Bug #76972 [Opn->Csd]: Data truncation due to forceful ssl socket shutdown

Edit report at https://bugs.php.net/bug.php?id=76972&edit=1 ID: 76972 Updated by: nikic@php.net Reported by: manuel-php at mausz dot at Summary: Data truncation due to forceful ssl socket shutdown -Status: Open +Status: Closed Type: Bug Package: FTP related Operating System: Linux PHP Version: 7.1.22 Block user comment: N Private report: N New Comment: Automatic comment on behalf of manuel@mausz.at Revision: http://git.php.net/?p=php-src.git;a=commit;h=bb4a2e8bb7fc80fa5b3725508bcc8fea525f059b Log: Fix #76972: FTP data truncation due to forceful ssl socket shutdown Previous Comments: ------------------------------------------------------------------------ [2018-10-04 16:40:03] manuel-php at mausz dot at Description: ------------ With TLS 1.3 session tickets get sent after the handshake has completed (in TLS 1.2 this only happens upon renegotiation). With connections that never read from the socket (like the FTP data connection) this data will never actually be trained. However closing the socket without training (unidirectional shutdown) causes an ECONNRESET on server side which might lead to data truncation. As explained in https://www.openssl.org/docs/manmaster/man3/SSL_shutdown.html PHP instead should call SSL_read after calling SSL_shutdown until we've received the servers close_notify alert. For reference see CURLs implementation: https://github.com/curl/curl/blob/e2dd435d473cdc97785df95d032276fafb4b7746/lib/vtls/openssl.c#L1267 As well as https://github.com/openssl/openssl/issues/6904 Test script: --------------- ProFTPd with OpenSSL 1.1.1 and TLS 1.3. Script is as simple as: ftp_put($ftp, "dest", "source", FTP_BINARY); Results in: Transfer aborted. Link to file server lost ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=76972&edit=1