You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by Weibin Yao <nb...@gmail.com> on 2010/11/01 09:35:02 UTC

Invalid message recieved with signature

Hi tomcat developers,
    Our tomcat_5.5.20 servers encounter a lot of error logs:

/2010-11-1 14:58:10 org.apache.coyote.ajp.AjpMessage processHeader
▒▒▒▒: Invalid message recieved with signature 13410
2010-11-1 14:58:10 
org.apache.coyote.ajp.AjpAprProtocol$AjpConnectionHandler process
▒▒▒▒: Error reading request, ignored
java.lang.StringIndexOutOfBoundsException: String index out of range: 30076
        at java.lang.String.checkBounds(String.java:402)
        at java.lang.String.<init>(String.java:443)
        at 
org.apache.tomcat.util.buf.ByteChunk.toStringInternal(ByteChunk.java:498)
        at 
org.apache.tomcat.util.buf.StringCache.toString(StringCache.java:310)
        at org.apache.tomcat.util.buf.ByteChunk.toString(ByteChunk.java:491)
        at 
org.apache.tomcat.util.buf.MessageBytes.toString(MessageBytes.java:209)
        at 
org.apache.coyote.RequestInfo.updateCounters(RequestInfo.java:146)
        at org.apache.coyote.Request.updateCounters(Request.java:488)
        at 
org.apache.coyote.ajp.AjpAprProcessor.process(AjpAprProcessor.java:450)
        at 
org.apache.coyote.ajp.AjpAprProtocol$AjpConnectionHandler.process(AjpAprProtocol.java:452)
        at 
org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:1285)
        at java.lang.Thread.run(Thread.java:619)
/

    We use this servers as upload servers, most of the AJP requests are 
POST method. This a debug log:

/2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage processHeader
▒▒▒▒: Invalid message recieved with signature 11565
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: In: : [B@cc5b10 4/11569
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 2d 2d 2d 2d 02 04 00 08 48 54 54 50 2f 31 2e 30  | ----....HTTP/1.0
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 00 00 0a 2f 75 70 6c 6f 61 64 2e 64 6f 00 00 0c  | .../upload.do...
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 31 38 33 2e 31 37 2e 38 2e 32 30 38 00 ff ff 00  | 183.17.8.208.??.
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 14 75 70 6c 6f 61 64 2e 70 68 6f 74 6f 2e 31 36  | .upload.photo.16
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 33 2e 63 6f 6d 00 00 50 00 00 0d a0 0b 00 14 75  | 3.com..P...?...u
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 70 6c 6f 61 64 2e 70 68 6f 74 6f 2e 31 36 33 2e  | pload.photo.163.
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 63 6f 6d 00 00 0f 58 2d 46 6f 72 77 61 72 64 65  | com...X-Forwarde
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 64 2d 46 6f 72 00 00 0c 31 38 33 2e 31 37 2e 38  | d-For...183.17.8
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 2e 32 30 38 00 00 09 58 2d 46 72 6f 6d 2d 49 50  | .208...X-From-IP
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 00 00 0c 31 38 33 2e 31 37 2e 38 2e 32 30 38 00  | ...183.17.8.208.
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 00 0a 58 2d 46 72 6f 6d 2d 49 53 50 00 00 01 32  | ..X-From-ISP...2
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 00 a0 06 00 05 63 6c 6f 73 65 00 a0 0d 00 14 75  | .?...close.?...u
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 70 6c 6f 61 64 2e 70 68 6f 74 6f 2e 31 36 33 2e  | pload.photo.163.
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
▒▒▒: 63 6f 6d 00 a0 01 00 06 74 65 78 74 2f 2a 00 a0  | com.?...text/*.?
2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
.../*

    *It seems that the packet's 4 bytes in the beginning are incorrect.
   
    Meanwhile I also captured all the TCP packets with port 8009 by 
tcpdump. I found all the TCP packet's header are all fine which is 
beginning with 0x1234.

    We use apache2.2.3, libapache2-mod-jk_1.2.21 and tomcat_5.5.20.
    The boxes system are 2.6.18-4-686 #1 SMP Mon Mar 26 17:17:36 UTC 
2007 i686 GNU/Linux.

-- 

Weibin Yao


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

Re: Invalid message recieved with signature

Posted by Weibin Yao <nb...@gmail.com>.
Rainer Jung at 2010-11-1 19:38 wrote:
> On 01.11.2010 09:35, Weibin Yao wrote:
>> Hi tomcat developers,
>> Our tomcat_5.5.20 servers encounter a lot of error logs:
>>
>> /2010-11-1 14:58:10 org.apache.coyote.ajp.AjpMessage processHeader
>> ▒▒▒▒: Invalid message recieved with signature 13410
>> 2010-11-1 14:58:10
>> org.apache.coyote.ajp.AjpAprProtocol$AjpConnectionHandler process
>> ▒▒▒▒: Error reading request, ignored
>> java.lang.StringIndexOutOfBoundsException: String index out of range: 
>> 30076
>> at java.lang.String.checkBounds(String.java:402)
>> at java.lang.String.<init>(String.java:443)
>> at
>> org.apache.tomcat.util.buf.ByteChunk.toStringInternal(ByteChunk.java:498) 
>>
>> at org.apache.tomcat.util.buf.StringCache.toString(StringCache.java:310)
>> at org.apache.tomcat.util.buf.ByteChunk.toString(ByteChunk.java:491)
>> at 
>> org.apache.tomcat.util.buf.MessageBytes.toString(MessageBytes.java:209)
>> at org.apache.coyote.RequestInfo.updateCounters(RequestInfo.java:146)
>> at org.apache.coyote.Request.updateCounters(Request.java:488)
>> at 
>> org.apache.coyote.ajp.AjpAprProcessor.process(AjpAprProcessor.java:450)
>> at
>> org.apache.coyote.ajp.AjpAprProtocol$AjpConnectionHandler.process(AjpAprProtocol.java:452) 
>>
>>
>> at 
>> org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:1285)
>> at java.lang.Thread.run(Thread.java:619)
>> /
>>
>> We use this servers as upload servers, most of the AJP requests are POST
>> method. This a debug log:
>>
>> /2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage processHeader
>> ▒▒▒▒: Invalid message recieved with signature 11565
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: In: : [B@cc5b10 4/11569
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 2d 2d 2d 2d 02 04 00 08 48 54 54 50 2f 31 2e 30 | ----....HTTP/1.0
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 00 00 0a 2f 75 70 6c 6f 61 64 2e 64 6f 00 00 0c | .../upload.do...
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 31 38 33 2e 31 37 2e 38 2e 32 30 38 00 ff ff 00 | 183.17.8.208.??.
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 14 75 70 6c 6f 61 64 2e 70 68 6f 74 6f 2e 31 36 | .upload.photo.16
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 33 2e 63 6f 6d 00 00 50 00 00 0d a0 0b 00 14 75 | 3.com..P...?...u
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 70 6c 6f 61 64 2e 70 68 6f 74 6f 2e 31 36 33 2e | pload.photo.163.
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 63 6f 6d 00 00 0f 58 2d 46 6f 72 77 61 72 64 65 | com...X-Forwarde
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 64 2d 46 6f 72 00 00 0c 31 38 33 2e 31 37 2e 38 | d-For...183.17.8
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 2e 32 30 38 00 00 09 58 2d 46 72 6f 6d 2d 49 50 | .208...X-From-IP
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 00 00 0c 31 38 33 2e 31 37 2e 38 2e 32 30 38 00 | ...183.17.8.208.
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 00 0a 58 2d 46 72 6f 6d 2d 49 53 50 00 00 01 32 | ..X-From-ISP...2
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 00 a0 06 00 05 63 6c 6f 73 65 00 a0 0d 00 14 75 | .?...close.?...u
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 70 6c 6f 61 64 2e 70 68 6f 74 6f 2e 31 36 33 2e | pload.photo.163.
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> ▒▒▒: 63 6f 6d 00 a0 01 00 06 74 65 78 74 2f 2a 00 a0 | com.?...text/*.?
>> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
>> .../*
>>
>> *It seems that the packet's 4 bytes in the beginning are incorrect.
>
> Right.
>
>> Meanwhile I also captured all the TCP packets with port 8009 by tcpdump.
>> I found all the TCP packet's header are all fine which is beginning with
>> 0x1234.
>
> Very strange.
>
>> We use apache2.2.3, libapache2-mod-jk_1.2.21 and tomcat_5.5.20.
>> The boxes system are 2.6.18-4-686 #1 SMP Mon Mar 26 17:17:36 UTC 2007
>> i686 GNU/Linux.
>
> Which exact Java version? There was a JVMbug on x86 introduced in 
> about 1.6.0_18 and solved in _21:
>
> http://bugs.sun.com/view_bug.do?bug_id=6875866
>
> In addition mod_jk improved a lot since 1.2.21, which is more than 3.5 
> years oldand e.g. has security problems. Roughly the same is true for 
> Apache 2.2.3 and Tomcat 5.5.20. Not saying we definitely fixed 
> something that looks like the below, but before investigating it seems 
> better to do updates first.
Thanks, we have updated the Tomcat to the latest tomcat 5.5.31 and the 
problem disappeared.
>
> Regards,
>
> Rainer
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: dev-help@tomcat.apache.org
>
>


-- 
Weibin Yao


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org

Re: Invalid message recieved with signature

Posted by Rainer Jung <ra...@kippdata.de>.
On 01.11.2010 09:35, Weibin Yao wrote:
> Hi tomcat developers,
> Our tomcat_5.5.20 servers encounter a lot of error logs:
>
> /2010-11-1 14:58:10 org.apache.coyote.ajp.AjpMessage processHeader
> ▒▒▒▒: Invalid message recieved with signature 13410
> 2010-11-1 14:58:10
> org.apache.coyote.ajp.AjpAprProtocol$AjpConnectionHandler process
> ▒▒▒▒: Error reading request, ignored
> java.lang.StringIndexOutOfBoundsException: String index out of range: 30076
> at java.lang.String.checkBounds(String.java:402)
> at java.lang.String.<init>(String.java:443)
> at
> org.apache.tomcat.util.buf.ByteChunk.toStringInternal(ByteChunk.java:498)
> at org.apache.tomcat.util.buf.StringCache.toString(StringCache.java:310)
> at org.apache.tomcat.util.buf.ByteChunk.toString(ByteChunk.java:491)
> at org.apache.tomcat.util.buf.MessageBytes.toString(MessageBytes.java:209)
> at org.apache.coyote.RequestInfo.updateCounters(RequestInfo.java:146)
> at org.apache.coyote.Request.updateCounters(Request.java:488)
> at org.apache.coyote.ajp.AjpAprProcessor.process(AjpAprProcessor.java:450)
> at
> org.apache.coyote.ajp.AjpAprProtocol$AjpConnectionHandler.process(AjpAprProtocol.java:452)
>
> at org.apache.tomcat.util.net.AprEndpoint$Worker.run(AprEndpoint.java:1285)
> at java.lang.Thread.run(Thread.java:619)
> /
>
> We use this servers as upload servers, most of the AJP requests are POST
> method. This a debug log:
>
> /2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage processHeader
> ▒▒▒▒: Invalid message recieved with signature 11565
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: In: : [B@cc5b10 4/11569
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 2d 2d 2d 2d 02 04 00 08 48 54 54 50 2f 31 2e 30 | ----....HTTP/1.0
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 00 00 0a 2f 75 70 6c 6f 61 64 2e 64 6f 00 00 0c | .../upload.do...
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 31 38 33 2e 31 37 2e 38 2e 32 30 38 00 ff ff 00 | 183.17.8.208.??.
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 14 75 70 6c 6f 61 64 2e 70 68 6f 74 6f 2e 31 36 | .upload.photo.16
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 33 2e 63 6f 6d 00 00 50 00 00 0d a0 0b 00 14 75 | 3.com..P...?...u
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 70 6c 6f 61 64 2e 70 68 6f 74 6f 2e 31 36 33 2e | pload.photo.163.
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 63 6f 6d 00 00 0f 58 2d 46 6f 72 77 61 72 64 65 | com...X-Forwarde
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 64 2d 46 6f 72 00 00 0c 31 38 33 2e 31 37 2e 38 | d-For...183.17.8
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 2e 32 30 38 00 00 09 58 2d 46 72 6f 6d 2d 49 50 | .208...X-From-IP
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 00 00 0c 31 38 33 2e 31 37 2e 38 2e 32 30 38 00 | ...183.17.8.208.
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 00 0a 58 2d 46 72 6f 6d 2d 49 53 50 00 00 01 32 | ..X-From-ISP...2
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 00 a0 06 00 05 63 6c 6f 73 65 00 a0 0d 00 14 75 | .?...close.?...u
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 70 6c 6f 61 64 2e 70 68 6f 74 6f 2e 31 36 33 2e | pload.photo.163.
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> ▒▒▒: 63 6f 6d 00 a0 01 00 06 74 65 78 74 2f 2a 00 a0 | com.?...text/*.?
> 2010-11-1 14:19:33 org.apache.coyote.ajp.AjpMessage dump
> .../*
>
> *It seems that the packet's 4 bytes in the beginning are incorrect.

Right.

> Meanwhile I also captured all the TCP packets with port 8009 by tcpdump.
> I found all the TCP packet's header are all fine which is beginning with
> 0x1234.

Very strange.

> We use apache2.2.3, libapache2-mod-jk_1.2.21 and tomcat_5.5.20.
> The boxes system are 2.6.18-4-686 #1 SMP Mon Mar 26 17:17:36 UTC 2007
> i686 GNU/Linux.

Which exact Java version? There was a JVMbug on x86 introduced in about 
1.6.0_18 and solved in _21:

http://bugs.sun.com/view_bug.do?bug_id=6875866

In addition mod_jk improved a lot since 1.2.21, which is more than 3.5 
years oldand e.g. has security problems. Roughly the same is true for 
Apache 2.2.3 and Tomcat 5.5.20. Not saying we definitely fixed something 
that looks like the below, but before investigating it seems better to 
do updates first.

Regards,

Rainer

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org