Method loads

salt/crypt.py:2136–2206

Conditionally decrypt and un-serialize a python object. Detects whether the data was encrypted with AES or sent via TLS-only. Args: data: Data to decrypt and deserialize raw: Whether to return raw deserialized data nonce: Optional nonce

(self, data, raw=False, nonce=None, peer_cert=None, claimed_id=None)

            return super().dumps(obj, nonce=nonce)

    def loads(self, data, raw=False, nonce=None, peer_cert=None, claimed_id=None):
        """
        Conditionally decrypt and un-serialize a python object.

        Detects whether the data was encrypted with AES or sent via TLS-only.

        Args:
            data: Data to decrypt and deserialize
            raw: Whether to return raw deserialized data
            nonce: Optional nonce for verification
            peer_cert: Peer's SSL certificate (DER format bytes)
            claimed_id: The minion ID claimed in the message

        Returns:
            Deserialized python object
        """
        import salt.transport.tls_util

        # Check if data has TLS marker (was sent without AES)
        if data.startswith(self.TLS_MARKER):
            # Verify TLS optimization is valid for this connection
            if not salt.transport.tls_util.can_skip_aes_encryption(
                self.opts, peer_cert=peer_cert, claimed_id=claimed_id
            ):
                log.warning(
                    "Received TLS-optimized message but TLS requirements not met. Rejecting."
                )
                return {}

            log.debug("TLS optimization: skipping AES decryption for %s", claimed_id)
            # Remove TLS marker
            data = data[len(self.TLS_MARKER) :]

            # Verify integrity marker
            if not data.startswith(self.PICKLE_PAD):
                return {}
            data = data[len(self.PICKLE_PAD) :]

            # Handle nonce if present
            if nonce:
                ret_nonce = data[:32].decode()
                data = data[32:]
                if ret_nonce != nonce:
                    from salt.exceptions import SaltClientError

                    raise SaltClientError(
                        f"Nonce verification error {ret_nonce} {nonce}"
                    )

            # Deserialize payload
            payload = salt.payload.loads(data, raw=raw)

            # Handle serial number check
            if isinstance(payload, dict):
                if "serial" in payload:
                    serial = payload.pop("serial")
                    if serial <= self.serial:
                        log.critical(