Subject: Odd interaction between mod_ssl, mod_rewrite and mod_proxy

From: Patrick Herborn <[email-masked]>
Date: Tue, 26 Mar 2002 18:31:16 +0000

I have been trying to configure the following setup:

  PRIVATE LAN           |              INTERNET 
			|
  back_end <--HTTP--> Apache <--HTTPS--> Client
			|
			|

Ie the Apache box is acting as a bastion host between the Internet and a
private LAN segment. I have a valid cert and key on the Apache box, and SSL
negotiation works fine. I also have the whole thing working with pure HTTP (no
SSL) but with both, ie running SSL to the Apache box, then plain HTTP to the
back end, it breaks.

This is with Apache 2.0.32 (so the API is somewhat different), but here's a
brief trace from the SSL engine log....

[26/Mar/2002 16:38:34 19733] [info]  Connection to child 4 established (server www.test.com:443, client 1.2.3.4)
[26/Mar/2002 16:38:34 19733] [info]  Seeding PRNG with 136 bytes of entropy
[26/Mar/2002 16:38:34 19733] [info]  Connection: Client IP: 1.2.3.4, Protocol: TLSv1, Cipher: RC4-MD5 (128/128 bits)
[26/Mar/2002 16:38:34 19733] [info]  Connection to child 4 established (server www.test.com:443, client 10.46.101.101)
[26/Mar/2002 16:38:34 19733] [info]  Seeding PRNG with 136 bytes of entropy
[26/Mar/2002 16:38:34 19733] [error] SSL error on writing data (OpenSSL library error follows)
[26/Mar/2002 16:38:34 19733] [error] OpenSSL: error:140D0114:SSL routines:SSL_write:uninitialized
[26/Mar/2002 16:38:34 19733] [error] failed to write 16 of 16 bytes (reason unknown)

Client IP address has been changed, as has the site name... OK, so everything
is going really well up to line 4. 10.46.101.101 is the back end server, but
it would appear that the SSL engine thinks that the back end server has
connected to it as a client (odd...). It then all goes pear shaped.

>From what I can remember, this type of setup should work, and I seem
to recall getting it to work before (with Apache 1.3.x ?). Has anyone else
had any success at getting this type of bastion host to work with 
Apache 2.0.32 (and the mod_ssl supplied with that) ? Is it supposed to
work at all? Is this a bug, feature, or just my poor configuration skills?

>From what I can tell from the source code, it would appear that mod_ssl calls
ap_hook_pre_connection to register the function which builds the SSL session, my
gut feeling is that this is being inherited by mod_proxy, and as mod_proxy
tries to send the HTTP/1.1 request to the back end, mod_ssl is trying to
negotiate an SSL with a client (which does not exist). But I may well be 
barking up the wrong tree. Any help / advice / known good configs most
appreciated.

Regards,
Patrick Herborn. 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Merton Campbell Crockett <[email-masked]>
Date: Tue, 26 Mar 2002 14:42:37 -0800 (PST)

> SSL) but with both, ie running SSL to the Apache box, then plain HTTP to the

I assume that you have a virtual host defined on the Apache server with
the same name as the back_end.  Use mod_rewrite's [P] flag to generate the
HTTP request to back_end.  Use mod_proxy's ProxyPassReverse to capture the
response from back_end and return it to the client.

Re-read Ralph Engelshall's notes on mod_rewrite 3 or 4 times.  It takes
time for what my grandmother would have called "jookery-pookery" to sink
in.

When I developed a system running Stronghold several years ago, I recall
running into problems with SSL (ssleay) until I realized that you needed
to simulate ProxyPass using mod_rwrite.  I don't think this is a mod_ssl
problem.  It's more of a problem of under which shell is the pea.

Merton Campbell Crockett

-- 
BEGIN:				vcard
VERSION:			3.0
FN:				Merton Campbell Crockett
ORG:				General Dynamics Advanced Information Systems;
				Intelligence Solutions
N:				Crockett;Merton;Campbell
EMAIL;TYPE=internet:		[email-masked]
TEL;TYPE=work,voice,msg,pref:	+1(805)497-5045
TEL;TYPE=pager,msg:		+1(877)528-0049
TEL;TYPE=fax,work:		+1(805)497-5050
TEL;TYPE=cell,voice,msg:	+1(805)377-6762
END:				vcard

---

From: Patrick Herborn <[email-masked]>
Date: Wed, 27 Mar 2002 10:43:15 +0000

On Tue, 26 Mar 2002 14:42:37 -0800 (PST)
Merton Campbell Crockett <[email-masked]> wrote:

> > negotiation works fine. I also have the whole thing working with pure HTTP
> > (no SSL) but with both, ie running SSL to the Apache box, then plain HTTP
> > to the back end, it breaks.
> 
> the same name as the back_end.

Yes, that is correct, the only difference is that in the Apache box it
is defined <VirtualHost www.test.com:443> and a user would just connect
to https://www.test.com/, without the port number because it is implicit.

> Use mod_rewrite's [P] flag to generate the HTTP request to back_end.

Yes, and that much appears to work. Indeed, running a tcpdump on the back end
interface, I can actually see a SYN, SYN/ACK and ACK, ie the TCP layer is 
fine, mod_proxy is trying to connect (and does) with the back end, but as
soon as it tries to send a GET to the back end, it breaks. 

> Use mod_proxy's ProxyPassReverse to capture the response from back_end and 
> return it to the client.

Yep, got that. Like I said, it all works with plain old HTTP, but as soon
as I try to run SSL it breaks. 

> time for what my grandmother would have called "jookery-pookery" to sink

I'm not trying to do anything too complex with mod_rewrite, indeed I could
use ProxyPass instead of [P] (but I will be doing URL filtering so I need 
the [F] target of mod_rewrite, something that ProxyPass wouldn't do)

> to simulate ProxyPass using mod_rwrite.

I have tested it with ProxyPass also, just to see if the problem lies with
mod_rewrite, but I get exactly the same results. Today I will do a bit of
testing with Apache 1.3.x to see if that works...

> I don't think this is a mod_ssl problem.

I'm not sure exactly where the problem lies, but thinking about it, if using
ProxyPass yields the same results as RewriteRule, then it stands to reason
that the problem doesn't lie with mod_rewrite, so that leaves mod_proxy and
mod_ssl (and of course the Apache core). I'll keep digging....

> It's more of a problem of under which shell is the pea.

Yeah... needle in haystack... up to now I've been content with configuring
build options, building, and running Apache... now I need to sift through
God knows how many lines of source code. Eeek.

Regards,

Patrick Herborn.

---

From: Patrick Herborn <[email-masked]>
Date: Wed, 27 Mar 2002 13:32:45 +0000

> response from back_end and return it to the client.

Just a quick update. As previously stated it was setup as suggested and it
worked fine with plain HTTP, but broke with HTTPS / SSL. I have now set this up
with pretty much identical config but running Apache 1.3.x and it works just
fine, it still does not work with Apache 2.0.32.  

My gut feeling at this stage, from the miniscule knowledge of the source I have
gathered in the last day or so, is that it is an unwanted side-effect of the
Apache 2.0 hook mechanism; it's as if the hook is being called even for a
server-initiated TCP connection, not just for client initiated connections. 

Question is whose "responsibility" is it? Should mod_ssl skip the SSL
negotiation on server-initiated connections (especially to port 80!), or should
the Apache core bypass the hook on server-initiated connections? Ie is it a
mod_ssl problem, or is it an Apache core problem? Or am I just barking up the
wrong tree entirely?

Patrick Herborn.