address review from @dwoz

mattp- · dwoz · commit 31cfa53b51c2 · 2025-06-10T17:49:58.000-07:00
diff --git a/salt/cache/localfs_key.py b/salt/cache/localfs_key.py
@@ -3,7 +3,7 @@
 
 .. versionadded:: 3008.0
 
-The ``localfs_keys_backcompat`` is a shim driver meant to allow the salt.cache
+The ``localfs_key`` is a shim driver meant to allow the salt.cache
 subsystem to interact with the existing master pki folder/file structure
 without any migration from previous versions of salt.  It is not meant for
 general purpose use and should not be used outside of the master auth system.
@@ -123,7 +123,7 @@ def store(bank, key, data, cachedir, user, **kwargs):
     savefn = Path(cachedir) / base / key
     base = savefn.parent
 
-    if not clean_path(cachedir, savefn, subdir=True):
+    if not clean_path(cachedir, str(savefn), subdir=True):
         raise SaltCacheError(f"key {key} is not a valid key path.")
 
     try:
@@ -191,6 +191,9 @@ def fetch(bank, key, cachedir, **kwargs):
             ]:
                 keyfile = Path(cachedir, bank, key)
 
+                if not clean_path(cachedir, str(keyfile), subdir=True):
+                    raise SaltCacheError(f"key {key} is not a valid key path.")
+
                 if keyfile.is_file() and not keyfile.is_symlink():
                     with salt.utils.files.fopen(keyfile, "r") as fh_:
                         return {"state": state, "pub": fh_.read()}
@@ -200,6 +203,9 @@ def fetch(bank, key, cachedir, **kwargs):
             # with the filesystem, so return a list of 1
             pubfn_denied = os.path.join(cachedir, "minions_denied", key)
 
+            if not clean_path(cachedir, pubfn_denied, subdir=True):
+                raise SaltCacheError(f"key {key} is not a valid key path.")
+
             if os.path.isfile(pubfn_denied):
                 with salt.utils.files.fopen(pubfn_denied, "r") as fh_:
                     return [fh_.read()]
@@ -209,6 +215,9 @@ def fetch(bank, key, cachedir, **kwargs):
 
             keyfile = Path(cachedir, key)
 
+            if not clean_path(cachedir, str(keyfile), subdir=True):
+                raise SaltCacheError(f"key {key} is not a valid key path.")
+
             if keyfile.is_file() and not keyfile.is_symlink():
                 with salt.utils.files.fopen(keyfile, "r") as fh_:
                     return fh_.read()
@@ -243,7 +252,7 @@ def updated(bank, key, cachedir, **kwargs):
     for dir in bases:
         keyfile = Path(cachedir, dir, key)
 
-        if not clean_path(cachedir, keyfile, subdir=True):
+        if not clean_path(cachedir, str(keyfile), subdir=True):
             raise SaltCacheError(f"key {key} is not a valid key path.")
 
         if keyfile.is_file() and not keyfile.is_symlink():
@@ -336,10 +345,13 @@ def list_(bank, cachedir, **kwargs):
             )
         for item in items:
             # salt foolishly dumps a file here for key cache, ignore it
-            if bank in ["keys", "denied_keys"] and not valid_id(__opts__, item):
+            keyfile = Path(cachedir, base, item)
+
+            if (
+                bank in ["keys", "denied_keys"] and not valid_id(__opts__, item)
+            ) or not clean_path(cachedir, str(keyfile), subdir=True):
                 log.error("saw invalid id %s, discarding", item)
 
-            keyfile = Path(cachedir, base, item)
             if keyfile.is_file() and not keyfile.is_symlink():
                 ret.append(item)
     return ret
@@ -366,7 +378,7 @@ def contains(bank, key, cachedir, **kwargs):
     for base in bases:
         keyfile = Path(cachedir, base, key)
 
-        if not clean_path(cachedir, keyfile, subdir=True):
+        if not clean_path(cachedir, str(keyfile), subdir=True):
             raise SaltCacheError(f"key {key} is not a valid key path.")
 
         if keyfile.is_file() and not keyfile.is_symlink():
diff --git a/salt/crypt.py b/salt/crypt.py
@@ -230,7 +230,7 @@ def parse_hash(algorithm):
 class PrivateKey(BaseKey):
 
     def __init__(self, key_bytes, passphrase=None):
-        log.debug("salt.crypt.get_rsa_key: Loading private key")
+        log.debug("Loading private key")
         if passphrase:
             password = passphrase.encode()
         else:
@@ -279,7 +279,7 @@ def public_key(self):
 
 class PublicKey(BaseKey):
     def __init__(self, key_bytes):
-        log.debug("salt.crypt.get_rsa_pub_key: Loading public key")
+        log.debug("Loading public key")
         try:
             self.key = serialization.load_pem_public_key(key_bytes)
         except ValueError:
@@ -349,13 +349,13 @@ def sign_message(privkey_path, message, passphrase=None, algorithm=PKCS1v15_SHA1
     return PrivateKey.from_file(privkey_path, passphrase).sign(message, algorithm)
 
 
-def verify_signature(key, message, signature, algorithm=PKCS1v15_SHA1):
+def verify_signature(pubkey_path, message, signature, algorithm=PKCS1v15_SHA1):
     """
     Use Crypto.Signature.PKCS1_v1_5 to verify the signature on a message.
     Returns True for valid signature.
     """
-    log.debug("salt.crypt.verify_signature: Loading public key")
-    return PublicKey.from_file(key).verify(message, signature, algorithm)
+    log.debug("Loading public key")
+    return PublicKey.from_file(pubkey_path).verify(message, signature, algorithm)
 
 
 def pwdata_decrypt(rsa_key, pwdata):
diff --git a/salt/master.py b/salt/master.py
@@ -1874,10 +1874,15 @@ def _return(self, load):
             sig = load.pop("sig")
             this_minion_pubkey = self.key_cache.fetch("keys", load["id"])
             serialized_load = salt.serializers.msgpack.serialize(load)
-            if not salt.crypt.verify_signature(
-                this_minion_pubkey, serialized_load, sig
+            if not this_minion_pubkey or not this_minion_pubkey.verify(
+                serialized_load, sig
             ):
-                log.info("Failed to verify event signature from minion %s.", load["id"])
+                if not this_minion_pubkey:
+                    log.error("Failed to fetch pub key for minion %s.", load["id"])
+                else:
+                    log.info(
+                        "Failed to verify event signature from minion %s.", load["id"]
+                    )
                 if self.opts["drop_messages_signature_fail"]:
                     log.critical(
                         "drop_messages_signature_fail is enabled, dropping "
diff --git a/salt/wheel/key.py b/salt/wheel/key.py
@@ -33,10 +33,10 @@
 import salt.crypt
 import salt.key
 import salt.utils.crypt
-import salt.utils.files
+import salt.utils.versions
 from salt.utils.sanitizers import clean
 
-__func_alias__ = {"list_": "list", "key_str": "print", "name_match": "glob_match"}
+__func_alias__ = {"list_": "list", "key_str": "print"}
 
 log = logging.getLogger(__name__)
 
@@ -77,6 +77,18 @@ def list_all():
         return skey.all_keys()
 
 
+def name_match(match):
+    """
+    Alias to glob_match
+    """
+    salt.utils.versions.warn_until(
+        3010,
+        "'wheel.key.name_match' has been renamed to 'wheel.key.glob_match', and will be removed in the Calcium release."
+        "Please update your workflows to use glob_match instead.",
+    )
+    return glob_match(match)
+
+
 def glob_match(match):
     """
     List all the keys based on a glob match
