saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch '3007.x' of github.com:saltstack/salt into hotfix/merge-forward-into-3007.x

Browse source
This commit is contained in:
Pedro Algarvio 2024-03-06 12:37:56 +00:00
commit 54f4150727
No known key found for this signature in database
GPG key ID: BB36BF6584A298FF
3 changed files with 16 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
salt/channel/server.py
View file

@ -56,6 +56,16 @@ class ReqServerChannel:
transport = salt.transport.request_server(opts, **kwargs) transport = salt.transport.request_server(opts, **kwargs)
return cls(opts, transport) return cls(opts, transport)
@classmethod
def compare_keys(cls, key1, key2):
"""
Normalize and compare two keys
Returns:
bool: ``True`` if the keys match, otherwise ``False``
"""
return salt.crypt.clean_key(key1) == salt.crypt.clean_key(key2)
def __init__(self, opts, transport): def __init__(self, opts, transport):
self.opts = opts self.opts = opts
self.transport = transport self.transport = transport
@ -381,7 +391,7 @@ class ReqServerChannel:
elif os.path.isfile(pubfn): elif os.path.isfile(pubfn):
# The key has been accepted, check it # The key has been accepted, check it
with salt.utils.files.fopen(pubfn, "r") as pubfn_handle: with salt.utils.files.fopen(pubfn, "r") as pubfn_handle:
if salt.crypt.clean_key(pubfn_handle.read()) != load["pub"]: if not self.compare_keys(pubfn_handle.read(), load["pub"]):
log.error( log.error(
"Authentication attempt from %s failed, the public " "Authentication attempt from %s failed, the public "
"keys did not match. This may be an attempt to compromise " "keys did not match. This may be an attempt to compromise "
@ -490,7 +500,7 @@ class ReqServerChannel:
# case. Otherwise log the fact that the minion is still # case. Otherwise log the fact that the minion is still
# pending. # pending.
with salt.utils.files.fopen(pubfn_pend, "r") as pubfn_handle: with salt.utils.files.fopen(pubfn_pend, "r") as pubfn_handle:
if salt.crypt.clean_key(pubfn_handle.read()) != load["pub"]: if not self.compare_keys(pubfn_handle.read(), load["pub"]):
log.error( log.error(
"Authentication attempt from %s failed, the public " "Authentication attempt from %s failed, the public "
"key in pending did not match. This may be an " "key in pending did not match. This may be an "
@ -546,7 +556,7 @@ class ReqServerChannel:
# so, pass on doing anything here, and let it get automatically # so, pass on doing anything here, and let it get automatically
# accepted below. # accepted below.
with salt.utils.files.fopen(pubfn_pend, "r") as pubfn_handle: with salt.utils.files.fopen(pubfn_pend, "r") as pubfn_handle:
if salt.crypt.clean_key(pubfn_handle.read()) != load["pub"]: if not self.compare_keys(pubfn_handle.read(), load["pub"]):
log.error( log.error(
"Authentication attempt from %s failed, the public " "Authentication attempt from %s failed, the public "
"keys in pending did not match. This may be an " "keys in pending did not match. This may be an "

2
tests/pytests/functional/modules/state/requisites/test_unless.py
View file

@ -6,6 +6,7 @@ pytestmark = [
] ]
@pytest.mark.timeout(120)
def test_unless_req(state): def test_unless_req(state):
ret = state.single(fun="test.succeed_with_changes", name="unless test", unless=[{}]) ret = state.single(fun="test.succeed_with_changes", name="unless test", unless=[{}])
assert ret.result is True assert ret.result is True
@ -35,6 +36,7 @@ def test_unless_req(state):
assert ret.comment == "Success!" assert ret.comment == "Success!"
@pytest.mark.timeout(120)
def test_unless_req_retcode(state): def test_unless_req_retcode(state):
ret = state.single( ret = state.single(
fun="test.succeed_with_changes", fun="test.succeed_with_changes",

2
tests/pytests/integration/modules/grains/test_append.py
View file

@ -106,7 +106,7 @@ def test_grains_append_val_is_list(salt_call_cli, append_grain):
assert ret.data == {append_grain.key: [append_grain.value, second_grain]} assert ret.data == {append_grain.key: [append_grain.value, second_grain]}
@pytest.mark.timeout_unless_on_windows(240) @pytest.mark.timeout_unless_on_windows(300)
def test_grains_remove_add( def test_grains_remove_add(
salt_call_cli, append_grain, wait_for_pillar_refresh_complete salt_call_cli, append_grain, wait_for_pillar_refresh_complete
): ):