CI: run everything pytest-able and various cleanups

.github/workflows/linux.yml

@@ -22,6 +22,9 @@ on:
       - '**.md'
       - changes-entries/*
 
+permissions:
+  contents: read
+
 env:
   MARGS: "-j2"
   CFLAGS: "-g"
@@ -95,6 +98,26 @@ jobs:
               APU_VERSION=1.6.3
               APU_CONFIG="--with-crypto --with-ldap"
           # -------------------------------------------------------------------------
+          - name: APR 1.7.6, APR-util 1.6.3, LDAP
+            config: --enable-mods-shared=reallyall
+            pkgs: ldap-utils
+            env: |
+              APR_VERSION=1.7.6
+              APU_VERSION=1.6.3
+              APU_CONFIG="--with-crypto --with-ldap"
+              TEST_MALLOC=1
+              TEST_LDAP=1
+              TEST_ARGS="-defines LDAP"
+              TESTS="t/modules/"
+          # -------------------------------------------------------------------------
+          - name: APR 1.7.x, APR-util 1.6.x
+            config: --enable-mods-shared=reallyall
+            env: |
+              APR_VERSION=1.7.x
+              APU_VERSION=1.6.x
+              APU_CONFIG="--with-crypto --with-ldap"
+              CLEAR_CACHE=1
+          # -------------------------------------------------------------------------
           - name: APR 1.8.x, APR-util 1.7.x
             config: --enable-mods-shared=reallyall
             env: |
@@ -103,6 +126,25 @@ jobs:
               APU_CONFIG="--with-crypto --with-ldap"
               CLEAR_CACHE=1
           # -------------------------------------------------------------------------
+          - name: APR 1.7.x, APR-util 1.7.x, LDAP
+            config: --enable-mods-shared=reallyall
+            pkgs: ldap-utils
+            env: |
+              APR_VERSION=1.7.x
+              APU_VERSION=1.7.x
+              APU_CONFIG="--with-crypto --with-ldap"
+              TEST_MALLOC=1
+              TEST_LDAP=1
+              TEST_ARGS="-defines LDAP"
+              TESTS="t/modules/"
+              CLEAR_CACHE=1
+          # -------------------------------------------------------------------------
+          - name: APR trunk thread debugging
+            config: --enable-mods-shared=reallyall --with-mpm=event
+            env: |
+              APR_VERSION=trunk
+              APR_CONFIG="--with-crypto --enable-thread-debug"
+          # -------------------------------------------------------------------------
           - name: Pool-debug
             config: --enable-mods-shared=reallyall
             env: |
@@ -171,94 +213,52 @@ jobs:
               BUILDCONFIG="--with-regen-expr"
               MFLAGS=
           # -------------------------------------------------------------------------
-          - name: APR 1.7.6, APR-util 1.6.3, LDAP
-            config: --enable-mods-shared=reallyall
-            pkgs: ldap-utils
-            env: |
-              APR_VERSION=1.7.6
-              APU_VERSION=1.6.3
-              APU_CONFIG="--with-crypto --with-ldap"
-              TEST_MALLOC=1
-              TEST_LDAP=1
-              TEST_ARGS="-defines LDAP"
-              TESTS="t/modules/"
-          # -------------------------------------------------------------------------
-          - name: APR 1.7.x, APR-util 1.7.x, LDAP
-            config: --enable-mods-shared=reallyall
-            pkgs: ldap-utils
-            env: |
-              APR_VERSION=1.7.x
-              APU_VERSION=1.7.x
-              APU_CONFIG="--with-crypto --with-ldap"
-              TEST_MALLOC=1
-              TEST_LDAP=1
-              TEST_ARGS="-defines LDAP"
-              TESTS="t/modules/"
-              CLEAR_CACHE=1
-          # -------------------------------------------------------------------------
-          ### TODO: if: *condition_not_24x
-          - name: APR trunk thread debugging
-            config: --enable-mods-shared=reallyall --with-mpm=event
-            env: |
-              APR_VERSION=trunk
-              APR_CONFIG="--with-crypto --enable-thread-debug"
-          # -------------------------------------------------------------------------
           - name: UBSan
             notest-cflags: -fsanitize=undefined -fno-sanitize-recover=undefined
             config: --enable-mods-shared=reallyall --disable-http2
             env: |
               NOTEST_LIBS=-lubsan
               TEST_UBSAN=1
+              TEST_PYTEST=1
           # -------------------------------------------------------------------------
           - name: ASan
             notest-cflags: -ggdb -fsanitize=address -fno-sanitize-recover=address -fno-omit-frame-pointer
             config: --enable-mods-shared=reallyall
+            pkgs: nghttp2-client
             env: |
               APR_VERSION=1.7.x
               APU_VERSION=1.7.x
               APU_CONFIG="--with-crypto --with-ldap"
               TEST_ASAN=1
+              TEST_PYTEST=1
               CLEAR_CACHE=1
           # -------------------------------------------------------------------------
           - name: ASan, pool-debug
             notest-cflags: -ggdb -fsanitize=address -fno-sanitize-recover=address -fno-omit-frame-pointer
             config: --enable-mods-shared=reallyall
+            pkgs: nghttp2-client
             env: |
               APR_VERSION=1.7.x
               APR_CONFIG="--enable-pool-debug"
               APU_VERSION=1.7.x
               APU_CONFIG="--with-crypto --with-ldap"
               TEST_ASAN=1
+              TEST_PYTEST=1
               CLEAR_CACHE=1
           # -------------------------------------------------------------------------
-          - name: HTTP/2 test suite
+          # Runs every pytest-based test suite (pytest_suite/ + all
+          # test/modules/*/ pyhttpd suites except modules/md, which needs a
+          # local ACME/pebble server that isn't available here) via `make
+          # check-all-pytest`. See TEST_PYTEST in test/travis_run_linux.sh.
+          - name: Python pytest test suites
             config: --enable-mods-shared=reallyall --with-mpm=event --enable-mpms-shared=all
-            pkgs: curl python3-pytest nghttp2-client python3-cryptography python3-requests python3-multipart python3-filelock python3-websockets
+            pkgs: nghttp2-client
             env: |
               APR_VERSION=1.7.6
               APU_VERSION=1.6.3
               APU_CONFIG="--with-crypto"
               NO_TEST_FRAMEWORK=1
-              TEST_INSTALL=1
-              TEST_H2=1
-              TEST_CORE=1
-              TEST_PROXY=1
-          # -------------------------------------------------------------------------
-          ### TODO: if: *condition_not_24x
-          ### TODO: pebble install is broken.
-          # - name: ACME test suite
-          #   config: --enable-mods-shared=reallyall --with-mpm=event --enable-mpms-shared=event
-          #   pkgs: >-
-          #     python3-pytest nghttp2-client python3-cryptography python3-requests python3-filelock
-          #     golang-1.17 curl
-          #   env: |
-          #     APR_VERSION=1.7.6
-          #     APU_VERSION=1.6.3
-          #     APU_CONFIG="--with-crypto"
-          #     GOROOT=/usr/lib/go-1.17
-          #     NO_TEST_FRAMEWORK=1
-          #     TEST_INSTALL=1
-          #     TEST_MD=1
+              TEST_PYTEST=1
           # -------------------------------------------------------------------------
           ### TODO: if: *condition_not_24x
           - name: Configured w/reduced exports
@@ -355,9 +355,9 @@ jobs:
     - name: Install prerequisites
       run: sudo apt-get install -o Acquire::Retries=5
                     cpanminus libtool-bin libapr1-dev libaprutil1-dev
-                    liblua5.3-dev libbrotli-dev libcurl4-openssl-dev     
+                    liblua5.3-dev libbrotli-dev libcurl4-openssl-dev
                     libnghttp2-dev libjansson-dev libpcre2-dev gdb
-                    perl-doc libsasl2-dev ${{ matrix.pkgs }} check
+                    perl-doc libsasl2-dev curl pipx ${{ matrix.pkgs }} check
     - uses: actions/checkout@v6
     - uses: actions/checkout@v6
       with:
@@ -384,6 +384,11 @@ jobs:
         name: config.log-${{ env.JOBID }}
         path: |
           /home/runner/build/**/config.log
+    - name: Install uv
+      if: env.TEST_PYTEST == '1'
+      run: |
+        pipx install uv
+        echo "$HOME/.local/bin" >> $GITHUB_PATH
     - name: Build and test
       run: ./test/travis_run_linux.sh
     - uses: actions/upload-artifact@v7
@@ -393,3 +398,5 @@ jobs:
         path: |
           **/config.log
           test/perl-framework/t/logs/error_log
+          test/pytest_suite/t/logs/error_log
+          test/gen/apache/logs/error_log

.github/workflows/windows.yml

@@ -22,6 +22,9 @@ on:
       - '**.md'
       - changes-entries/*
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}

.gitignore

@@ -337,14 +337,19 @@ Release
 /support/logresolve
 /support/ab
 /support/apxs
+/support/apxs-ng
 /support/apachectl
 /support/checkgid
 /support/dbmmanage
+/support/dbmmanage-ng
 /support/envvars-std
 /support/log_server_status
+/support/log_server_status-ng
 /support/logresolve.pl
 /support/split-logfile
+/support/split-logfile-ng
 /support/phf_abuse_log.cgi
+/support/phf_abuse_log-ng.cgi
 /support/httxt2dbm
 /support/fcgistarter
 /support/firehose

CHANGES

@@ -1,6 +1,9 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.1
 
+  * mod_ssl: Add support for OpenSSL provider based certificate
+    stores. [Graham Leggett]
+
   *) mod_proxy_beacon: Back-end reverse proxy servers can announce
      themselves and be auto-added to their front-end proxy balancer.
      [Jim Jagielski]

Makefile.in

@@ -34,7 +34,7 @@ DISTCLEAN_TARGETS  = include/ap_config_auto.h include/ap_config_layout.h \
 	build/pkg/pkginfo build/config_vars.sh bsd_converted
 EXTRACLEAN_TARGETS = configure include/ap_config_auto.h.in generated_lists \
 	httpd.spec
-PHONY_TARGETS := check check-conf check-dirs check-include unittest-objdir
+PHONY_TARGETS := check check-conf check-dirs check-include check-pytest check-all-pytest unittest-objdir
 
 TESTS =
 TEST_CONFIG =
@@ -495,6 +495,9 @@ check/modules/stamp: build/config_vars.mk
 check-pytest: check-tree check/bin/apachectl check/config.ini check/modules/stamp
 	PYHTTPD_CONFIG=$(top_builddir)/check/config.ini $(PYTEST3) $(PYTEST_DIRS)
 
+check-all-pytest: check-tree check/bin/apachectl check/config.ini check/modules/stamp
+	PYHTTPD_CONFIG=$(top_builddir)/check/config.ini $(SHELL) $(top_srcdir)/test/run-all-tests.sh --apxs "$(top_builddir)/check/bin/apxs"
+
 # Runs all configured/available test targets.
 check: $(CHECK_TARGETS)
 

STATUS

@@ -104,6 +104,7 @@ THINGS THAT SHOULD BE CONSIDERED EARLY IN THE 2.6/3.0 DEVELOPMENT CYCLE:
   * Candidates to remove:
     - mod_access_compat
     - mod_imagemap
+    - mod_cern_meta
     - mod_privileges
     - mod_noloris
     - mod_ssl_ct

changes-entries/cern-meta-header-injection.txt

@@ -0,0 +1,2 @@
+  *) mod_cern_meta: Reject HTTP framing headers in metadata files to prevent
+     response splitting.  [Joe Orton]

changes-entries/ldap-url-cache-uaf.txt

@@ -0,0 +1,2 @@
+  *) mod_ldap: Fix intermittent worker crashes under concurrent
+     LDAP-authenticated requests.  [Joe Orton]

changes-entries/pr68527.txt

@@ -0,0 +1,2 @@
+  *) mod_dir: Fix a crash in fixup_dir for a request not mapped to any type. 
+     PR68527.  [Eric Covener]

changes-entries/remoteip-proxy-v2-local.txt

@@ -0,0 +1,2 @@
+  *) mod_remoteip: Fix crash with PROXY v2 LOCAL command and
+     RemoteIPProxyProtocol enabled.  [Joe Orton]

changes-entries/substitute-maxlinelength-overflow.txt

@@ -0,0 +1,2 @@
+  *) mod_substitute: Fix SubstituteMaxLineLength to reject values too
+     large for the K/M/G suffix.  [Joe Orton]

changes-entries/substitute-pattern-oob-read.txt

@@ -0,0 +1,2 @@
+  *) mod_substitute: Fix crash or misbehaviour when loading a Substitute
+     directive with a missing closing delimiter.  [Joe Orton]

docs/log-message-tags/next-number

@@ -1 +1 @@
-10597
+10618