Bug #72345 [Com]: session_start() is not subject to max_execution_time
Edit report at https://bugs.php.net/bug.php?id=72345&edit=1
ID: 72345
Comment by: maggus dot staab at googlemail dot com
Reported by: maggus dot staab at googlemail dot com
Summary: session_start() is not subject to max_execution_time
Status: Open
Type: Bug
Package: Session related
PHP Version: Irrelevant
Block user comment: N
Private report: N
New Comment:
in the last 2 months we had at least 4 DDOS attacks which succeeded because php "never"
returns from session_start() of parallel running requests.
A few attackers were able to DOS a apache2 (mod_php) with 400 workers, because all the workers were
waiting for a session lock.
would it be possible to add a "lock_timeout" option (or similar) so one could configure
that session_start() should return (or throw) after a certain amount of milliseconds if it could not
acquire a session lock?
Previous Comments:
------------------------------------------------------------------------
[2016-06-06 17:48:57] maggus dot staab at googlemail dot com
I agree that it is a documented/known issue.
Like https://bugs.php.net/bug.php?id=72346 it is
a very fundamental problem.. The fact that there are a bunch of functions which are not subject to
any timeout makes it really easy to abuse/attack php based applications.
One just needs to block all available php workers and the website will be unavailble. There are no
means in php to protect against such kind of attacks (except you do everything async, but this is
not something 99% of php apps will do)
------------------------------------------------------------------------
[2016-06-06 16:36:58] cmb@php.net
It is documented[1] that:
| The maximum execution time is not affected by system calls,
| stream operations etc. Please see the set_time_limit() function
| for more details.
So, in my opinion, this is not a bug.
[1] <http://php.net/manual/en/info.configuration.php#ini.max-execution-time>
------------------------------------------------------------------------
[2016-06-06 16:12:43] maggus dot staab at googlemail dot com
fixed package
------------------------------------------------------------------------
[2016-06-06 15:54:47] maggus dot staab at googlemail dot com
Description:
------------
time spent in session_start() is not subject to max_execution_time().
this can cause php to block all its worker processes by waiting for the session_lock, which finally
leads to a no longer responding website.
shouldn't a process error and exit after max_execution_time-seconds when it is not able to
aquire the session lock while session_start()?
running with php 5.4 (as this is the most recent version which ubuntu12lts provides)
PHP 5.4.45-3+deb.sury.org~precise+1 (cli) (built: Jan 7 2016 15:32:17)
Copyright (c) 1997-2014 The PHP Group
Zend Engine v2.4.0, Copyright (c) 1998-2014 Zend Technologies
with Zend Debugger v6.0.0, Copyright (c) 1999-2013, by Zend Technologies
with blackfire v1.10.6, https://blackfire.io, by Blackfireio
Inc.
Test script:
---------------
<?php
// run the script 2x concurrently
set_time_limit(5);
echo "acquire session lock:". time() ."\n";
session_start();
echo "got session lock:". time()."\n";
sleep(10);
echo "finished:". time()."\n";
Expected result:
----------------
1st instance should report
>acquire session lock:1465227871
>got session lock:1465227871
>finished:1465227881
2nd instance should error after 5 seconds because session_start() is not able to aquire a session
lock within 5 seconds
Actual result:
--------------
1st instance reports
>acquire session lock:1465227871
>got session lock:1465227871 // LOCK immediately acquired
>finished:1465227881
2nd instance reports
>acquire session lock:1465227872
>got session lock:1465227881 // LOCK acquired after 1st instance exit'ed
>finished:1465227891
------------------------------------------------------------------------
--
Edit this bug report at https://bugs.php.net/bug.php?id=72345&edit=1
Thread (8 messages)