Bionic verification. Starting with the packages that show the bug:
ubuntu@bionic-apache-1750356:~$ apt-cache policy apache2
apache2:
Installed: 2.4.29-1ubuntu4.2
Candidate: 2.4.29-1ubuntu4.2
Version table:
*** 2.4.29-1ubuntu4.2 500
500 http://br.archive.ubuntu.com/ubuntu bionic-updates/main amd64
Packages
100 /var/lib/dpkg/status
status shows the expected error:
(...)
Aug 28 17:20:37 bionic-apache-1750356 systemd[1]: Starting The Apache HTTP
Server...
Aug 28 17:20:37 bionic-apache-1750356 apachectl[2040]: AH00526: Syntax error on
line 24 of /etc/apache2/sites-enabled/000-default.conf:
Aug 28 17:20:37 bionic-apache-1750356 apachectl[2040]: BalancerMember worker
hostname (xxxxxx-xx-xxxxxxxx-xxxxx-xxxxx.xx-xxxx-x.xxxxx-xxx.xxx.xxxxx.xxxx)
too long
Aug 28 17:20:37 bionic-apache-1750356 apachectl[2040]: Action 'start' failed.
Upgrading to the packages in proposed:
ubuntu@bionic-apache-1750356:~$ apt-cache policy apache2
apache2:
Installed: 2.4.29-1ubuntu4.3
Candidate: 2.4.29-1ubuntu4.3
Version table:
*** 2.4.29-1ubuntu4.3 500
500 http://br.archive.ubuntu.com/ubuntu bionic-proposed/main amd64
Packages
100 /var/lib/dpkg/status
2.4.29-1ubuntu4.2 500
500 http://br.archive.ubuntu.com/ubuntu bionic-updates/main amd64
Packages
Service is running right after the upgrade:
ubuntu@bionic-apache-1750356:~$ sudo systemctl status apache2
● apache2.service - The Apache HTTP Server
Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset:
enabled)
Drop-In: /lib/systemd/system/apache2.service.d
└─apache2-systemd.conf
Active: active (running) since Tue 2018-08-28 17:22:31 UTC; 25s ago
Main PID: 2847 (apache2)
Tasks: 54 (limit: 4915)
CGroup: /system.slice/apache2.service
├─2847 /usr/sbin/apache2 -k start
├─2849 /usr/sbin/apache2 -k start
└─2850 /usr/sbin/apache2 -k start
Aug 28 17:22:31 bionic-apache-1750356 systemd[1]: Starting The Apache HTTP
Server...
Aug 28 17:22:31 bionic-apache-1750356 systemd[1]: Started The Apache HTTP
Server.
Accessing the balancer url triggers the expected error:
ubuntu@bionic-apache-1750356:~$ wget http://localhost/foo
--2018-08-28 17:23:34-- http://localhost/foo
Resolving localhost (localhost)... 127.0.0.1
Connecting to localhost (localhost)|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 502 Proxy Error
2018-08-28 17:23:35 ERROR 502: Proxy Error.
And the logs confirm that the server tried to reach the balancer member:
ubuntu@bionic-apache-1750356:~$ tail /var/log/apache2/error.log -n 1
[Tue Aug 28 17:23:35.277191 2018] [proxy:error] [pid 2850:tid 139871414892288]
[client 127.0.0.1:49520] AH00898: DNS lookup failure for:
xxxxxx-xx-xxxxxxxx-xxxxx-xxxxx.xx-xxxx-x.xxxxx-xxx.xxx.xxxxx.xxxx returned by
/foo
Verification complete and successfull for bionic.
** Description changed:
[Impact]
If the BalancerMember directive contains a URL with a hostname longer
than X characters, apache2 will fail to start with the following error:
BalancerMember worker hostname (65.character.host.name) too long
RFC1035 allows for longer hostnames, and apache upstream has this fix
already.
[Test Case]
* Install the packages:
- sudo apt install apache
+ sudo apt install apache2
* Edit /etc/apache2/sites-available/000-default.conf and add the following
block inside the VirtualHost block:
<Proxy "balancer://test">
BalancerMember
"http://xxxxxx-xx-xxxxxxxx-xxxxx-xxxxx.xx-xxxx-x.xxxxx-xxx.xxx.xxxxx.xxxx:90/";
BalancerMember
"http://xxxxxx-xx-xxxxxxxx-xxxxx-xxxxx.xx-xxxx-x.xxxxx-xxx.xxx.xxxxx.xxxx:91/";
</Proxy>
ProxyRequests Off
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
RewriteEngine On
RewriteRule ^/foo balancer://test/foo [P,L]
* Enable the necessary apache modules:
sudo a2enmod proxy_balancer proxy lbmethod_byrequests proxy_http rewrite
* Restart apache2, which will fail:
sudo systemctl restart apache2
* Run the status action and expect an error like this:
sudo systemctl status apache2.service
...
Jun 27 18:31:16 bionic-apache-1750356 apachectl[2218]: BalancerMember worker
hostname (xxxxxx-xx-xxxxxxxx-xxxxx-xxxxx.xx-xxxx-x.xxxxx-xxx.xxx.xxxxx.xxxx)
too long
* Update the apache2 packages to the ones available in proposed. As part of
the upgrade, apache2 will be restarted again, and in this time it will work.
Confirm with systemctl status apache2 that there are no errors this time:
sudo systemctl status apache2
* Try to access http://localhost/foo to trigger the load balancer
configuration. It will trigger a DNS error as we don't have an entry for
the BalancerMember hostname, but it shows that the configuration worked:
ubuntu@bionic-apache-1750356:~$ wget http://localhost/foo
--2018-06-27 18:39:58-- http://localhost/foo
Resolving localhost (localhost)... 127.0.0.1
Connecting to localhost (localhost)|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 502 Proxy Error
2018-06-27 18:39:58 ERROR 502: Proxy Error.
ubuntu@bionic-apache-1750356:~$ tail /var/log/apache2/error.log -n 1
[Wed Jun 27 18:39:58.732097 2018] [proxy:error] [pid 3628:tid
139981565716224] [client 127.0.0.1:42508] AH00898: DNS lookup failure for:
xxxxxx-xx-xxxxxxxx-xxxxx-xxxxx.xx-xxxx-x.xxxxx-xxx.xxx.xxxxx.xxxx returned by
/foo
[Regression Potential]
This change is twofold: it allows for longer hostnames, and apache won't fail
to start anymore if that length is exceeded. In the latter case, however, the
hostname is truncated. With that in mind, here are some scenarios:
- hostnames larger than 65 characters but less than 255: before apache2 would
fail to start, now it works.
- hostname larger than 255 characters. Before apache would fail to start;
now, it starts but truncates that hostname, logging a warning. The
configuration is likely to not work due to the truncation, which will lead to
DNS errors. If the admin was only relying on (re)start errors to become aware
of configuration problems, he/she might miss this until it's too late. But at
least the log will be clear about what happened.
- third party modules that use apache's mod_proxy structure might not be
aware of the new hostname_ex member which can hold the longer string, since we
didn't update the MODULE_MAGIC_NUMBER_MINOR number with this patchset, and will
probably remain exhibiting the problem described in this bug.
[Other Info]
The security team's regression test suite for apache2
(http://launchpad.net/qa-regression-testing) was run with the test packages
from the PPA at
https://launchpad.net/~ahasenack/+archive/ubuntu/apache-balance-member-hostname-1750356/+packages
and passed: https://pastebin.ubuntu.com/p/nZ6GGHXgwQ/
-
== Original Description ==
If the BalancerMember directive contains a URL with a hostname longer
than X characters, we fail as follows:
BalancerMember worker hostname (65.character.host.name) too long
The size of the hostname needs to be raised so it is RFC1035 compliant.
Bug fixed upstream at
https://bz.apache.org/bugzilla/show_bug.cgi?id=62085, patches backported
to v2.4.30:
http://svn.apache.org/r1824455
http://svn.apache.org/r1824504
(Both patches required, first is extended by second).
** Tags removed: verification-needed-bionic
** Tags added: verification-done-bionic
--
You received this bug notification because you are a member of Ubuntu
Server, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1750356
Title:
Apache2: BalancerMember worker hostname (65.character.host.name) too
long
To manage notifications about this bug go to:
https://bugs.launchpad.net/apache2/+bug/1750356/+subscriptions
--
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at:
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
