Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Prevent error on systems with older cURL compile target #1

Merged
merged 1 commit into from
May 25, 2021

Conversation

spackmat
Copy link

On systems, where the PHP cURL extension is compiled against an older version of cURL without support for public key pinning (e.g. the builds from https://rpms.remirepo.net/ for RHEL/CentOS 7), the CurlHttpDriver fails with a 500 error, stating that the constant CURLOPT_PINNEDPUBLICKEY is not found. For the worse this happens even when the PHP installation itself uses a newer cURL, but the extension doesn't know about that constant and its corresponding cURL option.

This PR adds a feature test to omit the certificate pinning on systems that don't support it (i.e. where the constant is not defined), otherwise the whole Threema-API cannot be used at all on those systems.

On systems, where the PHP cURL extension is compiled against an older version of cURL without support for public key pinning (e.g. the builds from https://rpms.remirepo.net/ for RHEL/CentOS 7), the CurlHttpDriver fails with a 500 error, stating that the constant CURLOPT_PINNEDPUBLICKEY is not found. For the worse this happens even when the PHP installation itself uses a newer cURL, but the extension doesn't know about that constant and its corresponding cURL option.

This PR adds a feature test to omit the certificate pinning on systems that don't support it (i.e. where the constant is not defined), otherwise the whole Threema-API cannot be used at all on those systems.
@spackmat
Copy link
Author

The error message is, for those who search for it:

Undefined constant "Threema\MsgApi\HttpDriver\CURLOPT_PINNEDPUBLICKEY"

At first, I thought using \CURLOPT_PINNEDPUBLICKEY instead of CURLOPT_PINNEDPUBLICKEY would solve the issue, but that is not the case. The problem is that my hosting (uberspace U7) is based on CentOS 7 and the cURL extension is compiled against its originally shipped cURL 7.29.0, while that public key pinning is available from cURL 7.39 on. So the extension doesn't know about public key pinning, regardless of the currently used cURL version of that PHP installation, which is 7.76.1 (you can use php -i | grep 'cURL Information' to check that).

To make it short: Unfortunately we cannot assume CURLOPT_PINNEDPUBLICKEY as available, even if we declare PHP >= 7.2. In my case it is PHP 8.0. Oh, how I'm in love with such unforeseeable deploy-time (hopefully staging-time) problems…

@pavarnos pavarnos merged commit 8361a1c into pavarnos:master May 25, 2021
@pavarnos
Copy link
Owner

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
2 participants