Merge r684351, r686549 from trunk:

* Introduce environment variable proxy-initial-not-pooled to avoid reusing
  pooled connections if the client connection is an initial connection.
  This avoids the "proxy: error reading status line from remote server"
  error caused by the race condition that the backend server closed the
  connection after the connection check on our side and before our data
  reached the backend. Yes, this downgrades performance, especially with
  HTTP/1.0 clients. Hence it is configurable and off by default.

PR: 37770

* Add missing documentation for proxy-initial-not-pooled (r684351).

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@691230 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index b501405b352dc80febbcb81f6e638152ac6683d7..2bcc04279d85439853497b183d568c502c7cb2bc 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -5,6 +5,10 @@ Changes with Apache 2.2.10
      mod_proxy_ftp: Prevent XSS attacks when using wildcards in the path of
      the FTP URL. Discovered by Marc Bevand of Rapid7. [Ruediger Pluem]
 
+  *) mod_proxy_http: Introduce environment variable proxy-initial-not-pooled to
+     avoid reusing pooled connections if the client connection is an initial
+     connection. PR 37770. [Ruediger Pluem]
+
   *) mod_rewrite: Allow Cookie option to set secure and HttpOnly flags.
      PR 44799 [Christian Wenz <christian wenz.org>]
 

diff --git a/docs/manual/env.xml b/docs/manual/env.xml
index 125dd753bfd4f95b326971399174116bbf753862..0e3acf3271be4397afec15f2eb0abbf9c928c235 100644 (file)
--- a/docs/manual/env.xml
+++ b/docs/manual/env.xml
@@ -390,7 +390,7 @@
    </section>
 
    <section id="proxy"><title>force-proxy-request-1.0, proxy-nokeepalive, proxy-sendchunked,
-   proxy-sendcl, proxy-chain-auth, proxy-interim-response</title>
+   proxy-sendcl, proxy-chain-auth, proxy-interim-response, proxy-initial-not-pooled</title>
 
    <p>These directives alter the protocol behavior of
    <module>mod_proxy</module>.  See the <module>mod_proxy</module> and <module>mod_proxy_http</module>

diff --git a/docs/manual/mod/mod_proxy_http.xml b/docs/manual/mod/mod_proxy_http.xml
index f92a86facc2e18fd22ecf31688f266f32f2f3722..1d7ae94191d702be24461b7126fc3804c9a116df 100644 (file)
--- a/docs/manual/mod/mod_proxy_http.xml
+++ b/docs/manual/mod/mod_proxy_http.xml
@@ -101,6 +101,16 @@
         <code>proxy-interim-response RFC</code> to be fully protocol
         compliant, or <code>proxy-interim-response Suppress</code>
         to suppress interim responses.</dd>
+        <dt>proxy-initial-not-pooled</dt>
+        <dd>If this variable is set no pooled connection will be reused
+        if the client connection is an initial connection. This avoids
+        the "proxy: error reading status line from remote server" error message
+        caused by the race condition that the backend server closed the
+        pooled connection after the connection check by the proxy and
+        before data send by the proxy reached the backend. It has to be
+        kept in mind that setting this variable downgrades performance,
+        especially with HTTP/1.0 clients.
+        </dd>
     </dl>
 </section>
 

diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
index b8dcbbaa0843ed0f165c08c1f7a6f7f4176a56c6..791c1dba499a63cb3d6fa280f053d154b8895086 100644 (file)
--- a/modules/proxy/mod_proxy_http.c
+++ b/modules/proxy/mod_proxy_http.c
@@ -1929,6 +1929,19 @@ static int proxy_http_handler(request_rec *r, proxy_worker *worker,
         ap_proxy_ssl_connection_cleanup(backend, r);
     }
 
+    /*
+     * In the case that we are handling a reverse proxy connection and this
+     * is not a request that is coming over an already kept alive connection
+     * with the client, do NOT reuse the connection to the backend, because
+     * we cannot forward a failure to the client in this case as the client
+     * does NOT expects this in this situation.
+     * Yes, this creates a performance penalty.
+     */
+    if ((r->proxyreq == PROXYREQ_REVERSE) && (!c->keepalives)
+        && (apr_table_get(r->subprocess_env, "proxy-initial-not-pooled"))) {
+        backend->close = 1;
+    }
+
     /* Step One: Determine Who To Connect To */
     if ((status = ap_proxy_determine_connection(p, r, conf, worker, backend,
                                                 uri, &url, proxyname,

diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c
index 6b3b13a338736a9595f9083f69fa4ee969815b5c..abc056cd5359fdf89c842864b7ae3dd3d1ef6641 100644 (file)
--- a/modules/proxy/proxy_util.c
+++ b/modules/proxy/proxy_util.c
@@ -2168,6 +2168,11 @@ ap_proxy_determine_connection(apr_pool_t *p, request_rec *r,
     else {
         conn->addr = worker->cp->addr;
     }
+    /* Close a possible existing socket if we are told to do so */
+    if (conn->close) {
+        socket_cleanup(conn);
+        conn->close = 0;
+    }
 
     if (err != APR_SUCCESS) {
         return ap_proxyerror(r, HTTP_BAD_GATEWAY,