32-bit libpq.dll. But 32-bit builds available only up to version 12, and has no pipelining support.
Version 14 with pipelining support has only 64-bit builds.

So now I changed ESqlDBPostgres to nil in call to Resolve.

May be there is a 32-bit libpq.dll with pipelining?

In previous example I use two useBidirSocket servers, one for HTTP, and one for HTTPS. But REST-server NotifyCallback can be used only with one useBidirSocket server (last registered).

Also, ConnectionID of those two useBidirSocket servers is the same, so we can not distinguish between them in IsActiveWebSocket, even if we can call NotifyCallback of all HTTP-servers.

Try this:

<script>
    window.templates = {};
    window.templates.vtSettings = '{{ToJson VTSettings}}';
</script>

Yes, It helps.

But I think the root case is in the TRttiProp.SetVariantProp - it does not handle varVariantByRef.
But varByRef used in many parts of the core units.

For example, TOrm.SetFieldVariant may also be affected:

 v := _Json('{arr:[1,2]}');
 a.SetFieldVariant('Opts', v.arr); // v.arr will be returned by reference

Great, everything works now.
Thanks!

Yes, it works (now only ES256).
But I can adopt it to use DerParse for 32, 48 or 66 bytes of signature (ECC_SIZE).
P.S.
It's not so simple, because for ES512 there is 2-byte length value in DER:
https://gist.github.com/achechulin/3212 … b0595bfc24

Something like this:

var
  doc: variant;
begin
  doc := _Arr([]);
  // or TDocVariantData(doc).Init(mDefault, dvArray)

  with _Safe(doc)^ do
  begin
    // add new item
    AddItem(MESSAGE_FORTUNES);
  end;

  // or 
  P := _Safe(doc);
  P^.AddItem(MESSAGE_FORTUNES);
end;

I do not use package and do not use mormot.core.fpcx64mm.
I use FPC 3.2.3-554-g8b21bf1cce, and may be it's too old.

In my case RedirectRtlCall calls RedirectCode($FFFFFFFFF14BF09F, $0000000000D659E0) - function address invalid - negative, and then AV.
With latest version (2.0.3676) there is no changes.
Generated ASM for _fpc_setstring_ansistr:
https://drive.google.com/file/d/1GqN080 … sp=sharing

After latest changes (added TOpenSslNetTls.SetupCtx), browser asks client certificate when connecting via HTTPS:
https://drive.google.com/file/d/1SoyGOv … Rk0ZDmH1t/

So, we need to change IgnoreCertificateErrors to True to avoid client certificate request.
But this can be done only in THttpServerSocketGeneric.WaitStarted.

May be add new option to THttpServerOptions, like hsoTlsClientCert (or some other name, hsoTlsVerifyPeer?), and in WaitStarted:

  // now the server socket has been bound, and is ready to accept connections
  if (hsoEnableTls in fOptions) and
     (CertificateFile <> '') and
     (fSock <> nil) and // may be nil at first
     not fSock.TLS.Enabled then
  begin
    ...
    fSock.TLS.IgnoreCertificateErrors := not (hsoTlsClientCert in fOptions);
    InitializeTlsAfterBind; // validate TLS certificate(s) now
    ...
  end;

Some little patches.

For mormot.net.server.pas, in THttpServerSocketGeneric.WaitStarted, because for WIndows CertificateFile is enough:

@ -1620,7 +1620,7 @@ begin
  until false;
  // now the server socket has been bound, and is ready to accept connections
  if (hsoEnableTls in fOptions) and
-    (PrivateKeyFile <> '') and
+    (CertificateFile <> '') and
     not fSock.TLS.Enabled then
  begin
    StringToUtf8(CertificateFile, fSock.TLS.CertificateFile);

For mormot.net.sock.windows.inc, in TSChannelNetTls.AfterBind, for proper error when .pfx can not be read:

@ -1117,6 +1117,8 @@ begin
    // openssl pkcs12 -inkey privkey.pem -in cert.pem -export -out mycert.pfx
    fAcceptCertStore := PFXImportCertStore(@blob, nil,
      PKCS12_INCLUDE_EXTENDED_PROPERTIES);
+   if fAcceptCertStore = nil then
+     ESChannelRaiseLastError(SEC_E_CERT_UNKNOWN);
  end;
  // find first certificate in store
  fAcceptCert := CertFindCertificateInStore(fAcceptCertStore, 0, 0,

For mormot.net.async.pas, in TPollAsyncSockets.ProcessRead, because working thread terminates after exception in TLS code:

@ -1353,7 +1353,13 @@ begin
           not (fFirstRead in connection.fFlags) then
        begin
          include(connection.fFlags, fFirstRead);
-         fOnFirstRead(connection); // e.g. TAsyncServer.OnFirstReadDoTls
+         try
+          fOnFirstRead(connection); // e.g. TAsyncServer.OnFirstReadDoTls
+         except
+           // TLS error -> abort
+           UnlockAndCloseConnection(false, connection, 'ProcessRead OnFirstRead');
+           exit;
+         end;
        end;
        repeat
          if fRead.Terminated or

Thanks for merge.
But I see commit in history:
https://github.com/synopse/mORMot2/comm … 057af03443
May be it's wrong? Git is quite complex.

For infomation, patch to use OpenSSL 3.0 (installed on Ubuntu 22.04):
https://gist.github.com/achechulin/adbb … 1810dc78c6

ab, can I use mormot.lib.sspi in mormot.net.sock.windows.inc?

And why we load secur32.dll dynamically? It's available since Windows 95 and Windows NT 4 with installed Directory Service Client, and always available on Windows 2000.