Merge branch 'main' into claude/coderabbit-yaml-t8851claude/coderabbit-yaml-t8851

3 files changed, 73 insertions, 10 deletions

diff --git a/changelogs/fragments/t6818_password_filtering.yml b/changelogs/fragments/t6818_password_filtering.yml
new file mode 100644
index 00000000..d52283b9
--- /dev/null
+++ b/changelogs/fragments/t6818_password_filtering.yml
@@ -0,0 +1,2 @@
+minor_changes:
+  - plugins/modules/vyos_config.py - Added an argument to control password filtering in vyos_config. Current filtering behavior is still the default.
diff --git a/plugins/modules/vyos_config.py b/plugins/modules/vyos_config.py
index a9774638..2407ce01 100644
--- a/plugins/modules/vyos_config.py
+++ b/plugins/modules/vyos_config.py
@@ -142,6 +142,20 @@ options:
           in C(filename) within I(backup) directory.
         type: path
     type: dict
+  allow_password_change:
+    description:
+    - The C(allow_password_change) argument specifies whether any configuration lines which
+      would change a user's password should be filtered out.  By default only plaintext
+      password changes are allowed and any encrypted-password keys are filtered out. In
+      order to allow all password updates, both plaintext and encrypted, set this argument
+      to C(all).
+    type: str
+    default: plaintext
+    choices:
+    - all
+    - plaintext
+    - encrypted
+    - none
 """
 
 EXAMPLES = """
@@ -233,9 +247,7 @@ from ansible_collections.vyos.vyos.plugins.module_utils.network.vyos.vyos import
 
 DEFAULT_COMMENT = "configured by vyos_config"
 
-CONFIG_FILTERS = [
-    re.compile(r"set system login user \S+ authentication encrypted-password"),
-]
+PASSWORD_NEEDLE = re.compile(r"set system login user \S+ authentication (encrypted|plaintext)-password")
 
 
 def get_candidate(module):
@@ -294,14 +306,26 @@ def diff_config(commands, config):
     return list(updates)
 
 
-def sanitize_config(config, result):
+def sanitize_config(config, result, allow):
     result["filtered"] = list()
+
+    if allow == "all":
+        return
+
     index_to_filter = list()
-    for regex in CONFIG_FILTERS:
-        for index, line in enumerate(list(config)):
-            if regex.search(line):
-                result["filtered"].append(line)
-                index_to_filter.append(index)
+
+    for index, line in enumerate(list(config)):
+        found = PASSWORD_NEEDLE.search(line)
+
+        if found is None:
+            continue
+
+        if allow == found[1]:
+            continue
+
+        result["filtered"].append(line)
+        index_to_filter.append(index)
+
     # Delete all filtered configs
     for filter_index in sorted(index_to_filter, reverse=True):
         del config[filter_index]
@@ -328,7 +352,9 @@ def run(module, result):
         module.fail_json(msg=to_text(exc, errors="surrogate_then_replace"))
 
     commands = response.get("config_diff")
-    sanitize_config(commands, result)
+
+    allow_password_change = module.params["allow_password_change"]
+    sanitize_config(commands, result, allow=allow_password_change)
 
     result["commands"] = commands
 
@@ -368,6 +394,7 @@ def main():
         backup=dict(type="bool", default=False),
         backup_options=dict(type="dict", options=backup_spec),
         save=dict(type="bool", default=False),
+        allow_password_change=dict(default="plaintext", choices=["all", "encrypted", "plaintext", "none"])
     )
 
     mutually_exclusive = [("lines", "src")]
diff --git a/tests/integration/targets/vyos_config/tests/cli/check_config.yaml b/tests/integration/targets/vyos_config/tests/cli/check_config.yaml
index 8e2e8372..83a62197 100644
--- a/tests/integration/targets/vyos_config/tests/cli/check_config.yaml
+++ b/tests/integration/targets/vyos_config/tests/cli/check_config.yaml
@@ -49,9 +49,43 @@
       - set system login user esa authentication encrypted-password '!abc!'
       - set system login user vyos full-name 'VyOS admin'
       - set system login user vyos authentication encrypted-password 'abc'
+      - set system login user john full-name 'John'
+      - set system login user john authentication plaintext-password 'xyz'
 
 - assert:
     that:
       - result.filtered|length == 2
 
+- name: check multiple line config filter is working
+  register: result
+  vyos.vyos.vyos_config:
+    allow_password_change: none
+    lines:
+      - set system login user esa full-name 'ESA admin'
+      - set system login user esa authentication encrypted-password '!abc!'
+      - set system login user vyos full-name 'VyOS admin'
+      - set system login user vyos authentication encrypted-password 'abc'
+      - set system login user john full-name 'John'
+      - set system login user john authentication plaintext-password 'xyz'
+
+- assert:
+    that:
+      - result.filtered|length == 3
+
+- name: check multiple line config filter is working
+  register: result
+  vyos.vyos.vyos_config:
+    allow_password_change: all
+    lines:
+      - set system login user esa full-name 'ESA admin'
+      - set system login user esa authentication encrypted-password '!abc!'
+      - set system login user vyos full-name 'VyOS admin'
+      - set system login user vyos authentication encrypted-password 'abc'
+      - set system login user john full-name 'John'
+      - set system login user john authentication plaintext-password 'xyz'
+
+- assert:
+    that:
+      - result.filtered|length == 0
+
 - debug: msg="END cli/config_check.yaml on connection={{ ansible_connection }}"