Act nowcan affect a running systemReviewed all 19 non-merge commits from build 2.4.17190 through 2.4.17208: 1176 additions and 372 deletions across 11 non-version files. Version-only changes in mormot.commit.inc and mormot.commit-num.inc were ignored. The raw payload has no superseded_by links, so avoid and still_moving remain empty; the final upstream head still matches the payload head.
SChannel turns on TLS 1.3 as Windows CNG support comes together
This Windows-heavy series changes the default SChannel protocol policy, shares server credentials across accepted HTTPS connections and adds substantial CNG, certificate-store and msLAPS support. The final commits also close Delphi 7 and Delphi 13 compilation gaps, protect Wine from stubbed CNG APIs and fix ownership around certificate private keys.
TL;DR
- Land on build 2.4.17208 at 18e7d88c0083b279402c59019c030abdfe39e3e1.
- SChannelEnableTls13 now defaults to true on Windows 11 and Windows Server 2022 or newer; set it false before initialization if that rollout is not intended.
- HTTPS servers using SChannel now acquire one shared server credential and keep it alive until the last accepted TLS context is released.
- TNetTlsContext can feed SChannel a PCCERT_CONTEXT or password-protected PFX and ReleaseBuffers now releases idle SChannel buffers.
- New TNCrypt, TWinCertStore and TWinCertCngKey wrappers expose CNG keys, certificate stores, signing, secret unprotection and msLAPS decryption.
- Wine skips its stubbed CNG layer, while Delphi 7 and Delphi 13 receive explicit compilation repairs.
Upgrade advice
Windows SChannel users should pull the complete edition through build 2.4.17208, then test TLS 1.3 negotiation, certificate/PFX loading and server shutdown under concurrency. Set SChannelEnableTls13 to false before TLS initialization only when the new default is not yet acceptable. Delphi 7, Delphi 13 and Wine users should not stop before the final compatibility fixes.
19 of 19 entries · 19 commits upstream
1
High
TLS 1.3 becomes the SChannel default on current Windows
The public SChannelEnableTls13 global changes its default from false to true. The flag is applied only on Windows 11 and Windows Server 2022 or newer and remains an opt-out switch.
Breaking changes
mormot.net.sock
f479106f+6-5
net: now SChannelEnableTls13 default is true
Impact
Eligible SChannel clients and servers may negotiate TLS 1.3 without an application code change. Protocol behavior can therefore change silently after rebuilding.
Worth a look
Test handshakes, cipher policy and peer compatibility; set SChannelEnableTls13 := false before TLS initialization if rollout must wait.
Public API
SChannelEnableTls13behaviour-changed — Default is now true on supported Windows versions.
Units
2
High
Certificate record layouts are corrected after the Crypt32 expansion
The Crypt32 types are moved into mormot.core.os.security and their pointer, blob and record declarations are corrected so mormot.lib.sspi compiles against them.
Fixes
mormot.core.os.security+1
d73d5445+14-8
lib: fixed mormot.lib.sspi compilation
Impact
This repairs the immediately preceding Windows binding change. Delphi and FPC projects should not consume the earlier intermediate revision alone.
Upgrade recommended
Take this together with the preceding Crypt32 binding commit, or use the final edition head.
3
High
SChannel certificate-key ownership is corrected on PRISM
TSChannelNetTls.AfterBind stops requesting CRYPT_ACQUIRE_CACHE_FLAG, initializes ownership outputs for every certificate and releases acquired CAPI or CNG handles when the API says the caller owns them.
Fixes
mormot.core.os.security+1
86828b99+12-3
net: fixed TSChannelNetTls.AfterBind on PRISM
Impact
SChannel server setup avoids stale output state and leaked private-key handles, including on PRISM targets. No source migration is required.
Upgrade recommended
Upgrade Windows SChannel servers that bind certificate private keys and retest shutdown/rebind paths.
4
High
Logging serialization and SChannel acceptance compile after the new flags
TWindowsSpecs serialization in mormot.core.log grows from byte to word after wsWeakCng is added, and the SChannel accept path stores the shared context in a TObject local before casting.
Fixes
mormot.core.log+1
37405644+9-6
core: fixed compilation after previous commits
Impact
This closes compilation issues introduced by the preceding Windows-spec and shared-context work. No application source change is required.
Upgrade recommended
Take the Wine flag and shared SChannel context together with this compiler follow-up.
5
High
SChannel accepts certificate contexts and password-protected PFX input
The SChannel backend implements TNetTlsContext.CertificateRaw, PrivatePassword and OnPrivatePassword for server certificates, implements ReleaseBuffers, validates accessible private keys and explicitly rejects unsupported ClientCertificateAuthentication.
New features
mormot.lib.sspi+2
3f0914a0+76-31
net: enhanced SChannel TLS layer
Impact
Windows servers can supply an existing PCCERT_CONTEXT or a protected PFX without OpenSSL. Configurations that request SChannel client-certificate authentication now fail explicitly instead of appearing supported.
Worth a look
Test certificate import, password callbacks and idle-buffer release; do not enable ClientCertificateAuthentication on SChannel.
Public API
TNetTlsContext.CertificateRawbehaviour-changed — SChannel server now consumes a PCCERT_CONTEXT.TNetTlsContext.PrivatePasswordbehaviour-changed — Used as the SChannel PFX import password.TNetTlsContext.OnPrivatePasswordbehaviour-changed — Can override the SChannel PFX password.INetTls.ReleaseBuffersbehaviour-changed — SChannel now releases idle read/write buffers.
6
High
A certificate-to-CNG-key wrapper centralizes ownership checks
TWinCertCngKey acquires a certificate private key, requires a CNG handle, optionally compares it with the certificate public key and releases it according to CryptAcquireCertificatePrivateKey ownership. Related constants move into core Windows security.
New features
mormot.core.os+3
73dc5e6a+87-20
lib: new TWinCertCngKey wrapper
Impact
SChannel and other Windows backends get one checked lifetime boundary for certificate-backed CNG signing keys, reducing leaks and accidental use of CAPI handles.
Worth a look
Use Init/Done as a pair and enable CompareKey when certificate/key mismatch must be rejected.
Public API
TWinCertCngKeyadded — Short-lived checked wrapper for a certificate CNG private key.
7
High
SChannel HTTPS servers share one credential across connections
TSChannelNetTls.AfterBind creates a reference-counted TSChannelServerContext containing the server CredHandle. Accepted connections share it and release it only after their own security contexts are gone.
Performance
mormot.net.sock.windows
73798d46+193-140
net: shared credentials for the HTTPS server using SChannel
Impact
Busy Windows HTTPS servers avoid per-connection AcquireCredentialsHandleW calls and get explicit credential lifetime ordering. The wire protocol and application API are unchanged.
Upgrade recommended
Load-test SChannel accept/shutdown cycles and confirm credential handles disappear after the last active connection.
8
High
The TLS factory declaration is made compatible with Delphi 7
mormot.net.sock introduces the public TNewNetTls function type for NewNetTls and moves a local character constant to module scope to satisfy Delphi 7.
Compiler & platform
mormot.net.sock
a51ffadf+11-7
net: fixed Delphi 7 compilation
Impact
Delphi 7 projects regain compilation after the surrounding TLS changes. Other compilers see a named type for the existing factory variable.
Upgrade recommended
Delphi 7 users should take this fix together with the complete SChannel series.
Public API
TNewNetTlsadded — Public function type now used by NewNetTls.
Units
9
High
The final SChannel certificate path compiles on Delphi 13
mormot.net.sock.windows removes an explicit PCCERT_CONTEXT cast when passing Context.CertificateRaw to CertDuplicateCertificateContext, matching Delphi 13's type checking.
Compiler & platform
mormot.net.sock.windows
18e7d88c+3-4
net: fixed Dlephi 13 compilation
Impact
Delphi 13 projects using the new SChannel CertificateRaw path compile at the final edition head. Runtime behavior is unchanged.
Upgrade recommended
Delphi 13 users should land on this final commit rather than an earlier point in the SChannel series.
10
Medium
Certificate metadata and CNG signing details are hardened
TWinCertInfo records provider type, flags and key spec; certificate enumeration bindings are added; NTE_BAD_PUBLIC_KEY is named; and the ECDSA signing path initializes the PKCS#1 algorithm pointer to nil.
Fixes
mormot.core.os+2
6e9ef943+44-15
core: enhanced Windows SSPI/CNG API wrappers
Impact
Certificate consumers get the provider information needed to choose CAPI versus CNG, and ECDSA signing no longer passes uninitialized padding metadata.
Upgrade recommended
Upgrade users of the new CNG signing path and validate RSA plus ECDSA certificates from each target provider.
Public API
TWinCertInfo.KeyProviderTypeadded — Exposes the certificate key provider type.TWinCertInfo.KeyProviderFlagsadded — Exposes provider acquisition flags.TWinCertInfo.KeySpecadded — Exposes the certificate key specification.
11
Medium
The CNG wrapper gains complete property, signing and decrypt helpers
TNCrypt adds typed handles, hash and signing modes, raw OpenKey/GetProperty/SignHash/Decrypt operations, and higher-level GetCardinal, GetBuffer, KeyBits, KeyUsage and KeySign methods.
New features
mormot.lib.sspi
6a4f0636+250-24
lib: completed CNG API wrapper
Impact
Windows backends can inspect and use CNG private keys, including RSA PKCS#1/PSS and ECDSA signing, through checked wrappers that raise ENCrypt on failure.
Worth a look
Select TNcryptSignMode explicitly, verify provider key usage and test signatures against an independent verifier.
Public API
TNcryptHashAlgoadded — Public hash selector for CNG signing.TNcryptSignModeadded — Public RSA/ECDSA signing mode selector.TNCrypt.KeySignadded — High-level checked CNG signing helper.
Units
12
Medium
Windows certificate stores gain an owning iterator and PEM export
mormot.core.os.security introduces TWinCertStore and TWinCertStoreLocation with Create, Next, Duplicate and ToPem, plus WinCryptBinaryAppendAsText. Existing system-store PEM collection is refactored onto the wrapper.
New features
mormot.core.os.security+1
4211be31+155-48
core: new TWinCertStore wrapper and associated raw API
Impact
Windows backends can safely enumerate stores, duplicate contexts that must outlive iteration and export certificates as PEM. The object owns its store and current context.
Worth a look
Call Duplicate before retaining Context beyond the next Next call, and free each TWinCertStore instance.
Public API
TWinCertStoreLocationadded — Public selector for Windows certificate-store location.TWinCertStoreadded — Owning Windows certificate-store iterator.WinCryptBinaryAppendAsTextadded — Appends Windows binary data as PEM/base64 text.
13
Medium
A late-bound Windows CNG key-storage layer enters the public API
mormot.lib.sspi introduces ENCrypt, TNCrypt and the NCrypt factory with dynamically loaded provider, key creation, property, finalize, delete and free operations.
New features
mormot.core.os+1
373f69f3+133-3
lib: introducing Windows Cryptography API: Next Generation (CNG) API
Impact
Windows backends can use CNG without a static ncrypt.dll dependency. XP remains unsupported by CNG and callers must respect runtime availability.
Worth a look
Gate new CNG use on NCrypt availability and exercise provider/key cleanup on each supported Windows version.
Public API
ENCryptadded — Public exception for NCrypt/CNG failures.TNCryptadded — Late-bound CNG key-storage wrapper.NCryptadded — Global factory for the CNG wrapper.
14
Medium
NCrypt can unprotect secrets and decode encrypted msLAPS values
TNCrypt gains Unprotect and LapsDecrypt over optional Windows 8+ protection APIs. LapsDecrypt accepts TLdapAttribute.GetRaw binary data and zeroes the temporary cleartext buffer.
New features
mormot.lib.sspi
622071a5+108-13
lib: new NCrypt.LapsDecrypt method
Impact
Windows directory-management backends can decrypt msLAPS-EncryptedPassword values in process. Unsupported systems or malformed data raise ENCrypt.
Worth a look
Use only the raw binary LDAP attribute, handle ENCrypt and minimize the lifetime of returned password strings.
Public API
TNCrypt.Unprotectadded — Unprotects data with Windows NCrypt protection APIs.TNCrypt.LapsDecryptadded — Decodes an msLAPS encrypted-password attribute.
Units
15
Medium
Crypt32 bindings gain self-signed certificate creation primitives
mormot.lib.sspi declares CertStrToNameW and CertCreateSelfSignCertificate, while mormot.core.os maps CRYPT_E_NOT_FOUND to a readable Windows error name.
New features
mormot.core.os+1
d6d52bf0+20-7
lib: enhanced crypt32.dll WinAPI support
Impact
Windows backends can build names and create self-signed certificate contexts through the raw Crypt32 surface; existing application code is unchanged.
Public API
CertStrToNameWadded — Raw Crypt32 name conversion declaration.CertCreateSelfSignCertificateadded — Raw Crypt32 self-signed certificate declaration.
16
Medium
Wine is marked as unsafe for CNG calls
TWindowsSpec gains wsWeakCng; Wine detection sets it and InitializeNCrypt skips ncrypt.dll because Wine exposes stubs that report success without implementing the work.
Compiler & platform
mormot.core.os+1
1d60fd28+15-13
lib: don't try to use CNG on Wine
Impact
mORMot2 applications running under Wine no longer attempt unreliable CNG operations. Native Windows behavior is unchanged.
Upgrade recommended
Wine deployments using new CNG-dependent features should detect NCrypt unavailability and provide another path.
Public API
TWindowsSpec.wsWeakCngadded — Marks Windows environments with unusable CNG APIs.
17
Low
LocalFree is exposed with a pointer-friendly signature
mormot.core.os adds a public LocalFree(pointer): pointer declaration and Windows security code removes internal HLOCAL casts when freeing API buffers.
New features
mormot.core.os+1
79a03b23+8-5
core: new LocalFree() public function for Windows
Impact
Windows code can free LocalAlloc-family results without HLOCAL casts. Existing Delphi and FPC backend code remains compatible.
Public API
LocalFreeadded — Public Windows declaration accepting and returning pointer.
18
Low
Windows CNG status codes receive readable error names
WinErrorShort and OSErrorShort recognize the NTE_* range returned by CNG, and the core test suite adds coverage for those names.
Compiler & platform
mormot.core.os+1
3c49fdbf+19-5
core: recognize NTE_* errors as returned by CNG Windows API
Impact
CNG failures in Delphi and FPC backends produce diagnostic names instead of bare numeric codes. Application behavior is otherwise unchanged.
19
Low
The msLAPS decryption helper is simplified without changing its contract
TNCrypt.LapsDecrypt removes redundant local state, uses the parsed header length directly and corrects an internal LDAPS/msLAPS wording typo.
Under the hood
mormot.lib.sspi
32e7d9b3+13-15
lib: NCrypt.LapsDecrypt() cleanup
Impact
No application-code impact is expected; the public signature and the decrypted result remain unchanged.