ci(nix): Startup/configure apache for renegotiate test under nix #4592

dougch · 2024-06-10T23:47:44Z

Resolved issues:

Partial for #3841

Description of changes:

This PR adds an Apache configuration and startup for the nix devShell, so the integration test renegotiate_apache will pass.

Call-outs:

Apache modules and configuration are somewhat distribution specific, in our current CI setup.

Instead of trying to patch/alter a distribution's apache configs, I've cat'ed together the minimum setup to get the renegotiate_apache test to pass, with as few configuration files as possible.

Testing:

[nix awslc] dougch:~/gitrepos/s2n-tls$ apache2_start
[nix awslc] dougch:~/gitrepos/s2n-tls$ curl -Sk  https://localhost:7777/
<html>
<head>
    <title>Renegotiation Testing Server</title>
</head>
<body>
<p>Welcome to the s2n renegotiation testing server! See the following endpoints:</p>

<ul>
    <li>
        <a href="/change_cipher_suite">/change_cipher_suite</a> forces a renegotiation by changing the negotiated
        cipher suite to AES-128-SHA.
    </li>
    <li>
        <a href="/mutual_auth">/mutual_auth</a> forces a renegotiation by enforcing mutual authentication.
    </li>
</ul>
</body>
</html>

Adhoc codebuild job of just the renegotiate_apache test.

How is this change tested (unit tests, fuzz tests, etc.)? locally, CI

Is this a refactor change? If so, how have you proved that the intended behavior hasn't changed?

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

goatgoose

If apache configuration is distribution specific, and can't be run with nix without a lot of assumptions, what is the benefit of running it with nix? Would another option be to just run apache in our ubuntu18 CI before running the renegotiate test with nix? If apache can only be run with nix on ubuntu18 anyway, I don't see much of a difference.

nix/shell.sh

codebuild/bin/apache2/apache2.conf

codebuild/bin/install_apache2.sh

codebuild/bin/apache2/apache2.conf

tests/integrationv2/apache2/nix/conf-enabled/localized-error-pages.conf

nix/shell.sh

tests/integrationv2/apache2/nix/apache2.conf

Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com>

goatgoose · 2024-06-17T18:29:42Z

If apache configuration is distribution specific, and can't be run with nix without a lot of assumptions, what is the benefit of running it with nix? Would another option be to just run apache in our ubuntu18 CI before running the renegotiate test with nix? If apache can only be run with nix on ubuntu18 anyway, I don't see much of a difference.

We discussed this offline. I was confused - the ubuntu18 configuration was used, but this should work with other environments using nix as well.

nix/shell.sh

tests/integrationv2/apache2/nix/conf-enabled/charset.conf

tests/integrationv2/apache2/nix/lock/.gitignore

nix/shell.sh

Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com>

nix/shell.sh

lrstewart · 2024-08-01T20:28:41Z

tests/integrationv2/apache2/nix/conf/mime.types

Why is this necessary? Wouldn't we just want the defaults?

tests/integrationv2/apache2/nix/conf/apache2.conf

nix/shell.sh

Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com>

goatgoose · 2024-08-02T15:39:55Z

tests/integrationv2/apache2/nix/conf/apache2.conf

+	SSLCipherSuite HIGH:!aNULL
+	SSLProtocol all -SSLv3


Is this configuration needed? How does it interact with the site-specific configuration?

s2n-tls/codebuild/bin/apache2/sites-enabled/renegotiate.conf

Lines 33 to 37 in aacb0ab

SSLProtocol -ALL +TLSv1.2

SSLHonorCipherOrder On

SSLCipherSuite HIGH:!aNULL:!MD5

SSLCompression Off

SSLInsecureRenegotiation Off

it should only apply to the *:443/ default site

lrstewart · 2024-08-13T16:50:38Z

tests/integrationv2/apache2/nix/conf/apache2.conf

+	AddCharset ISO-8859-5  .iso8859-5  .cyr .iso-ru
+	AddCharset ISO-8859-6  .iso8859-6  .arb .arabic
+	AddCharset ISO-8859-7  .iso8859-7  .grk .greek
+	AddCharset ISO-8859-8  .iso8859-8  .heb .hebrew


I have no idea what most of these character sets are, but since we now only support english (and spanish?), why include the obviously non-english ones?

Trimmed it down some more.

lrstewart · 2024-08-13T16:51:22Z

tests/integrationv2/apache2/nix/conf/apache2.conf

+	AddLanguage en .en
+	# es is ecmascript in /etc/mime.types
+	RemoveType  es
+	AddLanguage es .es


Why does our integ test server need spanish :P

It doesn't - removed.

lrstewart · 2024-08-13T16:54:25Z

tests/integrationv2/apache2/nix/conf/mime.types

#4592 (comment)

Unless this has to match some default, can we at least remove the commented out lines? This is almost 2k lines of config I don't think we understand or have really thought about. The most exotic type our integ test server needs is probably json...

Trimmed the comments from mime.types

lrstewart

I still think we can get the apache config more focused and minimal (especially mime.types), but this is fine.

dougch added 3 commits June 10, 2024 22:39

apache2 startup under nix functional

cd8f596

add an httpd nix store variable

f69b10b

final TODOs added

c78a311

github-actions bot added the s2n-core team label Jun 10, 2024

dougch changed the title ~~Nix apache2~~ ci(nix): Startup/configure apache for renegotiate test under nix Jun 10, 2024

dougch added 3 commits June 10, 2024 23:53

additonal callout

58dad41

missing nix utils

da4261c

missing directory

afca602

dougch requested a review from goatgoose June 11, 2024 00:20

dougch added 4 commits June 13, 2024 00:23

Backup the Ubuntu apache configs, modified to work with nixpkgs httpd

7c486cc

split out the site from the base apache config for nix

e09b8ff

Fix hardcoded module configs and handle distro specific group

052152a

missing dir

9c6baea

dougch force-pushed the nix_apache2 branch from 0c5c5da to 9c6baea Compare June 13, 2024 19:57

dougch added 2 commits June 13, 2024 20:23

remove nix hard coded paths

09940cb

fix nix file paths

5549e13

dougch marked this pull request as ready for review June 13, 2024 20:56

goatgoose reviewed Jun 17, 2024

View reviewed changes

dougch and others added 3 commits June 17, 2024 09:22

Update nix/shell.sh

6ad3101

Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com>

Update nix/shell.sh

846751c

Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com>

Update nix/shell.sh

5c82928

Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com>

Reverting changes to existing integ apache files.

8933245

dougch requested a review from goatgoose June 17, 2024 21:46

goatgoose reviewed Jun 17, 2024

View reviewed changes

nix/shell.sh Outdated Show resolved Hide resolved

tests/integrationv2/apache2/nix/conf-enabled/charset.conf Outdated Show resolved Hide resolved

tests/integrationv2/apache2/nix/lock/.gitignore Outdated Show resolved Hide resolved

pr feedback

bfc80e8

dougch requested a review from goatgoose June 18, 2024 23:04

goatgoose approved these changes Jun 19, 2024

View reviewed changes

nix/shell.sh Outdated Show resolved Hide resolved

Update nix/shell.sh

0f32b33

Co-authored-by: Sam Clark <3758302+goatgoose@users.noreply.github.com>

dougch requested a review from lrstewart June 19, 2024 19:15

dougch added 4 commits July 25, 2024 20:32

Refactor configs

a159c2a

Add apache modules; move files around

aae0495

consolidated apache config

bb85900

remove dup/unused sites file

993f670

dougch requested a review from goatgoose July 29, 2024 23:12

Merge branch 'main' into nix_apache2

0e187d6

lrstewart reviewed Aug 1, 2024

View reviewed changes

Update nix/shell.sh

6e0e3f7

Co-authored-by: Lindsay Stewart <stewart.r.lindsay@gmail.com>

dougch requested a review from lrstewart August 1, 2024 20:54

goatgoose reviewed Aug 2, 2024

View reviewed changes

Reduce langs/charsets

fd8406d

lrstewart reviewed Aug 13, 2024

View reviewed changes

Removing more from apache config

463ac52

dougch requested a review from lrstewart August 14, 2024 17:36

lrstewart approved these changes Aug 14, 2024

View reviewed changes

Merge branch 'main' into nix_apache2

4a7a170

dougch enabled auto-merge (squash) August 14, 2024 20:52

dougch added 2 commits August 15, 2024 09:08

Merge branch 'main' into nix_apache2

79c09a9

Merge branch 'main' into nix_apache2

dc29f51

dougch merged commit 45bf1d4 into aws:main Aug 15, 2024
35 checks passed

BrewTestBot mentioned this pull request Aug 20, 2024

s2n 1.5.1 Homebrew/homebrew-core#181832

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci(nix): Startup/configure apache for renegotiate test under nix #4592

ci(nix): Startup/configure apache for renegotiate test under nix #4592

dougch commented Jun 10, 2024 •

edited

Loading

goatgoose left a comment

goatgoose commented Jun 17, 2024

lrstewart Aug 1, 2024

goatgoose Aug 2, 2024

dougch Aug 6, 2024

lrstewart Aug 13, 2024

dougch Aug 14, 2024

lrstewart Aug 13, 2024

dougch Aug 14, 2024

lrstewart Aug 13, 2024

dougch Aug 14, 2024

lrstewart left a comment

	SSLProtocol -ALL +TLSv1.2
	SSLHonorCipherOrder On
	SSLCipherSuite HIGH:!aNULL:!MD5
	SSLCompression Off
	SSLInsecureRenegotiation Off

ci(nix): Startup/configure apache for renegotiate test under nix #4592

ci(nix): Startup/configure apache for renegotiate test under nix #4592

Conversation

dougch commented Jun 10, 2024 • edited Loading

Resolved issues:

Description of changes:

Call-outs:

Testing:

goatgoose left a comment

Choose a reason for hiding this comment

goatgoose commented Jun 17, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

lrstewart left a comment

Choose a reason for hiding this comment

dougch commented Jun 10, 2024 •

edited

Loading