ext/openssl: 8.2.31+/8.3.31+ fail to build against OpenSSL 1.0.2 (ASN1_STRING_get0_data in xp_ssl.c)
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 79/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Domain
- backend, build-system
Research direction
Read ext/openssl/xp_ssl.c around php_openssl_matches_san_list() and compare the OpenSSL compatibility fallback in ext/openssl/openssl.c. Reproduce the build with PHP 8.3.36 and OpenSSL 1.0.2, then verify it builds and IP SAN matching still works. Done means the affected PHP 8.2 and 8.3 branches compile against OpenSSL 1.0.2 without breaking newer OpenSSL builds.
Written by the indexing model from the issue text.
Description
Description
PHP 8.2.31+ and 8.3.31+ no longer compile against OpenSSL 1.0.2, though both branches still accept it (ext/openssl/config0.m4: "requires OpenSSL >= 1.0.2").
To reproduce, build PHP 8.3.36 (or any 8.3.31+ or 8.2.31+) --with-openssl against OpenSSL 1.0.2, e.g. on CentOS 7 (OpenSSL 1.0.2k, gcc 4.8.5).
Resulted in this output:
ext/openssl/xp_ssl.c: In function 'php_openssl_matches_san_list':
ext/openssl/xp_ssl.c:506:6: warning: implicit declaration of function 'ASN1_STRING_get0_data' [-Wimplicit-function-declaration]
ASN1_STRING_get0_data(san->d.iPAddress)[0],
^
ext/openssl/xp_ssl.c:506:45: error: subscripted value is neither array nor pointer nor vector
ASN1_STRING_get0_data(san->d.iPAddress)[0],
^
ext/openssl/xp_ssl.c:507:45: error: subscripted value is neither array nor pointer nor vector
ext/openssl/xp_ssl.c:508:45: error: subscripted value is neither array nor pointer nor vector
ext/openssl/xp_ssl.c:509:45: error: subscripted value is neither array nor pointer nor vector
ext/openssl/xp_ssl.c:138:10: error: subscripted value is neither array nor pointer nor vector
_bytes[0] << 8 | _bytes[1], \
But I expected the build to succeed, as it does with 8.3.30 / 8.2.30 against the same OpenSSL.
Cause: 19255f4b78 ("Backport compatibility changes for OpenSSL 4.0") changed the IP SAN code in php_openssl_matches_san_list() from san->d.iPAddress->data to ASN1_STRING_get0_data(san->d.iPAddress). ASN1_STRING_get0_data() was added in OpenSSL 1.1.0. ext/openssl/openssl.c already defines a fallback for it under #if PHP_OPENSSL_API_VERSION < 0x10100 (return M_ASN1_STRING_data(asn1);), but that is static to openssl.c, and xp_ssl.c has no equivalent. (ASN1_STRING_length(), used in the same change, does exist in 1.0.2.) PHP-8.2 and PHP-8.3 HEAD are both still affected. 8.4+ requires OpenSSL >= 1.1.1, so it is not.
Suggested fix: the same fallback in xp_ssl.c, under the same guard (it compiles away on 1.1.0+):
--- a/ext/openssl/xp_ssl.c
+++ b/ext/openssl/xp_ssl.c
@@ -36,6 +36,10 @@
#include <openssl/bn.h>
#include <openssl/dh.h>
+#if PHP_OPENSSL_API_VERSION < 0x10100
+# define ASN1_STRING_get0_data(asn1) ((const unsigned char *)M_ASN1_STRING_data(asn1))
+#endif
+
#ifdef PHP_WIN32
#include "win32/winutil.h"
#include "win32/time.h"
With that applied, 8.3.36 builds on CentOS 7 against OpenSSL 1.0.2k. A verified TLS connection to a server whose certificate's only SAN is IP:127.0.0.1 succeeds, and the same connection with a peer_name the certificate doesn't cover is refused, so the IP SAN matching works. Alternatively, the fallback could move to php_openssl.h so both files share it.
PHP Version
PHP 8.3.36 (fails to build against OpenSSL 1.0.2; first affected: 8.3.31 and 8.2.31)
Operating System
CentOS 7 (OpenSSL 1.0.2k)
- Dominant language
- C
- Stars
- 41.8k
- Forks
- 8.5k
- Avg merge
- 2d 13h
- Merged PRs (30d)
- 145
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from php/php-src
-
Bug Status: Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
php/php-src#25397 · 1 comment ·
Maintainers usually reply within 1 day
-
SNMP accepts malformed remote portsPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 Half a day Newbie friendliness 62/100
php/php-src#25137 · 1 comment ·
Maintainers usually reply within 1 day
-
Bug Status: Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
Maintainers usually reply within 1 day
-
quoted_printable_encode() produces lines longer than 76 characters for bytes 0xF5 to 0xFFPossibly taken A pull request linked to this issue is open or already merged. Open
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
Maintainers usually reply within 1 day
-
Bug Status: Needs Triage
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
php/php-src#24196 · 1 comment ·
Maintainers usually reply within 1 day
Similar issues
-
Ship /Local/Applications, the Local domain's Applications folderPossibly taken @pkgdemon claimed this today. Openarea:base enhancement
Difficulty 1/5 Under an hour Newbie friendliness 94/100
nextbsd/nextbsd-userland#612 ·
Maintainers usually reply within 1 day
-
good first issue needs-triage
Difficulty 1/5 Under an hour Newbie friendliness 88/100
InauguralSystems/EigenScript#2347 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
colbymchenry/codegraph#3277 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
not for AI lovers
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
OSGeo/gdal#15515 · 1 comment ·
Maintainers usually reply within 1 day