110 lines
4.1 KiB
YAML
110 lines
4.1 KiB
YAML
---
|
|
# Copyright (c) Ansible Project
|
|
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
####################################################################
|
|
# WARNING: These are designed specifically for Ansible tests #
|
|
# and should not be used as examples of how to write Ansible roles #
|
|
####################################################################
|
|
|
|
# Test matrix:
|
|
# * cryptography
|
|
# * DSA or ECC or ...
|
|
# * password protected private key or not
|
|
|
|
- name: Set up test combinations
|
|
set_fact:
|
|
all_tests: []
|
|
backends: []
|
|
key_types: []
|
|
key_password:
|
|
- passwd: nopasswd
|
|
- passwd: passwd
|
|
privatekey_passphrase: hunter2
|
|
privatekey_cipher: auto
|
|
|
|
- name: Add cryptography backend
|
|
set_fact:
|
|
backends: "{{ backends + [ { 'backend': 'cryptography' } ] }}"
|
|
when: cryptography_version.stdout is version('1.4', '>=')
|
|
|
|
- name: Add RSA tests
|
|
set_fact:
|
|
key_types: "{{ key_types + [ { 'type': 'RSA', 'size': default_rsa_key_size } ] }}"
|
|
when: cryptography_version.stdout is version('1.4', '>=')
|
|
|
|
- name: Add DSA + ECDSA tests
|
|
set_fact:
|
|
key_types: "{{ key_types + [ { 'type': 'DSA', 'size': 2048 }, { 'type': 'ECC', 'curve': 'secp256r1' } ] }}"
|
|
when:
|
|
- cryptography_version.stdout is version('1.5', '>=')
|
|
# FreeBSD 11 fails on secp256r1 keys
|
|
- not ansible_os_family == 'FreeBSD'
|
|
|
|
- name: Add Ed25519 + Ed448 tests
|
|
set_fact:
|
|
key_types: "{{ key_types + [ { 'type': 'Ed25519' }, { 'type': 'Ed448' } ] }}"
|
|
when:
|
|
# The module under tests works with >= 2.6, but we also need to be able to create a certificate which requires 2.8
|
|
- cryptography_version.stdout is version('2.8', '>=')
|
|
# FreeBSD doesn't have support for Ed448/25519
|
|
- not ansible_os_family == 'FreeBSD'
|
|
|
|
- name: Create all test combinations
|
|
set_fact:
|
|
# Explanation: see https://serverfault.com/a/1004124
|
|
all_tests: >-
|
|
[
|
|
{% for b in backends %}
|
|
{% for kt in key_types %}
|
|
{% for kp in key_password %}
|
|
{{ b | combine (kt) | combine(kp) }},
|
|
{% endfor %}
|
|
{% endfor %}
|
|
{% endfor %}
|
|
]
|
|
|
|
- name: Generate private keys
|
|
openssl_privatekey:
|
|
path: '{{ remote_tmp_dir }}/{{item.backend}}_privatekey_{{ item.type }}_{{ item.passwd }}.pem'
|
|
type: '{{ item.type }}'
|
|
curve: '{{ item.curve | default(omit) }}'
|
|
size: '{{ item.size | default(omit) }}'
|
|
passphrase: '{{ item.privatekey_passphrase | default(omit) }}'
|
|
cipher: '{{ item.privatekey_cipher | default(omit) }}'
|
|
select_crypto_backend: cryptography
|
|
loop: '{{ all_tests }}'
|
|
|
|
- name: Generate public keys
|
|
openssl_publickey:
|
|
path: '{{ remote_tmp_dir }}/{{item.backend}}_publickey_{{ item.type }}_{{ item.passwd }}.pem'
|
|
privatekey_path: '{{ remote_tmp_dir }}/{{item.backend}}_privatekey_{{ item.type }}_{{ item.passwd }}.pem'
|
|
privatekey_passphrase: '{{ item.privatekey_passphrase | default(omit) }}'
|
|
loop: '{{ all_tests }}'
|
|
|
|
- name: Generate CSRs
|
|
openssl_csr:
|
|
path: '{{ remote_tmp_dir }}/{{item.backend}}_{{ item.type }}_{{ item.passwd }}.csr'
|
|
privatekey_path: '{{ remote_tmp_dir }}/{{item.backend}}_privatekey_{{ item.type }}_{{ item.passwd }}.pem'
|
|
privatekey_passphrase: '{{ item.privatekey_passphrase | default(omit) }}'
|
|
loop: '{{ all_tests }}'
|
|
|
|
- name: Generate selfsigned certificates
|
|
x509_certificate:
|
|
provider: selfsigned
|
|
path: '{{ remote_tmp_dir }}/{{item.backend}}_certificate_{{ item.type }}_{{ item.passwd }}.pem'
|
|
privatekey_path: '{{ remote_tmp_dir }}/{{item.backend}}_privatekey_{{ item.type }}_{{ item.passwd }}.pem'
|
|
privatekey_passphrase: '{{ item.privatekey_passphrase | default(omit) }}'
|
|
csr_path: '{{ remote_tmp_dir }}/{{item.backend}}_{{ item.type }}_{{ item.passwd }}.csr'
|
|
loop: '{{ all_tests }}'
|
|
|
|
- name: Create statement to be signed
|
|
copy:
|
|
content: "Erst wenn der Subwoofer die Katze inhaliert, fickt der Bass richtig übel. -- W.A. Mozart"
|
|
dest: '{{ remote_tmp_dir }}/statement.txt'
|
|
|
|
- name: Loop over all variants
|
|
include_tasks: loop.yml
|
|
loop: '{{ all_tests }}'
|