From d7626170794948b4f0ca270af0316f7e5fa38a99 Mon Sep 17 00:00:00 2001 From: Jeff King Date: Wed, 1 Feb 2023 06:37:21 -0500 Subject: [PATCH 1/4] t/lib-httpd: bump required apache version to 2.2 Apache 2.2 was released in 2005, almost 18 years ago. We can probably assume that people are running a version at least that old (and the stakes for removing it are fairly low, as the worst case is that they would not run the http tests against their ancient version). Dropping support for the older versions cleans up the config file a little, and will also enable us to bump the required version further (with more cleanups) in a future patch. Note that the file actually checks for version 2.1. In apache's versioning scheme, odd numbered versions are for development and even numbers are for stable releases. So 2.1 and 2.2 are effectively the same from our perspective. Older versions would just fail to start, which would generally cause us to skip the tests. However, we do have version detection code in lib-httpd.sh which produces a nicer error message, so let's update that, too. I didn't bother handling the case of "3.0", etc. Apache has been on 2.x for 21 years, with no signs of bumping the major version. And if they eventually do, I suspect there will be enough breaking changes that we'd need to update more than just the numeric version check. We can worry about that hypothetical when it happens. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano --- t/lib-httpd.sh | 11 +++++++---- t/lib-httpd/apache.conf | 8 -------- 2 files changed, 7 insertions(+), 12 deletions(-) diff --git a/t/lib-httpd.sh b/t/lib-httpd.sh index 608949ea80..8fc411ff41 100644 --- a/t/lib-httpd.sh +++ b/t/lib-httpd.sh @@ -99,16 +99,19 @@ then fi HTTPD_VERSION=$($LIB_HTTPD_PATH -v | \ - sed -n 's/^Server version: Apache\/\([0-9]*\)\..*$/\1/p; q') + sed -n 's/^Server version: Apache\/\([0-9.]*\).*$/\1/p; q') +HTTPD_VERSION_MAJOR=$(echo $HTTPD_VERSION | cut -d. -f1) +HTTPD_VERSION_MINOR=$(echo $HTTPD_VERSION | cut -d. -f2) -if test -n "$HTTPD_VERSION" +if test -n "$HTTPD_VERSION_MAJOR" then if test -z "$LIB_HTTPD_MODULE_PATH" then - if ! test $HTTPD_VERSION -ge 2 + if ! test "$HTTPD_VERSION_MAJOR" -eq 2 || + ! test "$HTTPD_VERSION_MINOR" -ge 2 then test_skip_or_die GIT_TEST_HTTPD \ - "at least Apache version 2 is required" + "at least Apache version 2.2 is required" fi if ! test -d "$DEFAULT_HTTPD_MODULE_PATH" then diff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf index 0294739a77..35f5e28507 100644 --- a/t/lib-httpd/apache.conf +++ b/t/lib-httpd/apache.conf @@ -38,13 +38,6 @@ Protocols h2c LockFile accept.lock - - - LoadModule auth_module modules/mod_auth.so - - - -= 2.1> LoadModule auth_basic_module modules/mod_auth_basic.so @@ -57,7 +50,6 @@ LockFile accept.lock LoadModule authz_host_module modules/mod_authz_host.so - = 2.4> From edd060dc84fb9b870df6f8344bd86b211608b5be Mon Sep 17 00:00:00 2001 From: Jeff King Date: Wed, 1 Feb 2023 06:38:24 -0500 Subject: [PATCH 2/4] t/lib-httpd: bump required apache version to 2.4 Apache 2.4 has been out since early 2012, almost 11 years. And its predecessor, 2.2, has been out of support since its last release in 2017, over 5 years ago. The last mention on the mailing list was from around the same time, in this thread: https://lore.kernel.org/git/20171231023234.21215-1-tmz@pobox.com/ We can probably assume that 2.4 is available everywhere. And the stakes are fairly low, as the worst case is that such a platform would skip the http tests. This lets us clean up a few minor version checks in the config file, but also revert f1f2b45be0 (tests: adjust the configuration for Apache 2.2, 2016-05-09). Its technique isn't _too_ bad, but certainly required a bit more explanation than the 2.4 version it replaced. I manually confirmed that the test in t5551 still behaves as expected (if you replace "cadabra" with "foo", the server correctly rejects the request). It will also help future patches which will no longer have to deal with conditional config for this old version. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano --- t/lib-httpd.sh | 4 ++-- t/lib-httpd/apache.conf | 22 ++++------------------ 2 files changed, 6 insertions(+), 20 deletions(-) diff --git a/t/lib-httpd.sh b/t/lib-httpd.sh index 8fc411ff41..5d2d56c445 100644 --- a/t/lib-httpd.sh +++ b/t/lib-httpd.sh @@ -108,10 +108,10 @@ then if test -z "$LIB_HTTPD_MODULE_PATH" then if ! test "$HTTPD_VERSION_MAJOR" -eq 2 || - ! test "$HTTPD_VERSION_MINOR" -ge 2 + ! test "$HTTPD_VERSION_MINOR" -ge 4 then test_skip_or_die GIT_TEST_HTTPD \ - "at least Apache version 2.2 is required" + "at least Apache version 2.4 is required" fi if ! test -d "$DEFAULT_HTTPD_MODULE_PATH" then diff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf index 35f5e28507..332617f10d 100644 --- a/t/lib-httpd/apache.conf +++ b/t/lib-httpd/apache.conf @@ -34,10 +34,6 @@ LoadModule http2_module modules/mod_http2.so Protocols h2c - -LockFile accept.lock - - LoadModule auth_basic_module modules/mod_auth_basic.so @@ -51,7 +47,6 @@ LockFile accept.lock LoadModule authz_host_module modules/mod_authz_host.so -= 2.4> LoadModule authn_core_module modules/mod_authn_core.so @@ -75,7 +70,6 @@ LockFile accept.lock LoadModule mpm_prefork_module modules/mod_mpm_prefork.so - PassEnv GIT_VALGRIND PassEnv GIT_VALGRIND_OPTIONS @@ -115,6 +109,10 @@ Alias /auth/dumb/ www/auth/dumb/ Header set Set-Cookie name=value + + Require expr %{HTTP:x-magic-one} == 'abra' + Require expr %{HTTP:x-magic-two} == 'cadabra' + SetEnv GIT_EXEC_PATH ${GIT_EXEC_PATH} SetEnv GIT_HTTP_EXPORT_ALL @@ -197,18 +195,6 @@ RewriteRule ^/intern-redir/(.*)/foo$ /smart/$1 [PT] RewriteRule ^/redir-objects/(.*/info/refs)$ /dumb/$1 [PT] RewriteRule ^/redir-objects/(.*/objects/.*)$ /dumb/$1 [R=301] -# Apache 2.2 does not understand , so we use RewriteCond. -# And as RewriteCond does not allow testing for non-matches, we match -# the desired case first (one has abra, two has cadabra), and let it -# pass by marking the RewriteRule as [L], "last rule, do not process -# any other matching RewriteRules after this"), and then have another -# RewriteRule that matches all other cases and lets them fail via '[F]', -# "fail the request". -RewriteCond %{HTTP:x-magic-one} =abra -RewriteCond %{HTTP:x-magic-two} =cadabra -RewriteRule ^/smart_headers/.* - [L] -RewriteRule ^/smart_headers/.* - [F] - LoadModule ssl_module modules/mod_ssl.so From d113449e265d1914e55f67f0e14e26a8d784b987 Mon Sep 17 00:00:00 2001 From: Jeff King Date: Wed, 1 Feb 2023 06:39:06 -0500 Subject: [PATCH 3/4] t/lib-httpd: drop SSLMutex config The SSL config enabled by setting LIB_HTTPD_SSL does not work with Apache versions greater than 2.2, as more recent versions complain about the SSLMutex directive. According to https://httpd.apache.org/docs/current/upgrading.html: Directives AcceptMutex, LockFile, RewriteLock, SSLMutex, SSLStaplingMutex, and WatchdogMutexPath have been replaced with a single Mutex directive. You will need to evaluate any use of these removed directives in your 2.2 configuration to determine if they can just be deleted or will need to be replaced using Mutex. Deleting this line will just use the system default, which seems sensible. The original came as part of faa4bc35a0 (http-push: add regression tests, 2008-02-27), but no specific reason is given there (or on the mailing list) for its presence. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano --- t/lib-httpd/apache.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/t/lib-httpd/apache.conf b/t/lib-httpd/apache.conf index 332617f10d..51a4fbcf62 100644 --- a/t/lib-httpd/apache.conf +++ b/t/lib-httpd/apache.conf @@ -203,7 +203,6 @@ SSLCertificateKeyFile httpd.pem SSLRandomSeed startup file:/dev/urandom 512 SSLRandomSeed connect file:/dev/urandom 512 SSLSessionCache none -SSLMutex file:ssl_mutex SSLEngine On From b08edf709dfcd79c3691370930cd89c4b9b16d2f Mon Sep 17 00:00:00 2001 From: Jeff King Date: Wed, 1 Feb 2023 06:39:26 -0500 Subject: [PATCH 4/4] t/lib-httpd: increase ssl key size to 2048 bits Recent versions of openssl will refuse to work with 1024-bit RSA keys, as they are considered insecure. I didn't track down the exact version in which the defaults were tightened, but the Debian-package openssl 3.0 on my system yields: $ LIB_HTTPD_SSL=1 ./t5551-http-fetch-smart.sh -v -i [...] SSL Library Error: error:0A00018F:SSL routines::ee key too small 1..0 # SKIP web server setup failed This could probably be overcome with configuration, but that's likely to be a headache (especially if it requires touching /etc/openssl). Let's just pick a key size that's less outrageously out of date. Signed-off-by: Jeff King Signed-off-by: Junio C Hamano --- t/lib-httpd/ssl.cnf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/t/lib-httpd/ssl.cnf b/t/lib-httpd/ssl.cnf index 6dab2579cb..812e8253f0 100644 --- a/t/lib-httpd/ssl.cnf +++ b/t/lib-httpd/ssl.cnf @@ -1,7 +1,7 @@ RANDFILE = $ENV::RANDFILE_PATH [ req ] -default_bits = 1024 +default_bits = 2048 distinguished_name = req_distinguished_name prompt = no [ req_distinguished_name ]