includes/http/PhpHttpRequest.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  */
  20
  21 class PhpHttpRequest extends MWHttpRequest {
  22
  23         private $fopenErrors = [];
  24
  25         /**
  26          * @param string $url
  27          * @return string
  28          */
  29         protected function urlToTcp( $url ) {
  30                 $parsedUrl = parse_url( $url );
  31
  32                 return 'tcp://' . $parsedUrl['host'] . ':' . $parsedUrl['port'];
  33         }
  34
  35         /**
  36          * Returns an array with a 'capath' or 'cafile' key
  37          * that is suitable to be merged into the 'ssl' sub-array of
  38          * a stream context options array.
  39          * Uses the 'caInfo' option of the class if it is provided, otherwise uses the system
  40          * default CA bundle if PHP supports that, or searches a few standard locations.
  41          * @return array
  42          * @throws DomainException
  43          */
  44         protected function getCertOptions() {
  45                 $certOptions = [];
  46                 $certLocations = [];
  47                 if ( $this->caInfo ) {
  48                         $certLocations = [ 'manual' => $this->caInfo ];
  49                 } elseif ( version_compare( PHP_VERSION, '5.6.0', '<' ) ) {
  50                         // @codingStandardsIgnoreStart Generic.Files.LineLength
  51                         // Default locations, based on
  52                         // https://www.happyassassin.net/2015/01/12/a-note-about-ssltls-trusted-certificate-stores-and-platforms/
  53                         // PHP 5.5 and older doesn't have any defaults, so we try to guess ourselves.
  54                         // PHP 5.6+ gets the CA location from OpenSSL as long as it is not set manually,
  55                         // so we should leave capath/cafile empty there.
  56                         // @codingStandardsIgnoreEnd
  57                         $certLocations = array_filter( [
  58                                 getenv( 'SSL_CERT_DIR' ),
  59                                 getenv( 'SSL_CERT_PATH' ),
  60                                 '/etc/pki/tls/certs/ca-bundle.crt', # Fedora et al
  61                                 '/etc/ssl/certs',  # Debian et al
  62                                 '/etc/pki/tls/certs/ca-bundle.trust.crt',
  63                                 '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem',
  64                                 '/System/Library/OpenSSL', # OSX
  65                         ] );
  66                 }
  67
  68                 foreach ( $certLocations as $key => $cert ) {
  69                         if ( is_dir( $cert ) ) {
  70                                 $certOptions['capath'] = $cert;
  71                                 break;
  72                         } elseif ( is_file( $cert ) ) {
  73                                 $certOptions['cafile'] = $cert;
  74                                 break;
  75                         } elseif ( $key === 'manual' ) {
  76                                 // fail more loudly if a cert path was manually configured and it is not valid
  77                                 throw new DomainException( "Invalid CA info passed: $cert" );
  78                         }
  79                 }
  80
  81                 return $certOptions;
  82         }
  83
  84         /**
  85          * Custom error handler for dealing with fopen() errors.
  86          * fopen() tends to fire multiple errors in succession, and the last one
  87          * is completely useless (something like "fopen: failed to open stream")
  88          * so normal methods of handling errors programmatically
  89          * like get_last_error() don't work.
  90          * @internal
  91          * @param int $errno
  92          * @param string $errstr
  93          */
  94         public function errorHandler( $errno, $errstr ) {
  95                 $n = count( $this->fopenErrors ) + 1;
  96                 $this->fopenErrors += [ "errno$n" => $errno, "errstr$n" => $errstr ];
  97         }
  98
  99         /**
 100          * @see MWHttpRequest::execute
 101          *
 102          * @return Status
 103          */
 104         public function execute() {
 105                 $this->prepare();
 106
 107                 if ( is_array( $this->postData ) ) {
 108                         $this->postData = wfArrayToCgi( $this->postData );
 109                 }
 110
 111                 if ( $this->parsedUrl['scheme'] != 'http'
 112                         && $this->parsedUrl['scheme'] != 'https' ) {
 113                         $this->status->fatal( 'http-invalid-scheme', $this->parsedUrl['scheme'] );
 114                 }
 115
 116                 $this->reqHeaders['Accept'] = "*/*";
 117                 $this->reqHeaders['Connection'] = 'Close';
 118                 if ( $this->method == 'POST' ) {
 119                         // Required for HTTP 1.0 POSTs
 120                         $this->reqHeaders['Content-Length'] = strlen( $this->postData );
 121                         if ( !isset( $this->reqHeaders['Content-Type'] ) ) {
 122                                 $this->reqHeaders['Content-Type'] = "application/x-www-form-urlencoded";
 123                         }
 124                 }
 125
 126                 // Set up PHP stream context
 127                 $options = [
 128                         'http' => [
 129                                 'method' => $this->method,
 130                                 'header' => implode( "\r\n", $this->getHeaderList() ),
 131                                 'protocol_version' => '1.1',
 132                                 'max_redirects' => $this->followRedirects ? $this->maxRedirects : 0,
 133                                 'ignore_errors' => true,
 134                                 'timeout' => $this->timeout,
 135                                 // Curl options in case curlwrappers are installed
 136                                 'curl_verify_ssl_host' => $this->sslVerifyHost ? 2 : 0,
 137                                 'curl_verify_ssl_peer' => $this->sslVerifyCert,
 138                         ],
 139                         'ssl' => [
 140                                 'verify_peer' => $this->sslVerifyCert,
 141                                 'SNI_enabled' => true,
 142                                 'ciphers' => 'HIGH:!SSLv2:!SSLv3:-ADH:-kDH:-kECDH:-DSS',
 143                                 'disable_compression' => true,
 144                         ],
 145                 ];
 146
 147                 if ( $this->proxy ) {
 148                         $options['http']['proxy'] = $this->urlToTcp( $this->proxy );
 149                         $options['http']['request_fulluri'] = true;
 150                 }
 151
 152                 if ( $this->postData ) {
 153                         $options['http']['content'] = $this->postData;
 154                 }
 155
 156                 if ( $this->sslVerifyHost ) {
 157                         // PHP 5.6.0 deprecates CN_match, in favour of peer_name which
 158                         // actually checks SubjectAltName properly.
 159                         if ( version_compare( PHP_VERSION, '5.6.0', '>=' ) ) {
 160                                 $options['ssl']['peer_name'] = $this->parsedUrl['host'];
 161                         } else {
 162                                 $options['ssl']['CN_match'] = $this->parsedUrl['host'];
 163                         }
 164                 }
 165
 166                 $options['ssl'] += $this->getCertOptions();
 167
 168                 $context = stream_context_create( $options );
 169
 170                 $this->headerList = [];
 171                 $reqCount = 0;
 172                 $url = $this->url;
 173
 174                 $result = [];
 175
 176                 if ( $this->profiler ) {
 177                         $profileSection = $this->profiler->scopedProfileIn(
 178                                 __METHOD__ . '-' . $this->profileName
 179                         );
 180                 }
 181                 do {
 182                         $reqCount++;
 183                         $this->fopenErrors = [];
 184                         set_error_handler( [ $this, 'errorHandler' ] );
 185                         $fh = fopen( $url, "r", false, $context );
 186                         restore_error_handler();
 187
 188                         if ( !$fh ) {
 189                                 // HACK for instant commons.
 190                                 // If we are contacting (commons|upload).wikimedia.org
 191                                 // try again with CN_match for en.wikipedia.org
 192                                 // as php does not handle SubjectAltName properly
 193                                 // prior to "peer_name" option in php 5.6
 194                                 if ( isset( $options['ssl']['CN_match'] )
 195                                         && ( $options['ssl']['CN_match'] === 'commons.wikimedia.org'
 196                                                 || $options['ssl']['CN_match'] === 'upload.wikimedia.org' )
 197                                 ) {
 198                                         $options['ssl']['CN_match'] = 'en.wikipedia.org';
 199                                         $context = stream_context_create( $options );
 200                                         continue;
 201                                 }
 202                                 break;
 203                         }
 204
 205                         $result = stream_get_meta_data( $fh );
 206                         $this->headerList = $result['wrapper_data'];
 207                         $this->parseHeader();
 208
 209                         if ( !$this->followRedirects ) {
 210                                 break;
 211                         }
 212
 213                         # Handle manual redirection
 214                         if ( !$this->isRedirect() || $reqCount > $this->maxRedirects ) {
 215                                 break;
 216                         }
 217                         # Check security of URL
 218                         $url = $this->getResponseHeader( "Location" );
 219
 220                         if ( !Http::isValidURI( $url ) ) {
 221                                 $this->logger->debug( __METHOD__ . ": insecure redirection\n" );
 222                                 break;
 223                         }
 224                 } while ( true );
 225                 if ( $this->profiler ) {
 226                         $this->profiler->scopedProfileOut( $profileSection );
 227                 }
 228
 229                 $this->setStatus();
 230
 231                 if ( $fh === false ) {
 232                         if ( $this->fopenErrors ) {
 233                                 $this->logger->warning( __CLASS__
 234                                         . ': error opening connection: {errstr1}', $this->fopenErrors );
 235                         }
 236                         $this->status->fatal( 'http-request-error' );
 237                         return Status::wrap( $this->status ); // TODO B/C; move this to callers
 238                 }
 239
 240                 if ( $result['timed_out'] ) {
 241                         $this->status->fatal( 'http-timed-out', $this->url );
 242                         return Status::wrap( $this->status ); // TODO B/C; move this to callers
 243                 }
 244
 245                 // If everything went OK, or we received some error code
 246                 // get the response body content.
 247                 if ( $this->status->isOK() || (int)$this->respStatus >= 300 ) {
 248                         while ( !feof( $fh ) ) {
 249                                 $buf = fread( $fh, 8192 );
 250
 251                                 if ( $buf === false ) {
 252                                         $this->status->fatal( 'http-read-error' );
 253                                         break;
 254                                 }
 255
 256                                 if ( strlen( $buf ) ) {
 257                                         call_user_func( $this->callback, $fh, $buf );
 258                                 }
 259                         }
 260                 }
 261                 fclose( $fh );
 262
 263                 return Status::wrap( $this->status ); // TODO B/C; move this to callers
 264         }
 265 }