I thought I'd post here first because I've always seen great responses in this forum and I wanted to see if any of you had some insight.
I don't know if this is:
(1) a PHP bug,
(2) a vulnerability,
(3) something I haven't configured properly (very possible lol), or
(4) something else.
I am running:
FreeBSD 11.3-RELEASE-p5
PHP 7.2.33 (fpm-fcgi), Zend OPcache v7.2.33
Apache/2.4.46 (FreeBSD)
In the PHP documentation:
www.php.net
The first example given is:
I'm building a much more complicated script but this simple example is all I need to illustrate the problem:
With certain VALID URLs, the above script will cause one of the CPU cores to go to 100% for 120 seconds until the PHP script times out. Then, the following error will appear in my PHP error log:
During those 2 minutes, none of the sites on my server are accessible! I'm hosting about 20 client sites at the moment. This is a backup server with all the same specs and same software versions as the production server. Its roughly, but not exactly a mirror and all of the sites on the backup are fully functional.
Now, I realize the code example in the PHP docs is simplified but I'm concerned that such a simple script can essentially cripple the Apache server.
Digging into it, I **think** the "lock up" happens here:
I've found some servers aren't sending standard CRLF, some servers send mangled headers, some servers don't like the "128" and I've found that simply using "fgets($fp);" will SOMETIMES avoid the lock-up for that particular case.
But I'm not here for advice on coding. I have the function working well. My issue is that anyone playing with this PHP function can lock up the whole server for 2 minutes every they run it.
So I my thoughts/questions are:
1) Why would a socket connection cause a core to go to 100%?
2) I've got 8 cores. Htop is showing only one going to 100%. Why is this locking up all my other web sites for 2 minutes?
Thanks in advance for any ideas. Let me know if additional system info is needed.
I don't know if this is:
(2) a vulnerability,
(3) something I haven't configured properly (very possible lol), or
(4) something else.
I am running:
FreeBSD 11.3-RELEASE-p5
PHP 7.2.33 (fpm-fcgi), Zend OPcache v7.2.33
Apache/2.4.46 (FreeBSD)
In the PHP documentation:
PHP: fsockopen - Manual
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
www.php.net
The first example given is:
PHP:
<?php
$fp = fsockopen("www.example.com", 80, $errno, $errstr, 30);
if (!$fp) {
echo "$errstr ($errno)<br />\n";
} else {
$out = "GET / HTTP/1.1\r\n";
$out .= "Host: www.example.com\r\n";
$out .= "Connection: Close\r\n\r\n";
fwrite($fp, $out);
while (!feof($fp)) {
echo fgets($fp, 128);
}
fclose($fp);
}
?>I'm building a much more complicated script but this simple example is all I need to illustrate the problem:
With certain VALID URLs, the above script will cause one of the CPU cores to go to 100% for 120 seconds until the PHP script times out. Then, the following error will appear in my PHP error log:
Code:
[06-Oct-2020 23:07:38 America/New_York] PHP Fatal error: Maximum execution time of 120 seconds exceeded in /... path-to-my-script.php on line 710During those 2 minutes, none of the sites on my server are accessible! I'm hosting about 20 client sites at the moment. This is a backup server with all the same specs and same software versions as the production server. Its roughly, but not exactly a mirror and all of the sites on the backup are fully functional.
Now, I realize the code example in the PHP docs is simplified but I'm concerned that such a simple script can essentially cripple the Apache server.
Digging into it, I **think** the "lock up" happens here:
PHP:
while (!feof($fp)) {
echo fgets($fp, 128);
}I've found some servers aren't sending standard CRLF, some servers send mangled headers, some servers don't like the "128" and I've found that simply using "fgets($fp);" will SOMETIMES avoid the lock-up for that particular case.
But I'm not here for advice on coding. I have the function working well. My issue is that anyone playing with this PHP function can lock up the whole server for 2 minutes every they run it.
So I my thoughts/questions are:
1) Why would a socket connection cause a core to go to 100%?
2) I've got 8 cores. Htop is showing only one going to 100%. Why is this locking up all my other web sites for 2 minutes?
Thanks in advance for any ideas. Let me know if additional system info is needed.
Last edited:
