v1.2.3

What's Changed

• SOCKS5 handshake now respects the timeout option — Previously the SOCKS5 TCP handshake used a hardcoded 30-second timeout, ignoring the user-specified timeout. A proxy that stalls on UDP ASSOCIATE (e.g. 3proxy with UDPASSOC denied by ACL) would hang for 30s regardless. The timeout is now propagated through to SO_RCVTIMEO/SO_SNDTIMEO on the SOCKS5 control socket.

v1.2.2

Security Fixes

• Fix stack buffer overflow in SOCKS5 RFC 1929 authentication
• Fix file descriptor double-close and leak in socketpair forwarder
• Fix use-after-free race condition in forwarder thread cleanup
• Replace volatile with atomic builtins for cross-architecture thread safety
• Validate SOCKS5 proxy port range (1-65535)
• Zero password memory before freeing
• Reject oversized socks5_proxy strings instead of silent truncation

Other Changes

• Remove unused BIO filter code (~170 lines)
• Add missing SOCKS5 reply error code 0x06 (TTL expired)
• Add SOCKS5 test suite (037-064) with 3proxy UDPMAP log verification
• Add test runner artifacts to .gitignore

v1.2.1

Fix SOCKS5 QUIC proxy

Fixed SOCKS5 UDP relay support for tunneling QUIC connections through SOCKS5 proxies.

What changed

• Replaced non-functional BIO filter approach with a socketpair-based forwarder thread
• OpenSSL QUIC internally bypasses BIO filter chains for sendmmsg/recvmmsg, so we now use a Unix SOCK_DGRAM socketpair where one end goes to OpenSSL's native dgram BIO and a pthread forwarder on the other end wraps/unwraps SOCKS5 UDP headers
• Full RFC 1928 SOCKS5 auth + UDP ASSOCIATE handshake in C

Tested

• HTTP/3 over SOCKS5 (3proxy) to Cloudflare, verified via /cdn-cgi/trace
• Direct QUIC unaffected
• Graceful fallback to H2 when proxy doesn't support UDP

v1.2.0

What's New

TLS Options Parity

Added constructor options matching PHP's stream context TLS capabilities (where applicable to QUIC/TLS 1.3):

• ciphersuites — TLS 1.3 cipher suite selection (TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:...)
• peer_name — Override hostname for SNI and certificate verification
• verify_peer_name — Toggle hostname verification (default: true)
• allow_self_signed — Accept self-signed certificates when verify_peer is enabled

Hostname Verification Fix

SSL_set1_host() is now called during connection when verify_peer and verify_peer_name are both enabled. Previously, hostname verification was silently skipped even with verify_peer => true.

SOCKS5 Proxy — Complete Rewrite

The previous SOCKS5 implementation only had a UDP relay BIO filter but was missing the entire TCP handshake, making it non-functional. This release adds:

• Full RFC 1928 TCP control channel handshake
• Auth negotiation: no-auth and RFC 1929 username/password (socks5_username, socks5_password)
• UDP ASSOCIATE command with relay address parsing (IPv4, IPv6, domain ATYP)
• Proper TCP control socket lifecycle (kept alive during relay, closed on disconnect)
• Handles 0.0.0.0 relay addresses by falling back to the proxy IP

Tests

• 033-ciphersuites — TLS 1.3 cipher selection and invalid cipher rejection
• 034-peer-name — SNI override and hostname mismatch behavior
• 035-verify-peer-name — Hostname verification toggle
• 036-allow-self-signed — Self-signed certificate acceptance
• 037-socks5-handshake-errors — SOCKS5 error paths (bad format, refused, unresolvable)
• 038-socks5-functional — End-to-end SOCKS5 proxy test (requires microsocks)

1.1.0

Add SOCKS5 UDP relay support for tunneling QUIC connections (RFC 1928). New 'socks5_proxy' option in QuicConnection constructor.

1.0.0

PHP QUIC Extension v1.0.0

Native C extension providing QUIC client transport (RFC 9000) using OpenSSL 3.2+ QUIC API.

Features

• QuicConnection class with full TLS 1.3 configuration (ALPN, peer verification, ciphersuites, client certificates)
• QuicStream class supporting bidirectional and unidirectional streams
• Stream multiplexing with proper flow control
• quic_connect() convenience function
• Connection statistics tracking
• GC-safe reference counting between connections and streams

Requirements

• PHP 8.4+
• OpenSSL 3.2+ with QUIC support

Test Suite

55 phpt tests covering:

• Core functionality (connect, streams, TLS options, ALPN, timeouts, stats)
• Protocol compliance regression tests derived from bugs in msquic, quic-go, quiche, ngtcp2, and OpenSSL
• Security audit tests (serialization safety, input validation, boundary values, GC safety, resource leak detection)

Known Issues

• acceptStream() timeout logic is inverted (non-blocking flag sent for blocking case and vice versa)
• serialize()/unserialize() not denied on QUIC objects (dangling pointer risk)
• connect() after close() leaks the previous SSL object and file descriptor
• getPeerCertificate() leaks a zend_string on each call
• Client-only (OpenSSL 3.2 limitation; server support requires OpenSSL 3.5+)