modules/proxy/proxy_connect.c

	proxy_connect.c revision 7aeac3e3e334cb421641c1a317b5d926e9dbd44c
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd/* ====================================================================
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * The Apache Software License, Version 1.1
fd9abdda70912b99b24e3bf1a38f26fde908a74cnd *
fd9abdda70912b99b24e3bf1a38f26fde908a74cnd * Copyright (c) 2000-2001 The Apache Software Foundation.  All rights
fd9abdda70912b99b24e3bf1a38f26fde908a74cnd * reserved.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * Redistribution and use in source and binary forms, with or without
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * modification, are permitted provided that the following conditions
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * are met:
96ad5d81ee4a2cc66a4ae19893efc8aa6d06fae7jailletc *
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * 1. Redistributions of source code must retain the above copyright
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *    notice, this list of conditions and the following disclaimer.
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen *
2e545ce2450a9953665f701bb05350f0d3f26275nd * 2. Redistributions in binary form must reproduce the above copyright
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen *    notice, this list of conditions and the following disclaimer in
d29d9ab4614ff992b0e8de6e2b88d52b6f1f153erbowen *    the documentation and/or other materials provided with the
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *    distribution.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *
af33a4994ae2ff15bc67d19ff1a7feb906745bf8rbowen * 3. The end-user documentation included with the redistribution,
3f08db06526d6901aa08c110b5bc7dde6bc39905nd *    if any, must include the following acknowledgment:
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *       "This product includes software developed by the
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *        Apache Software Foundation (http://www.apache.org/)."
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *    Alternately, this acknowledgment may appear in the software itself,
3f08db06526d6901aa08c110b5bc7dde6bc39905nd *    if and wherever such third-party acknowledgments normally appear.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * 4. The names "Apache" and "Apache Software Foundation" must
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *    not be used to endorse or promote products derived from this
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *    software without prior written permission. For written
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *    permission, please contact apache@apache.org.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung * 5. Products derived from this software may not be called "Apache",
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *    nor may "Apache" appear in their name, without prior written
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *    permission of the Apache Software Foundation.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen * DISCLAIMED.  IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * SUCH DAMAGE.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * ====================================================================
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * This software consists of voluntary contributions made by many
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * individuals on behalf of the Apache Software Foundation.  For more
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * information on the Apache Software Foundation, please see
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * <http://www.apache.org/>.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * Portions of this software are based upon public domain software
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * originally written at the National Center for Supercomputing Applications,
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * University of Illinois, Urbana-Champaign.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd */
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd/* CONNECT method for Apache proxy */
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd#define CORE_PRIVATE
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd#include "mod_proxy.h"
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd/*
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * This handles Netscape CONNECT method secure proxy requests.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * A connection is opened to the specified host and data is
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * passed through between the WWW site and the browser.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * This code is based on the INTERNET-DRAFT document
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * "Tunneling SSL Through a WWW Proxy" currently at
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * http://www.mcom.com/newsref/std/tunneling_ssl.html.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * If proxyhost and proxyport are set, we send a CONNECT to
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * the specified proxy..
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * FIXME: this doesn't log the number of bytes sent, but
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *        that may be okay, since the data is supposed to
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *        be transparent. In fact, this doesn't log at all
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *        yet. 8^)
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * FIXME: doesn't check any headers initally sent from the
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *        client.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * FIXME: should allow authentication, but hopefully the
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd *        generic proxy authentication is good enough.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd * FIXME: no check for r->assbackwards, whatever that is.
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd */
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1ndstatic int
1ac39787115a288f5e848344b1b1e8dccb1c58f1ndallowed_port(proxy_server_conf *conf, int port)
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd{
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    int i;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    int *list = (int *) conf->allowed_connect_ports->elts;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    for(i = 0; i < conf->allowed_connect_ports->nelts; i++) {
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	if(port == list[i])
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	    return 1;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    }
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    return 0;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd}
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1ndint ap_proxy_connect_handler(request_rec *r, char *url,
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd			  const char *proxyname, int proxyport)
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd{
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    apr_pool_t *p = r->pool;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    apr_socket_t *sock;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    char buffer[HUGE_STRING_LEN];
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    int nbytes, i, err;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd#if 0
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    apr_socket_t *client_sock = NULL;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd#endif
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    apr_pollfd_t *pollfd;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    apr_int32_t pollcnt;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    apr_int16_t pollevent;
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    apr_sockaddr_t *uri_addr, *connect_addr;
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    uri_components uri;
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    const char *connectname;
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    int connectport = 0;
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    void *sconf = r->server->module_config;
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    proxy_server_conf *conf =
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    (proxy_server_conf *) ap_get_module_config(sconf, &proxy_module);
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    /*
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen     * Step One: Determine Who To Connect To
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen     *
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen     * Break up the URL to determine the host to connect to
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen     */
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    /* we break the URL into host, port, uri */
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    if (HTTP_OK != ap_parse_hostinfo_components(p, url, &uri)) {
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen	return ap_proxyerror(r, HTTP_BAD_REQUEST,
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd			     apr_pstrcat(p, "URI cannot be parsed: ", url, NULL));
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    }
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r->server,
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd		 "proxy: CONNECT: connecting %s to %s:%d", url, uri.hostname, uri.port);
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    /* do a DNS lookup for the destination host */
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    err = apr_sockaddr_info_get(&uri_addr, uri.hostname, APR_UNSPEC, uri.port, 0, p);
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    /* are we connecting directly, or via a proxy? */
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    if (proxyname) {
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	connectname = proxyname;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	connectport = proxyport;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd        err = apr_sockaddr_info_get(&connect_addr, proxyname, APR_UNSPEC, proxyport, 0, p);
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    }
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    else {
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	connectname = uri.hostname;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	connectport = uri.port;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	connect_addr = uri_addr;
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    }
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, NULL,
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd		 "proxy: CONNECT: connecting to remote proxy %s on port %d", connectname, connectport);
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    /* check if ProxyBlock directive on this host */
d1636bdc2e674b84ee46f534b51be18ecac6bef5rbowen    if (OK != ap_proxy_checkproxyblock(r, conf, uri_addr)) {
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	return ap_proxyerror(r, HTTP_FORBIDDEN,
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd			     "Connect to remote machine blocked");
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    }
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    /* Check if it is an allowed port */
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    if (conf->allowed_connect_ports->nelts == 0) {
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	/* Default setting if not overridden by AllowCONNECT */
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	switch (uri.port) {
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd	    case DEFAULT_HTTPS_PORT:
f086b4b402fa9a2fefc7dda85de2a3cc1cd0a654rjung	    case DEFAULT_SNEWS_PORT:
727872d18412fc021f03969b8641810d8896820bhumbedooh		break;
0d0ba3a410038e179b695446bb149cce6264e0abnd	    default:
727872d18412fc021f03969b8641810d8896820bhumbedooh		return HTTP_FORBIDDEN;
cc7e1025de9ac63bd4db6fe7f71c158b2cf09fe4humbedooh	}
0d0ba3a410038e179b695446bb149cce6264e0abnd    } else if(!allowed_port(conf, uri.port))
cc7e1025de9ac63bd4db6fe7f71c158b2cf09fe4humbedooh	return HTTP_FORBIDDEN;
727872d18412fc021f03969b8641810d8896820bhumbedooh
0d0ba3a410038e179b695446bb149cce6264e0abnd
0d0ba3a410038e179b695446bb149cce6264e0abnd    /*
0d0ba3a410038e179b695446bb149cce6264e0abnd     * Step Two: Make the Connection
ac082aefa89416cbdc9a1836eaf3bed9698201c8humbedooh     *
0d0ba3a410038e179b695446bb149cce6264e0abnd     * We have determined who to connect to. Now make the connection.
0d0ba3a410038e179b695446bb149cce6264e0abnd     */
0d0ba3a410038e179b695446bb149cce6264e0abnd
727872d18412fc021f03969b8641810d8896820bhumbedooh    /* get all the possible IP addresses for the destname and loop through them
0d0ba3a410038e179b695446bb149cce6264e0abnd     * until we get a successful connection
0d0ba3a410038e179b695446bb149cce6264e0abnd     */
30471a4650391f57975f60bbb6e4a90be7b284bfhumbedooh    if (APR_SUCCESS != err) {
205f749042ed530040a4f0080dbcb47ceae8a374rjung	return ap_proxyerror(r, HTTP_BAD_GATEWAY, apr_pstrcat(p,
af33a4994ae2ff15bc67d19ff1a7feb906745bf8rbowen                             "DNS lookup failure for: ",
0d0ba3a410038e179b695446bb149cce6264e0abnd                             connectname, NULL));
7fec19672a491661b2fe4b29f685bc7f4efa64d4nd    }
7fec19672a491661b2fe4b29f685bc7f4efa64d4nd
7fec19672a491661b2fe4b29f685bc7f4efa64d4nd    /* create a new socket */
1ac39787115a288f5e848344b1b1e8dccb1c58f1nd    if ((apr_socket_create(&sock, APR_INET, SOCK_STREAM, r->pool)) != APR_SUCCESS) {
        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
            "proxy: error creating socket");
        return HTTP_INTERNAL_SERVER_ERROR;
    }

	/*
	 * At this point we have a list of one or more IP addresses of
	 * the machine to connect to. If configured, reorder this
	 * list so that the "best candidate" is first try. "best
	 * candidate" could mean the least loaded server, the fastest
	 * responding server, whatever.
         *
         * For now we do nothing, ie we get DNS round robin.
	 * XXX FIXME
	 */


    /* try each IP address until we connect successfully */
    {
	int failed = 1;
	while (connect_addr) {

	    /* make the connection out of the socket */
	    err = apr_connect(sock, connect_addr);

	    /* if an error occurred, loop round and try again */
            if (err != APR_SUCCESS) {
		ap_log_error(APLOG_MARK, APLOG_ERR, err, r->server,
			     "proxy: CONNECT: attempt to connect to %pI (%s) failed", connect_addr, connectname);
		connect_addr = connect_addr->next;
		continue;
            }

	    /* if we get here, all is well */
	    failed = 0;
	    break;
	}

	/* handle a permanent error from the above loop */
	if (failed) {
	    apr_socket_close(sock);
	    if (proxyname) {
		return DECLINED;
	    }
	    else {
		return HTTP_BAD_GATEWAY;
	    }
	}
    }


    /*
     * Step Three: Send the Request
     *
     * Send the HTTP/1.1 CONNECT request to the remote server
     */

    /* we are acting as a tunnel - the output filter stack should
     * be completely empty, because when we are done here we are done completely.
     * We add the NULL filter to the stack to do this...
     */
    r->output_filters = NULL;
    r->connection->output_filters = NULL;


    /* If we are connecting through a remote proxy, we need to pass
     * the CONNECT request on to it.
     */
    if (proxyport) {
	/* FIXME: Error checking ignored.
	 */
        ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r->server,
		     "proxy: CONNECT: sending the CONNECT request to the remote proxy");
        nbytes = apr_snprintf(buffer, sizeof(buffer),
			      "CONNECT %s HTTP/1.0" CRLF, r->uri);
        apr_send(sock, buffer, &nbytes);
        nbytes = apr_snprintf(buffer, sizeof(buffer),
			      "Proxy-agent: %s" CRLF CRLF, ap_get_server_version());
        apr_send(sock, buffer, &nbytes);
    }
    else {
        ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r->server,
		     "proxy: CONNECT: Returning 200 OK Status");
        nbytes = apr_snprintf(buffer, sizeof(buffer),
			      "HTTP/1.0 200 Connection Established" CRLF);
        apr_send(r->connection->client_socket, buffer, &nbytes);
        nbytes = apr_snprintf(buffer, sizeof(buffer),
			      "Proxy-agent: %s" CRLF CRLF, ap_get_server_version());
        apr_send(r->connection->client_socket, buffer, &nbytes);
    }

    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r->server,
		 "proxy: CONNECT: setting up poll()");

    /*
     * Step Four: Handle Data Transfer
     *
     * Handle two way transfer of data over the socket (this is a tunnel).
     */

/*    r->sent_bodyct = 1;*/

    if(apr_poll_setup(&pollfd, 2, r->pool) != APR_SUCCESS)
    {
	apr_socket_close(sock);
        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
            "proxy: CONNECT: error apr_poll_setup()");
        return HTTP_INTERNAL_SERVER_ERROR;
    }

    /* Add client side to the poll */
    apr_poll_socket_add(pollfd, r->connection->client_socket, APR_POLLIN);

    /* Add the server side to the poll */
    apr_poll_socket_add(pollfd, sock, APR_POLLIN);

    while (1) { /* Infinite loop until error (one side closes the connection) */
/*	ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r->server, "proxy: CONNECT: going to sleep (poll)");*/
        if (apr_poll(pollfd, &pollcnt, -1) != APR_SUCCESS)
        {
	    apr_socket_close(sock);
            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, "proxy: CONNECT: error apr_poll()");
            return HTTP_INTERNAL_SERVER_ERROR;
        }
/*	ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r->server,
                     "proxy: CONNECT: woke from select(), i=%d", pollcnt);*/

        if (pollcnt) {
	    apr_poll_revents_get(&pollevent, sock, pollfd);
            if (pollevent & APR_POLLIN) {
/*		ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r->server,
                             "proxy: CONNECT: sock was set");*/
                nbytes = sizeof(buffer);
                if (apr_recv(sock, buffer, &nbytes) == APR_SUCCESS) {
                    int o = 0;
                    while(nbytes)
                    {
                        i = nbytes;
			if (apr_send(r->connection->client_socket, buffer + o, &i) != APR_SUCCESS)
			    break;
                        o += i;
                        nbytes -= i;
                    }
                }
                else
                    break;
            }
            else if ((pollevent & APR_POLLERR) || (pollevent & APR_POLLHUP))
		break;


            apr_poll_revents_get(&pollevent, r->connection->client_socket, pollfd);
            if (pollevent & APR_POLLIN) {
/*		ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r->server,
                             "proxy: CONNECT: client was set");*/
                nbytes = sizeof(buffer);
                if (apr_recv(r->connection->client_socket, buffer, &nbytes) == APR_SUCCESS) {
                    int o = 0;
                    while(nbytes)
                    {
                        i = nbytes;
			if (apr_send(sock, buffer + o, &i) != APR_SUCCESS)
			    break;
                        o += i;
                        nbytes -= i;
                    }
                }
                else
                    break;
            }
            else if ((pollevent & APR_POLLERR) || (pollevent & APR_POLLHUP))
		break;
        }
        else
            break;
    }

    ap_log_error(APLOG_MARK, APLOG_DEBUG|APLOG_NOERRNO, 0, r->server,
		 "proxy: CONNECT: finished with poll() - cleaning up");

    /*
     * Step Five: Clean Up
     *
     * Close the socket and clean up
     */

    apr_socket_close(sock);

    return OK;
}