{"action":"created","issue":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/1579","repository_url":"https://api.github.com/repos/letsencrypt/boulder","labels_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1579/labels{/name}","comments_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1579/comments","events_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1579/events","html_url":"https://github.com/letsencrypt/boulder/issues/1579","id":139406101,"number":1579,"title":"Transition to ctxhttp for CT","user":{"login":"riking","id":627891,"avatar_url":"https://avatars.githubusercontent.com/u/627891?v=3","gravatar_id":"","url":"https://api.github.com/users/riking","html_url":"https://github.com/riking","followers_url":"https://api.github.com/users/riking/followers","following_url":"https://api.github.com/users/riking/following{/other_user}","gists_url":"https://api.github.com/users/riking/gists{/gist_id}","starred_url":"https://api.github.com/users/riking/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/riking/subscriptions","organizations_url":"https://api.github.com/users/riking/orgs","repos_url":"https://api.github.com/users/riking/repos","events_url":"https://api.github.com/users/riking/events{/privacy}","received_events_url":"https://api.github.com/users/riking/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2016-03-08T22:00:32Z","updated_at":"2016-03-08T22:32:35Z","closed_at":null,"body":"https://godoc.org/golang.org/x/net/context/ctxhttp\r\n\r\nctxhttp is a library allowing for cancellable HTTP requests using context.Context.\r\n\r\nIf Certificate Transparency logs start taking a long time to perform requests, we might start having certificates that don't get logged after a first error, because the OCSP updater's tick finishes and it starts over again.\r\nUsing timeouts for the HTTP requests should help to mitigate the chances of such a cascading failure."},"comment":{"url":"https://api.github.com/repos/letsencrypt/boulder/issues/comments/193999265","html_url":"https://github.com/letsencrypt/boulder/issues/1579#issuecomment-193999265","issue_url":"https://api.github.com/repos/letsencrypt/boulder/issues/1579","id":193999265,"user":{"login":"jsha","id":220205,"avatar_url":"https://avatars.githubusercontent.com/u/220205?v=3","gravatar_id":"","url":"https://api.github.com/users/jsha","html_url":"https://github.com/jsha","followers_url":"https://api.github.com/users/jsha/followers","following_url":"https://api.github.com/users/jsha/following{/other_user}","gists_url":"https://api.github.com/users/jsha/gists{/gist_id}","starred_url":"https://api.github.com/users/jsha/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsha/subscriptions","organizations_url":"https://api.github.com/users/jsha/orgs","repos_url":"https://api.github.com/users/jsha/repos","events_url":"https://api.github.com/users/jsha/events{/privacy}","received_events_url":"https://api.github.com/users/jsha/received_events","type":"User","site_admin":false},"created_at":"2016-03-08T22:32:35Z","updated_at":"2016-03-08T22:32:35Z","body":"> If Certificate Transparency logs start taking a long time to perform requests, we might start having certificates that don't get logged after a first error, because the OCSP updater's tick finishes and it starts over again.\r\n> Using timeouts for the HTTP requests should help to mitigate the chances of such a cascading failure.\r\n\r\nTechnically, the current behavior \"works\" under this scenario and the proposed behavior doesn't.\r\n\r\nSay our deadline for the CT submission is 60 seconds, and the CT log consistently takes 70 seconds to respond successfully. Right now, that HTTP request will eventually succeed, and `AddChainWithContext` will return after 70 seconds, because the deadlining is only applied at retry time, not to the HTTP request itself. The Publisher would then write the SCT to the DB, and OCSP Updater would not trigger another try.\r\n\r\nAfter making this fix, the HTTP request would be cancelled at 60 seconds, so we would never receive a reply. The CT log might or might not finish adding the certificate to its log, but we definitely wouldn't get the SCT back.\r\n\r\nStill, I think it's worth making this change (eventually). If a CT log is consistently taking longer than our deadline for normal, successful cases, we should either increase the deadline or drop the log. The main thing we want is to know that when we've cancelled something for exceeding a deadline, that we've cancelled all its sub-tasks."}}