Skip to content

Commit fa04956

Browse files
AyeshAyesh
committed
ext/openssl: Bump minimum required OpenSSL version to 1.1.1
Bumps the minimum required OpenSSL version from 1.0.2 to 1.1.1. OpenSSL 1.1.1 is an LTS release, but has reached[^1] EOL from upstream. However, Linux distro/OS vendors continue to ship OpenSSL 1.1.1, so 1.1.1 was picked as the minimum. The current minimum 1.0.2 reached EOL in 2018. Bumping the minimum required OpenSSL version makes it possible for ext-openssl to remove a bunch of conditional code, and assume that TLS 1.3 (shipped with OpenSSL 1.1.1) will be supported everywhere. - Debian buster: 1.1.1[^2] - Ubuntu 20.04: 1.1.1[^3] - CentOS/RHEL 7: 1.0.2 - RHEL 8/Rocky 8/EL 8: 1.1.1 - Fedora 38: 3.0.9 (`openssl11` provides OpenSSL 1.1 as well) RHEL/CentOS 7 reaches EOL mid 2024, so for PHP 8.4 scheduled towards the end of this year, we can safely bump the minimum OpenSSL version. [^1]: https://www.openssl.org/blog/blog/2023/03/28/1.1.1-EOL/index.html [^2]: https://packages.debian.org/buster/libssl-dev [^3]: https://packages.ubuntu.com/focal/libssl-dev
1 parent 5b7d458 commit fa04956

20 files changed

+19
-53
lines changed

‎NEWS

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,6 +110,7 @@ PHP NEWS
110110
Florian Sowade)
111111
. Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
112112
(Vincent Jardin)
113+
. Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)
113114

114115
- Output:
115116
. Clear output handler status flags during handler initialization. (haszi)

‎UPGRADING

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -494,6 +494,9 @@ PHP 8.4 UPGRADE NOTES
494494
- Intl:
495495
. The class constants are typed now.
496496

497+
- Intl:
498+
. The OpenSSL extension now requires at least OpenSSL 1.1.1.
499+
497500
- PDO:
498501
. The class constants are typed now.
499502

‎build/php.m4

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1817,7 +1817,7 @@ dnl
18171817
AC_DEFUN([PHP_SETUP_OPENSSL],[
18181818
found_openssl=no
18191819
1820-
PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
1820+
PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])
18211821
18221822
if test "$found_openssl" = "yes"; then
18231823
PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)

‎ext/ftp/ftp.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
293293
return 0;
294294
}
295295

296-
#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
297296
ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
298-
#endif
299297
SSL_CTX_set_options(ctx, ssl_ctx_options);
300298

301299
/* Allow SSL to re-use sessions.

‎ext/ftp/php_ftp.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {
9999

100100
PHP_MINIT_FUNCTION(ftp)
101101
{
102-
#ifdef HAVE_FTP_SSL
103-
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
102+
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
104103
SSL_library_init();
105104
OpenSSL_add_all_ciphers();
106105
OpenSSL_add_all_digests();
107106
OpenSSL_add_all_algorithms();
108107

109108
SSL_load_error_strings();
110-
#endif
111109
#endif
112110

113111
php_ftp_ce = register_class_FTP_Connection();

‎ext/openssl/config0.m4

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
PHP_ARG_WITH([openssl],
22
[for OpenSSL support],
33
[AS_HELP_STRING([--with-openssl],
4-
[Include OpenSSL support (requires OpenSSL >= 1.0.2)])])
4+
[Include OpenSSL support (requires OpenSSL >= 1.1.1)])])
55

66
PHP_ARG_WITH([kerberos],
77
[for Kerberos support],

‎ext/openssl/openssl.c

Lines changed: 5 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@
6161
#include <openssl/param_build.h>
6262
#endif
6363

64-
#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
64+
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
6565
#include <openssl/engine.h>
6666
#endif
6767

@@ -99,7 +99,7 @@
9999
#define HAVE_EVP_PKEY_EC 1
100100

101101
/* the OPENSSL_EC_EXPLICIT_CURVE value was added
102-
* in OpenSSL 1.1.0; previous versions should
102+
* in OpenSSL 1.1.0; previous versions should
103103
* use 0 instead.
104104
*/
105105
#ifndef OPENSSL_EC_EXPLICIT_CURVE
@@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
12691269
php_openssl_pkey_object_handlers.clone_obj = NULL;
12701270
php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;
12711271

1272-
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
1272+
#ifdef LIBRESSL_VERSION_NUMBER
12731273
OPENSSL_config(NULL);
12741274
SSL_library_init();
12751275
OpenSSL_add_all_ciphers();
@@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
13091309
php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
13101310
php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
13111311
php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
1312-
#if OPENSSL_VERSION_NUMBER >= 0x10101000
13131312
php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
1314-
#endif
13151313

13161314
/* override the default tcp socket provider */
13171315
php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
@@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
13641362
/* {{{ PHP_MSHUTDOWN_FUNCTION */
13651363
PHP_MSHUTDOWN_FUNCTION(openssl)
13661364
{
1367-
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
1365+
#ifdef LIBRESSL_VERSION_NUMBER
13681366
EVP_cleanup();
13691367

13701368
/* prevent accessing locking callback from unloaded extension */
@@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
13911389
php_stream_xport_unregister("tlsv1.0");
13921390
php_stream_xport_unregister("tlsv1.1");
13931391
php_stream_xport_unregister("tlsv1.2");
1394-
#if OPENSSL_VERSION_NUMBER >= 0x10101000
13951392
php_stream_xport_unregister("tlsv1.3");
1396-
#endif
13971393

13981394
/* reinstate the default tcp handler */
13991395
php_stream_xport_register("tcp", php_stream_generic_socket_factory);
@@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
46094605
EVP_PKEY_CTX_free(ctx);
46104606
ctx = EVP_PKEY_CTX_new(param_key, NULL);
46114607
}
4612-
4608+
46134609
if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
46144610
*is_private = d != NULL;
46154611
EVP_PKEY_up_ref(param_key);

‎ext/openssl/php_openssl.h

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
2626
#define PHP_OPENSSL_VERSION PHP_VERSION
2727

2828
#include <openssl/opensslv.h>
29-
#if defined(LIBRESSL_VERSION_NUMBER)
29+
#ifdef LIBRESSL_VERSION_NUMBER
3030
/* LibreSSL version check */
3131
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
3232
#define PHP_OPENSSL_API_VERSION 0x10001
@@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
3535
#endif
3636
#else
3737
/* OpenSSL version check */
38-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
39-
#define PHP_OPENSSL_API_VERSION 0x10002
40-
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
38+
#if OPENSSL_VERSION_NUMBER < 0x30000000L
4139
#define PHP_OPENSSL_API_VERSION 0x10100
4240
#else
4341
#define PHP_OPENSSL_API_VERSION 0x30000

‎ext/openssl/tests/bug80747.phpt

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,6 @@
22
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
33
--EXTENSIONS--
44
openssl
5-
--SKIPIF--
6-
<?php
7-
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
8-
?>
95
--FILE--
106
<?php
117

‎ext/openssl/tests/openssl_error_string_basic.phpt

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,8 +95,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
9595
var_dump($error_queue_size);
9696
echo "\n";
9797

98-
$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
99-
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
98+
$err_pem_no_start_line = '0909006C';
10099

101100
// PKEY
102101
echo "PKEY errors\n";

0 commit comments

Comments
 (0)