mod_proxy_http: Use the same hostname for SNI as for the HTTP request when

forwarding to SSL backends.

PR: 53134
Backports: r1333969
Submitted by: Michael Weiser <michael weiser.dinsnail.net>, rpluem
Reviewed by: covener, wrowe, rjung

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1497470 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index c7b2c6c4b16932cee65385167af345461b9c0422..f4f25b6f3cbde45fad5406683f78d4f5cbec9419 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -20,6 +20,10 @@ Changes with Apache 2.2.25
   *) mod_ssl/proxy: enable the SNI extension for backend TLS connections
      [Kaspar Brand]
 
+  *) mod_proxy: Use the the same hostname for SNI as for the HTTP request when
+     forwarding to SSL backends. PR 53134.
+     [Michael Weiser <michael weiser.dinsnail.net>, Ruediger Pluem]
+
   *) mod_ssl: Quiet FIPS mode weak keys disabled and FIPS not selected emits
      in the error log to debug level.  [William Rowe]
 

diff --git a/STATUS b/STATUS
index 716833afb08e48d94bf59dd14a6c113ab4d9d56a..e41c99b12075cf58c108f2c4239469c5a9f92502 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -96,14 +96,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
   
-   * mod_proxy_http: Use the same hostname for SNI as for the HTTP request when
-     forwarding to SSL backends.
-     PR: 53134
-     Based on a patch from: Michael Weiser <michael weiser.dinsnail.net>
-     trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1333969
-     2.4.x patch: http://svn.apache.org/viewvc?view=revision&revision=1356881
-     2.2.x patch: http://people.apache.org/~rjung/patches/mod_proxy_http-fix-hostname-ssl-2_2.patch
-     +1: covener, wrowe, rjung (w/r1175416 above applied first)
 
 PATCHES PROPOSED TO BACKPORT FROM TRUNK:
   [ New proposals should be added at the end of the list ]

diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
index ba01c68152fc18c8d44052e6809aede681a1c7df..072c24a36f1fbb98aaaa084244066d6b14f3c8bb 100644 (file)
--- a/modules/proxy/mod_proxy_http.c
+++ b/modules/proxy/mod_proxy_http.c
@@ -2023,8 +2023,22 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
          * so.
          */
         if (is_ssl) {
+            const char *ssl_hostname;
+
+            /*
+             * In the case of ProxyPreserveHost on use the hostname of
+             * the request if present otherwise use the one from the
+             * backend request URI.
+             */
+            if ((conf->preserve_host != 0) && (r->hostname != NULL)) {
+                ssl_hostname = r->hostname;
+            }
+            else {
+                ssl_hostname = uri->hostname;
+            }
+
             apr_table_set(backend->connection->notes, "proxy-request-hostname",
-                          uri->hostname);
+                          ssl_hostname);
         }
     }