Revize 76648193

Re #8705 - Added the `verify_key` method to CryptoService.

src/services/cryptography.py

@@ -10 +10 @@
 from src.utils.logger import Logger
 from src.utils.temporary_file import TemporaryFile
 
+# the prefix of an rsa key
+KEY_PREFIX = b"-----BEGIN RSA PRIVATE KEY-----"
+
+# what every encrypted key contains
+GUARANTEED_SUBSTRING_OF_ENCRYPTED_KEYS = "ENCRYPTED"
+
 # encryption method to be used when generating private keys
 PRIVATE_KEY_ENCRYPTION_METHOD = "-aes256"
 
@@ -411 +417 @@
 
         # openssl ca requires the .srl file to exists, therefore a dummy, unused file is created
         with TemporaryFile("serial.srl", "0") as serial_file, \
-             TemporaryFile("crl.conf", CRL_CONFIG % (index_file_path, serial_file)) as config_file, \
-             TemporaryFile("certificate.pem", cert.pem_data) as cert_file, \
-             TemporaryFile("private_key.pem", key.private_key) as key_file:
-
+                TemporaryFile("crl.conf", CRL_CONFIG % (index_file_path, serial_file)) as config_file, \
+                TemporaryFile("certificate.pem", cert.pem_data) as cert_file, \
+                TemporaryFile("private_key.pem", key.private_key) as key_file:
             args = ["ca", "-config", config_file, "-gencrl", "-keyfile", key_file, "-cert", cert_file, "-outdir", "."]
 
             if key.password is not None and key.password != "":
@@ -437 +442 @@
         Logger.debug("Function launched.")
 
         with TemporaryFile("certificate.pem", cert.pem_data) as ca_certificate, \
-             TemporaryFile("private_key.pem", key.private_key) as key_file, \
-             TemporaryFile("request.der", der_ocsp_request) as request_file:
-
+                TemporaryFile("private_key.pem", key.private_key) as key_file, \
+                TemporaryFile("request.der", der_ocsp_request) as request_file:
             args = ["ocsp", "-index", index_path, "-CA", ca_certificate, "-rsigner", ca_certificate, "-rkey", key_file,
                     "-reqin", request_file, "-respout", "-"]
 
@@ -448 +452 @@
 
             return self.__run_for_output(args)
 
+    def verify_key(self, key, passphrase):
+        """
+        Verifies whether the provided key is encrypted by the provided passphrase. If passphrase is none, verifies
+        that the provided key is unencrypted.
+        :param key: target key
+        :param passphrase: target passphrase or None
+        :return: True if the condition is fulfilled, else False
+        """
+        if passphrase is None:
+            return re.search(GUARANTEED_SUBSTRING_OF_ENCRYPTED_KEYS, key) is None
+        else:
+            if re.search(GUARANTEED_SUBSTRING_OF_ENCRYPTED_KEYS, key) is None:
+                return False
+            else:
+                try:
+                    with TemporaryFile("tested_key.pem", key) as f:
+                        ret = self.__run_for_output(["rsa", "-in", f, "-passin", f"pass:{passphrase}"])
+                    return ret.startswith(KEY_PREFIX)
+                except CryptographyException:
+                    return False
+
 
 class CryptographyException(Exception):