You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2012/04/23 16:30:37 UTC

DO NOT REPLY [Bug 53134] New: SNI with Host header preservation through reverse proxy

https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

             Bug #: 53134
           Summary: SNI with Host header preservation through reverse
                    proxy
           Product: Apache httpd-2
           Version: 2.4-HEAD
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: enhancement
          Priority: P2
         Component: mod_proxy_http
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: michael@weiser.dinsnail.net
    Classification: Unclassified


As discussed on httpd-users
(http://mail-archives.apache.org/mod_mbox/httpd-users/201204.mbox/%3C20120406121150.GC22138@dinsnail.net%3E)
and httpd-dev
(http://mail-archives.apache.org/mod_mbox/httpd-dev/201204.mbox/%3C4F7F6F8C.5020409@primary.net%3E),
httpd-2.4 and later reverse proxies use SNI towards the backend server. If
ProxyPreserveHost is turned On, a mismatch between Host header and SNI data can
occur which may cause the backend server to deny the request. This could be
fixed by extracting the Host header from the request and putting its hostname
into the SNI data.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

--- Comment #7 from Ruediger Pluem <rp...@apache.org> ---
Proposed for backport to 2.4.x as r1338662.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

--- Comment #10 from Michael Weiser <mi...@weiser.dinsnail.net> ---
When I checked (April 2012), 2.2 couldn't do SNI when reverse proxying. A
backport (of just the fix) is mute then...

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

--- Comment #5 from Ruediger Pluem <rp...@apache.org> ---
Committed to trunk as r1333969. Thanks for testing.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

--- Comment #9 from Rainer Jung <ra...@kippdata.de> ---
Released with 2.4.3.
Proposed for 2.2.x.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

--- Comment #2 from Michael Weiser <mi...@weiser.dinsnail.net> 2012-04-23 14:52:09 UTC ---
I forgot: The patch is against httpd-trunk as of 2012-04-22. But it also
applies against httpd-2.4 HEAD as of the same date.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

Michael Weiser <mi...@weiser.dinsnail.net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #11 from Michael Weiser <mi...@weiser.dinsnail.net> ---
I can confirm that the problem is fixed in 2.4.3. As far as I am concerned, the
bug can be closed. Thank you for all your help.

BTW: I'm now facing a follow-up problem with subjectAltNames for which I've
opened another bug #54030 with patches for 2.4.2 and trunk.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

--- Comment #3 from Ruediger Pluem <rp...@apache.org> ---
Created attachment 28697
  --> https://issues.apache.org/bugzilla/attachment.cgi?id=28697&action=edit
Slightly different approach

I think it is better to use r->hostname instead of reparsing the host header
again. Can you please check if this patch works for you as well?

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

--- Comment #4 from Michael Weiser <mi...@weiser.dinsnail.net> ---
(In reply to comment #3)
> Can you please check if this patch works for you as well?

Yes, your patch works fine.

-- 
You are receiving this mail because:
You are the assignee for the bug.

[Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

--- Comment #8 from Stefan Fritsch <sf...@sfritsch.de> ---
Will be in 2.4.3: r1356881

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

--- Comment #6 from Michael Weiser <mi...@weiser.dinsnail.net> ---
Will this automaticlly show up in a 2.4.x release or do I need to do something
more to make it happen?

-- 
You are receiving this mail because:
You are the assignee for the bug.

DO NOT REPLY [Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

--- Comment #1 from Michael Weiser <mi...@weiser.dinsnail.net> 2012-04-23 14:33:21 UTC ---
Created attachment 28658
  --> https://issues.apache.org/bugzilla/attachment.cgi?id=28658
use Host header for SNI data if ProxyPreserveHost is on

This patch parses the Host header, extracts the hostname and uses it for the CN
check and SNI data if ProxyPreserveHost is On. This fixes the issue for me.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 53134] SNI with Host header preservation through reverse proxy

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=53134

Ruediger Pluem <rp...@apache.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |FixedInTrunk,
                   |                            |PatchAvailable

-- 
You are receiving this mail because:
You are the assignee for the bug.