ext/ftp: cryptic error on servers that don't support TLS session resumption on data connection

Description

The following code:

<?php
$conn_id = ftp_ssl_connect($url);
$login_result = ftp_login($conn_id, $un, $pw);
ftp_set_option($conn_id, FTP_USEPASVADDRESS, false);
ftp_pasv($conn_id, true);

if (!$login_result) {
    die("can't login\n");
}
else{
    echo "logged in success\n";
    $buff = ftp_nlist($conn_id,'outbound');
    var_dump($buff);
}

Resulted in this output:

logged in success
Warning: ftp_nlist: data_accept: failed to retrieve the existing SSL session

But I expected this output instead:

logged in success
[nlist output]

TLS session resumption on the data connection is required for it to be secure. GH-12851 fixed that. However, some servers don't seem to support TLS session resumption. In this case, PHP seems to fail with a cryptic-to-the-user error message. However, other FTP clients like i.e. FileZilla will prompt the user with a message like:

This server does not support TLS session resumption on the data connection.
TLS session resumption on the data connection is an important security feature to protect against data connection stealing attacks.
If you continue, transferred files may be intercepted or their contents replaced by an attacker.

I don't know if we want to support opting out of the behaviour (and certainly not continue insecurely silently), but we should definitely provide a better warning here, so users know what's wrong and what to blame.

A user reached out to me for support because this was "working" in PHP 8.1 (insecurely. probably) but stopped working when they upgraded to PHP 8.5, and thought it was a PHP issue. They did try it under 8.2.12 (last version XAMPP shipped) and that worked, and that was prior to when that PR was merged. I'm asking the user to bisect 8.2.13 vs. 8.2.14 to confirm.

As for the problematic FTP server in question, it seems to be Axway SecureTransport as installed by a large logistics company. A little hard to test for ourselves, and a little hard to get them to fix it. I don't know if we can force i.e. vsftpd to disallow session resumption to test it.

PHP Version

PHP 8.5.9

Operating System

Windows Server 2019

Start in ext/ftp at the ftp_nlist data-connection path and the data_accept failure that reports the TLS session error. Reproduce with the PHP 8.5.9 example and inspect how the warning is formed; done means users receive a clear explanation that TLS session resumption is unsupported, without silently continuing insecurely.