# Soap over SSL and

- Thread: https://externals.io/message/44753
- Original archive: https://news-web.php.net/php.internals/44753
- Started by endrazine on 2009-07-07T13:42:31+00:00
- Messages: 13
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #44753 — endrazine — 2009-07-07T13:42:31+00:00

URL: https://externals.io/message/44753#44753

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hello dear list,

I realise this is probably not the best place to ask this kind of
questions, but after doing my howmeworks on google and php.net, I can't
find a decent solution to a development problem I thought would be
common. If this is strictly off topic, feel free to let me know.

I am currently interfacing a client's ecommerce website (let's call it
C) with an online payment gateway (let's call it G). The communication
between C and G is done over ssl, using Soap. The payment gateway's
support team provided us a sample php script responsible to connect to
G, make the payment etc. It lacks any kind of security checks, and in
particular doesn't verify G's SSL certificate, nor does it verify that
the certificate actually comes from a certification authority that we do
in fact trust. Internal experiments showed that if presented a fake self
signed certificate using the domain name of the gateway, the web app of
C doesn't realize the subterfuge and proceeds to the payment, which is
indeed quite anoying from a security point of view.

C is a php webapp running on php 5.2.9 under apache 2.x, here is the
full httpd banner:

Apache/2.2.11 (Ubuntu) PHP/5.2.9 mod_ssl/2.2.11 OpenSSL/0.9.8g Server


The code provided by the gateway's support team to perform the
connection to G looks like this:


$client = new SoapClient( $this->WSDL_SOAP, $this->header_soap);
                    $doWebPaymentResponse =
$client->doWebPayment($doWebPaymentRequest);
                    return util::responseToArray($doWebPaymentResponse);


It is lacking any type of authentication of the payment gateway, which
is not acceptable.

So in a nutshell, my problem is : can I get acces to the x509
certificate used by SoapClient ? Is there an api to then verify the
whole authority certification chain up to the root certificates I may
decide to trust automagically, or shall I use the openssl api ?

Note: I have been suggested to rely on SoapClient like above to perform
the payment, while opening a second socket (possibly using libcurl, or
even using the binary openssl itself) which would only verify the SSL
certification chain "in parallel". This seems quite a bad solution to me
since it is not verifying anything on the connection made by SoapClient
: imho there will be a race condition however I implement it ;(

Note2: I _did_ try to get the payment gateway's team to provide us the
necessary php code, but they don't seem interrested in making things
work in a secure way :(

In case SoapClient couldn't be used for this purpose, what is the
suggested way to extend it's capabilities (hooking/patching/writing an
apache module) ?


Thanks for your time,

- --
Jonathan


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkpTUMcACgkQK/YAm7PYybkkHgCfdbuhceR6BDdONspDN7CyZNEk
Z4IAmgPopaVgui/Ils/FraDXNhIEkUC8
=t1Gv
-----END PGP SIGNATURE

---

## #44761 — Brian A. Seklecki — 2009-07-07T14:18:28+00:00

URL: https://externals.io/message/44753#44761 · In reply to: #44753

> 
> It is lacking any type of authentication of the payment gateway, which
> is not acceptable.
> 

I agree+++.  

The problem is that PHP SOAP uses an internal "streams" library instead
of libcurl; the former lacks, the later has, client/server PKI support.

If it did use libcurl, dozens of problems over the last few years would
have magically solved themselves (pipe-line'ing, keep-alive, socket
options, PKI, etc.)

Support needs to be added to PHP for this and it's been on the
back-burner for me, but I think it is time to take it to the next level.

This being 2009, and all, perhaps a few organizations can pool resources
and sponsor the needed development.

~BAS

> So in a nutshell, my problem is : can I get acces to the x509
> certificate used by SoapClient ? Is there an api to then verify the
> whole authority certification chain up to the root certificates I may
> decide to trust automagically, or shall I use the openssl api ?

---

## #44775 — crrodriguez@suse.de — 2009-07-07T16:51:07+00:00

URL: https://externals.io/message/44753#44775 · In reply to: #44761

> If it did use libcurl, dozens of problems over the last few years would
> have magically solved themselves (pipe-line'ing, keep-alive, socket
> options, PKI, etc.)

Not only this extension but pretty much everything should use curl IMHO, 
it is included in all *nixes and works on windows too..

---

## #44842 — Richard Lynch — 2009-07-08T17:53:11+00:00

URL: https://externals.io/message/44753#44842

> -----BEGIN PGP SIGNED MESSAGE-----
> The first possibility is to directly patch SoapClient() to force it
> use
> libcurl (wich has ssl verification features). While doable
> tehcnically,
> I wonder if my patch for it would be merged into the framework, or if
> I'd have to then mantain my own version of php - which I am indeed not
> too encline to do..

I am not authorized to say this, but it's the same answer as has been
given before:

If the patch is of quality, it would almost certainly be accepted.

-- 
Some people ask for gifts here.
I just want you to buy an Indie CD for yourself:
http://cdbaby.com/search/from/lynch

---

## #44896 — david.zuelke@bitextender.com — 2009-07-10T10:38:25+00:00

URL: https://externals.io/message/44753#44896 · In reply to: #44761

> 
> > […]
>
> I agree+++.
>
> The problem is that PHP SOAP uses an internal "streams" library  
> instead
> of libcurl; the former lacks, the later has, client/server PKI  
> support.

Nonsense. ext/soap has support for all of this through PHP's "https"  
stream which wraps the "ssl" stream.

Please RT(F)M:
http://php.net/manual/en/soapclient.soapclient.php
http://php.net/manual/en/context.ssl.php

In short:

$c = new SoapClient(
   'https://foo/bar.wsdl',
   array(
     'stream_context" => stream_context_create(array(
       'ssl' => array(
         'verify_peer' => true
       )
     ))
   )
);

There is the whole range of options related to certs, including for CA  
certs etc. SoapClient itself has an option for a 'local_cert' as well.

- David

---

## #44910 — Hannes Magnusson — 2009-07-10T14:48:02+00:00

URL: https://externals.io/message/44753#44910

> David Zülke wrote:
>
> > […]
>
>
> This works and solves the issue, thank you :)
>
> The other methods I have been suggested and have been testing, for
> instance recompiling with --with-curlwrappers do NOT work.

--with-curlwrappers overwrites the builtin stream support to use curl.
The curlwrappers have their own context options:
http://php.net/context.curl


-Hannes

---

## #44911 — Richard Quadling — 2009-07-10T14:49:05+00:00

URL: https://externals.io/message/44753#44911 · In reply to: #44896

2009/7/10 David Zülke <david.zuelke@bitextender.com>:
> 
>
> > […]
>
> Nonsense. ext/soap has support for all of this through PHP's "https" stream
> which wraps the "ssl" stream.
>
> Please RT(F)M:
> http://php.net/manual/en/soapclient.soapclient.php
> http://php.net/manual/en/context.ssl.php
>
> In short:
>
> $c = new SoapClient(
>  'https://foo/bar.wsdl',
>  array(
>    'stream_context" => stream_context_create(array(
>      'ssl' => array(
>        'verify_peer' => true
>      )
>    ))
>  )
> );
>
> There is the whole range of options related to certs, including for CA certs
> etc. SoapClient itself has an option for a 'local_cert' as well.
>
> - David


That's a great example. When SVN is back online, I'll add that as an example.


-- 
-----
Richard Quadling
Zend Certified Engineer : http://zend.com/zce.php?c=ZEND002498&r=213474731
"Standing on the shoulders of some very clever giants!"
ZOPA : http://uk.zopa.com/member/RQuadling

---

## #44915 — Uwe Schindler — 2009-07-10T14:58:10+00:00

URL: https://externals.io/message/44753#44915

As far as I know, SOAP does not use the HTTP wrappers directly, it uses only
sockets/ssl for communication (so the context applies only to the lower
level SSL socket). So CURL is not used, because PHP's HTTP streams are not
used.

-----
Uwe Schindler
thetaphi@php.net - http://www.php.net
NSAPI SAPI developer
Bremen, Germany


> -----Original Message-----
> From: endrazine [mailto:endrazine@gmail.com]
> Sent: Friday, July 10, 2009 4:52 PM
> To: Hannes Magnusson
> Cc: David Zülke; PHP internals
> Subject: Re: [PHP-DEV] Soap over SSL and
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hannes Magnusson wrote:
> > […]
> 
> I verified it doesn't work.
> 
> Regards,
> 
> j-
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.9 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
> 
> iEYEARECAAYFAkpXVagACgkQK/YAm7PYyblesgCcD25MfGepg4UslL/YYi+R0Yo9
> Tu8An3hNn3ad3iXVsBK0fc/2BhqSkSTl
> =186g
> -----END PGP SIGNATURE

---

## #44916 — Hannes Magnusson — 2009-07-10T14:58:36+00:00

URL: https://externals.io/message/44753#44916

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hannes Magnusson wrote:
> > […]
>
> I verified it doesn't work.

Then please report a bug.

-Hannes

---

## #44918 — Hannes Magnusson — 2009-07-10T15:00:22+00:00

URL: https://externals.io/message/44753#44918 · In reply to: #44915

> As far as I know, SOAP does not use the HTTP wrappers directly, it uses only
> sockets/ssl for communication (so the context applies only to the lower
> level SSL socket). So CURL is not used, because PHP's HTTP streams are not
> used.


Ahhhh. You are right.
But that was because PHP streams didn't support chunked encoding, wasn't it?
Dmitry: There is no reason why SOAP should be doing its own magic anylonger?

-Hannes

---

## #44919 — endrazine — 2009-07-10T15:06:52+00:00

URL: https://externals.io/message/44753#44919 · In reply to: #44918

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hannes Magnusson wrote:
> 
> > […]
> 
> 
> Ahhhh. You are right.
> But that was because PHP streams didn't support chunked encoding, wasn't it?
> Dmitry: There is no reason why SOAP should be doing its own magic anylonger?
> 
> -Hannes
> 

Hello, I used gdb to follow the execution of a simple php sample using
sopaClient, and I confirm what Uwe Schindler said : SoapClient is not
using http wrappers. So again, compiling with --with-curlwrappers
doesn't solve the problem :)

Cheers,

j-
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkpXWQsACgkQK/YAm7PYybmb8ACfSorpjDl6gPu+VwNz2mBLRWFn
s9gAn0d4kSitdy7fMQChRBsZW1puzoow
=HgEP
-----END PGP SIGNATURE

---

## #44920 — david.zuelke@bitextender.com — 2009-07-10T15:09:27+00:00

URL: https://externals.io/message/44753#44920 · In reply to: #44918

> 
> > […]
>
>
> Ahhhh. You are right.
> But that was because PHP streams didn't support chunked encoding,  
> wasn't it?
> Dmitry: There is no reason why SOAP should be doing its own magic  
> anylonger?

Yes, that was the reason.

http://article.gmane.org/gmane.comp.php.devel/53763

- David

---

## #44938 — Dmitry Stogov — 2009-07-13T05:58:00+00:00

URL: https://externals.io/message/44753#44938 · In reply to: #44920

it's not the only reason. ext/soap also supports digital authentication
which is still unsupported by streams. (may be something else).

Thanks. Dmitry.


David Zülke wrote:
> 
> 
> > […]
> 
> Yes, that was the reason.
> 
> http://article.gmane.org/gmane.comp.php.devel/53763
> 
> - David