From: bostjan at a2o dot si Operating system: Linux (Slackware PHP version: 5.2.12 PHP Bug Type: Streams related Bug description: Patch for CN_match to support wildcards
Description: ------------ Stream context option CN_match does not support wildcard CN matching on PHP side. It only supports matching if a client connecting to PHP presents itself with wildcard in CN or if PHP connects to server which presents itself with wildcard in CN. See my comment from 20Feb2010 here: http://www.php.net/manual/en/context.ssl.php Here is a link to a patch which enables "limited wildcard matching" if asterisk is present in CN_match. http://source.a2o.si/php/php-ext-openssl-CN_match-wildcard.diff Reproduce code: --------------- ####### SERVER // Create context and other stuff ... // Set relevant option stream_context_set_option($ctx, 'ssl', 'CN_match', '*.example.org'); // Create the server socket $server = stream_socket_server('ssl://0.0.0.0:9001', $errno, $errstr, STREAM_SERVER_BIND|STREAM_SERVER_LISTEN, $ctx); ####### COMMAND LINE CLIENT $ openssl s_client -host localhost -port 9001 -cert host.example.org.cert Expected result: ---------------- Successfull connection Actual result: -------------- Connection is closed with following warning message: Warning: stream_socket_accept(): Peer certificate CN=`host.example.org' did not match expected CN=`*.example.org' in... -- Edit bug report at http://bugs.php.net/?id=51100&edit=1 -- Try a snapshot (PHP 5.2): http://bugs.php.net/fix.php?id=51100&r=trysnapshot52 Try a snapshot (PHP 5.3): http://bugs.php.net/fix.php?id=51100&r=trysnapshot53 Try a snapshot (PHP 6.0): http://bugs.php.net/fix.php?id=51100&r=trysnapshot60 Fixed in SVN: http://bugs.php.net/fix.php?id=51100&r=fixed Fixed in SVN and need be documented: http://bugs.php.net/fix.php?id=51100&r=needdocs Fixed in release: http://bugs.php.net/fix.php?id=51100&r=alreadyfixed Need backtrace: http://bugs.php.net/fix.php?id=51100&r=needtrace Need Reproduce Script: http://bugs.php.net/fix.php?id=51100&r=needscript Try newer version: http://bugs.php.net/fix.php?id=51100&r=oldversion Not developer issue: http://bugs.php.net/fix.php?id=51100&r=support Expected behavior: http://bugs.php.net/fix.php?id=51100&r=notwrong Not enough info: http://bugs.php.net/fix.php?id=51100&r=notenoughinfo Submitted twice: http://bugs.php.net/fix.php?id=51100&r=submittedtwice register_globals: http://bugs.php.net/fix.php?id=51100&r=globals PHP 4 support discontinued: http://bugs.php.net/fix.php?id=51100&r=php4 Daylight Savings: http://bugs.php.net/fix.php?id=51100&r=dst IIS Stability: http://bugs.php.net/fix.php?id=51100&r=isapi Install GNU Sed: http://bugs.php.net/fix.php?id=51100&r=gnused Floating point limitations: http://bugs.php.net/fix.php?id=51100&r=float No Zend Extensions: http://bugs.php.net/fix.php?id=51100&r=nozend MySQL Configuration Error: http://bugs.php.net/fix.php?id=51100&r=mysqlcfg
