saltstack/salt
1
0
Fork 0
mirror of https://github.com/saltstack/salt.git synced 2025-04-17 10:10:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

validate minion crypto config

Browse source
This commit is contained in:
Daniel A. Wozniak 2024-05-25 15:51:16 -07:00 • committed by Daniel Wozniak
parent 277e56b113
commit 7d35efe5b9
2 changed files with 20 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
salt/config/__init__.py
View file

@ -13,6 +13,7 @@ import types
import urllib.parse
from copy import deepcopy
import salt.crypt
import salt.defaults.exitcodes
import salt.exceptions
import salt.features
@ -3855,6 +3856,17 @@ def apply_minion_config(
_update_ssl_config(opts)
_update_discovery_config(opts)
if opts["encryption_algorithm"] not in salt.crypt.VALID_ENCRYPTION_ALGORITHMS:
raise salt.exceptions.SaltConfigurationError(
f"The encryption algorithm '{opts['encryption_algorithm']}' is not valid. "
f"Please specify one of {','.join(salt.crypt.VALID_ENCRYPTION_ALGORITHMS)}."
)
if opts["signing_algorithm"] not in salt.crypt.VALID_SIGNING_ALGORITHMS:
raise salt.exceptions.SaltConfigurationError(
f"The signging algorithm '{opts['signing_algorithm']}' is not valid. "
f"Please specify one of {','.join(salt.crypt.VALID_SIGNING_ALGORITHMS)}."
)
return opts

8
salt/crypt.py
View file

@ -75,6 +75,14 @@ VALID_HASHES = (
VALID_PADDING_FOR_SIGNING = (PKCS1v15,)
VALID_PADDING_FOR_ENCRYPTION = (OAEP,)
VALID_ENCRYPTION_ALGORITHMS = (
OAEP_SHA1,
OAEP_SHA224,
)
VALID_SIGNING_ALGORITHMS = (
PKCS1v15_SHA1,
PKCS1v15_SHA224,
)
def fips_enabled():