Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: local policy)
From: Pavel =?utf-8?B?TWF0xJtqYQ==?= <pavel@netsafe.cz>
To: dev@httpd.apache.org
Subject: Re: Re: Behavior of Host: vs. SNI Hostname in proxy CONNECT requests
Date: Tue, 18 Feb 2014 14:14:31 +0100
Message-ID: <5144800.Zjx3nWxCiJ@nudel>
Organization: Netsafe Solutions, s.r.o.
User-Agent: KMail/4.11.5 (Linux/3.13-trunk-amd64; KDE/4.11.5; x86_64; ; )
In-Reply-To: <52B08B76.6060600@velox.ch>
References: <20131125155541.66e19919@hub> <52943239.9080607@velox.ch>
 <52B08B76.6060600@velox.ch>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain; charset="UTF-8"

Dne =C3=9At 17. prosince 2013 18:35:50, Kaspar Brand napsal(a):
> On 26.11.2013 06:31, Kaspar Brand wrote:
> > As far as PR 55782 is concerned, the problem might be that
> > proxy_util.c:ap_proxy_determine_connection() does not take Host: he=
ader
> > differences into account when checking if an existing connection ca=
n be
> > reused (not sure). With SNI this would have the effect that the hos=
tname
> > from the TLS handshake is causing the mismatch with the Host: heade=
r.
>=20
> To clear this up: the above guess was a red herring. mod_proxy's curr=
ent
> behavior is fine in this aspect and does not conflict with any IP res=
olution
> "coincidence" when reverse proxying SNI-based URLs (I'm aware that th=
is
> thread is supposed to deal with forward proxying only, but am adding =
this
> for posterity, in case someone is sifting through archives).
>=20
> It's not ap_proxy_determine_connection() which is really relevant, bu=
t
> proxy_util.c:ap_proxy_get_worker() instead. mod_proxy (only) reuses w=
orkers
> for reverse proxying based on the target URL; looking at
> proxy_util.c:ap_proxy_get_worker() in 2.4 e.g we see:
>=20
>     /*
>      * Do a "longest match" on the worker name to find the worker tha=
t
>      * fits best to the URL, but keep in mind that we must have at le=
ast
>      * a minimum matching of length min_match such that
>      * scheme://hostname[:port] matches between worker and url.
>      */
>=20
>     if (balancer) {
>         proxy_worker **workers =3D (proxy_worker **)balancer->workers=
->elts;
>         for (i =3D 0; i < balancer->workers->nelts; i++, workers++) {=

>             worker =3D *workers;
>             if ( ((worker_name_length =3D strlen(worker->s->name)) <=3D=

> url_length) && (worker_name_length >=3D min_match)
>                 && (worker_name_length > max_match)
>                 && (strncmp(url_copy, worker->s->name, worker_name_le=
ngth)
> =3D=3D 0) ) { max_worker =3D worker;
>                 max_match =3D worker_name_length;
>             }
>=20
>         }
>     } else {
>         worker =3D (proxy_worker *)conf->workers->elts;
>         for (i =3D 0; i < conf->workers->nelts; i++, worker++) {
>             if ( ((worker_name_length =3D strlen(worker->s->name)) <=3D=

> url_length) && (worker_name_length >=3D min_match)
>                 && (worker_name_length > max_match)
>                 && (strncmp(url_copy, worker->s->name, worker_name_le=
ngth)
> =3D=3D 0) ) { max_worker =3D worker;
>                 max_match =3D worker_name_length;
>             }
>         }
>     }
>=20
> I.e., there's no risk of two workers for reverse proxying, say,
> https://foo.example.net and https://bar.example.net, ever being reuse=
d for
> each other, irrespective of whether foo.example.net and bar.example.n=
et
> resolve to the same IP address.
>=20
> Kaspar

Hi,
sorry for late follow-up but you are wrong.
There is one big risk when someone uses reverse HTTPS proxy with Server=
Alias.

Let say you have on both - backend and proxy servers options:
ServerName www.example.com
ServerAlias example.com

In old non-SNI days everything was working just fine.

Now when one client connects to proxy and requires www.example.com, con=
nection=20
is established to backend server with SNI hostname set to www.example.c=
om.
Second client connects to proxy and requires example.com. Worker is mat=
ched=20
because there is just one. Connection is reused but you will get 4xx Ba=
d=20
Request because there is mismatch between old and current SNI hostname.=


It's kind of heisenbug because even tons of request to example.com only=
 or to=20
www.example.com only are just fine. You have to request both sites at t=
he same=20
time to realize what's going on.
--=20
Pavel Mateja