This is an automated email from the ASF dual-hosted git repository.
csutherl pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomcat.git
The following commit(s) were added to refs/heads/main by this push:
new 648009ea57 Skip OCSP tests when responder port is unavailable instead
of fail (#1051)
648009ea57 is described below
commit 648009ea5738e1b4af92bc005a9f4eb1e4fdf70e
Author: Coty Sutherland <[email protected]>
AuthorDate: Tue Aug 25 14:34:51 2026 -0400
Skip OCSP tests when responder port is unavailable instead of fail (#1051)
* Skip soft-fail OCSP tests when responder port is unavailable and give the
skip a reason
---------
Co-authored-by: Dimitris Soumis <[email protected]>
---
.../tomcat/util/net/ocsp/TestOcspEnabled.java | 32 +++++++++++++++++---
.../net/ocsp/TestOcspSoftFailInternalError.java | 34 ++++++++++++++++++----
.../util/net/ocsp/TestOcspSoftFailTryLater.java | 34 ++++++++++++++++++----
3 files changed, 86 insertions(+), 14 deletions(-)
diff --git a/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java
b/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java
index 39b2028dcd..166390c04e 100644
--- a/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java
+++ b/test/org/apache/tomcat/util/net/ocsp/TestOcspEnabled.java
@@ -16,6 +16,7 @@
*/
package org.apache.tomcat.util.net.ocsp;
+import java.net.BindException;
import java.net.SocketException;
import java.util.ArrayList;
import java.util.Collection;
@@ -40,12 +41,35 @@ public class TestOcspEnabled extends OcspBaseTest {
@BeforeClass
public static void startOcspResponder() {
- ocspResponder = new TesterOcspResponder();
+ TesterOcspResponder responder = new TesterOcspResponder();
try {
- ocspResponder.start();
+ responder.start();
+ ocspResponder = responder;
} catch (Exception e) {
- e.printStackTrace();
+ responder.stop();
+ if (isBindException(e)) {
+ // The fixed OCSP responder port (8888, baked into the test
+ // certificates) is in use by another process. This is an
+ // environmental issue, so leave ocspResponder null to skip the
+ // tests rather than reporting spurious failures.
+ ocspResponder = null;
+ e.printStackTrace();
+ } else {
+ // Any other startup failure is a genuine problem.
+ throw new IllegalStateException("Failed to start OCSP
responder", e);
+ }
+ }
+ }
+
+
+ private static boolean isBindException(Throwable t) {
+ while (t != null) {
+ if (t instanceof BindException) {
+ return true;
+ }
+ t = t.getCause();
}
+ return false;
}
@@ -106,7 +130,7 @@ public class TestOcspEnabled extends OcspBaseTest {
@Test
public void test() throws Exception {
- Assume.assumeNotNull(ocspResponder);
+ Assume.assumeTrue("OCSP responder unavailable (port 8888 in use?)",
ocspResponder != null);
try {
doTest(clientCertValid, serverCertValid, verifyClientCert,
verifyServerCert);
if (handshakeFailureExpected) {
diff --git
a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java
b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java
index ea32d2b712..5de2c4d76c 100644
--- a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java
+++ b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailInternalError.java
@@ -17,6 +17,7 @@
package org.apache.tomcat.util.net.ocsp;
import java.io.IOException;
+import java.net.BindException;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
@@ -40,13 +41,36 @@ public class TestOcspSoftFailInternalError extends
OcspBaseTest {
@BeforeClass
public static void startOcspResponder() {
- ocspResponder = new TesterOcspResponder();
- ocspResponder.setFixedResponse(OcspResponse.INTERNAL_ERROR);
+ TesterOcspResponder responder = new TesterOcspResponder();
+ responder.setFixedResponse(OcspResponse.INTERNAL_ERROR);
try {
- ocspResponder.start();
+ responder.start();
+ ocspResponder = responder;
} catch (Exception e) {
- e.printStackTrace();
+ responder.stop();
+ if (isBindException(e)) {
+ // The fixed OCSP responder port (8888, baked into the test
+ // certificates) is in use by another process. This is an
+ // environmental issue, so leave ocspResponder null to skip the
+ // tests rather than reporting spurious failures.
+ ocspResponder = null;
+ e.printStackTrace();
+ } else {
+ // Any other startup failure is a genuine problem.
+ throw new IllegalStateException("Failed to start OCSP
responder", e);
+ }
+ }
+ }
+
+
+ private static boolean isBindException(Throwable t) {
+ while (t != null) {
+ if (t instanceof BindException) {
+ return true;
+ }
+ t = t.getCause();
}
+ return false;
}
@@ -94,7 +118,7 @@ public class TestOcspSoftFailInternalError extends
OcspBaseTest {
@Test
public void test() throws Exception {
- Assume.assumeNotNull(ocspResponder);
+ Assume.assumeTrue("OCSP responder unavailable (port 8888 in use?)",
ocspResponder != null);
try {
doTest(clientCertValid, true,
ClientCertificateVerification.ENABLED, false, softFail);
if (handshakeFailureExpected) {
diff --git a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java
b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java
index 3bf148d32e..e81002ea59 100644
--- a/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java
+++ b/test/org/apache/tomcat/util/net/ocsp/TestOcspSoftFailTryLater.java
@@ -16,6 +16,7 @@
*/
package org.apache.tomcat.util.net.ocsp;
+import java.net.BindException;
import java.net.SocketException;
import java.util.ArrayList;
import java.util.Collection;
@@ -42,13 +43,36 @@ public class TestOcspSoftFailTryLater extends OcspBaseTest {
@BeforeClass
public static void startOcspResponder() {
- ocspResponder = new TesterOcspResponder();
- ocspResponder.setFixedResponse(OcspResponse.TRY_LATER);
+ TesterOcspResponder responder = new TesterOcspResponder();
+ responder.setFixedResponse(OcspResponse.TRY_LATER);
try {
- ocspResponder.start();
+ responder.start();
+ ocspResponder = responder;
} catch (Exception e) {
- e.printStackTrace();
+ responder.stop();
+ if (isBindException(e)) {
+ // The fixed OCSP responder port (8888, baked into the test
+ // certificates) is in use by another process. This is an
+ // environmental issue, so leave ocspResponder null to skip the
+ // tests rather than reporting spurious failures.
+ ocspResponder = null;
+ e.printStackTrace();
+ } else {
+ // Any other startup failure is a genuine problem.
+ throw new IllegalStateException("Failed to start OCSP
responder", e);
+ }
+ }
+ }
+
+
+ private static boolean isBindException(Throwable t) {
+ while (t != null) {
+ if (t instanceof BindException) {
+ return true;
+ }
+ t = t.getCause();
}
+ return false;
}
@@ -96,7 +120,7 @@ public class TestOcspSoftFailTryLater extends OcspBaseTest {
@Test
public void test() throws Exception {
- Assume.assumeNotNull(ocspResponder);
+ Assume.assumeTrue("OCSP responder unavailable (port 8888 in use?)",
ocspResponder != null);
try {
doTest(clientCertValid, true,
ClientCertificateVerification.ENABLED, false, softFail);
if (handshakeFailureExpected) {
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
