Merge ~athos-ribeiro/ubuntu/+source/php8.1:fix-ss3-eof-jammy into ubuntu/+source/php8.1:ubuntu/jammy-devel

[Athos Ribeiro]

Jammy SRU proposal for LP: #1975626.

This should be a straightforward upstream patch as described in the SRU bug.

PPA: https://launchpad.net/~athos-ribeiro/+archive/ubuntu/lp1975626-php-ssl3-eof/+packages

I will update this MP with the autopkgtest results as soon as I get them.

[Bryce Harrington (bryce)]

Change itself LGTM, and assuming the tests results are good, +1. A couple text suggestions:

For the changelog entry, I think it would be beneficial to add a sentence or so of extra explanation to help users understand if their system is affected. Sounds like they would see an error message like 'SSL routines::unexpected eof...' so might be worth mentioning that. Can we also specify what version introduced the security fix that caused the regression?

For the SRU text, one typo in the Impact section: 'non complaint' -> 'non-compliant'. Rest of the text looks solid.

review: Approve

[git-ubuntu bot (git-ubuntu-bot)]

Approvers: athos-ribeiro, bryce
Uploaders: athos-ribeiro, bryce
MP auto-approved

review: Approve

[Athos Ribeiro (athos-ribeiro)]

Thanks for the review, Bryce. I fixed the SRU text. I will fix the changelog entry with your suggestions and upload it.

Local dep8 test result summary:

autopkgtest [17:44:36]: @@@@@@@@@@@@@@@@@@@@ summary
cli PASS
cgi PASS
mod-php PASS
fpm PASS

[Athos Ribeiro (athos-ribeiro)]

Updated changelog and SRU text and uploaded the package.

$ dput ubuntu ../php8.1_8.1.2-1ubuntu2.2_source.changes
D: Setting host argument.
Checking signature on .changes
gpg: ../php8.1_8.1.2-1ubuntu2.2_source.changes: Valid signature from 033C4CA276024834
Checking signature on .dsc
gpg: ../php8.1_8.1.2-1ubuntu2.2.dsc: Valid signature from 033C4CA276024834
Uploading to ubuntu (via ftp to upload.ubuntu.com):
  Uploading php8.1_8.1.2-1ubuntu2.2.dsc: done.
  Uploading php8.1_8.1.2-1ubuntu2.2.debian.tar.xz: done.
  Uploading php8.1_8.1.2-1ubuntu2.2_source.buildinfo: done.
  Uploading php8.1_8.1.2-1ubuntu2.2_source.changes: done.
Successfully uploaded packages.

[Athos Ribeiro (athos-ribeiro)]

There was a security change in php8.1 during the SRU process for this one. I re-based it on top of the new security changes and re-uploaded, as requested by Steve.

diff --git a/debian/changelog b/debian/changelog
index 062da46..7635e9e 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+php8.1 (8.1.2-1ubuntu2.3) jammy; urgency=medium
+
+  * d/p/0046-Fix-ssl3-unexpected-eof.patch: fix OpenSSL3 related unexpected
+    EOF failure. This patch was originally introduced in PHP 8.1.7 to maintain
+    compatibility with servers that are not yet compatible with new OpenSSL 3
+    changes. This lack of compatibility would result in errors like
+    "error:0A000126:SSL routines::unexpected eof while reading in LOCATION".
+    (LP: #1975626)
+
+ -- Athos Ribeiro <[e-mail]>  Mon, 15 Aug 2022 09:24:10 -0300
+
 php8.1 (8.1.2-1ubuntu2.2) jammy-security; urgency=medium
 
   * SECURITY UPDATE: Memory corruption in libmagic
diff --git a/debian/patches/0046-Fix-ssl3-unexpected-eof.patch b/debian/patches/0046-Fix-ssl3-unexpected-eof.patch
new file mode 100644
index 0000000..9e1d08b
--- /dev/null
+++ b/debian/patches/0046-Fix-ssl3-unexpected-eof.patch
@@ -0,0 +1,76 @@
+From 74f75db0c3665677ec006cd379fd561feacffdc6 Mon Sep 17 00:00:00 2001
+From: Jakub Zelenka <[e-mail]>
+Date: Sun, 15 May 2022 13:49:17 +0100
+Subject: Fix bug #79589: ssl3_read_n:unexpected eof while reading
+
+The unexpected EOF failure was introduced in OpenSSL 3.0 to prevent
+truncation attack. However there are many non complaint servers and
+it is causing break for many users including potential majority
+of those where the truncation attack is not applicable. For that reason
+we try to keep behavior consitent with older OpenSSL versions which is
+also the path chosen by some other languages and web servers.
+
+Closes GH-8369
+
+Bug: https://github.com/php/php-src/issues/8369
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/php8.1/+bug/1975626
+Last-Update: 2022-06-11
+Origin: upstream, https://github.com/php/php-src/commit/74f75db0c3665677ec006cd379fd561feacffdc6
+---
+ NEWS                            |  4 ++++
+ ext/openssl/tests/bug79589.phpt | 21 +++++++++++++++++++++
+ ext/openssl/xp_ssl.c            |  5 +++++
+ 3 files changed, 30 insertions(+)
+ create mode 100644 ext/openssl/tests/bug79589.phpt
+
+--- a/NEWS
++++ b/NEWS
+@@ -356,6 +356,10 @@
+   . Added the Ristretto255 functions, which are available in libsodium 1.0.18.
+     (P.I.E. Security Team)
+ 
++- OpenSSL:
++  . Fixed bug #79589 (error:14095126:SSL routines:ssl3_read_n:unexpected eof
++    while reading). (Jakub Zelenka)
++
+ - SPL:
+   . Fixed bug #66588 (SplFileObject::fgetcsv incorrectly returns a row on
+     premature EOF). (Aliaksandr Bystry)
+--- /dev/null
++++ b/ext/openssl/tests/bug79589.phpt
+@@ -0,0 +1,21 @@
++--TEST--
++Bug #65538: TLS unexpected EOF failure
++--EXTENSIONS--
++openssl
++--SKIPIF--
++<?php
++if (getenv("SKIP_ONLINE_TESTS")) die("skip online test");
++?>
++--FILE--
++<?php
++
++$release = file_get_contents(
++    'https://chromedriver.storage.googleapis.com/LATEST_RELEASE',
++    false,
++    stream_context_create(['ssl' => ['verify_peer'=> false]])
++);
++echo gettype($release);
++
++?>
++--EXPECT--
++string
+--- a/ext/openssl/xp_ssl.c
++++ b/ext/openssl/xp_ssl.c
+@@ -1648,6 +1648,11 @@
+ 
+ 	ssl_ctx_options &= ~SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
+ 
++#ifdef SSL_OP_IGNORE_UNEXPECTED_EOF
++	/* Only for OpenSSL 3+ to keep OpenSSL 1.1.1 behavior */
++	ssl_ctx_options |= SSL_OP_IGNORE_UNEXPECTED_EOF;
++#endif
++
+ 	if (!GET_VER_OPT("disable_compression") || zend_is_true(val)) {
+ 		ssl_ctx_options |= SSL_OP_NO_COMPRESSION;
+ 	}
diff --git a/debian/patches/series b/debian/patches/series
index 60751c0..e21b06b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -43,6 +43,7 @@
 0043-Lower-the-OpenSSL-requirement-to-1.0.1.patch
 0044-Fail-the-build-when-the-dtrace-call-fails.patch
 0045-Override-result-of-AC_PROG_LN_S-to-fix-FTBFS-on-ppc6.patch
+0046-Fix-ssl3-unexpected-eof.patch
 CVE-2021-21708.patch
 CVE-2022-31625.patch
 CVE-2022-31626.patch