Skip to content

Commit a21c5ea

Browse files
gene1woodgene1wood
committed
Add check if simple_test private key is being used
* Add check if the user is using the simple_test private key * Change unit tests to use simple_example instead of simple_test * Break up large check_update_private_key_and_ca_crt method Fixes #10
1 parent 788591f commit a21c5ea

File tree

6 files changed

+107
-19
lines changed

6 files changed

+107
-19
lines changed

‎hsm_orchestrator/__init__.py‎

Lines changed: 27 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -115,8 +115,8 @@ def get_openssl_cnf_config(self) -> None:
115115
"", inline_comment
116116
)
117117

118-
def check_update_private_key_and_ca_crt(self) -> None:
119-
"""Validate and update the OpenSSL 'private_key' and 'certificate' values.
118+
def check_update_private_key(self) -> None:
119+
"""Validate and update the OpenSSL 'private_key' value.
120120
121121
Prompts the user if the referenced files are missing or invalid and writes
122122
updates back to the OpenSSL configuration file.
@@ -129,10 +129,6 @@ def check_update_private_key_and_ca_crt(self) -> None:
129129
private_key_name = self.openssl_config[
130130
self.openssl_config["ca"]["default_ca"]
131131
].get("private_key")
132-
# 'certificate' OpenSSL config value is equivalent to the "-cert" CLI argument
133-
ca_crt_name = self.openssl_config[self.openssl_config["ca"]["default_ca"]].get(
134-
"certificate"
135-
)
136132

137133
ca_dir = Path(self.repo_dir / Path("certificate-authorities"))
138134
possible_private_key_names = [x.name for x in ca_dir.iterdir() if x.is_dir()]
@@ -150,6 +146,12 @@ def check_update_private_key_and_ca_crt(self) -> None:
150146
f" '{private_key_name}' doesn't map to a directory in the"
151147
" hsm/certificate-authorities/ directory."
152148
)
149+
elif private_key_name == "simple_test":
150+
prompt_for_private_key = Confirm.ask(
151+
f"The 'private_key' in the {self.cnf_file} file is set to 'simple_test'"
152+
" which is a test private key. [q]Would you like to change it to"
153+
" something different?[/q]"
154+
)
153155
if prompt_for_private_key:
154156
private_key_name = Prompt.ask(
155157
"[q]What would you like to change the 'private_key' value in the"
@@ -161,7 +163,24 @@ def check_update_private_key_and_ca_crt(self) -> None:
161163
] = private_key_name
162164
self.openssl_config.write()
163165

166+
def check_update_ca_crt(self) -> None:
167+
"""Validate and update the OpenSSL 'certificate' value.
168+
169+
Prompts the user if the referenced files are missing or invalid and writes
170+
updates back to the OpenSSL configuration file.
171+
172+
:returns: None
173+
174+
"""
175+
ca_crt_name = self.openssl_config[self.openssl_config["ca"]["default_ca"]].get(
176+
"certificate"
177+
)
178+
ca_dir = Path(self.repo_dir / Path("certificate-authorities"))
179+
private_key_name = self.openssl_config[
180+
self.openssl_config["ca"]["default_ca"]
181+
].get("private_key")
164182
private_key_path = Path(ca_dir / Path(private_key_name))
183+
165184
prompt_for_certificate = False
166185
if not ca_crt_name:
167186
prompt_for_certificate = True
@@ -331,7 +350,8 @@ def check_update_cnf_file(self) -> None:
331350
" 'ca' section which is required."
332351
)
333352
self.check_update_start_end_date()
334-
self.check_update_private_key_and_ca_crt()
353+
self.check_update_private_key()
354+
self.check_update_ca_crt()
335355
self.check_update_unique_subject()
336356
self.check_ca_files()
337357

‎tests/files/example.cnf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ serial = $dir/serial # The current serial number
2222
crlnumber = $dir/crlnumber # the current crl number
2323
# must be commented out to leave a V1 CRL
2424
crl = $dir/crl.pem # The current CRL
25-
private_key = simple_test # The private key
25+
private_key = simple_example # The private key
2626

2727
x509_extensions = mozilla_amo_intermediate_ca # The extensions to add to the cert
2828

‎tests/setup.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -114,17 +114,17 @@ def set_up_environment(
114114
Path(repo_dir / "certs_issued").mkdir()
115115
Path(repo_dir / "certs_issued" / "test").mkdir()
116116
Path(repo_dir / "certificate-authorities").mkdir()
117-
Path(repo_dir / "certificate-authorities" / "simple_test").mkdir()
118-
Path(repo_dir / "certificate-authorities" / "simple_test" / "test").mkdir()
117+
Path(repo_dir / "certificate-authorities" / "simple_example").mkdir()
118+
Path(repo_dir / "certificate-authorities" / "simple_example" / "test").mkdir()
119119
Path(
120-
repo_dir / "certificate-authorities" / "simple_test" / "test" / "test.crt"
120+
repo_dir / "certificate-authorities" / "simple_example" / "test" / "test.crt"
121121
).touch()
122122
with Path(
123-
repo_dir / "certificate-authorities" / "simple_test" / "test" / "serial"
123+
repo_dir / "certificate-authorities" / "simple_example" / "test" / "serial"
124124
).open("w") as f:
125125
f.write("01")
126126
with Path(
127-
repo_dir / "certificate-authorities" / "simple_test" / "test" / "index.txt"
127+
repo_dir / "certificate-authorities" / "simple_example" / "test" / "index.txt"
128128
).open("w") as f:
129129
f.write(
130130
"V\t22511013200827Z\t\t01\tunknown\t/C=US/O=Mozilla Corporation/OU=Mozilla"

‎tests/test_check.py‎

Lines changed: 66 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -500,7 +500,7 @@ def test_missing_private_key_setting(tmp_path, datafiles, monkeypatch):
500500
result = runner.invoke(
501501
main,
502502
["check", "--skip-git-fetch", "--config", env["orchestrator_config_file"]],
503-
input="simple_test\n",
503+
input="simple_example\n",
504504
)
505505
re_search(r"You must set the 'private_key' value in the .* file", result.output)
506506

@@ -524,7 +524,71 @@ def test_wrong_private_key_value(tmp_path, datafiles, monkeypatch):
524524
result = runner.invoke(
525525
main,
526526
["check", "--skip-git-fetch", "--config", env["orchestrator_config_file"]],
527-
input="simple_test\n",
527+
input="simple_example\n",
528+
)
529+
re_search(
530+
r"What would you like to change the 'private_key' value in the"
531+
r" .*example.cnf to\? \[",
532+
result.output,
533+
)
534+
535+
536+
@pytest.mark.datafiles(FIXTURE_DIR / "example.csr", FIXTURE_DIR / "example.cnf")
537+
def test_using_test_private_key(tmp_path, datafiles, monkeypatch):
538+
runner = CliRunner()
539+
with runner.isolated_filesystem(tmp_path):
540+
env = set_up_environment(tmp_path, datafiles, monkeypatch)
541+
repo_dir = env["repo_dir"]
542+
Path(repo_dir / "certificate-authorities" / "simple_test").mkdir()
543+
Path(repo_dir / "certificate-authorities" / "simple_test" / "test").mkdir()
544+
Path(
545+
repo_dir / "certificate-authorities" / "simple_test" / "test" / "test.crt"
546+
).touch()
547+
with Path(
548+
repo_dir / "certificate-authorities" / "simple_test" / "test" / "serial"
549+
).open("w") as f:
550+
f.write("01")
551+
with Path(
552+
repo_dir / "certificate-authorities" / "simple_test" / "test" / "index.txt"
553+
).open("w") as f:
554+
f.write(
555+
"V\t22511013200827Z\t\t01\tunknown\t/C=US/O=Mozilla"
556+
" Corporation/OU=Mozilla AMO Production Signing Service/CN=test"
557+
)
558+
with (
559+
Path(datafiles / "example.cnf").open("r") as in_file,
560+
env["cnf_file"].open("w") as out_file,
561+
):
562+
for line in in_file:
563+
if line.startswith("private_key"):
564+
out_file.write("private_key = simple_test # The private key\n")
565+
else:
566+
out_file.write(line)
567+
result = runner.invoke(
568+
main,
569+
["check", "--skip-git-fetch", "--config", env["orchestrator_config_file"]],
570+
input="n\n",
571+
)
572+
re_search(
573+
r"The 'private_key' in the .* file is set to 'simple_test' which is a test"
574+
r" private key\. Would you like to change it to something different\?",
575+
result.output,
576+
)
577+
re_search(
578+
r"What would you like to change the 'private_key' value in the"
579+
r" .*example.cnf to\? \[",
580+
result.output,
581+
reverse=True,
582+
)
583+
result = runner.invoke(
584+
main,
585+
["check", "--skip-git-fetch", "--config", env["orchestrator_config_file"]],
586+
input="y\nsimple_example\n",
587+
)
588+
re_search(
589+
r"The 'private_key' in the .* file is set to 'simple_test' which is a test"
590+
r" private key\. Would you like to change it to something different\?",
591+
result.output,
528592
)
529593
re_search(
530594
r"What would you like to change the 'private_key' value in the"

‎tests/test_pull.py‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -192,12 +192,12 @@ def test_file_actions_table_output(tmp_path, datafiles, monkeypatch):
192192
result_lines,
193193
)
194194
re_search(
195-
r"repo[/\\]certificate-authorities[/\\]simple_test[/\\]test *:"
195+
r"repo[/\\]certificate-authorities[/\\]simple_example[/\\]test *:"
196196
r" usb[/\\]serial$",
197197
result_lines,
198198
)
199199
re_search(
200-
r"repo[/\\]certificate-authorities[/\\]simple_test[/\\]test *:"
200+
r"repo[/\\]certificate-authorities[/\\]simple_example[/\\]test *:"
201201
r" usb[/\\]index\.txt$",
202202
result_lines,
203203
)
@@ -243,7 +243,9 @@ def test_file_actions(tmp_path, datafiles, monkeypatch):
243243
).exists()
244244

245245
assert Path(env["usb_mount_point"] / "unrelated-directory").exists()
246-
ca_path = env["repo_dir"] / "certificate-authorities" / "simple_test" / "test"
246+
ca_path = (
247+
env["repo_dir"] / "certificate-authorities" / "simple_example" / "test"
248+
)
247249
assert Path(ca_path / "serial").exists()
248250
assert Path(ca_path / "index.txt").exists()
249251
cert_path = env["repo_dir"] / "certs_issued" / "test"

‎tests/test_push.py‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,9 @@ def test_selecting_usb_stick(tmp_path, datafiles, monkeypatch):
3535

3636

3737
@pytest.mark.datafiles(FIXTURE_DIR / "example.csr", FIXTURE_DIR / "example.cnf")
38-
def test_selecting_usb_stick_with_unsupported_filesystem(tmp_path, datafiles, monkeypatch):
38+
def test_selecting_usb_stick_with_unsupported_filesystem(
39+
tmp_path, datafiles, monkeypatch
40+
):
3941
runner = CliRunner()
4042
with runner.isolated_filesystem(tmp_path):
4143
env = set_up_environment(tmp_path, datafiles, create_usb_stick=False)

0 commit comments

Comments
 (0)