Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make OCSP stapling tests more stable #97979

Merged
merged 5 commits into from
Feb 6, 2024
Merged

Make OCSP stapling tests more stable #97979

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
0cfcf10
WIP
rzikm Feb 5, 2024
fee4c11
Make Server OCSP tests more stable
rzikm Feb 5, 2024
0f5f900
uncomment
rzikm Feb 5, 2024
2d5c396
Last fix
rzikm Feb 5, 2024
f3bc8e2
Move attribute to class instead
rzikm Feb 6, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 11 additions & 0 deletions ...ibraries/System.Net.Security/src/System/Net/Security/SslStreamCertificateContext.Linux.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -154,6 +154,17 @@ partial void AddRootCertificate(X509Certificate2? rootCertificate, ref bool tran
return ValueTask.FromResult(_ocspResponse);
}

internal ValueTask<byte[]?> WaitForPendingOcspFetchAsync()
rzikm marked this conversation as resolved.
Show resolved Hide resolved
{
Task<byte[]?>? pending = _pendingDownload;
if (pending is not null && !pending.IsFaulted)
{
return new ValueTask<byte[]?>(pending);
}

return ValueTask.FromResult(DateTimeOffset.UtcNow <= _ocspExpiration ? _ocspResponse : null);
}

private ValueTask<byte[]?> DownloadOcspAsync()
{
Task<byte[]?>? pending = _pendingDownload;
Expand Down
54 changes: 36 additions & 18 deletions ...ibraries/System.Net.Security/tests/UnitTests/SslStreamCertificateContextOcspLinuxTests.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@ namespace System.Net.Security.Tests;
public class SslStreamCertificateContextOcspLinuxTests
{
[Fact]
[PlatformSpecific(TestPlatforms.Linux)]
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The class is named "OcspLinuxTests", can/should this attribute just be put on the class? (I think it works at that level)

public async Task OfflineContext_NoFetchOcspResponse()
{
await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity, ctxFactory, responder) =>
Expand All @@ -31,6 +32,7 @@ await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity
}

[Fact]
[PlatformSpecific(TestPlatforms.Linux)]
public async Task FetchOcspResponse_NoExpiration_Success()
{
await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity, ctxFactory, responder) =>
Expand All @@ -46,6 +48,7 @@ await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity
[Theory]
[InlineData(PkiOptions.OcspEverywhere)]
[InlineData(PkiOptions.OcspEverywhere | PkiOptions.IssuerAuthorityHasDesignatedOcspResponder)]
[PlatformSpecific(TestPlatforms.Linux)]
public async Task FetchOcspResponse_WithExpiration_Success(PkiOptions pkiOptions)
{
await SimpleTest(pkiOptions, async (root, intermediate, endEntity, ctxFactory, responder) =>
Expand All @@ -63,6 +66,7 @@ await SimpleTest(pkiOptions, async (root, intermediate, endEntity, ctxFactory, r
}

[Fact]
[PlatformSpecific(TestPlatforms.Linux)]
public async Task FetchOcspResponse_Expired_ReturnsNull()
{
await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity, ctxFactory, responder) =>
Expand All @@ -76,6 +80,7 @@ await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity
}

[Fact]
[PlatformSpecific(TestPlatforms.Linux)]
public async Task FetchOcspResponse_FirstInvalidThenValid()
{
await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity, ctxFactory, responder) =>
Expand All @@ -93,6 +98,7 @@ await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity
}

[Fact]
[PlatformSpecific(TestPlatforms.Linux)]
public async Task RefreshOcspResponse_BeforeExpiration()
{
await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity, ctxFactory, responder) =>
Expand All @@ -101,7 +107,8 @@ await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity
intermediate.RevocationExpiration = DateTimeOffset.UtcNow.Add(SslStreamCertificateContext.MinRefreshBeforeExpirationInterval);

SslStreamCertificateContext ctx = ctxFactory(false);
byte[] ocsp = await ctx.GetOcspResponseAsync();
byte[] ocsp = await ctx.WaitForPendingOcspFetchAsync();

Assert.NotNull(ocsp);

intermediate.RevocationExpiration = DateTimeOffset.UtcNow.AddDays(1);
Expand All @@ -111,24 +118,26 @@ await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity
byte[] ocsp2 = ctx.GetOcspResponseNoWaiting();
Assert.Equal(ocsp, ocsp2);

await RetryHelper.ExecuteAsync(async () =>
{
byte[] ocsp3 = await ctx.GetOcspResponseAsync();
Assert.NotNull(ocsp3);
Assert.NotEqual(ocsp, ocsp3);
}, maxAttempts: 5, backoffFunc: i => (i + 1) * 200 /* ms */);
// The download should succeed
byte[] ocsp3 = await ctx.WaitForPendingOcspFetchAsync();
Assert.NotNull(ocsp3);
Assert.NotEqual(ocsp, ocsp3);
});
}

[Fact]
[PlatformSpecific(TestPlatforms.Linux)]
public async Task RefreshOcspResponse_AfterExpiration()
{
await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity, ctxFactory, responder) =>
{
intermediate.RevocationExpiration = DateTimeOffset.UtcNow.AddSeconds(1);

SslStreamCertificateContext ctx = ctxFactory(false);
// Make sure the inner OCSP fetch finished
await ctx.WaitForPendingOcspFetchAsync();

// wait until the cached OCSP response expires
await Task.Delay(2000);

intermediate.RevocationExpiration = DateTimeOffset.UtcNow.AddDays(1);
Expand All @@ -137,14 +146,15 @@ await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity
byte[] ocsp = ctx.GetOcspResponseNoWaiting();
Assert.Null(ocsp);

// subsequent call will return the new response
byte[] ocsp2 = await ctx.GetOcspResponseAsync();
// The download should succeed
byte[] ocsp2 = await ctx.WaitForPendingOcspFetchAsync();
Assert.NotNull(ocsp2);
});
}

[Fact]
[OuterLoop("Takes about 15 seconds")]
[PlatformSpecific(TestPlatforms.Linux)]
public async Task RefreshOcspResponse_FirstInvalidThenValid()
{
Assert.True(SslStreamCertificateContext.MinRefreshBeforeExpirationInterval > SslStreamCertificateContext.RefreshAfterFailureBackOffInterval * 4, "Backoff interval is too long");
Expand All @@ -155,25 +165,33 @@ await SimpleTest(PkiOptions.OcspEverywhere, async (root, intermediate, endEntity
intermediate.RevocationExpiration = DateTimeOffset.UtcNow.Add(SslStreamCertificateContext.MinRefreshBeforeExpirationInterval);

SslStreamCertificateContext ctx = ctxFactory(false);
byte[] ocsp = await ctx.GetOcspResponseAsync();
// Make sure the inner OCSP fetch finished
byte[] ocsp = await ctx.WaitForPendingOcspFetchAsync();
Assert.NotNull(ocsp);

responder.RespondKind = RespondKind.Invalid;
for (int i = 0; i < 3; i++)
for (int i = 0; i < 2; i++)
{
await Task.Delay(SslStreamCertificateContext.RefreshAfterFailureBackOffInterval);
byte[] ocsp2 = await ctx.GetOcspResponseAsync();
Assert.Equal(ocsp, ocsp2);
await Task.Delay(SslStreamCertificateContext.RefreshAfterFailureBackOffInterval);
}

// make sure we try again only after backoff expires
await ctx.WaitForPendingOcspFetchAsync();
await Task.Delay(SslStreamCertificateContext.RefreshAfterFailureBackOffInterval);

// after responder comes back online, the staple is eventually refreshed
intermediate.RevocationExpiration = DateTimeOffset.UtcNow.AddDays(1);
responder.RespondKind = RespondKind.Normal;
await RetryHelper.ExecuteAsync(async () =>
{
byte[] ocsp3 = await ctx.GetOcspResponseAsync();
Assert.NotNull(ocsp3);
Assert.NotEqual(ocsp, ocsp3);
}, maxAttempts: 5, backoffFunc: i => (i + 1) * 200 /* ms */);

// dispatch background refresh (first call still returns the old cached value)
await ctx.GetOcspResponseAsync();

// after refresh we should have a new staple
byte[] ocsp3 = await ctx.WaitForPendingOcspFetchAsync();
Assert.NotNull(ocsp3);
Assert.NotEqual(ocsp, ocsp3);
});
}

Expand Down
Loading