com php-src: Merge branch 'PHP-5.6': ext/openssl/openssl.c ext/openssl/xp_ssl.c
| From: | rdlowrey@php.net | Date: | Sun, 02 Mar 2014 17:39:03 +0000 |
| Subject: | com php-src: Merge branch 'PHP-5.6': ext/openssl/openssl.c ext/openssl/xp_ssl.c | ||
| Groups: | php.cvs | ||
| Request: | Send a blank email to php-cvs+get-76307@lists.php.net to get a copy of this message | ||
Commit: 41bde3f0a74b5eaf0ee0a21856f86bdd9a364437
Author: Daniel Lowrey <rdlowrey@php.net> Sun, 2 Mar 2014 10:39:03 -0700
Parents: ec7935f7b582767193dff4cb15b40d67cdb33921 c126c16479c13e5fcbb57e6fe2341736c37edf36
Branches: master
Link: http://git.php.net/?p=php-src..git;a=commitdiff;h=41bde3f0a74b5eaf0ee0a21856f86bdd9a364437
Log:
Merge branch 'PHP-5.6'
* PHP-5.6:
Capture peer cert even if verify fails
Windows cert verify improvements + leak fixes
Changed paths:
MM ext/openssl/openssl.c
MM ext/openssl/xp_ssl.c
Diff:
diff --cc ext/openssl/xp_ssl.c
index c522f7d,d63519e..a4046a6
--- a/ext/openssl/xp_ssl.c
+++ b/ext/openssl/xp_ssl.c
@@@ -824,6 -822,58 +824,58 @@@ static inline void enable_client_sni(ph
/* }}} */
#endif
+ static int capture_peer_certs(php_stream *stream,
+ php_openssl_netstream_data_t *sslsock,
+ X509 *peer_cert
+ TSRMLS_DC)
+ {
+ zval **val, *zcert;
+ int cert_captured = 0;
+
+ if (SUCCESS == php_stream_context_get_option(stream->context,
+ "ssl", "capture_peer_cert", &val) &&
- zend_is_true(*val)
++ zend_is_true(*val TSRMLS_CC)
+ ) {
+ MAKE_STD_ZVAL(zcert);
+ ZVAL_RESOURCE(zcert, zend_list_insert(peer_cert, php_openssl_get_x509_list_id() TSRMLS_CC));
+ php_stream_context_set_option(stream->context, "ssl", "peer_certificate",
zcert);
+ cert_captured = 1;
+ FREE_ZVAL(zcert);
+ }
+
+ if (SUCCESS == php_stream_context_get_option(stream->context,
+ "ssl", "capture_peer_cert_chain", &val) &&
- zend_is_true(*val)
++ zend_is_true(*val TSRMLS_CC)
+ ) {
+ zval *arr;
+ STACK_OF(X509) *chain;
+
+ MAKE_STD_ZVAL(arr);
+ chain = SSL_get_peer_cert_chain(sslsock->ssl_handle);
+
+ if (chain && sk_X509_num(chain) > 0) {
+ int i;
+ array_init(arr);
+
+ for (i = 0; i < sk_X509_num(chain); i++) {
+ X509 *mycert = X509_dup(sk_X509_value(chain, i));
+ MAKE_STD_ZVAL(zcert);
+ ZVAL_RESOURCE(zcert, zend_list_insert(mycert, php_openssl_get_x509_list_id() TSRMLS_CC));
+ add_next_index_zval(arr, zcert);
+ }
+
+ } else {
+ ZVAL_NULL(arr);
+ }
+
+ php_stream_context_set_option(stream->context, "ssl",
"peer_certificate_chain", arr);
+ zval_dtor(arr);
+ efree(arr);
+ }
+
+ return cert_captured;
+ }
+
static inline int php_openssl_enable_crypto(php_stream *stream,
php_openssl_netstream_data_t *sslsock,
php_stream_xport_crypto_param *cparam
@@@ -936,19 -990,15 +992,15 @@@
} else {
sslsock->ssl_active = 1;
- /* allow the script to capture the peer cert
- * and/or the certificate chain */
if (stream->context) {
- zval **val, *zcert;
+ zval **val;
- if (SUCCESS == php_stream_context_get_option(
- stream->context, "ssl",
- "capture_session_meta", &val) &&
- zend_is_true(*val TSRMLS_CC)) {
+ if (SUCCESS == php_stream_context_get_option(stream->context,
+ "ssl", "capture_session_meta", &val) &&
- zend_is_true(*val)
++ zend_is_true(*val TSRMLS_CC)
+ ) {
zval *meta_arr = php_capture_ssl_session_meta(sslsock->ssl_handle);
- php_stream_context_set_option(stream->context,
- "ssl", "session_meta",
- meta_arr);
+ php_stream_context_set_option(stream->context, "ssl", "session_meta",
meta_arr);
zval_dtor(meta_arr);
efree(meta_arr);
}