RE: [PHP-DEV] Re: networking.c and fopen wrappers etc. (was RE: [ PHP-DEV] some IPv6 code added, compile problems anyone?)

> I think hostconnect should be more low level, so there should be some > other code that determines whether to use UDP or TCP and then calls > hostconnect. > > When using SSL, you could do > > s = php_hostconnect(.....); > sbuf = php_sockcreate(s); > if (sbuf) { > ... > sslret = SSL_connect(ssl); > } > right? Yes, you could. But the "purist" in me would like to see an extra parameter to php_hostconnect that allows you to choose which encryption/SSL protocol you use. But, this might not be appropriate if you want to allow a client cert to be chosen, random seeds etc., so perhaps there should be a php_hostconnect_ssl() call? > > > It would be nice to allow the user to verify certs etc. using > the SSL API > > just by passing the socket you get back from fsockopen as the "handle". > > You may also need something to select certs to use before doing > SSL_new or? Don't know this so well. It depends on how user-friendly we want to make the php interface. I have a feeling that we need to hook in before the actual SSL_connect call to be able to choose a client cert. > > The nice thing about using OpenSSL is that it is very lightweight, > > especially if your server is already using mod_ssl. (Although I > haven't used > > cURL, I have heard that it is a bit "heavy"). > > You may be right. Using OpenSSL seems pretty simple actually. The code in my patch comes from the cli.cpp example that was included in OpenSSL; there is probably a lot more that could/should be done to ensure better security. Also, the code in the patch only works for SSL client connections, so a little more work is required to get things in server mode. We could generalize and go for the generic client/server mode I saw mentioned in the header files. > BTW, what about PRNG seeds? Don't you need to feed it some > random data to get something secure? I have to confess that I am not an OpenSSL expert. So, you might be right. > > Anyway, I will leave it to you to look through and see how it > fits into your > > plans. > > Fits very well if what I write about hostconnect above is correct (: Good. If we go for a php_hostconnect_ssl call, it might look a bit like this: typedef enum { PHPSSL_SSLV3 = 1, /* Use SSL V3 */ PHPSSL_SSLV2 = 2, /* Use SSL V2 */ PHPSSL_SSLV3V2 =3, /* Use SSL V3, if not possible, fall back on V2 */ PHPSSL_TLSV1 = 4, /* Use TLS 1.0 */ PHPSSL_SERVER = 0x7f /* if this bit is set in proto, assume a server context */ } phpssl_proto; int php_hostconnect_ssl(char * host, ushort port, int timeout, phpssl_proto proto, char * certfile) { sock = php_hostconnect(host, port, SOCK_STREAM, timeout); ... create SSL context ... ... randomize (if needed) ... ... load certfile and use it ... SSL_connect(...) ... hook for cert verification ? ... return sock } I'm going to read up a bit more on OpenSSL, to make sure I know what I am talking about... --Wez.