[pull] master from php:master

.github/scripts/setup-slapd.sh

@@ -72,6 +72,9 @@ olcTLSCertificateKeyFile: /etc/ldap/ssl/server.key
 add: olcTLSVerifyClient
 olcTLSVerifyClient: never
 -
+add: olcTLSProtocolMin
+olcTLSProtocolMin: 3.3
+-
 add: olcAuthzRegexp
 olcAuthzRegexp: uid=usera,cn=digest-md5,cn=auth cn=usera,dc=my-domain,dc=com
 -

UPGRADING

@@ -430,6 +430,9 @@ PHP 8.5 UPGRADE NOTES
   . Added grapheme_levenshtein() function.
     RFC: https://wiki.php.net/rfc/grapheme_levenshtein
 
+- Opcache:
+  . Added opcache_is_script_cached_in_file_cache().
+
 - Pdo\Sqlite:
   . Added support for Pdo\Sqlite::setAuthorizer(), which is the equivalent of
     SQLite3::setAuthorizer(). The only interface difference is that the

ext/ldap/ldap.c

@@ -3725,7 +3725,8 @@ PHP_FUNCTION(ldap_rename_ext)
  */
 static int _php_ldap_tls_newctx(LDAP *ld)
 {
-	int val = 0, i, opts[] = {
+	int val = 0, i;
+	int str_opts[] = {
 #if (LDAP_API_VERSION > 2000)
 		LDAP_OPT_X_TLS_CACERTDIR,
 		LDAP_OPT_X_TLS_CACERTFILE,
@@ -3745,21 +3746,42 @@ static int _php_ldap_tls_newctx(LDAP *ld)
 #endif
 	0};
 
-	for (i=0 ; opts[i] ; i++) {
+	for (i=0 ; str_opts[i] ; i++) {
 		char *path = NULL;
 
-		ldap_get_option(ld, opts[i], &path);
+		ldap_get_option(ld, str_opts[i], &path);
 		if (path) {			/* already set locally */
 			ldap_memfree(path);
 		} else {
-			ldap_get_option(NULL, opts[i], &path);
+			ldap_get_option(NULL, str_opts[i], &path);
 			if (path) { 	/* set globally, inherit */
-				ldap_set_option(ld, opts[i], path);
+				ldap_set_option(ld, str_opts[i], path);
 				ldap_memfree(path);
 			}
 		}
 	}
 
+#ifdef LDAP_OPT_X_TLS_PROTOCOL_MIN
+	int int_opts[] = {
+		LDAP_OPT_X_TLS_PROTOCOL_MIN,
+#ifdef LDAP_OPT_X_TLS_PROTOCOL_MAX
+		LDAP_OPT_X_TLS_PROTOCOL_MAX,
+#endif
+		0
+	};
+	for (i=0 ; int_opts[i] ; i++) {
+		int value = 0;
+
+		ldap_get_option(ld, int_opts[i], &value);
+		if (value <= 0) { 	/* if value is not set already */
+			ldap_get_option(NULL, int_opts[i], &value);
+			if (value > 0) { 	/* set globally, inherit */
+				ldap_set_option(ld, int_opts[i], &value);
+			}
+		}
+	}
+#endif
+
 	return ldap_set_option(ld, LDAP_OPT_X_TLS_NEWCTX, &val);
 }
 

ext/ldap/tests/ldap_start_tls_rc_max_version.conf

@@ -0,0 +1 @@
+TLS_PROTOCOL_MAX 3.2

ext/ldap/tests/ldap_start_tls_rc_max_version.phpt

@@ -0,0 +1,41 @@
+--TEST--
+ldap_start_tls() - Basic ldap_start_tls test
+--EXTENSIONS--
+ldap
+--ENV--
+LDAPCONF={PWD}/ldap_start_tls_rc_max_version.conf
+--SKIPIF--
+<?php
+$require_vendor = [
+    "name" => "OpenLDAP",
+    "min_version" => 20600,
+];
+require_once __DIR__ .'/skipifbindfailure.inc';
+?>
+--FILE--
+<?php
+require_once "connect.inc";
+
+// CI uses self signed certificate
+
+// No cert option - fails
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+var_dump(@ldap_start_tls($link));
+
+// No cert check - should pass but due to ldaps check, it fails as well
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+ldap_set_option($link, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_NEVER);
+var_dump(@ldap_start_tls($link));
+
+// With cert check - fails
+$link = ldap_connect($uri);
+ldap_set_option($link, LDAP_OPT_PROTOCOL_VERSION, $protocol_version);
+ldap_set_option($link, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_DEMAND);
+var_dump(@ldap_start_tls($link));
+?>
+--EXPECT--
+bool(false)
+bool(false)
+bool(false)

ext/ldap/tests/skipifbindfailure.inc

@@ -10,4 +10,37 @@ if ($skip_on_bind_failure) {
 
     ldap_unbind($link);
 }
+
+if (isset($require_vendor)) {
+    ob_start();
+    phpinfo(INFO_MODULES);
+    $phpinfo = ob_get_clean();
+
+    // Extract the LDAP section specifically
+    if (preg_match('/^ldap\s*$(.*?)^[a-z_]+\s*$/ims', $phpinfo, $ldap_section_match)) {
+        $ldap_section = $ldap_section_match[1];
+
+        // Extract vendor info from the LDAP section only
+        if (preg_match('/Vendor Name\s*=>\s*(.+)/i', $ldap_section, $name_match) &&
+            preg_match('/Vendor Version\s*=>\s*(\d+)/i', $ldap_section, $version_match)) {
+
+            $vendor_name = trim($name_match[1]);
+            $vendor_version = (int)$version_match[1];
+
+            // Check vendor name if specified
+            if (isset($require_vendor['name']) && $vendor_name !== $require_vendor['name']) {
+                die("skip Requires {$require_vendor['name']} (detected: $vendor_name)");
+            }
+
+            // Check minimum version if specified
+            if (isset($require_vendor['min_version']) && $vendor_version < $require_vendor['min_version']) {
+                die("skip Requires minimum version {$require_vendor['min_version']} (detected: $vendor_version)");
+            }
+        } else {
+            die("skip Cannot determine LDAP vendor information");
+        }
+    } else {
+        die("skip LDAP extension information not found");
+    }
+}
 ?>

ext/opcache/opcache.stub.php

@@ -23,3 +23,5 @@ function opcache_jit_blacklist(Closure $closure): void {}
 function opcache_get_configuration(): array|false {}
 
 function opcache_is_script_cached(string $filename): bool {}
+
+function opcache_is_script_cached_in_file_cache(string $filename): bool {}

ext/opcache/tests/gh16979_check_file_cache_function.inc

@@ -0,0 +1,3 @@
+<?php
+
+function test() {}

ext/opcache/tests/gh16979_check_file_cache_function.phpt

@@ -0,0 +1,48 @@
+--TEST--
+GH-16979: Test opcache_is_script_cached_in_file_cache function
+--SKIPIF--
+<?php
+@mkdir(__DIR__ . '/gh16979_cache', 0777, true);
+?>
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.jit=disable
+opcache.file_cache="{PWD}/gh16979_cache"
+opcache.file_update_protection=0
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+
+$file = __DIR__ . '/gh16979_check_file_cache_function.inc';
+var_dump(opcache_is_script_cached_in_file_cache($file));
+opcache_compile_file($file);
+var_dump(opcache_is_script_cached_in_file_cache($file));
+opcache_invalidate($file, force: true);
+var_dump(opcache_is_script_cached_in_file_cache($file));
+
+?>
+--CLEAN--
+<?php
+function removeDirRecursive($dir) {
+    if (!is_dir($dir)) return;
+    $iterator = new RecursiveIteratorIterator(
+        new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS),
+        RecursiveIteratorIterator::CHILD_FIRST
+    );
+    foreach ($iterator as $fileinfo) {
+        if ($fileinfo->isDir()) {
+            @rmdir($fileinfo->getRealPath());
+        } else {
+            @unlink($fileinfo->getRealPath());
+        }
+    }
+    @rmdir($dir);
+}
+removeDirRecursive(__DIR__ . '/gh16979_cache');
+?>
+--EXPECT--
+bool(false)
+bool(true)
+bool(false)

ext/opcache/zend_accelerator_module.c

@@ -27,6 +27,7 @@
 #include "zend_closures.h"
 #include "zend_shared_alloc.h"
 #include "zend_accelerator_blacklist.h"
+#include "zend_file_cache.h"
 #include "php_ini.h"
 #include "SAPI.h"
 #include "zend_virtual_cwd.h"
@@ -364,6 +365,23 @@ static int filename_is_in_cache(zend_string *filename)
 	return 0;
 }
 
+static int filename_is_in_file_cache(zend_string *filename)
+{
+	zend_string *realpath = zend_resolve_path(filename);
+	if (!realpath) {
+		return 0;
+	}
+
+	zend_file_handle handle;
+	zend_stream_init_filename_ex(&handle, filename);
+	handle.opened_path = realpath;
+
+	zend_persistent_script *result = zend_file_cache_script_load_ex(&handle, true);
+	zend_destroy_file_handle(&handle);
+
+	return result != NULL;
+}
+
 static int accel_file_in_cache(INTERNAL_FUNCTION_PARAMETERS)
 {
 	if (ZEND_NUM_ARGS() == 1) {
@@ -999,3 +1017,27 @@ ZEND_FUNCTION(opcache_is_script_cached)
 
 	RETURN_BOOL(filename_is_in_cache(script_name));
 }
+
+/* {{{ Return true if the script is cached in OPCache file cache, false if it is not cached or if OPCache is not running. */
+ZEND_FUNCTION(opcache_is_script_cached_in_file_cache)
+{
+	zend_string *script_name;
+
+	ZEND_PARSE_PARAMETERS_START(1, 1)
+		Z_PARAM_STR(script_name)
+	ZEND_PARSE_PARAMETERS_END();
+
+	if (!validate_api_restriction()) {
+		RETURN_FALSE;
+	}
+
+	if (!(ZCG(accelerator_enabled) || ZCG(accel_directives).file_cache_only)) {
+		RETURN_FALSE;
+	}
+
+	if (!ZCG(accel_directives).file_cache) {
+		RETURN_FALSE;
+	}
+
+	RETURN_BOOL(filename_is_in_file_cache(script_name));
+}

ext/opcache/zend_file_cache.c

@@ -1871,7 +1871,14 @@ static void zend_file_cache_unserialize(zend_persistent_script  *script,
 	zend_file_cache_unserialize_early_bindings(script, buf);
 }
 
+static zend_persistent_script file_cache_validate_success_script;
+
 zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handle)
+{
+	return zend_file_cache_script_load_ex(file_handle, false);
+}
+
+zend_persistent_script *zend_file_cache_script_load_ex(zend_file_handle *file_handle, bool validate_only)
 {
 	zend_string *full_path = file_handle->opened_path;
 	int fd;
@@ -1948,6 +1955,16 @@ zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handl
 		return NULL;
 	}
 
+	/* return here if validating */
+	if (validate_only) {
+		if (zend_file_cache_flock(fd, LOCK_UN) != 0) {
+			zend_accel_error(ACCEL_LOG_WARNING, "opcache cannot unlock file '%s'\n", filename);
+		}
+		close(fd);
+		efree(filename);
+		return &file_cache_validate_success_script;
+	}
+
 	checkpoint = zend_arena_checkpoint(CG(arena));
 #if defined(__AVX__) || defined(__SSE2__)
 	/* Align to 64-byte boundary */

ext/opcache/zend_file_cache.h

@@ -21,6 +21,7 @@
 
 int zend_file_cache_script_store(zend_persistent_script *script, bool in_shm);
 zend_persistent_script *zend_file_cache_script_load(zend_file_handle *file_handle);
+zend_persistent_script *zend_file_cache_script_load_ex(zend_file_handle *file_handle, bool validate_only);
 void zend_file_cache_invalidate(zend_string *full_path);
 
 #endif /* ZEND_FILE_CACHE_H */