Mailing List Archive: Apache: Bugs

[Bug 29744] CONNECT does not work over existing SSL connection

Index | Next | Previous | View Threaded

bugzilla at apache

Nov 14, 2009, 3:39 AM

Post #1 of 9 (1009 views)
Permalink

[Bug 29744] CONNECT does not work over existing SSL connection

https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

Stoyan Ivanov <tonibony [at] gmail> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |tonibony [at] gmail

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Nov 25, 2009, 10:31 AM

Post #2 of 9 (932 views)
Permalink

[Bug 29744] CONNECT does not work over existing SSL connection [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

ivan.krivyakov [at] sungard changed:

What |Removed |Added
----------------------------------------------------------------------------
Attachment #23840|0 |1
is obsolete| |

--- Comment #95 from ivan.krivyakov [at] sungard 2009-11-25 10:31:36 UTC ---
Created an attachment (id=24615)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=24615)
Patch for version 2.2.14

This is a patch for version 2.2.14. It is more or less mechanically derived
from the 2.2.11 patch. I compiled this version and it seems to work fine for
me.

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Nov 25, 2009, 10:38 AM

Post #3 of 9 (967 views)
Permalink

[Bug 29744] CONNECT does not work over existing SSL connection [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

--- Comment #96 from Ivan Krivyakov <ivan.krivyakov [at] sungard> 2009-11-25 10:38:37 UTC ---
Created an attachment (id=24616)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=24616)
Win32 binary for patched version 2.2.14

Compiled patched version 2.2.14. It is installed on my server and seems to work
OK.

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Nov 28, 2009, 8:33 AM

Post #4 of 9 (915 views)
Permalink

[Bug 29744] CONNECT does not work over existing SSL connection [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

--- Comment #97 from Kevin Croft <krcroft [at] gmail> 2009-11-28 08:33:26 UTC ---
(In reply to comment #95)
> Created an attachment (id=24615)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=24615) [details]
> Patch for version 2.2.14
>
> This is a patch for version 2.2.14. It is more or less mechanically derived
> from the 2.2.11 patch. I compiled this version and it seems to work fine for
> me.

Have you tried applying this patch to the 2.2.14 sources?

# wget -O - http://apache.mirror.rafal.ca/httpd/httpd-2.2.14.tar.bz2 | tar jx
# cd httpd-2.2.14/modules/proxy
# curl https://issues.apache.org/bugzilla/attachment.cgi?id=24615 | patch -p1
--verbose

Hmm... Looks like a unified diff to me...
The text leading up to this was:
--------------------------
|--- 2.2.14/mod_proxy_connect.c 2009-11-22 00:24:14.762000000 -0500
|+++ 2.2.14-new/mod_proxy_connect.c 2009-11-22 00:29:27.954000000 -0500
--------------------------
Patching file mod_proxy_connect.c using Plan A...
Hunk #1 FAILED at 21.
Hunk #2 FAILED at 73.
Hunk #3 FAILED at 125.
Hunk #4 FAILED at 208.
Hunk #5 FAILED at 253.
Hunk #6 FAILED at 314.
Hunk #7 FAILED at 326.
Hunk #8 FAILED at 351.
Hunk #9 FAILED at 369.
Hunk #10 FAILED at 379.
Hunk #11 FAILED at 420.
11 out of 11 hunks FAILED -- saving rejects to file mod_proxy_connect.c.rej
done

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Nov 28, 2009, 9:02 PM

Post #5 of 9 (902 views)
Permalink

[Bug 29744] CONNECT does not work over existing SSL connection [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

--- Comment #98 from Ivan Krivyakov <ivan.krivyakov [at] sungard> 2009-11-28 21:02:20 UTC ---
(In reply to comment #97)
>
> Have you tried applying this patch to the 2.2.14 sources?
>

Hm... Yes I have. Can't get to it now, but I will investigate ASAP.

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Nov 29, 2009, 7:21 AM

Post #6 of 9 (888 views)
Permalink

[Bug 29744] CONNECT does not work over existing SSL connection [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

--- Comment #99 from Colin Dean <c.c.dean [at] durham> 2009-11-29 07:20:58 UTC ---
Can I just put in another plea that this patch be incorporated into the 2.2
stream, so people don't have to keep updating it and re-applying it.

In my case I'm using it with a browser based application that provides web
access to VNC consoles of virtual machines. The user sees the available
machines in a conventional dynamic web page, and when selecting a console to
view, a Java applet is run. With this patch, the VNC (RFB) connection can be
securely tunneled over the same HTTPS connection as the main page - without it
lots of VNC ports have to be opened to the outside world.

Although I can patch my Apache installation, I have users of the same
application in other organizations who want to use a standard distribution and
aren't comfortable patching and recompiling.

By the way, I'm also puzzling over the best way to enable HTTP CONNECT proxying
but not generic HTTP 0.9/1.0/1.1, AJP13 and FTP. The best I've managed so far
is:

ProxyRequests On
AllowCONNECT 5900

<ProxyMatch /.*/>
Order deny,allow
Deny from all
</ProxyMatch>

which does seem to allow CONNECT proxying only, because the ProxyMatch doesn't
seem to match this (unlike <Proxy *>, which matches all kinds of forward
proxying). But this seems very ugly! I guess I'm looking for a
<ProxyMatchProtocol> feature.

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Nov 29, 2009, 10:55 AM

Post #7 of 9 (891 views)
Permalink

[Bug 29744] CONNECT does not work over existing SSL connection [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

--- Comment #100 from Ivan Krivyakov <ivan.krivyakov [at] sungard> 2009-11-29 10:55:12 UTC ---
>
> Have you tried applying this patch to the 2.2.14 sources?
>
> # wget -O - http://apache.mirror.rafal.ca/httpd/httpd-2.2.14.tar.bz2 | tar jx
> # cd httpd-2.2.14/modules/proxy
> # curl https://issues.apache.org/bugzilla/attachment.cgi?id=24615 | patch -p1
> --verbose
>

I have double-checked it -- it works fine with Win32 sources.

unzip httpd-2.2.14-win32-src.zip
cd httpd-2.2.14\modules\proxy
patch -p1 <mod_proxy_connect.patch

patching file mod_proxy_connect.c

The resulting file is identical to my modified version, so the patch worked.

It could be the end-of-line thing, GNU patch.exe for Windows insists on line
endings to be /r/n, so this is what went into the patch file. I don't have a
Linux instance handy to check this.

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Nov 30, 2009, 10:03 PM

Post #8 of 9 (843 views)
Permalink

[Bug 29744] CONNECT does not work over existing SSL connection [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

--- Comment #101 from Kevin Croft <krcroft [at] gmail> 2009-11-30 22:03:28 UTC ---
(In reply to comment #100)
> >
> > Have you tried applying this patch to the 2.2.14 sources?
> >
> > # wget -O - http://apache.mirror.rafal.ca/httpd/httpd-2.2.14.tar.bz2 | tar jx
> > # cd httpd-2.2.14/modules/proxy
> > # curl https://issues.apache.org/bugzilla/attachment.cgi?id=24615 | patch -p1
> > --verbose
> >
>
> I have double-checked it -- it works fine with Win32 sources.
>
> unzip httpd-2.2.14-win32-src.zip
> cd httpd-2.2.14\modules\proxy
> patch -p1 <mod_proxy_connect.patch
>
> patching file mod_proxy_connect.c
>
> The resulting file is identical to my modified version, so the patch worked.
>
> It could be the end-of-line thing, GNU patch.exe for Windows insists on line
> endings to be /r/n, so this is what went into the patch file. I don't have a
> Linux instance handy to check this.

Ivan, that was it. Converted the patch using 'dos2unix', and it applies cleanly
to the generic sources httpd-2.2.14.tar.bz2. Thanks again for the patch, and
sorry for the false alarm!

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

bugzilla at apache

Dec 12, 2009, 8:04 PM

Post #9 of 9 (640 views)
Permalink

[Bug 29744] CONNECT does not work over existing SSL connection [In reply to]

https://issues.apache.org/bugzilla/show_bug.cgi?id=29744

--- Comment #102 from somebody <whoreperl [at] gmail> 2009-12-12 20:04:19 UTC ---
I tried the patch.

Patch applied successfully but it still does not work with SSL.

This is my configuration in httpd.conf
#=====================================================
<VirtualHost 123.123.123.123:443>
ServerName lol.mydomain.com
SSLEngine on
SSLCertificateFile /root/SSL/ssh-proxy/server.crt
SSLCertificateKeyFile /root/SSL/ssh-proxy/server.key

CustomLog "/root/empty/ssh-access.log" common
ErrorLog "/root/empty/ssh-error.log"

HostnameLookups On
ProxyRequests on
AllowCONNECT 22 2022
ProxyVia on

<ProxyMatch lol.mydomain.com>
Order deny,allow
Deny from all
Allow from 59.93
</ProxyMatch>
</VirtualHost>
#=====================================================

It works if I disable SSL

--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe [at] httpd
For additional commands, e-mail: bugs-help [at] httpd

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads