wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1174389 - Add result strings to PSM OCSP xpcshell tests. r=keeler

Browse Source
This commit is contained in:
Cykesiopka 2015-07-02 00:45:00 +02:00
parent 01d300654e
commit 881a288dce
7 changed files with 77 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

50
security/manager/ssl/tests/unit/test_ocsp_caching.js
View File

@ -4,6 +4,9 @@
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
"use strict";
// Checks various aspects of the OCSP cache, mainly to to ensure we do not fetch
// responses more than necessary.
let gFetchCount = 0;
let gGoodOCSPResponse = null;
@ -84,19 +87,27 @@ function add_tests() {
// This test assumes that OCSPStaplingServer uses the same cert for
// ocsp-stapling-unknown.example.com and ocsp-stapling-none.example.com.
// Get an Unknown response for the *.exmaple.com cert and put it in the
// Get an Unknown response for the *.example.com cert and put it in the
// OCSP cache.
add_connection_test("ocsp-stapling-unknown.example.com",
SEC_ERROR_OCSP_UNKNOWN_CERT,
clearSessionCache);
add_test(function() { do_check_eq(gFetchCount, 0); run_next_test(); });
add_test(function() {
equal(gFetchCount, 0,
"Stapled Unknown response -> a fetch should not have been attempted");
run_next_test();
});
// A failure to retrieve an OCSP response must result in the cached Unkown
// A failure to retrieve an OCSP response must result in the cached Unknown
// response being recognized and honored.
add_connection_test("ocsp-stapling-none.example.com",
SEC_ERROR_OCSP_UNKNOWN_CERT,
clearSessionCache);
add_test(function() { do_check_eq(gFetchCount, 1); run_next_test(); });
add_test(function() {
equal(gFetchCount, 1,
"No stapled response -> a fetch should have been attempted");
run_next_test();
});
// A valid Good response from the OCSP responder must override the cached
// Unknown response.
@ -117,14 +128,23 @@ function add_tests() {
});
add_connection_test("ocsp-stapling-none.example.com", PRErrorCodeSuccess,
clearSessionCache);
add_test(function() { do_check_eq(gFetchCount, 2); run_next_test(); });
add_test(function() {
equal(gFetchCount, 2,
"Cached Unknown response, no stapled response -> a fetch should" +
" have been attempted");
run_next_test();
});
// The Good response retrieved from the previous fetch must have replaced
// the Unknown response in the cache, resulting in the catched Good response
// being returned and no fetch.
add_connection_test("ocsp-stapling-none.example.com", PRErrorCodeSuccess,
clearSessionCache);
add_test(function() { do_check_eq(gFetchCount, 2); run_next_test(); });
add_test(function() {
equal(gFetchCount, 2,
"Cached Good response -> a fetch should not have been attempted");
run_next_test();
});
//---------------------------------------------------------------------------
@ -136,19 +156,31 @@ function add_tests() {
// added to the cache.
add_connection_test("ocsp-stapling-none.example.com", PRErrorCodeSuccess,
clearSessionCache);
add_test(function() { do_check_eq(gFetchCount, 1); run_next_test(); });
add_test(function() {
equal(gFetchCount, 1,
"No stapled response -> a fetch should have been attempted");
run_next_test();
});
// The error entry will prevent a fetch from happening for a while.
add_connection_test("ocsp-stapling-none.example.com", PRErrorCodeSuccess,
clearSessionCache);
add_test(function() { do_check_eq(gFetchCount, 1); run_next_test(); });
add_test(function() {
equal(gFetchCount, 1,
"Noted OCSP server failure -> a fetch should not have been attempted");
run_next_test();
});
// The error entry must not prevent a stapled OCSP response from being
// honored.
add_connection_test("ocsp-stapling-revoked.example.com",
SEC_ERROR_REVOKED_CERTIFICATE,
clearSessionCache);
add_test(function() { do_check_eq(gFetchCount, 1); run_next_test(); });
add_test(function() {
equal(gFetchCount, 1,
"Stapled Revoked response -> a fetch should not have been attempted");
run_next_test();
});
//---------------------------------------------------------------------------

6
security/manager/ssl/tests/unit/test_ocsp_no_hsts_upgrade.js
View File

@ -45,8 +45,10 @@ function run_test() {
let sslStatus = new FakeSSLStatus();
SSService.processHeader(Ci.nsISiteSecurityService.HEADER_HSTS, uri,
"max-age=10000", sslStatus, 0);
do_check_true(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
"localhost", 0));
ok(SSService.isSecureHost(Ci.nsISiteSecurityService.HEADER_HSTS,
"localhost", 0),
"Domain for the OCSP AIA URI should be considered a HSTS host, otherwise" +
" we wouldn't be testing what we think we're testing");
run_next_test();
}

3
security/manager/ssl/tests/unit/test_ocsp_required.js
View File

@ -47,7 +47,8 @@ function add_tests()
add_connection_test("ocsp-stapling-none.example.com",
SEC_ERROR_OCSP_BAD_SIGNATURE);
add_test(function () {
do_check_eq(gOCSPRequestCount, 1);
equal(gOCSPRequestCount, 1,
"OCSP request count should be 1 due to OCSP response caching");
gOCSPRequestCount = 0;
run_next_test();
});

18
security/manager/ssl/tests/unit/test_ocsp_stapling.js
View File

@ -170,11 +170,16 @@ function check_ocsp_stapling_telemetry() {
.getService(Ci.nsITelemetry)
.getHistogramById("SSL_OCSP_STAPLING")
.snapshot();
do_check_eq(histogram.counts[0], 0); // histogram bucket 0 is unused
do_check_eq(histogram.counts[1], 5); // 5 connections with a good response
do_check_eq(histogram.counts[2], 18); // 18 connections with no stapled resp.
do_check_eq(histogram.counts[3], 0); // 0 connections with an expired response
do_check_eq(histogram.counts[4], 21); // 21 connections with bad responses
equal(histogram.counts[0], 0,
"Should have 0 connections for unused histogram bucket 0");
equal(histogram.counts[1], 5,
"Actual and expected connections with a good response should match");
equal(histogram.counts[2], 18,
"Actual and expected connections with no stapled response should match");
equal(histogram.counts[3], 0,
"Actual and expected connections with an expired response should match");
equal(histogram.counts[4], 21,
"Actual and expected connections with bad responses should match");
run_next_test();
}
@ -190,7 +195,8 @@ function run_test() {
let fakeOCSPResponder = new HttpServer();
fakeOCSPResponder.registerPrefixHandler("/", function (request, response) {
response.setStatusLine(request.httpVersion, 500, "Internal Server Error");
do_check_true(gExpectOCSPRequest);
ok(gExpectOCSPRequest,
"Should be getting an OCSP request only when expected");
});
fakeOCSPResponder.start(8888);

17
security/manager/ssl/tests/unit/test_ocsp_stapling_expired.js
View File

@ -21,7 +21,7 @@ function add_ocsp_test(aHost, aExpectedResult, aOCSPResponseToServe) {
gOCSPRequestCount = 0;
},
function() {
do_check_eq(gOCSPRequestCount, 1);
equal(gOCSPRequestCount, 1, "Should have made 1 fallback OCSP request");
});
}
@ -158,10 +158,15 @@ function check_ocsp_stapling_telemetry() {
.getService(Ci.nsITelemetry)
.getHistogramById("SSL_OCSP_STAPLING")
.snapshot();
do_check_eq(histogram.counts[0], 0); // histogram bucket 0 is unused
do_check_eq(histogram.counts[1], 0); // 0 connections with a good response
do_check_eq(histogram.counts[2], 0); // 0 connections with no stapled resp.
do_check_eq(histogram.counts[3], 21); // 21 connections with an expired response
do_check_eq(histogram.counts[4], 0); // 0 connections with bad responses
equal(histogram.counts[0], 0,
"Should have 0 connections for unused histogram bucket 0");
equal(histogram.counts[1], 0,
"Actual and expected connections with a good response should match");
equal(histogram.counts[2], 0,
"Actual and expected connections with no stapled response should match");
equal(histogram.counts[3], 21,
"Actual and expected connections with an expired response should match");
equal(histogram.counts[4], 0,
"Actual and expected connections with bad responses should match");
run_next_test();
}

2
security/manager/ssl/tests/unit/test_ocsp_stapling_with_intermediate.js
View File

@ -38,7 +38,7 @@ function run_test() {
add_test(function () { ocspResponder.stop(run_next_test); });
add_test(function() {
do_check_eq(gOCSPRequestCount, 0);
equal(gOCSPRequestCount, 0, "No OCSP requests should have been made");
run_next_test();
});
run_next_test();

9
security/manager/ssl/tests/unit/test_ocsp_timeout.js
View File

@ -70,15 +70,18 @@ function add_tests_in_mode(useHardFail) {
// Windows XP). See Bug 1121117.
const FUZZ_MS = 300;
if (useHardFail) {
do_check_true(timeDifference + FUZZ_MS > 10000);
ok(timeDifference + FUZZ_MS > 10000,
"Automatic OCSP timeout should be about 10s for hard-fail");
} else {
do_check_true(timeDifference + FUZZ_MS > 2000);
ok(timeDifference + FUZZ_MS > 2000,
"Automatic OCSP timeout should be about 2s for soft-fail");
}
// Make sure we didn't wait too long.
// (Unfortunately, we probably can't have a tight upper bound on
// how long is too long for this test, because we might be running
// on slow hardware.)
do_check_true(timeDifference < 60000);
ok(timeDifference < 60000,
"Automatic OCSP timeout shouldn't be more than 60s");
clearOCSPCache();
run_next_test();
});