Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:101235
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.216.175 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CANUQDCgEqxAT4+kiTFsg7yxoktZ+upWV6OD7wW9ggME2OMcAfg@mail.gmail.com>
References: <a64088a5-e93b-3450-fe8c-8ba6ac9d851a@php.net> <CADNQb0VA+-E2B21EZCfzau7v0_0=SeheHB+cxZCsx7RoVNn8jA@mail.gmail.com>
 <41630a4e-8772-bdfb-e859-831a36dc67ea@rhsoft.net> <CANUQDCjsz31t-VqbLeUOc-qJd=wzQ8Tbk2UGhY-74xw+JaGHUA@mail.gmail.com>
 <e8b900c3-3d76-9fe0-7b96-3c1f468d160e@rhsoft.net> <CAESVnVqhNgge2dzHTbf1bCR0unGCYwEeDqS2ErWdyK34M26k6g@mail.gmail.com>
 <9f3d28e1-cc6d-d5dc-da04-7e3791070be8@rhsoft.net> <CAESVnVoWeNdh2R4KROe=CfACQVQJP9sf66iJASPp73nURi9ouw@mail.gmail.com>
 <35e8f8c5-8fe0-702b-f304-890cf902b390@rhsoft.net> <b9075c8d-a5e1-8b28-cde7-8a642abaf0d0@rhsoft.net>
 <CANUQDCgEqxAT4+kiTFsg7yxoktZ+upWV6OD7wW9ggME2OMcAfg@mail.gmail.com>
Date: Mon, 4 Dec 2017 13:53:08 -0800
Message-ID: <CAMPTd_A2DB4_mysLeaTkcNFTZtrseNqWsmtaxjG6E_vPo7ghkg@mail.gmail.com>
To: PHP Internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="94eb2c122a847168c4055f8abe90"
Subject: Re: [PHP-DEV] PHP 7.2.0 Released
From: walterp@gmail.com (Walter Parker)

--94eb2c122a847168c4055f8abe90
Content-Type: text/plain; charset="UTF-8"

On Mon, Dec 4, 2017 at 1:43 PM, Niklas Keller <me@kelunik.com> wrote:

> >
> > and to be clear here:
> >
> > a client when connecting to a server configured like below has to respect
> > the cipher order of the server while
> > https://www.ssllabs.com/ssltest/ exists for years to give dministrators
> > of the server some help and which clients are using which cipher
> >
>
> Just minor nitpicking to get the facts right: A client does never respect
> the used cipher order of the server. A client offers a number of ciphers
> and the server chooses one of those, either based on its own order
> (preferred) or based on the client-preferred order.
>
> If you know other programs doing it better, research how they do it and
> propose a change to PHP please.
>
> Regards, Niklas
>

That's good news. Given that openssl 1.1.0 only shipped late last year, I
fail to see how this has been an failure in PHP for many years for not
using a recent feature in openssl.
Looking at the sources for ab.c, it appears to do things like PHP. The
protocol level is hard coded to one value (SSL_METHOD
*SSLv23_method(void);)
There is a command line override (-Z protocol) that allows the protocol
selection to be changed to TLS1, TLS1.1, TLS1.2, or TLS1+TLS1.1+TLS1.2.

Lists, could you please clarify what PHP should learn from how ab does TLS?


Walter



-- 
The greatest dangers to liberty lurk in insidious encroachment by men of
zeal, well-meaning but without understanding.   -- Justice Louis D. Brandeis

--94eb2c122a847168c4055f8abe90--