openssl_csr: fix bad tests, avoid accepting invalid crl_distribution_points records

changelogs/fragments/560-openssl_csr-crl_distribution_points.yml

@@ -0,0 +1,2 @@
+bugfixes:
+  - "openssl_csr, openssl_csr_pipe - prevent invalid values for ``crl_distribution_points`` that do not have one of ``full_name``, ``relative_name``, and ``crl_issuer`` (https://github.com/ansible-collections/community.crypto/pull/560)."

plugins/module_utils/crypto/module_backends/csr.py

@@ -289,6 +289,8 @@ def parse_crl_distribution_points(module, crl_distribution_points):
             result.append(cryptography.x509.DistributionPoint(**params))
         except OpenSSLObjectError as e:
             raise OpenSSLObjectError('Error while parsing CRL distribution point #{index}: {error}'.format(index=index, error=e))
+        except ValueError as e:
+            raise OpenSSLObjectError('Error while parsing CRL distribution point #{index}: {error}'.format(index=index, error=e))
     return result
 
 
@@ -651,7 +653,8 @@ def get_csr_argument_spec():
                         'aa_compromise',
                     ]),
                 ),
-                mutually_exclusive=[('full_name', 'relative_name')]
+                mutually_exclusive=[('full_name', 'relative_name')],
+                required_one_of=[('full_name', 'relative_name', 'crl_issuer')],
             ),
             select_crypto_backend=dict(type='str', default='auto', choices=['auto', 'cryptography']),
         ),

tests/integration/targets/openssl_csr/tasks/impl.yml

@@ -950,7 +950,6 @@
               - CN=ca.example.com
             reasons:
               - certificate_hold
-          - {}
         select_crypto_backend: '{{ select_crypto_backend }}'
       register: crl_distribution_endpoints_1
 
@@ -973,7 +972,6 @@
               - CN=ca.example.com
             reasons:
               - certificate_hold
-          - {}
         select_crypto_backend: '{{ select_crypto_backend }}'
       register: crl_distribution_endpoints_2
 
@@ -984,9 +982,7 @@
         subject:
           commonName: www.ansible.com
         crl_distribution_points:
-          - full_name:
-              - "URI:https://ca.example.com/revocations.crl"
-            crl_issuer:
+          - crl_issuer:
               - "URI:https://ca.example.com/"
             reasons:
               - key_compromise