summaryrefslogtreecommitdiff
path: root/ext/openssl
Commit message (Collapse)AuthorAgeFilesLines
* Fix bug #79983: Add support for OCB modeNikita Popov2020-10-194-7/+199
| | | | | | | | | | OCB mode ciphers were already exposed to openssl_encrypt/decrypt, but misbehaved, because they were not treated as AEAD ciphers. From that perspective, OCB should be treated the same way as GCM. In OpenSSL 1.1 the necessary controls were unified under EVP_CTRL_AEAD_* (and OCB is only supported since OpenSSL 1.1). Closes GH-6337.
* Allow passing $tag for non-authenticated encryptionNikita Popov2020-10-144-13/+7
| | | | | | | | | | | | | | openssl_encrypt() currently throws a warning if the $tag out parameter is passed for a non-authenticated cipher. This violates the principle that a function should behave the same if a parameter is not passed, and if the default value is passed for the parameter. I believe this warning should simply be dropped and the $tag be populated with null, as is already the case. Otherwise, it is not possible to use openssl_encrypt() in generic wrapper APIs, that are compatible with both authenticated and non-authenticated encryption. Closes GH-6333.
* Revert "Add missing X509 purpose constants"Nikita Popov2020-10-122-14/+2
| | | | | | This reverts commit 1e53e14bc31aec98a408e517c7c8493ef4bf80cd. This fails on Travis.
* Add missing X509 purpose constantsVincent JARDIN2020-10-122-2/+14
| | | | | | | | | | | | | X509_PURPOSE_OCSP_HELPER, X509_PURPOSE_TIMESTAMP_SIGN are available from OpenSSL for many years: - X509_PURPOSE_OCSP_HELPER, since 2001 - X509_PURPOSE_TIMESTAMP_SIGN, since 2006 Also drop the ifdef check for X509_PURPOSE_ANY, as it is always available in supported OpenSSL versions. Closes GH-6312.
* Merge branch 'PHP-7.3' into PHP-7.4Stanislav Malyshev2020-09-284-22/+57
|\ | | | | | | | | | | | | | | * PHP-7.3: Update UPGRADING Update NEWS & UPGRADING Do not decode cookie names anymore Fix bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV)
| * Merge branch 'PHP-7.2' into PHP-7.3Stanislav Malyshev2020-09-284-22/+57
| |\ | | | | | | | | | | | | | | | | | | * PHP-7.2: Update NEWS & UPGRADING Do not decode cookie names anymore Fix bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV)
| | * Fix bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV)Stanislav Malyshev2020-09-264-22/+57
| | |
* | | Fixed bug #79881Nikita Popov2020-07-222-4/+49
| | |
* | | Generate temporary config file when generating certificatesNikita Popov2020-06-192-37/+47
| | | | | | | | | | | | | | | The putenv trick doesn't work on ZTS Windows, so generate a new openssl config every time.
* | | Downgrade server security level in security level testNikita Popov2020-06-181-1/+4
| | | | | | | | | | | | | | | We want to test the client side error here, so make sure the server side can start up successfully.
* | | Add SubjectAltName support to certificate generatorNikita Popov2020-06-187-77/+71
| | | | | | | | | | | | | | | | | | | | | And switch tests using SAN certificates to the generator. This is ugly, but there doesn't seem to be a more direct way to privide SAN in PHP.
* | | Generate certificates for bug69215.phptNikita Popov2020-06-184-86/+22
| | |
* | | Generate certificate for bug68920.phptNikita Popov2020-06-181-1/+12
| | | | | | | | | | | | | | | The certificate really doesn't matter here, but it still needs to comply with security level...
* | | Generate certificate for bug65729.pemNikita Popov2020-06-182-35/+18
| | | | | | | | | | | | Make this test pass under security level 2.
* | | Revert "Fix tests regarding OpenSSL security_level"Nikita Popov2020-06-183-36/+18
| | | | | | | | | | | | This reverts commit b281493503401a2b5c45c11fcd0498d8448998c2.
* | | Don't generate spurious warning is security_level not supportedNikita Popov2020-06-181-5/+1
| | | | | | | | | | | | | | | People should not have to worry about the used openssl version when downgrading security_level.
* | | Fix tests regarding OpenSSL security_levelChristoph M. Becker2020-06-183-18/+36
| | | | | | | | | | | | | | | | | | The `security_level` stream option is only available as of OpenSSL 1.1.0, so we only set it for these versions. Older OpenSSL versions do not have security levels at all.
* | | Migrate some tests to certificate generatorNikita Popov2020-06-189-41/+106
| | | | | | | | | | | | | | | | | | | | | | | | | | | This migrates all the tests using ext/openssl/tests/streams_crypto_method.pem to the certificate generator, so we can easily adjust needed parameters. In particular, this makes the cert security level 2 compatible. However, we still need to downgrade security_level to 1 in a number of tests, because they are testing TLS < 1.2 connections.
* | | Use sha256 as digest algorithm in certificate generatorNikita Popov2020-06-171-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | This makes the generated certificates compatible with security level 2, which is apparently the default on Ubuntu 20.04. Unfortunately this does not fix all tests, because some are using pre-generated certificates.
* | | Merge branch 'PHP-7.3' into PHP-7.4Christoph M. Becker2020-06-092-2/+17
|\ \ \ | |/ / | | | | | | | | | * PHP-7.3: Fix #62890: default_socket_timeout=-1 causes connection to timeout
| * | Fix #62890: default_socket_timeout=-1 causes connection to timeoutChristoph M. Becker2020-06-092-2/+17
| | | | | | | | | | | | | | | | | | While unencrypted connections ignore negative timeouts, SSL/TLS connections did not special case that, and so always failed due to timeout.
* | | Merge branch 'PHP-7.3' into PHP-7.4Nikita Popov2020-04-201-2/+2
|\ \ \ | |/ / | | | | | | | | | * PHP-7.3: Fix #79497: Fix php_openssl_subtract_timeval()
| * | Fix #79497: Fix php_openssl_subtract_timeval()Joe Cai2020-04-201-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | I stumbled upon this while debugging a strange issue with stream_socket_client() where it randomly throws out errors when the connection timeout is set to below 1s. The logic to calculate time difference in php_openssl_subtract_timeval() is wrong when a.tv_usec < b.tv_usec, causing connection errors before the timeout is reached.
* | | Enable error diagnostic for check_default_conf_path.phptChristoph M. Becker2020-04-011-0/+2
| | | | | | | | | | | | | | | Otherwise we have no clue why the test failed, if the regex didn't match.
* | | Merge branch 'PHP-7.3' into PHP-7.4Christoph M. Becker2020-01-212-2/+26
|\ \ \ | |/ / | | | | | | | | | * PHP-7.3: Fix #79145: openssl memory leak
| * | Fix #79145: openssl memory leakChristoph M. Becker2020-01-212-2/+26
| | | | | | | | | | | | | | | | | | We must increase the refcount of `return_value` only if `cert` is a resource; this is already done in `php_openssl_evp_from_zval()`, though.
* | | Merge branch 'PHP-7.3' into PHP-7.4Nikita Popov2019-11-051-0/+2
|\ \ \ | |/ / | | | | | | | | | * PHP-7.3: Fixed bug #78775
| * | Merge branch 'PHP-7.2' into PHP-7.3Nikita Popov2019-11-051-0/+2
| |\ \ | | |/ | | | | | | | | | * PHP-7.2: Fixed bug #78775
| | * Fixed bug #78775Nikita Popov2019-11-051-0/+2
| | | | | | | | | | | | | | | | | | Clear the OpenSSL error queue before performing SSL stream operations. As we don't control all code that could possibly be using OpenSSL, we can't rely on the error queue being empty.
* | | Update regarding changed OpenSSL default config pathChristoph M. Becker2019-10-011-3/+3
| | |
* | | Add missing SKIPIF (openssl)Fabien Villepinte2019-09-041-0/+2
| | | | | | | | | | | | Co-Authored-By: Gabriel Caruso <carusogabriel34@gmail.com>
* | | Fixed bug #78391Nikita Popov2019-08-092-1/+14
| | |
* | | Remove php_openssl_cipher_get_version()Nikita Popov2019-07-241-21/+2
| | | | | | | | | | | | | | | | | | This was added in 7.1 when add_assoc_string mistakenly accepted a char* rather than const char* parameter and is no longer needed. We can use SSL_CIPHER_get_version() directly.
* | | Report errors from stream read and write operationsNikita Popov2019-07-221-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The php_stream_read() and php_stream_write() functions now return an ssize_t value, with negative results indicating failure. Functions like fread() and fwrite() will return false in that case. As a special case, EWOULDBLOCK and EAGAIN on non-blocking streams should not be regarded as error conditions, and be reported as successful zero-length reads/writes instead. The handling of EINTR remains unclear and is internally inconsistent (e.g. some code-paths will automatically retry on EINTR, while some won't). I'm landing this now to make sure the stream wrapper ops API changes make it into 7.4 -- however, if the user-facing changes turn out to be problematic we have the option of clamping negative returns to zero in php_stream_read() and php_stream_write() to restore the old behavior in a relatively non-intrusive manner.
* | | Remove HAVE_DSA_DEFAULT_METHODPeter Kokot2019-07-221-10/+0
| | | | | | | | | | | | | | | | | | Last usage removed via 6a813634052710f3f4bf6e2e03ca1b6c7be3bcee. Closes GH-4455
* | | Merge branch 'PHP-7.3' into PHP-7.4Nikita Popov2019-07-031-1/+2
|\ \ \ | |/ /
| * | Merge branch 'PHP-7.2' into PHP-7.3Nikita Popov2019-07-031-1/+2
| |\ \ | | |/
| | * Fixed bug #78231Nikita Popov2019-07-031-1/+2
| | |
* | | Merge branch 'PHP-7.3' into PHP-7.4Nikita Popov2019-06-212-13/+34
|\ \ \ | |/ /
| * | Merge branch 'PHP-7.2' into PHP-7.3Nikita Popov2019-06-212-13/+34
| |\ \ | | |/
| | * Fix PKCS12 leak in opensslNikita Popov2019-06-211-2/+3
| | |
| | * Fix d leak in ecc openssl_pkey_newNikita Popov2019-06-211-1/+6
| | |
| | * Fix netscape spki leak in opensslNikita Popov2019-06-211-0/+3
| | |
| | * Fix X509 leak in openssl_pkcs7_verify()Nikita Popov2019-06-211-1/+1
| | |
| | * Fix CSR leaks in opensslNikita Popov2019-06-211-9/+20
| | |
| | * Free cert in php_openssl_load_stream_cafile()Nikita Popov2019-06-211-0/+1
| | | | | | | | | | | | | | | X509_STORE_add_cert() increments the refcount of the cert, so we should free it here.
* | | Merge branch 'PHP-7.3' into PHP-7.4Nikita Popov2019-06-211-0/+6
|\ \ \ | |/ /
| * | Merge branch 'PHP-7.2' into PHP-7.3Nikita Popov2019-06-211-0/+6
| |\ \ | | |/
| | * Fix memory leak in TLS matches_san_listNiklas Keller2019-06-211-0/+6
| | |
* | | Fix compilation without deprecated OpenSSL 1.1 APIsRosen Penev2019-06-142-11/+29
| | |
View Lorry Controller Status