Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitbd38bbd

Browse files
[HttpClient] Add optioncrypto_method to set the minimum TLS version and make it default to TLSv1.2
1 parent6222f8e commitbd38bbd

File tree

10 files changed

+53
-4
lines changed

10 files changed

+53
-4
lines changed

‎UPGRADE-6.3.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,8 @@ FrameworkBundle
6868
HttpClient
6969
----------
7070

71+
* The minimum TLS version now defaults to TLSv1.2; use the`crypto_method`
72+
option if you need to connect to servers that don't support it
7173
* The default user agents have been renamed from`Symfony HttpClient/Amp`,`Symfony HttpClient/Curl`
7274
and`Symfony HttpClient/Native` to`Symfony HttpClient (Amp)`,`Symfony HttpClient (Curl)`
7375
and`Symfony HttpClient (Native)` respectively to comply with the RFC 9110 specification

‎src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1817,7 +1817,7 @@ private function addHttpClientSection(ArrayNodeDefinition $rootNode, callable $e
18171817
->info('A network interface name, IP address, a host name or a UNIX socket to bind to.')
18181818
->end()
18191819
->booleanNode('verify_peer')
1820-
->info('Indicates if the peer should be verified in anSSL/TLS context.')
1820+
->info('Indicates if the peer should be verified in an TLS context.')
18211821
->end()
18221822
->booleanNode('verify_host')
18231823
->info('Indicates if the host should exist as a certificate common name.')
@@ -1838,7 +1838,7 @@ private function addHttpClientSection(ArrayNodeDefinition $rootNode, callable $e
18381838
->info('The passphrase used to encrypt the "local_pk" file.')
18391839
->end()
18401840
->scalarNode('ciphers')
1841-
->info('A list ofSSL/TLS ciphers separated by colons, commas or spaces (e.g. "RC3-SHA:TLS13-AES-128-GCM-SHA256"...)')
1841+
->info('A list of TLS ciphers separated by colons, commas or spaces (e.g. "RC3-SHA:TLS13-AES-128-GCM-SHA256"...)')
18421842
->end()
18431843
->arrayNode('peer_fingerprint')
18441844
->info('Associative array: hashing algorithm => hash(es).')
@@ -1849,6 +1849,9 @@ private function addHttpClientSection(ArrayNodeDefinition $rootNode, callable $e
18491849
->variableNode('md5')->end()
18501850
->end()
18511851
->end()
1852+
->scalarNode('crypto_method')
1853+
->info('The minimum version of TLS to accept; must be one of STREAM_CRYPTO_METHOD_TLSv*_CLIENT constants.')
1854+
->end()
18521855
->arrayNode('extra')
18531856
->info('Extra options for specific HTTP client')
18541857
->normalizeKeys(false)
@@ -1965,7 +1968,7 @@ private function addHttpClientSection(ArrayNodeDefinition $rootNode, callable $e
19651968
->info('A network interface name, IP address, a host name or a UNIX socket to bind to.')
19661969
->end()
19671970
->booleanNode('verify_peer')
1968-
->info('Indicates if the peer should be verified inan SSL/TLS context.')
1971+
->info('Indicates if the peer should be verified inaTLS context.')
19691972
->end()
19701973
->booleanNode('verify_host')
19711974
->info('Indicates if the host should exist as a certificate common name.')
@@ -1986,7 +1989,7 @@ private function addHttpClientSection(ArrayNodeDefinition $rootNode, callable $e
19861989
->info('The passphrase used to encrypt the "local_pk" file.')
19871990
->end()
19881991
->scalarNode('ciphers')
1989-
->info('A list ofSSL/TLS ciphers separated by colons, commas or spaces (e.g. "RC3-SHA:TLS13-AES-128-GCM-SHA256"...)')
1992+
->info('A list of TLS ciphers separated by colons, commas or spaces (e.g. "RC3-SHA:TLS13-AES-128-GCM-SHA256"...)')
19901993
->end()
19911994
->arrayNode('peer_fingerprint')
19921995
->info('Associative array: hashing algorithm => hash(es).')

‎src/Symfony/Component/HttpClient/AmpHttpClient.php‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,10 @@ final class AmpHttpClient implements HttpClientInterface, LoggerAwareInterface,
4747
use HttpClientTrait;
4848
use LoggerAwareTrait;
4949

50+
publicconstOPTIONS_DEFAULTS = HttpClientInterface::OPTIONS_DEFAULTS + [
51+
'crypto_method' => \STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
52+
];
53+
5054
privatearray$defaultOptions =self::OPTIONS_DEFAULTS;
5155
privatestaticarray$emptyDefaults =self::OPTIONS_DEFAULTS;
5256
privateAmpClientState$multi;

‎src/Symfony/Component/HttpClient/CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ CHANGELOG
44
6.3
55
---
66

7+
* Add option`crypto_method` to set the minimum TLS version and make it default to TLSv1.2
78
* Add`UriTemplateHttpClient` to use URI templates as specified in the RFC 6570
89
* Add`ServerSentEvent::getArrayData()` to get the Server-Sent Event's data decoded as an array when it's a JSON payload
910
* Allow array of urls as`base_uri` option value in`RetryableHttpClient` to retry on a new url each time

‎src/Symfony/Component/HttpClient/CurlHttpClient.php‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ final class CurlHttpClient implements HttpClientInterface, LoggerAwareInterface,
3636
{
3737
use HttpClientTrait;
3838

39+
publicconstOPTIONS_DEFAULTS = HttpClientInterface::OPTIONS_DEFAULTS + [
40+
'crypto_method' => \STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
41+
];
42+
3943
privatearray$defaultOptions =self::OPTIONS_DEFAULTS + [
4044
'auth_ntlm' =>null,// array|string - an array containing the username as first value, and optionally the
4145
// password as the second one; or string like username:password - enabling NTLM auth
@@ -116,6 +120,12 @@ public function request(string $method, string $url, array $options = []): Respo
116120
\CURLOPT_SSLKEY =>$options['local_pk'],
117121
\CURLOPT_KEYPASSWD =>$options['passphrase'],
118122
\CURLOPT_CERTINFO =>$options['capture_peer_cert_chain'],
123+
\CURLOPT_SSLVERSION =>match ($options['crypto_method']) {
124+
\STREAM_CRYPTO_METHOD_TLSv1_3_CLIENT => \CURL_SSLVERSION_TLSv1_3,
125+
\STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT => \CURL_SSLVERSION_TLSv1_2,
126+
\STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT => \CURL_SSLVERSION_TLSv1_1,
127+
\STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT => \CURL_SSLVERSION_TLSv1_0,
128+
},
119129
];
120130

121131
if (1.0 === (float)$options['http_version']) {

‎src/Symfony/Component/HttpClient/HttpClientTrait.php‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
useSymfony\Component\HttpClient\Response\StreamableInterface;
1717
useSymfony\Component\HttpClient\Response\StreamWrapper;
1818
useSymfony\Component\Mime\MimeTypes;
19+
useSymfony\Contracts\HttpClient\HttpClientInterface;
1920

2021
/**
2122
* Provides the common logic from writing HttpClientInterface implementations.
@@ -116,6 +117,15 @@ private static function prepareRequest(?string $method, ?string $url, array $opt
116117
$options['peer_fingerprint'] =self::normalizePeerFingerprint($options['peer_fingerprint']);
117118
}
118119

120+
if (isset($options['crypto_method']) && !\in_array($options['crypto_method'], [
121+
\STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT,
122+
\STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT,
123+
\STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
124+
\STREAM_CRYPTO_METHOD_TLSv1_3_CLIENT,
125+
],true)) {
126+
thrownewInvalidArgumentException('Option "crypto_method" must be one of "STREAM_CRYPTO_METHOD_TLSv1_*_CLIENT".');
127+
}
128+
119129
// Validate on_progress
120130
if (isset($options['on_progress']) && !\is_callable($onProgress =$options['on_progress'])) {
121131
thrownewInvalidArgumentException(sprintf('Option "on_progress" must be callable, "%s" given.',get_debug_type($onProgress)));

‎src/Symfony/Component/HttpClient/Internal/AmpClientState.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@ private function getClient(array $options): array
126126
'ciphers' =>$options['ciphers'],
127127
'capture_peer_cert_chain' =>$options['capture_peer_cert_chain'] ||$options['peer_fingerprint'],
128128
'proxy' =>$options['proxy'],
129+
'crypto_method' =>$options['crypto_method'],
129130
];
130131

131132
$key =hash('xxh128',serialize($options));
@@ -141,6 +142,7 @@ private function getClient(array $options): array
141142
$options['local_cert'] &&$context =$context->withCertificate(newCertificate($options['local_cert'],$options['local_pk']));
142143
$options['ciphers'] &&$context =$context->withCiphers($options['ciphers']);
143144
$options['capture_peer_cert_chain'] &&$context =$context->withPeerCapturing();
145+
$options['crypto_method'] &&$context =$context->withMinimumVersion($options['crypto_method']);
144146

145147
$connector =$handleConnector =newclass()implements Connector {
146148
public$connector;

‎src/Symfony/Component/HttpClient/NativeHttpClient.php‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ final class NativeHttpClient implements HttpClientInterface, LoggerAwareInterfac
3636
use HttpClientTrait;
3737
use LoggerAwareTrait;
3838

39+
publicconstOPTIONS_DEFAULTS = HttpClientInterface::OPTIONS_DEFAULTS + [
40+
'crypto_method' => \STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,
41+
];
42+
3943
privatearray$defaultOptions =self::OPTIONS_DEFAULTS;
4044
privatestaticarray$emptyDefaults =self::OPTIONS_DEFAULTS;
4145

@@ -198,6 +202,12 @@ public function request(string $method, string $url, array $options = []): Respo
198202
$options['timeout'] =min($options['max_duration'],$options['timeout']);
199203
}
200204

205+
switch ($cryptoMethod =$options['crypto_method']) {
206+
case \STREAM_CRYPTO_METHOD_TLSv1_0_CLIENT:$cryptoMethod |= \STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT;
207+
case \STREAM_CRYPTO_METHOD_TLSv1_1_CLIENT:$cryptoMethod |= \STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT;
208+
case \STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT:$cryptoMethod |= \STREAM_CRYPTO_METHOD_TLSv1_3_CLIENT;
209+
}
210+
201211
$context = [
202212
'http' => [
203213
'protocol_version' =>min($options['http_version'] ?:'1.1','1.1'),
@@ -224,6 +234,7 @@ public function request(string $method, string $url, array $options = []): Respo
224234
'allow_self_signed' => (bool)$options['peer_fingerprint'],
225235
'SNI_enabled' =>true,
226236
'disable_compression' =>true,
237+
'crypto_method' =>$cryptoMethod,
227238
],staticfn ($v) =>null !==$v),
228239
'socket' => [
229240
'bindto' =>$options['bindto'],

‎src/Symfony/Contracts/CHANGELOG.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
CHANGELOG
22
=========
33

4+
3.3
5+
---
6+
7+
* Add option`crypto_method` to`HttpClientInterface` to define the minimum TLS version to accept
8+
49
3.2
510
---
611

‎src/Symfony/Contracts/HttpClient/HttpClientInterface.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,7 @@ interface HttpClientInterface
6666
'ciphers' =>null,
6767
'peer_fingerprint' =>null,
6868
'capture_peer_cert_chain' =>false,
69+
'crypto_method' => \STREAM_CRYPTO_METHOD_TLSv1_2_CLIENT,// STREAM_CRYPTO_METHOD_TLSv*_CLIENT - minimum TLS version
6970
'extra' => [],// array - additional options that can be ignored if unsupported, unlike regular options
7071
];
7172

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp