[exim-cvs] Testsuite: avoid generating leaf certs expiring a…

Gitweb: https://git.exim.org/exim.git/commitdiff/b577156a5877f5cbe0ac263219fb6d686aaf620c

Commit:     b577156a5877f5cbe0ac263219fb6d686aaf620c
Parent:     415c5379af11bf8777af1a082a336ad7c5369525
Author:     Jeremy Harris <jgh146exb@???>
AuthorDate: Thu Nov 24 18:05:44 2022 +0000
Committer:  Jeremy Harris <jgh146exb@???>
CommitDate: Thu Nov 24 18:23:35 2022 +0000

    Testsuite: avoid generating leaf certs expiring after signer expiry
---
 test/aux-fixed/exim-ca/README.regenerate |  6 ++++--
 test/aux-fixed/exim-ca/genall            | 20 ++++++++++++++------
 2 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/test/aux-fixed/exim-ca/README.regenerate b/test/aux-fixed/exim-ca/README.regenerate
index d87512cfb..f31a5f6f0 100755
--- a/test/aux-fixed/exim-ca/README.regenerate
+++ b/test/aux-fixed/exim-ca/README.regenerate
@@ -5,6 +5,8 @@ and dnszones-src/db.example.com (the commands are next to each one).
The script "tlsa_regenerate" automates this.

Also, because of the certs changes, the following testcase outputs will change:
-2102
-5720
+2002 (GnuTLS)
+2102 (OpenSSL)
+5710 (GnuTLS)
+5720 (OpenSSL)
5800
diff --git a/test/aux-fixed/exim-ca/genall b/test/aux-fixed/exim-ca/genall
index 878c6aba0..25e46c7cf 100755
--- a/test/aux-fixed/exim-ca/genall
+++ b/test/aux-fixed/exim-ca/genall
@@ -15,6 +15,14 @@ echo use - date -u 110112342019
echo hit return when ready
read junk

+# Calc number of months from then to (about) Nov 2037.
+# We're sticking to a 2038 cutoff for now, to maintain support for 32b systems,
+# but will have to give that up in only a few years.
+#
+tgt_secs=`date -d 'Nov 25 2037' +%s`
+now_secs=`date +%s`
+diff_months=$(( ($tgt_secs - $now_secs) / 60 / 60 / 24 / 31 ))
+
# Main suite: RSA certs
for tld in com org net
do
@@ -41,14 +49,14 @@ do

     # create server leaf certs
     # -m <months>
-    clica $V -D $idir -p password -s 101 -S server1.$iname -m 301 \
+    clica $V -D $idir -p password -s 101 -S server1.$iname -m $diff_months \
     -8 alternatename.server1.example.$tld,alternatename2.server1.example.$tld,*.test.ex
-    clica $V -D $idir -p password -s 102 -S revoked1.$iname -m 301
+    clica $V -D $idir -p password -s 102 -S revoked1.$iname -m $diff_months
     clica $V -D $idir -p password -s 103 -S expired1.$iname -m 1

-    clica $V -D $idir -p password -s 201 -S  server2.$iname -m 301 \
+    clica $V -D $idir -p password -s 201 -S  server2.$iname -m $diff_months \
     -3 "CN=clica CA rsa,O=example.$tld" -8 '*.test.ex'
-    clica $V -D $idir -p password -s 202 -S revoked2.$iname -m 301
+    clica $V -D $idir -p password -s 202 -S revoked2.$iname -m $diff_months
     clica $V -D $idir -p password -s 203 -S expired2.$iname -m 1

####
@@ -195,7 +203,7 @@ done

# Create one EC leaf cert in the RSA cert tree. It will have an EC pubkey but be signed using its parent
# therefore its parent's algo, RSA.
-clica $V -D example.com -p password -k ec -q nistp521 -s 1101 -S server1_ec.example.com -m 301 -8 'server1.example.com,*.test.ex'
+clica $V -D example.com -p password -k ec -q nistp521 -s 1101 -S server1_ec.example.com -m $diff_months -8 'server1.example.com,*.test.ex'
SDIR=example.com/server1_ec.example.com
SPFX=$SDIR/server1_ec.example.com
openssl ec -in $SPFX.key -passin file:$SDIR/pwdfile -out $SPFX.unlocked.key
@@ -225,7 +233,7 @@ do

     # create server certs
     # -m <months>
-    clica $V -D $idir -p password -s 2101 -S server1.$iname -m 301 \
+    clica $V -D $idir -p password -s 2101 -S server1.$iname -m $diff_months \
     -k ec -q nistp521 \
     -8 server1.example.$tld,alternatename.server1.example.$tld,alternatename2.server1.example.$tld,*.test.ex