PHP  
 PHP: Test and Code Coverage Analysis
downloads | QA | documentation | faq | getting help | mailing lists | reporting bugs | php.net sites | links | my php.net 
 

LCOV - code coverage report
Current view: top level - ext/openssl - openssl.c (source / functions) Hit Total Coverage
Test: PHP Code Coverage Lines: 1491 2260 66.0 %
Date: 2014-04-19 Functions: 66 82 80.5 %
Legend: Lines: hit not hit

          Line data    Source code
       1             : /*
       2             :    +----------------------------------------------------------------------+
       3             :    | PHP Version 5                                                        |
       4             :    +----------------------------------------------------------------------+
       5             :    | Copyright (c) 1997-2014 The PHP Group                                |
       6             :    +----------------------------------------------------------------------+
       7             :    | This source file is subject to version 3.01 of the PHP license,      |
       8             :    | that is bundled with this package in the file LICENSE, and is        |
       9             :    | available through the world-wide-web at the following url:           |
      10             :    | http://www.php.net/license/3_01.txt                                  |
      11             :    | If you did not receive a copy of the PHP license and are unable to   |
      12             :    | obtain it through the world-wide-web, please send a note to          |
      13             :    | license@php.net so we can mail you a copy immediately.               |
      14             :    +----------------------------------------------------------------------+
      15             :    | Authors: Stig Venaas <venaas@php.net>                                |
      16             :    |          Wez Furlong <wez@thebrainroom.com>                          |
      17             :    |          Sascha Kettler <kettler@gmx.net>                            |
      18             :    |          Pierre-Alain Joye <pierre@php.net>                          |
      19             :    |          Marc Delling <delling@silpion.de> (PKCS12 functions)        |
      20             :    +----------------------------------------------------------------------+
      21             :  */
      22             : 
      23             : /* $Id$ */
      24             : 
      25             : #ifdef HAVE_CONFIG_H
      26             : #include "config.h"
      27             : #endif
      28             : 
      29             : #include "php.h"
      30             : #include "php_openssl.h"
      31             : 
      32             : /* PHP Includes */
      33             : #include "ext/standard/file.h"
      34             : #include "ext/standard/info.h"
      35             : #include "ext/standard/php_fopen_wrappers.h"
      36             : #include "ext/standard/md5.h"
      37             : #include "ext/standard/base64.h"
      38             : 
      39             : #if PHP_WIN32
      40             : # include "win32/winutil.h"
      41             : #endif
      42             : 
      43             : /* OpenSSL includes */
      44             : #include <openssl/evp.h>
      45             : #include <openssl/x509.h>
      46             : #include <openssl/x509v3.h>
      47             : #include <openssl/crypto.h>
      48             : #include <openssl/pem.h>
      49             : #include <openssl/err.h>
      50             : #include <openssl/conf.h>
      51             : #include <openssl/rand.h>
      52             : #include <openssl/ssl.h>
      53             : #include <openssl/pkcs12.h>
      54             : 
      55             : /* Common */
      56             : #include <time.h>
      57             : 
      58             : #ifdef NETWARE
      59             : #define timezone _timezone      /* timezone is called _timezone in LibC */
      60             : #endif
      61             : 
      62             : #define DEFAULT_KEY_LENGTH      512
      63             : #define MIN_KEY_LENGTH          384
      64             : 
      65             : #define OPENSSL_ALGO_SHA1       1
      66             : #define OPENSSL_ALGO_MD5        2
      67             : #define OPENSSL_ALGO_MD4        3
      68             : #ifdef HAVE_OPENSSL_MD2_H
      69             : #define OPENSSL_ALGO_MD2        4
      70             : #endif
      71             : #define OPENSSL_ALGO_DSS1       5
      72             : #if OPENSSL_VERSION_NUMBER >= 0x0090708fL
      73             : #define OPENSSL_ALGO_SHA224 6
      74             : #define OPENSSL_ALGO_SHA256 7
      75             : #define OPENSSL_ALGO_SHA384 8
      76             : #define OPENSSL_ALGO_SHA512 9
      77             : #define OPENSSL_ALGO_RMD160 10
      78             : #endif
      79             : #define DEBUG_SMIME     0
      80             : 
      81             : #if !defined(OPENSSL_NO_EC) && defined(EVP_PKEY_EC)
      82             : #define HAVE_EVP_PKEY_EC 1
      83             : #endif
      84             : 
      85             : /* FIXME: Use the openssl constants instead of
      86             :  * enum. It is now impossible to match real values
      87             :  * against php constants. Also sorry to break the
      88             :  * enum principles here, BC...
      89             :  */
      90             : enum php_openssl_key_type {
      91             :         OPENSSL_KEYTYPE_RSA,
      92             :         OPENSSL_KEYTYPE_DSA,
      93             :         OPENSSL_KEYTYPE_DH,
      94             :         OPENSSL_KEYTYPE_DEFAULT = OPENSSL_KEYTYPE_RSA,
      95             : #ifdef HAVE_EVP_PKEY_EC
      96             :         OPENSSL_KEYTYPE_EC = OPENSSL_KEYTYPE_DH +1
      97             : #endif
      98             : };
      99             : 
     100             : enum php_openssl_cipher_type {
     101             :         PHP_OPENSSL_CIPHER_RC2_40,
     102             :         PHP_OPENSSL_CIPHER_RC2_128,
     103             :         PHP_OPENSSL_CIPHER_RC2_64,
     104             :         PHP_OPENSSL_CIPHER_DES,
     105             :         PHP_OPENSSL_CIPHER_3DES,
     106             :         PHP_OPENSSL_CIPHER_AES_128_CBC,
     107             :         PHP_OPENSSL_CIPHER_AES_192_CBC,
     108             :         PHP_OPENSSL_CIPHER_AES_256_CBC,
     109             : 
     110             :         PHP_OPENSSL_CIPHER_DEFAULT = PHP_OPENSSL_CIPHER_RC2_40
     111             : };
     112             : 
     113             : PHP_FUNCTION(openssl_get_md_methods);
     114             : PHP_FUNCTION(openssl_get_cipher_methods);
     115             : 
     116             : PHP_FUNCTION(openssl_digest);
     117             : PHP_FUNCTION(openssl_encrypt);
     118             : PHP_FUNCTION(openssl_decrypt);
     119             : PHP_FUNCTION(openssl_cipher_iv_length);
     120             : 
     121             : PHP_FUNCTION(openssl_dh_compute_key);
     122             : PHP_FUNCTION(openssl_random_pseudo_bytes);
     123             : 
     124             : /* {{{ arginfo */
     125             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_x509_export_to_file, 0, 0, 2)
     126             :     ZEND_ARG_INFO(0, x509)
     127             :     ZEND_ARG_INFO(0, outfilename)
     128             :     ZEND_ARG_INFO(0, notext)
     129             : ZEND_END_ARG_INFO()
     130             : 
     131             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_x509_export, 0, 0, 2)
     132             :     ZEND_ARG_INFO(0, x509)
     133             :     ZEND_ARG_INFO(1, out)
     134             :     ZEND_ARG_INFO(0, notext)
     135             : ZEND_END_ARG_INFO()
     136             : 
     137             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_x509_check_private_key, 0)
     138             :     ZEND_ARG_INFO(0, cert)
     139             :     ZEND_ARG_INFO(0, key)
     140             : ZEND_END_ARG_INFO()
     141             : 
     142             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_x509_parse, 0)
     143             :     ZEND_ARG_INFO(0, x509)
     144             :     ZEND_ARG_INFO(0, shortname)
     145             : ZEND_END_ARG_INFO()
     146             : 
     147             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_x509_checkpurpose, 0, 0, 3)
     148             :     ZEND_ARG_INFO(0, x509cert)
     149             :     ZEND_ARG_INFO(0, purpose)
     150             :     ZEND_ARG_INFO(0, cainfo) /* array */
     151             :     ZEND_ARG_INFO(0, untrustedfile)
     152             : ZEND_END_ARG_INFO()
     153             : 
     154             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_x509_read, 0)
     155             :     ZEND_ARG_INFO(0, cert)
     156             : ZEND_END_ARG_INFO()
     157             : 
     158             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_x509_free, 0)
     159             :     ZEND_ARG_INFO(0, x509)
     160             : ZEND_END_ARG_INFO()
     161             : 
     162             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_pkcs12_export_to_file, 0, 0, 4)
     163             :     ZEND_ARG_INFO(0, x509)
     164             :     ZEND_ARG_INFO(0, filename)
     165             :     ZEND_ARG_INFO(0, priv_key)
     166             :     ZEND_ARG_INFO(0, pass)
     167             :     ZEND_ARG_INFO(0, args) /* array */
     168             : ZEND_END_ARG_INFO()
     169             : 
     170             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_pkcs12_export, 0)
     171             :     ZEND_ARG_INFO(0, x509)
     172             :     ZEND_ARG_INFO(1, out)
     173             :     ZEND_ARG_INFO(0, priv_key)
     174             :     ZEND_ARG_INFO(0, pass)
     175             :     ZEND_ARG_INFO(0, args) /* array */
     176             : ZEND_END_ARG_INFO()
     177             : 
     178             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_pkcs12_read, 0)
     179             :     ZEND_ARG_INFO(0, PKCS12)
     180             :     ZEND_ARG_INFO(1, certs) /* array */
     181             :     ZEND_ARG_INFO(0, pass)
     182             : ZEND_END_ARG_INFO()
     183             : 
     184             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_csr_export_to_file, 0, 0, 2)
     185             :     ZEND_ARG_INFO(0, csr)
     186             :     ZEND_ARG_INFO(0, outfilename)
     187             :     ZEND_ARG_INFO(0, notext)
     188             : ZEND_END_ARG_INFO()
     189             : 
     190             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_csr_export, 0, 0, 2)
     191             :     ZEND_ARG_INFO(0, csr)
     192             :     ZEND_ARG_INFO(1, out)
     193             :     ZEND_ARG_INFO(0, notext)
     194             : ZEND_END_ARG_INFO()
     195             : 
     196             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_csr_sign, 0, 0, 4)
     197             :     ZEND_ARG_INFO(0, csr)
     198             :     ZEND_ARG_INFO(0, x509)
     199             :     ZEND_ARG_INFO(0, priv_key)
     200             :     ZEND_ARG_INFO(0, days)
     201             :     ZEND_ARG_INFO(0, config_args) /* array */
     202             :     ZEND_ARG_INFO(0, serial)
     203             : ZEND_END_ARG_INFO()
     204             : 
     205             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_csr_new, 0, 0, 2)
     206             :     ZEND_ARG_INFO(0, dn) /* array */
     207             :     ZEND_ARG_INFO(1, privkey)
     208             :     ZEND_ARG_INFO(0, configargs)
     209             :     ZEND_ARG_INFO(0, extraattribs)
     210             : ZEND_END_ARG_INFO()
     211             : 
     212             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_csr_get_subject, 0)
     213             :     ZEND_ARG_INFO(0, csr)
     214             : ZEND_END_ARG_INFO()
     215             : 
     216             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_csr_get_public_key, 0)
     217             :     ZEND_ARG_INFO(0, csr)
     218             : ZEND_END_ARG_INFO()
     219             : 
     220             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_pkey_new, 0, 0, 0)
     221             :     ZEND_ARG_INFO(0, configargs) /* array */
     222             : ZEND_END_ARG_INFO()
     223             : 
     224             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_pkey_export_to_file, 0, 0, 2)
     225             :     ZEND_ARG_INFO(0, key)
     226             :     ZEND_ARG_INFO(0, outfilename)
     227             :     ZEND_ARG_INFO(0, passphrase)
     228             :     ZEND_ARG_INFO(0, config_args) /* array */
     229             : ZEND_END_ARG_INFO()
     230             : 
     231             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_pkey_export, 0, 0, 2)
     232             :     ZEND_ARG_INFO(0, key)
     233             :     ZEND_ARG_INFO(1, out)
     234             :     ZEND_ARG_INFO(0, passphrase)
     235             :     ZEND_ARG_INFO(0, config_args) /* array */
     236             : ZEND_END_ARG_INFO()
     237             : 
     238             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_pkey_get_public, 0)
     239             :     ZEND_ARG_INFO(0, cert)
     240             : ZEND_END_ARG_INFO()
     241             : 
     242             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_pkey_free, 0)
     243             :     ZEND_ARG_INFO(0, key)
     244             : ZEND_END_ARG_INFO()
     245             : 
     246             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_pkey_get_private, 0, 0, 1)
     247             :     ZEND_ARG_INFO(0, key)
     248             :     ZEND_ARG_INFO(0, passphrase)
     249             : ZEND_END_ARG_INFO()
     250             : 
     251             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_pkey_get_details, 0)
     252             :     ZEND_ARG_INFO(0, key)
     253             : ZEND_END_ARG_INFO()
     254             : 
     255             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_pkcs7_verify, 0, 0, 2)
     256             :     ZEND_ARG_INFO(0, filename)
     257             :     ZEND_ARG_INFO(0, flags)
     258             :     ZEND_ARG_INFO(0, signerscerts)
     259             :     ZEND_ARG_INFO(0, cainfo) /* array */
     260             :     ZEND_ARG_INFO(0, extracerts)
     261             :     ZEND_ARG_INFO(0, content)
     262             : ZEND_END_ARG_INFO()
     263             : 
     264             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_pkcs7_encrypt, 0, 0, 4)
     265             :     ZEND_ARG_INFO(0, infile)
     266             :     ZEND_ARG_INFO(0, outfile)
     267             :     ZEND_ARG_INFO(0, recipcerts)
     268             :     ZEND_ARG_INFO(0, headers) /* array */
     269             :     ZEND_ARG_INFO(0, flags)
     270             :     ZEND_ARG_INFO(0, cipher)
     271             : ZEND_END_ARG_INFO()
     272             : 
     273             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_pkcs7_sign, 0, 0, 5)
     274             :     ZEND_ARG_INFO(0, infile)
     275             :     ZEND_ARG_INFO(0, outfile)
     276             :     ZEND_ARG_INFO(0, signcert)
     277             :     ZEND_ARG_INFO(0, signkey)
     278             :     ZEND_ARG_INFO(0, headers) /* array */
     279             :     ZEND_ARG_INFO(0, flags)
     280             :     ZEND_ARG_INFO(0, extracertsfilename)
     281             : ZEND_END_ARG_INFO()
     282             : 
     283             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_pkcs7_decrypt, 0, 0, 3)
     284             :     ZEND_ARG_INFO(0, infilename)
     285             :     ZEND_ARG_INFO(0, outfilename)
     286             :     ZEND_ARG_INFO(0, recipcert)
     287             :     ZEND_ARG_INFO(0, recipkey)
     288             : ZEND_END_ARG_INFO()
     289             : 
     290             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_private_encrypt, 0, 0, 3)
     291             :     ZEND_ARG_INFO(0, data)
     292             :     ZEND_ARG_INFO(1, crypted)
     293             :     ZEND_ARG_INFO(0, key)
     294             :     ZEND_ARG_INFO(0, padding)
     295             : ZEND_END_ARG_INFO()
     296             : 
     297             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_private_decrypt, 0, 0, 3)
     298             :     ZEND_ARG_INFO(0, data)
     299             :     ZEND_ARG_INFO(1, crypted)
     300             :     ZEND_ARG_INFO(0, key)
     301             :     ZEND_ARG_INFO(0, padding)
     302             : ZEND_END_ARG_INFO()
     303             : 
     304             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_public_encrypt, 0, 0, 3)
     305             :     ZEND_ARG_INFO(0, data)
     306             :     ZEND_ARG_INFO(1, crypted)
     307             :     ZEND_ARG_INFO(0, key)
     308             :     ZEND_ARG_INFO(0, padding)
     309             : ZEND_END_ARG_INFO()
     310             : 
     311             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_public_decrypt, 0, 0, 3)
     312             :     ZEND_ARG_INFO(0, data)
     313             :     ZEND_ARG_INFO(1, crypted)
     314             :     ZEND_ARG_INFO(0, key)
     315             :     ZEND_ARG_INFO(0, padding)
     316             : ZEND_END_ARG_INFO()
     317             : 
     318             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_error_string, 0)
     319             : ZEND_END_ARG_INFO()
     320             : 
     321             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_sign, 0, 0, 3)
     322             :     ZEND_ARG_INFO(0, data)
     323             :     ZEND_ARG_INFO(1, signature)
     324             :     ZEND_ARG_INFO(0, key)
     325             :     ZEND_ARG_INFO(0, method)
     326             : ZEND_END_ARG_INFO()
     327             : 
     328             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_verify, 0, 0, 3)
     329             :     ZEND_ARG_INFO(0, data)
     330             :     ZEND_ARG_INFO(0, signature)
     331             :     ZEND_ARG_INFO(0, key)
     332             :     ZEND_ARG_INFO(0, method)
     333             : ZEND_END_ARG_INFO()
     334             : 
     335             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_seal, 0)
     336             :     ZEND_ARG_INFO(0, data)
     337             :     ZEND_ARG_INFO(1, sealdata)
     338             :     ZEND_ARG_INFO(1, ekeys) /* arary */
     339             :     ZEND_ARG_INFO(0, pubkeys) /* array */
     340             : ZEND_END_ARG_INFO()
     341             : 
     342             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_open, 0)
     343             :     ZEND_ARG_INFO(0, data)
     344             :     ZEND_ARG_INFO(1, opendata)
     345             :     ZEND_ARG_INFO(0, ekey)
     346             :     ZEND_ARG_INFO(0, privkey)
     347             : ZEND_END_ARG_INFO()
     348             : 
     349             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_get_md_methods, 0, 0, 0)
     350             :     ZEND_ARG_INFO(0, aliases)
     351             : ZEND_END_ARG_INFO()
     352             : 
     353             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_get_cipher_methods, 0, 0, 0)
     354             :     ZEND_ARG_INFO(0, aliases)
     355             : ZEND_END_ARG_INFO()
     356             : 
     357             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_digest, 0, 0, 2)
     358             :     ZEND_ARG_INFO(0, data)
     359             :     ZEND_ARG_INFO(0, method)
     360             :     ZEND_ARG_INFO(0, raw_output)
     361             : ZEND_END_ARG_INFO()
     362             : 
     363             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_encrypt, 0, 0, 3)
     364             :     ZEND_ARG_INFO(0, data)
     365             :     ZEND_ARG_INFO(0, method)
     366             :     ZEND_ARG_INFO(0, password)
     367             :     ZEND_ARG_INFO(0, options)
     368             :     ZEND_ARG_INFO(0, iv)
     369             : ZEND_END_ARG_INFO()
     370             : 
     371             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_decrypt, 0, 0, 3)
     372             :     ZEND_ARG_INFO(0, data)
     373             :     ZEND_ARG_INFO(0, method)
     374             :     ZEND_ARG_INFO(0, password)
     375             :     ZEND_ARG_INFO(0, options)
     376             :     ZEND_ARG_INFO(0, iv)
     377             : ZEND_END_ARG_INFO()
     378             : 
     379             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_cipher_iv_length, 0)
     380             :     ZEND_ARG_INFO(0, method)
     381             : ZEND_END_ARG_INFO()
     382             : 
     383             : ZEND_BEGIN_ARG_INFO(arginfo_openssl_dh_compute_key, 0)
     384             :     ZEND_ARG_INFO(0, pub_key)
     385             :     ZEND_ARG_INFO(0, dh_key)
     386             : ZEND_END_ARG_INFO()
     387             : 
     388             : ZEND_BEGIN_ARG_INFO_EX(arginfo_openssl_random_pseudo_bytes, 0, 0, 1)
     389             :     ZEND_ARG_INFO(0, length)
     390             :     ZEND_ARG_INFO(1, result_is_strong)
     391             : ZEND_END_ARG_INFO()
     392             : /* }}} */
     393             : 
     394             : /* {{{ openssl_functions[]
     395             :  */
     396             : const zend_function_entry openssl_functions[] = {
     397             : /* public/private key functions */
     398             :         PHP_FE(openssl_pkey_free,                       arginfo_openssl_pkey_free)
     399             :         PHP_FE(openssl_pkey_new,                        arginfo_openssl_pkey_new)
     400             :         PHP_FE(openssl_pkey_export,                     arginfo_openssl_pkey_export)
     401             :         PHP_FE(openssl_pkey_export_to_file,     arginfo_openssl_pkey_export_to_file)
     402             :         PHP_FE(openssl_pkey_get_private,        arginfo_openssl_pkey_get_private)
     403             :         PHP_FE(openssl_pkey_get_public,         arginfo_openssl_pkey_get_public)
     404             :         PHP_FE(openssl_pkey_get_details,        arginfo_openssl_pkey_get_details)
     405             : 
     406             :         PHP_FALIAS(openssl_free_key,            openssl_pkey_free,                      arginfo_openssl_pkey_free)
     407             :         PHP_FALIAS(openssl_get_privatekey,      openssl_pkey_get_private,       arginfo_openssl_pkey_get_private)
     408             :         PHP_FALIAS(openssl_get_publickey,       openssl_pkey_get_public,        arginfo_openssl_pkey_get_public)
     409             : 
     410             : /* x.509 cert funcs */
     411             :         PHP_FE(openssl_x509_read,                               arginfo_openssl_x509_read)
     412             :         PHP_FE(openssl_x509_free,                       arginfo_openssl_x509_free)
     413             :         PHP_FE(openssl_x509_parse,                              arginfo_openssl_x509_parse)
     414             :         PHP_FE(openssl_x509_checkpurpose,               arginfo_openssl_x509_checkpurpose)
     415             :         PHP_FE(openssl_x509_check_private_key,  arginfo_openssl_x509_check_private_key)
     416             :         PHP_FE(openssl_x509_export,                             arginfo_openssl_x509_export)
     417             :         PHP_FE(openssl_x509_export_to_file,             arginfo_openssl_x509_export_to_file)
     418             : 
     419             : /* PKCS12 funcs */
     420             :         PHP_FE(openssl_pkcs12_export,                   arginfo_openssl_pkcs12_export)
     421             :         PHP_FE(openssl_pkcs12_export_to_file,   arginfo_openssl_pkcs12_export_to_file)
     422             :         PHP_FE(openssl_pkcs12_read,                             arginfo_openssl_pkcs12_read)
     423             : 
     424             : /* CSR funcs */
     425             :         PHP_FE(openssl_csr_new,                         arginfo_openssl_csr_new)
     426             :         PHP_FE(openssl_csr_export,                      arginfo_openssl_csr_export)
     427             :         PHP_FE(openssl_csr_export_to_file,      arginfo_openssl_csr_export_to_file)
     428             :         PHP_FE(openssl_csr_sign,                        arginfo_openssl_csr_sign)
     429             :         PHP_FE(openssl_csr_get_subject,         arginfo_openssl_csr_get_subject)
     430             :         PHP_FE(openssl_csr_get_public_key,      arginfo_openssl_csr_get_public_key)
     431             : 
     432             :         PHP_FE(openssl_digest,                          arginfo_openssl_digest)
     433             :         PHP_FE(openssl_encrypt,                         arginfo_openssl_encrypt)
     434             :         PHP_FE(openssl_decrypt,                         arginfo_openssl_decrypt)
     435             :         PHP_FE(openssl_cipher_iv_length,        arginfo_openssl_cipher_iv_length)
     436             :         PHP_FE(openssl_sign,                            arginfo_openssl_sign)
     437             :         PHP_FE(openssl_verify,                          arginfo_openssl_verify)
     438             :         PHP_FE(openssl_seal,                            arginfo_openssl_seal)
     439             :         PHP_FE(openssl_open,                            arginfo_openssl_open)
     440             : 
     441             : /* for S/MIME handling */
     442             :         PHP_FE(openssl_pkcs7_verify,            arginfo_openssl_pkcs7_verify)
     443             :         PHP_FE(openssl_pkcs7_decrypt,           arginfo_openssl_pkcs7_decrypt)
     444             :         PHP_FE(openssl_pkcs7_sign,                      arginfo_openssl_pkcs7_sign)
     445             :         PHP_FE(openssl_pkcs7_encrypt,           arginfo_openssl_pkcs7_encrypt)
     446             : 
     447             :         PHP_FE(openssl_private_encrypt,         arginfo_openssl_private_encrypt)
     448             :         PHP_FE(openssl_private_decrypt,         arginfo_openssl_private_decrypt)
     449             :         PHP_FE(openssl_public_encrypt,          arginfo_openssl_public_encrypt)
     450             :         PHP_FE(openssl_public_decrypt,          arginfo_openssl_public_decrypt)
     451             : 
     452             :         PHP_FE(openssl_get_md_methods,          arginfo_openssl_get_md_methods)
     453             :         PHP_FE(openssl_get_cipher_methods,      arginfo_openssl_get_cipher_methods)
     454             : 
     455             :         PHP_FE(openssl_dh_compute_key,      arginfo_openssl_dh_compute_key)
     456             : 
     457             :         PHP_FE(openssl_random_pseudo_bytes,    arginfo_openssl_random_pseudo_bytes)
     458             :         PHP_FE(openssl_error_string, arginfo_openssl_error_string)
     459             :         PHP_FE_END
     460             : };
     461             : /* }}} */
     462             : 
     463             : /* {{{ openssl_module_entry
     464             :  */
     465             : zend_module_entry openssl_module_entry = {
     466             :         STANDARD_MODULE_HEADER,
     467             :         "openssl",
     468             :         openssl_functions,
     469             :         PHP_MINIT(openssl),
     470             :         PHP_MSHUTDOWN(openssl),
     471             :         NULL,
     472             :         NULL,
     473             :         PHP_MINFO(openssl),
     474             :         NO_VERSION_YET,
     475             :         STANDARD_MODULE_PROPERTIES
     476             : };
     477             : /* }}} */
     478             : 
     479             : #ifdef COMPILE_DL_OPENSSL
     480             : ZEND_GET_MODULE(openssl)
     481             : #endif
     482             : 
     483             : static int le_key;
     484             : static int le_x509;
     485             : static int le_csr;
     486             : static int ssl_stream_data_index;
     487             : 
     488           9 : int php_openssl_get_x509_list_id(void) /* {{{ */
     489             : {
     490           9 :         return le_x509;
     491             : }
     492             : /* }}} */
     493             : 
     494             : /* {{{ resource destructors */
     495          24 : static void php_pkey_free(zend_rsrc_list_entry *rsrc TSRMLS_DC)
     496             : {
     497          24 :         EVP_PKEY *pkey = (EVP_PKEY *)rsrc->ptr;
     498             : 
     499             :         assert(pkey != NULL);
     500             : 
     501          24 :         EVP_PKEY_free(pkey);
     502          24 : }
     503             : 
     504          18 : static void php_x509_free(zend_rsrc_list_entry *rsrc TSRMLS_DC)
     505             : {
     506          18 :         X509 *x509 = (X509 *)rsrc->ptr;
     507          18 :         X509_free(x509);
     508          18 : }
     509             : 
     510           5 : static void php_csr_free(zend_rsrc_list_entry *rsrc TSRMLS_DC)
     511             : {
     512           5 :         X509_REQ * csr = (X509_REQ*)rsrc->ptr;
     513           5 :         X509_REQ_free(csr);
     514           5 : }
     515             : /* }}} */
     516             : 
     517             : /* {{{ openssl open_basedir check */
     518         125 : inline static int php_openssl_open_base_dir_chk(char *filename TSRMLS_DC)
     519             : {
     520         125 :         if (php_check_open_basedir(filename TSRMLS_CC)) {
     521           0 :                 return -1;
     522             :         }
     523             : 
     524         125 :         return 0;
     525             : }
     526             : /* }}} */
     527             : 
     528             : /* openssl -> PHP "bridging" */
     529             : /* true global; readonly after module startup */
     530             : static char default_ssl_conf_filename[MAXPATHLEN];
     531             : 
     532             : struct php_x509_request { /* {{{ */
     533             : #if OPENSSL_VERSION_NUMBER >= 0x10000002L
     534             :         LHASH_OF(CONF_VALUE) * global_config;   /* Global SSL config */
     535             :         LHASH_OF(CONF_VALUE) * req_config;              /* SSL config for this request */
     536             : #else
     537             :         LHASH * global_config;  /* Global SSL config */
     538             :         LHASH * req_config;             /* SSL config for this request */
     539             : #endif
     540             :         const EVP_MD * md_alg;
     541             :         const EVP_MD * digest;
     542             :         char    * section_name,
     543             :                         * config_filename,
     544             :                         * digest_name,
     545             :                         * extensions_section,
     546             :                         * request_extensions_section;
     547             :         int priv_key_bits;
     548             :         int priv_key_type;
     549             : 
     550             :         int priv_key_encrypt;
     551             : 
     552             :         EVP_PKEY * priv_key;
     553             : 
     554             :     const EVP_CIPHER * priv_key_encrypt_cipher;
     555             : };
     556             : /* }}} */
     557             : 
     558             : static X509 * php_openssl_x509_from_zval(zval ** val, int makeresource, long * resourceval TSRMLS_DC);
     559             : static EVP_PKEY * php_openssl_evp_from_zval(zval ** val, int public_key, char * passphrase, int makeresource, long * resourceval TSRMLS_DC);
     560             : static int php_openssl_is_private_key(EVP_PKEY* pkey TSRMLS_DC);
     561             : static X509_STORE     * setup_verify(zval * calist TSRMLS_DC);
     562             : static STACK_OF(X509) * load_all_certs_from_file(char *certfile);
     563             : static X509_REQ * php_openssl_csr_from_zval(zval ** val, int makeresource, long * resourceval TSRMLS_DC);
     564             : static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req TSRMLS_DC);
     565             : 
     566          38 : static void add_assoc_name_entry(zval * val, char * key, X509_NAME * name, int shortname TSRMLS_DC) /* {{{ */
     567             : {
     568             :         zval **data;
     569             :         zval *subitem, *subentries;
     570          38 :         int i, j = -1, last = -1, obj_cnt = 0;
     571             :         char *sname;
     572             :         int nid;
     573             :         X509_NAME_ENTRY * ne;
     574          38 :         ASN1_STRING * str = NULL;
     575             :         ASN1_OBJECT * obj;
     576             : 
     577          38 :         if (key != NULL) {
     578          36 :                 MAKE_STD_ZVAL(subitem);
     579          36 :                 array_init(subitem);
     580             :         } else {
     581           2 :                 subitem = val;
     582             :         }
     583             : 
     584         251 :         for (i = 0; i < X509_NAME_entry_count(name); i++) {
     585             :                 unsigned char *to_add;
     586         213 :                 int to_add_len = 0;
     587             : 
     588             : 
     589         213 :                 ne  = X509_NAME_get_entry(name, i);
     590         213 :                 obj = X509_NAME_ENTRY_get_object(ne);
     591         213 :                 nid = OBJ_obj2nid(obj);
     592         213 :                 obj_cnt = 0;
     593             : 
     594         213 :                 if (shortname) {
     595         203 :                         sname = (char *) OBJ_nid2sn(nid);
     596             :                 } else {
     597          10 :                         sname = (char *) OBJ_nid2ln(nid);
     598             :                 }
     599             : 
     600         213 :                 str = X509_NAME_ENTRY_get_data(ne);
     601         213 :                 if (ASN1_STRING_type(str) != V_ASN1_UTF8STRING) {
     602         193 :                         to_add_len = ASN1_STRING_to_UTF8(&to_add, str);
     603             :                 } else {
     604          20 :                         to_add = ASN1_STRING_data(str);
     605          20 :                         to_add_len = ASN1_STRING_length(str);
     606             :                 }
     607             : 
     608         213 :                 if (to_add_len != -1) {
     609         211 :                         if (zend_hash_find(Z_ARRVAL_P(subitem), sname, strlen(sname)+1, (void**)&data) == SUCCESS) {
     610           8 :                                 if (Z_TYPE_PP(data) == IS_ARRAY) {
     611           4 :                                         subentries = *data;
     612           4 :                                         add_next_index_stringl(subentries, (char *)to_add, to_add_len, 1);
     613           4 :                                 } else if (Z_TYPE_PP(data) == IS_STRING) {
     614           4 :                                         MAKE_STD_ZVAL(subentries);
     615           4 :                                         array_init(subentries);
     616           4 :                                         add_next_index_stringl(subentries, Z_STRVAL_PP(data), Z_STRLEN_PP(data), 1);
     617           4 :                                         add_next_index_stringl(subentries, (char *)to_add, to_add_len, 1);
     618           4 :                                         zend_hash_update(Z_ARRVAL_P(subitem), sname, strlen(sname)+1, &subentries, sizeof(zval*), NULL);
     619             :                                 }
     620             :                         } else {
     621         203 :                                 add_assoc_stringl(subitem, sname, (char *)to_add, to_add_len, 1);
     622             :                         }
     623             :                 }
     624             :         }
     625          38 :         if (key != NULL) {
     626          36 :                 zend_hash_update(HASH_OF(val), key, strlen(key) + 1, (void *)&subitem, sizeof(subitem), NULL);
     627             :         }
     628          38 : }
     629             : /* }}} */
     630             : 
     631          38 : static void add_assoc_asn1_string(zval * val, char * key, ASN1_STRING * str) /* {{{ */
     632             : {
     633          38 :         add_assoc_stringl(val, key, (char *)str->data, str->length, 1);
     634          38 : }
     635             : /* }}} */
     636             : 
     637          36 : static time_t asn1_time_to_time_t(ASN1_UTCTIME * timestr TSRMLS_DC) /* {{{ */
     638             : {
     639             : /*
     640             :         This is how the time string is formatted:
     641             : 
     642             :    snprintf(p, sizeof(p), "%02d%02d%02d%02d%02d%02dZ",ts->tm_year%100,
     643             :       ts->tm_mon+1,ts->tm_mday,ts->tm_hour,ts->tm_min,ts->tm_sec);
     644             : */
     645             : 
     646             :         time_t ret;
     647             :         struct tm thetime;
     648             :         char * strbuf;
     649             :         char * thestr;
     650          36 :         long gmadjust = 0;
     651             : 
     652          36 :         if (ASN1_STRING_type(timestr) != V_ASN1_UTCTIME) {
     653           1 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal ASN1 data type for timestamp");
     654           1 :                 return (time_t)-1;
     655             :         }
     656             : 
     657          35 :         if (ASN1_STRING_length(timestr) != strlen(ASN1_STRING_data(timestr))) {
     658           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "illegal length in timestamp");
     659           0 :                 return (time_t)-1;
     660             :         }
     661             : 
     662          35 :         if (ASN1_STRING_length(timestr) < 13) {
     663           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to parse time string %s correctly", timestr->data);
     664           0 :                 return (time_t)-1;
     665             :         }
     666             : 
     667          35 :         strbuf = estrdup((char *)ASN1_STRING_data(timestr));
     668             : 
     669          35 :         memset(&thetime, 0, sizeof(thetime));
     670             : 
     671             :         /* we work backwards so that we can use atoi more easily */
     672             : 
     673          35 :         thestr = strbuf + ASN1_STRING_length(timestr) - 3;
     674             : 
     675          35 :         thetime.tm_sec = atoi(thestr);
     676          35 :         *thestr = '\0';
     677          35 :         thestr -= 2;
     678          35 :         thetime.tm_min = atoi(thestr);
     679          35 :         *thestr = '\0';
     680          35 :         thestr -= 2;
     681          35 :         thetime.tm_hour = atoi(thestr);
     682          35 :         *thestr = '\0';
     683          35 :         thestr -= 2;
     684          35 :         thetime.tm_mday = atoi(thestr);
     685          35 :         *thestr = '\0';
     686          35 :         thestr -= 2;
     687          35 :         thetime.tm_mon = atoi(thestr)-1;
     688          35 :         *thestr = '\0';
     689          35 :         thestr -= 2;
     690          35 :         thetime.tm_year = atoi(thestr);
     691             : 
     692          35 :         if (thetime.tm_year < 68) {
     693          35 :                 thetime.tm_year += 100;
     694             :         }
     695             : 
     696          35 :         thetime.tm_isdst = -1;
     697          35 :         ret = mktime(&thetime);
     698             : 
     699             : #if HAVE_TM_GMTOFF
     700          35 :         gmadjust = thetime.tm_gmtoff;
     701             : #else
     702             :         /*
     703             :         ** If correcting for daylight savings time, we set the adjustment to
     704             :         ** the value of timezone - 3600 seconds. Otherwise, we need to overcorrect and
     705             :         ** set the adjustment to the main timezone + 3600 seconds.
     706             :         */
     707             :         gmadjust = -(thetime.tm_isdst ? (long)timezone - 3600 : (long)timezone + 3600);
     708             : #endif
     709          35 :         ret += gmadjust;
     710             : 
     711          35 :         efree(strbuf);
     712             : 
     713          35 :         return ret;
     714             : }
     715             : /* }}} */
     716             : 
     717             : #if OPENSSL_VERSION_NUMBER >= 0x10000002L
     718          27 : static inline int php_openssl_config_check_syntax(const char * section_label, const char * config_filename, const char * section, LHASH_OF(CONF_VALUE) * config TSRMLS_DC) /* {{{ */
     719             : #else
     720             : static inline int php_openssl_config_check_syntax(const char * section_label, const char * config_filename, const char * section, LHASH * config TSRMLS_DC)
     721             : #endif
     722             : {
     723             :         X509V3_CTX ctx;
     724             : 
     725          27 :         X509V3_set_ctx_test(&ctx);
     726          27 :         X509V3_set_conf_lhash(&ctx, config);
     727          27 :         if (!X509V3_EXT_add_conf(config, &ctx, (char *)section, NULL)) {
     728           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error loading %s section %s of %s",
     729             :                                 section_label,
     730             :                                 section,
     731             :                                 config_filename);
     732           0 :                 return FAILURE;
     733             :         }
     734          27 :         return SUCCESS;
     735             : }
     736             : /* }}} */
     737             : 
     738          24 : static int add_oid_section(struct php_x509_request * req TSRMLS_DC) /* {{{ */
     739             : {
     740             :         char * str;
     741             :         STACK_OF(CONF_VALUE) * sktmp;
     742             :         CONF_VALUE * cnf;
     743             :         int i;
     744             : 
     745          24 :         str = CONF_get_string(req->req_config, NULL, "oid_section");
     746          24 :         if (str == NULL) {
     747          17 :                 return SUCCESS;
     748             :         }
     749           7 :         sktmp = CONF_get_section(req->req_config, str);
     750           7 :         if (sktmp == NULL) {
     751           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "problem loading oid section %s", str);
     752           0 :                 return FAILURE;
     753             :         }
     754          28 :         for (i = 0; i < sk_CONF_VALUE_num(sktmp); i++) {
     755          21 :                 cnf = sk_CONF_VALUE_value(sktmp, i);
     756          21 :                 if (OBJ_create(cnf->value, cnf->name, cnf->name) == NID_undef) {
     757           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "problem creating object %s=%s", cnf->name, cnf->value);
     758           0 :                         return FAILURE;
     759             :                 }
     760             :         }
     761           7 :         return SUCCESS;
     762             : }
     763             : /* }}} */
     764             : 
     765             : #define PHP_SSL_REQ_INIT(req)           memset(req, 0, sizeof(*req))
     766             : #define PHP_SSL_REQ_DISPOSE(req)        php_openssl_dispose_config(req TSRMLS_CC)
     767             : #define PHP_SSL_REQ_PARSE(req, zval)    php_openssl_parse_config(req, zval TSRMLS_CC)
     768             : 
     769             : #define PHP_SSL_CONFIG_SYNTAX_CHECK(var) if (req->var && php_openssl_config_check_syntax(#var, \
     770             :                         req->config_filename, req->var, req->req_config TSRMLS_CC) == FAILURE) return FAILURE
     771             : 
     772             : #define SET_OPTIONAL_STRING_ARG(key, varname, defval)   \
     773             :         if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \
     774             :                 varname = Z_STRVAL_PP(item); \
     775             :         else \
     776             :                 varname = defval
     777             : 
     778             : #define SET_OPTIONAL_LONG_ARG(key, varname, defval)     \
     779             :         if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), key, sizeof(key), (void**)&item) == SUCCESS) \
     780             :                 varname = Z_LVAL_PP(item); \
     781             :         else \
     782             :                 varname = defval
     783             : 
     784             : static const EVP_CIPHER * php_openssl_get_evp_cipher_from_algo(long algo);
     785             : 
     786             : 
     787          24 : static int php_openssl_parse_config(struct php_x509_request * req, zval * optional_args TSRMLS_DC) /* {{{ */
     788             : {
     789             :         char * str;
     790             :         zval ** item;
     791             : 
     792          24 :         SET_OPTIONAL_STRING_ARG("config", req->config_filename, default_ssl_conf_filename);
     793          24 :         SET_OPTIONAL_STRING_ARG("config_section_name", req->section_name, "req");
     794          24 :         req->global_config = CONF_load(NULL, default_ssl_conf_filename, NULL);
     795          24 :         req->req_config = CONF_load(NULL, req->config_filename, NULL);
     796             : 
     797          24 :         if (req->req_config == NULL) {
     798           0 :                 return FAILURE;
     799             :         }
     800             : 
     801             :         /* read in the oids */
     802          24 :         str = CONF_get_string(req->req_config, NULL, "oid_file");
     803          24 :         if (str && !php_openssl_open_base_dir_chk(str TSRMLS_CC)) {
     804           0 :                 BIO *oid_bio = BIO_new_file(str, "r");
     805           0 :                 if (oid_bio) {
     806           0 :                         OBJ_create_objects(oid_bio);
     807           0 :                         BIO_free(oid_bio);
     808             :                 }
     809             :         }
     810          24 :         if (add_oid_section(req TSRMLS_CC) == FAILURE) {
     811           0 :                 return FAILURE;
     812             :         }
     813          24 :         SET_OPTIONAL_STRING_ARG("digest_alg", req->digest_name,
     814             :                 CONF_get_string(req->req_config, req->section_name, "default_md"));
     815          24 :         SET_OPTIONAL_STRING_ARG("x509_extensions", req->extensions_section,
     816             :                 CONF_get_string(req->req_config, req->section_name, "x509_extensions"));
     817          24 :         SET_OPTIONAL_STRING_ARG("req_extensions", req->request_extensions_section,
     818             :                 CONF_get_string(req->req_config, req->section_name, "req_extensions"));
     819          24 :         SET_OPTIONAL_LONG_ARG("private_key_bits", req->priv_key_bits,
     820             :                 CONF_get_number(req->req_config, req->section_name, "default_bits"));
     821             : 
     822          24 :         SET_OPTIONAL_LONG_ARG("private_key_type", req->priv_key_type, OPENSSL_KEYTYPE_DEFAULT);
     823             : 
     824          28 :         if (optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key", sizeof("encrypt_key"), (void**)&item) == SUCCESS) {
     825           4 :                 req->priv_key_encrypt = Z_BVAL_PP(item);
     826             :         } else {
     827          20 :                 str = CONF_get_string(req->req_config, req->section_name, "encrypt_rsa_key");
     828          20 :                 if (str == NULL) {
     829          20 :                         str = CONF_get_string(req->req_config, req->section_name, "encrypt_key");
     830             :                 }
     831          20 :                 if (str && strcmp(str, "no") == 0) {
     832           0 :                         req->priv_key_encrypt = 0;
     833             :                 } else {
     834          20 :                         req->priv_key_encrypt = 1;
     835             :                 }
     836             :         }
     837             : 
     838          24 :         if (req->priv_key_encrypt && optional_args && zend_hash_find(Z_ARRVAL_P(optional_args), "encrypt_key_cipher", sizeof("encrypt_key_cipher"), (void**)&item) == SUCCESS) {
     839           0 :                 long cipher_algo = Z_LVAL_PP(item);
     840           0 :                 const EVP_CIPHER* cipher = php_openssl_get_evp_cipher_from_algo(cipher_algo);
     841           0 :                 if (cipher == NULL) {
     842           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown cipher algorithm for private key.");
     843           0 :                         return FAILURE;
     844             :                 } else  {
     845           0 :                         req->priv_key_encrypt_cipher = cipher;
     846             :                 }
     847             :         } else {
     848          24 :                 req->priv_key_encrypt_cipher = NULL;
     849             :         }
     850             : 
     851             : 
     852             : 
     853             :         /* digest alg */
     854          24 :         if (req->digest_name == NULL) {
     855          14 :                 req->digest_name = CONF_get_string(req->req_config, req->section_name, "default_md");
     856             :         }
     857          24 :         if (req->digest_name) {
     858          10 :                 req->digest = req->md_alg = EVP_get_digestbyname(req->digest_name);
     859             :         }
     860          24 :         if (req->md_alg == NULL) {
     861          14 :                 req->md_alg = req->digest = EVP_sha1();
     862             :         }
     863             : 
     864          24 :         PHP_SSL_CONFIG_SYNTAX_CHECK(extensions_section);
     865             : 
     866             :         /* set the string mask */
     867          24 :         str = CONF_get_string(req->req_config, req->section_name, "string_mask");
     868          24 :         if (str && !ASN1_STRING_set_default_mask_asc(str)) {
     869           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Invalid global string mask setting %s", str);
     870           0 :                 return FAILURE;
     871             :         }
     872             : 
     873          24 :         PHP_SSL_CONFIG_SYNTAX_CHECK(request_extensions_section);
     874             : 
     875          24 :         return SUCCESS;
     876             : }
     877             : /* }}} */
     878             : 
     879          28 : static void php_openssl_dispose_config(struct php_x509_request * req TSRMLS_DC) /* {{{ */
     880             : {
     881          28 :         if (req->priv_key) {
     882           1 :                 EVP_PKEY_free(req->priv_key);
     883           1 :                 req->priv_key = NULL;
     884             :         }
     885          28 :         if (req->global_config) {
     886          24 :                 CONF_free(req->global_config);
     887          24 :                 req->global_config = NULL;
     888             :         }
     889          28 :         if (req->req_config) {
     890          24 :                 CONF_free(req->req_config);
     891          24 :                 req->req_config = NULL;
     892             :         }
     893          28 : }
     894             : /* }}} */
     895             : 
     896          11 : static int php_openssl_load_rand_file(const char * file, int *egdsocket, int *seeded TSRMLS_DC) /* {{{ */
     897             : {
     898             :         char buffer[MAXPATHLEN];
     899             : 
     900          11 :         *egdsocket = 0;
     901          11 :         *seeded = 0;
     902             : 
     903          11 :         if (file == NULL) {
     904           5 :                 file = RAND_file_name(buffer, sizeof(buffer));
     905           6 :         } else if (RAND_egd(file) > 0) {
     906             :                 /* if the given filename is an EGD socket, don't
     907             :                  * write anything back to it */
     908           0 :                 *egdsocket = 1;
     909           0 :                 return SUCCESS;
     910             :         }
     911          11 :         if (file == NULL || !RAND_load_file(file, -1)) {
     912          11 :                 if (RAND_status() == 0) {
     913           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to load random state; not enough random data!");
     914           0 :                         return FAILURE;
     915             :                 }
     916          11 :                 return FAILURE;
     917             :         }
     918           0 :         *seeded = 1;
     919           0 :         return SUCCESS;
     920             : }
     921             : /* }}} */
     922             : 
     923          11 : static int php_openssl_write_rand_file(const char * file, int egdsocket, int seeded) /* {{{ */
     924             : {
     925             :         char buffer[MAXPATHLEN];
     926             : 
     927             :         TSRMLS_FETCH();
     928             : 
     929          11 :         if (egdsocket || !seeded) {
     930             :                 /* if we did not manage to read the seed file, we should not write
     931             :                  * a low-entropy seed file back */
     932          11 :                 return FAILURE;
     933             :         }
     934           0 :         if (file == NULL) {
     935           0 :                 file = RAND_file_name(buffer, sizeof(buffer));
     936             :         }
     937           0 :         if (file == NULL || !RAND_write_file(file)) {
     938           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to write random state");
     939           0 :                 return FAILURE;
     940             :         }
     941           0 :         return SUCCESS;
     942             : }
     943             : /* }}} */
     944             : 
     945          15 : static EVP_MD * php_openssl_get_evp_md_from_algo(long algo) { /* {{{ */
     946             :         EVP_MD *mdtype;
     947             : 
     948          15 :         switch (algo) {
     949             :                 case OPENSSL_ALGO_SHA1:
     950           8 :                         mdtype = (EVP_MD *) EVP_sha1();
     951           8 :                         break;
     952             :                 case OPENSSL_ALGO_MD5:
     953           5 :                         mdtype = (EVP_MD *) EVP_md5();
     954           5 :                         break;
     955             :                 case OPENSSL_ALGO_MD4:
     956           0 :                         mdtype = (EVP_MD *) EVP_md4();
     957           0 :                         break;
     958             : #ifdef HAVE_OPENSSL_MD2_H
     959             :                 case OPENSSL_ALGO_MD2:
     960             :                         mdtype = (EVP_MD *) EVP_md2();
     961             :                         break;
     962             : #endif
     963             :                 case OPENSSL_ALGO_DSS1:
     964           2 :                         mdtype = (EVP_MD *) EVP_dss1();
     965           2 :                         break;
     966             : #if OPENSSL_VERSION_NUMBER >= 0x0090708fL
     967             :                 case OPENSSL_ALGO_SHA224:
     968           0 :                         mdtype = (EVP_MD *) EVP_sha224();
     969           0 :                         break;
     970             :                 case OPENSSL_ALGO_SHA256:
     971           0 :                         mdtype = (EVP_MD *) EVP_sha256();
     972           0 :                         break;
     973             :                 case OPENSSL_ALGO_SHA384:
     974           0 :                         mdtype = (EVP_MD *) EVP_sha384();
     975           0 :                         break;
     976             :                 case OPENSSL_ALGO_SHA512:
     977           0 :                         mdtype = (EVP_MD *) EVP_sha512();
     978           0 :                         break;
     979             :                 case OPENSSL_ALGO_RMD160:
     980           0 :                         mdtype = (EVP_MD *) EVP_ripemd160();
     981           0 :                         break;
     982             : #endif
     983             :                 default:
     984           0 :                         return NULL;
     985             :                         break;
     986             :         }
     987          15 :         return mdtype;
     988             : }
     989             : /* }}} */
     990             : 
     991           5 : static const EVP_CIPHER * php_openssl_get_evp_cipher_from_algo(long algo) { /* {{{ */
     992           5 :         switch (algo) {
     993             : #ifndef OPENSSL_NO_RC2
     994             :                 case PHP_OPENSSL_CIPHER_RC2_40:
     995           5 :                         return EVP_rc2_40_cbc();
     996             :                         break;
     997             :                 case PHP_OPENSSL_CIPHER_RC2_64:
     998           0 :                         return EVP_rc2_64_cbc();
     999             :                         break;
    1000             :                 case PHP_OPENSSL_CIPHER_RC2_128:
    1001           0 :                         return EVP_rc2_cbc();
    1002             :                         break;
    1003             : #endif
    1004             : 
    1005             : #ifndef OPENSSL_NO_DES
    1006             :                 case PHP_OPENSSL_CIPHER_DES:
    1007           0 :                         return EVP_des_cbc();
    1008             :                         break;
    1009             :                 case PHP_OPENSSL_CIPHER_3DES:
    1010           0 :                         return EVP_des_ede3_cbc();
    1011             :                         break;
    1012             : #endif
    1013             : 
    1014             : #ifndef OPENSSL_NO_AES
    1015             :                 case PHP_OPENSSL_CIPHER_AES_128_CBC:
    1016           0 :                         return EVP_aes_128_cbc();
    1017             :                         break;
    1018             :                 case PHP_OPENSSL_CIPHER_AES_192_CBC:
    1019           0 :                         return EVP_aes_192_cbc();
    1020             :                         break;
    1021             :                 case PHP_OPENSSL_CIPHER_AES_256_CBC:
    1022           0 :                         return EVP_aes_256_cbc();
    1023             :                         break;
    1024             : #endif
    1025             : 
    1026             : 
    1027             :                 default:
    1028           0 :                         return NULL;
    1029             :                         break;
    1030             :         }
    1031             : }
    1032             : /* }}} */
    1033             : 
    1034             : /* {{{ PHP_MINIT_FUNCTION
    1035             :  */
    1036       20133 : PHP_MINIT_FUNCTION(openssl)
    1037             : {
    1038             :         char * config_filename;
    1039             : 
    1040       20133 :         le_key = zend_register_list_destructors_ex(php_pkey_free, NULL, "OpenSSL key", module_number);
    1041       20133 :         le_x509 = zend_register_list_destructors_ex(php_x509_free, NULL, "OpenSSL X.509", module_number);
    1042       20133 :         le_csr = zend_register_list_destructors_ex(php_csr_free, NULL, "OpenSSL X.509 CSR", module_number);
    1043             : 
    1044       20133 :         SSL_library_init();
    1045       20133 :         OpenSSL_add_all_ciphers();
    1046       20133 :         OpenSSL_add_all_digests();
    1047       20133 :         OpenSSL_add_all_algorithms();
    1048             : 
    1049       20133 :         SSL_load_error_strings();
    1050             : 
    1051             :         /* register a resource id number with OpenSSL so that we can map SSL -> stream structures in
    1052             :          * OpenSSL callbacks */
    1053       20133 :         ssl_stream_data_index = SSL_get_ex_new_index(0, "PHP stream index", NULL, NULL, NULL);
    1054             : 
    1055       20133 :         REGISTER_STRING_CONSTANT("OPENSSL_VERSION_TEXT", OPENSSL_VERSION_TEXT, CONST_CS|CONST_PERSISTENT);
    1056       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_VERSION_NUMBER", OPENSSL_VERSION_NUMBER, CONST_CS|CONST_PERSISTENT);
    1057             : 
    1058             :         /* purposes for cert purpose checking */
    1059       20133 :         REGISTER_LONG_CONSTANT("X509_PURPOSE_SSL_CLIENT", X509_PURPOSE_SSL_CLIENT, CONST_CS|CONST_PERSISTENT);
    1060       20133 :         REGISTER_LONG_CONSTANT("X509_PURPOSE_SSL_SERVER", X509_PURPOSE_SSL_SERVER, CONST_CS|CONST_PERSISTENT);
    1061       20133 :         REGISTER_LONG_CONSTANT("X509_PURPOSE_NS_SSL_SERVER", X509_PURPOSE_NS_SSL_SERVER, CONST_CS|CONST_PERSISTENT);
    1062       20133 :         REGISTER_LONG_CONSTANT("X509_PURPOSE_SMIME_SIGN", X509_PURPOSE_SMIME_SIGN, CONST_CS|CONST_PERSISTENT);
    1063       20133 :         REGISTER_LONG_CONSTANT("X509_PURPOSE_SMIME_ENCRYPT", X509_PURPOSE_SMIME_ENCRYPT, CONST_CS|CONST_PERSISTENT);
    1064       20133 :         REGISTER_LONG_CONSTANT("X509_PURPOSE_CRL_SIGN", X509_PURPOSE_CRL_SIGN, CONST_CS|CONST_PERSISTENT);
    1065             : #ifdef X509_PURPOSE_ANY
    1066       20133 :         REGISTER_LONG_CONSTANT("X509_PURPOSE_ANY", X509_PURPOSE_ANY, CONST_CS|CONST_PERSISTENT);
    1067             : #endif
    1068             : 
    1069             :         /* signature algorithm constants */
    1070       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_ALGO_SHA1", OPENSSL_ALGO_SHA1, CONST_CS|CONST_PERSISTENT);
    1071       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_ALGO_MD5", OPENSSL_ALGO_MD5, CONST_CS|CONST_PERSISTENT);
    1072       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_ALGO_MD4", OPENSSL_ALGO_MD4, CONST_CS|CONST_PERSISTENT);
    1073             : #ifdef HAVE_OPENSSL_MD2_H
    1074             :         REGISTER_LONG_CONSTANT("OPENSSL_ALGO_MD2", OPENSSL_ALGO_MD2, CONST_CS|CONST_PERSISTENT);
    1075             : #endif
    1076       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_ALGO_DSS1", OPENSSL_ALGO_DSS1, CONST_CS|CONST_PERSISTENT);
    1077             : #if OPENSSL_VERSION_NUMBER >= 0x0090708fL
    1078       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_ALGO_SHA224", OPENSSL_ALGO_SHA224, CONST_CS|CONST_PERSISTENT);
    1079       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_ALGO_SHA256", OPENSSL_ALGO_SHA256, CONST_CS|CONST_PERSISTENT);
    1080       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_ALGO_SHA384", OPENSSL_ALGO_SHA384, CONST_CS|CONST_PERSISTENT);
    1081       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_ALGO_SHA512", OPENSSL_ALGO_SHA512, CONST_CS|CONST_PERSISTENT);
    1082       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_ALGO_RMD160", OPENSSL_ALGO_RMD160, CONST_CS|CONST_PERSISTENT);
    1083             : #endif
    1084             : 
    1085             :         /* flags for S/MIME */
    1086       20133 :         REGISTER_LONG_CONSTANT("PKCS7_DETACHED", PKCS7_DETACHED, CONST_CS|CONST_PERSISTENT);
    1087       20133 :         REGISTER_LONG_CONSTANT("PKCS7_TEXT", PKCS7_TEXT, CONST_CS|CONST_PERSISTENT);
    1088       20133 :         REGISTER_LONG_CONSTANT("PKCS7_NOINTERN", PKCS7_NOINTERN, CONST_CS|CONST_PERSISTENT);
    1089       20133 :         REGISTER_LONG_CONSTANT("PKCS7_NOVERIFY", PKCS7_NOVERIFY, CONST_CS|CONST_PERSISTENT);
    1090       20133 :         REGISTER_LONG_CONSTANT("PKCS7_NOCHAIN", PKCS7_NOCHAIN, CONST_CS|CONST_PERSISTENT);
    1091       20133 :         REGISTER_LONG_CONSTANT("PKCS7_NOCERTS", PKCS7_NOCERTS, CONST_CS|CONST_PERSISTENT);
    1092       20133 :         REGISTER_LONG_CONSTANT("PKCS7_NOATTR", PKCS7_NOATTR, CONST_CS|CONST_PERSISTENT);
    1093       20133 :         REGISTER_LONG_CONSTANT("PKCS7_BINARY", PKCS7_BINARY, CONST_CS|CONST_PERSISTENT);
    1094       20133 :         REGISTER_LONG_CONSTANT("PKCS7_NOSIGS", PKCS7_NOSIGS, CONST_CS|CONST_PERSISTENT);
    1095             : 
    1096       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_PKCS1_PADDING", RSA_PKCS1_PADDING, CONST_CS|CONST_PERSISTENT);
    1097       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_SSLV23_PADDING", RSA_SSLV23_PADDING, CONST_CS|CONST_PERSISTENT);
    1098       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_NO_PADDING", RSA_NO_PADDING, CONST_CS|CONST_PERSISTENT);
    1099       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_PKCS1_OAEP_PADDING", RSA_PKCS1_OAEP_PADDING, CONST_CS|CONST_PERSISTENT);
    1100             : 
    1101             :         /* Ciphers */
    1102             : #ifndef OPENSSL_NO_RC2
    1103       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_CIPHER_RC2_40", PHP_OPENSSL_CIPHER_RC2_40, CONST_CS|CONST_PERSISTENT);
    1104       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_CIPHER_RC2_128", PHP_OPENSSL_CIPHER_RC2_128, CONST_CS|CONST_PERSISTENT);
    1105       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_CIPHER_RC2_64", PHP_OPENSSL_CIPHER_RC2_64, CONST_CS|CONST_PERSISTENT);
    1106             : #endif
    1107             : #ifndef OPENSSL_NO_DES
    1108       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_CIPHER_DES", PHP_OPENSSL_CIPHER_DES, CONST_CS|CONST_PERSISTENT);
    1109       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_CIPHER_3DES", PHP_OPENSSL_CIPHER_3DES, CONST_CS|CONST_PERSISTENT);
    1110             : #endif
    1111             : #ifndef OPENSSL_NO_AES
    1112       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_CIPHER_AES_128_CBC", PHP_OPENSSL_CIPHER_AES_128_CBC, CONST_CS|CONST_PERSISTENT);
    1113       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_CIPHER_AES_192_CBC", PHP_OPENSSL_CIPHER_AES_192_CBC, CONST_CS|CONST_PERSISTENT);
    1114       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_CIPHER_AES_256_CBC", PHP_OPENSSL_CIPHER_AES_256_CBC, CONST_CS|CONST_PERSISTENT);
    1115             : #endif
    1116             : 
    1117             :         /* Values for key types */
    1118       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_KEYTYPE_RSA", OPENSSL_KEYTYPE_RSA, CONST_CS|CONST_PERSISTENT);
    1119             : #ifndef NO_DSA
    1120       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_KEYTYPE_DSA", OPENSSL_KEYTYPE_DSA, CONST_CS|CONST_PERSISTENT);
    1121             : #endif
    1122       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_KEYTYPE_DH", OPENSSL_KEYTYPE_DH, CONST_CS|CONST_PERSISTENT);
    1123             : #ifdef HAVE_EVP_PKEY_EC
    1124       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_KEYTYPE_EC", OPENSSL_KEYTYPE_EC, CONST_CS|CONST_PERSISTENT);
    1125             : #endif
    1126             : 
    1127       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_RAW_DATA", OPENSSL_RAW_DATA, CONST_CS|CONST_PERSISTENT);
    1128       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_ZERO_PADDING", OPENSSL_ZERO_PADDING, CONST_CS|CONST_PERSISTENT);
    1129             : 
    1130             : #if OPENSSL_VERSION_NUMBER >= 0x0090806fL && !defined(OPENSSL_NO_TLSEXT)
    1131             :         /* SNI support included in OpenSSL >= 0.9.8j */
    1132       20133 :         REGISTER_LONG_CONSTANT("OPENSSL_TLSEXT_SERVER_NAME", 1, CONST_CS|CONST_PERSISTENT);
    1133             : #endif
    1134             : 
    1135             :         /* Determine default SSL configuration file */
    1136       20133 :         config_filename = getenv("OPENSSL_CONF");
    1137       20133 :         if (config_filename == NULL) {
    1138       20133 :                 config_filename = getenv("SSLEAY_CONF");
    1139             :         }
    1140             : 
    1141             :         /* default to 'openssl.cnf' if no environment variable is set */
    1142       20133 :         if (config_filename == NULL) {
    1143       20133 :                 snprintf(default_ssl_conf_filename, sizeof(default_ssl_conf_filename), "%s/%s",
    1144             :                                 X509_get_default_cert_area(),
    1145             :                                 "openssl.cnf");
    1146             :         } else {
    1147           0 :                 strlcpy(default_ssl_conf_filename, config_filename, sizeof(default_ssl_conf_filename));
    1148             :         }
    1149             : 
    1150       20133 :         php_stream_xport_register("ssl", php_openssl_ssl_socket_factory TSRMLS_CC);
    1151       20133 :         php_stream_xport_register("sslv3", php_openssl_ssl_socket_factory TSRMLS_CC);
    1152             : #ifndef OPENSSL_NO_SSL2
    1153       20133 :         php_stream_xport_register("sslv2", php_openssl_ssl_socket_factory TSRMLS_CC);
    1154             : #endif
    1155       20133 :         php_stream_xport_register("tls", php_openssl_ssl_socket_factory TSRMLS_CC);
    1156             : 
    1157             :         /* override the default tcp socket provider */
    1158       20133 :         php_stream_xport_register("tcp", php_openssl_ssl_socket_factory TSRMLS_CC);
    1159             : 
    1160       20133 :         php_register_url_stream_wrapper("https", &php_stream_http_wrapper TSRMLS_CC);
    1161       20133 :         php_register_url_stream_wrapper("ftps", &php_stream_ftp_wrapper TSRMLS_CC);
    1162             : 
    1163       20133 :         return SUCCESS;
    1164             : }
    1165             : /* }}} */
    1166             : 
    1167             : /* {{{ PHP_MINFO_FUNCTION
    1168             :  */
    1169         148 : PHP_MINFO_FUNCTION(openssl)
    1170             : {
    1171         148 :         php_info_print_table_start();
    1172         148 :         php_info_print_table_row(2, "OpenSSL support", "enabled");
    1173         148 :         php_info_print_table_row(2, "OpenSSL Library Version", SSLeay_version(SSLEAY_VERSION));
    1174         148 :         php_info_print_table_row(2, "OpenSSL Header Version", OPENSSL_VERSION_TEXT);
    1175         148 :         php_info_print_table_end();
    1176         148 : }
    1177             : /* }}} */
    1178             : 
    1179             : /* {{{ PHP_MSHUTDOWN_FUNCTION
    1180             :  */
    1181       20169 : PHP_MSHUTDOWN_FUNCTION(openssl)
    1182             : {
    1183       20169 :         EVP_cleanup();
    1184             : 
    1185       20169 :         php_unregister_url_stream_wrapper("https" TSRMLS_CC);
    1186       20169 :         php_unregister_url_stream_wrapper("ftps" TSRMLS_CC);
    1187             : 
    1188       20169 :         php_stream_xport_unregister("ssl" TSRMLS_CC);
    1189             : #ifndef OPENSSL_NO_SSL2
    1190       20169 :         php_stream_xport_unregister("sslv2" TSRMLS_CC);
    1191             : #endif
    1192       20169 :         php_stream_xport_unregister("sslv3" TSRMLS_CC);
    1193       20169 :         php_stream_xport_unregister("tls" TSRMLS_CC);
    1194             : 
    1195             :         /* reinstate the default tcp handler */
    1196       20169 :         php_stream_xport_register("tcp", php_stream_generic_socket_factory TSRMLS_CC);
    1197             : 
    1198       20169 :         return SUCCESS;
    1199             : }
    1200             : /* }}} */
    1201             : 
    1202             : /* {{{ x509 cert functions */
    1203             : 
    1204             : /* {{{ php_openssl_x509_from_zval
    1205             :         Given a zval, coerce it into an X509 object.
    1206             :         The zval can be:
    1207             :                 . X509 resource created using openssl_read_x509()
    1208             :                 . if it starts with file:// then it will be interpreted as the path to that cert
    1209             :                 . it will be interpreted as the cert data
    1210             :         If you supply makeresource, the result will be registered as an x509 resource and
    1211             :         it's value returned in makeresource.
    1212             : */
    1213         114 : static X509 * php_openssl_x509_from_zval(zval ** val, int makeresource, long * resourceval TSRMLS_DC)
    1214             : {
    1215         114 :         X509 *cert = NULL;
    1216             : 
    1217         114 :         if (resourceval) {
    1218         114 :                 *resourceval = -1;
    1219             :         }
    1220         114 :         if (Z_TYPE_PP(val) == IS_RESOURCE) {
    1221             :                 /* is it an x509 resource ? */
    1222             :                 void * what;
    1223             :                 int type;
    1224             : 
    1225          13 :                 what = zend_fetch_resource(val TSRMLS_CC, -1, "OpenSSL X.509", &type, 1, le_x509);
    1226          13 :                 if (!what) {
    1227           0 :                         return NULL;
    1228             :                 }
    1229             :                 /* this is so callers can decide if they should free the X509 */
    1230          13 :                 if (resourceval) {
    1231          13 :                         *resourceval = Z_LVAL_PP(val);
    1232             :                 }
    1233          13 :                 if (type == le_x509) {
    1234          13 :                         return (X509*)what;
    1235             :                 }
    1236             :                 /* other types could be used here - eg: file pointers and read in the data from them */
    1237             : 
    1238           0 :                 return NULL;
    1239             :         }
    1240             : 
    1241         101 :         if (!(Z_TYPE_PP(val) == IS_STRING || Z_TYPE_PP(val) == IS_OBJECT)) {
    1242          16 :                 return NULL;
    1243             :         }
    1244             : 
    1245             :         /* force it to be a string and check if it refers to a file */
    1246          98 :         convert_to_string_ex(val);
    1247             : 
    1248         132 :         if (Z_STRLEN_PP(val) > 7 && memcmp(Z_STRVAL_PP(val), "file://", sizeof("file://") - 1) == 0) {
    1249             :                 /* read cert from the named file */
    1250             :                 BIO *in;
    1251             : 
    1252          48 :                 if (php_openssl_open_base_dir_chk(Z_STRVAL_PP(val) + (sizeof("file://") - 1) TSRMLS_CC)) {
    1253           0 :                         return NULL;
    1254             :                 }
    1255             : 
    1256          48 :                 in = BIO_new_file(Z_STRVAL_PP(val) + (sizeof("file://") - 1), "r");
    1257          48 :                 if (in == NULL) {
    1258           0 :                         return NULL;
    1259             :                 }
    1260          48 :                 cert = PEM_read_bio_X509(in, NULL, NULL, NULL);
    1261          48 :                 BIO_free(in);
    1262             :         } else {
    1263             :                 BIO *in;
    1264             : 
    1265          36 :                 in = BIO_new_mem_buf(Z_STRVAL_PP(val), Z_STRLEN_PP(val));
    1266          36 :                 if (in == NULL) {
    1267           0 :                         return NULL;
    1268             :                 }
    1269             : #ifdef TYPEDEF_D2I_OF
    1270          36 :                 cert = (X509 *) PEM_ASN1_read_bio((d2i_of_void *)d2i_X509, PEM_STRING_X509, in, NULL, NULL, NULL);
    1271             : #else
    1272             :                 cert = (X509 *) PEM_ASN1_read_bio((char *(*)())d2i_X509, PEM_STRING_X509, in, NULL, NULL, NULL);
    1273             : #endif
    1274          36 :                 BIO_free(in);
    1275             :         }
    1276             : 
    1277          84 :         if (cert && makeresource && resourceval) {
    1278           4 :                 *resourceval = zend_list_insert(cert, le_x509 TSRMLS_CC);
    1279             :         }
    1280          84 :         return cert;
    1281             : }
    1282             : 
    1283             : /* }}} */
    1284             : 
    1285             : /* {{{ proto bool openssl_x509_export_to_file(mixed x509, string outfilename [, bool notext = true])
    1286             :    Exports a CERT to file or a var */
    1287           5 : PHP_FUNCTION(openssl_x509_export_to_file)
    1288             : {
    1289             :         X509 * cert;
    1290             :         zval ** zcert;
    1291           5 :         zend_bool notext = 1;
    1292             :         BIO * bio_out;
    1293             :         long certresource;
    1294             :         char * filename;
    1295             :         int filename_len;
    1296             : 
    1297           5 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zp|b", &zcert, &filename, &filename_len, &notext) == FAILURE) {
    1298           0 :                 return;
    1299             :         }
    1300           5 :         RETVAL_FALSE;
    1301             : 
    1302           5 :         cert = php_openssl_x509_from_zval(zcert, 0, &certresource TSRMLS_CC);
    1303           5 :         if (cert == NULL) {
    1304           2 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get cert from parameter 1");
    1305           2 :                 return;
    1306             :         }
    1307             : 
    1308           3 :         if (php_openssl_open_base_dir_chk(filename TSRMLS_CC)) {
    1309           0 :                 return;
    1310             :         }
    1311             : 
    1312           3 :         bio_out = BIO_new_file(filename, "w");
    1313           3 :         if (bio_out) {
    1314           3 :                 if (!notext) {
    1315           0 :                         X509_print(bio_out, cert);
    1316             :                 }
    1317           3 :                 PEM_write_bio_X509(bio_out, cert);
    1318             : 
    1319           3 :                 RETVAL_TRUE;
    1320             :         } else {
    1321           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error opening file %s", filename);
    1322             :         }
    1323           3 :         if (certresource == -1 && cert) {
    1324           2 :                 X509_free(cert);
    1325             :         }
    1326           3 :         BIO_free(bio_out);
    1327             : }
    1328             : /* }}} */
    1329             : 
    1330             : /* {{{ proto bool openssl_x509_export(mixed x509, string &out [, bool notext = true])
    1331             :    Exports a CERT to file or a var */
    1332           6 : PHP_FUNCTION(openssl_x509_export)
    1333             : {
    1334             :         X509 * cert;
    1335             :         zval ** zcert, *zout;
    1336           6 :         zend_bool notext = 1;
    1337             :         BIO * bio_out;
    1338             :         long certresource;
    1339             : 
    1340           6 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zz|b", &zcert, &zout, &notext) == FAILURE) {
    1341           0 :                 return;
    1342             :         }
    1343           6 :         RETVAL_FALSE;
    1344             : 
    1345           6 :         cert = php_openssl_x509_from_zval(zcert, 0, &certresource TSRMLS_CC);
    1346           6 :         if (cert == NULL) {
    1347           2 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get cert from parameter 1");
    1348           2 :                 return;
    1349             :         }
    1350             : 
    1351           4 :         bio_out = BIO_new(BIO_s_mem());
    1352           4 :         if (!notext) {
    1353           1 :                 X509_print(bio_out, cert);
    1354             :         }
    1355           4 :         if (PEM_write_bio_X509(bio_out, cert))  {
    1356             :                 BUF_MEM *bio_buf;
    1357             : 
    1358           4 :                 zval_dtor(zout);
    1359           4 :                 BIO_get_mem_ptr(bio_out, &bio_buf);
    1360           4 :                 ZVAL_STRINGL(zout, bio_buf->data, bio_buf->length, 1);
    1361             : 
    1362           4 :                 RETVAL_TRUE;
    1363             :         }
    1364             : 
    1365           4 :         if (certresource == -1 && cert) {
    1366           2 :                 X509_free(cert);
    1367             :         }
    1368           4 :         BIO_free(bio_out);
    1369             : }
    1370             : /* }}} */
    1371             : 
    1372             : /* {{{ proto bool openssl_x509_check_private_key(mixed cert, mixed key)
    1373             :    Checks if a private key corresponds to a CERT */
    1374           5 : PHP_FUNCTION(openssl_x509_check_private_key)
    1375             : {
    1376             :         zval ** zcert, **zkey;
    1377           5 :         X509 * cert = NULL;
    1378           5 :         EVP_PKEY * key = NULL;
    1379           5 :         long certresource = -1, keyresource = -1;
    1380             : 
    1381           5 :         RETVAL_FALSE;
    1382             : 
    1383           5 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ZZ", &zcert, &zkey) == FAILURE) {
    1384           0 :                 return;
    1385             :         }
    1386           5 :         cert = php_openssl_x509_from_zval(zcert, 0, &certresource TSRMLS_CC);
    1387           5 :         if (cert == NULL) {
    1388           2 :                 RETURN_FALSE;
    1389             :         }
    1390           3 :         key = php_openssl_evp_from_zval(zkey, 0, "", 1, &keyresource TSRMLS_CC);
    1391           3 :         if (key) {
    1392           2 :                 RETVAL_BOOL(X509_check_private_key(cert, key));
    1393             :         }
    1394             : 
    1395           3 :         if (keyresource == -1 && key) {
    1396           0 :                 EVP_PKEY_free(key);
    1397             :         }
    1398           3 :         if (certresource == -1 && cert) {
    1399           3 :                 X509_free(cert);
    1400             :         }
    1401             : }
    1402             : /* }}} */
    1403             : 
    1404             : /* Special handling of subjectAltName, see CVE-2013-4073
    1405             :  * Christian Heimes
    1406             :  */
    1407             : 
    1408          12 : static int openssl_x509v3_subjectAltName(BIO *bio, X509_EXTENSION *extension)
    1409             : {
    1410             :         GENERAL_NAMES *names;
    1411          12 :         const X509V3_EXT_METHOD *method = NULL;
    1412             :         long i, length, num;
    1413             :         const unsigned char *p;
    1414             : 
    1415          12 :         method = X509V3_EXT_get(extension);
    1416          12 :         if (method == NULL) {
    1417           0 :                 return -1;
    1418             :         }
    1419             : 
    1420          12 :         p = extension->value->data;
    1421          12 :         length = extension->value->length;
    1422          12 :         if (method->it) {
    1423          12 :                 names = (GENERAL_NAMES*)(ASN1_item_d2i(NULL, &p, length,
    1424          12 :                                                        ASN1_ITEM_ptr(method->it)));
    1425             :         } else {
    1426           0 :                 names = (GENERAL_NAMES*)(method->d2i(NULL, &p, length));
    1427             :         }
    1428          12 :         if (names == NULL) {
    1429           0 :                 return -1;
    1430             :         }
    1431             : 
    1432          12 :         num = sk_GENERAL_NAME_num(names);
    1433          42 :         for (i = 0; i < num; i++) {
    1434             :                         GENERAL_NAME *name;
    1435             :                         ASN1_STRING *as;
    1436          30 :                         name = sk_GENERAL_NAME_value(names, i);
    1437          30 :                         switch (name->type) {
    1438             :                                 case GEN_EMAIL:
    1439           2 :                                         BIO_puts(bio, "email:");
    1440           2 :                                         as = name->d.rfc822Name;
    1441           2 :                                         BIO_write(bio, ASN1_STRING_data(as),
    1442             :                                                   ASN1_STRING_length(as));
    1443           2 :                                         break;
    1444             :                                 case GEN_DNS:
    1445          25 :                                         BIO_puts(bio, "DNS:");
    1446          25 :                                         as = name->d.dNSName;
    1447          25 :                                         BIO_write(bio, ASN1_STRING_data(as),
    1448             :                                                   ASN1_STRING_length(as));
    1449          25 :                                         break;
    1450             :                                 case GEN_URI:
    1451           1 :                                         BIO_puts(bio, "URI:");
    1452           1 :                                         as = name->d.uniformResourceIdentifier;
    1453           1 :                                         BIO_write(bio, ASN1_STRING_data(as),
    1454             :                                                   ASN1_STRING_length(as));
    1455           1 :                                         break;
    1456             :                                 default:
    1457             :                                         /* use builtin print for GEN_OTHERNAME, GEN_X400,
    1458             :                                          * GEN_EDIPARTY, GEN_DIRNAME, GEN_IPADD and GEN_RID
    1459             :                                          */
    1460           2 :                                         GENERAL_NAME_print(bio, name);
    1461             :                         }
    1462             :                         /* trailing ', ' except for last element */
    1463          30 :                         if (i < (num - 1)) {
    1464          18 :                                 BIO_puts(bio, ", ");
    1465             :                         }
    1466             :         }
    1467          12 :         sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
    1468             : 
    1469          12 :         return 0;
    1470             : }
    1471             : 
    1472             : /* {{{ proto array openssl_x509_parse(mixed x509 [, bool shortnames=true])
    1473             :    Returns an array of the fields/values of the CERT */
    1474          29 : PHP_FUNCTION(openssl_x509_parse)
    1475             : {
    1476             :         zval ** zcert;
    1477          29 :         X509 * cert = NULL;
    1478          29 :         long certresource = -1;
    1479             :         int i;
    1480          29 :         zend_bool useshortnames = 1;
    1481             :         char * tmpstr;
    1482             :         zval * subitem;
    1483             :         X509_EXTENSION *extension;
    1484             :         char *extname;
    1485             :         BIO  *bio_out;
    1486             :         BUF_MEM *bio_buf;
    1487             :         char buf[256];
    1488             : 
    1489          29 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z|b", &zcert, &useshortnames) == FAILURE) {
    1490           1 :                 return;
    1491             :         }
    1492          28 :         cert = php_openssl_x509_from_zval(zcert, 0, &certresource TSRMLS_CC);
    1493          27 :         if (cert == NULL) {
    1494           9 :                 RETURN_FALSE;
    1495             :         }
    1496          18 :         array_init(return_value);
    1497             : 
    1498          18 :         if (cert->name) {
    1499          18 :                 add_assoc_string(return_value, "name", cert->name, 1);
    1500             :         }
    1501             : /*      add_assoc_bool(return_value, "valid", cert->valid); */
    1502             : 
    1503          18 :         add_assoc_name_entry(return_value, "subject",                 X509_get_subject_name(cert), useshortnames TSRMLS_CC);
    1504             :         /* hash as used in CA directories to lookup cert by subject name */
    1505             :         {
    1506             :                 char buf[32];
    1507          18 :                 snprintf(buf, sizeof(buf), "%08lx", X509_subject_name_hash(cert));
    1508          18 :                 add_assoc_string(return_value, "hash", buf, 1);
    1509             :         }
    1510             : 
    1511          18 :         add_assoc_name_entry(return_value, "issuer",          X509_get_issuer_name(cert), useshortnames TSRMLS_CC);
    1512          18 :         add_assoc_long(return_value, "version",                       X509_get_version(cert));
    1513             : 
    1514          18 :         add_assoc_string(return_value, "serialNumber", i2s_ASN1_INTEGER(NULL, X509_get_serialNumber(cert)), 1);
    1515             : 
    1516          18 :         add_assoc_asn1_string(return_value, "validFrom",      X509_get_notBefore(cert));
    1517          18 :         add_assoc_asn1_string(return_value, "validTo",                X509_get_notAfter(cert));
    1518             : 
    1519          18 :         add_assoc_long(return_value, "validFrom_time_t",      asn1_time_to_time_t(X509_get_notBefore(cert) TSRMLS_CC));
    1520          18 :         add_assoc_long(return_value, "validTo_time_t",                asn1_time_to_time_t(X509_get_notAfter(cert) TSRMLS_CC));
    1521             : 
    1522          18 :         tmpstr = (char *)X509_alias_get0(cert, NULL);
    1523          18 :         if (tmpstr) {
    1524           0 :                 add_assoc_string(return_value, "alias", tmpstr, 1);
    1525             :         }
    1526             : /*
    1527             :         add_assoc_long(return_value, "signaturetypeLONG", X509_get_signature_type(cert));
    1528             :         add_assoc_string(return_value, "signaturetype", OBJ_nid2sn(X509_get_signature_type(cert)), 1);
    1529             :         add_assoc_string(return_value, "signaturetypeLN", OBJ_nid2ln(X509_get_signature_type(cert)), 1);
    1530             : */
    1531          18 :         MAKE_STD_ZVAL(subitem);
    1532          18 :         array_init(subitem);
    1533             : 
    1534             :         /* NOTE: the purposes are added as integer keys - the keys match up to the X509_PURPOSE_SSL_XXX defines
    1535             :            in x509v3.h */
    1536         180 :         for (i = 0; i < X509_PURPOSE_get_count(); i++) {
    1537             :                 int id, purpset;
    1538             :                 char * pname;
    1539             :                 X509_PURPOSE * purp;
    1540             :                 zval * subsub;
    1541             : 
    1542         162 :                 MAKE_STD_ZVAL(subsub);
    1543         162 :                 array_init(subsub);
    1544             : 
    1545         162 :                 purp = X509_PURPOSE_get0(i);
    1546         162 :                 id = X509_PURPOSE_get_id(purp);
    1547             : 
    1548         162 :                 purpset = X509_check_purpose(cert, id, 0);
    1549         162 :                 add_index_bool(subsub, 0, purpset);
    1550             : 
    1551         162 :                 purpset = X509_check_purpose(cert, id, 1);
    1552         162 :                 add_index_bool(subsub, 1, purpset);
    1553             : 
    1554         162 :                 pname = useshortnames ? X509_PURPOSE_get0_sname(purp) : X509_PURPOSE_get0_name(purp);
    1555         162 :                 add_index_string(subsub, 2, pname, 1);
    1556             : 
    1557             :                 /* NOTE: if purpset > 1 then it's a warning - we should mention it ? */
    1558             : 
    1559         162 :                 add_index_zval(subitem, id, subsub);
    1560             :         }
    1561          18 :         add_assoc_zval(return_value, "purposes", subitem);
    1562             : 
    1563          18 :         MAKE_STD_ZVAL(subitem);
    1564          18 :         array_init(subitem);
    1565             : 
    1566             : 
    1567         136 :         for (i = 0; i < X509_get_ext_count(cert); i++) {
    1568             :                 int nid;
    1569         118 :                 extension = X509_get_ext(cert, i);
    1570         118 :                 nid = OBJ_obj2nid(X509_EXTENSION_get_object(extension));
    1571         118 :                 if (nid != NID_undef) {
    1572         116 :                         extname = (char *)OBJ_nid2sn(OBJ_obj2nid(X509_EXTENSION_get_object(extension)));
    1573             :                 } else {
    1574           2 :                         OBJ_obj2txt(buf, sizeof(buf)-1, X509_EXTENSION_get_object(extension), 1);
    1575           2 :                         extname = buf;
    1576             :                 }
    1577         118 :                 bio_out = BIO_new(BIO_s_mem());
    1578         118 :                 if (nid == NID_subject_alt_name) {
    1579          12 :                         if (openssl_x509v3_subjectAltName(bio_out, extension) == 0) {
    1580          12 :                                 BIO_get_mem_ptr(bio_out, &bio_buf);
    1581          12 :                                 add_assoc_stringl(subitem, extname, bio_buf->data, bio_buf->length, 1);
    1582             :                         } else {
    1583             :                                 zval_dtor(return_value);
    1584           0 :                                 if (certresource == -1 && cert) {
    1585           0 :                                         X509_free(cert);
    1586             :                                 }
    1587           0 :                                 BIO_free(bio_out);
    1588           0 :                                 RETURN_FALSE;
    1589             :                         }
    1590             :                 }
    1591         106 :                 else if (X509V3_EXT_print(bio_out, extension, 0, 0)) {
    1592         104 :                         BIO_get_mem_ptr(bio_out, &bio_buf);
    1593         104 :                         add_assoc_stringl(subitem, extname, bio_buf->data, bio_buf->length, 1);
    1594             :                 } else {
    1595           2 :                         add_assoc_asn1_string(subitem, extname, X509_EXTENSION_get_data(extension));
    1596             :                 }
    1597         118 :                 BIO_free(bio_out);
    1598             :         }
    1599          18 :         add_assoc_zval(return_value, "extensions", subitem);
    1600             : 
    1601          18 :         if (certresource == -1 && cert) {
    1602           9 :                 X509_free(cert);
    1603             :         }
    1604             : }
    1605             : /* }}} */
    1606             : 
    1607             : /* {{{ load_all_certs_from_file */
    1608           0 : static STACK_OF(X509) * load_all_certs_from_file(char *certfile)
    1609             : {
    1610           0 :         STACK_OF(X509_INFO) *sk=NULL;
    1611           0 :         STACK_OF(X509) *stack=NULL, *ret=NULL;
    1612           0 :         BIO *in=NULL;
    1613             :         X509_INFO *xi;
    1614             :         TSRMLS_FETCH();
    1615             : 
    1616           0 :         if(!(stack = sk_X509_new_null())) {
    1617           0 :                 php_error_docref(NULL TSRMLS_CC, E_ERROR, "memory allocation failure");
    1618           0 :                 goto end;
    1619             :         }
    1620             : 
    1621           0 :         if (php_openssl_open_base_dir_chk(certfile TSRMLS_CC)) {
    1622           0 :                 sk_X509_free(stack);
    1623           0 :                 goto end;
    1624             :         }
    1625             : 
    1626           0 :         if(!(in=BIO_new_file(certfile, "r"))) {
    1627           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error opening the file, %s", certfile);
    1628           0 :                 sk_X509_free(stack);
    1629           0 :                 goto end;
    1630             :         }
    1631             : 
    1632             :         /* This loads from a file, a stack of x509/crl/pkey sets */
    1633           0 :         if(!(sk=PEM_X509_INFO_read_bio(in, NULL, NULL, NULL))) {
    1634           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error reading the file, %s", certfile);
    1635           0 :                 sk_X509_free(stack);
    1636           0 :                 goto end;
    1637             :         }
    1638             : 
    1639             :         /* scan over it and pull out the certs */
    1640           0 :         while (sk_X509_INFO_num(sk)) {
    1641           0 :                 xi=sk_X509_INFO_shift(sk);
    1642           0 :                 if (xi->x509 != NULL) {
    1643           0 :                         sk_X509_push(stack,xi->x509);
    1644           0 :                         xi->x509=NULL;
    1645             :                 }
    1646           0 :                 X509_INFO_free(xi);
    1647             :         }
    1648           0 :         if(!sk_X509_num(stack)) {
    1649           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "no certificates in file, %s", certfile);
    1650           0 :                 sk_X509_free(stack);
    1651           0 :                 goto end;
    1652             :         }
    1653           0 :         ret=stack;
    1654             : end:
    1655           0 :         BIO_free(in);
    1656           0 :         sk_X509_INFO_free(sk);
    1657             : 
    1658           0 :         return ret;
    1659             : }
    1660             : /* }}} */
    1661             : 
    1662             : /* {{{ check_cert */
    1663           0 : static int check_cert(X509_STORE *ctx, X509 *x, STACK_OF(X509) *untrustedchain, int purpose)
    1664             : {
    1665           0 :         int ret=0;
    1666             :         X509_STORE_CTX *csc;
    1667             :         TSRMLS_FETCH();
    1668             : 
    1669           0 :         csc = X509_STORE_CTX_new();
    1670           0 :         if (csc == NULL) {
    1671           0 :                 php_error_docref(NULL TSRMLS_CC, E_ERROR, "memory allocation failure");
    1672           0 :                 return 0;
    1673             :         }
    1674           0 :         X509_STORE_CTX_init(csc, ctx, x, untrustedchain);
    1675           0 :         if(purpose >= 0) {
    1676           0 :                 X509_STORE_CTX_set_purpose(csc, purpose);
    1677             :         }
    1678           0 :         ret = X509_verify_cert(csc);
    1679           0 :         X509_STORE_CTX_free(csc);
    1680             : 
    1681           0 :         return ret;
    1682             : }
    1683             : /* }}} */
    1684             : 
    1685             : /* {{{ proto int openssl_x509_checkpurpose(mixed x509cert, int purpose, array cainfo [, string untrustedfile])
    1686             :    Checks the CERT to see if it can be used for the purpose in purpose. cainfo holds information about trusted CAs */
    1687           0 : PHP_FUNCTION(openssl_x509_checkpurpose)
    1688             : {
    1689           0 :         zval ** zcert, * zcainfo = NULL;
    1690           0 :         X509_STORE * cainfo = NULL;
    1691           0 :         X509 * cert = NULL;
    1692           0 :         long certresource = -1;
    1693           0 :         STACK_OF(X509) * untrustedchain = NULL;
    1694             :         long purpose;
    1695           0 :         char * untrusted = NULL;
    1696           0 :         int untrusted_len = 0, ret;
    1697             : 
    1698           0 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zl|a!s", &zcert, &purpose, &zcainfo, &untrusted, &untrusted_len) == FAILURE) {
    1699           0 :                 return;
    1700             :         }
    1701             : 
    1702           0 :         RETVAL_LONG(-1);
    1703             : 
    1704           0 :         if (untrusted) {
    1705           0 :                 untrustedchain = load_all_certs_from_file(untrusted);
    1706           0 :                 if (untrustedchain == NULL) {
    1707           0 :                         goto clean_exit;
    1708             :                 }
    1709             :         }
    1710             : 
    1711           0 :         cainfo = setup_verify(zcainfo TSRMLS_CC);
    1712           0 :         if (cainfo == NULL) {
    1713           0 :                 goto clean_exit;
    1714             :         }
    1715           0 :         cert = php_openssl_x509_from_zval(zcert, 0, &certresource TSRMLS_CC);
    1716           0 :         if (cert == NULL) {
    1717           0 :                 goto clean_exit;
    1718             :         }
    1719             : 
    1720           0 :         ret = check_cert(cainfo, cert, untrustedchain, purpose);
    1721           0 :         if (ret != 0 && ret != 1) {
    1722           0 :                 RETVAL_LONG(ret);
    1723             :         } else {
    1724           0 :                 RETVAL_BOOL(ret);
    1725             :         }
    1726             : 
    1727             : clean_exit:
    1728           0 :         if (certresource == 1 && cert) {
    1729           0 :                 X509_free(cert);
    1730             :         }
    1731           0 :         if (cainfo) {
    1732           0 :                 X509_STORE_free(cainfo);
    1733             :         }
    1734           0 :         if (untrustedchain) {
    1735           0 :                 sk_X509_pop_free(untrustedchain, X509_free);
    1736             :         }
    1737             : }
    1738             : /* }}} */
    1739             : 
    1740             : /* {{{ setup_verify
    1741             :  * calist is an array containing file and directory names.  create a
    1742             :  * certificate store and add those certs to it for use in verification.
    1743             : */
    1744           0 : static X509_STORE * setup_verify(zval * calist TSRMLS_DC)
    1745             : {
    1746             :         X509_STORE *store;
    1747             :         X509_LOOKUP * dir_lookup, * file_lookup;
    1748             :         HashPosition pos;
    1749           0 :         int ndirs = 0, nfiles = 0;
    1750             : 
    1751           0 :         store = X509_STORE_new();
    1752             : 
    1753           0 :         if (store == NULL) {
    1754           0 :                 return NULL;
    1755             :         }
    1756             : 
    1757           0 :         if (calist && (Z_TYPE_P(calist) == IS_ARRAY)) {
    1758           0 :                 zend_hash_internal_pointer_reset_ex(HASH_OF(calist), &pos);
    1759           0 :                 for (;; zend_hash_move_forward_ex(HASH_OF(calist), &pos)) {
    1760             :                         zval ** item;
    1761             :                         struct stat sb;
    1762             : 
    1763           0 :                         if (zend_hash_get_current_data_ex(HASH_OF(calist), (void**)&item, &pos) == FAILURE) {
    1764           0 :                                 break;
    1765             :                         }
    1766           0 :                         convert_to_string_ex(item);
    1767             : 
    1768           0 :                         if (VCWD_STAT(Z_STRVAL_PP(item), &sb) == -1) {
    1769           0 :                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to stat %s", Z_STRVAL_PP(item));
    1770           0 :                                 continue;
    1771             :                         }
    1772             : 
    1773           0 :                         if ((sb.st_mode & S_IFREG) == S_IFREG) {
    1774           0 :                                 file_lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
    1775           0 :                                 if (file_lookup == NULL || !X509_LOOKUP_load_file(file_lookup, Z_STRVAL_PP(item), X509_FILETYPE_PEM)) {
    1776           0 :                                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "error loading file %s", Z_STRVAL_PP(item));
    1777             :                                 } else {
    1778           0 :                                         nfiles++;
    1779             :                                 }
    1780           0 :                                 file_lookup = NULL;
    1781             :                         } else {
    1782           0 :                                 dir_lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
    1783           0 :                                 if (dir_lookup == NULL || !X509_LOOKUP_add_dir(dir_lookup, Z_STRVAL_PP(item), X509_FILETYPE_PEM)) {
    1784           0 :                                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "error loading directory %s", Z_STRVAL_PP(item));
    1785             :                                 } else {
    1786           0 :                                         ndirs++;
    1787             :                                 }
    1788           0 :                                 dir_lookup = NULL;
    1789             :                         }
    1790           0 :                 }
    1791             :         }
    1792           0 :         if (nfiles == 0) {
    1793           0 :                 file_lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
    1794           0 :                 if (file_lookup) {
    1795           0 :                         X509_LOOKUP_load_file(file_lookup, NULL, X509_FILETYPE_DEFAULT);
    1796             :                 }
    1797             :         }
    1798           0 :         if (ndirs == 0) {
    1799           0 :                 dir_lookup = X509_STORE_add_lookup(store, X509_LOOKUP_hash_dir());
    1800           0 :                 if (dir_lookup) {
    1801           0 :                         X509_LOOKUP_add_dir(dir_lookup, NULL, X509_FILETYPE_DEFAULT);
    1802             :                 }
    1803             :         }
    1804           0 :         return store;
    1805             : }
    1806             : /* }}} */
    1807             : 
    1808             : /* {{{ proto resource openssl_x509_read(mixed cert)
    1809             :    Reads X.509 certificates */
    1810           8 : PHP_FUNCTION(openssl_x509_read)
    1811             : {
    1812             :         zval **cert;
    1813             :         X509 *x509;
    1814             : 
    1815           8 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z", &cert) == FAILURE) {
    1816           0 :                 return;
    1817             :         }
    1818           8 :         Z_TYPE_P(return_value) = IS_RESOURCE;
    1819           8 :         x509 = php_openssl_x509_from_zval(cert, 1, &Z_LVAL_P(return_value) TSRMLS_CC);
    1820             : 
    1821           8 :         if (x509 == NULL) {
    1822           3 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "supplied parameter cannot be coerced into an X509 certificate!");
    1823           3 :                 RETURN_FALSE;
    1824             :         }
    1825             : }
    1826             : /* }}} */
    1827             : 
    1828             : /* {{{ proto void openssl_x509_free(resource x509)
    1829             :    Frees X.509 certificates */
    1830           6 : PHP_FUNCTION(openssl_x509_free)
    1831             : {
    1832             :         zval *x509;
    1833             :         X509 *cert;
    1834             : 
    1835           6 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r", &x509) == FAILURE) {
    1836           3 :                 return;
    1837             :         }
    1838           3 :         ZEND_FETCH_RESOURCE(cert, X509 *, &x509, -1, "OpenSSL X.509", le_x509);
    1839           3 :         zend_list_delete(Z_LVAL_P(x509));
    1840             : }
    1841             : /* }}} */
    1842             : 
    1843             : /* }}} */
    1844             : 
    1845             : /* Pop all X509 from Stack and free them, free the stack afterwards */
    1846           0 : static void php_sk_X509_free(STACK_OF(X509) * sk) /* {{{ */
    1847             : {
    1848             :         for (;;) {
    1849           0 :                 X509* x = sk_X509_pop(sk);
    1850           0 :                 if (!x) break;
    1851           0 :                 X509_free(x);
    1852           0 :         }
    1853           0 :         sk_X509_free(sk);
    1854           0 : }
    1855             : /* }}} */
    1856             : 
    1857           0 : static STACK_OF(X509) * php_array_to_X509_sk(zval ** zcerts TSRMLS_DC) /* {{{ */
    1858             : {
    1859             :         HashPosition hpos;
    1860             :         zval ** zcertval;
    1861           0 :         STACK_OF(X509) * sk = NULL;
    1862             :     X509 * cert;
    1863             :     long certresource;
    1864             : 
    1865           0 :         sk = sk_X509_new_null();
    1866             : 
    1867             :         /* get certs */
    1868           0 :         if (Z_TYPE_PP(zcerts) == IS_ARRAY) {
    1869           0 :                 zend_hash_internal_pointer_reset_ex(HASH_OF(*zcerts), &hpos);
    1870           0 :                 while(zend_hash_get_current_data_ex(HASH_OF(*zcerts), (void**)&zcertval, &hpos) == SUCCESS) {
    1871             : 
    1872           0 :                         cert = php_openssl_x509_from_zval(zcertval, 0, &certresource TSRMLS_CC);
    1873           0 :                         if (cert == NULL) {
    1874           0 :                                 goto clean_exit;
    1875             :                         }
    1876             : 
    1877           0 :                         if (certresource != -1) {
    1878           0 :                                 cert = X509_dup(cert);
    1879             : 
    1880           0 :                                 if (cert == NULL) {
    1881           0 :                                         goto clean_exit;
    1882             :                                 }
    1883             : 
    1884             :                         }
    1885           0 :                         sk_X509_push(sk, cert);
    1886             : 
    1887           0 :                         zend_hash_move_forward_ex(HASH_OF(*zcerts), &hpos);
    1888             :                 }
    1889             :         } else {
    1890             :                 /* a single certificate */
    1891           0 :                 cert = php_openssl_x509_from_zval(zcerts, 0, &certresource TSRMLS_CC);
    1892             : 
    1893           0 :                 if (cert == NULL) {
    1894           0 :                         goto clean_exit;
    1895             :                 }
    1896             : 
    1897           0 :                 if (certresource != -1) {
    1898           0 :                         cert = X509_dup(cert);
    1899           0 :                         if (cert == NULL) {
    1900           0 :                                 goto clean_exit;
    1901             :                         }
    1902             :                 }
    1903           0 :                 sk_X509_push(sk, cert);
    1904             :         }
    1905             : 
    1906             :   clean_exit:
    1907           0 :     return sk;
    1908             : }
    1909             : /* }}} */
    1910             : 
    1911             : /* {{{ proto bool openssl_pkcs12_export_to_file(mixed x509, string filename, mixed priv_key, string pass[, array args])
    1912             :    Creates and exports a PKCS to file */
    1913           0 : PHP_FUNCTION(openssl_pkcs12_export_to_file)
    1914             : {
    1915           0 :         X509 * cert = NULL;
    1916           0 :         BIO * bio_out = NULL;
    1917           0 :         PKCS12 * p12 = NULL;
    1918             :         char * filename;
    1919           0 :         char * friendly_name = NULL;
    1920             :         int filename_len;
    1921             :         char * pass;
    1922             :         int pass_len;
    1923           0 :         zval **zcert = NULL, *zpkey = NULL, *args = NULL;
    1924           0 :         EVP_PKEY *priv_key = NULL;
    1925             :         long certresource, keyresource;
    1926             :         zval ** item;
    1927           0 :         STACK_OF(X509) *ca = NULL;
    1928             : 
    1929           0 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zpzs|a", &zcert, &filename, &filename_len, &zpkey, &pass, &pass_len, &args) == FAILURE)
    1930           0 :                 return;
    1931             : 
    1932           0 :         RETVAL_FALSE;
    1933             : 
    1934           0 :         cert = php_openssl_x509_from_zval(zcert, 0, &certresource TSRMLS_CC);
    1935           0 :         if (cert == NULL) {
    1936           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get cert from parameter 1");
    1937           0 :                 return;
    1938             :         }
    1939           0 :         priv_key = php_openssl_evp_from_zval(&zpkey, 0, "", 1, &keyresource TSRMLS_CC);
    1940           0 :         if (priv_key == NULL) {
    1941           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get private key from parameter 3");
    1942           0 :                 goto cleanup;
    1943             :         }
    1944           0 :         if (cert && !X509_check_private_key(cert, priv_key)) {
    1945           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "private key does not correspond to cert");
    1946           0 :                 goto cleanup;
    1947             :         }
    1948           0 :         if (php_openssl_open_base_dir_chk(filename TSRMLS_CC)) {
    1949           0 :                 goto cleanup;
    1950             :         }
    1951             : 
    1952             :         /* parse extra config from args array, promote this to an extra function */
    1953           0 :         if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS)
    1954           0 :                 friendly_name = Z_STRVAL_PP(item);
    1955             :         /* certpbe (default RC2-40)
    1956             :            keypbe (default 3DES)
    1957             :            friendly_caname
    1958             :         */
    1959             : 
    1960           0 :         if (args && zend_hash_find(Z_ARRVAL_P(args), "extracerts", sizeof("extracerts"), (void**)&item) == SUCCESS)
    1961           0 :                 ca = php_array_to_X509_sk(item TSRMLS_CC);
    1962             :         /* end parse extra config */
    1963             : 
    1964             :         /*PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert, STACK_OF(X509) *ca,
    1965             :                                        int nid_key, int nid_cert, int iter, int mac_iter, int keytype);*/
    1966             : 
    1967           0 :         p12 = PKCS12_create(pass, friendly_name, priv_key, cert, ca, 0, 0, 0, 0, 0);
    1968             : 
    1969           0 :         bio_out = BIO_new_file(filename, "w");
    1970           0 :         if (bio_out) {
    1971             : 
    1972           0 :                 i2d_PKCS12_bio(bio_out, p12);
    1973             : 
    1974           0 :                 RETVAL_TRUE;
    1975             :         } else {
    1976           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error opening file %s", filename);
    1977             :         }
    1978             : 
    1979           0 :         BIO_free(bio_out);
    1980           0 :         PKCS12_free(p12);
    1981           0 :         php_sk_X509_free(ca);
    1982             : 
    1983             : cleanup:
    1984             : 
    1985           0 :         if (keyresource == -1 && priv_key) {
    1986           0 :                 EVP_PKEY_free(priv_key);
    1987             :         }
    1988           0 :         if (certresource == -1 && cert) {
    1989           0 :                 X509_free(cert);
    1990             :         }
    1991             : }
    1992             : /* }}} */
    1993             : 
    1994             : /* {{{ proto bool openssl_pkcs12_export(mixed x509, string &out, mixed priv_key, string pass[, array args])
    1995             :    Creates and exports a PKCS12 to a var */
    1996           0 : PHP_FUNCTION(openssl_pkcs12_export)
    1997             : {
    1998           0 :         X509 * cert = NULL;
    1999             :         BIO * bio_out;
    2000           0 :         PKCS12 * p12 = NULL;
    2001           0 :         zval * zcert = NULL, *zout = NULL, *zpkey, *args = NULL;
    2002           0 :         EVP_PKEY *priv_key = NULL;
    2003             :         long certresource, keyresource;
    2004             :         char * pass;
    2005             :         int pass_len;
    2006           0 :         char * friendly_name = NULL;
    2007             :         zval ** item;
    2008           0 :         STACK_OF(X509) *ca = NULL;
    2009             : 
    2010           0 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "zzzs|a", &zcert, &zout, &zpkey, &pass, &pass_len, &args) == FAILURE)
    2011           0 :                 return;
    2012             : 
    2013           0 :         RETVAL_FALSE;
    2014             : 
    2015           0 :         cert = php_openssl_x509_from_zval(&zcert, 0, &certresource TSRMLS_CC);
    2016           0 :         if (cert == NULL) {
    2017           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get cert from parameter 1");
    2018           0 :                 return;
    2019             :         }
    2020           0 :         priv_key = php_openssl_evp_from_zval(&zpkey, 0, "", 1, &keyresource TSRMLS_CC);
    2021           0 :         if (priv_key == NULL) {
    2022           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get private key from parameter 3");
    2023           0 :                 goto cleanup;
    2024             :         }
    2025           0 :         if (cert && !X509_check_private_key(cert, priv_key)) {
    2026           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "private key does not correspond to cert");
    2027           0 :                 goto cleanup;
    2028             :         }
    2029             : 
    2030             :         /* parse extra config from args array, promote this to an extra function */
    2031           0 :         if (args && zend_hash_find(Z_ARRVAL_P(args), "friendly_name", sizeof("friendly_name"), (void**)&item) == SUCCESS)
    2032           0 :                 friendly_name = Z_STRVAL_PP(item);
    2033             : 
    2034           0 :         if (args && zend_hash_find(Z_ARRVAL_P(args), "extracerts", sizeof("extracerts"), (void**)&item) == SUCCESS)
    2035           0 :                 ca = php_array_to_X509_sk(item TSRMLS_CC);
    2036             :         /* end parse extra config */
    2037             : 
    2038           0 :         p12 = PKCS12_create(pass, friendly_name, priv_key, cert, ca, 0, 0, 0, 0, 0);
    2039             : 
    2040           0 :         bio_out = BIO_new(BIO_s_mem());
    2041           0 :         if (i2d_PKCS12_bio(bio_out, p12))  {
    2042             :                 BUF_MEM *bio_buf;
    2043             : 
    2044           0 :                 zval_dtor(zout);
    2045           0 :                 BIO_get_mem_ptr(bio_out, &bio_buf);
    2046           0 :                 ZVAL_STRINGL(zout, bio_buf->data, bio_buf->length, 1);
    2047             : 
    2048           0 :                 RETVAL_TRUE;
    2049             :         }
    2050             : 
    2051           0 :         BIO_free(bio_out);
    2052           0 :         PKCS12_free(p12);
    2053           0 :         php_sk_X509_free(ca);
    2054             : 
    2055             : cleanup:
    2056             : 
    2057           0 :         if (keyresource == -1 && priv_key) {
    2058           0 :                 EVP_PKEY_free(priv_key);
    2059             :         }
    2060           0 :         if (certresource == -1 && cert) {
    2061           0 :                 X509_free(cert);
    2062             :         }
    2063             : }
    2064             : /* }}} */
    2065             : 
    2066             : /* {{{ proto bool openssl_pkcs12_read(string PKCS12, array &certs, string pass)
    2067             :    Parses a PKCS12 to an array */
    2068           1 : PHP_FUNCTION(openssl_pkcs12_read)
    2069             : {
    2070           1 :         zval *zout = NULL, *zextracerts, *zcert, *zpkey;
    2071             :         char *pass, *zp12;
    2072             :         int pass_len, zp12_len;
    2073           1 :         PKCS12 * p12 = NULL;
    2074           1 :         EVP_PKEY * pkey = NULL;
    2075           1 :         X509 * cert = NULL;
    2076           1 :         STACK_OF(X509) * ca = NULL;
    2077           1 :         BIO * bio_in = NULL;
    2078             :         int i;
    2079             : 
    2080           1 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "szs", &zp12, &zp12_len, &zout, &pass, &pass_len) == FAILURE)
    2081           0 :                 return;
    2082             : 
    2083           1 :         RETVAL_FALSE;
    2084             : 
    2085           1 :         bio_in = BIO_new(BIO_s_mem());
    2086             : 
    2087           1 :         if(!BIO_write(bio_in, zp12, zp12_len))
    2088           0 :                 goto cleanup;
    2089             : 
    2090           1 :         if(d2i_PKCS12_bio(bio_in, &p12)) {
    2091           0 :                 if(PKCS12_parse(p12, pass, &pkey, &cert, &ca)) {
    2092             :                         BIO * bio_out;
    2093             : 
    2094           0 :                         zval_dtor(zout);
    2095           0 :                         array_init(zout);
    2096             : 
    2097           0 :                         bio_out = BIO_new(BIO_s_mem());
    2098           0 :                         if (PEM_write_bio_X509(bio_out, cert)) {
    2099             :                                 BUF_MEM *bio_buf;
    2100           0 :                                 BIO_get_mem_ptr(bio_out, &bio_buf);
    2101           0 :                                 MAKE_STD_ZVAL(zcert);
    2102           0 :                                 ZVAL_STRINGL(zcert, bio_buf->data, bio_buf->length, 1);
    2103           0 :                                 add_assoc_zval(zout, "cert", zcert);
    2104             :                         }
    2105           0 :                         BIO_free(bio_out);
    2106             : 
    2107           0 :                         bio_out = BIO_new(BIO_s_mem());
    2108           0 :                         if (PEM_write_bio_PrivateKey(bio_out, pkey, NULL, NULL, 0, 0, NULL)) {
    2109             :                                 BUF_MEM *bio_buf;
    2110           0 :                                 BIO_get_mem_ptr(bio_out, &bio_buf);
    2111           0 :                                 MAKE_STD_ZVAL(zpkey);
    2112           0 :                                 ZVAL_STRINGL(zpkey, bio_buf->data, bio_buf->length, 1);
    2113           0 :                                 add_assoc_zval(zout, "pkey", zpkey);
    2114             :                         }
    2115           0 :                         BIO_free(bio_out);
    2116             : 
    2117           0 :                         MAKE_STD_ZVAL(zextracerts);
    2118           0 :                         array_init(zextracerts);
    2119             : 
    2120           0 :                         for (i=0;;i++) {
    2121             :                                 zval * zextracert;
    2122           0 :                                 X509* aCA = sk_X509_pop(ca);
    2123           0 :                                 if (!aCA) break;
    2124             : 
    2125           0 :                                 bio_out = BIO_new(BIO_s_mem());
    2126           0 :                                 if (PEM_write_bio_X509(bio_out, aCA)) {
    2127             :                                         BUF_MEM *bio_buf;
    2128           0 :                                         BIO_get_mem_ptr(bio_out, &bio_buf);
    2129           0 :                                         MAKE_STD_ZVAL(zextracert);
    2130           0 :                                         ZVAL_STRINGL(zextracert, bio_buf->data, bio_buf->length, 1);
    2131           0 :                                         add_index_zval(zextracerts, i, zextracert);
    2132             : 
    2133             :                                 }
    2134           0 :                                 BIO_free(bio_out);
    2135             : 
    2136           0 :                                 X509_free(aCA);
    2137           0 :                         }
    2138           0 :                         if(ca) {
    2139           0 :                                 sk_X509_free(ca);
    2140           0 :                                 add_assoc_zval(zout, "extracerts", zextracerts);
    2141             :                         } else {
    2142             :                                 zval_dtor(zextracerts);
    2143             :                         }
    2144             : 
    2145           0 :                         RETVAL_TRUE;
    2146             : 
    2147           0 :                         PKCS12_free(p12);
    2148             :                 }
    2149             :         }
    2150             : 
    2151             :   cleanup:
    2152           1 :         if (bio_in) {
    2153           1 :                 BIO_free(bio_in);
    2154             :         }
    2155           1 :         if (pkey) {
    2156           0 :                 EVP_PKEY_free(pkey);
    2157             :         }
    2158           1 :         if (cert) {
    2159           0 :                 X509_free(cert);
    2160             :         }
    2161             : }
    2162             : /* }}} */
    2163             : 
    2164             : /* {{{ x509 CSR functions */
    2165             : 
    2166             : /* {{{ php_openssl_make_REQ */
    2167           6 : static int php_openssl_make_REQ(struct php_x509_request * req, X509_REQ * csr, zval * dn, zval * attribs TSRMLS_DC)
    2168             : {
    2169           6 :         STACK_OF(CONF_VALUE) * dn_sk, *attr_sk = NULL;
    2170             :         char * str, *dn_sect, *attr_sect;
    2171             : 
    2172           6 :         dn_sect = CONF_get_string(req->req_config, req->section_name, "distinguished_name");
    2173           6 :         if (dn_sect == NULL) {
    2174           0 :                 return FAILURE;
    2175             :         }
    2176           6 :         dn_sk = CONF_get_section(req->req_config, dn_sect);
    2177           6 :         if (dn_sk == NULL) {
    2178           0 :                 return FAILURE;
    2179             :         }
    2180           6 :         attr_sect = CONF_get_string(req->req_config, req->section_name, "attributes");
    2181           6 :         if (attr_sect == NULL) {
    2182           0 :                 attr_sk = NULL;
    2183             :         } else {
    2184           6 :                 attr_sk = CONF_get_section(req->req_config, attr_sect);
    2185           6 :                 if (attr_sk == NULL) {
    2186           0 :                         return FAILURE;
    2187             :                 }
    2188             :         }
    2189             :         /* setup the version number: version 1 */
    2190           6 :         if (X509_REQ_set_version(csr, 0L)) {
    2191             :                 int i, nid;
    2192             :                 char * type;
    2193             :                 CONF_VALUE * v;
    2194             :                 X509_NAME * subj;
    2195             :                 HashPosition hpos;
    2196             :                 zval ** item;
    2197             : 
    2198           6 :                 subj = X509_REQ_get_subject_name(csr);
    2199             :                 /* apply values from the dn hash */
    2200           6 :                 zend_hash_internal_pointer_reset_ex(HASH_OF(dn), &hpos);
    2201          35 :                 while(zend_hash_get_current_data_ex(HASH_OF(dn), (void**)&item, &hpos) == SUCCESS) {
    2202          23 :                         char * strindex = NULL;
    2203          23 :                         uint strindexlen = 0;
    2204             :                         ulong intindex;
    2205             : 
    2206          23 :                         zend_hash_get_current_key_ex(HASH_OF(dn), &strindex, &strindexlen, &intindex, 0, &hpos);
    2207             : 
    2208          29 :                         convert_to_string_ex(item);
    2209             : 
    2210          23 :                         if (strindex) {
    2211             :                                 int nid;
    2212             : 
    2213          21 :                                 nid = OBJ_txt2nid(strindex);
    2214          21 :                                 if (nid != NID_undef) {
    2215          21 :                                         if (!X509_NAME_add_entry_by_NID(subj, nid, MBSTRING_UTF8,
    2216          21 :                                                                 (unsigned char*)Z_STRVAL_PP(item), -1, -1, 0))
    2217             :                                         {
    2218           0 :                                                 php_error_docref(NULL TSRMLS_CC, E_WARNING,
    2219             :                                                         "dn: add_entry_by_NID %d -> %s (failed; check error"
    2220             :                                                         " queue and value of string_mask OpenSSL option "
    2221             :                                                         "if illegal characters are reported)",
    2222           0 :                                                         nid, Z_STRVAL_PP(item));
    2223           0 :                                                 return FAILURE;
    2224             :                                         }
    2225             :                                 } else {
    2226           0 :                                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "dn: %s is not a recognized name", strindex);
    2227             :                                 }
    2228             :                         }
    2229          23 :                         zend_hash_move_forward_ex(HASH_OF(dn), &hpos);
    2230             :                 }
    2231             : 
    2232             :                 /* Finally apply defaults from config file */
    2233          90 :                 for(i = 0; i < sk_CONF_VALUE_num(dn_sk); i++) {
    2234             :                         int len;
    2235             :                         char buffer[200 + 1]; /*200 + \0 !*/
    2236             : 
    2237          84 :                         v = sk_CONF_VALUE_value(dn_sk, i);
    2238          84 :                         type = v->name;
    2239             : 
    2240          84 :                         len = strlen(type);
    2241          84 :                         if (len < sizeof("_default")) {
    2242           0 :                                 continue;
    2243             :                         }
    2244          84 :                         len -= sizeof("_default") - 1;
    2245          84 :                         if (strcmp("_default", type + len) != 0) {
    2246          66 :                                 continue;
    2247             :                         }
    2248          18 :                         if (len > 200) {
    2249           0 :                                 len = 200;
    2250             :                         }
    2251          18 :                         memcpy(buffer, type, len);
    2252          18 :                         buffer[len] = '\0';
    2253          18 :                         type = buffer;
    2254             : 
    2255             :                         /* Skip past any leading X. X: X, etc to allow for multiple
    2256             :                          * instances */
    2257         204 :                         for (str = type; *str; str++) {
    2258         192 :                                 if (*str == ':' || *str == ',' || *str == '.') {
    2259           6 :                                         str++;
    2260           6 :                                         if (*str) {
    2261           6 :                                                 type = str;
    2262             :                                         }
    2263           6 :                                         break;
    2264             :                                 }
    2265             :                         }
    2266             :                         /* if it is already set, skip this */
    2267          18 :                         nid = OBJ_txt2nid(type);
    2268          18 :                         if (X509_NAME_get_index_by_NID(subj, nid, -1) >= 0) {
    2269          10 :                                 continue;
    2270             :                         }
    2271           8 :                         if (!X509_NAME_add_entry_by_txt(subj, type, MBSTRING_UTF8, (unsigned char*)v->value, -1, -1, 0)) {
    2272           0 :                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "add_entry_by_txt %s -> %s (failed)", type, v->value);
    2273           0 :                                 return FAILURE;
    2274             :                         }
    2275           8 :                         if (!X509_NAME_entry_count(subj)) {
    2276           0 :                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "no objects specified in config file");
    2277           0 :                                 return FAILURE;
    2278             :                         }
    2279             :                 }
    2280           6 :                 if (attribs) {
    2281           1 :                         zend_hash_internal_pointer_reset_ex(HASH_OF(attribs), &hpos);
    2282           2 :                         while(zend_hash_get_current_data_ex(HASH_OF(attribs), (void**)&item, &hpos) == SUCCESS) {
    2283           0 :                                 char *strindex = NULL;
    2284             :                                 uint strindexlen;
    2285             :                                 ulong intindex;
    2286             : 
    2287           0 :                                 zend_hash_get_current_key_ex(HASH_OF(attribs), &strindex, &strindexlen, &intindex, 0, &hpos);
    2288           0 :                                 convert_to_string_ex(item);
    2289             : 
    2290           0 :                                 if (strindex) {
    2291             :                                         int nid;
    2292             : 
    2293           0 :                                         nid = OBJ_txt2nid(strindex);
    2294           0 :                                         if (nid != NID_undef) {
    2295           0 :                                                 if (!X509_NAME_add_entry_by_NID(subj, nid, MBSTRING_UTF8, (unsigned char*)Z_STRVAL_PP(item), -1, -1, 0)) {
    2296           0 :                                                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "attribs: add_entry_by_NID %d -> %s (failed)", nid, Z_STRVAL_PP(item));
    2297           0 :                                                         return FAILURE;
    2298             :                                                 }
    2299             :                                         } else {
    2300           0 :                                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "dn: %s is not a recognized name", strindex);
    2301             :                                         }
    2302             :                                 }
    2303           0 :                                 zend_hash_move_forward_ex(HASH_OF(attribs), &hpos);
    2304             :                         }
    2305           2 :                         for (i = 0; i < sk_CONF_VALUE_num(attr_sk); i++) {
    2306           2 :                                 v = sk_CONF_VALUE_value(attr_sk, i);
    2307             :                                 /* if it is already set, skip this */
    2308           2 :                                 nid = OBJ_txt2nid(v->name);
    2309           2 :                                 if (X509_REQ_get_attr_by_NID(csr, nid, -1) >= 0) {
    2310           0 :                                         continue;
    2311             :                                 }
    2312           2 :                                 if (!X509_REQ_add1_attr_by_txt(csr, v->name, MBSTRING_UTF8, (unsigned char*)v->value, -1)) {
    2313           1 :                                         php_error_docref(NULL TSRMLS_CC, E_WARNING,
    2314             :                                                 "add1_attr_by_txt %s -> %s (failed; check error queue "
    2315             :                                                 "and value of string_mask OpenSSL option if illegal "
    2316             :                                                 "characters are reported)",
    2317             :                                                 v->name, v->value);
    2318           1 :                                         return FAILURE;
    2319             :                                 }
    2320             :                         }
    2321             :                 }
    2322             :         }
    2323             : 
    2324           5 :         X509_REQ_set_pubkey(csr, req->priv_key);
    2325           5 :         return SUCCESS;
    2326             : }
    2327             : /* }}} */
    2328             : 
    2329             : /* {{{ php_openssl_csr_from_zval */
    2330          18 : static X509_REQ * php_openssl_csr_from_zval(zval ** val, int makeresource, long * resourceval TSRMLS_DC)
    2331             : {
    2332          18 :         X509_REQ * csr = NULL;
    2333          18 :         char * filename = NULL;
    2334             :         BIO * in;
    2335             : 
    2336          18 :         if (resourceval) {
    2337          18 :                 *resourceval = -1;
    2338             :         }
    2339          18 :         if (Z_TYPE_PP(val) == IS_RESOURCE) {
    2340             :                 void * what;
    2341             :                 int type;
    2342             : 
    2343          14 :                 what = zend_fetch_resource(val TSRMLS_CC, -1, "OpenSSL X.509 CSR", &type, 1, le_csr);
    2344          14 :                 if (what) {
    2345          13 :                         if (resourceval) {
    2346          13 :                                 *resourceval = Z_LVAL_PP(val);
    2347             :                         }
    2348          13 :                         return (X509_REQ*)what;
    2349             :                 }
    2350           1 :                 return NULL;
    2351           4 :         } else if (Z_TYPE_PP(val) != IS_STRING) {
    2352           1 :                 return NULL;
    2353             :         }
    2354             : 
    2355           3 :         if (Z_STRLEN_PP(val) > 7 && memcmp(Z_STRVAL_PP(val), "file://", sizeof("file://") - 1) == 0) {
    2356           0 :                 filename = Z_STRVAL_PP(val) + (sizeof("file://") - 1);
    2357             :         }
    2358           3 :         if (filename) {
    2359           0 :                 if (php_openssl_open_base_dir_chk(filename TSRMLS_CC)) {
    2360           0 :                         return NULL;
    2361             :                 }
    2362           0 :                 in = BIO_new_file(filename, "r");
    2363             :         } else {
    2364           3 :                 in = BIO_new_mem_buf(Z_STRVAL_PP(val), Z_STRLEN_PP(val));
    2365             :         }
    2366           3 :         csr = PEM_read_bio_X509_REQ(in, NULL,NULL,NULL);
    2367           3 :         BIO_free(in);
    2368             : 
    2369           3 :         return csr;
    2370             : }
    2371             : /* }}} */
    2372             : 
    2373             : /* {{{ proto bool openssl_csr_export_to_file(resource csr, string outfilename [, bool notext=true])
    2374             :    Exports a CSR to file */
    2375           0 : PHP_FUNCTION(openssl_csr_export_to_file)
    2376             : {
    2377             :         X509_REQ * csr;
    2378           0 :         zval * zcsr = NULL;
    2379           0 :         zend_bool notext = 1;
    2380           0 :         char * filename = NULL; int filename_len;
    2381             :         BIO * bio_out;
    2382             :         long csr_resource;
    2383             : 
    2384           0 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rp|b", &zcsr, &filename, &filename_len, &notext) == FAILURE) {
    2385           0 :                 return;
    2386             :         }
    2387           0 :         RETVAL_FALSE;
    2388             : 
    2389           0 :         csr = php_openssl_csr_from_zval(&zcsr, 0, &csr_resource TSRMLS_CC);
    2390           0 :         if (csr == NULL) {
    2391           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get CSR from parameter 1");
    2392           0 :                 return;
    2393             :         }
    2394             : 
    2395           0 :         if (php_openssl_open_base_dir_chk(filename TSRMLS_CC)) {
    2396           0 :                 return;
    2397             :         }
    2398             : 
    2399           0 :         bio_out = BIO_new_file(filename, "w");
    2400           0 :         if (bio_out) {
    2401           0 :                 if (!notext) {
    2402           0 :                         X509_REQ_print(bio_out, csr);
    2403             :                 }
    2404           0 :                 PEM_write_bio_X509_REQ(bio_out, csr);
    2405           0 :                 RETVAL_TRUE;
    2406             :         } else {
    2407           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error opening file %s", filename);
    2408             :         }
    2409             : 
    2410           0 :         if (csr_resource == -1 && csr) {
    2411           0 :                 X509_REQ_free(csr);
    2412             :         }
    2413           0 :         BIO_free(bio_out);
    2414             : }
    2415             : /* }}} */
    2416             : 
    2417             : /* {{{ proto bool openssl_csr_export(resource csr, string &out [, bool notext=true])
    2418             :    Exports a CSR to file or a var */
    2419           7 : PHP_FUNCTION(openssl_csr_export)
    2420             : {
    2421             :         X509_REQ * csr;
    2422           7 :         zval * zcsr = NULL, *zout=NULL;
    2423           7 :         zend_bool notext = 1;
    2424             :         BIO * bio_out;
    2425             : 
    2426             :         long csr_resource;
    2427             : 
    2428           7 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "rz|b", &zcsr, &zout, &notext) == FAILURE) {
    2429           2 :                 return;
    2430             :         }
    2431           5 :         RETVAL_FALSE;
    2432             : 
    2433           5 :         csr = php_openssl_csr_from_zval(&zcsr, 0, &csr_resource TSRMLS_CC);
    2434           5 :         if (csr == NULL) {
    2435           1 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get CSR from parameter 1");
    2436           1 :                 return;
    2437             :         }
    2438             : 
    2439             :         /* export to a var */
    2440             : 
    2441           4 :         bio_out = BIO_new(BIO_s_mem());
    2442           4 :         if (!notext) {
    2443           2 :                 X509_REQ_print(bio_out, csr);
    2444             :         }
    2445             : 
    2446           4 :         if (PEM_write_bio_X509_REQ(bio_out, csr)) {
    2447             :                 BUF_MEM *bio_buf;
    2448             : 
    2449           4 :                 BIO_get_mem_ptr(bio_out, &bio_buf);
    2450           4 :                 zval_dtor(zout);
    2451           4 :                 ZVAL_STRINGL(zout, bio_buf->data, bio_buf->length, 1);
    2452             : 
    2453           4 :                 RETVAL_TRUE;
    2454             :         }
    2455             : 
    2456           4 :         if (csr_resource == -1 && csr) {
    2457           0 :                 X509_REQ_free(csr);
    2458             :         }
    2459           4 :         BIO_free(bio_out);
    2460             : }
    2461             : /* }}} */
    2462             : 
    2463             : /* {{{ proto resource openssl_csr_sign(mixed csr, mixed x509, mixed priv_key, long days [, array config_args [, long serial]])
    2464             :    Signs a cert with another CERT */
    2465          14 : PHP_FUNCTION(openssl_csr_sign)
    2466             : {
    2467          14 :         zval ** zcert = NULL, **zcsr, **zpkey, *args = NULL;
    2468             :         long num_days;
    2469          14 :         long serial = 0L;
    2470          14 :         X509 * cert = NULL, *new_cert = NULL;
    2471             :         X509_REQ * csr;
    2472          14 :         EVP_PKEY * key = NULL, *priv_key = NULL;
    2473          14 :         long csr_resource, certresource = 0, keyresource = -1;
    2474             :         int i;
    2475             :         struct php_x509_request req;
    2476             : 
    2477          14 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ZZ!Zl|a!l", &zcsr, &zcert, &zpkey, &num_days, &args, &serial) == FAILURE)
    2478           3 :                 return;
    2479             : 
    2480          11 :         RETVAL_FALSE;
    2481          11 :         PHP_SSL_REQ_INIT(&req);
    2482             : 
    2483          11 :         csr = php_openssl_csr_from_zval(zcsr, 0, &csr_resource TSRMLS_CC);
    2484          11 :         if (csr == NULL) {
    2485           2 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get CSR from parameter 1");
    2486           2 :                 return;
    2487             :         }
    2488           9 :         if (zcert) {
    2489           3 :                 cert = php_openssl_x509_from_zval(zcert, 0, &certresource TSRMLS_CC);
    2490           3 :                 if (cert == NULL) {
    2491           2 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get cert from parameter 2");
    2492           2 :                         goto cleanup;
    2493             :                 }
    2494             :         }
    2495           7 :         priv_key = php_openssl_evp_from_zval(zpkey, 0, "", 1, &keyresource TSRMLS_CC);
    2496           7 :         if (priv_key == NULL) {
    2497           2 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get private key from parameter 3");
    2498           2 :                 goto cleanup;
    2499             :         }
    2500           5 :         if (cert && !X509_check_private_key(cert, priv_key)) {
    2501           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "private key does not correspond to signing cert");
    2502           0 :                 goto cleanup;
    2503             :         }
    2504             : 
    2505           5 :         if (PHP_SSL_REQ_PARSE(&req, args) == FAILURE) {
    2506           0 :                 goto cleanup;
    2507             :         }
    2508             :         /* Check that the request matches the signature */
    2509           5 :         key = X509_REQ_get_pubkey(csr);
    2510           5 :         if (key == NULL) {
    2511           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error unpacking public key");
    2512           0 :                 goto cleanup;
    2513             :         }
    2514           5 :         i = X509_REQ_verify(csr, key);
    2515             : 
    2516           5 :         if (i < 0) {
    2517           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Signature verification problems");
    2518           0 :                 goto cleanup;
    2519             :         }
    2520           5 :         else if (i == 0) {
    2521           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Signature did not match the certificate request");
    2522           0 :                 goto cleanup;
    2523             :         }
    2524             : 
    2525             :         /* Now we can get on with it */
    2526             : 
    2527           5 :         new_cert = X509_new();
    2528           5 :         if (new_cert == NULL) {
    2529           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "No memory");
    2530           0 :                 goto cleanup;
    2531             :         }
    2532             :         /* Version 3 cert */
    2533           5 :         if (!X509_set_version(new_cert, 2))
    2534           0 :                 goto cleanup;
    2535             : 
    2536           5 :         ASN1_INTEGER_set(X509_get_serialNumber(new_cert), serial);
    2537             : 
    2538           5 :         X509_set_subject_name(new_cert, X509_REQ_get_subject_name(csr));
    2539             : 
    2540           5 :         if (cert == NULL) {
    2541           4 :                 cert = new_cert;
    2542             :         }
    2543           5 :         if (!X509_set_issuer_name(new_cert, X509_get_subject_name(cert))) {
    2544           0 :                 goto cleanup;
    2545             :         }
    2546           5 :         X509_gmtime_adj(X509_get_notBefore(new_cert), 0);
    2547           5 :         X509_gmtime_adj(X509_get_notAfter(new_cert), (long)60*60*24*num_days);
    2548           5 :         i = X509_set_pubkey(new_cert, key);
    2549           5 :         if (!i) {
    2550           0 :                 goto cleanup;
    2551             :         }
    2552           5 :         if (req.extensions_section) {
    2553             :                 X509V3_CTX ctx;
    2554             : 
    2555           5 :                 X509V3_set_ctx(&ctx, cert, new_cert, csr, NULL, 0);
    2556           5 :                 X509V3_set_conf_lhash(&ctx, req.req_config);
    2557           5 :                 if (!X509V3_EXT_add_conf(req.req_config, &ctx, req.extensions_section, new_cert)) {
    2558           0 :                         goto cleanup;
    2559             :                 }
    2560             :         }
    2561             : 
    2562             :         /* Now sign it */
    2563           5 :         if (!X509_sign(new_cert, priv_key, req.digest)) {
    2564           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "failed to sign it");
    2565           0 :                 goto cleanup;
    2566             :         }
    2567             : 
    2568             :         /* Succeeded; lets return the cert */
    2569           5 :         RETVAL_RESOURCE(zend_list_insert(new_cert, le_x509 TSRMLS_CC));
    2570           5 :         new_cert = NULL;
    2571             : 
    2572             : cleanup:
    2573             : 
    2574           9 :         if (cert == new_cert) {
    2575           4 :                 cert = NULL;
    2576             :         }
    2577           9 :         PHP_SSL_REQ_DISPOSE(&req);
    2578             : 
    2579           9 :         if (keyresource == -1 && priv_key) {
    2580           0 :                 EVP_PKEY_free(priv_key);
    2581             :         }
    2582           9 :         if (key) {
    2583           5 :                 EVP_PKEY_free(key);
    2584             :         }
    2585           9 :         if (csr_resource == -1 && csr) {
    2586           0 :                 X509_REQ_free(csr);
    2587             :         }
    2588           9 :         if (certresource == -1 && cert) {
    2589           1 :                 X509_free(cert);
    2590             :         }
    2591           9 :         if (new_cert) {
    2592           0 :                 X509_free(new_cert);
    2593             :         }
    2594             : }
    2595             : /* }}} */
    2596             : 
    2597             : /* {{{ proto bool openssl_csr_new(array dn, resource &privkey [, array configargs [, array extraattribs]])
    2598             :    Generates a privkey and CSR */
    2599           8 : PHP_FUNCTION(openssl_csr_new)
    2600             : {
    2601             :         struct php_x509_request req;
    2602           8 :         zval * args = NULL, * dn, *attribs = NULL;
    2603             :         zval * out_pkey;
    2604           8 :         X509_REQ * csr = NULL;
    2605           8 :         int we_made_the_key = 1;
    2606             :         long key_resource;
    2607             : 
    2608           8 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "az|a!a!", &dn, &out_pkey, &args, &attribs) == FAILURE) {
    2609           2 :                 return;
    2610             :         }
    2611           6 :         RETVAL_FALSE;
    2612             : 
    2613           6 :         PHP_SSL_REQ_INIT(&req);
    2614             : 
    2615           6 :         if (PHP_SSL_REQ_PARSE(&req, args) == SUCCESS) {
    2616             :                 /* Generate or use a private key */
    2617           6 :                 if (Z_TYPE_P(out_pkey) != IS_NULL) {
    2618           6 :                         req.priv_key = php_openssl_evp_from_zval(&out_pkey, 0, NULL, 0, &key_resource TSRMLS_CC);
    2619           6 :                         if (req.priv_key != NULL) {
    2620           4 :                                 we_made_the_key = 0;
    2621             :                         }
    2622             :                 }
    2623           6 :                 if (req.priv_key == NULL) {
    2624           2 :                         php_openssl_generate_private_key(&req TSRMLS_CC);
    2625             :                 }
    2626           6 :                 if (req.priv_key == NULL) {
    2627           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to generate a private key");
    2628             :                 } else {
    2629           6 :                         csr = X509_REQ_new();
    2630           6 :                         if (csr) {
    2631           6 :                                 if (php_openssl_make_REQ(&req, csr, dn, attribs TSRMLS_CC) == SUCCESS) {
    2632             :                                         X509V3_CTX ext_ctx;
    2633             : 
    2634           5 :                                         X509V3_set_ctx(&ext_ctx, NULL, NULL, csr, NULL, 0);
    2635           5 :                                         X509V3_set_conf_lhash(&ext_ctx, req.req_config);
    2636             : 
    2637             :                                         /* Add extensions */
    2638           5 :                                         if (req.request_extensions_section && !X509V3_EXT_REQ_add_conf(req.req_config,
    2639             :                                                                 &ext_ctx, req.request_extensions_section, csr))
    2640             :                                         {
    2641           0 :                                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error loading extension section %s", req.request_extensions_section);
    2642             :                                         } else {
    2643           5 :                                                 RETVAL_TRUE;
    2644             : 
    2645           5 :                                                 if (X509_REQ_sign(csr, req.priv_key, req.digest)) {
    2646           5 :                                                         RETVAL_RESOURCE(zend_list_insert(csr, le_csr TSRMLS_CC));
    2647           5 :                                                         csr = NULL;
    2648             :                                                 } else {
    2649           0 :                                                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Error signing request");
    2650             :                                                 }
    2651             : 
    2652           5 :                                                 if (we_made_the_key) {
    2653             :                                                         /* and a resource for the private key */
    2654           1 :                                                         zval_dtor(out_pkey);
    2655           1 :                                                         ZVAL_RESOURCE(out_pkey, zend_list_insert(req.priv_key, le_key TSRMLS_CC));
    2656           1 :                                                         req.priv_key = NULL; /* make sure the cleanup code doesn't zap it! */
    2657           4 :                                                 } else if (key_resource != -1) {
    2658           4 :                                                         req.priv_key = NULL; /* make sure the cleanup code doesn't zap it! */
    2659             :                                                 }
    2660             :                                         }
    2661             :                                 }
    2662             :                                 else {
    2663           1 :                                         if (!we_made_the_key) {
    2664             :                                                 /* if we have not made the key we are not supposed to zap it by calling dispose! */
    2665           0 :                                                 req.priv_key = NULL;
    2666             :                                         }
    2667             :                                 }
    2668             :                         }
    2669             :                 }
    2670             :         }
    2671           6 :         if (csr) {
    2672           1 :                 X509_REQ_free(csr);
    2673             :         }
    2674           6 :         PHP_SSL_REQ_DISPOSE(&req);
    2675             : }
    2676             : /* }}} */
    2677             : 
    2678             : /* {{{ proto mixed openssl_csr_get_subject(mixed csr)
    2679             :    Returns the subject of a CERT or FALSE on error */
    2680           2 : PHP_FUNCTION(openssl_csr_get_subject)
    2681             : {
    2682             :         zval ** zcsr;
    2683           2 :         zend_bool use_shortnames = 1;
    2684             :         long csr_resource;
    2685             :         X509_NAME * subject;
    2686             :         X509_REQ * csr;
    2687             : 
    2688           2 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z|b", &zcsr, &use_shortnames) == FAILURE) {
    2689           0 :                 return;
    2690             :         }
    2691             : 
    2692           2 :         csr = php_openssl_csr_from_zval(zcsr, 0, &csr_resource TSRMLS_CC);
    2693             : 
    2694           2 :         if (csr == NULL) {
    2695           0 :                 RETURN_FALSE;
    2696             :         }
    2697             : 
    2698           2 :         subject = X509_REQ_get_subject_name(csr);
    2699             : 
    2700           2 :         array_init(return_value);
    2701           2 :         add_assoc_name_entry(return_value, NULL, subject, use_shortnames TSRMLS_CC);
    2702           2 :         return;
    2703             : }
    2704             : /* }}} */
    2705             : 
    2706             : /* {{{ proto mixed openssl_csr_get_public_key(mixed csr)
    2707             :         Returns the subject of a CERT or FALSE on error */
    2708           0 : PHP_FUNCTION(openssl_csr_get_public_key)
    2709             : {
    2710             :         zval ** zcsr;
    2711           0 :         zend_bool use_shortnames = 1;
    2712             :         long csr_resource;
    2713             : 
    2714             :         X509_REQ * csr;
    2715             :         EVP_PKEY *tpubkey;
    2716             : 
    2717           0 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z|b", &zcsr, &use_shortnames) == FAILURE) {
    2718           0 :                 return;
    2719             :         }
    2720             : 
    2721           0 :         csr = php_openssl_csr_from_zval(zcsr, 0, &csr_resource TSRMLS_CC);
    2722             : 
    2723           0 :         if (csr == NULL) {
    2724           0 :                 RETURN_FALSE;
    2725             :         }
    2726             : 
    2727           0 :         tpubkey=X509_REQ_get_pubkey(csr);
    2728           0 :         RETVAL_RESOURCE(zend_list_insert(tpubkey, le_key TSRMLS_CC));
    2729           0 :         return;
    2730             : }
    2731             : /* }}} */
    2732             : 
    2733             : /* }}} */
    2734             : 
    2735             : /* {{{ EVP Public/Private key functions */
    2736             : 
    2737             : /* {{{ php_openssl_evp_from_zval
    2738             :    Given a zval, coerce it into a EVP_PKEY object.
    2739             :         It can be:
    2740             :                 1. private key resource from openssl_get_privatekey()
    2741             :                 2. X509 resource -> public key will be extracted from it
    2742             :                 3. if it starts with file:// interpreted as path to key file
    2743             :                 4. interpreted as the data from the cert/key file and interpreted in same way as openssl_get_privatekey()
    2744             :                 5. an array(0 => [items 2..4], 1 => passphrase)
    2745             :                 6. if val is a string (possibly starting with file:///) and it is not an X509 certificate, then interpret as public key
    2746             :         NOTE: If you are requesting a private key but have not specified a passphrase, you should use an
    2747             :         empty string rather than NULL for the passphrase - NULL causes a passphrase prompt to be emitted in
    2748             :         the Apache error log!
    2749             : */
    2750         105 : static EVP_PKEY * php_openssl_evp_from_zval(zval ** val, int public_key, char * passphrase, int makeresource, long * resourceval TSRMLS_DC)
    2751             : {
    2752         105 :         EVP_PKEY * key = NULL;
    2753         105 :         X509 * cert = NULL;
    2754         105 :         int free_cert = 0;
    2755         105 :         long cert_res = -1;
    2756         105 :         char * filename = NULL;
    2757             :         zval tmp;
    2758             : 
    2759         105 :         Z_TYPE(tmp) = IS_NULL;
    2760             : 
    2761             : #define TMP_CLEAN \
    2762             :         if (Z_TYPE(tmp) == IS_STRING) {\
    2763             :                 zval_dtor(&tmp); \
    2764             :         } \
    2765             :         return NULL;
    2766             : 
    2767         105 :         if (resourceval) {
    2768         105 :                 *resourceval = -1;
    2769             :         }
    2770         105 :         if (Z_TYPE_PP(val) == IS_ARRAY) {
    2771             :                 zval ** zphrase;
    2772             : 
    2773             :                 /* get passphrase */
    2774             : 
    2775           9 :                 if (zend_hash_index_find(HASH_OF(*val), 1, (void **)&zphrase) == FAILURE) {
    2776           5 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "key array must be of the form array(0 => key, 1 => phrase)");
    2777           5 :                         return NULL;
    2778             :                 }
    2779             : 
    2780           4 :                 if (Z_TYPE_PP(zphrase) == IS_STRING) {
    2781           3 :                         passphrase = Z_STRVAL_PP(zphrase);
    2782             :                 } else {
    2783           1 :                         tmp = **zphrase;
    2784             :                         zval_copy_ctor(&tmp);
    2785           1 :                         convert_to_string(&tmp);
    2786           1 :                         passphrase = Z_STRVAL(tmp);
    2787             :                 }
    2788             : 
    2789             :                 /* now set val to be the key param and continue */
    2790           4 :                 if (zend_hash_index_find(HASH_OF(*val), 0, (void **)&val) == FAILURE) {
    2791           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "key array must be of the form array(0 => key, 1 => phrase)");
    2792           0 :                         TMP_CLEAN;
    2793             :                 }
    2794             :         }
    2795             : 
    2796         100 :         if (Z_TYPE_PP(val) == IS_RESOURCE) {
    2797             :                 void * what;
    2798             :                 int type;
    2799             : 
    2800          20 :                 what = zend_fetch_resource(val TSRMLS_CC, -1, "OpenSSL X.509/key", &type, 2, le_x509, le_key);
    2801          20 :                 if (!what) {
    2802           0 :                         TMP_CLEAN;
    2803             :                 }
    2804          20 :                 if (resourceval) {
    2805          20 :                         *resourceval = Z_LVAL_PP(val);
    2806             :                 }
    2807          20 :                 if (type == le_x509) {
    2808             :                         /* extract key from cert, depending on public_key param */
    2809           0 :                         cert = (X509*)what;
    2810           0 :                         free_cert = 0;
    2811          20 :                 } else if (type == le_key) {
    2812             :                         int is_priv;
    2813             : 
    2814          20 :                         is_priv = php_openssl_is_private_key((EVP_PKEY*)what TSRMLS_CC);
    2815             : 
    2816             :                         /* check whether it is actually a private key if requested */
    2817          20 :                         if (!public_key && !is_priv) {
    2818           0 :                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "supplied key param is a public key");
    2819           0 :                                 TMP_CLEAN;
    2820             :                         }
    2821             : 
    2822          20 :                         if (public_key && is_priv) {
    2823           1 :                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Don't know how to get public key from this private key");
    2824           2 :                                 TMP_CLEAN;
    2825             :                         } else {
    2826          19 :                                 if (Z_TYPE(tmp) == IS_STRING) {
    2827             :                                         zval_dtor(&tmp);
    2828             :                                 }
    2829             :                                 /* got the key - return it */
    2830          19 :                                 return (EVP_PKEY*)what;
    2831             :                         }
    2832             :                 } else {
    2833             :                         /* other types could be used here - eg: file pointers and read in the data from them */
    2834           0 :                         TMP_CLEAN;
    2835             :                 }
    2836             :         } else {
    2837             :                 /* force it to be a string and check if it refers to a file */
    2838             :                 /* passing non string values leaks, object uses toString, it returns NULL
    2839             :                  * See bug38255.phpt
    2840             :                  */
    2841          80 :                 if (!(Z_TYPE_PP(val) == IS_STRING || Z_TYPE_PP(val) == IS_OBJECT)) {
    2842          10 :                         TMP_CLEAN;
    2843             :                 }
    2844          85 :                 convert_to_string_ex(val);
    2845             : 
    2846          75 :                 if (Z_STRLEN_PP(val) > 7 && memcmp(Z_STRVAL_PP(val), "file://", sizeof("file://") - 1) == 0) {
    2847          51 :                         filename = Z_STRVAL_PP(val) + (sizeof("file://") - 1);
    2848             :                 }
    2849             :                 /* it's an X509 file/cert of some kind, and we need to extract the data from that */
    2850          75 :                 if (public_key) {
    2851          28 :                         cert = php_openssl_x509_from_zval(val, 0, &cert_res TSRMLS_CC);
    2852          28 :                         free_cert = (cert_res == -1);
    2853             :                         /* actual extraction done later */
    2854          28 :                         if (!cert) {
    2855             :                                 /* not a X509 certificate, try to retrieve public key */
    2856             :                                 BIO* in;
    2857          26 :                                 if (filename) {
    2858          20 :                                         in = BIO_new_file(filename, "r");
    2859             :                                 } else {
    2860           6 :                                         in = BIO_new_mem_buf(Z_STRVAL_PP(val), Z_STRLEN_PP(val));
    2861             :                                 }
    2862          26 :                                 if (in == NULL) {
    2863           0 :                                         TMP_CLEAN;
    2864             :                                 }
    2865          26 :                                 key = PEM_read_bio_PUBKEY(in, NULL,NULL, NULL);
    2866          26 :                                 BIO_free(in);
    2867             :                         }
    2868             :                 } else {
    2869             :                         /* we want the private key */
    2870             :                         BIO *in;
    2871             : 
    2872          47 :                         if (filename) {
    2873          31 :                                 if (php_openssl_open_base_dir_chk(filename TSRMLS_CC)) {
    2874           0 :                                         TMP_CLEAN;
    2875             :                                 }
    2876          31 :                                 in = BIO_new_file(filename, "r");
    2877             :                         } else {
    2878          16 :                                 in = BIO_new_mem_buf(Z_STRVAL_PP(val), Z_STRLEN_PP(val));
    2879             :                         }
    2880             : 
    2881          47 :                         if (in == NULL) {
    2882           0 :                                 TMP_CLEAN;
    2883             :                         }
    2884          47 :                         key = PEM_read_bio_PrivateKey(in, NULL,NULL, passphrase);
    2885          47 :                         BIO_free(in);
    2886             :                 }
    2887             :         }
    2888             : 
    2889          75 :         if (public_key && cert && key == NULL) {
    2890             :                 /* extract public key from X509 cert */
    2891           2 :                 key = (EVP_PKEY *) X509_get_pubkey(cert);
    2892             :         }
    2893             : 
    2894          75 :         if (free_cert && cert) {
    2895           2 :                 X509_free(cert);
    2896             :         }
    2897          75 :         if (key && makeresource && resourceval) {
    2898          14 :                 *resourceval = ZEND_REGISTER_RESOURCE(NULL, key, le_key);
    2899             :         }
    2900          75 :         if (Z_TYPE(tmp) == IS_STRING) {
    2901             :                 zval_dtor(&tmp);
    2902             :         }
    2903          75 :         return key;
    2904             : }
    2905             : /* }}} */
    2906             : 
    2907             : /* {{{ php_openssl_generate_private_key */
    2908          11 : static EVP_PKEY * php_openssl_generate_private_key(struct php_x509_request * req TSRMLS_DC)
    2909             : {
    2910          11 :         char * randfile = NULL;
    2911             :         int egdsocket, seeded;
    2912          11 :         EVP_PKEY * return_val = NULL;
    2913             : 
    2914          11 :         if (req->priv_key_bits < MIN_KEY_LENGTH) {
    2915           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "private key length is too short; it needs to be at least %d bits, not %d",
    2916             :                                 MIN_KEY_LENGTH, req->priv_key_bits);
    2917           0 :                 return NULL;
    2918             :         }
    2919             : 
    2920          11 :         randfile = CONF_get_string(req->req_config, req->section_name, "RANDFILE");
    2921          11 :         php_openssl_load_rand_file(randfile, &egdsocket, &seeded TSRMLS_CC);
    2922             : 
    2923          11 :         if ((req->priv_key = EVP_PKEY_new()) != NULL) {
    2924          11 :                 switch(req->priv_key_type) {
    2925             :                         case OPENSSL_KEYTYPE_RSA:
    2926          11 :                                 if (EVP_PKEY_assign_RSA(req->priv_key, RSA_generate_key(req->priv_key_bits, 0x10001, NULL, NULL))) {
    2927          11 :                                         return_val = req->priv_key;
    2928             :                                 }
    2929          11 :                                 break;
    2930             : #if !defined(NO_DSA) && defined(HAVE_DSA_DEFAULT_METHOD)
    2931             :                         case OPENSSL_KEYTYPE_DSA:
    2932             :                                 {
    2933           0 :                                         DSA *dsapar = DSA_generate_parameters(req->priv_key_bits, NULL, 0, NULL, NULL, NULL, NULL);
    2934           0 :                                         if (dsapar) {
    2935           0 :                                                 DSA_set_method(dsapar, DSA_get_default_method());
    2936           0 :                                                 if (DSA_generate_key(dsapar)) {
    2937           0 :                                                         if (EVP_PKEY_assign_DSA(req->priv_key, dsapar)) {
    2938           0 :                                                                 return_val = req->priv_key;
    2939             :                                                         }
    2940             :                                                 } else {
    2941           0 :                                                         DSA_free(dsapar);
    2942             :                                                 }
    2943             :                                         }
    2944             :                                 }
    2945           0 :                                 break;
    2946             : #endif
    2947             : #if !defined(NO_DH)
    2948             :                         case OPENSSL_KEYTYPE_DH:
    2949             :                                 {
    2950           0 :                                         DH *dhpar = DH_generate_parameters(req->priv_key_bits, 2, NULL, NULL);
    2951           0 :                                         int codes = 0;
    2952             : 
    2953           0 :                                         if (dhpar) {
    2954           0 :                                                 DH_set_method(dhpar, DH_get_default_method());
    2955           0 :                                                 if (DH_check(dhpar, &codes) && codes == 0 && DH_generate_key(dhpar)) {
    2956           0 :                                                         if (EVP_PKEY_assign_DH(req->priv_key, dhpar)) {
    2957           0 :                                                                 return_val = req->priv_key;
    2958             :                                                         }
    2959             :                                                 } else {
    2960           0 :                                                         DH_free(dhpar);
    2961             :                                                 }
    2962             :                                         }
    2963             :                                 }
    2964           0 :                                 break;
    2965             : #endif
    2966             :                         default:
    2967           0 :                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unsupported private key type");
    2968             :                 }
    2969             :         }
    2970             : 
    2971          11 :         php_openssl_write_rand_file(randfile, egdsocket, seeded);
    2972             : 
    2973          11 :         if (return_val == NULL) {
    2974           0 :                 EVP_PKEY_free(req->priv_key);
    2975           0 :                 req->priv_key = NULL;
    2976           0 :                 return NULL;
    2977             :         }
    2978             : 
    2979          11 :         return return_val;
    2980             : }
    2981             : /* }}} */
    2982             : 
    2983             : /* {{{ php_openssl_is_private_key
    2984             :         Check whether the supplied key is a private key by checking if the secret prime factors are set */
    2985          20 : static int php_openssl_is_private_key(EVP_PKEY* pkey TSRMLS_DC)
    2986             : {
    2987             :         assert(pkey != NULL);
    2988             : 
    2989          20 :         switch (pkey->type) {
    2990             : #ifndef NO_RSA
    2991             :                 case EVP_PKEY_RSA:
    2992             :                 case EVP_PKEY_RSA2:
    2993             :                         assert(pkey->pkey.rsa != NULL);
    2994          17 :                         if (pkey->pkey.rsa != NULL && (NULL == pkey->pkey.rsa->p || NULL == pkey->pkey.rsa->q)) {
    2995           3 :                                 return 0;
    2996             :                         }
    2997          14 :                         break;
    2998             : #endif
    2999             : #ifndef NO_DSA
    3000             :                 case EVP_PKEY_DSA:
    3001             :                 case EVP_PKEY_DSA1:
    3002             :                 case EVP_PKEY_DSA2:
    3003             :                 case EVP_PKEY_DSA3:
    3004             :                 case EVP_PKEY_DSA4:
    3005             :                         assert(pkey->pkey.dsa != NULL);
    3006             : 
    3007           2 :                         if (NULL == pkey->pkey.dsa->p || NULL == pkey->pkey.dsa->q || NULL == pkey->pkey.dsa->priv_key){
    3008           1 :                                 return 0;
    3009             :                         }
    3010           1 :                         break;
    3011             : #endif
    3012             : #ifndef NO_DH
    3013             :                 case EVP_PKEY_DH:
    3014             :                         assert(pkey->pkey.dh != NULL);
    3015             : 
    3016           0 :                         if (NULL == pkey->pkey.dh->p || NULL == pkey->pkey.dh->priv_key) {
    3017           0 :                                 return 0;
    3018             :                         }
    3019           0 :                         break;
    3020             : #endif
    3021             : #ifdef HAVE_EVP_PKEY_EC
    3022             :                 case EVP_PKEY_EC:
    3023             :                         assert(pkey->pkey.ec != NULL);
    3024             : 
    3025           1 :                         if ( NULL == EC_KEY_get0_private_key(pkey->pkey.ec)) {
    3026           0 :                                 return 0;
    3027             :                         }
    3028           1 :                         break;
    3029             : #endif
    3030             :                 default:
    3031           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "key type not supported in this PHP build!");
    3032             :                         break;
    3033             :         }
    3034          16 :         return 1;
    3035             : }
    3036             : /* }}} */
    3037             : 
    3038             : #define OPENSSL_PKEY_GET_BN(_type, _name) do {                                                  \
    3039             :                 if (pkey->pkey._type->_name != NULL) {                                                    \
    3040             :                         int len = BN_num_bytes(pkey->pkey._type->_name);                  \
    3041             :                         char *str = emalloc(len + 1);                                                           \
    3042             :                         BN_bn2bin(pkey->pkey._type->_name, (unsigned char*)str);  \
    3043             :                         str[len] = 0;                                                   \
    3044             :                         add_assoc_stringl(_type, #_name, str, len, 0);                          \
    3045             :                 }                                                                                                                               \
    3046             :         } while (0)
    3047             : 
    3048             : #define OPENSSL_PKEY_SET_BN(_ht, _type, _name) do {                                             \
    3049             :                 zval **bn;                                                                                                              \
    3050             :                 if (zend_hash_find(_ht, #_name, sizeof(#_name), (void**)&bn) == SUCCESS && \
    3051             :                                 Z_TYPE_PP(bn) == IS_STRING) {                                                   \
    3052             :                         _type->_name = BN_bin2bn(                                                                    \
    3053             :                                 (unsigned char*)Z_STRVAL_PP(bn),                                                \
    3054             :                                 Z_STRLEN_PP(bn), NULL);                                                                 \
    3055             :             }                                                               \
    3056             :         } while (0);
    3057             : 
    3058             : 
    3059             : /* {{{ proto resource openssl_pkey_new([array configargs])
    3060             :    Generates a new private key */
    3061          12 : PHP_FUNCTION(openssl_pkey_new)
    3062             : {
    3063             :         struct php_x509_request req;
    3064          12 :         zval * args = NULL;
    3065             :         zval **data;
    3066             : 
    3067          12 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|a!", &args) == FAILURE) {
    3068           0 :                 return;
    3069             :         }
    3070          12 :         RETVAL_FALSE;
    3071             : 
    3072          12 :         if (args && Z_TYPE_P(args) == IS_ARRAY) {
    3073             :                 EVP_PKEY *pkey;
    3074             : 
    3075           8 :                 if (zend_hash_find(Z_ARRVAL_P(args), "rsa", sizeof("rsa"), (void**)&data) == SUCCESS &&
    3076           1 :                     Z_TYPE_PP(data) == IS_ARRAY) {
    3077           1 :                     pkey = EVP_PKEY_new();
    3078           1 :                     if (pkey) {
    3079           1 :                                 RSA *rsa = RSA_new();
    3080           1 :                                 if (rsa) {
    3081           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, n);
    3082           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, e);
    3083           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, d);
    3084           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, p);
    3085           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, q);
    3086           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, dmp1);
    3087           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, dmq1);
    3088           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), rsa, iqmp);
    3089           1 :                                         if (rsa->n && rsa->d) {
    3090           0 :                                                 if (EVP_PKEY_assign_RSA(pkey, rsa)) {
    3091           0 :                                                         RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));
    3092             :                                                 }
    3093             :                                         }
    3094           1 :                                         RSA_free(rsa);
    3095             :                                 }
    3096           1 :                                 EVP_PKEY_free(pkey);
    3097             :                         }
    3098           1 :                         RETURN_FALSE;
    3099           7 :                 } else if (zend_hash_find(Z_ARRVAL_P(args), "dsa", sizeof("dsa"), (void**)&data) == SUCCESS &&
    3100           1 :                            Z_TYPE_PP(data) == IS_ARRAY) {
    3101           1 :                     pkey = EVP_PKEY_new();
    3102           1 :                     if (pkey) {
    3103           1 :                                 DSA *dsa = DSA_new();
    3104           1 :                                 if (dsa) {
    3105           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, p);
    3106           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, q);
    3107           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, g);
    3108           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, priv_key);
    3109           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dsa, pub_key);
    3110           1 :                                         if (dsa->p && dsa->q && dsa->g) {
    3111           0 :                                                 if (!dsa->priv_key && !dsa->pub_key) {
    3112           0 :                                                         DSA_generate_key(dsa);
    3113             :                                                 }
    3114           0 :                                                 if (EVP_PKEY_assign_DSA(pkey, dsa)) {
    3115           0 :                                                         RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));
    3116             :                                                 }
    3117             :                                         }
    3118           1 :                                         DSA_free(dsa);
    3119             :                                 }
    3120           1 :                                 EVP_PKEY_free(pkey);
    3121             :                         }
    3122           1 :                         RETURN_FALSE;
    3123           6 :                 } else if (zend_hash_find(Z_ARRVAL_P(args), "dh", sizeof("dh"), (void**)&data) == SUCCESS &&
    3124           1 :                            Z_TYPE_PP(data) == IS_ARRAY) {
    3125           1 :                     pkey = EVP_PKEY_new();
    3126           1 :                     if (pkey) {
    3127           1 :                                 DH *dh = DH_new();
    3128           1 :                                 if (dh) {
    3129           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, p);
    3130           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, g);
    3131           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, priv_key);
    3132           1 :                                         OPENSSL_PKEY_SET_BN(Z_ARRVAL_PP(data), dh, pub_key);
    3133           1 :                                         if (dh->p && dh->g) {
    3134           0 :                                                 if (!dh->pub_key) {
    3135           0 :                                                         DH_generate_key(dh);
    3136             :                                                 }
    3137           0 :                                                 if (EVP_PKEY_assign_DH(pkey, dh)) {
    3138           0 :                                                         RETURN_RESOURCE(zend_list_insert(pkey, le_key TSRMLS_CC));
    3139             :                                                 }
    3140             :                                         }
    3141           1 :                                         DH_free(dh);
    3142             :                                 }
    3143           1 :                                 EVP_PKEY_free(pkey);
    3144             :                         }
    3145           1 :                         RETURN_FALSE;
    3146             :                 }
    3147             :         }
    3148             : 
    3149           9 :         PHP_SSL_REQ_INIT(&req);
    3150             : 
    3151           9 :         if (PHP_SSL_REQ_PARSE(&req, args) == SUCCESS)
    3152             :         {
    3153           9 :                 if (php_openssl_generate_private_key(&req TSRMLS_CC)) {
    3154             :                         /* pass back a key resource */
    3155           9 :                         RETVAL_RESOURCE(zend_list_insert(req.priv_key, le_key TSRMLS_CC));
    3156             :                         /* make sure the cleanup code doesn't zap it! */
    3157           9 :                         req.priv_key = NULL;
    3158             :                 }
    3159             :         }
    3160           9 :         PHP_SSL_REQ_DISPOSE(&req);
    3161             : }
    3162             : /* }}} */
    3163             : 
    3164             : /* {{{ proto bool openssl_pkey_export_to_file(mixed key, string outfilename [, string passphrase, array config_args)
    3165             :    Gets an exportable representation of a key into a file */
    3166           1 : PHP_FUNCTION(openssl_pkey_export_to_file)
    3167             : {
    3168             :         struct php_x509_request req;
    3169           1 :         zval ** zpkey, * args = NULL;
    3170           1 :         char * passphrase = NULL; int passphrase_len = 0;
    3171           1 :         char * filename = NULL; int filename_len = 0;
    3172           1 :         long key_resource = -1;
    3173             :         EVP_PKEY * key;
    3174           1 :         BIO * bio_out = NULL;
    3175             :         const EVP_CIPHER * cipher;
    3176             : 
    3177           1 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zp|s!a!", &zpkey, &filename, &filename_len, &passphrase, &passphrase_len, &args) == FAILURE) {
    3178           0 :                 return;
    3179             :         }
    3180           1 :         RETVAL_FALSE;
    3181             : 
    3182           1 :         key = php_openssl_evp_from_zval(zpkey, 0, passphrase, 0, &key_resource TSRMLS_CC);
    3183             : 
    3184           1 :         if (key == NULL) {
    3185           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get key from parameter 1");
    3186           0 :                 RETURN_FALSE;
    3187             :         }
    3188             : 
    3189           1 :         if (php_openssl_open_base_dir_chk(filename TSRMLS_CC)) {
    3190           0 :                 RETURN_FALSE;
    3191             :         }
    3192             : 
    3193           1 :         PHP_SSL_REQ_INIT(&req);
    3194             : 
    3195           1 :         if (PHP_SSL_REQ_PARSE(&req, args) == SUCCESS) {
    3196           1 :                 bio_out = BIO_new_file(filename, "w");
    3197             : 
    3198           2 :                 if (passphrase && req.priv_key_encrypt) {
    3199           1 :                         if (req.priv_key_encrypt_cipher) {
    3200           0 :                                 cipher = req.priv_key_encrypt_cipher;
    3201             :                         } else {
    3202           1 :                                 cipher = (EVP_CIPHER *) EVP_des_ede3_cbc();
    3203             :                         }
    3204             :                 } else {
    3205           0 :                         cipher = NULL;
    3206             :                 }
    3207           1 :                 if (PEM_write_bio_PrivateKey(bio_out, key, cipher, (unsigned char *)passphrase, passphrase_len, NULL, NULL)) {
    3208             :                         /* Success!
    3209             :                          * If returning the output as a string, do so now */
    3210           1 :                         RETVAL_TRUE;
    3211             :                 }
    3212             :         }
    3213           1 :         PHP_SSL_REQ_DISPOSE(&req);
    3214             : 
    3215           1 :         if (key_resource == -1 && key) {
    3216           0 :                 EVP_PKEY_free(key);
    3217             :         }
    3218           1 :         if (bio_out) {
    3219           1 :                 BIO_free(bio_out);
    3220             :         }
    3221             : }
    3222             : /* }}} */
    3223             : 
    3224             : /* {{{ proto bool openssl_pkey_export(mixed key, &mixed out [, string passphrase [, array config_args]])
    3225             :    Gets an exportable representation of a key into a string or file */
    3226           3 : PHP_FUNCTION(openssl_pkey_export)
    3227             : {
    3228             :         struct php_x509_request req;
    3229           3 :         zval ** zpkey, * args = NULL, *out;
    3230           3 :         char * passphrase = NULL; int passphrase_len = 0;
    3231           3 :         long key_resource = -1;
    3232             :         EVP_PKEY * key;
    3233           3 :         BIO * bio_out = NULL;
    3234             :         const EVP_CIPHER * cipher;
    3235             : 
    3236           3 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Zz|s!a!", &zpkey, &out, &passphrase, &passphrase_len, &args) == FAILURE) {
    3237           0 :                 return;
    3238             :         }
    3239           3 :         RETVAL_FALSE;
    3240             : 
    3241           3 :         key = php_openssl_evp_from_zval(zpkey, 0, passphrase, 0, &key_resource TSRMLS_CC);
    3242             : 
    3243           3 :         if (key == NULL) {
    3244           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "cannot get key from parameter 1");
    3245           0 :                 RETURN_FALSE;
    3246             :         }
    3247             : 
    3248           3 :         PHP_SSL_REQ_INIT(&req);
    3249             : 
    3250           3 :         if (PHP_SSL_REQ_PARSE(&req, args) == SUCCESS) {
    3251           3 :                 bio_out = BIO_new(BIO_s_mem());
    3252             : 
    3253           3 :                 if (passphrase && req.priv_key_encrypt) {
    3254           0 :                         if (req.priv_key_encrypt_cipher) {
    3255           0 :                                 cipher = req.priv_key_encrypt_cipher;
    3256             :                         } else {
    3257           0 :                                 cipher = (EVP_CIPHER *) EVP_des_ede3_cbc();
    3258             :                         }
    3259             :                 } else {
    3260           3 :                         cipher = NULL;
    3261             :                 }
    3262           3 :                 if (PEM_write_bio_PrivateKey(bio_out, key, cipher, (unsigned char *)passphrase, passphrase_len, NULL, NULL)) {
    3263             :                         /* Success!
    3264             :                          * If returning the output as a string, do so now */
    3265             : 
    3266             :                         char * bio_mem_ptr;
    3267             :                         long bio_mem_len;
    3268           3 :                         RETVAL_TRUE;
    3269             : 
    3270           3 :                         bio_mem_len = BIO_get_mem_data(bio_out, &bio_mem_ptr);
    3271           3 :                         zval_dtor(out);
    3272           3 :                         ZVAL_STRINGL(out, bio_mem_ptr, bio_mem_len, 1);
    3273             :                 }
    3274             :         }
    3275           3 :         PHP_SSL_REQ_DISPOSE(&req);
    3276             : 
    3277           3 :         if (key_resource == -1 && key) {
    3278           0 :                 EVP_PKEY_free(key);
    3279             :         }
    3280           3 :         if (bio_out) {
    3281           3 :                 BIO_free(bio_out);
    3282             :         }
    3283             : }
    3284             : /* }}} */
    3285             : 
    3286             : /* {{{ proto int openssl_pkey_get_public(mixed cert)
    3287             :    Gets public key from X.509 certificate */
    3288           5 : PHP_FUNCTION(openssl_pkey_get_public)
    3289             : {
    3290             :         zval **cert;
    3291             :         EVP_PKEY *pkey;
    3292             : 
    3293           5 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z", &cert) == FAILURE) {
    3294           0 :                 return;
    3295             :         }
    3296           5 :         Z_TYPE_P(return_value) = IS_RESOURCE;
    3297           5 :         pkey = php_openssl_evp_from_zval(cert, 1, NULL, 1, &Z_LVAL_P(return_value) TSRMLS_CC);
    3298             : 
    3299           5 :         if (pkey == NULL) {
    3300           1 :                 RETURN_FALSE;
    3301             :         }
    3302           4 :         zend_list_addref(Z_LVAL_P(return_value));
    3303             : }
    3304             : /* }}} */
    3305             : 
    3306             : /* {{{ proto void openssl_pkey_free(int key)
    3307             :    Frees a key */
    3308           3 : PHP_FUNCTION(openssl_pkey_free)
    3309             : {
    3310             :         zval *key;
    3311             :         EVP_PKEY *pkey;
    3312             : 
    3313           3 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r", &key) == FAILURE) {
    3314           0 :                 return;
    3315             :         }
    3316           3 :         ZEND_FETCH_RESOURCE(pkey, EVP_PKEY *, &key, -1, "OpenSSL key", le_key);
    3317           3 :         zend_list_delete(Z_LVAL_P(key));
    3318             : }
    3319             : /* }}} */
    3320             : 
    3321             : /* {{{ proto int openssl_pkey_get_private(string key [, string passphrase])
    3322             :    Gets private keys */
    3323           8 : PHP_FUNCTION(openssl_pkey_get_private)
    3324             : {
    3325             :         zval **cert;
    3326             :         EVP_PKEY *pkey;
    3327           8 :         char * passphrase = "";
    3328           8 :         int passphrase_len = sizeof("")-1;
    3329             : 
    3330           8 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "Z|s", &cert, &passphrase, &passphrase_len) == FAILURE) {
    3331           0 :                 return;
    3332             :         }
    3333           8 :         Z_TYPE_P(return_value) = IS_RESOURCE;
    3334           8 :         pkey = php_openssl_evp_from_zval(cert, 0, passphrase, 1, &Z_LVAL_P(return_value) TSRMLS_CC);
    3335             : 
    3336           8 :         if (pkey == NULL) {
    3337           0 :                 RETURN_FALSE;
    3338             :         }
    3339           8 :         zend_list_addref(Z_LVAL_P(return_value));
    3340             : }
    3341             : 
    3342             : /* }}} */
    3343             : 
    3344             : /* {{{ proto resource openssl_pkey_get_details(resource key)
    3345             :         returns an array with the key details (bits, pkey, type)*/
    3346           4 : PHP_FUNCTION(openssl_pkey_get_details)
    3347             : {
    3348             :         zval *key;
    3349             :         EVP_PKEY *pkey;
    3350             :         BIO *out;
    3351             :         unsigned int pbio_len;
    3352             :         char *pbio;
    3353             :         long ktype;
    3354             : 
    3355           4 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "r", &key) == FAILURE) {
    3356           3 :                 return;
    3357             :         }
    3358           1 :         ZEND_FETCH_RESOURCE(pkey, EVP_PKEY *, &key, -1, "OpenSSL key", le_key);
    3359           1 :         if (!pkey) {
    3360           0 :                 RETURN_FALSE;
    3361             :         }
    3362           1 :         out = BIO_new(BIO_s_mem());
    3363           1 :         PEM_write_bio_PUBKEY(out, pkey);
    3364           1 :         pbio_len = BIO_get_mem_data(out, &pbio);
    3365             : 
    3366           1 :         array_init(return_value);
    3367           1 :         add_assoc_long(return_value, "bits", EVP_PKEY_bits(pkey));
    3368           1 :         add_assoc_stringl(return_value, "key", pbio, pbio_len, 1);
    3369             :         /*TODO: Use the real values once the openssl constants are used
    3370             :          * See the enum at the top of this file
    3371             :          */
    3372           1 :         switch (EVP_PKEY_type(pkey->type)) {
    3373             :                 case EVP_PKEY_RSA:
    3374             :                 case EVP_PKEY_RSA2:
    3375           1 :                         ktype = OPENSSL_KEYTYPE_RSA;
    3376             : 
    3377           1 :                         if (pkey->pkey.rsa != NULL) {
    3378             :                                 zval *rsa;
    3379             : 
    3380           1 :                                 ALLOC_INIT_ZVAL(rsa);
    3381           1 :                                 array_init(rsa);
    3382           1 :                                 OPENSSL_PKEY_GET_BN(rsa, n);
    3383           1 :                                 OPENSSL_PKEY_GET_BN(rsa, e);
    3384           1 :                                 OPENSSL_PKEY_GET_BN(rsa, d);
    3385           1 :                                 OPENSSL_PKEY_GET_BN(rsa, p);
    3386           1 :                                 OPENSSL_PKEY_GET_BN(rsa, q);
    3387           1 :                                 OPENSSL_PKEY_GET_BN(rsa, dmp1);
    3388           1 :                                 OPENSSL_PKEY_GET_BN(rsa, dmq1);
    3389           1 :                                 OPENSSL_PKEY_GET_BN(rsa, iqmp);
    3390           1 :                                 add_assoc_zval(return_value, "rsa", rsa);
    3391             :                         }
    3392             : 
    3393           1 :                         break;
    3394             :                 case EVP_PKEY_DSA:
    3395             :                 case EVP_PKEY_DSA2:
    3396             :                 case EVP_PKEY_DSA3:
    3397             :                 case EVP_PKEY_DSA4:
    3398           0 :                         ktype = OPENSSL_KEYTYPE_DSA;
    3399             : 
    3400           0 :                         if (pkey->pkey.dsa != NULL) {
    3401             :                                 zval *dsa;
    3402             : 
    3403           0 :                                 ALLOC_INIT_ZVAL(dsa);
    3404           0 :                                 array_init(dsa);
    3405           0 :                                 OPENSSL_PKEY_GET_BN(dsa, p);
    3406           0 :                                 OPENSSL_PKEY_GET_BN(dsa, q);
    3407           0 :                                 OPENSSL_PKEY_GET_BN(dsa, g);
    3408           0 :                                 OPENSSL_PKEY_GET_BN(dsa, priv_key);
    3409           0 :                                 OPENSSL_PKEY_GET_BN(dsa, pub_key);
    3410           0 :                                 add_assoc_zval(return_value, "dsa", dsa);
    3411             :                         }
    3412           0 :                         break;
    3413             :                 case EVP_PKEY_DH:
    3414             : 
    3415           0 :                         ktype = OPENSSL_KEYTYPE_DH;
    3416             : 
    3417           0 :                         if (pkey->pkey.dh != NULL) {
    3418             :                                 zval *dh;
    3419             : 
    3420           0 :                                 ALLOC_INIT_ZVAL(dh);
    3421           0 :                                 array_init(dh);
    3422           0 :                                 OPENSSL_PKEY_GET_BN(dh, p);
    3423           0 :                                 OPENSSL_PKEY_GET_BN(dh, g);
    3424           0 :                                 OPENSSL_PKEY_GET_BN(dh, priv_key);
    3425           0 :                                 OPENSSL_PKEY_GET_BN(dh, pub_key);
    3426           0 :                                 add_assoc_zval(return_value, "dh", dh);
    3427             :                         }
    3428             : 
    3429           0 :                         break;
    3430             : #ifdef HAVE_EVP_PKEY_EC
    3431             :                 case EVP_PKEY_EC:
    3432           0 :                         ktype = OPENSSL_KEYTYPE_EC;
    3433           0 :                         break;
    3434             : #endif
    3435             :                 default:
    3436           0 :                         ktype = -1;
    3437             :                         break;
    3438             :         }
    3439           1 :         add_assoc_long(return_value, "type", ktype);
    3440             : 
    3441           1 :         BIO_free(out);
    3442             : }
    3443             : /* }}} */
    3444             : 
    3445             : /* }}} */
    3446             : 
    3447             : /* {{{ PKCS7 S/MIME functions */
    3448             : 
    3449             : /* {{{ proto bool openssl_pkcs7_verify(string filename, long flags [, string signerscerts [, array cainfo [, string extracerts [, string content]]]])
    3450             :    Verifys that the data block is intact, the signer is who they say they are, and returns the CERTs of the signers */
    3451           0 : PHP_FUNCTION(openssl_pkcs7_verify)
    3452             : {
    3453           0 :         X509_STORE * store = NULL;
    3454           0 :         zval * cainfo = NULL;
    3455           0 :         STACK_OF(X509) *signers= NULL;
    3456           0 :         STACK_OF(X509) *others = NULL;
    3457           0 :         PKCS7 * p7 = NULL;
    3458           0 :         BIO * in = NULL, * datain = NULL, * dataout = NULL;
    3459           0 :         long flags = 0;
    3460             :         char * filename; int filename_len;
    3461           0 :         char * extracerts = NULL; int extracerts_len = 0;
    3462           0 :         char * signersfilename = NULL; int signersfilename_len = 0;
    3463           0 :         char * datafilename = NULL; int datafilename_len = 0;
    3464             : 
    3465           0 :         RETVAL_LONG(-1);
    3466             : 
    3467           0 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "pl|papp", &filename, &filename_len,
    3468             :                                 &flags, &signersfilename, &signersfilename_len, &cainfo,
    3469             :                                 &extracerts, &extracerts_len, &datafilename, &datafilename_len) == FAILURE) {
    3470           0 :                 return;
    3471             :         }
    3472             : 
    3473           0 :         if (extracerts) {
    3474           0 :                 others = load_all_certs_from_file(extracerts);
    3475           0 :                 if (others == NULL) {
    3476           0 :                         goto clean_exit;
    3477             :                 }
    3478             :         }
    3479             : 
    3480           0 :         flags = flags & ~PKCS7_DETACHED;
    3481             : 
    3482           0 :         store = setup_verify(cainfo TSRMLS_CC);
    3483             : 
    3484           0 :         if (!store) {
    3485           0 :                 goto clean_exit;
    3486             :         }
    3487           0 :         if (php_openssl_open_base_dir_chk(filename TSRMLS_CC)) {
    3488           0 :                 goto clean_exit;
    3489             :         }
    3490             : 
    3491           0 :         in = BIO_new_file(filename, (flags & PKCS7_BINARY) ? "rb" : "r");
    3492           0 :         if (in == NULL) {
    3493           0 :                 goto clean_exit;
    3494             :         }
    3495           0 :         p7 = SMIME_read_PKCS7(in, &datain);
    3496           0 :         if (p7 == NULL) {
    3497             : #if DEBUG_SMIME
    3498             :                 zend_printf("SMIME_read_PKCS7 failed\n");
    3499             : #endif
    3500           0 :                 goto clean_exit;
    3501             :         }
    3502             : 
    3503           0 :         if (datafilename) {
    3504             : 
    3505           0 :                 if (php_openssl_open_base_dir_chk(datafilename TSRMLS_CC)) {
    3506           0 :                         goto clean_exit;
    3507             :                 }
    3508             : 
    3509           0 :                 dataout = BIO_new_file(datafilename, "w");
    3510           0 :                 if (dataout == NULL) {
    3511           0 :                         goto clean_exit;
    3512             :                 }
    3513             :         }
    3514             : #if DEBUG_SMIME
    3515             :         zend_printf("Calling PKCS7 verify\n");
    3516             : #endif
    3517             : 
    3518           0 :         if (PKCS7_verify(p7, others, store, datain, dataout, flags)) {
    3519             : 
    3520           0 :                 RETVAL_TRUE;
    3521             : 
    3522           0 :                 if (signersfilename) {
    3523             :                         BIO *certout;
    3524             : 
    3525           0 :                         if (php_openssl_open_base_dir_chk(signersfilename TSRMLS_CC)) {
    3526           0 :                                 goto clean_exit;
    3527             :                         }
    3528             : 
    3529           0 :                         certout = BIO_new_file(signersfilename, "w");
    3530           0 :                         if (certout) {
    3531             :                                 int i;
    3532           0 :                                 signers = PKCS7_get0_signers(p7, NULL, flags);
    3533             : 
    3534           0 :                                 for(i = 0; i < sk_X509_num(signers); i++) {
    3535           0 :                                         PEM_write_bio_X509(certout, sk_X509_value(signers, i));
    3536             :                                 }
    3537           0 :                                 BIO_free(certout);
    3538           0 :                                 sk_X509_free(signers);
    3539             :                         } else {
    3540           0 :                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "signature OK, but cannot open %s for writing", signersfilename);
    3541           0 :                                 RETVAL_LONG(-1);
    3542             :                         }
    3543             :                 }
    3544           0 :                 goto clean_exit;
    3545             :         } else {
    3546           0 :                 RETVAL_FALSE;
    3547             :         }
    3548             : clean_exit:
    3549           0 :         X509_STORE_free(store);
    3550           0 :         BIO_free(datain);
    3551           0 :         BIO_free(in);
    3552           0 :         BIO_free(dataout);
    3553           0 :         PKCS7_free(p7);
    3554           0 :         sk_X509_free(others);
    3555             : }
    3556             : /* }}} */
    3557             : 
    3558             : /* {{{ proto bool openssl_pkcs7_encrypt(string infile, string outfile, mixed recipcerts, array headers [, long flags [, long cipher]])
    3559             :    Encrypts the message in the file named infile with the certificates in recipcerts and output the result to the file named outfile */
    3560          12 : PHP_FUNCTION(openssl_pkcs7_encrypt)
    3561             : {
    3562          12 :         zval ** zrecipcerts, * zheaders = NULL;
    3563          12 :         STACK_OF(X509) * recipcerts = NULL;
    3564          12 :         BIO * infile = NULL, * outfile = NULL;
    3565          12 :         long flags = 0;
    3566          12 :         PKCS7 * p7 = NULL;
    3567             :         HashPosition hpos;
    3568             :         zval ** zcertval;
    3569             :         X509 * cert;
    3570          12 :         const EVP_CIPHER *cipher = NULL;
    3571          12 :         long cipherid = PHP_OPENSSL_CIPHER_DEFAULT;
    3572             :         uint strindexlen;
    3573             :         ulong intindex;
    3574             :         char * strindex;
    3575          12 :         char * infilename = NULL;       int infilename_len;
    3576          12 :         char * outfilename = NULL;      int outfilename_len;
    3577             : 
    3578          12 :         RETVAL_FALSE;
    3579             : 
    3580          12 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ppZa!|ll", &infilename, &infilename_len,
    3581             :                                 &outfilename, &outfilename_len, &zrecipcerts, &zheaders, &flags, &cipherid) == FAILURE)
    3582           2 :                 return;
    3583             : 
    3584             : 
    3585          10 :         if (php_openssl_open_base_dir_chk(infilename TSRMLS_CC) || php_openssl_open_base_dir_chk(outfilename TSRMLS_CC)) {
    3586           0 :                 return;
    3587             :         }
    3588             : 
    3589          10 :         infile = BIO_new_file(infilename, "r");
    3590          10 :         if (infile == NULL) {
    3591           2 :                 goto clean_exit;
    3592             :         }
    3593             : 
    3594           8 :         outfile = BIO_new_file(outfilename, "w");
    3595           8 :         if (outfile == NULL) {
    3596           1 :                 goto clean_exit;
    3597             :         }
    3598             : 
    3599           7 :         recipcerts = sk_X509_new_null();
    3600             : 
    3601             :         /* get certs */
    3602           7 :         if (Z_TYPE_PP(zrecipcerts) == IS_ARRAY) {
    3603           1 :                 zend_hash_internal_pointer_reset_ex(HASH_OF(*zrecipcerts), &hpos);
    3604           4 :                 while(zend_hash_get_current_data_ex(HASH_OF(*zrecipcerts), (void**)&zcertval, &hpos) == SUCCESS) {
    3605             :                         long certresource;
    3606             : 
    3607           2 :                         cert = php_openssl_x509_from_zval(zcertval, 0, &certresource TSRMLS_CC);
    3608           2 :                         if (cert == NULL) {
    3609           0 :                                 goto clean_exit;
    3610             :                         }
    3611             : 
    3612           2 :                         if (certresource != -1) {
    3613             :                                 /* we shouldn't free this particular cert, as it is a resource.
    3614             :                                         make a copy and push that on the stack instead */
    3615           0 :                                 cert = X509_dup(cert);
    3616           0 :                                 if (cert == NULL) {
    3617           0 :                                         goto clean_exit;
    3618             :                                 }
    3619             :                         }
    3620           2 :                         sk_X509_push(recipcerts, cert);
    3621             : 
    3622           2 :                         zend_hash_move_forward_ex(HASH_OF(*zrecipcerts), &hpos);
    3623             :                 }
    3624             :         } else {
    3625             :                 /* a single certificate */
    3626             :                 long certresource;
    3627             : 
    3628           6 :                 cert = php_openssl_x509_from_zval(zrecipcerts, 0, &certresource TSRMLS_CC);
    3629           6 :                 if (cert == NULL) {
    3630           2 :                         goto clean_exit;
    3631             :                 }
    3632             : 
    3633           4 :                 if (certresource != -1) {
    3634             :                         /* we shouldn't free this particular cert, as it is a resource.
    3635             :                                 make a copy and push that on the stack instead */
    3636           0 :                         cert = X509_dup(cert);
    3637           0 :                         if (cert == NULL) {
    3638           0 :                                 goto clean_exit;
    3639             :                         }
    3640             :                 }
    3641           4 :                 sk_X509_push(recipcerts, cert);
    3642             :         }
    3643             : 
    3644             :         /* sanity check the cipher */
    3645           5 :         cipher = php_openssl_get_evp_cipher_from_algo(cipherid);
    3646           5 :         if (cipher == NULL) {
    3647             :                 /* shouldn't happen */
    3648           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Failed to get cipher");
    3649           0 :                 goto clean_exit;
    3650             :         }
    3651             : 
    3652           5 :         p7 = PKCS7_encrypt(recipcerts, infile, (EVP_CIPHER*)cipher, flags);
    3653             : 
    3654           5 :         if (p7 == NULL) {
    3655           0 :                 goto clean_exit;
    3656             :         }
    3657             : 
    3658             :         /* tack on extra headers */
    3659           5 :         if (zheaders) {
    3660           5 :                 zend_hash_internal_pointer_reset_ex(HASH_OF(zheaders), &hpos);
    3661          18 :                 while(zend_hash_get_current_data_ex(HASH_OF(zheaders), (void**)&zcertval, &hpos) == SUCCESS) {
    3662           8 :                         strindex = NULL;
    3663           8 :                         zend_hash_get_current_key_ex(HASH_OF(zheaders), &strindex, &strindexlen, &intindex, 0, &hpos);
    3664             : 
    3665           8 :                         convert_to_string_ex(zcertval);
    3666             : 
    3667           8 :                         if (strindex) {
    3668           2 :                                 BIO_printf(outfile, "%s: %s\n", strindex, Z_STRVAL_PP(zcertval));
    3669             :                         } else {
    3670           6 :                                 BIO_printf(outfile, "%s\n", Z_STRVAL_PP(zcertval));
    3671             :                         }
    3672             : 
    3673           8 :                         zend_hash_move_forward_ex(HASH_OF(zheaders), &hpos);
    3674             :                 }
    3675             :         }
    3676             : 
    3677           5 :         (void)BIO_reset(infile);
    3678             : 
    3679             :         /* write the encrypted data */
    3680           5 :         SMIME_write_PKCS7(outfile, p7, infile, flags);
    3681             : 
    3682           5 :         RETVAL_TRUE;
    3683             : 
    3684             : clean_exit:
    3685          10 :         PKCS7_free(p7);
    3686          10 :         BIO_free(infile);
    3687          10 :         BIO_free(outfile);
    3688          10 :         if (recipcerts) {
    3689           7 :                 sk_X509_pop_free(recipcerts, X509_free);
    3690             :         }
    3691             : }
    3692             : /* }}} */
    3693             : 
    3694             : /* {{{ proto bool openssl_pkcs7_sign(string infile, string outfile, mixed signcert, mixed signkey, array headers [, long flags [, string extracertsfilename]])
    3695             :    Signs the MIME message in the file named infile with signcert/signkey and output the result to file name outfile. headers lists plain text headers to exclude from the signed portion of the message, and should include to, from and subject as a minimum */
    3696             : 
    3697          11 : PHP_FUNCTION(openssl_pkcs7_sign)
    3698             : {
    3699             :         zval ** zcert, ** zprivkey, * zheaders;
    3700             :         zval ** hval;
    3701          11 :         X509 * cert = NULL;
    3702          11 :         EVP_PKEY * privkey = NULL;
    3703          11 :         long flags = PKCS7_DETACHED;
    3704          11 :         PKCS7 * p7 = NULL;
    3705          11 :         BIO * infile = NULL, * outfile = NULL;
    3706          11 :         STACK_OF(X509) *others = NULL;
    3707          11 :         long certresource = -1, keyresource = -1;
    3708             :         ulong intindex;
    3709             :         uint strindexlen;
    3710             :         HashPosition hpos;
    3711             :         char * strindex;
    3712             :         char * infilename;      int infilename_len;
    3713             :         char * outfilename;     int outfilename_len;
    3714          11 :         char * extracertsfilename = NULL; int extracertsfilename_len;
    3715             : 
    3716          11 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ppZZa!|lp",
    3717             :                                 &infilename, &infilename_len, &outfilename, &outfilename_len,
    3718             :                                 &zcert, &zprivkey, &zheaders, &flags, &extracertsfilename,
    3719             :                                 &extracertsfilename_len) == FAILURE) {
    3720           2 :                 return;
    3721             :         }
    3722             : 
    3723           9 :         RETVAL_FALSE;
    3724             : 
    3725           9 :         if (extracertsfilename) {
    3726           0 :                 others = load_all_certs_from_file(extracertsfilename);
    3727           0 :                 if (others == NULL) {
    3728           0 :                         goto clean_exit;
    3729             :                 }
    3730             :         }
    3731             : 
    3732           9 :         privkey = php_openssl_evp_from_zval(zprivkey, 0, "", 0, &keyresource TSRMLS_CC);
    3733           9 :         if (privkey == NULL) {
    3734           1 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error getting private key");
    3735           1 :                 goto clean_exit;
    3736             :         }
    3737             : 
    3738           8 :         cert = php_openssl_x509_from_zval(zcert, 0, &certresource TSRMLS_CC);
    3739           8 :         if (cert == NULL) {
    3740           2 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error getting cert");
    3741           2 :                 goto clean_exit;
    3742             :         }
    3743             : 
    3744           6 :         if (php_openssl_open_base_dir_chk(infilename TSRMLS_CC) || php_openssl_open_base_dir_chk(outfilename TSRMLS_CC)) {
    3745             :                 goto clean_exit;
    3746             :         }
    3747             : 
    3748           6 :         infile = BIO_new_file(infilename, "r");
    3749           6 :         if (infile == NULL) {
    3750           2 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error opening input file %s!", infilename);
    3751           2 :                 goto clean_exit;
    3752             :         }
    3753             : 
    3754           4 :         outfile = BIO_new_file(outfilename, "w");
    3755           4 :         if (outfile == NULL) {
    3756           1 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error opening output file %s!", outfilename);
    3757           1 :                 goto clean_exit;
    3758             :         }
    3759             : 
    3760           3 :         p7 = PKCS7_sign(cert, privkey, others, infile, flags);
    3761           3 :         if (p7 == NULL) {
    3762           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "error creating PKCS7 structure!");
    3763           0 :                 goto clean_exit;
    3764             :         }
    3765             : 
    3766           3 :         (void)BIO_reset(infile);
    3767             : 
    3768             :         /* tack on extra headers */
    3769           3 :         if (zheaders) {
    3770           3 :                 zend_hash_internal_pointer_reset_ex(HASH_OF(zheaders), &hpos);
    3771          10 :                 while(zend_hash_get_current_data_ex(HASH_OF(zheaders), (void**)&hval, &hpos) == SUCCESS) {
    3772           4 :                         strindex = NULL;
    3773           4 :                         zend_hash_get_current_key_ex(HASH_OF(zheaders), &strindex, &strindexlen, &intindex, 0, &hpos);
    3774             : 
    3775           4 :                         convert_to_string_ex(hval);
    3776             : 
    3777           4 :                         if (strindex) {
    3778           2 :                                 BIO_printf(outfile, "%s: %s\n", strindex, Z_STRVAL_PP(hval));
    3779             :                         } else {
    3780           2 :                                 BIO_printf(outfile, "%s\n", Z_STRVAL_PP(hval));
    3781             :                         }
    3782           4 :                         zend_hash_move_forward_ex(HASH_OF(zheaders), &hpos);
    3783             :                 }
    3784             :         }
    3785             :         /* write the signed data */
    3786           3 :         SMIME_write_PKCS7(outfile, p7, infile, flags);
    3787             : 
    3788           3 :         RETVAL_TRUE;
    3789             : 
    3790             : clean_exit:
    3791           9 :         PKCS7_free(p7);
    3792           9 :         BIO_free(infile);
    3793           9 :         BIO_free(outfile);
    3794           9 :         if (others) {
    3795           0 :                 sk_X509_pop_free(others, X509_free);
    3796             :         }
    3797           9 :         if (privkey && keyresource == -1) {
    3798           8 :                 EVP_PKEY_free(privkey);
    3799             :         }
    3800           9 :         if (cert && certresource == -1) {
    3801           6 :                 X509_free(cert);
    3802             :         }
    3803             : }
    3804             : /* }}} */
    3805             : 
    3806             : /* {{{ proto bool openssl_pkcs7_decrypt(string infilename, string outfilename, mixed recipcert [, mixed recipkey])
    3807             :    Decrypts the S/MIME message in the file name infilename and output the results to the file name outfilename.  recipcert is a CERT for one of the recipients. recipkey specifies the private key matching recipcert, if recipcert does not include the key */
    3808             : 
    3809          15 : PHP_FUNCTION(openssl_pkcs7_decrypt)
    3810             : {
    3811          15 :         zval ** recipcert, ** recipkey = NULL;
    3812          15 :         X509 * cert = NULL;
    3813          15 :         EVP_PKEY * key = NULL;
    3814             :         long certresval, keyresval;
    3815          15 :         BIO * in = NULL, * out = NULL, * datain = NULL;
    3816          15 :         PKCS7 * p7 = NULL;
    3817             :         char * infilename;      int infilename_len;
    3818             :         char * outfilename;     int outfilename_len;
    3819             : 
    3820          15 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ppZ|Z", &infilename, &infilename_len,
    3821             :                                 &outfilename, &outfilename_len, &recipcert, &recipkey) == FAILURE) {
    3822           0 :                 return;
    3823             :         }
    3824             : 
    3825          15 :         RETVAL_FALSE;
    3826             : 
    3827          15 :         cert = php_openssl_x509_from_zval(recipcert, 0, &certresval TSRMLS_CC);
    3828          15 :         if (cert == NULL) {
    3829           8 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to coerce parameter 3 to x509 cert");
    3830           8 :                 goto clean_exit;
    3831             :         }
    3832             : 
    3833           7 :         key = php_openssl_evp_from_zval(recipkey ? recipkey : recipcert, 0, "", 0, &keyresval TSRMLS_CC);
    3834           7 :         if (key == NULL) {
    3835           2 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to get private key");
    3836           2 :                 goto clean_exit;
    3837             :         }
    3838             : 
    3839           5 :         if (php_openssl_open_base_dir_chk(infilename TSRMLS_CC) || php_openssl_open_base_dir_chk(outfilename TSRMLS_CC)) {
    3840             :                 goto clean_exit;
    3841             :         }
    3842             : 
    3843           5 :         in = BIO_new_file(infilename, "r");
    3844           5 :         if (in == NULL) {
    3845           2 :                 goto clean_exit;
    3846             :         }
    3847           3 :         out = BIO_new_file(outfilename, "w");
    3848           3 :         if (out == NULL) {
    3849           1 :                 goto clean_exit;
    3850             :         }
    3851             : 
    3852           2 :         p7 = SMIME_read_PKCS7(in, &datain);
    3853             : 
    3854           2 :         if (p7 == NULL) {
    3855           0 :                 goto clean_exit;
    3856             :         }
    3857           2 :         if (PKCS7_decrypt(p7, key, cert, out, PKCS7_DETACHED)) {
    3858           2 :                 RETVAL_TRUE;
    3859             :         }
    3860             : clean_exit:
    3861          15 :         PKCS7_free(p7);
    3862          15 :         BIO_free(datain);
    3863          15 :         BIO_free(in);
    3864          15 :         BIO_free(out);
    3865          15 :         if (cert && certresval == -1) {
    3866           7 :                 X509_free(cert);
    3867             :         }
    3868          15 :         if (key && keyresval == -1) {
    3869           5 :                 EVP_PKEY_free(key);
    3870             :         }
    3871             : }
    3872             : /* }}} */
    3873             : 
    3874             : /* }}} */
    3875             : 
    3876             : /* {{{ proto bool openssl_private_encrypt(string data, string &crypted, mixed key [, int padding])
    3877             :    Encrypts data with private key */
    3878           6 : PHP_FUNCTION(openssl_private_encrypt)
    3879             : {
    3880             :         zval **key, *crypted;
    3881             :         EVP_PKEY *pkey;
    3882             :         int cryptedlen;
    3883           6 :         unsigned char *cryptedbuf = NULL;
    3884           6 :         int successful = 0;
    3885           6 :         long keyresource = -1;
    3886             :         char * data;
    3887             :         int data_len;
    3888           6 :         long padding = RSA_PKCS1_PADDING;
    3889             : 
    3890           6 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "szZ|l", &data, &data_len, &crypted, &key, &padding) == FAILURE) {
    3891           0 :                 return;
    3892             :         }
    3893           6 :         RETVAL_FALSE;
    3894             : 
    3895           6 :         pkey = php_openssl_evp_from_zval(key, 0, "", 0, &keyresource TSRMLS_CC);
    3896             : 
    3897           6 :         if (pkey == NULL) {
    3898           3 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "key param is not a valid private key");
    3899           3 :                 RETURN_FALSE;
    3900             :         }
    3901             : 
    3902           3 :         cryptedlen = EVP_PKEY_size(pkey);
    3903           3 :         cryptedbuf = emalloc(cryptedlen + 1);
    3904             : 
    3905           3 :         switch (pkey->type) {
    3906             :                 case EVP_PKEY_RSA:
    3907             :                 case EVP_PKEY_RSA2:
    3908           6 :                         successful =  (RSA_private_encrypt(data_len,
    3909             :                                                 (unsigned char *)data,
    3910             :                                                 cryptedbuf,
    3911           3 :                                                 pkey->pkey.rsa,
    3912             :                                                 padding) == cryptedlen);
    3913           3 :                         break;
    3914             :                 default:
    3915           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "key type not supported in this PHP build!");
    3916             :         }
    3917             : 
    3918           3 :         if (successful) {
    3919           3 :                 zval_dtor(crypted);
    3920           3 :                 cryptedbuf[cryptedlen] = '\0';
    3921           3 :                 ZVAL_STRINGL(crypted, (char *)cryptedbuf, cryptedlen, 0);
    3922           3 :                 cryptedbuf = NULL;
    3923           3 :                 RETVAL_TRUE;
    3924             :         }
    3925           3 :         if (cryptedbuf) {
    3926           0 :                 efree(cryptedbuf);
    3927             :         }
    3928           3 :         if (keyresource == -1) {
    3929           3 :                 EVP_PKEY_free(pkey);
    3930             :         }
    3931             : }
    3932             : /* }}} */
    3933             : 
    3934             : /* {{{ proto bool openssl_private_decrypt(string data, string &decrypted, mixed key [, int padding])
    3935             :    Decrypts data with private key */
    3936           6 : PHP_FUNCTION(openssl_private_decrypt)
    3937             : {
    3938             :         zval **key, *crypted;
    3939             :         EVP_PKEY *pkey;
    3940             :         int cryptedlen;
    3941           6 :         unsigned char *cryptedbuf = NULL;
    3942             :         unsigned char *crypttemp;
    3943           6 :         int successful = 0;
    3944           6 :         long padding = RSA_PKCS1_PADDING;
    3945           6 :         long keyresource = -1;
    3946             :         char * data;
    3947             :         int data_len;
    3948             : 
    3949           6 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "szZ|l", &data, &data_len, &crypted, &key, &padding) == FAILURE) {
    3950           0 :                 return;
    3951             :         }
    3952           6 :         RETVAL_FALSE;
    3953             : 
    3954           6 :         pkey = php_openssl_evp_from_zval(key, 0, "", 0, &keyresource TSRMLS_CC);
    3955           6 :         if (pkey == NULL) {
    3956           2 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "key parameter is not a valid private key");
    3957           2 :                 RETURN_FALSE;
    3958             :         }
    3959             : 
    3960           4 :         cryptedlen = EVP_PKEY_size(pkey);
    3961           4 :         crypttemp = emalloc(cryptedlen + 1);
    3962             : 
    3963           4 :         switch (pkey->type) {
    3964             :                 case EVP_PKEY_RSA:
    3965             :                 case EVP_PKEY_RSA2:
    3966           8 :                         cryptedlen = RSA_private_decrypt(data_len,
    3967             :                                         (unsigned char *)data,
    3968             :                                         crypttemp,
    3969           4 :                                         pkey->pkey.rsa,
    3970             :                                         padding);
    3971           4 :                         if (cryptedlen != -1) {
    3972           3 :                                 cryptedbuf = emalloc(cryptedlen + 1);
    3973           3 :                                 memcpy(cryptedbuf, crypttemp, cryptedlen);
    3974           3 :                                 successful = 1;
    3975             :                         }
    3976           4 :                         break;
    3977             :                 default:
    3978           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "key type not supported in this PHP build!");
    3979             :         }
    3980             : 
    3981           4 :         efree(crypttemp);
    3982             : 
    3983           4 :         if (successful) {
    3984           3 :                 zval_dtor(crypted);
    3985           3 :                 cryptedbuf[cryptedlen] = '\0';
    3986           3 :                 ZVAL_STRINGL(crypted, (char *)cryptedbuf, cryptedlen, 0);
    3987           3 :                 cryptedbuf = NULL;
    3988           3 :                 RETVAL_TRUE;
    3989             :         }
    3990             : 
    3991           4 :         if (keyresource == -1) {
    3992           4 :                 EVP_PKEY_free(pkey);
    3993             :         }
    3994           4 :         if (cryptedbuf) {
    3995           0 :                 efree(cryptedbuf);
    3996             :         }
    3997             : }
    3998             : /* }}} */
    3999             : 
    4000             : /* {{{ proto bool openssl_public_encrypt(string data, string &crypted, mixed key [, int padding])
    4001             :    Encrypts data with public key */
    4002           6 : PHP_FUNCTION(openssl_public_encrypt)
    4003             : {
    4004             :         zval **key, *crypted;
    4005             :         EVP_PKEY *pkey;
    4006             :         int cryptedlen;
    4007             :         unsigned char *cryptedbuf;
    4008           6 :         int successful = 0;
    4009           6 :         long keyresource = -1;
    4010           6 :         long padding = RSA_PKCS1_PADDING;
    4011             :         char * data;
    4012             :         int data_len;
    4013             : 
    4014           6 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "szZ|l", &data, &data_len, &crypted, &key, &padding) == FAILURE)
    4015           0 :                 return;
    4016             : 
    4017           6 :         RETVAL_FALSE;
    4018             : 
    4019           6 :         pkey = php_openssl_evp_from_zval(key, 1, NULL, 0, &keyresource TSRMLS_CC);
    4020           6 :         if (pkey == NULL) {
    4021           3 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "key parameter is not a valid public key");
    4022           3 :                 RETURN_FALSE;
    4023             :         }
    4024             : 
    4025           3 :         cryptedlen = EVP_PKEY_size(pkey);
    4026           3 :         cryptedbuf = emalloc(cryptedlen + 1);
    4027             : 
    4028           3 :         switch (pkey->type) {
    4029             :                 case EVP_PKEY_RSA:
    4030             :                 case EVP_PKEY_RSA2:
    4031           6 :                         successful = (RSA_public_encrypt(data_len,
    4032             :                                                 (unsigned char *)data,
    4033             :                                                 cryptedbuf,
    4034           3 :                                                 pkey->pkey.rsa,
    4035             :                                                 padding) == cryptedlen);
    4036           3 :                         break;
    4037             :                 default:
    4038           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "key type not supported in this PHP build!");
    4039             : 
    4040             :         }
    4041             : 
    4042           3 :         if (successful) {
    4043           3 :                 zval_dtor(crypted);
    4044           3 :                 cryptedbuf[cryptedlen] = '\0';
    4045           3 :                 ZVAL_STRINGL(crypted, (char *)cryptedbuf, cryptedlen, 0);
    4046           3 :                 cryptedbuf = NULL;
    4047           3 :                 RETVAL_TRUE;
    4048             :         }
    4049           3 :         if (keyresource == -1) {
    4050           3 :                 EVP_PKEY_free(pkey);
    4051             :         }
    4052           3 :         if (cryptedbuf) {
    4053           0 :                 efree(cryptedbuf);
    4054             :         }
    4055             : }
    4056             : /* }}} */
    4057             : 
    4058             : /* {{{ proto bool openssl_public_decrypt(string data, string &crypted, resource key [, int padding])
    4059             :    Decrypts data with public key */
    4060           7 : PHP_FUNCTION(openssl_public_decrypt)
    4061             : {
    4062             :         zval **key, *crypted;
    4063             :         EVP_PKEY *pkey;
    4064             :         int cryptedlen;
    4065           7 :         unsigned char *cryptedbuf = NULL;
    4066             :         unsigned char *crypttemp;
    4067           7 :         int successful = 0;
    4068           7 :         long keyresource = -1;
    4069           7 :         long padding = RSA_PKCS1_PADDING;
    4070             :         char * data;
    4071             :         int data_len;
    4072             : 
    4073           7 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "szZ|l", &data, &data_len, &crypted, &key, &padding) == FAILURE) {
    4074           0 :                 return;
    4075             :         }
    4076           7 :         RETVAL_FALSE;
    4077             : 
    4078           7 :         pkey = php_openssl_evp_from_zval(key, 1, NULL, 0, &keyresource TSRMLS_CC);
    4079           7 :         if (pkey == NULL) {
    4080           3 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "key parameter is not a valid public key");
    4081           3 :                 RETURN_FALSE;
    4082             :         }
    4083             : 
    4084           4 :         cryptedlen = EVP_PKEY_size(pkey);
    4085           4 :         crypttemp = emalloc(cryptedlen + 1);
    4086             : 
    4087           4 :         switch (pkey->type) {
    4088             :                 case EVP_PKEY_RSA:
    4089             :                 case EVP_PKEY_RSA2:
    4090           8 :                         cryptedlen = RSA_public_decrypt(data_len,
    4091             :                                         (unsigned char *)data,
    4092             :                                         crypttemp,
    4093           4 :                                         pkey->pkey.rsa,
    4094             :                                         padding);
    4095           4 :                         if (cryptedlen != -1) {
    4096           3 :                                 cryptedbuf = emalloc(cryptedlen + 1);
    4097           3 :                                 memcpy(cryptedbuf, crypttemp, cryptedlen);
    4098           3 :                                 successful = 1;
    4099             :                         }
    4100           4 :                         break;
    4101             : 
    4102             :                 default:
    4103           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "key type not supported in this PHP build!");
    4104             : 
    4105             :         }
    4106             : 
    4107           4 :         efree(crypttemp);
    4108             : 
    4109           4 :         if (successful) {
    4110           3 :                 zval_dtor(crypted);
    4111           3 :                 cryptedbuf[cryptedlen] = '\0';
    4112           3 :                 ZVAL_STRINGL(crypted, (char *)cryptedbuf, cryptedlen, 0);
    4113           3 :                 cryptedbuf = NULL;
    4114           3 :                 RETVAL_TRUE;
    4115             :         }
    4116             : 
    4117           4 :         if (cryptedbuf) {
    4118           0 :                 efree(cryptedbuf);
    4119             :         }
    4120           4 :         if (keyresource == -1) {
    4121           4 :                 EVP_PKEY_free(pkey);
    4122             :         }
    4123             : }
    4124             : /* }}} */
    4125             : 
    4126             : /* {{{ proto mixed openssl_error_string(void)
    4127             :    Returns a description of the last error, and alters the index of the error messages. Returns false when the are no more messages */
    4128           2 : PHP_FUNCTION(openssl_error_string)
    4129             : {
    4130             :         char buf[512];
    4131             :         unsigned long val;
    4132             : 
    4133           2 :         if (zend_parse_parameters_none() == FAILURE) {
    4134           0 :                 return;
    4135             :         }
    4136             : 
    4137           2 :         val = ERR_get_error();
    4138           2 :         if (val) {
    4139           1 :                 RETURN_STRING(ERR_error_string(val, buf), 1);
    4140             :         } else {
    4141           1 :                 RETURN_FALSE;
    4142             :         }
    4143             : }
    4144             : /* }}} */
    4145             : 
    4146             : /* {{{ proto bool openssl_sign(string data, &string signature, mixed key[, mixed method])
    4147             :    Signs data */
    4148           7 : PHP_FUNCTION(openssl_sign)
    4149             : {
    4150             :         zval **key, *signature;
    4151             :         EVP_PKEY *pkey;
    4152             :         int siglen;
    4153             :         unsigned char *sigbuf;
    4154           7 :         long keyresource = -1;
    4155             :         char * data;
    4156             :         int data_len;
    4157             :         EVP_MD_CTX md_ctx;
    4158           7 :         zval *method = NULL;
    4159           7 :         long signature_algo = OPENSSL_ALGO_SHA1;
    4160             :         const EVP_MD *mdtype;
    4161             : 
    4162           7 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "szZ|z", &data, &data_len, &signature, &key, &method) == FAILURE) {
    4163           1 :                 return;
    4164             :         }
    4165           6 :         pkey = php_openssl_evp_from_zval(key, 0, "", 0, &keyresource TSRMLS_CC);
    4166           6 :         if (pkey == NULL) {
    4167           1 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "supplied key param cannot be coerced into a private key");
    4168           1 :                 RETURN_FALSE;
    4169             :         }
    4170             : 
    4171           9 :         if (method == NULL || Z_TYPE_P(method) == IS_LONG) {
    4172           4 :                 if (method != NULL) {
    4173           2 :                         signature_algo = Z_LVAL_P(method);
    4174             :                 }
    4175           4 :                 mdtype = php_openssl_get_evp_md_from_algo(signature_algo);
    4176           1 :         } else if (Z_TYPE_P(method) == IS_STRING) {
    4177           1 :                 mdtype = EVP_get_digestbyname(Z_STRVAL_P(method));
    4178             :         } else {
    4179           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown signature algorithm.");
    4180           0 :                 RETURN_FALSE;
    4181             :         }
    4182           5 :         if (!mdtype) {
    4183           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown signature algorithm.");
    4184           0 :                 RETURN_FALSE;
    4185             :         }
    4186             : 
    4187           5 :         siglen = EVP_PKEY_size(pkey);
    4188           5 :         sigbuf = emalloc(siglen + 1);
    4189             : 
    4190           5 :         EVP_SignInit(&md_ctx, mdtype);
    4191           5 :         EVP_SignUpdate(&md_ctx, data, data_len);
    4192           5 :         if (EVP_SignFinal (&md_ctx, sigbuf,(unsigned int *)&siglen, pkey)) {
    4193           5 :                 zval_dtor(signature);
    4194           5 :                 sigbuf[siglen] = '\0';
    4195           5 :                 ZVAL_STRINGL(signature, (char *)sigbuf, siglen, 0);
    4196           5 :                 RETVAL_TRUE;
    4197             :         } else {
    4198           0 :                 efree(sigbuf);
    4199           0 :                 RETVAL_FALSE;
    4200             :         }
    4201           5 :         EVP_MD_CTX_cleanup(&md_ctx);
    4202           5 :         if (keyresource == -1) {
    4203           2 :                 EVP_PKEY_free(pkey);
    4204             :         }
    4205             : }
    4206             : /* }}} */
    4207             : 
    4208             : /* {{{ proto int openssl_verify(string data, string signature, mixed key[, mixed method])
    4209             :    Verifys data */
    4210          16 : PHP_FUNCTION(openssl_verify)
    4211             : {
    4212             :         zval **key;
    4213             :         EVP_PKEY *pkey;
    4214             :         int err;
    4215             :         EVP_MD_CTX     md_ctx;
    4216             :         const EVP_MD *mdtype;
    4217          16 :         long keyresource = -1;
    4218             :         char * data;    int data_len;
    4219             :         char * signature;       int signature_len;
    4220          16 :         zval *method = NULL;
    4221          16 :         long signature_algo = OPENSSL_ALGO_SHA1;
    4222             : 
    4223          16 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ssZ|z", &data, &data_len, &signature, &signature_len, &key, &method) == FAILURE) {
    4224           5 :                 return;
    4225             :         }
    4226             : 
    4227          22 :         if (method == NULL || Z_TYPE_P(method) == IS_LONG) {
    4228          11 :                 if (method != NULL) {
    4229           5 :                         signature_algo = Z_LVAL_P(method);
    4230             :                 }
    4231          11 :                 mdtype = php_openssl_get_evp_md_from_algo(signature_algo);
    4232           0 :         } else if (Z_TYPE_P(method) == IS_STRING) {
    4233           0 :                 mdtype = EVP_get_digestbyname(Z_STRVAL_P(method));
    4234             :         } else {
    4235           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown signature algorithm.");
    4236           0 :                 RETURN_FALSE;
    4237             :         }
    4238          11 :         if (!mdtype) {
    4239           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown signature algorithm.");
    4240           0 :                 RETURN_FALSE;
    4241             :         }
    4242             : 
    4243          11 :         pkey = php_openssl_evp_from_zval(key, 1, NULL, 0, &keyresource TSRMLS_CC);
    4244          11 :         if (pkey == NULL) {
    4245           5 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "supplied key param cannot be coerced into a public key");
    4246           5 :                 RETURN_FALSE;
    4247             :         }
    4248             : 
    4249           6 :         EVP_VerifyInit   (&md_ctx, mdtype);
    4250           6 :         EVP_VerifyUpdate (&md_ctx, data, data_len);
    4251           6 :         err = EVP_VerifyFinal (&md_ctx, (unsigned char *)signature, signature_len, pkey);
    4252           6 :         EVP_MD_CTX_cleanup(&md_ctx);
    4253             : 
    4254           6 :         if (keyresource == -1) {
    4255           3 :                 EVP_PKEY_free(pkey);
    4256             :         }
    4257           6 :         RETURN_LONG(err);
    4258             : }
    4259             : /* }}} */
    4260             : 
    4261             : /* {{{ proto int openssl_seal(string data, &string sealdata, &array ekeys, array pubkeys)
    4262             :    Seals data */
    4263          11 : PHP_FUNCTION(openssl_seal)
    4264             : {
    4265             :         zval *pubkeys, **pubkey, *sealdata, *ekeys;
    4266             :         HashTable *pubkeysht;
    4267             :         HashPosition pos;
    4268             :         EVP_PKEY **pkeys;
    4269             :         long * key_resources;   /* so we know what to cleanup */
    4270             :         int i, len1, len2, *eksl, nkeys;
    4271          11 :         unsigned char *buf = NULL, **eks;
    4272             :         char * data; int data_len;
    4273          11 :         char *method =NULL;
    4274          11 :         int method_len = 0;
    4275             :         const EVP_CIPHER *cipher;
    4276             :         EVP_CIPHER_CTX ctx;
    4277             : 
    4278          11 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "szza/|s", &data, &data_len, &sealdata, &ekeys, &pubkeys, &method, &method_len) == FAILURE) {
    4279           3 :                 return;
    4280             :         }
    4281             : 
    4282           8 :         pubkeysht = HASH_OF(pubkeys);
    4283           8 :         nkeys = pubkeysht ? zend_hash_num_elements(pubkeysht) : 0;
    4284           8 :         if (!nkeys) {
    4285           2 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Fourth argument to openssl_seal() must be a non-empty array");
    4286           2 :                 RETURN_FALSE;
    4287             :         }
    4288             : 
    4289           6 :         if (method) {
    4290           0 :                 cipher = EVP_get_cipherbyname(method);
    4291           0 :                 if (!cipher) {
    4292           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown signature algorithm.");
    4293           0 :                         RETURN_FALSE;
    4294             :                 }
    4295             :         } else {
    4296           6 :                 cipher = EVP_rc4();
    4297             :         }
    4298             : 
    4299           6 :         pkeys = safe_emalloc(nkeys, sizeof(*pkeys), 0);
    4300           6 :         eksl = safe_emalloc(nkeys, sizeof(*eksl), 0);
    4301           6 :         eks = safe_emalloc(nkeys, sizeof(*eks), 0);
    4302           6 :         memset(eks, 0, sizeof(*eks) * nkeys);
    4303           6 :         key_resources = safe_emalloc(nkeys, sizeof(long), 0);
    4304           6 :         memset(key_resources, 0, sizeof(*key_resources) * nkeys);
    4305             : 
    4306             :         /* get the public keys we are using to seal this data */
    4307           6 :         zend_hash_internal_pointer_reset_ex(pubkeysht, &pos);
    4308           6 :         i = 0;
    4309          19 :         while (zend_hash_get_current_data_ex(pubkeysht, (void **) &pubkey,
    4310             :                                 &pos) == SUCCESS) {
    4311          10 :                 pkeys[i] = php_openssl_evp_from_zval(pubkey, 1, NULL, 0, &key_resources[i] TSRMLS_CC);
    4312          10 :                 if (pkeys[i] == NULL) {
    4313           3 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "not a public key (%dth member of pubkeys)", i+1);
    4314           3 :                         RETVAL_FALSE;
    4315           3 :                         goto clean_exit;
    4316             :                 }
    4317           7 :                 eks[i] = emalloc(EVP_PKEY_size(pkeys[i]) + 1);
    4318           7 :                 zend_hash_move_forward_ex(pubkeysht, &pos);
    4319           7 :                 i++;
    4320             :         }
    4321             : 
    4322           3 :         if (!EVP_EncryptInit(&ctx,cipher,NULL,NULL)) {
    4323           0 :                 RETVAL_FALSE;
    4324           0 :                 EVP_CIPHER_CTX_cleanup(&ctx);
    4325           0 :                 goto clean_exit;
    4326             :         }
    4327             : 
    4328             : #if 0
    4329             :         /* Need this if allow ciphers that require initialization vector */
    4330             :         ivlen = EVP_CIPHER_CTX_iv_length(&ctx);
    4331             :         iv = ivlen ? emalloc(ivlen + 1) : NULL;
    4332             : #endif
    4333             :         /* allocate one byte extra to make room for \0 */
    4334           3 :         buf = emalloc(data_len + EVP_CIPHER_CTX_block_size(&ctx));
    4335           3 :         EVP_CIPHER_CTX_cleanup(&ctx);
    4336             : 
    4337           3 :         if (!EVP_SealInit(&ctx, cipher, eks, eksl, NULL, pkeys, nkeys) || !EVP_SealUpdate(&ctx, buf, &len1, (unsigned char *)data, data_len)) {
    4338           0 :                 RETVAL_FALSE;
    4339           0 :                 efree(buf);
    4340           0 :                 EVP_CIPHER_CTX_cleanup(&ctx);
    4341           0 :                 goto clean_exit;
    4342             :         }
    4343             : 
    4344           3 :         EVP_SealFinal(&ctx, buf + len1, &len2);
    4345             : 
    4346           3 :         if (len1 + len2 > 0) {
    4347           3 :                 zval_dtor(sealdata);
    4348           3 :                 buf[len1 + len2] = '\0';
    4349           3 :                 buf = erealloc(buf, len1 + len2 + 1);
    4350           3 :                 ZVAL_STRINGL(sealdata, (char *)buf, len1 + len2, 0);
    4351             : 
    4352           3 :                 zval_dtor(ekeys);
    4353           3 :                 array_init(ekeys);
    4354           9 :                 for (i=0; i<nkeys; i++) {
    4355           6 :                         eks[i][eksl[i]] = '\0';
    4356           6 :                         add_next_index_stringl(ekeys, erealloc(eks[i], eksl[i] + 1), eksl[i], 0);
    4357           6 :                         eks[i] = NULL;
    4358             :                 }
    4359             : #if 0
    4360             :                 /* If allow ciphers that need IV, we need this */
    4361             :                 zval_dtor(*ivec);
    4362             :                 if (ivlen) {
    4363             :                         iv[ivlen] = '\0';
    4364             :                         ZVAL_STRINGL(*ivec, erealloc(iv, ivlen + 1), ivlen, 0);
    4365             :                 } else {
    4366             :                         ZVAL_EMPTY_STRING(*ivec);
    4367             :                 }
    4368             : #endif
    4369             :         } else {
    4370           0 :                 efree(buf);
    4371             :         }
    4372           3 :         RETVAL_LONG(len1 + len2);
    4373           3 :         EVP_CIPHER_CTX_cleanup(&ctx);
    4374             : 
    4375             : clean_exit:
    4376          16 :         for (i=0; i<nkeys; i++) {
    4377          10 :                 if (key_resources[i] == -1) {
    4378          10 :                         EVP_PKEY_free(pkeys[i]);
    4379             :                 }
    4380          10 :                 if (eks[i]) {
    4381           1 :                         efree(eks[i]);
    4382             :                 }
    4383             :         }
    4384           6 :         efree(eks);
    4385           6 :         efree(eksl);
    4386           6 :         efree(pkeys);
    4387           6 :         efree(key_resources);
    4388             : }
    4389             : /* }}} */
    4390             : 
    4391             : /* {{{ proto bool openssl_open(string data, &string opendata, string ekey, mixed privkey)
    4392             :    Opens data */
    4393           4 : PHP_FUNCTION(openssl_open)
    4394             : {
    4395             :         zval **privkey, *opendata;
    4396             :         EVP_PKEY *pkey;
    4397             :         int len1, len2;
    4398             :         unsigned char *buf;
    4399           4 :         long keyresource = -1;
    4400             :         EVP_CIPHER_CTX ctx;
    4401             :         char * data;    int data_len;
    4402             :         char * ekey;    int ekey_len;
    4403           4 :         char *method =NULL;
    4404           4 :         int method_len = 0;
    4405             :         const EVP_CIPHER *cipher;
    4406             : 
    4407           4 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "szsZ|s", &data, &data_len, &opendata, &ekey, &ekey_len, &privkey, &method, &method_len) == FAILURE) {
    4408           0 :                 return;
    4409             :         }
    4410             : 
    4411           4 :         pkey = php_openssl_evp_from_zval(privkey, 0, "", 0, &keyresource TSRMLS_CC);
    4412           4 :         if (pkey == NULL) {
    4413           1 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "unable to coerce parameter 4 into a private key");
    4414           1 :                 RETURN_FALSE;
    4415             :         }
    4416             : 
    4417           3 :         if (method) {
    4418           0 :                 cipher = EVP_get_cipherbyname(method);
    4419           0 :                 if (!cipher) {
    4420           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown signature algorithm.");
    4421           0 :                         RETURN_FALSE;
    4422             :                 }
    4423             :         } else {
    4424           3 :                 cipher = EVP_rc4();
    4425             :         }
    4426             : 
    4427           3 :         buf = emalloc(data_len + 1);
    4428             : 
    4429           5 :         if (EVP_OpenInit(&ctx, cipher, (unsigned char *)ekey, ekey_len, NULL, pkey) && EVP_OpenUpdate(&ctx, buf, &len1, (unsigned char *)data, data_len)) {
    4430           2 :                 if (!EVP_OpenFinal(&ctx, buf + len1, &len2) || (len1 + len2 == 0)) {
    4431           0 :                         efree(buf);
    4432           0 :                         RETVAL_FALSE;
    4433             :                 } else {
    4434           2 :                         zval_dtor(opendata);
    4435           2 :                         buf[len1 + len2] = '\0';
    4436           2 :                         ZVAL_STRINGL(opendata, erealloc(buf, len1 + len2 + 1), len1 + len2, 0);
    4437           2 :                         RETVAL_TRUE;
    4438             :                 }
    4439             :         } else {
    4440           1 :                 efree(buf);
    4441           1 :                 RETVAL_FALSE;
    4442             :         }
    4443           3 :         if (keyresource == -1) {
    4444           3 :                 EVP_PKEY_free(pkey);
    4445             :         }
    4446           3 :         EVP_CIPHER_CTX_cleanup(&ctx);
    4447             : }
    4448             : /* }}} */
    4449             : 
    4450             : /* SSL verification functions */
    4451             : 
    4452             : #define GET_VER_OPT(name)               (stream->context && SUCCESS == php_stream_context_get_option(stream->context, "ssl", name, &val))
    4453             : #define GET_VER_OPT_STRING(name, str)   if (GET_VER_OPT(name)) { convert_to_string_ex(val); str = Z_STRVAL_PP(val); }
    4454             : 
    4455           2 : static int verify_callback(int preverify_ok, X509_STORE_CTX *ctx) /* {{{ */
    4456             : {
    4457             :         php_stream *stream;
    4458             :         SSL *ssl;
    4459             :         X509 *err_cert;
    4460             :         int err, depth, ret;
    4461             :         zval **val;
    4462             : 
    4463           2 :         ret = preverify_ok;
    4464             : 
    4465             :         /* determine the status for the current cert */
    4466           2 :         err_cert = X509_STORE_CTX_get_current_cert(ctx);
    4467           2 :         err = X509_STORE_CTX_get_error(ctx);
    4468           2 :         depth = X509_STORE_CTX_get_error_depth(ctx);
    4469             : 
    4470             :         /* conjure the stream & context to use */
    4471           2 :         ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
    4472           2 :         stream = (php_stream*)SSL_get_ex_data(ssl, ssl_stream_data_index);
    4473             : 
    4474             :         /* if allow_self_signed is set, make sure that verification succeeds */
    4475           2 :         if (err == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT && GET_VER_OPT("allow_self_signed") && zval_is_true(*val)) {
    4476           0 :                 ret = 1;
    4477             :         }
    4478             : 
    4479             :         /* check the depth */
    4480           2 :         if (GET_VER_OPT("verify_depth")) {
    4481           0 :                 convert_to_long_ex(val);
    4482             : 
    4483           0 :                 if (depth > Z_LVAL_PP(val)) {
    4484           0 :                         ret = 0;
    4485           0 :                         X509_STORE_CTX_set_error(ctx, X509_V_ERR_CERT_CHAIN_TOO_LONG);
    4486             :                 }
    4487             :         }
    4488             : 
    4489           2 :         return ret;
    4490             : 
    4491             : }
    4492             : /* }}} */
    4493             : 
    4494          15 : int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stream TSRMLS_DC) /* {{{ */
    4495             : {
    4496          15 :         zval **val = NULL;
    4497          15 :         char *cnmatch = NULL;
    4498             :         X509_NAME *name;
    4499             :         char buf[1024];
    4500             :         int err;
    4501             : 
    4502             :         /* verification is turned off */
    4503          15 :         if (!(GET_VER_OPT("verify_peer") && zval_is_true(*val))) {
    4504          15 :                 return SUCCESS;
    4505             :         }
    4506             : 
    4507           0 :         if (peer == NULL) {
    4508           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not get peer certificate");
    4509           0 :                 return FAILURE;
    4510             :         }
    4511             : 
    4512           0 :         err = SSL_get_verify_result(ssl);
    4513           0 :         switch (err) {
    4514             :                 case X509_V_OK:
    4515             :                         /* fine */
    4516           0 :                         break;
    4517             :                 case X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT:
    4518           0 :                         if (GET_VER_OPT("allow_self_signed") && zval_is_true(*val)) {
    4519             :                                 /* allowed */
    4520           0 :                                 break;
    4521             :                         }
    4522             :                         /* not allowed, so fall through */
    4523             :                 default:
    4524           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Could not verify peer: code:%d %s", err, X509_verify_cert_error_string(err));
    4525           0 :                         return FAILURE;
    4526             :         }
    4527             : 
    4528             :         /* if the cert passed the usual checks, apply our own local policies now */
    4529             : 
    4530           0 :         name = X509_get_subject_name(peer);
    4531             : 
    4532             :         /* Does the common name match ? (used primarily for https://) */
    4533           0 :         GET_VER_OPT_STRING("CN_match", cnmatch);
    4534           0 :         if (cnmatch) {
    4535           0 :                 int match = 0;
    4536           0 :                 int name_len = X509_NAME_get_text_by_NID(name, NID_commonName, buf, sizeof(buf));
    4537             : 
    4538           0 :                 if (name_len == -1) {
    4539           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to locate peer certificate CN");
    4540           0 :                         return FAILURE;
    4541           0 :                 } else if (name_len != strlen(buf)) {
    4542           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Peer certificate CN=`%.*s' is malformed", name_len, buf);
    4543           0 :                         return FAILURE;
    4544             :                 }
    4545             : 
    4546           0 :                 match = strcmp(cnmatch, buf) == 0;
    4547           0 :                 if (!match && strlen(buf) > 3 && buf[0] == '*' && buf[1] == '.') {
    4548             :                         /* Try wildcard */
    4549             : 
    4550           0 :                         if (strchr(buf+2, '.')) {
    4551           0 :                                 char *tmp = strstr(cnmatch, buf+1);
    4552             : 
    4553           0 :                                 match = tmp && strcmp(tmp, buf+2) && tmp == strchr(cnmatch, '.');
    4554             :                         }
    4555             :                 }
    4556             : 
    4557           0 :                 if (!match) {
    4558             :                         /* didn't match */
    4559           0 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Peer certificate CN=`%.*s' did not match expected CN=`%s'", name_len, buf, cnmatch);
    4560           0 :                         return FAILURE;
    4561             :                 }
    4562             :         }
    4563             : 
    4564           0 :         return SUCCESS;
    4565             : }
    4566             : /* }}} */
    4567             : 
    4568           1 : static int passwd_callback(char *buf, int num, int verify, void *data) /* {{{ */
    4569             : {
    4570           1 :     php_stream *stream = (php_stream *)data;
    4571           1 :     zval **val = NULL;
    4572           1 :     char *passphrase = NULL;
    4573             :     /* TODO: could expand this to make a callback into PHP user-space */
    4574             : 
    4575           1 :     GET_VER_OPT_STRING("passphrase", passphrase);
    4576             : 
    4577           1 :     if (passphrase) {
    4578           1 :         if (Z_STRLEN_PP(val) < num - 1) {
    4579           1 :             memcpy(buf, Z_STRVAL_PP(val), Z_STRLEN_PP(val)+1);
    4580           1 :             return Z_STRLEN_PP(val);
    4581             :         }
    4582             :     }
    4583           0 :     return 0;
    4584             : }
    4585             : /* }}} */
    4586             : 
    4587          16 : SSL *php_SSL_new_from_context(SSL_CTX *ctx, php_stream *stream TSRMLS_DC) /* {{{ */
    4588             : {
    4589          16 :         zval **val = NULL;
    4590          16 :         char *cafile = NULL;
    4591          16 :         char *capath = NULL;
    4592          16 :         char *certfile = NULL;
    4593          16 :         char *cipherlist = NULL;
    4594          16 :         int ok = 1;
    4595             : 
    4596          16 :         ERR_clear_error();
    4597             : 
    4598             :         /* look at context options in the stream and set appropriate verification flags */
    4599          17 :         if (GET_VER_OPT("verify_peer") && zval_is_true(*val)) {
    4600             : 
    4601             :                 /* turn on verification callback */
    4602           1 :                 SSL_CTX_set_verify(ctx, SSL_VERIFY_PEER, verify_callback);
    4603             : 
    4604             :                 /* CA stuff */
    4605           1 :                 GET_VER_OPT_STRING("cafile", cafile);
    4606           1 :                 GET_VER_OPT_STRING("capath", capath);
    4607             : 
    4608           1 :                 if (cafile || capath) {
    4609           1 :                         if (!SSL_CTX_load_verify_locations(ctx, cafile, capath)) {
    4610           0 :                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to set verify locations `%s' `%s'", cafile, capath);
    4611           0 :                                 return NULL;
    4612             :                         }
    4613             :                 }
    4614             : 
    4615           1 :                 if (GET_VER_OPT("verify_depth")) {
    4616           0 :                         convert_to_long_ex(val);
    4617           0 :                         SSL_CTX_set_verify_depth(ctx, Z_LVAL_PP(val));
    4618             :                 }
    4619             :         } else {
    4620          15 :                 SSL_CTX_set_verify(ctx, SSL_VERIFY_NONE, NULL);
    4621             :         }
    4622             : 
    4623             :         /* callback for the passphrase (for localcert) */
    4624          16 :         if (GET_VER_OPT("passphrase")) {
    4625           1 :                 SSL_CTX_set_default_passwd_cb_userdata(ctx, stream);
    4626           1 :                 SSL_CTX_set_default_passwd_cb(ctx, passwd_callback);
    4627             :         }
    4628             : 
    4629          16 :         GET_VER_OPT_STRING("ciphers", cipherlist);
    4630          16 :         if (!cipherlist) {
    4631          16 :                 cipherlist = "DEFAULT";
    4632             :         }
    4633          16 :         if (SSL_CTX_set_cipher_list(ctx, cipherlist) != 1) {
    4634           0 :                 return NULL;
    4635             :         }
    4636             : 
    4637          16 :         GET_VER_OPT_STRING("local_cert", certfile);
    4638          16 :         if (certfile) {
    4639             :                 char resolved_path_buff[MAXPATHLEN];
    4640           4 :                 const char * private_key = NULL;
    4641             : 
    4642           4 :                 if (VCWD_REALPATH(certfile, resolved_path_buff)) {
    4643             :                         /* a certificate to use for authentication */
    4644           4 :                         if (SSL_CTX_use_certificate_chain_file(ctx, resolved_path_buff) != 1) {
    4645           0 :                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to set local cert chain file `%s'; Check that your cafile/capath settings include details of your certificate and its issuer", certfile);
    4646           0 :                                 return NULL;
    4647             :                         }
    4648           4 :                         GET_VER_OPT_STRING("local_pk", private_key);
    4649             : 
    4650           4 :                         if (private_key) {
    4651             :                                 char resolved_path_buff_pk[MAXPATHLEN];
    4652           0 :                                 if (VCWD_REALPATH(private_key, resolved_path_buff_pk)) {
    4653           0 :                                         if (SSL_CTX_use_PrivateKey_file(ctx, resolved_path_buff_pk, SSL_FILETYPE_PEM) != 1) {
    4654           0 :                                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to set private key file `%s'", resolved_path_buff_pk);
    4655           0 :                                                 return NULL;
    4656             :                                         }
    4657             :                                 }
    4658             :                         } else {
    4659           4 :                                 if (SSL_CTX_use_PrivateKey_file(ctx, resolved_path_buff, SSL_FILETYPE_PEM) != 1) {
    4660           0 :                                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unable to set private key file `%s'", resolved_path_buff);
    4661           0 :                                         return NULL;
    4662             :                                 }
    4663             :                         }
    4664             : 
    4665             : #if OPENSSL_VERSION_NUMBER < 0x10001001L
    4666             :                         do {
    4667             :                                 /* Unnecessary as of OpenSSLv1.0.1 (will segfault if used with >= 10001001 ) */
    4668             :                                 X509 *cert = NULL;
    4669             :                                 EVP_PKEY *key = NULL;
    4670             :                                 SSL *tmpssl = SSL_new(ctx);
    4671             :                                 cert = SSL_get_certificate(tmpssl);
    4672             : 
    4673             :                                 if (cert) {
    4674             :                                         key = X509_get_pubkey(cert);
    4675             :                                         EVP_PKEY_copy_parameters(key, SSL_get_privatekey(tmpssl));
    4676             :                                         EVP_PKEY_free(key);
    4677             :                                 }
    4678             :                                 SSL_free(tmpssl);
    4679             :                         } while (0);
    4680             : #endif
    4681           4 :                         if (!SSL_CTX_check_private_key(ctx)) {
    4682           0 :                                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Private key does not match certificate!");
    4683             :                         }
    4684             :                 }
    4685             :         }
    4686          16 :         if (ok) {
    4687          16 :                 SSL *ssl = SSL_new(ctx);
    4688             : 
    4689          16 :                 if (ssl) {
    4690             :                         /* map SSL => stream */
    4691          16 :                         SSL_set_ex_data(ssl, ssl_stream_data_index, stream);
    4692             :                 }
    4693          16 :                 return ssl;
    4694             :         }
    4695             : 
    4696           0 :         return NULL;
    4697             : }
    4698             : /* }}} */
    4699             : 
    4700           0 : static void openssl_add_method_or_alias(const OBJ_NAME *name, void *arg) /* {{{ */
    4701             : {
    4702           0 :         add_next_index_string((zval*)arg, (char*)name->name, 1);
    4703           0 : }
    4704             : /* }}} */
    4705             : 
    4706           0 : static void openssl_add_method(const OBJ_NAME *name, void *arg) /* {{{ */
    4707             : {
    4708           0 :         if (name->alias == 0) {
    4709           0 :                 add_next_index_string((zval*)arg, (char*)name->name, 1);
    4710             :         }
    4711           0 : }
    4712             : /* }}} */
    4713             : 
    4714             : /* {{{ proto array openssl_get_md_methods([bool aliases = false])
    4715             :    Return array of available digest methods */
    4716           0 : PHP_FUNCTION(openssl_get_md_methods)
    4717             : {
    4718           0 :         zend_bool aliases = 0;
    4719             : 
    4720           0 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|b", &aliases) == FAILURE) {
    4721           0 :                 return;
    4722             :         }
    4723           0 :         array_init(return_value);
    4724           0 :         OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_MD_METH,
    4725           0 :                 aliases ? openssl_add_method_or_alias: openssl_add_method,
    4726             :                 return_value);
    4727             : }
    4728             : /* }}} */
    4729             : 
    4730             : /* {{{ proto array openssl_get_cipher_methods([bool aliases = false])
    4731             :    Return array of available cipher methods */
    4732           0 : PHP_FUNCTION(openssl_get_cipher_methods)
    4733             : {
    4734           0 :         zend_bool aliases = 0;
    4735             : 
    4736           0 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "|b", &aliases) == FAILURE) {
    4737           0 :                 return;
    4738             :         }
    4739           0 :         array_init(return_value);
    4740           0 :         OBJ_NAME_do_all_sorted(OBJ_NAME_TYPE_CIPHER_METH,
    4741           0 :                 aliases ? openssl_add_method_or_alias: openssl_add_method,
    4742             :                 return_value);
    4743             : }
    4744             : /* }}} */
    4745             : 
    4746             : /* {{{ proto string openssl_digest(string data, string method [, bool raw_output=false])
    4747             :    Computes digest hash value for given data using given method, returns raw or binhex encoded string */
    4748           2 : PHP_FUNCTION(openssl_digest)
    4749             : {
    4750           2 :         zend_bool raw_output = 0;
    4751             :         char *data, *method;
    4752             :         int data_len, method_len;
    4753             :         const EVP_MD *mdtype;
    4754             :         EVP_MD_CTX md_ctx;
    4755             :         int siglen;
    4756             :         unsigned char *sigbuf;
    4757             : 
    4758           2 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "ss|b", &data, &data_len, &method, &method_len, &raw_output) == FAILURE) {
    4759           0 :                 return;
    4760             :         }
    4761           2 :         mdtype = EVP_get_digestbyname(method);
    4762           2 :         if (!mdtype) {
    4763           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown signature algorithm");
    4764           0 :                 RETURN_FALSE;
    4765             :         }
    4766             : 
    4767           2 :         siglen = EVP_MD_size(mdtype);
    4768           2 :         sigbuf = emalloc(siglen + 1);
    4769             : 
    4770           2 :         EVP_DigestInit(&md_ctx, mdtype);
    4771           2 :         EVP_DigestUpdate(&md_ctx, (unsigned char *)data, data_len);
    4772           2 :         if (EVP_DigestFinal (&md_ctx, (unsigned char *)sigbuf, (unsigned int *)&siglen)) {
    4773           2 :                 if (raw_output) {
    4774           0 :                         sigbuf[siglen] = '\0';
    4775           0 :                         RETVAL_STRINGL((char *)sigbuf, siglen, 0);
    4776             :                 } else {
    4777           2 :                         int digest_str_len = siglen * 2;
    4778           2 :                         char *digest_str = emalloc(digest_str_len + 1);
    4779             : 
    4780           2 :                         make_digest_ex(digest_str, sigbuf, siglen);
    4781           2 :                         efree(sigbuf);
    4782           2 :                         RETVAL_STRINGL(digest_str, digest_str_len, 0);
    4783             :                 }
    4784             :         } else {
    4785           0 :                 efree(sigbuf);
    4786           0 :                 RETVAL_FALSE;
    4787             :         }
    4788             : }
    4789             : /* }}} */
    4790             : 
    4791          14 : static zend_bool php_openssl_validate_iv(char **piv, int *piv_len, int iv_required_len TSRMLS_DC)
    4792             : {
    4793             :         char *iv_new;
    4794             : 
    4795             :         /* Best case scenario, user behaved */
    4796          14 :         if (*piv_len == iv_required_len) {
    4797          10 :                 return 0;
    4798             :         }
    4799             : 
    4800           4 :         iv_new = ecalloc(1, iv_required_len + 1);
    4801             : 
    4802           4 :         if (*piv_len <= 0) {
    4803             :                 /* BC behavior */
    4804           4 :                 *piv_len = iv_required_len;
    4805           4 :                 *piv     = iv_new;
    4806           4 :                 return 1;
    4807             :         }
    4808             : 
    4809           0 :         if (*piv_len < iv_required_len) {
    4810           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "IV passed is only %d bytes long, cipher expects an IV of precisely %d bytes, padding with \\0", *piv_len, iv_required_len);
    4811           0 :                 memcpy(iv_new, *piv, *piv_len);
    4812           0 :                 *piv_len = iv_required_len;
    4813           0 :                 *piv     = iv_new;
    4814           0 :                 return 1;
    4815             :         }
    4816             : 
    4817           0 :         php_error_docref(NULL TSRMLS_CC, E_WARNING, "IV passed is %d bytes long which is longer than the %d expected by selected cipher, truncating", *piv_len, iv_required_len);
    4818           0 :         memcpy(iv_new, *piv, iv_required_len);
    4819           0 :         *piv_len = iv_required_len;
    4820           0 :         *piv     = iv_new;
    4821           0 :         return 1;
    4822             : 
    4823             : }
    4824             : 
    4825             : /* {{{ proto string openssl_encrypt(string data, string method, string password [, long options=0 [, string $iv='']])
    4826             :    Encrypts given data with given method and key, returns raw or base64 encoded string */
    4827          15 : PHP_FUNCTION(openssl_encrypt)
    4828             : {
    4829          15 :         long options = 0;
    4830          15 :         char *data, *method, *password, *iv = "";
    4831          15 :         int data_len, method_len, password_len, iv_len = 0, max_iv_len;
    4832             :         const EVP_CIPHER *cipher_type;
    4833             :         EVP_CIPHER_CTX cipher_ctx;
    4834          15 :         int i=0, outlen, keylen;
    4835             :         unsigned char *outbuf, *key;
    4836             :         zend_bool free_iv;
    4837             : 
    4838          15 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sss|ls", &data, &data_len, &method, &method_len, &password, &password_len, &options, &iv, &iv_len) == FAILURE) {
    4839           6 :                 return;
    4840             :         }
    4841           9 :         cipher_type = EVP_get_cipherbyname(method);
    4842           9 :         if (!cipher_type) {
    4843           1 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown cipher algorithm");
    4844           1 :                 RETURN_FALSE;
    4845             :         }
    4846             : 
    4847           8 :         keylen = EVP_CIPHER_key_length(cipher_type);
    4848           8 :         if (keylen > password_len) {
    4849           8 :                 key = emalloc(keylen);
    4850           8 :                 memset(key, 0, keylen);
    4851           8 :                 memcpy(key, password, password_len);
    4852             :         } else {
    4853           0 :                 key = (unsigned char*)password;
    4854             :         }
    4855             : 
    4856           8 :         max_iv_len = EVP_CIPHER_iv_length(cipher_type);
    4857           8 :         if (iv_len <= 0 && max_iv_len > 0) {
    4858           2 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Using an empty Initialization Vector (iv) is potentially insecure and not recommended");
    4859             :         }
    4860           8 :         free_iv = php_openssl_validate_iv(&iv, &iv_len, max_iv_len TSRMLS_CC);
    4861             : 
    4862           8 :         outlen = data_len + EVP_CIPHER_block_size(cipher_type);
    4863           8 :         outbuf = emalloc(outlen + 1);
    4864             : 
    4865           8 :         EVP_EncryptInit(&cipher_ctx, cipher_type, NULL, NULL);
    4866           8 :         if (password_len > keylen) {
    4867           0 :                 EVP_CIPHER_CTX_set_key_length(&cipher_ctx, password_len);
    4868             :         }
    4869           8 :         EVP_EncryptInit_ex(&cipher_ctx, NULL, NULL, key, (unsigned char *)iv);
    4870           8 :         if (options & OPENSSL_ZERO_PADDING) {
    4871           1 :                 EVP_CIPHER_CTX_set_padding(&cipher_ctx, 0);
    4872             :         }
    4873           8 :         if (data_len > 0) {
    4874           7 :                 EVP_EncryptUpdate(&cipher_ctx, outbuf, &i, (unsigned char *)data, data_len);
    4875             :         }
    4876           8 :         outlen = i;
    4877           8 :         if (EVP_EncryptFinal(&cipher_ctx, (unsigned char *)outbuf + i, &i)) {
    4878           8 :                 outlen += i;
    4879           8 :                 if (options & OPENSSL_RAW_DATA) {
    4880           2 :                         outbuf[outlen] = '\0';
    4881           2 :                         RETVAL_STRINGL((char *)outbuf, outlen, 0);
    4882             :                 } else {
    4883             :                         int base64_str_len;
    4884             :                         char *base64_str;
    4885             : 
    4886           6 :                         base64_str = (char*)php_base64_encode(outbuf, outlen, &base64_str_len);
    4887           6 :                         efree(outbuf);
    4888           6 :                         RETVAL_STRINGL(base64_str, base64_str_len, 0);
    4889             :                 }
    4890             :         } else {
    4891           0 :                 efree(outbuf);
    4892           0 :                 RETVAL_FALSE;
    4893             :         }
    4894           8 :         if (key != (unsigned char*)password) {
    4895           8 :                 efree(key);
    4896             :         }
    4897           8 :         if (free_iv) {
    4898           2 :                 efree(iv);
    4899             :         }
    4900           8 :         EVP_CIPHER_CTX_cleanup(&cipher_ctx);
    4901             : }
    4902             : /* }}} */
    4903             : 
    4904             : /* {{{ proto string openssl_decrypt(string data, string method, string password [, long options=0 [, string $iv = '']])
    4905             :    Takes raw or base64 encoded string and dectupt it using given method and key */
    4906          14 : PHP_FUNCTION(openssl_decrypt)
    4907             : {
    4908          14 :         long options = 0;
    4909          14 :         char *data, *method, *password, *iv = "";
    4910          14 :         int data_len, method_len, password_len, iv_len = 0;
    4911             :         const EVP_CIPHER *cipher_type;
    4912             :         EVP_CIPHER_CTX cipher_ctx;
    4913             :         int i, outlen, keylen;
    4914             :         unsigned char *outbuf, *key;
    4915             :         int base64_str_len;
    4916          14 :         char *base64_str = NULL;
    4917             :         zend_bool free_iv;
    4918             : 
    4919          14 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sss|ls", &data, &data_len, &method, &method_len, &password, &password_len, &options, &iv, &iv_len) == FAILURE) {
    4920           3 :                 return;
    4921             :         }
    4922             : 
    4923          11 :         if (!method_len) {
    4924           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown cipher algorithm");
    4925           0 :                 RETURN_FALSE;
    4926             :         }
    4927             : 
    4928          11 :         cipher_type = EVP_get_cipherbyname(method);
    4929          11 :         if (!cipher_type) {
    4930           4 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown cipher algorithm");
    4931           4 :                 RETURN_FALSE;
    4932             :         }
    4933             : 
    4934           7 :         if (!(options & OPENSSL_RAW_DATA)) {
    4935           5 :                 base64_str = (char*)php_base64_decode((unsigned char*)data, data_len, &base64_str_len);
    4936           5 :                 if (!base64_str) {
    4937           1 :                         php_error_docref(NULL TSRMLS_CC, E_WARNING, "Failed to base64 decode the input");
    4938           1 :                         RETURN_FALSE;
    4939             :                 }
    4940           4 :                 data_len = base64_str_len;
    4941           4 :                 data = base64_str;
    4942             :         }
    4943             : 
    4944           6 :         keylen = EVP_CIPHER_key_length(cipher_type);
    4945           6 :         if (keylen > password_len) {
    4946           6 :                 key = emalloc(keylen);
    4947           6 :                 memset(key, 0, keylen);
    4948           6 :                 memcpy(key, password, password_len);
    4949             :         } else {
    4950           0 :                 key = (unsigned char*)password;
    4951             :         }
    4952             : 
    4953           6 :         free_iv = php_openssl_validate_iv(&iv, &iv_len, EVP_CIPHER_iv_length(cipher_type) TSRMLS_CC);
    4954             : 
    4955           6 :         outlen = data_len + EVP_CIPHER_block_size(cipher_type);
    4956           6 :         outbuf = emalloc(outlen + 1);
    4957             : 
    4958           6 :         EVP_DecryptInit(&cipher_ctx, cipher_type, NULL, NULL);
    4959           6 :         if (password_len > keylen) {
    4960           0 :                 EVP_CIPHER_CTX_set_key_length(&cipher_ctx, password_len);
    4961             :         }
    4962           6 :         EVP_DecryptInit_ex(&cipher_ctx, NULL, NULL, key, (unsigned char *)iv);
    4963           6 :         if (options & OPENSSL_ZERO_PADDING) {
    4964           1 :                 EVP_CIPHER_CTX_set_padding(&cipher_ctx, 0);
    4965             :         }
    4966           6 :         EVP_DecryptUpdate(&cipher_ctx, outbuf, &i, (unsigned char *)data, data_len);
    4967           6 :         outlen = i;
    4968           6 :         if (EVP_DecryptFinal(&cipher_ctx, (unsigned char *)outbuf + i, &i)) {
    4969           4 :                 outlen += i;
    4970           4 :                 outbuf[outlen] = '\0';
    4971           4 :                 RETVAL_STRINGL((char *)outbuf, outlen, 0);
    4972             :         } else {
    4973           2 :                 efree(outbuf);
    4974           2 :                 RETVAL_FALSE;
    4975             :         }
    4976           6 :         if (key != (unsigned char*)password) {
    4977           6 :                 efree(key);
    4978             :         }
    4979           6 :         if (free_iv) {
    4980           2 :                 efree(iv);
    4981             :         }
    4982           6 :         if (base64_str) {
    4983           4 :                 efree(base64_str);
    4984             :         }
    4985           6 :         EVP_CIPHER_CTX_cleanup(&cipher_ctx);
    4986             : }
    4987             : /* }}} */
    4988             : 
    4989             : /* {{{ proto int openssl_cipher_iv_length(string $method) */
    4990           2 : PHP_FUNCTION(openssl_cipher_iv_length)
    4991             : {
    4992             :         char *method;
    4993             :         int method_len;
    4994             :         const EVP_CIPHER *cipher_type;
    4995             : 
    4996           2 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "s", &method, &method_len) == FAILURE) {
    4997           0 :                 return;
    4998             :         }
    4999             : 
    5000           2 :         if (!method_len) {
    5001           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown cipher algorithm");
    5002           0 :                 RETURN_FALSE;
    5003             :         }
    5004             : 
    5005           2 :         cipher_type = EVP_get_cipherbyname(method);
    5006           2 :         if (!cipher_type) {
    5007           0 :                 php_error_docref(NULL TSRMLS_CC, E_WARNING, "Unknown cipher algorithm");
    5008           0 :                 RETURN_FALSE;
    5009             :         }
    5010             : 
    5011           2 :         RETURN_LONG(EVP_CIPHER_iv_length(cipher_type));
    5012             : }
    5013             : /* }}} */
    5014             : 
    5015             : 
    5016             : /* {{{ proto string openssl_dh_compute_key(string pub_key, resource dh_key)
    5017             :    Computes shared secret for public value of remote DH key and local DH key */
    5018           0 : PHP_FUNCTION(openssl_dh_compute_key)
    5019             : {
    5020             :         zval *key;
    5021             :         char *pub_str;
    5022             :         int pub_len;
    5023             :         EVP_PKEY *pkey;
    5024             :         BIGNUM *pub;
    5025             :         char *data;
    5026             :         int len;
    5027             : 
    5028           0 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "sr", &pub_str, &pub_len, &key) == FAILURE) {
    5029           0 :                 return;
    5030             :         }
    5031           0 :         ZEND_FETCH_RESOURCE(pkey, EVP_PKEY *, &key, -1, "OpenSSL key", le_key);
    5032           0 :         if (!pkey || EVP_PKEY_type(pkey->type) != EVP_PKEY_DH || !pkey->pkey.dh) {
    5033           0 :                 RETURN_FALSE;
    5034             :         }
    5035             : 
    5036           0 :         pub = BN_bin2bn((unsigned char*)pub_str, pub_len, NULL);
    5037             : 
    5038           0 :         data = emalloc(DH_size(pkey->pkey.dh) + 1);
    5039           0 :         len = DH_compute_key((unsigned char*)data, pub, pkey->pkey.dh);
    5040             : 
    5041           0 :         if (len >= 0) {
    5042           0 :                 data[len] = 0;
    5043           0 :                 RETVAL_STRINGL(data, len, 0);
    5044             :         } else {
    5045           0 :                 efree(data);
    5046           0 :                 RETVAL_FALSE;
    5047             :         }
    5048             : 
    5049           0 :         BN_free(pub);
    5050             : }
    5051             : /* }}} */
    5052             : 
    5053             : /* {{{ proto string openssl_random_pseudo_bytes(integer length [, &bool returned_strong_result])
    5054             :    Returns a string of the length specified filled with random pseudo bytes */
    5055          10 : PHP_FUNCTION(openssl_random_pseudo_bytes)
    5056             : {
    5057             :         long buffer_length;
    5058          10 :         unsigned char *buffer = NULL;
    5059          10 :         zval *zstrong_result_returned = NULL;
    5060          10 :         int strong_result = 0;
    5061             : 
    5062          10 :         if (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, "l|z", &buffer_length, &zstrong_result_returned) == FAILURE) {
    5063           0 :                 return;
    5064             :         }
    5065             : 
    5066          10 :         if (buffer_length <= 0) {
    5067           1 :                 RETURN_FALSE;
    5068             :         }
    5069             : 
    5070           9 :         if (zstrong_result_returned) {
    5071           9 :                 zval_dtor(zstrong_result_returned);
    5072           9 :                 ZVAL_BOOL(zstrong_result_returned, 0);
    5073             :         }
    5074             : 
    5075           9 :         buffer = emalloc(buffer_length + 1);
    5076             : 
    5077             : #ifdef PHP_WIN32
    5078             :         strong_result = 1;
    5079             :         /* random/urandom equivalent on Windows */
    5080             :         if (php_win32_get_random_bytes(buffer, (size_t) buffer_length) == FAILURE) {
    5081             :                 efree(buffer);
    5082             :                 if (zstrong_result_returned) {
    5083             :                         ZVAL_BOOL(zstrong_result_returned, 0);
    5084             :                 }
    5085             :                 RETURN_FALSE;
    5086             :         }
    5087             : #else
    5088           9 :         if ((strong_result = RAND_pseudo_bytes(buffer, buffer_length)) < 0) {
    5089           0 :                 efree(buffer);
    5090           0 :                 if (zstrong_result_returned) {
    5091           0 :                         ZVAL_BOOL(zstrong_result_returned, 0);
    5092             :                 }
    5093           0 :                 RETURN_FALSE;
    5094             :         }
    5095             : #endif
    5096             : 
    5097           9 :         buffer[buffer_length] = 0;
    5098           9 :         RETVAL_STRINGL((char *)buffer, buffer_length, 0);
    5099             : 
    5100           9 :         if (zstrong_result_returned) {
    5101           9 :                 ZVAL_BOOL(zstrong_result_returned, strong_result);
    5102             :         }
    5103             : }
    5104             : /* }}} */
    5105             : 
    5106             : /*
    5107             :  * Local variables:
    5108             :  * tab-width: 8
    5109             :  * c-basic-offset: 8
    5110             :  * End:
    5111             :  * vim600: sw=4 ts=4 fdm=marker
    5112             :  * vim<600: sw=4 ts=4
    5113             :  */

Generated by: LCOV version 1.10

Generated at Sun, 20 Apr 2014 03:52:12 +0000 (4 days ago)

Copyright © 2005-2014 The PHP Group
All rights reserved.