Skip to content

Commit 3de3e13

Browse files
Ayeshbukka
Ayesh
authored and
bukka
committed
ext/openssl: Bump minimum required OpenSSL version to 1.1.1
Bumps the minimum required OpenSSL version from 1.0.2 to 1.1.1. OpenSSL 1.1.1 is an LTS release, but has reached[^1] EOL from upstream. However, Linux distro/OS vendors continue to ship OpenSSL 1.1.1, so 1.1.1 was picked as the minimum. The current minimum 1.0.2 reached EOL in 2018. Bumping the minimum required OpenSSL version makes it possible for ext-openssl to remove a bunch of conditional code, and assume that TLS 1.3 (shipped with OpenSSL 1.1.1) will be supported everywhere. - Debian buster: 1.1.1[^2] - Ubuntu 20.04: 1.1.1[^3] - CentOS/RHEL 7: 1.0.2 - RHEL 8/Rocky 8/EL 8: 1.1.1 - Fedora 38: 3.0.9 (`openssl11` provides OpenSSL 1.1 as well) RHEL/CentOS 7 reaches EOL mid 2024, so for PHP 8.4 scheduled towards the end of this year, we can safely bump the minimum OpenSSL version. [^1]: https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/index.html [^2]: https://packages.debian.org/buster/libssl-dev [^3]: https://packages.ubuntu.com/focal/libssl-dev
1 parent 0c07b0d commit 3de3e13

20 files changed

+19
-53
lines changed

‎NEWS

+1
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ PHP NEWS
112112
Florian Sowade)
113113
. Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
114114
(Vincent Jardin)
115+
. Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)
115116

116117
- Output:
117118
. Clear output handler status flags during handler initialization. (haszi)

‎UPGRADING

+3
Original file line numberDiff line numberDiff line change
@@ -498,6 +498,9 @@ PHP 8.4 UPGRADE NOTES
498498
- Intl:
499499
. The class constants are typed now.
500500

501+
- Intl:
502+
. The OpenSSL extension now requires at least OpenSSL 1.1.1.
503+
501504
- PDO:
502505
. The class constants are typed now.
503506

‎build/php.m4

+1-1
Original file line numberDiff line numberDiff line change
@@ -1828,7 +1828,7 @@ dnl
18281828
AC_DEFUN([PHP_SETUP_OPENSSL],[
18291829
found_openssl=no
18301830
1831-
PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
1831+
PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])
18321832
18331833
if test "$found_openssl" = "yes"; then
18341834
PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)

‎ext/ftp/ftp.c

-2
Original file line numberDiff line numberDiff line change
@@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
293293
return 0;
294294
}
295295

296-
#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
297296
ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
298-
#endif
299297
SSL_CTX_set_options(ctx, ssl_ctx_options);
300298

301299
/* Allow SSL to re-use sessions.

‎ext/ftp/php_ftp.c

+1-3
Original file line numberDiff line numberDiff line change
@@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {
9999

100100
PHP_MINIT_FUNCTION(ftp)
101101
{
102-
#ifdef HAVE_FTP_SSL
103-
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
102+
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
104103
SSL_library_init();
105104
OpenSSL_add_all_ciphers();
106105
OpenSSL_add_all_digests();
107106
OpenSSL_add_all_algorithms();
108107

109108
SSL_load_error_strings();
110-
#endif
111109
#endif
112110

113111
php_ftp_ce = register_class_FTP_Connection();

‎ext/openssl/config0.m4

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PHP_ARG_WITH([openssl],
22
[for OpenSSL support],
33
[AS_HELP_STRING([--with-openssl],
4-
[Include OpenSSL support (requires OpenSSL >= 1.0.2)])])
4+
[Include OpenSSL support (requires OpenSSL >= 1.1.1)])])
55

66
PHP_ARG_WITH([kerberos],
77
[for Kerberos support],

‎ext/openssl/openssl.c

+5-9
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161
#include <openssl/param_build.h>
6262
#endif
6363

64-
#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
64+
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
6565
#include <openssl/engine.h>
6666
#endif
6767

@@ -99,7 +99,7 @@
9999
#define HAVE_EVP_PKEY_EC 1
100100

101101
/* the OPENSSL_EC_EXPLICIT_CURVE value was added
102-
* in OpenSSL 1.1.0; previous versions should
102+
* in OpenSSL 1.1.0; previous versions should
103103
* use 0 instead.
104104
*/
105105
#ifndef OPENSSL_EC_EXPLICIT_CURVE
@@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
12691269
php_openssl_pkey_object_handlers.clone_obj = NULL;
12701270
php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;
12711271

1272-
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
1272+
#ifdef LIBRESSL_VERSION_NUMBER
12731273
OPENSSL_config(NULL);
12741274
SSL_library_init();
12751275
OpenSSL_add_all_ciphers();
@@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
13091309
php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
13101310
php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
13111311
php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
1312-
#if OPENSSL_VERSION_NUMBER >= 0x10101000
13131312
php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
1314-
#endif
13151313

13161314
/* override the default tcp socket provider */
13171315
php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
@@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
13641362
/* {{{ PHP_MSHUTDOWN_FUNCTION */
13651363
PHP_MSHUTDOWN_FUNCTION(openssl)
13661364
{
1367-
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
1365+
#ifdef LIBRESSL_VERSION_NUMBER
13681366
EVP_cleanup();
13691367

13701368
/* prevent accessing locking callback from unloaded extension */
@@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
13911389
php_stream_xport_unregister("tlsv1.0");
13921390
php_stream_xport_unregister("tlsv1.1");
13931391
php_stream_xport_unregister("tlsv1.2");
1394-
#if OPENSSL_VERSION_NUMBER >= 0x10101000
13951392
php_stream_xport_unregister("tlsv1.3");
1396-
#endif
13971393

13981394
/* reinstate the default tcp handler */
13991395
php_stream_xport_register("tcp", php_stream_generic_socket_factory);
@@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
46094605
EVP_PKEY_CTX_free(ctx);
46104606
ctx = EVP_PKEY_CTX_new(param_key, NULL);
46114607
}
4612-
4608+
46134609
if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
46144610
*is_private = d != NULL;
46154611
EVP_PKEY_up_ref(param_key);

‎ext/openssl/php_openssl.h

+2-4
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
2626
#define PHP_OPENSSL_VERSION PHP_VERSION
2727

2828
#include <openssl/opensslv.h>
29-
#if defined(LIBRESSL_VERSION_NUMBER)
29+
#ifdef LIBRESSL_VERSION_NUMBER
3030
/* LibreSSL version check */
3131
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
3232
#define PHP_OPENSSL_API_VERSION 0x10001
@@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
3535
#endif
3636
#else
3737
/* OpenSSL version check */
38-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
39-
#define PHP_OPENSSL_API_VERSION 0x10002
40-
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
38+
#if OPENSSL_VERSION_NUMBER < 0x30000000L
4139
#define PHP_OPENSSL_API_VERSION 0x10100
4240
#else
4341
#define PHP_OPENSSL_API_VERSION 0x30000

‎ext/openssl/tests/bug80747.phpt

-4
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,6 @@
22
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
33
--EXTENSIONS--
44
openssl
5-
--SKIPIF--
6-
<?php
7-
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
8-
?>
95
--FILE--
106
<?php
117

‎ext/openssl/tests/openssl_error_string_basic.phpt

+1-2
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
9595
var_dump($error_queue_size);
9696
echo "\n";
9797

98-
$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
99-
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
98+
$err_pem_no_start_line = '0909006C';
10099

101100
// PKEY
102101
echo "PKEY errors\n";

‎ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt

-3
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,6 @@ int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose [, array $cainfo
44
marcosptf - <[email protected]>
55
--EXTENSIONS--
66
openssl
7-
--SKIPIF--
8-
<?php if (OPENSSL_VERSION_NUMBER < 0x10000000) die("skip Output requires OpenSSL 1.0");
9-
?>
107
--FILE--
118
<?php
129
include 'CertificateGenerator.inc';

‎ext/openssl/tests/session_meta_capture_tlsv13.phpt

-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ openssl
55
--SKIPIF--
66
<?php
77
if (!function_exists("proc_open")) die("skip no proc_open");
8-
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
98
?>
109
--FILE--
1110
<?php

‎ext/openssl/tests/stream_crypto_flags_003.phpt

-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ openssl
55
--SKIPIF--
66
<?php
77
if (!function_exists("proc_open")) die("skip no proc_open");
8-
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
98
?>
109
--FILE--
1110
<?php

‎ext/openssl/tests/stream_security_level.phpt

-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ security_level setting to prohibit cert
44
openssl
55
--SKIPIF--
66
<?php
7-
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
87
if (!function_exists("proc_open")) die("skip no proc_open");
98
?>
109
--FILE--

‎ext/openssl/tests/tls_wrapper.phpt

-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ openssl
55
--SKIPIF--
66
<?php
77
if (!function_exists("proc_open")) die("skip no proc_open");
8-
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
98
?>
109
--FILE--
1110
<?php

‎ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt

-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ openssl
55
--SKIPIF--
66
<?php
77
if (!function_exists("proc_open")) die("skip no proc_open");
8-
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
98
?>
109
--FILE--
1110
<?php

‎ext/openssl/tests/tlsv1.3_wrapper.phpt

-1
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ openssl
55
--SKIPIF--
66
<?php
77
if (!function_exists("proc_open")) die("skip no proc_open");
8-
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
98
?>
109
--FILE--
1110
<?php

‎ext/openssl/xp_ssl.c

+2-6
Original file line numberDiff line numberDiff line change
@@ -76,7 +76,7 @@
7676
#define HAVE_TLS12 1
7777
#endif
7878

79-
#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(OPENSSL_NO_TLS1_3)
79+
#ifndef OPENSSL_NO_TLS1_3
8080
#define HAVE_TLS13 1
8181
#endif
8282

@@ -89,7 +89,7 @@
8989
#define HAVE_TLS_ALPN 1
9090
#endif
9191

92-
#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
92+
#ifndef LIBRESSL_VERSION_NUMBER
9393
#define HAVE_SEC_LEVEL 1
9494
#endif
9595

@@ -676,11 +676,7 @@ static int php_openssl_win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx,
676676
{
677677
PCCERT_CONTEXT cert_ctx = NULL;
678678
PCCERT_CHAIN_CONTEXT cert_chain_ctx = NULL;
679-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
680-
X509 *cert = x509_store_ctx->cert;
681-
#else
682679
X509 *cert = X509_STORE_CTX_get0_cert(x509_store_ctx);
683-
#endif
684680

685681
php_stream *stream;
686682
php_openssl_netstream_data_t *sslsock;

‎php.ini-development

+1-6
Original file line numberDiff line numberDiff line change
@@ -928,12 +928,6 @@ default_socket_timeout = 60
928928
; Be sure to appropriately set the extension_dir directive.
929929
;
930930
;extension=bz2
931-
932-
; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
933-
; otherwise it results in segfault when unloading after using SASL.
934-
; See https://github.com/php/php-src/issues/8620 for more info.
935-
;extension=ldap
936-
937931
;extension=curl
938932
;extension=ffi
939933
;extension=ftp
@@ -942,6 +936,7 @@ default_socket_timeout = 60
942936
;extension=gettext
943937
;extension=gmp
944938
;extension=intl
939+
;extension=ldap
945940
;extension=mbstring
946941
;extension=exif ; Must be after mbstring as it depends on it
947942
;extension=mysqli

‎php.ini-production

+1-6
Original file line numberDiff line numberDiff line change
@@ -930,12 +930,6 @@ default_socket_timeout = 60
930930
; Be sure to appropriately set the extension_dir directive.
931931
;
932932
;extension=bz2
933-
934-
; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
935-
; otherwise it results in segfault when unloading after using SASL.
936-
; See https://github.com/php/php-src/issues/8620 for more info.
937-
;extension=ldap
938-
939933
;extension=curl
940934
;extension=ffi
941935
;extension=ftp
@@ -944,6 +938,7 @@ default_socket_timeout = 60
944938
;extension=gettext
945939
;extension=gmp
946940
;extension=intl
941+
;extension=ldap
947942
;extension=mbstring
948943
;extension=exif ; Must be after mbstring as it depends on it
949944
;extension=mysqli

0 commit comments

Comments
 (0)