1--TEST-- 2TLS server rate-limits client-initiated renegotiation 3--SKIPIF-- 4<?php 5if (!extension_loaded("openssl")) die("skip openssl not loaded"); 6if (!function_exists("proc_open")) die("skip no proc_open"); 7exec('openssl help', $out, $code); 8if ($code > 0) die("skip couldn't locate openssl binary"); 9if(substr(PHP_OS, 0, 3) == 'WIN') { 10 die('skip not suitable for Windows'); 11} 12?> 13--FILE-- 14<?php 15 16/** 17 * This test uses the openssl binary directly to initiate renegotiation. At this time it's not 18 * possible renegotiate the TLS handshake in PHP userland, so using the openssl s_client binary 19 * command is the only feasible way to test renegotiation limiting functionality. It's not an ideal 20 * solution, but it's really the only way to get test coverage on the rate-limiting functionality 21 * given current limitations. 22 */ 23 24$serverCode = <<<'CODE' 25 $printed = false; 26 $serverUri = "ssl://127.0.0.1:64321"; 27 $serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN; 28 $serverCtx = stream_context_create(['ssl' => [ 29 'local_cert' => __DIR__ . '/bug54992.pem', 30 'reneg_limit' => 0, 31 'reneg_window' => 30, 32 'reneg_limit_callback' => function($stream) use (&$printed) { 33 if (!$printed) { 34 $printed = true; 35 var_dump($stream); 36 } 37 } 38 ]]); 39 40 $server = stream_socket_server($serverUri, $errno, $errstr, $serverFlags, $serverCtx); 41 phpt_notify(); 42 43 $clients = []; 44 while (1) { 45 $r = array_merge([$server], $clients); 46 $w = $e = []; 47 48 stream_select($r, $w, $e, $timeout=42); 49 50 foreach ($r as $sock) { 51 if ($sock === $server && ($client = stream_socket_accept($server, $timeout = 42))) { 52 $clientId = (int) $client; 53 $clients[$clientId] = $client; 54 } elseif ($sock !== $server) { 55 $clientId = (int) $sock; 56 $buffer = fread($sock, 1024); 57 if (strlen($buffer)) { 58 continue; 59 } elseif (!is_resource($sock) || feof($sock)) { 60 unset($clients[$clientId]); 61 break 2; 62 } 63 } 64 } 65 } 66CODE; 67 68$clientCode = <<<'CODE' 69 $cmd = 'openssl s_client -connect 127.0.0.1:64321'; 70 $descriptorSpec = [["pipe", "r"], ["pipe", "w"], ["pipe", "w"]]; 71 $process = proc_open($cmd, $descriptorSpec, $pipes); 72 73 list($stdin, $stdout, $stderr) = $pipes; 74 75 // Trigger renegotiation twice 76 // Server settings only allow one per second (should result in disconnection) 77 fwrite($stdin, "R\nR\nR\nR\n"); 78 79 $lines = []; 80 while(!feof($stderr)) { 81 fgets($stderr); 82 } 83 84 fclose($stdin); 85 fclose($stdout); 86 fclose($stderr); 87 proc_terminate($process); 88CODE; 89 90include 'ServerClientTestCase.inc'; 91ServerClientTestCase::getInstance()->run($serverCode, $clientCode); 92?> 93--EXPECTF-- 94resource(%d) of type (stream) 95