From 3879f00c4663d527624e67d752966af101047d00 Mon Sep 17 00:00:00 2001
From: Andres Amaya Garcia <Andres.AmayaGarcia@arm.com>
Date: Wed, 21 Mar 2018 09:44:41 +0000
Subject: [PATCH] Add OCSP resp test for future revocation time

---
 tests/data_files/Makefile                     |  14 ++++++++++
 .../ocsp-req-for-revoked-future.der           | Bin 0 -> 69 bytes
 .../ocsp-resp-for-revoked-future.der          | Bin 0 -> 1409 bytes
 .../server2-in-database-revoked-future.crt    |  25 ++++++++++++++++++
 .../server2-in-database-revoked-future.csr    |  16 +++++++++++
 tests/data_files/test-ca-index.txt            |   1 +
 tests/data_files/test-ca-serial.txt           |   2 +-
 tests/suites/test_suite_x509parse_ocsp.data   |   4 +++
 8 files changed, 61 insertions(+), 1 deletion(-)
 create mode 100644 tests/data_files/ocsp-req-for-revoked-future.der
 create mode 100644 tests/data_files/ocsp-resp-for-revoked-future.der
 create mode 100644 tests/data_files/server2-in-database-revoked-future.crt
 create mode 100644 tests/data_files/server2-in-database-revoked-future.csr

diff --git a/tests/data_files/Makefile b/tests/data_files/Makefile
index 512c2d2aef..b2d0de2032 100644
--- a/tests/data_files/Makefile
+++ b/tests/data_files/Makefile
@@ -119,6 +119,14 @@ authorized-ocsp-responder-for-server2-ca.crt: authorized-ocsp-responder-for-serv
 	$(OPENSSL) x509 -req -extfile $(cli_crt_extensions_file) -CAkey server2.key -passin "pass:$(test_ca_pwd_rsa)" -CA server2-ca.crt -extensions ocsp -days 3653 -set_serial 20 -sha256 -in $< -out $@
 all_final += authorized-ocsp-responder-for-server2-ca.crt
 
+server2-in-database-revoked-future.csr: server2.key $(test_ca_config_file) test-ca-index.txt test-ca-serial.txt test-ca-index.txt.attr
+	$(OPENSSL) req -config $(test_ca_config_file) -key $< -passin "pass:$(test_ca_pwd_rsa)" -subj "/C=NL/O=PolarSSL/CN=Mbed TLS OCSP future revoked test cert" -out $@ -new -sha256
+all_intermediate += server2-in-database-revoked-future.csr
+server2-in-database-revoked-future.crt: server2-in-database-revoked-future.csr $(test_ca_config_file) test-ca-index.txt test-ca-serial.txt test-ca-index.txt.attr test-ca-sha256.crt
+	$(OPENSSL) ca -batch -config $(test_ca_config_file) -extensions server_cert -cert test-ca-sha256.crt -keyfile $(test_ca_key_file_rsa) -days 3653 -notext -md sha256 -passin "pass:$(test_ca_pwd_rsa)" -in $< -out $@
+	$(FAKETIME) -f "+3652d" $(OPENSSL) ca -config $(test_ca_config_file) -passin "pass:$(test_ca_pwd_rsa)" -cert test-ca-sha256.crt -notext -keyfile $(test_ca_key_file_rsa) -revoke $@
+all_final += server2-in-database-revoked-future.crt
+
 ################################################################
 #### Generate OCSP responses using existing certificates
 ################################################################
@@ -170,6 +178,9 @@ all_intermediate += ocsp-req-for-server2-in-database-revoked.der
 ocsp-req-for-good-revoked-unknown.der: server2.crt server2-in-database.crt server2-in-database-revoked.crt test-ca-sha256.crt
 	$(OPENSSL) ocsp -issuer test-ca-sha256.crt -cert server2.crt -cert server2-in-database.crt -cert server2-in-database-revoked.crt -no_nonce -reqout $@
 all_intermediate += ocsp-req-for-good-revoked-unknown.der
+ocsp-req-for-revoked-future.der: server2-in-database-revoked-future.crt test-ca-sha256.crt
+	$(OPENSSL) ocsp -issuer test-ca-sha256.crt -cert $< -no_nonce -reqout $@
+all_intermediate += ocsp-req-for-revoked-future.der
 
 ocsp-resp-future-produced-at-this-update.der: ocsp-req-for-server2-in-database.der test-ca-index.txt test-ca-sha256.crt
 	$(FAKETIME) -f "+9y" $(OPENSSL) ocsp -rsigner test-ca-sha256.crt -index test-ca-index.txt -rkey $(test_ca_key_file_rsa) -CA test-ca-sha256.crt -noverify -reqin $< -respout $@
@@ -200,6 +211,9 @@ all_final += ocsp-resp-fail-issuer-checks.der
 ocsp-resp-fail-unauthorized-issuer.der: ocsp-req-for-server2-in-database.der test-ca-index.txt server2-ca.crt server2.key
 	$(OPENSSL) ocsp -rsigner authorized-ocsp-responder-for-server2-ca.crt -index test-ca-index.txt -rkey server2.key -CA server2-ca.crt -noverify -reqin $< -respout $@
 all_final += ocsp-resp-fail-unauthorized-issuer.der
+ocsp-resp-for-revoked-future.der: ocsp-req-for-revoked-future.der server2-in-database-revoked-future.crt test-ca-index.txt test-ca-sha256.crt server2.key
+	$(OPENSSL) ocsp -rsigner test-ca-sha256.crt -index test-ca-index.txt -rkey $(test_ca_key_file_rsa) -CA test-ca-sha256.crt -noverify -reqin $< -respout $@
+all_final += ocsp-resp-for-revoked-future.der
 
 ################################################################
 #### Meta targets
diff --git a/tests/data_files/ocsp-req-for-revoked-future.der b/tests/data_files/ocsp-req-for-revoked-future.der
new file mode 100644
index 0000000000000000000000000000000000000000..e344fb38b0fa9ebd842debad19441c11cd6674d5
GIT binary patch
literal 69
zcmV-L0J{G$Loh)wKQKKoJ1_|b1uG5%0vZJX1QZGtXr|GJA7iba-L|pMZAS6}2?qoe
bv|8k)v)<BD_PN!jl@IGayvP0j0s;^N$ch>A

literal 0
HcmV?d00001

diff --git a/tests/data_files/ocsp-resp-for-revoked-future.der b/tests/data_files/ocsp-resp-for-revoked-future.der
new file mode 100644
index 0000000000000000000000000000000000000000..239a091c555e658056a8bb17cc168456dab2b3ac
GIT binary patch
literal 1409
zcmXqLVy)$3WLVI|T4vD1TExbw&Bn;e%5K2O$kN1`3>1ntXxzHc*1+13+klgeIh2J>
zn90w_P|$!M#Np!M2*}S#ED8?xF_bhA2MICr2*89CLQ;!M6r3F;_>Bw<Eewo}3=J%e
zO%2VW43Z5J4XlCYv1;=%GfA;Bu!wMpW-PndE}y)1-ra2*&*!>*V&Y_H5!n*;Wa;L6
zmx8|Syt-^E|7*KF$N&CkViI6pC<rps2xO*#fu*6Tfl(BuCA@5$T5TR}-+38<K4M^Q
zVq|3So^(*WaaY`Ao@b04t30M#ooN-FIWy|b$$wp`@wUo>Tig1lbeG@I&sCoNS})GT
zSlXbZJhpWvf7a&pFL=B!s`VOa{d>DXVpdRP>BM)t-rZTfs95^lk$Cn6M&|inGmpNs
zEInxNt<d;XYv$3mh=3D&gzxal`%TX2k(<TD&7E%Sx<Xtv&XKuFY5EG^s_7ZR*FFkI
z%ns#a-}Qa2%-m@Ht$j194VTY0+q!Gkf0mi$o`-jO++MdLAk#c8v-LsY;>Dg!-&46C
zZ<Sf_r(}KnDaA{iN7J9(?zY&VTCRKGSBma}KR=}GG&)W1YtP&^eRV0**4ZB>-w0cJ
z?|w+W$PD!@+S2?N3l}so_Zu`ZcLQ;|K@(H{0%j&gCMHG(1EjFxW@Vr#whiROc@51C
zObtv7%}mV=45P$(jX+#r#Dlq%8Q#RGgzQ*GaK!R67&I|*F@a+Ez<u*S;=3PAn`_^8
zZ<<l9%TlogXB9uryz=JN=^BX$jwwsu%s$$EUrKJK#msiO>I1!&_bp-zD%da2yE*yA
z&Z5Ah=N20Tt^D-dp+Mxc%c3IgLr)!k+C5#yxB2HAujB(eG#N_fgj=sz$}*ww<KE_*
z_Scp^veD{)uby!D*!<JG-Xzp+f7W8O&;NIXni6yLl`U6)e|<bnui(HFy}f_*-aT>*
zJz%0&t5TGC+I^#lLvwBVm$q+)t3OsQ*|b$p=x2-ghopRUJK>0pA-sySip>`qoX?+h
z=iAFaYi{dlT&!dAR$d_b$s#p{^A%5CpS1Xb!V{ZkpIrU&@Tc?b)A}2jjONXZ$X|4o
ziJ6gsadG2RgT_e)vcUW(%f}*yJs%k)gQS&NVho}hux7M{_Dd+s_f5cr#RIZLn1$7V
znUV27a?Amf88}PItUoTd<)%^PRio)~*R<^RHR!I2d;I7~qTY_f?|LuG-4V<&+g7Hq
ze%V@~)wySzlg=cyzOk0#{wu<DPq{i^P3WCN{X%;UVp;Z0SfbTwJA31=$8(cKWoL(2
zoJxBUoK<*n*<Wd$d!OcJXU1s7s{~c;KNW8JlkK4N0;{dw7mD`IJehvA`DM@3N=3iT
zeQ~eNEOso(Z`~ktDOgq5<>LQMHV-ZZ+uHB7t7e+`g{z?E;x^7rV(d1BpJu#Htzf9p
zRMTCR_p|vM@4_9=d*tTKZhR75JkvEu_2oB-`MJEV0j6QrRuU|J>zlKpJMDk$l25*~
ZMQ6j2Uvo7SoTe)s(r@|o{o5Hs4*>5*9!&rM

literal 0
HcmV?d00001

diff --git a/tests/data_files/server2-in-database-revoked-future.crt b/tests/data_files/server2-in-database-revoked-future.crt
new file mode 100644
index 0000000000..b318ea0046
--- /dev/null
+++ b/tests/data_files/server2-in-database-revoked-future.crt
@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEPjCCAyagAwIBAgICEAMwDQYJKoZIhvcNAQELBQAwOzELMAkGA1UEBhMCTkwx
+ETAPBgNVBAoMCFBvbGFyU1NMMRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0IENBMB4X
+DTE4MDMyMTA5MTQ1M1oXDTI4MDMyMTA5MTQ1M1owUTELMAkGA1UEBhMCTkwxETAP
+BgNVBAoMCFBvbGFyU1NMMS8wLQYDVQQDDCZNYmVkIFRMUyBPQ1NQIGZ1dHVyZSBy
+ZXZva2VkIHRlc3QgY2VydDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
+AMFNo93nzR3RBNdJcriZrA545Do8Ss86ExbQWuTNowCIp+4ea5anUrSQ7y1yej4k
+mvy2NKwk9XfgJmSMnLAofaHa6ozmyRyWvP7BBFKzNtSj+uGxdtiQwWG0ZlI2oiZT
+qqt0Xgd9GYLbKtgfoNkNHC1JZvdbJXNG6AuKT2kMtQCQ4dqCEGZ9rlQri2V5kaHi
+YcPNQEkI7mgM8YuG0ka/0LiqEQMef1aoGh5EGA8PhYvai0Re4hjGYi/HZo36Xdh9
+8yeJKQHFkA4/J/EwyEoO79bex8cna8cFPXrEAjyaHT4P6DSYW8tzS1KW2BGiLICI
+aTla0w+w3lkvEcf36hIBMJcCAwEAAaOCATQwggEwMAkGA1UdEwQCMAAwEQYJYIZI
+AYb4QgEBBAQDAgZAMDQGCWCGSAGG+EIBDQQnFiVNYmVkIFRMUyBHZW5lcmF0ZWQg
+U2VydmVyIENlcnRpZmljYXRlMB0GA1UdDgQWBBSlBehkuNzfYA9QEk1gqGSvTYtD
+kzBjBgNVHSMEXDBagBS0WuSls97SUva51aaVD+s+vMf9/6E/pD0wOzELMAkGA1UE
+BhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMRkwFwYDVQQDDBBQb2xhclNTTCBUZXN0
+IENBggEAMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAxBggr
+BgEFBQcBAQQlMCMwIQYIKwYBBQUHMAGGFWh0dHA6Ly9sb2NhbGhvc3Q6NDQ1NTAN
+BgkqhkiG9w0BAQsFAAOCAQEAMt9c8iH1J0Fenq0gu4jqiE+RER2eD5Oriwn2fdg9
+Nn1BwU7Cj6BFRSyLM3KIRCXRBATr0iwx+N8AqoLzPg2ONWI/T05RBGGxpSO66R4R
+f39BqcldO9TOVqW7V2ie7PRLbRbOrJSz0wvXgMRI1Ql15+cus6EpVpZV1uOc6gr4
+7gqFy5Fwrg6OTdNOF/gduebA7rJzFO2n8tcIkWlDvYje09MSoNPOVO18VhAU4Ylh
+Os2VGx+s5/1bpjmKm+bmr0dLMxXeNXt4BZ3plr/t2NxemevCXQs3jmsRDLI+kxsO
+NHkVqVl/a42TJBLGX4R93sbYolk9Qa56ByHLP1q4rM6gaw==
+-----END CERTIFICATE-----
diff --git a/tests/data_files/server2-in-database-revoked-future.csr b/tests/data_files/server2-in-database-revoked-future.csr
new file mode 100644
index 0000000000..962238d729
--- /dev/null
+++ b/tests/data_files/server2-in-database-revoked-future.csr
@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICljCCAX4CAQAwUTELMAkGA1UEBhMCTkwxETAPBgNVBAoMCFBvbGFyU1NMMS8w
+LQYDVQQDDCZNYmVkIFRMUyBPQ1NQIGZ1dHVyZSByZXZva2VkIHRlc3QgY2VydDCC
+ASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMFNo93nzR3RBNdJcriZrA54
+5Do8Ss86ExbQWuTNowCIp+4ea5anUrSQ7y1yej4kmvy2NKwk9XfgJmSMnLAofaHa
+6ozmyRyWvP7BBFKzNtSj+uGxdtiQwWG0ZlI2oiZTqqt0Xgd9GYLbKtgfoNkNHC1J
+ZvdbJXNG6AuKT2kMtQCQ4dqCEGZ9rlQri2V5kaHiYcPNQEkI7mgM8YuG0ka/0Liq
+EQMef1aoGh5EGA8PhYvai0Re4hjGYi/HZo36Xdh98yeJKQHFkA4/J/EwyEoO79be
+x8cna8cFPXrEAjyaHT4P6DSYW8tzS1KW2BGiLICIaTla0w+w3lkvEcf36hIBMJcC
+AwEAAaAAMA0GCSqGSIb3DQEBCwUAA4IBAQAPtdyoA0sArHtVa7d8O9J+Y6V9yfuV
+A/531Wnccq+bKsq6xfJRDf955tB6HAkjqZda46osMYfnTODTV/tB5Z0n2Hh7dSGR
+rY35Z4pvSTLCkKfJjxXGAgwhtpWLGx+rmsgJLbynCo7nqTOXKKqtMuwm11Gw67AN
+UziuFYtBw043b7HYKSW1ygVs0ItCXNEUBdtgwhRPTdapnoNwmcoLdCs5JJA/J40Q
+t7gHma07DJE5i6vhiEo2BDfP9DvwVUfQILn+vLky2jX7UFnPwAkut/KpaCt10lfC
+4EF62AjFIObXeLtWmqJFgCtuGYWduPnZ0lDLnlWzNSBmkvP2x9KlZcQP
+-----END CERTIFICATE REQUEST-----
diff --git a/tests/data_files/test-ca-index.txt b/tests/data_files/test-ca-index.txt
index 84695584a3..e8607ff6de 100644
--- a/tests/data_files/test-ca-index.txt
+++ b/tests/data_files/test-ca-index.txt
@@ -1,3 +1,4 @@
 V	280301220605Z		1000	unknown	/C=NL/O=PolarSSL/CN=Mbed TLS OCSP test cert
 R	280306220741Z	180306220741Z	1001	unknown	/C=NL/O=PolarSSL/CN=Mbed TLS OCSP revoked test cert
 V	280315220334Z		1002	unknown	/C=NL/O=PolarSSL/CN=PolarSSL Server 2 Test CA
+R	280321091453Z	280320091502Z	1003	unknown	/C=NL/O=PolarSSL/CN=Mbed TLS OCSP future revoked test cert
diff --git a/tests/data_files/test-ca-serial.txt b/tests/data_files/test-ca-serial.txt
index baccd0398f..59c1122662 100644
--- a/tests/data_files/test-ca-serial.txt
+++ b/tests/data_files/test-ca-serial.txt
@@ -1 +1 @@
-1003
+1004
diff --git a/tests/suites/test_suite_x509parse_ocsp.data b/tests/suites/test_suite_x509parse_ocsp.data
index 3abbb38412..b88ef75c07 100644
--- a/tests/suites/test_suite_x509parse_ocsp.data
+++ b/tests/suites/test_suite_x509parse_ocsp.data
@@ -288,6 +288,10 @@ X509 OCSP Response verification (future producedAt only)
 depends_on:MBEDTLS_SHA1_C
 x509_ocsp_response_verify:"data_files/ocsp-resp-future-produced-at.der":"data_files/server2-in-database.crt":"data_files/test-ca-sha256.crt":"data_files/test-ca-sha256.crt":MBEDTLS_ERR_X509_OCSP_RESPONSE_VERIFY_FAILED:MBEDTLS_X509_BADOCSP_RESPONSE_FUTURE | MBEDTLS_X509_BADOCSP_RESPONSE_NOT_TRUSTED
 
+X509 OCSP Response verification (future revocationTime only)
+depends_on:MBEDTLS_SHA1_C
+x509_ocsp_response_verify:"data_files/ocsp-resp-for-revoked-future.der":"data_files/server2-in-database-revoked-future.crt":"data_files/test-ca-sha256.crt":"data_files/test-ca-sha256.crt":MBEDTLS_ERR_X509_OCSP_RESPONSE_VERIFY_FAILED:MBEDTLS_X509_BADOCSP_RESPONSE_FUTURE | MBEDTLS_X509_BADOCSP_RESPONSE_REVOKED_CERT
+
 X509 OCSP Response verification (response not supplied)
 depends_on:MBEDTLS_SHA1_C
 x509_ocsp_response_verify:"":"data_files/server2-in-database.crt":"data_files/test-ca-sha256.crt":"data_files/test-ca-sha256.crt":MBEDTLS_ERR_X509_BAD_INPUT_DATA:0