Revize 7ff4be59

Re #8573 - Improved testing of extract_public_key_from_certificate and extract_public_key_from_private_key methods

tests/unit_tests/services/cryptography/conftest.py

@@ -105 +105 @@
     """
 
 
+# contains certificate, private key as well as PK passphrase
 @pytest.fixture
 def certificate_with_encrypted_pk_pem():
     return """
@@ -129 +130 @@
 c2xJmcA3t2cFCHYKXDmlBJJ5Kvkuak9U+TZLl7+Y7+SmyJIv9nRN2THwDKpaRtff
 94wl65n2IoG1YP4XyjyX
 -----END CERTIFICATE-----
-    """, "pass"
+    """, """
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,CC2F8ACBF28E244F2DCD4239D38EE3A5
+
+75uLZWsoCKfzOlp//IbWVkISUsrG2MqrJi8JIRKWeR63jGCuskju87U+LoPP7EZ+
+xBm9uP0voayUIXPnGOJS/1veUfV8477RGhqK0/pM/MLWcYnggeoBu7EIzUVi80tQ
+chC1DJxB+mi1DG3lytyzvuDq8AsQ7iK7VWmST9pJHDgw9K19zBLRtPjZLYs09A0e
+PJE74IgZySOctZxwidmdwYDysGaMK35nxP6tPUngQjuA2TdDQxOKBTG17g4drqcJ
+ddJFpw3HKiSRyHtl8DQoQwHXvgSFNz/dAnXRRAA+8ogyCyzcroekBGqaMJWpJMNp
+sbJgochbFZ+ayAQuQQGxDQHkzpTlYP4HCeDW7hR79HUWLziPXCjoE5PcEz/z/Be1
+dxYzK3zArFSHthvhKWNhwsFhCmseAlR8jtOBOncAG4F1wkkwIGjfrWFTUmvBBS+m
+KbUzDM2H4caUnG8gWiGht/EZU6M4fEuFy6Ms8ZXUZLnz3k4wfw5KKIGgdZ4BsVt0
+zTLkrvuy/wCRo6j5EQT7fBr2RAhakIBOOmXBD5ZukJljvP2EF8z33AgeOO2CE1Uw
+fq460dOHuk7A89pGfYHmy9KVpL2q70xswYbv+2yjaDOhRRHoNNGtIK9b+aTo0dxD
+ixHgrxQeJnkwpLBhuax0pMzL1vbG0jujlApVRUodUo2xkZjwjgwp95Ss4RJr124U
+pLjQJ+9V1BUl1i0VqrC8IyABQH2hpPXk/yxGsAZ2xOXCsGKd1IT997SroA8vnJBf
+umGVl88GowzSVRdVwZozb5JGyh/pV+haNgHM8NBwZEqD8kB+4038l3dwtr115Ogi
+8zRqUgvcBXTaXOJ04qpZmnhILFTu36Z5OtE1VRT+7e/9viAsvTzrGpoVd8rPSima
+Vxus94+yDgakkXpF7nyoP/r0PVZNpcB2Iq1c8jqln6YL+9uxGnkAcCWerYx75lpv
+TSXCw9IS07f3ggiJ77d3IleEFA5ohCKoAZndxmRS+M1/EsZn4ShsN71CCY3UTofV
+T4Gadwk5nKKVDF2BP7nVOu4KBN0ws9ENweZjFVbr/uRghbt2fxQlFCcMSR+huTcU
+p2JNCXNhhqCtswjr2nt1Ti/LyFwxSrJqTw1HNIeTHYHp/YPfGCq8O3gBT4DOxQ5D
+0vg7+yNV4tmfgKxjA+MgHBFo1SffRKYtMy9ILZyo2yb+AyjZWfl6ab0tyhK517jD
+YSClJgqlzYCe1sWU/Vot0/GrPn4jI/0o2cIXOXRf2LH8JEkXC8qxxWl3gLzTmznG
+s+r8D6UAmo6cCXaB4bquRooIi1BT1bINOixASa6BF/58VXnnpE8ItqIp4o2gb4Nq
+TD+620Jn9JZOdaq5heDObfg6wIH8PS/1VDdcFflayX9YxdMDJ4RGG6CRLWplJWT/
+Q7Kex+qupynM4gwXfpg9AuM3uAaIlUYU45zgTC9cF+vBWFtao0tZCmjJEXaik9L/
+H1WudWhZjp6RflnLKTcLvYslutwUb4q23mPUim03H/7YZ5tPLDWgSHiOk4phHVPG
+pIeQ6WxVbfVqyCBrTAsKUvkfs+rGvyM0iXgPw5As7M2nRE3emwpw8PskqLUnTMyK
+-----END RSA PRIVATE KEY-----
+    """, "pass"

tests/unit_tests/services/cryptography/extract_public_key_from_certificate_test.py

@@ +1 @@
+import subprocess
+
 
 def test_extract_public_key_encrypted(service, certificate_with_encrypted_pk_pem):
     public_key = service.extract_public_key_from_certificate(certificate_with_encrypted_pk_pem[0])
 
-    assert "-----BEGIN PUBLIC KEY-----" in public_key
+    # get modulus from the private key
+    modulus_pk = subprocess.check_output(
+        ["openssl", "rsa", "-noout", "-in", "-", "-modulus", "-passin", f"pass:{certificate_with_encrypted_pk_pem[2]}"],
+        input=bytes(certificate_with_encrypted_pk_pem[1], encoding="utf-8"),
+        stderr=subprocess.STDOUT).decode()
+
+    # get the modulus from the extracted public key
+    modulus_from_extracted_public_key = subprocess.check_output(
+        ["openssl", "rsa", "-noout", "-pubin", "-in", "-", "-modulus"],
+        input=bytes(public_key,
+                    encoding="utf-8"),
+        stderr=subprocess.STDOUT).decode()
+
+    # moduli should match
+    assert modulus_pk == modulus_from_extracted_public_key
 
 
 def test_extract_public_key(service, certificate_pem):
     public_key = service.extract_public_key_from_certificate(certificate_pem)
 
-    # TODO test whether public key matches a private key
-    assert "-----BEGIN PUBLIC KEY-----" in public_key
+    # get public key from the certificate
+    expected_public_key = subprocess.check_output(
+        ["openssl", "x509", "-in", "-", "-noout", "-pubkey"],
+        input=bytes(certificate_pem, encoding="utf-8"),
+        stderr=subprocess.STDOUT).decode()
+
+    assert expected_public_key == public_key
 

tests/unit_tests/services/cryptography/extract_public_key_test.py

@@ +1 @@
+import subprocess
+
 import pytest
 
 from src.services.cryptography import CryptographyException
@@ -7 +9 @@
     public_key = service.extract_public_key_from_private_key(private_key_encrypted_pem[0],
                                                              passphrase=private_key_encrypted_pem[1])
 
-    assert "-----BEGIN PUBLIC KEY-----" in public_key
+    # get modulus from the private key
+    modulus_pk = subprocess.check_output(
+        ["openssl", "rsa", "-noout", "-in", "-", "-modulus", "-passin", f"pass:{private_key_encrypted_pem[1]}"],
+        input=bytes(private_key_encrypted_pem[0], encoding="utf-8"),
+        stderr=subprocess.STDOUT).decode()
+
+    # get the modulus from the extracted public key
+    modulus_from_extracted_public_key = subprocess.check_output(
+        ["openssl", "rsa", "-noout", "-pubin", "-in", "-", "-modulus"],
+        input=bytes(public_key,
+                    encoding="utf-8"),
+        stderr=subprocess.STDOUT).decode()
+
+    # moduli should match
+    assert modulus_pk == modulus_from_extracted_public_key
 
 
 def test_extract_public_key(service, private_key_pem):
     public_key = service.extract_public_key_from_private_key(private_key_pem)
 
-    # TODO test whether public key matches a private key
-    assert "-----BEGIN PUBLIC KEY-----" in public_key
+    # get modulus from the private key
+    modulus_pk = subprocess.check_output(
+        ["openssl", "rsa", "-noout", "-in", "-", "-modulus"],
+        input=bytes(private_key_pem, encoding="utf-8"),
+        stderr=subprocess.STDOUT).decode()
+
+    # get the modulus from the extracted public key
+    modulus_from_extracted_public_key = subprocess.check_output(
+        ["openssl", "rsa", "-noout", "-pubin", "-in", "-", "-modulus"],
+        input=bytes(public_key,
+                    encoding="utf-8"),
+        stderr=subprocess.STDOUT).decode()
+
+    # moduli should match
+    assert modulus_pk == modulus_from_extracted_public_key
 
 
 def test_extract_public_key_encrypted_fails(service, private_key_encrypted_pem):