Edit report at https://bugs.php.net/bug.php?id=68046&edit=1
ID: 68046
Updated by: rdlowrey@php.net
Reported by: spam2 at rhsoft dot net
Summary: 5.5.17 breaks mysqlnd + SSL again
Status: Open
Type: Bug
Package: MySQLi related
Operating System: Linux
PHP Version: 5.5.17
-Assigned To:
+Assigned To: rdlowrey
Block user comment: N
Private report: N
New Comment:
Yes, we know about this. It was addressed on the mailing list within a couple of hours of the 5.5.17
and 5.4.33 releases. People *do* care about a regression like this.
This issue results from trying to fix the DoS vulnerability here:
https://bugs.php.net/bug.php?id=41631
Part of the problem is that the streams API has exactly zero test cases and the openssl streams have
very few. So when we try to fix one bug there is always the potential to cause another that
isn't prevented by preexisting tests.
There are volunteers working to improve these aspects of the php-src codebase to help avoid these
issues going forward, but it just takes time.
Previous Comments:
------------------------------------------------------------------------
[2014-09-20 21:56:41] spam2 at rhsoft dot net
i bet the report below on the roundcube-list has the same root-cause
likely a side-effect of https://bugs.php.net/bug.php?id=41631
what is that difficult to write a simple script connection to mysql over TCP with SSL and run it
before propose a release and why does nobody care about such a major regression?
_____________________________________________________
My setup: roundcube-1.0.2 + nginx-1.6.2 in a FreeBSD-10 jail. RC will connect to a recent dovecot
server in another jail at the same host.
Recently, after upgrading php from 5.4.32 to 5.4.33 roundcube will refuse to connect to dovecot:
| roundcube: PHP Warning: fgets(): SSL read operation timed out in \
| /...path2rc.../roundcube/program/lib/Roundcube/rcube_imap_generic.php on line 200
Recompiling every port involved and restarting both involved jails hasn't been successful.
Only, reverting back to php 5.4.32 made RC work again.
Is anyone running into this as well?
Any idea how to debug this?
_____________________________________________________
------------------------------------------------------------------------
[2014-09-18 15:42:54] spam2 at rhsoft dot net
Description:
------------
after https://bugs.php.net/bug.php?id=55283
(comment from 2011-08-18 01:34 UTC) and 5.3.7 i created a autotest, well with 5.5.17 it is hanging
again forever and a clone of the machine with 5.5.16 works still fine
what about a autotest in the QA to prevent the same as on 2011-08-18 happen 3 years later?
/Volumes/dune/buildserver/autotest/parts/mailrelay.php
OK: mail - send - relay
/Volumes/dune/buildserver/autotest/parts/mysql_ssl.php
.....................
________________________________________________
[root@buildserver:~]$ ps aux | grep /Volumes/dune/buildserver/autotest/parts/mysql_ssl.php | grep -v
grep
root 25967 0.0 1.1 322328 34340 pts/2 S<+ 17:24 0:00 /usr/bin/php
/Volumes/dune/buildserver/autotest/parts/mysql_ssl.php
[root@buildserver:~]$ date
Do 18. Sep 17:37:54 CEST 2014
________________________________________________
[root@backup-buildserver:~]$ php -v
PHP 5.5.16 (cli) (built: Aug 22 2014 06:07:26)
[root@backup-buildserver:~]$ autotest.php mysql_ssl
/Volumes/dune/buildserver/autotest/parts/mysql_ssl.php
OK: mysql-over-ssl - DHE-RSA-AES128-SHA / TLSv1
________________________________________________
mysqli with mysqlnd
$this->ssl_key = '/etc/mysql-ssl/client.pem';
$this->ssl_crt = '/etc/mysql-ssl/client.pem';
$this->ssl_ca = '/etc/mysql-ssl/ca.crt';
$>conn->ssl_set($this->ssl_key, $this->ssl_crt, $this->ssl_ca, NULL, NULL);
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=68046&edit=1