Revize 3e770afd

Re #8571 - cryptography.py unified extension specification and support for CRL LF

src/services/cryptography.py

@@ -14 +14 @@
 # format of NOT_BEFORE NOT_AFTER date fields
 NOT_AFTER_BEFORE_DATE_FORMAT = "%b %d %H:%M:%S %Y %Z"
 
+# minimal configuration file to be used for openssl req command
+# specifies distinguished_name that references empty section only
+# openssl requires this option to be present
+MINIMAL_CONFIG_FILE = "[req]\ndistinguished_name = req_distinguished_name\n[req_distinguished_name]\n\n"
+
+# section to be used to specify extensions when creating a SSCRT
+SSCRT_SECTION = "sscrt_ext"
+
+CA_EXTENSIONS = "basicConstraints=critical,CA:TRUE"
+
 
 class CryptographyService:
 
@@ -110 +120 @@
 
         subj = self.__subject_to_param_format(subject)
 
+        # To specify extension for creating a SSCRT, one has to use a configuration
+        # file instead of an extension file. Therefore the following code creates
+        # the most basic configuration file with sscrt_ext section, that is later
+        # reference in openssl req command using -extensions option.
+        extensions += "\n"+CA_EXTENSIONS
+        if len(config) == 0:
+            config += MINIMAL_CONFIG_FILE+"[ " + SSCRT_SECTION + " ]"+"\n"+extensions
+        config += "\n[ " + SSCRT_SECTION + " ]" + "\n" + extensions
+
         with TemporaryFile("openssl.conf", config) as conf_path:
             args = ["req", "-x509", "-new", "-subj", subj, "-days", f"{days}",
                     "-key", "-"]
+
             if len(config) > 0:
                 args.extend(["-config", conf_path])
-
             if len(extensions) > 0:
-                args.extend(["-extensions", extensions])
+                args.extend(["-extensions", SSCRT_SECTION]) # when creating SSCRT, section references section in config
 
             # it would be best to not send the pass phrase at all, but for some reason pytest then prompts for
             # the pass phrase (this does not happen when run from pycharm)
@@ -268 +287 @@
 
         # split lines
         results = re.split("\n", cert_info_raw)
-        subj_line = results[0]
-        not_before_line = results[1]
-        not_after_line = results[2]
+        subj_line = results[0].strip()
+        not_before_line = results[1].strip()
+        not_after_line = results[2].strip()
 
         # attempt to extract subject via regex
         match = re.search(r"subject=(.*)", subj_line)
@@ -284 +303 @@
             subj = Subject()
             for key, value in found:
                 if key == "C":
-                    subj.country = value
+                    subj.country = value.strip()
                 elif key == "ST":
-                    subj.state = value
+                    subj.state = value.strip()
                 elif key == "L":
-                    subj.locality = value
+                    subj.locality = value.strip()
                 elif key == "O":
-                    subj.organization = value
+                    subj.organization = value.strip()
                 elif key == "OU":
-                    subj.organization_unit = value
+                    subj.organization_unit = value.strip()
                 elif key == "CN":
-                    subj.common_name = value
+                    subj.common_name = value.strip()
                 elif key == "emailAddress":
-                    subj.email_address = value
+                    subj.email_address = value.strip()
 
         # extract notBefore and notAfter date fields
         not_before = re.search(r"notBefore=(.*)", not_before_line)