Bug 1541450

Summary:	OCSP test cases in upstream test suite are skipped when building package
Product:	Red Hat Enterprise Linux 7	Reporter:	Hubert Kario <hkario>
Component:	nss	Assignee:	nss-nspr-maint <nss-nspr-maint>
Status:	CLOSED WONTFIX	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	unspecified	Docs Contact:
Priority:	high
Version:	7.5	CC:	dueno, mthacker, szidek
Target Milestone:	rc	Keywords:	Regression
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1566477 (view as bug list)		Environment:
Last Closed:	2019-02-11 15:39:52 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1645231
Bug Blocks:	1566477

Description Hubert Kario 2018-02-02 15:22:53 UTC

Description of problem:
No OCSP stapling test cases are run during upstream test suite, all are reported as skipped.

Version-Release number of selected component (if applicable):
nss-3.34.0-4.el7.x86_64

How reproducible:
always

Steps to Reproduce:
1. rpmbuild srpm

Actual results:
No connection reports "Received 1 Cert Status items (OCSP stapled data)"
All "OCSP Stapling" test are skipped:

ssl.sh: SSL Cert Status (OCSP Stapling)  - server fips/client normal ===============================
ssl.sh: skipping  OCSP stapling, signed response, good status (non-FIPS only)
ssl.sh: skipping  OCSP stapling, signed response, revoked status (non-FIPS only)
ssl.sh: skipping  OCSP stapling, signed response, unknown status (non-FIPS only)
ssl.sh: skipping  OCSP stapling, unsigned failure response (non-FIPS only)
ssl.sh: skipping  OCSP stapling, good status, bad signature (non-FIPS only)
ssl.sh: skipping  OCSP stapling, invalid cert status data (non-FIPS only)
ssl.sh: skipping  Valid cert, Server doesn't staple (non-FIPS only)
ssl.sh: skipping  Stress OCSP stapling, server uses random status (non-FIPS only)

ssl.sh: SSL Cert Status (OCSP Stapling) Extended Test - server fips/client normal ===============================
ssl.sh: skipping  OCSP stapling, signed response, good status for Extended Test
ssl.sh: skipping  OCSP stapling, signed response, revoked status for Extended Test
ssl.sh: skipping  OCSP stapling, signed response, unknown status for Extended Test
ssl.sh: skipping  OCSP stapling, unsigned failure response for Extended Test
ssl.sh: skipping  OCSP stapling, good status, bad signature for Extended Test
ssl.sh: skipping  OCSP stapling, invalid cert status data for Extended Test
ssl.sh: skipping  Valid cert, Server doesn't staple for Extended Test
ssl.sh: skipping  Stress OCSP stapling, server uses random status for Extended Test

ssl.sh: SSL Cert Status (OCSP Stapling)  - server normal/client fips ===============================
ssl.sh: skipping  OCSP stapling, signed response, good status (non-FIPS only)
ssl.sh: skipping  OCSP stapling, signed response, revoked status (non-FIPS only)
ssl.sh: skipping  OCSP stapling, signed response, unknown status (non-FIPS only)
ssl.sh: skipping  OCSP stapling, unsigned failure response (non-FIPS only)
ssl.sh: skipping  OCSP stapling, good status, bad signature (non-FIPS only)
ssl.sh: skipping  OCSP stapling, invalid cert status data (non-FIPS only)
ssl.sh: skipping  Valid cert, Server doesn't staple (non-FIPS only)
ssl.sh: skipping  Stress OCSP stapling, server uses random status (non-FIPS only)

Expected results:
At least one set of OCSP stapling tests passed

Additional info:

Comment 1 Kai Engert (:kaie) (inactive account) 2018-03-09 16:49:20 UTC

In my opinion this isn't acceptable and needs to be fixed.

Standa, can you grant qa-ack?

Comment 10 Simo Sorce 2019-02-11 15:39:52 UTC

This issue was not selected to be included either in Red Hat Enterprise Linux 7.7 because it is seen either as low or moderate impact to a small amount of use-cases. The next release will be in Maintenance Support 1 Phase, which means that qualified Critical and Important Security errata advisories (RHSAs) and Urgent Priority Bug Fix errata advisories (RHBAs) may be released as they become available. We will now close this issue, but if you believe that it qualifies for the Maintenance Support 1 Phase, please re-open; otherwise we recommend moving the request to Red Hat Enterprise Linux 8 if applicable.