Skip to content

Commit 34ae0fe

Browse files
bukkabukka
committed
Fix bug #74796: Requests through http proxy set peer name
This issue happens because http wrapper sets peer_name but then does not remove so it stays in the context. The fix removes the peer name from the context after enabling crypto. In addition to bug #74796, this also fixes bug #76196. In addition it should be a final fix for those SOAP bugs: bug #69783 bug #52913 bug #61463
1 parent e7a44a6 commit 34ae0fe

File tree

4 files changed

+198
-1
lines changed

4 files changed

+198
-1
lines changed

‎ext/openssl/tests/bug74796.phpt

+175
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,175 @@
1+
--TEST--
2+
Bug #74796: TLS encryption fails behind HTTP proxy
3+
--EXTENSIONS--
4+
openssl
5+
--SKIPIF--
6+
<?php
7+
if (!function_exists("proc_open")) die("skip no proc_open");
8+
?>
9+
--FILE--
10+
<?php
11+
12+
$serverCode = <<<'CODE'
13+
$serverFlags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
14+
$ctx = stream_context_create(['ssl' => [
15+
'SNI_server_certs' => [
16+
"cs.php.net" => __DIR__ . "/sni_server_cs.pem",
17+
"uk.php.net" => __DIR__ . "/sni_server_uk.pem",
18+
"us.php.net" => __DIR__ . "/sni_server_us.pem"
19+
]
20+
]]);
21+
22+
$server = stream_socket_server('tls://127.0.0.1:0', $errno, $errstr, $serverFlags, $ctx);
23+
phpt_notify_server_start($server);
24+
25+
for ($i=0; $i < 3; $i++) {
26+
$conn = stream_socket_accept($server, 3);
27+
fwrite($conn, "HTTP/1.0 200 OK\r\n\r\nHello from server $i");
28+
fclose($conn);
29+
}
30+
31+
phpt_wait();
32+
CODE;
33+
34+
$proxyCode = <<<'CODE'
35+
function parse_sni_from_client_hello($data) {
36+
$sni = null;
37+
38+
if (strlen($data) < 5 || ord($data[0]) != 0x16) return null;
39+
40+
$session_id_len = ord($data[43]);
41+
$ptr = 44 + $session_id_len;
42+
43+
// Cipher suites length
44+
$cipher_suites_len = (ord($data[$ptr]) << 8) | ord($data[$ptr+1]);
45+
$ptr += 2 + $cipher_suites_len;
46+
47+
// Compression methods length
48+
$compression_methods_len = ord($data[$ptr]);
49+
$ptr += 1 + $compression_methods_len;
50+
51+
// Extensions length
52+
if ($ptr + 2 > strlen($data)) return null;
53+
$extensions_len = (ord($data[$ptr]) << 8) | ord($data[$ptr+1]);
54+
$ptr += 2;
55+
56+
$extensions_end = $ptr + $extensions_len;
57+
58+
while ($ptr + 4 <= $extensions_end) {
59+
$ext_type = (ord($data[$ptr]) << 8) | ord($data[$ptr+1]);
60+
$ext_len = (ord($data[$ptr+2]) << 8) | ord($data[$ptr+3]);
61+
$ptr += 4;
62+
63+
if ($ext_type === 0x00) { // SNI extension
64+
if ($ptr + 2 > strlen($data)) break;
65+
$name_list_len = (ord($data[$ptr]) << 8) | ord($data[$ptr+1]);
66+
$ptr += 2;
67+
68+
if ($ptr + 3 > strlen($data)) break;
69+
$name_type = ord($data[$ptr]);
70+
$name_len = (ord($data[$ptr+1]) << 8) | ord($data[$ptr+2]);
71+
$ptr += 3;
72+
73+
if ($name_type === 0) { // host_name type
74+
$sni = substr($data, $ptr, $name_len);
75+
break;
76+
}
77+
}
78+
79+
$ptr += $ext_len;
80+
}
81+
82+
return $sni;
83+
}
84+
85+
$flags = STREAM_SERVER_BIND | STREAM_SERVER_LISTEN;
86+
$server = stream_socket_server("tcp://127.0.0.1:0", $errornum, $errorstr, $flags);
87+
phpt_notify_server_start($server);
88+
89+
for ($i=0; $i < 3; $i++) {
90+
$upstream = stream_socket_client("tcp://{{ ADDR }}", $errornum, $errorstr, 30, STREAM_CLIENT_CONNECT);
91+
stream_set_blocking($upstream, false);
92+
93+
$conn = stream_socket_accept($server);
94+
stream_set_blocking($conn, true);
95+
96+
// reading CONNECT request headers
97+
while (($line = fgets($conn)) !== false) {
98+
if (rtrim($line) === '') break; // empty line means end of headers
99+
}
100+
101+
// successful CONNECT response
102+
fwrite($conn, "HTTP/1.0 200 Connection established\r\n\r\n");
103+
104+
// tunnel data
105+
stream_set_blocking($conn, false);
106+
$firstRead = true;
107+
while (!feof($conn) && !feof($upstream)) {
108+
$clientData = fread($conn, 8192);
109+
if ($clientData !== false && $clientData !== '') {
110+
if ($firstRead) {
111+
$sni = parse_sni_from_client_hello($clientData);
112+
if ($sni !== null) {
113+
file_put_contents(__DIR__ . "/bug74796_proxy_sni.log", $sni . "\n", FILE_APPEND);
114+
}
115+
$firstRead = false;
116+
}
117+
fwrite($upstream, $clientData);
118+
}
119+
120+
$serverData = fread($upstream, 8192);
121+
if ($serverData !== false && $serverData !== '') {
122+
fwrite($conn, $serverData);
123+
}
124+
}
125+
fclose($conn);
126+
fclose($upstream);
127+
phpt_wait();
128+
}
129+
CODE;
130+
131+
$clientCode = <<<'CODE'
132+
$clientCtx = stream_context_create([
133+
'ssl' => [
134+
'cafile' => __DIR__ . '/sni_server_ca.pem',
135+
'verify_peer' => true,
136+
'verify_peer_name' => true,
137+
],
138+
"http" => [
139+
"proxy" => "tcp://{{ ADDR }}"
140+
],
141+
]);
142+
143+
// servers
144+
$hosts = ["cs.php.net", "uk.php.net", "us.php.net"];
145+
foreach ($hosts as $host) {
146+
var_dump(file_get_contents("https://$host/", false, $clientCtx));
147+
var_dump(stream_context_get_options($clientCtx)['ssl']['peer_name'] ?? null);
148+
phpt_notify('proxy');
149+
}
150+
151+
echo file_get_contents(__DIR__ . "/bug74796_proxy_sni.log");
152+
153+
phpt_notify('server');
154+
CODE;
155+
156+
include 'ServerClientTestCase.inc';
157+
ServerClientTestCase::getInstance()->run($clientCode, [
158+
'server' => $serverCode,
159+
'proxy' => $proxyCode,
160+
]);
161+
?>
162+
--CLEAN--
163+
<?php
164+
@unlink(__DIR__ . "/bug74796_proxy_sni.log");
165+
?>
166+
--EXPECT--
167+
string(19) "Hello from server 0"
168+
NULL
169+
string(19) "Hello from server 1"
170+
NULL
171+
string(19) "Hello from server 2"
172+
NULL
173+
cs.php.net
174+
uk.php.net
175+
us.php.net

‎ext/standard/http_fopen_wrapper.c

+6
Original file line numberDiff line numberDiff line change
@@ -470,12 +470,14 @@ static php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper,
470470

471471
if (stream && use_proxy && use_ssl) {
472472
smart_str header = {0};
473+
bool reset_ssl_peer_name = false;
473474

474475
/* Set peer_name or name verification will try to use the proxy server name */
475476
if (!context || (tmpzval = php_stream_context_get_option(context, "ssl", "peer_name")) == NULL) {
476477
ZVAL_STR_COPY(&ssl_proxy_peer_name, resource->host);
477478
php_stream_context_set_option(PHP_STREAM_CONTEXT(stream), "ssl", "peer_name", &ssl_proxy_peer_name);
478479
zval_ptr_dtor(&ssl_proxy_peer_name);
480+
reset_ssl_peer_name = true;
479481
}
480482

481483
smart_str_appendl(&header, "CONNECT ", sizeof("CONNECT ")-1);
@@ -572,6 +574,10 @@ static php_stream *php_stream_url_wrap_http_ex(php_stream_wrapper *wrapper,
572574
stream = NULL;
573575
}
574576
}
577+
578+
if (reset_ssl_peer_name) {
579+
php_stream_context_unset_option(PHP_STREAM_CONTEXT(stream), "ssl", "peer_name");
580+
}
575581
}
576582

577583
php_stream_http_response_header_info_init(&header_info);

‎main/streams/php_stream_context.h

+2-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,8 @@ PHPAPI zval *php_stream_context_get_option(php_stream_context *context,
5959
const char *wrappername, const char *optionname);
6060
PHPAPI void php_stream_context_set_option(php_stream_context *context,
6161
const char *wrappername, const char *optionname, zval *optionvalue);
62-
62+
void php_stream_context_unset_option(php_stream_context *context,
63+
const char *wrappername, const char *optionname);
6364
PHPAPI php_stream_notifier *php_stream_notification_alloc(void);
6465
PHPAPI void php_stream_notification_free(php_stream_notifier *notifier);
6566
END_EXTERN_C()

‎main/streams/streams.c

+15
Original file line numberDiff line numberDiff line change
@@ -2432,6 +2432,21 @@ PHPAPI void php_stream_context_set_option(php_stream_context *context,
24322432
SEPARATE_ARRAY(wrapperhash);
24332433
zend_hash_str_update(Z_ARRVAL_P(wrapperhash), optionname, strlen(optionname), optionvalue);
24342434
}
2435+
2436+
void php_stream_context_unset_option(php_stream_context *context,
2437+
const char *wrappername, const char *optionname)
2438+
{
2439+
zval *wrapperhash;
2440+
zval category;
2441+
2442+
wrapperhash = zend_hash_str_find(Z_ARRVAL(context->options), wrappername, strlen(wrappername));
2443+
if (NULL == wrapperhash) {
2444+
return;
2445+
}
2446+
SEPARATE_ARRAY(&context->options);
2447+
SEPARATE_ARRAY(wrapperhash);
2448+
zend_hash_str_del(Z_ARRVAL_P(wrapperhash), optionname, strlen(optionname));
2449+
}
24352450
/* }}} */
24362451

24372452
/* {{{ php_stream_dirent_alphasort */

0 commit comments

Comments
 (0)