httpd: set psgi.url_scheme to 'https' for TLS listeners

For users using the native TLS functionality of -httpd (instead
of using nginx + Plack::Middleware::ReverseProxy),
psgi.url_scheme=http was wrong and would lead to improper
redirects.

diff --git a/lib/PublicInbox/HTTPD.pm b/lib/PublicInbox/HTTPD.pm
index fb683f746a9c988875dd2ee0e141df8d23021d1c..02f424c67138edca6af65835b1f2feb328d3a72d 100644 (file)
--- a/lib/PublicInbox/HTTPD.pm
+++ b/lib/PublicInbox/HTTPD.pm
@@ -13,7 +13,7 @@ use PublicInbox::Daemon;
 sub pi_httpd_async { PublicInbox::HTTPD::Async->new(@_) }
 
 sub new {
-       my ($class, $sock, $app) = @_;
+       my ($class, $sock, $app, $client) = @_;
        my $n = getsockname($sock) or die "not a socket: $sock $!\n";
        my ($host, $port) = PublicInbox::Daemon::host_with_port($n);
 
@@ -23,7 +23,8 @@ sub new {
                SCRIPT_NAME => '',
                'psgi.version' => [ 1, 1 ],
                'psgi.errors' => \*STDERR,
-               'psgi.url_scheme' => 'http',
+               'psgi.url_scheme' => $client->can('accept_SSL') ?
+                                       'https' : 'http',
                'psgi.nonblocking' => Plack::Util::TRUE,
                'psgi.streaming' => Plack::Util::TRUE,
                'psgi.run_once'  => Plack::Util::FALSE,

diff --git a/script/public-inbox-httpd b/script/public-inbox-httpd
index 7b0ec56093e070c298f017e9324887557e9edd22..a4dd809916c5116db301ec30c65f0919a48517ec 100755 (executable)
--- a/script/public-inbox-httpd
+++ b/script/public-inbox-httpd
@@ -42,9 +42,10 @@ my $refresh = sub {
 };
 
 PublicInbox::Daemon::run('0.0.0.0:8080', $refresh,
-       sub ($$$) { # post_accept
-               my ($client, $addr, $srv) = @_;
+       sub ($$$) { # Listener->{post_accept}
+               my ($client, $addr, $srv, $tls_wrap) = @_;
                my $fd = fileno($srv);
-               my $h = $httpds{$fd} //= PublicInbox::HTTPD->new($srv, $app);
+               my $h = $httpds{$fd} //=
+                       PublicInbox::HTTPD->new($srv, $app, $client);
                PublicInbox::HTTP->new($client, $addr, $h),
        });

diff --git a/t/httpd-corner.psgi b/t/httpd-corner.psgi
index 5fab2ba48d1e39e05cc6bcff9c0005673661cb2f..e9a3a6b7c1c8bbf29a2c1d4658a3530433f9125b 100644 (file)
--- a/t/httpd-corner.psgi
+++ b/t/httpd-corner.psgi
@@ -111,8 +111,10 @@ my $app = sub {
        } elsif ($path eq '/pid') {
                $code = 200;
                push @$body, "$$\n";
+       } elsif ($path eq '/url_scheme') {
+               $code = 200;
+               push @$body, $env->{'psgi.url_scheme'}
        }
-
        [ $code, $h, $body ]
 };
 

diff --git a/t/httpd-https.t b/t/httpd-https.t
index b37492ebb2908524d41a6ba810d5697b5835135a..bf7d3f94de6c57965aa6883e9cdd68955cc36d08 100644 (file)
--- a/t/httpd-https.t
+++ b/t/httpd-https.t
@@ -53,11 +53,12 @@ for my $args (
        # normal HTTPS
        my $c = tcp_connect($https);
        IO::Socket::SSL->start_SSL($c, %o);
-       ok($c->print("GET /empty HTTP/1.1\r\n\r\nHost: example.com\r\n\r\n"),
-               'wrote HTTP request');
+       $c->print("GET /url_scheme HTTP/1.1\r\n\r\nHost: example.com\r\n\r\n")
+               or xbail "failed to write HTTP request: $!";
        my $buf = '';
-       sysread($c, $buf, 2007, length($buf)) until $buf =~ /\r\n\r\n/;
+       sysread($c, $buf, 2007, length($buf)) until $buf =~ /\r\n\r\nhttps?/;
        like($buf, qr!\AHTTP/1\.1 200!, 'read HTTP response');
+       like($buf, qr!\r\nhttps\z!, "psgi.url_scheme is 'https'");
 
        # HTTPS with bad hostname
        $c = tcp_connect($https);