salt: [BUG] TCP transport broken on 3004.1 and relevant bugfixes

Description Salt Master on TCP transport is broken on newly released version (https://saltproject.io/security_announcements/salt-security-advisory-release/) that mitigates several CVEs, resulting in no jobs being published.

In master logs following stacktrace can be seen:

2022-03-28 20:15:02,912 [tornado.application:640 ][ERROR   ][25004] Exception in callback functools.partial(<function wrap.<locals>.null_wrapper at 0x7f354fda3ea0>, <sal
t.ext.tornado.concurrent.Future object at 0x7f35462c6940>)
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/ioloop.py", line 606, in _run_callback
    ret = callback()
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/stack_context.py", line 278, in null_wrapper
    return fn(*args, **kwargs)
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/ioloop.py", line 628, in _discard_future_result
    future.result()
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/concurrent.py", line 249, in result
    raise_exc_info(self._exc_info)
  File "<string>", line 4, in raise_exc_info
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/gen.py", line 294, in wrapper
    result = func(*args, **kwargs)
  File "/usr/lib64/python3.6/types.py", line 248, in wrapped
    coro = func(*args, **kwargs)
  File "/usr/lib/python3.6/site-packages/salt/transport/tcp.py", line 1565, in publish_payload
    payload = salt.transport.frame.frame_msg(package["payload"])
KeyError: 'payload'

Setup TCP transport on master & minion, 3004.1 master.

Please be as specific as possible and give set-up details.

  • on-prem machine
  • VM (Virtualbox, KVM, etc. please specify)
  • VM running on a cloud service, please be explicit and add details
  • container (Kubernetes, Docker, containerd, etc. please specify)
  • or a combination, please be explicit
  • jails if it is FreeBSD

Steps to Reproduce the behavior Run any job, doesn’t get published and no results can be obtained.

Expected behavior Jobs can actually be published.

Screenshots If applicable, add screenshots to help explain your problem.

Versions Report

salt --versions-report
    Salt Version:
              Salt: 3004.1
     
    Dependency Versions:
              cffi: 1.9.1
          cherrypy: Not Installed
          dateutil: 2.4.2
         docker-py: Not Installed
             gitdb: 0.6.4
         gitpython: 1.0.1
            Jinja2: 2.11.1
           libgit2: Not Installed
          M2Crypto: 0.35.2
              Mako: Not Installed
           msgpack: 0.6.2
      msgpack-pure: Not Installed
      mysql-python: Not Installed
         pycparser: 2.14
          pycrypto: Not Installed
      pycryptodome: Not Installed
            pygit2: Not Installed
            Python: 3.6.8 (default, Aug 13 2020, 07:46:32)
      python-gnupg: Not Installed
            PyYAML: 3.13
             PyZMQ: 17.0.0
             smmap: 0.9.0
           timelib: Not Installed
           Tornado: 4.5.3
               ZMQ: 4.1.4
     
    System Versions:
              dist: rhel 7.9 Maipo
            locale: UTF-8
           machine: x86_64
           release: 3.10.0-1160.53.1.el7.x86_64
            system: Linux
           version: Red Hat Enterprise Linux Server 7.9 Maipo

Additional context https://github.com/saltstack/salt/blob/v3004.1/salt/transport/tcp.py#L1564 should be package = self.pack_publish(package) (package instead of payload) - can be applied as a workaround

About this issue

  • Original URL
  • State: closed
  • Created 2 years ago
  • Comments: 28 (13 by maintainers)

Most upvoted comments

During salt-bootstrap of the latest minion version we are seeing this error, is this traceback related as it comes from the same variable?

2022-03-29 11:54:26,543 [salt.utils.process:244 ][INFO    ][4107] pidfile: /var/run/process_responsibility_salt-minion.pid not found
2022-03-29 11:54:26,703 [salt.cli.daemons :89  ][INFO    ][4107] Starting up the Salt Minion
2022-03-29 11:54:26,704 [salt.utils.event :1125][INFO    ][4107] Starting pull socket on /var/run/salt/minion/minion_event_051400d64e_pull.ipc
2022-03-29 11:54:27,171 [salt.minion      :1292][INFO    ][4107] Creating minion process manager
2022-03-29 11:54:27,286 [salt.crypt       :896 ][INFO    ][4107] Generating keys: /etc/salt/pki/minion
2022-03-29 11:54:27,411 [tornado.application:640 ][ERROR   ][4107] Exception in callback functools.partial(<function wrap.<locals>.null_wrapper at 0x7f947be52a60>, <salt.ext.tornado.concurrent.Future object at 0x7f947a502ba8>)
Traceback (most recent call last):
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/ioloop.py", line 606, in _run_callback
    ret = callback()
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/stack_context.py", line 278, in null_wrapper
    return fn(*args, **kwargs)
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/ioloop.py", line 628, in _discard_future_result
    future.result()
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/concurrent.py", line 249, in result
    raise_exc_info(self._exc_info)
  File "<string>", line 4, in raise_exc_info
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/gen.py", line 1064, in run
    yielded = self.gen.throw(*exc_info)
  File "/usr/lib/python3.6/site-packages/salt/crypt.py", line 654, in _authenticate
    creds = yield self.sign_in(channel=channel)
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/gen.py", line 1056, in run
    value = future.result()
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/concurrent.py", line 249, in result
    raise_exc_info(self._exc_info)
  File "<string>", line 4, in raise_exc_info
  File "/usr/lib/python3.6/site-packages/salt/ext/tornado/gen.py", line 1070, in run
    yielded = self.gen.send(value)
  File "/usr/lib/python3.6/site-packages/salt/crypt.py", line 780, in sign_in
    ret = self.handle_signin_response(sign_in_payload, payload)
  File "/usr/lib/python3.6/site-packages/salt/crypt.py", line 792, in handle_signin_response
    clear_signature = payload["sig"]
KeyError: 'sig'
2022-03-29 11:55:27,222 [salt.minion      :1095][ERROR   ][4107] Minion unable to successfully connect to a Salt Master.```

I am also having the original issue without upgrading the master.

This minion install is fresh using the https://github.com/saltstack/salt-bootstrap#install-on-windows Powershell instructions. Regardless of the user I connect as, whether as service or Administrator on using the salt-minion-debug.bat files, I get the same exception in crypt.py

Salt Version (master):
          Salt: 3003.2
 
Dependency Versions:
          cffi: Not Installed
      cherrypy: unknown
      dateutil: 2.7.3
     docker-py: Not Installed
         gitdb: 2.0.6
     gitpython: 3.0.7
        Jinja2: 3.0.1
       libgit2: 0.28.3
      M2Crypto: Not Installed
          Mako: 1.1.0
       msgpack: 1.0.2
  msgpack-pure: Not Installed
  mysql-python: 1.4.4
     pycparser: Not Installed
      pycrypto: Not Installed
  pycryptodome: 3.10.1
        pygit2: 1.0.3
        Python: 3.8.10 (default, Jun  2 2021, 10:49:15)
  python-gnupg: 0.4.5
        PyYAML: 5.4.1
         PyZMQ: 22.2.1
         smmap: 2.0.5
       timelib: 0.2.4
       Tornado: 4.5.3
           ZMQ: 4.3.4
 
System Versions:
          dist: ubuntu 20.04 focal
        locale: utf-8
       machine: x86_64
       release: 4.15.0-153-generic
        system: Linux
       version: Ubuntu 20.04 focal
Salt Version (minion):
          Salt: 3003.4

Dependency Versions:
          cffi: 1.14.5
      cherrypy: 18.6.0
      dateutil: 2.8.1
     docker-py: Not Installed
         gitdb: 4.0.5
     gitpython: Not Installed
        Jinja2: 2.11.3
       libgit2: Not Installed
      M2Crypto: Not Installed
          Mako: 1.1.4
       msgpack: 1.0.2
  msgpack-pure: Not Installed
  mysql-python: Not Installed
     pycparser: 2.20
      pycrypto: Not Installed
  pycryptodome: 3.9.8
        pygit2: Not Installed
        Python: 3.7.4 (tags/v3.7.4:e09359112e, Jul  8 2019, 20:34:20) [MSC v.1916 64 bit (AMD64)]
  python-gnupg: 0.4.6
        PyYAML: 5.4.1
         PyZMQ: 18.0.1
         smmap: 3.0.4
       timelib: 0.2.4
       Tornado: 4.5.3
           ZMQ: 4.3.1

System Versions:
          dist:
        locale: cp1252
       machine: AMD64
       release: 10
        system: Windows
       version: 10 10.0.19041 SP0
2022-04-15 17:42:38,693 [tornado.application:640 ][ERROR   ][1424] Exception in callback functools.partial(<function wrap.<locals>.null_wrapper at 0x000002582040D318>, <salt.ext.tornado.concurrent.Future object at 0x0000025820C0A108>)
Traceback (most recent call last):
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\ext\tornado\ioloop.py", line 606, in _run_callback
    ret = callback()
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\ext\tornado\stack_context.py", line 278, in null_wrapper
    return fn(*args, **kwargs)
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\ext\tornado\ioloop.py", line 628, in _discard_future_result
    future.result()
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\ext\tornado\concurrent.py", line 249, in result
    raise_exc_info(self._exc_info)
  File "<string>", line 4, in raise_exc_info
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\ext\tornado\gen.py", line 1064, in run
    yielded = self.gen.throw(*exc_info)
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\crypt.py", line 648, in _authenticate
    creds = yield self.sign_in(channel=channel)
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\ext\tornado\gen.py", line 1056, in run
    value = future.result()
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\ext\tornado\concurrent.py", line 249, in result
    raise_exc_info(self._exc_info)
  File "<string>", line 4, in raise_exc_info
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\ext\tornado\gen.py", line 1070, in run
    yielded = self.gen.send(value)
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\crypt.py", line 773, in sign_in
    ret = self.handle_signin_response(sign_in_payload, payload)
  File "c:\salt\bin\lib\site-packages\salt-3003.4-py3.7.egg\salt\crypt.py", line 785, in handle_signin_response
    clear_signature = payload["sig"]
KeyError: 'sig'

Your error is not the one in this issue. Your issue is you are trying to run a CVE-fixed minion against a Non CVE-fixed master.

Upgrade your master.

nm. found the problem. After the upgrade my minion configuration was erased. Updated the minion file and restarted. the minion is back online now.

I am having the same issue. I have upgraded the master to node to latest. but still ‘sig’ is not part of master response.

This is the response from master. {'load': {'ret': True}, 'enc': 'clear'}

My minions with older version continue to work fine but i am unable to register any new minions.

@lukasraska I’ve confirmed this is an issue and your suggestion seems to resolve it.

From 21166b20f01ab9b49d4c43c6a19aa21ecba1d72a Mon Sep 17 00:00:00 2001
From: "Daniel A. Wozniak" <dwozniak@saltstack.com>
Date: Mon, 28 Mar 2022 14:11:50 -0700
Subject: [PATCH] Tcp transport bugfix

---
 salt/transport/tcp.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/transport/tcp.py b/salt/transport/tcp.py
index f00b3c40eb..2c4844a2a6 100644
--- a/salt/transport/tcp.py
+++ b/salt/transport/tcp.py
@@ -1562,7 +1562,7 @@ class PubServer(salt.ext.tornado.tcpserver.TCPServer):
     def publish_payload(self, package, _):
         log.debug("TCP PubServer sending payload: %s", package)
         payload = self.pack_publish(package)
-        payload = salt.transport.frame.frame_msg(package["payload"])
+        payload = salt.transport.frame.frame_msg(payload["payload"])
 
         to_remove = []
         if "topic_lst" in package:
-- 
2.30.2