From 7b3616db775ce11bd85918af2a7a38bb15c3729f Mon Sep 17 00:00:00 2001 From: Sergei Turchanov Date: Thu, 3 Sep 2015 17:24:34 +1000 Subject: Fix #70456: mysqlnd doesn't activate TCP keep-alive when connecting to a server libmysqlclient activates TCP keep-alive when connecting to a server. PHP mysqlnd extension must do the same to maintain compatibility. --- ext/mysqlnd/mysqlnd_net.c | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) (limited to 'ext/mysqlnd/mysqlnd_net.c') diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c index 8683248e4c..fa0ea8fb63 100644 --- a/ext/mysqlnd/mysqlnd_net.c +++ b/ext/mysqlnd/mysqlnd_net.c @@ -61,6 +61,27 @@ mysqlnd_set_sock_no_delay(php_stream * stream TSRMLS_DC) /* }}} */ +/* {{{ mysqlnd_set_sock_keepalive */ +static int +mysqlnd_set_sock_keepalive(php_stream * stream TSRMLS_DC) +{ + + int socketd = ((php_netstream_data_t*)stream->abstract)->socket; + int ret = SUCCESS; + int flag = 1; + int result = setsockopt(socketd, SOL_SOCKET, SO_KEEPALIVE, (char *) &flag, sizeof(int)); + + DBG_ENTER("mysqlnd_set_sock_keepalive"); + + if (result == -1) { + ret = FAILURE; + } + + DBG_RETURN(ret); +} +/* }}} */ + + /* {{{ mysqlnd_net::network_read_ex */ static enum_func_status MYSQLND_METHOD(mysqlnd_net, network_read_ex)(MYSQLND_NET * const net, zend_uchar * const buffer, const size_t count, @@ -252,6 +273,8 @@ MYSQLND_METHOD(mysqlnd_net, post_connect_set_opt)(MYSQLND_NET * const net, if (!memcmp(scheme, "tcp://", sizeof("tcp://") - 1)) { /* TCP -> Set TCP_NODELAY */ mysqlnd_set_sock_no_delay(net_stream TSRMLS_CC); + /* TCP -> Set SO_KEEPALIVE */ + mysqlnd_set_sock_keepalive(net_stream TSRMLS_CC); } } -- cgit v1.2.1 From 59de2c037c4c946fc43478edc154d89dda95873d Mon Sep 17 00:00:00 2001 From: Andrey Hristov Date: Fri, 25 Sep 2015 14:06:28 +0200 Subject: Fixed bug #70572 segfault in mysqlnd_connect --- ext/mysqlnd/mysqlnd_net.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'ext/mysqlnd/mysqlnd_net.c') diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c index fa0ea8fb63..69f4b7a54a 100644 --- a/ext/mysqlnd/mysqlnd_net.c +++ b/ext/mysqlnd/mysqlnd_net.c @@ -206,8 +206,10 @@ MYSQLND_METHOD(mysqlnd_net, open_tcp_or_unix)(MYSQLND_NET * const net, const cha if (hashed_details) { mnd_sprintf_free(hashed_details); } - errcode = CR_CONNECTION_ERROR; - SET_CLIENT_ERROR(*error_info, errcode? errcode:CR_CONNECTION_ERROR, UNKNOWN_SQLSTATE, errstr); + SET_CLIENT_ERROR(*error_info, + CR_CONNECTION_ERROR, + UNKNOWN_SQLSTATE, + errstr? errstr:"Unknown error while connecting"); if (errstr) { /* no mnd_ since we don't allocate it */ efree(errstr); -- cgit v1.2.1 From 8292260515a904b4d515484145c78f33a06ae1ae Mon Sep 17 00:00:00 2001 From: Andrey Hristov Date: Wed, 21 Oct 2015 15:10:24 +0200 Subject: Fix for Bug #68344 MySQLi does not provide way to disable peer certificate validation --- ext/mysqlnd/mysqlnd_net.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) (limited to 'ext/mysqlnd/mysqlnd_net.c') diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c index 69f4b7a54a..4cbe9deb29 100644 --- a/ext/mysqlnd/mysqlnd_net.c +++ b/ext/mysqlnd/mysqlnd_net.c @@ -901,6 +901,12 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net TSRMLS_DC) zval verify_peer_zval; ZVAL_TRUE(&verify_peer_zval); php_stream_context_set_option(context, "ssl", "verify_peer", &verify_peer_zval); + php_stream_context_set_option(context, "ssl", "verify_peer_name", &verify_peer_zval); + } else { + zval verify_peer_zval; + ZVAL_FALSE(&verify_peer_zval); + php_stream_context_set_option(context, "ssl", "verify_peer", &verify_peer_zval); + php_stream_context_set_option(context, "ssl", "verify_peer_name", &verify_peer_zval); } if (net->data->options.ssl_cert) { zval cert_zval; @@ -918,7 +924,7 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net TSRMLS_DC) if (net->data->options.ssl_capath) { zval capath_zval; ZVAL_STRING(&capath_zval, net->data->options.ssl_capath, 0); - php_stream_context_set_option(context, "ssl", "cafile", &capath_zval); + php_stream_context_set_option(context, "ssl", "capath", &capath_zval); } if (net->data->options.ssl_passphrase) { zval passphrase_zval; -- cgit v1.2.1 From afd31489d0d9999f701467e99ef2b40794eed196 Mon Sep 17 00:00:00 2001 From: Andrey Hristov Date: Thu, 22 Oct 2015 11:48:53 +0200 Subject: Improve fix for Bug #68344 MySQLi does not provide way to disable peer certificate validation --- ext/mysqlnd/mysqlnd_net.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) (limited to 'ext/mysqlnd/mysqlnd_net.c') diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c index 4cbe9deb29..7b164ac294 100644 --- a/ext/mysqlnd/mysqlnd_net.c +++ b/ext/mysqlnd/mysqlnd_net.c @@ -897,14 +897,9 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net TSRMLS_DC) ZVAL_STRING(&key_zval, net->data->options.ssl_key, 0); php_stream_context_set_option(context, "ssl", "local_pk", &key_zval); } - if (net->data->options.ssl_verify_peer) { - zval verify_peer_zval; - ZVAL_TRUE(&verify_peer_zval); - php_stream_context_set_option(context, "ssl", "verify_peer", &verify_peer_zval); - php_stream_context_set_option(context, "ssl", "verify_peer_name", &verify_peer_zval); - } else { + { zval verify_peer_zval; - ZVAL_FALSE(&verify_peer_zval); + ZVAL_BOOL(&verify_peer_zval, net->data->options.ssl_verify_peer); php_stream_context_set_option(context, "ssl", "verify_peer", &verify_peer_zval); php_stream_context_set_option(context, "ssl", "verify_peer_name", &verify_peer_zval); } -- cgit v1.2.1 From c67fc6bb090d3faecc93691626e891540405fbf9 Mon Sep 17 00:00:00 2001 From: Dmitry Stogov Date: Thu, 29 Oct 2015 20:06:55 +0300 Subject: Fixed memory leak in php_stream_context_set_option() --- ext/mysqlnd/mysqlnd_net.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'ext/mysqlnd/mysqlnd_net.c') diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c index c0a913bab6..ccac6ad1fc 100644 --- a/ext/mysqlnd/mysqlnd_net.c +++ b/ext/mysqlnd/mysqlnd_net.c @@ -924,6 +924,7 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net) zval key_zval; ZVAL_STRING(&key_zval, net->data->options.ssl_key); php_stream_context_set_option(context, "ssl", "local_pk", &key_zval); + zval_ptr_dtor(&key_zval); any_flag = TRUE; } if (net->data->options.ssl_cert) { @@ -933,6 +934,7 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net) if (!net->data->options.ssl_key) { php_stream_context_set_option(context, "ssl", "local_pk", &cert_zval); } + zval_ptr_dtor(&cert_zval); any_flag = TRUE; } if (net->data->options.ssl_ca) { @@ -945,18 +947,21 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net) zval capath_zval; ZVAL_STRING(&capath_zval, net->data->options.ssl_capath); php_stream_context_set_option(context, "ssl", "capath", &capath_zval); + zval_ptr_dtor(&capath_zval); any_flag = TRUE; } if (net->data->options.ssl_passphrase) { zval passphrase_zval; ZVAL_STRING(&passphrase_zval, net->data->options.ssl_passphrase); php_stream_context_set_option(context, "ssl", "passphrase", &passphrase_zval); + zval_ptr_dtor(&passphrase_zval); any_flag = TRUE; } if (net->data->options.ssl_cipher) { zval cipher_zval; ZVAL_STRING(&cipher_zval, net->data->options.ssl_cipher); php_stream_context_set_option(context, "ssl", "ciphers", &cipher_zval); + zval_ptr_dtor(&cipher_zval); any_flag = TRUE; } { -- cgit v1.2.1 From 6d51b7b2e3468601acdaaf9041c9131b5aa47f98 Mon Sep 17 00:00:00 2001 From: Andrey Hristov Date: Tue, 27 Oct 2015 12:59:09 +0100 Subject: Another Fix for Bug #68344 MySQLi does not provide way to disable peer certificate validation Added the possibility to explicitly state that the peer certificate should not be checked. Back to the default - checking the certificate. Exported MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT Usage : mysqli_real_connect( , , , , , MYSQLI_CLIENT_SSL | MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT) If mysqli_ssl_set() is not called, but only MYSQLI_CLIENT_SSL is passed, without the (don't) very flag, then no verification takes place. --- ext/mysqlnd/mysqlnd_net.c | 50 ++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 43 insertions(+), 7 deletions(-) (limited to 'ext/mysqlnd/mysqlnd_net.c') diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c index 7b164ac294..3e8d0993fa 100644 --- a/ext/mysqlnd/mysqlnd_net.c +++ b/ext/mysqlnd/mysqlnd_net.c @@ -798,8 +798,27 @@ MYSQLND_METHOD(mysqlnd_net, set_client_option)(MYSQLND_NET * const net, enum mys break; } case MYSQL_OPT_SSL_VERIFY_SERVER_CERT: - net->data->options.ssl_verify_peer = value? ((*(zend_bool *)value)? TRUE:FALSE): FALSE; + { + enum mysqlnd_ssl_peer val = *((enum mysqlnd_ssl_peer *)value); + switch (val) { + case MYSQLND_SSL_PEER_VERIFY: + DBG_INF("MYSQLND_SSL_PEER_VERIFY"); + break; + case MYSQLND_SSL_PEER_DONT_VERIFY: + DBG_INF("MYSQLND_SSL_PEER_DONT_VERIFY"); + break; + case MYSQLND_SSL_PEER_DEFAULT: + DBG_INF("MYSQLND_SSL_PEER_DEFAULT"); + val = MYSQLND_SSL_PEER_DEFAULT; + break; + default: + DBG_INF("default = MYSQLND_SSL_PEER_DEFAULT_ACTION"); + val = MYSQLND_SSL_PEER_DEFAULT; + break; + } + net->data->options.ssl_verify_peer = val; break; + } case MYSQL_OPT_READ_TIMEOUT: net->data->options.timeout_read = *(unsigned int*) value; break; @@ -886,6 +905,7 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net TSRMLS_DC) #ifdef MYSQLND_SSL_SUPPORTED php_stream_context * context = php_stream_context_alloc(TSRMLS_C); php_stream * net_stream = net->data->m.get_stream(net TSRMLS_CC); + zend_bool any_flag = FALSE; DBG_ENTER("mysqlnd_net::enable_ssl"); if (!context) { @@ -896,12 +916,7 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net TSRMLS_DC) zval key_zval; ZVAL_STRING(&key_zval, net->data->options.ssl_key, 0); php_stream_context_set_option(context, "ssl", "local_pk", &key_zval); - } - { - zval verify_peer_zval; - ZVAL_BOOL(&verify_peer_zval, net->data->options.ssl_verify_peer); - php_stream_context_set_option(context, "ssl", "verify_peer", &verify_peer_zval); - php_stream_context_set_option(context, "ssl", "verify_peer_name", &verify_peer_zval); + any_flag = TRUE; } if (net->data->options.ssl_cert) { zval cert_zval; @@ -910,27 +925,48 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net TSRMLS_DC) if (!net->data->options.ssl_key) { php_stream_context_set_option(context, "ssl", "local_pk", &cert_zval); } + any_flag = TRUE; } if (net->data->options.ssl_ca) { zval cafile_zval; ZVAL_STRING(&cafile_zval, net->data->options.ssl_ca, 0); php_stream_context_set_option(context, "ssl", "cafile", &cafile_zval); + any_flag = TRUE; } if (net->data->options.ssl_capath) { zval capath_zval; ZVAL_STRING(&capath_zval, net->data->options.ssl_capath, 0); php_stream_context_set_option(context, "ssl", "capath", &capath_zval); + any_flag = TRUE; } if (net->data->options.ssl_passphrase) { zval passphrase_zval; ZVAL_STRING(&passphrase_zval, net->data->options.ssl_passphrase, 0); php_stream_context_set_option(context, "ssl", "passphrase", &passphrase_zval); + any_flag = TRUE; } if (net->data->options.ssl_cipher) { zval cipher_zval; ZVAL_STRING(&cipher_zval, net->data->options.ssl_cipher, 0); php_stream_context_set_option(context, "ssl", "ciphers", &cipher_zval); + any_flag = TRUE; + } + { + zval verify_peer_zval; + zend_bool verify; + + if (net->data->options.ssl_verify_peer == MYSQLND_SSL_PEER_DEFAULT) { + net->data->options.ssl_verify_peer = any_flag? MYSQLND_SSL_PEER_DEFAULT_ACTION:MYSQLND_SSL_PEER_DONT_VERIFY; + } + + verify = net->data->options.ssl_verify_peer == MYSQLND_SSL_PEER_VERIFY? TRUE:FALSE; + + DBG_INF_FMT("VERIFY=%d", verify); + ZVAL_BOOL(&verify_peer_zval, verify); + php_stream_context_set_option(context, "ssl", "verify_peer", &verify_peer_zval); + php_stream_context_set_option(context, "ssl", "verify_peer_name", &verify_peer_zval); } + php_stream_context_set(net_stream, context); if (php_stream_xport_crypto_setup(net_stream, STREAM_CRYPTO_METHOD_TLS_CLIENT, NULL TSRMLS_CC) < 0 || php_stream_xport_crypto_enable(net_stream, 1 TSRMLS_CC) < 0) -- cgit v1.2.1 From 822400ef3b807f0a73b4c0879cdf4a802bf7e4fe Mon Sep 17 00:00:00 2001 From: Andrey Hristov Date: Mon, 16 Nov 2015 12:38:25 +0100 Subject: News for fixed bug #68344 --- ext/mysqlnd/mysqlnd_net.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'ext/mysqlnd/mysqlnd_net.c') diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c index 3e8d0993fa..2231e1db2c 100644 --- a/ext/mysqlnd/mysqlnd_net.c +++ b/ext/mysqlnd/mysqlnd_net.c @@ -965,6 +965,10 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net TSRMLS_DC) ZVAL_BOOL(&verify_peer_zval, verify); php_stream_context_set_option(context, "ssl", "verify_peer", &verify_peer_zval); php_stream_context_set_option(context, "ssl", "verify_peer_name", &verify_peer_zval); + if (net->data->options.ssl_verify_peer == MYSQLND_SSL_PEER_DONT_VERIFY) { + ZVAL_TRUE(&verify_peer_zval); + php_stream_context_set_option(context, "ssl", "allow_self_signed", &verify_peer_zval); + } } php_stream_context_set(net_stream, context); -- cgit v1.2.1 From 49493a2dcfb2cd1758b69b13d9006ead3be0e066 Mon Sep 17 00:00:00 2001 From: Lior Kaplan Date: Fri, 1 Jan 2016 19:19:27 +0200 Subject: Happy new year (Update copyright to 2016) --- ext/mysqlnd/mysqlnd_net.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'ext/mysqlnd/mysqlnd_net.c') diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c index 2231e1db2c..0fa67107e6 100644 --- a/ext/mysqlnd/mysqlnd_net.c +++ b/ext/mysqlnd/mysqlnd_net.c @@ -2,7 +2,7 @@ +----------------------------------------------------------------------+ | PHP Version 5 | +----------------------------------------------------------------------+ - | Copyright (c) 2006-2015 The PHP Group | + | Copyright (c) 2006-2016 The PHP Group | +----------------------------------------------------------------------+ | This source file is subject to version 3.01 of the PHP license, | | that is bundled with this package in the file LICENSE, and is | -- cgit v1.2.1 From 93dc91b386b53bdd317ea6abd70640e2bbfbaf73 Mon Sep 17 00:00:00 2001 From: Nikita Popov Date: Sat, 30 Jan 2016 14:56:17 +0100 Subject: Remove version checks PHP_VERSION_ID PHP_API_VERSION ZEND_MODULE_API_NO PHP_MAJOR_VERSION, PHP_MINOR_VERSION ZEND_ENGINE_2 I've left litespeed alone, as it seems to genuinely maintain support for many PHP versions. --- ext/mysqlnd/mysqlnd_net.c | 16 ---------------- 1 file changed, 16 deletions(-) (limited to 'ext/mysqlnd/mysqlnd_net.c') diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c index a44faf75db..bf86a17a08 100644 --- a/ext/mysqlnd/mysqlnd_net.c +++ b/ext/mysqlnd/mysqlnd_net.c @@ -133,11 +133,7 @@ MYSQLND_METHOD(mysqlnd_net, open_pipe)(MYSQLND_NET * const net, const char * con const zend_bool persistent, MYSQLND_STATS * const conn_stats, MYSQLND_ERROR_INFO * const error_info) { -#if PHP_API_VERSION < 20100412 - unsigned int streams_options = ENFORCE_SAFE_MODE; -#else unsigned int streams_options = 0; -#endif dtor_func_t origin_dtor; php_stream * net_stream = NULL; @@ -173,11 +169,7 @@ MYSQLND_METHOD(mysqlnd_net, open_tcp_or_unix)(MYSQLND_NET * const net, const cha const zend_bool persistent, MYSQLND_STATS * const conn_stats, MYSQLND_ERROR_INFO * const error_info) { -#if PHP_API_VERSION < 20100412 - unsigned int streams_options = ENFORCE_SAFE_MODE; -#else unsigned int streams_options = 0; -#endif unsigned int streams_flags = STREAM_XPORT_CLIENT | STREAM_XPORT_CONNECT; char * hashed_details = NULL; int hashed_details_len = 0; @@ -983,11 +975,7 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net) php_stream_context_set_option(context, "ssl", "allow_self_signed", &verify_peer_zval); } } -#if PHP_API_VERSION >= 20131106 - php_stream_context_set(net_stream, context); -#else php_stream_context_set(net_stream, context); -#endif if (php_stream_xport_crypto_setup(net_stream, STREAM_CRYPTO_METHOD_TLS_CLIENT, NULL) < 0 || php_stream_xport_crypto_enable(net_stream, 1) < 0) { @@ -1003,11 +991,7 @@ MYSQLND_METHOD(mysqlnd_net, enable_ssl)(MYSQLND_NET * const net) of the context, which means usage of already freed memory, bad. Actually we don't need this context anymore after we have enabled SSL on the connection. Thus it is very simple, we remove it. */ -#if PHP_API_VERSION >= 20131106 php_stream_context_set(net_stream, NULL); -#else - php_stream_context_set(net_stream, NULL); -#endif if (net->data->options.timeout_read) { struct timeval tv; -- cgit v1.2.1 From f2ab731a8c47d2988ddf0d61cb06c0f62e17ab19 Mon Sep 17 00:00:00 2001 From: Andrey Hristov Date: Wed, 16 Mar 2016 10:24:52 +0100 Subject: Fix emails in headers. @mysql.com addresses are no more since many years. --- ext/mysqlnd/mysqlnd_net.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) (limited to 'ext/mysqlnd/mysqlnd_net.c') diff --git a/ext/mysqlnd/mysqlnd_net.c b/ext/mysqlnd/mysqlnd_net.c index a44faf75db..56c9d30df1 100644 --- a/ext/mysqlnd/mysqlnd_net.c +++ b/ext/mysqlnd/mysqlnd_net.c @@ -12,13 +12,12 @@ | obtain it through the world-wide-web, please send a note to | | license@php.net so we can mail you a copy immediately. | +----------------------------------------------------------------------+ - | Authors: Andrey Hristov | - | Ulf Wendel | - | Georg Richter | + | Authors: Andrey Hristov | + | Ulf Wendel | + | Georg Richter | +----------------------------------------------------------------------+ */ -/* $Id: mysqlnd_ps.c 316906 2011-09-17 10:24:18Z pajoye $ */ #include "php.h" #include "php_globals.h" #include "mysqlnd.h" -- cgit v1.2.1