Skip to content

Commit b795892

Browse files
derickrderickr
committed
Merge branch 'v1.5'
2 parents d1ae6ae + 5383ca0 commit b795892

File tree

4 files changed

+104
-12
lines changed

4 files changed

+104
-12
lines changed

‎php_phongo.c

Lines changed: 67 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1968,6 +1968,29 @@ static bool php_phongo_apply_wc_options_to_uri(mongoc_uri_t* uri, bson_t* option
19681968
} /* }}} */
19691969

19701970
#ifdef MONGOC_ENABLE_SSL
1971+
1972+
static void php_phongo_mongoc_ssl_opts_from_uri(mongoc_ssl_opt_t* ssl_opt, mongoc_uri_t* uri, bool* any_ssl_option_set)
1973+
{
1974+
const char* pem_file = mongoc_uri_get_option_as_utf8(uri, MONGOC_URI_SSLCLIENTCERTIFICATEKEYFILE, NULL);
1975+
const char* pem_pwd = mongoc_uri_get_option_as_utf8(uri, MONGOC_URI_SSLCLIENTCERTIFICATEKEYPASSWORD, NULL);
1976+
const char* ca_file = mongoc_uri_get_option_as_utf8(uri, MONGOC_URI_SSLCERTIFICATEAUTHORITYFILE, NULL);
1977+
1978+
ssl_opt->pem_file = pem_file ? estrdup(pem_file) : NULL;
1979+
ssl_opt->pem_pwd = pem_pwd ? estrdup(pem_pwd) : NULL;
1980+
ssl_opt->ca_file = ca_file ? estrdup(ca_file) : NULL;
1981+
ssl_opt->weak_cert_validation = mongoc_uri_get_option_as_bool(uri, MONGOC_URI_SSLALLOWINVALIDCERTIFICATES, false);
1982+
ssl_opt->allow_invalid_hostname = mongoc_uri_get_option_as_bool(uri, MONGOC_URI_SSLALLOWINVALIDHOSTNAMES, false);
1983+
1984+
/* Boolean options default to false, so we cannot consider them for
1985+
* any_ssl_option_set. This isn't actually a problem as libmongoc will
1986+
* already have assigned them when creating the client, enabling SSL, and
1987+
* assigning SSL options. Therefore, we only need to check for non-defaults
1988+
* (i.e. non-NULL strings, true booleans). */
1989+
if (pem_file || pem_pwd || ca_file || ssl_opt->weak_cert_validation || ssl_opt->allow_invalid_hostname) {
1990+
*any_ssl_option_set = true;
1991+
}
1992+
}
1993+
19711994
static inline char* php_phongo_fetch_ssl_opt_string(zval* zoptions, const char* key, int key_len)
19721995
{
19731996
int plen;
@@ -1981,9 +2004,10 @@ static inline char* php_phongo_fetch_ssl_opt_string(zval* zoptions, const char*
19812004
return value;
19822005
}
19832006

1984-
static mongoc_ssl_opt_t* php_phongo_make_ssl_opt(zval* zoptions TSRMLS_DC)
2007+
static mongoc_ssl_opt_t* php_phongo_make_ssl_opt(mongoc_uri_t* uri, zval* zoptions TSRMLS_DC)
19852008
{
19862009
mongoc_ssl_opt_t* ssl_opt;
2010+
bool any_ssl_option_set = false;
19872011

19882012
if (!zoptions) {
19892013
return NULL;
@@ -2010,44 +2034,76 @@ static mongoc_ssl_opt_t* php_phongo_make_ssl_opt(zval* zoptions TSRMLS_DC)
20102034

20112035
ssl_opt = ecalloc(1, sizeof(mongoc_ssl_opt_t));
20122036

2037+
/* If SSL options are set in the URL, we need to read them and set them on
2038+
* the options struct so we can merge potential options from passed in
2039+
* driverOptions (zoptions) */
2040+
if (mongoc_uri_get_ssl(uri)) {
2041+
php_phongo_mongoc_ssl_opts_from_uri(ssl_opt, uri, &any_ssl_option_set);
2042+
}
2043+
20132044
/* Check canonical option names first and fall back to SSL context options
20142045
* for backwards compatibility. */
20152046
if (php_array_existsc(zoptions, "allow_invalid_hostname")) {
20162047
ssl_opt->allow_invalid_hostname = php_array_fetchc_bool(zoptions, "allow_invalid_hostname");
2048+
any_ssl_option_set = true;
20172049
}
20182050

20192051
if (php_array_existsc(zoptions, "weak_cert_validation")) {
20202052
ssl_opt->weak_cert_validation = php_array_fetchc_bool(zoptions, "weak_cert_validation");
2053+
any_ssl_option_set = true;
20212054
} else if (php_array_existsc(zoptions, "allow_self_signed")) {
20222055
ssl_opt->weak_cert_validation = php_array_fetchc_bool(zoptions, "allow_self_signed");
2056+
any_ssl_option_set = true;
20232057
}
20242058

2059+
#define PHONGO_SSL_OPTION_SWAP_STRING(o, n) \
2060+
if ((o)) { \
2061+
efree((char*) (o)); \
2062+
} \
2063+
(o) = php_phongo_fetch_ssl_opt_string(zoptions, ZEND_STRL((n)));
2064+
20252065
if (php_array_existsc(zoptions, "pem_file")) {
2026-
ssl_opt->pem_file = php_phongo_fetch_ssl_opt_string(zoptions, ZEND_STRL("pem_file"));
2066+
PHONGO_SSL_OPTION_SWAP_STRING(ssl_opt->pem_file, "pem_file");
2067+
any_ssl_option_set = true;
20272068
} else if (php_array_existsc(zoptions, "local_cert")) {
2028-
ssl_opt->pem_file = php_phongo_fetch_ssl_opt_string(zoptions, ZEND_STRL("local_cert"));
2069+
PHONGO_SSL_OPTION_SWAP_STRING(ssl_opt->pem_file, "local_cert");
2070+
any_ssl_option_set = true;
20292071
}
20302072

20312073
if (php_array_existsc(zoptions, "pem_pwd")) {
2032-
ssl_opt->pem_pwd = php_phongo_fetch_ssl_opt_string(zoptions, ZEND_STRL("pem_pwd"));
2074+
PHONGO_SSL_OPTION_SWAP_STRING(ssl_opt->pem_pwd, "pem_pwd");
2075+
any_ssl_option_set = true;
20332076
} else if (php_array_existsc(zoptions, "passphrase")) {
2034-
ssl_opt->pem_pwd = php_phongo_fetch_ssl_opt_string(zoptions, ZEND_STRL("passphrase"));
2077+
PHONGO_SSL_OPTION_SWAP_STRING(ssl_opt->pem_pwd, "passphrase");
2078+
any_ssl_option_set = true;
20352079
}
20362080

20372081
if (php_array_existsc(zoptions, "ca_file")) {
2038-
ssl_opt->ca_file = php_phongo_fetch_ssl_opt_string(zoptions, ZEND_STRL("ca_file"));
2082+
PHONGO_SSL_OPTION_SWAP_STRING(ssl_opt->ca_file, "ca_file");
2083+
any_ssl_option_set = true;
20392084
} else if (php_array_existsc(zoptions, "cafile")) {
2040-
ssl_opt->ca_file = php_phongo_fetch_ssl_opt_string(zoptions, ZEND_STRL("cafile"));
2085+
PHONGO_SSL_OPTION_SWAP_STRING(ssl_opt->ca_file, "cafile");
2086+
any_ssl_option_set = true;
20412087
}
20422088

20432089
if (php_array_existsc(zoptions, "ca_dir")) {
2044-
ssl_opt->ca_dir = php_phongo_fetch_ssl_opt_string(zoptions, ZEND_STRL("ca_dir"));
2090+
PHONGO_SSL_OPTION_SWAP_STRING(ssl_opt->ca_dir, "ca_dir");
2091+
any_ssl_option_set = true;
20452092
} else if (php_array_existsc(zoptions, "capath")) {
2046-
ssl_opt->ca_dir = php_phongo_fetch_ssl_opt_string(zoptions, ZEND_STRL("capath"));
2093+
PHONGO_SSL_OPTION_SWAP_STRING(ssl_opt->ca_dir, "capath");
2094+
any_ssl_option_set = true;
20472095
}
20482096

20492097
if (php_array_existsc(zoptions, "crl_file")) {
2050-
ssl_opt->crl_file = php_phongo_fetch_ssl_opt_string(zoptions, ZEND_STRL("crl_file"));
2098+
PHONGO_SSL_OPTION_SWAP_STRING(ssl_opt->crl_file, "crl_file");
2099+
any_ssl_option_set = true;
2100+
}
2101+
2102+
#undef PHONGO_SSL_OPTION_SWAP_STRING
2103+
2104+
if (!any_ssl_option_set) {
2105+
efree(ssl_opt);
2106+
return NULL;
20512107
}
20522108

20532109
return ssl_opt;
@@ -2465,7 +2521,7 @@ void phongo_manager_init(php_phongo_manager_t* manager, const char* uri_string,
24652521
}
24662522

24672523
#ifdef MONGOC_ENABLE_SSL
2468-
ssl_opt = php_phongo_make_ssl_opt(driverOptions TSRMLS_CC);
2524+
ssl_opt = php_phongo_make_ssl_opt(uri, driverOptions TSRMLS_CC);
24692525

24702526
/* An exception may be thrown during SSL option creation */
24712527
if (EG(exception)) {

‎tests/manager/manager-ctor-ssl-002.phpt

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
--TEST--
2+
PHPC-1239: Passing SSL driverOptions overrides SSL options from URI
3+
--SKIPIF--
4+
<?php require __DIR__ . "/../utils/basic-skipif.inc"; ?>
5+
<?php skip_if_not_live(); ?>
6+
--FILE--
7+
<?php
8+
require_once __DIR__ . "/../utils/basic.inc";
9+
10+
$manager = new MongoDB\Driver\Manager(URI, array(), array());
11+
12+
$manager->executeCommand(DATABASE_NAME, new MongoDB\Driver\Command(['ping' => 1]));
13+
?>
14+
===DONE===
15+
<?php exit(0); ?>
16+
--EXPECT--
17+
===DONE===

‎tests/manager/manager-set-uri-options-003.phpt

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
--TEST--
2+
MongoDB\Driver\Manager: SSL options in URI and 'options' don't leak
3+
--SKIPIF--
4+
<?php require __DIR__ . "/../utils/basic-skipif.inc"; ?>
5+
<?php skip_if_not_libmongoc_ssl(); ?>
6+
<?php skip_if_not_ssl(); ?>
7+
--FILE--
8+
<?php
9+
require_once __DIR__ . "/../utils/basic.inc";
10+
11+
$options = array(
12+
"pem_pwd" => "does-not-matter",
13+
);
14+
15+
$manager = new MongoDB\Driver\Manager(URI . '&sslclientcertificatekeypassword=does-also-not-matter', [], $options);
16+
?>
17+
===DONE===
18+
<?php exit(0); ?>
19+
--EXPECTF--
20+
===DONE===

‎tests/standalone/manager-as-singleton.phpt

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@ PHPC-431: Segfault when using Manager through singleton class
33
--SKIPIF--
44
<?php require __DIR__ . "/../utils/basic-skipif.inc"; ?>
55
<?php skip_if_not_live(); ?>
6-
<?php skip_if_ssl(); /* Temporary, until PHPC-1239 is resolved */ ?>
76
--FILE--
87
<?php
98
use MongoDB\Driver\Manager;

0 commit comments

Comments
 (0)