You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by Johan Corveleyn <jc...@gmail.com> on 2012/08/11 10:25:02 UTC
running test-suite over https
Trying to further pin down issue #4174 [1], which only occurs with
serf over https (and only on Windows clients I think), I'd like to try
running the test-suite over https. Is there any documentation on that?
I looked in the community guide, in subversion/tests/README and in
subversion/tests/cmdline/README, but didn't find anything.
Getting apache configured with a self-signed cert or with a simple
example cert should be easy enough, but I'm wondering how to get the
test-suite to trust that server cert. Any hints?
[1] http://subversion.tigris.org/issues/show_bug.cgi?id=4174 (serf:
checkout / export over https errors out with "svn: E730053: Error
retrieving REPORT (730053)")
--
Johan
Re: running test-suite over https
Posted by Philip Martin <ph...@wandisco.com>.
I considered generating the certificate but I am wary of draining the
system entropy. I don't know how much entropy generating an SSL
certificate requires but the testsuite doesn't need a high quality
certificate and it should avoid using entropy if possible. So I
embedded a pre-generated certificate in the script.
Ben Reser <be...@reser.org> writes:
> Neon's test suite has some logic in it to generate certificates. We
> should probably do something similar for this.
>
> Side note: If someone implements it just please don't do what neon
> does and depend on the Gnu specific flag '-d' to the date command to
> figure out the right timestamp to set on the cert(s). I believe date
> -v is much more portable (though I haven't gotten around to checking
> more than OS X and Linux).
>
> On Mon, Aug 13, 2012 at 6:27 AM, Philip Martin
> <ph...@wandisco.com> wrote:
>> My mistake. In my case the certificate embedded in davautocheck.sh has
>> expired:
>>
>> W: Error validating server certificate for 'https://localhost:13864':
>> W: - The certificate is not issued by a trusted authority. Use the
>> W: fingerprint to validate the certificate manually!
>> W: - The certificate has expired.
>>
>> If I update the script to use an in-date certificate the tests PASS over
>> SSL.
>
--
Certified & Supported Apache Subversion Downloads:
http://www.wandisco.com/subversion/download
Re: running test-suite over https
Posted by Ben Reser <be...@reser.org>.
Neon's test suite has some logic in it to generate certificates. We
should probably do something similar for this.
Side note: If someone implements it just please don't do what neon
does and depend on the Gnu specific flag '-d' to the date command to
figure out the right timestamp to set on the cert(s). I believe date
-v is much more portable (though I haven't gotten around to checking
more than OS X and Linux).
On Mon, Aug 13, 2012 at 6:27 AM, Philip Martin
<ph...@wandisco.com> wrote:
> My mistake. In my case the certificate embedded in davautocheck.sh has
> expired:
>
> W: Error validating server certificate for 'https://localhost:13864':
> W: - The certificate is not issued by a trusted authority. Use the
> W: fingerprint to validate the certificate manually!
> W: - The certificate has expired.
>
> If I update the script to use an in-date certificate the tests PASS over
> SSL.
Re: running test-suite over https
Posted by Johan Corveleyn <jc...@gmail.com>.
On Tue, Aug 14, 2012 at 1:10 AM, Philip Martin
<ph...@wandisco.com> wrote:
> Johan Corveleyn <jc...@gmail.com> writes:
>
>> I tried all I can think of for configuring Apache. Pfffff.
>
> Do you have an explicit ServerName? Are you using VirtualHost? Can you
> connect using 1.7/neon? Can you connect using a browser?
Explicit ServerName: yes.
Using a VirtualHost: yes, I was, but now I've removed it ... still same problem.
1.7/neon: same error.
Browser: yes, no problem (after ignoring the security warnings about
the self-signed certificate)
> Here is the complete Apache config file generated by davautocheck.sh:
For my last attempt I actually made my configuration almost exactly
the same as the one in davautocheck.sh. So without a VirtualHost etc.
See attachment for my last attempt.
I also re-installed Apache (2.2.22 (including openssl 0.9.8t)) from
the officially distributed Windows binaries.
After all these attempts, I'm wondering if this even works (with
Windows clients, because it seems to work for you so I suppose it's
Windows specific): being able to accept a self-signed (or signed by
untrusted CA) certificate permanently. Maybe some strange quirk
somewhere ... ??
However, when I add --non-interactive and --trust-server-cert to the
command, it works. No prompt whatsoever. Why doesn't the test-suite
actually use those two options to suppress cert-stuff?
--
Johan
Re: running test-suite over https
Posted by Philip Martin <ph...@wandisco.com>.
Johan Corveleyn <jc...@gmail.com> writes:
> I tried all I can think of for configuring Apache. Pfffff.
Do you have an explicit ServerName? Are you using VirtualHost? Can you
connect using 1.7/neon? Can you connect using a browser?
Here is the complete Apache config file generated by davautocheck.sh:
LoadModule ssl_module "/usr/lib/apache2/modules/mod_ssl.so"
LoadModule mime_module "/usr/lib/apache2/modules/mod_mime.so"
LoadModule alias_module "/usr/lib/apache2/modules/mod_alias.so"
LoadModule dav_module "/usr/lib/apache2/modules/mod_dav.so"
LoadModule dav_svn_module "/home/pm/sw/subversion/obj/subversion/mod_dav_svn/.libs/mod_dav_svn.so"
LoadModule auth_basic_module "/usr/lib/apache2/modules/mod_auth_basic.so"
LoadModule authn_file_module "/usr/lib/apache2/modules/mod_authn_file.so"
LoadModule authz_user_module "/usr/lib/apache2/modules/mod_authz_user.so"
LoadModule authz_svn_module "/home/pm/sw/subversion/obj/subversion/mod_authz_svn/.libs/mod_authz_svn.so"
LockFile lock
User pm
Group pm
SSLEngine on
SSLCertificateFile /home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/cert.pem
SSLCertificateKeyFile /home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/cert-key.pem
Listen 24306
ServerName localhost
PidFile "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/pid"
LogFormat "%h %l %u %t \"%r\" %>s %b" common
CustomLog "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/access_log" common
ErrorLog "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/error_log"
LogLevel Debug
ServerRoot "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607"
DocumentRoot "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607"
ScoreBoardFile "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/run"
CoreDumpDirectory "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607"
TypesConfig "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/mime.types"
StartServers 4
MaxRequestsPerChild 0
<IfModule worker.c>
ThreadsPerChild 8
</IfModule>
MaxClients 16
HostNameLookups Off
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" format
CustomLog "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/req" format
CustomLog "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/ops" "%t %u %{SVN-REPOS-NAME}e %{SVN-ACTION}e" env=SVN-ACTION
<Directory />
AllowOverride none
</Directory>
<Directory "/home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607">
AllowOverride none
#Require all granted
</Directory>
<Location /svn-test-work/repositories>
DAV svn
SVNParentPath "/home/pm/sw/subversion/obj/subversion/tests/cmdline/svn-test-work/repositories"
AuthzSVNAccessFile "/home/pm/sw/subversion/obj/subversion/tests/cmdline/svn-test-work/authz"
AuthType Basic
AuthName "Subversion Repository"
AuthUserFile /home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/users
Require valid-user
SVNAdvertiseV2Protocol on
SVNCacheRevProps off
</Location>
<Location /svn-test-work/local_tmp/repos>
DAV svn
SVNPath "/home/pm/sw/subversion/obj/subversion/tests/cmdline/svn-test-work/local_tmp/repos"
AuthzSVNAccessFile "/home/pm/sw/subversion/obj/subversion/tests/cmdline/svn-test-work/authz"
AuthType Basic
AuthName "Subversion Repository"
AuthUserFile /home/pm/sw/subversion/obj/subversion/tests/cmdline/httpd-20120814-000607/users
Require valid-user
SVNAdvertiseV2Protocol on
</Location>
RedirectMatch permanent ^/svn-test-work/repositories/REDIRECT-PERM-(.*)$ /svn-test-work/repositories/$1
RedirectMatch ^/svn-test-work/repositories/REDIRECT-TEMP-(.*)$ /svn-test-work/repositories/$1
--
Certified & Supported Apache Subversion Downloads:
http://www.wandisco.com/subversion/download
Re: running test-suite over https
Posted by Johan Corveleyn <jc...@gmail.com>.
On Mon, Aug 13, 2012 at 3:27 PM, Philip Martin
<ph...@wandisco.com> wrote:
> Philip Martin <ph...@wandisco.com> writes:
>
>> Johan Corveleyn <jc...@gmail.com> writes:
>>
>>> <ph...@wandisco.com> wrote:
>>>> Me. subversion/tests/cmdline/davautocheck.sh does the relevant magic to
>>>> setup Apache if one uses:
>>>>
>>>> make davautocheck USE_SSL=1
>>>
>>> Nice. I made a change (locally) to win-tests.py to also pass this
>>> option, but it doesn't seem to work properly. I created a CA
>>> certificate and signed a server cert with that. When I pass
>>> --ssl-cert=server.crt, it fails with:
>>>
>>> [[[
>>> Error validating server certificate for 'https://localhost:443':
>>> - The certificate is not issued by a trusted authority. Use the
>>> fingerprint to validate the certificate manually!
>>> Certificate information:
>>> - Hostname: localhost
>>> - Valid: from Aug 13 00:26:09 2012 GMT until Aug 7 00:26:09 2032 GMT
>>> - Issuer: (null), Test, (null), Test, BE ((null))
>>> - Fingerprint: C2:50:D1:2C:03:32:26:8B:04:97:16:4A:F0:BB:E5:27:1A:A8:46:40
>>> (R)eject or accept (t)emporarily?
>>> ]]]
>>
>> I get the same on Linux. I believe it worked when I wrote it.
>
> My mistake. In my case the certificate embedded in davautocheck.sh has
> expired:
>
> W: Error validating server certificate for 'https://localhost:13864':
> W: - The certificate is not issued by a trusted authority. Use the
> W: fingerprint to validate the certificate manually!
> W: - The certificate has expired.
>
> If I update the script to use an in-date certificate the tests PASS over
> SSL.
Gah! This is driving me insane. I tried re-generating the cert, and
even copy-pasted your certs out of davautocheck.sh, but still getting
the same error:
[[[
Error validating server certificate for 'https://localhost:443':
- The certificate is not issued by a trusted authority. Use the
fingerprint to validate the certificate manually!
Certificate information:
- Hostname: localhost
- Valid: from Aug 13 14:09:04 2012 GMT until Dec 30 14:09:04 2039 GMT
- Issuer: (null), Internet Widgits Pty Ltd, (null), Some-State, AU ((null))
- Fingerprint: 2D:3A:FA:4C:C1:65:18:C9:D7:7D:DB:11:06:A9:9A:E6:E1:56:77:D3
(R)eject or accept (t)emporarily? r
]]]
Even when I try with a 1.7.4 (SlikSVN) client, same thing ...
[[[
R:\test\subversion\tests\cmdline>svn.exe import -m "Log message for
revision 1." svn-test-work\local_tmp\greekfiles
https://localhost:443/svn-test-work/local_tmp/repos --config-dir
R:\test\subversion\tests\cmdline\svn-test-work\local_tmp\config
--password rayjandom --no-auth-cache --username jrandom
Error validating server certificate for 'https://localhost:443':
- The certificate is not issued by a trusted authority. Use the
fingerprint to validate the certificate manually!
Certificate information:
- Hostname: localhost
- Valid: from Aug 13 14:09:04 2012 GMT until Dec 30 14:09:04 2039 GMT
- Issuer: (null), Internet Widgits Pty Ltd, (null), Some-State, AU ((null))
- Fingerprint: 2D:3A:FA:4C:C1:65:18:C9:D7:7D:DB:11:06:A9:9A:E6:E1:56:77:D3
(R)eject or accept (t)emporarily? r
]]]
I tried all I can think of for configuring Apache. Pfffff.
Maybe I should ditch my self-built Apache, and try the ready-built
Windows binary.
--
Johan
Re: running test-suite over https
Posted by Philip Martin <ph...@wandisco.com>.
Philip Martin <ph...@wandisco.com> writes:
> Johan Corveleyn <jc...@gmail.com> writes:
>
>> <ph...@wandisco.com> wrote:
>>> Me. subversion/tests/cmdline/davautocheck.sh does the relevant magic to
>>> setup Apache if one uses:
>>>
>>> make davautocheck USE_SSL=1
>>
>> Nice. I made a change (locally) to win-tests.py to also pass this
>> option, but it doesn't seem to work properly. I created a CA
>> certificate and signed a server cert with that. When I pass
>> --ssl-cert=server.crt, it fails with:
>>
>> [[[
>> Error validating server certificate for 'https://localhost:443':
>> - The certificate is not issued by a trusted authority. Use the
>> fingerprint to validate the certificate manually!
>> Certificate information:
>> - Hostname: localhost
>> - Valid: from Aug 13 00:26:09 2012 GMT until Aug 7 00:26:09 2032 GMT
>> - Issuer: (null), Test, (null), Test, BE ((null))
>> - Fingerprint: C2:50:D1:2C:03:32:26:8B:04:97:16:4A:F0:BB:E5:27:1A:A8:46:40
>> (R)eject or accept (t)emporarily?
>> ]]]
>
> I get the same on Linux. I believe it worked when I wrote it.
My mistake. In my case the certificate embedded in davautocheck.sh has
expired:
W: Error validating server certificate for 'https://localhost:13864':
W: - The certificate is not issued by a trusted authority. Use the
W: fingerprint to validate the certificate manually!
W: - The certificate has expired.
If I update the script to use an in-date certificate the tests PASS over
SSL.
--
Certified & Supported Apache Subversion Downloads:
http://www.wandisco.com/subversion/download
Re: running test-suite over https
Posted by Philip Martin <ph...@wandisco.com>.
Johan Corveleyn <jc...@gmail.com> writes:
> <ph...@wandisco.com> wrote:
>> Me. subversion/tests/cmdline/davautocheck.sh does the relevant magic to
>> setup Apache if one uses:
>>
>> make davautocheck USE_SSL=1
>
> Nice. I made a change (locally) to win-tests.py to also pass this
> option, but it doesn't seem to work properly. I created a CA
> certificate and signed a server cert with that. When I pass
> --ssl-cert=server.crt, it fails with:
>
> [[[
> Error validating server certificate for 'https://localhost:443':
> - The certificate is not issued by a trusted authority. Use the
> fingerprint to validate the certificate manually!
> Certificate information:
> - Hostname: localhost
> - Valid: from Aug 13 00:26:09 2012 GMT until Aug 7 00:26:09 2032 GMT
> - Issuer: (null), Test, (null), Test, BE ((null))
> - Fingerprint: C2:50:D1:2C:03:32:26:8B:04:97:16:4A:F0:BB:E5:27:1A:A8:46:40
> (R)eject or accept (t)emporarily?
> ]]]
I get the same on Linux. I believe it worked when I wrote it.
--
Certified & Supported Apache Subversion Downloads:
http://www.wandisco.com/subversion/download
Re: running test-suite over https
Posted by Johan Corveleyn <jc...@gmail.com>.
On Mon, Aug 13, 2012 at 9:28 AM, Philip Martin
<ph...@wandisco.com> wrote:
> Daniel Shahaf <d....@daniel.shahaf.name> writes:
>
>> Johan Corveleyn wrote on Sat, Aug 11, 2012 at 22:11:22 +0200:
>>>
>>> Okay, I see there is an --ssl-cert option in svntest/main.py which
>>> does the necessary stuff. It's just not exposed through win-tests.py.
>>
>> Someone must have added it while I wasn't looking...
>
> Me. subversion/tests/cmdline/davautocheck.sh does the relevant magic to
> setup Apache if one uses:
>
> make davautocheck USE_SSL=1
Nice. I made a change (locally) to win-tests.py to also pass this
option, but it doesn't seem to work properly. I created a CA
certificate and signed a server cert with that. When I pass
--ssl-cert=server.crt, it fails with:
[[[
Error validating server certificate for 'https://localhost:443':
- The certificate is not issued by a trusted authority. Use the
fingerprint to validate the certificate manually!
Certificate information:
- Hostname: localhost
- Valid: from Aug 13 00:26:09 2012 GMT until Aug 7 00:26:09 2032 GMT
- Issuer: (null), Test, (null), Test, BE ((null))
- Fingerprint: C2:50:D1:2C:03:32:26:8B:04:97:16:4A:F0:BB:E5:27:1A:A8:46:40
(R)eject or accept (t)emporarily?
]]]
Even though the cert is correctly put into a file in
config\auth\svn.ssl.server. Is this normal? Is there something wrong
with the issuer? Or is the only way to accept my certificate to also
add "ssl-authority-files=/path/to/ca.crt" in the servers file from
within main.py?
See also dav-tests.log in attachment.
--
Johan
Re: running test-suite over https
Posted by Philip Martin <ph...@wandisco.com>.
Daniel Shahaf <d....@daniel.shahaf.name> writes:
> Johan Corveleyn wrote on Sat, Aug 11, 2012 at 22:11:22 +0200:
>>
>> Okay, I see there is an --ssl-cert option in svntest/main.py which
>> does the necessary stuff. It's just not exposed through win-tests.py.
>
> Someone must have added it while I wasn't looking...
Me. subversion/tests/cmdline/davautocheck.sh does the relevant magic to
setup Apache if one uses:
make davautocheck USE_SSL=1
--
Certified & Supported Apache Subversion Downloads:
http://www.wandisco.com/subversion/download
Re: running test-suite over https
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
Johan Corveleyn wrote on Sat, Aug 11, 2012 at 22:11:22 +0200:
> On Sat, Aug 11, 2012 at 8:54 PM, Daniel Shahaf <d....@daniel.shahaf.name> wrote:
> > Johan Corveleyn wrote on Sat, Aug 11, 2012 at 10:25:02 +0200:
> >> Trying to further pin down issue #4174 [1], which only occurs with
> >> serf over https (and only on Windows clients I think), I'd like to try
> >> running the test-suite over https. Is there any documentation on that?
> >> I looked in the community guide, in subversion/tests/README and in
> >> subversion/tests/cmdline/README, but didn't find anything.
> >>
> >> Getting apache configured with a self-signed cert or with a simple
> >> example cert should be easy enough, but I'm wondering how to get the
> >> test-suite to trust that server cert. Any hints?
> >>
> >
> > Add the certificate to auth/svn.ssl.server/ under the config-dir that
> > svntest/main.py creates, or change _with_command() to pass
> > --trust-server-cert in addition to --non-interactive.
> >
> > Makes sense?
>
> Okay, I see there is an --ssl-cert option in svntest/main.py which
> does the necessary stuff. It's just not exposed through win-tests.py.
Someone must have added it while I wasn't looking...
Re: running test-suite over https
Posted by Johan Corveleyn <jc...@gmail.com>.
On Sat, Aug 11, 2012 at 8:54 PM, Daniel Shahaf <d....@daniel.shahaf.name> wrote:
> Johan Corveleyn wrote on Sat, Aug 11, 2012 at 10:25:02 +0200:
>> Trying to further pin down issue #4174 [1], which only occurs with
>> serf over https (and only on Windows clients I think), I'd like to try
>> running the test-suite over https. Is there any documentation on that?
>> I looked in the community guide, in subversion/tests/README and in
>> subversion/tests/cmdline/README, but didn't find anything.
>>
>> Getting apache configured with a self-signed cert or with a simple
>> example cert should be easy enough, but I'm wondering how to get the
>> test-suite to trust that server cert. Any hints?
>>
>
> Add the certificate to auth/svn.ssl.server/ under the config-dir that
> svntest/main.py creates, or change _with_command() to pass
> --trust-server-cert in addition to --non-interactive.
>
> Makes sense?
Okay, I see there is an --ssl-cert option in svntest/main.py which
does the necessary stuff. It's just not exposed through win-tests.py.
Thanks.
--
Johan
Re: running test-suite over https
Posted by Daniel Shahaf <d....@daniel.shahaf.name>.
Johan Corveleyn wrote on Sat, Aug 11, 2012 at 10:25:02 +0200:
> Trying to further pin down issue #4174 [1], which only occurs with
> serf over https (and only on Windows clients I think), I'd like to try
> running the test-suite over https. Is there any documentation on that?
> I looked in the community guide, in subversion/tests/README and in
> subversion/tests/cmdline/README, but didn't find anything.
>
> Getting apache configured with a self-signed cert or with a simple
> example cert should be easy enough, but I'm wondering how to get the
> test-suite to trust that server cert. Any hints?
>
Add the certificate to auth/svn.ssl.server/ under the config-dir that
svntest/main.py creates, or change _with_command() to pass
--trust-server-cert in addition to --non-interactive.
Makes sense?
> [1] http://subversion.tigris.org/issues/show_bug.cgi?id=4174 (serf:
> checkout / export over https errors out with "svn: E730053: Error
> retrieving REPORT (730053)")
>
> --
> Johan