Re: [PR #22159] ext/curl: expose SOCKOPT/OPENSOCKET/CLOSESOCKET callbacks

Hi everyone, Just want to add more context here: today PHP doesn't offer any good option to prevent SSRF that points to localhost. The options are tricky and error prone: that's exactly the use case of the CURLOPT_OPENSOCKETFUNCTION callback, that was added to curl in 2007. So, I'm not sure what the next step is, I remain available to iterate if needed ; I would love to see this released before the feature freeze. Have a nice day, Xavier Le lun. 15 juin 2026 à 15:20, Xavier Leune <xavier.leune+internals@gmail.com> a écrit : > Hi internals, > > PR #22159 adds three libcurl callback options to ext/curl for 8.6: > > - CURLOPT_SOCKOPTFUNCTION > - CURLOPT_OPENSOCKETFUNCTION > - CURLOPT_CLOSESOCKETFUNCTION > > https://github.com/php/php-src/pull/22159 > > Motivation: give PHP users a native way to do SSRF filtering (validate the > resolved peer IP before connect) and low-level socket tuning > (SO_BINDTODEVICE, SO_MARK, keepalive, TCP_NODELAY...) without dropping to > ext/ffi. > > Because the C signatures use a raw curl_socket_t fd, the callbacks bridge > to ext/sockets and exchange real Socket objects, fully usable with > socket_set_option(), socket_close(), etc. > > Thanks to @devnexen who helped me to improve the dependencies management > and the low level integration. > CI is fully green (Linux, macOS, FreeBSD, Windows, ASAN). > > Feedback welcome on any matter. > > Thanks, > Xavier Leune > >