`manage.safe_accept` has several significant bugs
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 15.7k
- Forks
- 5.6k
- Avg merge
- 2d 44m
- Merged PRs (30d)
- 80
Description
Description of Issue
(1) Failure to pass __opts__ to the ssh client
Overrides passed on the command line are ignored.
(2) Hard-coded assumption about len(16) fingerprints
Most fingerprints appear to be len(32) in recent salt releases.
(3) Fingerprints returned from key.finger are actually located at ret[minion_id]['return']
(4) Attempt to delete from a dictionary while iterating over it
(5) Implicit assumption that the minion names in the roster are meaningful
This is a bad assumption in bootstrapping scenarios where all the caller has is an IP address and, thus, the roster can't "know" the minion name in advance of ssh-ing in.
(6) Failure to pass __opts__ when adding the keys
(7) Failure to check that the current master key matches the master key cached by the minions, if any
Might as well catch a possible minion-side authentication failure while we're at it.
Setup
Steps to Reproduce Issue
salt-run -c <some_other_config> manage.safe_accept <some_minion>
Versions Report
Salt: 2019.2.1
Dependency Versions:
cffi: Not Installed
cherrypy: Not Installed
dateutil: 2.8.0
docker-py: Not Installed
gitdb: Not Installed
gitpython: Not Installed
ioflo: Not Installed
Jinja2: 2.10.1
libgit2: Not Installed
libnacl: Not Installed
M2Crypto: Not Installed
Mako: Not Installed
msgpack-pure: Not Installed
msgpack-python: 0.6.2
mysql-python: Not Installed
pycparser: Not Installed
pycrypto: 2.6.1
pycryptodome: Not Installed
pygit2: Not Installed
Python: 3.6.8 (default, Aug 20 2019, 17:12:48)
python-gnupg: Not Installed
PyYAML: 3.13
PyZMQ: 18.1.0
RAET: Not Installed
smmap: Not Installed
timelib: Not Installed
Tornado: 4.5.3
ZMQ: 4.3.2
System Versions:
dist: Ubuntu 18.04 bionic
locale: UTF-8
machine: x86_64
release: 4.15.0-64-generic
system: Linux
version: Ubuntu 18.04 bionic
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading salt/runners/manage.py around the linked lines 34 and 565-588, then reproduce the behavior with salt-run -c <some_other_config> manage.safe_accept <some_minion>. Done means the command handles the listed option propagation, fingerprint structure and length, roster naming, dictionary iteration, key addition, and master-key checks correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100