Req #66462 [Asn->Wfx]: Add opcache.api_enabled to provide password-based access to API functions

Edit report at https://bugs.php.net/bug.php?id=66462&edit=1 ID: 66462 Updated by: dmitry@php.net Reported by: Terry at ellisons dot org dot uk Summary: Add opcache.api_enabled to provide password-based access to API functions -Status: Assigned +Status: Wont fix Type: Feature/Change Request Package: opcache Operating System: N/A PHP Version: master-Git-2014-01-10 (Git) Assigned To: dmitry Block user comment: N Private report: N Previous Comments: ------------------------------------------------------------------------ [2014-01-11 12:50:17] Terry at ellisons dot org dot uk Joe, The requirement that I am trying to address here is a simply one: a set off apps is being developed by various teams of application developers, plus imported 3rd party libraries/applications and run an a production system controlled by sysadmins within a separate subgroup with in the same corporate or organisational domain. The sysadmins will want to have some simple assurance mechanism to prevent app developers putting in, say development-specific, opcache calls which could then trash the production system performance if executed. Yes, the opcache.restrict_api parameter already enables sysadmins to limit access to the Opcache API according to the translated path of the request API and therefore configure the webserver's access control mechanisms to enable effective access control over the opcache API. But this is not well understood by the sysadmin community. We are left with a requirements interpretation as to whether SysAdmins would prefer having a password-based alternative. I have previously discussed this with Dmitry offlist before developing the patch, and as I said it was up to him whether this would be viewed as useful and worth committing. As the value judgement "this is horrible hack...", this is essentially the same approach as adopted by packages such as MySQL, MediaWiki and phpBB for basic password access. If we are to offer a password based alternative, then (because of the need to avoid platform and build dependencies) we need to limit ourselves to ext/standard exported functions. MD5 is currently the only such hash implemented by ext/standard that has an exported API, so don't have easy access to alternatives such as SHA-512. ------------------------------------------------------------------------ [2014-01-11 06:29:34] krakjoe@php.net -1 This is a horrible hack and not required, should you need to secure access to a script utilizing status functions of opcache then you should do that in the industry standard way, we should not provide a half baked hack and shout out "we got this" when we haven't, at all ... ------------------------------------------------------------------------ [2014-01-10 23:37:31] Terry at ellisons dot org dot uk Description: ------------ As per README addition: opcache.api_password (default "") calling OPcache API functions only from PHP scripts which first the API by calling opcache_enable_api("password"). This parameter is set to the MD5 of the required password. Note that if the opcache.restrict_api is also set then both tests are applied. The patch is attached Test script: --------------- This PHPT validates the functionality: --TEST-- Validate use of the directive --INI-- opcache.enable=1 opcache.enable_cli=1 opcache.api_password="e946adb45d4299def2071880d30136d4" --SKIPIF-- <?php require_once('skipif.inc'); ?> --FILE-- <?php var_dump(opcache_get_status()); var_dump(opcache_enable_api("fred")); var_dump(opcache_get_status()); var_dump(opcache_enable_api("Mary had a little lamb")); $status = opcache_get_status(); echo "Get status ", (is_array($status) && isset($status['scripts'][__FILE__])) ? "works":"fails", "\n"; ?> --EXPECTF-- Warning: Zend OPcache API is restricted by "api_password" configuration directive in %s on line 2 bool(false) Warning: Zend OPcache Invalid API enable password in %s line 3 bool(false) Warning: Zend OPcache API is restricted by "api_password" configuration directive in %s on line 4 bool(false) bool(true) Get status works ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=66462&edit=1