Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
Subject: Re: mod_proxy_http2
From: Stefan Eissing <stefan.eissing@greenbytes.de>
In-Reply-To: 
 <CAKQ1sVPcnQN3BpNkVF4FDQ160TBuY=7sS58MPB-vP=dS5Tr6Qg@mail.gmail.com>
Date: Tue, 9 Feb 2016 18:21:08 +0100
Content-Transfer-Encoding: quoted-printable
Message-Id: <5904AE25-F5C5-442F-89DB-2E6945C079CD@greenbytes.de>
References: <CCC0EA0E-00CE-430D-A01C-022E7A2FFE16@greenbytes.de>
 <CAKQ1sVPcnQN3BpNkVF4FDQ160TBuY=7sS58MPB-vP=dS5Tr6Qg@mail.gmail.com>
To: dev@httpd.apache.org

I had the effect that when a socket was determined to be dead, the SNI =
was cleared and a new connection was made without any SNI. So, I save =
the first ssl_hostname I see and set that on every new connection.

> Am 09.02.2016 um 15:42 schrieb Yann Ylavic <ylavic.dev@gmail.com>:
>=20
> On Mon, Feb 8, 2016 at 6:07 PM, Stefan Eissing
> <stefan.eissing@greenbytes.de> wrote:
>>=20
>> One thing: the ssl_hostname that is used for SNI by the generic proxy =
utils seems to get lost when the socket needs to reset and is then not =
available on the next connect. That should affect mod_proxy_http as far =
as I can tell. Maybe someone with more experience in that module wants =
to take a look.
>=20
> This is intended (for http/1 at least), why is it an issue?
> When mod_proxy closes the backend connection, it indeed clears any
> associated SNI.
> But it sets the SNI for any new connection, based on the Host
> requested on that connection.
> Keep in mind that with "ProxyPreserveHost on" the requested Host may
> be the one given by the client, which may hence differ for each
> request (mod_proxy won't reuse a connection with a different SNI than
> the Host it requests).