Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72750
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 209.85.223.172 as permitted sender)
MIME-Version: 1.0
In-Reply-To: <CAGa2bXZ=kymcBAiaBt6CHpjmV-tcyEsbTe1pokHP9pRphoALwQ@mail.gmail.com>
References: <CAH8MpnnjTyp=cPBk2BpYF8Rs0x-4kCXw2yWO2pxDuSiiwQ=xDA@mail.gmail.com>
	<CALwr1G=D0fFO0-6xXyxdS1GyT+gkhG-uhOuGf81NuQGV11pvXQ@mail.gmail.com>
	<CAGa2bXZ=kymcBAiaBt6CHpjmV-tcyEsbTe1pokHP9pRphoALwQ@mail.gmail.com>
Date: Fri, 21 Feb 2014 16:18:40 -0500
Message-ID: <CAH8Mpn=fQ=MGzDVDxvks+k-KobPMvm=su1-MuZhSO3d4d_Ut6g@mail.gmail.com>
To: Yasuo Ohgaki <yohgaki@ohgaki.net>
Cc: =?ISO-8859-1?Q?P=E1draic_Brady?= <padraic.brady@gmail.com>, 
	"internals@lists.php.net" <internals@lists.php.net>
Content-Type: multipart/alternative; boundary=089e0111c1ca78d1c704f2f12a82
Subject: Re: [PHP-DEV] Future TLS roadmap
From: rdlowrey@gmail.com (Daniel Lowrey)

--089e0111c1ca78d1c704f2f12a82
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Wed, Feb 12, 2014 at 4:41 PM, Yasuo Ohgaki <yohgaki@ohgaki.net> wrote:

> Hi all,
>
> On Wed, Feb 12, 2014 at 10:39 PM, P=E1draic Brady <padraic.brady@gmail.co=
m>wrote:
>
>> On 12 February 2014 13:22, Daniel Lowrey <rdlowrey@gmail.com> wrote:
>> > FYI, these are things I plan to work on for the post-5.6 timeframe:
>> >
>> > - Support for SNI in *servers* (currently only supported by clients)
>> > - Support for DTLS (datagram client/server encryption)
>> > - Mitigating the client-initiated renegotiation DoS vector in TLS
>> servers
>> >
>> > Most TLS changes could probably pass as "security fixes" and may be
>> > feasible for 5.6 bugfix releases. The alternative is obviously to put
>> them
>> > in master and wait for 5.7. In any case we can cross that bridge when =
we
>> > get there.
>>
>> I'd support the renegotiation DOS vector as a current bugfix - it's
>> been documented for what, 2 years now since a POC was published?
>
>
> I'm getting used to delayed security fixes...
> +1 for fix it ASAP.
>
>
To interested parties ...

Because it's a security vulnerability for encrypted stream servers I've
taken care of client-initiated renegotiation DoS mitigation and merged it
for 5.6:

https://github.com/php/php-src/pull/600

The implementation uses a standard leaky bucket rate-limiting approach. If
you'd like to know more just click over to the PR link above.

--089e0111c1ca78d1c704f2f12a82--