svn commit: r1497470 - in /httpd/httpd/branches/2.2.x: CHANGES STATUS modules/proxy/mod_proxy_http.c

[wr...@apache.org]

Author: wrowe
Date: Thu Jun 27 17:29:17 2013
New Revision: 1497470

URL: http://svn.apache.org/r1497470
Log:
mod_proxy_http: Use the same hostname for SNI as for the HTTP request when
forwarding to SSL backends.

PR: 53134
Backports: r1333969
Submitted by: Michael Weiser <michael weiser.dinsnail.net>, rpluem
Reviewed by: covener, wrowe, rjung


Modified:
    httpd/httpd/branches/2.2.x/CHANGES
    httpd/httpd/branches/2.2.x/STATUS
    httpd/httpd/branches/2.2.x/modules/proxy/mod_proxy_http.c

Modified: httpd/httpd/branches/2.2.x/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/CHANGES?rev=1497470&r1=1497469&r2=1497470&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/CHANGES [utf-8] (original)
+++ httpd/httpd/branches/2.2.x/CHANGES [utf-8] Thu Jun 27 17:29:17 2013
@@ -20,6 +20,10 @@ Changes with Apache 2.2.25
   *) mod_ssl/proxy: enable the SNI extension for backend TLS connections
      [Kaspar Brand]
 
+  *) mod_proxy: Use the the same hostname for SNI as for the HTTP request when
+     forwarding to SSL backends. PR 53134.
+     [Michael Weiser <michael weiser.dinsnail.net>, Ruediger Pluem]
+
   *) mod_ssl: Quiet FIPS mode weak keys disabled and FIPS not selected emits
      in the error log to debug level.  [William Rowe]
 

Modified: httpd/httpd/branches/2.2.x/STATUS
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/STATUS?rev=1497470&r1=1497469&r2=1497470&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/STATUS (original)
+++ httpd/httpd/branches/2.2.x/STATUS Thu Jun 27 17:29:17 2013
@@ -96,14 +96,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
   
-   * mod_proxy_http: Use the same hostname for SNI as for the HTTP request when
-     forwarding to SSL backends.
-     PR: 53134
-     Based on a patch from: Michael Weiser <michael weiser.dinsnail.net>
-     trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1333969
-     2.4.x patch: http://svn.apache.org/viewvc?view=revision&revision=1356881
-     2.2.x patch: http://people.apache.org/~rjung/patches/mod_proxy_http-fix-hostname-ssl-2_2.patch
-     +1: covener, wrowe, rjung (w/r1175416 above applied first)
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]

Modified: httpd/httpd/branches/2.2.x/modules/proxy/mod_proxy_http.c
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/modules/proxy/mod_proxy_http.c?rev=1497470&r1=1497469&r2=1497470&view=diff
==============================================================================
--- httpd/httpd/branches/2.2.x/modules/proxy/mod_proxy_http.c (original)
+++ httpd/httpd/branches/2.2.x/modules/proxy/mod_proxy_http.c Thu Jun 27 17:29:17 2013
@@ -2023,8 +2023,22 @@ static int proxy_http_handler(request_re
          * so.
          */
         if (is_ssl) {
+            const char *ssl_hostname;
+
+            /*
+             * In the case of ProxyPreserveHost on use the hostname of
+             * the request if present otherwise use the one from the
+             * backend request URI.
+             */
+            if ((conf->preserve_host != 0) && (r->hostname != NULL)) {
+                ssl_hostname = r->hostname;
+            }
+            else {
+                ssl_hostname = uri->hostname;
+            }
+
             apr_table_set(backend->connection->notes, "proxy-request-hostname",
-                          uri->hostname);
+                          ssl_hostname);
         }
     }