Page MenuHomePhabricator
Create Task
Maniphest T75203

PhpHttpRequest requires a certificate repository
Closed, ResolvedPublic
Actions

Description

When I activated $wgInstantCommons on my fresh computer without php-curl (so MW used PhpHttpRequest to download data from Commons), it didn’t work until I specified the caInfo option in PhpHttpRequest (to /etc/ssl/certs, Ubuntu 14.04).

(Then I experienced bug 73199 but this is not directly linked.)

It would be nice if this piece of code could automatically find the certificate repository file or directory. Perhaps some magic value make PHP automatically find the default cert repo of the system or perhaps it works on some couple (PHP version, Operating System).

Else I don’t see other solutions than specifing default cert repo for major OS (I know, it would be a pain to maintain it). Or another option would be to even remove all HTTPS-related code in PhpHttpRequest and require CURL for HTTPS.

Before changing anything, it would be great to see this is bug is widely experienced on various platforms (PHP+OS) or if it is only an isolated case.

Version: 1.25-git
Severity: normal

Details

Reference
bz73203
SubjectRepoBranchLines +/-
Use system default location for cafile when using php fopen.mediawiki/coreREL1_24+45 -7
Use system default location for cafile when using php fopen.mediawiki/coreREL1_25+45 -7
Use system default location for cafile when using php fopen.mediawiki/coreREL1_23+45 -7
Use system default location for cafile when using php fopen.mediawiki/coremaster+45 -7
Customize query in gerrit

Related Objects
Search...

Event Timeline

• bzimport raised the priority of this task from to Medium.Nov 22 2014, 3:45 AM
• bzimport added a project: MediaWiki-General.
• bzimport set Reference to bz73203.
• bzimport added a subscriber: Unknown Object (MLST).
Seb35 created this task.Nov 9 2014, 5:37 PM
Seb35 mentioned this in T75199: PhpHttpRequest should not check host against CN x509 attribute.Jul 1 2015, 12:01 AM
Seb35 mentioned this in T102566: InstantCommons broken by switch to HTTPS.Jul 1 2015, 12:22 AM
Bawolff added projects: Multimedia, HTTPS.Jul 1 2015, 12:29 AM
Bawolff set Security to None.
Restricted Application added a subscriber: Matanya. · View Herald TranscriptJul 1 2015, 12:29 AM
Bawolff subscribed.Jul 1 2015, 7:51 AM

Starting with php 5.6 we have the nice openssl_get_cert_locations() function... but that doesn't help us on older versions.

I think we should just check if /etc/ssl/certs exists (and whatever other common places exist) and use that

http://www.docnet.nu/tech-portal/2014/06/26/ssl-and-php-streams-part-1-you-are-doing-it-wrongtm/C0 is also interesting reading.

Maybe we should "encourage" people to instal php5-curl in the installer. fopen support for ssl is so borked...

gerritbot subscribed.Jul 1 2015, 8:43 AM

Change 222079 had a related patch set uploaded (by Brian Wolff):
Use system default location for cafile when using php fopen.

https://gerrit.wikimedia.org/r/222079

gerritbot added a project: Patch-For-Review.Jul 1 2015, 8:43 AM
Bawolff added a parent task: T102566: InstantCommons broken by switch to HTTPS.Jul 1 2015, 9:41 AM
BBlack subscribed.Aug 26 2015, 12:29 PM

Is this ready to merge? into upcoming point releases? we're basically way overdue for giving up on clients that can't do basic HTTPS...

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 26 2015, 12:29 PM
Tgr subscribed.Aug 30 2015, 9:33 PM

This Stackoverflow answer (written by a PHP dev who works on SSL issues) is a good summary of the situation. Some highlights:

  • PHP pre-5.6 does not support Windows certfiles for SSL (cannot handle the format)
  • PHP 5.6 supports OS cert files (both Linux and Windows) which means it will actually be better than curl (which comes with bundled root certs and is less up to date)

Also, PHP 5.6 got a huge SSL update in general. So we might want to revisit our decision to prefer libcurl when available.

Unrelated to this task but the TLS defaults RFC has an example for sending secure requests in old PHP which includes setting 'disable_compression' => true (to prevent CRIME I presume), which we don't.

Jdforrester-WMF moved this task from Untriaged to Backlog on the Multimedia board.Sep 4 2015, 6:23 PM
gerritbot added a comment.Sep 8 2015, 8:34 PM

Change 222079 merged by jenkins-bot:
Use system default location for cafile when using php fopen.

https://gerrit.wikimedia.org/r/222079

Tgr mentioned this in rMWbcc31a9a0fa7: Use system default location for cafile when using php fopen..Sep 8 2015, 8:35 PM
gerritbot added a comment.Sep 9 2015, 12:43 AM

Change 237000 had a related patch set uploaded (by Gergő Tisza):
Use system default location for cafile when using php fopen.

https://gerrit.wikimedia.org/r/237000

gerritbot added a comment.Sep 9 2015, 12:44 AM

Change 237002 had a related patch set uploaded (by Gergő Tisza):
Use system default location for cafile when using php fopen.

https://gerrit.wikimedia.org/r/237002

gerritbot added a comment.Sep 9 2015, 12:44 AM

Change 237003 had a related patch set uploaded (by Gergő Tisza):
Use system default location for cafile when using php fopen.

https://gerrit.wikimedia.org/r/237003

ReleaseTaggerBot added projects: MW-1.26-release, WMF-deploy-2015-09-15_(1.26wmf23).Sep 10 2015, 9:12 PM
gerritbot added a comment.Sep 11 2015, 12:53 AM

Change 237000 merged by jenkins-bot:
Use system default location for cafile when using php fopen.

https://gerrit.wikimedia.org/r/237000

bd808 mentioned this in rMWef5f4febe590: Use system default location for cafile when using php fopen..Sep 11 2015, 12:53 AM
gerritbot added a comment.Sep 11 2015, 12:54 AM

Change 237003 merged by jenkins-bot:
Use system default location for cafile when using php fopen.

https://gerrit.wikimedia.org/r/237003

Tgr mentioned this in rMW2bec99f94a7c: Use system default location for cafile when using php fopen..Sep 11 2015, 12:54 AM
Tgr closed this task as Resolved.Sep 11 2015, 12:59 AM
Tgr claimed this task.
ReleaseTaggerBot added projects: MW-1.25-release, MW-1.23-release.Sep 11 2015, 1:00 AM
gerritbot added a comment.Sep 11 2015, 1:03 AM

Change 237002 merged by jenkins-bot:
Use system default location for cafile when using php fopen.

https://gerrit.wikimedia.org/r/237002

Tgr mentioned this in rMW146016c93cbc: Use system default location for cafile when using php fopen..Sep 11 2015, 1:03 AM
ReleaseTaggerBot added a project: MW-1.24-release.Sep 11 2015, 2:00 AM
Jdforrester-WMF moved this task from Backlog to Done on the Multimedia board.Sep 11 2015, 6:22 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL