Allow to specify subject (for CSRs) and issuer (for CRLs) ordered (#316)

* Allow to specify subject (for CSRs) and issuer (for CRLs) ordered. * Forgot import. * Apply suggestions from code review Co-authored-by: Ajpantuso <ajpantuso@gmail.com> * Apply suggestions from code review Co-authored-by: Ajpantuso <ajpantuso@gmail.com> * Fix typo. * Simplify error handling, reject empty values outright. * Document d497231e1c. Co-authored-by: Ajpantuso <ajpantuso@gmail.com>
2026-05-07 05:43:06 +00:00 · 2021-10-31 15:05:04 +01:00
parent ecbd44df22
commit 589e7c72ef
11 changed files with 391 additions and 108 deletions
--- a/tests/integration/targets/openssl_csr/tasks/impl.yml
+++ b/tests/integration/targets/openssl_csr/tasks/impl.yml
@@ -29,8 +29,8 @@
  openssl_csr:
    path: '{{ remote_tmp_dir }}/csr.csr'
    privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
-    subject:
-      commonName: www.ansible.com
+    subject_ordered:
+      - commonName: www.ansible.com
    select_crypto_backend: '{{ select_crypto_backend }}'
    return_content: yes
  register: generate_csr_idempotent
@@ -517,23 +517,23 @@
  openssl_csr:
    path: '{{ remote_tmp_dir }}/csr_everything.csr'
    privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
-    subject:
-      commonName: www.example.com
-      C: de
-      L: Somewhere
-      ST: Zürich
-      streetAddress: Welcome Street N° 5
-      O: Ansiblé
-      organizationalUnitName: Crÿpto Depârtment ☺
-      serialNumber: "1234"
-      SN: Last Name Which Happens To Be A Very Løng String With A Lot Of Spaces, Jr.
-      GN: First Name
-      title: Chïeﬀ
-      pseudonym: test
-      UID: asdf
-      emailAddress: test@example.com
-      postalAddress: 1234 Somewhere
-      postalCode: "1234"
+    subject_ordered:
+      - commonName: www.example.com
+      - C: de
+      - L: Somewhere
+      - ST: Zürich
+      - streetAddress: Welcome Street N° 5
+      - O: Ansiblé
+      - organizationalUnitName: Crÿpto Depârtment ☺
+      - serialNumber: "1234"
+      - SN: Last Name Which Happens To Be A Very Løng String With A Lot Of Spaces, Jr.
+      - GN: First Name
+      - title: Chïeﬀ
+      - pseudonym: test
+      - UID: asdf
+      - emailAddress: test@example.com
+      - postalAddress: 1234 Somewhere
+      - postalCode: "1234"
    useCommonNameForSAN: no
    key_usage:
      - digitalSignature
@@ -602,23 +602,23 @@
  openssl_csr:
    path: '{{ remote_tmp_dir }}/csr_everything.csr'
    privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
-    subject:
-      CN: www.example.com
-      countryName: de
-      L: Somewhere
-      ST: Zürich
-      streetAddress: Welcome Street N° 5
-      organizationName: Ansiblé
-      organizationalUnitName: Crÿpto Depârtment ☺
-      serialNumber: "1234"
-      SN: Last Name Which Happens To Be A Very Løng String With A Lot Of Spaces, Jr.
-      GN: First Name
-      title: Chïeﬀ
-      pseudonym: test
-      UID: asdf
-      emailAddress: test@example.com
-      postalAddress: 1234 Somewhere
-      postalCode: "1234"
+    subject_ordered:
+      - CN: www.example.com
+      - countryName: de
+      - L: Somewhere
+      - ST: Zürich
+      - streetAddress: Welcome Street N° 5
+      - organizationName: Ansiblé
+      - organizationalUnitName: Crÿpto Depârtment ☺
+      - serialNumber: "1234"
+      - SN: Last Name Which Happens To Be A Very Løng String With A Lot Of Spaces, Jr.
+      - GN: First Name
+      - title: Chïeﬀ
+      - pseudonym: test
+      - UID: asdf
+      - emailAddress: test@example.com
+      - postalAddress: 1234 Somewhere
+      - postalCode: "1234"
    useCommonNameForSAN: no
    key_usage:
      - digitalSignature
@@ -689,18 +689,19 @@
    path: '{{ remote_tmp_dir }}/csr_everything.csr'
    privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
    subject:
+      # Subject has been reordered, but is inside 'subject' and not 'subject_ordered'
      CN: www.example.com
-      countryName: de
      L: Somewhere
+      countryName: de
      ST: Zürich
      streetAddress: Welcome Street N° 5
-      organizationName: Ansiblé
      organizationalUnitName: Crÿpto Depârtment ☺
+      organizationName: Ansiblé
      serialNumber: "1234"
      SN: Last Name Which Happens To Be A Very Løng String With A Lot Of Spaces, Jr.
      GN: First Name
-      title: Chïeﬀ
      pseudonym: test
+      title: Chïeﬀ
      UID: asdf
      emailAddress: test@example.com
      postalAddress: 1234 Somewhere
@@ -769,6 +770,93 @@
      - "IP:0::0:1:0:0/112"
  register: everything_3

+- name: "({{ select_crypto_backend }}) Generate CSR with everything (not idempotent, check mode)"
+  openssl_csr:
+    path: '{{ remote_tmp_dir }}/csr_everything.csr'
+    privatekey_path: '{{ remote_tmp_dir }}/privatekey.pem'
+    subject_ordered:
+      # Subject has been reordered, this should force a change
+      - CN: www.example.com
+      - L: Somewhere
+      - countryName: de
+      - ST: Zürich
+      - streetAddress: Welcome Street N° 5
+      - organizationalUnitName: Crÿpto Depârtment ☺
+      - organizationName: Ansiblé
+      - serialNumber: "1234"
+      - SN: Last Name Which Happens To Be A Very Løng String With A Lot Of Spaces, Jr.
+      - GN: First Name
+      - pseudonym: test
+      - title: Chïeﬀ
+      - UID: asdf
+      - emailAddress: test@example.com
+      - postalAddress: 1234 Somewhere
+      - postalCode: "1234"
+    useCommonNameForSAN: no
+    key_usage:
+      - digitalSignature
+      - keyAgreement
+      - Non Repudiation
+      - Key Encipherment
+      - dataEncipherment
+      - Certificate Sign
+      - cRLSign
+      - Encipher Only
+      - decipherOnly
+    key_usage_critical: yes
+    extended_key_usage: '{{ value_for_extended_key_usage }}'
+    subject_alt_name: '{{ value_for_san }}'
+    basic_constraints:
+      - "CA:TRUE"
+      - "pathlen:23"
+    basic_constraints_critical: yes
+    name_constraints_permitted: '{{ value_for_name_constraints_permitted }}'
+    name_constraints_excluded:
+      - "DNS:.org"
+      - "DNS:.example.com"
+    name_constraints_critical: yes
+    ocsp_must_staple: yes
+    subject_key_identifier: 00:11:22:33
+    authority_key_identifier: 44:55:66:77
+    authority_cert_issuer: '{{ value_for_authority_cert_issuer }}'
+    authority_cert_serial_number: 12345
+    select_crypto_backend: '{{ select_crypto_backend }}'
+  vars:
+    value_for_extended_key_usage:
+      - serverAuth  # the same as "TLS Web Server Authentication"
+      - TLS Web Server Authentication
+      - TLS Web Client Authentication
+      - Code Signing
+      - E-mail Protection
+      - timeStamping
+      - OCSPSigning
+      - Any Extended Key Usage
+      - qcStatements
+      - DVCS
+      - IPSec User
+      - biometricInfo
+      - 1.2.3.4.5.6
+    value_for_authority_cert_issuer:
+      - "DNS:ca.example.org"
+      - "IP:1.2.3.4"
+    value_for_san:
+      - "DNS:www.ansible.com"
+      - "IP:1.2.3.4"
+      - "IP:::1"
+      - "email:test@example.org"
+      - "URI:https://example.org/test/index.html"
+      - "RID:1.2.3.4"
+      - "otherName:1.2.3.4;0c:07:63:65:72:74:72:65:71"
+      - "otherName:1.3.6.1.4.1.311.20.2.3;UTF8:bob@localhost"
+      - "dirName:CN= example.net,    O  =Example Net"
+      - "dirName:/CN=  example.com/O  =Example Com"
+    value_for_name_constraints_permitted:
+      - "DNS:www.example.com"
+      - "IP:1.2.3.0/255.255.255.0"
+      - "IP:0::0:1:0:0/112"
+  register: everything_4
+  check_mode: true
+
 - name: "({{ select_crypto_backend }}) Get info from CSR with everything"
  community.crypto.openssl_csr_info:
    path: '{{ remote_tmp_dir }}/csr_everything.csr'
--- a/tests/integration/targets/openssl_csr/tests/validate.yml
+++ b/tests/integration/targets/openssl_csr/tests/validate.yml
@@ -195,6 +195,7 @@
      - everything_1 is changed
      - everything_2 is not changed
      - everything_3 is not changed
+      - everything_4 is changed
      - everything_info.basic_constraints == [
          "CA:TRUE",
          "pathlen:23",
@@ -233,6 +234,25 @@
      - everything_info.subject.title == "Chïeﬀ"
      - everything_info.subject.userId == "asdf"
      - everything_info.subject | length == 16
+      - >
+        everything_info.subject_ordered == [
+          ["commonName", "www.example.com"],
+          ["countryName", "de"],
+          ["localityName", "Somewhere"],
+          ["stateOrProvinceName", "Zürich"],
+          ["streetAddress", "Welcome Street N° 5"],
+          ["organizationName", "Ansiblé"],
+          ["organizationalUnitName", "Crÿpto Depârtment ☺"],
+          ["serialNumber", "1234"],
+          ["surname", "Last Name Which Happens To Be A Very Løng String With A Lot Of Spaces, Jr."],
+          ["givenName", "First Name"],
+          ["title", "Chïeﬀ"],
+          ["pseudonym", "test"],
+          ["userId", "asdf"],
+          ["emailAddress", "test@example.com"],
+          ["postalAddress", "1234 Somewhere"],
+          ["postalCode", "1234"],
+        ]
      - everything_info.subject_alt_name_critical == false
      - everything_info.name_constraints_excluded == [
          "DNS:.example.com",
--- a/tests/integration/targets/x509_crl/tasks/impl.yml
+++ b/tests/integration/targets/x509_crl/tasks/impl.yml
@@ -1,25 +1,4 @@
 ---
- name: Create CRL 1 (check mode)
-  x509_crl:
-    path: '{{ remote_tmp_dir }}/ca-crl1.crl'
-    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
-    last_update: 20191013000000Z
-    next_update: 20191113000000Z
-    revoked_certificates:
-      - path: '{{ remote_tmp_dir }}/cert-1.pem'
-        revocation_date: 20191013000000Z
-      - path: '{{ remote_tmp_dir }}/cert-2.pem'
-        revocation_date: 20191013000000Z
-        reason: key_compromise
-        reason_critical: yes
-        invalidity_date: 20191012000000Z
-      - serial_number: 1234
-        revocation_date: 20191001000000Z
-  check_mode: yes
-  register: crl_1_check
-
 - name: Create CRL 1 (check mode)
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl1.crl'
@@ -283,8 +262,11 @@
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
+    issuer_ordered:
+      - CN: Ansible
+      - CN: CRL
+      - countryName: US
+      - CN: Test
    last_update: +0d
    next_update: +0d
    revoked_certificates:
@@ -301,8 +283,11 @@
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
+    issuer_ordered:
+      - CN: Ansible
+      - CN: CRL
+      - countryName: US
+      - CN: Test
    last_update: +0d
    next_update: +0d
    revoked_certificates:
@@ -318,8 +303,11 @@
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
+    issuer_ordered:
+      - CN: Ansible
+      - CN: CRL
+      - C: US
+      - CN: Test
    last_update: +0d
    next_update: +0d
    revoked_certificates:
@@ -337,8 +325,11 @@
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
+    issuer_ordered:
+      - CN: Ansible
+      - CN: CRL
+      - countryName: US
+      - CN: Test
    last_update: +0d
    next_update: +0d
    revoked_certificates:
@@ -355,8 +346,11 @@
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
+    issuer_ordered:
+      - CN: Ansible
+      - CN: CRL
+      - countryName: US
+      - CN: Test
    last_update: +0d
    next_update: +0d
    revoked_certificates:
@@ -370,8 +364,11 @@
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
+    issuer_ordered:
+      - CN: Ansible
+      - CN: CRL
+      - countryName: US
+      - CN: Test
    last_update: +0d
    next_update: +0d
    revoked_certificates:
@@ -384,8 +381,11 @@
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
+    issuer_ordered:
+      - CN: Ansible
+      - CN: CRL
+      - countryName: US
+      - CN: Test
    last_update: +0d
    next_update: +0d
    revoked_certificates:
@@ -402,8 +402,11 @@
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
+    issuer_ordered:
+      - CN: Ansible
+      - CN: CRL
+      - countryName: US
+      - CN: Test
    last_update: +0d
    next_update: +0d
    revoked_certificates:
@@ -419,8 +422,11 @@
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
+    issuer_ordered:
+      - CN: Ansible
+      - CN: CRL
+      - countryName: US
+      - CN: Test
    last_update: +0d
    next_update: +0d
    revoked_certificates:
@@ -437,8 +443,11 @@
  x509_crl:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
-    issuer:
-      CN: Ansible
+    issuer_ordered:
+      - CN: Ansible
+      - CN: CRL
+      - countryName: US
+      - CN: Test
    last_update: +0d
    next_update: +0d
    revoked_certificates:
@@ -451,8 +460,67 @@
    return_content: yes
  register: crl_2_change

+- name: Read ca-crl2.crl
+  slurp:
+    src: '{{ remote_tmp_dir }}/ca-crl2.crl'
+  register: slurp_crl2_1
+
 - name: Retrieve CRL 2 infos
  x509_crl_info:
    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
    list_revoked_certificates: false
  register: crl_2_info_1
+
+- name: Create CRL 2 (changed order, should be ignored)
+  x509_crl:
+    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
+    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
+    issuer:
+      countryName: US
+      CN:
+        - Ansible
+        - CRL
+        - Test
+    last_update: +0d
+    next_update: +0d
+    revoked_certificates:
+      - path: '{{ remote_tmp_dir }}/cert-2.pem'
+        reason: key_compromise
+        reason_critical: yes
+        invalidity_date: 20191012000000Z
+    ignore_timestamps: true
+    mode: update
+    return_content: yes
+  register: crl_2_change_order_ignore
+
+- name: Create CRL 2 (changed order)
+  x509_crl:
+    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
+    privatekey_path: '{{ remote_tmp_dir }}/ca.key'
+    issuer_ordered:
+      - CN: Ansible
+      - countryName: US
+      - CN: CRL
+      - CN: Test
+    last_update: +0d
+    next_update: +0d
+    revoked_certificates:
+      - path: '{{ remote_tmp_dir }}/cert-2.pem'
+        reason: key_compromise
+        reason_critical: yes
+        invalidity_date: 20191012000000Z
+    ignore_timestamps: true
+    mode: update
+    return_content: yes
+  register: crl_2_change_order
+
+- name: Read ca-crl2.crl
+  slurp:
+    src: '{{ remote_tmp_dir }}/ca-crl2.crl'
+  register: slurp_crl2_2
+
+- name: Retrieve CRL 2 infos again
+  x509_crl_info:
+    path: '{{ remote_tmp_dir }}/ca-crl2.crl'
+    list_revoked_certificates: false
+  register: crl_2_info_2
--- a/tests/integration/targets/x509_crl/tests/validate.yml
+++ b/tests/integration/targets/x509_crl/tests/validate.yml
@@ -66,11 +66,6 @@
    that:
      - crl_1_format_idem.crl | b64decode == content.content | b64decode

- name: Read ca-crl2.crl
-  slurp:
-    src: '{{ remote_tmp_dir }}/ca-crl2.crl'
-  register: slurp
-
 - name: Validate CRL 2
  assert:
    that:
@@ -84,9 +79,26 @@
      - crl_2_idem_update is not changed
      - crl_2_change_check is changed
      - crl_2_change is changed
-      - crl_2_change.crl == (slurp.content | b64decode)
+      - crl_2_change.crl == (slurp_crl2_1.content | b64decode)
+      - crl_2_change_order_ignore is not changed
+      - crl_2_change_order is changed
+      - crl_2_change_order.crl == (slurp_crl2_2.content | b64decode)

 - name: Validate CRL 2 info
  assert:
    that:
      - "'revoked_certificates' not in crl_2_info_1"
+      - >
+        crl_2_info_1.issuer_ordered == [
+          ['commonName', 'Ansible'],
+          ['commonName', 'CRL'],
+          ['countryName', 'US'],
+          ['commonName', 'Test'],
+        ]
+      - >
+        crl_2_info_2.issuer_ordered == [
+          ['commonName', 'Ansible'],
+          ['countryName', 'US'],
+          ['commonName', 'CRL'],
+          ['commonName', 'Test'],
+        ]