Initial commit

tests/integration/targets/openssl_dhparam/aliases

@@ -0,0 +1,3 @@
+shippable/posix/group1
+destructive
+skip/aix

tests/integration/targets/openssl_dhparam/meta/main.yml

@@ -0,0 +1,2 @@
+dependencies:
+  - setup_openssl

tests/integration/targets/openssl_dhparam/tasks/impl.yml

@@ -0,0 +1,101 @@
+---
+# The tests for this module generate unsafe parameters for testing purposes;
+# otherwise tests would be too slow. Use sizes of at least 2048 in production!
+- name: "[{{ select_crypto_backend }}] Generate parameter"
+  openssl_dhparam:
+    size: 768
+    path: '{{ output_dir }}/dh768.pem'
+    select_crypto_backend: "{{ select_crypto_backend }}"
+    return_content: yes
+  register: dhparam
+
+- name: "[{{ select_crypto_backend }}] Don't regenerate parameters with no change"
+  openssl_dhparam:
+    size: 768
+    path: '{{ output_dir }}/dh768.pem'
+    select_crypto_backend: "{{ select_crypto_backend }}"
+    return_content: yes
+  register: dhparam_changed
+
+- name: "[{{ select_crypto_backend }}] Generate parameters with size option"
+  openssl_dhparam:
+    path: '{{ output_dir }}/dh512.pem'
+    size: 512
+    select_crypto_backend: "{{ select_crypto_backend }}"
+
+- name: "[{{ select_crypto_backend }}] Don't regenerate parameters with size option and no change"
+  openssl_dhparam:
+    path: '{{ output_dir }}/dh512.pem'
+    size: 512
+    select_crypto_backend: "{{ select_crypto_backend }}"
+  register: dhparam_changed_512
+
+- copy:
+    src: '{{ output_dir }}/dh768.pem'
+    remote_src: yes
+    dest: '{{ output_dir }}/dh512.pem'
+
+- name: "[{{ select_crypto_backend }}] Re-generate if size is different"
+  openssl_dhparam:
+    path: '{{ output_dir }}/dh512.pem'
+    size: 512
+    select_crypto_backend: "{{ select_crypto_backend }}"
+  register: dhparam_changed_to_512
+
+- name: "[{{ select_crypto_backend }}] Force re-generate parameters with size option"
+  openssl_dhparam:
+    path: '{{ output_dir }}/dh512.pem'
+    size: 512
+    force: yes
+    select_crypto_backend: "{{ select_crypto_backend }}"
+  register: dhparam_changed_force
+
+- name: "[{{ select_crypto_backend }}] Create broken params"
+  copy:
+    dest: "{{ output_dir }}/dhbroken.pem"
+    content: "broken"
+- name: "[{{ select_crypto_backend }}] Regenerate broken params"
+  openssl_dhparam:
+    path: '{{ output_dir }}/dhbroken.pem'
+    size: 512
+    force: yes
+    select_crypto_backend: "{{ select_crypto_backend }}"
+  register: output_broken
+
+- name: "[{{ select_crypto_backend }}] Generate params"
+  openssl_dhparam:
+    path: '{{ output_dir }}/dh_backup.pem'
+    size: 512
+    backup: yes
+    select_crypto_backend: "{{ select_crypto_backend }}"
+  register: dhparam_backup_1
+- name: "[{{ select_crypto_backend }}] Generate params (idempotent)"
+  openssl_dhparam:
+    path: '{{ output_dir }}/dh_backup.pem'
+    size: 512
+    backup: yes
+    select_crypto_backend: "{{ select_crypto_backend }}"
+  register: dhparam_backup_2
+- name: "[{{ select_crypto_backend }}] Generate params (change)"
+  openssl_dhparam:
+    path: '{{ output_dir }}/dh_backup.pem'
+    size: 512
+    force: yes
+    backup: yes
+    select_crypto_backend: "{{ select_crypto_backend }}"
+  register: dhparam_backup_3
+- name: "[{{ select_crypto_backend }}] Generate params (remove)"
+  openssl_dhparam:
+    path: '{{ output_dir }}/dh_backup.pem'
+    state: absent
+    backup: yes
+    select_crypto_backend: "{{ select_crypto_backend }}"
+    return_content: yes
+  register: dhparam_backup_4
+- name: "[{{ select_crypto_backend }}] Generate params (remove, idempotent)"
+  openssl_dhparam:
+    path: '{{ output_dir }}/dh_backup.pem'
+    state: absent
+    backup: yes
+    select_crypto_backend: "{{ select_crypto_backend }}"
+  register: dhparam_backup_5

tests/integration/targets/openssl_dhparam/tasks/main.yml

@@ -0,0 +1,38 @@
+---
+# The tests for this module generate unsafe parameters for testing purposes;
+# otherwise tests would be too slow. Use sizes of at least 2048 in production!
+
+- name: Run module with backend autodetection
+  openssl_dhparam:
+    path: '{{ output_dir }}/dh_backend_selection.pem'
+    size: 512
+
+- block:
+  - name: Running tests with OpenSSL backend
+    include_tasks: impl.yml
+
+  - include_tasks: ../tests/validate.yml
+
+  vars:
+    select_crypto_backend: openssl
+  # when: openssl_version.stdout is version('1.0.0', '>=')
+
+- name: Remove output directory
+  file:
+    path: "{{ output_dir }}"
+    state: absent
+
+- name: Re-create output directory
+  file:
+    path: "{{ output_dir }}"
+    state: directory
+
+- block:
+  - name: Running tests with cryptography backend
+    include_tasks: impl.yml
+
+  - include_tasks: ../tests/validate.yml
+
+  vars:
+    select_crypto_backend: cryptography
+  when: cryptography_version.stdout is version('2.0', '>=')

tests/integration/targets/openssl_dhparam/tests/validate.yml

@@ -0,0 +1,58 @@
+---
+- name: "[{{ select_crypto_backend }}] Validate generated params"
+  shell: 'openssl dhparam -in {{ output_dir }}/{{ item }}.pem -noout -check'
+  with_items:
+    - dh768
+    - dh512
+
+- name: "[{{ select_crypto_backend }}] Get bit size of 768"
+  shell: 'openssl dhparam -noout -in {{ output_dir }}/dh768.pem -text | head -n1 | sed -ne "s@.*(\\([[:digit:]]\{1,\}\\) bit).*@\\1@p"'
+  register: bit_size_dhparam
+
+- name: "[{{ select_crypto_backend }}] Check bit size of default"
+  assert:
+    that:
+      - bit_size_dhparam.stdout == "768"
+
+- name: "[{{ select_crypto_backend }}] Get bit size of 512"
+  shell: 'openssl dhparam -noout -in {{ output_dir }}/dh512.pem -text | head -n1 | sed -ne "s@.*(\\([[:digit:]]\{1,\}\\) bit).*@\\1@p"'
+  register: bit_size_dhparam_512
+
+- name: "[{{ select_crypto_backend }}] Check bit size of default"
+  assert:
+    that:
+      - bit_size_dhparam_512.stdout == "512"
+
+- name: "[{{ select_crypto_backend }}] Check if changed works correctly"
+  assert:
+    that:
+      - dhparam_changed is not changed
+      - dhparam_changed_512 is not changed
+      - dhparam_changed_to_512 is changed
+      - dhparam_changed_force is changed
+
+- name: "[{{ select_crypto_backend }}] Make sure correct values are returned"
+  assert:
+    that:
+      - dhparam.dhparams == lookup('file', output_dir ~ '/dh768.pem', rstrip=False)
+      - dhparam.dhparams == dhparam_changed.dhparams
+
+- name: "[{{ select_crypto_backend }}] Verify that broken params will be regenerated"
+  assert:
+    that:
+      - output_broken is changed
+
+- name: "[{{ select_crypto_backend }}] Check backup"
+  assert:
+    that:
+      - dhparam_backup_1 is changed
+      - dhparam_backup_1.backup_file is undefined
+      - dhparam_backup_2 is not changed
+      - dhparam_backup_2.backup_file is undefined
+      - dhparam_backup_3 is changed
+      - dhparam_backup_3.backup_file is string
+      - dhparam_backup_4 is changed
+      - dhparam_backup_4.backup_file is string
+      - dhparam_backup_5 is not changed
+      - dhparam_backup_5.backup_file is undefined
+      - dhparam_backup_4.dhparams is none