com php-src: Fixed #69882: OpenSSL error "key values mismatch" after openssl_pkcs12_read with extra certs: NEWS ext/openssl/openssl.c
ext/openssl/php_openssl.h ext/o penssl/tests/bug69882.phpt ext/openssl/tests/p1 2_with_extra_certs.p12

Commit: 2ff3dafccfa4fd0bc031d5165f84593d092148d2 Author: Tjerk Meesters <datibbaw@php.net> Fri, 26 Jun 2015 05:31:54 +0800 Parents: b1ec4515b00739d89ba1c76ed9285b27094ea349 Branches: PHP-5.6 master Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=2ff3dafccfa4fd0bc031d5165f84593d092148d2 Log: Fixed #69882: OpenSSL error "key values mismatch" after openssl_pkcs12_read with extra certs Squashed commit of the following: commit a64c1d9bc4c129fd946a478bdcb55101e42157b7 Author: Tomasz Sawicki <falundir@gmail.com> Date: Wed Jun 24 08:49:37 2015 +0200 Fix #69882: OpenSSL error "key values mismatch" after openssl_pkcs12_read with extra certs The "key values mismatch" error is triggered in openssl_pkcs12_read by PKCS12_parse, because it uses X509_check_private_key to separate main certificate (which corresponds to private key) from extra certificates. Extra certificates usually comes first (p12 contents are reversed as stack) and X509_check_private_key triggers X509_R_KEY_VALUES_MISMATCH error. The fix pops "key values mismatch" error from OpenSSL error stack for each extra certificate if there are any. Bugs: https://bugs.php.net/69882 Changed paths: M NEWS M ext/openssl/openssl.c M ext/openssl/php_openssl.h A ext/openssl/tests/bug69882.phpt A ext/openssl/tests/p12_with_extra_certs.p12 Diff: diff --git a/NEWS b/NEWS index 3f4e5fa..77b26c2 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? Jul 2015, PHP 5.6.12 +- OpenSSL: + . Fixed bug #69882 (OpenSSL error “key values mismatch” after + openssl_pkcs12_read with extra cert) (Tomasz Sawicki) + 09 Jul 2015, PHP 5.6.11 - Core: diff --git a/ext/openssl/openssl.c b/ext/openssl/openssl.c index 23f893e..20a63b1 100644 --- a/ext/openssl/openssl.c +++ b/ext/openssl/openssl.c @@ -2575,7 +2575,15 @@ PHP_FUNCTION(openssl_pkcs12_read) zval * zextracert; X509* aCA = sk_X509_pop(ca); if (!aCA) break; - + + /* fix for bug 69882 */ + { + int err = ERR_peek_error(); + if (err == OPENSSL_ERROR_X509_PRIVATE_KEY_VALUES_MISMATCH) { + ERR_get_error(); + } + } + bio_out = BIO_new(BIO_s_mem()); if (PEM_write_bio_X509(bio_out, aCA)) { BUF_MEM *bio_buf; diff --git a/ext/openssl/php_openssl..h b/ext/openssl/php_openssl.h index 6fbb374..8a6643d 100644 --- a/ext/openssl/php_openssl.h +++ b/ext/openssl/php_openssl.h @@ -29,6 +29,8 @@ extern zend_module_entry openssl_module_entry; #define OPENSSL_RAW_DATA 1 #define OPENSSL_ZERO_PADDING 2 +#define OPENSSL_ERROR_X509_PRIVATE_KEY_VALUES_MISMATCH 0x0B080074 + /* Used for client-initiated handshake renegotiation DoS protection*/ #define OPENSSL_DEFAULT_RENEG_LIMIT 2 #define OPENSSL_DEFAULT_RENEG_WINDOW 300 diff --git a/ext/openssl/tests/bug69882.phpt b/ext/openssl/tests/bug69882.phpt new file mode 100644 index 0000000..6963f8d --- /dev/null +++ b/ext/openssl/tests/bug69882.phpt @@ -0,0 +1,17 @@ +--TEST-- +Bug #69882: OpenSSL error "key values mismatch" after openssl_pkcs12_read with extra certs +--SKIPIF-- +<?php +if (!extension_loaded("openssl")) die("skip"); +?> +--FILE-- +<?php +$p12 = file_get_contents(__DIR__.'/p12_with_extra_certs.p12'); + +$result = openssl_pkcs12_read($p12, $cert_data, 'qwerty'); +var_dump($result); +var_dump(openssl_error_string()); +?> +--EXPECTF-- +bool(true) +bool(false) diff --git a/ext/openssl/tests/p12_with_extra_certs.p12 b/ext/openssl/tests/p12_with_extra_certs.p12 new file mode 100644 index 0000000..b3ba223 Binary files /dev/null and b/ext/openssl/tests/p12_with_extra_certs.p12 differ