ansible · felixfontein · Jun 24, 2019 · Jun 13, 2019 · Jun 16, 2019 · Jun 21, 2019
diff --git a/changelogs/fragments/57801-openssh_keypair-fix-make-regenerating-valid-files-possible.yml b/changelogs/fragments/57801-openssh_keypair-fix-make-regenerating-valid-files-possible.yml
@@ -0,0 +1,2 @@
+bugfixes:
+  - openssh_keypair - make regeneration of valid keypairs with the ``force`` option possible, add better handling for invalid files
diff --git a/lib/ansible/modules/crypto/openssh_keypair.py b/lib/ansible/modules/crypto/openssh_keypair.py
@@ -116,6 +116,7 @@
 '''
 
 import os
+import stat
 import errno
 
 from ansible.module_utils.basic import AnsibleModule
@@ -180,8 +181,13 @@ def generate(self, module):
                 args.extend(['-C', ""])
 
             try:
+                if os.path.exists(self.path) and not os.access(self.path, os.W_OK):
+                    os.chmod(self.path, stat.S_IWUSR + stat.S_IRUSR)
                 self.changed = True
-                module.run_command(args)
+                stdin_data = None
+                if os.path.exists(self.path):
+                    stdin_data = 'y'
+                module.run_command(args, data=stdin_data)
                 proc = module.run_command([module.get_bin_path('ssh-keygen', True), '-lf', self.path])
                 self.fingerprint = proc[1].split()
                 pubkey = module.run_command([module.get_bin_path('ssh-keygen', True), '-yf', self.path])
@@ -201,7 +207,13 @@ def _check_state():
             return os.path.exists(self.path)
 
         if _check_state():
-            proc = module.run_command([module.get_bin_path('ssh-keygen', True), '-lf', self.path])
+            proc = module.run_command([module.get_bin_path('ssh-keygen', True), '-lf', self.path], check_rc=False)
+            if not proc[0] == 0:
+                if os.path.isdir(self.path):
+                    module.fail_json(msg='%s is a directory. Please specify a path to a file.' % (self.path))
+
+                return False
+
             fingerprint = proc[1].split()
             pubkey = module.run_command([module.get_bin_path('ssh-keygen', True), '-yf', self.path])
             pubkey = pubkey[1].strip('\n')

diff --git a/test/integration/targets/openssh_keypair/tasks/main.yml b/test/integration/targets/openssh_keypair/tasks/main.yml
@@ -27,4 +27,44 @@
     path: '{{ output_dir }}/privatekey5'
   register: publickey_gen
 
+- name: Generate privatekey6
+  openssh_keypair:
+    path: '{{ output_dir }}/privatekey6'
+    type: rsa
+
+- name: Regenerate privatekey6 via force
+  openssh_keypair:
+    path: '{{ output_dir }}/privatekey6'
+    type: rsa
+    force: yes
+  register: output_regenerated_via_force
+
+- name: Create broken key
+  copy:
+    dest: '{{ item }}'
+    content: ''
+    mode: '0700'
+  loop:
+    - '{{ output_dir }}/privatekeybroken'
+    - '{{ output_dir }}/privatekeybroken.pub'
+
+- name: Regenerate broken key
+  openssh_keypair:
+    path: '{{ output_dir }}/privatekeybroken'
+    type: rsa
+  register: output_broken
+
+- name: Generate read-only private key
+  openssh_keypair:
+    path: '{{ output_dir }}/privatekeyreadonly'
+    type: rsa
+    mode: '0200'
+
+- name: Regenerate read-only private key via force
+  openssh_keypair:
+    path: '{{ output_dir }}/privatekeyreadonly'
+    type: rsa
+    force: yes
+  register: output_read_only
+
 - import_tasks: ../tests/validate.yml
diff --git a/test/integration/targets/openssh_keypair/tests/validate.yml b/test/integration/targets/openssh_keypair/tests/validate.yml
@@ -1,3 +1,4 @@
+---
 - name: Log privatekey1 return values
   debug:
     var: privatekey1_result
@@ -73,3 +74,20 @@
   assert:
     that:
       - "publickey_gen.public_key == lookup('file', output_dir ~ '/privatekey5.pub').strip('\n')"
+    <
5DD3
span class='blob-code-inner blob-code-marker ' data-code-marker="+">
+- name: Verify that privatekey6 will be regenerated via force
+  assert:
+    that:
+      - output_regenerated_via_force is changed
+
+
+- name: Verify that broken key will be regenerated
+  assert:
+    that:
+      - output_broken is changed
+
+
+- name: Verify that read-only key will be regenerated
+  assert:
+    that:
+      - output_read_only is changed
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		bugfixes:
		- openssh_keypair - make regeneration of valid keypairs with the ``force`` option possible, add better handling for invalid files