Skip to content

Commit b9844b5

Browse files
bukkabukka
committed
Merge branch 'PHP-8.4'
2 parents 2afab21 + a57f582 commit b9844b5

File tree

5 files changed

+105
-5
lines changed

5 files changed

+105
-5
lines changed

‎.github/scripts/setup-slapd.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@ olcTLSCertificateKeyFile: /etc/ldap/ssl/server.key
7272
add: olcTLSVerifyClient
7373
olcTLSVerifyClient: never
7474
-
75+
add: olcTLSProtocolMin
76+
olcTLSProtocolMin: 3.3
77+
-
7578
add: olcAuthzRegexp
7679
olcAuthzRegexp: uid=usera,cn=digest-md5,cn=auth cn=usera,dc=my-domain,dc=com
7780
-

‎ext/ldap/ldap.c

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3725,7 +3725,8 @@ PHP_FUNCTION(ldap_rename_ext)
37253725
*/
37263726
static int _php_ldap_tls_newctx(LDAP *ld)
37273727
{
3728-
int val = 0, i, opts[] = {
3728+
int val = 0, i;
3729+
int str_opts[] = {
37293730
#if (LDAP_API_VERSION > 2000)
37303731
LDAP_OPT_X_TLS_CACERTDIR,
37313732
LDAP_OPT_X_TLS_CACERTFILE,
@@ -3745,21 +3746,42 @@ static int _php_ldap_tls_newctx(LDAP *ld)
37453746
#endif
37463747
0};
37473748

3748-
for (i=0 ; opts[i] ; i++) {
3749+
for (i=0 ; str_opts[i] ; i++) {
37493750
char *path = NULL;
37503751

3751-
ldap_get_option(ld, opts[i], &path);
3752+
ldap_get_option(ld, str_opts[i], &path);
37523753
if (path) { /* already set locally */
37533754
ldap_memfree(path);
37543755
} else {
3755-
ldap_get_option(NULL, opts[i], &path);
3756+
ldap_get_option(NULL, str_opts[i], &path);
37563757
if (path) { /* set globally, inherit */
3757-
ldap_set_option(ld, opts[i], path);
3758+
ldap_set_option(ld, str_opts[i], path);
37583759
ldap_memfree(path);
37593760
}
37603761
}
37613762
}
37623763

3764+
#ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
3765+
int int_opts[] = {
3766+
LDAP_OPT_X_TLS_PROTOCOL_MIN,
3767+
#ifdef LDAP_OPT_X_TLS_PROTOCOL_MAX
3768+
LDAP_OPT_X_TLS_PROTOCOL_MAX,
3769+
#endif
3770+
0
3771+
};
3772+
for (i=0 ; int_opts[i] ; i++) {
3773+
int value = 0;
3774+
3775+
ldap_get_option(ld, int_opts[i], &value);
3776+
if (value <= 0) { /* if value is not set already */
3777+
ldap_get_option(NULL, int_opts[i], &value);
3778+
if (value > 0) { /* set globally, inherit */
3779+
ldap_set_option(ld, int_opts[i], &value);
3780+
}
3781+
}
3782+
}
3783+
#endif
3784+
37633785
return ldap_set_option(ld, LDAP_OPT_X_TLS_NEWCTX, &val);
37643786
}
37653787

‎ext/ldap/tests/ldap_start_tls_rc_max_version.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
TLS_PROTOCOL_MAX 3.2

‎ext/ldap/tests/ldap_start_tls_rc_max_version.phpt

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
--TEST--
2+
ldap_start_tls() - Basic ldap_start_tls test
3+
--EXTENSIONS--
4+
ldap
5+
--ENV--
6+
LDAPCONF={PWD}/ldap_start_tls_rc_max_version.conf
7+
--SKIPIF--
8+
<?php
9+
$require_vendor = [
10+
"name" => "OpenLDAP",
11+
"min_version" => 20600,
12+
];
13+
require_once __DIR__ .'/skipifbindfailure.inc';
14+
?>
15+
--FILE--
16+
<?php
17+
require_once "connect.inc";
18+
19+
// CI uses self signed certificate
20+
21+
// No cert option - fails
22+
$link = ldap_connect($uri);
23+
ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
24+
var_dump(@ldap_start_tls($link));
25+
26+
// No cert check - should pass but due to ldaps check, it fails as well
27+
$link = ldap_connect($uri);
28+
ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
29+
ldap_set_option($link, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
30+
var_dump(@ldap_start_tls($link));
31+
32+
// With cert check - fails
33+
$link = ldap_connect($uri);
34+
ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
35+
ldap_set_option($link, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_DEMAND);
36+
var_dump(@ldap_start_tls($link));
37+
?>
38+
--EXPECT--
39+
bool(false)
40+
bool(false)
41+
bool(false)

‎ext/ldap/tests/skipifbindfailure.inc

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,37 @@ if ($skip_on_bind_failure) {
1010

1111
ldap_unbind($link);
1212
}
13+
14+
if (isset($require_vendor)) {
15+
ob_start();
16+
phpinfo(INFO_MODULES);
17+
$phpinfo = ob_get_clean();
18+
19+
// Extract the LDAP section specifically
20+
if (preg_match('/^ldap\s*$(.*?)^[a-z_]+\s*$/ims', $phpinfo, $ldap_section_match)) {
21+
$ldap_section = $ldap_section_match[1];
22+
23+
// Extract vendor info from the LDAP section only
24+
if (preg_match('/Vendor Name\s*=>\s*(.+)/i', $ldap_section, $name_match) &&
25+
preg_match('/Vendor Version\s*=>\s*(\d+)/i', $ldap_section, $version_match)) {
26+
27+
$vendor_name = trim($name_match[1]);
28+
$vendor_version = (int)$version_match[1];
29+
30+
// Check vendor name if specified
31+
if (isset($require_vendor['name']) && $vendor_name !== $require_vendor['name']) {
32+
die("skip Requires {$require_vendor['name']} (detected: $vendor_name)");
33+
}
34+
35+
// Check minimum version if specified
36+
if (isset($require_vendor['min_version']) && $vendor_version < $require_vendor['min_version']) {
37+
die("skip Requires minimum version {$require_vendor['min_version']} (detected: $vendor_version)");
38+
}
39+
} else {
40+
die("skip Cannot determine LDAP vendor information");
41+
}
42+
} else {
43+
die("skip LDAP extension information not found");
44+
}
45+
}
1346
?>

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy