Skip to content

Commit a57f582

Browse files
bukkabukka
committed
Merge branch 'PHP-8.3' into PHP-8.4
2 parents 4647dfc + eade5c1 commit a57f582

File tree

6 files changed

+109
-5
lines changed

6 files changed

+109
-5
lines changed

‎.github/scripts/setup-slapd.sh

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,9 @@ olcTLSCertificateKeyFile: /etc/ldap/ssl/server.key
7272
add: olcTLSVerifyClient
7373
olcTLSVerifyClient: never
7474
-
75+
add: olcTLSProtocolMin
76+
olcTLSProtocolMin: 3.3
77+
-
7578
add: olcAuthzRegexp
7679
olcAuthzRegexp: uid=usera,cn=digest-md5,cn=auth cn=usera,dc=my-domain,dc=com
7780
-

‎NEWS

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@ PHP NEWS
55
- Intl:
66
. Fix memleak on failure in collator_get_sort_key(). (nielsdos)
77

8+
- LDAP:
9+
. Fixed bug GH-18529 (additional inheriting of TLS int options).
10+
(Jakub Zelenka)
11+
812
- OpenSSL:
913
. Fixed bug GH-18986 (OpenSSL backend: incorrect RAND_{load,write}_file()
1014
return value check). (nielsdos, botovq)

‎ext/ldap/ldap.c

Lines changed: 27 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3740,7 +3740,8 @@ PHP_FUNCTION(ldap_rename_ext)
37403740
*/
37413741
static int _php_ldap_tls_newctx(LDAP *ld)
37423742
{
3743-
int val = 0, i, opts[] = {
3743+
int val = 0, i;
3744+
int str_opts[] = {
37443745
#if (LDAP_API_VERSION > 2000)
37453746
LDAP_OPT_X_TLS_CACERTDIR,
37463747
LDAP_OPT_X_TLS_CACERTFILE,
@@ -3760,21 +3761,42 @@ static int _php_ldap_tls_newctx(LDAP *ld)
37603761
#endif
37613762
0};
37623763

3763-
for (i=0 ; opts[i] ; i++) {
3764+
for (i=0 ; str_opts[i] ; i++) {
37643765
char *path = NULL;
37653766

3766-
ldap_get_option(ld, opts[i], &path);
3767+
ldap_get_option(ld, str_opts[i], &path);
37673768
if (path) { /* already set locally */
37683769
ldap_memfree(path);
37693770
} else {
3770-
ldap_get_option(NULL, opts[i], &path);
3771+
ldap_get_option(NULL, str_opts[i], &path);
37713772
if (path) { /* set globally, inherit */
3772-
ldap_set_option(ld, opts[i], path);
3773+
ldap_set_option(ld, str_opts[i], path);
37733774
ldap_memfree(path);
37743775
}
37753776
}
37763777
}
37773778

3779+
#ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
3780+
int int_opts[] = {
3781+
LDAP_OPT_X_TLS_PROTOCOL_MIN,
3782+
#ifdef LDAP_OPT_X_TLS_PROTOCOL_MAX
3783+
LDAP_OPT_X_TLS_PROTOCOL_MAX,
3784+
#endif
3785+
0
3786+
};
3787+
for (i=0 ; int_opts[i] ; i++) {
3788+
int value = 0;
3789+
3790+
ldap_get_option(ld, int_opts[i], &value);
3791+
if (value <= 0) { /* if value is not set already */
3792+
ldap_get_option(NULL, int_opts[i], &value);
3793+
if (value > 0) { /* set globally, inherit */
3794+
ldap_set_option(ld, int_opts[i], &value);
3795+
}
3796+
}
3797+
}
3798+
#endif
3799+
37783800
return ldap_set_option(ld, LDAP_OPT_X_TLS_NEWCTX, &val);
37793801
}
37803802

‎ext/ldap/tests/ldap_start_tls_rc_max_version.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
TLS_PROTOCOL_MAX 3.2

‎ext/ldap/tests/ldap_start_tls_rc_max_version.phpt

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
--TEST--
2+
ldap_start_tls() - Basic ldap_start_tls test
3+
--EXTENSIONS--
4+
ldap
5+
--ENV--
6+
LDAPCONF={PWD}/ldap_start_tls_rc_max_version.conf
7+
--SKIPIF--
8+
<?php
9+
$require_vendor = [
10+
"name" => "OpenLDAP",
11+
"min_version" => 20600,
12+
];
13+
require_once __DIR__ .'/skipifbindfailure.inc';
14+
?>
15+
--FILE--
16+
<?php
17+
require_once "connect.inc";
18+
19+
// CI uses self signed certificate
20+
21+
// No cert option - fails
22+
$link = ldap_connect($uri);
23+
ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
24+
var_dump(@ldap_start_tls($link));
25+
26+
// No cert check - should pass but due to ldaps check, it fails as well
27+
$link = ldap_connect($uri);
28+
ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
29+
ldap_set_option($link, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
30+
var_dump(@ldap_start_tls($link));
31+
32+
// With cert check - fails
33+
$link = ldap_connect($uri);
34+
ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
35+
ldap_set_option($link, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_DEMAND);
36+
var_dump(@ldap_start_tls($link));
37+
?>
38+
--EXPECT--
39+
bool(false)
40+
bool(false)
41+
bool(false)

‎ext/ldap/tests/skipifbindfailure.inc

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,37 @@ if ($skip_on_bind_failure) {
1010

1111
ldap_unbind($link);
1212
}
13+
14+
if (isset($require_vendor)) {
15+
ob_start();
16+
phpinfo(INFO_MODULES);
17+
$phpinfo = ob_get_clean();
18+
19+
// Extract the LDAP section specifically
20+
if (preg_match('/^ldap\s*$(.*?)^[a-z_]+\s*$/ims', $phpinfo, $ldap_section_match)) {
21+
$ldap_section = $ldap_section_match[1];
22+
23+
// Extract vendor info from the LDAP section only
24+
if (preg_match('/Vendor Name\s*=>\s*(.+)/i', $ldap_section, $name_match) &&
25+
preg_match('/Vendor Version\s*=>\s*(\d+)/i', $ldap_section, $version_match)) {
26+
27+
$vendor_name = trim($name_match[1]);
28+
$vendor_version = (int)$version_match[1];
29+
30+
// Check vendor name if specified
31+
if (isset($require_vendor['name']) && $vendor_name !== $require_vendor['name']) {
32+
die("skip Requires {$require_vendor['name']} (detected: $vendor_name)");
33+
}
34+
35+
// Check minimum version if specified
36+
if (isset($require_vendor['min_version']) && $vendor_version < $require_vendor['min_version']) {
37+
die("skip Requires minimum version {$require_vendor['min_version']} (detected: $vendor_version)");
38+
}
39+
} else {
40+
die("skip Cannot determine LDAP vendor information");
41+
}
42+
} else {
43+
die("skip LDAP extension information not found");
44+
}
45+
}
1346
?>

0 commit comments

Comments
 (0)