Skip to content

Commit e933da9

Browse files
bukkabukka
committed
Merge branch 'PHP-7.0'
2 parents 7d2c782 + a2f4c32 commit e933da9

File tree

3 files changed

+166
-99
lines changed

3 files changed

+166
-99
lines changed

‎ext/openssl/openssl.c

+68-10
Original file line numberDiff line numberDiff line change
@@ -1006,6 +1006,22 @@ static void php_openssl_dispose_config(struct php_x509_request * req) /* {{{ */
10061006
}
10071007
/* }}} */
10081008

1009+
#ifdef PHP_WIN32
1010+
#define PHP_OPENSSL_RAND_ADD_TIME() ((void) 0)
1011+
#else
1012+
#define PHP_OPENSSL_RAND_ADD_TIME() php_openssl_rand_add_timeval()
1013+
1014+
static inline void php_openssl_rand_add_timeval() /* {{{ */
1015+
{
1016+
struct timeval tv;
1017+
1018+
gettimeofday(&tv, NULL);
1019+
RAND_add(&tv, sizeof(tv), 0.0);
1020+
}
1021+
/* }}} */
1022+
1023+
#endif
1024+
10091025
static int php_openssl_load_rand_file(const char * file, int *egdsocket, int *seeded) /* {{{ */
10101026
{
10111027
char buffer[MAXPATHLEN];
@@ -1048,6 +1064,7 @@ static int php_openssl_write_rand_file(const char * file, int egdsocket, int see
10481064
if (file == NULL) {
10491065
file = RAND_file_name(buffer, sizeof(buffer));
10501066
}
1067+
PHP_OPENSSL_RAND_ADD_TIME();
10511068
if (file == NULL || !RAND_write_file(file)) {
10521069
php_error_docref(NULL, E_WARNING, "unable to write random state");
10531070
return FAILURE;
@@ -3414,6 +3431,7 @@ static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req
34143431
RSA* rsaparam;
34153432
#if OPENSSL_VERSION_NUMBER < 0x10002000L
34163433
/* OpenSSL 1.0.2 deprecates RSA_generate_key */
3434+
PHP_OPENSSL_RAND_ADD_TIME();
34173435
rsaparam = (RSA*)RSA_generate_key(req->priv_key_bits, RSA_F4, NULL, NULL);
34183436
#else
34193437
{
@@ -3424,6 +3442,7 @@ static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req
34243442
return NULL;
34253443
}
34263444
rsaparam = RSA_new();
3445+
PHP_OPENSSL_RAND_ADD_TIME();
34273446
RSA_generate_key_ex(rsaparam, req->priv_key_bits, bne, NULL);
34283447
BN_free(bne);
34293448
}
@@ -3435,6 +3454,7 @@ static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req
34353454
break;
34363455
#if !defined(NO_DSA)
34373456
case OPENSSL_KEYTYPE_DSA:
3457+
PHP_OPENSSL_RAND_ADD_TIME();
34383458
{
34393459
DSA *dsaparam = NULL;
34403460
#if OPENSSL_VERSION_NUMBER < 0x10002000L
@@ -3457,6 +3477,7 @@ static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req
34573477
#endif
34583478
#if !defined(NO_DH)
34593479
case OPENSSL_KEYTYPE_DH:
3480+
PHP_OPENSSL_RAND_ADD_TIME();
34603481
{
34613482
int codes = 0;
34623483
DH *dhparam = NULL;
@@ -3570,6 +3591,46 @@ static int php_openssl_is_private_key(EVP_PKEY* pkey)
35703591
} \
35713592
} while (0);
35723593

3594+
/* {{{ php_openssl_pkey_init_dsa */
3595+
zend_bool php_openssl_pkey_init_dsa(DSA *dsa)
3596+
{
3597+
if (!dsa->p || !dsa->q || !dsa->g) {
3598+
return 0;
3599+
}
3600+
if (dsa->priv_key || dsa->pub_key) {
3601+
return 1;
3602+
}
3603+
PHP_OPENSSL_RAND_ADD_TIME();
3604+
if (!DSA_generate_key(dsa)) {
3605+
return 0;
3606+
}
3607+
/* if BN_mod_exp return -1, then DSA_generate_key succeed for failed key
3608+
* so we need to double check that public key is created */
3609+
if (!dsa->pub_key || BN_is_zero(dsa->pub_key)) {
3610+
return 0;
3611+
}
3612+
/* all good */
3613+
return 1;
3614+
}
3615+
/* }}} */
3616+
3617+
/* {{{ php_openssl_pkey_init_dh */
3618+
zend_bool php_openssl_pkey_init_dh(DH *dh)
3619+
{
3620+
if (!dh->p || !dh->g) {
3621+
return 0;
3622+
}
3623+
if (dh->pub_key) {
3624+
return 1;
3625+
}
3626+
PHP_OPENSSL_RAND_ADD_TIME();
3627+
if (!DH_generate_key(dh)) {
3628+
return 0;
3629+
}
3630+
/* all good */
3631+
return 1;
3632+
}
3633+
/* }}} */
35733634

35743635
/* {{{ proto resource openssl_pkey_new([array configargs])
35753636
Generates a new private key */
@@ -3622,10 +3683,7 @@ PHP_FUNCTION(openssl_pkey_new)
36223683
OPENSSL_PKEY_SET_BN(Z_ARRVAL_P(data), dsa, g);
36233684
OPENSSL_PKEY_SET_BN(Z_ARRVAL_P(data), dsa, priv_key);
36243685
OPENSSL_PKEY_SET_BN(Z_ARRVAL_P(data), dsa, pub_key);
3625-
if (dsa->p && dsa->q && dsa->g) {
3626-
if (!dsa->priv_key && !dsa->pub_key) {
3627-
DSA_generate_key(dsa);
3628-
}
3686+
if (php_openssl_pkey_init_dsa(dsa)) {
36293687
if (EVP_PKEY_assign_DSA(pkey, dsa)) {
36303688
RETURN_RES(zend_register_resource(pkey, le_key));
36313689
}
@@ -3645,11 +3703,11 @@ PHP_FUNCTION(openssl_pkey_new)
36453703
OPENSSL_PKEY_SET_BN(Z_ARRVAL_P(data), dh, g);
36463704
OPENSSL_PKEY_SET_BN(Z_ARRVAL_P(data), dh, priv_key);
36473705
OPENSSL_PKEY_SET_BN(Z_ARRVAL_P(data), dh, pub_key);
3648-
if (dh->p && dh->g &&
3649-
(dh->pub_key || DH_generate_key(dh)) &&
3650-
EVP_PKEY_assign_DH(pkey, dh)) {
3651-
ZVAL_COPY_VALUE(return_value, zend_list_insert(pkey, le_key));
3652-
return;
3706+
if (php_openssl_pkey_init_dh(dh)) {
3707+
if (EVP_PKEY_assign_DH(pkey, dh)) {
3708+
ZVAL_COPY_VALUE(return_value, zend_list_insert(pkey, le_key));
3709+
return;
3710+
}
36533711
}
36543712
DH_free(dh);
36553713
}
@@ -5511,7 +5569,7 @@ PHP_FUNCTION(openssl_random_pseudo_bytes)
55115569
#else
55125570

55135571
PHP_OPENSSL_CHECK_LONG_TO_INT(buffer_length, length);
5514-
5572+
PHP_OPENSSL_RAND_ADD_TIME();
55155573
if (RAND_bytes((unsigned char*)ZSTR_VAL(buffer), (int)buffer_length) <= 0) {
55165574
zend_string_release(buffer);
55175575
if (zstrong_result_returned) {

‎ext/openssl/tests/bug72336.phpt

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
--TEST--
2+
Bug #72336 (openssl_pkey_new does not fail for invalid DSA params)
3+
--SKIPIF--
4+
<?php if (!extension_loaded("openssl")) print "skip"; ?>
5+
--FILE--
6+
<?php
7+
$p = '00f8000ae45b2dacb47dd977d58b719d097bdf07cb2c17660ad898518c08' .
8+
'1a61659a16daadfaa406a0a994c743df5eda07e36bd0adcad921b77432ff' .
9+
'24ccc31e782d647e66768122b578857e9293df78387dc8b44af2a4a3f305' .
10+
'1f236b1000a3e31da489c6681b0031f7ec37c2e1091bdb698e7660f135b6' .
11+
'996def90090303b7ad';
12+
13+
$q = '009b3734fc9f7a4a9d6437ec314e0a78c2889af64b';
14+
15+
$g = '00b320300a0bc55b8f0ec6edc218e2185250f38fbb8291db8a89227f6e41' .
16+
'00d47d6ccb9c7d42fc43280ecc2ed386e81ff65bc5d6a2ae78db7372f5dc' .
17+
'f780f4558e7ed3dd0c96a1b40727ac56c5165aed700a3b63997893a1fb21' .
18+
'4e882221f0dd9604820dc34e2725dd6901c93e0ca56f6d76d495c332edc5' .
19+
'b81747c4c447a941f3';
20+
21+
var_dump(openssl_pkey_new(array('dsa' => array('p' => $p, 'q' => $q, 'g' => $g))));
22+
?>
23+
--EXPECT--
24+
bool(false)

‎ext/openssl/tests/openssl_error_string_basic.phpt

+74-89
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,37 @@
11
--TEST--
22
openssl_error_string() tests
33
--SKIPIF--
4-
<?php
5-
if (!extension_loaded("openssl")) print "skip";
6-
//if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
7-
?>
8-
--XFAIL--
9-
ot ready baked yet, fails different ways on different envs
4+
<?php if (!extension_loaded("openssl")) print "skip"; ?>
105
--FILE--
116
<?php
12-
// helper function to dump openssl errors
13-
function dump_openssl_errors() {
7+
// helper function to check openssl errors
8+
function expect_openssl_errors($name, $expected_error_codes) {
9+
$expected_errors = array_fill_keys($expected_error_codes, false);
10+
while (($error_string = openssl_error_string()) !== false) {
11+
if (strlen($error_string) > 14) {
12+
$error_code = substr($error_string, 6, 8);
13+
if (isset($expected_errors[$error_code])) {
14+
$expected_errors[$error_code] = true;
15+
}
16+
}
17+
}
18+
19+
$fail = false;
20+
foreach ($expected_errors as $error_code => $error_code_found) {
21+
if (!$error_code_found) {
22+
$fail = true;
23+
echo "$name: no error code $error_code\n";
24+
}
25+
}
26+
27+
if (!$fail) {
28+
echo "$name: ok\n";
29+
}
30+
}
31+
32+
// helper for debugging errors
33+
function dump_openssl_errors($name) {
34+
echo "\n$name\n";
1435
while (($error_string = openssl_error_string()) !== false) {
1536
var_dump($error_string);
1637
}
@@ -56,61 +77,59 @@ while (($enc_error_new = openssl_error_string()) !== false) {
5677
++$error_queue_size;
5778
}
5879
var_dump($error_queue_size);
80+
echo "\n";
5981

6082
// PKEY
6183
echo "PKEY errors\n";
6284
// file for pkey (file:///) fails when opennig (BIO_new_file)
63-
openssl_pkey_export_to_file("file://" . $invalid_file_for_read, $output_file);
64-
dump_openssl_errors();
85+
@openssl_pkey_export_to_file("file://" . $invalid_file_for_read, $output_file);
86+
expect_openssl_errors('openssl_pkey_export_to_file opening', ['02001002', '2006D080']);
6587
// file or private pkey is not correct PEM - failing PEM_read_bio_PrivateKey
66-
openssl_pkey_export_to_file($csr_file, $output_file);
67-
dump_openssl_errors();
88+
@openssl_pkey_export_to_file($csr_file, $output_file);
89+
expect_openssl_errors('openssl_pkey_export_to_file pem', ['0906D06C']);
6890
// file to export cannot be written
69-
openssl_pkey_export_to_file($private_key_file, $invalid_file_for_write);
70-
dump_openssl_errors();
91+
@openssl_pkey_export_to_file($private_key_file, $invalid_file_for_write);
92+
expect_openssl_errors('openssl_pkey_export_to_file write', ['2006D002', '09072007']);
7193
// succesful export
72-
openssl_pkey_export($private_key_file_with_pass, $out, 'wrong pwd');
73-
dump_openssl_errors();
94+
@openssl_pkey_export($private_key_file_with_pass, $out, 'wrong pwd');
95+
expect_openssl_errors('openssl_pkey_export', ['06065064', '0906A065']);
7496
// invalid x509 for getting public key
75-
openssl_pkey_get_public($private_key_file);
76-
dump_openssl_errors();
97+
@openssl_pkey_get_public($private_key_file);
98+
expect_openssl_errors('openssl_pkey_get_public', ['0906D06C']);
7799
// private encrypt with unknown padding
78-
openssl_private_encrypt("data", $crypted, $private_key_file, 1000);
79-
dump_openssl_errors();
100+
@openssl_private_encrypt("data", $crypted, $private_key_file, 1000);
101+
expect_openssl_errors('openssl_private_encrypt', ['04066076']);
80102
// private decrypt with failed padding check
81-
openssl_private_decrypt("data", $crypted, $private_key_file);
82-
dump_openssl_errors();
103+
@openssl_private_decrypt("data", $crypted, $private_key_file);
104+
expect_openssl_errors('openssl_private_decrypt', ['04065072']);
83105
// public encrypt and decrypt with failed padding check and padding
84-
openssl_public_encrypt("data", $crypted, $public_key_file, 1000);
85-
openssl_public_decrypt("data", $crypted, $public_key_file);
86-
dump_openssl_errors();
106+
@openssl_public_encrypt("data", $crypted, $public_key_file, 1000);
107+
@openssl_public_decrypt("data", $crypted, $public_key_file);
108+
expect_openssl_errors('openssl_private_(en|de)crypt padding', ['0906D06C', '04068076', '0407006A', '04067072']);
87109

88110
// X509
89111
echo "X509 errors\n";
90112
// file for x509 (file:///) fails when opennig (BIO_new_file)
91-
openssl_x509_export_to_file("file://" . $invalid_file_for_read, $output_file);
92-
dump_openssl_errors();
113+
@openssl_x509_export_to_file("file://" . $invalid_file_for_read, $output_file);
114+
expect_openssl_errors('openssl_x509_export_to_file open', ['02001002']);
93115
// file or str cert is not correct PEM - failing PEM_read_bio_X509 or PEM_ASN1_read_bio
94-
openssl_x509_export_to_file($csr_file, $output_file);
95-
dump_openssl_errors();
116+
@openssl_x509_export_to_file($csr_file, $output_file);
117+
expect_openssl_errors('openssl_x509_export_to_file pem', ['0906D06C']);
96118
// file to export cannot be written
97-
openssl_x509_export_to_file($crt_file, $invalid_file_for_write);
98-
dump_openssl_errors();
119+
@openssl_x509_export_to_file($crt_file, $invalid_file_for_write);
120+
expect_openssl_errors('openssl_x509_export_to_file write', ['2006D002']);
99121
// checking purpose fails because there is no such purpose 1000
100-
openssl_x509_checkpurpose($crt_file, 1000);
101-
dump_openssl_errors();
102-
// make sure that X509_STORE_add_lookup will not emmit any error (just PHP warning)
103-
openssl_x509_checkpurpose($crt_file, X509_PURPOSE_SSL_CLIENT, array( __DIR__ . "/cert.csr"));
104-
dump_openssl_errors();
122+
@openssl_x509_checkpurpose($crt_file, 1000);
123+
expect_openssl_errors('openssl_x509_checkpurpose purpose', ['0B086079']);
105124

106125
// CSR
107126
echo "CSR errors\n";
108127
// file for csr (file:///) fails when opennig (BIO_new_file)
109-
openssl_csr_get_subject("file://" . $invalid_file_for_read);
110-
dump_openssl_errors();
128+
@openssl_csr_get_subject("file://" . $invalid_file_for_read);
129+
expect_openssl_errors('openssl_csr_get_subject open', ['02001002', '2006D080', '20068079', '0906D06C']);
111130
// file or str csr is not correct PEM - failing PEM_read_bio_X509_REQ
112131
openssl_csr_get_subject($crt_file);
113-
dump_openssl_errors();
132+
@expect_openssl_errors('openssl_csr_get_subjec pem', ['0906D06C']);
114133

115134
// other possible cuases that are difficult to catch:
116135
// - ASN1_STRING_to_UTF8 fails in add_assoc_name_entry
@@ -124,59 +143,25 @@ if (is_file($output_file)) {
124143
unlink($output_file);
125144
}
126145
?>
127-
--EXPECTF--
146+
--EXPECT--
128147
string(89) "error:0607A082:digital envelope routines:EVP_CIPHER_CTX_set_key_length:invalid key length"
129148
bool(false)
130149
int(15)
131-
PKEY errors
132-
133-
Warning: openssl_pkey_export_to_file(): cannot get key from parameter 1 in %s on line %d
134-
string(61) "error:02001002:system library:fopen:No such file or directory"
135-
string(53) "error:2006D080:BIO routines:BIO_new_file:no such file"
136150

137-
Warning: openssl_pkey_export_to_file(): cannot get key from parameter 1 in %s on line %d
138-
string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
139-
string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
140-
string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
141-
string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
142-
string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
143-
string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
144-
string(68) "error:0E06D06C:configuration file routines:NCONF_get_string:no value"
145-
string(50) "error:02001015:system library:fopen:Is a directory"
146-
string(51) "error:2006D002:BIO routines:BIO_new_file:system lib"
147-
string(49) "error:09072007:PEM routines:PEM_write_bio:BUF lib"
148-
149-
Warning: openssl_pkey_export(): cannot get key from parameter 1 in %s on line %d
150-
string(72) "error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt"
151-
string(53) "error:0906A065:PEM routines:PEM_do_header:bad decrypt"
152-
string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
153-
string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
154-
string(72) "error:04066076:rsa routines:RSA_EAY_PRIVATE_ENCRYPT:unknown padding type"
155-
string(78) "error:0407109F:rsa routines:RSA_padding_check_PKCS1_type_2:pkcs decoding error"
156-
string(72) "error:04065072:rsa routines:RSA_EAY_PRIVATE_DECRYPT:padding check failed"
157-
string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
158-
string(71) "error:04068076:rsa routines:RSA_EAY_PUBLIC_ENCRYPT:unknown padding type"
159-
string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
160-
string(79) "error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01"
161-
string(71) "error:04067072:rsa routines:RSA_EAY_PUBLIC_DECRYPT:padding check failed"
151+
PKEY errors
152+
openssl_pkey_export_to_file opening: ok
153+
openssl_pkey_export_to_file pem: ok
154+
openssl_pkey_export_to_file write: ok
155+
openssl_pkey_export: ok
156+
openssl_pkey_get_public: ok
157+
openssl_private_encrypt: ok
158+
openssl_private_decrypt: ok
159+
openssl_private_(en|de)crypt padding: ok
162160
X509 errors
163-
164-
Warning: openssl_x509_export_to_file(): cannot get cert from parameter 1 in %s on line %d
165-
string(61) "error:02001002:system library:fopen:No such file or directory"
166-
string(53) "error:2006D080:BIO routines:BIO_new_file:no such file"
167-
168-
Warning: openssl_x509_export_to_file(): cannot get cert from parameter 1 in %s on line %d
169-
string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
170-
171-
Warning: openssl_x509_export_to_file(): error opening file %s in %s on line %d
172-
string(50) "error:02001015:system library:fopen:Is a directory"
173-
string(51) "error:2006D002:BIO routines:BIO_new_file:system lib"
174-
string(90) "error:0B086079:x509 certificate routines:X509_STORE_CTX_purpose_inherit:unknown purpose id"
175-
176-
Warning: openssl_x509_checkpurpose(): error loading file %s in %s on line %d
161+
openssl_x509_export_to_file open: ok
162+
openssl_x509_export_to_file pem: ok
163+
openssl_x509_export_to_file write: ok
164+
openssl_x509_checkpurpose purpose: ok
177165
CSR errors
178-
string(61) "error:02001002:system library:fopen:No such file or directory"
179-
string(53) "error:2006D080:BIO routines:BIO_new_file:no such file"
180-
string(55) "error:20068079:BIO routines:BIO_gets:unsupported method"
181-
string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
182-
string(54) "error:0906D06C:PEM routines:PEM_read_bio:no start line"
166+
openssl_csr_get_subject open: ok
167+
openssl_csr_get_subjec pem: ok

0 commit comments

Comments
 (0)