openssl_csr: handle missing basic constraint

[schallee]

SUMMARY

Fixes #179 by verifying the basic constraint exists before checking it is critical.

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

openssl_csr

ADDITIONAL INFORMATION

[felixfontein]

Thanks for the PR! I'll take a look tomorrow.

[felixfontein]

Could you please add a changelog fragment?

[schallee]

I have made the suggest modifications.

I frankly find the logic in this method confusing. Initially I rewrote the whole method but decided on a more minimal change. The logic seems to be get the fields from both objects, giving them non-matching defaults if missing and then compare the fields one at a time. I would have tested that both objects existed before doing so which would caused this bug to never happen. I also tend to check each field for equality and then return true after all checks letting the optimizer convert the return true to the result of the last comparison because it makes it far easier to modify in the future. This is mostly taste and style which is why I went with the minimal change.

Hopefully the change log fragment is sufficient. There is only one other in this repo for an example;)

[felixfontein]

I have made the suggest modifications.

Thanks!

I frankly find the logic in this method confusing. Initially I rewrote the whole method but decided on a more minimal change.

I agree, I cannot remember why the function is as it is now, and I don't think there's a reason.

The logic seems to be get the fields from both objects, giving them non-matching defaults if missing

What do you mean by "non-matching defaults"? False for CA and None for path length are consistent with cryptography_get_basic_constraints(), and are the values that make most sense for a default (not a CA, and there is no restriction on path length).

Hopefully the change log fragment is sufficient. There is only one other in this repo for an example;)

For every release, all fragments are incorporated in changelogs/changelog.yaml, so you can find more examples there: https://github.com/ansible-collections/community.crypto/blob/main/changelogs/changelog.yaml#L289

[schallee]

Oops, I meant in the general case not the specific case. Eg: class has fields field1 and field2, if object_a.field1 != object_b.field1 return false. If object_a.field2 != object.field2 return false. Finally, return true;)

[felixfontein]

@schallee thanks for fixing this!