This is an automated email from the ASF dual-hosted git repository.
csutherl pushed a commit to branch 10.1.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/10.1.x by this push:
new ec030b4e28 Skip OCSP tests when responder port is unavailable instead of fail (#1051)
ec030b4e28 is described below
commit ec030b4e2832348f10942277d4650ac628326b01
Author: Coty Sutherland <[email protected]>
AuthorDate: Tue Aug 25 14:34:51 2026 -0400
Skip OCSP tests when responder port is unavailable instead of fail (#1051)
* Skip soft-fail OCSP tests when responder port is unavailable and give the skip a reason
---------
Co-authored-by: Dimitris Soumis <[email protected]>
---
.../tomcat/util/net/ocsp/TestOcspEnabled.java | 32 +++++++++++++++++---
.../net/ocsp/TestOcspSoftFailInternalError.java | 34 ++++++++++++++++++----
.../util/net/ocsp/TestOcspSoftFailTryLater.java | 34 ++++++++++++++++++----
3 files changed, 86 insertions(+), 14 deletions(-)
diff --git a/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java b/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java
index 39b2028dcd..166390c04e 100644
--- a/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java
+++ b/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java
@@ -16,6 +16,7 @@
*/
package org.apache.tomcat.util.net.ocsp;
+import java.net.BindException;
import java.net.SocketException;
import java.util.ArrayList;
import java.util.Collection;
@@ -40,12 +41,35 @@ public class TestOcspEnabled extends OcspBaseTest {
@BeforeClass
public static void startOcspResponder() {
- ocspResponder = new TesterOcspResponder();
+ TesterOcspResponder responder = new TesterOcspResponder();
try {
- ocspResponder.start();
+ responder.start();
+ ocspResponder = responder;
} catch (Exception e) {
- e.printStackTrace();
+ responder.stop();
+ if (isBindException(e)) {
+ // The fixed OCSP responder port (8888, baked into the test
+ // certificates) is in use by another process. This is an
+ // environmental issue, so leave ocspResponder null to skip the
+ // tests rather than reporting spurious failures.
+ ocspResponder = null;
+ e.printStackTrace();
+ } else {
+ // Any other startup failure is a genuine problem.
+ throw new IllegalStateException("Failed to start OCSP responder", e);
+ }
+ }
+ }
+
+
+ private static boolean isBindException(Throwable t) {
+ while (t != null) {
+ if (t instanceof BindException) {
+ return true;
+ }
+ t = t.getCause();
}
+ return false;
}
@@ -106,7 +130,7 @@ public class TestOcspEnabled extends OcspBaseTest {
@Test
public void test() throws Exception {
- Assume.assumeNotNull(ocspResponder);
+ Assume.assumeTrue("OCSP responder unavailable (port 8888 in use?)", ocspResponder != null);
try {
doTest(clientCertValid, serverCertValid, verifyClientCert, verifyServerCert);
if (handshakeFailureExpected) {
diff --git a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java
index ea32d2b712..5de2c4d76c 100644
--- a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java
+++ b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java
@@ -17,6 +17,7 @@
package org.apache.tomcat.util.net.ocsp;
import java.io.IOException;
+import java.net.BindException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
@@ -40,13 +41,36 @@ public class TestOcspSoftFailInternalError extends OcspBaseTest {
@BeforeClass
public static void startOcspResponder() {
- ocspResponder = new TesterOcspResponder();
- ocspResponder.setFixedResponse(OcspResponse.INTERNAL_ERROR);
+ TesterOcspResponder responder = new TesterOcspResponder();
+ responder.setFixedResponse(OcspResponse.INTERNAL_ERROR);
try {
- ocspResponder.start();
+ responder.start();
+ ocspResponder = responder;
} catch (Exception e) {
- e.printStackTrace();
+ responder.stop();
+ if (isBindException(e)) {
+ // The fixed OCSP responder port (8888, baked into the test
+ // certificates) is in use by another process. This is an
+ // environmental issue, so leave ocspResponder null to skip the
+ // tests rather than reporting spurious failures.
+ ocspResponder = null;
+ e.printStackTrace();
+ } else {
+ // Any other startup failure is a genuine problem.
+ throw new IllegalStateException("Failed to start OCSP responder", e);
+ }
+ }
+ }
+
+
+ private static boolean isBindException(Throwable t) {
+ while (t != null) {
+ if (t instanceof BindException) {
+ return true;
+ }
+ t = t.getCause();
}
+ return false;
}
@@ -94,7 +118,7 @@ public class TestOcspSoftFailInternalError extends OcspBaseTest {
@Test
public void test() throws Exception {
- Assume.assumeNotNull(ocspResponder);
+ Assume.assumeTrue("OCSP responder unavailable (port 8888 in use?)", ocspResponder != null);
try {
doTest(clientCertValid, true, ClientCertificateVerification.ENABLED, false, softFail);
if (handshakeFailureExpected) {
diff --git a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java
index 3bf148d32e..e81002ea59 100644
--- a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java
+++ b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java
@@ -16,6 +16,7 @@
*/
package org.apache.tomcat.util.net.ocsp;
+import java.net.BindException;
import java.net.SocketException;
import java.util.ArrayList;
import java.util.Collection;
@@ -42,13 +43,36 @@ public class TestOcspSoftFailTryLater extends OcspBaseTest {
@BeforeClass
public static void startOcspResponder() {
- ocspResponder = new TesterOcspResponder();
- ocspResponder.setFixedResponse(OcspResponse.TRY_LATER);
+ TesterOcspResponder responder = new TesterOcspResponder();
+ responder.setFixedResponse(OcspResponse.TRY_LATER);
try {
- ocspResponder.start();
+ responder.start();
+ ocspResponder = responder;
} catch (Exception e) {
- e.printStackTrace();
+ responder.stop();
+ if (isBindException(e)) {
+ // The fixed OCSP responder port (8888, baked into the test
+ // certificates) is in use by another process. This is an
+ // environmental issue, so leave ocspResponder null to skip the
+ // tests rather than reporting spurious failures.
+ ocspResponder = null;
+ e.printStackTrace();
+ } else {
+ // Any other startup failure is a genuine problem.
+ throw new IllegalStateException("Failed to start OCSP responder", e);
+ }
+ }
+ }
+
+
+ private static boolean isBindException(Throwable t) {
+ while (t != null) {
+ if (t instanceof BindException) {
+ return true;
+ }
+ t = t.getCause();
}
+ return false;
}
@@ -96,7 +120,7 @@ public class TestOcspSoftFailTryLater extends OcspBaseTest {
@Test
public void test() throws Exception {
- Assume.assumeNotNull(ocspResponder);
+ Assume.assumeTrue("OCSP responder unavailable (port 8888 in use?)", ocspResponder != null);
try {
doTest(clientCertValid, true, ClientCertificateVerification.ENABLED, false, softFail);
if (handshakeFailureExpected) {
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.