Skip to content

Commit 2aaa3d5

Browse files
rdlowreym6w6
rdlowrey
authored and
m6w6
committed
Added support for TLSv1.1 and TLSv1.2
Conflicts: ext/openssl/xp_ssl.c
1 parent 51b809e commit 2aaa3d5

File tree

7 files changed

+226
-3
lines changed

7 files changed

+226
-3
lines changed

‎ext/openssl/openssl.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1151,6 +1151,10 @@ PHP_MINIT_FUNCTION(openssl)
11511151
php_stream_xport_register("sslv2", php_openssl_ssl_socket_factory TSRMLS_CC);
11521152
#endif
11531153
php_stream_xport_register("tls", php_openssl_ssl_socket_factory TSRMLS_CC);
1154+
#if OPENSSL_VERSION_NUMBER >= 0x10001001L
1155+
php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory TSRMLS_CC);
1156+
php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory TSRMLS_CC);
1157+
#endif
11541158

11551159
/* override the default tcp socket provider */
11561160
php_stream_xport_register("tcp", php_openssl_ssl_socket_factory TSRMLS_CC);
@@ -1189,6 +1193,10 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
11891193
#endif
11901194
php_stream_xport_unregister("sslv3" TSRMLS_CC);
11911195
php_stream_xport_unregister("tls" TSRMLS_CC);
1196+
#if OPENSSL_VERSION_NUMBER >= 0x10001001L
1197+
php_stream_xport_unregister("tlsv1.1" TSRMLS_CC);
1198+
php_stream_xport_unregister("tlsv1.2" TSRMLS_CC);
1199+
#endif
11921200

11931201
/* reinstate the default tcp handler */
11941202
php_stream_xport_register("tcp", php_stream_generic_socket_factory TSRMLS_CC);

‎ext/openssl/tests/streams_crypto_method.pem

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIC5jCCAk+gAwIBAgIBADANBgkqhkiG9w0BAQQFADBcMQswCQYDVQQGEwJBVTET
3+
MBEGA1UECBMKUXVlZW5zbGFuZDEaMBgGA1UEChMRQ3J5cHRTb2Z0IFB0eSBMdGQx
4+
HDAaBgNVBAMTE1Rlc3QgUENBICgxMDI0IGJpdCkwHhcNOTkxMjAyMjEzNTQ4WhcN
5+
MDUwNzExMjEzNTQ4WjBcMQswCQYDVQQGEwJBVTETMBEGA1UECBMKUXVlZW5zbGFu
6+
ZDEaMBgGA1UEChMRQ3J5cHRTb2Z0IFB0eSBMdGQxHDAaBgNVBAMTE1Rlc3QgUENB
7+
ICgxMDI0IGJpdCkwgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBAJ2haT/f5Zwy
8+
V+MiuSDjSR62adBoSiBB7Usty44lXqsp9RICw+DCCxpsn/CfxPEDXLLd4olsWXc6
9+
JRcxGynbYmnzk+Z6aIPPJQhK3CTvaqGnWKZsA1m+WaUIUqJCuNTK4N+7hMAGaf6S
10+
S3e9HVgEQ4a34gXJ7VQFVIBNV1EnZRWHAgMBAAGjgbcwgbQwHQYDVR0OBBYEFE0R
11+
aEcrj18q1dw+G6nJbsTWR213MIGEBgNVHSMEfTB7gBRNEWhHK49fKtXcPhupyW7E
12+
1kdtd6FgpF4wXDELMAkGA1UEBhMCQVUxEzARBgNVBAgTClF1ZWVuc2xhbmQxGjAY
13+
BgNVBAoTEUNyeXB0U29mdCBQdHkgTHRkMRwwGgYDVQQDExNUZXN0IFBDQSAoMTAy
14+
NCBiaXQpggEAMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAUa8B3pho
15+
+Mvxeq9HsEzJxHIFQla05S5J/e/V+DQTYoKiRFchKPrDAdrzYSEvP3h4QJEtsNqQ
16+
JfOxg5M42uLFq7aPGWkF6ZZqZsYS+zA9IVT14g7gNA6Ne+5QtJqQtH9HA24st0T0
17+
Tga/lZ9M2ovImovaxSL/kRHbpCWcqWVxpOw=
18+
-----END CERTIFICATE-----
19+
-----BEGIN RSA PRIVATE KEY-----
20+
MIICXAIBAAKBgQCdoWk/3+WcMlfjIrkg40ketmnQaEogQe1LLcuOJV6rKfUSAsPg
21+
wgsabJ/wn8TxA1yy3eKJbFl3OiUXMRsp22Jp85PmemiDzyUIStwk72qhp1imbANZ
22+
vlmlCFKiQrjUyuDfu4TABmn+kkt3vR1YBEOGt+IFye1UBVSATVdRJ2UVhwIDAQAB
23+
AoGAba4fTtuap5l7/8ZsbE7Z1O32KJY4ZcOZukLOLUUhXxXduT+FTgGWujc0/rgc
24+
z9qYCLlNZHOouMYTgtSfYvuMuLZ11VIt0GYH+nRioLShE59Yy+zCRyC+gPigS1kz
25+
xvo14AsOIPYV14Tk/SsHyq6E0eTk7VzaIE197giiINUERPECQQDSKmtPTh/lRKw7
26+
HSZSM0I1mFWn/1zqrAbontRQY5w98QWIOe5qmzYyFbPXYT3d9BzlsMyhgiRNoBbD
27+
yvohSHXJAkEAwAHx6ezAZeWWzD5yXD36nyjpkVCw7Tk7TSmOceLJMWt1QcrCfqlS
28+
xA5jjpQ6Z8suU5DdtWAryM2sAir1WisYzwJAd6Zcx56jvAQ3xcPXsE6scBTVFzrj
29+
7FqZ6E+cclPzfLQ+QQsyOBE7bpI6e/FJppY26XGZXo3YGzV8IGXrt40oOQJALETG
30+
h86EFXo3qGOFbmsDy4pdP5nBERCu8X1xUCSfintiD4c2DInxgS5oGclnJeMcjTvL
31+
QjQoJCX3UJCi/OUO1QJBAKgcDHWjMvt+l1pjJBsSEZ0HX9AAIIVx0RQmbFGS+F2Q
32+
hhu5l77WnnZOQ9vvhV5u7NPCUF9nhU3jh60qWWO8mkc=
33+
-----END RSA PRIVATE KEY-----

‎ext/openssl/tests/tlsv1.1_wrapper_001.phpt

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
--TEST--
2+
tlsv1.1 stream wrapper
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("openssl")) die("skip");
6+
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSL 1.0.1 required");
7+
if (!function_exists('pcntl_fork')) die("skip no fork");
8+
--FILE--
9+
<?php
10+
$flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
11+
$ctx = stream_context_create(array('ssl' => array(
12+
'local_cert' => __DIR__ . '/streams_crypto_method.pem',
13+
)));
14+
15+
$server = stream_socket_server('tlsv1.1://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
16+
var_dump($server);
17+
18+
$pid = pcntl_fork();
19+
if ($pid == -1) {
20+
die('could not fork');
21+
} elseif ($pid) {
22+
$flags = STREAM_CLIENT_CONNECT;
23+
$ctx = stream_context_create(array('ssl' => array(
24+
'verify_peer' => false
25+
)));
26+
27+
$client = stream_socket_client("tlsv1.1://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
28+
var_dump($client);
29+
30+
$client = @stream_socket_client("sslv3://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
31+
var_dump($client);
32+
33+
$client = @stream_socket_client("tlsv1.2://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
34+
var_dump($client);
35+
36+
} else {
37+
@pcntl_wait($status);
38+
for ($i=0; $i < 3; $i++) {
39+
@stream_socket_accept($server, 1);
40+
}
41+
}
42+
--EXPECTF--
43+
resource(%d) of type (stream)
44+
resource(%d) of type (stream)
45+
bool(false)
46+
bool(false)

‎ext/openssl/tests/tlsv1.2_wrapper_002.phpt

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
--TEST--
2+
tlsv1.2 stream wrapper
3+
--SKIPIF--
4+
<?php
5+
if (!extension_loaded("openssl")) die("skip");
6+
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSL 1.0.1 required");
7+
if (!function_exists('pcntl_fork')) die("skip no fork");
8+
--FILE--
9+
<?php
10+
$flags = STREAM_SERVER_BIND|STREAM_SERVER_LISTEN;
11+
$ctx = stream_context_create(array('ssl' => array(
12+
'local_cert' => __DIR__ . '/streams_crypto_method.pem',
13+
)));
14+
15+
$server = stream_socket_server('tlsv1.2://127.0.0.1:64321', $errno, $errstr, $flags, $ctx);
16+
var_dump($server);
17+
18+
$pid = pcntl_fork();
19+
if ($pid == -1) {
20+
die('could not fork');
21+
} elseif ($pid) {
22+
$flags = STREAM_CLIENT_CONNECT;
23+
$ctx = stream_context_create(array('ssl' => array(
24+
'verify_peer' => false
25+
)));
26+
27+
$client = stream_socket_client("tlsv1.2://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
28+
var_dump($client);
29+
30+
$client = @stream_socket_client("sslv3://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
31+
var_dump($client);
32+
33+
$client = @stream_socket_client("tlsv1.1://127.0.0.1:64321", $errno, $errstr, 1, $flags, $ctx);
34+
var_dump($client);
35+
36+
} else {
37+
@pcntl_wait($status);
38+
for ($i=0; $i < 3; $i++) {
39+
@stream_socket_accept($server, 1);
40+
}
41+
}
42+
--EXPECTF--
43+
resource(%d) of type (stream)
44+
resource(%d) of type (stream)
45+
bool(false)
46+
bool(false)

‎ext/openssl/xp_ssl.c

Lines changed: 84 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -346,6 +346,24 @@ static inline int php_openssl_setup_crypto(php_stream *stream,
346346
sslsock->is_client = 1;
347347
method = TLSv1_client_method();
348348
break;
349+
case STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT:
350+
#if OPENSSL_VERSION_NUMBER >= 0x10001001L
351+
sslsock->is_client = 1;
352+
method = TLSv1_1_client_method();
353+
break;
354+
#else
355+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "TLSv1.1 support is not compiled into the OpenSSL library PHP is linked against");
356+
return -1;
357+
#endif
358+
case STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT:
359+
#if OPENSSL_VERSION_NUMBER >= 0x10001001L
360+
sslsock->is_client = 1;
361+
method = TLSv1_2_client_method();
362+
break;
363+
#else
364+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "TLSv1.2 support is not compiled into the OpenSSL library PHP is linked against");
365+
return -1;
366+
#endif
349367
case STREAM_CRYPTO_METHOD_SSLv23_SERVER:
350368
sslsock->is_client = 0;
351369
method = SSLv23_server_method();
@@ -367,6 +385,24 @@ static inline int php_openssl_setup_crypto(php_stream *stream,
367385
sslsock->is_client = 0;
368386
method = TLSv1_server_method();
369387
break;
388+
case STREAM_CRYPTO_METHOD_TLSv1_1_SERVER:
389+
#if OPENSSL_VERSION_NUMBER >= 0x10001001L
390+
sslsock->is_client = 0;
391+
method = TLSv1_1_server_method();
392+
break;
393+
#else
394+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "TLSv1.1 support is not compiled into the OpenSSL library PHP is linked against");
395+
return -1;
396+
#endif
397+
case STREAM_CRYPTO_METHOD_TLSv1_2_SERVER:
398+
#if OPENSSL_VERSION_NUMBER >= 0x10001001L
399+
sslsock->is_client = 0;
400+
method = TLSv1_2_server_method();
401+
break;
402+
#else
403+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "TLSv1.2 support is not compiled into the OpenSSL library PHP is linked against");
404+
return -1;
405+
#endif
370406
default:
371407
return -1;
372408

@@ -667,6 +703,12 @@ static inline int php_openssl_tcp_sockop_accept(php_stream *stream, php_openssl_
667703
case STREAM_CRYPTO_METHOD_TLS_CLIENT:
668704
sock->method = STREAM_CRYPTO_METHOD_TLS_SERVER;
669705
break;
706+
case STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT:
707+
sock->method = STREAM_CRYPTO_METHOD_TLSv1_1_SERVER;
708+
break;
709+
case STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT:
710+
sock->method = STREAM_CRYPTO_METHOD_TLSv1_2_SERVER;
711+
break;
670712
default:
671713
break;
672714
}
@@ -853,8 +895,32 @@ php_stream_ops php_openssl_socket_ops = {
853895
php_openssl_sockop_set_option,
854896
};
855897

856-
static char * get_sni(php_stream_context *ctx, char *resourcename, long resourcenamelen, int is_persistent TSRMLS_DC) {
898+
static int get_crypto_method(php_stream_context *ctx) {
899+
if (ctx) {
900+
zval **val = NULL;
901+
long crypto_method;
902+
903+
if (php_stream_context_get_option(ctx, "ssl", "crypto_method", &val) == SUCCESS) {
904+
convert_to_long_ex(val);
905+
crypto_method = (long)Z_LVAL_PP(val);
906+
907+
switch (crypto_method) {
908+
case STREAM_CRYPTO_METHOD_SSLv2_CLIENT:
909+
case STREAM_CRYPTO_METHOD_SSLv3_CLIENT:
910+
case STREAM_CRYPTO_METHOD_SSLv23_CLIENT:
911+
case STREAM_CRYPTO_METHOD_TLS_CLIENT:
912+
case STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT:
913+
case STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT:
914+
return crypto_method;
915+
}
916+
917+
}
918+
}
919+
920+
return STREAM_CRYPTO_METHOD_SSLv23_CLIENT;
921+
}
857922

923+
static char * get_sni(php_stream_context *ctx, const char *resourcename, size_t resourcenamelen, int is_persistent TSRMLS_DC) {
858924
php_url *url;
859925

860926
if (ctx) {
@@ -954,8 +1020,24 @@ php_stream *php_openssl_ssl_socket_factory(const char *proto, long protolen,
9541020
} else if (strncmp(proto, "tls", protolen) == 0) {
9551021
sslsock->enable_on_connect = 1;
9561022
sslsock->method = STREAM_CRYPTO_METHOD_TLS_CLIENT;
1023+
} else if (strncmp(proto, "tlsv1.1", protolen) == 0) {
1024+
#if OPENSSL_VERSION_NUMBER >= 0x10001001L
1025+
sslsock->enable_on_connect = 1;
1026+
sslsock->method = STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT;
1027+
#else
1028+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "TLSv1.1 support is not compiled into the OpenSSL library PHP is linked against");
1029+
return NULL;
1030+
#endif
1031+
} else if (strncmp(proto, "tlsv1.2", protolen) == 0) {
1032+
#if OPENSSL_VERSION_NUMBER >= 0x10001001L
1033+
sslsock->enable_on_connect = 1;
1034+
sslsock->method = STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT;
1035+
#else
1036+
php_error_docref(NULL TSRMLS_CC, E_WARNING, "TLSv1.2 support is not compiled into the OpenSSL library PHP is linked against");
1037+
return NULL;
1038+
#endif
9571039
}
958-
1040+
9591041
return stream;
9601042
}
9611043

‎ext/standard/file.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,10 +223,14 @@ PHP_MINIT_FUNCTION(file)
223223
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_SSLv3_CLIENT", STREAM_CRYPTO_METHOD_SSLv3_CLIENT, CONST_CS|CONST_PERSISTENT);
224224
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_SSLv23_CLIENT", STREAM_CRYPTO_METHOD_SSLv23_CLIENT, CONST_CS|CONST_PERSISTENT);
225225
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_TLS_CLIENT", STREAM_CRYPTO_METHOD_TLS_CLIENT, CONST_CS|CONST_PERSISTENT);
226+
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT", STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT, CONST_CS|CONST_PERSISTENT);
227+
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT", STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT, CONST_CS|CONST_PERSISTENT);
226228
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_SSLv2_SERVER", STREAM_CRYPTO_METHOD_SSLv2_SERVER, CONST_CS|CONST_PERSISTENT);
227229
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_SSLv3_SERVER", STREAM_CRYPTO_METHOD_SSLv3_SERVER, CONST_CS|CONST_PERSISTENT);
228230
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_SSLv23_SERVER", STREAM_CRYPTO_METHOD_SSLv23_SERVER, CONST_CS|CONST_PERSISTENT);
229231
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_TLS_SERVER", STREAM_CRYPTO_METHOD_TLS_SERVER, CONST_CS|CONST_PERSISTENT);
232+
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_TLSv1_1_SERVER", STREAM_CRYPTO_METHOD_TLSv1_1_SERVER, CONST_CS|CONST_PERSISTENT);
233+
REGISTER_LONG_CONSTANT("STREAM_CRYPTO_METHOD_TLSv1_2_SERVER", STREAM_CRYPTO_METHOD_TLSv1_2_SERVER, CONST_CS|CONST_PERSISTENT);
230234

231235
REGISTER_LONG_CONSTANT("STREAM_SHUT_RD", STREAM_SHUT_RD, CONST_CS|CONST_PERSISTENT);
232236
REGISTER_LONG_CONSTANT("STREAM_SHUT_WR", STREAM_SHUT_WR, CONST_CS|CONST_PERSISTENT);

‎main/streams/php_stream_transport.h

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -170,10 +170,14 @@ typedef enum {
170170
STREAM_CRYPTO_METHOD_SSLv3_CLIENT,
171171
STREAM_CRYPTO_METHOD_SSLv23_CLIENT,
172172
STREAM_CRYPTO_METHOD_TLS_CLIENT,
173+
STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT,
174+
STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
173175
STREAM_CRYPTO_METHOD_SSLv2_SERVER,
174176
STREAM_CRYPTO_METHOD_SSLv3_SERVER,
175177
STREAM_CRYPTO_METHOD_SSLv23_SERVER,
176-
STREAM_CRYPTO_METHOD_TLS_SERVER
178+
STREAM_CRYPTO_METHOD_TLS_SERVER,
179+
STREAM_CRYPTO_METHOD_TLSv1_1_SERVER,
180+
STREAM_CRYPTO_METHOD_TLSv1_2_SERVER
177181
} php_stream_xport_crypt_method_t;
178182

179183
BEGIN_EXTERN_C()

0 commit comments

Comments
 (0)