A PHP internals PR (#22159) proposes exposing three libcurl socket callbacks — CURLOPT_SOCKOPTFUNCTION, CURLOPT_OPENSOCKETFUNCTION, and CURLOPT_CLOSESOCKET FUNCTION — in PHP's ext/curl extension for PHP 8.6. The primary motivation is to give PHP developers a native, reliable way to perform SSRF filtering by validating the resolved peer IP before a connection is established, and to enable low-level socket tuning (SO_BINDTODEVICE, SO_MARK, keepalive, TCP_NODELAY, etc.) without resorting to ext/ffi. The callbacks bridge to ext/sockets, exposing real Socket objects usable with socket_set_option() and socket_close(). CI passes on Linux, macOS, FreeBSD, Windows, and ASAN.
223 Impressions