ByteInternet · vdloo · Sep 28, 2021 · Sep 28, 2021 · Sep 29, 2021 · Oct 5, 2021
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,7 +7,20 @@ Versions are `MAJOR.PATCH`.
 
 # Changelog
 
-Salt 3004 (2021-09-27)
+Salt 3004.1 (2022-02-16)
+========================
+
+Security
+--------
+
+- Sign authentication replies to prevent MiTM (cve-2022-22935)
+- Prevent job and fileserver replays (cve-2022-22936)
+- Sign pillar data to prevent MiTM attacks. (cve-2202-22934)
+- Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941) (#60413)
+- Fix denial of service in junos ifconfig output parsing.
+
+
+Salt 3004 (2021-10-11)
 ======================
 
 Removed
@@ -23,6 +36,7 @@ Removed
 Deprecated
 ----------
 
+- The _ext_nodes alias to the master_tops function was added back in 3004 to maintain backwards compatibility with older supported versions. This alias will now be removed in 3006. This change will break Master and Minion communication compatibility with Salt minions running versions 3003 and lower. (#60980)
 - utils/boto3_elasticsearch is no longer needed (#59882)
 - Changed "manufacture" grain to "manufacturer" for Solaris on SPARC to unify the name across all platforms. The old "manufacture" grain is now deprecated and will be removed in Sulfur (#60511)
 - Deprecate `salt.payload.Serial` (#60953)
@@ -41,6 +55,14 @@ Changed
 Fixed
 -----
 
+- Set default 'bootstrap_delay' to 0 (#61005)
+- Fixed issue where multiple args to netapi were not preserved (#59182)
+- Handle all repo formats in the aptpkg module. (#60971)
+- Do not break master_tops for minion with version lower to 3003
+  This is going to be removed in Salt 3006 (Sulfur) (#60980)
+- Reverting changes in PR #60150. Updating installed and removed functions to return changes when test=True. (#60995)
+- Handle signals and properly exit, instead of raising exceptions. (#60391, #60963)
+- Redirect imports of ``salt.ext.six`` to ``six`` (#60966)
 - Surface strerror to user state instead of returning false (#20789)
 - Fixing _get_envs() to preserve the order of pillar_roots. _get_envs() returned pillar_roots in a non-deterministic order. (#24501)
 - Fixes salt-cloud `KeyError` that occurs when there exists any subnets with no tags when profiles use `subnetname` (#44330)
@@ -303,16 +325,16 @@ Fixed
   valid if Powershell 7 is installed on the system. (#58598)
 - Fixed the zabbix.host_create call on zabbix_host.present to include the
   optional parameter visible_name. Now working as documented. (#58602)
-- Fixed some bugs to allow zabbix_host.present to update a host already 
+- Fixed some bugs to allow zabbix_host.present to update a host already
   existent on Zabbix server:
 
   - Added checks before "pop" the elements "bulk" and "details" from
     hostinterfaces_get's response. Without that, the interface comparison
     didn't works with Zabbix >= 5.0
   - Fixed the "inventory" comparison. It failed when both current and new
     inventory were missing.
-  - Rewrite of the update_interfaces routine to really "update" the 
-    interfaces and not trying to delete and recreate all interfaces, 
+  - Rewrite of the update_interfaces routine to really "update" the
+    interfaces and not trying to delete and recreate all interfaces,
     which almost always gives errors as interfaces with linked items
     can't be deleted. (#58603)
 - Added the "details" mandatory object with the properly default values

diff --git a/Gemfile b/Gemfile
@@ -8,7 +8,7 @@ gem 'kitchen-sync'
 gem 'git'
 
 group :docker do
-  gem 'kitchen-docker', :git => 'https://github.com/test-kitchen/kitchen-docker.git'
+  gem 'kitchen-docker', :git => 'https://github.com/test-kitchen/kitchen-docker.git', :branch => 'main'
 end
 
 group :windows do

diff --git a/doc/man/salt-api.1 b/doc/man/salt-api.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-API" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-API" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-api \- salt-api Command
 .

diff --git a/doc/man/salt-call.1 b/doc/man/salt-call.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-CALL" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-CALL" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-call \- salt-call Documentation
 .

diff --git a/doc/man/salt-cloud.1 b/doc/man/salt-cloud.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-CLOUD" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-CLOUD" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-cloud \- Salt Cloud Command
 .

diff --git a/doc/man/salt-cp.1 b/doc/man/salt-cp.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-CP" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-CP" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-cp \- salt-cp Documentation
 .

diff --git a/doc/man/salt-key.1 b/doc/man/salt-key.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-KEY" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-KEY" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-key \- salt-key Documentation
 .

diff --git a/doc/man/salt-master.1 b/doc/man/salt-master.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-MASTER" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-MASTER" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-master \- salt-master Documentation
 .

diff --git a/doc/man/salt-minion.1 b/doc/man/salt-minion.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-MINION" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-MINION" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-minion \- salt-minion Documentation
 .

diff --git a/doc/man/salt-proxy.1 b/doc/man/salt-proxy.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-PROXY" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-PROXY" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-proxy \- salt-proxy Documentation
 .

diff --git a/doc/man/salt-run.1 b/doc/man/salt-run.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-RUN" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-RUN" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-run \- salt-run Documentation
 .

diff --git a/doc/man/salt-ssh.1 b/doc/man/salt-ssh.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-SSH" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-SSH" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-ssh \- salt-ssh Documentation
 .

diff --git a/doc/man/salt-syndic.1 b/doc/man/salt-syndic.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-SYNDIC" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-SYNDIC" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-syndic \- salt-syndic Documentation
 .

diff --git a/doc/man/salt-unity.1 b/doc/man/salt-unity.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT-UNITY" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT-UNITY" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt-unity \- salt-unity Command
 .

diff --git a/doc/man/salt.1 b/doc/man/salt.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt \- salt
 .

diff --git a/doc/man/salt.7 b/doc/man/salt.7
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SALT" "7" "Sep 27, 2021" "3004" "Salt"
+.TH "SALT" "7" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 salt \- Salt Documentation
 .
@@ -193862,7 +193862,7 @@ Passes through all the parameters described in the
 \fI\%utils.http.query function\fP:
 .INDENT 7.0
 .TP
-.B salt.utils.http.query(url, method=\(aqGET\(aq, params=None, data=None, data_file=None, header_dict=None, header_list=None, header_file=None, username=None, password=None, auth=None, decode=False, decode_type=\(aqauto\(aq, status=False, headers=False, text=False, cookies=None, cookie_jar=None, cookie_format=\(aqlwp\(aq, persist_session=False, session_cookie_jar=None, data_render=False, data_renderer=None, header_render=False, header_renderer=None, template_dict=None, test=False, test_url=None, node=\(aqminion\(aq, port=80, opts=None, backend=None, ca_bundle=None, verify_ssl=None, cert=None, text_out=None, headers_out=None, decode_out=None, stream=False, streaming_callback=None, header_callback=None, handle=False, agent=\(aqSalt/3004rc0+315.g248e4e042c\(aq, hide_fields=None, raise_error=True, formdata=False, formdata_fieldname=None, formdata_filename=None, decode_body=True, **kwargs)
+.B salt.utils.http.query(url, method=\(aqGET\(aq, params=None, data=None, data_file=None, header_dict=None, header_list=None, header_file=None, username=None, password=None, auth=None, decode=False, decode_type=\(aqauto\(aq, status=False, headers=False, text=False, cookies=None, cookie_jar=None, cookie_format=\(aqlwp\(aq, persist_session=False, session_cookie_jar=None, data_render=False, data_renderer=None, header_render=False, header_renderer=None, template_dict=None, test=False, test_url=None, node=\(aqminion\(aq, port=80, opts=None, backend=None, ca_bundle=None, verify_ssl=None, cert=None, text_out=None, headers_out=None, decode_out=None, stream=False, streaming_callback=None, header_callback=None, handle=False, agent=\(aqSalt/3004.1(aq, hide_fields=None, raise_error=True, formdata=False, formdata_fieldname=None, formdata_filename=None, decode_body=True, **kwargs)
 Query a resource, and decode the return data
 .UNINDENT
 .INDENT 7.0

diff --git a/doc/man/spm.1 b/doc/man/spm.1
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SPM" "1" "Sep 27, 2021" "3004" "Salt"
+.TH "SPM" "1" "Feb 16, 2022" "3004.1" "Salt"
 .SH NAME
 spm \- Salt Package Manager Command
 .

diff --git a/doc/topics/releases/3004.1.rst b/doc/topics/releases/3004.1.rst
@@ -0,0 +1,33 @@
+.. _release-3004-1:
+
+=========================
+Salt 3004.1 Release Notes
+=========================
+
+Version 3004.1 is a CVE security fix release for :ref:`3004 <release-3004>`.
+
+Important notice about upgrading
+--------------------------------
+
+Version 3004.1 is a security release. 3004.1 minions are not able to
+communicate with masters older than 3004.1. You must upgrade your masters
+before upgrading minions.
+
+Minion authentication security
+------------------------------
+
+Authentication between masters and minions rely on public/private key
+encryption and message signing. To secure minion authentication before you must
+pre-seed the master's public key on minions. To pre-seed the minions' master
+key, place a copy of the master's public key in the minion's pki directory as
+``minion_master.pub``.
+
+
+Security
+--------
+
+- Sign authentication replies to prevent MiTM (cve-2022-22935)
+- Prevent job and fileserver replays (cve-2022-22936)
+- Sign pillar data to prevent MiTM attacks. (cve-2202-22934)
+- Fixed targeting bug, especially visible when using syndic and user auth. (CVE-2022-22941) (#60413)
+- Fix denial of service in junos ifconfig output parsing.
diff --git a/doc/topics/releases/3004.rst b/doc/topics/releases/3004.rst
@@ -55,6 +55,7 @@ Removed
 Deprecated
 ==========
 
+- The _ext_nodes alias to the master_tops function was added back in 3004 to maintain backwards compatibility with older supported versions. This alias will now be removed in 3006. This change will break Master and Minion communication compatibility with Salt minions running versions 3003 and lower. (#60980)
 - utils/boto3_elasticsearch is no longer needed (#59882)
 - Changed "manufacture" grain to "manufacturer" for Solaris on SPARC to unify the name across all platforms. The old "manufacture" grain is now deprecated and will be removed in Sulfur (#60511)
 - Deprecate ``salt.payload.Serial`` (#60953)
@@ -73,6 +74,14 @@ Changed
 Fixed
 =====
 
+- Set default 'bootstrap_delay' to 0 (#61005)
+- Fixed issue where multiple args to netapi were not preserved (#59182)
+- Handle all repo formats in the aptpkg module. (#60971)
+- Do not break master_tops for minion with version lower to 3003
+  This is going to be removed in Salt 3006 (Sulfur) (#60980)
+- Reverting changes in PR #60150. Updating installed and removed functions to return changes when test=True. (#60995)
+- Handle signals and properly exit, instead of raising exceptions. (#60391, #60963)
+- Redirect imports of ``salt.ext.six`` to ``six`` (#60966)
 - Surface strerror to user state instead of returning false (#20789)
 - Fixing _get_envs() to preserve the order of pillar_roots. _get_envs() returned pillar_roots in a non-deterministic order. (#24501)
 - Fixes salt-cloud ``KeyError`` that occurs when there exists any subnets with no tags when profiles use ``subnetname`` (#44330)

diff --git a/salt/__init__.py b/salt/__init__.py
@@ -36,8 +36,20 @@ def load_module(self, name):
         return mod
 
 
+class SixRedirectImporter:
+    def find_module(self, module_name, package_path=None):
+        if module_name.startswith("salt.ext.six"):
+            return self
+        return None
+
+    def load_module(self, name):
+        mod = importlib.import_module(name[9:])
+        sys.modules[name] = mod
+        return mod
+
+
 # Try our importer first
-sys.meta_path = [TornadoImporter()] + sys.meta_path
+sys.meta_path = [TornadoImporter(), SixRedirectImporter()] + sys.meta_path
 
 
 # All salt related deprecation warnings should be shown once each!

diff --git a/salt/cli/api.py b/salt/cli/api.py
@@ -77,10 +77,7 @@ def shutdown(self, exitcode=0, exitmsg=None):
             exitmsg = msg.strip()
         super().shutdown(exitcode, exitmsg)
 
-    def _handle_signals(self, signum, sigframe):  # pylint: disable=unused-argument
+    def _handle_signals(self, signum, sigframe):
         # escalate signal to the process manager processes
-        self.api.process_manager.stop_restarting()
-        self.api.process_manager.send_signal_to_processes(signum)
-        # kill any remaining processes
-        self.api.process_manager.kill_children()
+        self.api.process_manager._handle_signals(signum, sigframe)
         super()._handle_signals(signum, sigframe)
diff --git a/salt/cli/daemons.py b/salt/cli/daemons.py
@@ -126,13 +126,10 @@ class Master(
     Creates a master server
     """
 
-    def _handle_signals(self, signum, sigframe):  # pylint: disable=unused-argument
+    def _handle_signals(self, signum, sigframe):
         if hasattr(self.master, "process_manager"):
             # escalate signal to the process manager processes
-            self.master.process_manager.stop_restarting()
-            self.master.process_manager.send_signal_to_processes(signum)
-            # kill any remaining processes
-            self.master.process_manager.kill_children()
+            self.master.process_manager._handle_signals(signum, sigframe)
         super()._handle_signals(signum, sigframe)
 
     def prepare(self):

diff --git a/salt/client/netapi.py b/salt/client/netapi.py
@@ -71,9 +71,6 @@ def run(self):
 
         self.process_manager.run()
 
-    def _handle_signals(self, signum, sigframe):  # pylint: disable=unused-argument
+    def _handle_signals(self, signum, sigframe):
         # escalate the signals to the process manager
-        self.process_manager.stop_restarting()
-        self.process_manager.send_signal_to_processes(signum)
-        # kill any remaining processes
-        self.process_manager.kill_children()
+        self.process_manager._handle_signals(signum, sigframe)
diff --git a/salt/client/ssh/__init__.py b/salt/client/ssh/__init__.py
@@ -1133,6 +1133,7 @@ def run_wfunc(self):
             opts_pkg["_ssh_version"] = self.opts["_ssh_version"]
             opts_pkg["thin_dir"] = self.opts["thin_dir"]
             opts_pkg["master_tops"] = self.opts["master_tops"]
+            opts_pkg["extra_filerefs"] = self.opts.get("extra_filerefs", "")
             opts_pkg["__master_opts__"] = self.context["master_opts"]
             if "known_hosts_file" in self.opts:
                 opts_pkg["known_hosts_file"] = self.opts["known_hosts_file"]

diff --git a/salt/cloud/clouds/openstack.py b/salt/cloud/clouds/openstack.py
@@ -444,11 +444,9 @@ def _get_ips(node, addr_type="public"):
                 "OS-EXT-IPS:type"
             ):
                 ret.append(addr["addr"])
-            elif addr_type == "public" and __utils__["cloud.is_public_ip"](
-                addr["addr"]
-            ):
+            elif addr_type == "public" and salt.utils.cloud.is_public_ip(addr["addr"]):
                 ret.append(addr["addr"])
-            elif addr_type == "private" and not __utils__["cloud.is_public_ip"](
+            elif addr_type == "private" and not salt.utils.cloud.is_public_ip(
                 addr["addr"]
             ):
                 ret.append(addr["addr"])

diff --git a/salt/config/__init__.py b/salt/config/__init__.py
@@ -1662,7 +1662,7 @@ def _gather_buffer_space():
         "log_granular_levels": {},
         "log_rotate_max_bytes": 0,
         "log_rotate_backup_count": 0,
-        "bootstrap_delay": None,
+        "bootstrap_delay": 0,
         "cache": "localfs",
     }
 )