🚀 go-pugleaf

"Lesley Anne" <mspfila-ng@yahoo.com> wrote in message
news:453d224b$1@newsgroups.borland.com...

> Does anyone have an example of how to add SSL when using IdHTTP->Post?

This has been asked and answered many times before.  Please search through
the Borland newsgroup archives at http://www.deja.com, and also browse
through the old messages on the news.atozed.com server.

> Indy has two SSL components: TIdServerIOHandlerSSL and
> TIdSSLIOHandlerSocket.  I'm assuming that since I'm on the client
> side of the connection that I would just use TIdSSLIOHandlerSocket.
> Is that right?

Yes.

> And then sometime before the call to Post() I would set:
>    IdHTTP1->IOHandler = IdSSLIOHandlerSocket1;

Yes.

> what functions (if any) do I need to call?

There are no function calls needed.


Gambit

Remy Lebeau (TeamB) wrote:
> Lesley Anne wrote:
>
> > Does anyone have an example of how to add SSL when using IdHTTP->Post?
>
> This has been asked and answered many times before.  Please search
> through the Borland newsgroup archives at http://www.deja.com, and
> also browse through the old messages on the news.atozed.com server.

I've spent a full day reading through lots of messages, and the only useful 
thing I've found is where to download the necessary library files from. 
There have been many mentions of SSL in Indy, sometimes using Intercepts and 
sometimes using IO Handlers.  (I did find a couple messages that mentioned 
Intercepts being the older version, so I think the choice to use the IO 
Handler is correct.)  Of those using the TIdSSLIOHandlerSocket and who even 
mention any of its properties (which most of the messages don't), there's 
apparently some people who just set things like Method and Mode, while other 
people set the various certificate and key files, but I didn't find any 
messages that indicated when one approach or the other is needed.  Nor could 
I find any explanations of what the different options are (beyond just their 
names).  Similarly, some examples set handlers for events such as 
OnGetPassword and OnVerifyPeer, while others didn't.  (And none of the 
examples I found showed what was actually done in those event handlers, 
making it harder to determine whether they were necessary.  I still don't 
know what they're supposed to be for).  I've seen a lot of responses that 
end with "and configure it as needed", but none that provide any clues for 
how to determine what's needed.

In the Indy Knowledge Base, the topic "I need SSL help, where can I find 
answers?" just gives a single line directing the reader to a page that 
doesn't exist (404).  The demos for Indy 9 don't include any projects that 
use SSL.  The help file doesn't contain descriptions on /any/ of the 
TIdSSLIOHandlerSocket members (and even the root TIdSSLIOHandlerSocket page 
of the help file has only two sentences of description).

Questions on this may have been asked many times before, but answers are a 
lot harder to come by.

> > Indy has two SSL components: TIdServerIOHandlerSSL and
> > TIdSSLIOHandlerSocket.  I'm assuming that since I'm on the client
> > side of the connection that I would just use TIdSSLIOHandlerSocket.
> > Is that right?
>
> Yes.
>
> > And then sometime before the call to Post() I would set:
> >    IdHTTP1->IOHandler = IdSSLIOHandlerSocket1;
>
> Yes.
>
> > what functions (if any) do I need to call?
>
> There are no function calls needed.

What about properties or events?  Are any of them needed?  I still haven't 
figured out what any of them really mean.  The machine must have whatever 
certificates and keys any Windows machine normally has, but how do I tell 
the IOHandler that?  And do I need to tell it that, or does it pick those up 
by default, or does it even need them on the client side?  (We're using SSL 
for its encryption rather than its authentication capabilities, but I don't 
know how much those can be separated.)

The following is all I have so far for posting to the server:


// XMLQuery and HTTPAddress are thread-global input variables.
// XMLResponse and Success  are thread-global output variables
// ReturnResult() is a thread function for responding to the main thread
// ------------------------------------------------------------------------
void __fastcall TUDPPostThread::Execute()
{
   TStringList           *RequestData  = new TStringList;
   TStringStream         *Output       = new TStringStream("");
   TIdHTTP               *IdHTTP1      = new TIdHTTP(NULL);
   TIdSSLIOHandlerSocket *SSLIOHandler = new TIdSSLIOHandlerSocket(NULL);

   Success = true;

   SSLIOHandler->SSLOptions->Method = sslvSSLv23;
   SSLIOHandler->SSLOptions->Mode = sslmClient;
   SSLIOHandler->SSLOptions->VerifyDepth = 0;
   IdHTTP1->IOHandler = SSLIOHandler;
   IdHTTP1->ProtocolVersion = pv1_0;
   IdHTTP1->Request->Accept = "text/html, */*";
   IdHTTP1->Request->ContentLength = 0;
   IdHTTP1->Request->ContentRangeEnd = 0;
   IdHTTP1->Request->ContentRangeStart = 0;
   IdHTTP1->Request->ContentType = "application/x-www-form-urlencoded";
   IdHTTP1->Request->UserAgent = "Mozilla/3.0 (compatible; Indy Library)";

   RequestData->Add(XMLQuery);

   try {
      IdHTTP1->Post(HTTPAddress, RequestData, Output);
   } catch (EIdHTTPProtocolException &E) {
      Success = false;
      XMLResponse = "EIdHTTPProtocolException: " + E.ErrorMessage;
   } catch (EIdException &E) {
      Success = false;
      XMLResponse = "EIdException: " + E.Message;
   }

   if (Success)
        XMLResponse = Output->DataString;

   Synchronize(ReturnResult);

   delete RequestData;
   delete Output;
   delete IdHTTP1;
   delete SSLIOHandler;
}
// ------------------------------------------------------------------------


Even the few properties I did set here involved some guesswork, and I don't 
know whether I guessed correctly.  For instance, several of the code 
snippets I've seen in other messages set Mode to sslmUnassigned, but I set 
mine to sslmClient simply because I couldn't think of what "unassigned" 
could mean here.  Which is the right one to use?

"Lesley Anne" <mspfila-ng@yahoo.com> wrote in message
news:453e6ae5$1@newsgroups.borland.com...

> I've spent a full day reading through lots of messages, and the only
> useful thing I've found is where to download the necessary library
> files from.

I know for a fact that people have posted detailed information about which
properties to set and how.  Where exactly are you searching, and what search
criteria are you using?

> In the Indy Knowledge Base, the topic "I need SSL help, where can I
> find answers?" just gives a single line directing the reader to a page
> that doesn't exist (404).

Did you try reading the tutorial on that same website?

    IndySSL tutorial 1

http://www.intelicom.si/www.nsf/docs/6ERHETDSTR?opendocument&cat=11&doc=6ERHETDSTR&lang=en

> What about properties or events?  Are any of them needed?

That depends on the particular server you are trying to connect to.  Some do
require extra setup, and some don't.


Gambit

"Remy Lebeau (TeamB)" <no.spam@no.spam.com> wrote in message
news:453e6cfd$1@newsgroups.borland.com...

> I know for a fact that people have posted detailed information about
> which properties to set and how.  Where exactly are you searching,
> and what search criteria are you using?

Have you read the posts in the SSL newsgroup on the news.atozed.com server?


Gambit

Remy Lebeau (TeamB) wrote:
>
> I know for a fact that people have posted detailed information
> about which properties to set and how.  Where exactly are you
> searching, and what search criteria are you using?

Apart from a quick (and unproductive) check of the Indy Knowledge Base, I 
started off searching at Google Groups (the "all words" option) for "Indy 
SSL".  Then I tried a search for "TIdSSLIOHandlerSocket".  I also did 
searches on "Indy SSLOptions" and "Indy SSL demo".  There were thousands of 
results, so of course I couldn't check all of them.  I picked out perhaps a 
couple hundred message threads where I thought the short snippet that showed 
up on the google results page looked promising.  I have no doubt you're 
right that that detailed information is out there somewhere, but only a 
little of it was in any of the threads I picked to read.

Then I also went to the indy.encryption.ssl group on news.atozed.com.  (In 
retrospect, I suppose I should have started out there to begin with.)  I 
checked about a hundred messages there, picking whichever thread titles 
looked promising, but there are another 558 messages in that group which I 
haven't read yet.


> Did you try reading the tutorial on that same website?
>
>    IndySSL tutorial 1
>
> http://www.intelicom.si/www.nsf/docs/6ERHETDSTR?opendocument&cat=11&doc=6ERHETDSTR&lang=en

I saw that and skimmed over it, but got frustrated when the first half of 
the article was about how to use another utility.  It claimed that: "With 
IndySSL dll's we distribute also the precompiled openssl.exe utility that 
can be used to do the conversion."  In fact that's not true.  The download 
they have for the dll's contains /only/ the two dll's and a short readme 
file saying who developed them.  Anyway, when the article finally got to 
setting up the IdSSLIOHandlerSocket properties, it of course was mostly just 
setting them to the results of that missing utility.  I suppose tomorrow 
I'll try another search to find that utility.  If they no longer have it, 
maybe somebody else does.  If I can find it, then it'll be worth taking a 
closer look at that article.  (And perhaps worth looking at it when I'm not 
as tired.  I was already getting rather frustrated by the time I found this 
article, so I may have given it less attention than it deserves.)


> > What about properties or events?  Are any of them needed?
>
> That depends on the particular server you are trying to connect to.
> Some do require extra setup, and some don't.

OK.  We don't have direct control over the server, since it belongs to 
another department and they're outsourcing their side of the development, 
but it is being developed specifically for our client application, so they 
should be willing to talk to me about it.  I'll see if our product managers 
can get me in touch with whoever is developing that side.