Revize 64cfca84

Re #8576 - cryptography.py implemented generate_crl()

src/services/cryptography.py

@@ -3 +3 @@
 import time
 import random
 
+from src.constants import CRL_CONFIG
+from src.model.certificate import Certificate
+from src.model.private_key import PrivateKey
 from src.model.subject import Subject
 from src.utils.temporary_file import TemporaryFile
 
@@ -129 +132 @@
         # file instead of an extension file. Therefore the following code creates
         # the most basic configuration file with sscrt_ext section, that is later
         # reference in openssl req command using -extensions option.
-        extensions += "\n"+CA_EXTENSIONS
+        extensions += "\n" + CA_EXTENSIONS
         if len(config) == 0:
             config += MINIMAL_CONFIG_FILE
         config += "\n[ " + SSCRT_SECTION + " ]" + "\n" + extensions
@@ -146 +149 @@
             if len(config) > 0:
                 args.extend(["-config", conf_path])
             if len(extensions) > 0:
-                args.extend(["-extensions", SSCRT_SECTION]) # when creating SSCRT, section references section in config
+                args.extend(["-extensions", SSCRT_SECTION])  # when creating SSCRT, section references section in config
 
             # it would be best to not send the pass phrase at all, but for some reason pytest then prompts for
             # the pass phrase (this does not happen when run from pycharm)
@@ -355 +358 @@
         """
         return self.__run_for_output(["version"]).decode("utf-8")
 
-    def generate_crl(self, index_file_path: str) -> str:
+    def generate_crl(self, cert: Certificate, key: PrivateKey, index_file_path: str) -> str:
         """
         Generate a CertificateRevocationList for a specified
         certificate authority.
 
+        :param key: key that is used to sign the CRL (must belong to the given certificate)
+        :param cert: Certificate of the certificate authority that issue the CRL
         :param index_file_path: path to a file that contains the openssl index with all revoked certificates
         :return: CRL encoded in PEM format string
         """
-        # TODO
-        return ""
+        with TemporaryFile("serial.srl", "0") as serial_file, \
+             TemporaryFile("crl.conf", CRL_CONFIG % (index_file_path, serial_file)) as config_file, \
+             TemporaryFile("certificate.pem", cert.pem_data) as cert_file, \
+             TemporaryFile("private_key.pem", key.private_key) as key_file:
+
+            args = ["ca", "-config", config_file, "-gencrl", "-keyfile", key_file, "-cert", cert_file, "-outdir", "."]
+            return self.__run_for_output(args).decode("utf-8")
+
 
 class CryptographyException(Exception):