mirror of
https://github.com/ansible-collections/community.crypto.git
synced 2026-03-27 05:43:22 +00:00
118 lines
4.6 KiB
Python
118 lines
4.6 KiB
Python
# Copyright (c) 2020, Felix Fontein <felix@fontein.de>
|
|
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
|
|
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
from __future__ import annotations
|
|
|
|
import base64
|
|
import typing as t
|
|
|
|
from ansible.module_utils.common.text.converters import to_bytes
|
|
|
|
from ansible_collections.community.crypto.plugins.module_utils._crypto.basic import (
|
|
OpenSSLObjectError,
|
|
)
|
|
from ansible_collections.community.crypto.plugins.module_utils._crypto.module_backends.privatekey import (
|
|
get_privatekey_argument_spec,
|
|
select_backend,
|
|
)
|
|
from ansible_collections.community.crypto.plugins.plugin_utils._action_module import (
|
|
ActionModuleBase,
|
|
)
|
|
|
|
if t.TYPE_CHECKING:
|
|
from ansible_collections.community.crypto.plugins.module_utils._argspec import ( # pragma: no cover
|
|
ArgumentSpec,
|
|
)
|
|
from ansible_collections.community.crypto.plugins.module_utils._crypto.module_backends.privatekey import ( # pragma: no cover
|
|
PrivateKeyBackend,
|
|
)
|
|
from ansible_collections.community.crypto.plugins.plugin_utils._action_module import ( # pragma: no cover
|
|
AnsibleActionModule,
|
|
)
|
|
|
|
|
|
class PrivateKeyModule:
|
|
def __init__(
|
|
self, module: AnsibleActionModule, module_backend: PrivateKeyBackend
|
|
) -> None:
|
|
self.module = module
|
|
self.module_backend = module_backend
|
|
self.check_mode = module.check_mode
|
|
self.changed = False
|
|
self.return_current_key: bool = module.params["return_current_key"]
|
|
|
|
content: str | None = module.params["content"]
|
|
content_base64: bool = module.params["content_base64"]
|
|
if content is not None:
|
|
if content_base64:
|
|
try:
|
|
data = base64.b64decode(content)
|
|
except Exception as e:
|
|
module.fail_json(msg=f"Cannot decode Base64 encoded data: {e}")
|
|
else:
|
|
data = to_bytes(content)
|
|
module_backend.set_existing(privatekey_bytes=data)
|
|
|
|
def generate(self, module: AnsibleActionModule) -> None:
|
|
"""Generate a keypair."""
|
|
|
|
if self.module_backend.needs_regeneration():
|
|
# Regenerate
|
|
self.module_backend.generate_private_key()
|
|
# Call get_private_key_data() to make sure that exceptions are raised now:
|
|
self.module_backend.get_private_key_data()
|
|
self.changed = True
|
|
elif self.module_backend.needs_conversion():
|
|
# Convert
|
|
self.module_backend.convert_private_key()
|
|
# Call get_private_key_data() to make sure that exceptions are raised now:
|
|
self.module_backend.get_private_key_data()
|
|
self.changed = True
|
|
|
|
def dump(self) -> dict[str, t.Any]:
|
|
"""Serialize the object into a dictionary."""
|
|
result = self.module_backend.dump(
|
|
include_key=self.changed or self.return_current_key
|
|
)
|
|
result["changed"] = self.changed
|
|
return result
|
|
|
|
|
|
class ActionModule(ActionModuleBase):
|
|
def setup_module(self) -> tuple[ArgumentSpec, dict[str, t.Any]]:
|
|
argument_spec = get_privatekey_argument_spec()
|
|
argument_spec.argument_spec.update(
|
|
{
|
|
"content": {"type": "str", "no_log": True},
|
|
"content_base64": {"type": "bool", "default": False},
|
|
"return_current_key": {"type": "bool", "default": False},
|
|
}
|
|
)
|
|
return argument_spec, {
|
|
"supports_check_mode": True,
|
|
}
|
|
|
|
def run_module(self, module: AnsibleActionModule) -> None:
|
|
module_backend = select_backend(module=module)
|
|
|
|
try:
|
|
private_key = PrivateKeyModule(module, module_backend)
|
|
private_key.generate(module)
|
|
result = private_key.dump()
|
|
if private_key.return_current_key:
|
|
# In case the module's input (`content`) is returned as `privatekey`:
|
|
# Since `content` is no_log=True, `privatekey`'s value will get replaced by
|
|
# VALUE_SPECIFIED_IN_NO_LOG_PARAMETER. To avoid this, we remove the value of
|
|
# `content` from module.no_log_values. Since we explicitly set
|
|
# `module.no_log = True`, this should be safe.
|
|
module.no_log = True
|
|
try:
|
|
module.no_log_values.remove(module.params["content"])
|
|
except KeyError:
|
|
pass
|
|
module.params["content"] = "ANSIBLE_NO_LOG_VALUE"
|
|
module.exit_json(**result)
|
|
except OpenSSLObjectError as exc:
|
|
module.fail_json(msg=str(exc))
|