ext/ftp: cryptic error on servers that don't support TLS session resumption on data connection

Empieza en ext/ftp, en la ruta de conexión de datos de ftp_nlist y en el fallo de data_accept que informa del error de la sesión TLS. Reproduce el problema con el ejemplo de PHP 8.5.9 e inspecciona cómo se forma la advertencia; el trabajo estará terminado cuando los usuarios reciban una explicación clara de que la reanudación de la sesión TLS no es compatible, sin continuar silenciosamente de forma insegura.

Description

The following code:

<?php
$conn_id = ftp_ssl_connect($url);
$login_result = ftp_login($conn_id, $un, $pw);
ftp_set_option($conn_id, FTP_USEPASVADDRESS, false);
ftp_pasv($conn_id, true);

if (!$login_result) {
    die("can't login\n");
}
else{
    echo "logged in success\n";
    $buff = ftp_nlist($conn_id,'outbound');
    var_dump($buff);
}

Resulted in this output:

logged in success
Warning: ftp_nlist: data_accept: failed to retrieve the existing SSL session

But I expected this output instead:

logged in success
[nlist output]

TLS session resumption on the data connection is required for it to be secure. GH-12851 fixed that. However, some servers don't seem to support TLS session resumption. In this case, PHP seems to fail with a cryptic-to-the-user error message. However, other FTP clients like i.e. FileZilla will prompt the user with a message like:

This server does not support TLS session resumption on the data connection.
TLS session resumption on the data connection is an important security feature to protect against data connection stealing attacks.
If you continue, transferred files may be intercepted or their contents replaced by an attacker.

I don't know if we want to support opting out of the behaviour (and certainly not continue insecurely silently), but we should definitely provide a better warning here, so users know what's wrong and what to blame.

A user reached out to me for support because this was "working" in PHP 8.1 (insecurely. probably) but stopped working when they upgraded to PHP 8.5, and thought it was a PHP issue. They did try it under 8.2.12 (last version XAMPP shipped) and that worked, and that was prior to when that PR was merged. I'm asking the user to bisect 8.2.13 vs. 8.2.14 to confirm.

As for the problematic FTP server in question, it seems to be Axway SecureTransport as installed by a large logistics company. A little hard to test for ourselves, and a little hard to get them to fix it. I don't know if we can force i.e. vsftpd to disallow session resumption to test it.

PHP Version

PHP 8.5.9

Operating System

Windows Server 2019