ext/openssl: Bump minimum openssl version to 1.1.1#8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Ayesh wants to merge 1 commit into from
Closed

ext/openssl: Bump minimum openssl version to 1.1.1 #8

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions NEWS
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,7 @@ PHP NEWS
Florian Sowade)
. Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
(Vincent Jardin)
. Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)

- Output:
. Clear output handler status flags during handler initialization. (haszi)
Expand Down
1 change: 1 addition & 0 deletions UPGRADING
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -342,6 +342,7 @@ PHP 8.4 UPGRADE NOTES
a single entry.
. New serial_hex parameter added to openssl_csr_sign to allow setting serial
number in the hexadecimal format.
. The OpenSSL extension now requires at least OpenSSL 1.1.1.

- Output:
. Output handler status flags passed to the flags parameter of ob_start
Expand Down
2 changes: 1 addition & 1 deletion build/php.m4
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -1821,7 +1821,7 @@ dnl
AC_DEFUN([PHP_SETUP_OPENSSL],[
found_openssl=no

PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])

if test "$found_openssl" = "yes"; then
PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)
Expand Down
2 changes: 0 additions & 2 deletions ext/ftp/ftp.c
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
return 0;
}

#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
#endif
SSL_CTX_set_options(ctx, ssl_ctx_options);

/* Allow SSL to re-use sessions.
Expand Down
4 changes: 1 addition & 3 deletions ext/ftp/php_ftp.c
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {

PHP_MINIT_FUNCTION(ftp)
{
#ifdef HAVE_FTP_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
SSL_library_init();
OpenSSL_add_all_ciphers();
OpenSSL_add_all_digests();
OpenSSL_add_all_algorithms();

SSL_load_error_strings();
#endif
#endif

php_ftp_ce = register_class_FTP_Connection();
Expand Down
2 changes: 1 addition & 1 deletion ext/openssl/config0.m4
View file
Open in desktop
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
PHP_ARG_WITH([openssl],
[for OpenSSL support],
[AS_HELP_STRING([--with-openssl],
[Include OpenSSL support (requires OpenSSL >= 1.0.2)])])
[Include OpenSSL support (requires OpenSSL >= 1.1.1)])])

PHP_ARG_WITH([kerberos],
[for Kerberos support],
Expand Down
14 changes: 5 additions & 9 deletions ext/openssl/openssl.c
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -61,7 +61,7 @@
#include <openssl/param_build.h>
#endif

#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
#include <openssl/engine.h>
#endif

Expand DownExpand Up@@ -99,7 +99,7 @@
#define HAVE_EVP_PKEY_EC 1

/* the OPENSSL_EC_EXPLICIT_CURVE value was added
* in OpenSSL 1.1.0; previous versions should
* in OpenSSL 1.1.0; previous versions should
* use 0 instead.
*/
#ifndef OPENSSL_EC_EXPLICIT_CURVE
Expand DownExpand Up@@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
php_openssl_pkey_object_handlers.clone_obj = NULL;
php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
OPENSSL_config(NULL);
SSL_library_init();
OpenSSL_add_all_ciphers();
Expand DownExpand Up@@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
#if OPENSSL_VERSION_NUMBER >= 0x10101000
php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
#endif

/* override the default tcp socket provider */
php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
Expand DownExpand Up@@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(openssl)
{
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
EVP_cleanup();

/* prevent accessing locking callback from unloaded extension */
Expand All@@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
php_stream_xport_unregister("tlsv1.0");
php_stream_xport_unregister("tlsv1.1");
php_stream_xport_unregister("tlsv1.2");
#if OPENSSL_VERSION_NUMBER >= 0x10101000
php_stream_xport_unregister("tlsv1.3");
#endif

/* reinstate the default tcp handler */
php_stream_xport_register("tcp", php_stream_generic_socket_factory);
Expand DownExpand Up@@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
EVP_PKEY_CTX_free(ctx);
ctx = EVP_PKEY_CTX_new(param_key, NULL);
}

if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
*is_private = d != NULL;
EVP_PKEY_up_ref(param_key);
Expand Down
6 changes: 2 additions & 4 deletions ext/openssl/php_openssl.h
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
#define PHP_OPENSSL_VERSION PHP_VERSION

#include <openssl/opensslv.h>
#if defined(LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
/* LibreSSL version check */
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
#define PHP_OPENSSL_API_VERSION 0x10001
Expand All@@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
#endif
#else
/* OpenSSL version check */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define PHP_OPENSSL_API_VERSION 0x10002
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
#if OPENSSL_VERSION_NUMBER < 0x30000000L
#define PHP_OPENSSL_API_VERSION 0x10100
#else
#define PHP_OPENSSL_API_VERSION 0x30000
Expand Down
4 changes: 0 additions & 4 deletions ext/openssl/tests/bug80747.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -2,10 +2,6 @@
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
--EXTENSIONS--
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
?>
--FILE--
<?php

Expand Down
3 changes: 1 addition & 2 deletions ext/openssl/tests/openssl_error_string_basic.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -94,8 +94,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
var_dump($error_queue_size);
echo "\n";

$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
$err_pem_no_start_line = '0909006C';

// PKEY
echo "PKEY errors\n";
Expand Down
3 changes: 0 additions & 3 deletions ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -4,9 +4,6 @@ int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose [, array $cainfo
marcosptf - <marcosptf@yahoo.com.br>
--EXTENSIONS--
openssl
--SKIPIF--
<?php if (OPENSSL_VERSION_NUMBER < 0x10000000) die("skip Output requires OpenSSL 1.0");
?>
--FILE--
<?php
include 'CertificateGenerator.inc';
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/session_meta_capture_tlsv13.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/stream_crypto_flags_003.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
?>
--FILE--
<?php
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/stream_security_level.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -4,7 +4,6 @@ security_level setting to prohibit cert
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
if (!function_exists("proc_open")) die("skip no proc_open");
?>
--FILE--
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/tls_wrapper.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/tlsv1.3_wrapper.phpt
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down
8 changes: 2 additions & 6 deletions ext/openssl/xp_ssl.c
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@
#define HAVE_TLS12 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(OPENSSL_NO_TLS1_3)
#ifndef OPENSSL_NO_TLS1_3
#define HAVE_TLS13 1
#endif

Expand All@@ -89,7 +89,7 @@
#define HAVE_TLS_ALPN 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
#ifndef LIBRESSL_VERSION_NUMBER
#define HAVE_SEC_LEVEL 1
#endif

Expand DownExpand Up@@ -676,11 +676,7 @@ static int php_openssl_win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx,
{
PCCERT_CONTEXT cert_ctx = NULL;
PCCERT_CHAIN_CONTEXT cert_chain_ctx = NULL;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
X509 *cert = x509_store_ctx->cert;
#else
X509 *cert = X509_STORE_CTX_get0_cert(x509_store_ctx);
#endif

php_stream *stream;
php_openssl_netstream_data_t *sslsock;
Expand Down
7 changes: 1 addition & 6 deletions php.ini-development
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -928,12 +928,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -942,6 +936,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down
7 changes: 1 addition & 6 deletions php.ini-production
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -930,12 +930,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -944,6 +938,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
ext/openssl: Bump minimum openssl version to 1.1.1#8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

Ayesh
wants to merge
1
commit into

from

 Closed


ext/openssl: Bump minimum openssl version to 1.1.1
#8
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
NEWS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,7 @@ PHP NEWS
 Florian Sowade)
 . Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
 (Vincent Jardin)
 . Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)

- Output:
 . Clear output handler status flags during handler initialization. (haszi)
Expand Down

1 change: 1 addition & 0 deletions
UPGRADING

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -342,6 +342,7 @@ PHP 8.4 UPGRADE NOTES
 a single entry.
 . New serial_hex parameter added to openssl_csr_sign to allow setting serial
 number in the hexadecimal format.
 . The OpenSSL extension now requires at least OpenSSL 1.1.1.

- Output:
 . Output handler status flags passed to the flags parameter of ob_start
Expand Down

2 changes: 1 addition & 1 deletion
build/php.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1821,7 +1821,7 @@ dnl
AC_DEFUN([PHP_SETUP_OPENSSL],[
 found_openssl=no

 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])

 if test "$found_openssl" = "yes"; then
 PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)
Expand Down

2 changes: 0 additions & 2 deletions
ext/ftp/ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
 return 0;
 }

#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
 ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
#endif
 SSL_CTX_set_options(ctx, ssl_ctx_options);

 /* Allow SSL to re-use sessions.
Expand Down

4 changes: 1 addition & 3 deletions
ext/ftp/php_ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {

PHP_MINIT_FUNCTION(ftp)
{
#ifdef HAVE_FTP_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
	SSL_library_init();
	OpenSSL_add_all_ciphers();
	OpenSSL_add_all_digests();
	OpenSSL_add_all_algorithms();

	SSL_load_error_strings();
#endif
#endif

	php_ftp_ce = register_class_FTP_Connection();
Expand Down

2 changes: 1 addition & 1 deletion
ext/openssl/config0.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
PHP_ARG_WITH([openssl],
 [for OpenSSL support],
 [AS_HELP_STRING([--with-openssl],
 [Include OpenSSL support (requires OpenSSL >= 1.0.2)])])
 [Include OpenSSL support (requires OpenSSL >= 1.1.1)])])

PHP_ARG_WITH([kerberos],
 [for Kerberos support],
Expand Down

14 changes: 5 additions & 9 deletions
ext/openssl/openssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,7 +61,7 @@
#include <openssl/param_build.h>
#endif

#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
#include <openssl/engine.h>
#endif

Expand DownExpand Up@@ -99,7 +99,7 @@
#define HAVE_EVP_PKEY_EC 1

/* the OPENSSL_EC_EXPLICIT_CURVE value was added
 * in OpenSSL 1.1.0; previous versions should
 * in OpenSSL 1.1.0; previous versions should
 * use 0 instead.
 */
#ifndef OPENSSL_EC_EXPLICIT_CURVE
Expand DownExpand Up@@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_openssl_pkey_object_handlers.clone_obj = NULL;
	php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	OPENSSL_config(NULL);
	SSL_library_init();
	OpenSSL_add_all_ciphers();
Expand DownExpand Up@@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
#endif

	/* override the default tcp socket provider */
	php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
Expand DownExpand Up@@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(openssl)
{
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	EVP_cleanup();

	/* prevent accessing locking callback from unloaded extension */
Expand All@@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
	php_stream_xport_unregister("tlsv1.0");
	php_stream_xport_unregister("tlsv1.1");
	php_stream_xport_unregister("tlsv1.2");
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_unregister("tlsv1.3");
#endif

	/* reinstate the default tcp handler */
	php_stream_xport_register("tcp", php_stream_generic_socket_factory);
Expand DownExpand Up@@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
 EVP_PKEY_CTX_free(ctx);
 ctx = EVP_PKEY_CTX_new(param_key, NULL);
	}

	if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
 *is_private = d != NULL;
 EVP_PKEY_up_ref(param_key);
Expand Down

6 changes: 2 additions & 4 deletions
ext/openssl/php_openssl.h

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
#define PHP_OPENSSL_VERSION PHP_VERSION

#include <openssl/opensslv.h>
#if defined(LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
/* LibreSSL version check */
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
#define PHP_OPENSSL_API_VERSION 0x10001
Expand All@@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
#endif
#else
/* OpenSSL version check */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define PHP_OPENSSL_API_VERSION 0x10002
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
#if OPENSSL_VERSION_NUMBER < 0x30000000L
#define PHP_OPENSSL_API_VERSION 0x10100
#else
#define PHP_OPENSSL_API_VERSION 0x30000
Expand Down

4 changes: 0 additions & 4 deletions
ext/openssl/tests/bug80747.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,10 +2,6 @@
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
--EXTENSIONS--
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
?>
--FILE--
<?php

Expand Down

3 changes: 1 addition & 2 deletions
ext/openssl/tests/openssl_error_string_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,8 +94,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
var_dump($error_queue_size);
echo "\n";

$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
$err_pem_no_start_line = '0909006C';

// PKEY
echo "PKEY errors\n";
Expand Down

3 changes: 0 additions & 3 deletions
ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,9 +4,6 @@ int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose [, array $cainfo
marcosptf - <marcosptf@yahoo.com.br>
--EXTENSIONS--
openssl
--SKIPIF--
<?php if (OPENSSL_VERSION_NUMBER < 0x10000000) die("skip Output requires OpenSSL 1.0");
?>
--FILE--
<?php
include 'CertificateGenerator.inc';
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/session_meta_capture_tlsv13.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_crypto_flags_003.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_security_level.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,7 +4,6 @@ security_level setting to prohibit cert
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
if (!function_exists("proc_open")) die("skip no proc_open");
?>
--FILE--
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tlsv1.3_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

8 changes: 2 additions & 6 deletions
ext/openssl/xp_ssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@
#define HAVE_TLS12 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(OPENSSL_NO_TLS1_3)
#ifndef OPENSSL_NO_TLS1_3
#define HAVE_TLS13 1
#endif

Expand All@@ -89,7 +89,7 @@
#define HAVE_TLS_ALPN 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
#ifndef LIBRESSL_VERSION_NUMBER
#define HAVE_SEC_LEVEL 1
#endif

Expand DownExpand Up@@ -676,11 +676,7 @@ static int php_openssl_win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx,
{
	PCCERT_CONTEXT cert_ctx = NULL;
	PCCERT_CHAIN_CONTEXT cert_chain_ctx = NULL;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
	X509 *cert = x509_store_ctx->cert;
#else
	X509 *cert = X509_STORE_CTX_get0_cert(x509_store_ctx);
#endif

	php_stream *stream;
	php_openssl_netstream_data_t *sslsock;
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-development

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -928,12 +928,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -942,6 +936,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-production

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -930,12 +930,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -944,6 +938,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
ext/openssl: Bump minimum openssl version to 1.1.1#8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

Ayesh
wants to merge
1
commit into

from

 Closed


ext/openssl: Bump minimum openssl version to 1.1.1
#8
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
NEWS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,7 @@ PHP NEWS
 Florian Sowade)
 . Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
 (Vincent Jardin)
 . Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)

- Output:
 . Clear output handler status flags during handler initialization. (haszi)
Expand Down

1 change: 1 addition & 0 deletions
UPGRADING

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -342,6 +342,7 @@ PHP 8.4 UPGRADE NOTES
 a single entry.
 . New serial_hex parameter added to openssl_csr_sign to allow setting serial
 number in the hexadecimal format.
 . The OpenSSL extension now requires at least OpenSSL 1.1.1.

- Output:
 . Output handler status flags passed to the flags parameter of ob_start
Expand Down

2 changes: 1 addition & 1 deletion
build/php.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1821,7 +1821,7 @@ dnl
AC_DEFUN([PHP_SETUP_OPENSSL],[
 found_openssl=no

 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])

 if test "$found_openssl" = "yes"; then
 PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)
Expand Down

2 changes: 0 additions & 2 deletions
ext/ftp/ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
 return 0;
 }

#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
 ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
#endif
 SSL_CTX_set_options(ctx, ssl_ctx_options);

 /* Allow SSL to re-use sessions.
Expand Down

4 changes: 1 addition & 3 deletions
ext/ftp/php_ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {

PHP_MINIT_FUNCTION(ftp)
{
#ifdef HAVE_FTP_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
	SSL_library_init();
	OpenSSL_add_all_ciphers();
	OpenSSL_add_all_digests();
	OpenSSL_add_all_algorithms();

	SSL_load_error_strings();
#endif
#endif

	php_ftp_ce = register_class_FTP_Connection();
Expand Down

2 changes: 1 addition & 1 deletion
ext/openssl/config0.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
PHP_ARG_WITH([openssl],
 [for OpenSSL support],
 [AS_HELP_STRING([--with-openssl],
 [Include OpenSSL support (requires OpenSSL >= 1.0.2)])])
 [Include OpenSSL support (requires OpenSSL >= 1.1.1)])])

PHP_ARG_WITH([kerberos],
 [for Kerberos support],
Expand Down

14 changes: 5 additions & 9 deletions
ext/openssl/openssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,7 +61,7 @@
#include <openssl/param_build.h>
#endif

#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
#include <openssl/engine.h>
#endif

Expand DownExpand Up@@ -99,7 +99,7 @@
#define HAVE_EVP_PKEY_EC 1

/* the OPENSSL_EC_EXPLICIT_CURVE value was added
 * in OpenSSL 1.1.0; previous versions should
 * in OpenSSL 1.1.0; previous versions should
 * use 0 instead.
 */
#ifndef OPENSSL_EC_EXPLICIT_CURVE
Expand DownExpand Up@@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_openssl_pkey_object_handlers.clone_obj = NULL;
	php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	OPENSSL_config(NULL);
	SSL_library_init();
	OpenSSL_add_all_ciphers();
Expand DownExpand Up@@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
#endif

	/* override the default tcp socket provider */
	php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
Expand DownExpand Up@@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(openssl)
{
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	EVP_cleanup();

	/* prevent accessing locking callback from unloaded extension */
Expand All@@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
	php_stream_xport_unregister("tlsv1.0");
	php_stream_xport_unregister("tlsv1.1");
	php_stream_xport_unregister("tlsv1.2");
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_unregister("tlsv1.3");
#endif

	/* reinstate the default tcp handler */
	php_stream_xport_register("tcp", php_stream_generic_socket_factory);
Expand DownExpand Up@@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
 EVP_PKEY_CTX_free(ctx);
 ctx = EVP_PKEY_CTX_new(param_key, NULL);
	}

	if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
 *is_private = d != NULL;
 EVP_PKEY_up_ref(param_key);
Expand Down

6 changes: 2 additions & 4 deletions
ext/openssl/php_openssl.h

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
#define PHP_OPENSSL_VERSION PHP_VERSION

#include <openssl/opensslv.h>
#if defined(LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
/* LibreSSL version check */
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
#define PHP_OPENSSL_API_VERSION 0x10001
Expand All@@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
#endif
#else
/* OpenSSL version check */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define PHP_OPENSSL_API_VERSION 0x10002
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
#if OPENSSL_VERSION_NUMBER < 0x30000000L
#define PHP_OPENSSL_API_VERSION 0x10100
#else
#define PHP_OPENSSL_API_VERSION 0x30000
Expand Down

4 changes: 0 additions & 4 deletions
ext/openssl/tests/bug80747.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,10 +2,6 @@
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
--EXTENSIONS--
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
?>
--FILE--
<?php

Expand Down

3 changes: 1 addition & 2 deletions
ext/openssl/tests/openssl_error_string_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,8 +94,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
var_dump($error_queue_size);
echo "\n";

$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
$err_pem_no_start_line = '0909006C';

// PKEY
echo "PKEY errors\n";
Expand Down

3 changes: 0 additions & 3 deletions
ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,9 +4,6 @@ int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose [, array $cainfo
marcosptf - <marcosptf@yahoo.com.br>
--EXTENSIONS--
openssl
--SKIPIF--
<?php if (OPENSSL_VERSION_NUMBER < 0x10000000) die("skip Output requires OpenSSL 1.0");
?>
--FILE--
<?php
include 'CertificateGenerator.inc';
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/session_meta_capture_tlsv13.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_crypto_flags_003.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_security_level.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,7 +4,6 @@ security_level setting to prohibit cert
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
if (!function_exists("proc_open")) die("skip no proc_open");
?>
--FILE--
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tlsv1.3_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

8 changes: 2 additions & 6 deletions
ext/openssl/xp_ssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@
#define HAVE_TLS12 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(OPENSSL_NO_TLS1_3)
#ifndef OPENSSL_NO_TLS1_3
#define HAVE_TLS13 1
#endif

Expand All@@ -89,7 +89,7 @@
#define HAVE_TLS_ALPN 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
#ifndef LIBRESSL_VERSION_NUMBER
#define HAVE_SEC_LEVEL 1
#endif

Expand DownExpand Up@@ -676,11 +676,7 @@ static int php_openssl_win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx,
{
	PCCERT_CONTEXT cert_ctx = NULL;
	PCCERT_CHAIN_CONTEXT cert_chain_ctx = NULL;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
	X509 *cert = x509_store_ctx->cert;
#else
	X509 *cert = X509_STORE_CTX_get0_cert(x509_store_ctx);
#endif

	php_stream *stream;
	php_openssl_netstream_data_t *sslsock;
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-development

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -928,12 +928,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -942,6 +936,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-production

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -930,12 +930,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -944,6 +938,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
ext/openssl: Bump minimum openssl version to 1.1.1#8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

Ayesh
wants to merge
1
commit into

from

 Closed


ext/openssl: Bump minimum openssl version to 1.1.1
#8
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
NEWS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,7 @@ PHP NEWS
 Florian Sowade)
 . Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
 (Vincent Jardin)
 . Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)

- Output:
 . Clear output handler status flags during handler initialization. (haszi)
Expand Down

1 change: 1 addition & 0 deletions
UPGRADING

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -342,6 +342,7 @@ PHP 8.4 UPGRADE NOTES
 a single entry.
 . New serial_hex parameter added to openssl_csr_sign to allow setting serial
 number in the hexadecimal format.
 . The OpenSSL extension now requires at least OpenSSL 1.1.1.

- Output:
 . Output handler status flags passed to the flags parameter of ob_start
Expand Down

2 changes: 1 addition & 1 deletion
build/php.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1821,7 +1821,7 @@ dnl
AC_DEFUN([PHP_SETUP_OPENSSL],[
 found_openssl=no

 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])

 if test "$found_openssl" = "yes"; then
 PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)
Expand Down

2 changes: 0 additions & 2 deletions
ext/ftp/ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
 return 0;
 }

#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
 ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
#endif
 SSL_CTX_set_options(ctx, ssl_ctx_options);

 /* Allow SSL to re-use sessions.
Expand Down

4 changes: 1 addition & 3 deletions
ext/ftp/php_ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {

PHP_MINIT_FUNCTION(ftp)
{
#ifdef HAVE_FTP_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
	SSL_library_init();
	OpenSSL_add_all_ciphers();
	OpenSSL_add_all_digests();
	OpenSSL_add_all_algorithms();

	SSL_load_error_strings();
#endif
#endif

	php_ftp_ce = register_class_FTP_Connection();
Expand Down

2 changes: 1 addition & 1 deletion
ext/openssl/config0.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
PHP_ARG_WITH([openssl],
 [for OpenSSL support],
 [AS_HELP_STRING([--with-openssl],
 [Include OpenSSL support (requires OpenSSL >= 1.0.2)])])
 [Include OpenSSL support (requires OpenSSL >= 1.1.1)])])

PHP_ARG_WITH([kerberos],
 [for Kerberos support],
Expand Down

14 changes: 5 additions & 9 deletions
ext/openssl/openssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,7 +61,7 @@
#include <openssl/param_build.h>
#endif

#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
#include <openssl/engine.h>
#endif

Expand DownExpand Up@@ -99,7 +99,7 @@
#define HAVE_EVP_PKEY_EC 1

/* the OPENSSL_EC_EXPLICIT_CURVE value was added
 * in OpenSSL 1.1.0; previous versions should
 * in OpenSSL 1.1.0; previous versions should
 * use 0 instead.
 */
#ifndef OPENSSL_EC_EXPLICIT_CURVE
Expand DownExpand Up@@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_openssl_pkey_object_handlers.clone_obj = NULL;
	php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	OPENSSL_config(NULL);
	SSL_library_init();
	OpenSSL_add_all_ciphers();
Expand DownExpand Up@@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
#endif

	/* override the default tcp socket provider */
	php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
Expand DownExpand Up@@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(openssl)
{
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	EVP_cleanup();

	/* prevent accessing locking callback from unloaded extension */
Expand All@@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
	php_stream_xport_unregister("tlsv1.0");
	php_stream_xport_unregister("tlsv1.1");
	php_stream_xport_unregister("tlsv1.2");
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_unregister("tlsv1.3");
#endif

	/* reinstate the default tcp handler */
	php_stream_xport_register("tcp", php_stream_generic_socket_factory);
Expand DownExpand Up@@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
 EVP_PKEY_CTX_free(ctx);
 ctx = EVP_PKEY_CTX_new(param_key, NULL);
	}

	if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
 *is_private = d != NULL;
 EVP_PKEY_up_ref(param_key);
Expand Down

6 changes: 2 additions & 4 deletions
ext/openssl/php_openssl.h

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
#define PHP_OPENSSL_VERSION PHP_VERSION

#include <openssl/opensslv.h>
#if defined(LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
/* LibreSSL version check */
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
#define PHP_OPENSSL_API_VERSION 0x10001
Expand All@@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
#endif
#else
/* OpenSSL version check */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define PHP_OPENSSL_API_VERSION 0x10002
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
#if OPENSSL_VERSION_NUMBER < 0x30000000L
#define PHP_OPENSSL_API_VERSION 0x10100
#else
#define PHP_OPENSSL_API_VERSION 0x30000
Expand Down

4 changes: 0 additions & 4 deletions
ext/openssl/tests/bug80747.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,10 +2,6 @@
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
--EXTENSIONS--
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
?>
--FILE--
<?php

Expand Down

3 changes: 1 addition & 2 deletions
ext/openssl/tests/openssl_error_string_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,8 +94,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
var_dump($error_queue_size);
echo "\n";

$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
$err_pem_no_start_line = '0909006C';

// PKEY
echo "PKEY errors\n";
Expand Down

3 changes: 0 additions & 3 deletions
ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,9 +4,6 @@ int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose [, array $cainfo
marcosptf - <marcosptf@yahoo.com.br>
--EXTENSIONS--
openssl
--SKIPIF--
<?php if (OPENSSL_VERSION_NUMBER < 0x10000000) die("skip Output requires OpenSSL 1.0");
?>
--FILE--
<?php
include 'CertificateGenerator.inc';
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/session_meta_capture_tlsv13.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_crypto_flags_003.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_security_level.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,7 +4,6 @@ security_level setting to prohibit cert
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
if (!function_exists("proc_open")) die("skip no proc_open");
?>
--FILE--
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tlsv1.3_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

8 changes: 2 additions & 6 deletions
ext/openssl/xp_ssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@
#define HAVE_TLS12 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(OPENSSL_NO_TLS1_3)
#ifndef OPENSSL_NO_TLS1_3
#define HAVE_TLS13 1
#endif

Expand All@@ -89,7 +89,7 @@
#define HAVE_TLS_ALPN 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
#ifndef LIBRESSL_VERSION_NUMBER
#define HAVE_SEC_LEVEL 1
#endif

Expand DownExpand Up@@ -676,11 +676,7 @@ static int php_openssl_win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx,
{
	PCCERT_CONTEXT cert_ctx = NULL;
	PCCERT_CHAIN_CONTEXT cert_chain_ctx = NULL;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
	X509 *cert = x509_store_ctx->cert;
#else
	X509 *cert = X509_STORE_CTX_get0_cert(x509_store_ctx);
#endif

	php_stream *stream;
	php_openssl_netstream_data_t *sslsock;
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-development

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -928,12 +928,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -942,6 +936,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-production

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -930,12 +930,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -944,6 +938,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
ext/openssl: Bump minimum openssl version to 1.1.1#8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

Ayesh
wants to merge
1
commit into

from

 Closed


ext/openssl: Bump minimum openssl version to 1.1.1
#8
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
NEWS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,7 @@ PHP NEWS
 Florian Sowade)
 . Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
 (Vincent Jardin)
 . Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)

- Output:
 . Clear output handler status flags during handler initialization. (haszi)
Expand Down

1 change: 1 addition & 0 deletions
UPGRADING

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -342,6 +342,7 @@ PHP 8.4 UPGRADE NOTES
 a single entry.
 . New serial_hex parameter added to openssl_csr_sign to allow setting serial
 number in the hexadecimal format.
 . The OpenSSL extension now requires at least OpenSSL 1.1.1.

- Output:
 . Output handler status flags passed to the flags parameter of ob_start
Expand Down

2 changes: 1 addition & 1 deletion
build/php.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1821,7 +1821,7 @@ dnl
AC_DEFUN([PHP_SETUP_OPENSSL],[
 found_openssl=no

 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])

 if test "$found_openssl" = "yes"; then
 PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)
Expand Down

2 changes: 0 additions & 2 deletions
ext/ftp/ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
 return 0;
 }

#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
 ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
#endif
 SSL_CTX_set_options(ctx, ssl_ctx_options);

 /* Allow SSL to re-use sessions.
Expand Down

4 changes: 1 addition & 3 deletions
ext/ftp/php_ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {

PHP_MINIT_FUNCTION(ftp)
{
#ifdef HAVE_FTP_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
	SSL_library_init();
	OpenSSL_add_all_ciphers();
	OpenSSL_add_all_digests();
	OpenSSL_add_all_algorithms();

	SSL_load_error_strings();
#endif
#endif

	php_ftp_ce = register_class_FTP_Connection();
Expand Down

2 changes: 1 addition & 1 deletion
ext/openssl/config0.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
PHP_ARG_WITH([openssl],
 [for OpenSSL support],
 [AS_HELP_STRING([--with-openssl],
 [Include OpenSSL support (requires OpenSSL >= 1.0.2)])])
 [Include OpenSSL support (requires OpenSSL >= 1.1.1)])])

PHP_ARG_WITH([kerberos],
 [for Kerberos support],
Expand Down

14 changes: 5 additions & 9 deletions
ext/openssl/openssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,7 +61,7 @@
#include <openssl/param_build.h>
#endif

#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
#include <openssl/engine.h>
#endif

Expand DownExpand Up@@ -99,7 +99,7 @@
#define HAVE_EVP_PKEY_EC 1

/* the OPENSSL_EC_EXPLICIT_CURVE value was added
 * in OpenSSL 1.1.0; previous versions should
 * in OpenSSL 1.1.0; previous versions should
 * use 0 instead.
 */
#ifndef OPENSSL_EC_EXPLICIT_CURVE
Expand DownExpand Up@@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_openssl_pkey_object_handlers.clone_obj = NULL;
	php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	OPENSSL_config(NULL);
	SSL_library_init();
	OpenSSL_add_all_ciphers();
Expand DownExpand Up@@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
#endif

	/* override the default tcp socket provider */
	php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
Expand DownExpand Up@@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(openssl)
{
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	EVP_cleanup();

	/* prevent accessing locking callback from unloaded extension */
Expand All@@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
	php_stream_xport_unregister("tlsv1.0");
	php_stream_xport_unregister("tlsv1.1");
	php_stream_xport_unregister("tlsv1.2");
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_unregister("tlsv1.3");
#endif

	/* reinstate the default tcp handler */
	php_stream_xport_register("tcp", php_stream_generic_socket_factory);
Expand DownExpand Up@@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
 EVP_PKEY_CTX_free(ctx);
 ctx = EVP_PKEY_CTX_new(param_key, NULL);
	}

	if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
 *is_private = d != NULL;
 EVP_PKEY_up_ref(param_key);
Expand Down

6 changes: 2 additions & 4 deletions
ext/openssl/php_openssl.h

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
#define PHP_OPENSSL_VERSION PHP_VERSION

#include <openssl/opensslv.h>
#if defined(LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
/* LibreSSL version check */
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
#define PHP_OPENSSL_API_VERSION 0x10001
Expand All@@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
#endif
#else
/* OpenSSL version check */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define PHP_OPENSSL_API_VERSION 0x10002
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
#if OPENSSL_VERSION_NUMBER < 0x30000000L
#define PHP_OPENSSL_API_VERSION 0x10100
#else
#define PHP_OPENSSL_API_VERSION 0x30000
Expand Down

4 changes: 0 additions & 4 deletions
ext/openssl/tests/bug80747.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,10 +2,6 @@
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
--EXTENSIONS--
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
?>
--FILE--
<?php

Expand Down

3 changes: 1 addition & 2 deletions
ext/openssl/tests/openssl_error_string_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,8 +94,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
var_dump($error_queue_size);
echo "\n";

$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
$err_pem_no_start_line = '0909006C';

// PKEY
echo "PKEY errors\n";
Expand Down

3 changes: 0 additions & 3 deletions
ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,9 +4,6 @@ int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose [, array $cainfo
marcosptf - <marcosptf@yahoo.com.br>
--EXTENSIONS--
openssl
--SKIPIF--
<?php if (OPENSSL_VERSION_NUMBER < 0x10000000) die("skip Output requires OpenSSL 1.0");
?>
--FILE--
<?php
include 'CertificateGenerator.inc';
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/session_meta_capture_tlsv13.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_crypto_flags_003.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_security_level.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,7 +4,6 @@ security_level setting to prohibit cert
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
if (!function_exists("proc_open")) die("skip no proc_open");
?>
--FILE--
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tlsv1.3_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

8 changes: 2 additions & 6 deletions
ext/openssl/xp_ssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@
#define HAVE_TLS12 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(OPENSSL_NO_TLS1_3)
#ifndef OPENSSL_NO_TLS1_3
#define HAVE_TLS13 1
#endif

Expand All@@ -89,7 +89,7 @@
#define HAVE_TLS_ALPN 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
#ifndef LIBRESSL_VERSION_NUMBER
#define HAVE_SEC_LEVEL 1
#endif

Expand DownExpand Up@@ -676,11 +676,7 @@ static int php_openssl_win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx,
{
	PCCERT_CONTEXT cert_ctx = NULL;
	PCCERT_CHAIN_CONTEXT cert_chain_ctx = NULL;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
	X509 *cert = x509_store_ctx->cert;
#else
	X509 *cert = X509_STORE_CTX_get0_cert(x509_store_ctx);
#endif

	php_stream *stream;
	php_openssl_netstream_data_t *sslsock;
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-development

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -928,12 +928,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -942,6 +936,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-production

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -930,12 +930,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -944,6 +938,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
ext/openssl: Bump minimum openssl version to 1.1.1#8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

Ayesh
wants to merge
1
commit into

from

 Closed


ext/openssl: Bump minimum openssl version to 1.1.1
#8
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
NEWS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,7 @@ PHP NEWS
 Florian Sowade)
 . Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
 (Vincent Jardin)
 . Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)

- Output:
 . Clear output handler status flags during handler initialization. (haszi)
Expand Down

1 change: 1 addition & 0 deletions
UPGRADING

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -342,6 +342,7 @@ PHP 8.4 UPGRADE NOTES
 a single entry.
 . New serial_hex parameter added to openssl_csr_sign to allow setting serial
 number in the hexadecimal format.
 . The OpenSSL extension now requires at least OpenSSL 1.1.1.

- Output:
 . Output handler status flags passed to the flags parameter of ob_start
Expand Down

2 changes: 1 addition & 1 deletion
build/php.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1821,7 +1821,7 @@ dnl
AC_DEFUN([PHP_SETUP_OPENSSL],[
 found_openssl=no

 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])

 if test "$found_openssl" = "yes"; then
 PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)
Expand Down

2 changes: 0 additions & 2 deletions
ext/ftp/ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
 return 0;
 }

#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
 ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
#endif
 SSL_CTX_set_options(ctx, ssl_ctx_options);

 /* Allow SSL to re-use sessions.
Expand Down

4 changes: 1 addition & 3 deletions
ext/ftp/php_ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {

PHP_MINIT_FUNCTION(ftp)
{
#ifdef HAVE_FTP_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
	SSL_library_init();
	OpenSSL_add_all_ciphers();
	OpenSSL_add_all_digests();
	OpenSSL_add_all_algorithms();

	SSL_load_error_strings();
#endif
#endif

	php_ftp_ce = register_class_FTP_Connection();
Expand Down

2 changes: 1 addition & 1 deletion
ext/openssl/config0.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
PHP_ARG_WITH([openssl],
 [for OpenSSL support],
 [AS_HELP_STRING([--with-openssl],
 [Include OpenSSL support (requires OpenSSL >= 1.0.2)])])
 [Include OpenSSL support (requires OpenSSL >= 1.1.1)])])

PHP_ARG_WITH([kerberos],
 [for Kerberos support],
Expand Down

14 changes: 5 additions & 9 deletions
ext/openssl/openssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,7 +61,7 @@
#include <openssl/param_build.h>
#endif

#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
#include <openssl/engine.h>
#endif

Expand DownExpand Up@@ -99,7 +99,7 @@
#define HAVE_EVP_PKEY_EC 1

/* the OPENSSL_EC_EXPLICIT_CURVE value was added
 * in OpenSSL 1.1.0; previous versions should
 * in OpenSSL 1.1.0; previous versions should
 * use 0 instead.
 */
#ifndef OPENSSL_EC_EXPLICIT_CURVE
Expand DownExpand Up@@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_openssl_pkey_object_handlers.clone_obj = NULL;
	php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	OPENSSL_config(NULL);
	SSL_library_init();
	OpenSSL_add_all_ciphers();
Expand DownExpand Up@@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
#endif

	/* override the default tcp socket provider */
	php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
Expand DownExpand Up@@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(openssl)
{
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	EVP_cleanup();

	/* prevent accessing locking callback from unloaded extension */
Expand All@@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
	php_stream_xport_unregister("tlsv1.0");
	php_stream_xport_unregister("tlsv1.1");
	php_stream_xport_unregister("tlsv1.2");
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_unregister("tlsv1.3");
#endif

	/* reinstate the default tcp handler */
	php_stream_xport_register("tcp", php_stream_generic_socket_factory);
Expand DownExpand Up@@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
 EVP_PKEY_CTX_free(ctx);
 ctx = EVP_PKEY_CTX_new(param_key, NULL);
	}

	if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
 *is_private = d != NULL;
 EVP_PKEY_up_ref(param_key);
Expand Down

6 changes: 2 additions & 4 deletions
ext/openssl/php_openssl.h

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
#define PHP_OPENSSL_VERSION PHP_VERSION

#include <openssl/opensslv.h>
#if defined(LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
/* LibreSSL version check */
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
#define PHP_OPENSSL_API_VERSION 0x10001
Expand All@@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
#endif
#else
/* OpenSSL version check */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define PHP_OPENSSL_API_VERSION 0x10002
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
#if OPENSSL_VERSION_NUMBER < 0x30000000L
#define PHP_OPENSSL_API_VERSION 0x10100
#else
#define PHP_OPENSSL_API_VERSION 0x30000
Expand Down

4 changes: 0 additions & 4 deletions
ext/openssl/tests/bug80747.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,10 +2,6 @@
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
--EXTENSIONS--
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
?>
--FILE--
<?php

Expand Down

3 changes: 1 addition & 2 deletions
ext/openssl/tests/openssl_error_string_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,8 +94,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
var_dump($error_queue_size);
echo "\n";

$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
$err_pem_no_start_line = '0909006C';

// PKEY
echo "PKEY errors\n";
Expand Down

3 changes: 0 additions & 3 deletions
ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,9 +4,6 @@ int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose [, array $cainfo
marcosptf - <marcosptf@yahoo.com.br>
--EXTENSIONS--
openssl
--SKIPIF--
<?php if (OPENSSL_VERSION_NUMBER < 0x10000000) die("skip Output requires OpenSSL 1.0");
?>
--FILE--
<?php
include 'CertificateGenerator.inc';
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/session_meta_capture_tlsv13.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_crypto_flags_003.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_security_level.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,7 +4,6 @@ security_level setting to prohibit cert
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
if (!function_exists("proc_open")) die("skip no proc_open");
?>
--FILE--
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tlsv1.3_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

8 changes: 2 additions & 6 deletions
ext/openssl/xp_ssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@
#define HAVE_TLS12 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(OPENSSL_NO_TLS1_3)
#ifndef OPENSSL_NO_TLS1_3
#define HAVE_TLS13 1
#endif

Expand All@@ -89,7 +89,7 @@
#define HAVE_TLS_ALPN 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
#ifndef LIBRESSL_VERSION_NUMBER
#define HAVE_SEC_LEVEL 1
#endif

Expand DownExpand Up@@ -676,11 +676,7 @@ static int php_openssl_win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx,
{
	PCCERT_CONTEXT cert_ctx = NULL;
	PCCERT_CHAIN_CONTEXT cert_chain_ctx = NULL;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
	X509 *cert = x509_store_ctx->cert;
#else
	X509 *cert = X509_STORE_CTX_get0_cert(x509_store_ctx);
#endif

	php_stream *stream;
	php_openssl_netstream_data_t *sslsock;
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-development

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -928,12 +928,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -942,6 +936,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-production

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -930,12 +930,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -944,6 +938,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
ext/openssl: Bump minimum openssl version to 1.1.1#8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

Ayesh
wants to merge
1
commit into

from

 Closed


ext/openssl: Bump minimum openssl version to 1.1.1
#8
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
NEWS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,7 @@ PHP NEWS
 Florian Sowade)
 . Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
 (Vincent Jardin)
 . Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)

- Output:
 . Clear output handler status flags during handler initialization. (haszi)
Expand Down

1 change: 1 addition & 0 deletions
UPGRADING

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -342,6 +342,7 @@ PHP 8.4 UPGRADE NOTES
 a single entry.
 . New serial_hex parameter added to openssl_csr_sign to allow setting serial
 number in the hexadecimal format.
 . The OpenSSL extension now requires at least OpenSSL 1.1.1.

- Output:
 . Output handler status flags passed to the flags parameter of ob_start
Expand Down

2 changes: 1 addition & 1 deletion
build/php.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1821,7 +1821,7 @@ dnl
AC_DEFUN([PHP_SETUP_OPENSSL],[
 found_openssl=no

 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])

 if test "$found_openssl" = "yes"; then
 PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)
Expand Down

2 changes: 0 additions & 2 deletions
ext/ftp/ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
 return 0;
 }

#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
 ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
#endif
 SSL_CTX_set_options(ctx, ssl_ctx_options);

 /* Allow SSL to re-use sessions.
Expand Down

4 changes: 1 addition & 3 deletions
ext/ftp/php_ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {

PHP_MINIT_FUNCTION(ftp)
{
#ifdef HAVE_FTP_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
	SSL_library_init();
	OpenSSL_add_all_ciphers();
	OpenSSL_add_all_digests();
	OpenSSL_add_all_algorithms();

	SSL_load_error_strings();
#endif
#endif

	php_ftp_ce = register_class_FTP_Connection();
Expand Down

2 changes: 1 addition & 1 deletion
ext/openssl/config0.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
PHP_ARG_WITH([openssl],
 [for OpenSSL support],
 [AS_HELP_STRING([--with-openssl],
 [Include OpenSSL support (requires OpenSSL >= 1.0.2)])])
 [Include OpenSSL support (requires OpenSSL >= 1.1.1)])])

PHP_ARG_WITH([kerberos],
 [for Kerberos support],
Expand Down

14 changes: 5 additions & 9 deletions
ext/openssl/openssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,7 +61,7 @@
#include <openssl/param_build.h>
#endif

#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
#include <openssl/engine.h>
#endif

Expand DownExpand Up@@ -99,7 +99,7 @@
#define HAVE_EVP_PKEY_EC 1

/* the OPENSSL_EC_EXPLICIT_CURVE value was added
 * in OpenSSL 1.1.0; previous versions should
 * in OpenSSL 1.1.0; previous versions should
 * use 0 instead.
 */
#ifndef OPENSSL_EC_EXPLICIT_CURVE
Expand DownExpand Up@@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_openssl_pkey_object_handlers.clone_obj = NULL;
	php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	OPENSSL_config(NULL);
	SSL_library_init();
	OpenSSL_add_all_ciphers();
Expand DownExpand Up@@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
#endif

	/* override the default tcp socket provider */
	php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
Expand DownExpand Up@@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(openssl)
{
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	EVP_cleanup();

	/* prevent accessing locking callback from unloaded extension */
Expand All@@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
	php_stream_xport_unregister("tlsv1.0");
	php_stream_xport_unregister("tlsv1.1");
	php_stream_xport_unregister("tlsv1.2");
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_unregister("tlsv1.3");
#endif

	/* reinstate the default tcp handler */
	php_stream_xport_register("tcp", php_stream_generic_socket_factory);
Expand DownExpand Up@@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
 EVP_PKEY_CTX_free(ctx);
 ctx = EVP_PKEY_CTX_new(param_key, NULL);
	}

	if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
 *is_private = d != NULL;
 EVP_PKEY_up_ref(param_key);
Expand Down

6 changes: 2 additions & 4 deletions
ext/openssl/php_openssl.h

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
#define PHP_OPENSSL_VERSION PHP_VERSION

#include <openssl/opensslv.h>
#if defined(LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
/* LibreSSL version check */
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
#define PHP_OPENSSL_API_VERSION 0x10001
Expand All@@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
#endif
#else
/* OpenSSL version check */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define PHP_OPENSSL_API_VERSION 0x10002
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
#if OPENSSL_VERSION_NUMBER < 0x30000000L
#define PHP_OPENSSL_API_VERSION 0x10100
#else
#define PHP_OPENSSL_API_VERSION 0x30000
Expand Down

4 changes: 0 additions & 4 deletions
ext/openssl/tests/bug80747.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,10 +2,6 @@
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
--EXTENSIONS--
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
?>
--FILE--
<?php

Expand Down

3 changes: 1 addition & 2 deletions
ext/openssl/tests/openssl_error_string_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,8 +94,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
var_dump($error_queue_size);
echo "\n";

$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
$err_pem_no_start_line = '0909006C';

// PKEY
echo "PKEY errors\n";
Expand Down

3 changes: 0 additions & 3 deletions
ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,9 +4,6 @@ int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose [, array $cainfo
marcosptf - <marcosptf@yahoo.com.br>
--EXTENSIONS--
openssl
--SKIPIF--
<?php if (OPENSSL_VERSION_NUMBER < 0x10000000) die("skip Output requires OpenSSL 1.0");
?>
--FILE--
<?php
include 'CertificateGenerator.inc';
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/session_meta_capture_tlsv13.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_crypto_flags_003.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_security_level.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,7 +4,6 @@ security_level setting to prohibit cert
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
if (!function_exists("proc_open")) die("skip no proc_open");
?>
--FILE--
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tlsv1.3_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

8 changes: 2 additions & 6 deletions
ext/openssl/xp_ssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@
#define HAVE_TLS12 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(OPENSSL_NO_TLS1_3)
#ifndef OPENSSL_NO_TLS1_3
#define HAVE_TLS13 1
#endif

Expand All@@ -89,7 +89,7 @@
#define HAVE_TLS_ALPN 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
#ifndef LIBRESSL_VERSION_NUMBER
#define HAVE_SEC_LEVEL 1
#endif

Expand DownExpand Up@@ -676,11 +676,7 @@ static int php_openssl_win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx,
{
	PCCERT_CONTEXT cert_ctx = NULL;
	PCCERT_CHAIN_CONTEXT cert_chain_ctx = NULL;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
	X509 *cert = x509_store_ctx->cert;
#else
	X509 *cert = X509_STORE_CTX_get0_cert(x509_store_ctx);
#endif

	php_stream *stream;
	php_openssl_netstream_data_t *sslsock;
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-development

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -928,12 +928,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -942,6 +936,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-production

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -930,12 +930,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -944,6 +938,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
ext/openssl: Bump minimum openssl version to 1.1.1#8

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

Ayesh
wants to merge
1
commit into

from

 Closed


ext/openssl: Bump minimum openssl version to 1.1.1
#8
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


1 change: 1 addition & 0 deletions
NEWS

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,6 +94,7 @@ PHP NEWS
 Florian Sowade)
 . Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
 (Vincent Jardin)
 . Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)

- Output:
 . Clear output handler status flags during handler initialization. (haszi)
Expand Down

1 change: 1 addition & 0 deletions
UPGRADING

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -342,6 +342,7 @@ PHP 8.4 UPGRADE NOTES
 a single entry.
 . New serial_hex parameter added to openssl_csr_sign to allow setting serial
 number in the hexadecimal format.
 . The OpenSSL extension now requires at least OpenSSL 1.1.1.

- Output:
 . Output handler status flags passed to the flags parameter of ob_start
Expand Down

2 changes: 1 addition & 1 deletion
build/php.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -1821,7 +1821,7 @@ dnl
AC_DEFUN([PHP_SETUP_OPENSSL],[
 found_openssl=no

 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
 PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])

 if test "$found_openssl" = "yes"; then
 PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)
Expand Down

2 changes: 0 additions & 2 deletions
ext/ftp/ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
 return 0;
 }

#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
 ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
#endif
 SSL_CTX_set_options(ctx, ssl_ctx_options);

 /* Allow SSL to re-use sessions.
Expand Down

4 changes: 1 addition & 3 deletions
ext/ftp/php_ftp.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {

PHP_MINIT_FUNCTION(ftp)
{
#ifdef HAVE_FTP_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
	SSL_library_init();
	OpenSSL_add_all_ciphers();
	OpenSSL_add_all_digests();
	OpenSSL_add_all_algorithms();

	SSL_load_error_strings();
#endif
#endif

	php_ftp_ce = register_class_FTP_Connection();
Expand Down

2 changes: 1 addition & 1 deletion
ext/openssl/config0.m4

View file


Open in desktop

Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
PHP_ARG_WITH([openssl],
 [for OpenSSL support],
 [AS_HELP_STRING([--with-openssl],
 [Include OpenSSL support (requires OpenSSL >= 1.0.2)])])
 [Include OpenSSL support (requires OpenSSL >= 1.1.1)])])

PHP_ARG_WITH([kerberos],
 [for Kerberos support],
Expand Down

14 changes: 5 additions & 9 deletions
ext/openssl/openssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -61,7 +61,7 @@
#include <openssl/param_build.h>
#endif

#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
#include <openssl/engine.h>
#endif

Expand DownExpand Up@@ -99,7 +99,7 @@
#define HAVE_EVP_PKEY_EC 1

/* the OPENSSL_EC_EXPLICIT_CURVE value was added
 * in OpenSSL 1.1.0; previous versions should
 * in OpenSSL 1.1.0; previous versions should
 * use 0 instead.
 */
#ifndef OPENSSL_EC_EXPLICIT_CURVE
Expand DownExpand Up@@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_openssl_pkey_object_handlers.clone_obj = NULL;
	php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	OPENSSL_config(NULL);
	SSL_library_init();
	OpenSSL_add_all_ciphers();
Expand DownExpand Up@@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
	php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
	php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
#endif

	/* override the default tcp socket provider */
	php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
Expand DownExpand Up@@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(openssl)
{
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
	EVP_cleanup();

	/* prevent accessing locking callback from unloaded extension */
Expand All@@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
	php_stream_xport_unregister("tlsv1.0");
	php_stream_xport_unregister("tlsv1.1");
	php_stream_xport_unregister("tlsv1.2");
#if OPENSSL_VERSION_NUMBER >= 0x10101000
	php_stream_xport_unregister("tlsv1.3");
#endif

	/* reinstate the default tcp handler */
	php_stream_xport_register("tcp", php_stream_generic_socket_factory);
Expand DownExpand Up@@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
 EVP_PKEY_CTX_free(ctx);
 ctx = EVP_PKEY_CTX_new(param_key, NULL);
	}

	if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
 *is_private = d != NULL;
 EVP_PKEY_up_ref(param_key);
Expand Down

6 changes: 2 additions & 4 deletions
ext/openssl/php_openssl.h

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
#define PHP_OPENSSL_VERSION PHP_VERSION

#include <openssl/opensslv.h>
#if defined(LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
/* LibreSSL version check */
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
#define PHP_OPENSSL_API_VERSION 0x10001
Expand All@@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
#endif
#else
/* OpenSSL version check */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define PHP_OPENSSL_API_VERSION 0x10002
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
#if OPENSSL_VERSION_NUMBER < 0x30000000L
#define PHP_OPENSSL_API_VERSION 0x10100
#else
#define PHP_OPENSSL_API_VERSION 0x30000
Expand Down

4 changes: 0 additions & 4 deletions
ext/openssl/tests/bug80747.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,10 +2,6 @@
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
--EXTENSIONS--
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
?>
--FILE--
<?php

Expand Down

3 changes: 1 addition & 2 deletions
ext/openssl/tests/openssl_error_string_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -94,8 +94,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
var_dump($error_queue_size);
echo "\n";

$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
$err_pem_no_start_line = '0909006C';

// PKEY
echo "PKEY errors\n";
Expand Down

3 changes: 0 additions & 3 deletions
ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,9 +4,6 @@ int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose [, array $cainfo
marcosptf - <marcosptf@yahoo.com.br>
--EXTENSIONS--
openssl
--SKIPIF--
<?php if (OPENSSL_VERSION_NUMBER < 0x10000000) die("skip Output requires OpenSSL 1.0");
?>
--FILE--
<?php
include 'CertificateGenerator.inc';
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/session_meta_capture_tlsv13.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_crypto_flags_003.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/stream_security_level.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -4,7 +4,6 @@ security_level setting to prohibit cert
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
if (!function_exists("proc_open")) die("skip no proc_open");
?>
--FILE--
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

1 change: 0 additions & 1 deletion
ext/openssl/tests/tlsv1.3_wrapper.phpt

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down

8 changes: 2 additions & 6 deletions
ext/openssl/xp_ssl.c

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -76,7 +76,7 @@
#define HAVE_TLS12 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(OPENSSL_NO_TLS1_3)
#ifndef OPENSSL_NO_TLS1_3
#define HAVE_TLS13 1
#endif

Expand All@@ -89,7 +89,7 @@
#define HAVE_TLS_ALPN 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
#ifndef LIBRESSL_VERSION_NUMBER
#define HAVE_SEC_LEVEL 1
#endif

Expand DownExpand Up@@ -676,11 +676,7 @@ static int php_openssl_win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx,
{
	PCCERT_CONTEXT cert_ctx = NULL;
	PCCERT_CHAIN_CONTEXT cert_chain_ctx = NULL;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
	X509 *cert = x509_store_ctx->cert;
#else
	X509 *cert = X509_STORE_CTX_get0_cert(x509_store_ctx);
#endif

	php_stream *stream;
	php_openssl_netstream_data_t *sslsock;
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-development

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -928,12 +928,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -942,6 +936,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down

7 changes: 1 addition & 6 deletions
php.ini-production

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -930,12 +930,6 @@ default_socket_timeout = 60
; Be sure to appropriately set the extension_dir directive.
;
;extension=bz2

; The ldap extension must be before curl if OpenSSL 1.0.2 and OpenLDAP is used
; otherwise it results in segfault when unloading after using SASL.
; See https://github.com/php/php-src/issues/8620 for more info.
;extension=ldap

;extension=curl
;extension=ffi
;extension=ftp
Expand All@@ -944,6 +938,7 @@ default_socket_timeout = 60
;extension=gettext
;extension=gmp
;extension=intl
;extension=ldap
;extension=mbstring
;extension=exif ; Must be after mbstring as it depends on it
;extension=mysqli
Expand Down