Subject: Apache + mod_ssl + MSIE problems

From: jon schatz <[email-masked]>
Date: 22 Jan 2002 16:27:46 -0800

Hi. I've got a server (apache 1.3.20 + modssl-2.8.4 + mod_perl-1.2.26)
running on a linux machine. I've had problems with IE and ssl. I've got
these magic lines in my conf file (inside my ssl virtual host
container):

SetEnvIf User-Agent ".*MSIE.*" \
        	 nokeepalive ssl-unclean-shutdown \
	 downgrade-1.0 force-response-1.0

which should force apache/mod_ssl to use http/1.0 and allow unclean
shutdowns for the ssl connection. except it doesn't. On closer
inspection, my access log files contained the following (the first
request is ssl, the second is plaintext):

192.168.1.120 - - [22/Jan/2002:15:54:15 -0800] "GET /library/library.css
HTTP/1.1" 200 3327
<---snip---->
192.168.1.120 - - [22/Jan/2002:16:22:06 -0800] "GET /library/library.css
HTTP/1.1" 304 - "http://devotchka.sonicopia.com:12345/maestro/home"
"Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0; T312461)"

My log format is correct, but just to make sure, i added the same log
format entry into the ssl virtual host. still nothing.

next, i wrote an apache module to dump my environment. accessing it from
ssl shows that mod_perl is definitely aware of the HTTP_USER_AGENT env
variable. but apache seems to be ignoring it, which causes the above
regex not to work, which causes IE to fail, which leaves my boss very
angry. 

I tried this setup with the most current versions of openssl + apache,
and the result was the same. i tried searching on google, but i just get
pages and pages of RTFM's pointing to the above solution. my questions
are as follows:

1) is this a mod_ssl bug or an apache bug?
2) has anyone else noted this behavior?
3) how can i set the above values unconditionally? the app i'm working
on is IE specific anyway, so i don't need to worry about non-MS
browsers.

thanks...

-jon

-- 
[email-masked] || www.divisionbyzero.com
gpg key: www.divisionbyzero.com/pubkey.asc
think i have a virus?: www.divisionbyzero.com/pgp.html
"You are in a twisty little maze of Sendmail rules, all confusing."

---

From: "Kuczborski, Carol L" <[email-masked]>
Date: Wed, 23 Jan 2002 09:45:54 -0500

I had the same problem with most all versions of IE (5.0, 5.5, and 6.0), but
not Netscape (4.75, 4.76, and 6).  I received the "Page cannot be displayed"
and "Cannot find server or DNS error" messages.  I was running Apache and
mod_ssl as packaged with the Oracle9i Application Server on a Windows NT
platform.

I did not completely eliminate the errors, but reduced them quite
significantly by making the following changes:

1.  Modified httpd.conf as follows:

SetEnvIf User-Agent ".*MSIE.*" ssl-unclean-shutdown

2. Oracle Worldwide Support patched the ApacheModuleSSL.dll file.  The patch
to ApacheModuleSSL.dll implements a workaround in the code for reading from
a socket for WIN32.  According to the details for the ApacheModuleSSL.dll
patch, there was mention of a bug in the "select" function in Windows NT
4.0:

"When checking a socket, if data can be read without blocking, select ()
returns yes, but when actually reading from the socket with recv(), that
function returns WSAEWOULDBLOCK, which says that reading would block.  It
seems that this problem does not occur in usual operation, but only in an
SSL enabled Apache (modssl or apache-ssl) with https.  The code for WIN32,
which handles writing to a socket, already contains a workaround for this.
The code for reading from a socket did not have a workaround."

Basically, they added a retry loop so that if a read from the socket failed,
it tried the read again.  My suspicion is that Netscape does this on it's
own and IE does not. 

Carol Kuczborski
EDS - Enabling Business Solutions
MS A6N-B47
13600 EDS Drive
Herndon, VA 20171

* phone: +01-703-742-1025 (8-432)
* mailto:[email-masked]
www.eds.com

-----Original Message-----
From: jon schatz [mailto:[email-masked]]
Sent: Tuesday, January 22, 2002 7:28 PM
To: [email-masked]
Subject: Apache + mod_ssl + MSIE problems

thanks...

-jon

-- 
[email-masked] || www.divisionbyzero.com
gpg key: www.divisionbyzero.com/pubkey.asc
think i have a virus?: www.divisionbyzero.com/pgp.html
"You are in a twisty little maze of Sendmail rules, all confusing." 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]