Act nowcan affect a running systemReviewed all 56 non-merge commits from build 2.4.17209 through 2.4.17268: 2,694 additions and 1,378 deletions after excluding version bookkeeping. Four merge commits were excluded. No commit carries superseded_by metadata; ordering reflects directly inspected same-unit follow-ups and does not create an avoid range.
Windows CNG and PKCS#11 expand while JSON and socket safety defects are closed
This large cryptography-focused edition introduces a Windows CNG certificate-store backend, completes RSA envelope decryption through CNG and PKCS#11 keys, and repairs a long PKCS#11 import/signing lifecycle sequence. Outside cryptography, it closes an out-of-bounds JSON logging read, bounds a socket retry loop, fixes reverse-proxy session-cookie selection and adds distinct HTTP connect, send and receive timeouts.
TL;DR
- Land on build 2.4.17268 at 80bc2689df777dadbe1f8af745096eeb13205ef7.
- Add mormot.crypt.win to uses if code references TAesAbstractApi or its CryptoAPI AES descendants, which moved out of mormot.crypt.core.
- Windows gains TCryptCertAlgoCng, ICryptCertCng and TCryptCertCng.LoadPkcs12 for store, smart-card/KSP and transient PFX identities.
- PKCS#11 gains RSA envelope decryption and broader signing support, but TPkcs11 is explicitly no longer thread-safe; shared catalog access must use TCryptCertAlgoPkcs11.Lock/UnLock.
- Upgrade promptly for the TJsonWriter.AddEscapeBuffer over-read, TCrtSocket.TrySockRecv endless retry, CNG/PKCS#11 GPFs and OpenSSL ABI corrections.
- THttpClientSocket.SetTimeouts now separates connect, send and receive budgets; TRestHttpClientSocket applies all three.
Upgrade advice
Land on build 2.4.17268. Upgrade promptly if production logs untrusted or binary text, uses blocking/TLS sockets, Windows IOCP, reverse-proxied REST authentication, OpenSSL, Windows CNG or PKCS#11. Add mormot.crypt.win to affected uses clauses. Audit direct TPkcs11 sharing: it is no longer internally locked, so use TCryptCertAlgoPkcs11.Lock/UnLock around catalog operations. Exercise hardware-token import, PSS/ECC signing, shutdown during background discovery, RSA Open and distinct HTTP timeout paths. The raw payload has no superseded_by markers, so no avoid window is asserted.
56 of 56 entries · 60 commits upstream
1
Critical
JSON escaping stops reading past the supplied buffer
TJsonWriter.AddEscapeBuffer fixes an inverted MaxLen comparison: it now truncates Len when Len exceeds MaxLen instead of extending Len up to MaxLen.
Security
mormot.core.json
c955c837+2-2
core: TJsonWriter.AddEscapeBuffer() did read beyond the input buffer
Impact
Logging invalid UTF-8 or binary content no longer copies unrelated heap bytes into logs or raises an access violation while the log lock is held.
Upgrade recommended
Upgrade immediately where untrusted or binary values can reach TSynLog.LogText or TJsonWriter.AddEscapeBuffer; test truncation at TextTruncateAtLength.
Public API
TJsonWriter.AddEscapeBufferbehaviour-changed
Units
2
High
PKCS#11 locking moves from the low-level engine to the catalog
TPkcs11 changes from TObjectOSLock to TSynPersistent and removes internal locking. TCryptCertAlgoPkcs11 gains a reentrant TOSLock plus public Lock and UnLock methods protecting its shared engine and background load.
Breaking changes
mormot.crypt.pkcs11+1
fdbd6e9f+197-220
crypt: simplified PKCS#11 threading model
Impact
Direct TPkcs11 instances are explicitly not thread-safe. Concurrent callers that relied on Engine.Safe or implicit session serialization can race or corrupt shared session state.
Migration required
Grep for shared TPkcs11 and Engine.Safe use. Serialize catalog operations with TCryptCertAlgoPkcs11.Lock/UnLock or provide one engine per thread.
Public API
TPkcs11behaviour-changedTCryptCertAlgoPkcs11.LockaddedTCryptCertAlgoPkcs11.UnLockadded
3
High
Unsupported certificate factories return nil instead of dereferencing it
TCryptCertAlgo.New and FromHandle become virtual nil-returning defaults, and Load, Generate, CreateSelfSignedCsr and GenerateFromCsr now test the returned interface before invoking it. CNG and PKCS#11 delete duplicate weak overrides.
Fixes
mormot.crypt.secure+2
11f136ba+31-61
crypt: fixed potential GPF in TCryptCertAlgo misuse
Impact
Calling generic factory methods on catalog-style algorithms no longer risks an access violation. Supported certificate implementations retain their prior factories.
Upgrade recommended
Upgrade if code calls TCryptCertAlgo.Load, Generate or GenerateFromCsr through CNG or PKCS#11 providers.
Public API
TCryptCertAlgo.Newbehaviour-changedTCryptCertAlgo.FromHandlebehaviour-changed
4
High
PKCS#11 shutdown waits for background discovery
TCryptCertAlgoPkcs11 retains its TLoggedWorkThread with manual wait, frees it before the engine and moves completion notification into a finally block while holding the catalog lock.
Fixes
mormot.crypt.pkcs11
d74a0234+48-42
crypt: fixed PKCS#11 background loading
Impact
Destroying the catalog during slow library initialization no longer lets the loader touch freed memory and cause a GPF.
Upgrade recommended
Stress shutdown while PKCS#11 library loading and token enumeration are still in progress.
Units
5
High
PKCS#11 import returns the stored certificate and rolls back failures
TCryptCertAlgoPkcs11.Import validates hexadecimal ID, creates certificate and private-key objects, reloads the actual certificate, adds it to the catalog and destroys partial objects in reverse order on failure.
Fixes
mormot.crypt.pkcs11
f4ba19f2+55-29
crypt: fixed TCryptCertAlgoPkcs11.Import() method
Impact
Successful imports become immediately usable and failures no longer leave orphaned token objects.
Upgrade recommended
Retest successful import, invalid ID, private-key failure and rollback on each HSM.
Public API
TCryptCertAlgoPkcs11.Importbehaviour-changed
Units
6
High
PKCS#11 RSA-PSS signing supplies the required parameters
Pkcs11SetPssParams builds CK_RSA_PKCS_PSS_PARAMS with the matching hash, MGF1 and salt length; SignDigest sends the raw digest for PSS instead of a PKCS#1 DigestInfo.
Fixes
mormot.crypt.pkcs11+1
639e45ff+75-5
crypt: fixed PSS support in TCryptPrivateKeyPkcs11.SignDigest
Impact
Hardware tokens can produce valid PS256, PS384 and PS512 signatures rather than rejecting or mis-encoding the operation.
Upgrade recommended
Verify PSS signatures against an independent verifier for every deployed token.
Public API
Pkcs11SetPssParamsadded
7
High
PKCS#11 public keys are rebuilt from algorithm-specific attributes
Pkcs11PublicKey first tries CKA_PUBLIC_KEY_INFO, then rebuilds RSA from modulus/exponent, EC from CKA_EC_POINT and Ed25519 from raw or legacy DER point data. TCryptCertPkcs11.Create uses it instead of treating CKA_VALUE as public key material.
Fixes
mormot.crypt.pkcs11
4be9e812+65-10
crypt: fixed TCryptCertPkcs11.Create() key import
Impact
Token identities without CKO_CERTIFICATE or with restricted CKA_VALUE expose the correct public key, avoiding unusable fake X.509 instances.
Upgrade recommended
Test discovery for RSA, P-256/P-384/P-521 and Ed25519 public-key objects on each token.
Public API
Pkcs11PublicKeyadded
Units
8
High
Ed25519 PKCS#8 private keys follow RFC 8410 nesting
SeqToEccPrivKey now parses PKCS#8 Ed25519 as id-Ed25519 followed by an outer privateKey OCTET STRING containing the inner RFC 8410 OCTET STRING, while retaining RFC 5915 EC handling.
Fixes
mormot.crypt.secure
80bc2689+34-36
crypt: fixed ckaEdDSA private key extraction
Impact
Ed25519 private-key extraction yields the actual 32-byte key instead of failing or interpreting the wrong ASN.1 shape, enabling correct PKCS#11 import.
Upgrade recommended
Reimport an RFC 8410 Ed25519 PKCS#8 key and verify a token-backed signature.
Units
9
High
PKCS#11 object enumeration always finalizes its search
TPkcs11.GetObjects wraps FindObjects in try/finally, records C_FindObjectsFinal, runs it on exceptions and validates the final status after cleanup.
Fixes
mormot.lib.pkcs11
4f5f3b32+35-29
lib: fixed TPkcs11.GetObjects error handling
Impact
Enumeration failures no longer leave an active find operation that breaks later token calls.
Upgrade recommended
Test attribute-read failures followed by another object search in the same session.
Units
10
High
Transient CNG certificates no longer dereference a missing owner
TCryptCertCng stores an explicit TSynLogClass, permits a nil TCryptCertAlgoCng owner for PFX instances and derives system-store status from the owner instead of dereferencing it.
Fixes
mormot.crypt.win+1
3736871b+22-33
crypt: fixed GPF in TCryptCertCng
Impact
TCryptCertCng.LoadPkcs12 no longer risks a GPF while constructing or logging a transient certificate.
Upgrade recommended
Upgrade before deploying the new transient PFX factory.
11
High
PKCS#11 unload finalizes only initialized libraries
TPkcs11.Load tracks fInitialized after C_Initialize, cleans up each failure stage, and UnLoad calls C_Finalize only when initialization actually succeeded.
Fixes
mormot.lib.pkcs11
dfbd2889+28-20
lib: fixed TPkcs11.Load/UnLoad error handling
Impact
Failed library loads no longer finalize an uninitialized API or leak a partially opened library handle.
Upgrade recommended
Exercise missing symbols, C_Initialize failure, unsupported Cryptoki version and normal unload.
Units
12
High
PKCS#11 rejects signature algorithms incompatible with the real key
TCryptCertPkcs11.SetAsymAlgo checks the X.509 SubjectPublicKeyAlgorithm: unrestricted RSA accepts RS/PSS, RSA-PSS stays PSS-only and ECC must keep its curve-compatible family.
Fixes
mormot.crypt.pkcs11
978ba78c+30-7
crypt: fixed TCryptCertPkcs11.SetAsymAlgo logic
Impact
Algorithm switches can no longer authorize an invalid signing mechanism merely because enum families happened to map alike.
Upgrade recommended
Test every SetAsymAlgo transition used with RSA, RSA-PSS and EC token keys.
Public API
TCryptCertPkcs11.SetAsymAlgobehaviour-changed
Units
13
High
REST authentication ignores unrelated reverse-proxy cookies
TRestClientAuthentication.ClientGetSessionKey parses Set-Cookie only for HTTP-based schemes and searches all headers for the Model.Root cookie instead of consuming the first proxy cookie.
Fixes
mormot.rest.client
477811c6+26-9
rest: only use the session cookie for HTTP-based authentication
Impact
Signed-URI authentication behind proxies such as Azure App Proxy no longer derives a bogus session ID and fails subsequent requests with 403.
Upgrade recommended
Retest login and the first signed request behind any proxy that injects cookies.
Public API
TRestClientAuthentication.ClientGetSessionKeybehaviour-changed
Units
14
High
PKCS#11 signing sends data during the size query and always closes
TPkcs11.Sign passes Data and Len to the first C_Sign call instead of nil/zero. SignDigest wraps exceptions for tracing and moves engine.Close into finally; CAA_PSS centralizes PSS membership.
Fixes
mormot.crypt.pkcs11+3
b7c75631+17-12
crypt: fixed PKCS#11 signing
Impact
Tokens that require the real input for signature sizing work correctly, and failed signing no longer leaks an open session.
Upgrade recommended
Retest signing success and injected token errors, verifying sessions close in both cases.
Public API
CAA_PSSadded
15
High
Socket receive retries obey the configured timeout
TCrtSocket.TrySockRecv keeps nrRetry through RecvPending and WaitFor, measures elapsed time and passes only the remaining TimeOut instead of converting retry to nrOk and looping on recv indefinitely.
Fixes
mormot.net.sock
bb4110fa+14-3
net: fixed TCrtSocket.TrySockRecv endless recv() retry on nrRetry - now honors TimeOut
Impact
Blocking or TLS reads that repeatedly return retry can no longer hang past the caller’s timeout budget.
Upgrade recommended
Test idle, partial and TLS-renegotiation reads at the configured boundary.
Public API
TCrtSocket.TrySockRecvbehaviour-changed
Units
16
High
PKCS#11 import logs in with the normal user PIN
TCryptCertAlgoPkcs11.Import renames SoPinCode to PinCode and opens a read/write CKU_USER session instead of a Security Officer session before creating certificate and private-key objects.
Fixes
mormot.crypt.pkcs11
bb4dc3c1+9-8
fixed TCryptCertAlgoPkcs11.Import to use normal user PIN
Impact
HSMs that reject object creation under the SO role can import with the intended normal user credentials.
Upgrade recommended
Supply the normal user PIN to Import and retest permissions; do not pass the SO PIN.
Public API
TCryptCertAlgoPkcs11.Importbehaviour-changed
Units
17
High
GenerateFromCsr delegates to the created certificate instead of recursing
TCryptCertAlgo.GenerateFromCsr now calls result.GenerateFromCsr on the New instance instead of recursively invoking the factory method. Comments also clarify void factories and the CNG subclass.
Fixes
mormot.crypt.secure+2
1be7a731+8-7
crypt: several ICryptCert fixes and precisions
Impact
CSR-to-certificate generation through the base factory no longer recurses indefinitely or overflows the stack. Existing successful overrides keep their behavior.
Upgrade recommended
Upgrade if a backend invokes TCryptCertAlgo.GenerateFromCsr through a concrete factory.
18
High
PKCS#11 GetObject returns the single matching record
TPkcs11.GetObject finalizes and clears its output, requires exactly one GetObjects result and assigns that record to Info before copying an optional value.
Fixes
mormot.lib.pkcs11
15a2bdfd+7-5
lib: fixed TPkcs11.GetObject wrapper
Impact
Import and lookup callers receive initialized object metadata instead of a success flag with stale or empty Info.
Upgrade recommended
Retest token import and any direct TPkcs11.GetObject call.
Public API
TPkcs11.GetObjectbehaviour-changed
Units
19
High
IOCP AcceptEx sockets inherit the listener before shutdown
GetNextAccept sets SO_UPDATE_ACCEPT_CONTEXT with the listening socket before releasing accept state, logging a warning if setsockopt fails.
Fixes
mormot.net.sock.windows
0c84326d+11-0
net: set SO_UPDATE_ACCEPT_CONTEXT on IOCP AcceptEx sockets so that shutdown() sends a FIN
Impact
Server-side IOCP closes can call shutdown successfully and send FIN instead of failing with WSAENOTCONN and leaving clients waiting.
Upgrade recommended
Retest graceful server closes and client EOF detection on Windows IOCP.
20
High
PKCS#11 certificate import uses valid flags and recognizes P-521
AddSessionCertificate stops forcing posExtractable, always supplies CKA_SUBJECT and required private/ID values. Pkcs11KeyAlgorithm recognizes 528-bit coordinate storage as xkaEcc512 for secp521r1.
Fixes
mormot.crypt.pkcs11+1
7a3e2370+5-6
crypt: fixed CKO_CERTIFICATE import
Impact
Tokens receive a valid CKO_CERTIFICATE template, and P-521 public keys are classified correctly during import and discovery.
Upgrade recommended
Reimport a certificate on each HSM and add a P-521 discovery/signing test where supported.
21
High
OpenSSL C long declarations use platform-sized Pascal types
Dozens of mormot.lib.openssl11 declarations and wrapper returns change from integer/cardinal to clong or PtrInt for C long parameters, lengths, versions, modes and callbacks.
Compiler & platform
mormot.lib.openssl11
c60c6b66+93-93
lib: fixed OpenSSL API clong usage
Impact
ABI mismatches on 64-bit POSIX are removed. Low-level callers assigning these public results to 32-bit variables may need an explicit conversion.
Upgrade recommended
Rebuild all OpenSSL consumers on 64-bit POSIX and inspect compile errors around changed wrapper result types.
Public API
OpenSSL C API declarationssignature-changed
Units
22
High
OpenSSL option masks use the correct 1.1 and 3.x widths
SSL_CTX_set_options and SSL_CTX_clear_options now publish QWord masks and dispatch through 32-bit OpenSSL 1.1 or 64-bit OpenSSL 3 signatures; culong is introduced for unsigned C long values.
Compiler & platform
mormot.lib.openssl11
bee62163+16-15
lib: fixed SSL_CTX_set_options/SSL_CTX_clear_options for OpenSSL
Impact
OpenSSL 3 option bits are no longer truncated, while OpenSSL 1.1 keeps its native ABI.
Upgrade recommended
Retest TLS context options on both OpenSSL 1.1 and 3.x.
Public API
SSL_CTX_set_optionssignature-changedSSL_CTX_clear_optionssignature-changed
Units
23
High
Windows C long stays 32-bit on Win64
The Windows clong alias changes from PtrInt to integer and timeval fields use clong, correcting the LLP64 ABI used by OpenSSL on Win64.
Compiler & platform
mormot.lib.openssl11
e7edab5c+6-6
lib: long is 32-bit on Windows even on Win64
Impact
Win64 OpenSSL calls no longer pass or receive eight-byte values where the C ABI expects four bytes.
Upgrade recommended
Rebuild and retest Win64 OpenSSL certificate and TLS paths.
Units
24
High
Delphi Darwin stops linking an FPC-only C symbol
The mach_absolute_time external alias named GetTickCount64 is now declared only under FPC on Darwin, because Delphi never calls that entropy helper but still tried to resolve library c.
Compiler & platform
mormot.core.base
96914740+2-0
core: fixed Delphi Darwin linking
Impact
Delphi iOS and iOS Simulator links no longer fail with “ld: file not found: c”. FPC Darwin entropy behavior is unchanged.
Upgrade recommended
Rebuild Delphi iOS device and simulator targets.
Units
25
Medium
Windows CryptoAPI AES classes move into a dedicated unit
TAesAbstractApi, TAesEcbApi, TAesCbcApi, TAesCfbApi and TAesOfbApi move from mormot.crypt.core into the new mormot.crypt.win unit, which is added to the Lazarus package.
Breaking changes
mormot.crypt.core+1
c2a321d8+315-238
crypt: new mormot.crypt.win.pas unit
Impact
Projects that name these public types without already importing mormot.crypt.win stop compiling; AES behavior itself is unchanged. Non-Windows code can include the new do-nothing unit.
Migration required
Grep for TAesAbstractApi, TAesEcbApi, TAesCbcApi, TAesCfbApi and TAesOfbApi, then add mormot.crypt.win to those uses clauses.
Public API
mormot.crypt.winadded — The new unit now owns the public Windows CryptoAPI AES classes.
26
Medium
X.509 lookup accepts human-formatted thumbprints
TX509.FingerPrintCompare becomes case-insensitive and InternalFind normalizes ccmSha1/ccmSha256 values such as space- or colon-separated Windows clipboard thumbprints.
Fixes
mormot.crypt.x509+5
8f741a59+19-11
crypt: normalize X509 ccmSha1/ccmSha256 finding
Impact
Certificate searches accept common administrator-entered thumbprint forms instead of silently missing the certificate.
Public API
TX509.FingerPrintComparebehaviour-changed
27
Medium
Thumbprint normalization reaches every certificate backend
TCryptCert.InternalFind, TCryptCert.Compare and TX509.FingerPrintCompare use HumanHexCompare for SHA-1/SHA-256 digest matching, centralizing separators and case handling.
Fixes
mormot.crypt.secure+1
fd0b9854+7-14
crypt: global X.509 thumbprint normalization
Impact
Human-formatted digest matching behaves consistently for X.509, CNG and PKCS#11 certificate implementations.
28
Medium
PKCS#11 private keys validate algorithm and digest before use
TCryptPrivateKeyPkcs11 initializes fKeyAlgo from X.509, rejects mismatched signing algorithms or digest lengths and derives RSA modulus eligibility from the key algorithm rather than the selected signature algorithm.
Fixes
mormot.crypt.pkcs11+1
eb075586+14-6
crypt: some TCryptPrivateKeyPkcs11 fixes
Impact
Invalid combinations fail cleanly before opening a token session; RSA-PSS keys remain usable for envelope opening when appropriate.
29
Medium
PKCS#11 private-key attributes follow each X.509 algorithm
CryptCertToPkcs11PrivKeyAttributes refines RSA/ECC attribute conversion and key-usage flags when translating an ICryptCert for token import.
Fixes
mormot.crypt.pkcs11
b47c9353+9-6
crypt: fixed X.509 attributes to PKCS#11 conversion
Impact
Imported token keys carry attributes consistent with their certificate algorithm, improving HSM acceptance and later lookup.
Upgrade recommended
Reimport test RSA and EC identities and inspect token attributes.
Units
30
Medium
PKCS#11 bad signature lengths return false instead of raising
TPkcs11.Verify treats CKR_SIGNATURE_LEN_RANGE like CKR_SIGNATURE_INVALID and returns false; other token errors still raise EPkcs11.
Fixes
mormot.lib.pkcs11
4788f9a7+7-5
lib: fixed TPkcs11.Verify
Impact
Malformed-length signatures are ordinary verification failures instead of operational HSM exceptions.
Public API
TPkcs11.Verifybehaviour-changed
Units
31
Medium
OpenSSL certificate validity preserves negative start offsets
X509.SetValidity stops forcing negative ValidDays to zero because supported X509_gmtime_adj versions accept negative offsets.
Fixes
mormot.lib.openssl11
bae3c61c+3-4
lib: adjust X509.SetValidity() to the current OpenSSL state
Impact
Generated OpenSSL certificates can again start before the current time, preserving the intended clock-skew allowance.
Worth a look
Retest generated certificate notBefore values if ValidDays is negative.
Public API
X509.SetValiditybehaviour-changed
Units
32
Medium
REST cookie lookup mirrors slash-to-underscore naming
ClientGetSessionKey normalizes Model.Root with StringReplaceChars('/', '_') before comparing cookie names, matching TRestUriContext.SetOutCookie.
Fixes
mormot.rest.client
5f3c8069+3-2
rest: match the session cookie name as SetOutCookie() computes it
Impact
HTTP authentication works for roots such as api/v1 whose actual session cookie is api_v1.
Upgrade recommended
Retest HTTP authentication if Model.Root contains a slash.
Units
33
Medium
REST HTTP clients apply all three timeout settings
TRestHttpClientSocket now calls fSocket.SetTimeouts(fConnectTimeout, fSendTimeout, fReceiveTimeout) immediately after creating its THttpClientSocket.
Fixes
mormot.rest.http.client
9013722a+3-2
rest: fixed #624 in TRestHttpClientSocket
Impact
Configured REST send and receive timeouts are no longer collapsed into the connect timeout on the underlying socket.
Upgrade recommended
Retest REST calls with deliberately different connect, send and receive limits.
34
Medium
Windows certificate stores expose CNG-backed identities
mormot.crypt.win adds TWinCertStoreLocations, ICryptCertCng, TCryptCertAlgoCng and TCryptCertCng to enumerate CurrentUser/LocalMachine stores, find certificates and sign through CNG KSP keys.
New features
mormot.core.os.security+2
51d635d7+653-5
crypt: High-Level Windows CNG Certificate Store Integration
Impact
Windows backends can use system-store, smart-card and hardware-KSP identities without exporting private keys. Delphi and FPC builds on other platforms are unaffected.
Worth a look
Evaluate TCryptCertAlgoCng.Cert, Find or FindOne where Windows services currently load exportable PFX files.
Public API
TCryptCertAlgoCngaddedICryptCertCngaddedTWinCertStoreLocationsadded
35
Medium
Transient PFX loading becomes a CNG certificate class factory
LoadPkcs12 moves from TCryptCertAlgoCng to the class function TCryptCertCng.LoadPkcs12, accepts an optional log class and constructs a transient identity without a catalog owner.
New features
mormot.crypt.win
274091d4+81-76
crypt: proper TCryptCertCng.LoadPkcs12 factory
Impact
PFX loading no longer requires enumerating or retaining a Windows store catalog. Anyone who used the briefly introduced algorithm method must call the class factory.
Worth a look
Use TCryptCertCng.LoadPkcs12(Pfx, Password, LogClass) for transient identities.
Public API
TCryptCertCng.LoadPkcs12added
Units
36
Medium
RSA envelope opening can delegate the private operation
mormot.crypt.rsa adds TRsaPkcs1Decrypt and RsaOpen to validate the shared envelope, delegate PKCS#1 v1.5 key decryption and perform AES decryption; TRsa.Open now reuses it.
New features
mormot.crypt.rsa+1
634a72ff+77-56
crypt: introducing RsaOpen() reusable wrapper
Impact
External private-key providers such as CNG and PKCS#11 can open the same TRsa.Seal format without exporting the RSA key.
Worth a look
Use RsaOpen only with a callback that performs RSAES-PKCS1-v1_5 unpadding and returns the ephemeral key.
Public API
RsaOpenaddedTRsaPkcs1Decryptadded
37
Medium
CNG can load a transient identity from PKCS#12
An initial TCryptCertAlgoCng.LoadPkcs12 imports PFX data with PKCS12_NO_PERSIST_KEY, locates a certificate with an accessible CNG key and creates an ICryptCertCng with cached silent key access.
New features
mormot.crypt.win+1
7741fdc4+88-41
crypt: new TCryptCertAlgoCng.LoadPkcs12() method
Impact
Windows can use a PFX identity without persisting its private key. A later commit in this edition moves the final factory to TCryptCertCng.LoadPkcs12.
38
Medium
CNG private keys can open RSA-encrypted framework messages
TCryptPrivateKeyCng.Open decodes the AES cipher name, derives the RSA modulus size and uses RsaOpen plus TNCrypt.KeyDecryptPkcs1; key acquisition and logging are shared with signing.
New features
mormot.crypt.win+1
12e8ca5a+84-25
crypt: implemented TCryptPrivateKeyCng.Open()
Impact
ICryptCertCng.Open now decrypts TRsa.Seal-compatible messages with store or hardware keys that remain non-exportable.
Worth a look
Test Open with every AES cipher name and CNG provider used by the application.
Public API
TCryptPrivateKeyCng.Openbehaviour-changed
39
Medium
HTTP sockets expose separate connect, send and receive timeouts
THttpClientSocket adds fConnectTimeout/fSendTimeout/fReceiveTimeout and public SetTimeouts. OpenBind temporarily applies the connect budget, then installs send and receive socket timeouts and restores the high-level wait value.
New features
mormot.net.client
157ccf6f+69-30
net: introduce 3 explicit timeouts for THttpClientSocket
Impact
Backends can give connection establishment a short limit while allowing different request-write and response-read budgets. The old constructor still initializes all three to one value.
Worth a look
Set explicit phase budgets where connection and response latency differ, then test proxy CONNECT and retries.
Public API
THttpClientSocket.SetTimeoutsadded
Units
40
Medium
PKCS#11 private keys can open RSA envelopes
TPkcs11.Decrypt wraps C_DecryptInit/C_Decrypt, and TCryptPrivateKeyPkcs11.Open uses CKM_RSA_PKCS with RsaOpen to decrypt the framework RSA/AES envelope through a token private key.
New features
mormot.crypt.pkcs11+1
64321f11+87-8
crypt: implement TCryptPrivateKeyPkcs11.Open() method
Impact
Hardware-token RSA keys can decrypt ICryptPrivateKey.Open messages without exporting private material.
Worth a look
Verify that each target token permits CKM_RSA_PKCS decryption for the selected key.
Public API
TPkcs11.DecryptaddedTCryptPrivateKeyPkcs11.Openbehaviour-changed
41
Medium
Windows CNG decrypts one RSA PKCS#1 block
TNCrypt.KeyDecryptPkcs1 wraps NCryptDecrypt with PKCS#1 padding, optional silent mode, one hardware operation, bounded output and cleanup on error.
New features
mormot.lib.sspi
894714e2+50-3
lib: new TNCrypt.KeyDecryptPkcs1() wrapper method
Impact
CNG-backed RSA keys, including hardware KSP keys, gain the primitive needed for envelope decryption without a size-query operation.
Public API
TNCrypt.KeyDecryptPkcs1added
Units
42
Medium
A Windows wrapper imports PFX data with wiped passwords
mormot.lib.sspi adds WinCertStoreImportPfx, converts SpiUtf8 to UTF-16, invokes PFXImportCertStore, captures errors and wipes the temporary password buffer.
New features
mormot.lib.sspi
33e5e920+46-3
lib: new WinCertStoreImportPfx() wrapper function
Impact
Windows PFX consumers gain one error-code-based import path with explicit password cleanup. Existing direct API calls remain available.
Public API
WinCertStoreImportPfxadded
Units
43
Medium
PKCS#11 signs ES384, ES512 and ES256K in DER form
SignDigest converts raw r||s output with SetSignatureSecurityRaw for ES256, ES384, ES512 and ES256K, and ensures the PSS mechanism field is populated.
New features
mormot.crypt.pkcs11
9c9a402a+8-7
crypt: ES384 ES512 ES256K support for PKCS#11
Impact
Tokens with larger or secp256k1 EC keys now return the DER signature form expected by ICryptPrivateKey.
Worth a look
Add token-backed signature tests for every enabled ES algorithm.
Units
44
Medium
A second OpenSSL ABI pass fixes control and mode widths
The Windows compatibility types move before OpenSSL declarations, and session-cache, mode, extra-chain and callback wrappers consistently use clong; Windows timeval fields follow clong.
Compiler & platform
mormot.lib.openssl11
cdec1b9d+33-33
lib: another pass to fix clong OpenSSL usage
Impact
OpenSSL control wrappers now match C calling conventions across Delphi/FPC targets; ordinary high-level TLS code is source-compatible.
Upgrade recommended
Take this commit together with the surrounding OpenSSL declaration fixes.
Public API
SSL_CTX_set_modesignature-changedSSL_get_modesignature-changed
Units
45
Medium
OpenSSL error-queue codes get a platform-width type
TErrQueueCode aliases culong; ERR_get_error, ERR_error_string_n and OpenSSL_error wrappers use it, while EOpenSsl.LastError becomes PtrInt to hold SSL or queue codes.
Compiler & platform
mormot.lib.openssl11
6b5cbea6+33-26
lib: introducing TErrQueueCode specific type
Impact
64-bit POSIX error-queue values are preserved instead of truncating to 32 bits. Low-level error helper signatures change.
Worth a look
Recompile code that calls OpenSSL_error helpers or reads EOpenSsl.LastError into integer.
Public API
TErrQueueCodeaddedEOpenSsl.LastErrorsignature-changed
Units
46
Medium
Remaining OpenSSL unsigned-long declarations are narrowed
mormot.lib.openssl11 corrects additional culong-facing signatures and separates SSL error integers from TErrQueueCode, while keeping flag-only cardinal declarations where OpenSSL caps constants at 32 bits.
Compiler & platform
mormot.lib.openssl11
48dd6495+11-11
lib: minor OpenSSL API fixes
Impact
OpenSSL error reporting and option wrappers align with their actual C domains across platforms.
Upgrade recommended
Take this final declaration pass with the preceding OpenSSL ABI commits.
Units
47
Medium
CNG certificate construction tightens ownership and store metadata
TCryptCertCng construction is reorganized around duplicated contexts, provider records and explicit key options; GetSystemStore reports whether the identity came from a system store.
Under the hood
mormot.crypt.win
6b71ac9f+49-41
crypt: refined TCryptCertCng
Impact
New CNG identities keep clearer ownership and metadata. This is an in-edition refinement of the newly introduced API.
Units
48
Medium
CNG distinguishes store identities from transient PFX identities
TCryptCertCng separates context initialization from store metadata and changes ICryptCertCng.GetSystemStore to return a boolean plus store and location outputs.
Under the hood
mormot.crypt.win
5c0c3dec+34-21
crypt: refined ICryptCertCng usage
Impact
Callers can reliably tell whether a CNG certificate came from a persistent Windows store or an in-memory PFX.
Public API
ICryptCertCng.GetSystemStoresignature-changed
Units
49
Low
Windows certificate provider metadata gets a focused wrapper
mormot.lib.sspi adds TWinCertKeyProviderInfo and WinCertCtxtKeyProvider to decode CERT_KEY_PROV_INFO_PROP_ID; CNG store loading consumes this narrower record instead of the full TWinCertInfo.
New features
mormot.lib.sspi+1
fe37aa9f+77-21
lib: new TWinCertKeyProviderInfo CNG API wrapper
Impact
Windows callers gain a cheaper provider-information query; existing TWinCertInfo decoding remains available and application code need not change.
Public API
TWinCertKeyProviderInfoaddedWinCertCtxtKeyProvideradded
50
Low
RSA envelope header has one shared definition
TRsaSealHeader and PRsaSealHeader move to mormot.core.os.security so pure Pascal RSA and OpenSSL use the identical packed layout; RsaOpen takes its callback as const.
Under the hood
mormot.core.os.security+3
e0f6cbb5+21-36
core: moved TRsaSealHeader to mormot.core.os.security
Impact
Envelope compatibility is centralized with no wire-format change. Code importing the newly public header should use mormot.core.os.security.
Public API
TRsaSealHeaderadded
51
Low
CNG key acquisition options replace separate booleans
TWinCertCngKeyOption and TWinCertCngKeyOptions represent silent, key-comparison and cache choices; TWinCertCngKey.Init and TCryptCertCng use the set.
Under the hood
mormot.lib.sspi+1
08e67973+26-13
lib: introducing TWinCertCngKeyOptions
Impact
New CNG code can combine key-acquisition behavior explicitly. This API was introduced within the same edition, so no established call site is displaced.
Public API
TWinCertCngKeyOptionsadded
52
Low
Socket retry timing is expressed as one deadline
TrySockRecv computes an end tick and remaining time, separates nrOk and RecvPending fast paths, and keeps AcceptEx context setup inside the accept-state lock. A redundant PKCS#11 initializer is removed.
Under the hood
mormot.net.sock+2
19ddf82e+15-19
net: minor simplification/cleanup of #622 PR
Impact
The prior timeout and IOCP fixes keep their behavior with clearer invariants and atomic accept finalization.
53
Low
SChannel PFX loading reuses the secure Windows importer
TSChannelServerContext.LoadCertificate replaces inline PFXImportCertStore and password conversion with WinCertStoreImportPfx, then wipes the UTF-8 password and checks the returned error.
Under the hood
mormot.net.sock.windows+2
18dca4de+8-22
net: simplified TSChannelServerContext.LoadCertificate
Impact
SChannel server certificate loading keeps the same public behavior with centralized password cleanup and error handling.
54
Low
Windows CryptoAPI AES provider setup is streamlined
mormot.crypt.win simplifies the PROV_RSA_AES provider state check and local trailer XOR helper without changing its public AES classes.
Under the hood
mormot.crypt.win
7f601fcc+13-16
crypt: minor PROV_RSA_AES support refactoring on Windows
Impact
No application-code impact; the same CryptoAPI AES modes and errors remain exposed.
Units
55
Low
SChannel Receive has an explicit fatal default
TLS Channel Receive initializes result to nrFatalError and simplifies early exits around pending output and caught exceptions to avoid a Delphi 7 compiler warning.
Under the hood
mormot.net.sock.windows
8df1fca0+6-10
net: refactored TLS Channel Receive() method
Impact
Return behavior stays fatal on those unsupported/error paths; Delphi 7 builds stop warning about an uninitialized result.
56
Low
ZIP conditionals avoid misleading FPC compiler hints
mormot.core.zip rearranges conditional declarations and assignments around FPC-only symbols to silence incorrect compiler hints without changing executable logic.
Housekeeping
mormot.core.zip
507833b7+9-9
core: circumvent some weird FPC compiler hints
Impact
FPC builds are quieter; Delphi/FPC backend behavior and public APIs are unchanged.