aswi2021jmsd-gitlab/src/services/certificate_service.py @ 364a6830

from typing import List

from injector import inject

from src.config.configuration import Configuration
from src.constants import ROOT_CA_ID, INTERMEDIATE_CA_ID, CA_ID, CERTIFICATE_ID, CERTIFICATE_STATES, \
    CERTIFICATE_REVOCATION_REASONS, SSL_ID, SIGNATURE_ID, AUTHENTICATION_ID, CERTIFICATE_VALID, CERTIFICATE_EXPIRED, \
    CERTIFICATE_REVOKED,\
    CERTIFICATE_REVOCATION_REASON_HOLD
from src.dao.certificate_repository import CertificateRepository
from src.exceptions.certificate_not_found_exception import CertificateNotFoundException
from src.exceptions.database_exception import DatabaseException
from src.exceptions.unknown_exception import UnknownException
from src.model.certificate import Certificate
from src.model.private_key import PrivateKey
from src.model.subject import Subject
from src.services.cryptography import CryptographyService

import time

from src.utils.usages_to_extensions import usages_to_extension_lines, ExtensionFieldFlags, CRITICAL, KEY_CERT_SIGN, \
    CRL_SIGN, CA, DIGITAL_SIGNATURE, KEY_ENCIPHERMENT, KEY_AGREEMENT, SERVER_AUTH, NON_REPUDIATION, TIME_STAMPING, \
    CLIENT_AUTH

from src.utils.logger import Logger

VALID_FROM_TO_DATE_FORMAT = "%d.%m.%Y %H:%M:%S"
CA_EXTENSIONS = "basicConstraints=critical,CA:TRUE"
CRL_EXTENSION = "crlDistributionPoints=URI:"
OCSP_EXTENSION = "authorityInfoAccess=OCSP;URI:"
STATUS_REVOKED = "revoked"
STATUS_VALID = "valid"

# define which flags are required for various usages
REQUIRED_USAGE_EXTENSION_FLAGS = {
    CA_ID: ExtensionFieldFlags({CRITICAL, KEY_CERT_SIGN, CRL_SIGN}, {}, {CRITICAL, CA}),
    SSL_ID: ExtensionFieldFlags({DIGITAL_SIGNATURE, KEY_ENCIPHERMENT, KEY_AGREEMENT}, {SERVER_AUTH}, {}),
    SIGNATURE_ID: ExtensionFieldFlags({DIGITAL_SIGNATURE, NON_REPUDIATION}, {}, {}),
    AUTHENTICATION_ID: ExtensionFieldFlags({DIGITAL_SIGNATURE}, {CLIENT_AUTH}, {})}


class CertificateService:

    @inject
    def __init__(self, cryptography_service: CryptographyService,
                 certificate_repository: CertificateRepository,
                 configuration: Configuration):
        self.cryptography_service = cryptography_service
        self.certificate_repository = certificate_repository
        self.configuration = configuration

    # TODO usages present in method parameters but not in class diagram
    def create_root_ca(self, key: PrivateKey, subject: Subject, extensions: str = "", config: str = "",
                       usages=None, days=30):
        """
        Creates a root CA certificate based on the given parameters.
        :param key: Private key to be used when generating the certificate
        :param subject: Subject to be used put into the certificate
        :param config: String containing the configuration to be used
        :param extensions: Name of the section in the configuration representing extensions
        :param usages: A dictionary containing usages of the certificate to be generated (see constants.py)
        :param days: Number of days for which the generated cert. will be considered valid
        :return: An instance of Certificate class representing the generated root CA cert
        """

        Logger.debug("Function launched.")

        if usages is None:
            usages = {}

        cert_id = self.certificate_repository.get_next_id()

        # specify CA usage
        usages[CA_ID] = True

        # generate extension configuration lines based on the specified usages
        extensions = extensions + "\n" + "\n".join(usages_to_extension_lines(usages, REQUIRED_USAGE_EXTENSION_FLAGS))

        # create a new self signed  certificate
        cert_pem = self.cryptography_service.create_sscrt(subject, key.private_key, key_pass=key.password,
                                                          extensions=extensions, config=config, days=days, sn=cert_id)

        # wrap into Certificate class
        certificate = self.__create_wrapper(cert_pem, key.private_key_id, usages, 0,
                                            ROOT_CA_ID)

        # store the wrapper into the repository
        created_id = self.certificate_repository.create(certificate)

        # assign the generated ID to the inserted certificate
        certificate.certificate_id = created_id

        return certificate

    def __create_wrapper(self, cert_pem, private_key_id, usages, parent_id, cert_type):
        """
        Wraps the given parameters using the Certificate class. Uses CryptographyService to find out the notBefore and
        notAfter fields.
        :param cert_pem: PEM of the cert. to be wrapped
        :param private_key_id: ID of the private key used to create the given certificate
        :param usages: A dictionary containing usages of the generated certificate generated (see constants.py)
        :param parent_id: ID of the CA that issued this certificate
        :param cert_type: Type of this certificate (see constants.py)
        :return: An instance of the Certificate class wrapping the values passed  via method parameters
        """

        Logger.debug("Function launched.")

        # parse the generated pem for subject and notBefore/notAfter fields
        # TODO this could be improved in the future in such way that calling openssl is not required to parse the dates
        subj, not_before, not_after = self.cryptography_service.parse_cert_pem(cert_pem)
        # format the parsed date
        not_before_formatted = time.strftime(VALID_FROM_TO_DATE_FORMAT, not_before)
        not_after_formatted = time.strftime(VALID_FROM_TO_DATE_FORMAT, not_after)

        # create a certificate wrapper
        certificate = Certificate(-1, not_before_formatted, not_after_formatted, cert_pem, cert_type, parent_id,
                                  private_key_id, usages, subj.common_name, subj.country, subj.locality, subj.state,
                                  subj.organization, subj.organization_unit, subj.email_address)

        return certificate

    # TODO config parameter present in class diagram but not here (unused)
    def create_ca(self, subject_key: PrivateKey, subject: Subject, issuer_cert: Certificate, issuer_key: PrivateKey,
                  extensions: str = "", days: int = 30, usages=None):
        """
        Creates an intermediate CA certificate issued by the given parent CA.
        :param subject_key: Private key to be used when generating the certificate
        :param subject: Subject to be used put into the certificate
        :param issuer_cert: Issuer certificate that will sign the CSR required to create an intermediate CA
        :param issuer_key: PK used to generate the issuer certificate
        :param extensions: Extensions to be used when generating the certificate
        :param usages: A dictionary containing usages of the certificate to be generated (see constants.py)
        :param days: Number of days for which the generated cert. will be considered valid
        :return: An instance of Certificate class representing the generated intermediate CA cert
        """

        Logger.debug("Function launched.")

        if usages is None:
            usages = {}

        # specify CA usage
        usages[CA_ID] = True

        # generate extension configuration lines based on the specified usages
        extensions = extensions + "\n" + "\n".join(usages_to_extension_lines(usages, REQUIRED_USAGE_EXTENSION_FLAGS))

        # Add CRL and OCSP distribution point to certificate extensions
        cert_id = self.certificate_repository.get_next_id()
        extensions = extensions + "\n" + CRL_EXTENSION + " " + self.__get_crl_endpoint(issuer_cert.certificate_id)
        extensions = extensions + "\n" + OCSP_EXTENSION + " " + self.__get_ocsp_endpoint(issuer_cert.certificate_id)

        # TODO implement AIA URI via extensions
        cert_pem = self.cryptography_service.create_crt(subject, subject_key.private_key, issuer_cert.pem_data,
                                                        issuer_key.private_key,
                                                        subject_key_pass=subject_key.password,
                                                        issuer_key_pass=issuer_key.password, extensions=extensions,
                                                        days=days,
                                                        sn=cert_id)

        # wrap into Certificate class
        certificate = self.__create_wrapper(cert_pem, subject_key.private_key_id, usages,
                                            issuer_cert.certificate_id, INTERMEDIATE_CA_ID)

        # store the wrapper into the repository
        created_id = self.certificate_repository.create(certificate)

        # assign the generated ID to the inserted certificate
        certificate.certificate_id = created_id

        return certificate

    def create_end_cert(self, subject_key: PrivateKey, subject: Subject, issuer_cert: Certificate,
                        issuer_key: PrivateKey,
                        extensions: str = "", days: int = 30, usages=None):
        """
        Creates an end certificate issued by the given parent CA.
        :param subject_key: Private key to be used when generating the certificate
        :param subject: Subject to be used put into the certificate
        :param issuer_cert: Issuer certificate that will sign the CSR required to create an intermediate CA
        :param issuer_key: PK used to generate the issuer certificate
        :param extensions: Extensions to be used when generating the certificate
        :param usages: A dictionary containing usages of the certificate to be generated (see constants.py)
        :param days: Number of days for which the generated cert. will be considered valid
        :return: An instance of Certificate class representing the generated cert
        """

        Logger.debug("Function launched.")

        if usages is None:
            usages = {}

        # get the next certificate ID in order to be able to specify the serial number
        cert_id = self.certificate_repository.get_next_id()

        # generate extension configuration lines based on the specified usages
        extensions = extensions + "\n" + "\n".join(usages_to_extension_lines(usages, REQUIRED_USAGE_EXTENSION_FLAGS))

        # Add CRL and OCSP distribution point to certificate extensions
        extensions = extensions + "\n" + CRL_EXTENSION + " " + self.__get_crl_endpoint(issuer_cert.certificate_id)
        extensions = extensions + "\n" + OCSP_EXTENSION + " " + self.__get_ocsp_endpoint(issuer_cert.certificate_id)

        # generate a new certificate
        cert_pem = self.cryptography_service.create_crt(subject, subject_key.private_key, issuer_cert.pem_data,
                                                        issuer_key.private_key,
                                                        subject_key_pass=subject_key.password,
                                                        issuer_key_pass=issuer_key.password, extensions=extensions,
                                                        days=days,
                                                        sn=cert_id
                                                        )

        # wrap the generated certificate using Certificate class
        certificate = self.__create_wrapper(cert_pem, subject_key.private_key_id, usages,
                                            issuer_cert.certificate_id, CERTIFICATE_ID)

        created_id = self.certificate_repository.create(certificate)

        certificate.certificate_id = created_id

        return certificate

    def get_certificate(self, unique_id: int) -> Certificate:
        """
        Tries to fetch a certificate from the certificate repository using a given id.
        :param unique_id: ID of the certificate to be fetched
        :return: Instance of the Certificate class containing a certificate with the given id or `None` if such
        certificate is not found
        """

        Logger.debug("Function launched.")

        return self.certificate_repository.read(unique_id)

    def get_certificates(self, cert_type=None) -> List[Certificate]:
        """
        Tries to fetch a list of all certificates from the certificate repository. Using the `cert_type` parameter only
        certificates of the given type can be returned.
        :param cert_type: Type of certificates to be returned
        :return: List of instances of the Certificate class representing all certificates present in the certificate
        repository. An empty list is returned when no certificates are found.
        """

        Logger.debug("Function launched.")

        return self.certificate_repository.read_all(cert_type)

    def get_certificates_filter(self, target_types, target_usages, target_cn_substring, page, per_page):
        """
        Tries to fetch a filtered list of all certificates from the certificate repository.
        :param target_types: certificate types (filter)
        :param target_usages: certificate usages (filter)
        :param target_cn_substring: certificate CN substring (filter)
        :param page: target page
        :param per_page: target page size
        :return: List of instances of the Certificate class representing filtered certificates
                    present in the certificate repository. An empty list is returned when no certificates are found.
        """
        return self.certificate_repository.read_all_filter(target_types, target_usages, target_cn_substring,
                                                           page, per_page)

    def get_chain_of_trust(self, from_id: int, to_id: int = -1, exclude_root=True) -> List[Certificate]:
        """
        Traverses the certificate hierarchy tree upwards till a certificate with the `to_id` ID is found or till a
        root CA certificate is found. Root certificates are excluded from the chain by default.
        :param from_id: ID of the first certificate to be included in the chain of trust
        :param to_id: ID of the last certificate to be included in the chain of trust
        :param exclude_root: a flag indicating whether root CA certificate should be excluded
        :return: a list of certificates representing the chain of trust starting with the certificate given by `from_id`
        ID
        """

        Logger.debug("Function launched.")

        # read the first certificate of the chain
        start_cert = self.certificate_repository.read(from_id)

        # if no cert is found or the current cert is root CA and root CAs should be excluded, then return an empty list
        if start_cert is None or (start_cert.type_id == ROOT_CA_ID and exclude_root):
            return []

        current_cert = start_cert
        chain_of_trust = [current_cert]

        # TODO could possibly be simplified
        if start_cert.type_id == ROOT_CA_ID:
            # the first cert found is a root ca
            return chain_of_trust

        while True:
            parent_cert = self.certificate_repository.read(current_cert.parent_id)

            # check whether parent certificate exists
            if parent_cert is None:
                break

            # check whether the found certificate is a root certificate
            if parent_cert.type_id == ROOT_CA_ID:
                if not exclude_root:
                    # append the found root cert only if root certificates should not be excluded from the CoT
                    chain_of_trust.append(parent_cert)
                break

            # append the certificate
            chain_of_trust.append(parent_cert)

            # stop iterating over certificates if the id of the found certificate matches `to_id` method parameter
            if parent_cert.certificate_id == to_id:
                break

            current_cert = parent_cert

        return chain_of_trust

    def delete_certificate(self, unique_id):
        """
        Deletes a certificate. Raises an Exception should any unexpected behavior occur.

        :param unique_id: ID of specific certificate
        """

        Logger.debug("Function launched.")

        to_delete = self.certificate_repository.get_all_descendants_of(unique_id)
        if to_delete is None:
            Logger.error(f"No such certificate found 'ID = {unique_id}'.")
            raise CertificateNotFoundException(unique_id)

        for cert in to_delete:
            try:
                self.set_certificate_revocation_status(cert.certificate_id, STATUS_REVOKED)
            except CertificateAlreadyRevokedException:
                Logger.info(f"Certificate already revoked 'ID = {unique_id}'.")
                # TODO log as an info/debug, not warning or above <-- perfectly legal
                pass

            if not self.certificate_repository.delete(cert.certificate_id):
                Logger.error(f"The certificate has not been deleted 'ID = {cert.certificate_id}'.")

    def get_certificates_issued_by(self, issuer_id):
        """
        Returns a list of all children of a certificate identified by an unique_id.
        Raises a DatabaseException should any unexpected behavior occur.
        :param issuer_id: target certificate ID
        :return: children of unique_id
        """

        Logger.debug("Function launched.")

        try:
            if self.certificate_repository.read(issuer_id) is None:
                Logger.error(f"No such certificate found 'ID = {issuer_id}'.")
                raise CertificateNotFoundException(issuer_id)
        except DatabaseException:
            Logger.error(f"No such certificate found 'ID = {issuer_id}'.")
            raise CertificateNotFoundException(issuer_id)

        return self.certificate_repository.get_all_issued_by(issuer_id)

    def get_certificates_issued_by_filter(self, issuer_id, target_types, target_usages, target_cn_substring, page,
                                          per_page):
        """
        Returns a list of all children of a certificate identified by an unique_id.
        Filters the results according to target types, usages, cn substring and pagination.
        Raises a DatabaseException should any unexpected behavior occur.
        :param issuer_id: target certificate ID
        :param target_types: filter of types
        :param target_usages: filter of usages
        :param target_cn_substring: CN substring
        :param page: target page or None
        :param per_page: certs per page or None
        :return: list of certificates (a page if specified)
        """

        Logger.debug("Function launched.")

        try:
            if self.certificate_repository.read(issuer_id) is None:
                Logger.error(f"No such certificate found 'ID = {issuer_id}'.")
                raise CertificateNotFoundException(issuer_id)
        except DatabaseException:
            Logger.error(f"No such certificate found 'ID = {issuer_id}'.")
            raise CertificateNotFoundException(issuer_id)

        return self.certificate_repository.get_all_issued_by_filter(issuer_id, target_types, target_usages,
                                                                    target_cn_substring, page, per_page)

    def set_certificate_revocation_status(self, id, status, reason="unspecified"):
        """
        Set certificate status to 'valid' or 'revoked'.
        If the new status is revoked a reason can be provided -> default is unspecified
        :param reason: reason for revocation
        :param id: identifier of the certificate whose status is to be changed
        :param status: new status of the certificate
        :raises CertificateStatusInvalidException: if status is not valid
        :raises RevocationReasonInvalidException: if reason is not valid
        :raises CertificateNotFoundException: if certificate with given id cannot be found
        :raises CertificateCannotBeSetToValid: if certificate was already revoked and not on hold,
                it cannot be set revalidated
        :raises CertificateAlreadyRevokedException: if caller tries to revoke a certificate that is already revoked
        :raises UnknownException: if the database is corrupted
        """

        Logger.debug("Function launched.")

        if status not in CERTIFICATE_STATES:
            Logger.error(f"Wrong parameter, invalid status '{status}'.")
            raise CertificateStatusInvalidException(status)
        if reason not in CERTIFICATE_REVOCATION_REASONS:
            Logger.error(f"Wrong parameter, invalid reason '{reason}'.")
            raise RevocationReasonInvalidException(reason)

        # check whether the certificate exists
        certificate = self.certificate_repository.read(id)
        if certificate is None:
            Logger.error(f"No such certificate found 'ID = {id}'.")
            raise CertificateNotFoundException(id)

        updated = False
        if status == STATUS_VALID:
            # if the certificate is revoked but the reason is not certificateHold, it cannot be re-validated
            #    -> throw an exception
            if certificate.revocation_reason != "" and \
               certificate.revocation_reason != CERTIFICATE_REVOCATION_REASON_HOLD:
                raise CertificateCannotBeSetToValid(certificate.revocation_reason)
            updated = self.certificate_repository.clear_certificate_revocation(id)
        elif status == STATUS_REVOKED:
            # check if the certificate is not revoked already
            revoked = self.certificate_repository.get_all_revoked_by(certificate.parent_id)
            if certificate.certificate_id in [x.certificate_id for x in revoked]:
                Logger.error(f"Certificate already revoked 'ID = {id}'.")
                raise CertificateAlreadyRevokedException(id)

            revocation_timestamp = int(time.time())
            updated = self.certificate_repository.set_certificate_revoked(id, str(revocation_timestamp), reason)

        if not updated:
            Logger.error(f"Repository returned 'false' from clear_certificate_revocation() "
                         f"or set_certificate_revoked().")
            raise UnknownException("Repository returned 'false' from clear_certificate_revocation() "
                                   "or set_certificate_revoked().")

    def get_subject_from_certificate(self, certificate: Certificate) -> Subject:
        """
        Get Subject distinguished name from a Certificate
        :param certificate: certificate instance whose Subject shall be parsed
        :return: instance of Subject class containing resulting distinguished name
        """

        Logger.debug("Function launched.")

        subject = Subject(certificate.common_name,
                          certificate.country_code,
                          certificate.locality,
                          certificate.province,
                          certificate.organization,
                          certificate.organizational_unit,
                          certificate.email_address)
        return subject

    def get_public_key_from_certificate(self, certificate: Certificate):
        """
        Extracts a public key from the given certificate
        :param certificate: an instance of the Certificate class containing the certificate from which a public key
        should be extracted.
        :return: a string containing the extracted public key in PEM format
        """

        Logger.debug("Function launched.")

        return self.cryptography_service.extract_public_key_from_certificate(certificate.pem_data)

    def get_certificate_state(self, id: int) -> str:
        """
        Check whether the certificate is expired, valid or revoked.
            - in case it's revoked and expired, revoked is returned
        :param id: identifier of the certificate
        :return: certificates state from {valid, revoked, expired}
        :raises CertificateNotFoundException: in case id of non-existing certificate is entered
        """
        Logger.debug("Function launched.")
        status = CERTIFICATE_VALID

        # Read the selected certificate from the repository
        certificate = self.certificate_repository.read(id)
        if certificate is None:
            Logger.error("Certificate whose details were requested does not exist.")
            raise CertificateNotFoundException(id)

        # check the expiration date using OpenSSL
        if not self.cryptography_service.verify_cert(certificate.pem_data):
            status = CERTIFICATE_EXPIRED

        # check certificate revocation
        all_revoked_by_parent = self.certificate_repository.get_all_revoked_by(certificate.parent_id)
        all_revoked_by_parent_ids = [cert.certificate_id for cert in all_revoked_by_parent]

        if id in all_revoked_by_parent_ids:
            status = CERTIFICATE_REVOKED

        return status

    def __get_crl_endpoint(self, ca_identifier: int) -> str:
        """
        Get URL address of CRL distribution endpoint based on
        issuer's ID

        :param ca_identifier: ID of issuing authority
        :return: CRL endpoint for the given CA
        """

        Logger.debug("Function launched.")

        return self.configuration.base_server_url + "/api/crl/" + str(ca_identifier)

    def __get_ocsp_endpoint(self, ca_identifier: int) -> str:
        """
        Get URL address of OCSP distribution endpoint based on
        issuer's ID

        :param ca_identifier: ID of issuing authority
        :return: OCSP endpoint for the given CA
        """

        Logger.debug("Function launched.")

        return self.configuration.base_server_url + "/api/ocsp/" + str(ca_identifier)

    def generate_pkcs_identity(self, certificate: Certificate, cert_key: PrivateKey, identity_name: str, identity_passphrase: str):
        """
        Generates a PKCS identity of the certificate given by the specified ID while using the private key passed.
        A name of the identity to be used and certificate's passphrase have to be specified as well as the passphrase
        of certificate's private key (if encrypted).
        :param certificate: certificate to be put into the PKCS identity store
        :param cert_key: key used to sign the given certificate
        :param identity_name: name to be given to the identity to be created
        :param identity_passphrase: passphrase to be used to encrypt the identity
        :return: byte array containing the generated identity (PKCS12 store)
        """
        Logger.debug("Function launched.")

        # get the chain of trust of the certificate whose identity should be generated and exclude the certificate
        # whose chain of trust we are querying
        cot_pem_list = [cert.pem_data for cert in self.get_chain_of_trust(certificate.certificate_id, exclude_root=False)[1:]]

        return self.cryptography_service.generate_pkcs_identity(certificate.pem_data, cert_key.private_key,
                                                                identity_name,
                                                                identity_passphrase, cot_pem_list, cert_key.password)


class RevocationReasonInvalidException(Exception):
    """
    Exception that denotes that the caller was trying to revoke
    a certificate using an invalid revocation reason
    """

    def __init__(self, reason):
        self.reason = reason

    def __str__(self):
        return f"Revocation reason '{self.reason}' is not valid."


class CertificateStatusInvalidException(Exception):
    """
    Exception that denotes that the caller was trying to set
    a certificate to an invalid state
    """

    def __init__(self, status):
        self.status = status

    def __str__(self):
        return f"Certificate status '{self.status}' is not valid."


class CertificateAlreadyRevokedException(Exception):
    """
    Exception that denotes that the caller was trying to revoke
    a certificate that is already revoked
    """

    def __init__(self, id):
        self.id = id

    def __str__(self):
        return f"Certificate id '{self.id}' is already revoked."


class CertificateCannotBeSetToValid(Exception):
    """
    Exception that denotes that the caller was trying to
    set certificate to valid if the certificate was already
    revoked but not certificateHold.
    """

    def __init__(self, old_reason):
        self.old_state = old_reason

    def __str__(self):
        return "Cannot set revoked certificate back to valid when the certificate revocation reason is not " \
               "certificateHold. " \
               f"The revocation reason of the certificate is {self.old_state}"