Revize 94e89bb1

Re #8576 - calling CryptographyService from CrlService, passphrase support

src/constants.py

@@ -56 +56 @@
 # available certificate states and revocation reasons
 CERTIFICATE_STATES = {"valid", "revoked"}
 CERTIFICATE_REVOCATION_REASONS = {"unspecified", "keyCompromise",
-                                  "cACompromise", "affiliationChanged",
+                                  "CACompromise", "affiliationChanged",
                                   "superseded", "cessationOfOperation",
-                                  "certificateHold", "removeFromCRL",
-                                  "privilegeWithdrawn", "aACompromise"}
+                                  "certificateHold", "removeFromCRL"}
 
 
 # Insert values into the template using % (index_file, serial_file)

src/exceptions/private_key_not_found_exception.py

@@ +1 @@
+class PrivateKeyNotFoundException(Exception):
+    """
+    Exception that denotes that the caller was trying to set
+    work with non-existing private key
+    """
+
+    def __init__(self, id):
+        self.id = id
+
+    def __str__(self):
+        return f"PrivateKey with id '{self.id}' does not exist."

src/services/crl/crl_service.py

@@ -3 +3 @@
 from injector import inject
 
 from src.dao.certificate_repository import CertificateRepository
+from src.dao.private_key_repository import PrivateKeyRepository
 from src.exceptions.certificate_not_found_exception import CertificateNotFoundException
+from src.exceptions.private_key_not_found_exception import PrivateKeyNotFoundException
 from src.services.crl.ca_index_file_line_generator import create_index_file_revoked_line
 from src.services.cryptography import CryptographyService
 from src.utils.temporary_file import TemporaryFile
@@ -13 +15 @@
     @inject
     def __init__(self,
                  certificate_repository: CertificateRepository,
+                 key_repository: PrivateKeyRepository,
                  cryptography_service: CryptographyService
                  ):
+        self.key_repository = key_repository
         self.certificate_repository = certificate_repository
         self.cryptography_service = cryptography_service
 
@@ -53 +57 @@
         :param ca_id: ID of a CA whose CRL shall be generated
         :return: CRL in PEM format
         """
-        # check if the requested CA exists and if not throw an exception
-        if self.certificate_repository.read(ca_id) is None:
+        # get cert and check if the requested CA exists and if not throw an exception
+        cert = self.certificate_repository.read(ca_id)
+        if cert is None:
             raise CertificateNotFoundException(ca_id)
 
+        # get key and check if it exists
+        key = self.key_repository.read(cert.private_key_id)
+        if key is None:
+            raise PrivateKeyNotFoundException(ca_id)
+
         # Create an index file and call cryptography service to generate CRL
-        with TemporaryFile("crl.index", self.create_revoked_index(ca_id)) as index_path:
-            crl_content = self.cryptography_service.generate_crl(index_path)
+        with TemporaryFile("crl.index", f"{self.create_revoked_index(ca_id)}\n") as index_path:
+            crl_content = self.cryptography_service.generate_crl(cert, key, index_path)
 
         return crl_content

src/services/cryptography.py

@@ -374 +374 @@
              TemporaryFile("private_key.pem", key.private_key) as key_file:
 
             args = ["ca", "-config", config_file, "-gencrl", "-keyfile", key_file, "-cert", cert_file, "-outdir", "."]
+
+            if key.password is not None and key.password != "":
+                args.extend(["-passin", f"pass:{key.password}"])
+
             return self.__run_for_output(args).decode("utf-8")
 
 

tests/integration_tests/services/conftest.py

@@ -79 +79 @@
 
 
 @pytest.fixture
-def crl_service_unique(certificate_repository_unique, cryptography_service):
-    return CrlService(certificate_repository_unique, cryptography_service)
+def crl_service_unique(certificate_repository_unique, private_key_repository_unique, cryptography_service):
+    return CrlService(certificate_repository_unique, private_key_repository_unique, cryptography_service)

tests/integration_tests/services/crl_service_test.py

@@ -52 +52 @@
     certificate_service_unique.set_certificate_revocation_status(bar_ca.certificate_id, "revoked", "keyCompromise")
     # revoke the created end certificate (non-CA)
     certificate_service_unique.set_certificate_revocation_status(baz_cert.certificate_id, "revoked",
-                                                                 "privilegeWithdrawn")
+                                                                 "CACompromise")
 
     # create index of revoked certificates
     out = crl_service_unique.create_revoked_index(root_ca_cert.certificate_id)
@@ -80 +80 @@
     expected_lines = [
         f"R	{valid_to_dates[0]}	{revoked_dates[0]},unspecified	02	unknown	/CN=Foo CA/L=Brno",
         f"R	{valid_to_dates[1]}	{revoked_dates[1]},keyCompromise	03	unknown	/CN=Bar CA/C=CZ/L=Pilsen",
-        f"R	{valid_to_dates[2]}	{revoked_dates[2]},privilegeWithdrawn	05	unknown	/CN=Baz CA/ST=ST"
+        f"R	{valid_to_dates[2]}	{revoked_dates[2]},CACompromise	05	unknown	/CN=Baz CA/ST=ST"
     ]
 
     assert out == "\n".join(expected_lines)
+
+def test_generate_crl_response(certificate_service_unique, private_key_service_unique, crl_service_unique,
+                               cryptography_service):
+    root_ca_private_key = private_key_service_unique.create_new_key(passphrase="foobar")
+    inter_ca_private_key = private_key_service_unique.create_new_key(passphrase="barfoo")
+
+    root_ca_cert = certificate_service_unique.create_root_ca(root_ca_private_key,
+                                                             Subject(common_name="RootFoo",
+                                                                     organization_unit="Department of Foo"))
+
+    # create a CA
+    foo_ca = certificate_service_unique.create_ca(inter_ca_private_key, Subject(common_name="Foo CA", locality="Brno"),
+                                                  root_ca_cert,
+                                                  root_ca_private_key)
+
+    # create another CA
+    bar_ca = certificate_service_unique.create_ca(inter_ca_private_key,
+                                                  Subject(common_name="Bar CA", country="CZ", locality="Pilsen"),
+                                                  root_ca_cert,
+                                                  root_ca_private_key)
+
+    # create another CA
+    certificate_service_unique.create_ca(inter_ca_private_key, Subject(common_name="BarBaz CA"),
+                                         root_ca_cert,
+                                         root_ca_private_key)
+
+    # create a certificate
+    baz_cert = certificate_service_unique.create_end_cert(inter_ca_private_key,
+                                                          Subject(common_name="Baz CA", state="ST"),
+                                                          root_ca_cert,
+                                                          root_ca_private_key)
+
+    # revoke first created intermediate CA
+    certificate_service_unique.set_certificate_revocation_status(foo_ca.certificate_id, "revoked", "unspecified")
+    # revoke second created intermediate CA
+    certificate_service_unique.set_certificate_revocation_status(bar_ca.certificate_id, "revoked", "keyCompromise")
+    # revoke the created end certificate (non-CA)
+    certificate_service_unique.set_certificate_revocation_status(baz_cert.certificate_id, "revoked",
+                                                                 "CACompromise")
+
+    crl = crl_service_unique.generate_crl_response(root_ca_cert.certificate_id)
+    print(crl)