cmueller/ansible
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

acme_certificate: only return challenges that need to be satisfied (#61191)

Browse source 
* Only return challenges that need to be satisfied.

* Adjust PR #.
This commit is contained in:
Felix Fontein 2019-08-23 05:10:53 +02:00 committed by ansibot
parent 2eff25aef8
commit 72365b01e0
2 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
changelogs/fragments/61191-acme_certificate-fix-challenges.yaml Normal file
View file

@ -0,0 +1,2 @@
bugfixes:
- "acme_certificate - Only return challenges in ``challenge_data`` and ``challenge_data_dns`` which are not yet valid."

15
lib/ansible/modules/crypto/acme/acme_certificate.py
View file

@ -316,7 +316,9 @@ cert_days:
returned: success returned: success
type: int type: int
challenge_data: challenge_data:
description: Per identifier / challenge type challenge data. description:
- Per identifier / challenge type challenge data.
- Since Ansible 2.8.5, only challenges which are not yet valid are returned.
returned: changed returned: changed
type: complex type: complex
contains: contains:
@ -353,7 +355,9 @@ challenge_data:
sample: _acme-challenge.example.com sample: _acme-challenge.example.com
version_added: "2.5" version_added: "2.5"
challenge_data_dns: challenge_data_dns:
description: List of TXT values per DNS record, in case challenge is C(dns-01). description:
- List of TXT values per DNS record, in case challenge is C(dns-01).
- Since Ansible 2.8.5, only challenges which are not yet valid are returned.
returned: changed returned: changed
type: dict type: dict
version_added: "2.5" version_added: "2.5"
@ -839,8 +843,13 @@ class ACMEClient(object):
data = {} data = {}
for type_identifier, auth in self.authorizations.items(): for type_identifier, auth in self.authorizations.items():
identifier_type, identifier = type_identifier.split(':', 1) identifier_type, identifier = type_identifier.split(':', 1)
auth = self.authorizations[type_identifier]
# Skip valid authentications: their challenges are already valid
# and do not need to be returned
if auth['status'] == 'valid':
continue
# We drop the type from the key to preserve backwards compatibility # We drop the type from the key to preserve backwards compatibility
data[identifier] = self._get_challenge_data(self.authorizations[type_identifier], identifier_type, identifier) data[identifier] = self._get_challenge_data(auth, identifier_type, identifier)
# Get DNS challenge data # Get DNS challenge data
data_dns = {} data_dns = {}
if self.challenge == 'dns-01': if self.challenge == 'dns-01':