Skip to content

Commit 4ca75ff

Browse files
remicolletremicollet
committed
backport needed changes for OpenSSL 1.1
1 parent 390f647 commit 4ca75ff

8 files changed

Lines changed: 371 additions & 206 deletions

File tree

‎ext/openssl/openssl.c‎

Lines changed: 352 additions & 176 deletions
Large diffs are not rendered by default.

‎ext/openssl/tests/001.phpt‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,19 +18,20 @@ for ($z = "", $i = 0; $i < 1024; $i++) {
1818
usleep($i);
1919
}
2020

21-
$privkey = openssl_pkey_new();
21+
$conf = array('config' => dirname(__FILE__) . DIRECTORY_SEPARATOR . 'openssl.cnf');
22+
$privkey = openssl_pkey_new($conf);
2223

2324
if ($privkey === false)
2425
die("failed to create private key");
2526

2627
$passphrase = "banana";
27-
$key_file_name = tempnam("/tmp", "ssl");
28+
$key_file_name = tempnam(sys_get_temp_dir(), "ssl");
2829
if ($key_file_name === false)
2930
die("failed to get a temporary filename!");
3031

3132
echo "Export key to file\n";
3233

33-
openssl_pkey_export_to_file($privkey, $key_file_name, $passphrase) or die("failed to export to file $key_file_name");
34+
openssl_pkey_export_to_file($privkey, $key_file_name, $passphrase, $conf) or die("failed to export to file $key_file_name");
3435

3536
echo "Load key from file - array syntax\n";
3637

‎ext/openssl/tests/bug41033.phpt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,11 @@ $pub = 'file://' . dirname(__FILE__) . '/' . 'bug41033pub.pem';
1313

1414
$prkeyid = openssl_get_privatekey($prv, "1234");
1515
$ct = "Hello I am some text!";
16-
openssl_sign($ct, $signature, $prkeyid, OPENSSL_ALGO_DSS1);
16+
openssl_sign($ct, $signature, $prkeyid, OPENSSL_ALGO_SHA1);
1717
echo "Signature: ".base64_encode($signature) . "\n";
1818

1919
$pukeyid = openssl_get_publickey($pub);
20-
$valid = openssl_verify($ct, $signature, $pukeyid, OPENSSL_ALGO_DSS1);
20+
$valid = openssl_verify($ct, $signature, $pukeyid, OPENSSL_ALGO_SHA1);
2121
echo "Signature validity: " . $valid . "\n";
2222

2323

‎ext/openssl/tests/bug66501.phpt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ AwEHoUQDQgAEPq4hbIWHvB51rdWr8ejrjWo4qVNWVugYFtPg/xLQw0mHkIPZ4DvK
1616
sqOTOnMoezkbSmVVMuwz9flvnqHGmQvmug==
1717
-----END EC PRIVATE KEY-----';
1818
$key = openssl_pkey_get_private($pkey);
19-
$res = openssl_sign($data ='alpha', $sign, $key, 'ecdsa-with-SHA1');
19+
$res = openssl_sign($data ='alpha', $sign, $key, 'SHA1');
2020
var_dump($res);
2121
--EXPECTF--
2222
bool(true)

‎ext/openssl/tests/openssl_error_string_basic.phpt‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ expect_openssl_errors('openssl_pkey_export_to_file opening', ['02001002', '2006D
8989
expect_openssl_errors('openssl_pkey_export_to_file pem', ['0906D06C']);
9090
// file to export cannot be written
9191
@openssl_pkey_export_to_file($private_key_file, $invalid_file_for_write);
92-
expect_openssl_errors('openssl_pkey_export_to_file write', ['2006D002', '09072007']);
92+
expect_openssl_errors('openssl_pkey_export_to_file write', ['2006D002']);
9393
// succesful export
9494
@openssl_pkey_export($private_key_file_with_pass, $out, 'wrong pwd');
9595
expect_openssl_errors('openssl_pkey_export', ['06065064', '0906A065']);
@@ -105,7 +105,7 @@ expect_openssl_errors('openssl_private_decrypt', ['04065072']);
105105
// public encrypt and decrypt with failed padding check and padding
106106
@openssl_public_encrypt("data", $crypted, $public_key_file, 1000);
107107
@openssl_public_decrypt("data", $crypted, $public_key_file);
108-
expect_openssl_errors('openssl_private_(en|de)crypt padding', ['0906D06C', '04068076', '0407006A', '04067072']);
108+
expect_openssl_errors('openssl_private_(en|de)crypt padding', ['0906D06C', '04068076', '04067072']);
109109

110110
// X509
111111
echo "X509 errors\n";
@@ -126,7 +126,7 @@ expect_openssl_errors('openssl_x509_checkpurpose purpose', ['0B086079']);
126126
echo "CSR errors\n";
127127
// file for csr (file:///) fails when opennig (BIO_new_file)
128128
@openssl_csr_get_subject("file://" . $invalid_file_for_read);
129-
expect_openssl_errors('openssl_csr_get_subject open', ['02001002', '2006D080', '20068079', '0906D06C']);
129+
expect_openssl_errors('openssl_csr_get_subject open', ['02001002', '2006D080']);
130130
// file or str csr is not correct PEM - failing PEM_read_bio_X509_REQ
131131
@openssl_csr_get_subject($crt_file);
132132
expect_openssl_errors('openssl_csr_get_subjec pem', ['0906D06C']);

‎ext/openssl/tests/sni_server.phpt‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ sni_server
33
--SKIPIF--
44
<?php
55
if (!extension_loaded("openssl")) die("skip openssl not loaded");
6+
--XFAIL--
7+
Known to fail with OpenSSL 1.1
68
--FILE--
79
<?php
810
$serverCode = <<<'CODE'

‎ext/openssl/xp_ssl.c‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -935,13 +935,9 @@ static int set_local_cert(SSL_CTX *ctx, php_stream *stream TSRMLS_DC) /* {{{ */
935935
static const SSL_METHOD *php_select_crypto_method(long method_value, int is_client TSRMLS_DC) /* {{{ */
936936
{
937937
if (method_value == STREAM_CRYPTO_METHOD_SSLv2) {
938-
#ifndef OPENSSL_NO_SSL2
939-
return is_client ? SSLv2_client_method() : SSLv2_server_method();
940-
#else
941938
php_error_docref(NULL TSRMLS_CC, E_WARNING,
942939
"SSLv2 support is not compiled into the OpenSSL library PHP is linked against");
943940
return NULL;
944-
#endif
945941
} else if (method_value == STREAM_CRYPTO_METHOD_SSLv3) {
946942
#ifndef OPENSSL_NO_SSL3
947943
return is_client ? SSLv3_client_method() : SSLv3_server_method();
@@ -980,11 +976,6 @@ static long php_get_crypto_method_ctx_flags(long method_flags TSRMLS_DC) /* {{{
980976
{
981977
long ssl_ctx_options = SSL_OP_ALL;
982978

983-
#ifndef OPENSSL_NO_SSL2
984-
if (!(method_flags & STREAM_CRYPTO_METHOD_SSLv2)) {
985-
ssl_ctx_options |= SSL_OP_NO_SSLv2;
986-
}
987-
#endif
988979
#ifndef OPENSSL_NO_SSL3
989980
if (!(method_flags & STREAM_CRYPTO_METHOD_SSLv3)) {
990981
ssl_ctx_options |= SSL_OP_NO_SSLv3;
@@ -1602,7 +1593,6 @@ static zval *capture_session_meta(SSL *ssl_handle) /* {{{ */
16021593
#endif
16031594
case TLS1_VERSION: proto_str = "TLSv1"; break;
16041595
case SSL3_VERSION: proto_str = "SSLv3"; break;
1605-
case SSL2_VERSION: proto_str = "SSLv2"; break;
16061596
default: proto_str = "UNKNOWN";
16071597
}
16081598

@@ -2416,13 +2406,8 @@ php_stream *php_openssl_ssl_socket_factory(const char *proto, size_t protolen,
24162406
sslsock->enable_on_connect = 1;
24172407
sslsock->method = get_crypto_method(context, STREAM_CRYPTO_METHOD_ANY_CLIENT);
24182408
} else if (strncmp(proto, "sslv2", protolen) == 0) {
2419-
#ifdef OPENSSL_NO_SSL2
24202409
php_error_docref(NULL TSRMLS_CC, E_WARNING, "SSLv2 support is not compiled into the OpenSSL library PHP is linked against");
24212410
return NULL;
2422-
#else
2423-
sslsock->enable_on_connect = 1;
2424-
sslsock->method = STREAM_CRYPTO_METHOD_SSLv2_CLIENT;
2425-
#endif
24262411
} else if (strncmp(proto, "sslv3", protolen) == 0) {
24272412
#ifdef OPENSSL_NO_SSL3
24282413
php_error_docref(NULL TSRMLS_CC, E_WARNING, "SSLv3 support is not compiled into the OpenSSL library PHP is linked against");

‎ext/phar/util.c‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1531,7 +1531,7 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, php_uint32 sig_typ
15311531
BIO *in;
15321532
EVP_PKEY *key;
15331533
EVP_MD *mdtype = (EVP_MD *) EVP_sha1();
1534-
EVP_MD_CTX md_ctx;
1534+
EVP_MD_CTX *md_ctx;
15351535
#else
15361536
int tempsig;
15371537
#endif
@@ -1608,7 +1608,8 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, php_uint32 sig_typ
16081608
return FAILURE;
16091609
}
16101610

1611-
EVP_VerifyInit(&md_ctx, mdtype);
1611+
md_ctx = EVP_MD_CTX_create();
1612+
EVP_VerifyInit(md_ctx, mdtype);
16121613
read_len = end_of_phar;
16131614

16141615
if (read_len > sizeof(buf)) {
@@ -1620,17 +1621,17 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, php_uint32 sig_typ
16201621
php_stream_seek(fp, 0, SEEK_SET);
16211622

16221623
while (read_size && (len = php_stream_read(fp, (char*)buf, read_size)) > 0) {
1623-
EVP_VerifyUpdate (&md_ctx, buf, len);
1624+
EVP_VerifyUpdate (md_ctx, buf, len);
16241625
read_len -= (off_t)len;
16251626

16261627
if (read_len < read_size) {
16271628
read_size = (int)read_len;
16281629
}
16291630
}
16301631

1631-
if (EVP_VerifyFinal(&md_ctx, (unsigned char *)sig, sig_len, key) != 1) {
1632+
if (EVP_VerifyFinal(md_ctx, (unsigned char *)sig, sig_len, key) != 1) {
16321633
/* 1: signature verified, 0: signature does not match, -1: failed signature operation */
1633-
EVP_MD_CTX_cleanup(&md_ctx);
1634+
EVP_MD_CTX_destroy(md_ctx);
16341635

16351636
if (error) {
16361637
spprintf(error, 0, "broken openssl signature");
@@ -1639,7 +1640,7 @@ int phar_verify_signature(php_stream *fp, size_t end_of_phar, php_uint32 sig_typ
16391640
return FAILURE;
16401641
}
16411642

1642-
EVP_MD_CTX_cleanup(&md_ctx);
1643+
EVP_MD_CTX_destroy(md_ctx);
16431644
#endif
16441645

16451646
*signature_len = phar_hex_str((const char*)sig, sig_len, signature TSRMLS_CC);

0 commit comments

Comments
 (0)