---
# Copyright (c) Ansible Project
# GNU General Public License v3.0+ (see LICENSES/GPL-3.0-or-later.txt or https://www.gnu.org/licenses/gpl-3.0.txt)
# SPDX-License-Identifier: GPL-3.0-or-later

- name: '({{ select_crypto_backend }}) Validate PKCS#12'
  command: "{{ openssl_binary }} pkcs12 -info -in {{ remote_tmp_dir }}/ansible.p12 -nodes -passin pass:''"
  register: p12

- name: '({{ select_crypto_backend }}) Validate PKCS#12 with no private key'
  command: "{{ openssl_binary }} pkcs12 -info -in {{ remote_tmp_dir }}/ansible_no_pkey.p12 -nodes -passin pass:''"
  register: p12_validate_no_pkey

- name: '({{ select_crypto_backend }}) Validate PKCS#12 with multiple certs'
  shell: "{{ openssl_binary }} pkcs12 -info -in {{ remote_tmp_dir }}/ansible_multi_certs.p12 -nodes -passin pass:'hunter3' | grep subject"
  register: p12_validate_multi_certs

- name: '({{ select_crypto_backend }}) Validate PKCS#12 (assert)'
  assert:
    that:
      - p12_standard_check is changed
      - p12_standard is changed
      - p12.stdout_lines[2].split(':')[-1].strip() == 'abracadabra' or
        p12.stdout_lines[1].split(':')[-1].strip() == 'abracadabra'
      - p12_standard.mode == '0400'
      - p12_no_pkey is changed
      - p12_validate_no_pkey.stdout_lines[-1] == '-----END CERTIFICATE-----'
      - p12_force is changed
      - p12_force_and_mode.mode == '0644' and p12_force_and_mode.changed
      - p12_dumped is changed
      - p12_standard_idempotency is not changed
      - p12_standard_idempotency_check is not changed
      - p12_standard_idempotency_no_certs is not changed
      - p12_standard_idempotency_2 is not changed
      - p12_multiple_certs_idempotency is not changed
      - p12_dumped_idempotency is not changed
      - p12_dumped_check_mode is not changed
      - "'www1.' in p12_validate_multi_certs.stdout"
      - "'www2.' in p12_validate_multi_certs.stdout"
      - "'www3.' in p12_validate_multi_certs.stdout"

- name: '({{ select_crypto_backend }}) Check passphrase on private key'
  assert:
    that:
      - passphrase_error_1 is failed
      - "'assphrase' in passphrase_error_1.msg or 'assword' in passphrase_error_1.msg"
      - passphrase_error_2 is failed
      - "'assphrase' in passphrase_error_2.msg or 'assword' in passphrase_error_2.msg or 'serializ' in passphrase_error_2.msg"
      - passphrase_error_3 is failed
      - "'assphrase' in passphrase_error_3.msg or 'assword' in passphrase_error_3.msg or 'serializ' in passphrase_error_3.msg"

- name: '({{ select_crypto_backend }}) Verify that broken PKCS#12 will be regenerated'
  assert:
    that:
      - output_broken is changed

- name: '({{ select_crypto_backend }}) Check backup'
  assert:
    that:
      - p12_backup_1 is changed
      - p12_backup_1.backup_file is undefined
      - p12_backup_2 is not changed
      - p12_backup_2.backup_file is undefined
      - p12_backup_3 is changed
      - p12_backup_3.backup_file is string
      - p12_backup_4 is changed
      - p12_backup_4.backup_file is string
      - p12_backup_5 is not changed
      - p12_backup_5.backup_file is undefined
      - p12_backup_4.pkcs12 is none

- name: '({{ select_crypto_backend }}) Read files'
  slurp:
    src: '{{ item }}'
  loop:
    - "{{ remote_tmp_dir ~ '/ansible_empty.pem' }}"
    - "{{ remote_tmp_dir ~ '/ansible2.crt' }}"
    - "{{ remote_tmp_dir ~ '/ansible3.crt' }}"
  register: slurp

- name: '({{ select_crypto_backend }}) Load "empty" file'
  set_fact:
    empty_contents: "{{ slurp.results[0].content | b64decode }}"
    empty_expected_pyopenssl: "{{ (slurp.results[2].content | b64decode) ~ (slurp.results[1].content | b64decode) }}"
    empty_expected_cryptography: "{{ (slurp.results[1].content | b64decode) ~ (slurp.results[2].content | b64decode) }}"

- name: '({{ select_crypto_backend }}) Check "empty" file'
  assert:
    that:
      - p12_empty is changed
      - p12_empty_idem is not changed
      - p12_empty_concat_idem is not changed
      - p12_empty_concat_content_idem is not changed
      - (empty_contents == empty_expected_cryptography) or (empty_contents == empty_expected_pyopenssl and select_crypto_backend == 'pyopenssl')

- name: '({{ select_crypto_backend }}) PKCS#12 with compatibility2022 settings'
  when:
    - select_crypto_backend == 'cryptography'
    - cryptography_version.stdout is version('38.0.0', '>=')
  block:
    - name: '({{ select_crypto_backend }}) Validate PKCS#12 with compatibility2022 settings'
      shell: "{{ openssl_binary }} pkcs12 -info -in {{ remote_tmp_dir }}/ansible_compatibility2022.p12 -nodes -passin pass:'magicpassword'"
      register: p12_validate_compatibility2022

    - name: '({{ select_crypto_backend }}) Check PKCS#12 with compatibility2022 settings'
      assert:
        that:
          - p12_compatibility2022 is changed
          - >-
            'PKCS7 Encrypted data: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 3210' in p12_validate_compatibility2022.stderr_lines
          - >-
            'Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 3210' in p12_validate_compatibility2022.stderr_lines
          - >-
            'friendlyName: compat_fn' in p12_validate_compatibility2022.stdout
