Act nowcan affect a running systemReviewed all 26 non-merge commits from build 2.4.17269 through 2.4.17294: 1,474 additions and 440 deletions after excluding mormot.commit.inc and mormot.commit-num.inc. The exact upstream head was inspected. No commit carries superseded_by metadata; upgrade ordering follows directly inspected same-unit follow-ups without asserting an avoid range.
SChannel gains native mTLS while server startup races are closed
Windows servers can now require and validate client certificates through SChannel, using the existing TNetTlsContext trust stores and verification callbacks. A second sequence repairs HTTP and async server construction so their main threads do not run before sockets, workers and cross-references are ready. Teams using Windows mTLS or constructing servers under load should land on the final build, not an intermediate commit in either sequence.
TL;DR
- Land on build 2.4.17294 at de8d47ea7122b30aa81296a1e5e899a3909e34b1.
- SChannel servers now implement mTLS through ClientCertificateAuthentication, CACertificatesFile, CASystemStores, CACertificatesRaw, OnEachPeerVerify and OnAfterPeerValidate.
- HTTP and async server threads now stay suspended until their sockets, workers and owner links are initialized.
- Upgrade for the CACertificatesRaw loading fix, explicit missing-client-certificate errors and final SChannel declaration/cache corrections.
- Public additions include acoCreateSuspended, ConsoleLock/ConsoleUnLock and WinCryptTextToBinary.
Upgrade advice
Land on build 2.4.17294. Upgrade promptly if a Windows server uses or plans client-certificate authentication, if CACertificatesRaw supplies trust anchors, or if HTTP/async servers are created and started under concurrency. Verify accepted and rejected client chains, OnEachPeerVerify overrides, OnAfterPeerValidate context and both classic THttpServer and THttpAsyncServer startup. The raw payload has no superseded_by markers, so no formal avoid range is asserted; take the complete ordered sequences instead of cherry-picking their intermediate commits.
26 of 26 entries · 26 commits upstream
1
High
SChannel mTLS gains Windows 7 compatibility and stricter chain checks
mormot.net.sock.windows uses the shorter CERT_CHAIN_ENGINE_CONFIG layout supported by Windows 7, rejects older systems for mTLS, refines client-auth EKU and trust handling, and corrects chain-engine cleanup.
Fixes
mormot.net.sock.windows
9d610a05+36-20
net: several SChannel fixes
Impact
Windows 7 can use the new server mTLS path; pre-Windows-7 hosts receive a clear unsupported result. Chain resources are released correctly.
Upgrade recommended
Use the final edition head and include the oldest supported Windows version in mTLS tests.
2
High
Final SChannel fixes avoid type conflicts and blocking chain retrieval
mormot.net.sock.windows uses its own certificate-context pointer declarations, sets SCH_CRED_CACHE_ONLY_URL_RETRIEVAL_ON_CREATE, and finalizes SChannel test and Windows-version guards. This avoids Delphi RTL PCCERT_CONTEXT conflicts and network URL retrieval during credential creation.
Fixes
mormot.net.sock.windows+1
9a2fec3f+17-12
net: latest SChannel fixes
Impact
Windows Delphi and FPC builds get a stable final mTLS path, and server startup no longer blocks on certificate-chain URL fetching. Non-Windows TLS backends are unaffected.
Upgrade recommended
Take build 2.4.17294 and retest Windows client-certificate validation without outbound chain URLs.
3
High
Server threads now start only after construction completes
TLoggedThread.AfterConstruction now calls inherited before Start. THttpServerGeneric and TAsyncConnections always create their RTL thread suspended, remember the caller's suspended option, and start only after construction; THttpAsyncServer also marks esRunning only after its bound socket is valid.
Fixes
mormot.core.threads+2
0b8d9252+11-9
net: fixed previous commits
Impact
HTTP and async servers no longer race their constructors or report running before binding succeeds. This affects Delphi and FPC backends on every platform using these server classes.
Upgrade recommended
Land on 2.4.17294 and stress repeated create/start/free cycles for THttpServer, THttpAsyncServer and custom TAsyncConnections descendants.
Public API
TLoggedThread.AfterConstructionbehaviour-changed
4
High
Classic HTTP servers preserve full TLS client-auth policy per connection
THttpServerSocket.Create copies the complete TNetTlsContext into each accepted connection when client-certificate authentication is active, then resets transient state. OpenSSL validation also clears stale LastError and computes verification once.
Fixes
mormot.lib.openssl11+2
7b63898e+14-6
net: some TLS fixes especially on OpenSSL and THttpServer
Impact
Threaded THttpServer connections now retain CA lists and verification callbacks needed for mTLS. OpenSSL callbacks no longer inherit a stale error from a prior verification.
Upgrade recommended
Retest mTLS through both THttpServer and THttpAsyncServer, including callback rejection and acceptance.
Public API
THttpServerSocket.Createbehaviour-changed
5
High
SChannel reports missing client credentials and trust failures clearly
The Windows TLS path recognizes SEC_E_NO_CREDENTIALS for absent client certificates, expands SSPI error text, and tightens chain-policy failure handling while preserving callback override behavior.
Fixes
mormot.core.os+2
13a977c1+10-5
net: better SSPI/SChannel error handling
Impact
mTLS rejection is explicit and diagnosable instead of surfacing as an ambiguous handshake failure. Windows Delphi and FPC servers are affected; other backends are not.
Upgrade recommended
Verify logs and client-visible behavior for missing, expired and untrusted client certificates.
6
High
In-memory CA certificates now reach SChannel validation
TSChannelServerContext.Create fixes an else binding in the trust-source selection so CACertificatesRaw entries are parsed and added when neither CACertificatesFile nor CASystemStores supplies the CA set.
Fixes
mormot.net.sock.windows
4355bdd9+5-3
net: fixed SChannel CACertificatesRaw[] support
Impact
Windows mTLS servers that pass PEM roots through CACertificatesRaw now validate against those roots instead of silently omitting them.
Upgrade recommended
Upgrade and test both a trusted and an untrusted client chain when CACertificatesRaw is the only CA source.
Public API
TNetTlsContext.CACertificatesRawbehaviour-changed
7
High
Windows SChannel servers can require client certificates
TSChannelServerContext implements server-side mTLS from TNetTlsContext: it loads configured CA sources, builds an exclusive chain engine when needed, requests client credentials, checks client-auth EKU and runs OnEachPeerVerify and OnAfterPeerValidate.
New features
mormot.net.sock+1
cbc906b6+368-38
net: implement mTLS using SChannel
Impact
Windows backends can use native SChannel for mutual TLS without switching to OpenSSL. Existing servers remain one-way TLS unless ClientCertificateAuthentication is enabled.
Worth a look
If adopting SChannel mTLS, configure one CA source and test the two verification callbacks against your certificate policy on 2.4.17294.
Public API
TNetTlsContext.ClientCertificateAuthenticationbehaviour-changedTNetTlsContext.OnEachPeerVerifybehaviour-changedTNetTlsContext.OnAfterPeerValidatebehaviour-changed
8
Medium
HTTP server families adopt deferred main-thread startup
TAsyncConnections and THttpServerGeneric set TLoggedThread.fStartAfterConstruction from their public suspended options, while THttpApiServer drops a manual Start because the base class now owns startup timing.
Fixes
mormot.net.async+1
2acff7c1+5-21
net: fixed servers main thread startup
Impact
This is an intermediate startup repair later corrected by 0b8d9252. Do not cherry-pick it without the final construction changes.
9
Medium
THttpAsyncServer links its threads before either can run
THttpAsyncServer.Create builds both the inherited server thread and fAsync suspended, assigns reciprocal references, then starts the async side and waits for socket binding instead of exposing partially linked objects.
Fixes
mormot.net.async
fb7baf23+17-6
net: fixed THttpAsyncServer.Create thread startup sequence
Impact
This removes a constructor window where either thread could dereference missing owner state. It is an intermediate fix completed by the later startup commits.
Units
10
Medium
SChannel declarations expose Windows certificate-chain engines
mormot.lib.sspi adds the Windows certificate-chain structures, callbacks, constants and API imports required to create restricted chain engines and evaluate SSL chain policy for client certificates.
New features
mormot.lib.sspi
a1586a7c+154-2
lib: SChannel cert chain API support
Impact
Low-level Windows Delphi/FPC code can call the chain APIs directly, and SChannel mTLS has the declarations it needs. Other platforms are unchanged.
Public API
Windows certificate-chain API declarationsadded
Units
11
Medium
OpenSSL servers now invoke the final peer-validation callback
TOpenSslNetTls.AfterAccept calls TNetTlsContext.OnAfterPeerValidate after a successful server handshake, providing the TLS context, peer certificate, cipher information and the current verification result.
New features
mormot.lib.openssl11
bda449fe+36-8
lib: TOpenSslNetTls.AfterAccept implements OnAfterPeerValidate callback
Impact
OpenSSL server users get callback parity with the new SChannel path. Existing callbacks may now run on server accepts where they previously did not.
Worth a look
Review OnAfterPeerValidate handlers for server-side assumptions and test both accepted and rejected peer certificates.
Public API
TNetTlsContext.OnAfterPeerValidatebehaviour-changed
Units
12
Medium
TAsyncConnections can be constructed with its main loop suspended
The public acoCreateSuspended option is added to TAsyncConnectionsOptions. TAsyncConnections.Create uses it to keep the main thread suspended until workers and initialization are ready.
New features
mormot.net.async
342146c9+12-5
net: fixed TAsyncConnections main thread execution
Impact
Custom async-server descendants can explicitly control initial execution. Existing option sets keep their prior default, while framework constructors use the option internally for safe startup.
Public API
acoCreateSuspendedadded
Units
13
Medium
The Lazarus aggregate package now includes Windows cryptography
packages/lazarus/mormot2.pas adds mormot.crypt.win to its uses list so the aggregate FPC package compiles and registers the Windows cryptography unit introduced earlier.
Compiler & platform
mormot2+1
de8d47ea+8-7
fpc: fixed mormot2 package source
Impact
Lazarus package users no longer miss mormot.crypt.win symbols. Delphi projects and FPC projects listing units directly are unchanged.
Units
14
Medium
Async HTTP initialization publishes state before execution
mormot.net.async and mormot.net.ws.async move accept-only flags, bound-socket publication, owner links and WebSocket keep-instance setup earlier in construction, before worker and main-loop execution can observe them.
Under the hood
mormot.net.async+1
47868569+103-89
net: async HTTP server code cleanup
Impact
The async stack sees consistent constructor state, reducing startup races. It is part of the same sequence finalized by 0b8d9252 and needs no application migration.
15
Medium
TLoggedThread gains an internal post-construction start switch
mormot.core.threads adds the protected fStartAfterConstruction flag and an AfterConstruction override so descendants can defer leaving the suspended state until object construction has finished.
Under the hood
mormot.core.threads
b698a9c6+13-4
core: introducing TLoggedThread.fStartAfterConstruction flag
Impact
This internal mechanism supports the server startup repair. Existing application threads are unchanged unless a custom descendant opts into the protected flag.
Units
16
Low
TSynTests serializes multi-threaded console updates
mormot.core.test wraps TSynTests progress, color and error-output sequences with ConsoleLock and ConsoleUnLock so parallel suites cannot interleave cursor and color state.
Fixes
mormot.core.test
de6c7467+50-35
core: fixed TSynTests console output
Impact
Parallel test output remains readable. Application backends are unaffected unless they use TSynTests as part of their own tooling.
Units
17
Low
A Windows wrapper decodes PEM and Base64 certificate text
mormot.core.os.security adds WinCryptTextToBinary, a public RawUtf8-to-RawByteString wrapper over CryptStringToBinaryA with CRYPT_STRING_BASE64HEADER as the default, and streamlines WinCryptBinaryAppendAsText.
New features
mormot.core.os.security
d344d129+43-8
core: new WinCryptTextToBinary() wrapper function
Impact
Windows code gains one checked helper for PEM/Base64 decoding. Existing callers are source-compatible and can opt in.
Public API
WinCryptTextToBinaryadded
18
Low
Public console locking supports atomic output sequences
mormot.core.os adds ConsoleLock and ConsoleUnLock wrappers over the reentrant ConsoleCriticalSection, allowing callers to protect a multi-call console update as one sequence.
New features
mormot.core.os
3f2d5e44+18-2
core: new ConsoleLock/ConsoleUnLock functions
Impact
Tools and test runners can prevent interleaved output across threads. Existing console calls retain their behavior.
Public API
ConsoleLockaddedConsoleUnLockadded
Units
19
Low
Windows trust failures receive readable error names
mormot.core.os extends Windows error-code lookup with SChannel, SSPI and certificate-trust constants so diagnostics show symbolic names for chain and policy failures.
Compiler & platform
mormot.core.os
31cf2232+13-7
core: include SChannel/SSPI trust error codes
Impact
Logs and exceptions are easier to diagnose. Runtime trust decisions and application APIs are unchanged.
Units
20
Low
TLS callback and Windows decoding helpers are consolidated
mormot.lib.openssl11 moves final peer-callback assembly into a local helper, while mormot.lib.sspi reuses the shared WinCryptTextToBinary wrapper instead of a private CryptStringToBinaryA path.
Under the hood
mormot.lib.openssl11+1
c9977bb6+32-33
lib: small refactoring of the two previous commits
Impact
TLS verification behavior remains the same while duplicated conversion and callback code is removed. No application migration is required.
21
Low
A JSON length guard is rewritten without changing its result
TJsonWriter.AddEscapeBuffer replaces one short-circuit condition with nested checks for MaxLen and Len. The final predicate remains MaxLen greater than zero and Len greater than MaxLen.
Under the hood
mormot.core.json
5b7993fc+5-5
core: fixed #626 TJsonWriter.AddEscapeBuffer
Impact
No observable application behavior or public API changes; this is a control-flow rewrite of the guard fixed in the preceding edition.
Units
22
Low
The network suite gains an end-to-end SChannel mTLS server test
test.net.proto creates Windows SChannel servers with client-certificate authentication and exercises successful and failed handshakes against generated test identities.
Tests
test.net.proto
1a36278a+332-6
test: cover SChannel mTLS server
Impact
This is regression coverage for the new feature and does not itself change application behavior.
Units
23
Low
SChannel test servers now run concurrently
The network test suite starts multiple SChannel server variants in parallel, exercising concurrent console output and independent TLS server lifetimes.
Tests
test.net.proto
2f892a9e+141-118
test: made SChannel servers run in parallel
Impact
Only the test harness changes. Production Delphi/FPC backends gain no direct behavioral or API change.
Units
24
Low
SChannel integration tests cover the completed client-auth matrix
TNetworkProtocols._SChannel extends the final Windows TLS matrix across server implementations, certificate-authority inputs and client-certificate outcomes after the mTLS changes.
Tests
test.net.proto
eddc9ae5+35-33
test: completed TNetworkProtocols._SChannel
Impact
Regression coverage increases; Delphi/FPC application code and runtime behavior are unchanged by this test-only commit.
Units
25
Low
OpenSSL server tests exercise more TLS validation paths
test.net.proto expands OpenSSL TLS server coverage alongside the new shared peer-validation callback behavior and the SChannel client-certificate cases.
Tests
test.net.proto
09e6e909+29-7
test: enhanced OpenSSL TLS server coverage
Impact
This is test-only coverage. It gives maintainers parity checks between OpenSSL and SChannel without changing public APIs.
Units
26
Low
SChannel tests add trust and callback edge cases
test.net.proto broadens SChannel coverage around CA sources, peer callbacks and client-certificate outcomes while the implementation is being completed.
Tests
test.net.proto
170f4c56+19-3
tests: better SChannel coverage
Impact
The change improves regression detection only; no application code or public API changes.