mirror of
https://github.com/gogrlx/nats-server.git
synced 2026-04-02 03:38:42 -07:00
This PR backports the OCSP Peer feature option (as in 2.10 train) and includes two fixes for the existing OCSP Staple feature. OCSP Staple: 1. Fixed and clarified how NATS Server determines its own Issuer CA when obtaining and validating an OCSP Response for subsequent staple 2. Eliminated problematic assumption that all node peers are issued by same CA when NATS Server validates ROUTE and GATEWAY peer nodes 3. Added OCSP Response effectivity checks on ROUTE and GATEWAY peer-presented staple Note for #3: Allowed host clock skew between node peers set at 30-seconds. If the OCSP Response contains an empty assertion for NextUpdate, NATS Server will default to 1-hour validity (after ThisUpdate). It is recommended that CA OCSP Responder should assert NextUpdate.
Tests
Tests that run on Travis have been split into jobs that run in their own VM in parallel. This reduces the overall running time but also is allowing recycling of a job when we get a flapper as opposed to have to recycle the whole test suite.
JetStream Tests
For JetStream tests, we need to observe a naming convention so that no tests are omitted when running on Travis.
The script runTestsOnTravis.sh will run a given job based on the definition found in ".travis.yml".
As for the naming convention:
- All JetStream tests name should start with
TestJetStream - Cluster tests should go into
jetstream_cluster_test.goand start withTestJetStreamCluster - Super-cluster tests should go into
jetstream_super_cluster_test.goand start withTestJetStreamSuperCluster
Not following this convention means that some tests may not be executed on Travis.