XML RPC Windows Live Writter stopped working

F

foliovision

Member
#1
#1
We are suddenly having issues with WordPress and Windows Live Writer on our server. There was no WordPress update and it happens even without any plugins.

Was there any change in the Litespeed security filters? We are using Litespeed 5.0.7.

1) Here's how the XML RPC request looks like:

<?xml version=""1.0"" encoding=""utf-8""?>
<methodCall>
<methodName>metaWeblog.newMediaObject</methodName>
<params>
<param>
<value>
<string>1</string>
</value>
</param>
<param>
<value>
<string>foliovision</string>
</value>
</param>
<param>
<value>[removed]</value>
</param>
<param>
<value>
<struct>
<member>
<name>name</name>
<value>
<string>Koala.jpg</string>
</value>
</member>
<member>
<name>type</name>
<value>
<string>image/jpeg</string>
</value>
</member>
<member>
<name>bits</name>
<value>
<base64>[275718 bytes]</base64>
</value>
</member>
</struct>
</value>
</param>
</params>
</methodCall>

If there is no image in the request it works.

2) Here's the error message:

"The underlying connection was closed: The connection was closed unexpectedly."

3) The request takes a minute to finish and I can see it with status code 200 in access logs. I don't see anything in the PHP error logs.

I also put in some custom logging into dcrainmaker.com/xmlrpc.php and it doesn't trigger - so I'm thinking the request is somehow blocked and it newer reaches the PHP.

Thanks,
Martin
 
F

foliovision

Member
#3
#3
Hello NiteWave,

I updated Litespeed to 5.0.10 and the issue still exists.

How can we disable any filtering to check if it's Litespeed causing the issue here? I was also checking for any logs is /var/logs and /usr/local/lsws and /usr/local/apache and found nothing.

Thanks,
Martin
 
F

foliovision

Member
#5
#5
Hello NiteWave,

it happens on WordPress 4.3.1 and 4.4. However there has been no recent update it just stopped working.

It happens even without plugins or any special theme on a clean website.

Yes, it's a WHM/cPanel server. There were no additions to the mod_security rules and I don't see anything about it in cPanel ModSecurity interface.

The server is not behind CloudFlare.

Thanks,
Martin
 
N

NiteWave

Administrator
#6
#6
enable debug log, see if you can find anything ?
lsws web admin -> Actions -> Toggle Debug Logging
then watch error.log (no need restart lsws)
 
F

foliovision

Member
#8
#8
Hello NiteWave,

thank you for all your replies.

I was not getting this error yesterday from my home computer, but now I'm getting the same error in the office again. I upgraded to 4.4.1 as well, but nothing has changed.

I'm attaching a full log for my IP address from Litespeed logs with debug logging enabled.

The XML RPC request which failed starts with: "2016-01-07 04:02:03.903 [DEBUG] [184.75.209.234:80] New connection from 1.2.3.4:49441, concurrent: 6." The virtual host in question is APVH_dc.com (it's not the real domain name however, I shortened it).

Could you please have a look and let me know what seems to be the problem?


Thanks,
Martin
 

Attachments

N

NiteWave

Administrator
#9
#9
can you give a screen shot of your lsphp5 ext app setting ? have you made any change to it ?

and screen shot of lsws web admin -> Server -> Tuning -> Connection section.
see if you've made any changes to those default values.
 
N

NiteWave

Administrator
#11
#11
in ls-server-connection-tuning.png,
"Connection Timeout (secs):60"
please change back to default value: 300
restart lsws and test again.
 
N

NiteWave

Administrator
#13
#13
can you try this trick ?
http://leiflarsen.org/2015/xmlrpc-and-windows-live-writer

from your attachment:
2016-01-13 03:52:56.265 [NOTICE] [89.173.200.101:14881#APVH_site.com] Content len: 244612, Request line: 'POST /site/xmlrpc.php HTTP/1.1'
...
2016-01-13 03:52:58.197 [DEBUG] [89.173.200.101:14881#APVH_site.com] Read from client: 148
2016-01-13 03:52:58.197 [DEBUG] [89.173.200.101:14881#APVH_site.com] Finsh request body 197100/244612 bytes!
2016-01-13 03:58:00.261 [INFO] [89.173.200.101:14881#APVH_site.com] Connection idle time: 302 while in state: 3 watching for event: 25,close!
2016-01-13 03:58:00.261 [NOTICE] [89.173.200.101:14881#APVH_site.com] Content len: 244612, Request line: 'POST /site/xmlrpc.php HTTP/1.1'
2016-01-13 03:58:00.261 [INFO] [89.173.200.101:14881#APVH_site.com] Request body size: 244612, received: 197100.
2016-01-13 03:58:00.393 [DEBUG] [89.173.200.101:14881#APVH_site.com] Shutting down out-bound socket ...
2016-01-13 03:58:01.352 [DEBUG] [89.173.200.101:14881#APVH_site.com] Shutdown time out!
2016-01-13 03:58:01.352 [DEBUG] [89.173.200.101:14881#APVH_site.com] Close socket ...
2016-01-13 03:58:01.352 [DEBUG] [89.173.200.101:14881#APVH_site.com] Available Connections: 1698, concurrent conn: 0
2016-01-13 03:58:01.352 [DEBUG] [89.173.200.101:14881#APVH_site.com] Recycle NtwkIoLink
Click to expand...
so the 300 seconds setting has taken effect:
2016-01-13 03:58:00.261 [INFO] [89.173.200.101:14881#APVH_site.com] Connection idle time: 302 while in state: 3 watching for event: 25,close!

the issue is:
client (Windows Live Writer) want to post 244612 bytes to wordpress, and within 2 seconds(03:52:56.265 -> 03:52:58.197), has posted 197100 bytes, then client stopped to post the remaining 244612 - 197100 = 47512 bytes, and web server(litespeed) still wait there for 302 seconds(till 03:58:00.261). before close the connection.

please try the tick mentioned at the beginning of this reply. just see if it works.
we need reproduce this issue at our lab. can you also try another xmprpc client other than Windows Live Writer ?
 
You must log in or register to reply here.
Top