Weird SSL issue with module

[Joe Nardone <jn...@gmail.com>]

We have an existing module on 1.3 which we're porting (finally) to
2.2.  This is primarily a set of content handlers.

I'm seeing strange SSL behavior (all of our clients connect to this
through SSL).  Specifically, under 1.3 when our module would write
data (ap_rprintf) and then return OK, the headers and data would
return in the same single SSL record.

Under 2.2, it appears that no matter what I do, the headers and data
are being sent in two separate SSL records in the response.  This is
true at least for POST requests.

We have a lot (thousands) of clients using in-house written code that
(unfortunately) expects/requires that the entire response
(headers+data) is in a single SSL record.  We do not have any way to
upgrade the remote agents so the behavior has to be identical.

Does anyone know if this is something that needs to change in code, or
is something in mod_ssl's config, or is not possible?

Thanks for any leads.  It's been a frustrating search so far.

joe

Re: Weird SSL issue with module

["Joe N." <jn...@gmail.com>]

On Mon, Sep 21, 2009 at 23:14, Joe Nardone <jn...@gmail.com> wrote:
>>> Under 2.2, it appears that no matter what I do, the headers and data
>>> are being sent in two separate SSL records in the response.  This is
>>> true at least for POST requests.
>>>       
So, in response to myself (and anyone else who might find this in the 
future)... the sending of headers vs. data is deep in the code; the 
headers are passed in the first bucket, the data starting in the 2nd, 
and the much-nicer brigade code in 2.x dutifully calls SSL_write for 
each bucket as it streams through, creating the individual records.

One solution is to change mod_ssl or the core server code, but I don't 
want to do that -- this prevents upgrading the "main" software for 
security reasons without recompilation.  What I think I can do is write 
an upstream output filter that simply snags the first data bucket in the 
first brigade and waits for the 2nd and simply concatenates their 
contents together (as a new bucket attached to the head of the 2nd 
brigade).  From the looks of it this should be pretty easy, but I'm 
still getting used to 2.2's architecture.

Thanks,

Joe

Re: Weird SSL issue with module

[Joe Nardone <jn...@gmail.com>]

> On Mon, Sep 21, 2009 at 23:14, Joe Nardone <jn...@gmail.com> wrote:
>> Under 2.2, it appears that no matter what I do, the headers and data
>> are being sent in two separate SSL records in the response.  This is
>> true at least for POST requests.
>
> How large are these POST requests, Joe? I ask because SSL_read()
> doesn't support records > 16 kB (which may or may not be the maximum
> size for TLS records - it probably is, but don't take my word for it).
>
> http://www.openssl.org/docs/ssl/SSL_read.html
>

The request size isn't the problem (and you can have requests larger
than 16k, it's just in more than one data record/fragment).  The
problem is the response -- regardless of response size (even a few
bytes), the headers and data are being sent in separate segments
despite comments in the source indicating this should not occur.  I
have a content-length header, so it's not an issue of chunking.  I
guess I'm going to have to roll my own httpd/mod_ssl with more
debugging and try and unwind this.

joe

Re: Weird SSL issue with module

[Ben Noordhuis <in...@bnoordhuis.nl>]

On Mon, Sep 21, 2009 at 23:14, Joe Nardone <jn...@gmail.com> wrote:
> Under 2.2, it appears that no matter what I do, the headers and data
> are being sent in two separate SSL records in the response.  This is
> true at least for POST requests.

How large are these POST requests, Joe? I ask because SSL_read()
doesn't support records > 16 kB (which may or may not be the maximum
size for TLS records - it probably is, but don't take my word for it).

http://www.openssl.org/docs/ssl/SSL_read.html