Skip to content

Commit c1d2875

Browse files
StephenWallbukka
StephenWall
authored and
bukka
committed
Implement phpGH-20310: No critical extension indication in openssl_x509_parse() output
This add criticalExtensions field to openssl_x509_parse() output that provides name of all critical extensions. Closes php#20310 Closes php#20311
1 parent b391c28 commit c1d2875

File tree

5 files changed

+76
-33
lines changed

5 files changed

+76
-33
lines changed

‎NEWS‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,10 @@ PHP NEWS
5353
. Fixed bug GH-20051 (apache2 shutdowns when restart is requested during
5454
preloading). (Arnaud, welcomycozyhom)
5555

56+
- OpenSSL:
57+
. Implemented GH-20310 (No critical extension indication in
58+
openssl_x509_parse() output). (StephenWall)
59+
5660
- PDO_PGSQL:
5761
. Clear session-local state disconnect-equivalent processing.
5862
(KentarouTakeda)

‎UPGRADING‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ PHP 8.6 UPGRADE NOTES
7070
5. Changed Functions
7171
========================================
7272

73+
- OpenSSL:
74+
. Output of openssl_x509_parse() contains criticalExtensions listing all
75+
critical certificate extensions.
76+
7377
- Phar:
7478
. Phar::mungServer() now supports reference values.
7579

‎ext/openssl/openssl.c‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1003,6 +1003,8 @@ PHP_FUNCTION(openssl_x509_parse)
10031003
bool useshortnames = 1;
10041004
char * tmpstr;
10051005
zval subitem;
1006+
zval critext;
1007+
int critcount = 0;
10061008
X509_EXTENSION *extension;
10071009
X509_NAME *subject_name;
10081010
char *cert_name;
@@ -1115,18 +1117,22 @@ PHP_FUNCTION(openssl_x509_parse)
11151117
add_assoc_zval(return_value, "purposes", &subitem);
11161118

11171119
array_init(&subitem);
1118-
1120+
array_init(&critext);
11191121

11201122
for (i = 0; i < X509_get_ext_count(cert); i++) {
11211123
int nid;
11221124
extension = X509_get_ext(cert, i);
11231125
nid = OBJ_obj2nid(X509_EXTENSION_get_object(extension));
11241126
if (nid != NID_undef) {
1125-
extname = (char *)OBJ_nid2sn(OBJ_obj2nid(X509_EXTENSION_get_object(extension)));
1127+
extname = (char *)OBJ_nid2sn(nid);
11261128
} else {
11271129
OBJ_obj2txt(buf, sizeof(buf)-1, X509_EXTENSION_get_object(extension), 1);
11281130
extname = buf;
11291131
}
1132+
if (X509_EXTENSION_get_critical(extension)) {
1133+
add_next_index_string(&critext, extname);
1134+
critcount++;
1135+
}
11301136
bio_out = BIO_new(BIO_s_mem());
11311137
if (bio_out == NULL) {
11321138
php_openssl_store_errors();
@@ -1150,6 +1156,11 @@ PHP_FUNCTION(openssl_x509_parse)
11501156
BIO_free(bio_out);
11511157
}
11521158
add_assoc_zval(return_value, "extensions", &subitem);
1159+
if (critcount > 0) {
1160+
add_assoc_zval(return_value, "criticalExtensions", &critext);
1161+
} else {
1162+
zval_ptr_dtor(&critext);
1163+
}
11531164
if (cert_str) {
11541165
X509_free(cert);
11551166
}

‎ext/openssl/tests/crit.crt‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIC4DCCAkmgAwIBAgIUXulKXzpxr33sV/2LwI0+yhpUAZgwDQYJKoZIhvcNAQEF
3+
BQAwgYExHjAcBgNVBAMMFUhlbnJpcXVlIGRvIE4uIEFuZ2VsbzELMAkGA1UEBhMC
4+
QlIxGjAYBgNVBAgMEVJpbyBHcmFuZGUgZG8gU3VsMRUwEwYDVQQHDAxQb3J0byBB
5+
bGVncmUxHzAdBgkqhkiG9w0BCQEWEGhuYW5nZWxvQHBocC5uZXQwHhcNMjUxMDAy
6+
MTgwNjMwWhcNMjYxMDAyMTgwNjMwWjCBgTEeMBwGA1UEAwwVSGVucmlxdWUgZG8g
7+
Ti4gQW5nZWxvMQswCQYDVQQGEwJCUjEaMBgGA1UECAwRUmlvIEdyYW5kZSBkbyBT
8+
dWwxFTATBgNVBAcMDFBvcnRvIEFsZWdyZTEfMB0GCSqGSIb3DQEJARYQaG5hbmdl
9+
bG9AcGhwLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAy16ej5ArW6Vf
10+
j9YMBUFh+hM9FPN7hJkvCBp6XiPBZPK2P7xzmc2WWsUQsPpaMnN+NqggyEIXjDgj
11+
ZuRZHr89Oqu+e/6KKIi0d8q8mBioihtSGSIqZZrbAveaCq81EipOtMLiNZm4KTFD
12+
+Syov078XrOT5pFLV34ps9qoJHlHD6UCAwEAAaNTMFEwHQYDVR0OBBYEFNt+QHK9
13+
XDWF7CkpgRLoYmhqtz99MB8GA1UdIwQYMBaAFNt+QHK9XDWF7CkpgRLoYmhqtz99
14+
MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEFBQADgYEAc6jR36JD6xkzq2r0
15+
uIEjhiieDfFXcAVgisqymPHt6DDMSajRskfWPO58ayBKmT2J1yPxx2vdjAZxIRcg
16+
2a06ef2OxE62X4+WNm6skIKLCXmc3AgkT//cqCjOs54EQMpdCJ/mkkYo9gZMB1aQ
17+
jgozP+80FNIaioaDWVZsTsg3q0Q=
18+
-----END CERTIFICATE-----

‎ext/openssl/tests/openssl_x509_parse_basic.phpt‎

Lines changed: 37 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ if (OPENSSL_VERSION_NUMBER >= 0x30200000) die('skip For OpenSSL < 3.2');
88
?>
99
--FILE--
1010
<?php
11-
$cert = "file://" . __DIR__ . "/cert.crt";
11+
$cert = "file://" . __DIR__ . "/crit.crt";
1212

1313
$parsedCert = openssl_x509_parse($cert);
1414
var_dump($parsedCert === openssl_x509_parse(openssl_x509_read($cert)));
@@ -17,51 +17,51 @@ var_dump(openssl_x509_parse($cert, false));
1717
?>
1818
--EXPECTF--
1919
bool(true)
20-
array(16) {
20+
array(17) {
2121
["name"]=>
22-
string(96) "/C=BR/ST=Rio Grande do Sul/L=Porto Alegre/CN=Henrique do N. Angelo/[email protected]"
22+
string(96) "/CN=Henrique do N. Angelo/C=BR/ST=Rio Grande do Sul/L=Porto Alegre/[email protected]"
2323
["subject"]=>
2424
array(5) {
25+
["CN"]=>
26+
string(21) "Henrique do N. Angelo"
2527
["C"]=>
2628
string(2) "BR"
2729
["ST"]=>
2830
string(17) "Rio Grande do Sul"
2931
["L"]=>
3032
string(12) "Porto Alegre"
31-
["CN"]=>
32-
string(21) "Henrique do N. Angelo"
3333
["emailAddress"]=>
3434
string(16) "[email protected]"
3535
}
3636
["hash"]=>
3737
string(8) "%s"
3838
["issuer"]=>
3939
array(5) {
40+
["CN"]=>
41+
string(21) "Henrique do N. Angelo"
4042
["C"]=>
4143
string(2) "BR"
4244
["ST"]=>
4345
string(17) "Rio Grande do Sul"
4446
["L"]=>
4547
string(12) "Porto Alegre"
46-
["CN"]=>
47-
string(21) "Henrique do N. Angelo"
4848
["emailAddress"]=>
4949
string(16) "[email protected]"
5050
}
5151
["version"]=>
5252
int(2)
5353
["serialNumber"]=>
54-
string(20) "12593567369101004962"
54+
string(42) "0x5EE94A5F3A71AF7DEC57FD8BC08D3ECA1A540198"
5555
["serialNumberHex"]=>
56-
string(16) "AEC556CC723750A2"
56+
string(40) "5EE94A5F3A71AF7DEC57FD8BC08D3ECA1A540198"
5757
["validFrom"]=>
58-
string(13) "080630102843Z"
58+
string(13) "251002180630Z"
5959
["validTo"]=>
60-
string(13) "080730102843Z"
60+
string(13) "261002180630Z"
6161
["validFrom_time_t"]=>
62-
int(1214821723)
62+
int(1759428390)
6363
["validTo_time_t"]=>
64-
int(1217413723)
64+
int(1790964390)
6565
["signatureTypeSN"]=>
6666
string(8) "RSA-SHA1"
6767
["signatureTypeLN"]=>
@@ -157,58 +157,61 @@ array(16) {
157157
["subjectKeyIdentifier"]=>
158158
string(59) "DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D"
159159
["authorityKeyIdentifier"]=>
160-
string(%d) "keyid:DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D
161-
DirName:/C=BR/ST=Rio Grande do Sul/L=Porto Alegre/CN=Henrique do N. Angelo/[email protected]
162-
serial:AE:C5:56:CC:72:37:50:A2%A"
160+
string(%d) "DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D"
163161
["basicConstraints"]=>
164162
string(7) "CA:TRUE"
165163
}
164+
["criticalExtensions"]=>
165+
array(1) {
166+
[0]=>
167+
string(16) "basicConstraints"
168+
}
166169
}
167-
array(16) {
170+
array(17) {
168171
["name"]=>
169-
string(96) "/C=BR/ST=Rio Grande do Sul/L=Porto Alegre/CN=Henrique do N. Angelo/[email protected]"
172+
string(96) "/CN=Henrique do N. Angelo/C=BR/ST=Rio Grande do Sul/L=Porto Alegre/[email protected]"
170173
["subject"]=>
171174
array(5) {
175+
["commonName"]=>
176+
string(21) "Henrique do N. Angelo"
172177
["countryName"]=>
173178
string(2) "BR"
174179
["stateOrProvinceName"]=>
175180
string(17) "Rio Grande do Sul"
176181
["localityName"]=>
177182
string(12) "Porto Alegre"
178-
["commonName"]=>
179-
string(21) "Henrique do N. Angelo"
180183
["emailAddress"]=>
181184
string(16) "[email protected]"
182185
}
183186
["hash"]=>
184187
string(8) "%s"
185188
["issuer"]=>
186189
array(5) {
190+
["commonName"]=>
191+
string(21) "Henrique do N. Angelo"
187192
["countryName"]=>
188193
string(2) "BR"
189194
["stateOrProvinceName"]=>
190195
string(17) "Rio Grande do Sul"
191196
["localityName"]=>
192197
string(12) "Porto Alegre"
193-
["commonName"]=>
194-
string(21) "Henrique do N. Angelo"
195198
["emailAddress"]=>
196199
string(16) "[email protected]"
197200
}
198201
["version"]=>
199202
int(2)
200203
["serialNumber"]=>
201-
string(20) "12593567369101004962"
204+
string(42) "0x5EE94A5F3A71AF7DEC57FD8BC08D3ECA1A540198"
202205
["serialNumberHex"]=>
203-
string(16) "AEC556CC723750A2"
206+
string(40) "5EE94A5F3A71AF7DEC57FD8BC08D3ECA1A540198"
204207
["validFrom"]=>
205-
string(13) "080630102843Z"
208+
string(13) "251002180630Z"
206209
["validTo"]=>
207-
string(13) "080730102843Z"
210+
string(13) "261002180630Z"
208211
["validFrom_time_t"]=>
209-
int(1214821723)
212+
int(1759428390)
210213
["validTo_time_t"]=>
211-
int(1217413723)
214+
int(1790964390)
212215
["signatureTypeSN"]=>
213216
string(8) "RSA-SHA1"
214217
["signatureTypeLN"]=>
@@ -304,10 +307,13 @@ array(16) {
304307
["subjectKeyIdentifier"]=>
305308
string(59) "DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D"
306309
["authorityKeyIdentifier"]=>
307-
string(%d) "keyid:DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D
308-
DirName:/C=BR/ST=Rio Grande do Sul/L=Porto Alegre/CN=Henrique do N. Angelo/[email protected]
309-
serial:AE:C5:56:CC:72:37:50:A2%A"
310+
string(%d) "DB:7E:40:72:BD:5C:35:85:EC:29:29:81:12:E8:62:68:6A:B7:3F:7D"
310311
["basicConstraints"]=>
311312
string(7) "CA:TRUE"
312313
}
314+
["criticalExtensions"]=>
315+
array(1) {
316+
[0]=>
317+
string(16) "basicConstraints"
318+
}
313319
}

0 commit comments

Comments
 (0)