No method to close curl_share_init_persistent()

[kkmuffme]

Description

There's no method to close/end curl_share_init_persistent(), which means DNS expiration has to be awaited and all open connections are retried (and closed) unnecessarily even when one already knows (and could directly close them) - the only fix is to restart php-fpm?

PHP Version

PHP 8.5

Operating System

No response

[kkmuffme]

I didn't test it, but I assume that calling

curl_setopt( $curl_handle, CURLOPT_DNS_CACHE_TIMEOUT, -1 );

will mean there's no way to change the persistent DNS at all, bc:

https://curl.se/libcurl/c/CURLOPT_DNS_CACHE_TIMEOUT.html

DNS entries have a "TTL" property but libcurl does not use that.

[ericnorris]

There is no method to close a persistent share handle, by design. My understanding is that PHP has been moving more towards "making invalid states unrepresentable", and thus if you have a persistent share handle object, it is guaranteed to be valid.

There's a related discussion about closing PDO objects: https://externals.io/message/128741.

Could you explain a bit more context about your problem? Are you referring to DNS TTLs? I'm not surprised that you'd have to wait for them, and one answer would be to ensure your DNS TTLs are set to a value you're comfortable with - caching DNS resolvers will also cache entries for the length of the TTL, so this problem goes beyond just persistent curl share handles.

[kkmuffme]

Could you explain a bit more context about your problem?

What is unclear? It seems you didn't read it at all, bc you wrote:

ensure your DNS TTLs are set to a value you're comfortable with - caching DNS resolvers will also cache entries for the length of the TTL

but I already wrote before:

DNS entries have a "TTL" property but libcurl does not use that.

[iluuu1994]

@ericnorris Can you clarify whether there's something you need to progress with this issue? @kkmuffme As you know, a concise example that demonstrates the problem would be useful.

[kkmuffme]

taking the example from php-doc with a slight alteration:

<?php

// Create or retrieve a persistent cURL share handle set to share DNS lookups and connections
$sh = curl_share_init_persistent([CURL_LOCK_DATA_DNS, CURL_LOCK_DATA_CONNECT]);

// Initialize the first cURL handle and assign the share handle to it
$ch1 = curl_init("https://example.com/");
curl_setopt( $curl_handle, CURLOPT_DNS_CACHE_TIMEOUT, 3600 );

curl_setopt($ch1, CURLOPT_SHARE, $sh);

// Execute the first cURL handle. This may reuse the connection from an earlier SAPI request
curl_exec($ch1);

Run this multiple times, and change the DNS of example.com after the first request to a different IP. It will (should) still request the old IP for the next hour.
If you use -1 instead of 3600, you will forever be using the old IP and there's nothing you can do except restart php-fpm (if persistent indeed is persistent)

[ndossche]

One solution that avoids creating invalid states is to provide a "reset" instead of "close" operation.

[kkmuffme]

...and it's already being exploited it seems, maybe convert this ticket to private/security issue? While by itself it's harmless, it just makes exfiltrating/collecting data a lot easier for an attacker

[arnaud-lb]

One solution that avoids creating invalid states is to provide a "reset" instead of "close" operation.

Another would be to provide an "unlink" that makes the shared handle invisible from future curl_share_init_persistent() calls. This ensures that curl_share_init_persistent() returns a fresh handle, while not changing the state of the previous one.