saltstack / saltstack/salt

`manage.safe_accept` has several significant bugs

Open
#54,887 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Confirmed Runners severity-high
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

Description of Issue
(1) Failure to pass __opts__ to the ssh client

Overrides passed on the command line are ignored.

https://github.com/saltstack/salt/blob/c65fcc5a9260a5d8196d79554618b748ca0623fa/salt/runners/manage.py#L565

(2) Hard-coded assumption about len(16) fingerprints

Most fingerprints appear to be len(32) in recent salt releases.

https://github.com/saltstack/salt/blob/c65fcc5a9260a5d8196d79554618b748ca0623fa/salt/runners/manage.py#L571

https://github.com/saltstack/salt/blob/c65fcc5a9260a5d8196d79554618b748ca0623fa/salt/runners/manage.py#L34

(3) Fingerprints returned from key.finger are actually located at ret[minion_id]['return']

https://github.com/saltstack/salt/blob/c65fcc5a9260a5d8196d79554618b748ca0623fa/salt/runners/manage.py#L570

(4) Attempt to delete from a dictionary while iterating over it

https://github.com/saltstack/salt/blob/c65fcc5a9260a5d8196d79554618b748ca0623fa/salt/runners/manage.py#L578

(5) Implicit assumption that the minion names in the roster are meaningful

This is a bad assumption in bootstrapping scenarios where all the caller has is an IP address and, thus, the roster can't "know" the minion name in advance of ssh-ing in.

https://github.com/saltstack/salt/blob/c65fcc5a9260a5d8196d79554618b748ca0623fa/salt/runners/manage.py#L574

(6) Failure to pass __opts__ when adding the keys

https://github.com/saltstack/salt/blob/c65fcc5a9260a5d8196d79554618b748ca0623fa/salt/runners/manage.py#L588

(7) Failure to check that the current master key matches the master key cached by the minions, if any

Might as well catch a possible minion-side authentication failure while we're at it.

Setup
Steps to Reproduce Issue

salt-run -c <some_other_config> manage.safe_accept <some_minion>

Versions Report
           Salt: 2019.2.1
 
Dependency Versions:
           cffi: Not Installed
       cherrypy: Not Installed
       dateutil: 2.8.0
      docker-py: Not Installed
          gitdb: Not Installed
      gitpython: Not Installed
          ioflo: Not Installed
         Jinja2: 2.10.1
        libgit2: Not Installed
        libnacl: Not Installed
       M2Crypto: Not Installed
           Mako: Not Installed
   msgpack-pure: Not Installed
 msgpack-python: 0.6.2
   mysql-python: Not Installed
      pycparser: Not Installed
       pycrypto: 2.6.1
   pycryptodome: Not Installed
         pygit2: Not Installed
         Python: 3.6.8 (default, Aug 20 2019, 17:12:48)
   python-gnupg: Not Installed
         PyYAML: 3.13
          PyZMQ: 18.1.0
           RAET: Not Installed
          smmap: Not Installed
        timelib: Not Installed
        Tornado: 4.5.3
            ZMQ: 4.3.2
 
System Versions:
           dist: Ubuntu 18.04 bionic
         locale: UTF-8
        machine: x86_64
        release: 4.15.0-64-generic
         system: Linux
        version: Ubuntu 18.04 bionic

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading salt/runners/manage.py around the linked lines 34 and 565-588, then reproduce the behavior with salt-run -c <some_other_config> manage.safe_accept <some_minion>. Done means the command handles the listed option propagation, fingerprint structure and length, roster naming, dictionary iteration, key addition, and master-key checks correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.