cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity
ansible/test/integration/targets/openssl_pkcs12/tests/validate.yml

56 lines
2.1 KiB
YAML
Raw Normal View History

crypto: Add new module openssl_pkcs12 (#27320) [module] Create new module to handle PKCS#12 file.
2018-08-23 17:15:22 +02:00
- name: 'Validate PKCS#12'
command: "openssl pkcs12 -info -in {{ output_dir }}/ansible.p12 -nodes -passin pass:''"
register: p12
openssl_pkcs12: privatekey_path and friendly_name are not always required together (#54370) * Removed required_together, updated tests Since required_together: privatekey_path -> friendly_name, is not always required it has been removed. Updated openssl_pkcs12 integration tests to be in line with other openssl_* modules, and added a test for export with no privatekey_path. * linter fixes * Removed cryptography from tests * Added changelog fragment * Removed non-necessary select_crypto_backend
2019-03-26 16:06:00 +01:00
- name: 'Validate PKCS#12 with no private key'
command: "openssl pkcs12 -info -in {{ output_dir }}/ansible_no_pkey.p12 -nodes -passin pass:''"
register: p12_validate_no_pkey
openssl_pkcs12: Add idempotency checks (#54633) * Added idempotency logic to openssl_pkcs12 Also decoupled the 'parse' and 'generate' function from the file write as they are now used in different places that do not need the file to be written to disk. * Added idempotency tests for openssl_pkcs12 Also adds a new test for pkcs12 files with multiple certificates * Regenerate if parsed file is invalid * pkcs12_other_certificates check was wrong * Updated ca_certificates to other_certificates ca_certificates is left as an alias to other_certificates; friendlyname depends on private key, so it will be ignored while checking for idempotency if the pkey is not set; idempotency check only checks for correct certs in the stack * use different keys for different certs * Added other_certificates in module docs * Added changelog and porting guide * removed unrelated porting guide entry * renamed ca_cert* occurrence with other_cert
2019-04-10 12:43:08 +02:00
- name: 'Validate PKCS#12 with multiple certs'
shell: "openssl pkcs12 -info -in {{ output_dir }}/ansible_multi_certs.p12 -nodes -passin pass:'' | grep subject"
register: p12_validate_multi_certs
crypto: Add new module openssl_pkcs12 (#27320) [module] Create new module to handle PKCS#12 file.
2018-08-23 17:15:22 +02:00
- name: 'Validate PKCS#12 (assert)'
assert:
that:
- p12.stdout_lines[2].split(':')[-1].strip() == 'abracadabra'
- p12_standard.mode == '0400'
openssl_pkcs12: privatekey_path and friendly_name are not always required together (#54370) * Removed required_together, updated tests Since required_together: privatekey_path -> friendly_name, is not always required it has been removed. Updated openssl_pkcs12 integration tests to be in line with other openssl_* modules, and added a test for export with no privatekey_path. * linter fixes * Removed cryptography from tests * Added changelog fragment * Removed non-necessary select_crypto_backend
2019-03-26 16:06:00 +01:00
- p12_no_pkey.changed
- p12_validate_no_pkey.stdout_lines[-1] == '-----END CERTIFICATE-----'
crypto: Add new module openssl_pkcs12 (#27320) [module] Create new module to handle PKCS#12 file.
2018-08-23 17:15:22 +02:00
- p12_force.changed
- p12_force_and_mode.mode == '0644' and p12_force_and_mode.changed
openssl_pkcs12: Add idempotency checks (#54633) * Added idempotency logic to openssl_pkcs12 Also decoupled the 'parse' and 'generate' function from the file write as they are now used in different places that do not need the file to be written to disk. * Added idempotency tests for openssl_pkcs12 Also adds a new test for pkcs12 files with multiple certificates * Regenerate if parsed file is invalid * pkcs12_other_certificates check was wrong * Updated ca_certificates to other_certificates ca_certificates is left as an alias to other_certificates; friendlyname depends on private key, so it will be ignored while checking for idempotency if the pkey is not set; idempotency check only checks for correct certs in the stack * use different keys for different certs * Added other_certificates in module docs * Added changelog and porting guide * removed unrelated porting guide entry * renamed ca_cert* occurrence with other_cert
2019-04-10 12:43:08 +02:00
- not p12_standard_idempotency.changed
- not p12_multiple_certs_idempotency.changed
- "'www.' in p12_validate_multi_certs.stdout"
- "'www2.' in p12_validate_multi_certs.stdout"
- "'www3.' in p12_validate_multi_certs.stdout"
openssl_*: improve passphrase handling for private keys in PyOpenSSL (#53489) * Raise OpenSSLBadPassphraseError if passphrase is wrong. * Improve handling of passphrase errors. Current behavior for modules is: if passphrase is wrong (or wrongly specified), fail. Current behavior for openssl_privatekey is: if passphrase is worng (or wrongly specified), regenerate. * Add changelog. * Add tests. * Adjustments for some versions of PyOpenSSL. * Update lib/ansible/modules/crypto/openssl_certificate.py Improve text. Co-Authored-By: felixfontein <felix@fontein.de>
2019-03-08 17:21:18 +01:00
openssl_*: add backup option (#54294)
2019-03-30 15:38:43 +01:00
- name: Check passphrase on private key
openssl_*: improve passphrase handling for private keys in PyOpenSSL (#53489) * Raise OpenSSLBadPassphraseError if passphrase is wrong. * Improve handling of passphrase errors. Current behavior for modules is: if passphrase is wrong (or wrongly specified), fail. Current behavior for openssl_privatekey is: if passphrase is worng (or wrongly specified), regenerate. * Add changelog. * Add tests. * Adjustments for some versions of PyOpenSSL. * Update lib/ansible/modules/crypto/openssl_certificate.py Improve text. Co-Authored-By: felixfontein <felix@fontein.de>
2019-03-08 17:21:18 +01:00
assert:
that:
- passphrase_error_1 is failed
- "'assphrase' in passphrase_error_1.msg or 'assword' in passphrase_error_1.msg"
- passphrase_error_2 is failed
openssl_* modules: private key errors (#54088) * Improve error handling, in particular with respect to private key loading problems. * Add tests to validate that modules regenerate invalid input and don't crash. * Don't crash when input is invalid. * Create 'better' broken input. * Fix paths. * Simplifying pyOpenSSL error handling.
2019-03-30 14:28:10 +01:00
- "'assphrase' in passphrase_error_2.msg or 'assword' in passphrase_error_2.msg or 'serializ' in passphrase_error_2.msg"
openssl_*: improve passphrase handling for private keys in PyOpenSSL (#53489) * Raise OpenSSLBadPassphraseError if passphrase is wrong. * Improve handling of passphrase errors. Current behavior for modules is: if passphrase is wrong (or wrongly specified), fail. Current behavior for openssl_privatekey is: if passphrase is worng (or wrongly specified), regenerate. * Add changelog. * Add tests. * Adjustments for some versions of PyOpenSSL. * Update lib/ansible/modules/crypto/openssl_certificate.py Improve text. Co-Authored-By: felixfontein <felix@fontein.de>
2019-03-08 17:21:18 +01:00
- passphrase_error_3 is failed
openssl_* modules: private key errors (#54088) * Improve error handling, in particular with respect to private key loading problems. * Add tests to validate that modules regenerate invalid input and don't crash. * Don't crash when input is invalid. * Create 'better' broken input. * Fix paths. * Simplifying pyOpenSSL error handling.
2019-03-30 14:28:10 +01:00
- "'assphrase' in passphrase_error_3.msg or 'assword' in passphrase_error_3.msg or 'serializ' in passphrase_error_3.msg"
- name: "Verify that broken PKCS#12 will be regenerated"
assert:
that:
- output_broken is changed
openssl_*: add backup option (#54294)
2019-03-30 15:38:43 +01:00
- name: Check backup
assert:
that:
- p12_backup_1 is changed
- p12_backup_1.backup_file is undefined
- p12_backup_2 is not changed
- p12_backup_2.backup_file is undefined
- p12_backup_3 is changed
- p12_backup_3.backup_file is string
- p12_backup_4 is changed
- p12_backup_4.backup_file is string
- p12_backup_5 is not changed
- p12_backup_5.backup_file is undefined
Reference in a new issue Copy permalink