oci_pconnect with tls problems

Ivanov Sergey

Hi. I try to use persistent connection to database with tls protocol. Also i use nginx and php-fpm.

First 6 connections to db are established. Next connection is broken. This means that i have php warning: oci_parse(): supplied resource is not a valid oci8 connection resource.

For tests I use simple code:

ini_set('error_reporting', E_ALL);ini_set('display_errors', 1);function errorsHandler($errno , $errstr) {    echo "Errno: " . $errno . "\n";    echo "Errstr: " . $errstr . "\n";    die();}set_error_handler('errorsHandler');$conn = oci_pconnect('/', '', 'SECUREDCONNECTION','AL32UTF8',OCI_CRED_EXT);if (!$conn) {  die("Connection problems: " . oci_error());}$stid = oci_parse($conn, 'select * from p2p_accounts where account_number = :account_number');$value = '4080************2622';oci_bind_by_name($stid, ':account_number', $value, -1, SQLT_CHR);oci_execute($stid);echo "<table border='1'>\n";while ($row = oci_fetch_assoc($stid)) {  echo "<tr>\n";  foreach ($row as $k => $v) {    echo "    <td>" . $k . ' = ' . $v . "</td>\n";  }  echo "</tr>\n";}echo "</table>\n";oci_free_statement($stid);

Also if I use oci_connect() function, all works fine. Also if I use oci_pconnect() function without tls protocol all works fine.

I confused where I wrong?

PHP version: 7.0.15

Oracle Run-time Client Library Version 12.2.0.1.0

Oracle Compile-time Instant Client Version 12.2

Env variables are:

env[LD_LIBRARY_PATH] = /usr/lib/oracle/12.2/client64/lib

env[ORACLE_HOME] = /usr/lib/oracle/12.2/client64/

Christopher Jones-Oracle

Define 'broken'?

How is your TLS configured?

Ivanov Sergey

Define 'broken'?

This means that i have php warning "oci_parse(): supplied resource is not a valid oci8 connection resource" on line 17 of code above.

How is your TLS configured?

In folder /usr/lib/oracle/12.2/client64/network/admin/ I have some files:

cwallet.sso, ewallet.p12, sqlnet.ora, tnsnames.ora.

sqlnet.ora:

WALLET_LOCATION =  (SOURCE =    (METHOD = FILE)    (METHOD_DATA =      (DIRECTORY = /usr/lib/oracle/12.1/client64/network/admin)    )  )NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)SQLNET.AUTHENTICATION_SERVICES = (TCPS,NTS,BEQ)SSL_CIPHER_SUITES = (SSL_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA)SSL_VERSION=3.0SSL_SERVER_DN_MATCH=ONDIAG_ADR_ENABLED = OFF

tnsnames.ora:

SECUREDCONNECTION =  (DESCRIPTION =    (ADDRESS_LIST =      (ADDRESS = (PROTOCOL = TCPS)(HOST = XXX.XXX.XXX.XXX)(PORT = 1577))    )    (CONNECT_DATA =      (SERVER = DEDICATED)      (SERVICE_NAME = SECUREDSERVICE)    )    (SECURITY=      (SSL_SERVER_CERT_DN="CN=some_cn,OU=oracle,O=some_domain,L=IT,ST=MU,C=RU")    )  )WALLET_LOCATION =   (SOURCE =     (METHOD = FILE)     (METHOD_DATA =       (DIRECTORY = /usr/lib/oracle/12.1/client64/network/admin)     )   )

Christopher Jones-Oracle

There should be an error at connection or somewhere before the oci_parse() failed.  This call would have been the one that didn't return a valid connection. What ORA message is this failure giving?

Ivanov Sergey

There are no any error before execution oci_parse() function. If you can read PHP code, you can see that code handles all errors including ORA messages, but it doesn't appear!

Another not working code:

ini_set('error_reporting', E_ALL);ini_set('display_errors', 1);function errorsHandler($errno , $errstr) {    echo "Errno: " . $errno . "\n";    echo "Errstr: " . $errstr . "\n";    die();}set_error_handler('errorsHandler');for($i = 0; $i < 10; $i++) {    $conn = oci_pconnect('/', '', 'SECUREDCONNECTION', 'AL32UTF8', OCI_CRED_EXT);    echo print_r($conn, true). PHP_EOL;    if (!$conn) {        die("Connection problems: " . oci_error());    }    $stid = oci_parse($conn, 'select * from p2p_accounts where account_number = :account_number');    $value = '4080************2622';    oci_bind_by_name($stid, ':account_number', $value, -1, SQLT_CHR);    oci_execute($stid);    echo "<table border='1'>\n";    while ($row = oci_fetch_assoc($stid)) {        echo "<tr>\n";        foreach ($row as $k => $v) {            echo "    <td>" . $k . ' = ' . $v . "</td>\n";        }        echo "</tr>\n";    }    echo "</table>\n";    oci_free_statement($stid);    oci_close($conn);}

If I execute code, will receive receive:

Resource id #2<table border='1'><tr>    <td>ACCOUNT_NUMBER = 4080************2622</td>    <td>SOME_ID = VALUE1</td>    <td>NAME = VALUE2</td>    <td>TYPE = VALUE3</td></tr></table>Resource id #2Errno: 2Errstr: oci_parse(): supplied resource is not a valid oci8 connection resource

Thus, SQL is executed once. Also, as you can see, in second loop php prints $conn as a resource, but it is invalid resource just because then error appeared.

In addition, persistent connection is established over tls protocol.

If use oci_pconnect() without tls - it works, if use oci_connect() with tls - it works. Something wrong happen when use oci_pconnect() over tls protocol and php-fpm.

Christopher Jones-Oracle

Can you give me full DB & client info (platforms, versions)?  Your net configuration would help.  You can email me directly if you want, see my profile for the address. I'll ask around if anyone has thoughts.

Another quick check might be to try PHP 5.6.

Ivanov Sergey

Code above works in php5.6.22 in same restrictions. Something wrong in oci8 php wrapper of driver for php7.

In php7 each request to page creates new session in db, and php-fpm child process holds this connection. Next request creates new session and it stores in another php-fpm child process. It continues until reached php-fpm max_children param, then error occurs.

In php5.6 each request uses one session. All works correct

Christopher Jones-Oracle

Are you testing on the same machine with exactly the same Oracle client libraries - please triple check?

Ivanov Sergey

Tests were run with the same code in identical virtual machines with identical params, configs, instant client version etc. Difference in php version. One - php5.6.22, another - php7.1.3.

As I said before, something wrong with oci8 wrapper of driver for php7.

Can you reproduce this situation?

Christopher Jones-Oracle

The config info I asked for before would be helpful.

Ivanov Sergey

cj написал(а):The config info I asked for before would be helpful.

What does you mean? php.ini? php-fpm config? nginx config?)

Also I cannot find email in your profile to provide more detailed info.