FastCGI unix sockets support patch

php.internals

Rostislav Krasny

20 years ago
Hi, According to a 'php -h' output of php-cgi 5.1.2 the FastCGI can be used only by TCP/IP: -b <address:port>|<port> Bind Path for external FASTCGI Server mode But according to the code FastCGI could also be used by UNIX sockets. According to the code if the "-b <address:port>" option is used and the port number is illegal or omitted then all the "address:port" string assumed as a UNIX socket name. That means that the UNIX socket should allways include a ":" in its filename. My patch eliminate this limitation. After applying it one should use "-b socket:" for UNIX sockets and "-b address:port" or "-b port" for TCP/IP. And if the port number is illegal, an error message is printed. If the "-b socket:" format is used the ":" is not added to the UNIX socket filename. What do you think about following patch? --- sapi/cgi/libfcgi/os_unix.c.orig Sun Dec 7 14:59:54 2003 +++ sapi/cgi/libfcgi/os_unix.c Mon Mar 20 09:28:28 2006 @@ -299,13 +299,15 @@ char host[MAXPATHLEN]; strlcpy(host, bindPath, MAXPATHLEN-1); - if((tp = strchr(host, ':')) != 0) { + if((tp = strrchr(host, ':')) != 0) { *tp++ = 0; - if((port = atoi(tp)) == 0) { - *--tp = ':'; - } else { + if (*tp != '\0') { + if((port = atoi(tp)) == 0) { + fprintf(stderr, "%s is illegal port number!\n", tp); + return -1; + } tcp = TRUE; - } + } } if(tcp) { if (!*host || !strcmp(host,"*")) { @@ -357,7 +359,7 @@ servLen = sizeof(sa.inetVariant); } else { unlink(bindPath); - if(OS_BuildSockAddrUn(bindPath, &sa.unixVariant, &servLen)) { + if(OS_BuildSockAddrUn(host, &sa.unixVariant, &servLen)) { fprintf(stderr, "Listening socket's path name is too long.\n"); return -1; } This patch changes an OS_CreateLocalIpcFd() function. The same change of OS_FcgiConnect() should probably be done as well. I didn't because the OS_FcgiConnect() isn't used anywhere by php.

Dmitry Stogov

20 years ago
Hi Rostislav, PHP HEAD and PHP_5_1 (5.1.3) don't use libfcgi any more. They use simplest and smallest replacement library. Please look into CVS code and provide a patch for it (if necessary). Thanks. Dmitry.

Rostislav Krasny

20 years ago
On Mon, 20 Mar 2006 13:44:30 +0300 dmitry@zend.com ("Dmitry Stogov") wrote:
> Hi Rostislav, > > PHP HEAD and PHP_5_1 (5.1.3) don't use libfcgi any more. > They use simplest and smallest replacement library. > > Please look into CVS code and provide a patch for it (if necessary). > > Thanks. Dmitry.
Hello Dmitry, I've tried the latest php5.1-200603200930 snapshot. It has the same problem. During fixing it in sapi/cgi/fastcgi.c I reworked an fcgi_listen() function. The new version of this function only is attached to this message instead of a patch that may be less handy in this case. There are two additional things in the function that could still be improved: 1. use gethostbyname2(host, AF_INET) instead of gethostbyname(host) it will eliminate IPv6 addresses from resolving 2. use 0770 socket mode instead of 0777 it will make the UNIX socket more secure What do you think about that new code?

Rostislav Krasny

20 years ago
On Mon, 20 Mar 2006 21:41:39 +0200 rosti.bsd@gmail.com (Rostislav Krasny) wrote:
> 1. use gethostbyname2(host, AF_INET) instead of gethostbyname(host) > it will eliminate IPv6 addresses from resolving
The gethostbyname() doesn't actually request IPv6 addresses. Sorry for that separate false statement.

Dmitry Stogov

20 years ago
Hi Rostisla, I've committed another patch into HEAD and PHP_5_1, that allows usage of UNIX sockets without ':'. -b <host>:<port_number> -b <port_number> -b <unix_path> Thanks. Dmitry.

Rostislav Krasny

20 years ago
On Thu, 23 Mar 2006 13:23:40 +0300 dmitry@zend.com ("Dmitry Stogov") wrote:
> Hi Rostisla, > > I've committed another patch into HEAD and PHP_5_1, that allows usage of > UNIX sockets without ':'. > > -b <host>:<port_number> > -b <port_number> > -b <unix_path>
It means that a choice of the unix_path is restricted. It cannot be a number and cannot include ":number" at the end. I've seen the diff of sapi/cgi/cgi_main.c after your commit. IMHO the distinction between TCP/IP and UNIX socket better to be done according to last ":", as in proposed by me version of sapi/cgi/fastcgi.c. Alternative and maybe much better solution is to use different bind options for TCP/IP and UNIX sockets. For example -b and -B. Anyway sapi/cgi/fastcgi.c should be canged.

Unknown W. Brackets

20 years ago
Wouldn't you typically use a full (absolute) path to a unix socket? And, is it not so that hostnames should not contain /'s or <'s, etc? (I'm not sure what other path separators are used on platforms PHP supports, but I'm pretty sure they all use funky characters.) Assuming these cases are true, and handled, I don't think it's much of a flaw in the system, personally. -[Unknown] -------- Original Message --------

Dmitry Stogov

20 years ago
I don't think that "-b <path>:" is good solution. Two different options for TCP and UNIX sockets make sense. What is wrong with sapi/cgi/fastcgi.c? Thanks. Dmitry.

Rostislav Krasny

20 years ago
On Fri, 24 Mar 2006 11:14:56 +0300 dmitry@zend.com ("Dmitry Stogov") wrote:
> I don't think that "-b <path>:" is good solution. > Two different options for TCP and UNIX sockets make sense. > > What is wrong with sapi/cgi/fastcgi.c?
With two different options for TCP/IP and UNIX sockets you should have two different versions of fcgi_listen(). With a single bind option for both TCP/IP and UNIX sockets my version of fcgi_listen() is better because it doesn't restrict the unix_path. But let's go for the two options' solution :-)

steve roussey

20 years ago
I'll give this a test when 5.1.3RC2 comes out (later today?). I want to do a little testing before launch as this sapi is critical for php to function (for me). -steve-- On 3/23/06, Dmitry Stogov <dmitry@zend.com> wrote: