Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:64414
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: error (pb1.pair.com: domain webstart.fr from 74.125.82.181 cause and error)
MIME-Version: 1.0
In-Reply-To: <CAOfKkdRDLagLtxkqm6_5NQ-eKkE_aUN6fMMM4+siQjkEBwwwmQ@mail.gmail.com>
References: <CAOfKkdRDLagLtxkqm6_5NQ-eKkE_aUN6fMMM4+siQjkEBwwwmQ@mail.gmail.com>
Date: Fri, 21 Dec 2012 19:54:13 -0500
Message-ID: <CAOfKkdR5kxPWxoUpqaybbM6kJUwMHN1G5cU04q65oYN9+OXv=w@mail.gmail.com>
To: Internals <internals@lists.php.net>
Content-Type: text/plain; charset=ISO-8859-1
Subject: Re: Changes in libcurl for CURLOPT_SSL_VERIFYHOST in 7.28.1
From: pierrick@webstart.fr (Pierrick Charron)

The following solution was implemented :

https://github.com/php/php-src/commit/517f800277a11d6ce05b0e1afcd0e76dc544d452

Pierrick

On 18 December 2012 23:35, Pierrick Charron <pierrick@webstart.fr> wrote:
> Hi all,
>
> About 2 month ago, we had a discussion on this list about the fact
> that CURLOPT_SSL_VERIFYHOST was most of the time used with a Boolean
> value (true) instead of int values (0,1 or 2). This bad usage was
> leading to some security issues. The result of this discussion was to
> trigger a notice if someone tried to set the CURLOPT_SSL_VERIFYHOST to
> true (boolean), and was committed to >= 5.4
>
> On November 20th, Daniel (the author of libcurl) released cURL 7.28.1
> which no longer support the 1 value for CURLOPT_SSL_VERIFYHOST. This
> change introduced some bugs as #63795 (you'll find the cause of the
> bug in the comments).
>
> To fix this bug, and to minimize as much as possible the impact of
> this change, I'm proposing to do the following changes in the libcurl
> extension for future releases :
>
> When using libcurl < 7.28.1, if someone try to set
> CURLOPT_SSL_VERIFYHOST to 1 (or true), set the value to 1, but trigger
> a notice to inform that this value is deprecated.
>
> When using libcurl >= 7.28.1 if someone try to set
> CURLOPT_SSL_VERIFYHOST to 1 (or true), set CURLOPT_SSL_VERIFYHOST to
> 2, trigger a notice to inform the user that this value is no longer
> supported as of libcurl 7.28.1 but keep returning true.
>
> Also, as stated by Remy in bug #63795, when PHP is built with
> curl-wrappers, the context option "curl_verify_ssl_host" sets
> CURLOPT_SSL_VERIFYHOST to 1. I would like to modify this code to set
> CURLOPT_SSL_VERIFYHOST to 2. Since curl-wrappers is still marked as
> experimental I don't think this will cause a lot of troubles.
>
> If you have any comment, please do, otherwise, I'll commit those
> changes on Friday to all branches (including 5.3).
>
> Thanks
> Pierrick