com php-src: soap #69137 - Fix SSL verify when using a proxy: ext/soap/php_http.c ext/soap/soap.c ext/soap/tests/bu g69137.phpt

Commit: 31cbce341c4a5017eac3239c8ff1278cb9ff3900 Author: Keith Smiley <ksmiley@salesforce.com> Mon, 20 Jun 2016 14:23:49 -0400 Parents: 8908df690f7bc29b606421c18eb06414154fa183 Branches: PHP-7.0 Link: http://git.php.net/?p=php-src.git;a=commitdiff;h=31cbce341c4a5017eac3239c8ff1278cb9ff3900 Log: soap #69137 - Fix SSL verify when using a proxy Name verification was failing because the OpenSSL extension was picking the proxy server's address when guessing which name to compare to the SSL certificate. This scenario is already handled for stream wrappers in http_fopen_wrapper.c. This patch applies the same fix to the SOAP extension: when a proxy is used, set peer_name explicitly on the stream context. Bugs: https://bugs.php.net/69137 Changed paths: M ext/soap/php_http.c M ext/soap/soap.c A ext/soap/tests/bug69137.phpt Diff: diff --git a/ext/soap/php_http.c b/ext/soap/php_http.c index 7c91836..cb5550a 100644 --- a/ext/soap/php_http.c +++ b/ext/soap/php_http.c @@ -161,7 +161,7 @@ void http_context_headers(php_stream_context* context, static php_stream* http_connect(zval* this_ptr, php_url *phpurl, int use_ssl, php_stream_context *context, int *use_proxy) { php_stream *stream; - zval *proxy_host, *proxy_port, *tmp; + zval *proxy_host, *proxy_port, *tmp, ssl_proxy_peer_name; char *host; char *name; char *protocol; @@ -241,6 +241,13 @@ static php_stream* http_connect(zval* this_ptr, php_url *phpurl, int use_ssl, ph if (stream && *use_proxy && use_ssl) { smart_str soap_headers = {0}; + /* Set peer_name or name verification will try to use the proxy server name */ + if (context && (tmp = php_stream_context_get_option(context, "ssl", "peer_name")) != NULL) { + ZVAL_STRING(&ssl_proxy_peer_name, phpurl->host); + php_stream_context_set_option(PHP_STREAM_CONTEXT(stream), "ssl", "peer_name", &ssl_proxy_peer_name); + zval_ptr_dtor(&ssl_proxy_peer_name); + } + smart_str_append_const(&soap_headers, "CONNECT "); smart_str_appends(&soap_headers, phpurl->host); smart_str_appendc(&soap_headers, ':'); diff --git a/ext/soap/soap.c b/ext/soap/soap.c index 11c2d7c..344f240 100644 --- a/ext/soap/soap.c +++ b/ext/soap/soap.c @@ -2368,6 +2368,8 @@ PHP_METHOD(SoapClient, SoapClient) Z_TYPE_P(tmp) == IS_RESOURCE) { context = php_stream_context_from_zval(tmp, 1); Z_ADDREF_P(tmp); + } else { + context = php_stream_context_alloc(); } if ((tmp = zend_hash_str_find(ht, "location", sizeof("location")-1)) != NULL && diff --git a/ext/soap/tests/bug69137.phpt b/ext/soap/tests/bug69137.phpt new file mode 100644 index 0000000..a4d3baa --- /dev/null +++ b/ext/soap/tests/bug69137.phpt @@ -0,0 +1,41 @@ +--TEST-- +SOAP Bug #69137 - Peer verification fails when using a proxy with SoapClient +--SKIPIF-- +<?php +require_once('skipif.inc'); +if (getenv("SKIP_ONLINE_TESTS")) { die("skip test requiring internet connection"); } +if (!getenv('http_proxy')) { die("skip test unless an HTTP/HTTPS proxy server is specified in http_proxy environment variable"); } +?> +--INI-- +soap.wsdl_cache_enabled=0 +--FILE-- +<?php + +class IpLookup +{ + public $licenseKey; + public $ipAddress; +} + +list ($proxyHost, $proxyPort) = explode(':', str_replace('http://', '', $_ENV['http_proxy'])); + +$testServiceWsdl = 'https://ws.cdyne.com/ip2geo/ip2geo.asmx?wsdl'; +$parameters = [ + 'proxy_host' => $proxyHost, + 'proxy_port' => $proxyPort, + 'trace' => 1, +]; +$client = new SoapClient($testServiceWsdl, $parameters); + +$lookup = new IpLookup(); +$lookup->licenseKey = 0; +$lookup->ipAddress = '72.52.91.14'; + +$result = $client->ResolveIP($lookup); + +if ($result && is_object($result) && $result->ResolveIPResult && is_object($result->ResolveIPResult)) { + print "successful lookup"; +} +?> +--EXPECT-- +successful lookup