Bug #41631 [Com]: default_socket_timeout does not work with SSL

Edit report at https://bugs.php.net/bug.php?id=41631&edit=1 ID: 41631 Comment by: software-php at interfasys dot ch Reported by: david at acz dot org Summary: default_socket_timeout does not work with SSL Status: Re-Opened Type: Bug Package: OpenSSL related Operating System: * PHP Version: 5.2, 5.3, 5.4, 5.5, 5.6 Assigned To: rdlowrey Block user comment: N Private report: N New Comment: I'm happy to report that @askalski's updated patch is working well for us so far, using Horde. Connections on both IMAP and Sieve work well. Regarding bug #67850. I provided the patch because PHP would not compile if OpenSSL was not built with SSLv3 support. That's on FreeBSd, compiling OpenSSL from source. I'm not sure why it works for you in your setup. Maybe PHP picked another OpenSSL in your OS? Previous Comments: ------------------------------------------------------------------------ [2014-10-02 17:05:14] askalski at synacor dot com We should also solicit feedback about whether this addresses the mysqlnd hang on connect (bug #68046). I tested it myself and it seems to work, but I would like to hear confirmation from the reporter of that issue. Also, there are two changes in 5.5.17 that my patch does not include: 1) Bug #67850, which adds two "#ifdef OPENSSL_NO_SSL3" checks to the code. I'm very curious to know which use case this addresses. I had no trouble building PHP (without this patch) against OpenSSL 1.0.1i built with the "no-ssl3" option. I don't mind including this patch regardless, but I would like to satisfy my own curiosity about it (and add some comments to the code for posterity.) 2) Bug #65137, which is intended to help code that uses select/poll on SSL streams. Although I have not yet come up with a test case to prove it, I suspect that change is not 100% correct. The big problem with using select() directly on an SSL socket is: even if your application is "writing", a renegotiation behind the scenes may mean OpenSSL needs to block on a "read" (and vice versa.) So while it certainly helps to drain OpenSSL's internal buffers, the code could still get into a state where it's polling in the wrong direction. This could cause unwanted blocking, or busy-waiting in the case of a nonblocking socket. I still need to do more testing with this latter change. We'll also want feedback from the contributer of that fix (daverandom). ------------------------------------------------------------------------ [2014-10-02 16:25:29] rdlowrey@php.net Hi there folks, just returned from vacation. Can Horde folks verify whether or not @askalski's latest patch resolves their issues? We're reverting the relevant changes for the upcoming releases so the problem will disappear but I'd like to resolve this so we can fix things and see these changes in subsequent releases. ------------------------------------------------------------------------ [2014-09-29 18:49:13] askalski at synacor dot com I uploaded a new version of ssl_read_timeout-5.4.32.patch which should fix the issue with Horde's IMAP connection. The php_openssl_SSL_peek_ok function was calling SSL_read instead of SSL_peek, so the driver occasionally lost 1 byte at the start of a read. (My guess is this would likely occur only on very low latency connections, which explains why I hadn't yet encountered the bug.) ------------------------------------------------------------------------ [2014-09-29 15:34:45] software-php at interfasys dot ch I've just tested @askalski's patch and it did not work at all for IMAP per example. Horde would get completely confused by the replies it got. ------------------------------------------------------------------------ [2014-09-28 16:21:24] askalski at synacor dot com Both versions of the patch (bug41631.patch and ssl_read_timeout-5.4.32.patch) need more rigorous testing before they can be released. I'm willing to help devise a set of tests we can use to validate the implementation. To illustrate the point without getting to deep into things (it's still the weekend!), here's a test which fails on bug41631.patch, and gives an endless stream of warnings: <?php /* nonblocking-write.php */ $ssl = fsockopen("ssl://localhost", 6767); stream_set_blocking($ssl, 0); while (fwrite($ssl, str_repeat("x", 65536)) !== false); ?> # Window 1 $ sudo tc qdisc add dev lo root netem delay 100ms $ openssl s_server -cert server.pem -key server.key -accept 6767 >/dev/null ... $ sudo tc qdisc del dev lo root netem delay 100ms # Window 2 $ php nonblocking-write.php Warning: fwrite(): SSL operation failed with code 1. OpenSSL Error messages: error:1409F07F:SSL routines:SSL3_WRITE_PENDING:bad write retry in /home/askalski/work/php-bug41631/nonblocking-write.php on line 4 The artificial network delay via the NetEm driver is not required to reproduce the error, but rather makes it more reliable to reproduce. Don't forget to remove the delay after you're done testing. You can verify it's removed by checking the ping times of "ping localhost". If you need to generate a self-signed key for testing with "openssl s_server", here's a quick and dirty way: $ openssl genrsa -out server.key $ yes "" | openssl req -new -key server.key -out certreq.csr ; echo $ openssl x509 -req -days 3650 -in certreq.csr -signkey server.key -out server.pem ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=41631 -- Edit this bug report at https://bugs.php.net/bug.php?id=41631&edit=1