741873 - If the OCSP server is unreachable during NSS test suite execution, return a failure

Status: RESOLVED FIXED

(NSS :: Test, defect)

Description

[Kai Engert (:KaiE:)]

As of today, if the NSS test suite fails to contact the expected OCSP server, it will gracefully ignore this failure, and simply report
  OCSP server not accessible, skipping OCSP tests
in output.log

I propose, once we have the OCSP tests working again, that the NSS test suite should report a test failure (orange tinderbox) if the OCSP server cannot be reached.

Comment 1

[Kai Engert (:KaiE:)]

Attachment: Patch v1 [checked in]

Comment 2

[Robert Relyea]

Comment on attachment 612015 [details] [diff] [review]
Patch v1 [checked in]

r+ rrelyea

looks like a good idea.

Comment 3

[Kai Engert (:KaiE:)]

Checking in chains.sh;
/cvsroot/mozilla/security/nss/tests/chains/chains.sh,v  <--  chains.sh
new revision: 1.32; previous revision: 1.31
done

Comment 4

[Kai Engert (:KaiE:)]

The Mac tinderbox machine experience regular failure in the ping test. Despite the ocsp host being online all the time, the test suite complains the server cannot be reached. I suspect trouble in the home network using wireless connectivity.

As an attempt to fix the ping test, I've checked in a change, which increases the timeout for the ping response to 10 seconds.

Checking in chains.sh;
/cvsroot/mozilla/security/nss/tests/chains/chains.sh,v  <--  chains.sh
new revision: 1.33; previous revision: 1.32
done

Comment 5

[Kai Engert (:KaiE:)]

Backing out, reopening.
/cvsroot/mozilla/security/nss/tests/chains/chains.sh,v  <--  chains.sh
new revision: 1.35; previous revision: 1.34

The ping test fails frequently, which I cannot explain yet, because ocsp.kuix.de is constantly up. Maybe the build slaves have a very high system load at the time they attempt the ping.

I think, rather than using ping, it would be better to perform some kind of TCP based test to the OCSP server port serving the HTTP protocol.

Comment 6

[Kai Engert (:KaiE:)]

IMHO the classic "ping" test is too unreliable for our purposes.

I propose to use the "tstclnt -q" feature, which performs a TCP/IP socket connection to the destination server, then disconnects, without transferring any data.

I think this would be a more reliable test.
It would work even with Firewalls that filter the ICMP packages used by standard ping.

Comment 7

[Kai Engert (:KaiE:)]

Attachment: Additional Patch v2 [checked in]

Added a timeout parameter (20) to the tcp/ip based connection test, required for environments that block packets on the OCSP port.

Comment 8

[Robert Relyea]

Comment on attachment 617509 [details] [diff] [review]
Additional Patch v2 [checked in]

r+ rrelyea

Comment 9

[Kai Engert (:KaiE:)]

checked in both patches.

Checking in chains.sh;
/cvsroot/mozilla/security/nss/tests/chains/chains.sh,v  <--  chains.sh
new revision: 1.36; previous revision: 1.35
done