Revize cf1dec7f

Re #8706 - Extensions specification improvement

src/controllers/certificates_controller.py

@@ -62 +62 @@
 E_WRONG_PASSWORD = {"success": False, "data": "The provided passphrase does not match the provided key."}
 E_IDENTITY_NAME_NOT_SPECIFIED = {"success": False, "data": "Invalid request, missing identity name."}
 E_IDENTITY_PASSWORD_NOT_SPECIFIED = {"success": False, "data": "Invalid request, missing identity password."}
+E_INVALID_EXTENSIONS = {"success": False, "data": "Error occurred while creating a certificate. "
+                                                  "It may be caused by wrong format of extensions."}
 
 
 class CertController:
@@ -153 +155 @@
             extensions = ""
             if EXTENSIONS in body:
                 extensions = body[EXTENSIONS]
-
-            if CA not in body or body[CA] is None:                                  # if issuer omitted (legal) or none
-                cert = self.certificate_service.create_root_ca(                     # create a root CA
-                    key,
-                    subject,
-                    usages=usages_dict,                                             # TODO ignoring usages -> discussion
-                    days=body[VALIDITY_DAYS],
-                    extensions=extensions
-                )
-            else:
-                issuer = self.certificate_service.get_certificate(body[CA])         # get base issuer info
-
-                if issuer is None:                                              # if such issuer does not exist
-                    Logger.error(f"No certificate authority with such unique ID exists 'ID = {key.private_key_id}'.")
-                    self.key_service.delete_key(key.private_key_id)             # free
-                    return E_NO_ISSUER_FOUND, C_BAD_REQUEST                     # and throw
-
-                issuer_key = self.key_service.get_key(issuer.private_key_id)    # get issuer's key, which must exist
-
-                if issuer_key is None:                                          # if it does not
-                    Logger.error(f"Internal server error (corrupted database).")
-                    self.key_service.delete_key(key.private_key_id)             # free
-                    return E_CORRUPTED_DATABASE, C_INTERNAL_SERVER_ERROR        # and throw
-
-                f = self.certificate_service.create_ca if CA_ID in usages_dict and usages_dict[CA_ID] else \
-                    self.certificate_service.create_end_cert
-
-                # noinspection PyArgumentList
-                cert = f(                                                       # create inter CA or end cert
-                    key,                                                        # according to whether 'CA' is among
-                    subject,                                                    # the usages' fields
-                    issuer,
-                    issuer_key,
-                    usages=usages_dict,
-                    days=body[VALIDITY_DAYS],
-                    extensions=extensions
-                )
+            try:
+                if CA not in body or body[CA] is None:                                  # if issuer omitted (legal) or none
+                    cert = self.certificate_service.create_root_ca(                     # create a root CA
+                        key,
+                        subject,
+                        usages=usages_dict,                                             # TODO ignoring usages -> discussion
+                        days=body[VALIDITY_DAYS],
+                        extensions=extensions
+                    )
+                else:
+                    issuer = self.certificate_service.get_certificate(body[CA])         # get base issuer info
+
+                    if issuer is None:                                              # if such issuer does not exist
+                        Logger.error(f"No certificate authority with such unique ID exists 'ID = {key.private_key_id}'.")
+                        self.key_service.delete_key(key.private_key_id)             # free
+                        return E_NO_ISSUER_FOUND, C_BAD_REQUEST                     # and throw
+
+                    issuer_key = self.key_service.get_key(issuer.private_key_id)    # get issuer's key, which must exist
+
+                    if issuer_key is None:                                          # if it does not
+                        Logger.error(f"Internal server error (corrupted database).")
+                        self.key_service.delete_key(key.private_key_id)             # free
+                        return E_CORRUPTED_DATABASE, C_INTERNAL_SERVER_ERROR        # and throw
+
+                    f = self.certificate_service.create_ca if CA_ID in usages_dict and usages_dict[CA_ID] else \
+                        self.certificate_service.create_end_cert
+
+                    # noinspection PyArgumentList
+                    cert = f(                                                       # create inter CA or end cert
+                        key,                                                        # according to whether 'CA' is among
+                        subject,                                                    # the usages' fields
+                        issuer,
+                        issuer_key,
+                        usages=usages_dict,
+                        days=body[VALIDITY_DAYS],
+                        extensions=extensions
+                    )
+
+            # if extensions are specified and CryptoException occurs, the problem is probably in the
+            # extensions format - otherwise error 500 is expected
+            except CryptographyException as e:
+                if len(extensions) > 0:
+                    return E_INVALID_EXTENSIONS, C_BAD_REQUEST
+                else:
+                    raise CryptographyException(e.executable, e.args, e.message)
 
             if cert is not None:
                 return {"success": True,