Fix stub for openssl_csr_new

Implement GH-13514 PASSWORD_ARGON2 from OpenSSL 3.2 (#13635)

* Implement GH-13514 PASSWORD_ARGON2 from OpenSSL 3.2

* simplify init/shutdown

* use php_base64_encode_ex

Implement GH-13514 PASSWORD_ARGON2 from OpenSSL 3.2 (#13635)

* Implement GH-13514 PASSWORD_ARGON2 from OpenSSL 3.2

* simplify init/shutdown

* use php_base64_encode_ex

* - rename macros - use openssl RAND_bytes - CS

* add --with-openssl-argon2 build option

* check OSSL_KDF_PARAM_ARGON2_LANES instead of OSSL_set_max_threads

* Cleanup and CS

* save/restore old threads config + CS

* remove unneeded check

show more ...

Replace `@deprecated` by `#[\Deprecated]` for internal functions / class constants (#14750)

Co-authored-by: Gina Peter Banyard <girgias@php.net>
Co-authored-by: Niels Dossche <7771979+ni

Replace `@deprecated` by `#[\Deprecated]` for internal functions / class constants (#14750)

Co-authored-by: Gina Peter Banyard <girgias@php.net>
Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>

show more ...

Add support for Curve25519 + Curve448 based keys

For openssl_pkey_get_details we export the priv+pub parameters.

ED25519/ED448 do not support streaming, so we need to use
EVP_Di

Add support for Curve25519 + Curve448 based keys

For openssl_pkey_get_details we export the priv+pub parameters.

ED25519/ED448 do not support streaming, so we need to use
EVP_Digest{Sign,Verify} instead. In general the older EVP_{Sign,Verify}
interface should be avoided as the key is passed very late.
See BUGS section in OpenSSL manpages of EVP_{Sign,Verify}Final

Additionally per requirement we need to allow sign/verify without
digest. So we need to allow passing 0 as digest. In OpenSSL 3.0+ this also
corresponds to the default digest (see EVP_PKEY_get_default_digest_name).

For CSR creation we need to allow "null" as digest_alg option.

Closes GH-14052

show more ...

ext/openssl: Add X509 purpose constants.

- X509_PURPOSE_OCSP_HELPER.
- X509_PURPOSE_TIMESTAMP_SIGN.
- Also X509_PURPOSE_ANY is ok since 1.0.1+

Close GH-13149

Introduce new serial_hex parameter to openssl_csr_sign

Co-authored-by: Florian Sowade <f.sowade@suora.com>

Closes GH-13023
Closes GH-9851

Add PKCS7_NOOLDMIMETYPE and OPENSSL_CMS_OLDMIMETYPE

PKCS7_NOOLDMIMETYPE to use Content-Type application/pkcs7-mime
OPENSSL_CMS_OLDMIMETYPE to use Content-Type application/x-pkcs7-mime

Add PKCS7_NOOLDMIMETYPE and OPENSSL_CMS_OLDMIMETYPE

PKCS7_NOOLDMIMETYPE to use Content-Type application/pkcs7-mime
OPENSSL_CMS_OLDMIMETYPE to use Content-Type application/x-pkcs7-mime

SMIME_write_PKCS7 and SMIME_write_CMS are using SMIME_write_ASN1_ex.
The Content-Type application/x-pkcs7-mime is generated with the flag SMIME_OLDMIME (0x400).[^1]

SMIME_write_PKCS7 set SMIME_OLDMIME by default.[^2]
SMIME_write_CMS does not.[^3]

I picked OPENSSL_CMS_OLDMIMETYPE over OPENSSL_CMS_NOOLDMIMETYPE because that's what the flag actually does.

[^1]: https://github.com/openssl/openssl/blob/9a2f78e14a67eeaadefc77d05f0778fc9684d26c/crypto/asn1/asn_mime.c#L248-L251
[^2]: https://github.com/openssl/openssl/blob/9a2f78e14a67eeaadefc77d05f0778fc9684d26c/crypto/pkcs7/pk7_mime.c#L41-L43
[^3]: https://github.com/openssl/openssl/blob/9a2f78e14a67eeaadefc77d05f0778fc9684d26c/crypto/cms/cms_io.c#L93

Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>

show more ...

Fix OpenSSL conflicting merge for compilation issue with old digests

Add openssl_cipher_key_length function

This function works in exactly the same way as openssl_cipher_iv_length
but for a key length. This is especially useful to make sure that the
r

Add openssl_cipher_key_length function

This function works in exactly the same way as openssl_cipher_iv_length
but for a key length. This is especially useful to make sure that the
right key length is provided to openssl_encrypt and openssl_decrypt.

In addtion the change also updates implementation of
openssl_cipher_iv_length and adds a test for it.

show more ...

Declare ext/openssl constants in stubs (#9046)

Support the actual `#[\SensitiveParameter]` attribute in stubs (#8836)

Mark parameter in ext/openssl as sensitive

Fix openssl_csr_export() stub

Closes GH-8362.

Fixed bug #81502

Allow $tag to be null. This is the value that openssl_encrypt()
sets it to for non-AEAD ciphers, so we should also accept this
as an input to openssl_decrypt().

Fixed bug #81502

Allow $tag to be null. This is the value that openssl_encrypt()
sets it to for non-AEAD ciphers, so we should also accept this
as an input to openssl_decrypt().

Prior to PHP 8.1, null was accepted in weak mode due to the special
treatment of null arguments to internal functions.

show more ...

Add more specific array return type hints for various extensions - part 6 (#7474)

Switch default PKCS7/CMS cipher to AES-128-CBC

Switch default cipher for openssl_pkcs7_encrypt() and
openssl_cms_encrypt() from RC2-40 to AES-128-CBC.

The RC2-40 cipher is consi

Switch default PKCS7/CMS cipher to AES-128-CBC

Switch default cipher for openssl_pkcs7_encrypt() and
openssl_cms_encrypt() from RC2-40 to AES-128-CBC.

The RC2-40 cipher is considered insecure and is not loaded by
default in OpenSSL 3, which means that these functions will
always fail with default arguments.

As the used algorithm is embedded in the result (which makes this
different from the openssl_encrypt() case) changing the default
algorithm should be safe.

Closes GH-7357.

show more ...

Not serializable flag permeation

Fix some smaller formatting inconsistencies in stubs

openssl_pkcs7_read: input is data not filename

The argument should be an input string and not a filename.

Fix: https://github.com/php/doc-en/pull/559
Suggested-by: George Peter

openssl_pkcs7_read: input is data not filename

The argument should be an input string and not a filename.

Fix: https://github.com/php/doc-en/pull/559
Suggested-by: George Peter Banyard <girgias@php.net>

Closes GH-6942.

show more ...

Generate class entries from stubs for oci8, odbc, openssl, pcntl, pdo, pgsql

Closes GH-6691

Improve parameter names in ext/hash and ext/openssl

Closes GH-6156

Adjust ext/openssl parameter names

Closes GH-6121

Improve parameter handling in ext/openssl

Closes GH-6025

Require $method parameter in openssl_seal/openssl_open

RC4 is considered insecure, and it's not possible to change the
default of these functions. As such, require the method to be
p

Require $method parameter in openssl_seal/openssl_open

RC4 is considered insecure, and it's not possible to change the
default of these functions. As such, require the method to be
passed explicitly.

Closes GH-6093.

show more ...

Fix types in openssl stub

These two $recipcert parameters don't use proper union types
right now. They are a bit tricky due to the $recipkey -> $recipcert
fallback.