Skip to content

Commit e8fde6b

Browse files
bukkabukka
committed
Fix bug #80269: OpenSSL sets Subject wrong with extraattribs parameter
Closes GH-12979
1 parent 6c0d559 commit e8fde6b

File tree

6 files changed

+138
-5
lines changed

6 files changed

+138
-5
lines changed

‎NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,10 @@ Opcache:
4141
. If JIT is enabled, PHP will now exit with a fatal error on startup in case
4242
of JIT startup initialization issues. (danog)
4343

44+
OpenSSL:
45+
. Fixed bug #80269 (OpenSSL sets Subject wrong with extraattribs parameter).
46+
(Jakub Zelenka)
47+
4448
PDO:
4549
. Fixed setAttribute and getAttribute (SakiTakamachi)
4650

‎UPGRADING

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -226,6 +226,10 @@ PHP 8.4 UPGRADE NOTES
226226
. The behavior of mb_strcut is more consistent now on invalid UTF-8 and UTF-16
227227
strings. (For valid UTF-8 and UTF-16 strings, there is no change.)
228228

229+
- OpenSSL:
230+
. The extra_attributes parameter in openssl_csr_new sets CSR attributes
231+
instead of subject DN which was incorrectly done previously.
232+
229233
- PDO:
230234
. getAttribute, enabled to get the value of ATTR_STRINGIFY_FETCHES.
231235

‎ext/openssl/openssl.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2981,7 +2981,7 @@ static int php_openssl_make_REQ(struct php_x509_request * req, X509_REQ * csr, z
29812981
int nid;
29822982

29832983
if (NULL == strindex) {
2984-
php_error_docref(NULL, E_WARNING, "dn: numeric fild names are not supported");
2984+
php_error_docref(NULL, E_WARNING, "attributes: numeric fild names are not supported");
29852985
continue;
29862986
}
29872987

@@ -2991,15 +2991,15 @@ static int php_openssl_make_REQ(struct php_x509_request * req, X509_REQ * csr, z
29912991
if (UNEXPECTED(!str_item)) {
29922992
return FAILURE;
29932993
}
2994-
if (!X509_NAME_add_entry_by_NID(subj, nid, MBSTRING_UTF8, (unsigned char*)ZSTR_VAL(str_item), -1, -1, 0)) {
2994+
if (!X509_REQ_add1_attr_by_NID(csr, nid, MBSTRING_UTF8, (unsigned char*)ZSTR_VAL(str_item), (int)ZSTR_LEN(str_item))) {
29952995
php_openssl_store_errors();
2996-
php_error_docref(NULL, E_WARNING, "attribs: add_entry_by_NID %d -> %s (failed)", nid, ZSTR_VAL(str_item));
2996+
php_error_docref(NULL, E_WARNING, "attributes: add_attr_by_NID %d -> %s (failed)", nid, ZSTR_VAL(str_item));
29972997
zend_string_release(str_item);
29982998
return FAILURE;
29992999
}
30003000
zend_string_release(str_item);
30013001
} else {
3002-
php_error_docref(NULL, E_WARNING, "dn: %s is not a recognized name", ZSTR_VAL(strindex));
3002+
php_error_docref(NULL, E_WARNING, "attributes: %s is not a recognized attribute name", ZSTR_VAL(strindex));
30033003
}
30043004
} ZEND_HASH_FOREACH_END();
30053005
for (i = 0; i < sk_CONF_VALUE_num(attr_sk); i++) {

‎ext/openssl/tests/bug72165.phpt

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@ $options = ['config' => __DIR__ . DIRECTORY_SEPARATOR . 'openssl.cnf'];
99
$var2 = openssl_csr_new([0], $var0, $options, [0]);
1010
?>
1111
--EXPECTF--
12-
Warning: openssl_csr_new(): dn: numeric fild names are not supported in %sbug72165.php on line %d
12+
Warning: openssl_csr_new(): attributes: numeric fild names are not supported in %sbug72165.php on line %d
1313

1414
Warning: openssl_csr_new(): add1_attr_by_txt challengePassword_min -> 4 (failed; check error queue and value of string_mask OpenSSL option if illegal characters are reported) in %sbug72165.php on line %d

‎ext/openssl/tests/openssl_csr_attribs.cnf

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
oid_section = new_oids
2+
[ new_oids ]
3+
aansluitNummer = 1.3.6.1.4.1.11278.1150.2.1
4+
kvkNummer = 1.3.6.1.4.1.11278.1150.2.2
5+
6+
[ req ]
7+
default_bits = 2048
8+
distinguished_name = req_distinguished_name
9+
attributes = req_attributes
10+
req_extensions = v3_req
11+
prompt = no
12+
13+
[ req_distinguished_name ]
14+
C = NL
15+
ST = ST
16+
L = L
17+
O = O
18+
CN = test
19+
20+
[ req_attributes ]
21+
facsimileTelephoneNumber =
22+
postalCode =
23+
streetAddress =
24+
name = Organisation
25+
telephoneNumber = 012345678
26+
aansluitNummer = 1234
27+
kvkNummer = 12345678
28+
emailAddress = [email protected]
29+
30+
[ v3_req ]
31+
basicConstraints = CA:FALSE

‎ext/openssl/tests/openssl_csr_new_with_attribs.phpt

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
--TEST--
2+
openssl_csr_new() attributes setting tests
3+
--EXTENSIONS--
4+
openssl
5+
--FILE--
6+
<?php
7+
8+
$dn = array(
9+
"countryName" => "UK",
10+
"stateOrProvinceName" => "England",
11+
"localityName" => "London",
12+
"commonName" => "test.php.net",
13+
"emailAddress" => "[email protected]"
14+
);
15+
16+
17+
$config = __DIR__ . DIRECTORY_SEPARATOR . 'openssl_csr_attribs.cnf';
18+
19+
$config_arg = array('config' => $config);
20+
21+
$args = array(
22+
"digest_alg" => "sha256",
23+
"private_key_bits" => 2048,
24+
"private_key_type" => OPENSSL_KEYTYPE_DSA,
25+
"encrypt_key" => true,
26+
"config" => $config,
27+
);
28+
29+
$privkey = 'file://' . __DIR__ . '/private_rsa_2048.key';
30+
31+
$csr = openssl_csr_new(
32+
$dn,
33+
$privkey,
34+
$args,
35+
[
36+
'emailAddress' => '[email protected]',
37+
'aansluitNummer' => '11112222',
38+
'postalCode' => 'N11',
39+
]
40+
);
41+
42+
43+
var_dump(openssl_csr_get_subject($csr));
44+
var_dump(openssl_csr_export($csr, $output));
45+
var_dump($output);
46+
47+
var_dump(openssl_csr_new(
48+
$dn,
49+
$privkey,
50+
$args,
51+
['wrong' => '[email protected]']
52+
));
53+
54+
?>
55+
--EXPECTF--
56+
array(5) {
57+
["C"]=>
58+
string(2) "UK"
59+
["ST"]=>
60+
string(7) "England"
61+
["L"]=>
62+
string(6) "London"
63+
["CN"]=>
64+
string(12) "test.php.net"
65+
["emailAddress"]=>
66+
string(16) "[email protected]"
67+
}
68+
bool(true)
69+
string(1269) "-----BEGIN CERTIFICATE REQUEST-----
70+
MIIDcDCCAlgCAQAwaDELMAkGA1UEBhMCVUsxEDAOBgNVBAgMB0VuZ2xhbmQxDzAN
71+
BgNVBAcMBkxvbmRvbjEVMBMGA1UEAwwMdGVzdC5waHAubmV0MR8wHQYJKoZIhvcN
72+
AQkBFhB0ZXN0LnBocEBwaHAubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
73+
CgKCAQEArbUmVW1Y+rJzZRC3DYB0kdIgvk7MAday78ybGPPDhVlbAb4CjWbaPs4n
74+
yUCTEt9KVG0H7pXHxDbWSsC2974zdvqlP0L2op1/M2SteTcGCBOdwGH2jORVAZL8
75+
/WbTOf9IpKAM77oN14scsyOlQBJqhh+xrLg8ksB2dOos54yDqo0Tq7R5tldV+alK
76+
ZXWlJnqRCfFuxvqtfWI5nGTAedVZhvjQfLQQgujfXHoFWoGbXn2buzfwKGJEeqWP
77+
bQOZF/FeOJPlgOBhhDb3BAFNVCtM3k71Rblj54pNd3yvq152xsgFd0o3s15fuSwZ
78+
gerUjeEuw/wTK9k7vyp+MrIQHQmPdQIDAQABoIHCMAkGA1UECTECDAAwCQYDVQQX
79+
MQIMADAMBgNVBBExBQwDTjExMBIGA1UEFDELDAkwMTIzNDU2NzgwFQYDVQQpMQ4M
80+
DE9yZ2FuaXNhdGlvbjAZBgsrBgEEAdgOiH4CATEKDAgxMTExMjIyMjAZBgsrBgEE
81+
AdgOiH4CAjEKDAgxMjM0NTY3ODAaBgkqhkiG9w0BCQ4xDTALMAkGA1UdEwQCMAAw
82+
HwYJKoZIhvcNAQkBMRIWEGluZm9AZXhhbXBsZS5jb20wDQYJKoZIhvcNAQELBQAD
83+
ggEBAAoPI/sWY0QKPMEBuRp6MHcvWgSExwkkQfRJQZlYdepu6Tw0iZwYRTOR4sEn
84+
Vz95qsrWqHp6QkXxdFG9FPHi4N66OX2Xb5TtHgDGMxrJTwbH+7VdsJiXLkWbeLuo
85+
zKv8BsrhLRYiZkl+VWIrNyOcK7ao2sD+D3YkCBA4JK4OFhfhxY43D2sme7aEQVjr
86+
S+UvEjuIALN0AP6gO2AMiUODPBrjsPI3NpN40VUvVU+Hsp1Tlqvth/AYASuGT2yt
87+
M5YdcSm7JwaGAwIgOv8XPUQGem52yMEvzySRC4ZyTddfiZAkeTLmbh+SMVbHXXOk
88+
UeEz+fvmQ4L+sc3RE8u+M8g31LM=
89+
-----END CERTIFICATE REQUEST-----
90+
"
91+
92+
Warning: openssl_csr_new(): attributes: wrong is not a recognized attribute name in %s on line %d
93+
object(OpenSSLCertificateSigningRequest)#%d (0) {
94+
}

0 commit comments

Comments
 (0)