Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:72820
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain belski.net from 85.214.73.107 cause and error)
Message-ID: <54df89551690b2af245dba8088c7032b.squirrel@webmail.klapt.com>
In-Reply-To:
 <CAGAGxbYbvrF+aQP-Tm9S=+t0CXPMKaHuOAXqZO4ZOxtuNMQHPA@mail.gmail.com>
References:
    <CAH8MpnnmKt2byQU8DcWetnK6W7GB9HuF3srea-ECwQ4RRe1SWQ@mail.gmail.com>
    <CAGAGxbaZ5aCdSxsQrw05_xyxKEAhQY6uGaoAu06GkudKOtdqoQ@mail.gmail.com>
    <CAGAGxbYbvrF+aQP-Tm9S=+t0CXPMKaHuOAXqZO4ZOxtuNMQHPA@mail.gmail.com>
Date: Wed, 26 Feb 2014 11:39:04 +0100
To: "Chris Wright" <daverandom@php.net>
Cc: internals@lists.php.net,
 "Daniel Lowrey" <rdlowrey@gmail.com>,
 "Ferenc Kovacs" <tyra3l@gmail.com>,
 "Pierre Joye" <pierre.php@gmail.com>,
 =?UTF-8?Q?=22P=C3=A1draic_Brady=22?= <padraic.brady@gmail.com>
User-Agent: SquirrelMail/1.5.2 [SVN]
MIME-Version: 1.0
Content-Type: text/plain;charset=UTF-8
Content-Transfer-Encoding: 8bit
Subject: Re: [PHP-DEV] Windows Peer Verification
From: anatol.php@belski.net ("Anatol Belski")

Hi Chris,

On Wed, February 26, 2014 10:48, Chris Wright wrote:
> On 22 February 2014 00:31, Chris Wright <daverandom@php.net> wrote:
>
>> Following on from this thread and Daniel's excellent work on TLS
>> improvements, and liaising heavily with Daniel off-list, I have created a
>> PR [1] of some work I have done to get peer verification
>> working with Windows native certificate store.
>>
>> This is by far and away the most preferable option as it gives "out of
>> the box" support for peer verification by default on Windows, and does
>> not require any additional certificate bundles or configuration. It also
>> allows us to take advantage of trust updates rolled out via MS update
>> systems.
>>
>> The implementation is complete in that it supports all existing
>> features, although it needs a little polishing and some edge cases
>> covering before it can be merged. The only definite known issue at the
>> time of writing is that the method for fetching the CN from the
>> certificate incorrectly assumes that the returned data will always be
>> UTF-8 encoded, a solution for this is planned and will be implemented
>> in the next day or two.
>>
>> I am by no means an expert on the subject matter here in any respect,
>> so I encourage ruthless code review.
>>
>> Note that there are no new features here, it is simply looking to fill
>> in the gaps in the recent work by providing consistency on Windows.
>>
>> [1] https://github.com/php/php-src/pull/601
>>
>
> This patch is now merged (thanks Daniel) and will be available in the
> next alpha. If anyone finds anything that doesn't behave as expected,
> please let me know.
>

the tests with the removed pcntl dependencies do fail for me. I made a
small change here

http://git.php.net/?p=php-src.git;a=commitdiff;h=56cbe043810ab773605aa6a6ca2eb362ea9a54e9

but still there are some with the similar diff

TEST 43/79
[C:\php-sdk\php56\vc11\x64\php-src\ext\openssl\tests\bug65538_001.phpt]
========DIFF========
001+ Warning: file_get_contents(https://127.0.0.1:64321/): failed to open
stream: No connection could be made because the target machine actively
refused it.
001- string(12) "Hello World!"
002+  in
C:\php-sdk\php56\vc11\x64\php-src\ext\openssl\tests\ServerClientTestCase.inc(93)
: eval()'d code on line 8
003+ bool(false)
========DONE========

Actually it's great to get rid of that pcntl dependency there, just we
should bring it inline. Working on the further fixes.

Regards

Anatol