This is an automated email from the ASF dual-hosted git repository.
csutherl pushed a commit to branch 9.0.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/9.0.x by this push:
new 1f526c9779 Skip OCSP tests when responder port is unavailable instead of fail (#1051)
1f526c9779 is described below
commit 1f526c9779b0a829e84eec269c47af7c4ab5aa18
Author: Coty Sutherland <[email protected]>
AuthorDate: Tue Aug 25 14:34:51 2026 -0400
Skip OCSP tests when responder port is unavailable instead of fail (#1051)
* Skip soft-fail OCSP tests when responder port is unavailable and give the skip a reason
---------
Co-authored-by: Dimitris Soumis <[email protected]>
---
.../tomcat/util/net/ocsp/TestOcspEnabled.java | 32 +++++++++++++++++---
.../net/ocsp/TestOcspSoftFailInternalError.java | 34 ++++++++++++++++++----
.../util/net/ocsp/TestOcspSoftFailTryLater.java | 34 ++++++++++++++++++----
3 files changed, 86 insertions(+), 14 deletions(-)
diff --git a/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java b/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java
index 39b2028dcd..166390c04e 100644
--- a/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java
+++ b/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java
@@ -16,6 +16,7 @@
*/
package org.apache.tomcat.util.net.ocsp;
+import java.net.BindException;
import java.net.SocketException;
import java.util.ArrayList;
import java.util.Collection;
@@ -40,12 +41,35 @@ public class TestOcspEnabled extends OcspBaseTest {
@BeforeClass
public static void startOcspResponder() {
- ocspResponder = new TesterOcspResponder();
+ TesterOcspResponder responder = new TesterOcspResponder();
try {
- ocspResponder.start();
+ responder.start();
+ ocspResponder = responder;
} catch (Exception e) {
- e.printStackTrace();
+ responder.stop();
+ if (isBindException(e)) {
+ // The fixed OCSP responder port (8888, baked into the test
+ // certificates) is in use by another process. This is an
+ // environmental issue, so leave ocspResponder null to skip the
+ // tests rather than reporting spurious failures.
+ ocspResponder = null;
+ e.printStackTrace();
+ } else {
+ // Any other startup failure is a genuine problem.
+ throw new IllegalStateException("Failed to start OCSP responder", e);
+ }
+ }
+ }
+
+
+ private static boolean isBindException(Throwable t) {
+ while (t != null) {
+ if (t instanceof BindException) {
+ return true;
+ }
+ t = t.getCause();
}
+ return false;
}
@@ -106,7 +130,7 @@ public class TestOcspEnabled extends OcspBaseTest {
@Test
public void test() throws Exception {
- Assume.assumeNotNull(ocspResponder);
+ Assume.assumeTrue("OCSP responder unavailable (port 8888 in use?)", ocspResponder != null);
try {
doTest(clientCertValid, serverCertValid, verifyClientCert, verifyServerCert);
if (handshakeFailureExpected) {
diff --git a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java
index 82ce886cfb..f3ae6a6065 100644
--- a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java
+++ b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java
@@ -17,6 +17,7 @@
package org.apache.tomcat.util.net.ocsp;
import java.io.IOException;
+import java.net.BindException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
@@ -40,13 +41,36 @@ public class TestOcspSoftFailInternalError extends OcspBaseTest {
@BeforeClass
public static void startOcspResponder() {
- ocspResponder = new TesterOcspResponder();
- ocspResponder.setFixedResponse(OcspResponse.INTERNAL_ERROR);
+ TesterOcspResponder responder = new TesterOcspResponder();
+ responder.setFixedResponse(OcspResponse.INTERNAL_ERROR);
try {
- ocspResponder.start();
+ responder.start();
+ ocspResponder = responder;
} catch (Exception e) {
- e.printStackTrace();
+ responder.stop();
+ if (isBindException(e)) {
+ // The fixed OCSP responder port (8888, baked into the test
+ // certificates) is in use by another process. This is an
+ // environmental issue, so leave ocspResponder null to skip the
+ // tests rather than reporting spurious failures.
+ ocspResponder = null;
+ e.printStackTrace();
+ } else {
+ // Any other startup failure is a genuine problem.
+ throw new IllegalStateException("Failed to start OCSP responder", e);
+ }
+ }
+ }
+
+
+ private static boolean isBindException(Throwable t) {
+ while (t != null) {
+ if (t instanceof BindException) {
+ return true;
+ }
+ t = t.getCause();
}
+ return false;
}
@@ -94,7 +118,7 @@ public class TestOcspSoftFailInternalError extends OcspBaseTest {
@Test
public void test() throws Exception {
- Assume.assumeNotNull(ocspResponder);
+ Assume.assumeTrue("OCSP responder unavailable (port 8888 in use?)", ocspResponder != null);
try {
doTest(clientCertValid, true, ClientCertificateVerification.ENABLED, false, softFail);
if (handshakeFailureExpected) {
diff --git a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java
index 2abf56393a..05018b130a 100644
--- a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java
+++ b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java
@@ -16,6 +16,7 @@
*/
package org.apache.tomcat.util.net.ocsp;
+import java.net.BindException;
import java.net.SocketException;
import java.util.ArrayList;
import java.util.Collection;
@@ -44,13 +45,36 @@ public class TestOcspSoftFailTryLater extends OcspBaseTest {
@BeforeClass
public static void startOcspResponder() {
- ocspResponder = new TesterOcspResponder();
- ocspResponder.setFixedResponse(OcspResponse.TRY_LATER);
+ TesterOcspResponder responder = new TesterOcspResponder();
+ responder.setFixedResponse(OcspResponse.TRY_LATER);
try {
- ocspResponder.start();
+ responder.start();
+ ocspResponder = responder;
} catch (Exception e) {
- e.printStackTrace();
+ responder.stop();
+ if (isBindException(e)) {
+ // The fixed OCSP responder port (8888, baked into the test
+ // certificates) is in use by another process. This is an
+ // environmental issue, so leave ocspResponder null to skip the
+ // tests rather than reporting spurious failures.
+ ocspResponder = null;
+ e.printStackTrace();
+ } else {
+ // Any other startup failure is a genuine problem.
+ throw new IllegalStateException("Failed to start OCSP responder", e);
+ }
+ }
+ }
+
+
+ private static boolean isBindException(Throwable t) {
+ while (t != null) {
+ if (t instanceof BindException) {
+ return true;
+ }
+ t = t.getCause();
}
+ return false;
}
@@ -98,7 +122,7 @@ public class TestOcspSoftFailTryLater extends OcspBaseTest {
@Test
public void test() throws Exception {
- Assume.assumeNotNull(ocspResponder);
+ Assume.assumeTrue("OCSP responder unavailable (port 8888 in use?)", ocspResponder != null);
try {
doTest(clientCertValid, true, ClientCertificateVerification.ENABLED, false, softFail);
if (handshakeFailureExpected) {
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.