saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Turn on sign_pub_messages by default. Make sure messages with no 'sig' are dropped with error when sign_pub_messages is True.

Browse source
This commit is contained in:
C. R. Oldham 2017-03-20 11:36:01 -06:00
parent 35ddb79f59
commit 0a0f46fb14
2 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
salt/config/__init__.py
View file

@ -883,6 +883,7 @@ DEFAULT_MINION_OPTS = {
'master_failback': False,
'master_failback_interval': 0,
'verify_master_pubkey_sign': False,
'sign_pub_messages': True,
'always_verify_signature': False,
'master_sign_key_name': 'master_sign',
'syndic_finger': '',
@ -1292,7 +1293,7 @@ DEFAULT_MASTER_OPTS = {
'tcp_keepalive_idle': 300,
'tcp_keepalive_cnt': -1,
'tcp_keepalive_intvl': -1,
'sign_pub_messages': False,
'sign_pub_messages': True,
'keysize': 2048,
'transport': 'zeromq',
'gather_job_timeout': 10,
@ -1355,6 +1356,7 @@ DEFAULT_MASTER_OPTS = {
DEFAULT_PROXY_MINION_OPTS = {
'conf_file': os.path.join(salt.syspaths.CONFIG_DIR, 'proxy'),
'log_file': os.path.join(salt.syspaths.LOGS_DIR, 'proxy'),
'sign_pub_messages': True
'add_proxymodule_to_opts': False,
'proxy_merge_grains_in_module': False,
'append_minionid_config_dirs': ['cachedir'],

5
salt/transport/mixins/auth.py
View file

@ -29,7 +29,10 @@ log = logging.getLogger(__name__)
# TODO: rename
class AESPubClientMixin(object):
def _verify_master_signature(self, payload):
if payload.get('sig') and self.opts.get('sign_pub_messages'):
if self.opts.get('sign_pub_messages'):
if not payload.get('sig', False):
raise salt.crypt.AuthenticationError('Message signing is enabled but the payload has no signature.')
# Verify that the signature is valid
master_pubkey_path = os.path.join(self.opts['pki_dir'], 'minion_master.pub')
if not salt.crypt.verify_signature(master_pubkey_path, payload['load'], payload.get('sig')):