Skip to content

Commit 719da60

Browse files
committed
Remove native SSL support in phar extension
SSL support in phar extension is enabled when the PHP openssl extension is loaded, so there isn't any reason to have a separate native SSL support in phar extension. This removes the PHAR_HAVE_OPENSSL preprocessor macro from the PHP configuration header and the configure option --enable-phar-native-ssl on Windows. Also, the static libeay32 is not present in Windows OpenSSL builds anymore. The duplicate COMPILE_DL_PHAR compile definition is also removed as is already automatically defined in win32/build/confutils.js by the EXTENSION() function. Supersedes and closes GH-14578
1 parent fefa7d8 commit 719da60

File tree

7 files changed

+14
-234
lines changed

7 files changed

+14
-234
lines changed

UPGRADING

+4
Original file line numberDiff line numberDiff line change
@@ -907,6 +907,10 @@ PHP 8.4 UPGRADE NOTES
907907
- PgSQL:
908908
. The pgsql extension now requires at least libpq 10.0.
909909

910+
- Phar:
911+
. Native SSL support in phar extension has been removed in favor of phar SSL
912+
support through the PHP openssl extension.
913+
910914
- Reflection:
911915
. The class constants are typed now.
912916

UPGRADING.INTERNALS

+2-1
Original file line numberDiff line numberDiff line change
@@ -119,6 +119,7 @@ PHP 8.4 INTERNALS UPGRADE NOTES
119119
- Symbol HAVE_LIBM has been removed.
120120
- Symbol HAVE_INET_ATON has been removed.
121121
- Symbol HAVE_SIGSETJMP has been removed.
122+
- Symbol PHAR_HAVE_OPENSSL has been removed.
122123
- The Zend/zend_istdiostream.h header has been removed.
123124

124125
b. Unix build system changes
@@ -213,7 +214,7 @@ PHP 8.4 INTERNALS UPGRADE NOTES
213214

214215
c. Windows build system changes
215216
- The configure options --with-oci8-11g, --with-oci8-12c, --with-oci8-19,
216-
--enable-apache2-2handler have been removed.
217+
--enable-apache2-2handler, --enable-phar-native-ssl have been removed.
217218
- The configure option --enable-apache2-4handler is now an alias for the
218219
preferred --enable-apache2handler.
219220
- Added Bison flag '-Wall' when generating lexer files as done in *nix build

ext/phar/config.m4

-9
Original file line numberDiff line numberDiff line change
@@ -19,15 +19,6 @@ if test "$PHP_PHAR" != "no"; then
1919
[$ext_shared],,
2020
[-DZEND_ENABLE_STATIC_TSRMLS_CACHE=1])
2121

22-
AC_MSG_CHECKING([for phar openssl support])
23-
AS_VAR_IF([PHP_OPENSSL_SHARED], [yes],
24-
[AC_MSG_RESULT([no (shared openssl)])],
25-
[AS_VAR_IF([PHP_OPENSSL], [yes], [
26-
AC_MSG_RESULT([yes])
27-
AC_DEFINE([PHAR_HAVE_OPENSSL], [1],
28-
[Define to 1 if phar extension has native OpenSSL support.])
29-
], [AC_MSG_RESULT([no])])])
30-
3122
PHP_ADD_EXTENSION_DEP(phar, hash)
3223
PHP_ADD_EXTENSION_DEP(phar, spl)
3324
PHP_ADD_MAKEFILE_FRAGMENT

ext/phar/config.w32

+1-30
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,10 @@
11
// vim:ft=javascript
22

33
ARG_ENABLE("phar", "disable phar support", "yes");
4-
ARG_ENABLE("phar-native-ssl", "enable phar with native OpenSSL support", "no");
5-
6-
if (PHP_PHAR_NATIVE_SSL != "no") {
7-
PHP_PHAR = PHP_PHAR_NATIVE_SSL;
8-
}
94

105
if (PHP_PHAR != "no") {
116
EXTENSION("phar", "dirstream.c func_interceptors.c phar.c phar_object.c phar_path_check.c stream.c tar.c util.c zip.c", PHP_PHAR_SHARED, "/DZEND_ENABLE_STATIC_TSRMLS_CACHE=1");
12-
if (PHP_PHAR_SHARED || (PHP_PHAR_NATIVE_SSL_SHARED && PHP_SNAPSHOT_BUILD == "no")) {
13-
ADD_FLAG("CFLAGS_PHAR", "/D COMPILE_DL_PHAR ");
14-
}
15-
if (PHP_PHAR_NATIVE_SSL != "no") {
16-
if (CHECK_LIB("libeay32st.lib", "phar")) {
17-
/* We don't really need GDI for this, but there's no
18-
way to avoid linking it in the static openssl build */
19-
ADD_FLAG("LIBS_PHAR", "libeay32st.lib gdi32.lib");
20-
if (PHP_DEBUG == "no") {
21-
/* Silence irrelevant-to-us warning in release builds */
22-
ADD_FLAG("LDFLAGS_PHAR", "/IGNORE:4089 ");
23-
}
24-
AC_DEFINE('PHAR_HAVE_OPENSSL', 1);
25-
STDOUT.WriteLine(' Native OpenSSL support in Phar enabled');
26-
} else {
27-
WARNING('Could not enable native OpenSSL support in Phar');
28-
}
29-
} else {
30-
if (PHP_OPENSSL != "no" && !PHP_OPENSSL_SHARED && !PHP_PHAR_SHARED) {
31-
AC_DEFINE('PHAR_HAVE_OPENSSL', 1);
32-
STDOUT.WriteLine(' Native OpenSSL support in Phar enabled');
33-
} else {
34-
STDOUT.WriteLine(' Native OpenSSL support in Phar disabled');
35-
}
36-
}
7+
378
ADD_EXTENSION_DEP('phar', 'hash');
389
ADD_EXTENSION_DEP('phar', 'spl');
3910
PHP_INSTALL_HEADERS("ext/phar", "php_phar.h");

ext/phar/phar.c

+2-4
Original file line numberDiff line numberDiff line change
@@ -3585,15 +3585,13 @@ PHP_MINFO_FUNCTION(phar) /* {{{ */
35853585
} else {
35863586
php_info_print_table_row(2, "bzip2 compression", "disabled (install ext/bz2)");
35873587
}
3588-
#ifdef PHAR_HAVE_OPENSSL
3589-
php_info_print_table_row(2, "Native OpenSSL support", "enabled");
3590-
#else
3588+
35913589
if (zend_hash_str_exists(&module_registry, "openssl", sizeof("openssl")-1)) {
35923590
php_info_print_table_row(2, "OpenSSL support", "enabled");
35933591
} else {
35943592
php_info_print_table_row(2, "OpenSSL support", "disabled (install ext/openssl)");
35953593
}
3596-
#endif
3594+
35973595
php_info_print_table_end();
35983596

35993597
php_info_print_box_start(0);

ext/phar/phar_object.c

+1-6
Original file line numberDiff line numberDiff line change
@@ -1255,17 +1255,12 @@ PHP_METHOD(Phar, getSupportedSignatures)
12551255
add_next_index_stringl(return_value, "SHA-1", 5);
12561256
add_next_index_stringl(return_value, "SHA-256", 7);
12571257
add_next_index_stringl(return_value, "SHA-512", 7);
1258-
#ifdef PHAR_HAVE_OPENSSL
1259-
add_next_index_stringl(return_value, "OpenSSL", 7);
1260-
add_next_index_stringl(return_value, "OpenSSL_SHA256", 14);
1261-
add_next_index_stringl(return_value, "OpenSSL_SHA512", 14);
1262-
#else
1258+
12631259
if (zend_hash_str_exists(&module_registry, "openssl", sizeof("openssl")-1)) {
12641260
add_next_index_stringl(return_value, "OpenSSL", 7);
12651261
add_next_index_stringl(return_value, "OpenSSL_SHA256", 14);
12661262
add_next_index_stringl(return_value, "OpenSSL_SHA512", 14);
12671263
}
1268-
#endif
12691264
}
12701265
/* }}} */
12711266

ext/phar/util.c

+4-184
Original file line numberDiff line numberDiff line change
@@ -24,21 +24,7 @@
2424
#include "ext/hash/php_hash_sha.h"
2525
#include "ext/standard/md5.h"
2626

27-
#ifdef PHAR_HAVE_OPENSSL
28-
/* OpenSSL includes */
29-
#include <openssl/evp.h>
30-
#include <openssl/x509.h>
31-
#include <openssl/x509v3.h>
32-
#include <openssl/crypto.h>
33-
#include <openssl/pem.h>
34-
#include <openssl/err.h>
35-
#include <openssl/conf.h>
36-
#include <openssl/rand.h>
37-
#include <openssl/ssl.h>
38-
#include <openssl/pkcs12.h>
39-
#else
4027
static int phar_call_openssl_signverify(int is_sign, php_stream *fp, zend_off_t end, char *key, size_t key_len, char **signature, size_t *signature_len, uint32_t sig_type);
41-
#endif
4228

4329
/* for links to relative location, prepend cwd of the entry */
4430
static char *phar_get_link_location(phar_entry_info *entry) /* {{{ */
@@ -1439,7 +1425,6 @@ static int phar_hex_str(const char *digest, size_t digest_len, char **signature)
14391425
}
14401426
/* }}} */
14411427

1442-
#ifndef PHAR_HAVE_OPENSSL
14431428
static int phar_call_openssl_signverify(int is_sign, php_stream *fp, zend_off_t end, char *key, size_t key_len, char **signature, size_t *signature_len, uint32_t sig_type) /* {{{ */
14441429
{
14451430
zend_fcall_info fci;
@@ -1538,7 +1523,6 @@ static int phar_call_openssl_signverify(int is_sign, php_stream *fp, zend_off_t
15381523
}
15391524
}
15401525
/* }}} */
1541-
#endif /* #ifndef PHAR_HAVE_OPENSSL */
15421526

15431527
zend_result phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t sig_type, char *sig, size_t sig_len, char *fname, char **signature, size_t *signature_len, char **error) /* {{{ */
15441528
{
@@ -1552,33 +1536,18 @@ zend_result phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t s
15521536
case PHAR_SIG_OPENSSL_SHA512:
15531537
case PHAR_SIG_OPENSSL_SHA256:
15541538
case PHAR_SIG_OPENSSL: {
1555-
#ifdef PHAR_HAVE_OPENSSL
1556-
BIO *in;
1557-
EVP_PKEY *key;
1558-
const EVP_MD *mdtype;
1559-
EVP_MD_CTX *md_ctx;
1560-
1561-
if (sig_type == PHAR_SIG_OPENSSL_SHA512) {
1562-
mdtype = EVP_sha512();
1563-
} else if (sig_type == PHAR_SIG_OPENSSL_SHA256) {
1564-
mdtype = EVP_sha256();
1565-
} else {
1566-
mdtype = EVP_sha1();
1567-
}
1568-
#else
15691539
size_t tempsig;
1570-
#endif
15711540
zend_string *pubkey = NULL;
15721541
char *pfile;
15731542
php_stream *pfp;
1574-
#ifndef PHAR_HAVE_OPENSSL
1543+
15751544
if (!zend_hash_str_exists(&module_registry, "openssl", sizeof("openssl")-1)) {
15761545
if (error) {
15771546
spprintf(error, 0, "openssl not loaded");
15781547
}
15791548
return FAILURE;
15801549
}
1581-
#endif
1550+
15821551
/* use __FILE__ . '.pubkey' for public key file */
15831552
spprintf(&pfile, 0, "%s.pubkey", fname);
15841553
pfp = php_stream_open_wrapper(pfile, "rb", 0, NULL);
@@ -1595,7 +1564,7 @@ zend_result phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t s
15951564
}
15961565

15971566
php_stream_close(pfp);
1598-
#ifndef PHAR_HAVE_OPENSSL
1567+
15991568
tempsig = sig_len;
16001569

16011570
if (FAILURE == phar_call_openssl_signverify(0, fp, end_of_phar, ZSTR_VAL(pubkey), ZSTR_LEN(pubkey), &sig, &tempsig, sig_type)) {
@@ -1611,76 +1580,6 @@ zend_result phar_verify_signature(php_stream *fp, size_t end_of_phar, uint32_t s
16111580
zend_string_release_ex(pubkey, 0);
16121581

16131582
sig_len = tempsig;
1614-
#else
1615-
in = BIO_new_mem_buf(ZSTR_VAL(pubkey), ZSTR_LEN(pubkey));
1616-
1617-
if (NULL == in) {
1618-
zend_string_release_ex(pubkey, 0);
1619-
if (error) {
1620-
spprintf(error, 0, "openssl signature could not be processed");
1621-
}
1622-
return FAILURE;
1623-
}
1624-
1625-
key = PEM_read_bio_PUBKEY(in, NULL, NULL, NULL);
1626-
BIO_free(in);
1627-
zend_string_release_ex(pubkey, 0);
1628-
1629-
if (NULL == key) {
1630-
if (error) {
1631-
spprintf(error, 0, "openssl signature could not be processed");
1632-
}
1633-
return FAILURE;
1634-
}
1635-
1636-
md_ctx = EVP_MD_CTX_create();
1637-
if (!md_ctx || !EVP_VerifyInit(md_ctx, mdtype)) {
1638-
if (md_ctx) {
1639-
EVP_MD_CTX_destroy(md_ctx);
1640-
}
1641-
if (error) {
1642-
spprintf(error, 0, "openssl signature could not be verified");
1643-
}
1644-
return FAILURE;
1645-
}
1646-
read_len = end_of_phar;
1647-
1648-
if ((size_t)read_len > sizeof(buf)) {
1649-
read_size = sizeof(buf);
1650-
} else {
1651-
read_size = (size_t)read_len;
1652-
}
1653-
1654-
php_stream_seek(fp, 0, SEEK_SET);
1655-
1656-
while (read_size && (len = php_stream_read(fp, (char*)buf, read_size)) > 0) {
1657-
if (UNEXPECTED(EVP_VerifyUpdate (md_ctx, buf, len) == 0)) {
1658-
goto failure;
1659-
}
1660-
read_len -= (zend_off_t)len;
1661-
1662-
if (read_len < read_size) {
1663-
read_size = (size_t)read_len;
1664-
}
1665-
}
1666-
1667-
if (EVP_VerifyFinal(md_ctx, (unsigned char *)sig, sig_len, key) != 1) {
1668-
failure:
1669-
/* 1: signature verified, 0: signature does not match, -1: failed signature operation */
1670-
EVP_PKEY_free(key);
1671-
EVP_MD_CTX_destroy(md_ctx);
1672-
1673-
if (error) {
1674-
spprintf(error, 0, "broken openssl signature");
1675-
}
1676-
1677-
return FAILURE;
1678-
}
1679-
1680-
EVP_PKEY_free(key);
1681-
EVP_MD_CTX_destroy(md_ctx);
1682-
#endif
1683-
16841583
*signature_len = phar_hex_str((const char*)sig, sig_len, signature);
16851584
}
16861585
break;
@@ -1904,85 +1803,6 @@ zend_result phar_create_signature(phar_archive_data *phar, php_stream *fp, char
19041803
case PHAR_SIG_OPENSSL_SHA256:
19051804
case PHAR_SIG_OPENSSL: {
19061805
unsigned char *sigbuf;
1907-
#ifdef PHAR_HAVE_OPENSSL
1908-
unsigned int siglen;
1909-
BIO *in;
1910-
EVP_PKEY *key;
1911-
EVP_MD_CTX *md_ctx;
1912-
const EVP_MD *mdtype;
1913-
1914-
if (phar->sig_flags == PHAR_SIG_OPENSSL_SHA512) {
1915-
mdtype = EVP_sha512();
1916-
} else if (phar->sig_flags == PHAR_SIG_OPENSSL_SHA256) {
1917-
mdtype = EVP_sha256();
1918-
} else {
1919-
mdtype = EVP_sha1();
1920-
}
1921-
1922-
in = BIO_new_mem_buf(PHAR_G(openssl_privatekey), PHAR_G(openssl_privatekey_len));
1923-
1924-
if (in == NULL) {
1925-
if (error) {
1926-
spprintf(error, 0, "unable to write to phar \"%s\" with requested openssl signature", phar->fname);
1927-
}
1928-
return FAILURE;
1929-
}
1930-
1931-
key = PEM_read_bio_PrivateKey(in, NULL,NULL, "");
1932-
BIO_free(in);
1933-
1934-
if (!key) {
1935-
if (error) {
1936-
spprintf(error, 0, "unable to process private key");
1937-
}
1938-
return FAILURE;
1939-
}
1940-
1941-
md_ctx = EVP_MD_CTX_create();
1942-
if (md_ctx == NULL) {
1943-
EVP_PKEY_free(key);
1944-
if (error) {
1945-
spprintf(error, 0, "unable to initialize openssl signature for phar \"%s\"", phar->fname);
1946-
}
1947-
return FAILURE;
1948-
}
1949-
1950-
siglen = EVP_PKEY_size(key);
1951-
sigbuf = emalloc(siglen + 1);
1952-
1953-
if (!EVP_SignInit(md_ctx, mdtype)) {
1954-
EVP_PKEY_free(key);
1955-
efree(sigbuf);
1956-
if (error) {
1957-
spprintf(error, 0, "unable to initialize openssl signature for phar \"%s\"", phar->fname);
1958-
}
1959-
return FAILURE;
1960-
}
1961-
1962-
while ((sig_len = php_stream_read(fp, (char*)buf, sizeof(buf))) > 0) {
1963-
if (!EVP_SignUpdate(md_ctx, buf, sig_len)) {
1964-
EVP_PKEY_free(key);
1965-
efree(sigbuf);
1966-
if (error) {
1967-
spprintf(error, 0, "unable to update the openssl signature for phar \"%s\"", phar->fname);
1968-
}
1969-
return FAILURE;
1970-
}
1971-
}
1972-
1973-
if (!EVP_SignFinal (md_ctx, sigbuf, &siglen, key)) {
1974-
EVP_PKEY_free(key);
1975-
efree(sigbuf);
1976-
if (error) {
1977-
spprintf(error, 0, "unable to write phar \"%s\" with requested openssl signature", phar->fname);
1978-
}
1979-
return FAILURE;
1980-
}
1981-
1982-
sigbuf[siglen] = '\0';
1983-
EVP_PKEY_free(key);
1984-
EVP_MD_CTX_destroy(md_ctx);
1985-
#else
19861806
size_t siglen;
19871807
sigbuf = NULL;
19881808
siglen = 0;
@@ -1994,7 +1814,7 @@ zend_result phar_create_signature(phar_archive_data *phar, php_stream *fp, char
19941814
}
19951815
return FAILURE;
19961816
}
1997-
#endif
1817+
19981818
*signature = (char *) sigbuf;
19991819
*signature_length = siglen;
20001820
}

0 commit comments

Comments
 (0)