Implement GH-13514 PASSWORD_ARGON2 from OpenSSL 3.2

ext/openssl/config0.m4

@@ -17,8 +17,15 @@ PHP_ARG_WITH([openssl-legacy-provider],
   [no],
   [no])
 
+PHP_ARG_WITH([openssl-argon2],
+  [whether to enable argon2 password hashing (requires OpenSSL >= 3.2)],
+  [AS_HELP_STRING([--with-openssl-argon2],
+    [OPENSSL: Enable argon2 password hashing])],
+  [no],
+  [no])
+
 if test "$PHP_OPENSSL" != "no"; then
-  PHP_NEW_EXTENSION([openssl], [openssl.c xp_ssl.c], [$ext_shared])
+  PHP_NEW_EXTENSION([openssl], [openssl.c openssl_pwhash.c xp_ssl.c], [$ext_shared])
   PHP_SUBST([OPENSSL_SHARED_LIBADD])
   PHP_SETUP_OPENSSL([OPENSSL_SHARED_LIBADD],
     [AC_DEFINE([HAVE_OPENSSL_EXT], [1],
@@ -38,4 +45,14 @@ if test "$PHP_OPENSSL" != "no"; then
     [AC_DEFINE([LOAD_OPENSSL_LEGACY_PROVIDER], [1],
       [Define to 1 to load the OpenSSL legacy algorithm provider in addition to
       the default provider.])])
+
+  if test "$PHP_OPENSSL_ARGON2" != "no"; then
+    if test "$PHP_THREAD_SAFETY" != "no"; then
+      AC_MSG_ERROR([Not supported in ZTS mode for now])
+    fi
+    PHP_CHECK_LIBRARY([crypto], [OSSL_set_max_threads],
+      [AC_DEFINE([HAVE_OPENSSL_ARGON2], [1], [ Define to 1 to enable argon2 password hashing ])],
+      [AC_MSG_ERROR([argon2 hashing requires OpenSSL 3.2])],
+      [$OPENSSL_LIBS])
+  fi
 fi

ext/openssl/openssl.c

@@ -270,9 +270,20 @@ static void php_openssl_pkey_free_obj(zend_object *object)
 	zend_object_std_dtor(&key_object->std);
 }
 
+#if defined(HAVE_OPENSSL_ARGON2)
+static const zend_module_dep openssl_deps[] = {
+	ZEND_MOD_REQUIRED("standard")
+	ZEND_MOD_END
+};
+#endif
 /* {{{ openssl_module_entry */
 zend_module_entry openssl_module_entry = {
+#if defined(HAVE_OPENSSL_ARGON2)
+	STANDARD_MODULE_HEADER_EX, NULL,
+	openssl_deps,
+#else
 	STANDARD_MODULE_HEADER,
+#endif
 	"openssl",
 	ext_functions,
 	PHP_MINIT(openssl),
@@ -1330,6 +1341,12 @@ PHP_MINIT_FUNCTION(openssl)
 
 	REGISTER_INI_ENTRIES();
 
+#if defined(HAVE_OPENSSL_ARGON2)
+	if (FAILURE == PHP_MINIT(openssl_pwhash)(INIT_FUNC_ARGS_PASSTHRU)) {
+		return FAILURE;
+	}
+#endif
+
 	return SUCCESS;
 }
 /* }}} */

ext/openssl/openssl.stub.php

@@ -678,3 +678,8 @@ function openssl_spki_export_challenge(string $spki): string|false {}
  * @refcount 1
  */
 function openssl_get_cert_locations(): array {}
+
+#if defined(HAVE_OPENSSL_ARGON2)
+function openssl_password_hash(string $algo, #[\SensitiveParameter] string $password, array $options = []): string {}
+function openssl_password_verify(string $algo, #[\SensitiveParameter] string $password, string $hash): bool {}
+#endif