程序设计 – 微宇宙

PHP – OpenSSL 生成CA私钥&证书及签发带SAN的证书

生成CA私钥及证书：

参考Example #1 Creating a self-signed certificate

使用上面的方法可以生成CA证书并使用，但是如果使用上面的方法直接生成的自签名域名证书，即使你把（CA）证书加入到了受信任的根证书列表，也不会受浏览器信任：

NET::ERR_CERT_COMMON_NAME_INVALID

此服务器无法证实它就是 localhost – 它的安全证书没有指定主题备用名称。这可能是因为某项配置有误或某个攻击者拦截了您的连接。

你还需要把域名加入到SAN。

首先生成OpenSSL的配置文件：

// Domain name place at common name doesn't work on some browsers, you need to put them into SAN
$dnsNames = [
    "localhost",
    "127.0.0.1",
    "::1",
];

$opensslConfigurationFilePath = sprintf("%s/%s.%s.%s.conf", sys_get_temp_dir(), "openssl", mt_rand(1000000, 9999999), time());

// Create openssl.conf file
$oldUmask = umask(0077);
$opensslConfigurationFilePointer = fopen($opensslConfigurationFilePath, "w+");
umask($oldUmask);

// Write basic configurations
fwrite($opensslConfigurationFilePointer, <<<EOF
[req]
req_extensions = extension_section
x509_extensions	= extension_section
distinguished_name = dn

[dn]

[extension_section]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
EOF
);

// Write SANs
foreach ($dnsNames as $key => $value) {
    fwrite($opensslConfigurationFilePointer, sprintf("\nDNS.%d = %s", $key + 1, $value));
}

// Close configuration pointer
fflush($opensslConfigurationFilePointer);
fclose($opensslConfigurationFilePointer);

$configurationArray = [
    "digest_alg" => "sha256",
    "config" => $opensslConfigurationFilePath, // Use $opensslConfigurationFilePath as configuration file
];

// Domain name place at common name doesn't work on some browsers, you need to put them into SAN

$dnsNames = [

"localhost",

"127.0.0.1",

"::1",

];

$opensslConfigurationFilePath = sprintf("%s/%s.%s.%s.conf", sys_get_temp_dir(), "openssl", mt_rand(1000000, 9999999), time());

// Create openssl.conf file

$oldUmask = umask(0077);

$opensslConfigurationFilePointer = fopen($opensslConfigurationFilePath, "w+");

umask($oldUmask);

// Write basic configurations

fwrite($opensslConfigurationFilePointer, <<<EOF

[req]

req_extensions = extension_section

x509_extensions = extension_section

distinguished_name = dn

[dn]

[extension_section]

basicConstraints = CA:FALSE

keyUsage = nonRepudiation, digitalSignature, keyEncipherment

subjectAltName = @alt_names

[alt_names]

EOF

);

// Write SANs

foreach ($dnsNames as $key => $value) {

fwrite($opensslConfigurationFilePointer, sprintf("\nDNS.%d = %s", $key + 1, $value));

}

// Close configuration pointer

fflush($opensslConfigurationFilePointer);

fclose($opensslConfigurationFilePointer);

$configurationArray = [

"digest_alg" => "sha256",

"config" => $opensslConfigurationFilePath, // Use $opensslConfigurationFilePath as configuration file

];

通过上一步生成的配置文件生成CSR：

// $dn = [...];
// $privkey = ...;

// Generate a certificate signing request with configurationArray 
$csr = openssl_csr_new($dn, $privkey, $configurationArray);

// $dn = [...];

// $privkey = ...;

// Generate a certificate signing request with configurationArray

$csr = openssl_csr_new($dn, $privkey, $configurationArray);

对CSR进行签名：

// $CACertFile = ...;
// $CAPrivateKeyFile = ...;

// Generate a cert
$x509 = openssl_csr_sign($csr, $CACertFile, $CAPrivateKeyFile, 3650, $configurationArray);

// $CACertFile = ...;

// $CAPrivateKeyFile = ...;

// Generate a cert

$x509 = openssl_csr_sign($csr, $CACertFile, $CAPrivateKeyFile, 3650, $configurationArray);

最后删除配置文件：

unlink($opensslConfigurationFilePath);

1	unlink($opensslConfigurationFilePath);

References:

https://secure.php.net/manual/en/function.openssl-csr-new.php

https://comm.support.ca.com/kb/adding-custom-x509-extensions-to-certificate-signing-requests/kb000042912

https://www.openssl.org/docs/manmaster/man5/x509v3_config.html#Basic-Constraints

https://github.com/openssl/openssl/blob/2cc7acd273bc39f1360aed52400d18bb65b88a95/apps/openssl.cnf#L36

https://bugs.php.net/bug.php?id=71050

https://stackoverflow.com/questions/30977264/subject-alternative-name-not-present-in-certificate

ERROR: failed to retrieve TCP_INFO for socket: Protocol not available (92)

php_source_dir="/usr/src/php-7.2.12"
sed -i "s/#define HAVE_LQ_TCP_INFO 1/\/\/ #define HAVE_LQ_TCP_INFO 1/g" ${php_source_dir}/main/php_config.h
make -j32 clean && make -j$(cat /proc/cpuinfo | grep "processor" | wc -l) && make -j32 install

php_source_dir="/usr/src/php-7.2.12"

sed -i "s/#define HAVE_LQ_TCP_INFO 1/\/\/ #define HAVE_LQ_TCP_INFO 1/g" ${php_source_dir}/main/php_config.h

make -j32 clean && make -j$(cat /proc/cpuinfo | grep "processor" | wc -l) && make -j32 install

PHP 7.2 compile on Debian Stretch

Libraries:

apt -y install \
    libcurl4-openssl-dev \
    libgd-dev \
    libsodium-dev \
    libxml2-dev \
    libpcre3-dev \
    libssl-dev \
    libsqlite3-dev \
    libzip-dev \
    libbz2-dev \
    libedit-dev \
    libxmlrpc-epi-dev \
    libxmlrpc-core-c3-dev \
    libxslt1-dev \
    libwebp-dev \
    libreadline-dev

apt -y install \

libcurl4-openssl-dev \

libgd-dev \

libsodium-dev \

libxml2-dev \

libpcre3-dev \

libssl-dev \

libsqlite3-dev \

libzip-dev \

libbz2-dev \

libedit-dev \

libxmlrpc-epi-dev \

libxmlrpc-core-c3-dev \

libxslt1-dev \

libwebp-dev \

libreadline-dev

Configure:

./configure \
    --prefix=/usr/local/php-7.2 \
    --build=x86_64-linux-gnu \
    --host=x86_64-linux-gnu \
    --config-cache --cache-file=$(pwd -P)/config.cache \
    --with-libdir=lib/x86_64-linux-gnu \
    --enable-cli \
    --enable-fpm \
    --with-config-file-path=\${prefix}/etc \
    --with-config-file-scan-dir=\${prefix}/etc/conf.d \
    --with-fpm-user=www-data \
    --with-fpm-group=www-data \
    --disable-debug \
    --with-pic \
    --with-layout=GNU \
    --with-pear \
    --enable-filter \
    --with-openssl=yes \
    --with-pcre-regex=/usr \
    --enable-hash \
    --with-mhash=/usr \
    --enable-libxml \
    --enable-session \
    --with-sodium \
    --with-zlib=/usr \
    --with-zlib-dir=/usr \
    \
    --enable-opcache \
    --enable-opcache-file \
    --enable-huge-code-pages \
    \
    --enable-mysqlnd \
    --enable-mysqlnd-compression-support \
    --with-zlib-dir=/usr \
    --with-mysqli=mysqlnd \
    --with-pdo-mysql=mysqlnd \
    \
    --with-sqlite3=/usr \
    --with-pdo-sqlite=/usr \
    \
    --enable-json \
    \
    --enable-intl \
    \
    --with-curl=/usr \
    \
    --with-bz2=/usr \
    \
    --with-gd=/usr \
    --with-jpeg-dir=/usr \
    --with-xpm-dir=/usr/X11R6 \
    --with-png-dir=/usr \
    --with-freetype-dir=/usr \
    --with-webp-dir=/usr \
    \
    --enable-mbstring \
    --enable-mbregex \
    --enable-mbregex-backtrack \
    \
    --with-libedit=/usr \
    \
    --enable-wddx \
    --enable-xml \
    --with-xsl=/usr \
    \
    --with-xmlrpc=/usr \
    --with-libxml-dir=/usr \
    \
    --enable-zip \
    --with-zlib-dir=/usr \
    --with-libzip=/usr \
    \
    --enable-calendar \
    --enable-ctype \
    --enable-exif \
    --enable-fileinfo \
    --enable-ftp \
    --with-openssl-dir=/usr \
    --with-gettext=/usr \
    --with-iconv \
    --enable-pdo \
    --enable-phar \
    --enable-pcntl \
    --enable-posix \
    --enable-shmop \
    --enable-sockets \
    --enable-sysvmsg \
    --enable-sysvsem \
    --enable-sysvshm \
    --enable-tokenizer

./configure \

--prefix=/usr/local/php-7.2 \

--build=x86_64-linux-gnu \

--host=x86_64-linux-gnu \

--config-cache --cache-file=$(pwd -P)/config.cache \

--with-libdir=lib/x86_64-linux-gnu \

--enable-cli \

--enable-fpm \

--with-config-file-path=\${prefix}/etc \

--with-config-file-scan-dir=\${prefix}/etc/conf.d \

--with-fpm-user=www-data \

--with-fpm-group=www-data \

--disable-debug \

--with-pic \

--with-layout=GNU \

--with-pear \

--enable-filter \

--with-openssl=yes \

--with-pcre-regex=/usr \

--enable-hash \

--with-mhash=/usr \

--enable-libxml \

--enable-session \

--with-sodium \

--with-zlib=/usr \

--with-zlib-dir=/usr \

--enable-opcache \

--enable-opcache-file \

--enable-huge-code-pages \

--enable-mysqlnd \

--enable-mysqlnd-compression-support \

--with-zlib-dir=/usr \

--with-mysqli=mysqlnd \

--with-pdo-mysql=mysqlnd \

--with-sqlite3=/usr \

--with-pdo-sqlite=/usr \

--enable-json \

--enable-intl \

--with-curl=/usr \

--with-bz2=/usr \

--with-gd=/usr \

--with-jpeg-dir=/usr \

--with-xpm-dir=/usr/X11R6 \

--with-png-dir=/usr \

--with-freetype-dir=/usr \

--with-webp-dir=/usr \

--enable-mbstring \

--enable-mbregex \

--enable-mbregex-backtrack \

--with-libedit=/usr \

--enable-wddx \

--enable-xml \

--with-xsl=/usr \

--with-xmlrpc=/usr \

--with-libxml-dir=/usr \

--enable-zip \

--with-zlib-dir=/usr \

--with-libzip=/usr \

--enable-calendar \

--enable-ctype \

--enable-exif \

--enable-fileinfo \

--enable-ftp \

--with-openssl-dir=/usr \

--with-gettext=/usr \

--with-iconv \

--enable-pdo \

--enable-phar \

--enable-pcntl \

--enable-posix \

--enable-shmop \

--enable-sockets \

--enable-sysvmsg \

--enable-sysvsem \

--enable-sysvshm \

--enable-tokenizer

Make

xmlrpc error 1:

/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:187:2: error: unknown type name 'XMLRPC_SERVER'
  XMLRPC_SERVER server_ptr;
  ^~~~~~~~~~~~~
/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:195:2: error: unknown type name 'STRUCT_XMLRPC_REQUEST_OUTPUT_OPTIONS'
  STRUCT_XMLRPC_REQUEST_OUTPUT_OPTIONS xmlrpc_out;
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

...
Makefile:1933: recipe for target 'ext/xmlrpc/xmlrpc-epi-php.lo' failed

/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:187:2: error: unknown type name 'XMLRPC_SERVER'

XMLRPC_SERVER server_ptr;

^~~~~~~~~~~~~

/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:195:2: error: unknown type name 'STRUCT_XMLRPC_REQUEST_OUTPUT_OPTIONS'

STRUCT_XMLRPC_REQUEST_OUTPUT_OPTIONS xmlrpc_out;

^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

...

Makefile:1933: recipe for target 'ext/xmlrpc/xmlrpc-epi-php.lo' failed

Open Makefile, add

-I/usr/include/xmlrpc-epi

1	-I/usr/include/xmlrpc-epi

to the line(1933) where the error occured.

xmlrpc error 2:

ext/xmlrpc/.libs/xmlrpc-epi-php.o: In function `destroy_server_data':
/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:268: undefined reference to `XMLRPC_ServerDestroy'
ext/xmlrpc/.libs/xmlrpc-epi-php.o: In function `zm_info_xmlrpc':

...

collect2: error: ld returned 1 exit status
Makefile:296: recipe for target 'sapi/cli/php' failed
make: *** [sapi/cli/php] Error 1

ext/xmlrpc/.libs/xmlrpc-epi-php.o: In function `destroy_server_data':

/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:268: undefined reference to `XMLRPC_ServerDestroy'

ext/xmlrpc/.libs/xmlrpc-epi-php.o: In function `zm_info_xmlrpc':

...

collect2: error: ld returned 1 exit status

Makefile:296: recipe for target 'sapi/cli/php' failed

make: *** [sapi/cli/php] Error 1

find

EXTRA_LIBS =

1	EXTRA_LIBS =

in Makefile, add to the end of the line

-lxmlrpc-epi

1	-lxmlrpc-epi

readline error:

sapi/phpdbg/.libs/phpdbg_cmd.o: In function `phpdbg_read_input':
/usr/src/php-7.2.12/sapi/phpdbg/phpdbg_cmd.c:765: undefined reference to `readline'
/usr/src/php-7.2.12/sapi/phpdbg/phpdbg_cmd.c:773: undefined reference to `add_history'
collect2: error: ld returned 1 exit status
Makefile:374: recipe for target 'sapi/phpdbg/phpdbg' failed
make: *** [sapi/phpdbg/phpdbg] Error 1
make: *** Waiting for unfinished jobs....

sapi/phpdbg/.libs/phpdbg_cmd.o: In function `phpdbg_read_input':

/usr/src/php-7.2.12/sapi/phpdbg/phpdbg_cmd.c:765: undefined reference to `readline'

/usr/src/php-7.2.12/sapi/phpdbg/phpdbg_cmd.c:773: undefined reference to `add_history'

collect2: error: ld returned 1 exit status

Makefile:374: recipe for target 'sapi/phpdbg/phpdbg' failed

make: *** [sapi/phpdbg/phpdbg] Error 1

make: *** Waiting for unfinished jobs....

Open Makefile, searc

PHPDBG_EXTRA_LIBS =

1	PHPDBG_EXTRA_LIBS =

add “-lreadline”:

PHPDBG_EXTRA_LIBS = -lreadline

1	PHPDBG_EXTRA_LIBS = -lreadline

解除clock_gettime@@GLIBC_2.17的依赖

在x86_64的Debian Jessie上交叉编译一个mipsel架构的程序，能静态链接的都静态链接了。

程序编译好传送到mipsel架构的设备上时，ldd查看库的依赖，却提示

/lib/mipsel-linux-gnu/libc.so.6: version `GLIBC_2.17' not found

1	/lib/mipsel-linux-gnu/libc.so.6: version `GLIBC_2.17' not found

(⊙﹏⊙)b

mipsel设备上运行着Debian Wheezy，使用的是glibc 2.13：

# /lib/mipsel-linux-gnu/libc.so.6 
GNU C Library (Debian EGLIBC 2.13-38+deb7u11) stable release version 2.13, by Roland McGrath et al.

1 2	# /lib/mipsel-linux-gnu/libc.so.6 GNU C Library (Debian EGLIBC 2.13-38+deb7u11) stable release version 2.13, by Roland McGrath et al.

尝试了更新到glibc 2.17，结果运行所有动态链接glibc的程序都提示Segmentation fault或Bus error，眼看要变砖!!!∑(ﾟДﾟノ)ノ，最后用一个静态链接版本的busybox救回来(￣▽￣)~*。

换到Wheezy再交叉编译？然而Debian的Wiki:

ヽ(ー_ー)ノ，还不想自己编译gcc。

查找了下资料，没找到让gcc链接到自定义libc的方法。

查找了下资料，根据此文章：http://blog.csdn.net/hbuxiaofei/article/details/46012833，发现我交叉编译的程序也是clock_gettime()函数导致的，但是这作者你只提供分析方法却不提供解决方案算什么意思ヽ(ー_ー)ノ。

找了下这个函数的资料，发现除了glibc外，动态链接库librt有独立提供这个函数: https://stackoverflow.com/questions/2418157/ubuntu-linux-c-error-undefined-reference-to-clock-gettime-and-clock-settim，于是在g++编译参数中加入了-lrt，编译完成后，把程序传送到mipsel架构的设备上，再次ldd，没有了”`GLIBC_2.17′ not found”的提示，程序运行正常，成功解除对glibc 2.17的依赖(oﾟ▽ﾟ)o ：

探讨C语言返回struct的实现

C语言基本类型的返回通过寄存器实现。

寄存器容量不大，一个结构体的大小不定，多塞几个成员，很容易就会超过寄存器的容量，不太可能通过寄存器一次性返回一个结构体。

把以下代码转为汇编，探个究竟:

// return_struct.c

struct the_struct {
        int num1;
        int num2;
        double num3;
        double num4;
        int *num_ptr1;
        int *num_ptr2;
};

struct the_struct fun() {
        struct the_struct the_struct1;
        the_struct1.num1 = 1;
        the_struct1.num2 = 2;
        return the_struct1;
}

int get_struct() {
        struct the_struct the_struct1 = fun();
        return the_struct1.num1 + 1;
}

// return_struct.c

struct the_struct {

int num1;

int num2;

double num3;

double num4;

int *num_ptr1;

int *num_ptr2;

};

struct the_struct fun() {

struct the_struct the_struct1;

the_struct1.num1 = 1;

the_struct1.num2 = 2;

return the_struct1;

}

int get_struct() {

struct the_struct the_struct1 = fun();

return the_struct1.num1 + 1;

}

优化后的代码可能比较晦涩，64位寄存器数量是32位的一倍，为了简便理解，关闭代码优化，并且转为32位汇编，命令:

bash # gcc -O0 -S -masm=intel -m32 return_struct.c

1	bash # gcc -O0 -S -masm=intel -m32 return_struct.c

结果:

        .file   "return_struct.c"
        .intel_syntax noprefix
        .text
        .globl  _fun
        .def    _fun;   .scl    2;      .type   32;     .endef
_fun:
        push    ebp
        mov     ebp, esp
        sub     esp, 32 ; 为结构体在栈帧中分配32字节内存
        mov     DWORD PTR [ebp-32], 1 ; *(ebp - 32) = 1
        mov     DWORD PTR [ebp-28], 2 ; *(ebp - 28) = 1
        ; ebp指向的位置储存着get_struct()函数的ebp值
        ; ebp+4指向返回地址
        ; ebp+8是get_struct()函数中结构体的指针
        mov     eax, DWORD PTR [ebp+8] ; eax = get_struct()函数中结构体的指针
        mov     edx, DWORD PTR [ebp-32] ; edx是fun()函数中结构体首DWORD的值
        mov     DWORD PTR [eax], edx ; *eax = edx，让get_struct()中的结构体第一个DWORD = edx
        ; 结构体剩余的其余值传值
        mov     edx, DWORD PTR [ebp-28]
        mov     DWORD PTR [eax+4], edx
        mov     edx, DWORD PTR [ebp-24]
        mov     DWORD PTR [eax+8], edx
        mov     edx, DWORD PTR [ebp-20]
        mov     DWORD PTR [eax+12], edx
        mov     edx, DWORD PTR [ebp-16]
        mov     DWORD PTR [eax+16], edx
        mov     edx, DWORD PTR [ebp-12]
        mov     DWORD PTR [eax+20], edx
        mov     edx, DWORD PTR [ebp-8]
        mov     DWORD PTR [eax+24], edx
        mov     edx, DWORD PTR [ebp-4]
        mov     DWORD PTR [eax+28], edx
        mov     eax, DWORD PTR [ebp+8]
        leave
        ret     4
        .globl  _get_struct
        .def    _get_struct;    .scl    2;      .type   32;     .endef
_get_struct:
        push    ebp
        mov     ebp, esp
        sub     esp, 40 ; 分配40字节内存
        lea     eax, [ebp-32] ; eax = ebp - 32，eax是结构体的指针
        mov     DWORD PTR [esp], eax ; *esp储存结构体的指针，即get_struct()函数栈顶是结构体的指针
        call    _fun
        sub     esp, 4
        mov     eax, DWORD PTR [ebp-32] ; (ebp - 32)是结构体的地址
        add     eax, 1
        leave
        ret
        .ident  "GCC: (GNU) 5.3.0"

.file "return_struct.c"

.intel_syntax noprefix

.text

.globl _fun

.def _fun; .scl 2; .type 32; .endef

_fun:

push ebp

mov ebp, esp

sub esp, 32 ; 为结构体在栈帧中分配32字节内存

mov DWORD PTR [ebp-32], 1 ; *(ebp - 32) = 1

mov DWORD PTR [ebp-28], 2 ; *(ebp - 28) = 1

; ebp指向的位置储存着get_struct()函数的ebp值

; ebp+4指向返回地址

; ebp+8是get_struct()函数中结构体的指针

mov eax, DWORD PTR [ebp+8] ; eax = get_struct()函数中结构体的指针

mov edx, DWORD PTR [ebp-32] ; edx是fun()函数中结构体首DWORD的值

mov DWORD PTR [eax], edx ; *eax = edx，让get_struct()中的结构体第一个DWORD = edx

; 结构体剩余的其余值传值

mov edx, DWORD PTR [ebp-28]

mov DWORD PTR [eax+4], edx

mov edx, DWORD PTR [ebp-24]

mov DWORD PTR [eax+8], edx

mov edx, DWORD PTR [ebp-20]

mov DWORD PTR [eax+12], edx

mov edx, DWORD PTR [ebp-16]

mov DWORD PTR [eax+16], edx

mov edx, DWORD PTR [ebp-12]

mov DWORD PTR [eax+20], edx

mov edx, DWORD PTR [ebp-8]

mov DWORD PTR [eax+24], edx

mov edx, DWORD PTR [ebp-4]

mov DWORD PTR [eax+28], edx

mov eax, DWORD PTR [ebp+8]

leave

ret 4

.globl _get_struct

.def _get_struct; .scl 2; .type 32; .endef

_get_struct:

push ebp

mov ebp, esp

sub esp, 40 ; 分配40字节内存

lea eax, [ebp-32] ; eax = ebp - 32，eax是结构体的指针

mov DWORD PTR [esp], eax ; *esp储存结构体的指针，即get_struct()函数栈顶是结构体的指针

call _fun

sub esp, 4

mov eax, DWORD PTR [ebp-32] ; (ebp - 32)是结构体的地址

add eax, 1

leave

ret

.ident "GCC: (GNU) 5.3.0"

汇编代码已写上注释。

在get_struct()函数中，调用fun()之前，会首先把get_struct()函数中要接收返回值的地址压入栈中。

在fun()中，要返回值时，直接从get_struct()的栈帧取得保存结构体值的地址，直接对get_struct()的栈帧进行操作。

总的来说，一个函数要返回一个结构体，则从调用者函数的栈帧中取得接收结构体的地址（被赋值结构体的指针），直接对调用者函数的栈帧进行修改。