Improve TLS 1.3 support #186
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Construct underlying stream to always consume complete receive buffer. This avoids stale data in TLS buffers and also works around possible buffering issues in legacy PHP versions. The buffer size is limited due to TCP/IP buffers anyway, so this should not affect usage otherwise. This builds on top of reactphp/stream#139 to work around a bug in PHP where reading from a TLS 1.3 stream resource would hang with 100% CPU usage due to the changed TLS 1.3 handshake.
This only simplifies some of unneeded assignments for legacy PHP versions and should not affect usage otherwise. TLS 1.3 is implicitly available despite being omitted in this assignment. The required crypto flag is likely going to be added in PHP 7.2.x in the future via php/php-src#3700 and should thus be covered by the main crypto method constant in the future already. Due to the way how PHP interfaces with OpenSSL, this means that TLS 1.3 is in fact already enabled by default when using a recent OpenSSL version for all client and server connections even for older PHP versions.
jsor
approved these changes
Jan 3, 2019
This was referenced Jan 4, 2019
Closed
clue
added a commit
to clue-labs/socket
that referenced
this pull request
May 26, 2019
This PR improves the test suite to avoid a possible race condition for our TLS tests. It does not change anything about the actual behavior or the expected output, but it helps making the expected output more explicit and no longer subject to a possible race condition. This helps avoiding possible false negatives if TLS 1.3 is supported and PHP reports the EOF indicator before consuming all application data. This builds on top of reactphp#185 and reactphp#186
This was referenced May 26, 2019
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
TLS 1.3 is now an official standard as of August 2018 (https://tools.ietf.org/html/rfc8446) which is great news! 🎉 See https://wiki.openssl.org/index.php/TLS1.3 if you want to learn more about why this is great news.
OpenSSL 1.1.1 supports TLS 1.3 (https://www.openssl.org/blog/blog/2017/05/04/tlsv1.3/). For example, this version ships with Ubuntu 18.10 (and newer) by default, meaning that recent installations support TLS 1.3 out of the box
At the time of writing this, PHP does not know about TLS 1.3 at all. Interestingly, due to the way how PHP interfaces with OpenSSL, this means that TLS 1.3 is in fact enabled by default for all client and server connections when using a recent OpenSSL version (see also #184 for more details).
This PR improves TLS 1.3 support by working around the issues described in #184. In other words, prior to applying this patch, creating a TLS 1.3 connection could result in 100% CPU usage due to a bug in PHP. After applying this patch, this is worked around by consuming all stale data from the TLS receive buffers and as such support TLS 1.3 as well as older TLS versions. Accordingly, the test suite has been updated to add tests for all available TLS versions. The test suite confirms that existing behavior has not changed.
While PHP does not know about TLS 1.3 at the moment, there is however a pending PR that adds full TLS 1.3 support for a future PHP version (php/php-src#3700). This PR is designed in such a way as to be forwards compatible with when PHP receives official TLS 1.3 support and also when the underlying stream issue has been fixed (php/php-src#3729). Again, the test suite covers these details to avoid any future regressions.
Builds on top of #185
Builds on top of reactphp/stream#139
Fixes #184