Bug 65429

Summary: order of ProxyPass and ProxyPassMatch seems to matter
Product: Apache httpd-2 Reporter: Tobias Wendorff <tobwen>
Component: mod_proxyAssignee: Apache HTTPD Bugs Mailing List <bugs>
Status: RESOLVED FIXED    
Severity: normal Keywords: FixedInTrunk
Priority: P2    
Version: 2.4.48   
Target Milestone: ---   
Hardware: PC   
OS: Linux   
Attachments: Don't confuse/merge matchable and non-matchable proxy workers at loading
ProxyPassMatch full patch

Description Tobias Wendorff 2021-07-03 11:14:43 UTC
# summary
After upgrading from apache2 v2.4.46 to v2.4.48, the order of ProxyPass and ProxyPatchMatch seems to matter.

# test requests
1. GET http://demo.tobwen.local/internal/
2. GET http://demo.tobwen.local/tiles/osm/19/272348/174392.png

# config (1)
<VirtualHost *:80>
    ServerName demo.tobwen.local
    DocumentRoot /var/www/html/

    ProxyPass "/internal" "http://localhost:8081"    
    ProxyPassMatch "^/tiles/([^/\.]+)/(\d+/\d+/\d+.png)$"   "http://localhost:8081/wmts/$1/webmercator/$2"
</VirtualHost>

# results (1)
On v2.4.46 (and earlier), both test requests worked as expected.
On v2.4.48, the second request suddenly throws an ERROR 404.

# observation
Let's change the order of ProxyPass and ProxyPassMatch.

# config (2)
<VirtualHost *:80>
    ServerName demo.tobwen.local
    DocumentRoot /var/www/html/

    ProxyPassMatch "^/tiles/([^/\.]+)/(\d+/\d+/\d+.png)$"   "http://localhost:8081/wmts/$1/webmercator/$2"
    ProxyPass "/internal" "http://localhost:8081"    
</VirtualHost>

# results (2)
Crazy, now the requests work without a problem.

# conclusion
This seems to be a regression since it worked in earlier versions.
Comment 1 Yann Ylavic 2021-07-03 13:56:41 UTC
Created attachment 37938 [details]
Don't confuse/merge matchable and non-matchable proxy workers at loading

Could you please try this patch?

The issue is a change in 2.4.48 (r1880772) to allow for parameters (enablereuse, ttl..) in <ProxyMatch>/ProxyPassMatch workers with '$n' substitution in the URL, like <Proxy>/ProxyPass workers.

This patch should fix the regression that makes matchable and non-matchable workers be confused/merged at loading, which is why when the worker http://localhost:8081 (non-matchable) is defined first it blinds the second worker http://localhost:8081/wmts/$1/webmercator/$2 (matchable), thus no worker exists to handle "/tiles/osm/19/272348/174392.png" which ends up being not found in the DocumentRoot.

Note that there is another issue reported in bug 65419 about this change, another patch is available there for a full fix (the two patches can be applied with no conflict).
Comment 2 Tobias Wendorff 2021-07-03 14:30:50 UTC
I've just tested your patch and it works. Thanks.

Is there a repository where all those patches are collected?
Comment 3 Yann Ylavic 2021-07-03 14:39:45 UTC
Created attachment 37939 [details]
ProxyPassMatch full patch

Patch for both bug 65419 and bug 65429.

No repository for this full patch so far, I will make a backport proposal with it ASAP.
Comment 4 Yann Ylavic 2021-07-22 18:46:44 UTC
This patch is proposed for backport to 2.4.x: http://people.apache.org/~ylavic/patches/2.4.x-bz_65419+65429.patch
Comment 6 Yann Ylavic 2021-09-20 23:04:43 UTC
Fixed in 2.4.49 (r1892569).