OpenSSL 3: Support of SSL_OP_IGNORE_UNEXPECTED_EOF context option #8369

nrueckmann · 2022-04-14T08:56:16Z

Description

OpenSSL became more strict about unexpected EOF (not sending close notify) in 1.1.1e but reverted that change in 1.1.1f due to the huge amount of non-compliant servers. With the new major release 3.0.0 it came back. See openssl/openssl#11378 for more details.

Unfortunately, the situation of non-compliant servers did not change. And with OpenSSL 3 being the default version of Ubuntu 22.04 (and other distributions) the issue will raise more frequently.

I propose to add a new SSL context option ignore_unexpected_eof to set the SSL_OP_IGNORE_UNEXPECTED_EOF bit.

Documentation: https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_options.html#SSL_OP_IGNORE_UNEXPECTED_EOF

The text was updated successfully, but these errors were encountered:

nrueckmann · 2022-04-14T08:59:40Z

Example of an non-compliant server:

www-data@4e07da05c0ce:~/html$ php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());"
PHP Warning:  file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:0A000126:SSL routines::unexpected eof while reading in Command line code on line 1
PHP Warning:  file_get_contents(): SSL: Success in Command line code on line 1

cmb69 · 2022-04-14T11:32:57Z

Yeah, this issue already came up as https://bugs.php.net/bug.php?id=79589, and needs to be addressed.

@bukka, thoughts?

nrueckmann · 2022-04-14T11:55:15Z

Thank you for your response. Sorry for not checking bugs.php.net. I've only searched github for this issue.

cmb69 · 2022-04-14T12:12:34Z

Sorry for not checking bugs.php.net.

That's totally fine. :)

kocoten1992 · 2022-04-27T15:11:29Z

upgraded to ubuntu 22.04 today and run into this error 👍

file_put_contents(): SSL operation failed with code 1. OpenSSL Error messages:  
  error:0A000126:SSL routines::unexpected eof while reading

bukka · 2022-04-28T22:16:25Z

I have got this quite high on my TODO list so hopefully it won't take me too long to pick this up. I think that flag might be the best option but it will also need a test which will be probably hardest part on this fix.

bukka · 2022-04-28T22:20:15Z

Although maybe not the best idea to always add that option as it can potentially lead to the truncation attack so we might just make it optional somehow. Will need to think about it when I get to it.

nrueckmann · 2022-04-30T21:37:38Z

Although maybe not the best idea to always add that option as it can potentially lead to the truncation attack so we might just make it optional somehow. Will need to think about it when I get to it.

That's the feature request i've tried to describe. Having an option which can be (optionally) passed to the context. Same like we are doing with all other options (https://www.php.net/manual/en/context.ssl.php).

temporary fix php/php-src#8369

pieterza · 2022-05-12T16:23:50Z

We'd also like this fix please.

batata004 · 2022-05-12T18:53:19Z

Me too, I would like this bug to be fixed. It's pretty annoying. BTW, the temporary fix changing the openssl.cnf file does not work on Centos, only on certain Ubuntu (some people even on Ubuntu are facing this problem using the fix suggested).

pieterza · 2022-05-12T18:58:35Z

Me too, I would like this bug to be fixed. It's pretty annoying. BTW, the temporary fix changing the openssl.cnf file does not work on Centos, only on Ubuntu

Hehe.

That workaround did not work for me on Ubuntu 22.04 either...

Easy way to test:

php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());"

Returns:

file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:0A000126:SSL routines::unexpected eof while reading

batata004 · 2022-05-12T20:07:19Z

Me too, I would like this bug to be fixed. It's pretty annoying. BTW, the temporary fix changing the openssl.cnf file does not work on Centos, only on Ubuntu

Hehe.

That workaround did not work for me on Ubuntu 22.04 either...

Easy way to test:
php -r "echo file_get_contents('https://chromedriver.storage.googleapis.com/LATEST_RELEASE', false, stream_context_create());"
Returns:
file_get_contents(): SSL operation failed with code 1. OpenSSL Error messages:
error:0A000126:SSL routines::unexpected eof while reading

Sorry, I edited my comment. Indeed, the fix suggested does not work for all people on Ubuntu, some people are reporting the fix does not work at all on Ubuntu (on Centos I cant find a single person that made the fix work).

bukka · 2022-05-12T21:45:15Z

I will prioritise this and will start looking into it in the next few days.

bukka · 2022-05-13T20:06:36Z

So I just checked what Python does and they added the flag by default: python/cpython@6f37ebc . Also same for nginx https://hg.nginx.org/nginx/rev/1a03af395f44 .

Considering our users and the amount of non complaint server I tend to think that we should do the same at least for 8.1 and maybe few more other versions so we also have it consistent between supported OpenSSL versions.

pieterza · 2022-05-14T08:00:05Z

So I just checked what Python does and they added the flag by default: python/cpython@6f37ebc . Also same for nginx https://hg.nginx.org/nginx/rev/1a03af395f44 .

Considering our users and the amount of non complaint server I tend to think that we should do the same at least for 8.1 and maybe few more other versions so we also have it consistent between supported OpenSSL versions.

Great news!
May I request it also at least being something we can toggle for 8.0, or target 8.0 as default ?🙏

The unexpected EOF failure was introduced in OpenSSL 3.0 to prevent truncation attack. However there are many non complaint servers and it is causing break for many users including those where truncation attack is not an issue becuase it would break format parsing (e.g. JSON). we try to keep behavior consitent with older version which is also the path chosen by some other languages and web servers. Closes phpGH-8369

bukka · 2022-05-15T12:59:29Z

May I request it also at least being something we can toggle for 8.0, or target 8.0 as default ?

PHP 8.0 does not support OpenSSL 3.0 so it's not applicable there.

bukka · 2022-05-15T13:00:51Z

The fix is in #8558

The unexpected EOF failure was introduced in OpenSSL 3.0 to prevent truncation attack. However there are many non complaint servers and it is causing break for many users including potential majority of those where the truncation attack is not applicable. For that reason we try to keep behavior consitent with older OpenSSL versions which is also the path chosen by some other languages and web servers. Closes phpGH-8369

bukka · 2022-05-15T13:18:13Z

I have been also thinking about the truncation attack in our context and think it's not likely applicable to majority of the use cases. Even though I think that secure by default is what we should do, this might be an exception to this rule considering the amount of non complaint servers, problems this caused and potentially small attack vector. Therefore I think we could later just introduce an option in master to explicitly enable failure on missing close notify rather than thinking to re-enable this again by default.

SoftCreatR · 2022-05-15T13:37:42Z

May I request it also at least being something we can toggle for 8.0, or target 8.0 as default ?

PHP 8.0 does not support OpenSSL 3.0 so it's not applicable there.

But it works fine (except for the problem discussed here).

bukka · 2022-05-15T15:41:35Z

It's probably patched by distro because PHP-8.0 branch doesn't even compile with OpenSSL 3.0.

codgunt · 2022-06-09T17:06:16Z

Just wanting to note for anyone that is like me waiting on the fix, that theoretically this will be showing up in distros shortly as it is included in PHP 8.1.7:

https://www.php.net/ChangeLog-8.php#8.1.7

Older versions though will probably need manual patching.

batata004 · 2022-06-09T17:07:38Z

Thank you! I already updated twice my PHP version and the bug is still present. Hope on the next relase it gets fixed.

datenfalke · 2022-06-15T09:54:31Z

Working again on my Kubuntu 22.04 development system running PHP 7.4 using a reCaptcha widget for login which failed before.

Ubuntu 22.04 comes with OpenSSL 3, and the specific version that PHP is built against has a bug which has since been fixed but isn't showing up in the images that GitHub has available. See openssl/openssl#18574 and php/php-src#8369

nrueckmann added Feature Status: Needs Triage labels Apr 14, 2022

cmb69 added the Extension: openssl label Apr 14, 2022

TimWolla mentioned this issue May 2, 2022

https streams on Ubuntu 22.04 might emit PHP warnings during fread() guzzle/psr7#504

Closed

kocoten1992 mentioned this issue May 5, 2022

Warning message when using file_get_contents on hosts with HTTPS #8493

Closed

kocoten1992 added a commit to kocoten1992/laravel-geoip that referenced this issue May 5, 2022

fix: temporary fix openssl issue on some machine

99ad4fe

temporary fix php/php-src#8369

kocoten1992 mentioned this issue May 5, 2022

fix: temporary fix openssl issue on some machine Torann/laravel-geoip#217

Open

bukka mentioned this issue May 15, 2022

Fix bug #79589: ssl3_read_n:unexpected eof while reading #8558

Closed

bukka closed this as completed in 74f75db May 15, 2022

euperia mentioned this issue May 27, 2022

Chromedriver install fails with SSL operation failed with code 1. OpenSSL Error messages: error:0A000126:SSL routines::unexpected eof while reading laravel/dusk#979

Closed

dzuelke mentioned this issue Jul 1, 2022

[BUG] redis-server TLS connection close breaks OpenSSL 3 clients redis/redis#10915

Closed

edmorley mentioned this issue Jul 6, 2022

SSL_read: unexpected eof while reading using redis-rb on Heroku-22 heroku/base-images#220

Closed

LordSimal mentioned this issue Jul 15, 2022

Test using ubuntu 22.04 image cakephp/cakephp#16612

Closed

guillemmateos mentioned this issue Nov 4, 2022

Error code 0x2746 microsoft/msphpsql#1419

Closed

AutisticShark mentioned this issue Nov 6, 2022

[BUG]11月安装包Dailyjob报错 Anankke/SSPanel-UIM#1661

Closed

walkonthemarz mentioned this issue Jan 4, 2023

cURL: Support of SSL_OP_IGNORE_UNEXPECTED_EOF context option #10215

Closed

icing mentioned this issue Apr 17, 2024

curl 56 SSL_read error erno 0 with openssl >= 3.2 & curl 8.7.1 curl/curl#13389

Closed

This was referenced Oct 12, 2024

[Bug] TLS error on connection hestiacp/hestiacp#3781

Open

Add new option tls_ignore_missing_close_notify Exim/exim#94

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OpenSSL 3: Support of SSL_OP_IGNORE_UNEXPECTED_EOF context option #8369

OpenSSL 3: Support of SSL_OP_IGNORE_UNEXPECTED_EOF context option #8369

nrueckmann commented Apr 14, 2022

nrueckmann commented Apr 14, 2022

cmb69 commented Apr 14, 2022

nrueckmann commented Apr 14, 2022

cmb69 commented Apr 14, 2022

kocoten1992 commented Apr 27, 2022 •

edited

Loading

bukka commented Apr 28, 2022

bukka commented Apr 28, 2022

nrueckmann commented Apr 30, 2022

pieterza commented May 12, 2022

batata004 commented May 12, 2022 •

edited

Loading

pieterza commented May 12, 2022 •

edited

Loading

batata004 commented May 12, 2022

bukka commented May 12, 2022

bukka commented May 13, 2022 •

edited

Loading

pieterza commented May 14, 2022 •

edited

Loading

bukka commented May 15, 2022

bukka commented May 15, 2022 •

edited

Loading

bukka commented May 15, 2022

SoftCreatR commented May 15, 2022

bukka commented May 15, 2022 •

edited

Loading

codgunt commented Jun 9, 2022

batata004 commented Jun 9, 2022

datenfalke commented Jun 15, 2022

OpenSSL 3: Support of SSL_OP_IGNORE_UNEXPECTED_EOF context option #8369

OpenSSL 3: Support of SSL_OP_IGNORE_UNEXPECTED_EOF context option #8369

Comments

nrueckmann commented Apr 14, 2022

Description

nrueckmann commented Apr 14, 2022

cmb69 commented Apr 14, 2022

nrueckmann commented Apr 14, 2022

cmb69 commented Apr 14, 2022

kocoten1992 commented Apr 27, 2022 • edited Loading

bukka commented Apr 28, 2022

bukka commented Apr 28, 2022

nrueckmann commented Apr 30, 2022

pieterza commented May 12, 2022

batata004 commented May 12, 2022 • edited Loading

pieterza commented May 12, 2022 • edited Loading

batata004 commented May 12, 2022

bukka commented May 12, 2022

bukka commented May 13, 2022 • edited Loading

pieterza commented May 14, 2022 • edited Loading

bukka commented May 15, 2022

bukka commented May 15, 2022 • edited Loading

bukka commented May 15, 2022

SoftCreatR commented May 15, 2022

bukka commented May 15, 2022 • edited Loading

codgunt commented Jun 9, 2022

batata004 commented Jun 9, 2022

datenfalke commented Jun 15, 2022

kocoten1992 commented Apr 27, 2022 •

edited

Loading

batata004 commented May 12, 2022 •

edited

Loading

pieterza commented May 12, 2022 •

edited

Loading

bukka commented May 13, 2022 •

edited

Loading

pieterza commented May 14, 2022 •

edited

Loading

bukka commented May 15, 2022 •

edited

Loading

bukka commented May 15, 2022 •

edited

Loading