Re: Siteminder/mod_proxy issues

[Graham Leggett <mi...@sharp.fm>]

Martijn Schoemaker wrote:

> I put back an old libproxy.so from our (working) version shipped
> with apache 1.3.12 into apach 1.3.26. And when I sniff the whole
> kit'n kaboodle again I don't see the cookie duplication! If I put
> back the version of 1.3.26, I DO see cookie duplication!

If you can sniff the connection both sides (turn off SSL for testing, or 
use something like openssl s_client and speak HTTP directly to the 
server) then we can see what is happening on either side.

Regards,
Graham
-- 
-----------------------------------------
minfrin@sharp.fm 
	"There's a moon
					over Bourbon Street
						tonight..."

Re: Siteminder/mod_proxy issues

[Graham Leggett <mi...@sharp.fm>]

Martijn Schoemaker wrote:

> Ok guys, I think I found the problem.

> Now I think this is enough proof to say that the 'old' manual
> ap_overlay_tables() line (539 in my proxy_http.c file) can be
> (ehm MUST be) removed from the code since is now causes dup-
> lication of headers which again triggers a lot of other pro-
> blems ....
> 
> Do y'all concur in this one ?

Good catch... I scratched my head for ages trying to figure out what 
gives on this one.

Will commit a fix...

Regards,
Graham
-- 
-----------------------------------------
minfrin@sharp.fm 
	"There's a moon
					over Bourbon Street
						tonight..."

Re: Siteminder/mod_proxy issues

[Martijn Schoemaker <ma...@osp.nl>]

Ok guys, I think I found the problem.

This is really a mod_proxy issue since the sending of headers
changed with the http 1.1 patch which was created by Graham.

In the 'old' version (1.3.12) the mod_proxy uses ap_table_do()
to send out all headers directly. Since the siteminder headers
were in err_headers_out, they needed to be concatenated to the
output response headers otherwise they would get lost. For this
there was a patch, provided by siteminder, which added an
ap_overlay_tables() to concatenate the err_headers to the response
headers which were sent directly. This patch was also incor-
porated in the mod_proxy source. (dunno from which version)

Now, in the new mod_proxy, ap_table_do() is no longer used to
send out the headers, but ap_send_http_headers() is used. And
in this method it does another concatenate of the err_headers
to the output response headers. Since the siteminder headers
were still in here, they were concatenated twice. Once by the
previously added ap_overlay_tables() (originally put in to
do what ap_send_http_headers() already does already) and once
in the ap_send_http_headers().

Now I think this is enough proof to say that the 'old' manual
ap_overlay_tables() line (539 in my proxy_http.c file) can be
(ehm MUST be) removed from the code since is now causes dup-
lication of headers which again triggers a lot of other pro-
blems ....

Do y'all concur in this one ?

Cheers,
Martijn Schoemaker

--
You have reached the end of the message.
Press [t] to go to the top of this message, or [c] to close it.