Bug 50332

Created attachment 26337 [details]
mod_ssl -> mod_proxy note via conn_rec

In the event an SSL handshake from the httpd proxy to a backend fails, mod_proxy is not aware until it attempts to pass the request.

To duplicate, simply stand up an openssl s_server like so:
/usr/local/openssl/bin/openssl s_server -cert /root/certs/ssl.crt -key /root/certs/ssl.key -www -accept 8001 -Verify 1
/usr/local/openssl/bin/openssl s_server -cert /root/certs/ssl.crt -key /root/certs/ssl.key -www -accept 8002

And set up a balancer like so:
<Proxy balancer://mycluster>
   BalancerMember https://127.0.0.1:8001
   BalancerMember https://127.0.0.1:8002
</Proxy>

ProxyPass /test/ balancer://mycluster/



You will find that all requests to /test will attempt to connect, but fail on the first member. Worse yet, since no request ever gets through, the balancer never considers the next member for usage.

The attached patch utilizes a note on the conn_rec for mod_proxy_httpd to recognize that a failure has occurred. If a failure has been found, it's too late for that request, but the worker used is put in error state.

I am investigating as to whether or not this is needed for 2.3.