Re: siege failing and so on

-                                                 [email protected]
---------------------------------------------------------------------

On Sun, Oct 12, 2003 at 10:22:44PM +0400, Dmitry P. Schegolev wrote:

<snip>
> > hmm, IIRC on Linux, threads are normal processes, but sharing almost
> > evrything but stack and and registers. So it shouldnt make things worse
> > using threads instead of separate processes. But MT makes some things
> > a little bit difficult due shared memory (so locking is required).
> 
> Not instead!! I want to say that we must hard limit the number of clones(Let 
> name process or thread --- "clone"). We must do it because of factor of many 
> uid/gid instances - separate processes, against usual apache. 

hmm, as already said: a dynamic processor startup would be nice, but I dont
think its easy to implement. We need a good signalling between multiplexer,
processors and mother.

<snip>
> Usual apache 1.3.27 has on my current hosting 5 forks and pretty serve ~100 
> vhosts. In case of metuxmpm I get ~ 300 clones at startup only and if any 
yeah, thats the problem with the 3 ones instead of 1.
and apache-1 has the big difference that it serves all vhosts in the same
uid/gid, so it does not need at least one child for each uid/gid.

> rare requests become on some vhost it clone itself to ~20-50. If I simply 
> browse each vhost in my broser once(get /index.html), It become something 
> dramatic in my ps table.
This will also happen with dynamic child startup when the idle-die-delay
is too long. Perhaps the mother could kill rarely used childs when 
resources get low and learn which one to kill first (similar like the
kernel's pageout deamon does)

<snip>
> > We already filter, but only the first request. 
> It's a hole. May be difficulty exploitable, but hole. 
Any idea how to exploit ?
Headers are not passed directly from client to processor (@ first req.)
The only hole is that an overtaken processor could leave out the right
"Connection: Close" header and so let the client send requests to other
vhosts over this link. But didnt see an client doing so yet.

Perhaps we could set up an test farm for this questions and check 
out all known browsers.


cu
-- 
---------------------------------------------------------------------
 Enrico Weigelt    ==   metux IT services

 phone:     +49 36207 519931         www:       http://www.metux.de/     
 fax:       +49 36207 519932         email:     [email protected]
 cellphone: +49 174 7066481	     
---------------------------------------------------------------------
 Diese Mail wurde mit UUCP versandt.      http://www.metux.de/uucp/