Revert "Make build work with newer OpenSSL"

This reverts commit 5f90134bb69a345c7edb5013e6461e84caa32dbc.

Make build work with newer OpenSSL

Fix GH-8430: OpenSSL compiled with old disgests does not build

Specifically no-md2, no-md4 or no-rmd160 were not supported

Fix GH-9339: OpenSSL oid_file path check warning contains uninitialized path

Fix bug #50293 and #81713: file path checking in OpenSSL functions

It introduces a single function to check file paths passed to OpenSSL
functions. It expands the path, check null bytes

Fix bug #50293 and #81713: file path checking in OpenSSL functions

It introduces a single function to check file paths passed to OpenSSL
functions. It expands the path, check null bytes and finally does
an open basedir check.

show more ...

Fix #81327: Error build openssl extension on php 7.4.22

The recent fix for bug 52093 is not compatible with LibreSSL ≥ 2.7.0,
which we recognize as mostly OpenSSL 1.1.0 compatible, but t

Fix #81327: Error build openssl extension on php 7.4.22

The recent fix for bug 52093 is not compatible with LibreSSL ≥ 2.7.0,
which we recognize as mostly OpenSSL 1.1.0 compatible, but they still
do not support `ASN1_INTEGER_set_int64()`.

Closes GH-7339.

show more ...

Fix #52093: openssl_csr_sign truncates $serial

We use `ASN1_INTEGER_set_int64()` if supported[1], to avoid the
truncation of the integer.

[1] <https://www.openssl.org/docs/man1.

Fix #52093: openssl_csr_sign truncates $serial

We use `ASN1_INTEGER_set_int64()` if supported[1], to avoid the
truncation of the integer.

[1] <https://www.openssl.org/docs/man1.1.0/man3/ASN1_INTEGER_set_int64.html#HISTORY>

Closes GH-7209.

show more ...

Mark resource-like objects as non-comparable

As these hold on to some internal resource, there can't be two
"equal" objects with different identity. Make sure the lack of
public prop

Mark resource-like objects as non-comparable

As these hold on to some internal resource, there can't be two
"equal" objects with different identity. Make sure the lack of
public properties doesn't result in these being treated as always
equal.

show more ...

Suppress OpenSSL error on missing optional config

openssl_pkey_new() fetches various options from the config file --
most of these are optional, and not specifying them is not an error

Suppress OpenSSL error on missing optional config

openssl_pkey_new() fetches various options from the config file --
most of these are optional, and not specifying them is not an error
condition from the perspective of the user. Unfortunately, the
CONF_get_string() API pushes an error when accessing a key that
doesn't exist (_CONF_get_string does not, but that is presumably a
private API). This commit adds a helper php_openssl_conf_get_string()
that automatically clears the error in this case. I've found that
OpenSSL occasionally does the same thing internally:
https://github.com/openssl/openssl/blob/22040fb790c854cefb04bed98ed38ea6357daf83/apps/req.c#L515-L517

Closes GH-6699.

show more ...

Fixed bug #80747

If RSA key generation fails, actually report that failure.

Next attempt to fix bug #80368

Apparently treating LibreSSL as OpenSSL 1.1 is not just something
we did in our code, it's something that upstream LibreSSL claims,
despite not actuall

Next attempt to fix bug #80368

Apparently treating LibreSSL as OpenSSL 1.1 is not just something
we did in our code, it's something that upstream LibreSSL claims,
despite not actually being compatible. Duh.

Check for EVP_CIPH_OCB_MODE instead, which should reliably
determine support...

show more ...

Fixed bug #80368

We assume that usually LibreSSL supports everything OpenSSL 1.1 does.
In this instance, this is not the case.

Fix CCM tag length setting for old OpenSSL versions

While OpenSSL 1.1 allows unconditionally setting the CCM tag length
even for decryption, some older versions apparently do not. As suc

Fix CCM tag length setting for old OpenSSL versions

While OpenSSL 1.1 allows unconditionally setting the CCM tag length
even for decryption, some older versions apparently do not. As such,
we do need to treat CCM and OCB separately after all.

show more ...

Fix bug #79983: Add support for OCB mode

OCB mode ciphers were already exposed to openssl_encrypt/decrypt,
but misbehaved, because they were not treated as AEAD ciphers.
From that pe

Fix bug #79983: Add support for OCB mode

OCB mode ciphers were already exposed to openssl_encrypt/decrypt,
but misbehaved, because they were not treated as AEAD ciphers.
From that perspective, OCB should be treated the same way as GCM.
In OpenSSL 1.1 the necessary controls were unified under
EVP_CTRL_AEAD_* (and OCB is only supported since OpenSSL 1.1).

Closes GH-6337.

show more ...

Fix nullability of openssl_cms_sign() parameter

Allow passing $tag for non-authenticated encryption

openssl_encrypt() currently throws a warning if the $tag out
parameter is passed for a non-authenticated cipher. This violates
the

Allow passing $tag for non-authenticated encryption

openssl_encrypt() currently throws a warning if the $tag out
parameter is passed for a non-authenticated cipher. This violates
the principle that a function should behave the same if a parameter
is not passed, and if the default value is passed for the parameter.

I believe this warning should simply be dropped and the $tag be
populated with null, as is already the case. Otherwise, it is not
possible to use openssl_encrypt() in generic wrapper APIs, that are
compatible with both authenticated and non-authenticated encryption.

Closes GH-6333.

show more ...

Revert "Add missing X509 purpose constants"

This reverts commit 1e53e14bc31aec98a408e517c7c8493ef4bf80cd.

This fails on Travis.

Add missing X509 purpose constants

X509_PURPOSE_OCSP_HELPER, X509_PURPOSE_TIMESTAMP_SIGN are available
from OpenSSL for many years:

- X509_PURPOSE_OCSP_HELPER, since 2001

Add missing X509 purpose constants

X509_PURPOSE_OCSP_HELPER, X509_PURPOSE_TIMESTAMP_SIGN are available
from OpenSSL for many years:

- X509_PURPOSE_OCSP_HELPER, since 2001
- X509_PURPOSE_TIMESTAMP_SIGN, since 2006

Also drop the ifdef check for X509_PURPOSE_ANY, as it is always
available in supported OpenSSL versions.

Closes GH-6312.

show more ...

Add test instantiating all objects

Intended to find issues in opaque object destructors.

Closes GH-6251.

Fix bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV)

Fix bug #79601 (Wrong ciphertext/tag in AES-CCM encryption for a 12 bytes IV)

Improve parameter handling in ext/openssl

Closes GH-6025

Consolidate new union type ZPP macro names

They will now follow the canonical order of types. Older macros are
left intact due to maintaining BC.

Closes GH-6112

Require $method parameter in openssl_seal/openssl_open

RC4 is considered insecure, and it's not possible to change the
default of these functions. As such, require the method to be
p

Require $method parameter in openssl_seal/openssl_open

RC4 is considered insecure, and it's not possible to change the
default of these functions. As such, require the method to be
passed explicitly.

Closes GH-6093.

show more ...

Promote various OpenSSL warnings into Errors

Closes GH-5111