ICS V9.6

ICS 9.6 Release Notes

Changes in ICS V9.6 include:

1. Major improvements in ICS V9.6 include more Post Quantum Cryptography (PQC) support, a new general purpose symmetrical crypto component, HTTP support for WebDAV verbs, SNI, Cache-Control support and a sync request timeout, and new logging in TWSocket to replace or supplement logging code in numerous components and applications.
2. Security is continuously evolving, with new concepts added and old ones discontinued. This release removes some discontinued properties, so When opening old projects, please ignore warnings about missing properties, OcspHttp, OcspSrvStapling, SslDHParamLines and IcsLogger (can be enabled with a define).
3. Support for Post Quantum Cryptography (PQC) was added to OpenSSL 3.5, and is designed to be resistant against brute force hacking by ever faster computers. Initially, it is available for ML-DSA private keys for signing messages using Jose, and ML-KEM for TLS for secure key exchange as part of the SSL handshake. ICS V9.5 clients using OpenSSL 3.5 sent the group X25519MLKEM768, but this was not reported if supported, now fixed. This release adds similar support for TLSv1.3 servers. There are currently no PQC ciphers and PQC signed X509 certificates are awaiting an RFC and major changes for issuance, due to PQC keys being much larger than EC keys (over 1KB against 64 bytes) so are unacceptable in SSL handshakes.
4. Historically, event logging in ICS has varied between components, TWSocket had no cosmetically acceptable logging, only IcsLogger which was designed for development use, not end user applications. Some protocol components (SMPT, POP3, FTP) had limited logging while HTTP had none. This was resolved in the high level protocol components, HTTP Rest, Mail Queue, FTP Multi, HTTP Multi, that all have proper application logging. Likewise many samples had logging added to the component events. But what was logged was inconsistent, and maintaining the logging was difficult, in particular SSL handshake certificate checking and reporting where similar code was duplicated in literally dozens of components and samples, all of which had to be changed for new features or fixes.
5. Proper logging has now been added to TWSocket and TWSocketS, using the existing event onDebugDisplay (that was used in only one sample), controlled by a new set of options WSDebugOptions. Unless one or more options are set and the event handled no logging will be seen, so this is backward compatible with end user applications. TSslWSocket has new properties SslCertVerMethod and SslAllowSelfSign to enable SSL handshake certificate chain checking, replacing the similar code in numerous units.
6. Many of the protocol and server components already have an onDisplay event so this echoes from TWSocket, THTTPCli needed a new onDisplay event. Again these components expose WSDebugOptions and the SSL properties, but send no logging unless options are set, with the exception of protocol commands and responses previously sent by FTP and mail components still appear. So to get logging in your applications, use the onDebugDisplay (WSocket) or onDisplay (most other components) event and set WSDebugOptions, then remove any logging code you already have that duplicates the new logging, usually in the onConnected, onSslHandshakeDone and onDisconnect events. You may still need those events, to enable or disable buttons, change states, etc, just not for logging.
7. If your applications only uses high level components like HTTP Rest, no application changes are needed, the existing DebugLevel setting is mapped to similar WSDebugOptions so similar event messages appear, although there may be cosmetic improvements. Most servers already had some limited logging, but all now expose WSDebugOptions which should be set so TWSocketS reports SSL and IcsHosts problems, some of which previously got sent via the TX509Certs component.
8. The existing IcsLogger remains in the low level components, but DEFINE NO_DEBUG_LOG is now enabled in the Defs.inc file so the code will not be compiled. IcsLogger has been removed from all ICS samples and most high level components, and is planned to disappear completely as soon as possible, it's not been used it for development purposes for many years, if your applications use IcsLogger, please remove it. Dozens of samples have been updated to use the WSDebugOptions property for the new onDisplay and onDebugDisplay events, removing local logging where it duplicated the new logging,
9. As part of testing the new logging to ensure consistent reporting of connection IP addresses and hosts, fixed a long term problem with several protocol components that meant the TWSocket.Addr property was lost after a DnsLookup, which prevented logging the original host name. Likewise cleaned up proxy support for consistent logging of both proxy and target names.
10. ICS has long contained some functions for Blowfish cryptography, but these are now replaced by a proper TIcsSymCrypto component is a general purpose symmetrical cryptography component using block ciphers to encrypt and decrypt data, using a key derived from a password in various ways. It is designed to be compatible with the openssl-enc command line tool. The component can be tested using the OverbyteIcsJoseTst sample to encrypt and decrypt strings, streams or files. It supports all OpenSSL ciphers, AES being the most common, with several key derivation methods, PKCS5v15, PKCS5_PDKDF2_HMAC, Aragon2, Raw Key/IV, and a Quick Hash. There are two standalone functions IcsJoseStrEncrypt and IcsJoseStrDecrypt that include password, EvpCipher, and CKeyDerMethod as parameters for simplicity (last two have defaults). Note further testing for compatibility with JODE encryption is required.
11. Added new asymmetrical cryptography functions IcsJoseEncryptPKey, IcsJoseDecryptPKey, IcsJoseStrEncPKey, IcsJoseStrDecPKey, currently only work with RSA private and public keys. These replace older De/EncryptPublicRSA functions.
12. Added client and server support for HTTP WebDAV verbs, used for file transfer via HTTP. The HTTP components now support new verbs PURGE, PROPFIND, PROPPATCH, MKCOL, MOVE, COPY, LOCK and UNLOCK. Note only limited functionality is currently implemented, WebDAV is complex with many extensions from Microsoft. Currently the web server only internally handles PROPFIND for directory listings, some other verbs will be added for the next release. The HTTP REST sample converts the PROPFIND XML response into an array of TIcsFDirRec that other ICS functions can report and process. The WebDAV server commands require special authentication, performed in the three web servers samples.
13. The HTTP client has a new property SslSniType to specify how Host is sent as Server Name Indication (SNI), mainly when that name is an IP address. SslSniHostNoIP (default) does not send an IP address as SNI (most browsers do not), SslSniHostRawIP sends a raw IP address (default for ICS V9.4 and earlier, but breaks RFC6066), SslSniHostArpaIP converts the IP to reverse ARPA per V9.5), SslSniNone sends no SNI atall. Note certificate validation is always by SslServerName.
14. The HTTP client has a new property SyncMaxSecs for sync requests only, if non-zero specifies the maximum duration of a request in seconds, irrespective of the Timeout property which is only while the connection is idle. Only intended for short requests whose maximum duration is known, for the case where the request stalls for no sensible reason.
15. The HTTP client has a new property CacheType of THttpCacheType to replace NoCache with all the options: httpCacheNone, httpCacheNoCache, httpCacheNoStore, httpCacheMaxAge, httpCacheMaxStale, httpCacheMinFresh, httpCacheRevalidate, httpCacheOnlyIfCached. NoCache sets HttpCacheNone. cacheAgeSecs sets the cache age in seconds, 0=no cache. Note Cloudflare says 403 without a Cache-Control header. The OverbyteIcsHttpRestTst sample has new settings to test all the new HTTP client properties.
16. Other HTTP client changes include improved error handling so StatusCode=404 is always returned if a request fails, with the reason in ReasonPhrase and RequestDoneErrorStr; corrected DoBeforeConnect to set connection parameters from a DNS lookup using new method SetSinConn instead of connecting by IP address; setting a blank ProxyURL now clears previous proxy settings; ProxyURL now supports the SOCKS5 protocol; RequestAsync and RequestSync now reset FLocationChangeCurCount so relocation still works after failed relocations.
17. The WebSocket Client has a breaking change, WsConnect now passes URL instead of setting URL property, to allow RestParams to be passed. It now supports proxy setting correctly. Restored error handling for failed WSConnect in async mode, lost in V9.5, OnWSConnected event is called for success and failure, check IsWSConnected for success.
18. Improved IPv6 address handling for TX505Base. ListNameIP now returns standardised IPv6 addresses in an array, while SubAltNameIP returns a string with one line for each raw IPv6 address that may include capitals letters or extra :0:. Added ListAllNames that gets a string array of all subject alternate names for certificate, ie combines ListAltNameDNS and ListAltNameIP. SubAltAllDisp returns a display string with all SAN names. PostConnectionChec rewritten to use CheckHost but check IP addresses from SAN list since OpenSSL not happy with IPv6 addresses. Fixed CertMainInfo to correctly show TLS Server certificates with blank common name, and with IP addresses. Added TX509List method CertsHandshake to report client handshake certificates, usually host, intermediate and root. ValidateCertChain now reports the host name found, might be wildcard. IcsReportOpenSSLVer now reports loading error reason and only reports legacy module if loaded, since rarely needed now.
19. Updated the JOSE signing functions to use more private key types, specifically Post Quantum ML-DSA-44, ML-DSA-65, ML-DSA-87, ED448 and SM2, creating and reading JWS and JWT with new algorithms.
20. Let's Encrypt is now optionally issuing certificates with a six day expiry using the shortlived profile, in preparation for this requirement in 2029, and for IP addresses instead of host names. It is also issuing test certificates using a new dns-persist-01 challenge that can be set once in DNS for a specific account and never changes so can be set manually once, not live yet. ICS has been updated and tested with all these new features. Note that IPv6 string addresses are usually compacted, maybe in different ways, so uses IcsStndIPv6Str to standardise them for comparison. Now clearing old renewal dates properly, so new orders not stopped. Added SerNumType SerNumSpecific and SerialNum property for OwnCA. tlsserver and shortlived certificates without a subject name now install correctly in the Windows Store with a alternate name.
21. Updated the SMPT server component with IcsHosts for multiple listeners and automated certificates, now only available with SSL, none SSL version gone Added X-IpAddr and X-RDNS headers to avoid parsing Received header.
22. For the SMTP client and Mail Queue components, increased the SMTP timeout from five to 60 seconds, some servers accept commands slowly so mail failed.
23. In the proxy server component, added ForwardSocFamily property which sets the Forward Proxy family for all listeners, so a IPv4 listener can connect to IPv6 targets or be prevented from doing so. Added OnProxyForward event allows application to determine which ports HTTP Connect command will forward, normally only 80 and 443. If OnHttpPxyAuth event is assigned, Forward Proxy authentication is mandated with Proxy-Authorization: header and basic.
24. Added OpenSSL 4.0.0 to ICS, note the DLLs have new file names and will not load with any older version of ICS before this one today. Due to lack of testing, ICS V9.6 will remain defaulted to using OpenSSL 3.6 and will need changes to OverbyteIcsDefs.inc to load OpenSSL 4.0, see readme9.txt. When extracting OpenSSL files from resources, check that all three DLLs have been previously extracted, not just one. Also, don't stop extracting on first error, keep trying other files. There are no longer internal exceptions for errors. GSSLEAY_DLL_IgnoreNew now forces OpenSSL 3 if the old DLLs are found.
25. For Delphi 13.1, ICS may now be built for Windows WinARM64EC target, this has been added to the Delphi packages for the Win64 IDE only. Main difference with ARM is no assembler support or OBJ files. While the ICS packages build OK for ARM, no Windows ARM laptop to test samples.
26. Restored and updated an old sample OverbyteIcsServiceTcp.dpr, which is a Windows service with simple TCP server responding to telnet commands on 127.0.0.1 port 2150 by default. Added IcsSimpleLogging so it writes a daily log file so you know what it's doing. This sample uses the standard Windows service component, unlike the samples in Extra which use DDService.