ext/ftp: cryptic error on servers that don't support TLS session resumption on data connection

从 ext/ftp 中 ftp_nlist 的数据连接路径以及报告 TLS 会话错误的 data_accept 失败处开始。使用 PHP 8.5.9 示例重现问题，并检查警告是如何形成的；完成的标准是用户能够清楚地了解到不支持 TLS 会话恢复，同时不会在不安全的情况下静默继续。

Description

The following code:

<?php
$conn_id = ftp_ssl_connect($url);
$login_result = ftp_login($conn_id, $un, $pw);
ftp_set_option($conn_id, FTP_USEPASVADDRESS, false);
ftp_pasv($conn_id, true);

if (!$login_result) {
    die("can't login\n");
}
else{
    echo "logged in success\n";
    $buff = ftp_nlist($conn_id,'outbound');
    var_dump($buff);
}

Resulted in this output:

logged in success
Warning: ftp_nlist: data_accept: failed to retrieve the existing SSL session

But I expected this output instead:

logged in success
[nlist output]

TLS session resumption on the data connection is required for it to be secure. GH-12851 fixed that. However, some servers don't seem to support TLS session resumption. In this case, PHP seems to fail with a cryptic-to-the-user error message. However, other FTP clients like i.e. FileZilla will prompt the user with a message like:

This server does not support TLS session resumption on the data connection.
TLS session resumption on the data connection is an important security feature to protect against data connection stealing attacks.
If you continue, transferred files may be intercepted or their contents replaced by an attacker.

I don't know if we want to support opting out of the behaviour (and certainly not continue insecurely silently), but we should definitely provide a better warning here, so users know what's wrong and what to blame.

A user reached out to me for support because this was "working" in PHP 8.1 (insecurely. probably) but stopped working when they upgraded to PHP 8.5, and thought it was a PHP issue. They did try it under 8.2.12 (last version XAMPP shipped) and that worked, and that was prior to when that PR was merged. I'm asking the user to bisect 8.2.13 vs. 8.2.14 to confirm.

As for the problematic FTP server in question, it seems to be Axway SecureTransport as installed by a large logistics company. A little hard to test for ourselves, and a little hard to get them to fix it. I don't know if we can force i.e. vsftpd to disallow session resumption to test it.

PHP Version

PHP 8.5.9

Operating System

Windows Server 2019