Add openssl_privatekey_info module

[felixfontein]

SUMMARY

Adds a new module openssl_privatekey_info module, similar to openssl_certificate_info in #54709.

ISSUE TYPE

• New Module Pull Request

COMPONENT NAME

openssl_privatekey_info

[ansibot]

cc @MarkusTeufelberger @Shaps @Spredzy @Xyon @puiterwijk @resmo
click here for bot help

[ansibot]

The test ansible-test sanity --test ansible-doc --python 2.6 [explain] failed with 1 error:

lib/ansible/modules/crypto/openssl_privatekey_info.py:0:0: missing documentation (or could not parse documentation): expected string or buffer

The test ansible-test sanity --test ansible-doc --python 2.7 [explain] failed with 1 error:

lib/ansible/modules/crypto/openssl_privatekey_info.py:0:0: missing documentation (or could not parse documentation): expected string or buffer

The test ansible-test sanity --test ansible-doc --python 3.5 [explain] failed with 1 error:

lib/ansible/modules/crypto/openssl_privatekey_info.py:0:0: missing documentation (or could not parse documentation): expected string or bytes-like object

The test ansible-test sanity --test ansible-doc --python 3.6 [explain] failed with 1 error:

lib/ansible/modules/crypto/openssl_privatekey_info.py:0:0: missing documentation (or could not parse documentation): expected string or bytes-like object

The test ansible-test sanity --test ansible-doc --python 3.7 [explain] failed with 1 error:

lib/ansible/modules/crypto/openssl_privatekey_info.py:0:0: missing documentation (or could not parse documentation): expected string or bytes-like object

The test ansible-test sanity --test ansible-doc --python 3.8 [explain] failed with 1 error:

lib/ansible/modules/crypto/openssl_privatekey_info.py:0:0: missing documentation (or could not parse documentation): expected string or bytes-like object

The test ansible-test sanity --test validate-modules [explain] failed with 3 errors:

lib/ansible/modules/crypto/openssl_privatekey_info.py:0:0: E305 DOCUMENTATION.options.return_private_key_data.description.2: expected str @ data['options']['return_private_key_data']['description'][2]. Got {'WARNING': "you have to make sure that private key data isn't accidentally logged!"}
lib/ansible/modules/crypto/openssl_privatekey_info.py:304:0: E403 Type comparison using type() found. Use isinstance() instead
lib/ansible/modules/crypto/openssl_privatekey_info.py:307:0: E403 Type comparison using type() found. Use isinstance() instead

click here for bot help

[felixfontein]

I had to access OpenSSL directly for getting information on pyOpenSSL private keys (newer versions allow to get hold of a cryptography private key, which makes extracting information easier). But I think that now it works well enough, and apparently also for older OpenSSL versions (Ubuntu 16.04 and FreeBSD 11.1 have 1.0.x, OSX has 0.9.8zg).

ready_for_review

[ansibot]

@MarkusTeufelberger @Xyon @gdelpierre @japokorn @john-westcott-iv @lolcube @mgruener @thomwiggers

As a maintainer of a module in the same namespace this new module has been submitted to, your vote counts for shipits. Please review this module and add shipit if you would like to see it merged.

click here for bot help

[felixfontein]

@MarkusTeufelberger I've added that check. I found out that cryptography does not offer such checks at all (it also doesn't call the OpenSSL RSA_check_key() function), so I implemented that by directly calling the OpenSSL function. That won't work if cryptography ever supports a non-OpenSSL backend, but that will also break some other stuff (like for openssl_certificate_info). I'll probably try to get cryptography extended once all the major _info modules are done and I know what else is missing :)

[ansibot]

The test ansible-test sanity --test pylint [explain] failed with 1 error:

lib/ansible/modules/crypto/openssl_privatekey_info.py:265:47: undefined-variable Undefined variable 'text_data'

click here for bot help

[felixfontein]

ready_for_review

[MarkusTeufelberger]

Maybe these functions should go into module_utils/crypto? Seem useful for CSRs and certificates (maybe even SSH keys?) too.

[felixfontein]

You mean the ones above this? Makes sense. I've added a commit for this; I've kept _check_dsa_consistency and _is_cryptography_key_consistent, though, since they are (at the moment) private key specific, and the latter specific to cryptography. We can still move them when we actually need them in other modules as well (and do some necessary generalizations then).

[MarkusTeufelberger]

Yes, the ones that verify properties of private/public keys.

I'm not 100% sure what would happen in the selfsigned and ownca providers if used with a keypair that violates these specs, but I agreee, that can be fixed later.

[MarkusTeufelberger]

Looks great.
Let's

shipit

[felixfontein]

@thomwiggers @MarkusTeufelberger thanks for reviewing!
@mkrizek thanks for merging!