|
| 1 | +#!/usr/bin/env php |
| 2 | +<?php |
| 3 | + |
| 4 | +class Tls12Checker |
| 5 | +{ |
| 6 | + const API_URI = 'api-tls12.commercetools.com'; |
| 7 | + |
| 8 | + const URIS = [ |
| 9 | + 'auth-tls12.commercetools.com', |
| 10 | + 'api-tls12.commercetools.com', |
| 11 | + 'auth-tls12.commercetools.co', |
| 12 | + 'api-tls12.commercetools.co', |
| 13 | + 'api.sphere.io', |
| 14 | + 'api.commercetools.co', |
| 15 | + ]; |
| 16 | + |
| 17 | + public function allowedCiphers() |
| 18 | + { |
| 19 | + return [ |
| 20 | + 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA', |
| 21 | + 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256', |
| 22 | + 'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA', |
| 23 | + 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384', |
| 24 | + 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256', |
| 25 | + 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA', |
| 26 | + 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256', |
| 27 | + 'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA', |
| 28 | + 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', |
| 29 | + 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256', |
| 30 | + ]; |
| 31 | + } |
| 32 | + |
| 33 | + /** |
| 34 | + * @return array |
| 35 | + * @throws \Exception |
| 36 | + */ |
| 37 | + private function getSupportedCiphers() |
| 38 | + { |
| 39 | + $ch = curl_init(); |
| 40 | + curl_setopt($ch, CURLOPT_URL, "https://www.howsmyssl.com/a/check"); |
| 41 | + curl_setopt($ch, CURLOPT_SSLVERSION, 6); |
| 42 | + curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); |
| 43 | + $response = curl_exec($ch); |
| 44 | + curl_close($ch); |
| 45 | + $tlsInfo = json_decode($response, true); |
| 46 | + |
| 47 | + if ($response === false) { |
| 48 | + throw new \Exception('Connection not connect using TLS 1.2', 1); |
| 49 | + } |
| 50 | + |
| 51 | + return isset($tlsInfo['given_cipher_suites']) ? $tlsInfo['given_cipher_suites'] : []; |
| 52 | + } |
| 53 | + |
| 54 | + /** |
| 55 | + * @throws \Exception |
| 56 | + */ |
| 57 | + private function checkCiphers() |
| 58 | + { |
| 59 | + $supportedCiphers = $this->getSupportedCiphers(); |
| 60 | + $allowedCiphers = $this->allowedCiphers(); |
| 61 | + |
| 62 | + $diff = array_diff($allowedCiphers, $supportedCiphers); |
| 63 | + |
| 64 | + if (count($diff) < count($allowedCiphers)) { |
| 65 | + return; |
| 66 | + }; |
| 67 | + throw new \Exception('None of the allowed cipher suites are supported by curl: ' . implode(', ', $allowedCiphers), 1); |
| 68 | + } |
| 69 | + |
| 70 | + /** |
| 71 | + * @param string $apiUri |
| 72 | + * @param string $cipher |
| 73 | + * @throws Exception |
| 74 | + */ |
| 75 | + private function checkApiConnection($apiUri = self::API_URI, $cipher = null) |
| 76 | + { |
| 77 | + $ch = curl_init(); |
| 78 | + curl_setopt($ch, CURLOPT_URL, 'https://' . $apiUri); |
| 79 | + curl_setopt($ch, CURLOPT_SSLVERSION, 6); |
| 80 | + if (!is_null($cipher)) { |
| 81 | + curl_setopt($ch, CURLOPT_SSL_CIPHER_LIST, $cipher); |
| 82 | + } |
| 83 | + curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); |
| 84 | + $response = curl_exec($ch); |
| 85 | + curl_close($ch); |
| 86 | + |
| 87 | + if ($response == false) { |
| 88 | + throw new \Exception('Could not connect not connect to API using TLS 1.2' . (is_null($cipher) ? '' : ' with cipher ' . $cipher), 1); |
| 89 | + } |
| 90 | + } |
| 91 | + |
| 92 | + private function checkCurlVersion() |
| 93 | + { |
| 94 | + $curlVersion = curl_version(); |
| 95 | + $supportsTLS12 = true; |
| 96 | + if (version_compare(curl_version()['version'], '7.34.0', '<')) { |
| 97 | + $supportsTLS12 = false; |
| 98 | + } |
| 99 | + echo 'Curl version: ' . ($supportsTLS12 ? "\033[32m" : "\033[31m") . curl_version()['version'] . "\033[0m" . ($supportsTLS12 ? '' : '(TLS 1.2 not supported)') . PHP_EOL; |
| 100 | + |
| 101 | + if (isset($curlVersion['ssl_version'])) { |
| 102 | + echo 'Curl SSL Library: ' . curl_version()['ssl_version'] . PHP_EOL; |
| 103 | + } |
| 104 | + } |
| 105 | + |
| 106 | + /** |
| 107 | + * @return int |
| 108 | + */ |
| 109 | + public function check() |
| 110 | + { |
| 111 | + $this->checkCurlVersion(); |
| 112 | + |
| 113 | + echo "Checking TLS 1.2 connection ... "; |
| 114 | + try { |
| 115 | + $this->checkCiphers(); |
| 116 | + foreach (self::URIS as $uri) { |
| 117 | + $this->checkApiConnection($uri); |
| 118 | + } |
| 119 | + } catch (\Exception $exception) { |
| 120 | + echo "\033[31mFailed\033[0m" . PHP_EOL; |
| 121 | + echo $exception->getMessage() . PHP_EOL; |
| 122 | + return (int)$exception->getCode(); |
| 123 | + } |
| 124 | + |
| 125 | + echo "\033[32mOK\033[0m" . PHP_EOL; |
| 126 | + |
| 127 | + return 0; |
| 128 | + } |
| 129 | + |
| 130 | +// private function availableCiphers() |
| 131 | +// { |
| 132 | +// $localCiphers = explode(' ', exec('openssl ciphers \'ALL:eNULL\' | tr \':\' \' \'')); |
| 133 | +// $allowedCiphers = []; |
| 134 | +// foreach ($localCiphers as $localCipher) { |
| 135 | +// exec('echo -n | openssl s_client -connect ' . self::API_URI . ':443 -cipher ' . $localCipher . ' -tls1_2 2>&1', $dummy, $status); |
| 136 | +// if ($status === 0) { |
| 137 | +// $allowedCiphers[] = $localCipher; |
| 138 | +// } |
| 139 | +// } |
| 140 | +// |
| 141 | +// return $allowedCiphers; |
| 142 | +// } |
| 143 | +// |
| 144 | +// private function checkAvailableCiphers() |
| 145 | +// { |
| 146 | +// $availableCiphers = $this->availableCiphers(); |
| 147 | +// foreach ($availableCiphers as $cipher) { |
| 148 | +// echo 'Testing ' . $cipher . '...'; |
| 149 | +// try { |
| 150 | +// $this->checkApiConnection(self::API_URI, $cipher); |
| 151 | +// echo "\033[32mOK\033[0m" . PHP_EOL; |
| 152 | +// } catch (\Exception $exception) { |
| 153 | +// echo "\033[31mFailed\033[0m" . PHP_EOL; |
| 154 | +// } |
| 155 | +// } |
| 156 | +// } |
| 157 | +} |
| 158 | + |
| 159 | +$checker = new Tls12Checker(); |
| 160 | +exit($checker->check()); |
0 commit comments