certificate_complete_chain: avoid infinite loops, and double roots when root certificate was already part of chain

changelogs/fragments/360-certificate_complete_chain-loop.yml

@@ -0,0 +1,3 @@
+bugfixes:
+  - "certificate_complete_chain - do not hang when infinite loop is found (https://github.com/ansible-collections/community.crypto/issues/355, https://github.com/ansible-collections/community.crypto/pull/360)."
+  - "certificate_complete_chain - do not append root twice if the chain already ends with a root certificate (https://github.com/ansible-collections/community.crypto/pull/360)."

plugins/modules/certificate_complete_chain.py

@@ -238,12 +238,14 @@ def __init__(self, module):
         self.module = module
         self.certificates = set()
         self.certificate_by_issuer = dict()
+        self.certificate_by_cert = dict()
 
     def _load_file(self, path):
         certs = load_PEM_list(self.module, path, fail_on_error=False)
         for cert in certs:
             self.certificates.add(cert)
             self.certificate_by_issuer[cert.cert.subject] = cert
+            self.certificate_by_cert[cert.cert] = cert
 
     def load(self, path):
         '''
@@ -275,6 +277,16 @@ def format_cert(cert):
     return str(cert.cert)
 
 
+def check_cycle(module, occured_certificates, next):
+    '''
+    Make sure that next is not in occured_certificates so far, and add it.
+    '''
+    next_cert = next.cert
+    if next_cert in occured_certificates:
+        module.fail_json(msg='Found cycle while building certificate chain')
+    occured_certificates.add(next_cert)
+
+
 def main():
     module = AnsibleModule(
         argument_spec=dict(
@@ -313,13 +325,19 @@ def main():
     # Try to complete chain
     current = chain[-1]
     completed = []
+    occured_certificates = set([cert.cert for cert in chain])
+    if current.cert in roots.certificate_by_cert:
+        # Don't try to complete the chain when it's already ending with a root certificate
+        current = None
     while current:
         root = roots.find_parent(current)
         if root:
+            check_cycle(module, occured_certificates, root)
             completed.append(root)
             break
         intermediate = intermediates.find_parent(current)
         if intermediate:
+            check_cycle(module, occured_certificates, intermediate)
             completed.append(intermediate)
             current = intermediate
         else:

tests/integration/targets/certificate_complete_chain/tasks/main.yml

@@ -84,4 +84,48 @@
       - cert2_rootchain_alt.chain[:-1] | join('') == lookup('file', 'cert2-altchain.pem', rstrip=False)
       - cert2_rootchain_alt.root == lookup('file', 'cert2-altroot.pem', rstrip=False)
 
+  - name: Find alternate rootchain for cert 2 when complete chain is already presented to the module
+    certificate_complete_chain:
+      input_chain: '{{ lookup("file", "cert2.pem", rstrip=False) ~ lookup("file", "cert2-altchain.pem", rstrip=False) ~ lookup("file", "cert2-altroot.pem", rstrip=True) }}'
+      root_certificates:
+      - '{{ remote_tmp_dir }}/files/roots.pem'
+    register: cert2_complete_chain
+  - debug: var=cert2_complete_chain
+  - name: Verify rootchain for cert 2
+    assert:
+      that:
+      - cert2_complete_chain.complete_chain | join('') == (lookup('file', 'cert2.pem', rstrip=False) ~ lookup('file', 'cert2-altchain.pem', rstrip=False) ~ lookup('file', 'cert2-altroot.pem', rstrip=False))
+      - cert2_complete_chain.chain == []
+      - cert2_complete_chain.root == lookup('file', 'cert2-altroot.pem', rstrip=False)
+
+  - name: Check failure when no intermediate certificate can be found
+    certificate_complete_chain:
+      input_chain: '{{ lookup("file", "cert2.pem", rstrip=True) }}'
+      intermediate_certificates:
+      - '{{ remote_tmp_dir }}/files/cert1-chain.pem'
+      root_certificates:
+      - '{{ remote_tmp_dir }}/files/roots.pem'
+    register: cert2_no_intermediate
+    ignore_errors: true
+  - name: Verify failure
+    assert:
+      that:
+      - cert2_no_intermediate is failed
+      - "cert2_no_intermediate.msg.startswith('Cannot complete chain. Stuck at certificate ')"
+
+  - name: Check failure when infinite loop is found
+    certificate_complete_chain:
+      input_chain: '{{ lookup("file", "cert2-fullchain.pem", rstrip=True) }}'
+      intermediate_certificates:
+      - '{{ remote_tmp_dir }}/files/roots.pem'
+      root_certificates:
+      - '{{ remote_tmp_dir }}/files/cert1-chain.pem'
+    register: cert2_infinite_loop
+    ignore_errors: true
+  - name: Verify failure
+    assert:
+      that:
+      - cert2_infinite_loop is failed
+      - "cert2_infinite_loop.msg == 'Found cycle while building certificate chain'"
+
   when: cryptography_version.stdout is version('1.5', '>=')