fix: remove PHPStan error suppressions for TLS methods

Configure the crypto method bitmask through the SSL context before enabling
TLS, using the context fallback supported since before PHP 7.1. This keeps
combined protocol flags working without relying on PHPStan's incomplete
third-argument signature.

Remove ignoreErrors and reportUnmatchedIgnoredErrors overrides, and cover
both single and combined TLS methods for client and server connections.

Author: shuvroroy

phpstan.neon.dist

@@ -5,10 +5,3 @@ parameters:
     phpVersion: 70100
     # Retain runtime guards for older supported Promise implementations.
     treatPhpDocTypesAsCertain: false
-    # The crypto bitmask signature is already correct in older PHPStan releases.
-    reportUnmatchedIgnoredErrors: false
-    ignoreErrors:
-        # PHP accepts combined crypto flags; some PHPStan versions only list individual constants.
-        -
-            message: '#^Parameter \#3 \$crypto_method of function stream_socket_enable_crypto expects .+, int given\.$#'
-            path: src/StreamEncryption.php

src/StreamEncryption.php

@@ -125,7 +125,11 @@ public function toggleCrypto($socket, Deferred $deferred, bool $toggle, int $met
             return true;
         });
 
-        $result = \stream_socket_enable_crypto($socket, $toggle, $method);
+        if ($toggle) {
+            // Configure the full crypto bitmask through the SSL context, including combined protocol flags.
+            \stream_context_set_option($socket, 'ssl', 'crypto_method', $method);
+        }
+        $result = \stream_socket_enable_crypto($socket, $toggle);
 
         \restore_error_handler();
 

tests/FunctionalSecureServerTest.php

@@ -81,7 +81,8 @@ public function testClientUsesTls13ByDefaultWhenSupportedByOpenSSL()
         $server->close();
     }
 
-    public function testClientUsesTls12WhenCryptoMethodIsExplicitlyConfiguredByClient()
+    /** @dataProvider provideClientCryptoMethods */
+    public function testClientUsesTls12WhenCryptoMethodIsExplicitlyConfiguredByClient($method)
     {
         $server = new TcpServer(0);
         $server = new SecureServer($server, null, [
@@ -90,7 +91,7 @@ public function testClientUsesTls12WhenCryptoMethodIsExplicitlyConfiguredByClien
 
         $connector = new SecureConnector(new TcpConnector(), null, [
             'verify_peer' => false,
-            'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT
+            'crypto_method' => $method
         ]);
         $promise = $connector->connect($server->getAddress());
 
@@ -108,12 +109,21 @@ public function testClientUsesTls12WhenCryptoMethodIsExplicitlyConfiguredByClien
         $server->close();
     }
 
-    public function testClientUsesTls12WhenCryptoMethodIsExplicitlyConfiguredByServer()
+    public function provideClientCryptoMethods()
+    {
+        return [
+            'single method' => [STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT],
+            'combined methods' => [STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT | STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT]
+        ];
+    }
+
+    /** @dataProvider provideServerCryptoMethods */
+    public function testClientUsesTls12WhenCryptoMethodIsExplicitlyConfiguredByServer($method)
     {
         $server = new TcpServer(0);
         $server = new SecureServer($server, null, [
             'local_cert' => __DIR__ . '/../examples/localhost.pem',
-            'crypto_method' => STREAM_CRYPTO_METHOD_TLSv1_2_SERVER
+            'crypto_method' => $method
         ]);
 
         $connector = new SecureConnector(new TcpConnector(), null, [
@@ -135,6 +145,14 @@ public function testClientUsesTls12WhenCryptoMethodIsExplicitlyConfiguredByServe
         $server->close();
     }
 
+    public function provideServerCryptoMethods()
+    {
+        return [
+            'single method' => [STREAM_CRYPTO_METHOD_TLSv1_2_SERVER],
+            'combined methods' => [STREAM_CRYPTO_METHOD_TLSv1_1_SERVER | STREAM_CRYPTO_METHOD_TLSv1_2_SERVER]
+        ];
+    }
+
     public function testClientUsesTls10WhenCryptoMethodIsExplicitlyConfiguredByClient()
     {
         $server = new TcpServer(0);