You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Konrad Rosenbaum <ko...@silmor.de> on 2006/12/29 19:44:45 UTC
COPY and reverse-proxies
Hi,
in order to limit the damage if one of my dozens of web applications is
exploited by the script kiddie of the day, I have my subversion running on
one Apache instance in the background and access it through a reverse proxy
Apache that is visible to the world (and unifies over a dozen background
Apaches into different vhosts/URLs inside its own namespace).
Now the problem is: if I try to commit a change that contains a copy
operation I get "502 Bad Gateway" back from SVN.
I traced this back to be generated by mod_dav in my SVN-background Apache,
since it does not like the URL in the Destination header.
SVN sends to the proxy (Apache/SSL):
COPY /svn/old/path HTTP/1.1
Host: myserver.tld
Destination: https://myserver.tld/svn/new/path
....
The proxy only rewrites the request URL, but not the other headers, so the
SVN-Apache (Apache without SSL) receives:
COPY /svn/old/path HTTP/1.1
Host: svn.myserver.tld:10600
Destination: https://myserver.tld/svn/new/path
....
...and immediately recognizes that it is definitely not responsible for
serving https, let alone myserver.tld or even port 443. So it does not show
the the request to SVN, but instead sends back a 502 error.
(I found that with the help of tcpdump, LogLevel debug and a good long look
into the mod_dav sources.)
None of the Apache-Modules seems to be able to handle this situation:
mod_rewrite is very happy to rewrite URLs, but that is already taken care of
in mod_proxy
mod_headers is not able to change parts of headers, only to staticly
override them (actually the trunk version of this module does have an edit
functionality that does what I want, but running Apache/trunk is no option)
mod_ext_filter only filters the body
Does anyone have a solution for this? Is mod_perl able to do such magic? (If
yes: how? Unfortunately I'm not very familiar with this mod or Perl.)
Or do I need to backport the new mod_headers?
Konrad
Re: Solved: Re: COPY and reverse-proxies
Posted by Staffan Olsson <so...@gmail.com>.
Konrad, thank you for this solution.
I would like to add that it seems like the Apache guys have backported
this to the 2.2.x branch now. I have applied your fix using the source
checked out from
http://svn.apache.org/repos/asf/httpd/httpd/tags/2.2.4/.
/Staffan
On 12/30/06, Konrad Rosenbaum <ko...@silmor.de> wrote:
> On Saturday 30 December 2006 12:17, Konrad Rosenbaum wrote:
> > On Friday 29 December 2006 20:44, Konrad Rosenbaum wrote:
> > > Now the problem is: if I try to commit a change that contains a copy
> > > operation I get "502 Bad Gateway" back from SVN.
>
> ...just for convenience: I put it all into a little web page:
> http://silmor.de/49
>
>
>
> Konrad
>
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org
Re: Solved: Re: COPY and reverse-proxies
Posted by Konrad Rosenbaum <ko...@silmor.de>.
On Saturday 30 December 2006 12:17, Konrad Rosenbaum wrote:
> On Friday 29 December 2006 20:44, Konrad Rosenbaum wrote:
> > Now the problem is: if I try to commit a change that contains a copy
> > operation I get "502 Bad Gateway" back from SVN.
...just for convenience: I put it all into a little web page:
http://silmor.de/49
Konrad
Solved: Re: COPY and reverse-proxies
Posted by Konrad Rosenbaum <ko...@silmor.de>.
On Friday 29 December 2006 20:44, Konrad Rosenbaum wrote:
> Now the problem is: if I try to commit a change that contains a copy
> operation I get "502 Bad Gateway" back from SVN.
[cut: Description of proxy environment]
> Or do I need to backport the new mod_headers?
Actually this was easier than expected:
1) get the current snapshot of Apache trunk from
http://cvs.apache.org/snapshots/httpd/ (I used snapshot
httpd_20061229171811.tar.gz); the diff between 2.0 and trunk is small
enough for this file to not be a problem.
2) install the correct development packages for the Apache that you are
running (Debian: apache2-prefork-dev) - if you have subversion installed on
a production server, it might be a good idea to install these packages on a
different machine
3) untar the snapshot; cd httpd/modules/metadata
4) apxs2 -c mod_headers.c
5) copy .libs/mod_headers.so to the Apache modules directory
(Debian: /usr/lib/apache2/modules) - preferably using a new name for it
(like mod_headers_too.so)
6) go into the configuration of your actual SVN-serving Apache (not the
proxy - mod_proxy accesses the data stream before mod_headers has a chance
to manipulate it) and add this line to add the module to Apache:
LoadModule headers_module /usr/lib/apache2/modules/mod_headers_too.so
(of course you should correct the path to your installation and make sure
that the original mod_headers.so is not loaded)
7) in the same configuration, find the part where you configured SVN
(something like <Location /svn>...) and add:
RequestHeader edit Destination ^https http early
8) restart the SVN-Apache
Changing https to http in 7) should normally be enough. If not, either
change it to exchange "^https://myproxy.tld" for "http://myinternalsvnserv"
or add a "ServerAlias myproxy.tld" to the same config file/VHost.
Konrad
Re: COPY and reverse-proxies
Posted by Tony Morris <tm...@tmorris.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Konrad Rosenbaum wrote:
> Hi,
>
> in order to limit the damage if one of my dozens of web applications is
> exploited by the script kiddie of the day, I have my subversion running on
> one Apache instance in the background and access it through a reverse proxy
> Apache that is visible to the world (and unifies over a dozen background
> Apaches into different vhosts/URLs inside its own namespace).
>
> Now the problem is: if I try to commit a change that contains a copy
> operation I get "502 Bad Gateway" back from SVN.
I have had exactly this problem. Are you using mod_proxy to go between
HTTP and HTTPS? If so, the solution/workaround is to use one or other.
Tony Morris
http://tmorris.net/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.3 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFFltiimnpgrYe6r60RAoAqAJ4hUpzeJmtuZiec9CrvRagyG4Zt7QCfR8gB
R2qCpDG6O5G1W2GsZ5jEjPE=
=Q0oF
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@subversion.tigris.org
For additional commands, e-mail: users-help@subversion.tigris.org