GNUsocial/gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

Partial fix for ticket #2489 -- problems with SNI SSL virtual host certificate validation.

Browse Source 
Two prongs here:
* We attempt to enable SNI on the SSL stream context with the appropriate hostname... This requires PHP 5.3.2 and OpenSSL that supports the TLS extensions. Unfortunately this doesn't seem to be working in my testing.
* If set $config['http']['curl'] = true, we'll use the CURL backend if available. In my testing on Ubuntu 10.04, this works. No guarantees on other systems.

I'm not enabling CURL mode by default just yet; want to make sure there's no other surprises.
This commit is contained in:
Brion Vibber 2010-08-06 10:14:07 -07:00
parent 300ed65d30
commit ebd2fc2f7c
2 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/default.php
View File

@ -315,6 +315,7 @@ $default =
'members' => true, 'members' => true,
'peopletag' => true), 'peopletag' => true),
'http' => // HTTP client settings when contacting other sites 'http' => // HTTP client settings when contacting other sites
array('ssl_cafile' => false // To enable SSL cert validation, point to a CA bundle (eg '/usr/lib/ssl/certs/ca-certificates.crt') array('ssl_cafile' => false, // To enable SSL cert validation, point to a CA bundle (eg '/usr/lib/ssl/certs/ca-certificates.crt')
'curl' => false, // Use CURL backend for HTTP fetches if available. (If not, PHP's socket streams will be used.)
), ),
); );

13
lib/httpclient.php
View File

@ -145,6 +145,10 @@ class HTTPClient extends HTTP_Request2
$this->config['ssl_verify_peer'] = false; $this->config['ssl_verify_peer'] = false;
} }
if (common_config('http', 'curl') && extension_loaded('curl')) {
$this->config['adapter'] = 'HTTP_Request2_Adapter_Curl';
}
parent::__construct($url, $method, $config); parent::__construct($url, $method, $config);
$this->setHeader('User-Agent', $this->userAgent()); $this->setHeader('User-Agent', $this->userAgent());
} }
@ -204,6 +208,15 @@ class HTTPClient extends HTTP_Request2
protected function doRequest($url, $method, $headers) protected function doRequest($url, $method, $headers)
{ {
$this->setUrl($url); $this->setUrl($url);
// Workaround for HTTP_Request2 not setting up SNI in socket contexts;
// This fixes cert validation for SSL virtual hosts using SNI.
// Requires PHP 5.3.2 or later and OpenSSL with SNI support.
if ($this->url->getScheme() == 'https' && defined('OPENSSL_TLSEXT_SERVER_NAME')) {
$this->config['ssl_SNI_enabled'] = true;
$this->config['ssl_SNI_server_name'] = $this->url->getHost();
}
$this->setMethod($method); $this->setMethod($method);
if ($headers) { if ($headers) {
foreach ($headers as $header) { foreach ($headers as $header) {