-
Notifications
You must be signed in to change notification settings - Fork 7.9k
Introduce OpenSSL INI for selecting libctx #18768
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: master
Are you sure you want to change the base?
Conversation
#if PHP_OPENSSL_API_VERSION >= 0x30000 | ||
const char *name = ZSTR_VAL(new_value); | ||
|
||
if (!strcmp(name, "default")) { | ||
OPENSSL_G(ctx).libctx = OPENSSL_G(ctx).default_libctx; | ||
} else if (!strcmp(name, "custom")) { | ||
OPENSSL_G(ctx).libctx = OPENSSL_G(ctx).custom_libctx; | ||
} else { | ||
int err_type; | ||
if (stage == ZEND_INI_STAGE_RUNTIME) { | ||
err_type = E_WARNING; | ||
} else { | ||
err_type = E_ERROR; | ||
} | ||
|
||
/* Do not output error when restoring ini options. */ | ||
if (stage != ZEND_INI_STAGE_DEACTIVATE) { | ||
php_error_docref(NULL, err_type, "OpenSSL libctx \"%s\" cannot be found", name); | ||
} | ||
return FAILURE; | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You can just use the zend_string APIs which are clearer, and can also do some pointer comparisons if the strings are interned for any reason.
#if PHP_OPENSSL_API_VERSION >= 0x30000 | |
const char *name = ZSTR_VAL(new_value); | |
if (!strcmp(name, "default")) { | |
OPENSSL_G(ctx).libctx = OPENSSL_G(ctx).default_libctx; | |
} else if (!strcmp(name, "custom")) { | |
OPENSSL_G(ctx).libctx = OPENSSL_G(ctx).custom_libctx; | |
} else { | |
int err_type; | |
if (stage == ZEND_INI_STAGE_RUNTIME) { | |
err_type = E_WARNING; | |
} else { | |
err_type = E_ERROR; | |
} | |
/* Do not output error when restoring ini options. */ | |
if (stage != ZEND_INI_STAGE_DEACTIVATE) { | |
php_error_docref(NULL, err_type, "OpenSSL libctx \"%s\" cannot be found", name); | |
} | |
return FAILURE; | |
} | |
#if PHP_OPENSSL_API_VERSION >= 0x30000 | |
if (zend_string_equals(new_value, "default")) { | |
OPENSSL_G(ctx).libctx = OPENSSL_G(ctx).default_libctx; | |
} else if (zend_string_equals(new_value, "custom")) { | |
OPENSSL_G(ctx).libctx = OPENSSL_G(ctx).custom_libctx; | |
} else { | |
int err_type; | |
if (stage == ZEND_INI_STAGE_RUNTIME) { | |
err_type = E_WARNING; | |
} else { | |
err_type = E_ERROR; | |
} | |
/* Do not output error when restoring ini options. */ | |
if (stage != ZEND_INI_STAGE_DEACTIVATE) { | |
php_error_docref(NULL, err_type, "OpenSSL libctx \"%s\" cannot be found", ZSTR_VAL(new_value)); | |
} | |
return FAILURE; | |
} |
} else if (!strcmp(name, "custom")) { | ||
OPENSSL_G(ctx).libctx = OPENSSL_G(ctx).custom_libctx; | ||
} else { | ||
int err_type; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is this used only when stage != ZEND_INI_STAGE_DEACTIVATE
?
This introduces a new INI that will allow fallback to default ctx. The plan is to actually initially use custom libctx only on ZTS by default and keep the default one for non-zts. The reason why it's not done in this PR is to allow CI to test the custom libctx.
In addition custom libctx now loads the config and also legacy provider if
LOAD_OPENSSL_LEGACY_PROVIDER
defined.There's been some minor init / globals refactoring done as well.