Merge r1717816 from trunk:

Fix missing Upgrade headers on OPTION * requests, PR58688
Submitted by: wrowe
Reviewed/backported by: jim

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1729873 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/STATUS b/STATUS
index b5f46038d6ac78981b1331ca58294be054361dd4..7283baa9508f2545b1bd12ddeada526375b8bca9 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -112,15 +112,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
-  *) mod_ssl: Fix missing TLS Upgrade/Connection headers on OPTIONS * requests
-     (Note that this is simply a necessary band-aid, and still won't allow h2c
-     to peacefully coexist with tls/n.n upgrades, because Upgrade phase needs
-     to come earlier, not as a handler, and the bogus connection-close behavior
-     must be removed before the Protocol API can handle TLS upgrade.)
-     PR58688
-     trunk patch: http://svn.apache.org/r1717816
-     +1: wrowe, icing, ylavic
-
   *) mod_ssl: handle APR_TIMEUP on empty input by keeping connection state valid
               for later retries.
      trunk patch:  http://svn.apache.org/r1725940

diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
index 5a59dcc836923c19047b76a6ef5d50fd225a770c..381f3e016cc02cdd7eea75408b58b3ded4576300 100644 (file)
--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
@@ -246,6 +246,17 @@ int ssl_hook_ReadReq(request_rec *r)
         sslconn = myConnConfig(r->connection->master);
     }
     
+    /* If "SSLEngine optional" is configured, this is not an SSL
+     * connection, and this isn't a subrequest, send an Upgrade
+     * response header.  Note this must happen before map_to_storage
+     * and OPTIONS * request processing is completed.
+     */
+    if (sc->enabled == SSL_ENABLED_OPTIONAL && !(sslconn && sslconn->ssl)
+        && !r->main) {
+        apr_table_setn(r->headers_out, "Upgrade", "TLS/1.0, HTTP/1.1");
+        apr_table_mergen(r->headers_out, "Connection", "upgrade");
+    }
+
     if (!sslconn) {
         return DECLINED;
     }
@@ -1318,15 +1329,6 @@ int ssl_hook_Fixup(request_rec *r)
     SSL *ssl;
     int i;
 
-    /* If "SSLEngine optional" is configured, this is not an SSL
-     * connection, and this isn't a subrequest, send an Upgrade
-     * response header. */
-    if (sc->enabled == SSL_ENABLED_OPTIONAL && !(sslconn && sslconn->ssl)
-        && !r->main) {
-        apr_table_setn(r->headers_out, "Upgrade", "TLS/1.0, HTTP/1.1");
-        apr_table_mergen(r->headers_out, "Connection", "upgrade");
-    }
-
     if (!(sslconn && sslconn->ssl) && r->connection->master) {
         sslconn = myConnConfig(r->connection->master);
     }