Skip to content

Fix TLS stream EOF detection after close_notify with stale errno #24132

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bukka merged 1 commit into from
Oct 5, 2026
Merged

Fix TLS stream EOF detection after close_notify with stale errno #24132

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions NEWS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -120,6 +120,8 @@ PHP NEWS
- OpenSSL:
. Fixed stream_socket_enable_crypto() leaving the socket non-blocking
after a handshake timeout. (Ilia Alshanetsky)
. Fixed feof() on a TLS stream staying false after a close_notify on Windows.
(Jakub Zelenka)

- PCNTL:
. Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while
Expand Down
58 changes: 58 additions & 0 deletions ext/openssl/tests/stream_eof_after_close_notify.phpt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,58 @@
--TEST--
feof() is true after a TLS close_notify even if an earlier read left errno set to EAGAIN
--EXTENSIONS--
openssl
--SKIPIF--
<?php
if (!function_exists("proc_open")) die("skip no proc_open");
?>
--FILE--
<?php
$certFile = __DIR__ . DIRECTORY_SEPARATOR . 'stream_eof_after_close_notify.pem.tmp';

$serverCode = <<<'CODE'
$serverCtx = stream_context_create(['ssl' => ['local_cert' => '%s']]);
$sock = stream_socket_server("tls://127.0.0.1:0", $errno, $errstr,
STREAM_SERVER_BIND | STREAM_SERVER_LISTEN, $serverCtx);
phpt_notify_server_start($sock);

$link = stream_socket_accept($sock);
/* Let the client block in fread() first, so its SSL_read() sees WANT_READ */
phpt_wait();
usleep(100000);
fwrite($link, "data");
/* close_notify only, the TCP connection stays open */
stream_socket_enable_crypto($link, false);
phpt_wait();
fclose($link);
CODE;
$serverCode = sprintf($serverCode, $certFile);

$clientCode = <<<'CODE'
$clientCtx = stream_context_create(['ssl' => [
'verify_peer' => false,
'verify_peer_name' => false,
]]);
$sock = stream_socket_client("tls://{{ ADDR }}", $errno, $errstr, 2, STREAM_CLIENT_CONNECT, $clientCtx);

phpt_notify();
var_dump(fread($sock, 4));
var_dump(fread($sock, 4));
var_dump(feof($sock));
phpt_notify();
CODE;

include 'CertificateGenerator.inc';
(new CertificateGenerator())->saveNewCertAsFileWithKey('stream_eof_after_close_notify', $certFile);

include 'ServerClientTestCase.inc';
ServerClientTestCase::getInstance()->run($clientCode, $serverCode);
?>
--CLEAN--
<?php
@unlink(__DIR__ . DIRECTORY_SEPARATOR . 'stream_eof_after_close_notify.pem.tmp');
?>
--EXPECT--
string(4) "data"
string(0) ""
bool(true)
6 changes: 4 additions & 2 deletions ext/openssl/xp_ssl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2186,9 +2186,11 @@ static ssize_t php_openssl_sockop_io(int read, php_stream *stream, char *buf, si
retry = 1;
}

/* Also, on reads, we may get this condition on an EOF. We should check properly. */
if (read) {
stream->eof = (retry == 0 && errno != EAGAIN && !SSL_pending(sslsock->ssl_handle));
/* EOF unless the SSL layer just needs to wait. */
stream->eof = (retry == 0
&& err != SSL_ERROR_WANT_READ && err != SSL_ERROR_WANT_WRITE
&& !SSL_pending(sslsock->ssl_handle));
}

/* Don't loop indefinitely in non-blocking mode if no data is available */
Expand Down
Loading