Ubuntu
apache2 package

Secure web socket proxy does not work in Apache 2.4.7

Bug #1445914 reported by gianluca
270
This bug affects 2 people
Affects Status Importance Assigned to Milestone
Apache2 Web Server
Fix Released
High
apache2 (Ubuntu)
Fix Released
Medium
Unassigned
Trusty
Fix Released
Medium
Unassigned

Bug Description

[Impact]

In Apache 2.4.7 the wstunnel proxy has a bug where a plain-text request is sent to a WSS URL. The bug is described in https://bz.apache.org/bugzilla/show_bug.cgi?id=55320 and fixed in 2.4.10 with a very short and non-invasive patch.

[Test Case]

This is a testcase involving websockify and NoVNC.

On Host A install a VNC server listening on port 5900. On the same host also install websockify to make VNC accessible through websocket. Launch websockify with

websockify --cert privatecert.pem --ssl-only 6080 localhost:5900

where privatecert.pem contains both a certificate and the corresponding private key.

On Host B install Apache 2.4 and download NoVNC in the directory /vnc inside the document root. Enable SSL and the websocket proxy with

a2enmod proxy proxy_http proxy_wstunnel ssl

Add the following configuration directives for Apache:

<Location /ws/client>
   ProxyPass wss://HostA:6080
</Location>

Now, connecting with a browser at the following URL:

https://HostB/vnc/vnc.html?host=HostB&path=/ws/client/websockify&connectTimeout=5&disconnectTimeout=5&port=443&autoconnect=1

should launch a remote VNC session on HostB, but it does not work because the tunnel created by ProxyPass does not really use SSL.

[Regression Potential]

If someone had incorrectly configured Apache to use a WSS proxy towards a server which only supports WS, this would stop working after the bug is fixed. This can be fixed replacing the WSS schema with WS.

OS: Ubuntu 14.04.2 LTS
Package: 2.4.7-1ubuntu4.4

See original description
Revision history for this message
In , Alex-leo-ca (alex-leo-ca) wrote :

When I configure ws_proxy_wstunnel module with wss:// URL the request is actually sent in plaintext which gets rejected by backend server due to SSL handshake failure.

Suggested correction,
314a315
> int is_ssl = 0;
 320a322
> is_ssl = 1;
 344c346
< backend->is_ssl = 0;
---
> backend->is_ssl = is_ssl;

Thanks,

Alex

Revision history for this message
In , Jason-hoos (jason-hoos) wrote :

Created attachment 31035
Patch for mod_proxy_wstunnel.c

I ran into this issue today. To assist others, I'm attaching a patch file with Alex's fix.

Revision history for this message
In , Covener-0 (covener-0) wrote :

Thanks for the report, equivalent patch seems to be applied in trunk and 2.4.x.

Revision history for this message
In , Ylavic-dev (ylavic-dev) wrote :

*** Bug 56515 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Ylavic-dev (ylavic-dev) wrote :

This does not seem to be fixed (Bug 56515), at least I can't find the corresponding code. Eric?

Revision history for this message
In , Covener-0 (covener-0) wrote :

Looking now, I must have misread

Revision history for this message
In , Ylavic-dev (ylavic-dev) wrote :

Commited in trunk with r1594625.
Proposed for backport in 2.4.x.

Revision history for this message
In , Ylavic-dev (ylavic-dev) wrote :

Backported in upcoming 2.4.10.

Revision history for this message
In , tititou (christophe-jaillet) wrote :

Fixed and released in 2.4.10

Marc Deslauriers (mdeslaur)
information type: Private Security → Public Security
Changed in apache2 (Ubuntu):
status: New → Confirmed
Bug Watch Updater (bug-watch-updater)
Changed in apache2:
importance: Unknown → High
status: Unknown → Fix Released
Revision history for this message
Robie Basak (racb) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better.

Please follow the steps documented in https://wiki.ubuntu.com/StableReleaseUpdates#Procedure - in particular the Impact, Test Case and Regression Potential sections, which are best done by someone familiar with both the bug and the fix and without which we cannot update a stable release, in order to help avoid regressions to existing users.

Changed in apache2 (Ubuntu):
status: Confirmed → Triaged
importance: Undecided → Medium
gianluca (amato)
description: updated
Revision history for this message
Jeffrey Hutzelman (jhutz) wrote :

The upstream patch (see attached debdiff) corrects the problem for me, for an internal test case that is unfortunately too complex to share.

Revision history for this message
Marc Deslauriers (mdeslaur) wrote :

Thanks for the debdiff. The patch looks good, but could you please add proper DEP-3 patch tags, including the Origin tag?

For example:

Description: xxx
Origin: upstream, https://svn.apache.org/viewvc?view=revision&revision=1594625
Author: xxx

See the following for more information:

http://dep.debian.net/deps/dep3/

Thanks!

Revision history for this message
Jeffrey Hutzelman (jhutz) wrote :

Try this one. Note I omitted the Author tag. It's not clear to me that it's intended to name the author of the upstream patch, which in any case is available in the upstream bug, the upstream commit, and the debian/changelog entry. I myself have no authorship stake in this patch.

Note that while the upstream commit also patches the CHANGES file, I've omitted that, because the addition is to a section (Changes with Apache 2.5.0) that doesn't exist in 2.4.7. This file doesn't appear to make it into any binary packages in any event.

Revision history for this message
Martin Pitt (pitti) wrote :

So this is fixed in wily which has 2.4.12.

Changed in apache2 (Ubuntu):
status: Triaged → Fix Released
Revision history for this message
Martin Pitt (pitti) wrote :

I uploaded the trusty patch to the SRU review queue. Thank you!

Changed in apache2 (Ubuntu Trusty):
status: New → In Progress
Revision history for this message
Chris J Arges (arges) wrote : Please test proposed package

Hello gianluca, or anyone else affected,

Accepted apache2 into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/apache2/2.4.7-1ubuntu4.7 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in apache2 (Ubuntu Trusty):
status: In Progress → Fix Committed
tags: added: verification-needed
Revision history for this message
Jeffrey Hutzelman (jhutz) wrote :

2.4.7-1ubuntu4.7 fixes my problem.

Mathew Hodson (mhodson)
Changed in apache2 (Ubuntu Trusty):
importance: Undecided → Medium
tags: added: trusty verification-done
removed: verification-needed
Revision history for this message
Chris J Arges (arges) wrote : Update Released

The verification of the Stable Release Update for apache2 has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package apache2 - 2.4.7-1ubuntu4.7

---------------
apache2 (2.4.7-1ubuntu4.7) trusty; urgency=medium

  * d/p/wstunnel-ssl.patch: mod_proxy_wstunnel: Fix the use of SSL
    connections with the "wss:" scheme. PR55320. LP: #1445914
    Submitted by: Alex Liu <alex.leo.ca gmail.com>

 -- Jeffrey Hutzelman <email address hidden> Thu, 10 Sep 2015 12:50:00 -0400

Changed in apache2 (Ubuntu Trusty):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.