valitydev/salt
14
0
Fork 0
mirror of https://github.com/valitydev/salt.git synced 2024-11-09 01:36:48 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Validate exact pillar matches for publishes master-side

Browse Source
This commit is contained in:
Colton Myers 2014-11-06 18:16:15 -07:00
parent 2d284fa1ff
commit 9d41b1fb39
3 changed files with 24 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
salt/daemons/masterapi.py
View File

@ -412,16 +412,12 @@ class RemoteFuncs(object):
for arg in load['arg']:
arg_.append(arg.split())
load['arg'] = arg_
tgt_type = load.get('tgt_type', 'glob')
if tgt_type.lower() == 'pillar':
tgt_type = 'pillar_exact'
elif tgt_type.lower() == 'compound':
tgt_type = 'compound_pillar_exact'
good = self.ckminions.auth_check(
perms,
load['fun'],
load['tgt'],
tgt_type)
load.get('tgt_type', 'glob'),
publish_validate=True)
if not good:
return False
return True

3
salt/master.py
View File

@ -854,7 +854,8 @@ class AESFuncs(object):
perms,
clear_load['fun'],
clear_load['tgt'],
clear_load.get('tgt_type', 'glob'))
clear_load.get('tgt_type', 'glob'),
publish_validate=True)
def __verify_load(self, load, verify_keys):
'''

21
salt/utils/minions.py
View File

@ -572,13 +572,32 @@ class CkMinions(object):
fun,
form)
def auth_check(self, auth_list, funs, tgt, tgt_type='glob', groups=None):
def auth_check(self,
auth_list,
funs,
tgt,
tgt_type='glob',
groups=None,
publish_validate=False):
'''
Returns a bool which defines if the requested function is authorized.
Used to evaluate the standard structure under external master
authentication interfaces, like eauth, peer, peer_run, etc.
'''
# compound commands will come in a list so treat everything as a list
if publish_validate:
v_tgt_type = tgt_type
if tgt_type.lower() == 'pillar':
v_tgt_type = 'pillar_exact'
elif tgt_type.lower() == 'compound':
v_tgt_type = 'compound_pillar_exact'
v_minions = set(self.check_minions(tgt, v_tgt_type))
minions = set(self.check_minions(tgt, tgt_type))
mismatch = bool(minions.difference(v_minions))
# If the non-exact match gets more minions than the exact match
# then pillar globbing is being used, and we have a problem
if mismatch:
return False
if not isinstance(funs, list):
funs = [funs]
try: