Re: [RFC] openssl_get_channel_binding

Thank you for the thorough review. On Wed, Oct 28, 2026, at 15:18, Tim Düsterhus wrote: > Hi > > On 2026-10-27 10:25, Sjoerd Langkemper wrote: > > I have created an RFC to add the function openssl_get_channel_binding: > > https://wiki.php.net/rfc/openssl_get_channel_binding > > > 1. “The function returns null when the requested type is not applicable > to the connection.” > > An operation that is not applicable sounds like an Exception to me. Is > there currently any other situation where null is returned? No. I can see the appeal of throwing a specific exception (e.g. UnsupportedChannelBinding extends OpensslExtension). Then if the function returns something the caller knows it is a valid channel binding value. The RFC already identifies the case for tls-unique over TLS 1.3. I think using tls-server-end-point over TLS-PSK also may not work (because there's no certificate) and should also throw such an exception. > 2. “$stream is a stream, but it has no active OpenSSL TLS transport” > > That sounds like a programmer error, thus Openssl\OpensslError > (or > potentially ValueError). Yes, I agree. > 3. “An OpenSSL call fails while computing the value” > > Is this one reachable in practice or is this more of a generic “catch > all” error that cannot really happen? This was meant as a generic catch all for things that should not normally fail. > 4. “Because the second parameter is an enum, the function itself no > longer has an unknown-type error. […]” > > This paragraph should probably not be mentioned in the RFC Yes, I agree. I removed this. > 7. RFC Impact to “To Existing Extensions” > > Are there perhaps any extensions that might want to make use of the new > functionality internally? For example pdo_pgsql, I'm noting that the RFC > mentions tests against PostgreSQL? I hadn't considered this. Not really. Most extensions don't use a connection managed by ext/openssl. E.g. for postgres, libpq does the TLS handling and also the channel binding. Mysqlnd does use a PHP stream, but MySQL/mariadb don't have any channel binding functionality. Regards, Sjoerd Langkemper