@@ -1191,11 +1191,7 @@ static RSA *php_openssl_tmp_rsa_cb(SSL *s, int is_export, int keylength)
1191
1191
1192
1192
static int php_openssl_set_server_dh_param (php_stream * stream , SSL_CTX * ctx ) /* {{{ */
1193
1193
{
1194
- DH * dh ;
1195
- BIO * bio ;
1196
- zval * zdhpath ;
1197
-
1198
- zdhpath = php_stream_context_get_option (PHP_STREAM_CONTEXT (stream ), "ssl" , "dh_param" );
1194
+ zval * zdhpath = php_stream_context_get_option (PHP_STREAM_CONTEXT (stream ), "ssl" , "dh_param" );
1199
1195
if (zdhpath == NULL ) {
1200
1196
#if 0
1201
1197
/* Coming in OpenSSL 1.1 ... eventually we'll want to enable this
@@ -1210,14 +1206,29 @@ static int php_openssl_set_server_dh_param(php_stream * stream, SSL_CTX *ctx) /*
1210
1206
return FAILURE ;
1211
1207
}
1212
1208
1213
- bio = BIO_new_file (Z_STRVAL_P (zdhpath ), PHP_OPENSSL_BIO_MODE_R (PKCS7_BINARY ));
1209
+ BIO * bio = BIO_new_file (Z_STRVAL_P (zdhpath ), PHP_OPENSSL_BIO_MODE_R (PKCS7_BINARY ));
1214
1210
1215
1211
if (bio == NULL ) {
1216
1212
php_error_docref (NULL , E_WARNING , "Invalid dh_param" );
1217
1213
return FAILURE ;
1218
1214
}
1219
1215
1220
- dh = PEM_read_bio_DHparams (bio , NULL , NULL , NULL );
1216
+ #if PHP_OPENSSL_API_VERSION >= 0x30000
1217
+ EVP_PKEY * pkey = PEM_read_bio_Parameters (bio , NULL );
1218
+ BIO_free (bio );
1219
+
1220
+ if (pkey == NULL ) {
1221
+ php_error_docref (NULL , E_WARNING , "Failed reading DH params" );
1222
+ return FAILURE ;
1223
+ }
1224
+
1225
+ if (SSL_CTX_set0_tmp_dh_pkey (ctx , pkey ) < 0 ) {
1226
+ php_error_docref (NULL , E_WARNING , "Failed assigning DH params" );
1227
+ EVP_PKEY_free (pkey );
1228
+ return FAILURE ;
1229
+ }
1230
+ #else
1231
+ DH * dh = PEM_read_bio_DHparams (bio , NULL , NULL , NULL );
1221
1232
BIO_free (bio );
1222
1233
1223
1234
if (dh == NULL ) {
@@ -1232,6 +1243,7 @@ static int php_openssl_set_server_dh_param(php_stream * stream, SSL_CTX *ctx) /*
1232
1243
}
1233
1244
1234
1245
DH_free (dh );
1246
+ #endif
1235
1247
1236
1248
return SUCCESS ;
1237
1249
}
0 commit comments