summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--lib/default.php3
-rw-r--r--lib/httpclient.php13
2 files changed, 15 insertions, 1 deletions
diff --git a/lib/default.php b/lib/default.php
index dcf225d1f..45a4560ff 100644
--- a/lib/default.php
+++ b/lib/default.php
@@ -315,6 +315,7 @@ $default =
'members' => true,
'peopletag' => true),
'http' => // HTTP client settings when contacting other sites
- array('ssl_cafile' => false // To enable SSL cert validation, point to a CA bundle (eg '/usr/lib/ssl/certs/ca-certificates.crt')
+ array('ssl_cafile' => false, // To enable SSL cert validation, point to a CA bundle (eg '/usr/lib/ssl/certs/ca-certificates.crt')
+ 'curl' => false, // Use CURL backend for HTTP fetches if available. (If not, PHP's socket streams will be used.)
),
);
diff --git a/lib/httpclient.php b/lib/httpclient.php
index b69f718e5..514a5afeb 100644
--- a/lib/httpclient.php
+++ b/lib/httpclient.php
@@ -145,6 +145,10 @@ class HTTPClient extends HTTP_Request2
$this->config['ssl_verify_peer'] = false;
}
+ if (common_config('http', 'curl') && extension_loaded('curl')) {
+ $this->config['adapter'] = 'HTTP_Request2_Adapter_Curl';
+ }
+
parent::__construct($url, $method, $config);
$this->setHeader('User-Agent', $this->userAgent());
}
@@ -204,6 +208,15 @@ class HTTPClient extends HTTP_Request2
protected function doRequest($url, $method, $headers)
{
$this->setUrl($url);
+
+ // Workaround for HTTP_Request2 not setting up SNI in socket contexts;
+ // This fixes cert validation for SSL virtual hosts using SNI.
+ // Requires PHP 5.3.2 or later and OpenSSL with SNI support.
+ if ($this->url->getScheme() == 'https' && defined('OPENSSL_TLSEXT_SERVER_NAME')) {
+ $this->config['ssl_SNI_enabled'] = true;
+ $this->config['ssl_SNI_server_name'] = $this->url->getHost();
+ }
+
$this->setMethod($method);
if ($headers) {
foreach ($headers as $header) {