Bug #41631 [Com]: default_socket_timeout does not work with SSL

Edit report at https://bugs.php.net/bug.php?id=41631&edit=1 ID: 41631 Comment by: software-php at interfasys dot ch Reported by: david at acz dot org Summary: default_socket_timeout does not work with SSL Status: Re-Opened Type: Bug Package: OpenSSL related Operating System: * PHP Version: 5.2, 5.3, 5.4, 5.5, 5.6 Assigned To: rdlowrey Block user comment: N Private report: N New Comment: I've just tested @askalski's patch and it did not work at all for IMAP per example. Horde would get completely confused by the replies it got. Previous Comments: ------------------------------------------------------------------------ [2014-09-28 16:21:24] askalski at synacor dot com Both versions of the patch (bug41631.patch and ssl_read_timeout-5.4.32.patch) need more rigorous testing before they can be released. I'm willing to help devise a set of tests we can use to validate the implementation. To illustrate the point without getting to deep into things (it's still the weekend!), here's a test which fails on bug41631.patch, and gives an endless stream of warnings: <?php /* nonblocking-write.php */ $ssl = fsockopen("ssl://localhost", 6767); stream_set_blocking($ssl, 0); while (fwrite($ssl, str_repeat("x", 65536)) !== false); ?> # Window 1 $ sudo tc qdisc add dev lo root netem delay 100ms $ openssl s_server -cert server.pem -key server.key -accept 6767 >/dev/null ... $ sudo tc qdisc del dev lo root netem delay 100ms # Window 2 $ php nonblocking-write.php Warning: fwrite(): SSL operation failed with code 1. OpenSSL Error messages: error:1409F07F:SSL routines:SSL3_WRITE_PENDING:bad write retry in /home/askalski/work/php-bug41631/nonblocking-write.php on line 4 The artificial network delay via the NetEm driver is not required to reproduce the error, but rather makes it more reliable to reproduce. Don't forget to remove the delay after you're done testing. You can verify it's removed by checking the ping times of "ping localhost". If you need to generate a self-signed key for testing with "openssl s_server", here's a quick and dirty way: $ openssl genrsa -out server.key $ yes "" | openssl req -new -key server.key -out certreq.csr ; echo $ openssl x509 -req -days 3650 -in certreq.csr -signkey server.key -out server.pem ------------------------------------------------------------------------ [2014-09-26 18:43:06] askalski at synacor dot com I attached a locally-maintained patch for this bug that we've been running in production for the past 3 years. I'm curious to know if this version of the fix works with Horde? ------------------------------------------------------------------------ [2014-09-26 15:37:36] software-php at interfasys dot ch Even after the patches were applied, Horde could not connect to the sieve server (4190) using TLS, so something is still very wrong. ------------------------------------------------------------------------ [2014-09-26 14:14:04] admin at brandensittich dot de This Problem also affects Roundcube Webmail 1.0.2 PHP 5.5.17-1~dotdeb.1 (cli) (built: Sep 19 2014 01:56:56) Copyright (c) 1997-2014 The PHP Group Zend Engine v2.5.0, Copyright (c) 1998-2014 Zend Technologies with Zend OPcache v7.0.4-dev, Copyright (c) 1999-2014, by Zend Technologies [26-Sep-2014 16:02:55 Europe/Berlin] PHP Warning: fgets(): SSL read operation timed out in [...]/program/lib/Roundcube/rcube_imap_generic.php on line 200 /** * Reads line from the connection stream * * @param int $size Buffer size * * @return string Line of text response */ function readLine($size=1024) { $line = ''; if (!$size) { $size = 1024; } do { if ($this->eof()) { return $line ? $line : NULL; } // Line 200: SSL read operation timed out $buffer = fgets($this->fp, $size); if ($buffer === false) { $this->closeSocket(); break; } if ($this->_debug) { $this->debug('S: '. rtrim($buffer)); } $line .= $buffer; } while (substr($buffer, -1) != "\n"); return $line; } ------------------------------------------------------------------------ [2014-09-26 08:08:00] stas@php.net Since 5.4 is now in security-fixes mode, and the patch for this issue that got into 5.4.33 was not good, I have reverted the 5.4 branch to its 5.4.32 status for xp_ssl.c. Please verify ASAP that this does not cause additional regressions for 5.4. In 5.5, it still stays as it was before and additional fixes can be applied there if needed. ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=41631 -- Edit this bug report at https://bugs.php.net/bug.php?id=41631&edit=1