INSSL - Test Plan

Preparation

Host platform

3rd-party tools

Both of the 3-rd party utilities used in the test are included in binary form in the test archive, for easy running of the test. Below is a description of these utilities and where the sources for them can be found.

thttpd

http_load

Tests Summary

Automatic tests (mandatory)

• protocol compliance - INSSL serves both 1.0 and 1.1 clients (nb: emulate 1.0 clt using telnet)
• performance - throughput test, reqs/second, http and https
• performance - throughput test, bytes/second (small & large file: 100 bytes, 6K), http and https
• performance - concurrent sessions test - opening up to the max number of connections at the same time

Manual / special tests (optional)

These tests either require operator intervention or special test conditions that are not available on the AppLogic grids that are currently set up.

• preserve client IP in logs
• l7_accept property test
• l3_accept property test
• allowed_hosts test
• ssl cert tests

Running the Tests

To run the tests on the controller:

Copy and un-compress the tests archive file.

Create a test application by connecting 2 instances of the LINUX appliance (srv1, srv2) and one instance of NET(ctl1) as follows:

INSSL.http -> srv1.in
INSSL.aux -> srv2.in

Your test application should look something like this:

Note that the names of the instances are important, they have to be INSSL (the testee), clt1, srv1, and srv2. The test scripts will access them all by name.

Change to the directory where the tests were un-archived.

Prepare the test setup, by running the following command (this also verifies SSH connectivity to the test appliance instances, needed to control the test automatically):

bash tst-prep.sh localhost app-name

where app-name is the name of the test harness application.

The script will take a minute or so to run, and will start the test harness and copy all necessary files into it.

If the setup completes without errors, run the tests:

bash runall.sh localhost app-name</var

Preparing the 3rd Party tools

If re-building the test utilities (thttpd and http_load) is needed, do the following:

• download and un-archive the sources
• build the sources (./configure ; make ), but don't do 'make install'
• copy the thttpd binary into the test root directory, copy the http_load bindary into the ./remote sub-directory in the test root directory
• run the tests, as described above

Design

Structure

• an AppLogic application (test harness) containing the component under test (INSSL) and the instances of the LINUX and NET appliances.
• test utilities and a remote test script, intended to run on the AppLogic controller. The test may also be run from a remote console that has SSH access to the AppLogic controller. Note: the remote access to the controller uses the experimental access macros that are being developed for use with a "closed" controller. Their use requires the setup of a "restricted" key, instead of or in addition to the normal (full access) SSH key in the .ssh/authorized_keys file on the controller.

The test script is fully automated and includes the ability to install the necessary test software on the LINUX and NET instances comprising the test harness.

Back-end Setup - Web space contents

Test Details

protocol compliance - INSSL serves both 1.0 and 1.1 clients

performance - throughput test, reqs/second

Use the 'http-load' utility to measure the request rate that INSSL can handle. 'http-load' should be used with '-parallel X' option, to submit requests as fast as it can, up to X pending requests in parallel (use X=3..10 - when requesting a static page from the THTTPD back-end, the response should be fast enough to saturate the CPU on which INSSL is running with very few pending requests). The /index.html file is requested for this test (<100 bytes size).

performance - throughput test, bytes/second (small & large file: 100 bytes, 6K)

performance - concurrent sessions test - opening up to the max number of connections at the same time

In this test, the http_load application is set to open a large number of simultaneous connections. This should complete without delay for up to the max # of connections supported by INSSL.

Once the max request limit is reached, the test drops all connections and after a short delay repeats the procedure, to verify that INSSL cleans up properly and can continue accepting new requests.

preserve client IP

l7_accept property test

• Start the application with l7_accept set to none and verify that pound is not started on INSSL
• Start the application with l7_accept set to both without setting a certificate and verify that application fails

l3_accept property test

• set l3_accept_proto to tcp, l3_accept_port to 25 and check that the port is forwarded to srv2 (use nmap on ctl1 to generate the request and tcpdump on srv2 to verify it is recieved)
• set l3_accept_proto to tcp, l3_accept_port blank and check that all tcp ports are forwarded to srv2 (use nmap on ctl1 to generate request on port 21, 53 and 3306 and tcpdump on srv2 to verify it is recieved)
• set l3_accept_proto to udp, l3_accept_port to 25 and check that the port is forwarded to srv2 (use nmap on ctl1 to generate the request and tcpdump on srv2 to verify it is recieved)
• set l3_accept_proto to udp, l3_accept_port blank and check that all tcp ports are forwarded to srv2 (use nmap on ctl1 to generate request on port 21, 53 and 3306 and tcpdump on srv2 to verify it is recieved)
• set l3_accept_proto to raw, l3_accept_port to 46 and check that the port is forwarded to srv2 (use nmap on ctl1 to generate the request and tcpdump on srv2 to verify it is recieved)

allowed_hosts test

• set allowed_hosts to a value different from the external IP of NET and verify that access to INSSL is denied (both to http and aux terminals)
• set allowed_hosts to the external IP of NET and verify that access to INSSL is allowed (both to http and aux terminals)

ssl cert tests

• put a password protected certificate and check that INSSL fails to start
• put invalid certificate and check INSSL fails to start

webdav

• enable webdav on srv2 and INSSL, verify that a valid upload can be made.
• disable webdav on INSSL and verify that a webdav upload fails

-- NetClime - 02 Apr 2008