Revize f16fb9e7

Re #8472 - Added CryptographyService class and implemented a method to generate private keys

Added CryptographyException exception that is thrown when incorrect parameters are passed to openssl or when openssl process exits with non-zero return code.
Added 3 unit tests verifying the validity of the private key generation.

services/cryptography.py

@@ +1 @@
+import subprocess
+
+# encryption method to be used when generating private keys
+PRIVATE_KEY_ENCRYPTION_METHOD = "-aes256"
+
+# openssl executable name
+OPENSSL_EXECUTABLE = "openssl"
+
+
+class CryptographyService:
+
+    @staticmethod
+    def _run_for_output(args=None, stdin=None, executable=OPENSSL_EXECUTABLE):
+        """
+        Launches a new process in which the given executable is run. STDIN and process arguments can be set.
+        If the process ends with a non-zero then <CryptographyException> is raised.
+        :param args: Arguments to be passed to the program.
+        :param stdin: Arguments to be passed to the process.
+        :param executable: Executable to be run (defaults to openssl)
+        :return: If the process ends with a zero return code then the STDOUT of the process is returned as a byte array.
+        """
+        if args is None:
+            args = []
+        try:
+            # prepend the name of the executable
+            args.insert(0, executable)
+
+            # create a new process
+            proc = subprocess.Popen(args, stdin=stdin, stdout=subprocess.PIPE,
+                                    stderr=subprocess.PIPE)
+
+            # get process result
+            out, err = proc.communicate()
+
+            if proc.returncode != 0:
+                # if the process did not result in zero result code, then raise an exception
+                if err is not None:
+                    raise CryptographyException(err.decode())
+                else:
+                    raise CryptographyException(
+                        f""""{executable} with parameters {args} resulted in non-zero argument""")
+
+            return out
+        except FileNotFoundError:
+            raise CryptographyException(f""""{executable}" not found in the current PATH.""")
+
+    def create_private_key(self, passphrase=None):
+        """
+        Creates a private key with the option to encrypt it using a passphrase.
+        :param passphrase: A passphrase to be used when encrypting the key (if none is passed then the key is not
+        encrypted at all). Empty passphrase ("") also results in a key that is not encrypted.
+        :return: A text representation of the generated private key.
+        """
+        if passphrase is None or len(passphrase) == 0:
+            return self._run_for_output(["genrsa", "2048"]).decode()
+        else:
+            return self._run_for_output(
+                ["genrsa", PRIVATE_KEY_ENCRYPTION_METHOD, "-passout", f"pass:{passphrase}", "2048"]).decode()
+
+
+class CryptographyException(Exception):
+
+    def __init__(self, message):
+        self.message = message

tests/services/cryptography_test.py

@@ +1 @@
+import pytest
+from services.cryptography import CryptographyService, CryptographyException
+import subprocess
+
+
[e-mail]
+def service():
+    # provide a CryptographyService fixture
+    return CryptographyService()
+
+
+def test_private_key(service):
+    private_key = service.create_private_key()
+
+    # verify the private key
+    subprocess.check_output(["openssl", "rsa", "-in", "-", "-check"], input=bytes(private_key, encoding="utf-8"),
+                            stderr=subprocess.STDOUT)
+
+
+def test_encrypted_private_key(service):
+    private_key = service.create_private_key(passphrase="foobar")
+
+    # verify the private key providing a correct passphrase
+    subprocess.check_output(["openssl", "rsa", "-in", "-", "-passin", "pass:foobar", "-check"],
+                            input=bytes(private_key, encoding="utf-8"), stderr=subprocess.STDOUT)
+
+
+def test_encrypted_private_key_incorrect_pass(service):
+    private_key = service.create_private_key(passphrase="foobar")
+
+    # incorrect passphrase provided
+    with pytest.raises(subprocess.CalledProcessError) as e:
+        subprocess.check_output(["openssl", "rsa", "-in", "-", "-passin", "pass:bazbaz", "-check"],
+                                input=bytes(private_key, encoding="utf-8"), stderr=subprocess.STDOUT)
+    # no passphrase provided
+    with pytest.raises(subprocess.CalledProcessError) as e:
+        subprocess.check_output(["openssl", "rsa", "-in", "-", "-check"],
+                                input=bytes(private_key, encoding="utf-8"), stderr=subprocess.STDOUT)