| Summary | PHP 5.6 and IMAP/SMTP connection with TLSv1.2 not working |
| Queue | Horde Framework Packages |
| Type | Enhancement |
| State | Resolved |
| Priority | 1. Low |
| Owners | jan (at) horde (dot) org |
| Requester | john.kramer (at) neys (dot) org |
| Created | 12/12/2015 (3547 days ago) |
| Due | |
| Updated | 12/14/2015 (3545 days ago) |
| Assigned | 12/14/2015 (3545 days ago) |
| Resolved | 12/14/2015 (3545 days ago) |
| Milestone | Socket_Client 1.2.0 |
| Patch | No |
State ⇒ Resolved
commit 3a9a8c7d10cdc78f735fbf865d74f5f7ae1c6c15
Author: Jan Schneider <jan@horde.org>
Date: Mon Dec 14 12:03:13 2015 +0100
[jan] Enable TLS 1.1 and 1.2 connections (
Request #14190)..../Socket_Client/lib/Horde/Socket/Client.php | 17 ++++++++++++-----
framework/Socket_Client/package.xml | 12 ++++++------
2 files changed, 18 insertions(+), 11 deletions(-)
http://github.com/horde/horde/commit/3a9a8c7d10cdc78f735fbf865d74f5f7ae1c6c15
State ⇒ Assigned
Type ⇒ Enhancement
Priority ⇒ 1. Low
Type ⇒ Bug
Summary ⇒ PHP 5.6 and IMAP/SMTP connection with TLSv1.2 not working
Queue ⇒ Horde Framework Packages
Milestone ⇒
Patch ⇒ No
State ⇒ Unconfirmed
with TLSv1.2. Setting 'secure' => 'tls' just leads to TLSv1.0.
STREAM_CRYPTO_METHOD_TLS_CLIENT is the source of the problem. As
https://wiki.php.net/rfc/improved-tls-defaults states under "Stream
Wrapper Creep":
consistency problem. Do all users understand that the ssl wrapper
technically can negotiate any of the supported protocols? Do they
know that in contrast the tls wrapper will only negotiate TLSv1 and
not the newer TLS iterations?
[SNIP]
The existing constants are internally re-valued as shown below to
allow their use as bitwise flags. Because the existing code
delineates between clients and servers the least significant bit is
used to differentiate between the two stream types.
1), /* Any TLS protocol */
It seems there is a bug/feature?
http://grokbase.com/t/php/php-bugs/1541c7f5jy/php-bug-bug-69345-new-tls-wrapper-disables-tls-1-1
Hard coding STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT or
STREAM_CRYPTO_METHOD_SSLv23_CLIENT in Horde/Socket/Client.php upgrades
the imap/smtp connections to TLSv1.2.
Since this exists as of PHP 5.5 I guess it will not change soon. Is
there a chance to make Horde/Socket/Client.php capable of recognizing
the PHP version or just trying newer protocols first?
Maybe something like this (https://github.com/pear/Net_SMTP/pull/22)
can solve the problem.
More information to the problem:
http://lists.horde.org/archives/imp/Week-of-Mon-20151207/057059.html