You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Yann Ylavic <yl...@gmail.com> on 2014/04/24 15:05:09 UTC

SSL backend via ProxyRemote (using CONNECT)

Hello,

with the following (chained) configuration :

<VirtualHost 127.0.0.1:80>
    ServerName reverse-proxy
    ProxyPass / https://backend:443/
    ProxyRemote * http://proxy:8080
    #ProxyRequests off
</VirtualHost>

<VirtualHost 127.0.0.1:8080>
    ServerName forward-proxy
    ProxyRequests on
</VirtualHost>

<VirtualHost 127.0.0.1:443>
    ServerName backend
    ## Whatever ###
</VirtualHost>

Then, when the reverse-proxy receives a request-line like :
    GET /index.php HTTP/1.1
    Host: reverse-proxy
    ...

It forwards this one(s) to the backend :
    > CONNECT backend:443 HTTP/1.0
    < HTTP/1.0 200 Established
    < SSL stream now (note the full URL in the request-line) >
    GET https://backend/index.php HTTP/1.1
    Host: backend
    ...

I agree that ProxyRemote is supposed to be a forward proxy (hence the
full URL when requesting plain HTTP through it, with GET
http://backend/index.php HTTP/1.1), but the final backend is not (and
may even refuse full URLs, which is actually a case I'm facing).

Am I missing something or should this be fixed when CONNECT is used by
ProxyRemote?
In the latter case, should it depend on "ProxyRequests off" only (to
not break existing)?

That could be done with this patch (where ProxyRequests' dependency is
commented out):

Index: modules/proxy/proxy_util.c
===================================================================
--- modules/proxy/proxy_util.c    (revision 1589129)
+++ modules/proxy/proxy_util.c    (working copy)
@@ -2186,7 +2313,7 @@ ap_proxy_determine_connection(apr_pool_t *p, reque
      * short living pool.
      */
     /* are we connecting directly, or via a proxy? */
-    if (!proxyname) {
+    if (!proxyname || (conn->is_ssl/* && conf->req_set && !conf->req*/)) {
         *url = apr_pstrcat(p, uri->path, uri->query ? "?" : "",
                            uri->query ? uri->query : "",
                            uri->fragment ? "#" : "",
[END]

Regards,
Yann.

Re: SSL backend via ProxyRemote (using CONNECT)

Posted by Yann Ylavic <yl...@gmail.com>.
On Thu, Apr 24, 2014 at 3:37 PM, Yann Ylavic <yl...@gmail.com> wrote:
> On Thu, Apr 24, 2014 at 3:29 PM, Plüm, Rüdiger, Vodafone Group
> <ru...@vodafone.com> wrote:
>>
>> IMHO this is a flaw of the backend as IMHO full URL's are allowed also in non proxy cases by the RFC.
>
> I agree, but I can't do anything on the (broken) backend side, proxy only...
> I can live with my patch, but mod_proxy isn't doing the right thing
> either, IMHO.

Moreover, in the case the backend handles full URLs, the host name
from there has precedence, which makes the Host header ignored, and
may break things like ProxyPreserveHost (suppose IP addresses are used
in ProxyPass declarations)...

>
> Regards,
> Yann.

Re: SSL backend via ProxyRemote (using CONNECT)

Posted by Yann Ylavic <yl...@gmail.com>.
On Thu, Apr 24, 2014 at 3:29 PM, Plüm, Rüdiger, Vodafone Group
<ru...@vodafone.com> wrote:
>
> IMHO this is a flaw of the backend as IMHO full URL's are allowed also in non proxy cases by the RFC.

I agree, but I can't do anything on the (broken) backend side, proxy only...
I can live with my patch, but mod_proxy isn't doing the right thing
either, IMHO.

Regards,
Yann.

RE: SSL backend via ProxyRemote (using CONNECT)

Posted by Plüm, Rüdiger, Vodafone Group <ru...@vodafone.com>.

> -----Original Message-----
> From: Yann Ylavic [mailto:ylavic.dev@gmail.com]
> Sent: Donnerstag, 24. April 2014 15:05
> To: httpd
> Subject: SSL backend via ProxyRemote (using CONNECT)
> 
> Hello,
> 
> with the following (chained) configuration :
> 
> <VirtualHost 127.0.0.1:80>
>     ServerName reverse-proxy
>     ProxyPass / https://backend:443/
>     ProxyRemote * http://proxy:8080
>     #ProxyRequests off
> </VirtualHost>
> 
> <VirtualHost 127.0.0.1:8080>
>     ServerName forward-proxy
>     ProxyRequests on
> </VirtualHost>
> 
> <VirtualHost 127.0.0.1:443>
>     ServerName backend
>     ## Whatever ###
> </VirtualHost>
> 
> Then, when the reverse-proxy receives a request-line like :
>     GET /index.php HTTP/1.1
>     Host: reverse-proxy
>     ...
> 
> It forwards this one(s) to the backend :
>     > CONNECT backend:443 HTTP/1.0
>     < HTTP/1.0 200 Established
>     < SSL stream now (note the full URL in the request-line) >
>     GET https://backend/index.php HTTP/1.1
>     Host: backend
>     ...
> 
> I agree that ProxyRemote is supposed to be a forward proxy (hence the
> full URL when requesting plain HTTP through it, with GET
> http://backend/index.php HTTP/1.1), but the final backend is not (and
> may even refuse full URLs, which is actually a case I'm facing).

IMHO this is a flaw of the backend as IMHO full URL's are allowed also in non proxy cases by the RFC.

Regards

Rüdiger