Tweak openssl_random_pseudo_bytes() upper bound error message

As suggested by @guilliamxavier.

Restrict range of buffer_length on all platforms to INT_MAX

This has only been done for Windows systems so far, and there was a
TODO comment about looping for larger values; that appears

Restrict range of buffer_length on all platforms to INT_MAX

This has only been done for Windows systems so far, and there was a
TODO comment about looping for larger values; that appears to be
overkill, though, since 2 million bytes should be sufficient for all
use cases, and if there is really the need for more, users can still
loop manually. Anyhow, checking the range upfront on all platforms
is clearer then silently casting to `int`.

We split the error message for the least possible BC break.

Closes GH-9126.

show more ...

Declare ext/openssl constants in stubs (#9046)

Mark parameter in ext/openssl as sensitive

Fix bug #50293 and #81713: file path checking in OpenSSL functions

It introduces a single function to check file paths passed to OpenSSL
functions. It expands the path, check null bytes

Fix bug #50293 and #81713: file path checking in OpenSSL functions

It introduces a single function to check file paths passed to OpenSSL
functions. It expands the path, check null bytes and finally does
an open basedir check.

show more ...

Initialise zend_stat_t to fix MSAN build

Fixed bug #81502

Allow $tag to be null. This is the value that openssl_encrypt()
sets it to for non-AEAD ciphers, so we should also accept this
as an input to openssl_decrypt().

Fixed bug #81502

Allow $tag to be null. This is the value that openssl_encrypt()
sets it to for non-AEAD ciphers, so we should also accept this
as an input to openssl_decrypt().

Prior to PHP 8.1, null was accepted in weak mode due to the special
treatment of null arguments to internal functions.

show more ...

fix [-Wmaybe-uninitialized] build warnings

Switch default PKCS7/CMS cipher to AES-128-CBC

Switch default cipher for openssl_pkcs7_encrypt() and
openssl_cms_encrypt() from RC2-40 to AES-128-CBC.

The RC2-40 cipher is consi

Switch default PKCS7/CMS cipher to AES-128-CBC

Switch default cipher for openssl_pkcs7_encrypt() and
openssl_cms_encrypt() from RC2-40 to AES-128-CBC.

The RC2-40 cipher is considered insecure and is not loaded by
default in OpenSSL 3, which means that these functions will
always fail with default arguments.

As the used algorithm is embedded in the result (which makes this
different from the openssl_encrypt() case) changing the default
algorithm should be safe.

Closes GH-7357.

show more ...

implement openssl_256 and openssl_512 for phar singatures

Fix openssl memory leaks

Some leaks that snuck in during refactorings.

Use param API to create RSA key

Instead of deprecated low-level API.

A caveat here is that when using the high-level API, OpenSSL 3
requires that if the prime factors are set, t

Use param API to create RSA key

Instead of deprecated low-level API.

A caveat here is that when using the high-level API, OpenSSL 3
requires that if the prime factors are set, the CRT parameters
are also set. See https://github.com/openssl/openssl/issues/16271.

As such, add CRT parameters to the manual construction test.

This fixes the last deprecation warnings in openssl.c, but there
are more elsewhere.

show more ...

Add missing unsigned qualifier

This previously got lost in the deprecation warning noise.

Use param API for openssl_pkey_get_details()

Now that the DSA/DH/EC keys are not created using the legacy API,
we can fetch the details using the param API as well, and not
run into

Use param API for openssl_pkey_get_details()

Now that the DSA/DH/EC keys are not created using the legacy API,
we can fetch the details using the param API as well, and not
run into buggy priv_key handling.

show more ...

Extract public key portion via PEM roundtrip

The workaround with cloning the X509_REQ no longer works in
OpenSSL 3. Instead extract the public key portion by round
tripping through P

Extract public key portion via PEM roundtrip

The workaround with cloning the X509_REQ no longer works in
OpenSSL 3. Instead extract the public key portion by round
tripping through PEM.

show more ...

Use param API for creating EC keys

Rather than the deprecated low level APIs.

Extract EC key initialization

Use OpenSSL NCONF APIs (#7337)

minimal fix for openssl 3.0 (#7002)

Switch manual DSA key generation to param API

This is very similar to the DH case, with the primary difference
that priv_key is ignored if pub_key is not given, rather than
generatin

Switch manual DSA key generation to param API

This is very similar to the DH case, with the primary difference
that priv_key is ignored if pub_key is not given, rather than
generating pub_key from priv_key. Would be nice if these worked
the same (in which case we should probably also unify the keygen
for FFC algorithms, as it's very similar).

show more ...

Switch manual DH key generation to param API

Instead of using the deprecated low-level interface.

This should also avoid issues with fetching parameters from
legacy keys, cf. ht

Switch manual DH key generation to param API

Instead of using the deprecated low-level interface.

This should also avoid issues with fetching parameters from
legacy keys, cf. https://github.com/openssl/openssl/issues/16247.

show more ...

Do not special case export of EC keys

All other private keys are exported in PKCS#8 format, while EC
keys use traditional format. Switch them to use PKCS#8 format as
well.

A

Do not special case export of EC keys

All other private keys are exported in PKCS#8 format, while EC
keys use traditional format. Switch them to use PKCS#8 format as
well.

As the OpenSSL docs say:

> PEM_write_bio_PrivateKey_traditional() writes out a private key
> in the "traditional" format with a simple private key marker and
> should only be used for compatibility with legacy programs.

show more ...

Avoid DH_compute_key() with OpenSSL 3

Instead construct a proper EVP_PKEY for the public key and
perform a derive operation.

Unfortunately we can't use a common code path here,

Avoid DH_compute_key() with OpenSSL 3

Instead construct a proper EVP_PKEY for the public key and
perform a derive operation.

Unfortunately we can't use a common code path here, because
EVP_PKEY_set1_encoded_public_key() formerly known as
EVP_PKEY_set1_tls_encodedpoint() does not appear to work with
DH keys prior to OpenSSL 3.

show more ...

Extract php_openssl_pkey_derive() function

To allow sharing it with the openssl_dh_compute_key() implementation.

Store whether pkey object contains private key

Rather than querying whether the EVP_PKEY contains private key
information, determine this at time of construction and store it
in the

Store whether pkey object contains private key

Rather than querying whether the EVP_PKEY contains private key
information, determine this at time of construction and store it
in the PHP object.

OpenSSL doesn't provide an API for this purpose, and seems
somewhat reluctant to add one, see
https://github.com/openssl/openssl/issues/9467.

To avoid using deprecated low-level APIs to determine whether
something is a private key ourselves, remember it at the point
of construction.

show more ...