cvs: php-src /ext/openssl openssl.c xp_ssl.c

wez Sun Apr 30 23:45:13 2006 UTC Modified files: /php-src/ext/openssl openssl.c xp_ssl.c Log: merge from branch: peer certificate capture context options. http://cvs.php.net/viewcvs.cgi/php-src/ext/openssl/openssl.c?r1=1.105&r2=1.106&diff_format=u Index: php-src/ext/openssl/openssl.c diff -u php-src/ext/openssl/openssl.c:1.105 php-src/ext/openssl/openssl.c:1.106 --- php-src/ext/openssl/openssl.c:1.105 Tue Feb 21 20:12:42 2006 +++ php-src/ext/openssl/openssl.c Sun Apr 30 23:45:13 2006 @@ -18,7 +18,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: openssl.c,v 1.105 2006/02/21 20:12:42 dmitry Exp $ */ +/* $Id: openssl.c,v 1.106 2006/04/30 23:45:13 wez Exp $ */ #ifdef HAVE_CONFIG_H #include "config.h" @@ -156,6 +156,11 @@ static int le_csr; static int ssl_stream_data_index; +int php_openssl_get_x509_list_id(void) +{ + return le_x509; +} + /* {{{ resource destructors */ static void php_pkey_free(zend_rsrc_list_entry *rsrc TSRMLS_DC) { http://cvs.php.net/viewcvs.cgi/php-src/ext/openssl/xp_ssl.c?r1=1.24&r2=1.25&diff_format=u Index: php-src/ext/openssl/xp_ssl.c diff -u php-src/ext/openssl/xp_ssl.c:1.24 php-src/ext/openssl/xp_ssl.c:1.25 --- php-src/ext/openssl/xp_ssl.c:1.24 Sun Jan 1 13:09:52 2006 +++ php-src/ext/openssl/xp_ssl.c Sun Apr 30 23:45:13 2006 @@ -16,7 +16,7 @@ +----------------------------------------------------------------------+ */ -/* $Id: xp_ssl.c,v 1.24 2006/01/01 13:09:52 sniper Exp $ */ +/* $Id: xp_ssl.c,v 1.25 2006/04/30 23:45:13 wez Exp $ */ #include "php.h" #include "ext/standard/file.h" @@ -33,6 +33,7 @@ int php_openssl_apply_verification_policy(SSL *ssl, X509 *peer, php_stream *stream TSRMLS_DC); SSL *php_SSL_new_from_context(SSL_CTX *ctx, php_stream *stream TSRMLS_DC); +int php_openssl_get_x509_list_id(void); /* This implementation is very closely tied to the that of the native * sockets implemented in the core. @@ -414,9 +415,63 @@ SSL_shutdown(sslsock->ssl_handle); } else { sslsock->ssl_active = 1; + + /* allow the script to capture the peer cert + * and/or the certificate chain */ + if (stream->context) { + zval **val, *zcert; + + if (SUCCESS == php_stream_context_get_option( + stream->context, "ssl", + "capture_peer_cert", &val) && + zval_is_true(*val)) { + MAKE_STD_ZVAL(zcert); + ZVAL_RESOURCE(zcert, zend_list_insert(peer_cert, + php_openssl_get_x509_list_id())); + php_stream_context_set_option(stream->context, + "ssl", "peer_certificate", + zcert); + peer_cert = NULL; + } + + if (SUCCESS == php_stream_context_get_option( + stream->context, "ssl", + "capture_peer_cert_chain", &val) && + zval_is_true(*val)) { + zval *arr; + STACK_OF(X509) *chain; + + MAKE_STD_ZVAL(arr); + chain = SSL_get_peer_cert_chain( + sslsock->ssl_handle); + + if (chain) { + int i; + array_init(arr); + + for (i = 0; i < sk_X509_num(chain); i++) { + X509 *mycert = X509_dup( + sk_X509_value(chain, i)); + MAKE_STD_ZVAL(zcert); + ZVAL_RESOURCE(zcert, + zend_list_insert(mycert, + php_openssl_get_x509_list_id())); + add_next_index_zval(arr, zcert); + } + } else { + ZVAL_NULL(arr); + } + + php_stream_context_set_option(stream->context, + "ssl", "peer_certificate_chain", + arr); + } + } } - X509_free(peer_cert); + if (peer_cert) { + X509_free(peer_cert); + } } else { n = errno == EAGAIN ? 0 : -1; }