Issue #672: Changes in SSL handling breaks bschmitt/laravel-amqp

[olanko]

Referring to issue #672

Automatically setting $ssl_options['verify_peer'] = true breaks bschmitt/laravel-amqp which sends empty ssl_options when ssl is not enabled. Setting verify_peer enforces ssl later in PhpAmqpLib/Wire/IO/StreamIO.php even if it is not what the user wants.

Simply checking if $ssl_options is defined fixes this problem.

[lukebakken]

Setting verify_peer enforces ssl later in PhpAmqpLib/Wire/IO/StreamIO.php even if it is not what the user wants.

I'm not opposed to this change, but why would someone use AMQPSSLConnection if they didn't want to use ssl?

[olanko]

Hi,

I understand and kinda agree with you.

I don't know the reasoning why laravel-amqp uses this. My guess is that it has been easier to always use AMQPSSLConnection because it has actually worked with or without SSL depending on $ssl_options before this change 0f16fb8. Is that verify_peer part even related to that commit anyways?

I'll handle this case locally and hope that someone makes these libraries work together again :)

BR,
-Olli

[ramunasd]

What about PHP5.5 users who does not submit options(empty $ssl_options) and expect that verify_peer is enabled for secure connection? I think we must still keep compatibility here.

[lukebakken]

Well, according to this old code we used to check if ssl_options were empty before creating an ssl context. Technically the change isn't backwards-compatible, even if the old behavior didn't make sense.

[ramunasd]

@lukebakken I agree, that change was not 100% backwards compatible. So we either revert it or improve to acceptable point. I think 1st option isn't nice because additional argument $ssl_protocol creates additional confusion about how variables must be passed, imagine matrix:

$ssl_options	$ssl_protocol	is secure?
empty	empty	no
empty	ssl	yes?
empty	tls	yes?
not empty	empty	no?
not empty	ssl	yes
not empty	tls	yes

Is this what everyone would expect? My common sense says that AMQPSSLConnection always must be secure or fail to establish connection.

I see laravel guys are adopting library to latest changes, so no big problem here?

[lukebakken]

My common sense says that AMQPSSLConnection always must be secure or fail to establish connection

I agree.

Anyway, at this point, let's revert to the old behavior and then ensure this is fixed in 3.0.0.

[ramunasd]

I will take care.

[olanko]

Hi,

Thanks for taking this seriously! Although they fixed my original problem already, you are doing good job.

-Olli

[ramunasd]

Fix on PR #677

[lukebakken]

Fixed by #677