[Patch v2] Added tls 1.3 support for PHP #3700
Conversation
|
Look good, just one small NIT. Will try to test it during the week. P.S. you don't need to create a new PR next time - just squashing (or commit amend for the NIT fix) and then push force should be ok ;) |
codarrenvelvindron
force-pushed
the
master
branch
from
e8b3722 to
741ff7a
Compare
|
@bukka : Done. Thanks for the tip ! :) |
| @@ -171,6 +171,7 @@ typedef enum { | |||
| STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT = (1 << 3 | 1), | |||
| STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT = (1 << 4 | 1), | |||
| STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT = (1 << 5 | 1), | |||
| STREAM_CRYPTO_METHOD_TLSv1_3_CLIENT = (1 << 6 | 1), | |||
| /* TLS equates to TLS_ANY as of PHP 7.2 */ | |||
| STREAM_CRYPTO_METHOD_TLS_CLIENT = ((1 << 3) | (1 << 4) | (1 << 5) | 1), | |||
| STREAM_CRYPTO_METHOD_TLS_ANY_CLIENT = ((1 << 3) | (1 << 4) | (1 << 5) | 1), | |||
There was a problem hiding this comment.
These generic constants for any version need to include TLS v1.3, too.
There was a problem hiding this comment.
I have requested not to touch those as I don't want to negotiate 1.3 by default. It could break the existing clients so I would like to not do it at least for PHP 7.4. I think we could change that in PHP 8 though.
There was a problem hiding this comment.
Why not? Significant work has been put into TLS 1.3 to avoid breaking with broken TLS 1.2 implementations.
If you want to avoid TLS 1.3 by default, please update the default wrapper, but these constants specifically are for ANY TLS version, so the patch should reflect that.
|
Seems like there's a bug in |
This only simplifies some of unneeded assignments for legacy PHP versions and should not affect usage otherwise. TLS 1.3 is implicitly available despite being omitted in this assignment. The required crypto flag is likely going to be added in PHP 7.2.x in the future via php/php-src#3700 and should thus be covered by the main crypto method constant in the future already. Due to the way how PHP interfaces with OpenSSL, this means that TLS 1.3 is in fact already enabled by default when using a recent OpenSSL version for all client and server connections even for older PHP versions.
This only simplifies some of unneeded assignments for legacy PHP versions and should not affect usage otherwise. TLS 1.3 is implicitly available despite being omitted in this assignment. The required crypto flag is likely going to be added in PHP 7.2.x in the future via php/php-src#3700 and should thus be covered by the main crypto method constant in the future already. Due to the way how PHP interfaces with OpenSSL, this means that TLS 1.3 is in fact already enabled by default when using a recent OpenSSL version for all client and server connections even for older PHP versions.
|
This is a much desired feature to improve ssl performance. Just curious what the hold up is? |
|
I plan to do some testing in the next weeks and then would like to merge it to 7.3 if @cmb69 is fine with that? It's a self-contained feature and it also allows to use TLS 1.3 in PHP 7.3. The thing is that 7.2 will negotiate TLS 1.3 with OpenSSL 1.1.1 (it's not on purpose but it's how it works in 7.2 and lower versions). So it would be useful to have an options to explicitly allow it in 7.3 as it's the first version with pre-set max version which is a bit safer (at least for non-blocking use) when migrating from OpenSSL before 1.1.1. |
Yes. :) |
|
Happy to see some action in this long awaited feature again! 👍 I'm trying to understand the rationale for why
I agree that this would lead us to this awkward situation where PHP 7.2 supports TLS 1.3 and PHP 7.3 doesn't by default. See also the above discussion, what exactly is gained by not including TLS 1.3 in the default methods? On top of this, are there any plans to change this default constant in the future to also include TLS 1.3 by default in PHP 7.x again and perhaps if so, what needs to change for this to happen? |
|
Even if we don't make it the default, it should be in the constant as previously mentioned. |
|
@bukka Not updating the constants works actively against the voting in https://wiki.php.net/rfc/improved-tls-constants.
@codarrenvelvindron Could you please change your PR and update the constants? |
- add support for following secure options: tls-versions, tls-ciphersuites, ssl-ciphers - improve parsing Uri (e.g. previously in some cases ssl-mode has to always be in front of other secure options) - improve error messages - support trying open secure connections in loop for various TLS versions - still waiting for patches related to TLSv1.3 support in PHP: php/php-src#3650 php/php-src#3700 php/php-src#3909
Compiled/Tested php with openssl 1.1.1/1.1.0 official
This is a clean version of original(in sync with current) with all changes made according to review by @bukka :
Original: #3650
Ran make tests - OK
Work done during IETF 103 hackathon
~ codarren at cyberstorm.mu ~