Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:101229
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain rhsoft.net designates 91.118.73.15 as permitted sender)
To: "internals@lists.php.net >> Mailing-List php" <internals@lists.php.net>
References: <a64088a5-e93b-3450-fe8c-8ba6ac9d851a@php.net>
 <CADNQb0VA+-E2B21EZCfzau7v0_0=SeheHB+cxZCsx7RoVNn8jA@mail.gmail.com>
 <41630a4e-8772-bdfb-e859-831a36dc67ea@rhsoft.net>
 <CANUQDCjsz31t-VqbLeUOc-qJd=wzQ8Tbk2UGhY-74xw+JaGHUA@mail.gmail.com>
 <e8b900c3-3d76-9fe0-7b96-3c1f468d160e@rhsoft.net>
 <CAESVnVqhNgge2dzHTbf1bCR0unGCYwEeDqS2ErWdyK34M26k6g@mail.gmail.com>
 <9f3d28e1-cc6d-d5dc-da04-7e3791070be8@rhsoft.net>
 <CAESVnVoWeNdh2R4KROe=CfACQVQJP9sf66iJASPp73nURi9ouw@mail.gmail.com>
Message-ID: <35e8f8c5-8fe0-702b-f304-890cf902b390@rhsoft.net>
Date: Mon, 4 Dec 2017 19:18:40 +0100
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <CAESVnVoWeNdh2R4KROe=CfACQVQJP9sf66iJASPp73nURi9ouw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: de-CH
Content-Transfer-Encoding: 7bit
Subject: Re: [PHP-DEV] PHP 7.2.0 Released
From: lists@rhsoft.net ("lists@rhsoft.net")



Am 04.12.2017 um 18:36 schrieb Sara Golemon:
> On Fri, Dec 1, 2017 at 6:35 PM, lists@rhsoft.net <lists@rhsoft.net> wrote:
>> the main question is why does PHP need to to *anything* here instead hand
>> the TLS handshake completly over to openssl? in that case even PHP5 could
>> perfer TLS1.2 ciphers against a sevrer that orders them on top without touch
>> any line of PHP's code
>>
> Because the SSL API in OpenSSL that PHP uses doesn't let you say:
> "Just give me the best method you can"
> 
> There may be another SSL API that does, but that's more than just "set
> the value to any and be done with it"

and how does other software like the apache benchmark tool "ab" this for 
as long as i can think which is also linked against openssl?

[harry@srv-rhsoft:~]$ ab -c 1 -n 1 https://localhost/
This is ApacheBench, Version 2.3 <$Revision: 1807734 $>
Copyright 1996 Adam Twiss, Zeus Technology Ltd, http://www.zeustech.net/
Licensed to The Apache Software Foundation, http://www.apache.org/

Benchmarking localhost (be patient).....done

Server Software:
Server Hostname:        localhost
Server Port:            443
SSL/TLS Protocol:       TLSv1.2,ECDHE-ECDSA-AES128-GCM-SHA256,256,128
TLS Server Name:        localhost
______________________

[harry@srv-rhsoft:~]$ ldd /usr/bin/ab
         linux-vdso.so.1 (0x00007ffd015cc000)
         libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007fb83e962000)
         libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007fb83e4d7000)
         libaprutil-1.so.0 => /lib64/libaprutil-1.so.0 (0x00007fb83ed96000)
         libapr-1.so.0 => /lib64/libapr-1.so.0 (0x00007fb83ed5a000)
         libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fb83e2b8000)
         libm.so.6 => /lib64/libm.so.6 (0x00007fb83dfa2000)
         libc.so.6 => /lib64/libc.so.6 (0x00007fb83dbcd000)
         libz.so.1 => /lib64/libz.so.1 (0x00007fb83d9b6000)
         libdl.so.2 => /lib64/libdl.so.2 (0x00007fb83d7b2000)
         libuuid.so.1 => /lib64/libuuid.so.1 (0x00007fb83d5ad000)
         libcrypt.so.1 => /lib64/libcrypt.so.1 (0x00007fb83d377000)
         libexpat.so.1 => /lib64/libexpat.so.1 (0x00007fb83d144000)
         /lib64/ld-linux-x86-64.so.2 (0x00007fb83ebce000)
         libgomp.so.1 => /lib64/libgomp.so.1 (0x00007fb83cf15000)
         libfreebl3.so => /lib64/libfreebl3.so (0x00007fb83cd12000)