微信公众号搜"智元新知"关注
微信扫一扫可直接关注哦！

PHP：狂饮6-cURL错误7连接被拒绝

分类：Nginx作者：编程之家

我进行了搜索,并阅读了http://docs.guzzlephp.org/en/stable/request-options.html处的文档,并确认了https://curl.haxx.se/libcurl/c/libcurl-errors.html处的错误,并且对我而言,我无法弄清楚发生了什么.我的/ etc / hosts文件中有app-one和app-two的URL,我知道它们是正确的,因为我可以在浏览器中通过终端通过cURL来访问它们.

我的设置：

Docker容器配置为：

App 1 = PHP-fpm - responding app
App 2 = PHP-fpm - requesting app,using Guzzle 6.3.2
Nginx Reverse Proxy

Nginx配置：

应用程式1：

upstream PHP-app-one {
    server PHP-app-one:9000;
}

server {
    listen 80;
    listen [::]:80;
    server_name app-one.local;
    return 301 https://$server_name$request_uri;
}

server {
    # SSL configuration
    listen 443 ssl;
    listen [::]:443 ssl;

    ssl on;
    ssl_certificate /etc/Nginx/certs/app-one.crt;
    ssl_certificate_key /etc/Nginx/certs/app-one.key;
    ssl_dhparam /etc/Nginx/certs/dhparam.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3,ref: POODLE
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    server_name app-one.local;

    root /var/www/app-one;
    index index.PHP index.html;

    gzip_types text/plain text/css application/json application/x-javascript
               text/xml application/xml application/xml+RSS text/javascript;

    # Add headers to serve security related headers
    #
    # disable preloading HSTS for Now.  You can use the commented out header line that includes
    # the "preload" directive if you understand the implications.
    # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
    add_header x-frame-options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header Pragma "no-cache";
    add_header Cache-Control "no-cache";
    add_header X-uri "$uri";

    location ~* \.(eot|otf|ttf|woff|woff2)${
            add_header Access-Control-Allow-Origin *;
    }

    location / {
            proxy_read_timeout    90;
            proxy_connect_timeout 90;
            proxy_redirect        off;

            proxy_set_header      X-Real-IP $remote_addr;
            proxy_set_header      X-Scheme $scheme;
            proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header      X-Forwarded-Proto $scheme;
            proxy_set_header      X-Forwarded-Host $server_name;
            proxy_set_header      Host $host;
            proxy_set_header      X-Forwarded-Port 443;
            proxy_set_header      Authorization $http_authorization;
            proxy_pass_header     Authorization;

            try_files $uri $uri/ /index.PHP?$args;
    }

    # Pass all .PHP files onto a PHP-fpm/PHP-fcgi server.
    location ~ [^/]\.PHP(/|$) {
            add_header X-debug-message "A PHP file was used" always;
            # regex to split $uri to $fastcgi_script_name and $fastcgi_path
            fastcgi_split_path_info ^(.+?\.PHP)(/.*)$;
            # This is a robust solution for path info security issue and 
            # works with "cgi.fix_pathinfo = 1" in /etc/PHP.ini (default)
            # if (!-f $document_root$fastcgi_script_name) {
            #         return 404;
            # }
            # Check that the PHP script exists before passing it
            # try_files $fastcgi_script_name =404;
            # Bypass the fact that try_files resets $fastcgi_path_info
            # see: http://trac.Nginx.org/Nginx/ticket/321
            set $path_info $fastcgi_path_info;
            fastcgi_param PATH_INFO $path_info;
            fastcgi_intercept_errors on;
            fastcgi_pass PHP-app-one;
            fastcgi_index index.PHP;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)${
            add_header X-debug-message "A static file was served" always;
            expires max;
            # log_not_found off;
    }

    location ~ /\. {
            deny all;
    }
}

应用程式2：

upstream PHP-app-two {
    server PHP-app-two:9000;
}

server {
    listen 80;
    listen [::]:80;
    server_name app-two.local;
    return 301 https://$server_name$request_uri;
}

server {
    # SSL configuration
    listen 443 ssl;
    listen [::]:443 ssl;

    ssl_certificate /etc/Nginx/certs/app-two.crt;
    ssl_certificate_key /etc/Nginx/certs/app-two.key;
    ssl_dhparam /etc/Nginx/certs/dhparam.pem;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
    ssl_ecdh_curve secp384r1;
    ssl_session_cache shared:SSL:10m;
    ssl_session_tickets off;
    resolver 8.8.8.8 8.8.4.4 valid=300s;
    resolver_timeout 5s;

    server_name app-two.local;

    root /var/www/app-two;
    index index.PHP index.html;

    gzip_types text/plain text/css application/json application/x-javascript
               text/xml application/xml application/xml+RSS text/javascript;


    # Add headers to serve security related headers
    #
    # disable preloading HSTS for Now.  You can use the commented out header line that includes
    # the "preload" directive if you understand the implications.
    # add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;";
    add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
    add_header x-frame-options DENY;
    add_header X-Content-Type-Options nosniff;
    add_header X-XSS-Protection "1; mode=block";
    add_header X-Robots-Tag none;
    add_header Pragma "no-cache";
    add_header Cache-Control "no-cache";
    add_header X-uri "$uri";

    location ~* \.(eot|otf|ttf|woff|woff2)${
            add_header Access-Control-Allow-Origin *;
    }

    location / {
            proxy_read_timeout    90;
            proxy_connect_timeout 90;
            proxy_redirect        off;

            proxy_set_header      X-Real-IP $remote_addr;
            proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header      X-Forwarded-Host $server_name;
            proxy_set_header      Host $host;
            proxy_set_header      X-Forwarded-Proto $scheme;
            proxy_set_header      X-Forwarded-Port 443;
            proxy_set_header      Authorization $http_authorization;
            proxy_pass_header     Authorization;

            try_files $uri $uri/ /index.PHP;
    }

    # Pass all .PHP files onto a PHP-fpm/PHP-fcgi server.
    location ~ [^/]\.PHP(/|$) {
            add_header X-debug-message "A PHP file was used" always;
            # add_header Location "$uri" always;
            # regex to split $uri to $fastcgi_script_name and $fastcgi_path
            fastcgi_split_path_info ^(.+?\.PHP)(/.*)$;
            # This is a robust solution for path info security issue and 
            # works with "cgi.fix_pathinfo = 1" in /etc/PHP.ini (default)
            if (!-f $document_root$fastcgi_script_name) {
                    return 404;
            }
            # Check that the PHP script exists before passing it
            try_files $fastcgi_script_name =404;
            # Bypass the fact that try_files resets $fastcgi_path_info
            # see: http://trac.Nginx.org/Nginx/ticket/321
            set $path_info $fastcgi_path_info;
            fastcgi_param PATH_INFO $path_info;
            fastcgi_intercept_errors on;
            fastcgi_pass PHP-app-two;
            fastcgi_index index.PHP;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)${
            expires max;
            log_not_found off;
    }
}

Nginx反向代理：

worker_processes 1;

daemon off;

events {
    worker_connections 1024;
}

error_log   /var/log/Nginx/error.log warn;
pid         /var/run/Nginx.pid;

http {
    default_type application/octet-stream;
    include /etc/Nginx/conf/mime.types;

    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
    '$status $body_bytes_sent "$http_referer" '
    '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/Nginx/access.log main;

    sendfile on;

    keepalive_timeout 65;

    gzip on;
    gzip_disable "msie6";

    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_http_version 1.1;
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+RSS text/javascript;
    application/x-font-ttf ttc ttf;
    application/x-font-otf otf;
    application/font-woff woff;
    application/font-woff2 woff2;
    application/vnd.ms-fontobject eot;

    include /etc/Nginx/conf.d/*.conf;
}

docker-compose.yml：

version: '3.3'
services:
  # configured to act as a proxy for wp and member portal
  Nginx:
    image: evild/alpine-Nginx:1.9.15-openssl
    container_name: Nginx
    # volumes offer persistent storage
    volumes:
      - ./app_one:/var/www/app_one/:ro
      - ./app_two:/var/www/app_two/:ro
      - ./Nginx/conf/Nginx.conf:/etc/Nginx/conf/default.conf:ro
      - ./Nginx/conf.d:/etc/Nginx/conf.d:ro
      - ./certs:/etc/Nginx/certs
    # ports to bind to
    ports:
      - 80:80
      - 443:443
    # allows service to be accessible by other docker containers
    expose:
      - "80"
      - "443"
    depends_on:
      - PHP-app_one
      - PHP-app_two
    environment: 
      TZ: "America/Los_Angeles"


  # app-two PHP container
  PHP-app_two:
    environment: 
      TZ: "America/Los_Angeles"
    image: joebubna/PHP
    container_name: app_two_PHP
    restart: always
    volumes:
      - ./app_two:/var/www/app_two
    ports:
      - 9000:9000

   PHP-app_one:
     environment: 
       TZ: "America/Los_Angeles"
     image: joebubna/PHP
     container_name: app_one_PHP
     restart: always
     volumes:
       - ./app-one:/var/www/app-one
     ports:
       - 9001:9000

  db:
    image: MysqL:5.6
    container_name: app_two_MysqL
    volumes:
      - db-data:/var/lib/MysqL
      - ./MysqL/my.cnf:/etc/MysqL/conf.d/ZZ-app-one.cnf:ro
    environment:
      MysqL_ROOT_PASSWORD: root
      MysqL_USER: user
      MysqL_PASSWORD: password
      MysqL_DATABASE: cora
      TZ: "America/Los_Angeles"
    ports:
      - 3306:3306
    expose:
      - "3306"

    volumes:
      db-data:

应用程序1和应用程序2已启用具有自签名证书的SSL,该证书是在docker-compose创建时导入的.

App 1有多个API端点App 2需要访问.当我尝试通过Guzzle访问时,我收到：

Fatal error: Uncaught GuzzleHttp\Exception\ConnectException: cURL error 7: Failed to connect to app-one.local port 443: Connection refused (see http://curl.haxx.se/libcurl/c/libcurl-errors.html) in /var/www/app/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.PHP on line 185

GuzzleHttp\Exception\ConnectException: cURL error 7: Failed to connect to app-one.local port 443: Connection refused (see http://curl.haxx.se/libcurl/c/libcurl-errors.html) in /var/www/app/vendor/guzzlehttp/guzzle/src/Handler/CurlFactory.PHP on line 185

Call Stack:
0.0026     366656   1. {main}() /var/www/app/index.PHP:0
0.2229    3355944   2. Cora\Route->routeProcess() /var/www/app/index.PHP:45
0.2230    3357208   3. Cora\Route->routeFind() /var/www/app/vendor/cora/cora-framework/system/classes/Route.PHP:89
0.2240    3357912   4. Cora\Route->routeFind() /var/www/app/vendor/cora/cora-framework/system/classes/Route.PHP:474
0.2245    3358576   5. Cora\Route->getController() /var/www/app/vendor/cora/cora-framework/system/classes/Route.PHP:441
0.2364    3477872   6. Controllers\Api\Dashboard->__construct() /var/www/app/vendor/cora/cora-framework/system/classes/Route.PHP:501
0.2984    4086336   7. GuzzleHttp\Client->get() /var/www/app/controllers/api/controller.Dashboard.PHP:36
0.2984    4086712   8. GuzzleHttp\Client->__call() /var/www/app/controllers/api/controller.Dashboard.PHP:36
0.2984    4086712   9. GuzzleHttp\Client->request() /var/www/app/vendor/guzzlehttp/guzzle/src/Client.PHP:89
0.3521    4321000  10. GuzzleHttp\Promise\RejectedPromise->wait() /var/www/app/vendor/guzzlehttp/guzzle/src/Client.PHP:131

这是我当前实现客户端的方式(包括为解决此问题而添加的一些代码)：

<?PHP
namespace Controllers\Api;

use \GuzzleHttp\Client;
// use \GuzzleHttp\Psr7\Uri;

define('URL','https://app-one.local/api/');

class Dashboard extends ApiController 
{
    private $http;

    public function __construct($container)
    {
        // We're using guzzle for our requests to help keep opportunity
        // for cURL errors to a minimum
        $this->http = new Client([
            'base_uri'          => URL,'timeout'           => 30.0,'allow_redirects'   => true,'verify'            => false,'curl'              => [
                 CURLOPT_VERIFYPEER => false
            ],'headers'           => [
                'User-Agent'        => 'curl/7.38.0',],]);

        $response = $this->http->get('member/sales/hasalestest');
        var_dump($response);
        exit;
    }
}

正如我提到的,我可以很好地通过浏览器访问此端点,并且可以在终端中使用cURL直接访问它,只要我将-k标志用于“不安全”即可.我不确定我还能做些什么,因为Guzzle的文档对5和6之间的语法差异还不太清楚.然后Drupal和Laravel人群往往会遇到不相关的问题.

这样的SO帖子看起来很相似(减去了硬编码的端口号和Guzzle v.5),但没有提及我没有尝试过的任何内容：PHP Guzzle 5: Cannot handle URL with PORT number in it.

这个问题也很有趣,但是基于与应用程序1交互的其他应用程序,它的确允许其他应用程序使用某些API端点：cURL error 7: Failed to connect to maps.googleapis.com port 443

在这一点上,我能想到的只是Nginx配置问题？我需要朝着正确的方向前进,并获得需要消耗的其余端点.

感谢您的指导！

最佳答案
事实证明,这是一个相对简单的解决方案.问题是两个fpm容器彼此不认识,并且通过在app-two的请求中引用app-one.local,app-two基本上将请求发送到了void中.修复方法如下：

version: '3.3'
services:
  Nginx:
    image: evild/alpine-Nginx:1.9.15-openssl
    container_name: Nginx
    volumes:
      - ./app-one:/var/www/app-one/:ro
      - ./app-two:/var/www/app-two/:ro
      - ./Nginx/conf/Nginx.conf:/etc/Nginx/conf/default.conf:ro
      - ./Nginx/conf.d:/etc/Nginx/conf.d:ro
      - ./certs:/etc/Nginx/certs
    ports:
      - 80:80
      - 443:443
    expose:
      - "80"
      - "443"
    depends_on:
      - app-one
      - app-two
    environment: 
      TZ: "America/Los_Angeles"
    # This is the fix
    networks:
      default:
        aliases:
          - app-one.local
          - app-two.local

  app-one:
    environment: 
      TZ: "America/Los_Angeles"
    image: joebubna/PHP
    container_name: app-one
    restart: always
    volumes:
      - ./app-one:/var/www/app-one
    ports:
      - 9000:9000
    # This is the fix
    networks:
      - default

  app-two:
    environment: 
      TZ: "America/Los_Angeles"
    image: joebubna/PHP
    container_name: app-two
    restart: always
    volumes:
      - ./app-two:/var/www/app-two
    ports:
      - 9001:9000
    # This is the fix
    networks:
      - default

  db:
    image: MysqL:5.6
    container_name: MysqL
    volumes:
      - db-data:/var/lib/MysqL
      - ./MysqL/my.cnf:/etc/MysqL/conf.d/ZZ-MysqL.cnf:ro
    environment:
      MysqL_ROOT_PASSWORD: root
      MysqL_USER: user
      MysqL_PASSWORD: password
      MysqL_DATABASE: cora
      TZ: "America/Los_Angeles"
    ports:
      - 3306:3306
    expose:
      - "3306"
    # This is the fix
    networks:
      - default

volumes:
  db-data:
# This is the fix
networks:
  default:
    driver: bridge

我最终要做的是创建一个覆盖网络,并使Nginx容器知道每个fpm的域名.这使两个容器现在可以通过FQDN在彼此之间来回发送请求,而不是IP或容器ID /名称.在事后看来,这是一件容易忽视的事情.

原文地址：https://www.jb51.cc/nginx/532357.html

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。

curlcurl

相关推荐

如何基于nginx+uWSGI+django+virtualenv+supervisor部署发布web项目
Nginx (engine x) 是一个高性能的HTTP和反向代理服务，也是一个IMAP/POP3/SMTP服务。 wsgi是PythonWeb服务器网关接口(Web Server Gateway Interface)，WSGI是作为Web服务器与Web应用程序或应用框架之间的一种低级别的接口，以提
Vue+Django项目部署
本地项目配置 1 复制 luffy/settings/dev.py为prop.py 修改luffy/settings/prop.py中以下几项 (1) allow_hosts (2) 跨域白名单 (3) 支付宝电脑网站支付配置信息 2 修改luffy/wsgi.py文件 第14行 3 修改manag
nginx 隐藏版本号与WEB服务器信息
nginx不仅可以隐藏版本信息，还支持自定义web服务器信息 先看看最终的隐藏结果吧 具体怎么实现呢，其实也很简单，请往下看 1 官网下载最新稳定版 2 解压 3 修改C文件&#x9;（1）vim src/http/ngx_http_header_filter_module.c #修改49行&#x9;static
nginx漏洞分析与升级修复
一 、此次漏洞分析 1 nginx HTTP/2漏洞 [nginx-announce] nginx安全公告（CVE-2018-16843，CVE-2018-16844）在nginx HTTP / 2实现中发现了两个安全问题，漏洞对服务器的影响：&#x9;可能会导致过多的内存消耗（CVE-2018-16843
Nginx配置文件详解
###进入nginx 目录cd /usr/local/nginx###递归显示 2 级目录tree -L 2 ./一、conf 目录conf 目录：存放nginx 配置文件的目录fastcgi.conf：存放fastcgi 相关的配置 fastcgi.conf.default：fastcgi.conf 的原始备份文件，用于还原 fastcgi_params：fastcgi 相关参数文件 fastcgi_params.default：fastcgi_params 的原始...
windows关闭nginx
在cmd命令窗口输入下面命令进行查看 tasklist /fi "imagename eq nginx.exe"
Nginx显示500错误原因和解决方法
Nginx显示500错误原因和解决方法
linux系统下启停nginx的命令
linux系统下启停nginx的命令
【问题】4.Nginx之default_server问题
nginx 的 default_server 指令可以定义默认的 server出处理一些没有成功匹配 server_name 的请求1.显示定义2.指定Server_name3.隐式定义这三种方式都可禁止 ip 直接访问且 1,3同时可以禁止未绑定域名的访问（比如泛解析了主域名）。如果没有显式定义，则会选取第一个定义的 server 作为 default_server。http {# 显示的定义一个 default serverserver {}}
nginx笔记
Nginx是一款轻量级的 Web 服务器、反向代理服务器，由于它的内存占用少，启动极快，高并发能力强，在互联网项目中广泛应用。
苹果市值2025年有望达4万亿美元
pythonJavaScriptjavaHTMLPHPreactjsC#AndroidCSSNode.jssqlrpython-3.xMysqLjQueryc++pandasFlutterangularIOSdjangolinuxswifttypescript路由器JSON路由器设置无线路由器h3c华三华三路由器设置华三路由器电脑软件教程arraysdocker软件图文教程Cvue.jslaravelspring-boot