Edit report at https://bugs.php.net/bug.php?id=68046&edit=1
ID: 68046
Comment by: rdlowrey@php.net
Reported by: spam2 at rhsoft dot net
Summary: 5.5.17 breaks mysqlnd + SSL again
Status: Assigned
Type: Bug
Package: MySQLi related
Operating System: Linux
PHP Version: 5.5.17
Assigned To: rdlowrey
Block user comment: N
Private report: N
New Comment:
Please submit a PR if you think you have something useful to contribute to the project instead of
trying to push it off on other people. Complaining is being part of the problem. Contributing is
being part of the solution. Thanks for your time.
Previous Comments:
------------------------------------------------------------------------
[2014-09-22 15:30:45] spam2 at rhsoft dot net
how often do i need to post how to test this?
what do you do with a pull-request of a code using our own rwapper around mysqli?
http://php.net/manual/de/mysqli.ssl-set.php
mysqli_ssl_set ($link, $key, $cert, $ca, NULL, NULL) runs into a timeout
------------------------------------------------------------------------
[2014-09-22 15:22:51] rdlowrey@php.net
This is actually not a mysqli issue -- it's an openssl streams issue and has to do with feof()
never reporting as true when it should (which causes the script to hang indefinitely). However, any
test cases you feel would help can certainly be added. Please submit pull requests via the git
account and I will happily merge them.
------------------------------------------------------------------------
[2014-09-22 15:18:06] spam2 at rhsoft dot net
there is a simple test i wrote years ago when it was broken the first time
* just create certificates
* configure mysqld with them
* the $this below is only a wrapper which can switch layers
* ssl_set() is just the native function
$this->ssl_key = '/etc/mysql-ssl/client.pem';
$this->ssl_crt = '/etc/mysql-ssl/client.pem';
$this->ssl_ca = '/etc/mysql-ssl/ca.crt';
$this->conn->ssl_set($this->ssl_key, $this->ssl_crt, $this->ssl_ca, NULL, NULL);
------------------------------------------------------------------------
[2014-09-22 15:07:56] rdlowrey@php.net
Yes, we know about this. It was addressed on the mailing list within a couple of hours of the 5.5.17
and 5.4.33 releases. People *do* care about a regression like this.
This issue results from trying to fix the DoS vulnerability here:
https://bugs.php.net/bug.php?id=41631
Part of the problem is that the streams API has exactly zero test cases and the openssl streams have
very few. So when we try to fix one bug there is always the potential to cause another that
isn't prevented by preexisting tests.
There are volunteers working to improve these aspects of the php-src codebase to help avoid these
issues going forward, but it just takes time.
------------------------------------------------------------------------
[2014-09-20 21:56:41] spam2 at rhsoft dot net
i bet the report below on the roundcube-list has the same root-cause
likely a side-effect of https://bugs.php.net/bug.php?id=41631
what is that difficult to write a simple script connection to mysql over TCP with SSL and run it
before propose a release and why does nobody care about such a major regression?
_____________________________________________________
My setup: roundcube-1.0.2 + nginx-1.6.2 in a FreeBSD-10 jail. RC will connect to a recent dovecot
server in another jail at the same host.
Recently, after upgrading php from 5.4.32 to 5.4.33 roundcube will refuse to connect to dovecot:
| roundcube: PHP Warning: fgets(): SSL read operation timed out in \
| /...path2rc.../roundcube/program/lib/Roundcube/rcube_imap_generic.php on line 200
Recompiling every port involved and restarting both involved jails hasn't been successful.
Only, reverting back to php 5.4.32 made RC work again.
Is anyone running into this as well?
Any idea how to debug this?
_____________________________________________________
------------------------------------------------------------------------
The remainder of the comments for this report are too long. To view
the rest of the comments, please view the bug report online at
https://bugs.php.net/bug.php?id=68046
--
Edit this bug report at https://bugs.php.net/bug.php?id=68046&edit=1