From 032b33059eea10586587481f97a1509ceba60549 Mon Sep 17 00:00:00 2001
From: "Dr. Stephen Henson" <steve@openssl.org>
Date: Thu, 20 Dec 2012 18:48:11 +0000
Subject: [PATCH] Update test OCSP script "tocsp" to use shell functions and to
 use December 17th as check date to avoid certificate expiry errors.

---
 test/tocsp | 178 +++++++++++++++++++----------------------------------
 1 file changed, 64 insertions(+), 114 deletions(-)

diff --git a/test/tocsp b/test/tocsp
index 5d6c24abfd..9f992b173b 100644
--- a/test/tocsp
+++ b/test/tocsp
@@ -2,196 +2,146 @@
 
 cmd='../util/shlib_wrap.sh ../apps/openssl'
 ocspdir="ocsp-tests"
-stdparams="-trust_other -CApath /dev/null"
+# 17 December 2012 so we don't get certificate expiry errors.
+check_time="-attime 1355875200"
+
+test_ocsp () {
+
+	$cmd base64 -d -in $ocspdir/$1 | \
+		$cmd ocsp -respin - -partial_chain -trust_other $check_time \
+		-CAfile $ocspdir/$2 -verify_other $ocspdir/$2 -CApath /dev/null
+	[ $? != $3 ] && exit 1
+}
 
-for resp in `ls -1 $ocspdir/*.ors`
-do
-	$cmd base64 -d -in $resp -out $resp.der
-done
 
 echo "=== VALID OCSP RESPONSES ==="
 echo "NON-DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp ND1.ors ND1_Issuer_ICA.pem 0
 echo "NON-DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp ND2.ors ND2_Issuer_Root.pem 0
 echo "NON-DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp ND3.ors ND3_Issuer_Root.pem 0
 echo "DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp D1.ors D1_Issuer_ICA.pem 0
 echo "DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp D2.ors D2_Issuer_Root.pem 0
 echo "DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp D3.ors D3_Issuer_Root.pem 0
 
 echo "=== INVALID SIGNATURE on the OCSP RESPONSE ==="
 echo "NON-DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/ISOP_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ISOP_ND1.ors ND1_Issuer_ICA.pem 1
 echo "NON-DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/ISOP_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ISOP_ND2.ors ND2_Issuer_Root.pem 1
 echo "NON-DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/ISOP_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ISOP_ND3.ors ND3_Issuer_Root.pem 1
 echo "DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/ISOP_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ISOP_D1.ors D1_Issuer_ICA.pem 1
 echo "DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/ISOP_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ISOP_D2.ors D2_Issuer_Root.pem 1
 echo "DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/ISOP_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ISOP_D3.ors D3_Issuer_Root.pem 1
 
 echo "=== WRONG RESPONDERID in the OCSP RESPONSE ==="
 echo "NON-DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/WRID_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WRID_ND1.ors ND1_Issuer_ICA.pem 1
 echo "NON-DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/WRID_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WRID_ND2.ors ND2_Issuer_Root.pem 1
 echo "NON-DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/WRID_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WRID_ND3.ors ND3_Issuer_Root.pem 1
 echo "DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/WRID_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WRID_D1.ors D1_Issuer_ICA.pem 1
 echo "DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/WRID_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WRID_D2.ors D2_Issuer_Root.pem 1
 echo "DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/WRID_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WRID_D3.ors D3_Issuer_Root.pem 1
 
 echo "=== WRONG ISSUERNAMEHASH in the OCSP RESPONSE ==="
 echo "NON-DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/WINH_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WINH_ND1.ors ND1_Issuer_ICA.pem 1
 echo "NON-DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/WINH_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WINH_ND2.ors ND2_Issuer_Root.pem 1
 echo "NON-DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/WINH_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WINH_ND3.ors ND3_Issuer_Root.pem 1
 echo "DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/WINH_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WINH_D1.ors D1_Issuer_ICA.pem 1
 echo "DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/WINH_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WINH_D2.ors D2_Issuer_Root.pem 1
 echo "DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/WINH_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WINH_D3.ors D3_Issuer_Root.pem 1
 
 echo "=== WRONG ISSUERKEYHASH in the OCSP RESPONSE ==="
 echo "NON-DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/WIKH_ND1.ors.der -verify_other $ocspdir/ND1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WIKH_ND1.ors ND1_Issuer_ICA.pem 1
 echo "NON-DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/WIKH_ND2.ors.der -verify_other $ocspdir/ND2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WIKH_ND2.ors ND2_Issuer_Root.pem 1
 echo "NON-DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/WIKH_ND3.ors.der -verify_other $ocspdir/ND3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WIKH_ND3.ors ND3_Issuer_Root.pem 1
 echo "DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/WIKH_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WIKH_D1.ors D1_Issuer_ICA.pem 1
 echo "DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/WIKH_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WIKH_D2.ors D2_Issuer_Root.pem 1
 echo "DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/WIKH_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WIKH_D3.ors D3_Issuer_Root.pem 1
 
 echo "=== WRONG KEY in the DELEGATED OCSP SIGNING CERTIFICATE ==="
 echo "DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/WKDOSC_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $std_params
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WKDOSC_D1.ors D1_Issuer_ICA.pem 1
 echo "DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/WKDOSC_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $std_params
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WKDOSC_D2.ors D2_Issuer_Root.pem 1
 echo "DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/WKDOSC_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $std_params
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp WKDOSC_D3.ors D3_Issuer_Root.pem 1
 
 echo "=== INVALID SIGNATURE on the DELEGATED OCSP SIGNING CERTIFICATE ==="
 echo "DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/ISDOSC_D1.ors.der -verify_other $ocspdir/D1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ISDOSC_D1.ors D1_Issuer_ICA.pem 1
 echo "DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/ISDOSC_D2.ors.der -verify_other $ocspdir/D2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ISDOSC_D2.ors D2_Issuer_Root.pem 1
 echo "DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/ISDOSC_D3.ors.der -verify_other $ocspdir/D3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ISDOSC_D3.ors D3_Issuer_Root.pem 1
 
 echo "=== WRONG SUBJECT NAME in the ISSUER CERTIFICATE ==="
 echo "NON-DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/WSNIC_ND1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ND1.ors WSNIC_ND1_Issuer_ICA.pem 1
 echo "NON-DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/WSNIC_ND2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ND2.ors WSNIC_ND2_Issuer_Root.pem 1
 echo "NON-DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/WSNIC_ND3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ND3.ors WSNIC_ND3_Issuer_Root.pem 1
 echo "DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/WSNIC_D1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp D1.ors WSNIC_D1_Issuer_ICA.pem 1
 echo "DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/WSNIC_D2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp D2.ors WSNIC_D2_Issuer_Root.pem 1
 echo "DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/WSNIC_D3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp D3.ors WSNIC_D3_Issuer_Root.pem 1
 
 echo "=== WRONG KEY in the ISSUER CERTIFICATE ==="
 echo "NON-DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/WKIC_ND1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ND1.ors WKIC_ND1_Issuer_ICA.pem 1
 echo "NON-DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/WKIC_ND2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ND2.ors WKIC_ND2_Issuer_Root.pem 1
 echo "NON-DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/WKIC_ND3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp ND3.ors WKIC_ND3_Issuer_Root.pem 1
 echo "DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/WKIC_D1_Issuer_ICA.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp D1.ors WKIC_D1_Issuer_ICA.pem 1
 echo "DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/WKIC_D2_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp D2.ors WKIC_D2_Issuer_Root.pem 1
 echo "DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/WKIC_D3_Issuer_Root.pem $stdparams
-if [ $? = 0 ]; then exit 1; fi
+test_ocsp D3.ors WKIC_D3_Issuer_Root.pem 1
 
 echo "=== INVALID SIGNATURE on the ISSUER CERTIFICATE ==="
 # Expect success, because we're explicitly trusting the issuer certificate.
 echo "NON-DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/ND1.ors.der -verify_other $ocspdir/ISIC_ND1_Issuer_ICA.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp ND1.ors ISIC_ND1_Issuer_ICA.pem 0
 echo "NON-DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/ND2.ors.der -verify_other $ocspdir/ISIC_ND2_Issuer_Root.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp ND2.ors ISIC_ND2_Issuer_Root.pem 0
 echo "NON-DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/ND3.ors.der -verify_other $ocspdir/ISIC_ND3_Issuer_Root.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp ND3.ors ISIC_ND3_Issuer_Root.pem 0
 echo "DELEGATED; Intermediate CA -> EE"
-$cmd ocsp -respin $ocspdir/D1.ors.der -verify_other $ocspdir/ISIC_D1_Issuer_ICA.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp D1.ors ISIC_D1_Issuer_ICA.pem
 echo "DELEGATED; Root CA -> Intermediate CA"
-$cmd ocsp -respin $ocspdir/D2.ors.der -verify_other $ocspdir/ISIC_D2_Issuer_Root.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp D2.ors ISIC_D2_Issuer_Root.pem 0
 echo "DELEGATED; Root CA -> EE"
-$cmd ocsp -respin $ocspdir/D3.ors.der -verify_other $ocspdir/ISIC_D3_Issuer_Root.pem $stdparams
-if [ $? != 0 ]; then exit 1; fi
+test_ocsp D3.ors ISIC_D3_Issuer_Root.pem 0
 
-/bin/rm $ocspdir/*.ors.der
 echo "ALL OCSP TESTS SUCCESSFUL"
 exit 0
-- 
GitLab