RE: [PHP-DEV] Re: networking.c and fopen wrappers etc. (was RE: [ PHP-DEV] some IPv6 code added, compile problems anyone?) From: Wez Furlong (wez <email protected>)
Date: 09/07/00

> I think hostconnect should be more low level, so there should be some
> other code that determines whether to use UDP or TCP and then calls
> hostconnect.
>
> When using SSL, you could do
>
> s = php_hostconnect(.....);
> sbuf = php_sockcreate(s);
> if (sbuf) {
> ...
> sslret = SSL_connect(ssl);
> }
> right?

Yes, you could. But the "purist" in me would like to see an extra parameter
to php_hostconnect that allows you to choose which encryption/SSL protocol
you use.

But, this might not be appropriate if you want to allow a client cert to be
chosen, random seeds etc., so perhaps there should be a
php_hostconnect_ssl() call?

>
> > It would be nice to allow the user to verify certs etc. using
> the SSL API
> > just by passing the socket you get back from fsockopen as the "handle".
>
> You may also need something to select certs to use before doing
> SSL_new or? Don't know this so well.

It depends on how user-friendly we want to make the php interface. I have a
feeling that we need to hook in before the actual SSL_connect call to be
able to choose a client cert.

> > The nice thing about using OpenSSL is that it is very lightweight,
> > especially if your server is already using mod_ssl. (Although I
> haven't used
> > cURL, I have heard that it is a bit "heavy").
>
> You may be right. Using OpenSSL seems pretty simple actually.

The code in my patch comes from the cli.cpp example that was included in
OpenSSL; there is probably a lot more that could/should be done to ensure
better security.

Also, the code in the patch only works for SSL client connections, so a
little more work is required to get things in server mode. We could
generalize and go for the generic client/server mode I saw mentioned in the
header files.

> BTW, what about PRNG seeds? Don't you need to feed it some
> random data to get something secure?

I have to confess that I am not an OpenSSL expert. So, you might be right.

> > Anyway, I will leave it to you to look through and see how it
> fits into your
> > plans.
>
> Fits very well if what I write about hostconnect above is correct (:

Good.

If we go for a php_hostconnect_ssl call, it might look a bit like this:

typedef enum {
        PHPSSL_SSLV3 = 1, /* Use SSL V3 */
        PHPSSL_SSLV2 = 2, /* Use SSL V2 */
        PHPSSL_SSLV3V2 =3, /* Use SSL V3, if not possible, fall back on V2 */
        PHPSSL_TLSV1 = 4, /* Use TLS 1.0 */

        PHPSSL_SERVER = 0x7f /* if this bit is set in proto, assume a server
context */
} phpssl_proto;

int php_hostconnect_ssl(char * host, ushort port, int timeout, phpssl_proto
proto, char * certfile)
{
        sock = php_hostconnect(host, port, SOCK_STREAM, timeout);
        ... create SSL context ...
        ... randomize (if needed) ...
        ... load certfile and use it ...
        SSL_connect(...)
        ... hook for cert verification ? ...
        return sock
}

I'm going to read up a bit more on OpenSSL, to make sure I know what I am
talking about...

--Wez. 

-- 
PHP Development Mailing List <http://www.php.net/>
To unsubscribe, e-mail: php-dev-unsubscribe <email protected>
For additional commands, e-mail: php-dev-help <email protected>
To contact the list administrators, e-mail: php-list-admin <email protected>