Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:107988
MIME-Version: 1.0
Date: Sun, 5 Jan 2020 18:46:49 +0700
Message-ID: <CAP=w73Ut0Mt705XveLY=CFL52haBKTQk7+oxWnjU=sjBbCq5vA@mail.gmail.com>
To: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000c65006059b631906"
Subject: [PHP-DEV] SSL stream context 'local_pk' issue?
From: webdevxp.com@gmail.com (Kosit Supanyo)

--000000000000c65006059b631906
Content-Type: text/plain; charset="UTF-8"

Hi Internals

First of all, Happy new year!

I've found that everytime `stream_socket_accept()` accepts a SSL/TLS
connection, it always read 'local_cert' and 'local_pk' files despite being
read and verified before by `stream_socket_server()`. There's no problem
with 'local_cert' but 'local_pk' because private key files usually have
root 0600 permission. And that may be an issue because you must either run
PHP as root or change permission of private key files (I'm doing the latter
as workaround) in order to make `stream_socket_accept()` work. Is it
possible to make `stream_socket_server()` keep private key file in memory?
(Like nginx does, I think)

Here's a simple scenario with the issue:

<?php
$server = stream_socket_server(
    'tls://0.0.0.0:443',
    $errno,
    $errstr,
    STREAM_SERVER_BIND | STREAM_SERVER_LISTEN,
    stream_context_create([
        'ssl' => [
            'local_cert' => '/path/to/cert',
            'local_pk' => '/path/to/pk',
        ],
    ]),
);

$num_cpus = (int)shell_exec('nproc');

for ($i = 0; $i < $num_cpus; $i++) {
    // fork a worker process
    $pid = pcntl_fork();

    if ($pid === 0) {
        // change user/group of forked process to nobody
        posix_setgid(65534);
        posix_setuid(65534);

        while (true) {
            // This won't work because nobody cannot read private key
            $client = stream_socket_accept($server);

            if ($client) {
                // do something with connections
                // ...
            }
        }
    }
}

// master waits for children to exit
// ...

Another feature that I've found `stream_socket_accept()` lacks is TLS
session resumption. Is there someone working on this feature?

I apologize in advance if this topic had been raised before or if I
misunderstood something.

Cheers

Kosit

--000000000000c65006059b631906--