[ 
https://issues.apache.org/jira/browse/TS-4468?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15506995#comment-15506995
 ] 

Susan Hinrichs commented on TS-4468:
------------------------------------

I am concerned that we would be reducing client-side session reuse in HTTP/2 
case if we get too aggressive in policing SNI matching host field on new 
requests.  

Say the client negotiated a new TLS connection with SNI name set to 
one.bob.come.  It uses HTTP/2 to send a request with HOST set to one.bob.com.  
Then it sends a request with HOST field set to two.bob.com.  one.bob.com and 
two.bob.com resolve to the same address, and the cert is a wildcard for 
*.bob.com, so the client is reusing the same HTTP/2 session.  If we were 
stringent as [~oknet] suggests in bullet 2 we should reject that client 
request, which would reduce the utility of HTTP/2.

[~jered]'s patch only adapts our reuse to meet the requirements of upstream 
HTTP/1.x servers.

At most, if we decided we needed to be stringent in enforcing SNI/host matching 
on client side, I would want the ability to opt out.  

> http.server_session_sharing.match = both unsafe with HTTPS
> ----------------------------------------------------------
>
>                 Key: TS-4468
>                 URL: https://issues.apache.org/jira/browse/TS-4468
>             Project: Traffic Server
>          Issue Type: Bug
>          Components: HTTP, SSL
>    Affects Versions: 6.1.1
>            Reporter: Jered Floyd
>            Assignee: Susan Hinrichs
>             Fix For: 7.0.0
>
>         Attachments: TS-4468.patch
>
>          Time Spent: 3h 10m
>  Remaining Estimate: 0h
>
> proxy.config.http.server_session_sharing.match has a default value of "both", 
> which compares IP address, port, and FQDN when determining whether a 
> connection can be reused for further user agent requests.
> The "host" (FQDN) matching does not behave safely when ATS is operating as a 
> reverse proxy.  The compared value is the origin server FQDN after mapping, 
> rather than the initial "Host" target.
> If multiple Hosts map to the same origin server and the scheme is HTTPS, ATS 
> will attempt to reuse a connection that may have an SNI Host that does not 
> match the HTTP Host.  With Apache 2.4 origin servers this results in 400 Bad 
> Request to the user agent.
> PROBLEM REPRODUCTION:
> You can observe this behavior with two mapping rules such as:
> map https://example.com/ https://origin.example.com/
> map https://www.example.com/ https://origin.example.com/
> Non-caching clients alternately fetching URIs from the two targets will see 
> 400 Bad Request responses intermittently.
> WORKAROUND:
> proxy.config.http.server_session_sharing.match should have a default value of 
> "none" when proxy.config.reverse_proxy.enabled is "1"
> SUGGESTED FIXES:
> In order of completeness:
> 1) Do not share server sessions on reverse_proxy requests.
> 2) Do not share server sessions on reverse_proxy requests where scheme is 
> HTTPS.
> 3) Compare target host (SNI host) rather than replacement host when 
> determining if reuse of server session is allowed (when 
> server_session_sharing.match is set to "host" or "both").



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Reply via email to