Bug 591288

Summary:	www-servers/apache-2.4.23 using php-fpm: AH01067: Failed to read FastCGI header
Product:	Gentoo Linux	Reporter:	Nathan M <nmalinoski>
Component:	Current packages	Assignee:	Lars Wendler (Polynomial-C) (RETIRED) <polynomial-c>
Status:	RESOLVED TEST-REQUEST
Severity:	major	CC:	leho
Priority:	Normal
Version:	unspecified
Hardware:	AMD64
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---
Attachments:	/etc/apache2/modules.d/71_php-fpm.conf emerge --info emerge -pqv www-servers/apache

Description Nathan M 2016-08-15 02:06:03 UTC

Created attachment 443332 [details]
/etc/apache2/modules.d/71_php-fpm.conf

With apache-2.4.20 and php-5.6.24, my php-fpm setup works fine (See attached configs).

However, when I upgrade apache to 2.4.23 (latest stable at time of writing), only root-level pages are able to load. If I try to access any PHP content that has a URI, I get 503 error pages from Apache or just the text "File not found.".

I also see these types of errors in the vhost log:
[proxy_fcgi:error] [client <snip>] AH01067: Failed to read FastCGI header, referer: <snip>
[proxy_fcgi:error] (104)Connection reset by peer: [client <snip>] AH01075: Error dispatching request to : , referer: <snip>
[proxy_fcgi:error] [client <snip>] AH01071: Got error 'Primary script unknown\n', referer: <snip>
[proxy_fcgi:error] (32)Broken pipe: [client <snip>] AH01075: Error dispatching request to : (sending empty stdin), referer: <snip>


My workaround was reverting apache to 2.4.20.

Possibly related is bug #588138, in which 2.4.23 was stabilized to address a security issue with HTTP/2.

Comment 1 Nathan M 2016-08-15 02:07:22 UTC

Comment on attachment 443332 [details]
/etc/apache2/modules.d/71_php-fpm.conf

My Apache configuration for use of php-fpm for all vhosts; goes in /etc/apache2/modules.d and is enabled by adding '-D PHP5FPM' to APACHE2_OPTS.
(Moved text from Description field to comment.)

Comment 2 Nathan M 2016-08-15 02:07:57 UTC

Created attachment 443334 [details]
emerge --info

Comment 3 Nathan M 2016-08-15 02:08:20 UTC

Created attachment 443336 [details]
emerge -pqv www-servers/apache

Comment 4 Nathan M 2016-08-16 15:54:42 UTC

I was able to replicate this behavior with a new gentoo amd64 VM; works with Apache 2.4.20; fails with 2.4.23.

I am also experiencing the same error messages on sparc with Apache 2.4.20/2.4.23 and PHP 5.6.23/5.6.24 with the same configuration from my amd64 VMs; but, in this case, not even the root page will load. I'm not sure if this is a different issue.

2.4.23-r1 does not resolve the issue.

Comment 5 Nathan M 2016-08-16 19:12:25 UTC

php-fpm also does not work on sparc with Apache 2.4.16 or 2.4.12-r1; I'm not sure I want to revert further.

Comment 6 Nathan M 2016-09-30 13:03:57 UTC

So apache-2.4.20 has recently been removed from Portage, leaving me without a version of 2.4.x that can properly proxy to php-fpm. :(

Comment 7 Nathan M 2016-09-30 15:46:11 UTC

This bug appears to have been reported upstream: https://bz.apache.org/bugzilla/show_bug.cgi?id=59815

Comment 8 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev

2016-11-02 14:41:00 UTC

commit 692a27baa1b889755b928d2766f9efee17462291
Author: Lars Wendler <polynomial-c@gentoo.org>
Date:   Wed Nov 2 15:38:57 2016

    www-servers/apache: Security revbumps for CVE-2016-5387 (bug #589226).

    Also fixes fcgi bug in apache-2.4.23 (bug #591288).

    Package-Manager: portage-2.3.2
    Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>


Should be fixed in =www-servers/apache-2.4.23-r2
Can you please test that version and report back your results?

Comment 9 Nathan M 2016-11-05 01:17:30 UTC

Lars,

Thank you, but unfortunately, out of the box, 2.4.23-r2 does not change the behavior I'm experiencing.

I've narrowed down my pain point to rewrites for a CodeIgniter application in the document root of a vhost. (I'm not sure if it affects these types of rewrites in subdirectories.) The behavior only appears when I try to navigate to any URL that would get rewritten as parameters for index.php--the root page loads just fine.

These are the rewrites I was using with 2.4.20 with no issues:

<IfModule mod_rewrite.c>
        RewriteEngine On
        RewriteCond %{REQUEST_FILENAME} !index.php
        RewriteCond %{REQUEST_FILENAME} !-f
        RewriteCond %{REQUEST_FILENAME} !-d
        RewriteRule .* index.php/$0 [PT,L]
</IfModule>


As a not-ideal workaround, I can disable these rewrites and replace them with the following, which appears to let my application function again:

FallbackResource /index.php