You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@httpd.apache.org by Zisis Lianas <Zi...@consol.de> on 2012/09/05 19:08:31 UTC

Bug with "ProxyPass /" and mod_proxy_balancer + double-slashes (httpd-2.4.3)

There seems to be some problems when trying to proxy "/" with
ProxyPass and mod_proxy_balancer.

See also:
https://issues.apache.org/bugzilla/show_bug.cgi?id=51982
https://issues.apache.org/bugzilla/show_bug.cgi?id=51489

I could reproduce both errors in httpd-2.4.3:
  1) error 500 when configuring "ProxyPass / balancer://default"
  2) double-slash problem when backend returns 301



Sample config:
########################################
ProxyPreserveHost Off
<Proxy balancer://default>
    BalancerMember http://backend1.foo:5080 route=0
    BalancerMember http://backend2.foo:5080 route=1
    ProxySet lbmethod=bybusyness nofailover=off stickysession=JSESSIONID|jsessionid
</Proxy>

ProxyPass / balancer://default
ProxyPassReverse / balancer://default
########################################


1)
When configuring "ProxyPass / balancer://default", an error 500
occurs. When using a different ProxyPassMatch config, everything
works fine, e.g.: ProxyPassMatch ^/(.*)$ balancer://default/$1

I broke it down to mod_proxy.c::ap_proxy_trans_match().
"r->filename" resp. "found" is set to "proxy:balancer://defaultclusterjsp"
when for e.g. the URL "http://mydomain.foo/clusterjsp" is called.
"r->filename" should be "proxy:balancer://default/clusterjsp".

I wrote a patch for httpd-2.4.3 (attached) - maybe someone can
review and improve it to get it finally in trunk.


2)
When the patch from 1) is applied, you will run into another problem.
On 301 from backend, an dispensable "/" will be prepended to the URI.
E.g. when you call http://mydomain.foo:8080/clusterjsp in you browser, the
redirect location will be set wrong:
Location: http://mydomain.foo:8080//clusterjsp/

This will result in session problems... (cookie path is "/clusterjsp" and
not "//clusterjsp").

See attached logfile for more details.

A patch was proposed in https://issues.apache.org/bugzilla/show_bug.cgi?id=51489
for httpd-2.4.x, which is working for me.

I did a quick check with:
u = apr_pstrcat(r->pool, (strcmp(ent[i].fake, "/") == 0 ? "" : ent[i].fake), &url[l2], NULL);




regards,
zisis

Re: Bug with "ProxyPass /" and mod_proxy_balancer + double-slashes (httpd-2.4.3)

Posted by Tom Evans <te...@googlemail.com>.

On Thu, Sep 6, 2012 at 4:07 PM, Zisis Lianas <Zi...@consol.de> wrote:
> Tom, thanks for your feedback.
>
> The main difference between our configurations is that you do
> ProxyPassReverse the single BalancerMember (http://app05/...),
> which is also working for me - in my configuration I ProxyPassReverse
> the "balancer://cluster". And this is the configuration which does
> not work correctly.
>
> So...
>  ProxyPassReverse / http://app05/ => WORKS
>  ProxyPassReverse / balancer://cluster/ => DOES NOT WORK CORRECTLY
>
> As documented the balancer://... ProxyPassReverse should work:
> http://httpd.apache.org/docs/2.4/mod/mod_proxy_balancer.html#example
>
>
> So I think this is a bug.
>

Hmm, I'd have to check that, I thought ProxyPassReverse was straight
up string replacement, clearly not.

Cheers

Tom

Re: Bug with "ProxyPass /" and mod_proxy_balancer + double-slashes (httpd-2.4.3)

Posted by Micha Lenk <mi...@lenk.info>.

Hi Zisis,

Am 06.09.2012 08:07, schrieb Zisis Lianas:
> Tom, thanks for your feedback.
>
> The main difference between our configurations is that you do
> ProxyPassReverse the single BalancerMember (http://app05/...),
> which is also working for me - in my configuration I ProxyPassReverse
> the "balancer://cluster". And this is the configuration which does
> not work correctly.
>
> So...
>   ProxyPassReverse / http://app05/ =>  WORKS
>   ProxyPassReverse / balancer://cluster/ =>  DOES NOT WORK CORRECTLY
>
> As documented the balancer://... ProxyPassReverse should work:
> http://httpd.apache.org/docs/2.4/mod/mod_proxy_balancer.html#example
>
> So I think this is a bug.

As Tom confirmed, this is a bug not with ProxyPass but with 
ProxyPassReverse, which I also tried to report as issue #51489 (thanks 
for mentioning it). I already traced it down with gdb to one particular 
code path that seems to be broken. Checkout my most recently patch 
attached to issue #51489 for details.

Jim, you asked what exactly DOES NOT WORK CORRECTLY mean, I will try to 
describe that again in my own words. It means that ProxyPassReverse does 
its job, but adds an additional slash to the redirect target URL, which 
is inserted after the hostname. E.g. if the HTTP response from backend 
with status code 301 contains a Location header like this:

Location: http://backend01.foo:5080/clusterjsp/

then the HTTP response from reverse proxying Apache after processing the 
ProxyPassReverse configuration would look like this:

Location: http://mydomain.foo:8080//clusterjsp/
                                    ^--- this slash shouldn't be there

If you leave out the trailing slash in the ProxyPassReverse directive, 
Apache is unable to process the request (HTTP 500 error mentioned by 
Zisis) due to the broken configuration. If the ProxyPassReverse 
configuration matches the ProxyPass configuration, you get the 
additional slash.

As I wrote already above, I analyzed the code flow already and 
identified where in the code the problem exists. Apparently the corner 
case is hit when the destination URL in ProxyPassReverse has a 
slash-only path component (i.e. '/').

The available patch attached to issue #51489 should fix the issue, 
however someone more familiar with the Apache code should probably 
review the patch before applying it in SVN.

Regards,
Micha