You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2013/12/16 22:09:08 UTC

[Bug 55892] New: ProxyRemote with HTTPS backend sends requests with absoluteURI instead of abs_path

https://issues.apache.org/bugzilla/show_bug.cgi?id=55892

            Bug ID: 55892
           Summary: ProxyRemote with HTTPS backend sends requests with
                    absoluteURI instead of abs_path
           Product: Apache httpd-2
           Version: 2.5-HEAD
          Hardware: All
                OS: All
            Status: NEW
          Severity: normal
          Priority: P2
         Component: mod_proxy
          Assignee: bugs@httpd.apache.org
          Reporter: hendrik.harms@gmail.com

With ProxyRemote configuration the HTTPS backend receives a request with an
absoluteURI - which the backend couldn't handle.

Example: 
> ServerName myserver.localnet
> ProxyRemote https://foobar.com http://forwardproxy.localnet:8080
> ProxyPass /content/ https://foobar.com/content/

The Request 
    https://myserver.localnet/content/index.html 
will be received and logged by myserver.localnet as 
    "GET /content/index.html HTTP/1.1"
After a successfull CONNECT handshake with the forwardproxy.localnet we get a
SSL tunnel to the backend server. Cause of the SSL tunnel the request won't be
transformed/touched by the forward proxy. But the proxy module always sends
requests in the absoluteURI form to the backend if a forward proxy is
configured. So the backend receives the request in the absoluteURI form: 
    "GET https://foobar.com/content/indext.html HTTP/1.1"

RFC 2616 5.1.2 says that the absoluteURI form should be supported by every
HTTP/1.1 Server. My backend seems to have an incomplete rfc implemetation here.
:-(

Setting the environment "force-proxy-request-1.0" doesn't help.

I'm not sure about the severity. Is it a bug or a feature to handle improper
backend server. ;-)

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 55892] ProxyRemote with HTTPS backend sends requests with absoluteURI instead of abs_path

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55892

--- Comment #2 from Jim Jagielski <ji...@apache.org> ---
Trying to grok this... You seem to be mixing forward and reverse proxies
here...

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 55892] ProxyRemote with HTTPS backend sends requests with absoluteURI instead of abs_path

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55892

Hendrik Harms <he...@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |PatchAvailable

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 55892] ProxyRemote with HTTPS backend sends requests with absoluteURI instead of abs_path

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55892

--- Comment #1 from Hendrik Harms <he...@gmail.com> ---
Created attachment 31119
  --> https://issues.apache.org/bugzilla/attachment.cgi?id=31119&action=edit
patch for proxy_util.c

I like to handle HTTPS requests via forward-proxy to backend like direct
requests to backend.
This patch wants the "force-proxy-request-1.0" env to do so but I'm not sure
that this is really the intention of this switch.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 55892] ProxyRemote with HTTPS backend sends requests with absoluteURI instead of abs_path

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=55892

--- Comment #3 from Hendrik Harms <he...@gmail.com> ---
Created attachment 31255
  --> https://issues.apache.org/bugzilla/attachment.cgi?id=31255&action=edit
setup topology

ok, my setup is no very usual but there is no mixture between reverse and
forward proxy in the apache setup.

Like you can see on the picture (attachment) the Apache reverse proxy is only
allowed to connect a special HTTPS-Backend through a HTTP-ForwordProxy. The
Problem is that this backend could not serve absoluteURIs like defined in
rfc-2616. When using the ProxyRemote setup the Apache Reverse Proxy sends every
Request with absoluteURI. Also those tunneled with HTTPS though a
HTTP-ForwaredProxy.

I think sending HTTP-Requests to a ForwardProxy this behavior is ok but when
using a https tunnel it could cause problems.

The patch would be an enhancement to attach such broken backends.
Maybe the "force-proxy-request-1.0" switch is not the right one here.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org