If an application performs HTTP requests based on user input, it is often desirable to verify that the connection is done to an allowed host. Otherwise the functionality could be abused to request resources on the server or on the same network as the server (SSRF).
Xavier Leune made some pull requests to make this possible in curl. The idea is to hook in a callback that can verify the IP address that curl is going to connect to. 22159: exposes callbacks such as CURLOPT_OPENSOCKETFUNCTION. These are supported by curl, but exposing the socket to userland comes with problems. 23657: introduces CURLOPT_PRECONNECTFUNCTION. This is not supported by curl and is PHP-only, deviating from the normally thin abstraction on top of curl. The current plan is to expose only CURLOPT_OPENSOCKETFUNCTION with the signature function(string $address, int $port): bool. This is pretty limited compared with what OPENSOCKETFUNCTION can normally do, but at least makes it possible to do SSRF protection. What do you think? How can we expose SSRF protection to applications that perform curl requests? Regards, Sjoerd Langkemper
