Good day, all;
I would appreciate it if a committer could spare a moment to patch
the 2.2 STATUS file to include this as a proposal (a +1 would be really
great, too). For reference, the patch is also attached. The trunk patch
was applied in r1039304.
--
--
Daniel Ruggeri
Index: httpd-2.2.x/modules/proxy/mod_proxy_http.c
===================================================================
--- httpd-2.2.x/modules/proxy/mod_proxy_http.c (revision 1037345)
+++ httpd-2.2.x/modules/proxy/mod_proxy_http.c (working copy)
@@ -272,6 +272,12 @@
"proxy: pass request body failed to %pI (%s)",
conn->addr, conn->hostname);
if (origin->aborted) {
+ if(strcmp(apr_table_get(origin->notes, "SSL_connect_rv"), "err")
== 0){
+ return ap_proxyerror(r, HTTP_INTERNAL_SERVER_ERROR,
+ "Error during SSL Handshake with remote
server");
+ }
return APR_STATUS_IS_TIMEUP(status) ? HTTP_GATEWAY_TIME_OUT :
HTTP_BAD_GATEWAY;
}
else {
Index: httpd-2.2.x/modules/ssl/ssl_engine_io.c
===================================================================
--- httpd-2.2.x/modules/ssl/ssl_engine_io.c (revision 1037345)
+++ httpd-2.2.x/modules/ssl/ssl_engine_io.c (working copy)
@@ -1065,6 +1065,7 @@
ssl_log_ssl_error(APLOG_MARK, APLOG_INFO, server);
/* ensure that the SSL structures etc are freed, etc: */
ssl_filter_io_shutdown(filter_ctx, c, 1);
+ apr_table_set(c->notes, "SSL_connect_rv", "err");
return HTTP_BAD_GATEWAY;
}
@@ -1082,6 +1083,7 @@
}
/* ensure that the SSL structures etc are freed, etc: */
ssl_filter_io_shutdown(filter_ctx, c, 1);
+ apr_table_set(c->notes, "SSL_connect_rv", "err");
return HTTP_BAD_GATEWAY;
}
X509_free(cert);
@@ -1101,10 +1103,12 @@
hostname, hostname_note);
/* ensure that the SSL structures etc are freed, etc: */
ssl_filter_io_shutdown(filter_ctx, c, 1);
+ apr_table_set(c->notes, "SSL_connect_rv", "err");
return HTTP_BAD_GATEWAY;
}
}
+ apr_table_set(c->notes, "SSL_connect_rv", "ok");
return APR_SUCCESS;
}
Index: httpd-2.2.x/STATUS
===================================================================
--- httpd-2.2.x/STATUS (revision 1037345)
+++ httpd-2.2.x/STATUS (working copy)
@@ -184,6 +184,14 @@
enabling/disabling the basic capability is not split out into mod_unixd
2.2.x.
+1: trawick
+ * mod_proxy_http: Become aware of ssl handshake failures when attempting
+ to pass request. Makes it so workers are put in error state when a
+ handshake failure is encountered.
+ PR50332
+ Trunk patch: https://issues.apache.org/bugzilla/attachment.cgi?id=26339
+ 2.2.x patch: https://issues.apache.org/bugzilla/attachment.cgi?id=26374
+
PATCHES/ISSUES THAT ARE STALLED
* core: Support wildcards in both the directory and file components of
