Bug #81213 [Com]: Stream crypto methods SSLv2 and v3 switch to TLS1.0

Edit report at https://bugs.php.net/bug.php?id=81213&edit=1 ID: 81213 Comment by: daverandom@php.net Reported by: camille at affinez dot nl Summary: Stream crypto methods SSLv2 and v3 switch to TLS1.0 Status: Verified Type: Bug Package: OpenSSL related Operating System: Windows, Linux PHP Version: 8.0.7 Block user comment: N Private report: N New Comment: I don't have a build environment set up to test this theory, but I suspect this is related to the openssl build that PHP is using having SSL3 disabled: https://github.com/php/php-src/blob/master/ext/openssl/xp_ssl.c#L87-L92 Previous Comments: ------------------------------------------------------------------------ [2021-07-01 12:01:52] camille at affinez dot nl Description: ------------ Forcing an SMTP encryption channel to either SSLv2 or SSLv3 doesn't work as expected. When creating a network trace with Wireshark, it appears the stream is utilizing TLS1.0 instead. Google's SMTP servers return a false positive result when forcing SSLv2 and SSLv3, as Google supports TLS1.0 and up. When testing with Microsoft's 365 SMTP servers, a correct result is given as Microsoft only supports TLS1.2. Verified with OpenSSL 1.1.1h and the following command: openssl s_client -connect aspmx.l.google.com:25 -starttls smtp -servername mail.domain.com -no_tls1 -no_tls1_1 -no_tls1_2 -no_tls1_3 OpenSSL fails as expected. Test script: --------------- $SMTPconn = fsockopen("aspmx.l.google.com", 25, $error_int, $error_string, 10); fwrite($SMTPconn, "EHLO " . "tls.php.net" . "\r\n"); while (!feof($SMTPconn)) { $line = fgets($SMTPconn); $read = array($SMTPconn); $write = null; $except = null; $timeout = 0; $utimeout = 200000; if (!stream_select($read, $write, $except, $timeout, $utimeout)) break; } fwrite($SMTPconn, "STARTTLS" . "\r\n"); while (!feof($SMTPconn)) { $line = fgets($SMTPconn); $read = array($SMTPconn); $write = null; $except = null; $timeout = 0; $utimeout = 200000; if (!stream_select($read, $write, $except, $timeout, $utimeout)) break; } stream_context_set_option($SMTPconn, 'ssl', 'verify_peer', false); stream_context_set_option($SMTPconn, 'ssl', 'verify_peer_name', false); stream_context_set_option($SMTPconn, 'ssl', 'allow_self_signed', true); stream_context_set_option($SMTPconn, 'ssl', 'capture_peer_cert', true); stream_context_set_option($SMTPconn, 'ssl', 'capture_peer_cert_chain', true); $res = @stream_socket_enable_crypto($SMTPconn, true, STREAM_CRYPTO_METHOD_SSLv2_CLIENT); var_dump($res); Expected result: ---------------- int(0) or bool(false) The connection should fail, as SSLv2 or SSLv3 are not supported. Actual result: -------------- bool(true) The connection (falsely) succeeds by utilizing TLS1.0 instead of SSLv2 or SSLv3. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=81213&edit=1