Bug#780123: apache2.2-common: TimeOut used inconsistently with CGI scripts
Package: apache2.2-common
Version: 2.2.22-13+deb7u4
Severity: normal
Apache does not always follow the 'TimeOut' directive, but will
sometimes allow up to twice as long for a CGI script to run.
I configured Apache to use php5-cgi using mod_actions to serve .php
through /usr/bin/php-cgi, and created the following PHP code:
<?php
sleep(15);
print("OK");
?>
Under the default Timeout setting of 300 this script will wait for 15
seconds and then send the proper headers (200 OK, Content_Type:
text/html, etc) and display the text "OK".
However, if I change the Timeout to 10 seconds, the CGI script will run
for 10 seconds, and Apache logs the following lines to the error_log:
[Fri Mar 06 09:56:10 2015] [warn] [client 37.74.xx.xx] Timeout waiting
for output from CGI script /usr/bin/php-cgi
[Fri Mar 06 09:56:10 2015] [error] [client 37.74.xx.xx] Script timed out
before returning headers: php-cgi
However, Apache doesn't send any headers to the client yet, and the CGI
script is left running normal. After another 5 seconds the script will
end, send its headers and output to Apache(I can see this when
strace-ing the running php-cgi process). Apache will then discard these
and send a '504 Gateway Time-out' status with the configured 504 errorpage.
If I change the Timeout to 5 seconds, the CGI script will run for 5
seconds, and Apache logs the following 2 lines again.
[Fri Mar 06 09:57:05 2015] [warn] [client 37.74.xx.xx] Timeout waiting
for output from CGI script /usr/bin/php-cgi
[Fri Mar 06 09:57:05 2015] [error] [client 37.74.xx.xx] Script timed out
before returning headers: php-cgi
Again, no headers are send, and the process is left running. After
another 5 seconds the php-cgi binary will be Terminated (SIGTERM) and
apache logs the following:
[Fri Mar 06 09:57:10 2015] [warn] [client 37.74.xx.xx] Timeout waiting
for output from CGI script /usr/bin/php-cgi
Apache will then send a '504 Gateway Time-out' status with the
configured 504 errorpage.
Versions of PHP used:
ii php5 5.4.36-0+deb7u1 all
server-side, HTML-embedded scripting language (metapackage)
ii php5-cgi 5.4.36-0+deb7u3
amd64 server-side, HTML-embedded scripting language (CGI binary)
-- Package-specific info:
List of /etc/apache2/mods-enabled/*.load:
actions alias auth_basic authn_file authz_default authz_groupfile
authz_host authz_user autoindex cgi deflate dir env headers mime
negotiation reqtimeout rewrite setenvif ssl status
-- System Information:
Debian Release: 7.8
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.32-5-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Versions of packages apache2.2-common depends on:
ii apache2-utils 2.2.22-13+deb7u4
ii apache2.2-bin 2.2.22-13+deb7u4
ii lsb-base 4.1+Debian8+deb7u1
ii mime-support 3.52-1+deb7u1
ii perl 5.14.2-21+deb7u2
ii procps 1:3.3.3-3
Versions of packages apache2.2-common recommends:
ii ssl-cert 1.0.32
Versions of packages apache2.2-common suggests:
pn apache2-doc <none>
pn apache2-suexec | apache2-suexec-custom <none>
ii links [www-browser] 2.7-1+deb7u1
ii lynx-cur [www-browser] 2.8.8dev.12-2
ii w3m [www-browser] 0.5.3-8
Versions of packages apache2.2-common is related to:
pn apache2-mpm-event <none>
pn apache2-mpm-itk <none>
ii apache2-mpm-prefork 2.2.22-13+deb7u4
pn apache2-mpm-worker <none>
-- Configuration Files:
/etc/apache2/mods-available/actions.conf changed:
ScriptAlias /local-bin /usr/bin
AddHandler application/x-httpd-php5 php
Action application/x-httpd-php5 /local-bin/php-cgi
-- no debconf information
Reply to: