1 /*
2 +----------------------------------------------------------------------+
3 | Copyright (c) The PHP Group |
4 +----------------------------------------------------------------------+
5 | This source file is subject to version 3.01 of the PHP license, |
6 | that is bundled with this package in the file LICENSE, and is |
7 | available through the world-wide-web at the following url: |
8 | https://www.php.net/license/3_01.txt |
9 | If you did not receive a copy of the PHP license and are unable to |
10 | obtain it through the world-wide-web, please send a note to |
11 | license@php.net so we can mail you a copy immediately. |
12 +----------------------------------------------------------------------+
13 | Authors: Stig Venaas <venaas@php.net> |
14 | Wez Furlong <wez@thebrainroom.com |
15 +----------------------------------------------------------------------+
16 */
17
18 #ifndef PHP_OPENSSL_H
19 #define PHP_OPENSSL_H
20 /* HAVE_OPENSSL would include SSL MySQL stuff */
21 #ifdef HAVE_OPENSSL_EXT
22 extern zend_module_entry openssl_module_entry;
23 #define phpext_openssl_ptr &openssl_module_entry
24
25 #include "php_version.h"
26 #define PHP_OPENSSL_VERSION PHP_VERSION
27
28 #include <openssl/opensslv.h>
29 #if defined(LIBRESSL_VERSION_NUMBER)
30 /* LibreSSL version check */
31 #if LIBRESSL_VERSION_NUMBER < 0x20700000L
32 #define PHP_OPENSSL_API_VERSION 0x10001
33 #else
34 #define PHP_OPENSSL_API_VERSION 0x10100
35 #endif
36 #else
37 /* OpenSSL version check */
38 #if OPENSSL_VERSION_NUMBER < 0x10100000L
39 #define PHP_OPENSSL_API_VERSION 0x10002
40 #elif OPENSSL_VERSION_NUMBER < 0x30000000L
41 #define PHP_OPENSSL_API_VERSION 0x10100
42 #else
43 #define PHP_OPENSSL_API_VERSION 0x30000
44 #endif
45 #endif
46
47 #define OPENSSL_RAW_DATA 1
48 #define OPENSSL_ZERO_PADDING 2
49 #define OPENSSL_DONT_ZERO_PAD_KEY 4
50
51 #define OPENSSL_ERROR_X509_PRIVATE_KEY_VALUES_MISMATCH 0x0B080074
52
53 /* Used for client-initiated handshake renegotiation DoS protection*/
54 #define OPENSSL_DEFAULT_RENEG_LIMIT 2
55 #define OPENSSL_DEFAULT_RENEG_WINDOW 300
56 #define OPENSSL_DEFAULT_STREAM_VERIFY_DEPTH 9
57 #define OPENSSL_DEFAULT_STREAM_CIPHERS "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:" \
58 "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:" \
59 "DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:" \
60 "ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:" \
61 "ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:" \
62 "DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:" \
63 "AES256-GCM-SHA384:AES128:AES256:HIGH:!SSLv2:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!RC4:!ADH"
64
65 #include <openssl/err.h>
66
67 #ifdef PHP_WIN32
68 # define PHP_OPENSSL_API __declspec(dllexport)
69 #elif defined(__GNUC__) && __GNUC__ >= 4
70 # define PHP_OPENSSL_API __attribute__((visibility("default")))
71 #else
72 # define PHP_OPENSSL_API
73 #endif
74
75 struct php_openssl_errors {
76 int buffer[ERR_NUM_ERRORS];
77 int top;
78 int bottom;
79 };
80
81 ZEND_BEGIN_MODULE_GLOBALS(openssl)
82 struct php_openssl_errors *errors;
83 ZEND_END_MODULE_GLOBALS(openssl)
84
85 #define OPENSSL_G(v) ZEND_MODULE_GLOBALS_ACCESSOR(openssl, v)
86
87 #if defined(ZTS) && defined(COMPILE_DL_OPENSSL)
88 ZEND_TSRMLS_CACHE_EXTERN();
89 #endif
90
91 php_stream_transport_factory_func php_openssl_ssl_socket_factory;
92
93 void php_openssl_store_errors(void);
94
95 /* openssl file path extra */
96 bool php_openssl_check_path_ex(
97 const char *file_path, size_t file_path_len, char *real_path, uint32_t arg_num,
98 bool contains_file_protocol, bool is_from_array, const char *option_name);
99
100 /* openssl file path check */
php_openssl_check_path(const char * file_path,size_t file_path_len,char * real_path,uint32_t arg_num)101 static inline bool php_openssl_check_path(
102 const char *file_path, size_t file_path_len, char *real_path, uint32_t arg_num)
103 {
104 return php_openssl_check_path_ex(
105 file_path, file_path_len, real_path, arg_num, false, false, NULL);
106 }
107
108 /* openssl file path extra check with zend string */
php_openssl_check_path_str_ex(zend_string * file_path,char * real_path,uint32_t arg_num,bool contains_file_protocol,bool is_from_array,const char * option_name)109 static inline bool php_openssl_check_path_str_ex(
110 zend_string *file_path, char *real_path, uint32_t arg_num,
111 bool contains_file_protocol, bool is_from_array, const char *option_name)
112 {
113 return php_openssl_check_path_ex(
114 ZSTR_VAL(file_path), ZSTR_LEN(file_path), real_path, arg_num, contains_file_protocol,
115 is_from_array, option_name);
116 }
117
118 /* openssl file path check with zend string */
php_openssl_check_path_str(zend_string * file_path,char * real_path,uint32_t arg_num)119 static inline bool php_openssl_check_path_str(
120 zend_string *file_path, char *real_path, uint32_t arg_num)
121 {
122 return php_openssl_check_path_str_ex(file_path, real_path, arg_num, true, false, NULL);
123 }
124
125 PHP_OPENSSL_API zend_long php_openssl_cipher_iv_length(const char *method);
126 PHP_OPENSSL_API zend_long php_openssl_cipher_key_length(const char *method);
127 PHP_OPENSSL_API zend_string* php_openssl_random_pseudo_bytes(zend_long length);
128 PHP_OPENSSL_API zend_string* php_openssl_encrypt(
129 const char *data, size_t data_len,
130 const char *method, size_t method_len,
131 const char *password, size_t password_len,
132 zend_long options,
133 const char *iv, size_t iv_len,
134 zval *tag, zend_long tag_len,
135 const char *aad, size_t aad_len);
136 PHP_OPENSSL_API zend_string* php_openssl_decrypt(
137 const char *data, size_t data_len,
138 const char *method, size_t method_len,
139 const char *password, size_t password_len,
140 zend_long options,
141 const char *iv, size_t iv_len,
142 const char *tag, zend_long tag_len,
143 const char *aad, size_t aad_len);
144
145 /* OpenSSLCertificate class */
146
147 typedef struct _php_openssl_certificate_object {
148 X509 *x509;
149 zend_object std;
150 } php_openssl_certificate_object;
151
152 extern zend_class_entry *php_openssl_certificate_ce;
153
php_openssl_certificate_from_obj(zend_object * obj)154 static inline php_openssl_certificate_object *php_openssl_certificate_from_obj(zend_object *obj) {
155 return (php_openssl_certificate_object *)((char *)(obj) - XtOffsetOf(php_openssl_certificate_object, std));
156 }
157
158 #define Z_OPENSSL_CERTIFICATE_P(zv) php_openssl_certificate_from_obj(Z_OBJ_P(zv))
159
160 PHP_MINIT_FUNCTION(openssl);
161 PHP_MSHUTDOWN_FUNCTION(openssl);
162 PHP_MINFO_FUNCTION(openssl);
163 PHP_GINIT_FUNCTION(openssl);
164 PHP_GSHUTDOWN_FUNCTION(openssl);
165
166 #ifdef PHP_WIN32
167 #define PHP_OPENSSL_BIO_MODE_R(flags) (((flags) & PKCS7_BINARY) ? "rb" : "r")
168 #define PHP_OPENSSL_BIO_MODE_W(flags) (((flags) & PKCS7_BINARY) ? "wb" : "w")
169 #else
170 #define PHP_OPENSSL_BIO_MODE_R(flags) "r"
171 #define PHP_OPENSSL_BIO_MODE_W(flags) "w"
172 #endif
173
174 #else
175
176 #define phpext_openssl_ptr NULL
177
178 #endif
179
180
181 #endif
182
