Skip to content

Commit d679bfe

Browse files
jmikolajmikola
committed
PHPC-888: Support additional TLS libraries for bundled libmongoc
1 parent 274a444 commit d679bfe

File tree

4 files changed

+471
-28
lines changed

4 files changed

+471
-28
lines changed

‎config.m4

Lines changed: 3 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,6 @@
11
dnl config.m4 for extension mongodb
22
PHP_ARG_ENABLE(mongodb, whether to enable mongodb support,
33
[ --enable-mongodb Enable mongodb support])
4-
PHP_ARG_WITH(openssl-dir, OpenSSL dir for mongodb,
5-
[ --with-openssl-dir[=DIR] openssl install prefix], yes, no)
6-
PHP_ARG_WITH(system-ciphers, whether to use system default cipher list instead of hardcoded value,
7-
[ --with-system-ciphers OPENSSL: Use system default cipher list instead of hardcoded value], no, no)
84

95
dnl borrowed from libmongoc configure.ac
106
dnl AS_VAR_COPY is available in AC 2.64 and on, but we only require 2.60.
@@ -297,44 +293,23 @@ if test "$PHP_MONGODB" != "no"; then
297293

298294
PHP_ADD_SOURCES_X(PHP_EXT_DIR(mongodb)[src/libmongoc/src/mongoc], $PHP_MONGODB_MONGOC_SOURCES, $PHP_MONGODB_MONGOC_CFLAGS, shared_objects_mongodb, yes)
299295

300-
AC_SUBST(MONGOC_ENABLE_CRYPTO, 0)
301-
AC_SUBST(MONGOC_ENABLE_SSL, 0)
302-
AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 0)
303-
AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 0)
304-
AC_SUBST(MONGOC_HAVE_ASN1_STRING_GET0_DATA, 0)
296+
m4_include(scripts/build/autotools/m4/pkg.m4)
305297

306-
PHP_SETUP_OPENSSL(MONGODB_SHARED_LIBADD, [
307-
AC_SUBST(MONGOC_ENABLE_CRYPTO, 1)
308-
AC_SUBST(MONGOC_ENABLE_SSL, 1)
309-
AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 1)
310-
AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 1)
311-
312-
AC_CHECK_DECLS([ASN1_STRING_get0_data], [AC_SUBST(MONGOC_HAVE_ASN1_STRING_GET0_DATA, 1)], [AC_SUBST(MONGOC_HAVE_ASN1_STRING_GET0_DATA, 0)], [[#include <openssl/asn1.h>]])
313-
])
298+
m4_include(scripts/build/autotools/CheckHost.m4)
299+
m4_include(scripts/build/autotools/CheckSSL.m4)
314300

315301
if test "$PHP_SYSTEM_CIPHERS" != "no"; then
316302
AC_SUBST(MONGOC_ENABLE_CRYPTO_SYSTEM_PROFILE, 1)
317303
else
318304
AC_SUBST(MONGOC_ENABLE_CRYPTO_SYSTEM_PROFILE, 0)
319305
fi
320306

321-
dnl TODO: Support building with Secure Transport on OSX
322-
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 0)
323-
AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 0)
324-
325-
dnl Secure Channel only applies to Windows
326-
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_CHANNEL, 0)
327-
AC_SUBST(MONGOC_ENABLE_CRYPTO_CNG, 0)
328-
329-
AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 0)
330-
331307
AC_SUBST(MONGOC_NO_AUTOMATIC_GLOBALS, 1)
332308

333309
AC_CHECK_TYPE([socklen_t], [AC_SUBST(MONGOC_HAVE_SOCKLEN, 1)], [AC_SUBST(MONGOC_HAVE_SOCKLEN, 0)], [#include <sys/socket.h>])
334310

335311
with_snappy=auto
336312
with_zlib=auto
337-
m4_include(src/libmongoc/build/autotools/m4/pkg.m4)
338313
m4_include(src/libmongoc/build/autotools/CheckSnappy.m4)
339314
m4_include(src/libmongoc/build/autotools/CheckZlib.m4)
340315

‎scripts/build/autotools/CheckHost.m4

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,54 @@
1+
AC_CANONICAL_HOST
2+
3+
os_win32=no
4+
os_netbsd=no
5+
os_freebsd=no
6+
os_openbsd=no
7+
os_hpux=no
8+
os_linux=no
9+
os_solaris=no
10+
os_darwin=no
11+
os_gnu=no
12+
13+
case "$host" in
14+
*-mingw*|*-*-cygwin*)
15+
os_win32=yes
16+
TARGET_OS=windows
17+
;;
18+
*-*-*netbsd*)
19+
os_netbsd=yes
20+
ARGET_OS=unix
21+
;;
22+
*-*-*freebsd*)
23+
os_freebsd=yes
24+
TARGET_OS=unix
25+
;;
26+
*-*-*openbsd*)
27+
os_openbsd=yes
28+
TARGET_OS=unix
29+
;;
30+
*-*-hpux*)
31+
os_hpux=yes
32+
TARGET_OS=unix
33+
;;
34+
*-*-linux*)
35+
os_linux=yes
36+
os_gnu=yes
37+
TARGET_OS=unix
38+
;;
39+
*-*-solaris*)
40+
os_solaris=yes
41+
TARGET_OS=unix
42+
;;
43+
*-*-darwin*)
44+
os_darwin=yes
45+
TARGET_OS=unix
46+
;;
47+
gnu*|k*bsd*-gnu*)
48+
os_gnu=yes
49+
TARGET_OS=unix
50+
;;
51+
*)
52+
AC_MSG_WARN([*** Please add $host to configure.ac checks!])
53+
;;
54+
esac

‎scripts/build/autotools/CheckSSL.m4

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
PHP_ARG_WITH([mongodb-ssl],
2+
[whether to enable crypto and TLS],
3+
[AS_HELP_STRING([--with-mongodb-ssl=@<:@auto/no/openssl/libressl/darwin@:>@],
4+
[MongoDB: Enable TLS connections and SCRAM-SHA-1 authentication [default=auto]])],
5+
[auto],
6+
[no])
7+
8+
PHP_ARG_ENABLE([mongodb-crypto-system-profile],
9+
[whether to use system crypto profile],
10+
[AC_HELP_STRING([--enable-mongodb-crypto-system-profile],
11+
[MongoDB: Use system crypto profile (OpenSSL only) [default=no]])],
12+
[no],
13+
[no])
14+
15+
PHP_ARG_WITH([openssl-dir],
16+
[deprecated option for OpenSSL library path],
17+
[AC_HELP_STRING([--with-openssl-dir=@<:@auto/DIR@:>@],
18+
[MongoDB: OpenSSL library path (deprecated for pkg-config) [default=auto]])],
19+
[auto],
20+
[no])
21+
22+
PHP_ARG_WITH([system-ciphers],
23+
[deprecated option for whether to use system crypto profile],
24+
AC_HELP_STRING([--enable-system-ciphers],
25+
[MongoDB: whether to use system crypto profile (deprecated for --enable-mongodb-crypto-system-profile) [default=no]]),
26+
[no],
27+
[no])
28+
29+
AS_IF([test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "auto"],[
30+
found_openssl="no"
31+
32+
PKG_CHECK_MODULES([PHP_MONGODB_SSL],[openssl],[
33+
PHP_EVAL_INCLINE([$PHP_MONGODB_SSL_CFLAGS])
34+
PHP_EVAL_LIBLINE([$PHP_MONGODB_SSL_LIBS],[MONGODB_SHARED_LIBADD])
35+
PHP_MONGODB_SSL="openssl"
36+
found_openssl="yes"
37+
38+
old_CFLAGS="$CFLAGS"
39+
CFLAGS="$PHP_MONGODB_SSL_CFLAGS $CFLAGS"
40+
41+
AC_CHECK_DECLS([ASN1_STRING_get0_data],
42+
[have_ASN1_STRING_get0_data="yes"],
43+
[have_ASN1_STRING_get0_data="no"],
44+
[[#include <openssl/asn1.h>]])
45+
46+
CFLAGS="$old_CFLAGS"
47+
],[
48+
unset OPENSSL_INCDIR
49+
unset OPENSSL_LIBDIR
50+
51+
dnl Use a list of directories from PHP_SETUP_OPENSSL by default.
52+
dnl Support documented "auto" and older, undocumented "yes" options
53+
if test "$PHP_OPENSSL_DIR" = "auto" -o "$PHP_OPENSSL_DIR" = "yes"; then
54+
PHP_OPENSSL_DIR="/usr/local/ssl /usr/local /usr /usr/local/openssl"
55+
fi
56+
57+
for i in $PHP_OPENSSL_DIR; do
58+
if test -r $i/include/openssl/evp.h; then
59+
OPENSSL_INCDIR="$i/include"
60+
fi
61+
if test -r $i/$PHP_LIBDIR/libssl.a -o -r $i/$PHP_LIBDIR/libssl.$SHLIB_SUFFIX_NAME; then
62+
OPENSSL_LIBDIR="$i/$PHP_LIBDIR"
63+
fi
64+
test -n "$OPENSSL_INCDIR" && test -n "$OPENSSL_LIBDIR" && break
65+
done
66+
67+
if test -n "$OPENSSL_LIBDIR"; then
68+
OPENSSL_LIBDIR_LDFLAG="-L$OPENSSL_LIBDIR"
69+
fi
70+
71+
PHP_CHECK_LIBRARY([crypto],
72+
[EVP_DigestInit_ex],
73+
[have_crypto_lib="yes"],
74+
[have_crypto_lib="no"],
75+
[$OPENSSL_LIBDIR_LDFLAG])
76+
PHP_CHECK_LIBRARY([ssl],
77+
[SSL_library_init],
78+
[have_ssl_lib="yes"],
79+
[have_ssl_lib="no"],
80+
[$OPENSSL_LIBDIR_LDFLAG -lcrypto])
81+
82+
if test "$have_ssl_lib" = "yes" -a "$have_crypto_lib" = "yes"; then
83+
PHP_ADD_LIBRARY([ssl],,[MONGODB_SHARED_LIBADD])
84+
PHP_ADD_LIBRARY([crypto],,[MONGODB_SHARED_LIBADD])
85+
86+
if test -n "$OPENSSL_LIBDIR"; then
87+
PHP_ADD_LIBPATH([$OPENSSL_LIBDIR],[MONGODB_SHARED_LIBADD])
88+
fi
89+
90+
if test -n "$OPENSSL_INCDIR"; then
91+
PHP_ADD_INCLUDE($OPENSSL_INCDIR)
92+
fi
93+
94+
old_CFLAGS="$CFLAGS"
95+
CFLAGS="-I$OPENSSL_INCDIR $CFLAGS"
96+
97+
AC_CHECK_DECLS([ASN1_STRING_get0_data],
98+
[have_ASN1_STRING_get0_data="yes"],
99+
[have_ASN1_STRING_get0_data="no"],
100+
[[#include <openssl/asn1.h>]])
101+
102+
CFLAGS="$old_CFLAGS"
103+
104+
PHP_MONGODB_SSL="openssl"
105+
found_openssl="yes"
106+
fi
107+
])
108+
109+
if test "$PHP_MONGODB_SSL" = "openssl" -a "$found_openssl" != "yes"; then
110+
AC_MSG_ERROR([OpenSSL libraries and development headers could not be found])
111+
fi
112+
])
113+
114+
AS_IF([test "$PHP_MONGODB_SSL" = "libressl" -o "$PHP_MONGODB_SSL" = "auto"],[
115+
found_libressl="no"
116+
117+
PKG_CHECK_MODULES([PHP_MONGODB_SSL],[libtls libcrypto],[
118+
PHP_EVAL_INCLINE([$PHP_MONGODB_SSL_CFLAGS])
119+
PHP_EVAL_LIBLINE([$PHP_MONGODB_SSL_LIBS],[MONGODB_SHARED_LIBADD])
120+
PHP_MONGODB_SSL="libressl"
121+
found_libressl="yes"
122+
],[
123+
PHP_CHECK_LIBRARY([crypto],
124+
[EVP_DigestInit_ex],
125+
[have_crypto_lib="yes"],
126+
[have_crypto_lib="no"])
127+
PHP_CHECK_LIBRARY([tls],
128+
[tls_init],
129+
[have_ssl_lib="yes"],
130+
[have_ssl_lib="no"],
131+
[-lcrypto])
132+
133+
if test "$have_ssl_lib" = "yes" -a "$have_crypto_lib" = "yes"; then
134+
PHP_ADD_LIBRARY([tls],,[MONGODB_SHARED_LIBADD])
135+
PHP_ADD_LIBRARY([crypto],,[MONGODB_SHARED_LIBADD])
136+
PHP_MONGODB_SSL="libressl"
137+
found_libressl="yes"
138+
fi
139+
])
140+
141+
if test "$PHP_MONGODB_SSL" = "libressl" -a "$found_libressl" != "yes"; then
142+
AC_MSG_ERROR([LibreSSL libraries and development headers could not be found])
143+
fi
144+
])
145+
146+
AS_IF([test "$PHP_MONGODB_SSL" = "darwin" -o \( "$PHP_MONGODB_SSL" = "auto" -a "$os_darwin" = "yes" \)],[
147+
dnl PHP_FRAMEWORKS is only used for SAPI builds, so use MONGODB_SHARED_LIBADD for shared builds
148+
if test "$ext_shared" = "yes"; then
149+
MONGODB_SHARED_LIBADD="-framework Security -framework CoreFoundation $MONGODB_SHARED_LIBADD"
150+
else
151+
PHP_ADD_FRAMEWORK([Security])
152+
PHP_ADD_FRAMEWORK([CoreFoundation])
153+
fi
154+
PHP_MONGODB_SSL="darwin"
155+
])
156+
157+
AS_IF([test "$PHP_MONGODB_SSL" = "auto"],[
158+
PHP_MONGODB_SSL="no"
159+
])
160+
161+
AC_MSG_CHECKING([which TLS library to use])
162+
AC_MSG_RESULT([$PHP_MONGODB_SSL])
163+
164+
dnl Disable Windows SSL and crypto
165+
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_CHANNEL, 0)
166+
AC_SUBST(MONGOC_ENABLE_CRYPTO_CNG, 0)
167+
168+
if test "$PHP_MONGODB_SSL" = "openssl" -o "$PHP_MONGODB_SSL" = "libressl" -o "$PHP_MONGODB_SSL" = "darwin"; then
169+
AC_SUBST(MONGOC_ENABLE_SSL, 1)
170+
AC_SUBST(MONGOC_ENABLE_CRYPTO, 1)
171+
if test "$PHP_MONGODB_SSL" = "darwin"; then
172+
AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 0)
173+
AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 0)
174+
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 1)
175+
AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 0)
176+
AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 1)
177+
elif test "$PHP_MONGODB_SSL" = "openssl"; then
178+
AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 1)
179+
AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 0)
180+
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 0)
181+
AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 1)
182+
AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 0)
183+
elif test "$PHP_MONGODB_SSL" = "libressl"; then
184+
AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 0)
185+
AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 1)
186+
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 0)
187+
AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 1)
188+
AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 0)
189+
fi
190+
else
191+
AC_SUBST(MONGOC_ENABLE_SSL, 0)
192+
AC_SUBST(MONGOC_ENABLE_SSL_LIBRESSL, 0)
193+
AC_SUBST(MONGOC_ENABLE_SSL_OPENSSL, 0)
194+
AC_SUBST(MONGOC_ENABLE_SSL_SECURE_TRANSPORT, 0)
195+
AC_SUBST(MONGOC_ENABLE_CRYPTO, 0)
196+
AC_SUBST(MONGOC_ENABLE_CRYPTO_LIBCRYPTO, 0)
197+
AC_SUBST(MONGOC_ENABLE_CRYPTO_COMMON_CRYPTO, 0)
198+
fi
199+
200+
if test "x$have_ASN1_STRING_get0_data" = "xyes"; then
201+
AC_SUBST(MONGOC_HAVE_ASN1_STRING_GET0_DATA, 1)
202+
else
203+
AC_SUBST(MONGOC_HAVE_ASN1_STRING_GET0_DATA, 0)
204+
fi
205+
206+
dnl Also consider the deprecated --enable-system-ciphers option
207+
if test "$PHP_MONGODB_CRYPTO_SYSTEM_PROFILE" = "yes" -o "$PHP_SYSTEM_CIPHERS" = "yes"; then
208+
if test "$PHP_MONGODB_SSL" = "openssl"; then
209+
AC_SUBST(MONGOC_ENABLE_CRYPTO_SYSTEM_PROFILE, 1)
210+
else
211+
AC_MSG_ERROR([System crypto profile is only available with OpenSSL])
212+
fi
213+
else
214+
AC_SUBST(MONGOC_ENABLE_CRYPTO_SYSTEM_PROFILE, 0)
215+
fi

0 commit comments

Comments
 (0)