Re: [gentoo-server] httpd (2.0.55) proxying https to zope's http mangling POST data

[Edward Muller]

Well, my 'work around' was a little bit more extreme....

I upgraded to 2.2.0, which I know it hard masked. So I may be in for a world 
of pain by doing so. ATM though everything appears to be working.

Thanks for the input though. When a 2.0.56 ebuild becomes available I will 
probably downgrade to that.


On Friday 03 March 2006 04:00 pm, Andy Dustman wrote:
> On 3/3/06, Stelian Ionescu <stelian.ionescu-zeus@×××××.it> wrote:
> > On Fri, Mar 03, 2006 at 04:31:44PM -0500, Andy Dustman wrote:
> > >On 3/3/06, Edward Muller <edwardam@××××××××.com> wrote:
> > >> One of our clients has the following setup:
> > >> httpd 2.0.55 (Gentoo package 2.0.55-r1)
> > >> Zope 2.6.1
> > >>
> > >> Apache proxies zope for a http and https host via mod_rewrite/proxy
> > >>
> > >> POSTs going to httpd=>zope via http are fine, posts going to
> > >> httpd=>zope via https are not.
> > >
> > >Yup:
> > >
> > >https://bugs.gentoo.org/show_bug.cgi?id=121402
> > >http://issues.apache.org/bugzilla/show_bug.cgi?id=37145
> > >
> > >Unfortunately for you and me, despite having the patch available from
> > >upstream, the developer closed the bug with the comment "2.0.56 should
> > >be out real soon now, which addresses this problem." That was a month
> > >ago.
> >
> > 1) download this patch:
> > http://svn.apache.org/viewcvs.cgi/httpd/httpd/branches/2.0.x/modules/prox
> >y/proxy_http.c?p2=%2Fhttpd%2Fhttpd%2Fbranches%2F2.0.x%2Fmodules%2Fproxy%2F
> >proxy_http.c&p1=httpd%2Fhttpd%2Fbranches%2F2.0.x%2Fmodules%2Fproxy%2Fproxy
> >_http.c&r1=372046&r2=372045&rev=372046&view=diff&makepatch=1&diff_format=u
> > to /usr/portage/net-www/apache/files/plone.patch
> > 2) add this lines to the src_unpack in apache-2.0.55-r1.ebuild right
> > after "epatch ${GENTOO_PATCHDIR}...":
> >
> > epatch ${FILESDIR}/plone.patch
> >
> > 3) execute: ebuild /usr/portage/net-www/apache/apache-2.0.55-r1.ebuild
> > digest 4) remerge apache-2.0.55-r1
> >
> > (I'm ssuming that you're using an ~arch apache and that your portage
> > tree is in /usr/portage; alternativerly you might copy the ebuild to an
> > overlay and add the patch there)
>
> Actually, I just found a workaround. I saw something about
> mod_security, and thought that by adding that as an intermediate
> processing layer, it might fix the problem, and it does.
>
> 1) emerge mod_security
>
> 2) edit /etc/apache2/modules.d/99_mod_security.conf to suit, and in
> particular, you must comment out this rule:
>
>     # Forbid file upload
>     #SecFilterSelective "HTTP_CONTENT_TYPE" multipart/form-data
>
> Otherwise, you can't submit POST form data.
>
> 3) add -D SECURITY to the args in /etc/conf.d/apache2
>
> 4) /etc/init.d/apache2 restart
>
> BTW, it's not a Plone- or Zope-specific problem. It can happen anytime
> you are using mod_ssl to mod_proxy and have multi-part form data.
> --
> The Pythonic Principle: Python works the way it does
> because if it didn't, it wouldn't be Python.

-- 
Edward Muller - Interlix
edwardam@××××××××.com
417-862-0573
PGP Key: http://interlix.com/Members/edwardam/pgpkeys