Analysis of FastCGI protocol in php source code

typedef enum _fcgi_request_type {

      FCGI_BEGIN_REQUEST  =  1, /* [in] */

      FCGI_ABORT_REQUEST  =  2, /* [in]  (not supported) */

      FCGI_END_REQUEST     =  3, /* [out] */

      FCGI_PARAMS          =  4, /* [in]  environment variables  */

      FCGI_STDIN           =  5, /* [in]  post data   */

      FCGI_STDOUT          =  6, /* [out] response   */

      FCGI_STDERR          =  7, /* [out] errors     */

      FCGI_DATA    =  8, /* [in]  filter data (not supported) */

      FCGI_GET_VALUES      =  9, /* [in]  */

      FCGI_GET_VALUES_RESULT = 10  /* [out] */

} fcgi_request_type;

typedef struct _fcgi_header {

      unsigned char version;

      unsigned char type;

      unsigned char requestIdB1;

      unsigned char requestIdB0;

      unsigned char contentLengthB1;

      unsigned char contentLengthB0;

      unsigned char paddingLength;

      unsigned char reserved;

} fcgi_header;

(requestIdB1 <p>所以requestId的范围为0~2的16次方-1，也就是0~65535；</p><p>contentLength标识消息的contentData组件的字节数，计算方式跟requestId类似，范围同样是0~65535：</p><pre class="brush:php;toolbar:false">(contentLengthB1 <p>paddingLength标识消息的paddingData组件的字节数，范围是0~255；协议通过paddingData提供给发送者填充发送的记录的功能，并且方便接受者通过paddingLength快速的跳过paddingData。填充的目的是允许发送者为更有效地处理保持对齐的数据。如果内容的长度超过65535怎么办呢？答案是可以分成多个消息发送。</p><h2 id="strong-FCGI-BEGIN-REQUEST-strong"><strong>3. FCGI_BEGIN_REQUEST</strong></h2><p>FCGI_BEGIN_REQUEST 的结构体定义如下：</p><pre class="brush:php;toolbar:false">typedef struct _fcgi_begin_request {

      unsigned char roleB1;

      unsigned char roleB0;

      unsigned char flags;

      unsigned char reserved[5];

} fcgi_begin_request;

(roleB1 <p>对于PHP7中，处理了三种角色，分别是FCGI_RESPONDER，FCGI_AUTHORIZER       和FCGI_FILTER。</p><p>flags & FCGI_KEEP_CONN：如果为0，则在对本次请求响应后关闭链接。如果非0，在对本次请求响应后不会关闭链接。</p><h2 id="strong-名-值对-strong"><strong>4. 名-值对</strong></h2><p>对于，type为FCGI_PARAMS类型，FastCGI协议中提供了名-值对来很好的满足读写可变长度的name和value，格式如下：</p><pre class="brush:php;toolbar:false">nameLength+valueLength+name+value

if (UNEXPECTED(name_len >= 128)) {

      if (UNEXPECTED(p + 3 >= end)) return 0;

      name_len = ((name_len & 0x7f) <p>这样最长可以表达0~2的31次方的长度。</p><h2 id="strong-请求协议-strong"><strong>5. 请求协议</strong></h2><p>FastCGI协议的定义结构体如下：</p><pre class="brush:php;toolbar:false">    typedef struct _fcgi_begin_request_rec {

      fcgi_header hdr;

      fcgi_begin_request body;

} fcgi_begin_request_rec;

pm.max_children = 1

./sbin/php-fpm -y etc/php-fpm.conf

ps aux | grep php-fpm

root     30014  0.0  0.0 142308  4724 ?        Ss   Nov26   0:03 php-fpm: master process (etc/php-fpm.conf)

chenlei   30015  0.0  0.0 142508  5500 ?        S    Nov26   0:00 php-fpm: pool www

gdb –p 30015

(gdb) b fcgi_read_request

(gdb) b fcgi_read_request

(contentLengthB1 <p>paddingLength=5，而987+5=992，恰好是8的倍数。根据contentLength+ paddingLength向后读取992长度的字节流，我们打印一下：</p><pre class="brush:php;toolbar:false">(gdb) p *p@987

$1 = "\017TSCRIPT_FILENAME/home/xiaoju/webroot/beatles/application/mis/mis/src/index.php/admin/operation/index\f\016QUERY_STRINGactivity_id=89\016\003REQUEST_METHODGET\f\000CONTENT_TYPE\016\000CONTENT_LENGTH\v SCRIPT_NAME/index.php/admin/operation/index\v%REQUEST_URI/admin/operation/index?activity_id=89\f DOCUMENT_URI/index.php/admin/operation/index\r4DOCUMENT_ROOT/home/xiaoju/webroot/beatles/application/mis/mis/src\017\bSERVER_PROTOCOLHTTP/1.1\021\aGATEWAY_INTERFACECGI/1.1\017\vSERVER_SOFTWAREnginx/1.2.5\v\rREMOTE_ADDR172.22.32.131\v\005REMOTE_PORT50973\v\fSERVER_ADDR10.94.98.116\v\004SERVER_PORT8085\v\000SERVER_NAME\017\003REDIRECT_STATUS200\t\021HTTP_HOST10.94.98.116:8085\017\nHTTP_CONNECTIONkeep-alive\017xHTTP_USER_AGENTMozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36\036\001HTTP_UPGRADE_INSECURE_REQUESTS1\vUHTTP_ACCEPTtext/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\024\rHTTP_ACCEPT_ENCODINGgzip, deflate\024\027HTTP_ACCEPT_LANGUAGEzh-CN,zh;q=0.9,en;q=0.8"

int fcgi_flush(fcgi_request *req, int close)

{

      int len;

 

      close_packet(req);

      len = (int)(req->out_pos - req->out_buf);

 

      if (close) {

               fcgi_end_request_rec *rec = (fcgi_end_request_rec*)(req->out_pos);

                 //创建FCGI_END_REQUEST的头

               fcgi_make_header(&rec->hdr, FCGI_END_REQUEST, req->id, sizeof(fcgi_end_request));

                 //写入appStatus

               rec->body.appStatusB3 = 0;

               rec->body.appStatusB2 = 0;

               rec->body.appStatusB1 = 0;

               rec->body.appStatusB0 = 0;

                 //修改protocolStatus为FCGI_REQUEST_COMPLETE;

               rec->body.protocolStatus = FCGI_REQUEST_COMPLETE;

               len += sizeof(fcgi_end_request_rec);

      }

 

      if (safe_write(req, req->out_buf, len) != len) {

               req->keep = 0;

               req->out_pos = req->out_buf;

               return 0;

      }

 

      req->out_pos = req->out_buf;

      return 1;

}