Commit Graph

178 Commits (main)

Author SHA1 Message Date
Felix Fontein 5ffe97f874
Work around problem with cryptography being upgraded while installing pyOpenSSL (#137)
* Work around problem with cryptography being upgraded while installing pyOpenSSL.

* Avoid another instability.
2020-11-03 12:39:58 +01:00
Felix Fontein ec55161cb1
Run tests with macOS 10.15. (#112)
* Run tests with macOS 10.15.

* Update prepare_http_tests as in https://github.com/ansible/ansible/pull/71841/files.

* Also skip luks_device tests on macOS.

* Temporarily restrict to macOS/OSX nodes.

* Show full OpenSSL version.

* Show pyOpenSSL debug details.

* Make location of openssl binary configurable.

* Try to upgrade openssl on macOS when LibreSSL is found.

* Use other variable.

* Use found binary instead of default.

* Revert "Temporarily restrict to macOS/OSX nodes."

This reverts commit ea379382e5.

ci_complete

* Avoid crashing when OpenSSL.debug does not exist.

* Combine setup_openssl_cli with setup_openssl

* Split up setup_openssl in setup_openssl (openssl + cryptography) and setup_pyopenssl.

* Fix package name.

* Don't install cryptography on CentOS 6, print environment.

* Work around ansible-test limitation.
2020-11-03 08:45:32 +01:00
Felix Fontein 3c21079afa
Refactor openssl_privatekey module, move add openssl_privatekey_pipe module (#119)
* Move disk-independent parts of openssl_privatekey to module_utils and doc_fragments.

* Improve documentation.

* Add openssl_privatekey_pipe module.

* Fallback in case no fingerprints are returned.

* Prevent no_log=True for content to stop module from working correctly.

* Forgot version_added.

* Update copyright. All the interesting code is no longer in this file anyway.

* Remove file arguments.

* Add framework for action modules.

* Convert openssl_privatekey_pipe to action plugin.

* Linting.

* Bump version.

* Add return_current_key option.

* Add no_log to examples.

* Remove preparation for potential later extensibility (easy to re-add when needed).

* Fix deprecation version in docs.

* Use new ArgumentSpec object for AnsibleActionModule as well.
2020-10-28 21:52:54 +01:00
Felix Fontein 9792188b0e
Refactor openssl_csr module, add openssl_csr_pipe module (#123)
* Extract doc fragment from openssl_csr.

* Refactor openssl_csr module into backend + module.

* Add openssl_csr_pipe module.

* Add seealso references.

* ...

* Use /dev/stdin instead of -, which seems to be only supported by newer openssl versions.

* Bump version.

* DRY: use select_message_digest.

* Fix deprecation version in docs.

* Docs improvements.

* Improve argument spec handling for module backends.

* Linting.

* Fix linting problems by using kwargs.
2020-10-27 12:37:40 +01:00
Felix Fontein fd7871ae7d
Allow to run x509_certificate selfsigned provider without providing a CSR (#129)
* Allow to run x509_certificate selfsigned provider without providing a CSR.

* Add missing prefixes (unrelated).
2020-10-19 18:09:40 +02:00
Doug Stanley b32adcce78
Implement use_agent option to get signing key from ssh-agent. (#117) 2020-10-19 18:07:36 +02:00
Felix Fontein 7d0e5e814e
Return certificate fingerprints from x509_certificate_info (#121)
* Return certificate fingerprints from x509_certificate_info.

* Update plugins/modules/x509_certificate_info.py

Co-authored-by: MarkusTeufelberger <mteufelberger@mgit.at>

Co-authored-by: MarkusTeufelberger <mteufelberger@mgit.at>
2020-10-13 10:41:09 +02:00
Felix Fontein 42dd19c387
Allow to pass CSR to acme_certificate as csr_content (#115)
* Allow to pass CSR to acme_certificate as csr_content.

* Make sure contents are bytes.

* No need to write CSR to disk.

* Forgot version_added.

* Fix documentation.
2020-10-09 14:01:34 +02:00
Felix Fontein 8e10e1e590
Always show current backend during tests in `name:`. (#118)
* Always show current backend during tests.

* Remove double prefix.
2020-10-09 11:10:53 +02:00
Andrew Klychkov 010b54f0af
CI tests: add a note not to use tests as an example of writing roles (#111) 2020-09-25 09:25:48 +03:00
Felix Fontein 7cdfdc1bfb
openssl_pkcs12: do not crash when there's no certificate and/or private key in existing PKCS#12 file (#109)
* Do not crash when PKCS#12 file contains no private key and/or main certificate.

* Add changelog fragment.

* Call getters only once each, check explicitly for None.

* Add test.

* Also 'parse' correctly PKCS#12 file with no private key.
2020-09-16 09:25:24 +00:00
Felix Fontein 1b3ff44bc2
Avoid cffi 1.14.3 to be installed in CI by old pip versions (#110)
* Avoid cffi 1.14.3 to be installed in CI by old pip versions.

* Avoid too old version being installed.

* Add missing target.
2020-09-16 10:48:43 +02:00
Felix Fontein a2f36f426a
openssl_csr: catch errors on bad SANs (#106)
* Catch errors on bad SANs.

* Add changelog fragment.

* Adjust cryptography version and error message.
2020-09-08 04:24:30 +00:00
Markus Teufelberger 346c2f55ff Update openssl_signature module (#63)
* Use module_utils from collection, clean up code a bit

 * add DSA keys, because why not...

 * sign/verify was added in pyOpenSSL 0.11 apparently

 * Add signing capability detection to module_utils.crypto.basic

 * Rework feature detection of signature types.

 * Rename parameters to match other modules

 * Add initial version of integration tests

 * fix whitespace in tests

 * More whitespace fixes

 * small fixes for issues in testing

 * Organize integration tests as test matrix

 * another indentation fix to make pep8 happy

 * use openssl pkeyutl when possible, otherwise fall back to openssl dgst

 * More linter fixes

 * openssl pkeyutl -help can apparently return 1

 * ignore errors on openssl call and another try at formatting

 * Remove the OpenSSL calls in tests

 * Add collection name to deprecation notice and deprecate at version 2.0.0

 * Exclude Ed448/25519 tests on pyopenssl

 * revert the collection name in the deprecation notice (breaks 2.9)

 * limit test platforms even more

 * disable FreeBSD DSA and ECC tests

 * Add module name to README

 * rewrite and split into 2 modules instead

 * add module to README and fix whitespace issue

 * remove duplicated tests

 * address review remarks

 * resolve another comment
2020-08-18 15:18:59 +02:00
Felix Fontein 84342fce4e
openssl_csr: add support for name constraints extension (#92)
* Add support for name constraints extension to openssl_csr.

* Linting.

* Add tests.

* Fix IP address general name handling.
2020-08-18 12:23:37 +02:00
Felix Fontein d03e723fe0
acme_account: add support for External Account Binding (#100)
* acme_account: add support for External Account Binding.

* Add changelog fragment.

* Error if externalAccountRequired is set in ACME directory meta, but external account data is not provided.

* Validate that EAB key is Base64URL encoded.

* Improve documentation.

* Add padding to Base64 encoded key if necessary.

* Make account creation idempotent with ZeroSSL.
2020-08-16 18:00:26 +02:00
Felix Fontein 2f59d44f9e
acme_certificate - allow to select first certificate in chain. (#102) 2020-08-15 21:50:09 +02:00
Felix Fontein 1847b3ead7
Tests (#94)
* Fix CI test groups.

* Make files more similar.

* Run most tests in both cloud and OS-specific environments.

* Run ACME tests in both cloud and OS-specific environments.

* Use different Python version for 2.9 cloud test.

* Revert "Run ACME tests in both cloud and OS-specific environments."

This reverts commit 967bda9438.

* Revert "Run most tests in both cloud and OS-specific environments."

This reverts commit 6e9f090afd.
2020-07-27 16:43:43 +02:00
Felix Fontein 05b0bdbe0d
Support arbitrary dotted notation for OIDs in cryptography backend (#91)
* Support arbitrary dotted notation for OIDs in cryptography backend.

* Add test.

* Fix typos.

* Fix order.
2020-07-21 15:33:05 +02:00
Jordan Borean 70683e540d
Support otherName in subAltName in CSR for UTF8 strings (#53)
* Support otherName in subAltName in CSR for UTF8 strings

* Remove uneeded docs and added changelog fragment

* Missed a merge conflict

* Fix up sanity issues and added test expectation

* Rename function
2020-06-23 22:38:42 +02:00
Felix Fontein cb384443e4
cryptography backend: parse dirName, RID and otherName names (#9) 2020-06-21 22:47:48 +02:00
Felix Fontein de3c99eeac
Add support for CRLs in DER format. (#29) 2020-05-15 09:57:07 +02:00
Felix Fontein f7dbd61fa7
Rename openssl_certificate* to x509_certificate* (#7)
* Rename openssl_certificate* to x509_certificate*.

* Update README.

* Add redirects.

* Also print warnings when using Ansible 2.9.

* Adjust ignore-2.9.txt.

* Update documentation.
2020-04-06 14:34:24 +02:00
Felix Fontein 6b3ca2ca07
Ansible 2.9 tests (#14)
* Add CI group 2 for Ansible 2.9 tests.

* Temporarily disable some nodes.

* Fix ignore.txt.

* Use version prefix instead of groups.

* Ansible 2.9 doesn't support Python 3.9

ci_complete

* Make Ansible 2.9 compatible.

* Replace archive/unarchive with copy.

* Remove dependency on community.general in integration tests for Ansible 2.9.

* Let's see.

* Ansible 2.9's copy doesn't create directories.

* Re-enable no dependency.

ci_complete

* path should be bytes.

* Reenable nodes, add two more.

* Force complete CI run for Ansible 2.9.

* Used wrong variable.

* Fix Ansible 2.9 compatibility...
2020-04-01 11:35:43 +02:00
Felix Fontein 88ee99423c
Remove stray copies. (#6) 2020-03-31 16:12:49 +02:00
Felix Fontein de5b514629 Work around not yet complete package manager detection for ACD. (#5) 2020-03-29 20:02:02 +02:00
Felix Fontein e91849d1d8 Add shippable tests. (#4) 2020-03-29 20:01:53 +02:00
Ansible Core Team a9f45b4d5b Initial commit 2020-03-09 13:11:34 +00:00