Add OCSP resp test for future revocation time

tests/data_files/Makefile

@@ -119,6 +119,14 @@ authorized-ocsp-responder-for-server2-ca.crt: authorized-ocsp-responder-for-serv
 	$(OPENSSL) x509 -req -extfile $(cli_crt_extensions_file) -CAkey server2.key -passin "pass:$(test_ca_pwd_rsa)" -CA server2-ca.crt -extensions ocsp -days 3653 -set_serial 20 -sha256 -in $< -out $@
 all_final += authorized-ocsp-responder-for-server2-ca.crt
 
+server2-in-database-revoked-future.csr: server2.key $(test_ca_config_file) test-ca-index.txt test-ca-serial.txt test-ca-index.txt.attr
+	$(OPENSSL) req -config $(test_ca_config_file) -key $< -passin "pass:$(test_ca_pwd_rsa)" -subj "/C=NL/O=PolarSSL/CN=Mbed TLS OCSP future revoked test cert" -out $@ -new -sha256
+all_intermediate += server2-in-database-revoked-future.csr
+server2-in-database-revoked-future.crt: server2-in-database-revoked-future.csr $(test_ca_config_file) test-ca-index.txt test-ca-serial.txt test-ca-index.txt.attr test-ca-sha256.crt
+	$(OPENSSL) ca -batch -config $(test_ca_config_file) -extensions server_cert -cert test-ca-sha256.crt -keyfile $(test_ca_key_file_rsa) -days 3653 -notext -md sha256 -passin "pass:$(test_ca_pwd_rsa)" -in $< -out $@
+	$(FAKETIME) -f "+3652d" $(OPENSSL) ca -config $(test_ca_config_file) -passin "pass:$(test_ca_pwd_rsa)" -cert test-ca-sha256.crt -notext -keyfile $(test_ca_key_file_rsa) -revoke $@
+all_final += server2-in-database-revoked-future.crt
+
 ################################################################
 #### Generate OCSP responses using existing certificates
 ################################################################
@@ -170,6 +178,9 @@ all_intermediate += ocsp-req-for-server2-in-database-revoked.der
 ocsp-req-for-good-revoked-unknown.der: server2.crt server2-in-database.crt server2-in-database-revoked.crt test-ca-sha256.crt
 	$(OPENSSL) ocsp -issuer test-ca-sha256.crt -cert server2.crt -cert server2-in-database.crt -cert server2-in-database-revoked.crt -no_nonce -reqout $@
 all_intermediate += ocsp-req-for-good-revoked-unknown.der
+ocsp-req-for-revoked-future.der: server2-in-database-revoked-future.crt test-ca-sha256.crt
+	$(OPENSSL) ocsp -issuer test-ca-sha256.crt -cert $< -no_nonce -reqout $@
+all_intermediate += ocsp-req-for-revoked-future.der
 
 ocsp-resp-future-produced-at-this-update.der: ocsp-req-for-server2-in-database.der test-ca-index.txt test-ca-sha256.crt
 	$(FAKETIME) -f "+9y" $(OPENSSL) ocsp -rsigner test-ca-sha256.crt -index test-ca-index.txt -rkey $(test_ca_key_file_rsa) -CA test-ca-sha256.crt -noverify -reqin $< -respout $@
@@ -200,6 +211,9 @@ all_final += ocsp-resp-fail-issuer-checks.der
 ocsp-resp-fail-unauthorized-issuer.der: ocsp-req-for-server2-in-database.der test-ca-index.txt server2-ca.crt server2.key
 	$(OPENSSL) ocsp -rsigner authorized-ocsp-responder-for-server2-ca.crt -index test-ca-index.txt -rkey server2.key -CA server2-ca.crt -noverify -reqin $< -respout $@
 all_final += ocsp-resp-fail-unauthorized-issuer.der
+ocsp-resp-for-revoked-future.der: ocsp-req-for-revoked-future.der server2-in-database-revoked-future.crt test-ca-index.txt test-ca-sha256.crt server2.key
+	$(OPENSSL) ocsp -rsigner test-ca-sha256.crt -index test-ca-index.txt -rkey $(test_ca_key_file_rsa) -CA test-ca-sha256.crt -noverify -reqin $< -respout $@
+all_final += ocsp-resp-for-revoked-future.der
 
 ################################################################
 #### Meta targets

tests/data_files/server2-in-database-revoked-future.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEPjCCAyagAwIBAgICEAMwDQYJKoZIhvcNAQELBQAwOzELMAkGA1UEBhMCTkwx
+ETAPBgNVBAoMCFBvbGFyU1NMMRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0IENBMB4X
+DTE4MDMyMTA5MTQ1M1oXDTI4MDMyMTA5MTQ1M1owUTELMAkGA1UEBhMCTkwxETAP
+BgNVBAoMCFBvbGFyU1NMMS8wLQYDVQQDDCZNYmVkIFRMUyBPQ1NQIGZ1dHVyZSBy
+ZXZva2VkIHRlc3QgY2VydDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTNowCIp+4ea5anUrSQ7y1yej4k
+mvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKzNtSj+uGxdtiQwWG0ZlI2oiZT
+qqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kMtQCQ4dqCEGZ9rlQri2V5kaHi
+YcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8PhYvai0Re4hjGYi/HZo36Xdh9
+8yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjyaHT4P6DSYW8tzS1KW2BGiLICI
+aTla0w+w3lkvEcf36hIBMJcCAwEAAaOCATQwggEwMAkGA1UdEwQCMAAwEQYJYIZI
+AYb4QgEBBAQDAgZAMDQGCWCGSAGG+EIBDQQnFiVNYmVkIFRMUyBHZW5lcmF0ZWQg
+U2VydmVyIENlcnRpZmljYXRlMB0GA1UdDgQWBBSlBehkuNzfYA9QEk1gqGSvTYtD
+kzBjBgNVHSMEXDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0wOzELMAkGA1UE
+BhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0
+IENBggEAMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAxBggr
+BgEFBQcBAQQlMCMwIQYIKwYBBQUHMAGGFWh0dHA6Ly9sb2NhbGhvc3Q6NDQ1NTAN
+BgkqhkiG9w0BAQsFAAOCAQEAMt9c8iH1J0Fenq0gu4jqiE+RER2eD5Oriwn2fdg9
+Nn1BwU7Cj6BFRSyLM3KIRCXRBATr0iwx+N8AqoLzPg2ONWI/T05RBGGxpSO66R4R
+f39BqcldO9TOVqW7V2ie7PRLbRbOrJSz0wvXgMRI1Ql15+cus6EpVpZV1uOc6gr4
+7gqFy5Fwrg6OTdNOF/gduebA7rJzFO2n8tcIkWlDvYje09MSoNPOVO18VhAU4Ylh
+Os2VGx+s5/1bpjmKm+bmr0dLMxXeNXt4BZ3plr/t2NxemevCXQs3jmsRDLI+kxsO
+NHkVqVl/a42TJBLGX4R93sbYolk9Qa56ByHLP1q4rM6gaw==
+-----END CERTIFICATE-----

tests/data_files/server2-in-database-revoked-future.csr

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICljCCAX4CAQAwUTELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMS8w
+LQYDVQQDDCZNYmVkIFRMUyBPQ1NQIGZ1dHVyZSByZXZva2VkIHRlc3QgY2VydDCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA54
+5Do8Ss86ExbQWuTNowCIp+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa
+6ozmyRyWvP7BBFKzNtSj+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1J
+ZvdbJXNG6AuKT2kMtQCQ4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0Liq
+EQMef1aoGh5EGA8PhYvai0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79be
+x8cna8cFPXrEAjyaHT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcC
+AwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAPtdyoA0sArHtVa7d8O9J+Y6V9yfuV
+A/531Wnccq+bKsq6xfJRDf955tB6HAkjqZda46osMYfnTODTV/tB5Z0n2Hh7dSGR
+rY35Z4pvSTLCkKfJjxXGAgwhtpWLGx+rmsgJLbynCo7nqTOXKKqtMuwm11Gw67AN
+UziuFYtBw043b7HYKSW1ygVs0ItCXNEUBdtgwhRPTdapnoNwmcoLdCs5JJA/J40Q
+t7gHma07DJE5i6vhiEo2BDfP9DvwVUfQILn+vLky2jX7UFnPwAkut/KpaCt10lfC
+4EF62AjFIObXeLtWmqJFgCtuGYWduPnZ0lDLnlWzNSBmkvP2x9KlZcQP
+-----END CERTIFICATE REQUEST-----

tests/data_files/test-ca-index.txt

@@ -1,3 +1,4 @@
 V	280301220605Z		1000	unknown	/C=NL/O=PolarSSL/CN=Mbed TLS OCSP test cert
 R	280306220741Z	180306220741Z	1001	unknown	/C=NL/O=PolarSSL/CN=Mbed TLS OCSP revoked test cert
 V	280315220334Z		1002	unknown	/C=NL/O=PolarSSL/CN=PolarSSL Server 2 Test CA
+R	280321091453Z	280320091502Z	1003	unknown	/C=NL/O=PolarSSL/CN=Mbed TLS OCSP future revoked test cert

tests/data_files/test-ca-serial.txt

@@ -1 +1 @@
-1003
+1004

tests/suites/test_suite_x509parse_ocsp.data

@@ -288,6 +288,10 @@ X509 OCSP Response verification (future producedAt only)
 depends_on:MBEDTLS_SHA1_C
 x509_ocsp_response_verify:"data_files/ocsp-resp-future-produced-at.der":"data_files/server2-in-database.crt":"data_files/test-ca-sha256.crt":"data_files/test-ca-sha256.crt":MBEDTLS_ERR_X509_OCSP_RESPONSE_VERIFY_FAILED:MBEDTLS_X509_BADOCSP_RESPONSE_FUTURE | MBEDTLS_X509_BADOCSP_RESPONSE_NOT_TRUSTED
 
+X509 OCSP Response verification (future revocationTime only)
+depends_on:MBEDTLS_SHA1_C
+x509_ocsp_response_verify:"data_files/ocsp-resp-for-revoked-future.der":"data_files/server2-in-database-revoked-future.crt":"data_files/test-ca-sha256.crt":"data_files/test-ca-sha256.crt":MBEDTLS_ERR_X509_OCSP_RESPONSE_VERIFY_FAILED:MBEDTLS_X509_BADOCSP_RESPONSE_FUTURE | MBEDTLS_X509_BADOCSP_RESPONSE_REVOKED_CERT
+
 X509 OCSP Response verification (response not supplied)
 depends_on:MBEDTLS_SHA1_C
 x509_ocsp_response_verify:"":"data_files/server2-in-database.crt":"data_files/test-ca-sha256.crt":"data_files/test-ca-sha256.crt":MBEDTLS_ERR_X509_BAD_INPUT_DATA:0