Commit Graph

11 Commits (17ed39a0095b10e7939ca0198e29efaf45143f57)

Author SHA1 Message Date
Felix Fontein caf7fd2245 openssl_*: improve passphrase handling for private keys in PyOpenSSL (#53489)
* Raise OpenSSLBadPassphraseError if passphrase is wrong.

* Improve handling of passphrase errors.

Current behavior for modules is: if passphrase is wrong (or wrongly specified), fail.
Current behavior for openssl_privatekey is: if passphrase is worng (or wrongly specified), regenerate.

* Add changelog.

* Add tests.

* Adjustments for some versions of PyOpenSSL.

* Update lib/ansible/modules/crypto/openssl_certificate.py

Improve text.

Co-Authored-By: felixfontein <felix@fontein.de>
6 years ago
Felix Fontein e1218ca10f Elliptic curve tests for crypto modules (#50109)
* Add openssl_csr ECC test.

* Add openssl_publickey ECC test.

* Add openssl_certificate ECC test.
6 years ago
Matt Clay 4e489d1be8
Update Shippable integration test groups. (#43118)
* Update Shippable integration test groups.
* Update integration test group aliases.
* Rebalance AWS and Azure tests with extra group.
* Rebalance Windows tests with another group.
6 years ago
MarkusTeufelberger 9ea1b18ff7 Allow multiple values per key in name fields in openssl_certificate/csr (#30338)
* allow multiple values per key in name fields in openssl_certificate

* check correct side of comparison

* trigger only on lists

* add subject parameter to openssl_csr

* fix key: value mapping not skipping None elements

* temporary fix for undefined "subject" field

* fix iteration over subject entries

* fix docs

* quote sample string

* allow csr with only subject defined

* fix integration test

* look up NIDs before comparing, add hidden _strict params

* deal with empty issuer/subject fields

* adapt integration tests

* also normalize output from pyopenssl

* fix issue with _sanitize_inputs

* don't convert empty lists

* workaround for pyopenssl limitations

* properly encode the input to the txt2nid function

* another to_bytes fix

* make subject, commonname and subjecAltName completely optional

* don't compare hashes of keys in openssl_csr integration tests

* add integration test for old API in openssl_csr

* compare keys directly in certificate and publickey integration tests

* fix typo
7 years ago
Matt Martz 3a2c1541ca
Fix tests as filters syntax in recently modified integration tests (#33346) 7 years ago
Yanis Guenane a773bd7ad5 openssl_publickey: Ensure format OpenSSH is idempotent (#33264)
Currently the check() method for idempotence only assumes the public
key is under the form of a PEM file when its not always the case.

The module openssl_publickey allows one to generate OpenSSH format
publickey. This leads to idempotence not being detected.
7 years ago
Matt Martz 4fe08441be Deprecate tests used as filters (#32361)
* Warn on tests used as filters

* Update docs, add aliases for tests that fit more gramatically with test syntax

* Fix rst formatting

* Add successful filter, alias of success

* Remove renamed_deprecation, it was overkill

* Make directory alias for is_dir

* Update tests to use proper jinja test syntax

* Update additional documentation, living outside of YAML files, to reflect proper jinja test syntax

* Add conversion script, porting guide updates, and changelog updates

* Update newly added uses of tests as filters

* No underscore variable

* Convert recent tests as filter changes to win_stat

* Fix some changes related to rebasing a few integration tests

* Make tests_as_filters_warning explicitly accept the name of the test, instead of inferring the name

* Add test for tests_as_filters_warning

* Update tests as filters in newly added/modified tests

* Address recent changes to several integration tests

* Address recent changes in cs_vpc
7 years ago
Yanis Guenane 32635577a3 openssl_publickey: Do not fail on empty existing file (#33255)
Currently during the check phase, the code considers the file to be
a public key if the file exist - which is not necessarily true.

This commits aims to ensure that the file is actually a publickey else
returns false for the check.
7 years ago
Matt Clay 84295e6124 Mark destructive tests as such. 7 years ago
Yanis Guenane d4e7b045b7 Extend test coverage for openssl modules (#27548)
* openssl_privatekey: Extend test coverage

Extend the coverage of the integration test for the module
openssl_privatekey.

New tests have been added:

  * passphrase
  * idempotence
  * removal

Co-Authored-By: Pierre-Louis Bonicoli <pierre-louis.bonicoli@gmx.fr>

* openssl_publickey: Extend test coverage

Extend the coverage on the integration test for the module
openssl_publickey.

New tests have been added:

  * OpenSSH format
  * passphrase
  * idempotence
  * removal
7 years ago
Yanis Guenane 8b22c45a45 Enable integration tests for the crypto/ namespace (#26684)
Crypto namespace contains the openssl modules. It has no integration
testing as of now.

This commits aims to add integration tests for the crypto namespace.
This will make it easier to spot breaking changes in the future.

This tests currently apply to:

  * openssl_privatekey
  * openssl_publickey
  * openssl_csr
7 years ago