Revize dea7f12f

Re #8708 - Added a unit test covering a scenario in which an empty identity password is passed to the generate_pkcs_identity method of the CryptographyService

Improved the generate_pkcs_identity method in such way that when None is passed as the identity password then an empty string literal ("") is used instead.

src/services/cryptography.py

@@ -462 +462 @@
         :return: byte array containing the generated identity
         """
         with TemporaryFile("cert_key.pem", cert_key_pem) as cert_key_pem_file:
+            if identity_passphrase is None:
+                identity_passphrase = ""
+
             args = ["pkcs12", "-export", "-name", identity_name, "-in", "-", "-inkey", cert_key_pem_file, "-passout", f"pass:{identity_passphrase}", "-passin", f"pass:{cert_key_passphrase}"]
             proc_input = cert_pem
             # when the chain of trust is not empty append the -CAfile argument and the concatenated list of CoT PEMs

tests/unit_tests/services/cryptography/generate_pkcs_identity_test.py

@@ -114 +114 @@
     with pytest.raises(CryptographyException):
         service.generate_pkcs_identity(child_cert, child_key, "Baz Pkcs", "secret_pass",
                                        "".join([root_cert, inter_cert]), cert_key_passphrase="passkey")
+
+
+def test_generate_pkcs_identity_empty_identity_passphrase(service):
+    root_key = service.create_private_key()
+    root_cert = service.create_sscrt(Subject(common_name="Foo"), root_key)
+
+    inter_key = service.create_private_key()
+    inter_cert = service.create_crt(Subject(common_name="Bar"), inter_key, root_cert, root_key)
+
+    # protect the child key with a passphrase
+    child_key = service.create_private_key()
+    child_cert = service.create_crt(Subject(common_name="Baz"), child_key, inter_cert, inter_key)
+
+    # pass an empty identity passphrase
+    pkcs = service.generate_pkcs_identity(child_cert, child_key, "Baz Pkcs", "",
+                                          "".join([root_cert, inter_cert]))
+
+    # print out the pkcs store in order to be able to check it
+    pkcs_info = subprocess.check_output(
+        ["openssl", "pkcs12", "-info", "-in", "-", "-nodes", "-passin", "pass:"],
+        input=pkcs,
+        stderr=subprocess.STDOUT).decode()
+
+    assert child_cert in pkcs_info
+
+    assert "-----BEGIN PRIVATE KEY-----" in pkcs_info
+    assert root_cert in pkcs_info
+    assert inter_cert in pkcs_info