From: Eric Covener <covener@apache.org>
Date: Tue, 29 Nov 2022 13:21:06 +0000 (+0000)
Subject: Merge r1903167  from trunk:
X-Git-Tag: 2.4.55-rc1-candidate~55
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c2e15a4c9df2868dc0d5b9bceca7ea8c8482a8f9;p=thirdparty%2Fapache%2Fhttpd.git

Merge r1903167  from trunk:

  *) mod_ssl: fix for PR66190.

Submitted by: icing
Reviewed by: icing, rpluem, ylavic

Github: closes #326


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1905607 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/CHANGES b/CHANGES
index f9fad4b1d89..282f3bae767 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,6 +1,12 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.4.55
 
+  *) mod_ssl: when a proxy connection had handled a request using SSL, an
+     error was logged when "SSLProxyEngine" was only configured in the
+     location/proxy section and not the overall server. The connection
+     continued to work, the error log was in error. Fixed PR66190.
+     [Stefan Eissing]
+
   *) mod_http2: Export mod_http2.h as public header. [Stefan Eissing]
 
   *) mod_md: a new directive `MDStoreLocks` can be used on cluster
diff --git a/modules/ssl/mod_ssl.c b/modules/ssl/mod_ssl.c
index 049578f9c5f..5b8c4d5326b 100644
--- a/modules/ssl/mod_ssl.c
+++ b/modules/ssl/mod_ssl.c
@@ -548,6 +548,13 @@ static int ssl_hook_ssl_bind_outgoing(conn_rec *c,
     int status;
 
     sslconn = ssl_init_connection_ctx(c, per_dir_config, 1);
+    if (sslconn->ssl) {
+        /* we are already bound to this connection. We have rebound
+         * or removed the reference to a previous per_dir_config,
+         * there is nothing more to do. */
+        return OK;
+    }
+
     status = ssl_engine_status(c, sslconn);
     if (enable_ssl) {
         if (status != OK) {
diff --git a/test/modules/proxy/test_01_http.py b/test/modules/proxy/test_01_http.py
index 1b79855d15a..77635652420 100644
--- a/test/modules/proxy/test_01_http.py
+++ b/test/modules/proxy/test_01_http.py
@@ -71,7 +71,6 @@ class TestProxyHttp:
         assert r.response["status"] == 200
         assert r.json['host'] == seen
 
-    @pytest.mark.skip(reason="needs backport of r1903167")
     def test_proxy_01_003(self, env):
         domain = f"test1.{env.http_tld}"
         conf = HttpdConf(env)