Indy 10 loads SSL libraries even if I remove them

Question

I am currently encoutering a very strange problem. In one of my applications I use OpenSSL and Indy in order to create a secure TCP connection to a host. I wanted to test if the application (and Indy) are recognizing if the OpenSSL-libraries are missing. Those libraries are placed inside the application folder.

The strange thing is that my application still works fine even though I have removed the libraries. I also removed OpenSSL itself from my computer and searched for any other appearance of the OpenSSL-libraries. There are no OpenSSL-libraries on my computer.

So what is going on? I call the Load() method from IndyOpenSSLHeader in order to load the libraries and guess what...they are loading perfectly. How can this be? There are no libraries on my computer ^^

Btw I did NOT set up a custom library path. I am using the default one which - as far as I know - should be the application folder.

I am using Delphi XE5 and Indy 10 for me application.

What is wrong here?

Thanks in advance!

Answer 1

If you are on iOS then Indy links to OpenSSL statically. On any other platform, there is no possible way that Indy can successfully use OpenSSL SSL/TLS without loading its library files first, so they have to be getting loaded from somewhere you missed. If you are running on Windows, use Process Explorer to see where they are actually being loaded from.

Indy defaults to using the OS search path to load external libraries. The OS defaults to looking in the app's folder, but it can also look in other places as well. You can use Indy's IdOpenSSLSetLibPath() function to specify where you want OpenSSL loaded from (there is a similar function for ZLib - IdZLibSetLibPath()). This is good to ensure your app loads the libraries only from your app's folder and nowhere else, in case someone maliciously deletes the libraries from your app's folder in an attempt to trick it into loading the libraries from another path on the OS's search path. It is also good for testing purposes if you just want to see how your app reacts when the libraries are missing, without having to actually delete them.

Answer 2

They may be statically linked into your binary.

Also, there is a lot of places where SSL libraries could be. See this article (Search Order for Desktop Applications): http://msdn.microsoft.com/en-us/library/windows/desktop/ms682586%28v=vs.85%29.aspx