@@ -4525,6 +4525,27 @@ static zend_result php_openssl_setup_rsa_padding(EVP_PKEY_CTX *pctx, EVP_PKEY *p
45254525 return SUCCESS ;
45264526}
45274527
4528+ static zend_result php_openssl_setup_rsa_pss_salt_length (EVP_PKEY_CTX * pctx , EVP_PKEY * pkey , zend_long padding , zend_long salt_length )
4529+ {
4530+ /* Only apply if using PSS padding */
4531+ if (padding != RSA_PKCS1_PSS_PADDING ) {
4532+ return SUCCESS ;
4533+ }
4534+
4535+ /* Only apply to RSA keys */
4536+ if (EVP_PKEY_base_id (pkey ) != EVP_PKEY_RSA && EVP_PKEY_base_id (pkey ) != EVP_PKEY_RSA_PSS ) {
4537+ return SUCCESS ;
4538+ }
4539+
4540+ if (EVP_PKEY_CTX_set_rsa_pss_saltlen (pctx , (int )salt_length ) <= 0 ) {
4541+ php_openssl_store_errors ();
4542+ php_error_docref (NULL , E_WARNING , "Could not set RSA-PSS salt length" );
4543+ return FAILURE ;
4544+ }
4545+
4546+ return SUCCESS ;
4547+ }
4548+
45284549/* {{{ Signs data */
45294550PHP_FUNCTION (openssl_sign )
45304551{
@@ -4538,16 +4559,18 @@ PHP_FUNCTION(openssl_sign)
45384559 zend_long method_long = OPENSSL_ALGO_SHA1 ;
45394560 const EVP_MD * mdtype ;
45404561 zend_long padding = 0 ;
4562+ zend_long salt_length = RSA_PSS_SALTLEN_AUTO ;
45414563 EVP_PKEY_CTX * pctx ;
45424564 bool can_default_digest = ZEND_THREEWAY_COMPARE (PHP_OPENSSL_API_VERSION , 0x30000 ) >= 0 ;
45434565
4544- ZEND_PARSE_PARAMETERS_START (3 , 5 )
4566+ ZEND_PARSE_PARAMETERS_START (3 , 6 )
45454567 Z_PARAM_STRING (data , data_len )
45464568 Z_PARAM_ZVAL (signature )
45474569 Z_PARAM_ZVAL (key )
45484570 Z_PARAM_OPTIONAL
45494571 Z_PARAM_STR_OR_LONG (method_str , method_long )
45504572 Z_PARAM_LONG (padding )
4573+ Z_PARAM_LONG (salt_length )
45514574 ZEND_PARSE_PARAMETERS_END ();
45524575
45534576 pkey = php_openssl_pkey_from_zval (key , 0 , "" , 0 , 3 );
@@ -4568,12 +4591,14 @@ PHP_FUNCTION(openssl_sign)
45684591 php_error_docref (NULL , E_WARNING , "Unknown digest algorithm" );
45694592 RETURN_FALSE ;
45704593 }
4594+ PHP_OPENSSL_CHECK_LONG_TO_INT (salt_length , salt_length , 6 );
45714595
45724596 md_ctx = EVP_MD_CTX_create ();
45734597 size_t siglen ;
45744598 if (md_ctx != NULL &&
45754599 EVP_DigestSignInit (md_ctx , & pctx , mdtype , NULL , pkey ) &&
45764600 php_openssl_setup_rsa_padding (pctx , pkey , padding ) == SUCCESS &&
4601+ php_openssl_setup_rsa_pss_salt_length (pctx , pkey , padding , salt_length ) == SUCCESS &&
45774602 EVP_DigestSign (md_ctx , NULL , & siglen , (unsigned char * )data , data_len ) &&
45784603 (sigbuf = zend_string_alloc (siglen , 0 )) != NULL &&
45794604 EVP_DigestSign (md_ctx , (unsigned char * )ZSTR_VAL (sigbuf ), & siglen , (unsigned char * )data , data_len )) {
@@ -4607,19 +4632,22 @@ PHP_FUNCTION(openssl_verify)
46074632 zend_string * method_str = NULL ;
46084633 zend_long method_long = OPENSSL_ALGO_SHA1 ;
46094634 zend_long padding = 0 ;
4635+ zend_long salt_length = RSA_PSS_SALTLEN_AUTO ;
46104636 EVP_PKEY_CTX * pctx ;
46114637 bool can_default_digest = ZEND_THREEWAY_COMPARE (PHP_OPENSSL_API_VERSION , 0x30000 ) >= 0 ;
46124638
4613- ZEND_PARSE_PARAMETERS_START (3 , 5 )
4639+ ZEND_PARSE_PARAMETERS_START (3 , 6 )
46144640 Z_PARAM_STRING (data , data_len )
46154641 Z_PARAM_STRING (signature , signature_len )
46164642 Z_PARAM_ZVAL (key )
46174643 Z_PARAM_OPTIONAL
46184644 Z_PARAM_STR_OR_LONG (method_str , method_long )
46194645 Z_PARAM_LONG (padding )
4646+ Z_PARAM_LONG (salt_length )
46204647 ZEND_PARSE_PARAMETERS_END ();
46214648
46224649 PHP_OPENSSL_CHECK_SIZE_T_TO_UINT (signature_len , signature , 2 );
4650+ PHP_OPENSSL_CHECK_LONG_TO_INT (salt_length , salt_length , 6 );
46234651
46244652 if (method_str ) {
46254653 mdtype = php_openssl_get_evp_md_by_name (ZSTR_VAL (method_str ));
@@ -4648,7 +4676,8 @@ PHP_FUNCTION(openssl_verify)
46484676 }
46494677
46504678 if (!EVP_DigestVerifyInit (md_ctx , & pctx , mdtype , NULL , pkey ) ||
4651- php_openssl_setup_rsa_padding (pctx , pkey , padding ) == FAILURE ) {
4679+ php_openssl_setup_rsa_padding (pctx , pkey , padding ) == FAILURE ||
4680+ php_openssl_setup_rsa_pss_salt_length (pctx , pkey , padding , salt_length ) == FAILURE ) {
46524681 php_openssl_store_errors ();
46534682 err = -1 ;
46544683 goto cleanup ;
0 commit comments