TLS 1.3 is now an official standard as of August 2018 (https://tools.ietf.org/html/rfc8446) which is great news!
OpenSSL 1.1.1 supports TLS 1.3 (https://www.openssl.org/blog/blog/2017/05/04/tlsv1.3/). For example, this version ships with Ubuntu 18.10 (and newer) by default, meaning that recent installations support TLS 1.3 out of the box
At the time of writing this, PHP does not know about TLS 1.3 at all. Interestingly, due to the way how PHP interfaces with OpenSSL, this means that TLS 1.3 is in fact enabled by default for all client and server connections when using a recent OpenSSL version (see also #184 for more details).
This PR improves TLS 1.3 support by working around the issues described in #184. In other words, prior to applying this patch, creating a TLS 1.3 connection could result in 100% CPU usage due to a bug in PHP. After applying this patch, this is worked around by consuming all stale data from the TLS receive buffers and as such support TLS 1.3 as well as older TLS versions. Accordingly, the test suite has been updated to add tests for all available TLS versions. The test suite confirms that existing behavior has not changed.
While PHP does not know about TLS 1.3 at the moment, there is however a pending PR that adds full TLS 1.3 support for a future PHP version (php/php-src#3700). This PR is designed in such a way as to be forwards compatible with when PHP receives official TLS 1.3 support and also when the underlying stream issue has been fixed (php/php-src#3729). Again, the test suite covers these details to avoid any future regressions.
The text was updated successfully, but these errors were encountered:
Construct underlying stream to always consume complete receive buffer. This avoids stale data in TLS buffers and also works around possible buffering issues in legacy PHP versions. The buffer size is limited due to TCP/IP buffers anyway, so this should not affect usage otherwise. This builds on top of reactphp/stream#139 to work around a bug in PHP where reading from a TLS 1.3 stream resource would hang with 100% CPU usage due to the changed TLS 1.3 handshake.
This only simplifies some of unneeded assignments for legacy PHP versions and should not affect usage otherwise. TLS 1.3 is implicitly available despite being omitted in this assignment. The required crypto flag is likely going to be added in PHP 7.2.x in the future via php/php-src#3700 and should thus be covered by the main crypto method constant in the future already. Due to the way how PHP interfaces with OpenSSL, this means that TLS 1.3 is in fact already enabled by default when using a recent OpenSSL version for all client and server connections even for older PHP versions.
This PR improves the test suite to avoid a possible race condition for our TLS tests. It does not change anything about the actual behavior or the expected output, but it helps making the expected output more explicit and no longer subject to a possible race condition. This helps avoiding possible false negatives if TLS 1.3 is supported and PHP reports the EOF indicator before consuming all application data. This builds on top of reactphp#185 and reactphp#186