Repository: ansible/ansible-modules-extras

Issue:
Add abilit for known_hosts module to manage multiple keys per host
##### Issue Type:

Bug Report
##### Ansible Version:

ansible 1.9.2
  configured module search path = None
##### Ansible Configuration:

Default
##### Environment:

N/A
##### Summary:

The known_hosts module seems to replace the file instead of editing it.
##### Steps To Reproduce:

```
- name: tell the host about our servers it might want to ssh to
  known_hosts:
    host='example.com'
    path='/etc/ssh/ssh_known_hosts'
    key="{{ item }}"
  with_items:
    - "example.com ssh-rsa AAAAAxxxxxxxx"
    - "example.com ssh-ed25519 AAAAAyyyyyyyy"
```
##### Expected Results:

The known_host file should have both keys added in.
##### Actual Results:

The known_hosts file only has the last key added in, the first one has been overwritten.



Discussion:
the file gets copied, the copy gets edited and put back into place, with_ happens serially so the 2nd instance should copy the file with the first instance already there. 

The only thing i can think of is the OS returning that the copy was successful before it actually was and creating a race condition that the 2nd item in loop is hitting.

The current code of the known_hosts module manages a single key per host.  In your example you are trying to register two keys for the host.  So known_hosts ends up removing the first newly added key and replacing it with the second.

If someone has time, they could add an `exclusive` parameter similar to what authorized_keys has: http://docs.ansible.com/authorized_key_module.html to allow multiple keys.

hosts are allowed to have a key per type, so unique on host is incorrect


Resolving patch:
diff --git a/system/known_hosts.py b/system/known_hosts.py
--- a/system/known_hosts.py
+++ b/system/known_hosts.py
@@ -23,7 +23,7 @@
 module: known_hosts
 short_description: Add or remove a host from the C(known_hosts) file
 description:
-   - The M(known_hosts) module lets you add or remove a host from the C(known_hosts) file. 
+   - The M(known_hosts) module lets you add or remove a host keys from the C(known_hosts) file. Multiple entries per host are allowed, but only one for each key type supported by ssh.
      This is useful if you're going to want to use the M(git) module over ssh, for example. 
      If you have a very large number of host keys to manage, you will find the M(template) module more useful.
 version_added: "1.9"
@@ -36,7 +36,7 @@
     default: null
   key:
     description:
-      - The SSH public host key, as a string (required if state=present, optional when state=absent, in which case all keys for the host are removed)
+      - The SSH public host key, as a string (required if state=present, optional when state=absent, in which case all keys for the host are removed). The key must be in the right format for ssh (see ssh(1), section "SSH_KNOWN_HOSTS FILE FORMAT")
     required: false
     default: null
   path:
@@ -46,7 +46,7 @@
     default: "(homedir)+/.ssh/known_hosts"
   state:
     description:
-      - I(present) to add the host, I(absent) to remove it.
+      - I(present) to add the host key, I(absent) to remove it.
     choices: [ "present", "absent" ]
     required: no
     default: present
@@ -76,6 +76,7 @@
 import os.path
 import tempfile
 import errno
+import re
 
 def enforce_state(module, params):
     """
@@ -101,24 +102,24 @@ def enforce_state(module, params):
 
     sanity_check(module,host,key,sshkeygen)
 
-    current,replace=search_for_host_key(module,host,key,path,sshkeygen)
+    found,replace_or_add,found_line=search_for_host_key(module,host,key,path,sshkeygen)
 
-    #We will change state if current==True & state!="present"
-    #or current==False & state=="present"
-    #i.e (current) XOR (state=="present")
+    #We will change state if found==True & state!="present"
+    #or found==False & state=="present"
+    #i.e found XOR (state=="present")
     #Alternatively, if replace is true (i.e. key present, and we must change it)
     if module.check_mode:
-        module.exit_json(changed = replace or ((state=="present") != current))
+        module.exit_json(changed = replace_or_add or (state=="present") != found)
 
     #Now do the work.
 
-    #First, remove an extant entry if required
-    if replace==True or (current==True and state=="absent"):
-        module.run_command([sshkeygen,'-R',host,'-f',path],
-                           check_rc=True)
+    #Only remove whole host if found and no key provided
+    if found and key is None and state=="absent":
+        module.run_command([sshkeygen,'-R',host,'-f',path], check_rc=True)
         params['changed'] = True
+
     #Next, add a new (or replacing) entry
-    if replace==True or (current==False and state=="present"):
+    if replace_or_add or found != (state=="present"):
         try:
             inf=open(path,"r")
         except IOError, e:
@@ -130,10 +131,13 @@ def enforce_state(module, params):
         try:
             outf=tempfile.NamedTemporaryFile(dir=os.path.dirname(path))
             if inf is not None:
-                for line in inf:
+                for line_number, line in enumerate(inf, start=1):
+                    if found_line==line_number and (replace_or_add or state=='absent'):
+                        continue # skip this line to replace its key
                     outf.write(line)
                 inf.close()
-            outf.write(key)
+            if state == 'present':
+                outf.write(key)
             outf.flush()
             module.atomic_move(outf.name,path)
         except (IOError,OSError),e:
@@ -185,54 +189,76 @@ def sanity_check(module,host,key,sshkeygen):
         module.fail_json(msg="Host parameter does not match hashed host field in supplied key")
 
 def search_for_host_key(module,host,key,path,sshkeygen):
-    '''search_for_host_key(module,host,key,path,sshkeygen) -> (current,replace)
+    '''search_for_host_key(module,host,key,path,sshkeygen) -> (found,replace_or_add,found_line)
 
-    Looks up host in the known_hosts file path; if it's there, looks to see
+    Looks up host and keytype in the known_hosts file path; if it's there, looks to see
     if one of those entries matches key. Returns:
-    current (Boolean): is host found in path?
-    replace (Boolean): is the key in path different to that supplied by user?
-    if current=False, then replace is always False.
+    found (Boolean): is host found in path?
+    replace_or_add (Boolean): is the key in path different to that supplied by user?
+    found_line (int or None): the line where a key of the same type was found
+    if found=False, then replace is always False.
     sshkeygen is the path to ssh-keygen, found earlier with get_bin_path
     '''
-    replace=False
     if os.path.exists(path)==False:
-        return False, False
+        return False, False, None
     #openssh >=6.4 has changed ssh-keygen behaviour such that it returns
     #1 if no host is found, whereas previously it returned 0
     rc,stdout,stderr=module.run_command([sshkeygen,'-F',host,'-f',path],
                                  check_rc=False)
     if stdout=='' and stderr=='' and (rc==0 or rc==1):
-        return False, False #host not found, no other errors
+        return False, False, None #host not found, no other errors
     if rc!=0: #something went wrong
         module.fail_json(msg="ssh-keygen failed (rc=%d,stdout='%s',stderr='%s')" % (rc,stdout,stderr))
 
-#If user supplied no key, we don't want to try and replace anything with it
+    #If user supplied no key, we don't want to try and replace anything with it
     if key is None:
-        return True, False
+        return True, False, None
 
     lines=stdout.split('\n')
-    k=key.strip() #trim trailing newline
-    #ssh-keygen returns only the host we ask about in the host field,
-    #even if the key entry has multiple hosts. Emulate this behaviour here,
-    #otherwise we get false negatives.
-    #Only necessary for unhashed entries.
-    if k[0] !='|':
-        k=k.split()
-        #The optional "marker" field, used for @cert-authority or @revoked
-        if k[0][0] == '@':
-            k[1]=host
-        else:
-            k[0]=host
-        k=' '.join(k)
+    new_key = normalize_known_hosts_key(key, host)
+
     for l in lines:
-        if l=='': 
-            continue
-        if l[0]=='#': #comment
+        if l=='':
             continue
-        if k==l: #found a match
-            return True, False #current, not-replace
-    #No match found, return current and replace
-    return True, True
+        elif l[0]=='#': # info output from ssh-keygen; contains the line number where key was found
+            try:
+                # This output format has been hardcoded in ssh-keygen since at least OpenSSH 4.0
+                # It always outputs the non-localized comment before the found key
+                found_line = int(re.search(r'found: line (\d+)', l).group(1))
+            except IndexError, e:
+                module.fail_json(msg="failed to parse output of ssh-keygen for line number: '%s'" % l)
+        else:
+            found_key = normalize_known_hosts_key(l,host)
+            if new_key==found_key: #found a match
+                return True, False, found_line  #found exactly the same key, don't replace
+            elif new_key['type'] == found_key['type']: # found a different key for the same key type
+                return True, True, found_line
+    #No match found, return found and replace, but no line
+    return True, True, None
+
+def normalize_known_hosts_key(key, host):
+    '''
+    Transform a key, either taken from a known_host file or provided by the
+    user, into a normalized form.
+    The host part (which might include multiple hostnames or be hashed) gets
+    replaced by the provided host. Also, any spurious information gets removed
+    from the end (like the username@host tag usually present in hostkeys, but
+    absent in known_hosts files)
+    '''
+    k=key.strip() #trim trailing newline
+    k=key.split()
+    d = dict()
+    #The optional "marker" field, used for @cert-authority or @revoked
+    if k[0][0] == '@':
+        d['options'] = k[0]
+        d['host']=host
+        d['type']=k[2]
+        d['key']=k[3]
+    else:
+        d['host']=host
+        d['type']=k[1]
+        d['key']=k[2]
+    return d
 
 def main():
 


Test patch: