PHP – 微宇宙

PHP – OpenSSL 生成CA私钥&证书及签发带SAN的证书

生成CA私钥及证书：

参考Example #1 Creating a self-signed certificate

使用上面的方法可以生成CA证书并使用，但是如果使用上面的方法直接生成的自签名域名证书，即使你把（CA）证书加入到了受信任的根证书列表，也不会受浏览器信任：

NET::ERR_CERT_COMMON_NAME_INVALID

此服务器无法证实它就是 localhost – 它的安全证书没有指定主题备用名称。这可能是因为某项配置有误或某个攻击者拦截了您的连接。

你还需要把域名加入到SAN。

首先生成OpenSSL的配置文件：

// Domain name place at common name doesn't work on some browsers, you need to put them into SAN
$dnsNames = [
    "localhost",
    "127.0.0.1",
    "::1",
];

$opensslConfigurationFilePath = sprintf("%s/%s.%s.%s.conf", sys_get_temp_dir(), "openssl", mt_rand(1000000, 9999999), time());

// Create openssl.conf file
$oldUmask = umask(0077);
$opensslConfigurationFilePointer = fopen($opensslConfigurationFilePath, "w+");
umask($oldUmask);

// Write basic configurations
fwrite($opensslConfigurationFilePointer, <<<EOF
[req]
req_extensions = extension_section
x509_extensions	= extension_section
distinguished_name = dn

[dn]

[extension_section]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
EOF
);

// Write SANs
foreach ($dnsNames as $key => $value) {
    fwrite($opensslConfigurationFilePointer, sprintf("\nDNS.%d = %s", $key + 1, $value));
}

// Close configuration pointer
fflush($opensslConfigurationFilePointer);
fclose($opensslConfigurationFilePointer);

$configurationArray = [
    "digest_alg" => "sha256",
    "config" => $opensslConfigurationFilePath, // Use $opensslConfigurationFilePath as configuration file
];

// Domain name place at common name doesn't work on some browsers, you need to put them into SAN

$dnsNames = [

"localhost",

"127.0.0.1",

"::1",

];

$opensslConfigurationFilePath = sprintf("%s/%s.%s.%s.conf", sys_get_temp_dir(), "openssl", mt_rand(1000000, 9999999), time());

// Create openssl.conf file

$oldUmask = umask(0077);

$opensslConfigurationFilePointer = fopen($opensslConfigurationFilePath, "w+");

umask($oldUmask);

// Write basic configurations

fwrite($opensslConfigurationFilePointer, <<<EOF

[req]

req_extensions = extension_section

x509_extensions = extension_section

distinguished_name = dn

[dn]

[extension_section]

basicConstraints = CA:FALSE

keyUsage = nonRepudiation, digitalSignature, keyEncipherment

subjectAltName = @alt_names

[alt_names]

EOF

);

// Write SANs

foreach ($dnsNames as $key => $value) {

fwrite($opensslConfigurationFilePointer, sprintf("\nDNS.%d = %s", $key + 1, $value));

}

// Close configuration pointer

fflush($opensslConfigurationFilePointer);

fclose($opensslConfigurationFilePointer);

$configurationArray = [

"digest_alg" => "sha256",

"config" => $opensslConfigurationFilePath, // Use $opensslConfigurationFilePath as configuration file

];

通过上一步生成的配置文件生成CSR：

// $dn = [...];
// $privkey = ...;

// Generate a certificate signing request with configurationArray 
$csr = openssl_csr_new($dn, $privkey, $configurationArray);

// $dn = [...];

// $privkey = ...;

// Generate a certificate signing request with configurationArray

$csr = openssl_csr_new($dn, $privkey, $configurationArray);

对CSR进行签名：

// $CACertFile = ...;
// $CAPrivateKeyFile = ...;

// Generate a cert
$x509 = openssl_csr_sign($csr, $CACertFile, $CAPrivateKeyFile, 3650, $configurationArray);

// $CACertFile = ...;

// $CAPrivateKeyFile = ...;

// Generate a cert

$x509 = openssl_csr_sign($csr, $CACertFile, $CAPrivateKeyFile, 3650, $configurationArray);

最后删除配置文件：

unlink($opensslConfigurationFilePath);

1	unlink($opensslConfigurationFilePath);

References:

https://secure.php.net/manual/en/function.openssl-csr-new.php

https://comm.support.ca.com/kb/adding-custom-x509-extensions-to-certificate-signing-requests/kb000042912

https://www.openssl.org/docs/manmaster/man5/x509v3_config.html#Basic-Constraints

https://github.com/openssl/openssl/blob/2cc7acd273bc39f1360aed52400d18bb65b88a95/apps/openssl.cnf#L36

https://bugs.php.net/bug.php?id=71050

https://stackoverflow.com/questions/30977264/subject-alternative-name-not-present-in-certificate

ERROR: failed to retrieve TCP_INFO for socket: Protocol not available (92)

php_source_dir="/usr/src/php-7.2.12"
sed -i "s/#define HAVE_LQ_TCP_INFO 1/\/\/ #define HAVE_LQ_TCP_INFO 1/g" ${php_source_dir}/main/php_config.h
make -j32 clean && make -j$(cat /proc/cpuinfo | grep "processor" | wc -l) && make -j32 install

php_source_dir="/usr/src/php-7.2.12"

sed -i "s/#define HAVE_LQ_TCP_INFO 1/\/\/ #define HAVE_LQ_TCP_INFO 1/g" ${php_source_dir}/main/php_config.h

make -j32 clean && make -j$(cat /proc/cpuinfo | grep "processor" | wc -l) && make -j32 install

PHP 7.2 compile on Debian Stretch

Libraries:

apt -y install \
    libcurl4-openssl-dev \
    libgd-dev \
    libsodium-dev \
    libxml2-dev \
    libpcre3-dev \
    libssl-dev \
    libsqlite3-dev \
    libzip-dev \
    libbz2-dev \
    libedit-dev \
    libxmlrpc-epi-dev \
    libxmlrpc-core-c3-dev \
    libxslt1-dev \
    libwebp-dev \
    libreadline-dev

apt -y install \

libcurl4-openssl-dev \

libgd-dev \

libsodium-dev \

libxml2-dev \

libpcre3-dev \

libssl-dev \

libsqlite3-dev \

libzip-dev \

libbz2-dev \

libedit-dev \

libxmlrpc-epi-dev \

libxmlrpc-core-c3-dev \

libxslt1-dev \

libwebp-dev \

libreadline-dev

Configure:

./configure \
    --prefix=/usr/local/php-7.2 \
    --build=x86_64-linux-gnu \
    --host=x86_64-linux-gnu \
    --config-cache --cache-file=$(pwd -P)/config.cache \
    --with-libdir=lib/x86_64-linux-gnu \
    --enable-cli \
    --enable-fpm \
    --with-config-file-path=\${prefix}/etc \
    --with-config-file-scan-dir=\${prefix}/etc/conf.d \
    --with-fpm-user=www-data \
    --with-fpm-group=www-data \
    --disable-debug \
    --with-pic \
    --with-layout=GNU \
    --with-pear \
    --enable-filter \
    --with-openssl=yes \
    --with-pcre-regex=/usr \
    --enable-hash \
    --with-mhash=/usr \
    --enable-libxml \
    --enable-session \
    --with-sodium \
    --with-zlib=/usr \
    --with-zlib-dir=/usr \
    \
    --enable-opcache \
    --enable-opcache-file \
    --enable-huge-code-pages \
    \
    --enable-mysqlnd \
    --enable-mysqlnd-compression-support \
    --with-zlib-dir=/usr \
    --with-mysqli=mysqlnd \
    --with-pdo-mysql=mysqlnd \
    \
    --with-sqlite3=/usr \
    --with-pdo-sqlite=/usr \
    \
    --enable-json \
    \
    --enable-intl \
    \
    --with-curl=/usr \
    \
    --with-bz2=/usr \
    \
    --with-gd=/usr \
    --with-jpeg-dir=/usr \
    --with-xpm-dir=/usr/X11R6 \
    --with-png-dir=/usr \
    --with-freetype-dir=/usr \
    --with-webp-dir=/usr \
    \
    --enable-mbstring \
    --enable-mbregex \
    --enable-mbregex-backtrack \
    \
    --with-libedit=/usr \
    \
    --enable-wddx \
    --enable-xml \
    --with-xsl=/usr \
    \
    --with-xmlrpc=/usr \
    --with-libxml-dir=/usr \
    \
    --enable-zip \
    --with-zlib-dir=/usr \
    --with-libzip=/usr \
    \
    --enable-calendar \
    --enable-ctype \
    --enable-exif \
    --enable-fileinfo \
    --enable-ftp \
    --with-openssl-dir=/usr \
    --with-gettext=/usr \
    --with-iconv \
    --enable-pdo \
    --enable-phar \
    --enable-pcntl \
    --enable-posix \
    --enable-shmop \
    --enable-sockets \
    --enable-sysvmsg \
    --enable-sysvsem \
    --enable-sysvshm \
    --enable-tokenizer

./configure \

--prefix=/usr/local/php-7.2 \

--build=x86_64-linux-gnu \

--host=x86_64-linux-gnu \

--config-cache --cache-file=$(pwd -P)/config.cache \

--with-libdir=lib/x86_64-linux-gnu \

--enable-cli \

--enable-fpm \

--with-config-file-path=\${prefix}/etc \

--with-config-file-scan-dir=\${prefix}/etc/conf.d \

--with-fpm-user=www-data \

--with-fpm-group=www-data \

--disable-debug \

--with-pic \

--with-layout=GNU \

--with-pear \

--enable-filter \

--with-openssl=yes \

--with-pcre-regex=/usr \

--enable-hash \

--with-mhash=/usr \

--enable-libxml \

--enable-session \

--with-sodium \

--with-zlib=/usr \

--with-zlib-dir=/usr \

--enable-opcache \

--enable-opcache-file \

--enable-huge-code-pages \

--enable-mysqlnd \

--enable-mysqlnd-compression-support \

--with-zlib-dir=/usr \

--with-mysqli=mysqlnd \

--with-pdo-mysql=mysqlnd \

--with-sqlite3=/usr \

--with-pdo-sqlite=/usr \

--enable-json \

--enable-intl \

--with-curl=/usr \

--with-bz2=/usr \

--with-gd=/usr \

--with-jpeg-dir=/usr \

--with-xpm-dir=/usr/X11R6 \

--with-png-dir=/usr \

--with-freetype-dir=/usr \

--with-webp-dir=/usr \

--enable-mbstring \

--enable-mbregex \

--enable-mbregex-backtrack \

--with-libedit=/usr \

--enable-wddx \

--enable-xml \

--with-xsl=/usr \

--with-xmlrpc=/usr \

--with-libxml-dir=/usr \

--enable-zip \

--with-zlib-dir=/usr \

--with-libzip=/usr \

--enable-calendar \

--enable-ctype \

--enable-exif \

--enable-fileinfo \

--enable-ftp \

--with-openssl-dir=/usr \

--with-gettext=/usr \

--with-iconv \

--enable-pdo \

--enable-phar \

--enable-pcntl \

--enable-posix \

--enable-shmop \

--enable-sockets \

--enable-sysvmsg \

--enable-sysvsem \

--enable-sysvshm \

--enable-tokenizer

Make

xmlrpc error 1:

/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:187:2: error: unknown type name 'XMLRPC_SERVER'
  XMLRPC_SERVER server_ptr;
  ^~~~~~~~~~~~~
/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:195:2: error: unknown type name 'STRUCT_XMLRPC_REQUEST_OUTPUT_OPTIONS'
  STRUCT_XMLRPC_REQUEST_OUTPUT_OPTIONS xmlrpc_out;
  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

...
Makefile:1933: recipe for target 'ext/xmlrpc/xmlrpc-epi-php.lo' failed

/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:187:2: error: unknown type name 'XMLRPC_SERVER'

XMLRPC_SERVER server_ptr;

^~~~~~~~~~~~~

/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:195:2: error: unknown type name 'STRUCT_XMLRPC_REQUEST_OUTPUT_OPTIONS'

STRUCT_XMLRPC_REQUEST_OUTPUT_OPTIONS xmlrpc_out;

^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

...

Makefile:1933: recipe for target 'ext/xmlrpc/xmlrpc-epi-php.lo' failed

Open Makefile, add

-I/usr/include/xmlrpc-epi

1	-I/usr/include/xmlrpc-epi

to the line(1933) where the error occured.

xmlrpc error 2:

ext/xmlrpc/.libs/xmlrpc-epi-php.o: In function `destroy_server_data':
/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:268: undefined reference to `XMLRPC_ServerDestroy'
ext/xmlrpc/.libs/xmlrpc-epi-php.o: In function `zm_info_xmlrpc':

...

collect2: error: ld returned 1 exit status
Makefile:296: recipe for target 'sapi/cli/php' failed
make: *** [sapi/cli/php] Error 1

ext/xmlrpc/.libs/xmlrpc-epi-php.o: In function `destroy_server_data':

/usr/src/php-7.2.12/ext/xmlrpc/xmlrpc-epi-php.c:268: undefined reference to `XMLRPC_ServerDestroy'

ext/xmlrpc/.libs/xmlrpc-epi-php.o: In function `zm_info_xmlrpc':

...

collect2: error: ld returned 1 exit status

Makefile:296: recipe for target 'sapi/cli/php' failed

make: *** [sapi/cli/php] Error 1

find

EXTRA_LIBS =

1	EXTRA_LIBS =

in Makefile, add to the end of the line

-lxmlrpc-epi

1	-lxmlrpc-epi

readline error:

sapi/phpdbg/.libs/phpdbg_cmd.o: In function `phpdbg_read_input':
/usr/src/php-7.2.12/sapi/phpdbg/phpdbg_cmd.c:765: undefined reference to `readline'
/usr/src/php-7.2.12/sapi/phpdbg/phpdbg_cmd.c:773: undefined reference to `add_history'
collect2: error: ld returned 1 exit status
Makefile:374: recipe for target 'sapi/phpdbg/phpdbg' failed
make: *** [sapi/phpdbg/phpdbg] Error 1
make: *** Waiting for unfinished jobs....

sapi/phpdbg/.libs/phpdbg_cmd.o: In function `phpdbg_read_input':

/usr/src/php-7.2.12/sapi/phpdbg/phpdbg_cmd.c:765: undefined reference to `readline'

/usr/src/php-7.2.12/sapi/phpdbg/phpdbg_cmd.c:773: undefined reference to `add_history'

collect2: error: ld returned 1 exit status

Makefile:374: recipe for target 'sapi/phpdbg/phpdbg' failed

make: *** [sapi/phpdbg/phpdbg] Error 1

make: *** Waiting for unfinished jobs....

Open Makefile, searc

PHPDBG_EXTRA_LIBS =

1	PHPDBG_EXTRA_LIBS =

add “-lreadline”:

PHPDBG_EXTRA_LIBS = -lreadline

1	PHPDBG_EXTRA_LIBS = -lreadline

PHP HTTP $_(REQUEST|GET|POST)数据不完整(数量不足)问题

有个页面需要给PHP POST大量的数据，最近发现只有固定数量的数据可以保存到数据库，其余的数据提交上去后，完全无反应。

输出原始POST数据，无问题，但输出$_REQUEST，却发现一条记录后面的数据全丢了。

查了下资料，原来PHP有限制$_REQUEST/GET/POST/COOKIE数组的成员数量：http://php.net/manual/en/info.configuration.php#ini.max-input-vars

编辑php.ini，增大max_input_vars的值，重启PHP服务，即可解决。

PHP线程安全与非线程安全版本的本质区别

在百度上搜“PHP 线程安全非线程安全”，你肯定会找到这种话：

感觉这个没解释到点上。

线程和进程最大的根本区别就是内存数据的共享。

每个进程都独享一个虚拟内存[虚拟内存 = 物理内存 + SWAP/页面文件)]。

一个进程可以拥有多个线程，一般来说一个线程仅独享一个进程的虚拟内存中的一个函数栈帧。

程序储存数据有下面几种常用的方式:

自动变量: 自动变量是储存在栈中的，随着函数的调用而产生，结束而销毁。

静态(全局)变量: 静态分配的变量是随着程序的运行产生，程序的结束而销毁，这些变量储存在内存一个专门存放静态变量的区域。

堆: 即通过malloc()申请的内存，一旦申请后，直到调用free()，或程序结束后才释放。

其中造成“非线程安全”的主要是静态变量以及堆。

自动变量仅存在于函数自己的栈中，不管你如何修改其值，均不会影响其他函数(准确来说是线程)的数据。

静态变量独立储存于一个区域，这就意味着一个静态变量由整个进程的所有线程共享，一个线程修改了静态变量的值，将会改变其他线程读对该变量取得的结果，储存于堆的数据亦如此。

所谓“线程安全”，即采取了的措施，避免不同的线程同时对一个内存区域的数据进行修改。

例如某些函数的结果保存于静态分配的变量，或者是保存于堆中的一个区域，可以选择通过加锁，或互斥量来阻塞其他线程对这些函数的调用，但细心的话你也看到了“阻塞”二字，因此最佳的办法就是避免采用这些用到静态分配或堆的函数。

如果你用过PHP的Pthreads模块，并且理解了本文，那你应该明白为何Pthreads模块强制要求使用线程安全版本的PHP。