From e726d917e79c965af09fedb43be683fe77f02b5d Mon Sep 17 00:00:00 2001
From: Remi Collet <remi@remirepo.net>
Date: Thu, 15 May 2025 10:00:52 +0200
Subject: [PATCH] add more ldaps/tls tests with TLS_CACERTFILE

---
 ext/ldap/tests/ldap_start_tls_basic2.phpt | 36 +++++++++++++++
 ext/ldap/tests/ldaps_basic2.phpt          | 56 +++++++++++++++++++++++
 2 files changed, 92 insertions(+)
 create mode 100644 ext/ldap/tests/ldap_start_tls_basic2.phpt
 create mode 100644 ext/ldap/tests/ldaps_basic2.phpt

diff --git a/ext/ldap/tests/ldap_start_tls_basic2.phpt b/ext/ldap/tests/ldap_start_tls_basic2.phpt
new file mode 100644
index 00000000000..56d8c980b6f
--- /dev/null
+++ b/ext/ldap/tests/ldap_start_tls_basic2.phpt
@@ -0,0 +1,36 @@
+--TEST--
+ldap_start_tls() - Basic ldap_start_tls test with TLS_CACERTFILE
+--EXTENSIONS--
+ldap
+--SKIPIF--
+<?php
+require_once __DIR__ .'/skipifbindfailure.inc'; 
+if (!ldap_get_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, $val)) die('skip missing TLS_CACERTFILE');
+?>
+--FILE--
+<?php
+require_once "connect.inc";
+
+// CI uses self signed certificate
+
+// No cert option
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+var_dump(@ldap_start_tls($link));
+
+// No cert check
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+ldap_set_option($link, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
+var_dump(@ldap_start_tls($link));
+
+// With cert check
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+ldap_set_option($link, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_DEMAND);
+var_dump(@ldap_start_tls($link));
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
diff --git a/ext/ldap/tests/ldaps_basic2.phpt b/ext/ldap/tests/ldaps_basic2.phpt
new file mode 100644
index 00000000000..e464b09beba
--- /dev/null
+++ b/ext/ldap/tests/ldaps_basic2.phpt
@@ -0,0 +1,56 @@
+--TEST--
+ldap_connect() - Basic ldaps test with TLS_CACERTFILE
+--EXTENSIONS--
+ldap
+--SKIPIF--
+<?php
+require_once __DIR__ .'/skipifbindfailure.inc'; 
+if (!ldap_get_option(NULL, LDAP_OPT_X_TLS_CACERTFILE, $val)) die('skip missing TLS_CACERTFILE');
+?>
+--FILE--
+<?php
+require_once "connect.inc";
+
+$uri = "ldaps://$host:636";
+
+// CI uses self signed certificate
+
+// No cert option
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+var_dump(@ldap_bind($link, $user, $passwd));
+ldap_unbind($link);
+
+// No cert check
+ldap_set_option(null, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_ALLOW);
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+var_dump(@ldap_bind($link, $user, $passwd));
+ldap_unbind($link);
+
+// No change to TLS options
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+var_dump(@ldap_bind($link, $user, $passwd));
+ldap_unbind($link);
+
+// With cert check
+ldap_set_option(null, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_DEMAND);
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+var_dump(@ldap_bind($link, $user, $passwd));
+ldap_unbind($link);
+
+// No change to TLS options
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+var_dump(@ldap_bind($link, $user, $passwd));
+ldap_unbind($link);
+
+?>
+--EXPECT--
+bool(true)
+bool(true)
+bool(true)
+bool(true)
+bool(true)