I have a php function that can get the certificate from https-connections, is it possible to extend it to also be able to use on smtp-starttls?
Can I open it as a "tcp://", and after sending the "STARTTLS" command, switch it to a "ssl://"?
function ssl_fetch_cert($domain, $port = 443)
{
$url = "ssl://{$domain}:{$port}";
$connection_context_option['ssl']['capture_peer_cert'] = TRUE;
$connection_context = stream_context_create($connection_context_option);
$connection_client = stream_socket_client($url, $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $connection_context);
$connection_info = stream_context_get_params($connection_client);
// $sha256 = openssl_x509_fingerprint($connection_info['options']['ssl']['peer_certificate'], 'sha256');
return $connection_info['options']['ssl']['peer_certificate'];
}
the function stream_socket_enable_crypto() was useful.
$url = "tcp://{$domain}:{$port}";
$connection_client = stream_socket_client($url, $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $connection_context);
// timeout fread after 2s
stream_set_timeout($connection_client, 2);
// let the server introduce it self before sending command
fread($connection_client, 10240);
// send STARTTLS command
fwrite($connection_client, "STARTTLS\n");
// wait for server to say its ready, before switching
fread($connection_client, 10240);
// Switching to SSL/TLS
stream_socket_enable_crypto($connection_client, TRUE, STREAM_CRYPTO_METHOD_SSLv23_CLIENT);
https://github.com/puggan/tlsa_validation_php/blob/master/functions.php#L111
Related
I connect to the whois server and am able to retrieve the availability of a domain name.
Somehow I am not able to get a response back using the same connection when I do a request of a different domain name.
<?php
$context = stream_context_create();
if($fp = stream_socket_client("tcp://whois.eu:43", $errno, $errstr, 30, STREAM_CLIENT_CONNECT | STREAM_CLIENT_PERSISTENT, $context)) {
stream_set_timeout($fp, 30);
$domains = array('test.eu','amaai.eu');
foreach($domains as $domain) {
fwrite($fp, $domain."\r\n");
$contents = '';
while (!feof($fp)) {
$contents .= fread($fp, 8192);
}
echo $domain.": ".$contents;
}
fclose($fp);
}
What am I missing?
I really want to use the same connection.
The WHOIS protocol only supports one query. The server closes the connection after sending a response. You need to reconnect for each query.
I've coded a non-evil, non-spammy IRC bot in PHP, using fsockopen and related functions. It works. However, the problem is that I need to support proxies (preferably SOCKS5, but HTTP is also OK if that is somehow easier, which I doubt). This is not supported by fsockopen.
I've gone through all search results for "PHP fsockopen proxy" and related queries. I know of all the things that don't work, so please don't link to one of them.
The PHP manual page for fsockopen mentions the function stream_socket_client() as
similar but provides a richer set of options, including non-blocking connection and the ability to provide a stream context.
This sounded promising at first, supposedly allowing me to just replace the fsockopen call with stream_socket_client and specify a proxy, maybe via a "stream context"... but it doesn't. Or does it? I'm very confused by the manual.
Please note that it must be a PHP code solution; I cannot pay for "Proxifier" or use any other external software to "wrap around" this.
All the things I've tried seem to always result in me getting a bunch of empty output from the server, and then the socket is forcefully closed. Note that the proxy I'm trying with works when I use HexChat (a normal IRC client), with the same network, so it's not the proxies themselves that are at fault.
As far as I know there is no default option to set a SOCKS or HTTP proxy for fsockopen or stream_socket_client (we could create a context and set a proxy in HTTP options, but that doesn't apply to stream_socket_client). However we can establish a connection manually.
Connecting to HTTP proxies is quite simple:
The client connects to the proxy server and submits a CONNECT request.
The server responds 200 if the request is accepted.
The server then proxies all requests between the client and destination host.
<!- -!>
function connect_to_http_proxy($host, $port, $destination) {
$fp = fsockopen($host, $port, $errno, $errstr);
if ($errno == 0) {
$connect = "CONNECT $destination HTTP/1.1\r\n\r\n";
fwrite($fp, $connect);
$rsp = fread($fp, 1024);
if (preg_match('/^HTTP\/\d\.\d 200/', $rsp) == 1) {
return $fp;
}
echo "Request denied, $rsp\n";
return false;
}
echo "Connection failed, $errno, $errstr\n";
return false;
}
This function returns a file pointer resource if the connection is successful, else FALSE. We can use that resource to communicate with the destination host.
$proxy = "138.204.48.233";
$port = 8080;
$destination = "api.ipify.org:80";
$fp = connect_to_http_proxy($proxy, $port, $destination);
if ($fp) {
fwrite($fp, "GET /?format=json HTTP/1.1\r\nHost: $destination\r\n\r\n");
echo fread($fp, 1024);
fclose($fp);
}
The communication protocol for SOCKS5 proxies is a little more complex:
The client connects to the proxy server and sends (at least) three bytes: The first byte is the SOCKS version, the second is the number of authentication methods, the next byte(s) is the authentication method(s).
The server responds with two bytes, the SOCKS version and the selected authentication method.
The client requests a connection to the destination host. The request contains the SOCKS version, followed by the command (CONNECT in this case), followed by a null byte. The fourth byte specifies the address type, and is followed by the address and port.
The server finally sends ten bytes (or seven or twenty-two, depending on the destination address type). The second byte contains the status and it should be zero, if the request is successful.
The server proxies all requests.
<!- -!>
More details: SOCKS Protocol Version 5.
function connect_to_socks5_proxy($host, $port, $destination) {
$fp = fsockopen($host, $port, $errno, $errstr);
if ($errno == 0) {
fwrite($fp, "\05\01\00");
$rsp = fread($fp, 2);
if ($rsp === "\05\00" ) {
list($host, $port) = explode(":", $destination);
$host = gethostbyname($host); //not required if $host is an IP
$req = "\05\01\00\01" . inet_pton($host) . pack("n", $port);
fwrite($fp, $req);
$rsp = fread($fp, 10);
if ($rsp[1] === "\00") {
return $fp;
}
echo "Request denied, status: " . ord($rsp[1]) . "\n";
return false;
}
echo "Request denied\n";
return false;
}
echo "Connection failed, $errno, $errstr\n";
return false;
}
This function works the same way as connect_to_http_proxy. Although both functions are tested, it would be best to use a library; the code is provided mostly for educational purposes.
SSL support and authentication.
We can't create an SSL connection with fsockopen using the ssl:// or tls:// protocol, because that would attempt to create an SSL connection with the proxy server, not the destination host. But it is possible to enable SSL with stream_socket_enable_crypto and create a secure communication channel with the destination, after the connenection with the proxy server has been established. This requires to disable peer verification, which can be done with stream_socket_client using a custom context. Note that disabling peer verification may be a security issue.
For HTTP proxies we can add authentication with the Proxy-Authenticate header. The value of this header is the authentication type, followed by the username and password, base64 encoded (Basic Authentication).
For SOCKS5 proxies the authentication process is - again - more complex. It seems we have to change the authentication code fron 0x00 (NO AUTHENTICATION REQUIRED) to 0x02 (USERNAME/PASSWORD authentication). It is not clear to me how to create a request with the authentication values, so I can not provide an example.
function connect_to_http_proxy($host, $port, $destination, $creds=null) {
$context = stream_context_create(
['ssl'=> ['verify_peer'=> false, 'verify_peer_name'=> false]]
);
$soc = stream_socket_client(
"tcp://$host:$port", $errno, $errstr, 20,
STREAM_CLIENT_CONNECT, $context
);
if ($errno == 0) {
$auth = $creds ? "Proxy-Authorization: Basic ".base64_encode($creds)."\r\n": "";
$connect = "CONNECT $destination HTTP/1.1\r\n$auth\r\n";
fwrite($soc, $connect);
$rsp = fread($soc, 1024);
if (preg_match('/^HTTP\/\d\.\d 200/', $rsp) == 1) {
return $soc;
}
echo "Request denied, $rsp\n";
return false;
}
echo "Connection failed, $errno, $errstr\n";
return false;
}
$host = "proxy IP";
$port = "proxy port";
$destination = "chat.freenode.net:6697";
$credentials = "user:pass";
$soc = connect_to_http_proxy($host, $port, $destination, $credentials);
if ($soc) {
stream_socket_enable_crypto($soc, true, STREAM_CRYPTO_METHOD_ANY_CLIENT);
fwrite($soc,"USER test\nNICK test\n");
echo fread($soc, 1024);
fclose($soc);
}
I'm trying to get stream_socket_client working with proxy server.
Peace of code:
<?php
$context = stream_context_create(['http' => ['proxy' => '147.135.210.114:54566', 'request_fulluri' => true]]);
//$file = file_get_contents("http://www.google.com", false, $context);
$fp = stream_socket_client("tcp://www.google.com:80", $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $context);
if (!$fp) {
echo "$errstr ($errno)<br />\n";
} else {
fputs($fp, "GET / HTTP/1.0\r\nHost: www.google.com\r\nAccept: */*\r\n\r\n");
while (!feof($fp)) {
echo fgets($fp, 1024);
}
fclose($fp);
}
?>
While file_get_contents uses proxy (tcpdump -i any -A host 114.ip-147-135-210.eu) stream_socket_client simply omits it and goes directly to google.com. What am I doing wrong? My final goal is to connect to RabbitMQ (AMQP protocol) via proxy, but I can't even get simple HTTP connection working.
if anyone came here struggling, I ended up solving this by connecting to the proxy first then issuing http headers to get the content I wanted.
First create the socket to the proxy:
$sock = stream_socket_client(
"tcp://$proxy:$port",
$errno,
$errstr,30,
STREAM_CLIENT_CONNECT,
stream_context_create()
);
Second connect to the destination host you want:
$write = "CONNECT www.example.org HTTP/1.1\r\n";
$write .= "Proxy-Authorization: Basic ".base64_encode("$proxy_user:$proxy_pass)."\r\n";
$write .= "\r\n";
fwrite($sock, $write);
This should return a 200 code:
preg_match('/^HTTP\/\d\.\d 200/', fread($sock, 1024));
Now you can just issue GET (make sure you send all the HTTP header):
fwrite($sock, "GET / HTTP/1.1\r\n")
This has more details: https://stackoverflow.com/a/55010581/687976
I want to get a message back after succesfully connected with an UDP address via fsockopen. Connection with a RCON ModManager (game server).
What to expect?
If I use Telnet:
Telnet 31.204.131.9 15502 , I see:
ModManager Rcon v8.5
Digest seed: iJrrQAkv
Now in PHP:
<?php
$_ip = '31.204.131.9' ;
$_port = '15502';
if (($socket = fsockopen ('udp://'.$_ip, $_port, $errno, $errstr, 30))) {
// till here it works, got connected
// Digest seed?
if(fwrite($socket, "GET / HTTP/1.1\r\n")) { // writing works }
echo fread($socket, 1024); // NOTHING
fclose($socket);
}
?>
You can try it.. IP and Port valid. Thnx in advance!!
When you use telnet you use tcp protocol, not udp. Try
<?php
$_ip = '31.204.131.9' ;
$_port = '15502';
if (($socket = fsockopen ($_ip, $_port, $errno, $errstr, 30))) {
// till here it works, got connected
// Digest seed?
if(fwrite($socket, "GET / HTTP/1.1\r\n")) { echo "writing works\n"; }
echo fread($socket, 1024); // NOTHING
fclose($socket);
}
I'm using PHPMailer and it uses fsockopen to access the SMTP server.
But the machine has two IPs with different reverse DNS records. So in email headers I got the following:
Received: from one-server.tld (HELO another-server.tld) ...
I need to hide one-server.tld in favor of another-server.tld. But I need both IPs with their current RDNS settings.
I think its not possible using fsockopen. But its possible in curl, fopen and stream functions. What you need is stream_socket_client() function.
Here are some ways to achieve it.
Using context parameters which can be used in fopen function family and stream function family. See the example.
$opts = array(
'socket' => array(
'bindto' => '192.168.0.100:0',
),
);
// create the context...
$context = stream_context_create($opts);
$contents = fopen('http://www.example.com', 'r', false, $context);
Also stream_socket_client
$fp = stream_socket_client("tcp://www.example.com:80", $errno, $errstr, 30, STREAM_CLIENT_CONNECT, $opts);
if (!$fp) {
echo "$errstr ($errno)<br />\n";
} else {
fwrite($fp, "GET / HTTP/1.0\r\nHost: www.example.com\r\nAccept: */*\r\n\r\n");
while (!feof($fp)) {
echo fgets($fp, 1024);
}
fclose($fp);
}
Using socket_bind. PHP.NET got a simple example here.