Merge r1553204, r1555240, r1572198 from trunk:

* Do not perform SNI / Host header comparison in case of a forward proxy request as
  in case of a forward proxy request the host header can not be used for virtual
  host selection in our webserver.

* Update comment. No functional change.

* Put a note in CHANGES about r1553204
Submitted by: rpluem
Reviewed by: rpluem, kbrand, wrowe

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1576713 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 92d65e250ecdd313cc9784a2cc3f2763ebea8662..19f051bd695f17561f0c892d01aabc8439e7fedc 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -16,6 +16,9 @@ Changes with Apache 2.2.27
   *) mod_ldap: Fix a potential memory leak or corruption.  PR 54936.
      [Zhenbo Xu <zhenbo1987 gmail com>]
 
+  *) mod_ssl: Do not perform SNI / Host header comparison in case of a
+     forward proxy request. [Ruediger Pluem]
+
   *) mod_rewrite: Add mod_rewrite.h to the headers installed on Windows. 
      PR46679 [Bob Ionescu]
 

diff --git a/STATUS b/STATUS
index 5bac689577273486765495ac414f46ab21158137..e3528c2c01250a96be087c53317f149f06e20353 100644 (file)
--- a/STATUS
+++ b/STATUS
@@ -98,16 +98,6 @@ RELEASE SHOWSTOPPERS:
 PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
   [ start all new proposals below, under PATCHES PROPOSED. ]
 
- * mod_ssl: Do not perform SNI / Host header comparison in case of a
-   forward proxy request.
-     Trunk version of patch:
-        http://svn.apache.org/r1553204
-        http://svn.apache.org/r1555240
-        http://svn.apache.org/r1572198
-     Backport version for 2.2.x of patch:
-        http://people.apache.org/~rpluem/patches/no_sni_check_forward_proxy_2.2.x.diff
-     +1: rpluem, kbrand, wrowe
-
  * mod_proxy: Cleanup the client to backend brigade before returning an error
               (if any) to avoid buckets lifetime issues (backend connection's
               pool destroyed before request's one). PR 50335.

diff --git a/modules/ssl/ssl_engine_kernel.c b/modules/ssl/ssl_engine_kernel.c
index 28bc47aae2d9549d52190b32cbc3907d89ede357..e3afc53a0585a230cc81bce4562ab6c7d152a307 100644 (file)
--- a/modules/ssl/ssl_engine_kernel.c
+++ b/modules/ssl/ssl_engine_kernel.c
@@ -96,49 +96,60 @@ int ssl_hook_ReadReq(request_rec *r)
         return DECLINED;
     }
 #ifndef OPENSSL_NO_TLSEXT
-    if ((servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) {
-        char *host, *scope_id;
-        apr_port_t port;
-        apr_status_t rv;
-
-        /*
-         * The SNI extension supplied a hostname. So don't accept requests
-         * with either no hostname or a different hostname.
-         */
-        if (!r->hostname) {
-            ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
-                        "Hostname %s provided via SNI, but no hostname"
-                        " provided in HTTP request", servername);
-            return HTTP_BAD_REQUEST;
-        }
-        rv = apr_parse_addr_port(&host, &scope_id, &port, r->hostname, r->pool);
-        if (rv != APR_SUCCESS || scope_id) {
-            return HTTP_BAD_REQUEST;
+    if (r->proxyreq != PROXYREQ_PROXY) {
+        if ((servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name))) {
+            char *host, *scope_id;
+            apr_port_t port;
+            apr_status_t rv;
+
+            /*
+             * The SNI extension supplied a hostname. So don't accept requests
+             * with either no hostname or a different hostname as this could
+             * cause us to end up in a different virtual host as the one that
+             * was used for the handshake causing different SSL parameters to
+             * be applied as SSLProtocol, SSLCACertificateFile/Path and
+             * SSLCADNRequestFile/Path cannot be renegotiated (SSLCA* due
+             * to current limitations in OpenSSL, see
+             * http://mail-archives.apache.org/mod_mbox/httpd-dev/200806.mbox/%3C48592955.2090303@velox.ch%3E
+             * and
+             * http://mail-archives.apache.org/mod_mbox/httpd-dev/201312.mbox/%3CCAKQ1sVNpOrdiBm-UPw1hEdSN7YQXRRjeaT-MCWbW_7mN%3DuFiOw%40mail.gmail.com%3E
+             * )
+             */
+            if (!r->hostname) {
+                ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
+                            "Hostname %s provided via SNI, but no hostname"
+                            " provided in HTTP request", servername);
+                return HTTP_BAD_REQUEST;
+            }
+            rv = apr_parse_addr_port(&host, &scope_id, &port, r->hostname, r->pool);
+            if (rv != APR_SUCCESS || scope_id) {
+                return HTTP_BAD_REQUEST;
+            }
+            if (strcasecmp(host, servername)) {
+                ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
+                            "Hostname %s provided via SNI and hostname %s provided"
+                            " via HTTP are different", servername, host);
+                return HTTP_BAD_REQUEST;
+            }
         }
-        if (strcasecmp(host, servername)) {
+        else if ((((mySrvConfig(r->server))->strict_sni_vhost_check
+                  == SSL_ENABLED_TRUE)
+                 || (mySrvConfig(sslconn->server))->strict_sni_vhost_check
+                    == SSL_ENABLED_TRUE)
+                 && r->connection->vhost_lookup_data) {
+            /*
+             * We are using a name based configuration here, but no hostname was
+             * provided via SNI. Don't allow that if are requested to do strict
+             * checking. Check wether this strict checking was setup either in the
+             * server config we used for handshaking or in our current server.
+             * This should avoid insecure configuration by accident.
+             */
             ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
-                        "Hostname %s provided via SNI and hostname %s provided"
-                        " via HTTP are different", servername, host);
-            return HTTP_BAD_REQUEST;
+                         "No hostname was provided via SNI for a name based"
+                         " virtual host");
+            return HTTP_FORBIDDEN;
         }
     }
-    else if ((((mySrvConfig(r->server))->strict_sni_vhost_check
-              == SSL_ENABLED_TRUE)
-             || (mySrvConfig(sslconn->server))->strict_sni_vhost_check
-                == SSL_ENABLED_TRUE)
-             && r->connection->vhost_lookup_data) {
-        /*
-         * We are using a name based configuration here, but no hostname was
-         * provided via SNI. Don't allow that if are requested to do strict
-         * checking. Check wether this strict checking was setup either in the
-         * server config we used for handshaking or in our current server.
-         * This should avoid insecure configuration by accident.
-         */
-        ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,
-                     "No hostname was provided via SNI for a name based"
-                     " virtual host");
-        return HTTP_FORBIDDEN;
-    }
 #endif
     SSL_set_app_data2(ssl, r);