silva 2.3, mod_wsgi, and host header

--===============0277824637248364310==
Content-Type: multipart/alternative; boundary=000e0cd3ac9273ecac04abbeb45a

--000e0cd3ac9273ecac04abbeb45a
Content-Type: text/plain; charset=ISO-8859-1

Greetings,

We've encountered a very unusual error when running Silva 2.3 in Apache (2.0
or 2.2) with mod_wsgi.  This error surfaced in production for use with our
varnish caching server in front of some of our web pages.  This is very easy
to reproduce:

1) create a new buildout of Silva 2.3, make sure to include the mod_wsgi_app
part
2) configure your apache server to serve Silva 2.3 with mod_wsgi, the
standard configuration from docs.infrae.com/silva/2.3/wsgi.html should
suffice.  For the purposes of this test, run the vhost on port 8080.
3) start up apache, load a web page from your browser
4) now in a terminal, access apache using telnet, type the following.  We're
issuing a standard HTTP/1.1 request, but supplying a different HOST: header.
aaltepet@bilbo:~/silva/Silva-2.3> telnet localhost 8080
Escape character is '^]'.
GET / HTTP/1.1
HOST: localhost:6080

The output you get is similar to (I'm not printing the response body):
HTTP/1.1 500 Internal Server Error
Date: Tue, 30 Aug 2011 19:47:26 GMT
Server: Apache/2.2.15 (Linux/SUSE)
Vary: accept-language,accept-charset
Accept-Ranges: bytes
Connection: close
Content-Type: text/html; charset=iso-8859-1
Content-Language: en
X-Pad: avoid browser bug

There is a bizarre zope error recorded in the error log, see this pastebin
post: http://pastebin.com/3ZMZ8EDB

This is reproducible for us on rhel4/apache 2.0/mod_wsgi 3.3 and
opensuse11.3/apache 2.2/ mod_wsgi 3.3

Issuing multiple requests via telnet, varying the host header, I can see
that any INVALID host header raises this error, it does not matter whether
it is localhost or something.  ONLY VALID hosts, with the correct port, are
handled properly.  Also, HTTP/1.0 requests raise the same error.

Additionally, when running Silva 2.3 under paster, any value for the host
header is accepted.

This seems to be a mod_wsgi issue, but given the odd zope error I thought
I'd start by reporting it here.

peace,
Andy

--000e0cd3ac9273ecac04abbeb45a
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Greetings,<div><br></div><div>We&#39;ve encountered a very unusual error wh=
en running Silva 2.3 in Apache (2.0 or 2.2) with mod_wsgi. =A0This error su=
rfaced in production for use with our varnish caching server in front of so=
me of our web pages. =A0This is very easy to reproduce:</div>


<div><br></div><div>1) create a new buildout of Silva 2.3, make sure to inc=
lude the mod_wsgi_app part</div><div>2) configure your apache server to ser=
ve Silva 2.3 with mod_wsgi, the standard configuration from <a href=3D"http=
://docs.infrae.com/silva/2.3/wsgi.html" target=3D"_blank">docs.infrae.com/s=
ilva/2.3/wsgi.html</a> should suffice. =A0For the purposes of this test, ru=
n the vhost on port 8080.</div>


<div>3) start up apache, load a web page from your browser</div><div>4) now=
 in a terminal, access apache using telnet, type the following. =A0We&#39;r=
e issuing a standard HTTP/1.1 request, but supplying a different HOST: head=
er.</div>


<div>aaltepet@bilbo:~/silva/Silva-2.3&gt; telnet localhost 8080</div><div><=
div>Escape character is &#39;^]&#39;.</div><div>GET / HTTP/1.1</div><div>HO=
ST: localhost:6080</div></div><div><br></div><div>The output you get is sim=
ilar to (I&#39;m not printing the response body):</div>


<div><div>HTTP/1.1 500 Internal Server Error</div><div>Date: Tue, 30 Aug 20=
11 19:47:26 GMT</div><div>Server: Apache/2.2.15 (Linux/SUSE)</div><div>Vary=
: accept-language,accept-charset</div><div>Accept-Ranges: bytes</div><div>


Connection: close</div><div>Content-Type: text/html; charset=3Diso-8859-1</=
div><div>Content-Language: en</div><div>X-Pad: avoid browser bug</div></div=
><div><br></div><div>There is a bizarre zope error recorded in the error lo=
g, see this pastebin post:=A0<a href=3D"http://pastebin.com/3ZMZ8EDB" targe=
t=3D"_blank">http://pastebin.com/3ZMZ8EDB</a></div>

<div><br></div><div>This is reproducible for us on rhel4/apache 2.0/mod_wsg=
i 3.3 and opensuse11.3/apache 2.2/ mod_wsgi 3.3</div><div><br></div><div>Is=
suing multiple requests via telnet, varying the host header, I can see that=
 any INVALID host header raises this error, it does not matter whether it i=
s localhost or something. =A0ONLY VALID hosts, with the correct port, are h=
andled properly. =A0Also, HTTP/1.0 requests raise the same error.</div>
<div><br></div><div>Additionally, when running Silva 2.3 under paster, any =
value for the host header is accepted.</div><div><br></div><div>This seems =
to be a mod_wsgi issue, but given the odd zope error I thought I&#39;d star=
t by reporting it here.</div>
<div><br></div><div>peace,</div><div>Andy</div>

--000e0cd3ac9273ecac04abbeb45a--

--===============0277824637248364310==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
silva-dev mailing list
silva-dev-IAPFreCvJWM6s/[email protected]
https://lists.infrae.com/mailman/listinfo/silva-dev

--===============0277824637248364310==--