Add x509_crl_info module

[felixfontein]

SUMMARY

Follow-up to #63435. This adds a basic x509_crl_info module, and moves some common code to module_utils/crypto.py, in particular get_relative_time_option() (which exists in slightly different versions in several modules).

ISSUE TYPE

• New Module Pull Request

COMPONENT NAME

x509_crl_info

[ansibot]

cc @MarkusTeufelberger @Shaps @Spredzy @Xyon @ctrufan @puiterwijk @resmo
click here for bot help

[felixfontein]

I'm currently wondering whether a query functionality (is this certificate revoked?) should be part of this module (similar to valid_at in openssl_certificate_info), or whether there should be an additional x509_crl_query module. Any opinions?

[felixfontein]

I created a new PR for the refactoring part: #67540

[ctrufan]

You wouldn't want a revocation check to be CRL specific, but support OCSP as well. I'd lean towards a separate certificate_revocation_info module (or put it in *certificate_info as an optional check).

[felixfontein]

@ctrufan good point! I think it's probably better to have a separate openssl_certificate_revocation_info module, since the input can also be different than for openssl_certificate_info - like only having the serial number of the certificate, something that won't work for openssl_certificate_info.

[ansibot]

@MarkusTeufelberger @Xyon @ctrufan @gdelpierre @japokorn @john-westcott-iv @lolcube @mgruener @thomwiggers @tylert

As a maintainer of a module in the same namespace this new module has been submitted to, your vote counts for shipits. Please review this module and add shipit if you would like to see it merged.

click here for bot help

[Andersson007]

Suggested change

	self.module.fail_json(msg='Error while reading CRL file from disk: {0}'.format(e))
	self.module.fail_json(msg='Error while reading CRL file from disk: {0}'.format(to_native(e)))

[Andersson007]

and in a few places below

[felixfontein]

Why is that necessary? The code works fine both in Python 2 and Python 3 (see all the other crypto modules).

[Andersson007]

it's not necessary but you use it in the module in other places:)

[felixfontein]

Ah, I didn't notice :) The module is mostly a copy'n'paste of x509_crl with many parts removed, and that one is partially copied from other openssl_* modules. I guess it's time to do a big cleanup everywhere. But that should also wait until after the move ;)

[Andersson007]

i don't know why but when i'm looking at _dump_revoked(), my brain wants to scroll it down as fast as possible:)
maybe would be better to split it somehow
not critical

[felixfontein]

I'll do more refactoring once the community.crypto collection exists and stuff is in there. It doesn't make sense to start making x509_crl_info totally different from x509_crl right now when it is much easier doing that in the collection (by adding a new module_utils). :)

[Andersson007]

sounds reasonable

[Andersson007]

shipit

[MarkusTeufelberger]

Since @Andersson007 's vote probably won't count for the bot, here's my

shipit

[felixfontein]

@ctrufan @Andersson007 @MarkusTeufelberger thanks a lot for commenting and reviewing!

I'll start cleaning this more up once this has moved to the collection repo...