[solved] Wordpress plugin error 400 Bad Request

[Pingler.com]

Hello,

Our members are receiving a 400 Bad Request error when using our WordPress plugin. Simply put, our plugin allows members to send their latest posts to be added into their accounts on our website Pingler.com

We have just installed LiteSpeed and this is a new server we moved to.

There is no error when passed directly through the browser:

http://pingler.com/account/wp_add.p...pink-beauty/&title=Pink+Beauty&category_id=12

However, if passed from CURL we get this message:

>*400 Bad Request
It is not a valid request! Powered By LiteSpeed Web Server
LiteSpeed Technologies is not responsible for administration and contents of this web site!

Thank you

 

[mistwang]

You need to check the request sent by curl with tcpdump

tcpdump -s0 -X port 80 and host <ip_of_the_curl_client>

Please post or PM the tcpdump result containing the curl request if you believe it is a valid HTTP request.

 

[Pingler.com]

I ran this on the server I was connecting too and then tried the CURL script again but didn't get any useful data.

root@host [/var/log]# tcpdump -s0 -X -v port 80 and host IP ADDRESS
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

0 packets captured
0 packets received by filter
0 packets dropped by kernel

The strange thing is this only produces an error when the CURL function is passed a URL as a var but if I type the exact same URL manually it doesn't throw the error. But there is no difference in the URLs other then one is being passed to the function I even output them into the plugin to be sure.

Thanks.

 

[mistwang]

You may have multiple NICs, and the traffic is going through another NIC,
try

tcpdump -i eth1 ....

 

[Pingler.com]

I tried it again and got some packets received:

root@host [/var/log]# tcpdump -i eth1 -s0 -X -v port 80 and host IP ADDRESS
tcpdump: ioctl: No such device
root@host [/var/log]# tcpdump -s0 -X -v port 80 and host IP ADDRESS
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

0 packets captured
20 packets received by filter
0 packets dropped by kernel

 

[mistwang]

You should continue play with the tcpdump parameter until you can capture the packet contain the request.

you can try
tcpdump -s0 -x -v port 80

first see if you can get something, then add more rules one by one.

 

[webizen]

try following ('port 80' removed) to see if any packets can be captured.

tcpdump -s0 -X -v host IP_ADDRESS

where IP_ADDRESS is the client public IP.

 

[Pingler.com]

When I went directly to the URL i managed to capture this:

13:54:20.560768 IP host.pingler.com.http > host86-166-100-207.range86-166.btcentralplus.com.55898: P 1:232(231) ack 1866 win 11616
        0x0000:  4500 010f 6b62 4000 4006 cce6 d1ec 743e  E...kb@.@.....t>
        0x0010:  56a6 64cf 0050 da5a a31a a5db 13da 8e05  V.d..P.Z........
        0x0020:  5018 2d60 4eaa 0000 4854 5450 2f31 2e31  P.-`N...HTTP/1.1
        0x0030:  2032 3030 204f 4b0d 0a43 6f6e 7465 6e74  .200.OK..Content
        0x0040:  2d45 6e63 6f64 696e 673a 2067 7a69 700d  -Encoding:.gzip.
        0x0050:  0a56 6172 793a 2041 6363 6570 742d 456e  .Vary:.Accept-En
        0x0060:  636f 6469 6e67 0d0a 4461 7465 3a20 5765  coding..Date:.We
        0x0070:  642c 2030 3520 4f63 7420 3230 3131 2031  d,.05.Oct.2011.1
        0x0080:  383a 3534 3a32 3020 474d 540d 0a53 6572  8:54:20.GMT..Ser
        0x0090:  7665 723a 204c 6974 6553 7065 6564 0d0a  ver:.LiteSpeed..
        0x00a0:  436f 6e6e 6563 7469 6f6e 3a20 636c 6f73  Connection:.clos
        0x00b0:  650d 0a58 2d50 6f77 6572 6564 2d42 793a  e..X-Powered-By:
        0x00c0:  2050 4850 2f35 2e33 2e38 0d0a 436f 6e74  .PHP/5.3.8..Cont
        0x00d0:  656e 742d 5479 7065 3a20 7465 7874 2f68  ent-Type:.text/h
        0x00e0:  746d 6c0d 0a43 6f6e 7465 6e74 2d4c 656e  tml..Content-Len
        0x00f0:  6774 683a 2032 300d 0a0d 0a1f 8b08 0000  gth:.20.........
        0x0100:  0000 0004 0303 0000 0000 0000 0000 00    ...............
13:54:20.560785 IP host.pingler.com.http > host86-166-100-207.range86-166.btcentralplus.com.55898: F 232:232(0) ack 1866 win 11616
        0x0000:  4500 0028 6b63 4000 4006 cdcc d1ec 743e  E..(kc@.@.....t>
        0x0010:  56a6 64cf 0050 da5a a31a a6c2 13da 8e05  V.d..P.Z........
        0x0020:  5011 2d60 ba6b 0000                      P.-`.k..
13:54:20.692755 IP host86-166-100-207.range86-166.btcentralplus.com.55898 > host.pingler.com.http: . ack 233 win 65109
        0x0000:  4578 0028 0537 4000 6c06 0781 56a6 64cf  Ex.(.7@.l...V.d.
        0x0010:  d1ec 743e da5a 0050 13da 8e05 a31a a6c3  ..t>.Z.P........
        0x0020:  5010 fe55 e975 0000 0000 0000 0000       P..U.u........
13:54:20.703030 IP host86-166-100-207.range86-166.btcentralplus.com.55898 > host.pingler.com.http: F 1866:1866(0) ack 233 win 65109
        0x0000:  4578 0028 0538 4000 6c06 0780 56a6 64cf  Ex.(.8@.l...V.d.
        0x0010:  d1ec 743e da5a 0050 13da 8e05 a31a a6c3  ..t>.Z.P........
        0x0020:  5011 fe55 e974 0000 0000 0000 0000       P..U.t........
13:54:20.703049 IP host.pingler.com.http > host86-166-100-207.range86-166.btcentralplus.com.55898: . ack 1867 win 11616
        0x0000:  4578 0028 0000 4000 4006 38b8 d1ec 743e  Ex.(..@.@.8...t>
        0x0010:  56a6 64cf 0050 da5a a31a a6c3 13da 8e06  V.d..P.Z........
        0x0020:  5010 2d60 ba6a 0000                      P.-`.j..

12 packets captured
12 packets received by filter
0 packets dropped by kernel

But when I went through the plugin I got nothin show up at the time the 400 error came back.

The CURL function I am using is this:

function pingler_connect($url) {
	if (function_exists('curl_init')) {
		$ch = curl_init($url);
		curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
		@curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
		curl_setopt($ch, CURLOPT_USERAGENT, $_SERVER['HTTP_USER_AGENT']);
		return curl_exec($ch);
	} else {
		return file_get_contents($url);
	}
}

Which returns the 400 error however if I type the URL from $url directly into curl_init('URLHERE') then I don't get the error.

My thinking is that the URL is somehow different as the variable although it is not a visible difference on output. I really am lost on this one.

Thanks

 

[webizen]

...
My thinking is that the URL is somehow different as the variable although it is not a visible difference on output. I really am lost on this one.

Thanks

Looks like it. You may want to debug your code and see the difference between $url as the passing variable (not working) and hardcoded url (working) say by replacing the block of curl function with dumping the value of $url to a file or screen for verification.

 

[mistwang]

When I went directly to the URL i managed to capture this:

You should pay more attention to the packet before this one, containing request from the client.
If tcpdump does not catch anything for your script, means that your script does not hit server, but hits another server, thus 404.

 

[Pingler.com]

Hey, just wanted to update to thank you for your help and let you know I resolved the issue, the URL was being passed with white space that wasn't visible on the output but seemed to make the server reject the URL. So I cleaned the URL and it went through ok.

Thanks again.