Manager::selectServer(): SSL/TLS already set-up for this stream

[a-carvallo]

Hi,

I'm having in issue when connecting to a replicaSet of 3 servers with SSL and authentication with the following :

$uriOptions = [];
$uriOptions["readPreference"] = \MongoDB\Driver\ReadPreference::RP_NEAREST;
$uriOptions['ssl'] = true;
$uriOptions["replicaSet"] = "plop";
$uriOptions['username'] = "not actual username";
$uriOptions['password'] = "not actual password";

$context = stream_context_create(array(
    "ssl" => array(
        "cafile"            => "/etc/ssl/certs/SSLCertificateChainFile.crt",
        "allow_self_signed" => false,
        "verify_peer"       => false,
        "verify_expiry"     => false
    )
));
error_log("context OK");

$client = new \MongoDB\Client("mongodb://db1.myhost.com:27017,db2.myhost.com:27017,db3.myhost.com:27017", $uriOptions, ['context' => $context]);
error_log("client OK");

$db = $client->selectDatabase("myDB");
error_log("selectDB OK");

$db->command(['ping' => 1]);
error_log("ping OK");

The issue happens when calling that code twice, with a small interval between.
(If I do it 10 times in a row for example, it's going to work for tries 1,3,5,7,9 and fail for the others)

Result for 2 calls :

context OK
client OK
selectDB OK
ping OK

context OK
client OK
selectDB OK
MongoDB\Driver\Exception\SSLConnectionException: MongoDB\Driver\Manager::selectServer(): SSL/TLS already set-up for this stream in /var/www/BackEnd/vendor/mongodb/mongodb/src/Database.php:158
Stack trace:
#0 /var/www/BackEnd/vendor/mongodb/mongodb/src/Database.php(158): MongoDB\Driver\Manager->selectServer(Object(MongoDB\Driver\ReadPreference))
#1 /var/www/BackEnd/app/models/base.php(72): MongoDB\Database->command(Array)

So it happens in MongoDB\Driver\Manager::selectServer() when querying the db (command, count, find...).

Config:

Ubuntu 14.04.3 LTS
Apache/2.4.7
PHP 7.0.6-13+donate.sury.org~trusty+1
mongodb version => 1.1.6
libmongoc version => 1.3.5
libbson version => 1.3.5
mongo-php-library 1.0.2

Tell me if you need extra info and thanks by advance.

[moderndeveloperllc]

One I see is that you are using $uriOptions["connect"] = true;. I don't believe that is a valid option in the connect options anymore. It may be being ignored regardless (the MongoDB guys could say for sure).

I don't think you are listing your MongoDB version amongst your other info - they will want that.

[a-carvallo]

Thanks for the comment, I removed the connect option, still have the same results.

And indeed I forgot to mention the MongoDB version, it is : v3.0.7.

[moderndeveloperllc]

There are a few things you might try so that they can narrow down the issue:

1. Remove $uriOptions['ssl'] = true; to verify that this is actually an SSL issue.
2. Keep $uriOptions['ssl'] = true;, but pass no $context.

Also, how fast are you calling the "even" numbered calls? Is the "small interval between" less than a second, or a few seconds?

[a-carvallo]

So I just switched to MongoDB v3.2.6 and behaviour is still the same for my first example.

• If I remove $uriOptions['ssl'] = true; I get on the MongoDB server :

AssertionException handling request, closing client connection: 17189 The server is configured to only allow SSL connections

And on the client :

MongoDB\Driver\Exception\ConnectionTimeoutException: No suitable servers found (`serverselectiontryonce` set): [connection timeout calling ismaster on 'db1.myhost.com:27017'] [connection timeout calling ismaster on 'db2.myhost.com:27017'] [connection timeout calling ismaster on 'db3.myhost.com:27017'] in /var/www/BackEnd/vendor/mongodb/mongodb/src/Database.php:158
Stack trace:
#0 /var/www/BackEnd/vendor/mongodb/mongodb/src/Database.php(158): MongoDB\Driver\Manager->selectServer(Object(MongoDB\Driver\ReadPreference))
#1 /var/www/BackEnd/app/models/base.php(76): MongoDB\Database->command(Array)

• Then if I keep $uriOptions['ssl'] = true; but pass no $context it's the same result as my first comment, it's going to work like half the time.

As for the interval, it's between 0s to like 2s, if I wait enough the next call is going to work.

If SSL is not enforced on server, it will work with $uriOptions['ssl'] = false; and no $context.

[bjori]

As an awful workaround, can you try restarting your webserver?
It sounds like the connection manager didn't realize you change the connection options

[a-carvallo]

Server is running in a docker container, and has already been restarted, the new options are being used.

[jmikola]

@alex-cc: Can you confirm if this issue is still affecting you? I'm a bit confused by "new options are being used".

The issue happens when calling that code twice, with a small interval between. (If I do it 10 times in a row for example, it's going to work for tries 1,3,5,7,9 and fail for the others)

Based on that line and the ensuing output paste, am I correct in assuming that you're running the script in the same PHP process and each try if a loop iteration?

If you're running in a web SAPI where each try is its own web request, how many worker processes are there? Would it be possible to reproduce and funnel everything through a single process (e.g. using the built-in web server)?

Would it be possible to get some debug logs for the minimum viable reproduction? I think this would be two tries, where the first succeeds and the second fails. The debug log should show us how streams are being utilized internally.

---

Cross-referencing this with PHPC-415, which is long since fixed but involved a similar exception due to unnecessary SSL initialization on an existing stream.

[jmikola]

Tracking in PHPC-706.

[a-carvallo]

@jmikola Thanks for the answer and suggestions.

The "new options are being used" was for answering @bjori, meaning if I change options they are immediately used, so the issue wasn't here.

For the whole same process/SAPI thing, yes php is called by apache, and you were right about the "two tries", I now try with the following code (2 tries in a row) and have the same result.

$uriOptions = [];
$uriOptions["readPreference"] = \MongoDB\Driver\ReadPreference::RP_NEAREST;
$uriOptions['ssl'] = true;
$uriOptions["replicaSet"] = "plop";
$uriOptions['username'] = "not actual username";
$uriOptions['password'] = "not actual password";

 try {
    $client = new \MongoDB\Client("mongodb://db1.myhost.com:27017,db2.myhost.com:27017,db3.myhost.com:27017", $uriOptions);
    error_log("client OK");

    $db = $client->selectDatabase("myDB");
    error_log("selectDB OK");

    $db->command(['ping' => 1]);
    error_log("ping OK");

} catch (Exception $e) {
    error_log($e->getMessage());
}

$uriOptions = [];
$uriOptions["readPreference"] = \MongoDB\Driver\ReadPreference::RP_NEAREST;
$uriOptions['ssl'] = true;
$uriOptions["replicaSet"] = "plop";
$uriOptions['username'] = "not actual username";
$uriOptions['password'] = "not actual password";

  try {
    $client = new \MongoDB\Client("mongodb://db1.myhost.com:27017,db2.myhost.com:27017,db3.myhost.com:27017", $uriOptions);
    error_log("client OK");

    $db = $client->selectDatabase("myDB");
    error_log("selectDB OK");

    $db->command(['ping' => 1]);
    error_log("ping OK");

} catch (Exception $e) {
    error_log($e->getMessage());
}

So when calling it, I have the following log:
https://gist.github.com/alex-cc/37df700e865e1a6685e832086c6577f5

Again, tell me if I can provide any more details :)

[jmikola]

Thanks for the clarification. Another user (@lornajane) appears to have encountered this same bug a few days ago. I believe we have enough information to reproduce this, so I'll investigate when I get a chance.

Note that for 1.2.0 we are planning to drop PHP's streams API for libmongoc's socket handling (PHPC-605). To that end, we may decide to forego fixing this in 1.1.x and focus on fully addressing it in 1.2.0. We can leave this issue open until the matter is finally resolved, though.

[lornajane]

Yes this is exactly what I encountered - one call works, the next one doesn't, with the same error as above about SSL already being set up for this stream. Restarting the server (I'm using php -S as I was prototyping something) does help but is a bit of a pain ...

[habiem]

@jmikola Is there a workaround for this? I am experiencing the same issue and it's currently a show-stopper. In my case, the calls can be on subsequent page loads. For example, on one page load, an executeBulkWrite() works fine, but on the next page load, that same statement fails with:

MongoDB\Driver\Manager::executeBulkWrite(): SSL/TLS already set-up for this stream

Thanks!

[Infthitbox]

So I've run into this as well in that week or so, and it is a complete showstopper for me as well. I followed the instructions for installing from source, and noodled around until I found a workaround for the time being.

The problem stems from re-using persistent cached streams and then reconfiguring them for SSL. The function that sets up crypto for a php stream errors out if it has already been set up for that stream. I tried to insert some logic to test if a stream was in fact being reused or was created new, but couldn't figure it out. I tried to see if a stream already had ssl configured, but my naive method of trying to figure this out led to certificate name mismatches in a replica set environment.

I am not an expert, don't do this without first trying it extensively in a non-production environment

So, I simply made it so it no longer attempts to use a cached stream. I have no idea if this is safe, or how much effect it can have on performance. My fork ( https://github.com/Infthitbox/mongo-php-driver ) contains the hack in the v1.1 branch. If you want to use it, follow the instructions to build the driver from source, replacing the provided repository URL with my fork. You will also need to run a git checkout v1.1 before the git submodule sync command.

[bashofmann]

We are running into the same issue when trying to activate SSL