a-c-m
/
community.crypto
mirror of https://github.com/ansible-collections/community.crypto.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Emit warning when consistency cannot be checked. (#705)

pull/708/head
Felix Fontein 2024-01-27 10:39:13 +01:00 committed by GitHub
parent 87af1f2761
commit 9ec8680936
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
changelogs/fragments/705-openssl_privatekey_info-consistency.yml Normal file
View File

@ -0,0 +1,2 @@
bugfixes:
- "openssl_privatekey_info - ``check_consistency=true`` now reports a warning if it cannot determine consistency (https://github.com/ansible-collections/community.crypto/pull/705)."

6
plugins/module_utils/crypto/module_backends/privatekey_info.py
View File

@ -105,7 +105,7 @@ def _check_dsa_consistency(key_public_data, key_private_data):
return True return True
def _is_cryptography_key_consistent(key, key_public_data, key_private_data): def _is_cryptography_key_consistent(key, key_public_data, key_private_data, warn_func=None):
if isinstance(key, cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey): if isinstance(key, cryptography.hazmat.primitives.asymmetric.rsa.RSAPrivateKey):
# key._backend was removed in cryptography 42.0.0 # key._backend was removed in cryptography 42.0.0
backend = getattr(key, '_backend', None) backend = getattr(key, '_backend', None)
@ -160,6 +160,8 @@ def _is_cryptography_key_consistent(key, key_public_data, key_private_data):
except cryptography.exceptions.InvalidSignature: except cryptography.exceptions.InvalidSignature:
return False return False
# For X25519 and X448, there's no test yet. # For X25519 and X448, there's no test yet.
if warn_func is not None:
warn_func('Cannot determine consistency for key of type %s' % type(key))
return None return None
@ -256,7 +258,7 @@ class PrivateKeyInfoRetrievalCryptography(PrivateKeyInfoRetrieval):
return _get_cryptography_private_key_info(self.key, need_private_key_data=need_private_key_data) return _get_cryptography_private_key_info(self.key, need_private_key_data=need_private_key_data)
def _is_key_consistent(self, key_public_data, key_private_data): def _is_key_consistent(self, key_public_data, key_private_data):
return _is_cryptography_key_consistent(self.key, key_public_data, key_private_data) return _is_cryptography_key_consistent(self.key, key_public_data, key_private_data, warn_func=self.module.warn)
def get_privatekey_info(module, backend, content, passphrase=None, return_private_key_data=False, prefer_one_fingerprint=False): def get_privatekey_info(module, backend, content, passphrase=None, return_private_key_data=False, prefer_one_fingerprint=False):