Skip to content

ext/openssl: Bump minimum required OpenSSL version to 1.1.1 #13498

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Mar 23, 2024
Merged

ext/openssl: Bump minimum required OpenSSL version to 1.1.1 #13498

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
fa04956
ext/openssl: Bump minimum required OpenSSL version to 1.1.1
Ayesh Feb 25, 2024
edff7c7
ext/openssl: Remove kerberos support
Ayesh Mar 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 0 additions & 3 deletions .circleci/config.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,6 @@ jobs:
libsqlite3-dev \
libwebp-dev \
libonig-dev \
libkrb5-dev \
libgssapi-krb5-2 \
libcurl4-openssl-dev \
libxml2-dev \
libxslt1-dev \
Expand Down Expand Up @@ -128,7 +126,6 @@ jobs:
--enable-calendar \
--enable-ftp \
--with-enchant=/usr \
--with-kerberos \
--enable-sysvmsg \
--with-ffi \
--enable-zend-test \
Expand Down
4 changes: 2 additions & 2 deletions .cirrus.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,10 +11,10 @@ freebsd_task:
#- sed -i -e 's/quarterly/latest/g' /etc/pkg/FreeBSD.conf
#- pkg upgrade -y
- kldload accf_http
- pkg install -y autoconf bison gmake re2c icu libiconv png freetype2 enchant2 bzip2 krb5 t1lib gmp tidyp libsodium libzip libxml2 libxslt openssl oniguruma pkgconf webp libavif
- pkg install -y autoconf bison gmake re2c icu libiconv png freetype2 enchant2 bzip2 t1lib gmp tidyp libsodium libzip libxml2 libxslt openssl oniguruma pkgconf webp libavif
script:
- ./buildconf -f
- ./configure --prefix=/usr/local --enable-debug --enable-option-checking=fatal --enable-fpm --with-pdo-sqlite --without-pear --with-bz2 --with-avif --with-jpeg --with-webp --with-freetype --enable-gd --enable-exif --with-zip --with-zlib --enable-soap --enable-xmlreader --with-xsl --with-libxml --enable-shmop --enable-pcntl --enable-mbstring --with-curl --enable-sockets --with-openssl --with-iconv=/usr/local --enable-bcmath --enable-calendar --enable-ftp --with-kerberos --with-ffi --enable-zend-test --enable-dl-test=shared --enable-intl --with-mhash --with-sodium --enable-werror --with-config-file-path=/etc --with-config-file-scan-dir=/etc/php.d
- ./configure --prefix=/usr/local --enable-debug --enable-option-checking=fatal --enable-fpm --with-pdo-sqlite --without-pear --with-bz2 --with-avif --with-jpeg --with-webp --with-freetype --enable-gd --enable-exif --with-zip --with-zlib --enable-soap --enable-xmlreader --with-xsl --with-libxml --enable-shmop --enable-pcntl --enable-mbstring --with-curl --enable-sockets --with-openssl --with-iconv=/usr/local --enable-bcmath --enable-calendar --enable-ftp --with-ffi --enable-zend-test --enable-dl-test=shared --enable-intl --with-mhash --with-sodium --enable-werror --with-config-file-path=/etc --with-config-file-scan-dir=/etc/php.d
- gmake -j2
- mkdir /etc/php.d
- gmake install
Expand Down
2 changes: 0 additions & 2 deletions .github/actions/apt-x32/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,10 +23,8 @@ runs:
libffi-dev:i386 \
libfreetype6-dev:i386 \
libgmp-dev:i386 \
libgssapi-krb5-2:i386 \
libicu-dev:i386 \
libjpeg-dev:i386 \
libkrb5-dev:i386 \
libonig-dev:i386 \
libpng-dev:i386 \
libpq-dev:i386 \
Expand Down
2 changes: 0 additions & 2 deletions .github/actions/apt-x64/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,8 +40,6 @@ runs:
libsqlite3-mod-spatialite \
libwebp-dev \
libonig-dev \
libkrb5-dev \
libgssapi-krb5-2 \
libcurl4-openssl-dev \
libxml2-dev \
libxslt1-dev \
Expand Down
1 change: 0 additions & 1 deletion .github/actions/brew/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ runs:
brew install \
openssl@1.1 \
curl \
krb5 \
bzip2 \
enchant \
libffi \
Expand Down
2 changes: 0 additions & 2 deletions .github/actions/configure-macos/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,6 @@ runs:
export PATH="$BREW_OPT/bison/bin:$PATH"
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$BREW_OPT/openssl@1.1/lib/pkgconfig"
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$BREW_OPT/curl/lib/pkgconfig"
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$BREW_OPT/krb5/lib/pkgconfig"
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$BREW_OPT/libffi/lib/pkgconfig"
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$BREW_OPT/libxml2/lib/pkgconfig"
export PKG_CONFIG_PATH="$PKG_CONFIG_PATH:$BREW_OPT/libxslt/lib/pkgconfig"
Expand Down Expand Up @@ -58,7 +57,6 @@ runs:
--enable-bcmath \
--enable-calendar \
--enable-ftp \
--with-kerberos \
--enable-sysvmsg \
--with-ffi \
--enable-zend-test \
Expand Down
1 change: 0 additions & 1 deletion .github/actions/configure-x32/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,6 @@ runs:
--enable-bcmath \
--enable-calendar \
--enable-ftp \
--with-kerberos \
--enable-sysvmsg \
--with-ffi \
--enable-zend-test \
Expand Down
1 change: 0 additions & 1 deletion .github/actions/configure-x64/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,6 @@ runs:
--enable-calendar \
--enable-ftp \
${{ inputs.skipSlow == 'false' && '--with-enchant=/usr' || '' }} \
--with-kerberos \
--enable-sysvmsg \
--with-ffi \
--enable-zend-test \
Expand Down
1 change: 0 additions & 1 deletion .travis.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,6 @@ addons:
- libgmp-dev
- libicu-dev
- libjpeg-dev
- libkrb5-dev
- libonig-dev
- libpng-dev
- libpq-dev
Expand Down
1 change: 1 addition & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,7 @@ PHP NEWS
Florian Sowade)
. Added X509_PURPOSE_OCSP_HELPER and X509_PURPOSE_TIMESTAMP_SIGN constants.
(Vincent Jardin)
. Bumped minimum required OpenSSL version to 1.1.1. (Ayesh Karunaratne)

- Output:
. Clear output handler status flags during handler initialization. (haszi)
Expand Down
3 changes: 3 additions & 0 deletions UPGRADING
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -494,6 +494,9 @@ PHP 8.4 UPGRADE NOTES
- Intl:
. The class constants are typed now.

- Intl:
. The OpenSSL extension now requires at least OpenSSL 1.1.1.

- PDO:
. The class constants are typed now.

Expand Down
1 change: 1 addition & 0 deletions UPGRADING.INTERNALS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,7 @@ PHP 8.4 INTERNALS UPGRADE NOTES
- The configure option --with-imap-ssl has been removed.
- The configure option --with-oci8 has been removed.
- The configure option --with-zlib-dir has been removed.
- The configure option --with-kerberos has been removed.
- COOKIE_IO_FUNCTIONS_T symbol has been removed (use cookie_io_functions_t).
- HAVE_SOCKADDR_UN_SUN_LEN symbol renamed to HAVE_STRUCT_SOCKADDR_UN_SUN_LEN.
- HAVE_UTSNAME_DOMAINNAME symbol renamed to HAVE_STRUCT_UTSNAME_DOMAINNAME.
Expand Down
2 changes: 1 addition & 1 deletion build/php.m4
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1817,7 +1817,7 @@ dnl
AC_DEFUN([PHP_SETUP_OPENSSL],[
found_openssl=no

PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.0.2], [found_openssl=yes])
PKG_CHECK_MODULES([OPENSSL], [openssl >= 1.1.1], [found_openssl=yes])

if test "$found_openssl" = "yes"; then
PHP_EVAL_LIBLINE($OPENSSL_LIBS, $1)
Expand Down
2 changes: 0 additions & 2 deletions ext/ftp/ftp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -293,9 +293,7 @@ ftp_login(ftpbuf_t *ftp, const char *user, const size_t user_len, const char *pa
return 0;
}

#if OPENSSL_VERSION_NUMBER >= 0x0090605fL
ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
#endif
SSL_CTX_set_options(ctx, ssl_ctx_options);

/* Allow SSL to re-use sessions.
Expand Down
4 changes: 1 addition & 3 deletions ext/ftp/php_ftp.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,15 +99,13 @@ static void ftp_object_destroy(zend_object *zobj) {

PHP_MINIT_FUNCTION(ftp)
{
#ifdef HAVE_FTP_SSL
#if OPENSSL_VERSION_NUMBER < 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
#if defined(HAVE_FTP_SSL) && !defined(LIBRESSL_VERSION_NUMBER)
SSL_library_init();
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These functions inside this #if block are either deprecated or do nothing anymore on OpenSSL versions >= 1.1.0.
So I think this should've been removed, i.e. OPENSSL_VERSION_NUMBER < 0x10101000 is always false now.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

FTR: #13793

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PR does not contain LibreSSL bump: See #13498 (comment)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah sorry this part could actually be removed - it's not defined - missed that.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just went through it again and looks really like the only incorrect thing. Next step will be to bump LibreSSL and drop the code that is not needed.

OpenSSL_add_all_ciphers();
OpenSSL_add_all_digests();
OpenSSL_add_all_algorithms();

SSL_load_error_strings();
#endif
#endif

php_ftp_ce = register_class_FTP_Connection();
Expand Down
17 changes: 1 addition & 16 deletions ext/openssl/config0.m4
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,7 @@
PHP_ARG_WITH([openssl],
[for OpenSSL support],
[AS_HELP_STRING([--with-openssl],
[Include OpenSSL support (requires OpenSSL >= 1.0.2)])])

PHP_ARG_WITH([kerberos],
[for Kerberos support],
[AS_HELP_STRING([--with-kerberos],
[OPENSSL: Include Kerberos support])],
[no],
[no])
[Include OpenSSL support (requires OpenSSL >= 1.1.1)])])

PHP_ARG_WITH([system-ciphers],
[whether to use system default cipher list instead of hardcoded value],
Expand All @@ -20,14 +13,6 @@ PHP_ARG_WITH([system-ciphers],
if test "$PHP_OPENSSL" != "no"; then
PHP_NEW_EXTENSION(openssl, openssl.c xp_ssl.c, $ext_shared)
PHP_SUBST(OPENSSL_SHARED_LIBADD)

if test "$PHP_KERBEROS" != "no"; then
PKG_CHECK_MODULES([KERBEROS], [krb5-gssapi krb5])

PHP_EVAL_INCLINE($KERBEROS_CFLAGS)
PHP_EVAL_LIBLINE($KERBEROS_LIBS, OPENSSL_SHARED_LIBADD)
fi

PHP_SETUP_OPENSSL(OPENSSL_SHARED_LIBADD,
[
AC_DEFINE(HAVE_OPENSSL_EXT,1,[ ])
Expand Down
14 changes: 5 additions & 9 deletions ext/openssl/openssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@
#include <openssl/param_build.h>
#endif

#if (OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)) && !defined(OPENSSL_NO_ENGINE)
#if defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_NO_ENGINE)
#include <openssl/engine.h>
#endif

Expand Down Expand Up @@ -99,7 +99,7 @@
#define HAVE_EVP_PKEY_EC 1

/* the OPENSSL_EC_EXPLICIT_CURVE value was added
* in OpenSSL 1.1.0; previous versions should
* in OpenSSL 1.1.0; previous versions should
* use 0 instead.
*/
#ifndef OPENSSL_EC_EXPLICIT_CURVE
Expand Down Expand Up @@ -1269,7 +1269,7 @@ PHP_MINIT_FUNCTION(openssl)
php_openssl_pkey_object_handlers.clone_obj = NULL;
php_openssl_pkey_object_handlers.compare = zend_objects_not_comparable;

#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could we check LibreSSL if we still need this. It might be worth to bump LibreSSL min version as well so we can get rid of all of the 1.0.2 specific code.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't really know how to check if this works well with LibreSSL I'm afraid. I couldn't get PHP's configure to run without openssl present.

FWIW, LibreSSL seems to declare a OPENSSL_init_ssl compat, so we might not need this manual init part.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was for LibreSSL version that did not have any compat. Think it's enough to just change pkgconfig path to point to LibreSSL but don't worry, it might be actually better to leave it for another PR. I haven't used LibreSSL for some time so might need to look into it anyway to do some other testing.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perfect, thank you. I'll experiment with libressl later and see if I could be any help too.

OPENSSL_config(NULL);
SSL_library_init();
OpenSSL_add_all_ciphers();
Expand Down Expand Up @@ -1309,9 +1309,7 @@ PHP_MINIT_FUNCTION(openssl)
php_stream_xport_register("tlsv1.0", php_openssl_ssl_socket_factory);
php_stream_xport_register("tlsv1.1", php_openssl_ssl_socket_factory);
php_stream_xport_register("tlsv1.2", php_openssl_ssl_socket_factory);
#if OPENSSL_VERSION_NUMBER >= 0x10101000
php_stream_xport_register("tlsv1.3", php_openssl_ssl_socket_factory);
#endif

/* override the default tcp socket provider */
php_stream_xport_register("tcp", php_openssl_ssl_socket_factory);
Expand Down Expand Up @@ -1364,7 +1362,7 @@ PHP_MINFO_FUNCTION(openssl)
/* {{{ PHP_MSHUTDOWN_FUNCTION */
PHP_MSHUTDOWN_FUNCTION(openssl)
{
#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined (LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
EVP_cleanup();

/* prevent accessing locking callback from unloaded extension */
Expand All @@ -1391,9 +1389,7 @@ PHP_MSHUTDOWN_FUNCTION(openssl)
php_stream_xport_unregister("tlsv1.0");
php_stream_xport_unregister("tlsv1.1");
php_stream_xport_unregister("tlsv1.2");
#if OPENSSL_VERSION_NUMBER >= 0x10101000
php_stream_xport_unregister("tlsv1.3");
#endif

/* reinstate the default tcp handler */
php_stream_xport_register("tcp", php_stream_generic_socket_factory);
Expand Down Expand Up @@ -4609,7 +4605,7 @@ static EVP_PKEY *php_openssl_pkey_init_ec(zval *data, bool *is_private) {
EVP_PKEY_CTX_free(ctx);
ctx = EVP_PKEY_CTX_new(param_key, NULL);
}

if (EVP_PKEY_check(ctx) || EVP_PKEY_public_check_quick(ctx)) {
*is_private = d != NULL;
EVP_PKEY_up_ref(param_key);
Expand Down
6 changes: 2 additions & 4 deletions ext/openssl/php_openssl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ extern zend_module_entry openssl_module_entry;
#define PHP_OPENSSL_VERSION PHP_VERSION

#include <openssl/opensslv.h>
#if defined(LIBRESSL_VERSION_NUMBER)
#ifdef LIBRESSL_VERSION_NUMBER
/* LibreSSL version check */
#if LIBRESSL_VERSION_NUMBER < 0x20700000L
#define PHP_OPENSSL_API_VERSION 0x10001
Expand All @@ -35,9 +35,7 @@ extern zend_module_entry openssl_module_entry;
#endif
#else
/* OpenSSL version check */
#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define PHP_OPENSSL_API_VERSION 0x10002
#elif OPENSSL_VERSION_NUMBER < 0x30000000L
#if OPENSSL_VERSION_NUMBER < 0x30000000L
#define PHP_OPENSSL_API_VERSION 0x10100
#else
#define PHP_OPENSSL_API_VERSION 0x30000
Expand Down
4 changes: 0 additions & 4 deletions ext/openssl/tests/bug80747.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,6 @@
Bug #80747: Providing RSA key size < 512 generates key that crash PHP
--EXTENSIONS--
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
?>
--FILE--
<?php

Expand Down
3 changes: 1 addition & 2 deletions ext/openssl/tests/openssl_error_string_basic.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,8 +95,7 @@ while (($enc_error_new = openssl_error_string()) !== false) {
var_dump($error_queue_size);
echo "\n";

$is_111 = OPENSSL_VERSION_NUMBER >= 0x10101000;
$err_pem_no_start_line = $is_111 ? '0909006C': '0906D06C';
$err_pem_no_start_line = '0909006C';

// PKEY
echo "PKEY errors\n";
Expand Down
3 changes: 0 additions & 3 deletions ext/openssl/tests/openssl_x509_checkpurpose_basic.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,6 @@ int openssl_x509_checkpurpose ( mixed $x509cert , int $purpose [, array $cainfo
marcosptf - <marcosptf@yahoo.com.br>
--EXTENSIONS--
openssl
--SKIPIF--
<?php if (OPENSSL_VERSION_NUMBER < 0x10000000) die("skip Output requires OpenSSL 1.0");
?>
--FILE--
<?php
include 'CertificateGenerator.inc';
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/session_meta_capture_tlsv13.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/stream_crypto_flags_003.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10001001) die("skip OpenSSLv1.0.1 required");
?>
--FILE--
<?php
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/stream_security_level.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,6 @@ security_level setting to prohibit cert
openssl
--SKIPIF--
<?php
if (OPENSSL_VERSION_NUMBER < 0x10100000) die("skip OpenSSL >= v1.1.0 required");
if (!function_exists("proc_open")) die("skip no proc_open");
?>
--FILE--
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/tls_wrapper.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/tls_wrapper_with_tls_v1.3.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down
1 change: 0 additions & 1 deletion ext/openssl/tests/tlsv1.3_wrapper.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,6 @@ openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
if (OPENSSL_VERSION_NUMBER < 0x10101000) die("skip OpenSSL v1.1.1 required");
?>
--FILE--
<?php
Expand Down
8 changes: 2 additions & 6 deletions ext/openssl/xp_ssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,7 @@
#define HAVE_TLS12 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(OPENSSL_NO_TLS1_3)
#ifndef OPENSSL_NO_TLS1_3
#define HAVE_TLS13 1
#endif

Expand All @@ -89,7 +89,7 @@
#define HAVE_TLS_ALPN 1
#endif

#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
#ifndef LIBRESSL_VERSION_NUMBER
#define HAVE_SEC_LEVEL 1
#endif

Expand Down Expand Up @@ -676,11 +676,7 @@ static int php_openssl_win_cert_verify_callback(X509_STORE_CTX *x509_store_ctx,
{
PCCERT_CONTEXT cert_ctx = NULL;
PCCERT_CHAIN_CONTEXT cert_chain_ctx = NULL;
#if OPENSSL_VERSION_NUMBER < 0x10100000L
X509 *cert = x509_store_ctx->cert;
#else
X509 *cert = X509_STORE_CTX_get0_cert(x509_store_ctx);
#endif

php_stream *stream;
php_openssl_netstream_data_t *sslsock;
Expand Down
Loading