|
|
php.net | support | documentation | report a bug | advanced search | search howto | statistics | random bug | login |
[2013-07-25 03:39 UTC] yqbjtu at 163 dot com
Description:
------------
When I used stream_socket_client method to connect a server,which enabled the TLSv1.2, my php have 100% CPU usage, but can't connect to the server. I checked the stream_get_transports();,found that PHP only supports the tcp [1] => udp [2] => ssl [3] => sslv3 [4] => sslv2 [5] => tls.
I checked the source code, found that it does not support TLSv1.1 and TLSv1.2.
I found it is very simple to support TLSv1.2, if possible, I can do it.
----------------------------the following is the supported protocols:
C:\E\download\php-5.5.1-src\php-5.5.1-src\ext\openssl\openssl.c (5 hits)
Line 1157: php_stream_xport_register("ssl", php_openssl_ssl_socket_factory TSRMLS_CC);
Line 1158: php_stream_xport_register("sslv3", php_openssl_ssl_socket_factory TSRMLS_CC);
Line 1160: php_stream_xport_register("sslv2", php_openssl_ssl_socket_factory TSRMLS_CC);
Line 1162: php_stream_xport_register("tls", php_openssl_ssl_socket_factory TSRMLS_CC);
Line 1165: php_stream_xport_register("tcp", php_openssl_ssl_socket_factory TSRMLS_CC);
you can see
in php_stream *php_openssl_ssl_socket_factory method (src\ext\openssl\xp_ssl.c)
if (strncmp(proto, "ssl", protolen) == 0) {
sslsock->enable_on_connect = 1;
sslsock->method = STREAM_CRYPTO_METHOD_SSLv23_CLIENT;
} else if (strncmp(proto, "sslv2", protolen) == 0) {
#ifdef OPENSSL_NO_SSL2
php_error_docref(NULL TSRMLS_CC, E_WARNING, "SSLv2 support is not compiled into the OpenSSL library PHP is linked against");
return NULL;
#else
sslsock->enable_on_connect = 1;
sslsock->method = STREAM_CRYPTO_METHOD_SSLv2_CLIENT;
#endif
} else if (strncmp(proto, "sslv3", protolen) == 0) {
sslsock->enable_on_connect = 1;
sslsock->method = STREAM_CRYPTO_METHOD_SSLv3_CLIENT;
} else if (strncmp(proto, "tls", protolen) == 0) {
sslsock->enable_on_connect = 1;
sslsock->method = STREAM_CRYPTO_METHOD_TLS_CLIENT;
}
STREAM_CRYPTO_METHOD_TLS_CLIENT definition is as following.
case STREAM_CRYPTO_METHOD_TLS_CLIENT:
sslsock->is_client = 1;
method = TLSv1_client_method();
break;
========================================
There are some methods in openssl openssl\ssl.h
TLSv1_1_client_method(void); /* TLSv1.1 */
TLSv1_2_client_method(void); /* TLSv1.2 */
Expected result:
----------------
PHP does support TLSv1.1 and TLSv1.2
Actual result:
--------------
PHP does not support TLSv1.1 and TLSv1.2
PatchesPull RequestsHistoryAllCommentsChangesGit/SVN commits
|
|||||||||||||||||||||||||||||||||||||
Copyright © 2001-2024 The PHP GroupAll rights reserved. |
Last updated: Thu Nov 21 18:01:29 2024 UTC |
This simple patch would do it: if OpenSSL supports TLSv1.2 it defines SSL_TXT_TLSV1_2. Just detect that and use TLSv1.2 instead of TLSv1.0 if possible: --- php-5.5.6/ext/openssl/xp_ssl.c.orig +++ php-5.5.6/ext/openssl/xp_ssl.c @@ -345,5 +345,9 @@ case STREAM_CRYPTO_METHOD_TLS_CLIENT: sslsock->is_client = 1; +#ifdef SSL_TXT_TLSV1_2 + method = TLSv1_2_client_method(); +#else method = TLSv1_client_method(); +#endif break; case STREAM_CRYPTO_METHOD_SSLv23_SERVER: @@ -366,5 +370,9 @@ case STREAM_CRYPTO_METHOD_TLS_SERVER: sslsock->is_client = 0; +#ifdef SSL_TXT_TLSV1_2 + method = TLSv1_2_server_method(); +#else method = TLSv1_server_method(); +#endif break; default:It is true that PHP can use TLSv1.1 and TLSv1.2 but *only* if the opposite party utilizes the broadly compatible SSLv23 "hello" method. This is a standard practice for clients and servers who desire widespread compatibility. As of PHP 5.6 it is possible to negotiate TLS protocols using either the specific TLSv1.1 and TLSv1.2 methods or the broadly compatible SSLv23 method. Fine-grained protocol specification is available by passing the "crypto_method" bitmask as part of the SSL stream context. Alternatively, the following new stream wrappers are added in 5.6 to utilize the protocol specific methods: - tlsv1.0:// - tlsv1.1:// - tlsv1.2:// The more frequent TLS limitation comes from the underlying OpenSSL libs used to build PHP's openssl extension. OpenSSL1.0.1 is required for TLS1.1 and TLS1.2 support. If your PHP was not built against this newer lib you won't have access to TLSv1.1 and TLSv1.2 regardless. You can verify the version against which your extension is built: print_r(OPENSSL_VERSION_TEXT); You can read more about the TLS improvements arriving in PHP 5.6 here: - https://wiki.php.net/rfc/tls-peer-verification - https://wiki.php.net/rfc/improved-tls-defaults