Repository: ansible/ansible

Issue:
asa_* modules putting provider password in cleartext 
<!---
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release, and master branch are affected too.
-->

##### ISSUE TYPE
 - Bug Report

##### COMPONENT NAME
networking asa_* module
##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes below -->
```
2.4.0
```

##### CONFIGURATION
<!---
If using Ansible 2.4 or above, paste the results of "ansible-config dump --only-changed"

Otherwise, mention any settings you have changed/added/removed in ansible.cfg
(or using the ANSIBLE_* environment variables).

-->

##### OS / ENVIRONMENT
<!---
Mention the OS you are running Ansible from, and the OS you are
managing, or say "N/A" for anything that is not platform-specific.
Also mention the specific version of what you are trying to control,
e.g. if this is a network bug the version of firmware on the network device.
-->

##### SUMMARY
asa_* modules puts the provider password in clear text in /var/log/messages 

##### STEPS TO REPRODUCE
1.) Use any asa_* module and check the /var/log/messages after it ran. It puts the provider password in cleartext.
<!--- You can also paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
```
Oct 30 09:21:01 localhost ansible-asa_config: Invoked with authorize=None context=None replace=line port=None before=None auth_pass=NOT_LOGGING_PARAMETER parents=['tunnel-group 1.1.1.1 ipsec-attributes'] provider={'username': 'ec2-user', 'authorize': None, 'passwords': None, 'context': None, 'auth_pass': None, 'host': 'xx.xx.xx.xx', 'timeout': None, 'password': 'NOT_LOGGING_PARAMETER', 'port': None} save=False config=None match=line username=None passwords=None timeout=None after=None host=None password=NOT_LOGGING_PARAMETER src=None ssh_keyfile=None lines=['ikev1 pre-shared-key test']
```

##### ACTUAL RESULTS
<!--- What actually happened? If possible run with extra verbosity (-vvvv) -->
```
Oct 30 09:21:01 localhost ansible-asa_config: Invoked with authorize=None context=None replace=line port=None before=None auth_pass=NOT_LOGGING_PARAMETER parents=['tunnel-group 1.1.1.1 ipsec-attributes'] provider={'username': 'ec2-user', 'authorize': None, 'passwords': None, 'context': None, 'auth_pass': None, 'host': 'xx.xx.xx.xx', 'timeout': None, 'password': 'test', 'port': None} save=False config=None match=line username=None passwords=None timeout=None after=None host=None password=NOT_LOGGING_PARAMETER src=None ssh_keyfile=None lines=['ikev1 pre-shared-key test']
```
<!--- Paste verbatim command output between quotes below -->




Discussion:

Resolving patch:
diff --git a/lib/ansible/module_utils/asa.py b/lib/ansible/module_utils/asa.py
--- a/lib/ansible/module_utils/asa.py
+++ b/lib/ansible/module_utils/asa.py
@@ -33,7 +33,7 @@
 _DEVICE_CONFIGS = {}
 _CONNECTION = None
 
-asa_argument_spec = {
+asa_provider_spec = {
     'host': dict(),
     'port': dict(type='int'),
     'username': dict(fallback=(env_fallback, ['ANSIBLE_NET_USERNAME'])),
@@ -42,11 +42,15 @@
     'authorize': dict(fallback=(env_fallback, ['ANSIBLE_NET_AUTHORIZE']), type='bool'),
     'auth_pass': dict(fallback=(env_fallback, ['ANSIBLE_NET_AUTH_PASS']), no_log=True),
     'timeout': dict(type='int'),
-    'provider': dict(type='dict'),
     'context': dict(),
     'passwords': dict()
 }
 
+asa_argument_spec = {
+    'provider': dict(type='dict', options=asa_provider_spec),
+}
+asa_argument_spec.update(asa_provider_spec)
+
 command_spec = {
     'command': dict(key=True),
     'prompt': dict(),
@@ -59,17 +63,10 @@ def get_argspec():
 
 
 def check_args(module):
-    provider = module.params['provider'] or {}
-
     for key in asa_argument_spec:
         if key not in ['context', 'passwords', 'provider', 'authorize'] and module.params[key]:
             module.warn('argument %s has been deprecated and will be removed in a future version' % key)
 
-    if provider:
-        for param in ('auth_pass', 'password'):
-            if provider.get(param):
-                module.no_log_values.update(return_values(provider[param]))
-
 
 def get_connection(module):
     global _CONNECTION


Test patch: