ext/ftp: cryptic error on servers that don't support TLS session resumption on data connection
維護者通常 1 天內回覆
還沒有人認領這個 Issue。
評估
- 難度
- 4/5
- 預估耗時
- 3-5 天
- 新手友好度
- 52/100
- Issue 類型
- 缺陷
- 描述清晰度
- 基本清楚
- 活躍度
- 活躍
- 技術堆疊
- c
- 領域
- networking, security
研究方向
從 ext/ftp 中 ftp_nlist 的資料連線路徑以及回報 TLS 工作階段錯誤的 data_accept 失敗處開始。使用 PHP 8.5.9 範例重現問題，並檢查警告是如何形成的；完成的標準是使用者能清楚地了解不支援 TLS 工作階段恢復，同時不會在不安全的情況下靜默繼續。
由索引模型根據 Issue 內容生成。
描述
Description
The following code:
<?php
$conn_id = ftp_ssl_connect($url);
$login_result = ftp_login($conn_id, $un, $pw);
ftp_set_option($conn_id, FTP_USEPASVADDRESS, false);
ftp_pasv($conn_id, true);
if (!$login_result) {
die("can't login\n");
}
else{
echo "logged in success\n";
$buff = ftp_nlist($conn_id,'outbound');
var_dump($buff);
}
Resulted in this output:
logged in success
Warning: ftp_nlist: data_accept: failed to retrieve the existing SSL session
But I expected this output instead:
logged in success
[nlist output]
TLS session resumption on the data connection is required for it to be secure. GH-12851 fixed that. However, some servers don't seem to support TLS session resumption. In this case, PHP seems to fail with a cryptic-to-the-user error message. However, other FTP clients like i.e. FileZilla will prompt the user with a message like:
This server does not support TLS session resumption on the data connection.
TLS session resumption on the data connection is an important security feature to protect against data connection stealing attacks.
If you continue, transferred files may be intercepted or their contents replaced by an attacker.
I don't know if we want to support opting out of the behaviour (and certainly not continue insecurely silently), but we should definitely provide a better warning here, so users know what's wrong and what to blame.
A user reached out to me for support because this was "working" in PHP 8.1 (insecurely. probably) but stopped working when they upgraded to PHP 8.5, and thought it was a PHP issue. They did try it under 8.2.12 (last version XAMPP shipped) and that worked, and that was prior to when that PR was merged. I'm asking the user to bisect 8.2.13 vs. 8.2.14 to confirm.
As for the problematic FTP server in question, it seems to be Axway SecureTransport as installed by a large logistics company. A little hard to test for ourselves, and a little hard to get them to fix it. I don't know if we can force i.e. vsftpd to disallow session resumption to test it.
PHP Version
PHP 8.5.9
Operating System
Windows Server 2019
- 主要語言
- C
- 星號
- 40.4k
- 分支
- 8.2k
- 平均合併
- 2 天 9 小時
- 30 天內合併 PR
- 122
環境準備
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
php/php-src 的其他 Issue
-
難度 2/5 1-3 小時 新手友好度 72/100
維護者通常 1 天內回覆
-
Bug Status: Needs Triage
難度 2/5 1-3 小時 新手友好度 76/100
維護者通常 1 天內回覆
-
Bug Status: Needs Triage
難度 1/5 1 小時以內 新手友好度 90/100
維護者通常 1 天內回覆
-
Bug Status: Needs Triage
難度 2/5 1-3 小時 新手友好度 78/100
維護者通常 1 天內回覆
-
Bug Category: Tests Status: Verified
難度 2/5 1-3 小時 新手友好度 68/100
維護者通常 1 天內回覆
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 90/100
BasedHardware/omi#19711 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 85/100
microsoft/ebpf-for-windows#5604 ·
維護者通常 3 天內回覆
-
難度 2/5 1-3 小時 新手友好度 68/100
trezor/trezor-firmware#7985 ·
維護者通常 2 天內回覆
-
難度 2/5 1-3 小時 新手友好度 84/100
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 70/100
維護者通常 2 天內回覆