Newsgroups: php.internals Path: news.php.net Xref: news.php.net php.internals:101236 Return-Path: Mailing-List: contact internals-help@lists.php.net; run by ezmlm Delivered-To: mailing list internals@lists.php.net Received: (qmail 73742 invoked from network); 4 Dec 2017 22:21:42 -0000 Received: from unknown (HELO lists.php.net) (127.0.0.1) by localhost with SMTP; 4 Dec 2017 22:21:42 -0000 Authentication-Results: pb1.pair.com smtp.mail=lists@rhsoft.net; spf=pass; sender-id=pass Authentication-Results: pb1.pair.com header.from=lists@rhsoft.net; sender-id=pass Received-SPF: pass (pb1.pair.com: domain rhsoft.net designates 91.118.73.15 as permitted sender) X-PHP-List-Original-Sender: lists@rhsoft.net X-Host-Fingerprint: 91.118.73.15 mail.thelounge.net Received: from [91.118.73.15] ([91.118.73.15:63299] helo=mail.thelounge.net) by pb1.pair.com (ecelerity 2.1.1.9-wez r(12769M)) with ESMTP id CD/85-28358-57AC52A5 for ; Mon, 04 Dec 2017 17:21:42 -0500 Received: from srv-rhsoft.rhsoft.net (Authenticated sender: h.reindl@thelounge.net) by mail.thelounge.net (THELOUNGE MTA) with ESMTPSA id 3yrK9D27SrzXMR for ; Mon, 4 Dec 2017 23:21:36 +0100 (CET) To: internals@lists.php.net References: <41630a4e-8772-bdfb-e859-831a36dc67ea@rhsoft.net> <9f3d28e1-cc6d-d5dc-da04-7e3791070be8@rhsoft.net> <35e8f8c5-8fe0-702b-f304-890cf902b390@rhsoft.net> Message-ID: <10a39b35-57e2-d6c4-ea3a-75b47d8df514@rhsoft.net> Date: Mon, 4 Dec 2017 23:21:36 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: de-CH Content-Transfer-Encoding: 7bit Subject: Re: [PHP-DEV] PHP 7.2.0 Released From: lists@rhsoft.net ("lists@rhsoft.net") Am 04.12.2017 um 22:53 schrieb Walter Parker: > On Mon, Dec 4, 2017 at 1:43 PM, Niklas Keller wrote: >>> and to be clear here: >>> >>> a client when connecting to a server configured like below has to respect >>> the cipher order of the server while >>> https://www.ssllabs.com/ssltest/ exists for years to give dministrators >>> of the server some help and which clients are using which cipher >>> >> >> Just minor nitpicking to get the facts right: A client does never respect >> the used cipher order of the server. A client offers a number of ciphers >> and the server chooses one of those, either based on its own order >> (preferred) or based on the client-preferred order. >> >> If you know other programs doing it better, research how they do it and >> propose a change to PHP please. accepted, so PHP did only send a subset of the from openssl supported ciphers to the server not containing the modern ones > That's good news. Given that openssl 1.1.0 only shipped late last year, I > fail to see how this has been an failure in PHP for many years for not > using a recent feature in openssl. > Looking at the sources for ab.c, it appears to do things like PHP. The > protocol level is hard coded to one value (SSL_METHOD > *SSLv23_method(void);) > There is a command line override (-Z protocol) that allows the protocol > selection to be changed to TLS1, TLS1.1, TLS1.2, or TLS1+TLS1.1+TLS1.2. > > Lists, could you please clarify what PHP should learn from how ab does TLS? as you can see in the ssllabs tests openssl 1.0.1 shipped years ago was able to use ECDHE/ECDSA with AES-GCM which is the recommended cipher, PHP until recent was only able to use "DHE-RSA-AES128-SHA", the first part is slow and the second part SHA1 is deprecated long ago for TLS PHP 7.1 even with openssl 1.1.x against MariaDB 10.2: ECDHE-RSA-AES128-SHA PHP 7.2 on the same environment: ECDHE-RSA-AES128-GCM-SHA256 this was and is technically supported by openssl 1.0.x ssl-cipher = ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES128-SHA" if you restrict mysqld to "ssl-cipher = ECDHE-RSA-AES128-GCM-SHA256" nothing before PHP 7.2.0 is able to connect at all at the same time "ab" which is a small 50 KB binary supports ECDHE and AES-GCM ciphers for years and is also using openssl - it pretty sure gives a NULL as cipher to openssl which means openssl sends all it's supported ciphers to the server and the server then prefers the best one from his ordering due the handshake finally that means without touching the code around openssl from the moment on the openssl on the client side and the server supports and perefers a new cipher it will get used without touch "ab" and my question is why PHP is here completly differnt