com php-src: Deprecate CN_match in favor of peer_na me in SSL contexts: NEWS UPGRADING ext/openssl/op enssl.c ext/openssl/tests/bug46127.phpt ext/o
penssl/tests/bug48182.phpt ext/openssl/tests/bug 54992.phpt ext/openssl/tests/bug65538 _001.phpt ext/openssl/tests/bug65538_ 003.phpt
ext/openssl/tests/bug65729.phpt ext/openssl/tests/openssl_peer_fingerprint.phpt ext/ openssl/tests/peer_verification.phpt ext/openssl/tests/sa
n_peer_matching.phpt ext/openssl/
| From: | rdlowrey@php.net | Date: | Wed, 26 Feb 2014 20:20:06 +0000 |
| Subject: | com php-src: Deprecate CN_match in favor of peer_na me in SSL contexts: NEWS UPGRADING ext/openssl/op enssl.c ext/openssl/tests/bug46127.phpt ext/o penssl/tests/bug48182.phpt ext/openssl/tests/bug 54992.phpt ext/openssl/tests/bug65538 _001.phpt ext/openssl/tests/bug65538_ 003.phpt ext/openssl/tests/bug65729.phpt ext/openssl/tests/openssl_peer_fingerprint.phpt ext/ openssl/tests/peer_verification.phpt ext/openssl/tests/sa n_peer_matching.phpt ext/openssl/ |
||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-76238@lists.php.net to get a copy of this message | ||
Commit: d0a6f8c68ec1044e936735f28bdc1bbd35f81362
Author: Daniel Lowrey <rdlowrey@php.net> Wed, 26 Feb 2014 13:06:08 -0700
Parents: 96d0bb7bcab6bba97838bff6178b5f9d25c955cc
Branches: PHP-5.6
Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=d0a6f8c68ec1044e936735f28bdc1bbd35f81362
Log:
Deprecate CN_match in favor of peer_name in SSL contexts
Changed paths:
M NEWS
M UPGRADING
M ext/openssl/openssl.c
M ext/openssl/tests/bug46127.phpt
M ext/openssl/tests/bug48182.phpt
M ext/openssl/tests/bug54992.phpt
M ext/openssl/tests/bug65538_001.phpt
M ext/openssl/tests/bug65538_003.phpt
M ext/openssl/tests/bug65729.phpt
M ext/openssl/tests/openssl_peer_fingerprint.phpt
M ext/openssl/tests/peer_verification.phpt
M ext/openssl/tests/san_peer_matching.phpt
M ext/openssl/tests/session_meta_capture.phpt
M ext/openssl/tests/sni_001.phpt
M ext/openssl/tests/stream_crypto_flags_001.phpt
M ext/openssl/tests/stream_crypto_flags_002.phpt
M ext/openssl/tests/stream_crypto_flags_003.phpt
M ext/openssl/tests/stream_crypto_flags_004.phpt
D ext/openssl/tests/stream_verify_host_001.phpt
D ext/openssl/tests/stream_verify_host_002.phpt
D ext/openssl/tests/stream_verify_host_003.phpt
A ext/openssl/tests/stream_verify_peer_name_001.phpt
A ext/openssl/tests/stream_verify_peer_name_002.phpt
A ext/openssl/tests/stream_verify_peer_name_003.phpt
M ext/openssl/tests/streams_crypto_method.phpt
M ext/openssl/tests/tlsv1.0_wrapper.phpt
M ext/openssl/tests/tlsv1.1_wrapper.phpt
M ext/openssl/tests/tlsv1.2_wrapper.phpt
diff --git a/NEWS b/NEWS index b79f000..0c28d48 100644 --- a/NEWS +++ b/NEWS @@ -10,6 +10,9 @@ PHP NEWS . Implemented unified default encoding (RFC: https://wiki.php.net/rfc/default_encoding). (Yasuo Ohgaki) +- Curl + . Check for openssl.cafile ini directive when loading CA certs. (Daniel Lowrey) + - Fileinfo . Upgraded to libmagic-5.17 (Anatol) @@ -25,12 +28,17 @@ PHP NEWS . Fallback to Windows CA cert store for peer verification if no openssl.cafile ini directive or "cafile" SSL context option specified in Windows. (Chris Wright) + . The openssl.cafile and openssl.capath ini directives introduced in alpha2 + now have PHP_INI_PERDIR accessibility (was PHP_INI_ALL). (Daniel Lowrey) + . New "peer_name" SSL context option replaces "CN_match" (which still works + as before but triggers E_DEPRECATED). (Daniel Lowrey) . Fixed segfault when accessing non-existent context for client SNI use (Daniel Lowrey) . Fixed bug #66501 (Add EC key support to php_openssl_is_private_key). (Mark Zedwood) - . Fixed Bug #47030 (add new boolean "verify_host" SSL context option - allowing clients to verify names separately from peer certs). + . Fixed Bug #47030 (add new boolean "verify_peer_name" SSL context option + allowing clients to verify cert names separately from the cert itself). + "verify_peer_name" is enabled by default for client streams. (Daniel Lowrey) . Fixed Bug #65538 ("cafile" SSL context option now supports stream wrappers). (Daniel Lowrey) diff --git a/UPGRADING b/UPGRADING index 4ef3085..6ae672e 100755 --- a/UPGRADING +++ b/UPGRADING @@ -69,8 +69,8 @@ PHP X.Y UPGRADE NOTES - Added gost-crypto (CryptoPro S-box) hash algo. -- Stream wrappers verify peers and host names by default in encrypted client - streams. +- Stream wrappers verify peer certificates and host names by default in + encrypted client streams. - Added openssl certificate fingerprint support (inclusive stream context option). @@ -104,10 +104,14 @@ PHP X.Y UPGRADE NOTES - Added "crypto_method" SSL context option for use in encrypted streams. +- Added "peer_name" SSL context option to better reflect peer certificate + name matching using SAN extension (replaces deprecated "CN_match"). + - Added stream wrapper support when specifying "cafile" SSL context paths. -- Independent peer cert and host names validation is now available via a new - "verify_host" SSL context option. +- Independent peer cert and peer name validation is now available via a new + boolean "verify_peer_name" SSL context option. This option is enabled by + default in encrypted client streams. - Added protocol-specific tlsv1.0://, tlsv1.1:// and tlsv1.2:// encryption stream wrappers. tls:// wrapper now supports TLSv1.1 and TLSv1.2 (previously @@ -131,6 +135,13 @@ PHP X.Y UPGRADE NOTES Instance calls from an incompatible context are now deprecated and issue E_DEPRECATED instead of E_STRICT. See https://wiki.php.net/rfc/incompat_ctx +- The "CN_match" SSL context option is deprecated in favor of the new + "peer_name" option. Name verification now checks certificate SAN names as + well as the CN field and "CN_match" is deprecated to avoid confusion. Its + use triggers E_DEPRECATED but continues to work as before. If both values + are specified "CN_match" takes precedence. Otherwise, the two options are + interchangeable. + ======================================== 4. Changed Functions ======================================== diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index d2b4538..88ae9a1 100755 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -5145,24 +5145,26 @@ static zend_bool matches_common_name(X509 *peer, const char *subject_name TSRMLS int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stream TSRMLS_DC) /* {{{ */ { zval **val = NULL; - char *cnmatch = NULL; + char *peer_name = NULL; int err; zend_bool must_verify_peer; - zend_bool must_verify_host; + zend_bool must_verify_peer_name; zend_bool must_verify_fingerprint; + zend_bool has_cnmatch_ctx_opt; php_openssl_netstream_data_t *sslsock = (php_openssl_netstream_data_t*)stream->abstract; must_verify_peer = GET_VER_OPT("verify_peer") ? zend_is_true(*val) : sslsock->is_client; - must_verify_host = GET_VER_OPT("verify_host") + has_cnmatch_ctx_opt = GET_VER_OPT("CN_match"); + must_verify_peer_name = (has_cnmatch_ctx_opt || GET_VER_OPT("verify_peer_name")) ? zend_is_true(*val) : sslsock->is_client; must_verify_fingerprint = (GET_VER_OPT("peer_fingerprint") && zend_is_true(*val)); - if ((must_verify_peer || must_verify_host || must_verify_fingerprint) && peer == NULL) { + if ((must_verify_peer || must_verify_peer_name || must_verify_fingerprint) && peer == NULL) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not get peer certificate"); return FAILURE; } @@ -5190,7 +5192,7 @@ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stre } } - /* If a peer_fingerprint match is required this trumps host verification */ + /* If a peer_fingerprint match is required this trumps peer and peer_name verification */ if (must_verify_fingerprint) { if (Z_TYPE_PP(val) == IS_STRING || Z_TYPE_PP(val) == IS_ARRAY) { if (!php_x509_fingerprint_match(peer, *val TSRMLS_CC)) { @@ -5207,18 +5209,24 @@ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stre } /* verify the host name presented in the peer certificate */ + if (must_verify_peer_name) { + GET_VER_OPT_STRING("peer_name", peer_name); - if (must_verify_host) { - GET_VER_OPT_STRING("CN_match", cnmatch); - /* If no CN_match was specified assign the autodetected url name in client environments */ - if (cnmatch == NULL && sslsock->is_client) { - cnmatch = sslsock->url_name; + if (has_cnmatch_ctx_opt) { + GET_VER_OPT_STRING("CN_match", peer_name); + php_error(E_DEPRECATED, + "the 'CN_match' SSL context option is deprecated in favor of 'peer_name'" + ); + } + /* If no peer name was specified we use the autodetected url name in client environments */ + if (peer_name == NULL && sslsock->is_client) { + peer_name = sslsock->url_name; } - if (cnmatch) { - if (matches_san_list(peer, cnmatch TSRMLS_CC)) { + if (peer_name) { + if (matches_san_list(peer, peer_name TSRMLS_CC)) { return SUCCESS; - } else if (matches_common_name(peer, cnmatch TSRMLS_CC)) { + } else if (matches_common_name(peer, peer_name TSRMLS_CC)) { return SUCCESS; } else { return FAILURE; @@ -5342,7 +5350,7 @@ static int win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx, void *arg) / LPWSTR server_name = NULL; BOOL verify_result; - { /* This looks ridiculous and it is - but we validate the name ourselves using the CN_match + { /* This looks ridiculous and it is - but we validate the name ourselves using the peer_name ctx option, so just use the CN from the cert here */ X509_NAME *cert_name; diff --git a/ext/openssl/tests/bug46127.phpt b/ext/openssl/tests/bug46127.phpt index 6a3d1a0..80bd61c 100644 --- a/ext/openssl/tests/bug46127.phpt +++ b/ext/openssl/tests/bug46127.phpt @@ -27,7 +27,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => false, - 'verify_host' => false + 'verify_peer_name' => false ]]); phpt_wait(); diff --git a/ext/openssl/tests/bug48182.phpt b/ext/openssl/tests/bug48182.phpt index 8d3f9ee..5211c23 100644 --- a/ext/openssl/tests/bug48182.phpt +++ b/ext/openssl/tests/bug48182.phpt @@ -28,7 +28,7 @@ $clientCode = <<<'CODE' $clientFlags = STREAM_CLIENT_CONNECT | STREAM_CLIENT_ASYNC_CONNECT; $clientCtx = stream_context_create(['ssl' => [ 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local' + 'peer_name' => 'bug54992.local' ]]); phpt_wait(); diff --git a/ext/openssl/tests/bug54992.phpt b/ext/openssl/tests/bug54992.phpt index 2937faa..bcb33fd 100644 --- a/ext/openssl/tests/bug54992.phpt +++ b/ext/openssl/tests/bug54992.phpt @@ -25,7 +25,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'buga_buga', + 'peer_name' => 'buga_buga', ]]); phpt_wait(); diff --git a/ext/openssl/tests/bug65538_001.phpt b/ext/openssl/tests/bug65538_001.phpt index ea7d6f4..e666859 100644 --- a/ext/openssl/tests/bug65538_001.phpt +++ b/ext/openssl/tests/bug65538_001.phpt @@ -37,7 +37,7 @@ $clientCode = <<<'CODE' $serverUri = "https://127.0.0.1:64321/"; $clientCtx = stream_context_create(['ssl' => [ 'cafile' => 'file://' . __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/bug65538_003.phpt b/ext/openssl/tests/bug65538_003.phpt index b927e4e..da99779 100644 --- a/ext/openssl/tests/bug65538_003.phpt +++ b/ext/openssl/tests/bug65538_003.phpt @@ -38,7 +38,7 @@ $clientCode = <<<'CODE' $serverUri = "https://127.0.0.1:64321/"; $clientCtx = stream_context_create(['ssl' => [ 'cafile' => 'phar://' . __DIR__ . '/bug65538.phar/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/bug65729.phpt b/ext/openssl/tests/bug65729.phpt index e27dbb9..b405b72 100644 --- a/ext/openssl/tests/bug65729.phpt +++ b/ext/openssl/tests/bug65729.phpt @@ -33,7 +33,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'allow_self_signed' => true, - 'CN_match' => $expected_name, + 'peer_name' => $expected_name, ]]); var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx)); diff --git a/ext/openssl/tests/openssl_peer_fingerprint.phpt b/ext/openssl/tests/openssl_peer_fingerprint.phpt index 5390c49..0bd91d5 100644 --- a/ext/openssl/tests/openssl_peer_fingerprint.phpt +++ b/ext/openssl/tests/openssl_peer_fingerprint.phpt @@ -27,7 +27,7 @@ $clientCode = <<<'CODE' 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', 'capture_peer_cert' => true, - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/peer_verification.phpt b/ext/openssl/tests/peer_verification.phpt index 607b617..6aff34d 100644 --- a/ext/openssl/tests/peer_verification.phpt +++ b/ext/openssl/tests/peer_verification.phpt @@ -40,14 +40,14 @@ $clientCode = <<<'CODE' // Should succeed with peer verification disabled in context $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => false, - 'verify_host' => false, + 'verify_peer_name' => false, ]]); var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx)); // Should succeed with CA file specified in context $clientCtx = stream_context_create(['ssl' => [ 'cafile' => $caFile, - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx)); CODE; diff --git a/ext/openssl/tests/san_peer_matching.phpt b/ext/openssl/tests/san_peer_matching.phpt index 3fa479e..0e1f30c 100644 --- a/ext/openssl/tests/san_peer_matching.phpt +++ b/ext/openssl/tests/san_peer_matching.phpt @@ -30,10 +30,10 @@ $clientCode = <<<'CODE' phpt_wait(); - stream_context_set_option($clientCtx, 'ssl', 'CN_match', 'example.org'); + stream_context_set_option($clientCtx, 'ssl', 'peer_name', 'example.org'); var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx)); - stream_context_set_option($clientCtx, 'ssl', 'CN_match', 'moar.example.org'); + stream_context_set_option($clientCtx, 'ssl', 'peer_name', 'moar.example.org'); var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx)); CODE; diff --git a/ext/openssl/tests/session_meta_capture.phpt b/ext/openssl/tests/session_meta_capture.phpt index 3b2a804..62cdffe 100644 --- a/ext/openssl/tests/session_meta_capture.phpt +++ b/ext/openssl/tests/session_meta_capture.phpt @@ -29,7 +29,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', 'capture_session_meta' => true, ]]); diff --git a/ext/openssl/tests/sni_001.phpt b/ext/openssl/tests/sni_001.phpt index 0dbd18d..e6c05f7 100644 --- a/ext/openssl/tests/sni_001.phpt +++ b/ext/openssl/tests/sni_001.phpt @@ -26,9 +26,9 @@ function context($host = NULL) { stream_context_set_option($ctx, 'ssl', 'capture_peer_cert', true); stream_context_set_option($ctx, 'ssl', 'verify_peer', false); if ($host) { - stream_context_set_option($ctx, 'ssl', 'CN_match', $host); + stream_context_set_option($ctx, 'ssl', 'peer_name', $host); } else { - stream_context_set_option($ctx, 'ssl', 'verify_host', false); + stream_context_set_option($ctx, 'ssl', 'verify_peer_name', false); } return $ctx; diff --git a/ext/openssl/tests/stream_crypto_flags_001.phpt b/ext/openssl/tests/stream_crypto_flags_001.phpt index b9a49f9..f988886 100644 --- a/ext/openssl/tests/stream_crypto_flags_001.phpt +++ b/ext/openssl/tests/stream_crypto_flags_001.phpt @@ -27,7 +27,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/stream_crypto_flags_002.phpt b/ext/openssl/tests/stream_crypto_flags_002.phpt index 15b3fb9..b72b4d6 100644 --- a/ext/openssl/tests/stream_crypto_flags_002.phpt +++ b/ext/openssl/tests/stream_crypto_flags_002.phpt @@ -29,7 +29,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/stream_crypto_flags_003.phpt b/ext/openssl/tests/stream_crypto_flags_003.phpt index c5aebd8..30ca7a7 100644 --- a/ext/openssl/tests/stream_crypto_flags_003.phpt +++ b/ext/openssl/tests/stream_crypto_flags_003.phpt @@ -32,7 +32,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/stream_crypto_flags_004.phpt b/ext/openssl/tests/stream_crypto_flags_004.phpt index 38f406c..e51a2ba 100644 --- a/ext/openssl/tests/stream_crypto_flags_004.phpt +++ b/ext/openssl/tests/stream_crypto_flags_004.phpt @@ -29,7 +29,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/stream_verify_host_001.phpt b/ext/openssl/tests/stream_verify_host_001.phpt deleted file mode 100644 index c4d87b8..0000000 --- a/ext/openssl/tests/stream_verify_host_001.phpt +++ /dev/null @@ -1,39 +0,0 @@ ---TEST-- -Verify host name by default in client transfers ---SKIPIF-- -<?php -if (!extension_loaded("openssl")) die("skip openssl not loaded"); -if (!function_exists("proc_open")) die("skip no proc_open"); ---FILE-- -<?php -$serverCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; - $serverCtx = stream_context_create(['ssl' => [ - 'local_cert' => __DIR__ . '/bug54992.pem' - ]]); - - $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); - phpt_notify(); - - @stream_socket_accept($server, 1); -CODE; - -$clientCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $clientFlags = STREAM_CLIENT_CONNECT; - $clientCtx = stream_context_create(['ssl' => [ - 'verify_peer' => false, - 'CN_match' => 'bug54992.local' - ]]); - - phpt_wait(); - $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); - - var_dump($client); -CODE; - -include 'ServerClientTestCase.inc'; -ServerClientTestCase::getInstance()->run($clientCode, $serverCode); ---EXPECTF-- -resource(%d) of type (stream) diff --git a/ext/openssl/tests/stream_verify_host_002.phpt b/ext/openssl/tests/stream_verify_host_002.phpt deleted file mode 100644 index c0db4f2..0000000 --- a/ext/openssl/tests/stream_verify_host_002.phpt +++ /dev/null @@ -1,40 +0,0 @@ ---TEST-- -Allow host name mismatch when "verify_host" disabled ---SKIPIF-- -<?php -if (!extension_loaded("openssl")) die("skip openssl not loaded"); -if (!function_exists("proc_open")) die("skip no proc_open"); ---FILE-- -<?php -$serverCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; - $serverCtx = stream_context_create(['ssl' => [ - 'local_cert' => __DIR__ . '/bug54992.pem' - ]]); - - $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); - phpt_notify(); - - @stream_socket_accept($server, 1); -CODE; - -$clientCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $clientFlags = STREAM_CLIENT_CONNECT; - $clientCtx = stream_context_create(['ssl' => [ - 'verify_peer' => true, - 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'verify_host' => false - ]]); - - phpt_wait(); - $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); - - var_dump($client); -CODE; - -include 'ServerClientTestCase.inc'; -ServerClientTestCase::getInstance()->run($clientCode, $serverCode); ---EXPECTF-- -resource(%d) of type (stream) diff --git a/ext/openssl/tests/stream_verify_host_003.phpt b/ext/openssl/tests/stream_verify_host_003.phpt deleted file mode 100644 index e4e083f..0000000 --- a/ext/openssl/tests/stream_verify_host_003.phpt +++ /dev/null @@ -1,44 +0,0 @@ ---TEST-- -Host name mismatch triggers error ---SKIPIF-- -<?php -if (!extension_loaded("openssl")) die("skip openssl not loaded"); -if (!function_exists("proc_open")) die("skip no proc_open"); ---FILE-- -<?php -$serverCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; - $serverCtx = stream_context_create(['ssl' => [ - 'local_cert' => __DIR__ . '/bug54992.pem' - ]]); - - $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); - phpt_notify(); - - @stream_socket_accept($server, 1); -CODE; - -$clientCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $clientFlags = STREAM_CLIENT_CONNECT; - $clientCtx = stream_context_create(['ssl' => [ - 'verify_peer' => true, - 'cafile' => __DIR__ . '/bug54992-ca.pem' - ]]); - - phpt_wait(); - $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); - - var_dump($client); -CODE; - -include 'ServerClientTestCase.inc'; -ServerClientTestCase::getInstance()->run($clientCode, $serverCode); ---EXPECTF-- -Warning: stream_socket_client(): Peer certificate CN=`bug54992.local' did not match expected CN=`127.0.0.1' in %s on line %d - -Warning: stream_socket_client(): Failed to enable crypto in %s on line %d - -Warning: stream_socket_client(): unable to connect to ssl://127.0.0.1:64321 (Unknown error) in %s on line %d -bool(false) diff --git a/ext/openssl/tests/stream_verify_peer_name_001.phpt b/ext/openssl/tests/stream_verify_peer_name_001.phpt new file mode 100644 index 0000000..4aecf8c --- /dev/null +++ b/ext/openssl/tests/stream_verify_peer_name_001.phpt @@ -0,0 +1,39 @@ +--TEST-- +Verify host name by default in client transfers +--SKIPIF-- +<?php +if (!extension_loaded("openssl")) die("skip openssl not loaded"); +if (!function_exists("proc_open")) die("skip no proc_open"); +--FILE-- +<?php +$serverCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; + $serverCtx = stream_context_create(['ssl' => [ + 'local_cert' => __DIR__ . '/bug54992.pem' + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); + phpt_notify(); + + @stream_socket_accept($server, 1); +CODE; + +$clientCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $clientFlags = STREAM_CLIENT_CONNECT; + $clientCtx = stream_context_create(['ssl' => [ + 'verify_peer' => false, + 'peer_name' => 'bug54992.local' + ]]); + + phpt_wait(); + $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); + + var_dump($client); +CODE; + +include 'ServerClientTestCase.inc'; +ServerClientTestCase::getInstance()->run($clientCode, $serverCode); +--EXPECTF-- +resource(%d) of type (stream) diff --git a/ext/openssl/tests/stream_verify_peer_name_002.phpt b/ext/openssl/tests/stream_verify_peer_name_002.phpt new file mode 100644 index 0000000..ae97ea1 --- /dev/null +++ b/ext/openssl/tests/stream_verify_peer_name_002.phpt @@ -0,0 +1,40 @@ +--TEST-- +Allow host name mismatch when "verify_host" disabled +--SKIPIF-- +<?php +if (!extension_loaded("openssl")) die("skip openssl not loaded"); +if (!function_exists("proc_open")) die("skip no proc_open"); +--FILE-- +<?php +$serverCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; + $serverCtx = stream_context_create(['ssl' => [ + 'local_cert' => __DIR__ . '/bug54992.pem' + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); + phpt_notify(); + + @stream_socket_accept($server, 1); +CODE; + +$clientCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $clientFlags = STREAM_CLIENT_CONNECT; + $clientCtx = stream_context_create(['ssl' => [ + 'verify_peer' => true, + 'cafile' => __DIR__ . '/bug54992-ca.pem', + 'verify_peer_name' => false + ]]); + + phpt_wait(); + $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); + + var_dump($client); +CODE; + +include 'ServerClientTestCase.inc'; +ServerClientTestCase::getInstance()->run($clientCode, $serverCode); +--EXPECTF-- +resource(%d) of type (stream) diff --git a/ext/openssl/tests/stream_verify_peer_name_003.phpt b/ext/openssl/tests/stream_verify_peer_name_003.phpt new file mode 100644 index 0000000..e4e083f --- /dev/null +++ b/ext/openssl/tests/stream_verify_peer_name_003.phpt @@ -0,0 +1,44 @@ +--TEST-- +Host name mismatch triggers error +--SKIPIF-- +<?php +if (!extension_loaded("openssl")) die("skip openssl not loaded"); +if (!function_exists("proc_open")) die("skip no proc_open"); +--FILE-- +<?php +$serverCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; + $serverCtx = stream_context_create(['ssl' => [ + 'local_cert' => __DIR__ . '/bug54992.pem' + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); + phpt_notify(); + + @stream_socket_accept($server, 1); +CODE; + +$clientCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $clientFlags = STREAM_CLIENT_CONNECT; + $clientCtx = stream_context_create(['ssl' => [ + 'verify_peer' => true, + 'cafile' => __DIR__ . '/bug54992-ca.pem' + ]]); + + phpt_wait(); + $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); + + var_dump($client); +CODE; + +include 'ServerClientTestCase.inc'; +ServerClientTestCase::getInstance()->run($clientCode, $serverCode); +--EXPECTF-- +Warning: stream_socket_client(): Peer certificate CN=`bug54992.local' did not match expected CN=`127.0.0.1' in %s on line %d + +Warning: stream_socket_client(): Failed to enable crypto in %s on line %d + +Warning: stream_socket_client(): unable to connect to ssl://127.0.0.1:64321 (Unknown error) in %s on line %d +bool(false) diff --git a/ext/openssl/tests/streams_crypto_method.phpt b/ext/openssl/tests/streams_crypto_method.phpt index 1bf9048..84f7934 100644 --- a/ext/openssl/tests/streams_crypto_method.phpt +++ b/ext/openssl/tests/streams_crypto_method.phpt @@ -39,7 +39,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'crypto_method' => STREAM_CRYPTO_METHOD_SSLv3_CLIENT, 'verify_peer' => false, - 'verify_host' => false + 'verify_peer_name' => false ]]); phpt_wait(); diff --git a/ext/openssl/tests/tlsv1.0_wrapper.phpt b/ext/openssl/tests/tlsv1.0_wrapper.phpt index d24ab45..7479259 100644 --- a/ext/openssl/tests/tlsv1.0_wrapper.phpt +++ b/ext/openssl/tests/tlsv1.0_wrapper.phpt @@ -24,7 +24,7 @@ $clientCode = <<<'CODE' $flags = STREAM_CLIENT_CONNECT; $ctx = stream_context_create(['ssl' => [ 'verify_peer' => false, - 'verify_host' => false, + 'verify_peer_name' => false, ]]); phpt_wait(); diff --git a/ext/openssl/tests/tlsv1.1_wrapper.phpt b/ext/openssl/tests/tlsv1.1_wrapper.phpt index cd88178..3e067a1 100644 --- a/ext/openssl/tests/tlsv1.1_wrapper.phpt +++ b/ext/openssl/tests/tlsv1.1_wrapper.phpt @@ -25,7 +25,7 @@ $clientCode = <<<'CODE' $flags = STREAM_CLIENT_CONNECT; $ctx = stream_context_create(['ssl' => [ 'verify_peer' => false, - 'verify_host' => false, + 'verify_peer_name' => false, ]]); phpt_wait(); diff --git a/ext/openssl/tests/tlsv1.2_wrapper.phpt b/ext/openssl/tests/tlsv1.2_wrapper.phpt index 124fdf2..ca967d1 100644 --- a/ext/openssl/tests/tlsv1.2_wrapper.phpt +++ b/ext/openssl/tests/tlsv1.2_wrapper.phpt @@ -25,7 +25,7 @@ $clientCode = <<<'CODE' $flags = STREAM_CLIENT_CONNECT; $ctx = stream_context_create(['ssl' => [ 'verify_peer' => false, - 'verify_host' => false, + 'verify_peer_name' => false, ]]); phpt_wait();
diff --git a/NEWS b/NEWS index b79f000..0c28d48 100644 --- a/NEWS +++ b/NEWS @@ -10,6 +10,9 @@ PHP NEWS . Implemented unified default encoding (RFC: https://wiki.php.net/rfc/default_encoding). (Yasuo Ohgaki) +- Curl + . Check for openssl.cafile ini directive when loading CA certs. (Daniel Lowrey) + - Fileinfo . Upgraded to libmagic-5.17 (Anatol) @@ -25,12 +28,17 @@ PHP NEWS . Fallback to Windows CA cert store for peer verification if no openssl.cafile ini directive or "cafile" SSL context option specified in Windows. (Chris Wright) + . The openssl.cafile and openssl.capath ini directives introduced in alpha2 + now have PHP_INI_PERDIR accessibility (was PHP_INI_ALL). (Daniel Lowrey) + . New "peer_name" SSL context option replaces "CN_match" (which still works + as before but triggers E_DEPRECATED). (Daniel Lowrey) . Fixed segfault when accessing non-existent context for client SNI use (Daniel Lowrey) . Fixed bug #66501 (Add EC key support to php_openssl_is_private_key). (Mark Zedwood) - . Fixed Bug #47030 (add new boolean "verify_host" SSL context option - allowing clients to verify names separately from peer certs). + . Fixed Bug #47030 (add new boolean "verify_peer_name" SSL context option + allowing clients to verify cert names separately from the cert itself). + "verify_peer_name" is enabled by default for client streams. (Daniel Lowrey) . Fixed Bug #65538 ("cafile" SSL context option now supports stream wrappers). (Daniel Lowrey) diff --git a/UPGRADING b/UPGRADING index 4ef3085..6ae672e 100755 --- a/UPGRADING +++ b/UPGRADING @@ -69,8 +69,8 @@ PHP X.Y UPGRADE NOTES - Added gost-crypto (CryptoPro S-box) hash algo. -- Stream wrappers verify peers and host names by default in encrypted client - streams. +- Stream wrappers verify peer certificates and host names by default in + encrypted client streams. - Added openssl certificate fingerprint support (inclusive stream context option). @@ -104,10 +104,14 @@ PHP X.Y UPGRADE NOTES - Added "crypto_method" SSL context option for use in encrypted streams. +- Added "peer_name" SSL context option to better reflect peer certificate + name matching using SAN extension (replaces deprecated "CN_match"). + - Added stream wrapper support when specifying "cafile" SSL context paths. -- Independent peer cert and host names validation is now available via a new - "verify_host" SSL context option. +- Independent peer cert and peer name validation is now available via a new + boolean "verify_peer_name" SSL context option. This option is enabled by + default in encrypted client streams. - Added protocol-specific tlsv1.0://, tlsv1.1:// and tlsv1.2:// encryption stream wrappers. tls:// wrapper now supports TLSv1.1 and TLSv1.2 (previously @@ -131,6 +135,13 @@ PHP X.Y UPGRADE NOTES Instance calls from an incompatible context are now deprecated and issue E_DEPRECATED instead of E_STRICT. See https://wiki.php.net/rfc/incompat_ctx +- The "CN_match" SSL context option is deprecated in favor of the new + "peer_name" option. Name verification now checks certificate SAN names as + well as the CN field and "CN_match" is deprecated to avoid confusion. Its + use triggers E_DEPRECATED but continues to work as before. If both values + are specified "CN_match" takes precedence. Otherwise, the two options are + interchangeable. + ======================================== 4. Changed Functions ======================================== diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index d2b4538..88ae9a1 100755 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -5145,24 +5145,26 @@ static zend_bool matches_common_name(X509 *peer, const char *subject_name TSRMLS int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stream TSRMLS_DC) /* {{{ */ { zval **val = NULL; - char *cnmatch = NULL; + char *peer_name = NULL; int err; zend_bool must_verify_peer; - zend_bool must_verify_host; + zend_bool must_verify_peer_name; zend_bool must_verify_fingerprint; + zend_bool has_cnmatch_ctx_opt; php_openssl_netstream_data_t *sslsock = (php_openssl_netstream_data_t*)stream->abstract; must_verify_peer = GET_VER_OPT("verify_peer") ? zend_is_true(*val) : sslsock->is_client; - must_verify_host = GET_VER_OPT("verify_host") + has_cnmatch_ctx_opt = GET_VER_OPT("CN_match"); + must_verify_peer_name = (has_cnmatch_ctx_opt || GET_VER_OPT("verify_peer_name")) ? zend_is_true(*val) : sslsock->is_client; must_verify_fingerprint = (GET_VER_OPT("peer_fingerprint") && zend_is_true(*val)); - if ((must_verify_peer || must_verify_host || must_verify_fingerprint) && peer == NULL) { + if ((must_verify_peer || must_verify_peer_name || must_verify_fingerprint) && peer == NULL) { php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not get peer certificate"); return FAILURE; } @@ -5190,7 +5192,7 @@ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stre } } - /* If a peer_fingerprint match is required this trumps host verification */ + /* If a peer_fingerprint match is required this trumps peer and peer_name verification */ if (must_verify_fingerprint) { if (Z_TYPE_PP(val) == IS_STRING || Z_TYPE_PP(val) == IS_ARRAY) { if (!php_x509_fingerprint_match(peer, *val TSRMLS_CC)) { @@ -5207,18 +5209,24 @@ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stre } /* verify the host name presented in the peer certificate */ + if (must_verify_peer_name) { + GET_VER_OPT_STRING("peer_name", peer_name); - if (must_verify_host) { - GET_VER_OPT_STRING("CN_match", cnmatch); - /* If no CN_match was specified assign the autodetected url name in client environments */ - if (cnmatch == NULL && sslsock->is_client) { - cnmatch = sslsock->url_name; + if (has_cnmatch_ctx_opt) { + GET_VER_OPT_STRING("CN_match", peer_name); + php_error(E_DEPRECATED, + "the 'CN_match' SSL context option is deprecated in favor of 'peer_name'" + ); + } + /* If no peer name was specified we use the autodetected url name in client environments */ + if (peer_name == NULL && sslsock->is_client) { + peer_name = sslsock->url_name; } - if (cnmatch) { - if (matches_san_list(peer, cnmatch TSRMLS_CC)) { + if (peer_name) { + if (matches_san_list(peer, peer_name TSRMLS_CC)) { return SUCCESS; - } else if (matches_common_name(peer, cnmatch TSRMLS_CC)) { + } else if (matches_common_name(peer, peer_name TSRMLS_CC)) { return SUCCESS; } else { return FAILURE; @@ -5342,7 +5350,7 @@ static int win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx, void *arg) / LPWSTR server_name = NULL; BOOL verify_result; - { /* This looks ridiculous and it is - but we validate the name ourselves using the CN_match + { /* This looks ridiculous and it is - but we validate the name ourselves using the peer_name ctx option, so just use the CN from the cert here */ X509_NAME *cert_name; diff --git a/ext/openssl/tests/bug46127.phpt b/ext/openssl/tests/bug46127.phpt index 6a3d1a0..80bd61c 100644 --- a/ext/openssl/tests/bug46127.phpt +++ b/ext/openssl/tests/bug46127.phpt @@ -27,7 +27,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => false, - 'verify_host' => false + 'verify_peer_name' => false ]]); phpt_wait(); diff --git a/ext/openssl/tests/bug48182.phpt b/ext/openssl/tests/bug48182.phpt index 8d3f9ee..5211c23 100644 --- a/ext/openssl/tests/bug48182.phpt +++ b/ext/openssl/tests/bug48182.phpt @@ -28,7 +28,7 @@ $clientCode = <<<'CODE' $clientFlags = STREAM_CLIENT_CONNECT | STREAM_CLIENT_ASYNC_CONNECT; $clientCtx = stream_context_create(['ssl' => [ 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local' + 'peer_name' => 'bug54992.local' ]]); phpt_wait(); diff --git a/ext/openssl/tests/bug54992.phpt b/ext/openssl/tests/bug54992.phpt index 2937faa..bcb33fd 100644 --- a/ext/openssl/tests/bug54992.phpt +++ b/ext/openssl/tests/bug54992.phpt @@ -25,7 +25,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'buga_buga', + 'peer_name' => 'buga_buga', ]]); phpt_wait(); diff --git a/ext/openssl/tests/bug65538_001.phpt b/ext/openssl/tests/bug65538_001.phpt index ea7d6f4..e666859 100644 --- a/ext/openssl/tests/bug65538_001.phpt +++ b/ext/openssl/tests/bug65538_001.phpt @@ -37,7 +37,7 @@ $clientCode = <<<'CODE' $serverUri = "https://127.0.0.1:64321/"; $clientCtx = stream_context_create(['ssl' => [ 'cafile' => 'file://' . __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/bug65538_003.phpt b/ext/openssl/tests/bug65538_003.phpt index b927e4e..da99779 100644 --- a/ext/openssl/tests/bug65538_003.phpt +++ b/ext/openssl/tests/bug65538_003.phpt @@ -38,7 +38,7 @@ $clientCode = <<<'CODE' $serverUri = "https://127.0.0.1:64321/"; $clientCtx = stream_context_create(['ssl' => [ 'cafile' => 'phar://' . __DIR__ . '/bug65538.phar/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/bug65729.phpt b/ext/openssl/tests/bug65729.phpt index e27dbb9..b405b72 100644 --- a/ext/openssl/tests/bug65729.phpt +++ b/ext/openssl/tests/bug65729.phpt @@ -33,7 +33,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'allow_self_signed' => true, - 'CN_match' => $expected_name, + 'peer_name' => $expected_name, ]]); var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx)); diff --git a/ext/openssl/tests/openssl_peer_fingerprint.phpt b/ext/openssl/tests/openssl_peer_fingerprint.phpt index 5390c49..0bd91d5 100644 --- a/ext/openssl/tests/openssl_peer_fingerprint.phpt +++ b/ext/openssl/tests/openssl_peer_fingerprint.phpt @@ -27,7 +27,7 @@ $clientCode = <<<'CODE' 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', 'capture_peer_cert' => true, - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/peer_verification.phpt b/ext/openssl/tests/peer_verification.phpt index 607b617..6aff34d 100644 --- a/ext/openssl/tests/peer_verification.phpt +++ b/ext/openssl/tests/peer_verification.phpt @@ -40,14 +40,14 @@ $clientCode = <<<'CODE' // Should succeed with peer verification disabled in context $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => false, - 'verify_host' => false, + 'verify_peer_name' => false, ]]); var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx)); // Should succeed with CA file specified in context $clientCtx = stream_context_create(['ssl' => [ 'cafile' => $caFile, - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx)); CODE; diff --git a/ext/openssl/tests/san_peer_matching.phpt b/ext/openssl/tests/san_peer_matching.phpt index 3fa479e..0e1f30c 100644 --- a/ext/openssl/tests/san_peer_matching.phpt +++ b/ext/openssl/tests/san_peer_matching.phpt @@ -30,10 +30,10 @@ $clientCode = <<<'CODE' phpt_wait(); - stream_context_set_option($clientCtx, 'ssl', 'CN_match', 'example.org'); + stream_context_set_option($clientCtx, 'ssl', 'peer_name', 'example.org'); var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx)); - stream_context_set_option($clientCtx, 'ssl', 'CN_match', 'moar.example.org'); + stream_context_set_option($clientCtx, 'ssl', 'peer_name', 'moar.example.org'); var_dump(stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx)); CODE; diff --git a/ext/openssl/tests/session_meta_capture.phpt b/ext/openssl/tests/session_meta_capture.phpt index 3b2a804..62cdffe 100644 --- a/ext/openssl/tests/session_meta_capture.phpt +++ b/ext/openssl/tests/session_meta_capture.phpt @@ -29,7 +29,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', 'capture_session_meta' => true, ]]); diff --git a/ext/openssl/tests/sni_001.phpt b/ext/openssl/tests/sni_001.phpt index 0dbd18d..e6c05f7 100644 --- a/ext/openssl/tests/sni_001.phpt +++ b/ext/openssl/tests/sni_001.phpt @@ -26,9 +26,9 @@ function context($host = NULL) { stream_context_set_option($ctx, 'ssl', 'capture_peer_cert', true); stream_context_set_option($ctx, 'ssl', 'verify_peer', false); if ($host) { - stream_context_set_option($ctx, 'ssl', 'CN_match', $host); + stream_context_set_option($ctx, 'ssl', 'peer_name', $host); } else { - stream_context_set_option($ctx, 'ssl', 'verify_host', false); + stream_context_set_option($ctx, 'ssl', 'verify_peer_name', false); } return $ctx; diff --git a/ext/openssl/tests/stream_crypto_flags_001.phpt b/ext/openssl/tests/stream_crypto_flags_001.phpt index b9a49f9..f988886 100644 --- a/ext/openssl/tests/stream_crypto_flags_001.phpt +++ b/ext/openssl/tests/stream_crypto_flags_001.phpt @@ -27,7 +27,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/stream_crypto_flags_002.phpt b/ext/openssl/tests/stream_crypto_flags_002.phpt index 15b3fb9..b72b4d6 100644 --- a/ext/openssl/tests/stream_crypto_flags_002.phpt +++ b/ext/openssl/tests/stream_crypto_flags_002.phpt @@ -29,7 +29,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/stream_crypto_flags_003.phpt b/ext/openssl/tests/stream_crypto_flags_003.phpt index c5aebd8..30ca7a7 100644 --- a/ext/openssl/tests/stream_crypto_flags_003.phpt +++ b/ext/openssl/tests/stream_crypto_flags_003.phpt @@ -32,7 +32,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/stream_crypto_flags_004.phpt b/ext/openssl/tests/stream_crypto_flags_004.phpt index 38f406c..e51a2ba 100644 --- a/ext/openssl/tests/stream_crypto_flags_004.phpt +++ b/ext/openssl/tests/stream_crypto_flags_004.phpt @@ -29,7 +29,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'verify_peer' => true, 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'CN_match' => 'bug54992.local', + 'peer_name' => 'bug54992.local', ]]); phpt_wait(); diff --git a/ext/openssl/tests/stream_verify_host_001.phpt b/ext/openssl/tests/stream_verify_host_001.phpt deleted file mode 100644 index c4d87b8..0000000 --- a/ext/openssl/tests/stream_verify_host_001.phpt +++ /dev/null @@ -1,39 +0,0 @@ ---TEST-- -Verify host name by default in client transfers ---SKIPIF-- -<?php -if (!extension_loaded("openssl")) die("skip openssl not loaded"); -if (!function_exists("proc_open")) die("skip no proc_open"); ---FILE-- -<?php -$serverCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; - $serverCtx = stream_context_create(['ssl' => [ - 'local_cert' => __DIR__ . '/bug54992.pem' - ]]); - - $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); - phpt_notify(); - - @stream_socket_accept($server, 1); -CODE; - -$clientCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $clientFlags = STREAM_CLIENT_CONNECT; - $clientCtx = stream_context_create(['ssl' => [ - 'verify_peer' => false, - 'CN_match' => 'bug54992.local' - ]]); - - phpt_wait(); - $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); - - var_dump($client); -CODE; - -include 'ServerClientTestCase.inc'; -ServerClientTestCase::getInstance()->run($clientCode, $serverCode); ---EXPECTF-- -resource(%d) of type (stream) diff --git a/ext/openssl/tests/stream_verify_host_002.phpt b/ext/openssl/tests/stream_verify_host_002.phpt deleted file mode 100644 index c0db4f2..0000000 --- a/ext/openssl/tests/stream_verify_host_002.phpt +++ /dev/null @@ -1,40 +0,0 @@ ---TEST-- -Allow host name mismatch when "verify_host" disabled ---SKIPIF-- -<?php -if (!extension_loaded("openssl")) die("skip openssl not loaded"); -if (!function_exists("proc_open")) die("skip no proc_open"); ---FILE-- -<?php -$serverCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; - $serverCtx = stream_context_create(['ssl' => [ - 'local_cert' => __DIR__ . '/bug54992.pem' - ]]); - - $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); - phpt_notify(); - - @stream_socket_accept($server, 1); -CODE; - -$clientCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $clientFlags = STREAM_CLIENT_CONNECT; - $clientCtx = stream_context_create(['ssl' => [ - 'verify_peer' => true, - 'cafile' => __DIR__ . '/bug54992-ca.pem', - 'verify_host' => false - ]]); - - phpt_wait(); - $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); - - var_dump($client); -CODE; - -include 'ServerClientTestCase.inc'; -ServerClientTestCase::getInstance()->run($clientCode, $serverCode); ---EXPECTF-- -resource(%d) of type (stream) diff --git a/ext/openssl/tests/stream_verify_host_003.phpt b/ext/openssl/tests/stream_verify_host_003.phpt deleted file mode 100644 index e4e083f..0000000 --- a/ext/openssl/tests/stream_verify_host_003.phpt +++ /dev/null @@ -1,44 +0,0 @@ ---TEST-- -Host name mismatch triggers error ---SKIPIF-- -<?php -if (!extension_loaded("openssl")) die("skip openssl not loaded"); -if (!function_exists("proc_open")) die("skip no proc_open"); ---FILE-- -<?php -$serverCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; - $serverCtx = stream_context_create(['ssl' => [ - 'local_cert' => __DIR__ . '/bug54992.pem' - ]]); - - $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); - phpt_notify(); - - @stream_socket_accept($server, 1); -CODE; - -$clientCode = <<<'CODE' - $serverUri = "ssl://127.0.0.1:64321"; - $clientFlags = STREAM_CLIENT_CONNECT; - $clientCtx = stream_context_create(['ssl' => [ - 'verify_peer' => true, - 'cafile' => __DIR__ . '/bug54992-ca.pem' - ]]); - - phpt_wait(); - $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); - - var_dump($client); -CODE; - -include 'ServerClientTestCase.inc'; -ServerClientTestCase::getInstance()->run($clientCode, $serverCode); ---EXPECTF-- -Warning: stream_socket_client(): Peer certificate CN=`bug54992.local' did not match expected CN=`127.0.0.1' in %s on line %d - -Warning: stream_socket_client(): Failed to enable crypto in %s on line %d - -Warning: stream_socket_client(): unable to connect to ssl://127.0.0.1:64321 (Unknown error) in %s on line %d -bool(false) diff --git a/ext/openssl/tests/stream_verify_peer_name_001.phpt b/ext/openssl/tests/stream_verify_peer_name_001.phpt new file mode 100644 index 0000000..4aecf8c --- /dev/null +++ b/ext/openssl/tests/stream_verify_peer_name_001.phpt @@ -0,0 +1,39 @@ +--TEST-- +Verify host name by default in client transfers +--SKIPIF-- +<?php +if (!extension_loaded("openssl")) die("skip openssl not loaded"); +if (!function_exists("proc_open")) die("skip no proc_open"); +--FILE-- +<?php +$serverCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; + $serverCtx = stream_context_create(['ssl' => [ + 'local_cert' => __DIR__ . '/bug54992.pem' + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); + phpt_notify(); + + @stream_socket_accept($server, 1); +CODE; + +$clientCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $clientFlags = STREAM_CLIENT_CONNECT; + $clientCtx = stream_context_create(['ssl' => [ + 'verify_peer' => false, + 'peer_name' => 'bug54992.local' + ]]); + + phpt_wait(); + $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); + + var_dump($client); +CODE; + +include 'ServerClientTestCase.inc'; +ServerClientTestCase::getInstance()->run($clientCode, $serverCode); +--EXPECTF-- +resource(%d) of type (stream) diff --git a/ext/openssl/tests/stream_verify_peer_name_002.phpt b/ext/openssl/tests/stream_verify_peer_name_002.phpt new file mode 100644 index 0000000..ae97ea1 --- /dev/null +++ b/ext/openssl/tests/stream_verify_peer_name_002.phpt @@ -0,0 +1,40 @@ +--TEST-- +Allow host name mismatch when "verify_host" disabled +--SKIPIF-- +<?php +if (!extension_loaded("openssl")) die("skip openssl not loaded"); +if (!function_exists("proc_open")) die("skip no proc_open"); +--FILE-- +<?php +$serverCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; + $serverCtx = stream_context_create(['ssl' => [ + 'local_cert' => __DIR__ . '/bug54992.pem' + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); + phpt_notify(); + + @stream_socket_accept($server, 1); +CODE; + +$clientCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $clientFlags = STREAM_CLIENT_CONNECT; + $clientCtx = stream_context_create(['ssl' => [ + 'verify_peer' => true, + 'cafile' => __DIR__ . '/bug54992-ca.pem', + 'verify_peer_name' => false + ]]); + + phpt_wait(); + $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); + + var_dump($client); +CODE; + +include 'ServerClientTestCase.inc'; +ServerClientTestCase::getInstance()->run($clientCode, $serverCode); +--EXPECTF-- +resource(%d) of type (stream) diff --git a/ext/openssl/tests/stream_verify_peer_name_003.phpt b/ext/openssl/tests/stream_verify_peer_name_003.phpt new file mode 100644 index 0000000..e4e083f --- /dev/null +++ b/ext/openssl/tests/stream_verify_peer_name_003.phpt @@ -0,0 +1,44 @@ +--TEST-- +Host name mismatch triggers error +--SKIPIF-- +<?php +if (!extension_loaded("openssl")) die("skip openssl not loaded"); +if (!function_exists("proc_open")) die("skip no proc_open"); +--FILE-- +<?php +$serverCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; + $serverCtx = stream_context_create(['ssl' => [ + 'local_cert' => __DIR__ . '/bug54992.pem' + ]]); + + $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); + phpt_notify(); + + @stream_socket_accept($server, 1); +CODE; + +$clientCode = <<<'CODE' + $serverUri = "ssl://127.0.0.1:64321"; + $clientFlags = STREAM_CLIENT_CONNECT; + $clientCtx = stream_context_create(['ssl' => [ + 'verify_peer' => true, + 'cafile' => __DIR__ . '/bug54992-ca.pem' + ]]); + + phpt_wait(); + $client = stream_socket_client($serverUri, $errno, $errstr, 1, $clientFlags, $clientCtx); + + var_dump($client); +CODE; + +include 'ServerClientTestCase.inc'; +ServerClientTestCase::getInstance()->run($clientCode, $serverCode); +--EXPECTF-- +Warning: stream_socket_client(): Peer certificate CN=`bug54992.local' did not match expected CN=`127.0.0.1' in %s on line %d + +Warning: stream_socket_client(): Failed to enable crypto in %s on line %d + +Warning: stream_socket_client(): unable to connect to ssl://127.0.0.1:64321 (Unknown error) in %s on line %d +bool(false) diff --git a/ext/openssl/tests/streams_crypto_method.phpt b/ext/openssl/tests/streams_crypto_method.phpt index 1bf9048..84f7934 100644 --- a/ext/openssl/tests/streams_crypto_method.phpt +++ b/ext/openssl/tests/streams_crypto_method.phpt @@ -39,7 +39,7 @@ $clientCode = <<<'CODE' $clientCtx = stream_context_create(['ssl' => [ 'crypto_method' => STREAM_CRYPTO_METHOD_SSLv3_CLIENT, 'verify_peer' => false, - 'verify_host' => false + 'verify_peer_name' => false ]]); phpt_wait(); diff --git a/ext/openssl/tests/tlsv1.0_wrapper.phpt b/ext/openssl/tests/tlsv1.0_wrapper.phpt index d24ab45..7479259 100644 --- a/ext/openssl/tests/tlsv1.0_wrapper.phpt +++ b/ext/openssl/tests/tlsv1.0_wrapper.phpt @@ -24,7 +24,7 @@ $clientCode = <<<'CODE' $flags = STREAM_CLIENT_CONNECT; $ctx = stream_context_create(['ssl' => [ 'verify_peer' => false, - 'verify_host' => false, + 'verify_peer_name' => false, ]]); phpt_wait(); diff --git a/ext/openssl/tests/tlsv1.1_wrapper.phpt b/ext/openssl/tests/tlsv1.1_wrapper.phpt index cd88178..3e067a1 100644 --- a/ext/openssl/tests/tlsv1.1_wrapper.phpt +++ b/ext/openssl/tests/tlsv1.1_wrapper.phpt @@ -25,7 +25,7 @@ $clientCode = <<<'CODE' $flags = STREAM_CLIENT_CONNECT; $ctx = stream_context_create(['ssl' => [ 'verify_peer' => false, - 'verify_host' => false, + 'verify_peer_name' => false, ]]); phpt_wait(); diff --git a/ext/openssl/tests/tlsv1.2_wrapper.phpt b/ext/openssl/tests/tlsv1.2_wrapper.phpt index 124fdf2..ca967d1 100644 --- a/ext/openssl/tests/tlsv1.2_wrapper.phpt +++ b/ext/openssl/tests/tlsv1.2_wrapper.phpt @@ -25,7 +25,7 @@ $clientCode = <<<'CODE' $flags = STREAM_CLIENT_CONNECT; $ctx = stream_context_create(['ssl' => [ 'verify_peer' => false, - 'verify_host' => false, + 'verify_peer_name' => false, ]]); phpt_wait();