# 5.3.7 is breaking SSL

- Thread: https://externals.io/message/54667
- Original archive: https://news-web.php.net/php.internals/54667
- Started by Reindl Harald on 2011-08-18T00:50:40+00:00
- Messages: 6
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #54667 — Reindl Harald — 2011-08-18T00:50:40+00:00

URL: https://externals.io/message/54667#54667

well i guess it is the change below this results in connections in hanging
around and after a hughe timeout filling my mailbox with cron-mails:

mysqlnd 5.0.8-dev - 20102224 - $Revision: 310735 $

without ssl_set() all works fine but unencyrpted :-(
___________

MySQL server has gone away

 $this->ssl_key = '/etc/mysql-ssl/client.pem';
 $this->ssl_crt = '/etc/mysql-ssl/client.pem';
 $this->ssl_ca  = '/etc/mysql-ssl/ca.crt';

$>conn->ssl_set($this->ssl_key, $this->ssl_crt, $this->ssl_ca, NULL, NULL);
___________

https://bugs.php.net/bug.php?id=55283

- MySQLi extension:
  . Fixed bug #55283 (SSL options set by mysqli_ssl_set ignored for MySQLi
    persistent connections). (Andrey)

---

## #54668 — Rasmus Lerdorf — 2011-08-18T00:57:32+00:00

URL: https://externals.io/message/54667#54668 · In reply to: #54667

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> well i guess it is the change below this results in connections in
> hanging around and after a hughe timeout filling my mailbox with
> cron-mails:
> 
> mysqlnd 5.0.8-dev - 20102224 - $Revision: 310735 $
> 
> without ssl_set() all works fine but unencyrpted :-( ___________
> 
> MySQL server has gone away
> 
> $this->ssl_key = '/etc/mysql-ssl/client.pem'; $this->ssl_crt =
> '/etc/mysql-ssl/client.pem'; $this->ssl_ca  =
> '/etc/mysql-ssl/ca.crt';
> 
> $>conn->ssl_set($this->ssl_key, $this->ssl_crt, $this->ssl_ca, NULL,
> NULL);

If you think that is the reason, respond to the bug to alert the author
of that change. Also rebuild without the patch and verify if that is
actually the cause.

- -Rasmus
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk5MY3wACgkQlxayKTuqOuAzfQCaAt6s7ytrnpuJviovCv0K2def
lbgAn3IwbbUN6TaMj7XdZHPaw5O42FeY
=gw3V
-----END PGP SIGNATURE

---

## #54826 — Scott MacVicar — 2011-08-23T17:21:44+00:00

URL: https://externals.io/message/54667#54826 · In reply to: #54667

> well i guess it is the change below this results in connections in hanging
> around and after a hughe timeout filling my mailbox with cron-mails:
> 
> mysqlnd 5.0.8-dev - 20102224 - $Revision: 310735 $
> 
> without ssl_set() all works fine but unencyrpted :-(
> ___________
> 
> MySQL server has gone away
> 
> $this->ssl_key = '/etc/mysql-ssl/client.pem';
> $this->ssl_crt = '/etc/mysql-ssl/client.pem';
> $this->ssl_ca  = '/etc/mysql-ssl/ca.crt';
> 
> $>conn->ssl_set($this->ssl_key, $this->ssl_crt, $this->ssl_ca, NULL, NULL);
> ___________
> 
> https://bugs.php.net/bug.php?id=55283
> 
> - MySQLi extension:
>  . Fixed bug #55283 (SSL options set by mysqli_ssl_set ignored for MySQLi
>    persistent connections). (Andrey)
> 
> 


Do you have a full script I can use to look at? Do you set a mysql timeout?

- Scott

---

## #54827 — Pierre Joye — 2011-08-23T17:32:22+00:00

URL: https://externals.io/message/54667#54827 · In reply to: #54826

also check with Andrey, he spent a fair amount of time around this issue.


> 
>
> > […]
>
>
> Do you have a full script I can use to look at? Do you set a mysql timeout?
>
> - Scott
>
> --
> 
> 
>
>



-- 
Pierre

@pierrejoye | http://blog.thepimp.net | http://www.libgd.org

---

## #54833 — Reindl Harald — 2011-08-23T22:28:02+00:00

URL: https://externals.io/message/54667#54833 · In reply to: #54826

Am 23.08.2011 19:21, schrieb Scott MacVicar:
> 
> 
> > […]
> 
> 
> Do you have a full script I can use to look at? Do you set a mysql timeout?

wtah exactly are you mssing?

the code is above and timeouts does not matter if it takes 30 minutes
before "mysql server has gone" what leads to take a long time to
recognize that cronjobs are defacto dead

$conn = `mysqli_init()`;
$conn->ssl_set
(
 '/etc/mysql-ssl/client.pem',
 '/etc/mysql-ssl/client.pem',
 '/etc/mysql-ssl/ca.crt',
 NULL,
 `NULL` 
);
mysqli_real_connect($conn, $host, $user, $pwd, $db, port, '', 0);

this code is packed in a abstraction-layer which calls finally
 `mysqli_connect_error()` to display "mysql server has gone away"

PHP 5.3.8 is fixing this as far as i see on the first test machine
"Ssl_cipher DHE-RSA-AES256-SHA" instead dead and timeout

    * Reverted a change in timeout handling restoring PHP 5.3.6
      behavior, which caused mysqlnd SSL connections to hang (Bug
      #55283).

---

## #54849 — Andrey Hristov — 2011-08-24T08:31:29+00:00

URL: https://externals.io/message/54667#54849 · In reply to: #54827

Hi,
it's pretty simple, once you have a MySQL server running with enabled 
SSL. You can use the following three files to set your MySQL
http://hristov.com/mysql_certs/server-key.pem
http://hristov.com/mysql_certs/server-cert.pem
http://hristov.com/mysql_certs/cacert.pem
[mysqld]
ssl-capath=/path/to/certs
ssl-ca=/path/to/certscacert.pem
ssl-cert=/path/to/certsserver-cert.pem
ssl-key=/path/to/certsserver-key.pem

Then on the client side :
./php -r '$flags=MYSQLI_CLIENT_SSL; $c = `mysqli_init()`; 
$c->real_connect("127.0.0.1", "root", "root", "test", 3306, null, $flags);'

leads to a hang during authentication. The server has sent 11 bytes, the 
client reads 4 of them and knows that it should read additional 7, 
because of the information in the 4 bytes. The read of the 7 bytes hang. 
I tried to debug this with ssldump with no success.


Best,
Andrey


> also check with Andrey, he spent a fair amount of time around this issue.
>
> 
> > […]