Micro optimizations for xp_ssl.c (#7447)

If certfile/private_key points to a file that doesn't exist, it throw a warning and return failure now.
Also fixed sni_server tests.

Co-

Micro optimizations for xp_ssl.c (#7447)

If certfile/private_key points to a file that doesn't exist, it throw a warning and return failure now.
Also fixed sni_server tests.

Co-authored-by: Nikita Popov <nikita.ppv@googlemail.com>

show more ...

Simplify SSL_set_mode() calls (#7444)

SSL_set_mode() adds the mode set via bitmask in mode to ssl.

Switch dh_param handling to EVP_PKEY API

Fix typos (#7327)

Merge branch 'PHP-8.0'

* PHP-8.0:
Fix #76694: native Windows cert verification uses CN as sever name

Merge branch 'PHP-7.4' into PHP-8.0

* PHP-7.4:
Fix #76694: native Windows cert verification uses CN as sever name

Fix #76694: native Windows cert verification uses CN as sever name

This is not guaranteed to work, since the actual server name may only
be given as SAN. Since we're doing the peer veri

Fix #76694: native Windows cert verification uses CN as sever name

This is not guaranteed to work, since the actual server name may only
be given as SAN. Since we're doing the peer verification later anyway
(using the respective context options as appropriate), there is no need
to even supply a server name when verifying against the Windows cert
store.

Closes GH-7060.

show more ...

Mark various functions with void arguments.

This fixes a bunch of [-Wstrict-prototypes] warning,
because in C func() and func(void) have different semantics.

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as

Update http->https in license (#6945)

1. Update: http://www.php.net/license/3_01.txt to https, as there is anyway server header "Location:" to https.
2. Update few license 3.0 to 3.01 as 3.0 states "php 5.1.1, 4.1.1, and earlier".
3. In some license comments is "at through the world-wide-web" while most is without "at", so deleted.
4. fixed indentation in some files before |

show more ...

Use zend_string_equals_(literal_)ci() API more often

Also drive-by usage of zend_ini_parse_bool()

Closes GH-6844

Introduce pseudo-keyword ZEND_FALLTHROUGH

And use it instead of comments

Remove duplicated SSL_CTX_set_verify()

Duplicated with line 920.
Our minimal OpenSSL version is v1.0.1 (See https://github.com/openssl/openssl/blob/OpenSSL_1_0_1-stable/ssl/ssl_lib.c#L20

Remove duplicated SSL_CTX_set_verify()

Duplicated with line 920.
Our minimal OpenSSL version is v1.0.1 (See https://github.com/openssl/openssl/blob/OpenSSL_1_0_1-stable/ssl/ssl_lib.c#L2039).
Removing it does not affect program behavior.
Closes GH-6751.

show more ...

Replace zend_bool uses with bool

We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.

Of course, zend_bool

Replace zend_bool uses with bool

We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.

Of course, zend_bool is retained as an alias.

show more ...

Bump minimal OpenSSL version to 1.0.2

Convert resources to objects in ext/openssl

Closes GH-5860

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>

Avoid some unnecessary uses of no_separation=0

For the rare cases where references are part of the API,
construct them explicitly. Otherwise do not allow separation.

Merge branch 'PHP-7.4'

Don't generate spurious warning is security_level not supported

People should not have to worry about the used openssl version
when downgrading security_level.

Merge branch 'PHP-7.4'

* PHP-7.4:
Fix #62890: default_socket_timeout=-1 causes connection to timeout

Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
Fix #62890: default_socket_timeout=-1 causes connection to timeout

Fix #62890: default_socket_timeout=-1 causes connection to timeout

While unencrypted connections ignore negative timeouts, SSL/TLS
connections did not special case that, and so always fa

Fix #62890: default_socket_timeout=-1 causes connection to timeout

While unencrypted connections ignore negative timeouts, SSL/TLS
connections did not special case that, and so always failed due to
timeout.

show more ...

Merge branch 'PHP-7.4'

* PHP-7.4:
Fix #79497: Fix php_openssl_subtract_timeval()

Merge branch 'PHP-7.3' into PHP-7.4

* PHP-7.3:
Fix #79497: Fix php_openssl_subtract_timeval()

Fix #79497: Fix php_openssl_subtract_timeval()

I stumbled upon this while debugging a strange issue with
stream_socket_client() where it randomly throws out errors when
the connectio

Fix #79497: Fix php_openssl_subtract_timeval()

I stumbled upon this while debugging a strange issue with
stream_socket_client() where it randomly throws out errors when
the connection timeout is set to below 1s. The logic to calculate
time difference in php_openssl_subtract_timeval() is wrong when
a.tv_usec < b.tv_usec, causing connection errors before the timeout
is reached.

show more ...

Remove deprecated capture_session_meta OpenSSL stream context

Closes GH-5200