Revize 75ebc6fc

Re #8576 - Fixed generating index file for generating empty CRL

src/services/crl/ca_index_file_line_generator.py

@@ -38 +38 @@
     ]
 
     return TAB_CHAR.join(items)
+
+def create_index_file_valid_line(certificate: Certificate, subject: Subject, valid_to: struct_time) -> str:
+    # converts the given certificate as well as the subject and revocation / valid_to dates to a line of openssl CA
+    # index file format
+    items = [
+        # certificate status flag (R stands for revoked)
+        "V",
+        # followed by the expiration date field
+        f"{get_index_file_time_entry(valid_to)}",
+        # followed by the revocation date field
+        f"",
+        # followed by the serial number of the certificate in hex format
+        hex(certificate.certificate_id).replace("x", "").upper(),
+        # certificate filename ("unknown" literal used for unknown file names)
+        "unknown",
+        # certificate distinguished name
+        get_distinguished_name(subject)
+    ]
+
+    return TAB_CHAR.join(items)

src/services/crl/crl_service.py

@@ -6 +6 @@
 from src.dao.private_key_repository import PrivateKeyRepository
 from src.exceptions.certificate_not_found_exception import CertificateNotFoundException
 from src.exceptions.private_key_not_found_exception import PrivateKeyNotFoundException
-from src.services.crl.ca_index_file_line_generator import create_index_file_revoked_line
+from src.services.crl.ca_index_file_line_generator import create_index_file_revoked_line, create_index_file_valid_line
 from src.services.cryptography import CryptographyService
 from src.utils.temporary_file import TemporaryFile
 
@@ -30 +30 @@
         :param ca_id: ID of the CA whose revoked certificates should be put into the index file
         :return: a str representing the content of a CA index file
         """
+        # get issuing certificate
+        certificate = self.certificate_repository.read(ca_id)
+        if certificate is None:
+            raise CertificateNotFoundException(ca_id)
+
+        # get subject and notAfter of the issuer
+        subject, _, not_after = self.cryptography_service.parse_cert_pem(certificate.pem_data)
 
-        index_lines = []
+        index_lines = [create_index_file_valid_line(certificate, subject, not_after)]
         # iterate over revoked certificates of the CA given by an ID
         for certificate in self.certificate_repository.get_all_revoked_by(ca_id):
             # extract the complete subject information and not_after date field

tests/integration_tests/services/crl_service_test.py

@@ -83 +83 @@
 
     # convert valid_to date fields (expiration date fields change with each test run)
     valid_to_dates = [
+        convert_valid_to_date_to_ca_index_format(root_ca_cert.valid_to),
         convert_valid_to_date_to_ca_index_format(foo_ca.valid_to),
         convert_valid_to_date_to_ca_index_format(bar_ca.valid_to),
         convert_valid_to_date_to_ca_index_format(baz_cert.valid_to),
@@ -90 +91 @@
 
     # arrange expected lines
     expected_lines = [
-        f"R	{valid_to_dates[0]}	{revoked_dates[0]},unspecified	02	unknown	/CN=Foo CA/L=Brno",
-        f"R	{valid_to_dates[1]}	{revoked_dates[1]},keyCompromise	03	unknown	/CN=Bar CA/C=CZ/L=Pilsen",
-        f"R	{valid_to_dates[2]}	{revoked_dates[2]},CACompromise	05	unknown	/CN=Baz CA/ST=ST"
+        f"V\t{valid_to_dates[0]}\t\t01\tunknown\t/CN=RootFoo/OU=Department of Foo",
+        f"R	{valid_to_dates[1]}	{revoked_dates[0]},unspecified	02	unknown	/CN=Foo CA/L=Brno",
+        f"R	{valid_to_dates[2]}	{revoked_dates[1]},keyCompromise	03	unknown	/CN=Bar CA/C=CZ/L=Pilsen",
+        f"R	{valid_to_dates[3]}	{revoked_dates[2]},CACompromise	05	unknown	/CN=Baz CA/ST=ST"
     ]
 
     assert out == "\n".join(expected_lines)

tests/unit_tests/services/crl/ca_index_file_line_generator_test.py

@@ -2 +2 @@
 
 from src.model.certificate import Certificate
 from src.model.subject import Subject
-from src.services.crl.ca_index_file_line_generator import create_index_file_revoked_line
+from src.services.crl.ca_index_file_line_generator import create_index_file_revoked_line, create_index_file_valid_line
 
 
 def test_get_index_file_time_entry_valid():
@@ -64 +64 @@
                "Widgits Pty Ltd "
 
     assert expected == index_line
+
+def test_get_index_file_valid_line():
+    cert = Certificate(
+        1, "IA CA", "", "01.04.2023 15:01:11", "", -1, -1, -1, {}, "", ""
+    )
+
+    date_format = "%d.%m.%Y %H:%M:%S"
+
+    expiration_date = time.strptime(cert.valid_to, date_format)
+
+    index_line = create_index_file_valid_line(cert, Subject(
+        common_name=cert.common_name,
+        state="Some-State",
+        country="AU",
+        organization="Internet Widgits Pty Ltd "
+    ), expiration_date)
+
+    expected = "V\t230401150111Z\t\t01\tunknown\t/CN=IA CA/C=AU/ST=Some-State/O=Internet Widgits Pty Ltd "
+
+    assert expected == index_line