Bug #79501 [ReO]: TLS connections freezing on 7.4 (all versions after 7.3.17)

Edit report at https://bugs.php.net/bug.php?id=79501&edit=1 ID: 79501 User updated by: imnieves at gmail dot com Reported by: imnieves at gmail dot com Summary: TLS connections freezing on 7.4 (all versions after 7.3.17) Status: Re-Opened Type: Bug Package: *Encryption and hash functions Operating System: Linux PHP Version: 7.4.5 Block user comment: N Private report: N New Comment: In a separate method of testing, I constrained TLS versions of phpredis (instead of constraining TLS versions of nginx) In this way I have verified on php 7.4.5-fpm that TLS 1.2 results in consistent working connections. TLS 1.3 results in some connections that work and most other connections that fail. I can also say the cipher suite being used in all my TLS 1.3 connections (consistent and freezing): TLS_AES_256_GCM_SHA384 Previous Comments: ------------------------------------------------------------------------ [2020-05-06 20:51:54] imnieves at gmail dot com I have verified that TLS 1.2 connections work consistently, while TLS 1.3 connections freeze (fail to establish) on PHP 7.4.5-fpm. On the other side of the testing, both TLS 1.2 and TLS 1.3 connections work consistently on PHP 7.3.17-fpm. To perform this test I put nginx in front of my Redis, disabled TLS on Redis entirely, and enabled TLS on nginx. I varied the TLS settings on nginx as follows: TLS 1.2 only, then TLS 1.3 only, then both TLS 1.2 and TLS 1.3. Interesting to note, when nginx has: only TLS 1.2, the connections always work only TLS 1.3, the connections always freeze both TLS 1.2 and TLS 1.3, the connections work for the first 5 attempts, and then one freezes. If I attempt another connection then the next 4 or 5 connections succeed and then another one freezes. And this cycle repeats. ------------------------------------------------------------------------ [2020-05-06 19:00:45] imnieves at gmail dot com I will investigate ------------------------------------------------------------------------ [2020-05-04 14:52:30] nikic@php.net One relevant difference that comes to mind is that PHP 7.4 will negotiate TLS 1.3 by default. Do you know which TLS version actually gets used? ------------------------------------------------------------------------ [2020-05-03 12:46:16] cmb@php.net Related To: Bug #79559 ------------------------------------------------------------------------ [2020-04-20 22:28:28] imnieves at gmail dot com I hope the information below is helpful, or at least enough to re-open. ============================== From the previously mentioned website: <?php function l($message) { global $current; echo $message . ' (' . (microtime(true) - $current) . ')' . PHP_EOL; $current = microtime(true); } ini_set('default_socket_timeout', 5); $start = microtime(true); $current = microtime(true); l('start'); $redis = new Redis(); if (!$redis->connect('tls://redis-instance', 25061, 5, null, 5, 5)) { throw new RuntimeException($redis->getLastError()); } l('connected'); $redis->setOption(Redis::OPT_READ_TIMEOUT, 5); l('option is set'); $redis->auth('some-password'); l('auth complete'); $redis->select(4); l('db selected'); echo 'Total: ' . (microtime(true) - $start) . PHP_EOL; ========================= "occasionally this script hangs up for 300 seconds:" ========================= user:~$ while true; do php redis.php; done start (5.9604644775391E-6) connected (0.017167091369629) option is set (5.0067901611328E-6) auth complete (0.00058794021606445) db selected (0.00032281875610352) Total: 0.018187999725342 start (4.0531158447266E-6) connected (0.012931108474731) option is set (7.1525573730469E-6) auth complete (0.00078892707824707) db selected (0.00040698051452637) Total: 0.014256000518799 start (4.0531158447266E-6) connected (0.01163911819458) option is set (1.0967254638672E-5) auth complete (300.07370495796) db selected (0.00037598609924316) Total: 300.08729100227 ========================== strace log: ========================== write(3, "\27\3\3\0006[O\21\240\275|H\243\356\344\16\277\215\243\362h;\350*<N@\24\25\225\254["..., 59) = 59 fcntl(3, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) fcntl(3, F_SETFL, O_RDWR) = 0 poll([{fd=3, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, 0) = 0 (Timeout) fcntl(3, F_GETFL) = 0x2 (flags O_RDWR) fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 read(3, "\27\3\3\0\26", 5) = 5 read(3, "\262\341\277k3\317O\3143X\232\313\310\2742\246\v\203\341\332T\261", 22) = 22 fcntl(3, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) fcntl(3, F_SETFL, O_RDWR) = 0 write(1, "2020-03-17 10:49:05 auth complet"..., 522020-03-17 10:49:05 auth complete (300.79558706284) ) = 52 poll([{fd=3, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, 0) = 0 (Timeout) fcntl(3, F_GETFL) = 0x2 (flags O_RDWR) fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 write(3, "\27\3\3\0(\245\360\223\217\252\375p\311\324\246\323\1\303\243\360\343\302\2:\214\5'\"\224\32\2500"..., 45) = 45 fcntl(3, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) fcntl(3, F_SETFL, O_RDWR) = 0 poll([{fd=3, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, 0) = 0 (Timeout) fcntl(3, F_GETFL) = 0x2 (flags O_RDWR) fcntl(3, F_SETFL, O_RDWR|O_NONBLOCK) = 0 read(3, "\27\3\3\0\26", 5) = 5 read(3, "\327n\353\321\367\354\317[\274&\316)\237C\304\305\275\343\4\266\334\10", 22) = 22 fcntl(3, F_GETFL) = 0x802 (flags O_RDWR|O_NONBLOCK) fcntl(3, F_SETFL, O_RDWR) = 0 write(1, "2020-03-17 10:49:05 db selected "..., 542020-03-17 10:49:05 db selected (0.00063395500183105) ------------------------------------------------------------------------ The remainder of the comments for this report are too long. To view the rest of the comments, please view the bug report online at https://bugs.php.net/bug.php?id=79501 -- Edit this bug report at https://bugs.php.net/bug.php?id=79501&edit=1