PHP-FPM unix socket抓包
Sniffer for Unix Domain Sockets
https://github.com/jonschipp/unixsniff
Dependencies
apt-get install socat bash
test.php
<?php
echo 11;
------------------------------------------------------------------
Use
Enable sniffing on socket
$ ./unixsniff start /tmp/php-fpm.sock
访问http://127.0.0.1/test.php
> 2022/03/01 18:55:41.670565 length=936 from=0 to=935
01 01 00 01 00 08 00 00 00 01 00 00 00 00 00 00 ................
01 04 00 01 03 79 07 00 0f 1e 53 43 52 49 50 54 .....y....SCRIPT
5f 46 49 4c 45 4e 41 4d 45 2f 68 6f 6d 65 2f 77 _FILENAME/home/w
77 77 72 6f 6f 74 2f 64 65 66 61 75 6c 74 2f 74 wwroot/default/t
65 73 74 2e 70 68 70 0c 00 51 55 45 52 59 5f 53 est.php..QUERY_S
54 52 49 4e 47 0e 03 52 45 51 55 45 53 54 5f 4d TRING..REQUEST_M
45 54 48 4f 44 47 45 54 0c 00 43 4f 4e 54 45 4e ETHODGET..CONTEN
54 5f 54 59 50 45 0e 00 43 4f 4e 54 45 4e 54 5f T_TYPE..CONTENT_
4c 45 4e 47 54 48 0b 09 53 43 52 49 50 54 5f 4e LENGTH..SCRIPT_N
41 4d 45 2f 74 65 73 74 2e 70 68 70 0b 09 52 45 AME/test.php..RE
51 55 45 53 54 5f 55 52 49 2f 74 65 73 74 2e 70 QUEST_URI/test.p
68 70 0c 09 44 4f 43 55 4d 45 4e 54 5f 55 52 49 hp..DOCUMENT_URI
2f 74 65 73 74 2e 70 68 70 0d 15 44 4f 43 55 4d /test.php..DOCUM
45 4e 54 5f 52 4f 4f 54 2f 68 6f 6d 65 2f 77 77 ENT_ROOT/home/ww
77 72 6f 6f 74 2f 64 65 66 61 75 6c 74 0f 08 53 wroot/default..S
45 52 56 45 52 5f 50 52 4f 54 4f 43 4f 4c 48 54 ERVER_PROTOCOLHT
54 50 2f 31 2e 31 0e 04 52 45 51 55 45 53 54 5f TP/1.1..REQUEST_
53 43 48 45 4d 45 68 74 74 70 11 07 47 41 54 45 SCHEMEhttp..GATE
57 41 59 5f 49 4e 54 45 52 46 41 43 45 43 47 49 WAY_INTERFACECGI
2f 31 2e 31 0f 0c 53 45 52 56 45 52 5f 53 4f 46 /1.1..SERVER_SOF
54 57 41 52 45 6e 67 69 6e 78 2f 31 2e 32 30 2e TWAREnginx/1.20.
31 0b 0c 52 45 4d 4f 54 45 5f 41 44 44 52 31 39 1..REMOTE_ADDR19
32 2e 31 36 38 2e 31 37 2e 31 0b 05 52 45 4d 4f 2.168.17.1..REMO
54 45 5f 50 4f 52 54 36 33 33 39 38 0b 0e 53 45 TE_PORT63398..SE
52 56 45 52 5f 41 44 44 52 31 39 32 2e 31 36 38 RVER_ADDR192.168
2e 31 37 2e 31 32 39 0b 02 53 45 52 56 45 52 5f .17.129..SERVER_
50 4f 52 54 38 30 0b 01 53 45 52 56 45 52 5f 4e PORT80..SERVER_N
41 4d 45 5f 0f 03 52 45 44 49 52 45 43 54 5f 53 AME_..REDIRECT_S
54 41 54 55 53 32 30 30 0f 30 50 48 50 5f 41 44 TATUS200.0PHP_AD
4d 49 4e 5f 56 41 4c 55 45 6f 70 65 6e 5f 62 61 MIN_VALUEopen_ba
73 65 64 69 72 3d 2f 68 6f 6d 65 2f 77 77 77 72 sedir=/home/wwwr
6f 6f 74 2f 64 65 66 61 75 6c 74 2f 3a 2f 74 6d oot/default/:/tm
70 2f 3a 2f 70 72 6f 63 2f 09 0e 48 54 54 50 5f p/:/proc/..HTTP_
48 4f 53 54 31 39 32 2e 31 36 38 2e 31 37 2e 31 HOST192.168.17.1
32 39 0f 0a 29..
48 54 54 50 5f 43 4f 4e 4e 45 43 54 49 4f 4e 6b HTTP_CONNECTIONk
65 65 70 2d 61 6c 69 76 65 1e 01 48 54 54 50 5f eep-alive..HTTP_
55 50 47 52 41 44 45 5f 49 4e 53 45 43 55 52 45 UPGRADE_INSECURE
5f 52 45 51 55 45 53 54 53 31 0f 80 00 00 81 48 _REQUESTS1.....H
54 54 50 5f 55 53 45 52 5f 41 47 45 4e 54 4d 6f TTP_USER_AGENTMo
7a 69 6c 6c 61 2f 35 2e 30 20 28 57 69 6e 64 6f zilla/5.0 (Windo
77 73 20 4e 54 20 31 30 2e 30 3b 20 57 4f 57 36 ws NT 10.0; WOW6
34 29 20 41 70 70 6c 65 57 65 62 4b 69 74 2f 35 4) AppleWebKit/5
33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 37.36 (KHTML, li
6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 ke Gecko) Chrome
2f 35 35 2e 30 2e 32 38 38 33 2e 38 37 20 55 42 /55.0.2883.87 UB
72 6f 77 73 65 72 2f 36 2e 32 2e 34 30 39 38 2e rowser/6.2.4098.
33 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 0b 3 Safari/537.36.
4a 48 54 54 50 5f 41 43 43 45 50 54 74 65 78 74 JHTTP_ACCEPTtext
2f 68 74 6d 6c 2c 61 70 70 6c 69 63 61 74 69 6f /html,applicatio
6e 2f 78 68 74 6d 6c 2b 78 6d 6c 2c 61 70 70 6c n/xhtml+xml,appl
69 63 61 74 69 6f 6e 2f 78 6d 6c 3b 71 3d 30 2e ication/xml;q=0.
39 2c 69 6d 61 67 65 2f 77 65 62 70 2c 2a 2f 2a 9,image/webp,*/*
3b 71 3d 30 2e 38 14 0d 48 54 54 50 5f 41 43 43 ;q=0.8..HTTP_ACC
45 50 54 5f 45 4e 43 4f 44 49 4e 47 67 7a 69 70 EPT_ENCODINGgzip
2c 20 64 65 66 6c 61 74 65 14 0e 48 54 54 50 5f , deflate..HTTP_
41 43 43 45 50 54 5f 4c 41 4e 47 55 41 47 45 7a ACCEPT_LANGUAGEz
68 2d 43 4e 2c 7a 68 3b 71 3d 30 2e 38 00 00 00 h-CN,zh;q=0.8...
00 00 00 00 01 04 00 01 00 00 00 00 01 05 00 01 ................
00 00 00 00 ....
--
< 2022/03/01 18:55:41.674889 length=96 from=0 to=95
01 06 00 01 00 46 02 00 58 2d 50 6f 77 65 72 65 .....F..X-Powere
64 2d 42 79 3a 20 50 48 50 2f 37 2e 32 2e 33 34 d-By: PHP/7.2.34
0d 0a ..
43 6f 6e 74 65 6e 74 2d 74 79 70 65 3a 20 74 65 Content-type: te
78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 xt/html; charset
3d 55 54 46 2d 38 0d 0a =UTF-8..
0d 0a ..
31 31 00 00 01 03 00 01 00 08 00 00 00 00 00 00 11..............
00 37 35 37 .757
--
HTTP请求报头前半部分，与/usr/local/nginx/conf/fastcgi.conf一致。 后半部分，通常HTTP报头。
[root@VM-0-17-centos 09:20:12 /usr/local/share]# cat /usr/local/nginx/conf/fastcgi.conf
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param REQUEST_SCHEME $scheme;
fastcgi_param HTTPS $https if_not_empty;fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param REDIRECT_STATUS 200;
fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root/:/tmp/:/proc/";
Disable sniffing and restore socket
$ ./unixsniff stop /tmp/php-fpm.sock