484360 - Add CRLDP tests.

Status: RESOLVED FIXED

(NSS :: Test, defect, P2)

Description

[Slavomir Katuscak]

Need to add CRLDP tests to NSS test suite.

Comment 1

[Slavomir Katuscak]

Attachment: CRLDP support for chains.sh. (checked in)

Patch adding CRLDP support to chains.sh.

1. Added crldp parameter for certificates, will add CRLDP link to certificate.

Example of use:

entity CA2
  type Intermediate
  crldp CA0
  issuer CA0

2. Added sendcrl command - copy selected CRL to path specified by NSS_AIA_PATH variable (the same as for AIA certificates)

Example of use:

sendcrl CA0

This functionality should be OK (CRLDP link is added correctly, CRL is copied), but testing scenario wouldn't work now, because vfychain doesn't support CRLDP fetching yet (see bug 497339).

Comment 2

[Alexei Volkov]

Comment on attachment 382486 [details] [diff] [review]
CRLDP support for chains.sh. (checked in)

Looks good. Please rename send_crl to something like copy_crl because this is what it does. Please provide scenario file for crldp.

Comment 3

[Slavomir Katuscak]

Comment on attachment 382486 [details] [diff] [review]
CRLDP support for chains.sh. (checked in)

Checking in chains.sh;
/cvsroot/mozilla/security/nss/tests/chains/chains.sh,v  <--  chains.sh
new revision: 1.19; previous revision: 1.18
done

Comment 4

[Slavomir Katuscak]

Attachment: Scenario file.

This scenario is expected to test one not revoked cert (EE1) and one revoked cert (EE2). Certificate CA0 used for revocation is fetched via AIA, CRL is also expected to be fetched, but it isn't.

I tried more experiments with flags, combination requireFreshInfo with crl fails for both EE1 and EE2, even without attempt to fetch certs from server (see bug 497339).

Comment 5

[Slavomir Katuscak]

Attachment: Scenario + small fixes.

Scenario for CRLDP tests.

Changes in chains.sh:
-removed reason flag
-added scenario numbering used for CRL files (to have unique file names and prevent problems when HTTP server caches them)
-fixed bug when SERIAL variable was not cleaned after cert was created (caused that more certs were created with the same ID)

Comment 6

[Alexei Volkov]

Comment on attachment 389927 [details] [diff] [review]
Scenario + small fixes.

Thanks, Slavo. r+

Comment 7

[Slavomir Katuscak]

Checking in chains.sh;
/cvsroot/mozilla/security/nss/tests/chains/chains.sh,v  <--  chains.sh
new revision: 1.21; previous revision: 1.20
done
RCS file: /cvsroot/mozilla/security/nss/tests/chains/scenarios/crldp.cfg,v
done
Checking in scenarios/crldp.cfg;
/cvsroot/mozilla/security/nss/tests/chains/scenarios/crldp.cfg,v  <--  crldp.cfg
initial revision: 1.1
done
Checking in scenarios/scenarios;
/cvsroot/mozilla/security/nss/tests/chains/scenarios/scenarios,v  <--  scenarios
new revision: 1.6; previous revision: 1.5
done

Comment 8

[Slavomir Katuscak]

I had to disable CRLDP tests, because Tinderboxes went orange.

Checking in scenarios;
/cvsroot/mozilla/security/nss/tests/chains/scenarios/scenarios,v  <--  scenarios
new revision: 1.7; previous revision: 1.6
done

Comment 9

[Slavomir Katuscak]

Attachment: Fixed numbering of CRLs and enabled CRLDP tests.

Using date/time instead of numbering from 0 in CRL file names. In previous version when tests were run in more cycles in one run, they didn't have unique CRL file names, this patch fixes it.

Comment 10

[Alexei Volkov]

Comment on attachment 393775 [details] [diff] [review]
Fixed numbering of CRLs and enabled CRLDP tests.

r=alexei

Comment 11

[Slavomir Katuscak]

Checking in chains.sh;
/cvsroot/mozilla/security/nss/tests/chains/chains.sh,v  <--  chains.sh
new revision: 1.23; previous revision: 1.22
done
Checking in scenarios/scenarios;
/cvsroot/mozilla/security/nss/tests/chains/scenarios/scenarios,v  <--  scenarios
new revision: 1.8; previous revision: 1.7
done

Comment 12

[Slavomir Katuscak]

Still one minor problem on AIX, that doesn't accept == as string comparison:
all.sh[12]: ==: 0403-012 A test command parameter is not valid.

Comment 13

[Slavomir Katuscak]

Attachment: Fix for strings comparison.

Comment 14

[Slavomir Katuscak]

Checking in chains.sh;
/cvsroot/mozilla/security/nss/tests/chains/chains.sh,v  <--  chains.sh
new revision: 1.24; previous revision: 1.23
done