HTTPOptionsTrait::setCaBundle() - Code Metrics - Inspection of ":shower: CI updates" - chillerlan/php-httpinterface - Measure and Improve Code Quality continuously with Scrutinizer

Passed
Push — main ( f2efe3...53dc0a )

by smiley
created 2021-01-10 16:15 UTC
HTTPOptionsTrait::setCaBundle() B

↳ Parent: HTTPOptionsTrait
Complexity

Conditions	7
Paths	5
Size

Total Lines	21
Code Lines	12
Duplication

Lines	0
Ratio	0 %
Importance

Changes	1
Bugs	0	Features	0
Metric	Value
cc	7
eloc	12
nc	5
nop	0
dl	0
loc	21
rs	8.8333
c	1
b	0
f	0
<?php
/**
 * Trait HTTPOptionsTrait
 *
 * @filesource   HTTPOptionsTrait.php
 * @created      28.08.2018
 * @package      chillerlan\HTTP
 * @author       Smiley <[email protected]>
 * @copyright    2018 Smiley
 * @license      MIT
 *
 * @phan-file-suppress PhanTypeInvalidThrowsIsInterface
 */

namespace chillerlan\HTTP;

use chillerlan\HTTP\Psr18\ClientException;

use function file_exists, ini_get, is_array, is_dir, is_file, is_link, is_string, readlink, trim;

use const CURLOPT_CAINFO, CURLOPT_CAPATH, CURLOPT_SSL_VERIFYHOST, CURLOPT_SSL_VERIFYPEER;

trait HTTPOptionsTrait{

	/**
	 * A custom user agent string
	 */
	protected string $user_agent = 'chillerlanHttpInterface/2.0 +https://github.com/chillerlan/php-httpinterface';

	/**
	 * options for each curl instance
	 *
	 * this array is being merged into the default options as the last thing before curl_exec().
	 * none of the values (except existence of the CA file) will be checked - that's up to the implementation.
	 */
	protected array $curl_options = [];

	/**
	 * CA Root Certificates for use with CURL/SSL (if not configured in php.ini or available in a default path)
	 *
	 * @link https://curl.haxx.se/docs/caextract.html
	 * @link https://curl.haxx.se/ca/cacert.pem
	 * @link https://raw.githubusercontent.com/bagder/ca-bundle/master/ca-bundle.crt
	 */
	protected ?string $ca_info = null;

	/**
	 * see CURLOPT_SSL_VERIFYPEER
	 * requires either HTTPOptions::$ca_info or a properly working system CA file
	 *
	 * @link https://php.net/manual/function.curl-setopt.php
	 */
	protected bool $ssl_verifypeer = true;

	/**
	 * options for the curl multi instance
	 *
	 * @link https://www.php.net/manual/function.curl-multi-setopt.php
	 */
	protected array $curl_multi_options = [];

	/**
	 * maximum of concurrent requests for curl_multi
	 */
	protected int $windowSize = 5;

	/**
	 * sleep timer (milliseconds) between each fired multi request on startup
	 */
	protected ?int $sleep = null;

	/**
	 * Timeout value
	 *
	 * @see \CURLOPT_TIMEOUT
	 */
	protected int $timeout = 10;

	/**
	 * Number of retries (multi fetch)
	 */
	protected int $retries = 3;

	/**
	 * HTTPOptionsTrait constructor
	 *
	 * @throws \Psr\Http\Client\ClientExceptionInterface
	 */
	protected function HTTPOptionsTrait():void{

		if(!is_array($this->curl_options)){

			$this->curl_options = [];
		}

		if(!is_string($this->user_agent) || empty(trim($this->user_agent))){

			throw new ClientException('invalid user agent');
		}

		$this->setCA();
	}

	/**
	 * @throws \Psr\Http\Client\ClientExceptionInterface
	 */
	protected function setCA():void{

		if(!$this->checkVerifyEnabled()){
			return;
		}

		// a path/dir/link to a CA bundle is given, let's check that
		if(is_string($this->ca_info)){

			if($this->setCaBundle()){
				return;
			}

			throw new ClientException('invalid path to SSL CA bundle (HTTPOptions::$ca_info): '.$this->ca_info);
		}

		// we somehow landed here, so let's check if there's a CA bundle given via the cURL options
		$ca = $this->curl_options[CURLOPT_CAPATH] ?? $this->curl_options[CURLOPT_CAINFO] ?? false;

		if($ca){

			if($this->setCaBundleCurl($ca)){
				return;
			}

			throw new ClientException('invalid path to SSL CA bundle (CURLOPT_CAPATH/CURLOPT_CAINFO): '.$ca);
		}

		// check php.ini options - PHP should find the file by itself
		if(file_exists(ini_get('curl.cainfo'))){
			return; // @codeCoverageIgnore
		}

		// this is getting weird. as a last resort, we're going to check some default paths for a CA bundle file
		if($this->checkCaDefaultLocations()){
			return;
		}

		// @codeCoverageIgnoreStart
		$msg = 'No system CA bundle could be found in any of the the common system locations. '
		       .'In order to verify peer certificates, you will need to supply the path on disk to a certificate bundle via  '
		       .'HTTPOptions::$ca_info or HTTPOptions::$curl_options. If you do not need a specific certificate bundle, '
		       .'then you can download a CA bundle over here: https://curl.haxx.se/docs/caextract.html. '
		       .'Once you have a CA bundle available on disk, you can set the "curl.cainfo" php.ini setting to point '
		       .'to the path of the file, allowing you to omit the $ca_info or $curl_options setting. '
		       .'See http://curl.haxx.se/docs/sslcerts.html for more information.';

		throw new ClientException($msg);
		// @codeCoverageIgnoreEnd
	}

	/**
	 * Check default locations for the CA bundle
	 *
	 * @internal
	 */
	protected function checkCaDefaultLocations():bool{

		$cafiles = [
			// check other php.ini settings
			ini_get('openssl.cafile'),
			// Red Hat, CentOS, Fedora (provided by the ca-certificates package)
			'/etc/pki/tls/certs/ca-bundle.crt',
			// Ubuntu, Debian (provided by the ca-certificates package)
			'/etc/ssl/certs/ca-certificates.crt',
			// FreeBSD (provided by the ca_root_nss package)
			'/usr/local/share/certs/ca-root-nss.crt',
			// SLES 12 (provided by the ca-certificates package)
			'/var/lib/ca-certificates/ca-bundle.pem',
			// OS X provided by homebrew (using the default path)
			'/usr/local/etc/openssl/cert.pem',
			// Google app engine
			'/etc/ca-certificates.crt',
			// Windows?
			// http://php.net/manual/en/function.curl-setopt.php#110457
			'C:\\Windows\\system32\\curl-ca-bundle.crt',
			'C:\\Windows\\curl-ca-bundle.crt',
			'C:\\Windows\\system32\\cacert.pem',
			'C:\\Windows\\cacert.pem',
			// working path
			__DIR__.'/cacert.pem',
		];

		foreach($cafiles as $file){

			if(is_file($file) || (is_link($file) && is_file(readlink($file)))){
				$this->curl_options[CURLOPT_CAINFO] = $file;
				$this->ca_info                      = $file;

				return true;
			}

		}

		return false; // @codeCoverageIgnore
	}

	/**
	 * @internal
	 */
	protected function checkVerifyEnabled():bool{

		// disable verification if wanted so
		if($this->ssl_verifypeer !== true || (isset($this->curl_options[CURLOPT_SSL_VERIFYPEER]) && !$this->curl_options[CURLOPT_SSL_VERIFYPEER])){
			unset($this->curl_options[CURLOPT_CAINFO], $this->curl_options[CURLOPT_CAPATH]);

			$this->curl_options[CURLOPT_SSL_VERIFYHOST] = 0;
			$this->curl_options[CURLOPT_SSL_VERIFYPEER] = false;

			return false;
		}

		$this->curl_options[CURLOPT_SSL_VERIFYHOST] = 2;
		$this->curl_options[CURLOPT_SSL_VERIFYPEER] = true;

		return true;
	}

	/**
	 * @internal
	 */
	protected function setCaBundle():bool{

		// if you - for whatever obscure reason - need to check Windows .lnk links,
		// see http://php.net/manual/en/function.is-link.php#91249
		switch(true){
			case is_dir($this->ca_info):
			case is_dir(/** @scrutinizer ignore-type */ $this->ca_info):
			case is_link($this->ca_info) && is_dir(readlink($this->ca_info)): // @codeCoverageIgnore
			case is_link(/** @scrutinizer ignore-type */ $this->ca_info) && is_dir(readlink($this->ca_info)): // @codeCoverageIgnore
				$this->curl_options[CURLOPT_CAPATH] = $this->ca_info;
				unset($this->curl_options[CURLOPT_CAINFO]);

				return true;

			case is_file($this->ca_info):
			case is_file(/** @scrutinizer ignore-type */ $this->ca_info):
			case is_link($this->ca_info) && is_file(readlink($this->ca_info)): // @codeCoverageIgnore
				$this->curl_options[CURLOPT_CAINFO] = $this->ca_info;
				unset($this->curl_options[CURLOPT_CAPATH]);

				return true;
		}

		return false;
	}

	/**
	 * @internal
	 */
	protected function setCaBundleCurl(string $ca):bool{

		// just check if the file/path exists
		switch(true){
			case is_dir($ca):
			case is_link($ca) && is_dir(readlink($ca)): // @codeCoverageIgnore
				unset($this->curl_options[CURLOPT_CAINFO]);

				return true;

			case is_file($ca):
			case is_link($ca) && is_file(readlink($ca)): // @codeCoverageIgnore

				return true;
		}

		return false;
	}

}

chillerlan / php-httpinterface

Push — main ( f2efe3...53dc0a )

HTTPOptionsTrait::setCaBundle() B

Complexity

Size

Duplication

Importance

Duplication Side-by-Side

Filter issues like
