WP_Http_Streams::verify_ssl_certificate( resource $stream, string $host ): bool

Description

Parameters

$streamresource

The PHP Stream which the SSL request is being made over

$hoststring

The hostname being requested

Return

bool

If the certificate presented in $stream is valid for $host

Cost profile

Measured from the compiled opcodes, not from a stopwatch. Every number here is identical on any machine that runs the same PHP version, and every function in core is ranked by these figures.

Cost class

Light

Touches nothing outside its own arguments.

Scaling

Scales with input

The body loops, so the work grows with what you pass in.

Instructions

10–60

Executed per call on PHP 8.4, depending on the branch taken. The body compiles to 98.

Plugin surface

None

Nothing here hands control to plugin code.

Called by

1

1 place in core call this, so the cost is paid more often than your own code shows.

What it touches

• regexregular expression over the whole inputpreg_split()called directly

What one call costs · 11 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost WP_Http_Streams::verify_ssl_certificate() can have, taken from its control-flow graph on PHP 8.4.

Across PHP versions

Oldest PHP that compiles this body: 7.4. An instruction is not a fixed amount of time, so a version with the same count is not necessarily the same speed; what the count rules out is a difference in the work itself.

Uses · 1

• WP_Http::is_ip_address()Determines if a specified string represents an IP address or not.

Used by · 1

• WP_Http_Streams::request()Send a HTTP request to a URI using PHP Streams.

Source

View on Trac ↗View on GitHub ↗

433	public static function verify_ssl_certificate( $stream, $host ) {434		$context_options = stream_context_get_options( $stream );435 436		if ( empty( $context_options['ssl']['peer_certificate'] ) ) {437			return false;438		}439 440		$cert = openssl_x509_parse( $context_options['ssl']['peer_certificate'] );441		if ( ! $cert ) {442			return false;443		}444 445		/*446		 * If the request is being made to an IP address, we'll validate against IP fields447		 * in the cert (if they exist)448		 */449		$host_type = ( WP_Http::is_ip_address( $host ) ? 'ip' : 'dns' );450 451		$certificate_hostnames = array();452		if ( ! empty( $cert['extensions']['subjectAltName'] ) ) {453			$match_against = preg_split( '/,\s*/', $cert['extensions']['subjectAltName'] );454			foreach ( $match_against as $match ) {455				list( $match_type, $match_host ) = explode( ':', $match );456				if ( strtolower( trim( $match_type ) ) === $host_type ) { // IP: or DNS:457					$certificate_hostnames[] = strtolower( trim( $match_host ) );458				}459			}460		} elseif ( ! empty( $cert['subject']['CN'] ) ) {461			// Only use the CN when the certificate includes no subjectAltName extension.462			$certificate_hostnames[] = strtolower( $cert['subject']['CN'] );463		}464 465		// Exact hostname/IP matches.466		if ( in_array( strtolower( $host ), $certificate_hostnames, true ) ) {467			return true;468		}469 470		// IP's can't be wildcards, Stop processing.471		if ( 'ip' === $host_type ) {472			return false;473		}474 475		// Test to see if the domain is at least 2 deep for wildcard support.476		if ( substr_count( $host, '.' ) < 2 ) {477			return false;478		}479 480		// Wildcard subdomains certs (*.example.com) are valid for a.example.com but not a.b.example.com.481		$wildcard_host = preg_replace( '/^[^.]+\./', '*.', $host );482 483		return in_array( strtolower( $wildcard_host ), $certificate_hostnames, true );484	}

History

Introduced in 3.7.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 6.7.7 tag, from src/wp-includes/class-wp-http-streams.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.