OpenSSL tutorials?

Well, they have a wiki which includes code samples on client usage. I'd start with that.

If that isn't enough, I'd look at the source of curl and see how they did things.

Thanks for the replies; libCurl is probably a good option now I think about it. I had a quick look on google, but most of the tutorials I've found are very high level introductions.

I somehow missed the wiki completely too - I'll have a look through that also.

Cheers,

Steve

There is built-in support for it in Windows APIs, for handshakes and encrypt/decrypt. Found this for example, that wraps send/recv on a socket to properly encode the data: http://www.codeproject.com/Articles/24379/SSL-Convert-your-Plain-Sockets-to-SSL-Sockets-in-a

I haven't used libcurl. It is probably fine, my biggest concern (if you're worried about security, which I almost always am) is if its been evaluated or tested in any way to ensure that it actually "does the right thing."

WinHTTP is not... perfect, it has re-entrance issues and other problems, but it has had a lot of testing and professional software written using it, which means most of the security side bugs have been killed. I cannot say the same thing for libcurl. It might be a lot like OpenSSL, where very few eyes have actually looked at it and said "oh yeah, this is safe."

Here's a simple example of using WinHTTP to issue a secure request to google for its front page. You need to include the HttpRequest.idl into your project, visual studio will automatically build the appropriate header (mine called it httprequest_h.h). Do note that I'm using ATL to avoid manually managing memory. Also you can specify a certificate path and explicitly pick out a certificate to use if you wanted. I selected the client default certificate.

#include <string>
#include <Windows.h>
#include <atlbase.h>
#include "httprequest_h.h"

struct ScopedComInitialize {
	ScopedComInitialize() {
		CoInitialize(0);
	}

	~ScopedComInitialize() {
		CoUninitialize();
	}
};

int main()
{
	ScopedComInitialize s;
	CComPtr<IWinHttpRequest> request;

	HRESULT hr = CoCreateInstance(CLSID_WinHttpRequest, nullptr, CLSCTX_INPROC_SERVER, IID_IWinHttpRequest, reinterpret_cast<void**>(&request.p));

	if (FAILED(hr)) {
		std::cout << "Failed to create HTTP request." << std::endl;
		return -1;
	}

	CComBSTR url("https://www.google.com/");
	CComBSTR method("GET");
	CComVariant isAsync(false);
	
	hr = request->Open(method, url, isAsync);
	if (FAILED(hr)) {
		std::cout << "Failed to open secure connection to google.com" << std::endl;
		return -1;
	}

	hr = request->SetClientCertificate(CComBSTR(""));
	if (FAILED(hr)) {
		std::cout << "Failed to set client certificate." << std::endl;
		return -1;
	}

	CComVariant empty;
	empty.ChangeType(VT_ERROR);

	hr = request->Send(empty);
	if (FAILED(hr)) {
		std::cout << "Failed to send request to google.com" << std::endl;
		return -1;
	}

	CComBSTR responseText;
	hr = request->get_ResponseText(&responseText);

	if (FAILED(hr)) {
		std::cout << "Failed to read response text." << std::endl;
		return -1;
	}

	std::cout << CW2A(responseText) << std::endl;
	return 0;
}

my biggest concern (if you're worried about security, which I almost always am) is if its been evaluated or tested in any way to ensure that it actually "does the right thing."

my biggest concern (if you're worried about security, which I almost always am) is if its been evaluated or tested in any way to ensure that it actually "does the right thing."

Given that most Linux and even BSD distribution package managers end up relying on that library for their package management, I would be very surprised if it had inherent security flaws!

if one didn't know better, one might think you were being serious

I would be very surprised if it had inherent security flaws!

If it was Gentoo emerge and Arch pacman, I'd be with you :-) When it's some of the more mature projects, I give them a little more credence.

Also, every script-based web framework under the sun includes libcurl, which means that Facebook, Twitter, and a number of other large sites that are known to actually contribute patches back, have been using it. Thus, I'd trust libcurl over my own implementation on top of first principles.

So... you think that somehow it might have more eyes on it? I have no doubt that people contribute patches, but looking at the github I can see that there are 4 main developers who make up 99% of all commits. This is the SAME problem OpenSSL had, and you can recall how secure that "widely used" library turned out.

More eyes doesn't mean people are actually looking at it. and while it is nice in theory to claim that more eyes means more chances to spot the issues... most of these appear to be just feature additions, not necessarily security reviews and enhancements.

I am not saying one should implement their own SSL, in fact I have stated otherwise above. But, you already HAVE an implementation in place on windows, which gets all the benefits of windows security updates, and more. You do not need to use yet another one, where you will likely just drop in the DLL and never update it (or worse, static link it). That and I happen to know that WinHTTP HAS BEEN security audited. I cannot say the same about libcurl (and the same cannot be said about OpenSSL, which is in the process of but has not been completely, security reviewed).

This is the SAME problem OpenSSL had, and you can recall how secure that "widely used" library turned out.

So I set up libCurl, and wow - it's awesome. I don't know why I've not been using it already. I don't mind not being able to use my existing socket code; libcurl is amazingly simple to use and a lot more configurable than I thought it was.

Security isn't really a concern for me, since I'm only using it as an HTTP[S] client, and I'm not sending or receiving particularly sensitive data. I know ot should be a concern, but... meh

EDIT: Share and enjoy:

• https://www.dropbox.com/s/n2ccfcl2i307w7c/PWebRequest.h?dl=0
• https://www.dropbox.com/s/rgekny0gmsb7644/PWebRequest.cpp?dl=0
• https://www.dropbox.com/s/r7gv0dd47ww4h6n/PWebRequestFactory.h?dl=0
• https://www.dropbox.com/s/obweuojfrxxxggc/PWebRequestFactory.cpp?dl=0

Cheers,

Steve

That requires more effort than just pasting a Dropbox link though ;)